Information disclosure: It's everywhere

You might have seen stickers like this in the back window of some minivan and maybe you thought it was funny/cute/stupid, but did you ever think of it as information disclosure? What's the big deal about showing all of your family's names? glad you ask :), let me briefly describe something that happens in Mexico and South America: Virtual kidnapping extortion, criminals will call your phone, tell you that hey have kidnapped your kid (they have the names you graciously provided) and ask you to immediately pay the ransom, when in reality they don't have your kid, but use the emotional momentum to take advantage of you. This is only one example of how they conduct these activities, there are many other ways, and I'm not trying to make you scared of that, but to make a point on information disclosure. It can be found in the most innocent places and if you think this can't happen to you, then you're already very vulnerable.

You've also probably seen this:

I couldn't even tell you how many blogs have been hacked because of that (hint: too many), WordPress makes it too easy to break those sites when new vulnerabilities appear (as they do every other week).

I have seen systems where they use some employee id as their login credentials, that id is visible when the computer is locked, and it turns out you can call the help desk, provide them with that id, the person's name, and they will happily reset the password for you.

Unfortunately there are no rules that I can give you or that I have ever seen anywhere to prevent the issue of information disclosure, I'm just trying to raise the awareness on the potential issue that represents having information that bad people can use for malign purposes both in your systems and your own life. The only thing I can tell you is that information disclosure is really everywhere, in your comments, in your configuration files, disclosing the components that your app users, that version, that user id, etc. even in that innocent sticker.

Security does get in the way of usability and usability gets in the way of security, just give it a second thought and be careful out there.

There is no such thing as a secure system, all you can do is raise the bar a little bit more and yes, security by obscurity may be your friend some times.

is my password too complex?

this post from Scott reminded of a few days ago, when I changed my msn (live?) password and the next day I wasn't able to log back in because the hotmail (msn/live) passwords only allow a length of 16 characters and for some reason I was double typing 2 characters without noticing, after a while I figured it out and realized that I am using the maximum length allowed for passwords, and of course I use upper case, lower case, numbers and symbols... and of course I have categories of sites and the passwords I chose for them, depending on the importance and the security they implement

no wonder a number of people have looked at me like I'm some weirdo when they've seen me typing my passwords... mmm...

am I a freak, or is this normal among geeks? maybe... but there is no security in this world, so all we can do is raise the bar a bit

.NET user control not loading under https

keywords: .net user control, activex, ocx, IE7, IE, https, http, secure

Justin and I just had a heck of a week fighting ActiveX controls developed using C# in .NET 2.0, so we will be blogging about some of the issues that we found and their solutions (so we can remember later), the first one is about ActiveX controls running under https.

We developed our control, everything was fine, one of our clients wanted to try that over a secure site, so we said no problem... until we tried, and tried, and tried, and nothing worked, the control would just not load.

the solution ended up being really stupid (as is usually the case); when you include your control, you usually do something like this:

<object id="someId" classid="SomeDll#Namespace.ClassName"></object>

that's the way you'll find it in all the examples around the web, and that will work just fine (once you get past all the other stuff that is required to make it work) under http, but when you move that to https, it will simply not work.

the solution?

when you create your control, you assign a guid to it

[Guid("CAE67AEA-F489-4e52-956B-CCC774F40A3A")]
[ClassInterface(ClassInterfaceType.None), ComSourceInterfaces(typeof(IControlEvents))] // --Expose events
[ComVisible(true)]
public partial class MyControl : UserControl...

something like that...
well, to make it work on https, you simply have to use that GUID, not the class name, so you would just write this on your html code

<object id="someId" classid="clsid:CAE67AEA-F489-4e52-956B-CCC774F40A3A"></object>

done, hope we saved you hours of headache

Deploying .NET 2.0 security settings without SDK or caspol

This article applies to Microsoft .NET Framework 2.0 Security
keywords: CAS, full, trust, assembly, security, policy, mscorcfg.msc caspol.exe

When you want to adjust the security settings in .NET 2.0 you use the mscorcfg.msc tool (Control Panel/Administrative Tools/Microsoft .NET Framework 2.0 Configuration)

However sometimes in a production environment you might need to do the same thing in a bunch of machines, and the problem is that the mscorcfg.msc tool is only included in the SDK which is over 300 MB, another option is to use the caspol command line, but that will scare most people away, there are a lot of people having this problem, so I thought I would post an easier solution here.

I lied on the title of the article, you do need to the SDK, but only in one machine, since you are a developer (right?) I suppose you have Visual Studio, and that includes the SDK, if you don't have the SDK installed on any machine, then you need to download it and install it at least on one machine.

Once you have that you can use the mscorcfg tool, setup the machine with the permissions that you want, trust assemblies, adjust zone security settings, etc, then when you are done, use this option

Configure Code Access Security Policy







Create Deployment Package






you will see a new dialog, which doesn't have many options


this dialog is a bit weird and buggy, but all you have to specify is a file name in some valid folder, for example c:\SecuritySettings

the other thing you might want to change is the security policy level to deploy, if you are deploying to production machines you might need Machine or User
click Next, then finish.

What this little wizard does, it creates a package with all the security settings on that machine, and puts it in a simple small executable program that you can run in any machine to adjust the security settings to match that machine.

now all you need to do, is take that file to the machines where you want to deploy your new security settings, run it and you're done

When you run the file you are naturally tempted to wait for a dialog to come up and ask you to click next, next, next, finish, but no dialog will pop up, you'll see it flash for a second and then it will dissapear, that's all it does (you might need privileged rights to run that file), if you were able to run that file, the security settings have been changed.

now if "it works on my machine!", you can make it work in other machines too =o)

what are those S-1-5... things I see on the security tab?

sometimes you right click/properties/security on things like files and you see some garbled things like S-1-5-7blablabla...
They are called security identifiers (SID), I bet at some point you thought that they were just "messed up things" or garbage or something like that?

well, they actually have a meaning, here's a full list:

Anonymous Logon (S-1-5-7): A user who has connected to the computer without supplying a user name and password.

Authenticated Users (S-1-5-11): Includes all users and computers whose identities have been authenticated. Authenticated Users does not include Guest even if the Guest account has a password.

Batch (S-1-5-3): Includes all users who have logged on through a batch queue facility such as task scheduler jobs.

Creator Owner (S-1-3-0): A placeholder in an inheritable access control entry (ACE). When the ACE is inherited, the system replaces this SID with the SID for the object's current owner.

Creator Group (S-1-3-1): A placeholder in an inheritable ACE. When the ACE is inherited, the system replaces this SID with the SID for the primary group of the object's current owner.

Dialup (S-1-5-1): Includes all users who are logged on to the system through a dial-up connection.

Everyone (S-1-1-0): On computers running Windows Server 2003 operating systems, Everyone includes Authenticated Users and Guest. On computers running earlier versions of the operating system, Everyone includes Authenticated Users and Guest plus Anonymous Logon.

For more information, see Differences in default security settings.

Interactive (S-1-5-4): Includes all users logging on locally or through a Remote Desktop connection.

Local System (S-1-5-18): A service account that is used by the operating system.

Network (S-1-5-2): Includes all users who are logged on through a network connection. Access tokens for interactive users do not contain the Network SID.

Self (or Principal Self) (S-1-5-10): A placeholder in an ACE on a user, group, or computer object in Active Directory. When you grant permissions to Principal Self, you grant them to the security principal represented by the object. During an access check, the operating system replaces the SID for Principal Self with the SID for the security principal represented by the object.

Service (S-1-5-6): A group that includes all security principals that have logged on as a service. Membership is controlled by the operating system.

Terminal Server Users (S-1-5-13): Includes all users who have logged on to a Terminal Services server that is in Terminal Services version 4.0 application compatibility mode.

Other Organization (S-1-5-1000): Causes a check to ensure that a user from another forest or domain is allowed to authenticate to a particular service.

This Organization (S-1-5-15): Added by the authentication server to the authentication data of a user, provided the Other Organization SID is not already present.

that's it! now you still don't know what they are because you didn't read this thing, but you have a reference that you can keep in your bookmarks