[SecurityRatty] tag: sp1

Internet Explorer security levels compared

Tue, 16 Sep 2008 20:19:36 +0000

A pretty good question came across the newsgroups the other day. Someone was asking what are the differences between IE's "medium" and "medium-high" security settings. I did some digging, and found only this on MSDN: About URL security zone templates. No wonder it's difficult to find -- the terminology is different, and the table is organized by URL actions, not by the text in the dialog.

Someone on the IE security team forwarded me a document that had additional details. So here, for your enjoyment, is a chart listing the default settings for each security level. To answer the newsgroup poster, "medium" and "medium-high" aren't the same.

About the formatting: to get it to fit within the width of the blog's text section, I've made some abbreviations.

Column headings

Entries

H	High	D	Disable
MH	Medium-high	E	Enable
M	Medium	P	Prompt
ML	Medium-low
L	Low

In a few cases, the table shows a number rather than D or E or P; below the table is a description of each such entry.

At the very bottom of this post I've included the settings from the privacy tab, too.

Note: these settings reflect those for Internet Explorer 7 on Vista SP1. Please see the MDSN link above for differences between IE 6 and IE 7.

.NET Framework

	H	MH	M	ML	L
Loose XAML	D	E	E	E	E
XAML browser applications	D	E	E	E	E
XPS documents	D	E	E	E	E

.NET Framework-reliant components

	H	MH	M	ML	L
Permissions for components with manifests	D	1	1	1	1
Run components not signed with Authenticode	D	E	E	E	E
Run components signed with Authenticode	D	E	E	E	E

1 = High safety

ActiveX controls and plug-ins

	H	MH	M	ML	L
Allow previously unused ActiveX controls to run without prompt	D	D	E	E	E
Allow scriptlets	D	D	D	E	E
Automatic prompting for ActiveX controls	D	D	D	E	E
Binary and script behaviors	D	E	E	E	E
Display video and animation on a Web page that doesn't use an external media player	D	D	D	D	D
Download signed ActiveX controls	D	P	P	P	E
Download unsigned ActiveX controls	D	D	D	D	P
Initialize and script ActiveX controls not marked as safe for scripting	D	D	D	D	P
Run ActiveX controls and plug-ins	D	E	E	E	E
Script ActiveX controls marked as safe for scripting	D	E	E	E	E

Downloads

	H	MH	M	ML	L
Automatic prompting for file downloads	D	E	E	E	E
File download	D	E	E	E	E
Font download	P	E	E	E	E

Enable .NET Framework setup

	H	MH	M	ML	L
Enable .NET Framework setup	D	E	E	E	E

Miscellaneous

	H	MH	M	ML	L
Access data sources across domains	D	D	D	P	E
Allow META REFRESH	D	E	E	E	E
Allow scripting of Internet Explorer Web browser control	D	D	D	E	E
Allow script-initiated windows without size or position constraints	D	D	D	E	E
Allow web pages to use restricted protocols for active content	D	P	P	P	P
Allow web sites to open windows without address or status bars	D	D	D	E	E
Display mixed content	P	P	P	P	P
Don't prompt for client certificate selection when no certificates or only one certificate exists	D	D	D	E	E
Drag and drop or copy and paste files	P	E	E	E	E
Include local directory path when uploading files to a server	D	E	E	E	E
Installation of desktop items	D	P	P	P	E
Launching applications and unsafe files	D	P	P	E	E
Launching programs and files in an IFRAME	D	P	P	P	E
Navigate sub-frames across different domains	D	D	D	E	E
Open files based on content, not file extension	D	E	E	E	E
Software channel permissions	1	2	2	2	3
Submit non-encrypted form data	P	E	E	E	E
Use phishing filter	E	E	E	D	D
Use pop-up blocker	E	E	E	D	D
Userdata persistence	D	E	E	E	E
Web sites in less privileged content zone can navigate into this zone	D	E	E	E	P

     1 = Prohibit downloads from software update channels
     2 = Cache content downloaded from software update channels
     3 = Automatically install software updates

Scripting

	H	MH	M	ML	L
Active scripting	D	E	E	E	E
Allow programmatic clipboard access	D	P	P	P	E
Allow status bar updates via script	D	D	D	E	E
Allow Web sites to prompt for information using scripted windows	D	D	E	E	E
Scripting of Java applets	D	E	E	E	E

User authentication

	H	MH	M	ML	L
Logon	1	2	2	2	3

     1 = Prompt the user for name and password
     2 = Automatic logon only in intranet zone
     3 = Automatic logon with current user name and password

Privacy settings (on the "Privacy" tab)

	H	MH	M	ML	L
Allow persistent cookies	D	E	E	E	E
Allow per-session cookies	D	E	E	E	E
Allow third-party persistent cookies	D	P	P	E	E
Allow third-party session cookies	D	E	E	E	E

Black Hat : Got2 Luv the H8ers

Thu, 07 Aug 2008 01:07:02 +0000

So, this afternoon, I'm in the Microsoft booth at Black Hat when this guy comes up (badge hidden of course) and starts talking to some of my colleagues. Right away, it was pretty obvious that he was antagonistic. I will refer to him as "h8er" from here on out. Though I am paraphrasing a bit, this is based upon a true story. It gave me a chuckle, so I thought I'd share.

h8er: So, how does it feel to work for a company that has made so many bad security decisions.

MSFT guy: Well, I feel lucky to be in a position to try and influence good security decisions going forward - are there any specifics you want to give me feedback on?

h8er: All those prompts irritating people, for example.

MSFT guy: Oh, so you don't like that aspect of UAC. We've gotten a lot of feedback on that, but the UAC security changes in Windows Vista encompass a pretty wide range of options designed to make it easier for most users to run as non-admin. Plus, we've incorporated some of the feedback into SP1 and I think it is a lot better. Have you tried SP1?

h8er:

MSFT guy: (still trying) Let me ask it a different way. A lot of folks have said that after the first few weeks, the UAC prompts tapered off, have you not found that to be the case?

h8er:

MSFT guy: What about some of the other changes in Windows Vista - I think the addition of ASLR, for example, was a good decision and raises the bars for attackers developing exploits.

non-MSFT guys standing nearby: He has probably never even tried Vista - I bet you run Linux and just heard the prompt stuff second hand.

h8er: I don't run Linux ... I run a Mac!

(NOTE: This seemed to rattle him, so he went on the offensive.)

h8er: Don't you feel embarrassed working for Microsoft knowing that 40% of your customers are infected with Malware?

MSFT guy: Actually, based upon research in the latest Security Intelligence Report, less than 1% of machines have malware and need corrective action - plus, recent research in the same report has shown that most of that is on older platforms and Windows Vista has an even lower incidence. 40% is a pretty high number, what source did you hear that from?

h8er:

(NOTE: Need a new tack, better try something different.)

h8er: Well, I feel a lot safer running my Mac and knowing the malware writers aren't targeting me.

MSFT guy: Oh, threat landscape is a different topic than the security of the software, but I can't really agree anyway. Many of the folks I talk to are more concerned about spearphishing or targeted attacks specifically against their valuable data. Recent data shows that Mac OS X has quite a higher incidence of security vulnerabilities that other comparable systems. That means that if an attacker did target them, he'd have a lot more options to choose from. In that case, I feel much more comfortable using or recommending Windows Vista than I would using your Mac.

He left shortly after that, but not before giving the Microsoft guy an invite to his company's party - I won't tell you which company it was, but it makes the story even funnier. To cap it, a few minutes later, one of the bystanders came by and said "so, did the Mac fanboy get tired of harrassing you and leave?"

Having lots of fun at Black Hat 2008 ~ Jeff

Symantec tool cleans up XP SP3 registry corruption

Fri, 06 Jun 2008 09:00:00 +0000

Symantec has released a free tool that clears spurious Windows' registry entries that had crippled some PCs running the company's security software after they were upgraded to Windows XP Service Pack 3 or Vista SP1.

June Patch Tuesday Advance Notification

Thu, 05 Jun 2008 11:49:31 +0000

On Tuesday, June 10, Microsoft will release 7 security bulletins, 3 of them critical, and security updates to address them. Microsoft's new advance notification bulletin format adds a very readable new view in the Affected Software section. For each operating system version you can see which bulletins are relevant and what the severity is. The bulletins now have English titles too: The three critical bulletins:

The Bluetooth Bulletin: Affects XP SP2 and SP3, Vista and Vista SP1
The Internet Explorer Bulletin: Affects all Windows versions. Critical on IE6 and IE7 on Windows 2000, XP and Vista; Moderate on Windows Server 2003 and 2008.,
The DirectX Bulletin: Critical on all versions of Windows and DirectX.

The other bulletins are entitled WINS, Active Directory, PGM (all ranked Important) and Kill Bit, ranked Moderate.

June Patch Tuesday Advance Notification

Thu, 05 Jun 2008 11:49:31 +0000

On Tuesday, June 10, Microsoft will release seven security bulletins, three of them critical, and security updates to address them. Microsoft's new advance notification bulletin format adds a very readable new view in the Affected Software section. For each operating system version you can see which bulletins are relevant and what the severity is. The bulletins now have English titles too: The three critical bulletins:

The Bluetooth Bulletin: Affects XP SP2 and SP3, Vista and Vista SP1
The Internet Explorer Bulletin: Affects all Windows versions. Critical on IE 6 and IE 7 on Windows 2000, XP and Vista; Moderate on Windows Server 2003 and 2008
The DirectX Bulletin: Critical on all versions of Windows and DirectX

The other bulletins are for WINS, Active Directory and PGM (all ranked Important) and Kill Bit, ranked Moderate.

Security Briefing: May 27th

Tue, 27 May 2008 09:30:44 +0000

Sorry for the lack of content yesterday. Due to a ~~PBCAK~~ failure to pay attention I neglected to ~~publish~~ write yesterday’s article. So, ~~they’ll trickle out over the next couple days~~ I’ll try to do better while Dave takes some time off to work on a personal project. Thanks to all of our new subscribers that joined us yesterday. Welcome!

Click here to subscribe to Liquidmatrix Security Digest!

And now, the news…

The Science behind 3-1-1 Mental Note - When flying this weekend, do not play the part of a vain astronaut.
DeCSS is now illegal in Finland Quick - jam the inflatable boat back into the travel pouch — Hurry!
Microsoft Whitepaper: Comparing Features - Windows XP SP3 and Vista SP1 smell the slow burn of a sweaty Ballmer
CFP (Computers Freedom and Privacy) Conference Roundup from Wired’s 27B/6 MmmmMmmmm… Cyberdyne me baby
RIM will not give Blackberry Keys to India Ahhh yes, but to which national governments (besides the Mennonites) have the boyz in Waterloo given the keys?
Elevator disables UAC on a per-application basis Do you want to Allow or Cancel?
Nottingham University Student Detained DWB (Downloading While Brown) from the US Gov’t - Go Directly to Secret Detention
President Bush Signs Landmark Genetic Nondiscrimination Information Act Into Law Gattaca… Gattaca… Gattaca…

More as I process it all (seriously, where the hell does Dave find the time for this every.single.day?)

Tags: News, Daily Links, Security Blog, Information Security, Security News

Microsoft backpedals on Windows updates

Wed, 30 Apr 2008 20:00:00 +0000

Earlier this week, Microsoft announced that it was delaying the release of Windows XP Service Pack 3 due to incompatibilities with its Microsoft Dynamics Retail Management software. Now comes word that Windows Vista Service Pack 1 has also been withdrawn from automatic distribution. According to Microsoft representatives, changes introduced in Vista SP1 affect how Microsoft's SQL Server database behaves in certain situations, potentially resulting in data loss or corruption.

Researcher finds new flaw in QuickTime for Windows

Mon, 28 Apr 2008 09:00:00 +0000

A rather tricky vulnerability in QuickTime could be exploited remotely to attack Windows PCs running Vista SP1 or XP SP2.

Microsoft releases remaining Vista SP1 language packs

Tue, 15 Apr 2008 20:00:00 +0000

Microsoft Tuesday released the remaining 31 language editions of Windows Vista Service Pack 1 (SP1) to Windows Update.

Microsoft fixes SP1 'repeating reboot' bug

Tue, 08 Apr 2008 09:21:49 +0000

Microsoft is resuming automatic distribution of a Vista Service Pack 1 prerequisite update that previously sent some users of the operating system into an endless reboot cycle during installation.