Browse by Tags

All Tags » Security   (RSS)
Distribution List is more locked down in Exchange 2007 to reduce spam
Distribution list is used for grouping users together, and emails can be sent to all members belonging to a DL. In Exchange 2003, the default setting is that a DL accepts emails from any email addresses. It can be configured to reject external email addresses Read More...
Posted 30 April 07 06:30 by esiu | 1 Comments   
Filed under ,
Is anonymous read-only site immune to XSS?
Most folks know that cross-site scripting (XSS) bugs can be used to steal logon cookies, as this scenario is touted pretty often as a classic XSS exploit. How about an read-only site without requiring any logons, such as dictionary sites or some news Read More...
Posted 22 February 07 02:16 by esiu | 0 Comments   
Filed under
I am excited about EV Cert
I like the idea behind Extended Validation Cert a lot. It is designed to combat phishing problems. There are some well-known phishing victim sites, such as Paypal, Bank of America, EBay, etc, that would love this feature. Check out how IE7 green address Read More...
Posted 09 February 07 03:02 by esiu | 1 Comments   
Filed under
Why do browsers show cert warnings for Outlook Web Access 2007 by default?
You may wonder why OWA 2007 show cert warnings by default on most browsers. At the back of your mind, Microsoft has talked so much about trustworthy computing, and they must still do not get security. Exchange team has gone back and forth on this issue Read More...
Posted 03 February 07 05:51 by esiu | 0 Comments   
Filed under ,
Don't believe that anti-spam is disabled
After setting up Exchange 2007 Edge and Hub, you can verify their configuration via get-TransportServer. On Edge and Hub, two anti-spam settings are important. You can use "get-TransportServer | fl name, anti*" to show the status of anti-spam related Read More...
Posted 16 January 07 02:51 by esiu | 0 Comments   
Filed under ,
About NTLM/Kerberos and Constrained Delegation in W2k3
I find some well-written documentation on NTLM/Kerberos and Constrained Delegation in W2k3 to share with my colleagues. They are useful as introduction and reference materials. NTLM http://davenport.sourceforge.net/ntlm.html Kerberos http://www.microsoft.com/msj/0899/kerberos/kerberos.aspx Read More...
Posted 09 March 05 05:04 by esiu | 0 Comments   
Filed under
About LDAP injection
The concept of LDAP injection is similar to SQL injection, except that the target is Active Directory or any LDAP server. The idea is to inject untrusted data into a LDAP query by malicious users. Here comes a paper to explain that. http://www.spidynamics.com/support/whitepapers/LDAPinjection.pd Read More...
Posted 09 March 05 04:38 by esiu | 1 Comments   
Filed under
More Posts « Previous page

Search

This Blog

ACE Team

Syndication

Page view tracker