Tuesday, December 21, 2004
One-way mobile phone
I got a new mobile phone (Smartphone... sweet) and a new mobile number paid for by the company I work for and use this now as my primary phone. I have my old mobile number diverted to the work mobile. As not many people have updated their contact details for me, I am getting charged for all the redirections based on the length of the call... $20 a month for nothing basically.
How to get the message across without disconnecting my old number? (I want to keep my old mobile phone as a backup). Easy! After sending an email to everyone about the change, I have now redirected all incoming calls to +6139999 where +61 is my country code, 3 is my area code and 9999 is a fictious number that results in a "This number has been disconnected message".
This has all sorts of cool possibilities for caller ID. I can ring anyone using my old mobile phone and if they try to ring me back they get a "Disconnected" message. I now have a handy one-way mobile phone.
How to get the message across without disconnecting my old number? (I want to keep my old mobile phone as a backup). Easy! After sending an email to everyone about the change, I have now redirected all incoming calls to +6139999 where +61 is my country code, 3 is my area code and 9999 is a fictious number that results in a "This number has been disconnected message".
This has all sorts of cool possibilities for caller ID. I can ring anyone using my old mobile phone and if they try to ring me back they get a "Disconnected" message. I now have a handy one-way mobile phone.
Saturday, December 18, 2004
SuperScan 4 & XP SP2
I meant to put this up a while ago... SuperScan 4 from Foundstone is a port scanner/Windows enumeration tool/footprinting toolkit. The SYN scans no longer work under XP Service Pack 2.
Worthless Security Books
I decided to sell some of the plethora of security books I have around the place. So I went and had a look on eBay and Amazon's second-hand books for comparitive prices.
My books are worthless! Books that I have paid between AU$80 - $160 for were selling from $3 up to a whopping $10. Anyway the lesson here is never to buy security books new, the same lesson applies to cars.
My books are worthless! Books that I have paid between AU$80 - $160 for were selling from $3 up to a whopping $10. Anyway the lesson here is never to buy security books new, the same lesson applies to cars.
Thursday, December 16, 2004
Counter-intuitive: RRAS & Server Hardening
I have been (re)building my home servers and decided to combine two of my servers functions into a single Win2K dual-Pentium box and scrap my old faithful NT-based proxy server.
Being naturally paranoid, I hardened the box after building. That's when my troubles began. I needed to install the Routing and Remote Access service (RRAS). RRAS would start but the menus for configuring were greyed out and not accessible. There were no error messages on screen or in the logs.
I tried uninstalling/reinstalling, re-running service packs - all the usual stuff, to no avail.
Then I stumbled on a Microsoft Knowledgebase article KB254192 (thanks to the KBAlertz website) detailing how RRAS won't run without the Remote Registry service running. As part of my server hardening process I disable the Remote Registry service.
To quote the evil empire "Any situation that requires the Routing and Remote Access service to access configuration data, such as restarting the service or rebooting the system, causes the Routing and Remote Access service to stop functioning when the Remote Registry service is disabled."
So basically we have a service that facilitates remote user access and requires that the registry be remotely manipulatable as well. Seems counter-intuitive from a security standpoint to me.
Being naturally paranoid, I hardened the box after building. That's when my troubles began. I needed to install the Routing and Remote Access service (RRAS). RRAS would start but the menus for configuring were greyed out and not accessible. There were no error messages on screen or in the logs.
I tried uninstalling/reinstalling, re-running service packs - all the usual stuff, to no avail.
Then I stumbled on a Microsoft Knowledgebase article KB254192 (thanks to the KBAlertz website) detailing how RRAS won't run without the Remote Registry service running. As part of my server hardening process I disable the Remote Registry service.
To quote the evil empire "Any situation that requires the Routing and Remote Access service to access configuration data, such as restarting the service or rebooting the system, causes the Routing and Remote Access service to stop functioning when the Remote Registry service is disabled."
So basically we have a service that facilitates remote user access and requires that the registry be remotely manipulatable as well. Seems counter-intuitive from a security standpoint to me.
Friday, December 10, 2004
Google Desktop on a Server
I have become a big fan of Google Desktop but I really wanted to index all my security reference documents on my file server and access from my desktop.
Google Desktop was built with (some) security in mind and only binds to the loopback interface (127.0.0.1). No problem I thought, port redirection will fix this! So I installed a port redirector, bound it to the external interface and with a little fiddling of the URL (i.e. copying the parameters from the servers Google search URL) and voila! - searchable file server.
Searching worked fine but nothing happened when I clicked on the document links. I went and had a look at the server and all the documets had been opened on the server. Anyway a quick Google search (hmmmm.... irony) showed that other people had been down this path and there were some nice proxies for accessing Google Desktop on another server.
Project Computing Google Proxy http://www.projectcomputing.com/resources/desktopProxy/
While the proxy is not perfect, like every document being called redir.xxx, the result is good enough for me.
Google Desktop was built with (some) security in mind and only binds to the loopback interface (127.0.0.1). No problem I thought, port redirection will fix this! So I installed a port redirector, bound it to the external interface and with a little fiddling of the URL (i.e. copying the parameters from the servers Google search URL) and voila! - searchable file server.
Searching worked fine but nothing happened when I clicked on the document links. I went and had a look at the server and all the documets had been opened on the server. Anyway a quick Google search (hmmmm.... irony) showed that other people had been down this path and there were some nice proxies for accessing Google Desktop on another server.
Project Computing Google Proxy http://www.projectcomputing.com/resources/desktopProxy/
While the proxy is not perfect, like every document being called redir.xxx, the result is good enough for me.
Tuesday, December 07, 2004
ASP.NET user insecurity
When you install the Microsoft .NET framework which quite a few programs these days require, it creates an ASPNET user.
By default this user is explicitly granted the following rights:
- Access this computer from the network
- Deny logon locally
- Deny logon through Terminal Services
- Impersonate a client after authentication
- Log on as a batch job
- Log on as a service
This account uses a strong password BUT... a new utility AspNetUserPass http://www.nirsoft.net/utils/anup.html by Nir Sofer can instantly decrypt the ASPNET password regardless of complexity.
