I thought I had updated

A few days ago, like many IT people worldwide, I received a distressed call from a friend about the recent Microsoft Internet Explorer issue that they had seen all over the media. What did they need to do? I told them that they had to run a Microsoft Update from their browser. Having never done this (first bad sign) I had to given them an idea of what needed to be done. They were much calmer now knowing what make then safe. After not hearing again from them after a few day I assumed all was fine.

I was actually visiting this same friend today so I thought I’d just take a look at their system to ensure that it had been updated. I was amazed to find that the machine was not up to date at all and in fact was still vulnerable. After starting the update process I quizzed my friend as to why they hadn’t updated. Their reply was “I thought I had”.

So what happened? In theory Microsoft Update is only for Microsoft to inform the user about patches that need to be applied to the system. That is UNLESS they haven’t installed Service Pack 3 for Windows XP! If that hasn’t been installed you’ll see a screen like this:

The top option, and the one most likely to be picked by unsuspecting users like my friend, is to install Windows XP Service Pack 3 and no other updates. So what happened is my friend pushed the top button, not reading the actual instructions on the page, as non-computer people do, and merely installed Windows XP Service Pack 3 on their machine and nothing else.

Was their machine still vulnerable? Yes. Were they likely to run another update? Nope. Chalk up another win for the bad guys. This time in my books it really is an own goal on Microsoft’s part. Sure Windows XP Service Pack 3 is important but it isn’t a critical update. Being the first choice on the screen it is what most users (who aren’t computer people) are going to select in their quest to be “safe” given all the hysteria. Microsoft updates should be for critical updates only and if you are going to put a message about a Service Pack make it the second choice. Microsoft, please remember, most people have no idea about technology.

Perhaps I should have told my friend to keep running Microsoft Update until there were no more updates. Perhaps they should have read the update screen more carefully. Maybe, maybe, maybe. Yet it only takes one maybe for an attacker to compromise a system. Once they get control, your only real option is to reformat and reload, today’s malware is just too sophisticated for any cleaning tool to deal with 100% effectively. To guarantee that your system is clean after an infection the only option is a complete reload. Who wants to do that? No-one but the odds are stacked in an attackers favour. Why? You need to defend your system against EVERY threat in Windows, Office, iTunes, Acrobat and piece of software you have installed on your machine. Not just Windows, the lot. An attacker only needs to exploit ONE SUCCESSFULLY and they can have control. So who’s got the better odds? It certainly isn’t you!

It further illustrates to me the divide between those that develop IT systems and those that use them. The void between the level developers believe users are and where they actually are is immense and getting bigger everyday. Wasn’t technology supposed to get easier? The reality is that is only getting easier for attackers to compromise systems. What does that say for a system we put so much faith in these days. Our common technology is built on very shaky ground, very shaky indeed.

How to crash SBS2008 (and Vista)

I came across a bug in Microsoft Vista that allows it to be crashed from the command prompt by simply typing a single command. Apparently, Microsoft don’t believe that it warrants enough emphasis to provide a patch. They say they will fix it in the next Service Pack (due soon).

I was then a little curious. If Vista and Windows 2008 (and therefore SBS 2008) are based on the same TCP/IP stack would I also be able to crash SBS 2008?

I made sure my SBS 2008 machine was up to date:

Firstly, I go to the command prompt as an administrator and type:

route add 1.2.3.4/240 4.3.2.1

[On my test SBS2008 server it did not always happen immediately but I could normally force the issue if it didn’t happen initially by removing the route via the command:

route delete 1.2.3.4

]

I then wait a few moments and

BAMM! Blue screen of death!

Sure, to actually execute this command on Vista or SBS2008 you need to run it from a console but what is to stop some enterprising person getting this to run on a victim’s machine? We all know users just love to click and install spyware. So even though Microsoft say it isn’t a big worry I’d be concerned, especially as there is currently no patch available.

Information about the Vista issue is here but ladies and gentlemen the same thing happens on SBS 2008 so beware. Roll on Service Pack 2.

My life with Hyper-V so far

It has now been about 6 months since I converted basically all of my CIAOPS infrastructure to a single physical box running Microsoft Hyper-V so I thought I’d give you a progress report.

In summary, everything has gone much better than I ever would have anticipated. Previously I had converted most of machines to Microsoft Virtual PC’s so I was part of the way there. Going to Hyper-V has greatly increased performance, reliability and flexibility. Converting from Microsoft Virtual PC to Hyper-V machines was relatively straight forward (once you remove the Microsoft Virtual PC additions). After a few configuration changes for network cards and loading of the Hyper-V client software everything was up and running.

Probably the thing I like the most about Hyper-V is when it comes to update time. I simply shut the virtual machines down and take a snapshot backup. I found that sometimes a Hyper-V machine freezes if you take a backup when it is running, so I now always shut them down. I boot the machines back up, install the patches, reboot again and if everything is working ok I delete the oldest snapshot backup. That way I always have a backup copy I can roll back to if there are issues.

Because my Hyper-V host machine is running a standard version of Windows Server 2008 I also need to update that from time to time but again I can either shut the client Hyper-V machines down or I can simply freeze them while I install updates on the host Windows 2008 server. All in all a much quicker and easier process than when I had to install updates on all my physical machines.

In a perfect world I’d run one Hyper-V machine for production servers and one for test servers, but alas that is currently not the case. So on the one Hyper-V machine I am also running Windows Server 2008 Premium (i.e. 2 servers) again without issues. I am extremely please that I can get all these machines (6-8 in all) running on one piece of hardware, which also saves a huge amount on power bills.

If you haven’t investigated virtual PC technology like Microsoft Virtual PC or Microsoft Hyper-V then I’d recommend you give it a serious look. It has greatly cut down my admin time as well as saving me on my power bills just to mention two things. There are some downsides like a lack of USB support but you can normally work around these and I fully expect these things to be supported in future releases.

So in summary, Hyper-V has proved a real bonus for my business and helped me do more with less.

Connecting to local drives in Virtual PC

When you run up a Microsoft Virtual PC chances are you are going to want to copy files from the host system on which the Virtual PC is running to the actual Virtual PC. This is possible by simply going into the settings for that Virtual PC and selecting the Shared Folders option as shown below:

If you then select the Shared Folder button over on the right you are able to select a local directory which can be mapped a drive letter on the Virtual PC. Perfect for copying files up and down.

It is not possible to use this option to connect a Virtual PC drive to a network mapped drive you may have on the local machine. It only works with drives that are local to the host machine on which Virtual PC is running.

Happy chappy

I’m proud to say that I’ve recently passed the SBS 2008 configuration exam and can add another Technology Specialist qualification to my CV.

SBS Course starts tomorrow

My Introduction to SBS course starts tomorrow at Macquarie Community College begins tomorrow. For more information or to enrol please go to:

http://www.macquarie.nsw.edu.au/index.php?action=course&course_action=detail&code=408M297

It is held over 3 weeks and will give you a better understanding about what SBS is and how you can achieve the best results from the product. You’ll learn how to set it up, configure and administer SBS. Although the course is focused on SBS 2003 there will be content covering SBS 2008.

So if you want to learn more about SBS I encourage you to attend.

SBS2008 Best Practices analyzer

New from Microsoft:

Windows Small Business Server 2008 Best Practices Analyzer

The Windows Small Business Server 2008 Best Practices Analyzer examines a server that is running Windows Small Business Server 2008 (Windows SBS) and presents a list of information and errors that administrators should review.
The Windows SBS Best Practices Analyzer examines the server and collects configuration information from many sources including:
• Active Directory Windows Management Instrumentation (WMI)
• Registry
• Metabase
After collecting information about server configuration, the Windows SBS Best Practices Analyzer verifies that the information is correct and then presents administrators with a list of information and issues sorted by severity. The list describes each issue and provides a recommendation or possible solution.

http://www.microsoft.com/downloads/details.aspx?familyid=86a1aa32-9814-484e-bd43-3e42aec7f731&displaylang=en&tm

Haven’t run it myself yet but will be doing it soon.