stuart test blog

Looks like Vista’s UAC is getting another grilling on several security blogs at the moment. Security researcher, Joanna Rutkowska wrote a post going into detail about UAC and pointed out an obvious flaw that she discovered.

Seems that Vista detects setup executables when they are launched through a heuristics mechanism which checks for an installer manifest, as well as checking the executable name for strings such as “installer”, “setup”, “update”, etc. If UAC detects that a setup program has just been launched, it will provide a UAC prompt to elevate privileges to run the program. It does this for ALL installers, regardless of whether they need elevated privileges or not.

The flaw with this, if it’s not obvious yet, is that if you download a seemingly harmless setup program from the internet (Joanna uses a freeware version of Tetris as an example) then that setup program will run under full administrator privileges. This gives it God-like powers and even allows it to install kernel-mode drivers.

In my experience, most of the nasties that I have seen running on users’ computers – Trojans, spyware, keyloggers, dialers, etc – have mostly been installed surreptitiously through seemingly harmless applications like card games, screensavers, file sharing apps, and other common freeware programs. You would hope that the built-in spyware protection program, Windows Defender, would pick up the obvious nasties, but the fact that all of these apps will be installed under full administrator rights seems to defeat the purpose of UAC in the first place.

Mark Russinovich, who recently became a Microsoft employee, writes on his blog: “Because elevations and ILs don’t define a security boundary, potential avenues of attack , regardless of ease or scope, are not security bugs.” I have great respect for Mark’s opinion, but this seems like a copout to me – he’s saying that this method of getting around UAC can’t be called a security bug because it’s by design.

I’m not a fan of the way that Microsoft have implemented UAC, but I am a fan of the principles it tries to achieve. If Vista’s UAC can be defeated as easily as now it now seems, was it worth it all? Is a false sense of security better than no security at all?

http://www.cooksbeach.co.nz/mapzoom.html

I’ve been quietly working on the Blogtown NZ site for the last few months, and it seems to be shaping up nicely. It’s a free, hosted, blogging service for Kiwis and everyone else living in NZ. It’s based on WordPress MU which is the multi-user version of WordPress, the famous blogging software.

If you don’t have a blog yet, feel free to create one for yourself. It only takes a minute to sign up and doesn’t cost anything. Your blog address will be something like “mycoolblog.blogtown.co.nz”

Read more here: http://blogtown.co.nz and sign up here: http://blogtown.co.nz/wp-signup.php

Google recently released an update to their Image search pages. I hate it!! You now have to roll-over each image to see the dimensions and the domain name. Matt Cutts blogged about this recently and most of the comments he received were very negative towards the redesign.

I’ll admit that the interface now looks cleaner – but that’s only because they have hidden the useful information. Please fix this soon…

Biggest news around the blogosphere today was about Steve Jobs’s memo about DRM and why we shouldn’t put up with it. I won’t go in too deep on his thoughts as there is already lots being said out there (check TechMeme, Technorati, or Google BlogSearch for details.)

My brief thoughts are that although I agree with what he’s saying completely and I hope this comes true, I find it a bit hypocritical that the iTunes store doesn’t sell any music without DRM when there are lots of artists out there who don’t want DRM wrapped around their songs.

I’ll be up to date with my reading soon, but in the meantime here’s a whole bunch more to catch up on…

Downloadable Guide Available for Exchange 2007

You can now download the first couple of guides (word docs) for Exchange 2007.

Deploying a Standard Exchange Server 2007 Organization: http://go.microsoft.com/fwlink/?LinkId=82170

Deploying a Simple Exchange Server 2007 Organization: http://go.microsoft.com/fwlink/?LinkId=82171

Deploying a Large Exchange Server 2007 Organization: http://go.microsoft.com/fwlink/?LinkId=82172

Deploying a Complex Exchange Server 2007 Organization: http://go.microsoft.com/fwlink/?LinkId=82173

Additional guides will be released in the near future.

Source: Henrik Walther Blog » Blog Archive » Downloadable Guide Available for Exchange 2007

UPDATE: For more Exchange stuff, check out my Exchange tag!

I was going to update my original post with this but I thought it would be easier to put it in a seperate post. Here’s how I updated the Simpla theme to have 3 columns with widgets.

First read this post: http://stuart.amanzi.co.nz/2006/05/30/new-simpla-theme-with-widgets/

Then edit the sidebar.php like this:

<div id="sidebar2">
<ul>
<?php if ( !function_exists('dynamic_sidebar') || !dynamic_sidebar(2) ) : ?>
    <li id="pages">
        <h2>Pages</h2>
        <ul>
            <li><a href="<?php echo get_settings('home'); ?>/">Home</a></li>
            <?php wp_list_pages('title_li='); ?>
        </ul>
    </li>
<?php endif; ?>
</ul>
</div>
<div id="sidebar">
<ul>
<?php if ( !function_exists('dynamic_sidebar') || !dynamic_sidebar(1) ) : ?>
    <li id="links">
        <ul>
        <?php get_links_list(); ?>
        </ul>
    </li>
<?php endif; ?>
</ul>
</div>

Then edit the style.css to get the two sidebars to show correctly: (just modify the stylesheet with the bits below)

#wrap{
    margin:0 auto;
    text-align:left;
    width:980px;
}
#content{
    font-size:1.2em;
    float:left;
    padding:1em;
    width:600px;
}
#content .wide{
    width:980px;
}
#sidebar{
    font-size:1.1em;
    float:right;
    padding:0;
    width: 165px;
    border-right: 1px dotted #ddd;
}
#sidebar2{
    font-size:1.1em;
    float:right;
    padding:0;
    width: 165px;
}

Then finally, you need to edit the functions.php file to reference both sidebars:

<?php
if ( function_exists('register_sidebar') )
    register_sidebars(2);
?>

Let me know if you have any other questions.

I went to the Wellington Sevens tournament last night and it was great fun. We spent the first half of the night in the Delloitte Lounge and then headed intot the crowd for some mayhem. I snapped a whole bunch of pics which are now up on Flickr. Here’s some of the best.

(if you’re reading this in a feed reader, you’ll have to visit the site to see the slideshow.)

I’ve been running Vista Ultimate for the last couple of weeks – it’s been full of highs and lows, but I’m saving that for a future blog post.

But I ran into something interesting this morning when I went to use one of Vista’s little-known gems, the Snipping Tool. It’s a nifty little screen capture utility that I was very impressed with during the early betas. Unfortunately it was missing…

I couldn’t figure out why I didn’t have it installed, so assumed that Microsoft must have removed it from the final RTM release. But I searched the help and found lots of info about the tool with screencasts showing how it is used. But in the screencast, you see a hand dragging around a stylus on a tablet screen – which reminded me that I had uninstalled the tablet PC software from the Windows features.

Turns out the snipping tool is marked as a tablet pc optional component and you can’t get it without installing the whole tablet pc pack. This seems like a bit of bloatware to me – the snipping tool is equally as useful on a non-tablet computer, so why do I need the hand-writing recognition software and the other tablet pc components too? Does this also mean that the lower-spec Windows versions don’t include the useful snipping tool, because they don’t have the tablet pc feature pack..?

I meant to blog about this last year when I discovered it, but this appears to be the little-known Holy Grail of syncing applications. SyncMyCal is an Outlook plugin that synchronises your Google Calendar with your Outlook calendar – and both ways too!

If you search for “Google Calendar sync” you’ll find lots of people searching for the perfect tool to get two-way syncing happening between Google Calendar and Outlook. SyncMyCal comes in two versions, both versions provide full, two-way syncing, but the limitation on the free version is that you can only sync a range of 7 days of items, whereas the full version ($25) allows unlimited syncing.

This definitely works, although I have only used the free version so far. I was reminded of the tool after reading Jon Udell’s blog where he outlines the difficulty in getting multiple calendars synced.

Link to SyncMyCal – Share Outlook Calendar Free, Google Calendar Sync