Find your vulnerable desktop applications

02.03.2008

Many corporate and private computers have installed “standard” set of free programs and utilities which users use in everyday work. You use them for sure as well, Adobe Acrobat Reader, ICQ, Skype, Irfan view, Quick Time, iTunes, Firefox, plugins as flash, shockwave, Sun Java and many others. As it is usual, in every piece of non trivial software package is a hidden bug which just wait for discovery and if possible misuse with no exception for those above.

What is good that some of them have incorporated automatic patching function (like Adobe Acrobat, Quicktime, Firefox) but these mostly work only when logged as Admin and others don’t have anything. So after all its up to user to watch security lists like that in Secunia or just install every new version wherever available which is quite boring and nobody is doing it.

One nice option which is offered by danish security company Secunia for free. It is online (as Java applet) or offline (Secunia PSI) security scanner which “know” what vulnerabilities in what piece of sw is known and will tell you that. All the rest is up to user so he’ll install recommended new versions. Better once for a time than never. Self describing info can be found at http://secunia.com/blog/20/ which is telling that 81.01% of all Windows users that run Secunia’s security scanner had some piece of installed sw vulnerable to hacking.

So don’t wait, do a scan and patch, patch, patch as you do not want to become “privileged” member of botnet or do you? ๐Ÿ˜‰


Blat – command line SMTP client

26.02.2008

From time to time there is a need to send mails from command line. In Unix its easy but in Windows one of fine alternatives isย  Blat

Blat is a small, efficient SMTP command line mailer for Windows. It is the SMTP *sending* part of an eMail User Agent (MUA) or eMail client. As such, Blat sends eMail via SMTP (or internet eMail) from the command line, or CGI, …

lot of options, thorough output for debugging… but if you are hardcore IT, then read RFC 821 and telnet to TCP port 25 ๐Ÿ™‚

option reference here


Thinstall – another aquisition

17.02.2008

Just another very interesting acquisition. Vmware company – a big virtualization player – just acquired the Thinstall company, an application virtualization provider.

In their words the Thinstall technology – application virtualization – is:

“The Thinstall Virtualization Suite is a technology for virtualizing Windows software. Administrators do not have to install all applications on the workstation anymore โ€“ applications will be packed into a virtual environment, a sandbox, which contains all necessary information such as registry entries and applicationsโ€™ DLL files. Now, the virtualized software can be started from every workstation. After the virtualization, there is no need for a local installation, because all program routines are emulated in the virtual environment.”


Simply said: you have whole software package packed into a single exe file and that’s it. It can run with standard user priviledges, you can run two versions together etc. All in all it mean no pollution of OS via sw package installation and no difficult upgrades and patches.

You want to deploy a new Firefox to workstations? Easy. Just copy one file using startup script into a local disk or – and that’s easier – just update server side repository of “thinstalled” programs (they call it application streaming) and push a link onto user’s START menu.

If you want to try it straight away go to http://www.thindownload.com/ where they offer “thinstalled” free licenced software for direct download. My favorite Opera browser is there together with Firefox, Adobe Acrobat, ICQ and even huge iTunes.

Not to forget to mention, they were able to “thinstallize” even Internet explorer, Office etc. Wow!

I’m gonna to discover its internals soon. It would be nice – no difficult GPO installs and updates … ๐Ÿ™‚

Some nice flash demos are available here

update: I found they offer Thinstall suite for USD 5000. Ehm ehm …


Windows XP – end of sale

16.02.2008

Are you in same mood as me and do not want to push Vista into your corporate environment? Do not matter for what reason which might be higher hw needs of Vista, reliability and proveness of Windows XP, better hw compatibility, lazy to trash deployment images of XP and make new for Vista, expectable higher demand for enduser OS support of kind “where is that button” ๐Ÿ™‚ or whatever.

Then you should know that MS is going to cut XP sales to OEM very soon. As written here “Direct OEM and Retail License Availability (end date)” will end on June 30, 2008. So it mean if you’ll want to stay with xp after that date you’ll have to have volume licence (e.g. OLP start at 5 licences), buy Vista Business or Ultimate to be able to downgrade to XP (not sure if MS will allow this after the DATE.)

“Still, vendors such as Dell, Hewlett-Packard, Lenovo, Fujitsu, and more recently, NEC, all offer the opportunity to downgrade to XP pro.” PCWorld

These links have good info

What is also important is how long will MS provide us with security hotfixes. More info here http://support.microsoft.com/lifecycle/?p1=3223