Many browsers patched prior to hacking event

Many browsers patched prior to hacking event

By Susan Bradley

One of the top draws at CanSecWest, the highly regarded Canadian security conference, is the break-the-browser contest known as Pwn2Own.

So can it be coincidence that Apple, Google, and Mozilla updated their browsers just days before the contest?

Yesterday was the start of CanSecWest 2010 in Vancouver, British Columbia. This year, a U.S. $10,000 prize sponsored by TippingPoint’s Zero Day Initiative (more info) goes to each white-hat hacker who’s the first to bring down Microsoft’s Internet Explorer 8, Mozilla’s Firefox 3, Google’s Chrome 4, or Apple’s Safari 4. Smartphones are targeted in the competition, too.

At this writing, environments that failed the test included Apple’s iPhone and three different browsers: Safari, Firefox, and IE 8 (with the attacker able to circumvent IE’s vaunted Data Execution Prevention), according to the ZDI Twitter feed.

The benefits for us from the contest should be more-secure browsers — before the conference and, probably, soon after.

Zero-day threat in Firefox is now fixed

Mozilla pushed out an update to Firefox on March 22, earlier than the March 30 date originally promised.

The release notes for version 3.6.2 state that the update fixes several security issues, including a zero-day bug described in a Mozilla security advisory — an exploit that could allow a hacker to take control of your system.

For Firefox 3.6 users, this should be a high-priority patch. If you stayed back on versions 3.5 or 3.0, you are not vulnerable to this particular bug — thus proving once again that sometimes waiting on an application upgrade is for the best.

Safari browser gets fixes before its big test

Historically, Apple’s Safari browser has been one of the first to fail in the CanSecWest contest, usually with an unreleased exploit coded by Safari vulnerability expert Charlie Miller.

So it’s perhaps no surprise that Apple’s March 15 Safari 4.0.5 patch, detailed in bulletin HT4070, includes several security updates.

However, TippingPoint lists several still-unpatched security holes in Apple’s browser, so I would not bet on Safari getting through this upcoming contest unscathed.

Google’s Chrome gets a bit more privacy

Just as outgoing U.S. Federal Trade Commissioner Pamela Jones Harbour took Google to task in recent FTC roundtable remarks for privacy violations, Google reported new enhancements to its Chrome browser.

A March 17 Chrome blog noted that more-fine-grained cookie settings were added to the current versions of Chrome. This includes the capability to allow or block cookies from specific sites. So if you’d like more control over the information about you a site keeps, do the following:

• Click on the tool icon in the upper-right corner and scroll down to Options.
• Click on the Under the Hood tab and then Content settings.
• Under the Cookies tab, you can block all third-party cookies, allow certain Web sites to set cookies, and use even-more-granular controls.

The Cookies tab also has a link to the Adobe Flash Player storage settings site, where you change privacy settings for the version of Flash used in Chrome. (See Figure 1.)

When I launched the Flash Player manager, it listed the Web sites I’d visited — such as British car-show site TopGear. It’s a reminder that these programs know a lot about your habits — merely by noting the sites you visit.

Figure 1. The application for changing Chrome’s Flash Player cookie settings is on Adobe’s site.

WS contributing editor Susan Bradley recently received an MVP (Most Valuable Professional) award from Microsoft for her knowledge in the areas of Small Business Server and network security. She’s also a partner in a California CPA firm.

Running a virtual XP machine in Windows 7

By Tracey Capen

The Windows Secrets Lounge goes well beyond just solving problems.

In the first post listed below, JoeP reports that Win7’s Windows Virtual PC mode no longer requires hardware virtualization, and he provides the links for applying this useful tip.

• XP mode virtualization change

  Interesting news almost always generates questions, as in this thread started by JoeP. Lounge member Byron Tarbox saw JoeP’s post about a Windows Virtual PC upgrade but ran into installation problems. Fortunately, JoeP had the answer. More»

• Is there a Quicken substitute?

  Whether to upgrade or try a different brand of software is a question as old as PCs. Lounge member BillWilson asks whether there is an alternative to Quicken, the most-popular consumer financial application. The suggestion from fellow readers is to upgrade what he’s used to. More»

• Daylight Saving Time change problem

  It’s hard enough remembering to push our clocks an hour forward every spring, but member Stephen47’s PC jumped two hours ahead and he wonders whether anyone could tell him why. Several Loungers offered suggestions, but the problem eventually corrected itself. More»

Interesting questions raised on the Lounge

For many PC users, Outlook is more than e-mail — it’s their desktop organizer. Member SDGardella is looking for help modifying an existing Outlook contact form.

• Add field to Outlook 2007 contact form
• Secunia and old Google Chrome versions
• Freecell game randomly freezes during play

If you’re not already a Lounge member, use the quick registration form to sign up for free. The ability to post comments and take advantage of other Lounge features is available only to registered members.

If you’re already registered, you can jump right in to today’s discussions in the Lounge.

The Lounge Life column is a digest of the best of the WS Lounge discussion board. Tracey Capen is technical editor of WindowsSecrets.com.

The sincerest form of feathery flattery

By Stephanie Small The old saw that imitation is the sincerest form of flattery can take many forms &#8212 someone who copies your dress, someone who copies your mannerisms, someone who steals your favorite catch phrases. But what if that someone has feathers and takes on a form of imitation that’s totally unexpected? Listen as this Australian lyrebird imitates the many sounds of local zoo construction. It might make you listen extra-closely to the little sounds around you! Play the video

Tips on working within Windows 7's Libraries

By Fred Langa Win7’s Libraries are a powerful organizing tool, but they’re not always the best option for accessing your files. For some kinds of file management, the old way — using Windows Explorer and working within the files’ true folder — is still the best way.

Working around a Library’s file-type actions

Like many others, reader Al Gingrich is learning the ins and outs of Win7’s new features, including Libraries.

• “I recently upgraded to Windows 7 and found that in the Pictures folder I could no longer arrange or sort the files by Type.

  “I currently shoot my photos with a DSLR in raw + jpg. To browse the photos, it is much easier if they are arranged by file type, as this allows me to browse the jpg files and then edit the raw versions, if I choose. I was able to accomplish this by right-clicking the Library window, going to Sort by, clicking More, and then scrolling down and checking Type. I then clicked OK, returned to Sort by, and selected Type. There seemed to be no way to apply the change permanently.

  “Solution: I right-clicked on the Pictures Library, went to Properties and then changed the Library type to Documents. After re-opening the Library folder, I clicked View and then Large Icons. The Library now behaves the way I want it to. I am able to arrange by type and it looks pretty much the same as it did before.”

Viewing files through a Win7 Library is an indirect way of getting to them. A Library is a kind of alias or false-front folder that lets you aggregate folders (and their files) from many places into one virtual folder. Files placed in a Library aren’t actually moved from their real locations. You can even have the same file appear in several Libraries without duplicating or altering the original file.

Although Libraries are great at collecting and organizing files on a large scale, they’re not always great for small-scale file management — such as changing file attributes. If you run into trouble accessing a file or its attributes via a Library, you might do better going back to Windows Explorer — all of the classic Explorer functions will work the way they always have.

If you really want to access all your files using Libraries, Al’s tweak can help: right-click each Library folder’s Properties menu and select the appropriate way to optimize each Library’s display for whatever file type the folder contains. (See Figure 1.) Different optimizations change the way files are displayed by default in the affected folders.

Figure 1. Win7 Library folder behavior can be “optimized” for different types of content via the Properties menu.

Windows makes different assumptions about how you’ll probably want to work with the files within a Library folder, depending on whether the Library is optimized for documents, photos, music, videos, or general use. For example, the default file view may change from Thumbnails to Details or Icons. So if you don’t see the view you want, try a different folder optimization. (Note: All folders in Win7 and Vista can be optimized in this way — it’s not just a Win7 Library feature.)

Changing Folder Options can also help ensure you have access to the file and folder attributes you need for a given task. Folder Options can give you finer control than the more-general “optimizations” described above. The item in my March 11 column, “What to do when Win7 won’t show file extensions,” discusses how to access and modify Folder Options.

For more on Win7’s Libraries, see Microsoft’s Windows Blog article, “Understanding Windows 7 Libraries.”

If you’d prefer a good, third-party explanation, try the TechTalkz.com article, “Windows 7 Library feature: understanding and use.”

Network connections lost after security upgrade

Bob Baker’s new firewall was so secure, he couldn’t connect to anything!

• “I’ve searched everywhere trying to find a resolution to this and am wondering if you could offer some assistance. I uninstalled Norton security suite and reinstalled a newer version of the Symantec suite. Since then, every time I try to connect to a wireless connection or a DSL wired connection via DHCP, it just stays on “Acquiring Network Address.” Both the wireless and wire LAN can’t acquire an IP address and there is no network connection.”

Whenever I encounter this kind of trouble (lost connectivity after a security tool change), I always suspect that the firewall is “protecting” the system too aggressively.

I suggest you temporarily uninstall your security tools and then try to re-establish your Internet connection. While checking your connection, make sure you go only to a few safe, known-good sites such as Microsoft.com, Google.com, etc. Don’t randomly surf the Internet, open e-mail, download software, chat, or do any other risky Web-related tasks while your defenses are down! All you’re trying to do is make sure you can connect to the outside world.

As soon as you know you’re reconnected, reinstall your security tools. When the tools set themselves up, they should see the live connections and configure themselves to properly allow them permanently.

Then, once your defenses are back in place, you can resume normal surfing, e-mail, and so on.

Make apps remember window size and location

Joe’s e-mail cites XP, but the problem (and solution) can affect any current Windows version.

• “I work as an assistant in the IT dept. of a company overseeing about 60 computers. The boss and I find your column to be a real help. We both were talking about how neither of us could find a good utility to remember different open window sizes and positions that we use frequently on the XP desktop. I’m sure others have the same problem and a solution would be of great interest. Any ideas?”

A Windows app that plays by all the official programming rules will remember its size and position when it’s properly shut down — and will re-open to the same place later. But, alas, not all apps hew this closely to the specs.

One sure way to properly shut down an app: Use the File/Exit or File/Close menu commands, rather than clicking the X-button in the upper-right corner of the window. Again, if the app is properly coded, closing via File/Exit or File/Close will let the app remember where its window was.

If you’re habitually stuck on using the X button to close apps, try this: press and hold Ctrl+Shift, and then click the X. Again, this will force a properly coded app to remember its window size and position for later reuse.

Most newer Microsoft apps are properly coded and can remember where their windows were via the above techniques. But third-party apps may not support this ability at all, and Microsoft’s support was definitely sketchier in years past. So, I’m sorry to say, there’s no “this will always work” solution.

For more information, the Annoyances.org site has a good thread on the subject of making apps remember their window sizes and positions.

Add a reminder to Windows’ shutdown sequence

David Schreiber wants Windows to remind him to remove his USB stick before his PC shuts down. The solution is easy and applies to Windows 7, Vista, and XP.

• “Before Windows shuts down for me, I’d like it to give me a reminder to remove my USB thumb drive. I’ve looked at one or two free applications that help, but Windows doesn’t like them and complains that I’m trying to shut down while a program is still running. I couldn’t find any instructions to help me write my own script.”

You picked a good time to ask, David, because some of the tools I’ve recently discussed in this column can do exactly what you want.

For instance, see my Feb. 18 article, “Wanted: easy desktop-shutdown options.” The shutdown.exe command (built into every copy of Windows) can display whatever shutdown message you desire, for whatever length of time you wish.

The following copy-and-run example of the shutdown command works on any normal XP, Vista, or Win7 installation. You can copy and paste it into a Start/Run, Start/Start Search, or Start/Search Programs and Files box; or you can put it into a batch file — all on one line, of course. It places a shutting down/disconnect USB drives dialog box on the screen and then shuts down the system (to full power-off) after a 30-second delay:

C:/windows/system32/shutdown /s /t 30 /c “Shutting down. Disconnect USB drives.” /f /d p:0:0

In Win7 and Vista, the resulting dialog box looks like the one shown in Figure 2. XP’s looks different but contains the same text and also functions in the same way.

Figure 2. It’s easy to customize Windows’ built-in shutdown.exe command to display whatever message you want and for whatever duration you want.

You can make the dialog box say anything you want (up to 256 characters) by changing the text inside the command’s quotes. And if a 30-second delay isn’t to your liking, change the 30 in the command to whatever value you wish.

For full information on shutdown.exe and its many abilities, see the article referenced above, which also contains links to documentation on using the command line as well as documentation on alternative tools.

You’ll have your shutdowns customized in no time at all!

Fred Langa is a senior editor of the Windows Secrets Newsletter. He was formerly editor of Byte Magazine (1987–91), editorial director of CMP Media (1991–97), and editor of the LangaList e-mail newsletter from its origin in 1997 until its merger with Windows Secrets in November 2006.

Tools for removing blur from digital photos

By Ian “Gizmo” Richards Just because a digital photo is poorly focused or blurred by motion doesn’t mean it’s a total loss. Low-cost and free software can rescue blurry photos, once destined for the recycle bin.

When a photo is more than just a photo

It was a tragic subscriber letter. A reader had lost her 18-year-old half-brother in a motorcycle accident while he was traveling in Puerto Rico. She had just one blurry digital shot of him as an adult, and she wondered whether there were any ways to improve the photo.

My initial thought was, no. But after a bit of research, I discovered two applications that could help — one reasonably priced, the other free.

Before you get the wrong idea, know that these programs cannot transform a totally smudged snapshot into a photographic masterpiece. What they can do is improve overall detail and sharpness, often turning an unusable photo into one that is quite acceptable. No computer software that I know of, however sophisticated, can raise the quality of a blurry photo to that of one that was sharply focused when originally snapped.

For my subscriber, acceptable was enough — the results were far from perfect, but good enough for a lasting memento.

Deblurring photos is not the same as sharpening

Almost every photo-editing application has a tool to sharpen digital images (for example, Photoshop’s Smart Sharpen filter, to name one of the better ones). None of these tools, however, is adept at removing the blur created when a subject moves or the camera shakes. That task requires a totally different class of software.

Modern deblurring software got a boost when scientists needed to fix the fuzzy images taken by the Hubble Space Telescope, which launched into orbit with a mis-shaped mirror. Obviously, repairing the digital images with software-based mathematics was cheaper than repairing the Hubble. While the results were insufficient for astronomical images, the mathematical concepts worked for other applications such as medical imaging, digital signal processing, and forensics.

Simply put, deblurring (or deconvolution) is the process of extracting information you want from a mash of digital data you don’t want. Think of trying to assemble a jigsaw puzzle from a box containing the pieces of several puzzles.

The process is easier if you know something about the information you want to remove — the size, color, and shape of the puzzle pieces, for example. Blurring created by camera shake has its own character that can be described and removed with software. An out-of-focus lens produces yet another kind of distinct blurring with its own unique characteristics.

The best results require experimentation

Each brand of deblurring software uses its own mix of image-processing techniques. While the quality of the original photo is important, the combination of the program used and the settings applied can make a huge difference in your results — from excellent to unusable for the same photo. If you are not prepared to experiment, then you’ll likely be disappointed with these apps.

• Focus Magic gave me the best overall results, as shown in Figure 1. The program’s toolbar lets you select whether the image blur was caused by poor focus or camera movement. If you don’t know which, simply try both filters and choose the one that gives the best results. (See Figure 2.)

  As mentioned above, deblurring requires lots of trial-and-error experimentation with the deblurring program’s settings — and Focus Magic is no exception. Thankfully, it has an excellent built-in help file plus a comprehensive tutorial on its Web site.

  Focus Magic 3.0 costs U.S. $45 and is found on its download page at Acclaim Software. You can run it as a standalone program or use plug-ins for image editing programs such as Photoshop and Paintshop Pro.

  
  Figure 1. Though not perfect, Focus Magic did the better job of removing blur. (Images from the Focus Magic Web site.)

  
  Figure 2. In Focus Magic, you pick the type of deblurring process — focus blur or motion blur.

• Unshake does not force you to pick the type of deblurring process. Instead, it analyzes the shot and tries to figure out the type of blur by itself. (See Figure 3.) This makes Unshake a bit easier to use than Focus Magic, but I was less impressed with Unshake’s results correcting my reader’s photo. (See Figure 4 for Unshake samples.)

  Unshake is a free deblurring program available as a download on the author’s site. Written in Java, the program should run on any platform with Java installed. I tried it on a Windows 7 machine with the latest version of Sun Java, and it worked fine.

  Installation is a bit more complicated than with Focus Magic — you unzip the downloaded file into a convenient folder and then run launch.bat. For whatever reason, I couldn’t unpack the zip file with my usual unzip app, WinRar. However, it unpacked perfectly using the free 7-Zip I downloaded from the 7-Zip site.

  
  Figure 3. Unshake analyzes an image and tries to guess at the best deblurring process.

  
  Figure 4. Deblurring with Unshake was not so good as with Magic Focus. (Sample images from Unshake’s Web site.)

An interesting side note: I discovered another use for deblurring software, after reading a user comment on the Magic Focus site. You can use these programs to sharpen normal, nonblurry photos that might look a bit soft. Surprisingly, my results using deblurring programs were often superior to those produced with standard sharpening tools — photos had a more-natural and less-etched appearance. If you’re a keen photographer, they’re well worth trying.

Ian “Gizmo” Richards is senior editor of the Windows Secrets Newsletter. He was formerly editor of the Support Alert Newsletter, which merged with Windows Secrets in July 2008.

Support clock ticking on XP and Vista versions

By Susan Bradley Microsoft’s support for Windows XP Service Pack 2 and the orginal version of Vista is ending soon. If you haven’t upgraded to Windows XP SP3 or Vista SP1 or SP2, now is the time to do so.

Time running out for Windows 2000 users, too

For any Vista users who haven’t installed a Microsoft service pack, April 13 marks the deadline for any future security updates. You’ll need Vista SP1 or SP2 to keep your system secure.

Lately, I’ve seen too many PCs still running Windows XP with Service Pack 2. As of July 13, 2010, these systems will no longer get security updates from Microsoft, according to a Windows blog post. Microsoft support article 322389 discusses the various ways you can upgrade to XP SP3.

July 13 also represents the final date of support for any version of Windows 2000. If you have mission-critical business applications that run only on Windows 2000, it’s time to look carefully at a migration path to a current version of Windows. Also, ensure that any PCs running 2000 do not have Internet access.

If you aren’t sure which version of Windows you’re running, do the following:

Click Start, type winver in the Run box, and press Enter.

MS10-017 (978471 and 978474)
Chinese script obscures spreadsheet patch title

Updates for Excel 2002 and 2003 can have indecipherable titles when viewed in Windows XP’s Add or Remove Programs utility, according to MS10-017 articles 978471 and 978474. (See Figure 1.) Fortunately, this has no impact on the patches’ effectiveness. To remove this cosmetic problem, uninstall the updates using Add/Remove and manually reinstall them.

For Excel 2002, go to the KB978471 download page. For Excel 2003, use the KB978474 page.

Figure 1. The inadvertent use of Chinese Simplified script makes the title of two Excel patches unreadable.

An application-patching tool in the making

After Google and Shavlik went their separate ways and stopped supporting Shavlik’s Google Patch Gadget, I’ve been looking for a replacement — a patch-management tool similar to Secunia’s. And I think I’ve found the candidate. Although it’s in beta and a bit rough around the edges, IT.Shavlik.com looks like a good match for anyone running home or small-office networks.

IT.Shavlik.com, an inventory and patching platform, lives in a browser but is able to scan your network. When I tested it on my LAN, it alerted me that my QuickTime player was dangerously out of date.

To run the program, go online to the IT.Shavilk.com home page and sign up for an account. (Note: Before running the scan, Windows 7 and Vista users may need to right-click their Internet Explorer icon and select Run As Administrator.)

For now, IT.Shavlik.com only scans. It cannot deploy updates, but it has a Fix IT button that promises this capability in the future.

My first choice for a patch-management system is still Secunia’s Online Software Inspector (product page), followed by the Personal Software Inspector (download page).

Flash endangers Facebook and other social sites

Last week’s Woody’s Windows story calling rogue antivirus programs the scourge of the Internet reminded me of a Kaspersky Lab interview with vulnerability researcher Charlie Miller, best known as a member of the team that won the first “Pwn2Own” contest at the CanSecWest 2009 security conference.

He stated in that interview “In general, you’re probably in pretty good shape to have a browser in Windows 7” — meaning that any browser on that platform provided adequate protection. But then he went on to say, “However, don’t install Flash, because at Black Hat DC [a recent security conference held near Washington, D.C.], it was revealed how to defeat DEP and ALSR [two protection technologies] in Windows by using Flash.”

Flash-based advertisements on Facebook, YouTube, and other social sites have become a popular channel for infecting systems. Uninstalling Flash is impractical for most computer users, but it’s relatively easy to keep Flash disabled, when it’s not needed.

Internet Explorer 7 and 8 users may consider a free (donations accepted) utility called ToggleFlash, available on the ToggleFlash site. The program puts a small icon on the IE toolbar — which you click to enable or disable Flash. One small flaw with the button: it doesn’t tell you whether Flash is currently active or inactive.

Another trap is social network notifications sent by e-mail. I’ve received or seen bogus instant messenger and Twitter links that tried to install rogue antivirus applications. (See Figure 2.) Recently, I received e-mails with an attached ZIP file containing a nasty Trojan, as noted by the virus-testing site, Virustotal. More and more, the bad guys are using social media to trick you into installing malware on your system. Don’t click blindly on e-mail links to your favorite social application. Instead, browse to Facebook directly and log in there.

Figure 2. This malicious e-mail looks like it came from Facebook, but it’s really an attempt to deliver malware.

Exchange 2007 gets another updates rollup

Exchange 2007 Service Pack 2 gets its third roll-up, as detailed in Microsoft support article 979784. The update includes patches for deadlocks, where one or more processes competing for the same resources block all processes from working. I’ve not seen this problem on the Exchange 2007 server I manage at my office, but I’ll certainly be testing and deploying this update as soon as possible.

Cleaning up the side effects of Office patches

Sometimes updates have problems almost no one sees. But I note them in case you’re one of the unlucky few. Here are a few Office patches that fit into this category:

• Microsoft’s Office Sustained Engineering blog details a side effect of patch KB977724 on businesses that deployed Office in a terminal server setting. (In this situation, Office runs on a server connected to dumb computer terminals.)

  If you installed the patch on such a server, Office applications crashed. The patch has been pulled and replaced with the hotfix described in article 980210.

• After installing patch KB977724 on a system with Windows 2000, Office 2003, and the Office Compatibility Pack, users in a Windows Update newsgroup reported they could no longer open .docx files. There is no workaround for this one so far.
• In a Microsoft Windows Live Partner forum, members noted that the update in MS10-017 (978382) had the side effect of preventing people from opening shared files. One workaround for this issue is to save and share a workbook at the same time.

The Patch Watch column reveals problems with patches for Windows and major Windows applications. Susan Bradley recently received an MVP (Most Valuable Professional) award from Microsoft for her knowledge in the areas of Small Business Server and network security. She’s also a partner in a California CPA firm.