Freedom

Anyway, yes Holiday time in the very wonderful Isle of Wight. If you've got odd ASD children, you probably should be booking about now for one of next years Freedom Family week at East Dene. Why? a) Ventnor is a smashing little seaside resort. If you like walks, there are lovely walks there and back, or to Shanklin. b) The IoW railway will engage any train fiend, especially if you go all the way to the end of the pier, and it connects with steam trains if that's your bag. c) If you prefer to do nothing, the outdoor pool is heated, attended and open for hours a day. Most ASD kiddywinks and their siblings will play happily and tiringly in the pool for hours, and if they don't want that, there are activities most days. d) The air and views are conducive to a feeling of irrepressible well-being. e) It's catered. If you've been driven to self catering just to avoid the odd looks, it's amazingly wonderful not to have to hit the supermarket, look for pepper or whatever.

But none of that matters, because the real colossal advantage is is that however weird, badly behaved or just plain crazy your kiddies are, other children are crazier. Howls like a gibbon in the swimming pool? No problem. Unreliable judgement on wearing trousers? Don't we all. Turds on the staircarpet? Got to do it somewhere. True for all the other guests, true for staff. Amazingly relaxing, even if you're sleeping in a bunk and eating canteen food.

As a bonus you get to meet all the other odd children. Other people's kiddies are always more fun (because you get to hand them back) but this year I had the odd sensation that I was meeting children who were amazing. That's not a conventional wishy-washy feelgood disabled rights amazing, but absolutely fuck-off precocity and ability. Some were diagnosed, and some were slightly dodgy "we think he's all right" siblings. Amazing. I wish I could publish a list of names to watch out for because some of those kiddies are going far.......

Physical Security

I would have said there was nowhere in the UK, certainly in England, where you could run rocket engines for an orbital lifter without it being obvious to everyone around. It's all too small, and rockets are so very, very obvious.

Sucks to me then, because from the late 50's up until 1972, Saunders-Roe in Cowes managed strict secrecy while test firing assembled Black Knight and Black Arrow rockets right next to a tourist attraction on the Isle of Wight! Tucked away in a fold of Tennyson Down above the Needles Battery was a complete static test rig, with exhaust and cooling steam directed out to sea high above the cliffs. Less than a mile from the archetypical 50's tourist resort of Alum Bay, they kept their secret with nothing more than a wire fence, MoD police and a slightly deceptive line of sight.

Actually, there's one other thing you can only appreciate if you visit the site. The fantastic wind may not be louder than a rocket engine, but it would disperse it utterly.

This is all very fine, and the exhibition in the chalk bunkers of the new battery is well worth a look. But you have to be a real nerd to know that in Moonraker -- published in 1955 -- Ian Fleming had Hugo Drax, his nazi revanchiste, building and launching the rockets to destroy London from silos in the chalk cliffs between Dover and Folkstone. Fleming's intelligence contacts were the best: he must have known. Did the S-R security officer have kittens? Were there hard words exchanged? Was James Bond, of all people, responsible for a breach in national security?

Don't fear the Domain

This month has been packed with Windows servers not wanting to go in the Windows domain. Telephony servers, firewall management. And every time, the reason given is: it's more secure.

This reason is bollocks.

I can see the psychological justification: it feels like you are mixing your security sensitive servers with the common run. There is a sensation of "taint". But every time, it comes down to this: Domain membership lets domain admins do what they want with it.

The simple answer to this is that if you don't trust your domain admins you have your domain management wrong. And, more importantly, if you have more than one admin, the weakening of control caused by the shared user that will be used on the non-domain system substantially outweighs the possibility of a rogue assigning rights improperly. Let's be clear:

Not a Domain Member = Anonymous User IDs

Do you still want to be out of the domain. Really, what's possibly worse or less controlled than a shared user? Nothing!

The real agenda is designer/programmer laziness. If you don't plan to be in the domain, you can say that it doesn't matter if you run as an admin, so you don't have to worry about permissioning, you don't have to engage with Windows management and the whole thing becomes very much more like DOS. Which is of course what all programmers want.

There are still reasons to leave a server out of your production domain.

• Because it is especially exposed to compromise. Servers in the DMZ might fall into this category. This is why we put application proxies of various sorts, in the DMZ, in front of domain member servers which are inside the firewall.
• In theory, because the hardening requirements are incompatible with domain management. But if so, why are you running Windows?
• Because, by design, this is not an area for your administrator team. The only case I've ever seen is retention of administrator access logs, where admin access would rather negate the point.

I reckon that's the lot.

The Emir

I shouldn't really comment on terrorism, or trials -- GNUWin32 is more my schtick. But I couldn't help noticing that all the reports of the second July bombers trial called Muktar Ibrahim the "emir" of the plot, and helpfully translated that word as "ringleader" or "kingpin".

I just wonder how the Foreign Office would take it if the BBC started writing about the Ringleader of Kuwait...

More GNUWin32

Just a quicky. If you need to dump a raw disk on windows, you can do it with the GNUWin32 dd(1) program. But

dd if=d:

won't work. You need a little sprinkle of stardust with the device reference:

dd if=\\.\D:

seems to do the trick.

Colours

Light grey sky with a gentle mottle. At my feet, I can see green June grass, but looking across the meadow to the ragged black-green hedge, the colour is lost under the floating carpet of pure yellow buttercups and smoky lilac ryegrass tassels.

In the Raw

Just as a glimpse of on-the-fly development to satisfy investigation needs, here's a hack using James Macfarlane's Windows registry parser to get a timeline of registry key timestamps.

This is a source code module -- no DLLs -- and so even though I've never been able to get ActiveState PPM to install CPAN modules, it's easy to set up. Just download, open the package and drag the components into the corresponding directory locations under C:\perl. Why not use TieRegistry or something? Because we need this to work on "dead" files and the Windows API won't do that. The extra benefit is that this will run on Linux.

Only remaining frustration: there doesn't seem to be a timestamp on values as well.

use strict;
use warnings;
use Parse::Win32Registry qw( :REG_ );
my $time_fmt = '%04d-%02d-%02d %02d:%02d:%02d';

my $usage="$0: hive_file_name\n";
my $fn=shift or die $usage;

my $registry = Parse::Win32Registry->new($fn);
my $root_key = $registry->get_root_key;

my %keytimes=(); 

sub keyinfo
{
    my $key = shift or die "no key to recurse";
    my $nm = shift or die "no name";
    my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst)=gmtime($key->get_timestamp);
    $year+=1900;$mon++;
    my $ts = sprintf($time_fmt,$year,$mon,$mday,$hour,$min,$sec);
    $keytimes{$ts." ".$nm}=[$nm,$ts];
    my @subkeys = $key->get_list_of_subkeys;
    foreach my $subkey (@subkeys) {
        keyinfo ($subkey, $nm."\\".$subkey->get_name);
    }
}
# Main execution starts here
keyinfo($root_key,'.');
foreach my $keytime (sort keys %keytimes) {
    print "$keytime\n";
}

Dumphive and the unicode registry strings

The handy dumphive utility will list out registry and SAM files, but a lot of the content is left as unicode strings represented as octet sequences like this:

"\\DosDevices\\E:"=hex:5c,00,3f,00,3f,00,5c,00,53,00,54,00,4f,00,52,00,41,00,\
  47,00,45,00,23,00,52,00,65,00,6d,00,6f,00,76,00,61,00,62,00,6c,00,65,00,4d,\
  00,65,00,64,00,69,00,61,00,23,00,37,00,26,00,31,00,66,00,65,00,39,00,65,00,\
  35,00,63,00,34,00,26,00,30,00,26,00,52,00,4d,00,23,00,7b,00,35,00,33,00,66,\
  00,35,00,36,00,33,00,30,00,64,00,2d,00,62,00,36,00,62,00,66,00,2d,00,31,00,\
  31,00,64,00,30,00,2d,00,39,00,34,00,66,00,32,00,2d,00,30,00,30,00,61,00,30,\
  00,63,00,39,00,31,00,65,00,66,00,62,00,38,00,62,00,7d,00

Well, you can pick your way through that with an ASCII table, but here's a bone-headed script to get the gist out.

use strict;
use warnings;
my $av=join(',' , @ARGV) ;
foreach my $c (split(/,+/,$av)){
    if (my $a=oct("0x$c")) {
        printf "%c", $a;
    }
}

It would be cooler to read the blocks directly -- backslashes and all. Maybe next time. Anyway, all you have to do is figure out what

\??\STORAGE#RemovableMedia#7&1fe9e5c4&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

means.

GnuWin32 is the Shortcut for the Old and Feeble

I wrote about getting round the simple LUA bug in Steam. Essentially, the installer runs as an admin, which is fine, and it permits the entire installation directory to the admins only, which is not fine, because to use the app, you need write acces to at least some of the files. To get it working, and because the only documentation suggests that you have to be an admin to run steam, the simple route is to set permissions on that directory to Users/Full.

That's a bit of a challenge in XP on an isolated workstation, because the security tab is hidden, and on XP home, at least, it's hard to get it back. Last time, I bodged it with SubInACL. A bit like writing a program in COBOL to change the name of a file.

What I wanted to do was use chmod -- the Unix command. That's because I'm a crusty old fart, and it's hard for me to imagine anything easier than writing chmod -R a+rw "C:/program files/steam/" That may look involved, but the Windows command line equivalent, cacls, is way tougher and you have to use a different program to make it recurse. That's why I ended up with SubInACL.

I'm not the only person to prefer to work this way, but be stuck using Windows. (Because I am, OK?) A lot of people turn to CygWin -- a complete *nix environment hosted on Windows. That's good -- you get shells, utilities, compilers, familiar filing system, the lot, but the very compatibility makes it alien within Windows, and it's really too much of a commitment for me.

So instead, I move further back along the compatibility spectrum, and get to GnuWin32, and that makes me happy. Essentially I can download the stuff I want: grep, less, the core command line tools like ls and chmod, and OpenSSH without making a big production out of pretending to be on Unix. The working ports come as nice friendly installers and the only manual step is to set your path. Because it's not Cygwin, there's no issue using these tools alongside Activestate Perl, or Windows scripting. And the license is impeccable, of course.

Perfect? Almost. Some problems just can't be mentioned ("where's the GNU vi? Tee hee!") and some systems would suit me but aren't there. (I know RCS is obselete, but I don't want to learn SVN.) But GnuWin32 is part of the toolkit.

Quickest Compromise

Browsing round Ikea today I saw sales workstations left logged on to a Windows console, and that set me thinking. Our AUP requires users to lock their workstations on leaving them because the default screensaver lock of fifteen minutes is easily long enough for a malicious passer by to compromise the whole network, and I think that's fair enough. But I wouldn't have fancied standing in front of one of those screens trying to hack Ikea for more than about ten seconds. "Hey you..." So what's the quickest possible way to carry out an opportunistic compromise?

1. It's a real console -- a PC screen keyboard and mouse.
2. The logged on user is not an admin or a power user.
3. You can reboot (but not change a password), but the only boot device is the HD. USB, floppy etc. are all closed.
4. Internet access is through a proxy server running a business-access-focussed site category policy

Extra credit for universal applicability, and evading basic security precautions:

• ICAP server running signature checks on downloads
• No access to root of C:\ or anything other than the local profile
• Mo command line, regedit, ....
• Minimal profile in the event and proxy logs
• Hacked user can return to the console and notice nothing

I suppose the key points here are the exploit itself and the phone-home to control it. My mind is running to a binary exploit file, customised enough to pass signature checks, uploaded somewhere innocuous, and renamed after download to the desktop. The phone home is tougher.

Lunar Velocity

On Saturday evening there was a pretty but not unusual conjunction of Venus and the moon in the remains of the sunset. Venus made the apex of an equilateral triangle with the horns of the quarter moon, about 3 lunar widths east. Looking at the same time on Sunday, the moon had moved about a full hands span at arms length east in the 24 hours. I had thought it was faster.

Five nines

About four years ago, we were having trouble with the Group mail gateways, and I set up a half-hourly email to the helpdesk and some other support people to allow them to ensure that mail was being received.

I needed a platform that would be a lot more reliable that the Group gateways I was testing. So I put it on a box built from consumer-grade parts and a free operating system, with a power supply extended out of the house into a fifty-year old fuse box (real fuses) in a rat-infested shed which bakes in the summer, and literally freezes in winter. As you would expect, it's run reliably ever since, popping out the emails every half hour on the half hour.

(Perhaps there are some machine room management lessons here for us. But I hope not.)

Well, that issue is over now, and it was the last application on that machine, so I've shut it down to make room for the hydroponic cannabis farm which is the current fashion in rural enterprise.

Personal Service from Dawn's Rosy Fingers

Luscious pink sunrise this morning faded abruptly at 04:10 (GMT, natch). It felt as if it had been laid on for my benefit and switched off when I'd enjoyed it. Solipsism rocks.

Avarice

We'd come to the view that the more mad son had insuperable difficulty with arithmetic. We tried counting straws, counting up, writing dots, but the idea of adding just seemed to pass him by.

But lately he's been bringing home money work sheets. Ask him for the total price of a watch at 8p and a stick of rock at 4p (really) and he'll tell you. (Actually he got that one wrong, but normally he just stares a little up and to his left and pops out the answer.)

We should have known there'd be no fundamental problem. This is the boy who, still completely mute and detached, and still in nappies aged two, startled us late one night by ordering his magnetic numbers on the fridge door. I expect he just needed the money to give it some flavour.

Harvest Moon In May

The full moon rose at 21:20 or so last night, and it was the colour of the setting sun.