.:Computer Defense:.

I've been a little quiet lately... mostly because thing have been hectic at both work and home.. but I figured I should at least make an appearance. I decided to provide a daily link list (something I haven't done in a bit) with some of the cool things that I found as I was reading blogs (which is a nice wind down to end a busy day)..

Freedom to Tinker, which is a really great blog, had an interesting article today on Diebold voting machines. It seems that Diebold members can order keys to the voting machines from their website... You have to be a member to do this... so no big deal right? ... Wrong... They also provide images which are more than sufficient to produce keys that can open the voting machines. The article provides details and a video on the reproduction and use of these keys.

Mozilla announced the release of Mozilla Thunderbird 2 Beta 2 today.

There's a small write-up on gotspeech.net on using Wireshark to debug sip... Nothing new if you've used Wireshark before but a cool application of the software for those that haven't seen it before.

The SBS Diva Blog, pointed me towards an interesting article on eWeek... although rant might be a better word than article.  The Author of this opinion piece cries foul because Windows Update installed IE7 on his computer... without his knowledge and it was impossible for him to uninstall it. The SBS Diva blog makes an excellent point that he had to agree to the EULA in order to install it... so I guess the question then is, "Can you blame users for "automagically" clicking through screens?"... I may answer that in the future.

I decided I wanted to see just what happened, so I jumped on my fiance's  Windows XP Home PC... Sure enough the January Updates had been installed (via Automatic Updates) yet she was still running IE 6.  Just to be sure, I logged onto Windows Update and took a look... I can see KB929969 (MS07-004) has been installed, as has the January Malicious Software Removal Tool... So, I look under updates... sure enough IE 7 is listed... and right next to it... a check box so I can decide if I want to remove it or not... I don't see Microsoft forcing IE 7 on her. In fact it looks like she has plenty of choice.

Now another issue mentioned was uninstalling it... Time to check my Windows XP Pro PC which is running IE 7... Control Panel --> Add Remove Programs --> Windows Internet Explorer 7... Highlight and click Remove. Now before the uninstall would proceed I was asked if I was sure I wanted to remove IE 7 as other software had been installed since its installation and it couldn't guarantee that software would continue to work if it was reliant on IE 7... and that's understandable.

The last issue is that the author of the eWeek article makes the argument that this doesn't belong in Windows Updates which is for Security Updates... Windows Updates is for updating Windows... I've seen Media Player, .Net and other Non-Security Updates there... I've even seen driver updates... IE 7 was listed as High Priority but not pushed onto users.. This makes sense to me... I would even go so far, as to argue that IE 7 is indeed a security update when you look at the new features it contains.

Now I'm off to reinstall IE 7 on my PC.

Lastly, I wanted to pass on this email from the WebApp Sec Mailing list:

The Web Application Security Consortium (WASC) is seeking contributed 'Guest Articles' by industry
professionals on the latest in trends, techniques, defenses, best practices and lessons learned relevant
to the field of web application security. Articles will be reviewed by our peer review team which will provide
feedback and suggestions, as well as be promoted and marketed by WASC. Article submissions and comments may be sent to articles_@_webappsec.org. 

That's all for now.

Peace,
HT