Want to win a PDC Ticket?


c9meetsMCPMan[1]Caption this … the C9 guy meets, errr, MCP man (really? MCP man? What on earth?)

Anyway all you have to do is go to http://www.nxtgenug.net/NewsArticle.aspx?ArticleID=347 and tell us what is MCP Man saying to Channel 9 Guy?  The best/funniest caption wins as decided by the panel of judges (NxtGenUG Co-Founders) and a special Mystery Judge from Microsoft!

Normal rules apply, you can’t claim an equivalent cash prize, the judge’s decision is final blah, blah, blah ... it’s all on the competition page.

Technorati Tags:

author: Barry Dorrans | posted @ Saturday, October 10, 2009 11:45 PM | Feedback (0)

I’m not as annoying as I think …


“Congratulations! We are pleased to present you with the 2009 Microsoft® MVP Award!”

Oh and congratulations to two newbies I know - Alex Mackey who is a new an MVP (Mordor Versed Professional) and Sara Chipps who is also a new MVP (Most Valuable PrettyThing)

(And of course to everyone else who was renewed or has a shiny new MVP-ness)

author: Barry Dorrans | posted @ Thursday, October 01, 2009 3:16 PM | Feedback (2)

Congratulations – you’re at university, now protect yourself


Now you’re at university it’s time to protect yourself. No, this is not that cringeworthy conversation you had with your parents about where babies come from but some notes on data security.

First up your laptop. That network in the halls of residence? It’s going to contain at least one budding hacker, so make sure you run anti-virus software (that includes you Mac users, there’s malware out there specifically targeting Macs), use a firewall (either the one built into your OS or a third party one) and keep your anti-virus and operating system up to date (that includes you Mac users – Apple are notorious for not releasing security patches in a timely manner, so wipe that smug grin off your face and for heavens sake find some jeans that fit properly and use less product in your hair). Oh and back-up, a laptop crash will not be an accepted excuse for not submitting your papers.

A hacked facebook account Your laptop should be password protected. The account you get on a university system will also be password protected. Then there’s your facebook account, your twitter account, your email account, your internet banking, all password protected. This presents a problem for the absent minded, or those whose brains are addled by fresher’s week and the abundance of cheap beer – it’s all too tempting to use a common password for everything. Passwords are like condoms, they shouldn’t be re-used. A couple of months back a Christian dating web site was hacked and their user database stolen, which included email addresses and passwords. The mischief makers then tried the passwords for the dating site against the email accounts from that database. A lot of them worked. Then they tried logging into FaceBook using the stolen login details. That worked too, and chaos ensued as the poor innocents from the Christian dating site started publishing updates that they were pregnant, or coming out of the closet or had turned Atheist or to Satanism. Of course their friends didn’t realise their accounts were hacked and took these status updates seriously and hilarity or damage was caused, depending on your point of view (click on the image up there to take a look at one example – yes it’s probably amusing, until it happens to you). If you don’t think you can remember multiple passwords then your browser probably has the facility to remember passwords for you, or third party applications such as lastpass exist to help you. If you use Firefox you should protect your saved passwords by creating a master password by following these simple steps:

  1. Go to Tools > Options > Privacy
  2. Click on the + sign next to the words "Saved Passwords" or, in newer versions of Firefox, click on the "Passwords" tab.
  3. Click on the "Set Master Password" button.
  4. Key in a new "master" password.
  5. Click on OK.

For heaven’s sake make your passwords strong passwords. No pet’s names, no dictionary words, instead choose a password with numbers in it, and mixed case letters. lastpass helps you generate strong passwords for web sites so you don’t have to,

The same applies to your phone. Given that you’re all probably using the latest iProduct, loaded up with everything you can find (because there’s an app for that) your phone has more computing power and connectivity that I had for the first 10 years I used computers (you young people today, you have it easy, etc.). Your phone likely has email, twitter and of course your mum’s phone number in the address book. Lock your phone, keep it locked, don’t put it down unlocked when drinking with your friends otherwise you mean find “you’ve” tweeted about your love for Ashley Simpson tunes and text messaged your mother telling her you’ve quit university to join a band, or worse, the Socialist Workers party.

Then there’s the updates you actually make yourself. A facebook status explaining the joyful time you had last night with a member of the opposite (or same) sex you met three hours before may be a cause of some regret. Even if you delete it once you realise what you shared in a drunken haze you can never be sure it’s gone, it may be downloaded to your friend’s computers or worse, been indexed by google – and when that happens it’s never going away. Employers these days are searching social networking sites when looking at potential employees - a potential Cisco applicant tweeted:

Cisco just offered me a job! Now I have to weigh the utility of a fatty paycheck against the daily commute to San Jose and hating the work.

Tim Levad at Cisco saw the Tweet, and tweeted back:

Who is the hiring manager. I’m sure they would love to know that you will hate the work. We here at Cisco are versed in the web.

And those photos of you being sick in the street, or wearing a bra on your head? You don’t want to use those as your facebook profile pic either, just in case people save them or your profile is publically viewable. Facebook provides ways for you to limit photos, profiles and status updates to particular people – use it! (And hope your friends will never save and republish those pictures on the web).

Remember that the information you put on facebook is viewable to your friends – so don’t put your telephone number, email or address up there unless you fancy getting stalked when you reject someone at the bar who does a little too far.

Yes you’re going to have fun. Yes you’re going to embarrass yourself. Yes you’re going to sing along to Abba songs. But by protecting your computer and your accounts you can minimise the damage to feeling queasy the next morning when you wake up and remember what you did the night before and discover the traffic cone in your bed.

Technorati Tags: ,

author: Barry Dorrans | posted @ Wednesday, September 30, 2009 12:12 PM | Feedback (0)

Microsoft Security Essentials is out


For the last few months I’ve been using the beta of Microsoft Security Essentials, Microsoft’s own free anti-virus and anti-spyware program for Windows 7, Vista and XP. It’s now out and available for everyone to download and use.

It’s hard to know if you can recommend anti-virus programmes – it’s not as if I run into many viruses (although on some of the darker sites I visit (security people, not porn)) I do occasionally see an attempt to drop spyware or adware, usually through Adobe Acrobat (thanks for that Adobe). In the last three months Security Essentials has caught four such attempts, but of course you don’t know what it hasn’t caught.

When AV-Test tested MSE they described it as “Very Good”, detecting 3,200 common viruses and no false-positives. The AV-Comparatives folks apparently tested it last month and are due to release the results soon.

What I can say is it’s lightweight (the installer is 4.7Mb) and unobtrusive (although you sometimes see double context menu entries for its scan function). It works on Windows 7 and 64 bit (although not XP 64bit, Microsoft’s red-headed step child of recent operating systems). For now I’m going to continue using it, unless tests show it doesn’t detect very well.

You can download your own copy from the Security Essentials web site. Beta users will need to upgrade to release as well.

author: Barry Dorrans | posted @ Tuesday, September 29, 2009 5:13 PM | Feedback (0)

Wireless presenter mice going cheap on Amazon UK


Wireless Presenter Mouse 8000 I love this little mouse, it’s lasted me for 3 years and Amazon UK are selling them cheap right now at £30.04. It comes with a Bluetooth dongle which is pre-paired, but if you already have Bluetooth you don’t have to use it, it will pair like any normal mouse, and that’s a big bonus. MS’s recent mice all have custom receivers and I don’t want that, I already have a Bluetooth receiver in my laptop, so why on earth do I want something hanging off a USB port?

Anyway, highly recommended at this bargain price.

author: Barry Dorrans | posted @ Saturday, September 26, 2009 11:02 PM | Feedback (1)

Missed DDD7? Watch the videos


At DDD7 a lot of the sessions were videoed, but space to put them was hard to find. Until Ben Nunney stepped up, and now they’re all online …

Craig has the details and the links.

Technorati Tags: ,

author: Barry Dorrans | posted @ Saturday, September 26, 2009 9:33 PM | Feedback (1)

Microsoft release seven Web Application Toolkits (and a security problem)


To accompany WebsiteSpark (do MS have an internal app called SparkSpark which creates these programmes?) seven Web Application Toolkits have been released. Dinis Cruz asked on twitter if anyone had some spare time to look at them from a security perspective. I was bored, and needed a break from editing the book (that’s right folks it’s nearly done), so I thought I’d download one. I chose the FAQ toolkit (because I need to do something with the securingasp.net domain at some point).

Fired up Visual Studio, took a quick look at the code.

Nice surprises

  • It’s ASP.NET MVC based.
  • Appropriate use of HTML Encoding for both text and attributes. Some things aren’t encoded like dates from the data model, which aren’t strictly necessary, but encoding everything does no harm and should be standard practice.

Amusing surprises

  • It uses Linq2SQL – side note “Dear EF team, No-one likes you. You smell funny”

Silly surprises

  • When creating a list screen the FAQ answers will get chopped to the first X characters. Tags that get caught in this aren’t closed, so you could end up with half an <a href= and the bits of the page won’t be displayed.

Bad surprises.

  • No role based security.
  • You can vote on items multiple times as you can’t register an ordinary user.
  • No CSRF protection on any forms.
  • Admin users can create any response they want – no stripping of bad or unsafe HTML. Which wouldn’t be so bad, you would hopefully trust your admin users …
  • The admin login page has a link to register a user. Which creates a new user. And as there is no role based security the new user is … an administrator.

Oh dear.

Now reading the announcement for the templates perhaps MS view these things as plugins to your existing site, so you could make the argument that the people that use them already have security configured and know how to think about it. That’s great for you if you;re one of those people, but samples get examined and used by people who want to learn and by people that don’t want to learn at all and just want something that works, people who don’t know security. Worse still is the assumption by a lot of people that samples that from Microsoft are “the right way to do things”. Even out of work hours projects by Microsoft stuff get labelled like this as Rob Conery found out with his MVC Store Front series and the Oxite team also discovered. However it appears that the Web Application Toolkits are official projects.

Now maybe the other toolkits are better, maybe I’m being as unfair to that team as the ALT.NET folks were to Rob and the Oxite folks, but wearing my security hat I think this is pretty damned poor. I’ve only spent 10 minutes looking, I’m scared to do any in depth analysis now.

(Oh and if you’re in the UK and interested in WebsiteSpark remember you need to be nominated, so talk to Phil Winstanley, as Pixel Programming is a WebsiteSpark partner as well as being a BizSpark Partner).

author: Barry Dorrans | posted @ Saturday, September 26, 2009 11:09 AM | Feedback (0)

AntiXSS gets HTML Sanitation


Version 3.1 of the Microsoft AntiXSS library (binary download) was released on the 15th September and now comes with HTML sanitation. Not content with dropping a new release of the library Anil’s wife also dropped a release of her own and he’s now on paternity leave, which means the new functionality is undocumented for now.

A quick look in the help file shows two new methods, GetSafeHtml and GetSafeHtmlFragment. Both methods have the same three overloads,

  • GetSafeHtml(string) – which takes a string containing the HTML to be made safe
  • GetSafeHtml(TextReader, Stream) – which takes a TextReader as the source of the HTML and outputs to the specified stream
  • GetSafeHtml(TextReader, TextWriter) – which takes a TextReader as the source of the HTML and outputs to the specified text writer.

The difference between GetSafeHtml and GetSafeHtmlFragment lies in the output. GetSafeHtml outputs an html page, wrapping the input in <html> and <body> tags if they’re not there, GetSafeHtmlFragment just strips unsafe HTML from the input, without turning it into a complete page. What’s considered unsafe isn’t documented yet, but it does use a white list of non-scriptable tags and attributes. What you will find is that it is HTML it’s outputting, not XHTML, so if you want to use this to produce safe output for your XHTML site then you’re going to have to pump the output through the HtmlAgilityPack to get XHTML.

So congrats to Anil on the new babies. I think nappies/diapers come before documentation right now!

Technorati Tags: ,

author: Barry Dorrans | posted @ Sunday, September 20, 2009 9:54 AM | Feedback (0)

Get Fuzzy with MiniFuzzer


Jeffery Dallman on the SDL tools blog introduces MiniFuzzer, a baby fuzz testing tool for folks who’ve never fuzz tested before. Fuzz testing takes a template of known good input files and starts to fuzz them, playing with them, changing bits and bytes, doing all sorts of weird stuff and then firing them into your program to see if it can cause a crash, which it normally does. More “grown up” Fuzz Testers (like Peach) work from a specification of valid input and uses the spec to provide good, bad, and mostly good inputs, again feeding it into an application to see what happens.

Fuzz testing isn’t a substitute for unit tests or more formal tests, in a lot of cases passing a fuzz test indicates that the system handles errors correctly and does not indicate that it gets anything else right – however it’s a relatively low cost test which can reveal a high number of internal problems with the way your code handles input.

With MiniFuzzer you may have some work to do first – it requires that your program takes input as a startup parameter, so if your application is an ASP.NET application it’s time to take that input process code and link it into a command line app for testing. This may seem painful, but when you see your processing code start to fall over you’ll realise it’s probably a good idea :)

Technorati Tags: ,

author: Barry Dorrans | posted @ Wednesday, September 16, 2009 8:11 PM | Feedback (0)

Quick thoughts on the Microsoft AJAX CDN


Scott “Red Shirt” Guthrie announced today that the jQuery and the Microsoft AJAX scripts would be hosted on the Microsoft content delivery network (CDN) – which should speed up the initial loading of these script libraries and save you bandwidth, as you won’t have to host them any more. Being an untrusting soul, errr, security person, I thought I’d take a quick look at how its delivered.

The scripts are hosted on http://ajax.microsoft.com/ which presents the first problem – it’s a microsoft.com domain. When you do any serious browsing to the normal microsoft.com sites you’re going to get a cookie, for example if you login to view things that require Live authentication, or you register for an event or even a session ID. On my machine I have seven cookies that are sent to any microsoft.com site and some of them look like tracking identifiers (the omniID for example is a GUID, then there’s MUID, a cookie called ANON and so on). There’s no way of knowing what these cookies actually do, but they will be sent with requests for the CDN based script libraries which, if Microsoft were so inclined, could be used to track users as they travel through various sites using the CDN. Of course google does the same thing, and has been doing it for longer. The google script for loading other scripts (yes I know) comes from google.com, so the cookie that identifies your searches will be sent when you browse to a site that uses the google script CDN (adsense and google analytics scripts come from different domains, and so those identifying cookies won’t be sent). So there is a potential privacy problem here, if Microsoft were inclined to be evil.

A bigger problem arises if your site is a secure site. If you’re running your site on HTTPS then you’ll want to load your scripts from an HTTPS site to avoid the alerts that users will get about mixed security. The certificates on the CDN servers don’t match the ajax.microsoft.com domain – when I tried the certificate was issued to the underlying machine, a248.e.akamai.net so of course embedding the scripts won’t work due to this mismatch. Now yes, it’s beta, it’s very early beta, so one would hope the certificate problems would go away by release (or you simply don’t use the CDN if your site is a secure site, which is probably a better option – if your site is secure then it’s secure for a reason and you won’t want to load scripts from outside due to matters of trust – if the MS servers get owned, then, with json hijacking your app is in trouble, the same problem exists with the google hosted script libraries).

MS aren’t dropping cookies from the ajax CDN hosts and I’m not suggesting they’d be evil enough to aggregate requests for the ajax scripts with users of microsoft.com (and I doubt that would produce anything useful!) but I’d just feel happier if they didn’t accept them either, preferably by giving the CDN a domain name all of its very own.

Technorati Tags:

author: Barry Dorrans | posted @ Wednesday, September 16, 2009 10:18 AM | Feedback (3)