Introduction This is going to be a multi-part series of articles with the end goal of producing a solution which handles security/identity claims across domain boundaries using WCF services and Active Directory Federation Services 2.0 (with a federation trust) and Active Directory. In order to demonstrate an approach to handling […]
Security
39 posts
I was recently reading an article about a phishing site which was uncovered recently. The site in question – "Bank of Switzerland" – bankofswissltd[DOT]com was undone by some suspicious discrepancies in their site’s WHOIS record. If you’re uncertain what a WHOIS record is, a decent analogy might be to compare […]
This weekend I discovered a pretty massive security fail on the iPhone 4S. As you might know, you can set a security pin code to prevent unauthorized use of an iPhone handset. You might also be aware of the new Siri feature built into the iPhone 4S. Assuming you have […]
Today I received an e-mail which made it past Google’s Junk E-mail protection. It was sent from “Gmail Team” and titled “Google Verification”. As I’ve had to do site verifications for Analytics and Webmaster tools, I took a look at the e-mail. Within half a microsecond, I decided to compose […]
The IEEE Society and Internet Society of Australia (ISOC-AU) are presenting two free public seminars on recent developments in the Internet sphere including the “Kill Switch” used in Egypt and Libya, Wikileaks and beyond. This should prove a very timely event, given the recent developments concerning the Internet, and I’m […]
This morning I was trawling through a variety of websites as I usually do, and I came across an article which referenced this website called Qualys, where they have a tool called BrowserCheck. The site basically scans your web browser for vulnerabilities based on plugins which are installed. Assuming you […]
What is a Botnet? Well, in a nutshell, a Botnet is a internetworked series of computers which are running distributed software. The more notorious form of Botnet (and the topic of this post) typically infects other computers using a variety of attacks and vulnerabilities, increasing their overall size and computing […]
You might find this information handy if you work with Windows Services, and wish to grant some basic permissions to user accounts. In my scenario, I wanted to be able to list the status of several key Windows Services used in my overall architecture (for a diagnostic website/control panel) and […]
If you are like me, you probably aren’t a huge fan of Kerberos, but it does have some advantages. When using an Active Domain (AD) account as a service account, it is handy to reduce the attack vector by minimising the chosen Domain Account’s permissions and privileges. If you are […]
Today I learnt an important lesson about moving a PC from one Active Directory domain to another – the process will strip (domain) logins from SQL Server! Yes, I know this is kind of obvious and expected, but also easy to overlook. So our scenario is that we don’t have […]
Thanks to Bridger for pointing me in the direction of this excellent video of former SysInternals and current Microsoft internals guru Mark Russinovich demonstrating how to use some of the various debugging utilities with a particular view to debugging “plugins” and hosted programs which could be causing performance problems. The […]
Recently I went digging for a solution to a problem which has been bugging me on Windows Server 2008. It seems once connected to a virtual private network (via PPTP, peer to peer tunnelling) when you try to authenticate to non-VPN network resources, Windows passes your VPN credentials instead – […]
This just in from our ‘friends’ at Slashdot – a critical Microsoft patch for all “modern” Windows systems. There’s a bulletin notice located here which is pretty alarming, from the bulletin: “This security update resolves a privately reported vulnerability in the Server service. The vulnerability could allow remote code execution […]
Whilst partaking in my normal stroll through the Interweb I came across this truly interesting little development from Microsoft Research. Detours from Microsoft Research. How nice! This little development allows you to basically proxy calls from an application to DLLs it loads (by way of interception). Here’s the official blurb: […]
Well, I’ve been fighting Kerberos so I thought perhaps this might be a good time to document it. Hand up if you love Kerberos? …If you like Kerberos? ..If you have to live with Kerberos? Well, anyway, it’s often a necessary evil. Let’s start at the beginning. Event […]