I read today, on El Reg, that the Australian National University has just put a feed of their random number generator (link). The fantastically clever bit is that it is truly, and utterly, random. This is incredibly important, computers do not lend themselves easily to create random numbers; this by design. The processor is, basically, a series of switches that exist in either an ON state or an OFF state (this is pretty much what binary means). They don’t work well, or indeed at all, when their state is MEH.

The ANU are able to measure the quantum fluctuations of the vacuum (this is really cool):

The random numbers are generated in real-time in our lab by measuring the quantum fluctuations of the vacuum. The vacuum is described very differently in the quantum mechanical context than in the classical context. Traditionally, a vacuum is considered as a space that is empty of matter or photons. Quantum mechanically, however, that same space resembles a sea of virtual particles appearing and disappearing all the time. This results in the fact that the vacuum does not possess a zero-point energy, and consequently the electo-magnetic field describing this vacuum possesses random fluctuations in phase and amplitude at all frequencies. By carefully measuring these fluctuations, we are able to generate ultra-high bandwidth random numbers.

Random Numbers: link

TNEF is a way that Exchange and Outlook encapsulate messages to give a richer viewing experience and as a part of that it generates a winmail.dat file that, Exchange and Outlook know how to handle and how to discard (most importantly).  The problem is, with other email handling systems, especially automated ones, they don’t really know how to deal with it and generally crash and burn…

So why is this interesting, well a friend of mine who has moved his business to the cloud is using Office 365 for his email and collaboration.  Now it gives him all the awesome Exchange features, 25GB mailbox, calendaring, syncing to his iPhone etc all for £4 per month (which is frankly amazing) but part of what he does is to mail important files over to a separate LoB (Line of Business) application that takes these files and creates specialised workloads.  Now the problem here is that this system is built on Linux and Java, neither of which have native support for the rich functionality of Outlook, and this meant that every mail failed and created a massive amount of work for his team.

Being the friendly sort that I am, I thought I’d take a look and see if I could figure it out… Turns out I could.

What’s not immediately clear in the O365 administration site is that it actually has a massive amount of ‘hidden’ functionality.  Well, it isn’t strictly speaking hidden but it’s not accessible from the graphical front-end.  You have to go old school on it and fire up a command prompt, specifically a PowerShell command prompt (woooooooo).

First things first, enable some script action…

You need to let your machine run unsigned PowerShell to even be able to connect to the remote Exchange service, this is pretty easy too!

Click Start > All Programs > Accessories > Windows PowerShell

Now right-click on “Windows PowerShell” and select Run as Administrator.

Enter the command:

Set-RemoteExecutionPolicy unsigned

Now connect to your Exchange 2010

Ok so now you’re connected we need to disable TNEF, this is the easy bit but you need to decide if you want to just globally disable it (my recommendation) or disable it for specific domains

Killing TNEF

Enter this command:

Set-RemoteDomain Default -TNEFEnabled $false

Easy, wasn’t it?!  If you want to disable it on specific domains only then do the following:

In this example, the remote domain is fabrikam.com.

1. Run the following command to create a new remote domain for fabrikam.com:

   New-RemoteDomain -Name Fabrikam -DomainName fabrikam.com

2. Modify the default settings of the Fabrikam remote domain to disable TNEF encoding for all messages to the fabrikam.com domain:

   Set-RemoteDomain Fabrikam -TNEFEnabled $false

Note   If you create a remote domain for a specific destination domain, and the default settings for all destination domains conflicts with the same setting of the specific remote domain, the setting of the specific remote domain overrides the default settings for all destination domains. For example, if TNEFEnabled is $false for the default remote domain, and TNEFEnabled is $true for the fabrikam.com remote domain, TNEF-encoded messages are delivered to recipients in the fabrikam.com domain.  – Excerpt from http://help.outlook.com/en-us/140/gg263346.aspx

Now you’re done!

You may want to add back the protection you get from only running signed, just run:

Set-RemoteExecutionPolicy unsigned

Boom.

I took this at the top of a reasonably large hill, mountain maybe (probably not), after driving around in a  Citroen C4 which is the most inappropriate car on the planet to drive on windy, thin roads scratched into the side of a mountain with a 400m vertical drop.  Add on an automatic gearbox that takes 3 seconds to change-up or down and you have a very, very exciting time ahead of you.

Join me, John Bradshaw, as I guide you through the Microsoft strategy on the Consumerisation of IT and how it will affect your business.  Microsoft is committed to delivering a range of productivity, security and development tools to help you leverage the social network, cloud and personal systems that your teams and customer use on a daily basis.

What’s the hype?

There were lots of silly quotes in the news on this vulnerability, which had been specifically linked to HP printers:

Could a hacker from half-way around the planet control your printer and give it instructions so frantic that it could eventually catch fire? [Ed: No] – MSNBC, 29 November 2011

What’s the reality?

I’ll skip over the technical nitty-gritty of it, because its tedious, but essentially patches and updates were being installed without being validated as having come from HP.  Would you install an application that randomly started downloading to your computer?  Probably not, but unlike these printers you can make a choice.  They’re just responding to a correctly formed instruction.

As HP said, they’re printers all have thermal cutouts which are electromechanical switches and can’t be remotely hacked.

What’s the threat?

It’s not fiery printer death.  What it actually is, is far more insidious.  Imagine if you could copy every scan or print from any printer.  If you could do this at a bank, you could get transaction details, sensitive deal information, HR records… The list goes on, and the scenarios are infinite.

This sort of attack lets you copy anything and everything from any infected printer.

As an aside, lots of businesses have shifted to proximity printing in part for security reasons.  Proximity printing makes you stand by the printer while you swipe your access card to make it print out whatever you had sent.  Hopefully stopping anyone else from getting your prints, and the obvious risks involved with that.

What can you do?

This is tricky… As the video goes on to say, what we’re dealing with here are Embedded Systems and they are typically running bespoke operating systems.  Or more accurately they are simply state machines that respond to various inputs/scenarios and respond, I would imagine they’re written (at least in part) in C because of their need to interface and manage control systems.

The answer is, as with all security problems, defence in-depth.  You need to protect the network, the print server and the clients.

Going more technical here, so escape now while you can…

Network

In a properly configured enterprise network it would be sensible to restrict the physical port that the printer is connected to allow only connections from the print server over established ports.  This would make scanning the network pointless, and reduce the attack surface.

Deny all direct connections to the printer

It also makes sense to use IDS (Intrusion Detection System)/IPS (Intrusion Prevention System) to look at the network traffic, these are generally updated quickly and can address threats of this nature faster than manufacturers can develop patches.

Infrastructure

The usual bits and pieces are needed here!  Print servers should be running patched operating systems, have current antivirus and in Windows environments should be using AD to validate users.

Suggested Reading:

• Techcitement
• DailyTech

What do I do?

Do this:

Step 1

Go here, http://www.fanboy.co.nz/adblock/ie.html, and underneath Fanboy Adblock List for Internet Explorer 9, click Add TPL.

Step 2

Go here, http://dl.dropbox.com/u/17445922/ElementHidingRules.zip, and extract the file to your ‘My Documents’ or ‘Documents’ Library.

Step 3

Now you just need to go to Internet Options > General > Accessibility and select “Format documents using my style sheet”.  Enter the path to ElementHidingRules.css file you extracted earlier and hit OK, OK.

Step 4

Enjoy.  I’ve tried it on Bing, Google, Ars Technica and a handful of others and it all seems to work!

Can I do this via GPO?

Yes, probably.  I’ve done a little bit of research and I found the necessary settings within the registry to enforce the CSS.

The key: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Styles

Essentially all you then need is a GPO to copy the file over and have, that same GPO possibly, add this registry key.  What I cannot find, because it doesn’t exist, is a GPO to force the necessary TPL setting.  There may be a script o’matic solution, or the existing TPL settings could be used.  It’s worth a shot at any rate!

Checksums

I’ve checksumed the file ElementHidingRules.css that I used to block ads with, I do not warrant it in any way and you use it at your own discretion!

Checksums generated by ExactFile 1.0.0.15

http://www.exactfile.com

09/01/2012 17:07:07

ElementHidingRules.css
67551 bytes

ADLER32: c3d894d0
CRC32: 72773bae
MD2: dbfd566d28a9a5a6e32117f4e23468ce
MD4: 357813e5fa9fbdf3995d14bf4a6be245
MD5: a94f41ee8d0b0bafc675451c52d27960
SHA1: be107743d27394e7f55018f7a260918653064f5b
SHA256: 31efbc7c5c00412a3eb575284b54da6d7749b050e4caef06f384f51997d2e8f9
SHA384: d6050dd37e316a84b31566510b6668d4d1725d339462d9a554102aee06324d128156e7daac5c30c1373ca15207103950
SHA512: 5ce272fb6210fa6b2c56192688661bbfb6ed10cc1d444b9e53564e2e6daac161c96264511b263f5e768983eadddc08b1dbe1bc8a7e4932842b103af7a380637b
RIPEMD128: fa4af9060f4aae6a3622310fddeec106
RIPEMD160: 7f442bd5259d5e4ed79184be80ebe75f38a7a2b4
TIGER128: cbc05a1cc474c7ec4d351cc20d80b8bf
TIGER160: cbc05a1cc474c7ec4d351cc20d80b8bf55e18ddb
TIGER192: cbc05a1cc474c7ec4d351cc20d80b8bf55e18ddb6381366a
GOST: 5d0612e8fc91edd128ef3f051b5e383c2e6dc74f9b8ae2edaf31d1323f4b85f8

PS How could I be any kind of security consultant and not provide a checksum for a file I link to!

I’m just back from my holidays, as I imagine many of you are too, and I might post about them later but I wanted to say just how fantastic the Photosynth application is from Microsoft.  While I was off in Cologne I thought I’d give it a go, and below you can see my appalling efforts as a photographer.

Cologne Philharmonic Orchestra

Museum Ludwig

You can pick up the application for iPhone, iPad or iPod here.

What it does

Photosynth stitches images together to create panoramas live on your phone, and quoting from the website:

Photosynth is a powerful set of tools for capturing and viewing the world in 3D. You can share these views with your friends on Facebook, publish them to Bing Maps, or embed them in your own Web site.

-About Photosynth, http://photosynth.net/about.aspx

It has a pretty clever interface that guides you in taking the shots, which it does automatically, I am unfortunately ridiculously cackhanded and mine have come out all blurry.

If you’ve any great ones let me know in the comments below!

Be always at war with your vices, at peace with your neighbors, and let each new year find you a better man. ~Benjamin Franklin

Happy New Year! I wish you all the best for 2012, may it be your best yet!!

Ps. I forgot to post this yesterday…

And the Grinch, with his Grinch-feet ice cold in the snow, stood puzzling and puzzling, how could it be so? It came without ribbons. It came without tags. It came without packages, boxes or bags. And he puzzled and puzzled ’till his puzzler was sore. Then the Grinch thought of something he hadn’t before. What if Christmas, he thought, doesn’t come from a store. What if Christmas, perhaps, means a little bit more.

- Dr. Seuss

Have a Happy Christmas, Hanukah, Diwali, Eid, Yule et al. everybody!!

http://www.youtube.com/watch?v=6MHz15Ah_CI

 
PS: I really love The Grinch and The Muppets!!