January 2006 - Posts

New Internet Explorer 7 Beta 2 Preview available
31 January 06 10:38 AM

I've been using the current builds for ages now, here's my top reasons for using IE7 (beyond pure security and engineering): Printing is better (there was this really nasty habit of truncating on the right margin) Support for RSS and OPML in the browser. Read More...

Postedby michael_HOWARD | 2 Comments    

Filed under: Security

Protecting against Pointer Subterfuge (Kinda!)
30 January 06 10:10 PM

When exploiting a buffer overrun vulnerability, the goal of an attacker is usually to change the flow of execution from the normal execution flow to a flow dictated by the attacker. Sure, he may want to whack a DWORD in memory or change a variable, but Read More...

Postedby michael_HOWARD | 10 Comments    

Filed under: Security

How long will that crypto key be useful?
27 January 06 10:13 AM

One of the crypto guys here pointed this out to me last night, it's kinda cool. A small web-app to determine how long a key should be to provide adequate protection up to a specified year. There are a few other options in there too... http://www.keylength.com Read More...

Postedby michael_HOWARD | 1 Comments    

Filed under: Security

Blue Hat 2005 - Security Researchers come to Microsoft
26 January 06 01:22 PM

From http://channel9.msdn.com/Showpost.aspx?postid=157668 "This Fall, Microsoft hosted the second annual Blue Hat conference on Campus. The audience was primarily Microsoft employees who write code, as well as executives from around the company. Security Read More...

Postedby michael_HOWARD | 0 Comments    

Filed under: Security

Code Scanning Tools Do Not Make Software Secure
26 January 06 11:14 AM

There has been a lot of press recently about using ‘code scanning’ tools to find security bugs in source code. So I thought I’d share my view on code scanning tools. Such tools, often called static analysis tools, such as the tools we have included in Read More...

Postedby michael_HOWARD | 15 Comments    

Filed under: Security

CERTs Virtual Training Environment
25 January 06 01:33 PM

CERT has released a Web-based library for information assurance, forensics and incident response. I've poked around, it looks pretty good. http://vte.cert.org/ Read More...

Postedby michael_HOWARD | 1 Comments    

Filed under: Security

Russinovich and the WMF Flaw (MS06-001)
20 January 06 11:50 PM

I'm not 100% sure why no-one seems to have picked up on this, Russinovich decided to do his own analysis of the WMF flaw to see if Gibson's belief that WMF/SetAbortProc() is an intentional backdoor. Of course, it's not! Here's Mark's analysis: http://www.sysinternals.com/blog/ Read More...

Postedby michael_HOWARD | 6 Comments    

Filed under: Security

strlen_s, where for art thou?
17 January 06 01:50 PM

I just received an email from a product group wanting to replace a small number of calls to strlen with strlen_s to help them be SDL compliant. Problem is, there is no strlen_s ! :( So I had a chat with Martyn Lovell, who headed the SafeCRT work to find Read More...

Postedby michael_HOWARD | 2 Comments    

Filed under: Security

You heard it here first!
13 January 06 07:58 AM

You heard it here first, if you use MmSecureVirtualMemory, you should be aware that there are some potential reliability issues. By the way, 'secure' is a verb in this case, not a noun. If you run PRE f ast on code using this function and it's not in Read More...

Postedby michael_HOWARD | 1 Comments    

Filed under: Security

Windows QuickTime users - APPLY THE PATCH!!
12 January 06 11:32 AM

Apple has released a patch for Quicktime that fixes a bucket-load of image parsing bugs. If you're a Windows user, you should apply th patch ASAP. The clock is ticking. http://www.us-cert.gov/cas/techalerts/TA06-011A.html Read More...

Postedby michael_HOWARD | 7 Comments    

Filed under: Security