Discussions

http://blogs.csoonline.com/windows_vista_90_day_vulnerability_report

February 28^th marked 90 days that Windows Vista had been available to business customers. Has it been a good or a bad 90 days for security vulnerabilities?

 


http://blogs.technet.com/security/archive/2007/03/21/windows-vista-90-day-vulnerability-analysis.aspx

http://gristmill.grist.org/skeptics 

Below is a complete listing of the articles in "How to Talk to a Climate Skeptic," a series by Coby Beck containing responses to the most common skeptical arguments on global warming. There are four separate taxonomies; arguments are divided by: Stages of Denial, Scientific Topics, Types of Argument, and Levels of Sophistication.

sure you can.  Every vista install dvd, eighter its a retail, upgrade or oem version,  contains the same wim image that is copied to the disk, and extracted.

(by the way, an in place upgrade is actually just a clean install. Your pervious settings/documents are copied to a temp folder before the image is copied to disk and extrcated. After that, the contents of the temp folder are copied to the new intall base )

The technology that is vista version dependable, is "opened or unlocked if you will" by the key given during install.

After intallling a vista version, you can use windows anytime upgrade, to upgrade/downgrade your windows install.

You can actually turn off UAC from the Vista GUI,

control panel --> user accounts --> turn user account on or off

and by the way...IE will not run in protected mode when uac is disabeled. 

And  if you have business, enterprise or ultimate editions, local group policy can be used to config the uac.
Secpol.msc --> security settings\local policies\ security options\ user account control

 

ZippyV wrote:

Do you have access to other editions now?

So yes I have, but there are a lot of cs students and professors that have not. 

I have an operating systems design course starting January 15th and it would be interesting to discuss the new Vista (kernel, IO, memory, PowerShell ) features along with it.

I have already been in contact with the PA at my uni.
She had no information about when or if Vista would be available. 

When will Vista Business Edition be posted on AA ?
According to a Microsoft employee, the due date were set to December 1th, buth nothing found on MSDN Academic Alliance Software Center yet..

shreyasonline wrote:



phreaks wrote: Who surfs as Admin? wtf

I do all the stuff as Admin... I am myself a hacker, and can identify any virus by just looking at it ! More over, I don't use any anti virus and still have no virus related problem in last 2.5 years ! I do use a basic firewall.

Shreyas Zare

sure, remember your bragging about you hacker capabilites in some previous postings..

Like the one you posted asking for advice on a good data data recover application.

http://channel9.msdn.com/ShowPost.aspx?PostID=217838

if you really are this hacker genious, you sure wouldent have posted such a question..

You would have a toolbox full of software for your disposal. You wouldent even have had time to be posting at channel9 because of your high paying security gigs all around the world. 

And if you were eating bits for breakfast, your would have created more advanced tools than the mac changer app that you have on your site http://www.technitium.com/

who are you trying to impress by this thread hijacking speaking of yourself in superlatives not seen since beer2 "ruled" channel9 ?

If you are that good..why dont you apply for a job at microsoft

http://members.microsoft.com/careers/default.mspx

http://www.microsoft.com/india/careers/search.aspx

 

so it depends on what kind of hashing algorithm you are using.

You can think of a hash like a factory...
you send you message in, and get som numbers back. You provide the numbers (hash) along with the message to your friend, and he sends the message to his factory, and get som numbers back.

He then compares his numbers with the ones provied from your end. If they are equal, then he can be resonably sure that the message
are original and not modified in any way.

In a security context, one normally sign the hash to make sure that
that they are not forged. And since the hash is only useful if you have access to the source data, ( you need to compare two hashes created from the same source), you might think that one can convert between different hash alorithms...

But the hash is created by inspecting the original message block by block, its a one way function...you can get the hash by inspecting the message, but you cant get the message by inspecting the hash.

If you culd get an unseen message from a hash ( what you actually must do to convert from md5 to sha1), or find two different messages with the same hash, then the hash function
is considered insecure.

in xp sp 2 there are access checks (ACLs) on all calls, activations or launches of your com components,  members of the everyone group has local launch, activation and call permission, + remote call. But only admins has remote activation and launch permissions.

so do you surf online with admin credentials ? bad boy[6]

after you have provided the correct credentials to log on to a xp
computer, an access token is created. It holds a description of the
security permissions for that user. Every process that runs under that users session, will contact the token and run under its secuirty context.

Thats why you get spyware installed on your computer when browsing online with an admin account.

Back to your scenario, when accessing the remote siste with the crafted url, a system call will lanuch under you admin credentials, allowing them to do anything.

You are basically owned