Josh Wieder

I recently worked on a Windows 2003 server that required manual reboots in order to login, whether via console or Remote Desktop. After rebooting, Event ID 1517 was logged repeatedly in Event Viewer (protip: this error could also appear as Event ID 1524 in Windows Server 2003, or as Event 1000 in Windows Server 2000). Microsoft explains this error in better detail than I can in KB article 944984 - essentially, user profile registry hives are kept in limbo after log off, and never completely terminated. Unfortunately, the hotfix described in the KB article didn't help. I don't administrate this server, I was just called in to fix the issue without breaking anything else. At this point, I know the administrator had an application in need of some coding assistance. I didn't have time to review every application's authentication behavior, though, and I am a novice developer at best. As an alternative to reviewing miles of code, I installed the User Profile Hive Cleanup S...

I am always looking out for new gimmicks to trick poor innocent souls on the internet into stumbling onto my website, so after countless prompts and notifications, I have finally broke down and activated a Google+ Account. I'm interested in showing authorship in my search results , and now I can be sure that at least the FBI is reading my blog . It's still a work in progress, but I am not sure what the point is after an initial inspection. MySpace was for 12 year old girls and awful bands. Facebook is for stalking your ex and so you in turn can be stalked by your government. Google+ ... what is Google+ for? I found some friends and coworkers and added them to circles. This was okay, and they always have some interesting things to say in the stream, but I found after a while that their comments were pushed underneath a bunch of posts by people I don't know about topics I don't care about. Here are a brief list of some of the random things added to my stream that I ha...

I have seen quite a bit of advice on the Internet that is unsound over the years, enough that I thought I am rarely surprised by idiocy. The video above though - this one made me laugh out loud. You know the video is going to be a gem from the title - "Apple Keyboard Secret That Apple Does Not Tell You". Anything with "The Secret That X Doesn't Want You to Know" is usually a window into the mind of a lunatic, and this does not disappoint. Give it a click - its only about 30 seconds long.

A few months ago, I wrote a post about websockets and IIS7 , explaining how some extensive hacking is needed to get websockets working and providing a link to an application that would accomplish just that. That post was very popular - Microsoft developers are obviously looking for ways to implement web sockets, and there is not a lot of documentation out there to assist them yet. With the release of Windows Server 2012, Microsoft is now including native suppor t for WebSockets. Unfortunately the 2008 hack (released by HTML5Labs) is now deprecated, and has been removed from the developer's website. Because there is so much interest, and no longer a fix to implement websockets in IIS7 that I am readily aware of, I am going to start putting together some information for developers here on IIS8. This post will just have the basics, and I will expand on the topic through later posts. To get started, it is necessary to enable the WebSocket Protocol Module. The module is available as a ...

Have you encountered error 0x84B30002 when uninstalling MSSQL 2008 R2, preventing the uninstall from proceeding? I have. So far I have only encountered the issue with Express Edition, although rumor has it that the error can occur with other editions as well. The error message will be displayed in a pop-up as well as the summary.txt log file in the installation directory. Here is how to fix it: Launch the registry editor by typing regedit in the Run bar in the start menu. Navigate to the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ After expanding uninstall, you will need to locate each key related to the SQL instance you are attempting to remove - if there is only one instance on the server, locate each key with the word SQL in the DisplayName field.  Within each key, locate the GUID. It will look something like this:  234A1B2C-12AB-1AB2-B1C2-A12B345678C1   and be typically contained in either the...

That Was Quick Italian security consultants ITSEC discovered the security hole following an analysis of the Unified Extensible Firmware Interface (UEFI), a successor to the legacy BIOS firmware interface, that Microsoft began fully supporting with 64-bit versions of Windows 7. Tip of the Hat to The Register, linked above.  [EDIT: The article specifies the payload as a "bootkit". This was deliberately omitted on my part. The word "bootkit" strikes me as part of that trend to modify prefixes of words to make them ludicrously specific, like how Watergate became EverythingUnderTheSun-Gate. Its a cheap way to feign familiarity through reference. Is there a relevant disharmony between the terms bootloader and rootkit I'm ignoring? If so feel free to shine light on my ignorance via email or in the comments.] Since we are on the topic of hardware hacking, last week I caught a printer spamming - as in, a printer that was network available that had been compromis...

I received a notification from a large security auditing firm that of the ciphers currently available, only RC4 ciphers will be considered PCI compliant. My assumption based on the notification is that this move is intended as a rejection of CBC (Cipher Block Chaining). Well, that's fine as far as I am concerned. CBC has some serious issues as implemented in SSL v3 / TLS v1.0. In a nutshell, you can time responses for applications using the block cipher to get ranges of possible data in SSLv3 and partial payload decryption in TLS. So-called "stream" ciphers like RC4 are immune to this particular attack vector. You don't get private keys from the attack, its by no means a fast attack (minimum of three hours), and you need access to monitor the session . Further, patches for CBC exist to over-ride the timing exploit (for example the NSS libraries used by Mozilla have been patched). I will save debunking the man in the middle hysteria for a later post. What frustrate...