How to get a Process’ current security context – mystery and teaser…

…so I’ve crossed the threshold, and now I’m writing VB code in .NET 2.0.  It’s been a fascinating experience – going through fits and starts of trying to find a project motivating enough to keep me working on it through the inevitable “slump”.

For anyone who’s new to coding, and self-taught (like me), there’s the initial rush of being able to construct whatever it is your favoured “for morons” teaching book walks you through.  Then there’s the first tentative steps into adding something for which you don’t have stepwise instructions – which is just about anything else that might be useful – which is quickly followed by the frustration of knowing that you *should* be able to construct that next section of code, but having no idea why it doesn’t work the way you want it to work.

I’ve done this probably a half-dozen times, and every time I get discouraged that the damned code just doesn’t flow from my fingers.  I’ve been stymied by, in no particular order:

  • How to cast an Object to (as? into?) an Interface
  • How to use a GetEnumerator method
  • What the hell goes into a DataGrid
  • How to Dim an Object as something other than a String
  • When and where to define and instantiate an Object (e.g. inside the For loop?  outside the Private Sub?  Inside a Public Sub?)
  • How to write code in separate classes and still be able to take advantage of variables defined in the “other” Class

However, I think I’ve come up with sufficiently self-interested projects to complete at least ONE of them before I let myself fail at this AGAIN.

The latest fiasco was the last three attempts in which I’ve been trying to filter out only those processes that were launched in my user context (e.g. Run key, Startup folder, Start menu).  I’ve been failing to (a) identify an actual username from the info supplied in the System.Diagnostics.Process class, (b) construct an equivalent username to what comes from the My.User.Name property, and most recently (c) actually filter out the processes started in other users’ context (e.g. svchost.exe, wininet.exe, csrss.exe).

Here’s the current code mess I’ve constructed:

Dim process As New System.Diagnostics.Process
Dim dictionary As New System.Collections.Specialized.StringDictionary
Dim entry As New System.Collections.DictionaryEntry
Dim UsernameFromProcess As String = “”
Dim DomainFromProcess As String = “”
Dim Username As String = My.User.Name
Dim MyApplications As New Collection

dictionary = process.StartInfo.EnvironmentVariables

For Each entry In dictionary
    If entry.Key.ToString = “username” Then
        UsernameFromProcess = entry.Value.ToString
    End If

    If entry.Key.ToString = “userdomain” Then
        DomainFromProcess = entry.Value.ToString
    End If
Next entry

Dim QualifiedUserName As String = “”
QualifiedUserName = DomainFromProcess + “\” + UsernameFromProcess

If QualifiedUserName = Username Then
    MyApplications.Add(process)
EndIf

So why does this always result in adding the process to the MyApplications collection?  I woulda figured that the environment variables for processes started in other users’ contexts would reflect that user’s environment.  E.G. if csrss.exe starts in the SYSTEM context, then it should have USERDOMAIN =  [nul] and USERNAME = SYSTEM.  Whereas, when I launch Word from the Start Menu, its environment will include USERDOMAIN = REDMOND and USERNAME = mikesl.

If you’d like to see how I finally solved/worked around this little mystery, check out the CacheMyWork project on Codeplex.

Heading to Portland, Leaving Microsoft…

After five years living in Seattle (which my wife considers a pale comparison to Portland), Robin has been offered a kick-butt job at a really cool-sounding law firm in Portland, where she’ll practice tax-exempt and estate planning law.  Obviously we’ll be moving to Portland very shortly (in fact, in the next few weeks it looks like…)

That put me in the difficult position of considering whether to remain with Microsoft or venture out to new horizons.  Working for my current team (Security Accelerators – Security and Compliance) has been awesome, but it just can’t be done when not stationed on campus.  My next-best option would be to re-join Microsoft Consulting Services, but I don’t think I’m ready to go back to a delivery role after a few years of the intellectual rewards of working on the fringes of R&D.  I started my career at Microsoft in MCS Canada (take off eh!), and though I don’t regret those experiences, I’m more interested in making broad impact on the security of large numbers of individuals and organizations than go back to the one-at-a-time approach (not yet, anyway).

Looking around Portland, there’s a lot of high-tech opportunities but the big players are Intel and McAfee.  Against all odds, a really incredible job opening was available in a smallish, growing group at Intel.  Intel seems like a really interesting place to work, and the group I’m joining has their fingers in many pies: product pen testing, product security development lifecycle, product security consulting.  [I’m pretty sure I’m mischaracterizing their efforts but I’ll clear that up shortly.]

So yes, I’m leaving Microsoft and joining Intel!  For those of you that know me personally, this may come as a shock that I’m joining another international corporation (one good friend of mine thought I’d join a Save the Whales or militant tree-hugging organization – heh :), but it’s just too tempting to pass up: leveraging my past experiences in a new environment, learning a whole new set of technologies around hardware development, software & hardware programming, and stepping into a new role with new perspectives, leaders and fresh thinking – how can I beat that?

One of my colleagues asked me to start blogging about life after Microsoft (aka life in my new job), and I think I’ll take him up on that.  It should be fun to reflect on my new experiences, especially after so long in the belly of the Beast. 🙂

‘Embarrassed’ Gun Suspect Sues Microsoft After FBI Finds Sex Videos On His PC – Technology News by InformationWeek

You’re kidding, right?  This guy surfs for porn, bases a purchase decision on his need to surf for porn anonymously, and then sues Microsoft when he (inevitably) gets caught?  I know there are many folks out there that don’t understand the difference between “delete” and “wipe all traces”.  I’ve had to explain this to countless folks who want to understand how to actually protect their data from snoopers and thieves.

However, I’ve rarely known anyone with “questionable” surfing habits – and especially those who know their habits are questionable or at least embarrassing – to not investigate deep into the computer to make sure there are six ways from Sunday protecting them from unaware spouses, curious kids and wary employers.

What you do in the privacy of your own computer is your business, and I’m hardly condemning this guy for his legal and not-uncommon activities.  Still, he needs to cash a reality check if he has some expectation of privacy from law enforcement officials when he’s relying only on “automated delete” features of any piece of software.  There’s tons of discussions, web sites and vendors hawking cheap/strong/free encryption products, disk wipers, “trace erasers” and the like.

It’s no coincidence that Zimmerman’s PGP stood for “Pretty Good Privacy” – if you want to keep something to yourself, you’d better lock it behind a reasonable key and not leave the kitchen window wide open.

Heck, at least try some of the in-box encryption technology, before you go laying blame at Microsoft’s feet.  Then you’ve got at least a toe or two to stand on…

Link to ‘Embarrassed’ Gun Suspect Sues Microsoft After FBI Finds Sex Videos On His PC – Technology News by InformationWeek

Focused Thieves looking for payoffs in the Enterprise

I’ve been afraid of this for years… it’s amazed me that the people capable of writing worms, trojans and rootkits weren’t using these skills for financial gain.  The whole concept of ILoveYou and Nimda just creating denials of service was almost disappointing in a way.

Not that I minded having to deal with these temporary outages rather than real permanent damage.  It was nice to have a few more years to get our s*** together…but now it seems that the damage potential of these attacks has finally caught up with us.

I’ve been hearing from colleagues of mine for the last couple of years that there have been an increasing number of “stealth” attacks that have been both (a) much more focused and intelligent, and (b) much more damaging or criminally motivated.  I’ve been pretty jaded at all this “cloak and dagger” storytelling – it always reminds me of the folks who want you to believe they know something you don’t, and keep teasing you with the “big secret”, but are mostly full of crap.  Or all the folks with backgrounds in information security in the military – talking all the time about how crazy the threats are that they faced, but always stopping short of actually providing hard evidence – or even just believable stories – to back up these claims.

It’s not that I didn’t believe there wasn’t a growing criminal, financially motivated element to the information security threats.  However, it’s been difficult to gauge the likelihood/frequency of such threats, and I’ve been concerned with helping my customers address the prevalent threats that actually manifest on a regular or inevitable basis.  It seemed like a series of edge cases – fascinating technical issues that don’t affect most organizations, and the greatest impact on most customers was distracting them from focusing on the fundamentals.

Well, I’m becoming convinced that we’ve crossed an inflection point.  Stories like this are coming up more and more, and making it sound like there’s a significant proportion of security attacks that are taking on these criminal, financially motivated motives.  I really wish I could continue to believe we’re still living in the era of “flickering lights”, but it’s starting to feel like we’re entering the era of “smashing lightbulbs”. 

Link to Info Thieves Take Aim at the Enterprise

Vista’s IPv6 & IPv4 will flood Internet DNS servers?

I’m surprised Steve Gibson isn’t leading the charge on this one:
http://slashdot.org/articles/06/09/07/1441204.shtml

I can’t believe that Vista’s side-by-side IPv4 & IPv6 stacks would cause the entire Internet’s DNS infrastructure to fall to its knees in agony. Were this true, I gotta figure the whole lofty goal of converting the Internet as a whole to IPv6 is a doomed prospect.

To me, the addition of the IPv6 stack to Vista will create the most likely opportunity for smooth transition over to IPv6. If the DNS infrastructure – which must’ve anticipated IPv6 for years now – can’t handle a slow, gradual influx of Vista clients making queries and submitting update requests, then we’re all in a lot more trouble than people are letting on.

Windows Vista’s Full Volume Encryption & TPM, part 6: more oddball TPM 1.2 links

Semi-random links to information I’ve used as reference for some of my rambling thoughts…

Whew! Now back to your regularly scheduled surfing.

Recent Articles on Data Security

Summaries and comments on some [not-so-] recent articles that caught my attention…

It’s Audit Time. Do You Know Where Your Private Data Is?
http://www.securitypipeline.com/shared/article/printableArticleSrc.jhtml?articleId=170102445

  • data encryption is becoming more commonplace, especially on mobile devices
  • “full disk encryption” is fashionable, but the security of that encrypted data depends heavily on key management and authentication
  • A little more user education on “physical security” can help avoid the risks for which encryption is layered on thick and gooey
  • “California’s Office of Privacy Protection issued a clarification [of CSB 1386] that defined encryption as AES, the government’s official encryption system.”

Commentary: I’m in full agreement that “full disk encryption” is the easy answer to multiple regulatory burdens, and that key management (i.e. being able to recover lost or damaged keys – to be able to recover the data) and authentication (i.e. strength of the authentication that stands between the keyboard and the decryption keys) are vital.

If you encrypt your whole disk but have no way of recovering if the disk sector [or TPM storage location] where the keys are stored is damaged/erased, then chances are you’ll lose legitimate access to the data more often (user frustration) than you’ll grant illegitimate access to the data (data exposure).

Sure, the AES clarification in California isn’t legally binding, but any organization that ignores this now (especially with wide availability of AES encryption technologies – e.g. RMS, EFS in Windows XP SP1, PGP, Pointsec) would be more than foolish – in my mind, they’d be deliberately negligent [obligatory “IANAL” hereby stated].

[Note: the article is incorrect about which versions of Windows support AES in EFS – EFS uses the AES algorithm only in Windows XP, and AES is the default only at SP1 and later.]

Study: ID Theft from Data Breaches Rare
http://www.betanews.com/article/Study_ID_Theft_from_Data_Breaches_Rare/1134148338

  • Press release regurgitation: analysis and findings from a vendor of risk management technology

Commentary: in the “department of duh” category, not all security breaches involving identity data (credit cards, passwords, social security numbers, account numbers) resulted in massive identity theft.

US moves forward on data privacy
http://www.theregister.co.uk/2005/11/25/us_data_privacy/

  • Proposed Federal law not only mandates data privacy and security – but also requires oversight of outside organizations you pay to handle/manage/process that data
  • Mandatory notification is required as well
  • Penalties for non-compliance include significant fines and possible jail time for willful disregard
  • Also mentions two additional pieces of legislation cooking: the “Identity Theft Protection Act” & the “Data Accountability and Trust Act”

Commentary: about freakin’ time.

Bonus article!!
Q&A: ETrade CIO calls token-based authentication a success
http://www.computerworld.com/securitytopics/security/story/0,10801,106305,00.html?source=NLT_PM&nid=106305

Commentary: “success” is measured in the interviewee’s first answer: customers who have adopted the SecurID token for access to their ETrade accounts “are therefore willing to move more assets to us.” Security is not useful if it doesn’t positively affect the core business.

Do you have more interest in strong authentication issues? Hit the site http://www.secureidnews.com/.

Windows Vista FVE in the news

http://archives.seattletimes.nwsource.com/cgi-bin/texis.cgi/web/vortex/display?slug=bizbriefs20&date=20051220

The enterprise edition of Vista will have a feature called “BitLocker” that can encrypt systems that have an optional security chip.

The feature debuted Monday on a test version of Vista that Microsoft released to get feedback from software developers and customers.

“So essentially if a machine is lost … it renders it useless to whoever steals it or takes it from them,” said Shanen Boettcher, a senior director in the Windows group.

Commentary: This further supports the idea that FVE will only be available to those customers who license the Enterprise edition of Windows Vista. Will this be available to the consumer? I would suspect not, based on Microsoft’s history and its planned set of SKU’s:

  • the Enterprise editions of Windows (2000, 2003) in the past haven’t shown up on the shelves of retail stores
  • What with plans for SKUs such as Windows Vista Home Basic, Windows Vista Home Premium and Windows Vista Ultimate – all presumably oriented for the consumer market – I personally doubt there’ll be room in the OEM lineups for a fourth SKU directed at their consumer market.
  • Previous rumours indicated that the Vista Enterprise edition will only be available to Microsoft customers who have signed up for (the not inexpensive) Software Assurance plan, which is definitely not something consumers (or even small/medium-sized businesses) can usually afford.

However, I feel obligated to point out that the (obviously out-of-context) quote from Shanen Boettcher seems pretty misleading/overreaching in its current form. If I’m interpreting correctly, the “BitLocker” feature is nothing more than Secure Startup (SSU)/Full Volume Encryption (FVE).

While SSU does make it more difficult to discover on-disk secrets and sensitive data files, its mere presence or default configuration hardly makes the machine or its data “useless to whoever steals it”. So long as the disk contents remain undisturbed, the simple configuration of SSU will allow Windows to boot up and allow an attacker to attempt to access its data (e.g. via console logon, network logon, shares access, unpatched vulnerabilities, previously-installed malware, or other as-yet-unimagined attack techniques).

Seems it’s time to discuss the Full Volume Encryption technical whitepaper that’s available for download – make sure we’re all understanding it the same way (or not), and raise the obvious questions worth asking.

I’ve UnDeparted from Microsoft

I’m back, baby!

Due to my recent un-departure from Microsoft, I am now employed again full time, and so far I’m loving the new job!

I’ve willingly rejoined the Borg as a Technical Program Manager on the MSSC (Microsoft Solutions for Security and Compliance) team. I’m once again on campus in Redmond, but this time (cf. my previous career as a member of MCS) I’m not relegated to one of the “satellite” buildings; rather I’m stationed (with the rest of the team) in Building 18 – right on main campus!

The past eight months away from Microsoft has been one amazing vacation, disconnecting from the non-stop email, the petty politics and my growing unease with how little I felt I’d accomplished in five years there. I spent much of that time playing with the dogs (a good thing), getting to know my wife (a very good thing) and teaching myself firsthand that I can survive post-Microsoft. Hopefully I’ve cleared out many of my demons, my fears and my old habits – on to a new and revitalized career.

What will I be doing as a TPM? Well, the MSSC team makes it their mission to develop and deliver “solutions for security” – sometimes humungo series of papers/recommendations/technical knowledge, sometimes focused white papers, sometimes “push-button” apps that solve problems outside the scope of traditional product development. Based on my expertise in data security (& peripherally around data protection), I expect to be contributing to security solutions that help Microsoft’s customers’ data more secure. I don’t know exactly what this means, but I know that it’ll involve a lot of technical depth in technologies like EFS, RMS and Vista’s Secure Startup/Full Volume Encryption. [I’ve only been on board for a couple of weeks, so beyond that only time will tell.]

Anyone out there with any gripes, concerns or ideas for improvement in these and related technologies? You’re more than welcome to drop me a line and I’ll see if I can’t carve out some time to hear you out. With any luck, in my new position, I’ll be able to get good ideas directly into the ears of those who develop those products. How’s that for service? I dare you to suggest something radical to me. 🙂

[Note: this means that from here on, and of course for all posts up to this point, my one nod to the corporate machine is to state for the record that everything I write here is the result of my own personal opinions and cannot be construed as the “official Microsoft stance” on anything, nor can my ramblings be ascribed to my employer in any form or fashion. Everything here should be taken “as-is” (although certainly I believe there’s merit in my leavings), and YMMV. Now go forth and enjoy it!]

Windows OneCare + VPN connections: manual configuration, with no warning?

I thought I was going nuts I tell ya. I’d been a Microsoft VPN end-user for years, and had even administered an MS VPN infrastructure back in the dark ages of NT4. I’d used the MS VPN client (aka “Connection Manager”) in all kinds of network environments and under the whole spectrum of security conditions, and I’d never been denied like I was denied this weekend.

Blame it on Windows OneCare I say – no, wait, that’s not fair – can’t blame it on a beta product. Heck, I guess it was my own fault for putting a beta product in production, eh? Live and learn. Hopefully this tale will help you avoid the same hair-pulling foolishness.

So: Windows XP Professional SP2, Toshiba Tecra M2 notebook, MN-700 802.11b/g wireless router, Comcast broadband service. I’d configured the MS VPN client connectoid for default settings, filled in the appropriate authentication details, and couldn’t complete the connection. The client would connect to the VPN server, and would count approx. 33 seconds while attempting to authenticate my credentials, and just kicked me out.

According to all the googl’ing I did, all suggested solutions revolved around configuring port forwarding on my wireless router. I hadn’t had to configure the router’s network settings for a year or so, and I’d had to reset the firmware once this summer, so while I didn’t think this was the problem, I certainly wasn’t sure. I certainly did know for sure that the Windows XP SP2 firewall would allow any outbound communications, and would allow back any responses to requests initiated from the computer, so I really didn’t think about it any further.

I diddled with the router’s configuration a few different ways:

  • I tried to find the setting in the Connection Manager software that would allow me to override the automatic protocol selection, but despite my best efforts, it’s been well-hidden by the good folks in our IT department who setup this well-designed end-user configuration.
  • I forwarded 1723/tcp, 1723/udp, 1721/tcp, 1721/udp, thinking each time I added one, “Well maybe I’ve just forgotten my protocol settings – I’ll just try one more”.
  • I forwarded 500/udp, since one article reminded me that IPSec NAT-T (NAT Traversal) worked over 500/udp.I used dynamic forwarding; I used persistent forwarding (I ifgured dynamic was sufficient, since the router would detect my requests, but after that failed I figured persistent *had* to work. Nope.)
  • I finally configure the virtual DMZ to point to my computer’s IP address. I’d avoided it to this point since it would remove most protections the router afforded from my PC, but at this point I was getting desparate.

No dice. That’s when I finally gave in, and despite my better judgment (I’d NEVER had to do this before), disconnected the wireless router and connected the computer directly to the broadband “modem”. When I couldn’t make the connection even then, I knew the problem wasn’t with the port forwarding…

I finally had another look at the Windows Firewall configuration, and this time I really wondered why it continually reported that the firewall was “Off”, even though it also said that “For your security, some settings are controlled by Group Policy”. Did our IT group really disable the Windows Firewall on us through GPO? If so, what was it they were using to secure our systems? I knew I hadn’t installed any third party firewall like BlackIce… [oh hell. That’s right.]

That’s when it finally dawned on me to dig into the Windows OneCare software. Now, when I look at the client, there’s nothing that jumps out at me related to Windows Firewall – the three main blocks of reported info in the main window are “Protection Plus”, “Performance Plus” and “Backup and Restore”. Buried in the middle of the Protection Plus category is a single line simply labelled “Firewall: Auto”, which had until now escaped my attention.

I engaged my brain and chose the “View or change settings” selection, then grabbed the Firewall tab and hit the “Advanced settings…” button. While you can choose either “Program List” or “Ports and Protocols” to enable new exceptions in the OneCare firewall, I knew that there was no typical executable that uniquely identifies the VPN client connectoid, and thus it’d be difficult to nail down an .exe to add to the “Program List”.

Turning to the “Ports and Protocols” list, I finally had a stroke of luck. There appears to be a default configuration already set up for the “GRE” protocol – IP protocol 47, the control channel used by PPTP. I simply added another exception that I named “PPTP”: Protocol TCP, Port range 1723 to 1723, and retried the VPN client.

Of course it went through immediately.

I assume this’ll help any of those of you who are also running the beta of Windows OneCare Live, but I hope this’ll be made easier for folks by the time this releases. I’ll file a bug on this and see if the OneCare Live folks can’t help automate this somehow – if I got tripped up by it, I’m sure there must be others who’ll also be stumped.

Epilogue: I haven’t bothered to check which of the router configurations are still necessary once the OneCare firewall was properly configured. It may be that the DMZ setting is still needed, or perhaps the MN-700 actually does tranparently forward MS VPN traffic correctly (as I’d originally expected). Let’s leave that as an exercise for the class, shall we? Until next time…

[category: general security]