Author: Adam Fowler

More LinkedIn Security Risks with LinkedIn Intro

LinkedIn have just announced a new way they’ve engineered LinkedIn user information into the native iOS mail reader. Have a look at the article here: http://engineering.linkedin.com/mobile/linkedin-intro-doing-impossible-ios#!

In principal, this is an interesting idea – it’s what CMS (Customer Management Systems) have been doing for a long time, which is integrating a database of users/companies into your emails so at a glance you go from email address to user profile to company all in the one spot.

From a user perspective, this is quite neat. Seeing where someone works as part of the email, their job title, other connections saves a lot of time and brain energy when they’re thinking ‘who is this guy?’ – but from a security standpoint this is bad.

LinkedIn’s whole quote on the privacy aspect of this is:

Security and Privacy

We understand that operating an email proxy server carries great responsibility. We respect the fact that your email may contain very personal or sensitive information, and we will do everything we can to make sure that it is safe. Our principles and key security measures are detailed in our pledge of privacy.


That doesn’t say much, apart from ‘Come on.. trust me!’. Firstly, you’ve got to give LinkedIn your email password. Check my previous article as to why this is bad: http://www.adamfowlerit.com/2013/06/02/linkedin-securityinformation-risks-with-exchange/ – a pledge of privacy isn’t going to help you after a catastrophic event.

So, this method is actually worse again. All your emails traverse via LinkedIn’s proxy service, the email gets modified then delivered to your iOS device. Emails are insecure by nature as they traverse the internet in plain text format (excluding things like PGP and other encryption methods that most people/companies don’t use), but having them centrally filtered via a 3rd party means you’re giving them a truckload of information about yourself, who you deal with, your email habits and so on.

Would your company be happy with a 3rd party that you have no agreement with, receiving and forwarding on all your emails? Even if the emails aren’t stored, if LinkedIn was breached again (which they have been before, multiple times), other people could obtain anything from your contacts, to your password and email contents.

oAuth is supported too, which is a safer approach as it can be revoked – but you’re still giving the same level of access while the connection is approved.

Luckily for Exchange administrators, that doesn’t seem to be supported yet according to https://intro.linkedin.com/micro/faq but for Google Apps people, you’ll need to look into how this can be blocked if you want to. If you’ve found out how, I’d be happy to add it to this post.

Update: There is a great writeup from Bishop Fox on several great reasons as to why this is a ‘bad idea’ http://www.bishopfox.com/blog/2013/10/linkedin-intro/

SCCM 2012 R2 Upgrade Breaks Report Builder

Hi,

Just a quickie. After upgrading System Center Configuration Manager 2012 SP1 to R2, I could no longer create a report in the console. The error you see when clicking ‘Create Report’ is “The Report Builder click-once application does not exist on the report server ‘blah.server.com’. Ensure that the report builder application manifest exists on the server and try again.”

It DOES exist, just that the R2 upgrade changes a few settings.

This is actually the same issue when SP1 is installed, with the exact same fix. The full details are on this technet article: http://blogs.technet.com/b/smartinez/archive/2012/07/03/system-center-2012-configuration-manager-create-report-don-t-work-what-do-i-do-now.aspx but the brief two steps to perform on your SCCM/Config Manager server are –

1. Change the registry key “HKEY_LOCAL_MACHINE/SOFTWARE/Wow6432Node/Microsoft/ConfigMgr10/
AdminUI/Reporting/ReportBuilderApplicationManifestName” from the value “ReportBuilder_2_0_0_0.application” to “ReportBuilder_3_0_0_0.application”

2. Edit the file
“C:\Program Files (x86)\Microsoft Configuration
Manager\AdminConsole\bin\Microsoft.ConfigurationManagement.exe.config” and change the 2 to a 3 in the two areas:

 

Before
<add key=”10.0″ value=”ReportBuilder_2_0_0_0.application”/>
<add key=”DEFAULT” value=”ReportBuilder_2_0_0_0.application”/>

After
<add key=”10.0″ value=”ReportBuilder_3_0_0_0.application”/>
<add key=”DEFAULT” value=”ReportBuilder_3_0_0_0.application”/>

 

That’s it. You should now be able to build reports again.

Microsoft Remote Desktop for iOS

Hi,

Today, Microsoft released “Microsoft Remote Desktop” for iOS devices (iOS 5+). For a long time, the Apple store has contained many 3rd party solutions to this which usually require a 3rd party app to be installed on the Windows PC you’re connecting to (never a fan of this option), or have ‘basic’ Remote Desktop support, without the Network Level Authentication. This app supports it.

Firstly, by allowing this on any PC you’re opening up a way for attackers to get in. You need to weigh up the risks with this, and what data can be accessed. I won’t get into that with this post, but consider firewall settings and potentially using a VPN for extra security.

The iOS side of things is very simple. Go to the app store, install the “Microsoft Remote Desktop” app and launch it. You’ll end up with a ‘RD Client’ App on your home screen, and when launched will look like this (without my ‘Home’ connection):

2013-10-18T14-47-25_0Pretty clean. So, you can add a ‘New Remote Desktop’ if you know the PC name/IP address you’re connecting to. Most people will want this when they’re out and about though – so the first thing to do is make sure Remote Desktop is enabled on your PC.

At the PC end under System > Advanced System Settings are the Remote Desktop settings. Make sure you’ve got the ‘Allow connections only from computers running…’ tickbox selected. Why? Have a read here http://technet.microsoft.com/en-us/magazine/hh750380.aspx but the summary is that it’s more secure and is less susceptible to attacks.

system propeties

For the ‘Select Users’ box, add only the accounts you need to use remotely (unless they’re already a local admin). As part of this, you should have your local administrator account disabled as that’s often what someone or something will use as a username to try to access your PC. The account you’re planning to use can be a Microsoft account, so you’d just enter your email address (e.g. [email protected]) with your password, and that will authorise you to the PC.

Keep in mind you may need to allow port 3389 (RDP) traffic in via your Router, and have that go to the PC you’re trying to connect to.

Once you’re on, the iOS app is rather clean and easy to use. You’ll see a small menu bar at the top of the screen. To the right is the keyboard which has all the keys I could imagine wanting (even a start button!), and to the left is a zoom/scroll button. Pressing this shows a small circle in the top middle half of the screen, and zooms the screen in. If you want to navigate around in zoomed mode, press the circle and swipe the way you want to go. If you just swipe without starting at the circle, you’ll probably end up highlighting text like a mouse would. Right clicking is done by holding down your finger, and you’ll see a small square appear and increase in size, until the right click happens.

You can also change to mouse mode by pressing the middle of the top menu, which will drop down a larger menu. On the left side you’ll see a hand, press that and it will change to a cursor. The right side of this menu has the disconnect option when you’re done.

Android and Windows Phone 8 versions of Remote Desktop are on their way too, with the Android version available here: https://play.google.com/store/apps/details?id=com.microsoft.rdc.android

Also Simon Sharwood from The Register has posted this article about the app and quoted me :) http://www.theregister.co.uk/2013/10/18/windows_comes_to_android_ios/

Finally, here’s a really good article from Berkley University around Remote Desktop security https://security.berkeley.edu/node/94?destination=node/94

Troubleshooting NIC Drivers in WinPE for SCCM 2012

Hi,

This is one of the problems that every SCCM (System Center Configuration Manager) admin will come across. You’re trying to deploy an image to a PC from PXE booting, and you can’t get the list of task sequences to show up. The PC will reboot, and you’ll wonder what happened.

There’s several different ways to troubleshoot this, but it’s most likely network card drivers required in your Boot Image in SCCM. Where do you start on this though? There’s a couple of things to enable/set to make it a little easier.

First, enable command support on both your x86 and x64 boot images (Software Library > Overview > Operating Systems > Boot Images). This will allow you to press F8 when running WinPE from a task sequence, which brings up a command prompt to let you check things like log files.

The other setting I recommend is making custom Windows PE backgrounds (same screen as the command support option). Have one for your 32 bit Boot Image, and a different one for your 64 bit. This means when something fails, you can tell at a glance which boot image was used and troubleshooting accordingly.

boot image

Back to working out your NIC issue. If the task sequence is bombing out early on, press F8 to get your command prompt, then use the command ‘ipconfig’ If you see hardly any information, including the lack of an IP address then it’s a strong indicator that the correct NIC driver isn’t loaded. I’m going to guess you’ve checked the network cable is plugged in :)

To work out what NIC driver is required can be tricky. If your hardware came with an OS already loaded, or a recovery disk, you can load that up and from Windows see what driver is associated with the Network card. Here’s a good step by step guide on how to add the drivers: http://gerryhampsoncm.blogspot.com.au/2013/02/sccm-2012-sp1-step-by-step-guide-part-9.html

Generally (but not always) the driver you see in the standard OS should work in the WinPE environment too. You will probably need both 32 and 64 bit versions injected into the relevant boot images.

There’s also the log files to read, which can be rather messy when you first start out. From the command line window, run the command ‘cmtrace x:\windows\temp\smstslog\smsts.log’ and have a read – that’s your best bet to find out what’s causing your task sequence to fail. Do a quick google of the error code number you see to get an idea on what you’re dealing with.

Here’s an incredibly long breakdown of SCCM 2012 log files if you’re that way inclined: http://technet.microsoft.com/en-us/library/hh427342.aspx

Sometimes, this won’t even work which was the case with a new HP 800 G1 SFF I was working on. As a last resort, I knew the NIC was Intel I217, so I grabbed the latest driver pack from Intel themselves:
https://downloadcenter.intel.com/Detail_Desc.aspx?agr=Y&DwnldID=18713&lang=eng&OSVersion=Windows%207%20%20*&DownloadType=Drivers

After downloading an extracting all these drivers, I attempted the brute force method. Following these instructions: http://www.niallbrady.com/2011/08/31/missing-nic-driver-in-winpe-boot-image-no-problem/ I loaded the lot onto a USB drive, and just started loading driver after driver with the command ‘drvload filename.INF’ and then checking if the network was there using the ‘ipconfig’ command. About 10 drivers in, one of them took longer to load (e1d63x64.inf) and I had an IP address! I then loaded both the 32 and 64 bit versions into the boot images, and my task sequence to deploy Windows 7 was working.

If you’re not even getting as far as WinPE launching, then you’ve got a completely different issue, so start researching!

Nokia Lumia 1020 Whinge

Hi,

This post is not about how amazing the 41 megapixel camera is on the Nokia Lumia 1020 (because it is), it’s about my personal experience in actually using the phone, and some of the pain that followed.

Firstly, it’s always cool to get the new toy, and open it. This doesn’t mean it needs to be filmed – as a kid, how much fun was it to go to someone else’s birthday party and watch them open all their presents and be really excited? Yeah.

So, this wasn’t my first Windows Phone 8 device either, as I’d previously had a Lumia 920. A rather hefty phone that could most likely stop a bullet, but had an issue with the speaker that made people talking sound like they had a sock in their mouth. Annoyingly I had to send it back to my carrier, who sent it back still faulty, then sent it straight to Nokia to finally have it fixed about 3 weeks from the start. These things happen, I had no major issues after that.

The Lumia 1020 however, has been a different story. At first it seemed fine, although I couldn’t register my Microsoft account as part of the setup process because it couldn’t connect to the internet. I skipped that, and then connected it to wifi to be able to do so. I then took it home, and it seemed to be functioning fine. Simple so far…

Then, while I was out I just wanted to Google something (sorry about that Bing). I couldn’t, it had no internet connection again. I was showing 4G and had great signal, so what was going on? I tried rebooting but that didn’t help. I gave up for that night.

At home again, it’s working fine – so I ignore that issue for the time being. Instead, I go through the process of connecting the Bluetooth to my car (inbuilt bluetooth of a Hyundai ix35, or a Tuscan overseas). That seemed to work, but then 10 minutes later it would just drop off and reconnect. A bit annoying. Then, next time I get into my car it wouldn’t connect at all. I had the brainwave of turning bluetooth off and back on again on the Lumia, but pressing the ‘off’ switch seemed to take several minutes. I rebooted the phone after waiting that long, and then bluetooth could be turned on again. Turning it back on then seemed to let the phone and car start talking again. Getting weird…

This bluetooth problem happens about every second time I get in the car. I’d previously used a Samsung Galaxy S3 without issue for over a year, so I knew it wasn’t the car at fault generally (although it may have just not liked something about how the Lumia was doing bluetooth). Every time I’d try and turn off bluetooth it would never let me turn it back on, and just rebooting the phone without turning bluetooth off first seemed hit and miss.

At this stage, I’m getting annoyed. I reach out to Nokia via twitter, and pretty much get told to check the car supports it, after telling them that the 920 is supported as per their website.

I’m now waiting to hear back from Hyundai about this.

While this is going on, I then get back to work and my internet connection has stopped working from the phone. I realise it must be to do with 4G, so force the phone to go back to 3G and things start working. Getting onto my carrier, they say they’ll trigger off the carrier settings to make 4G work. My phone reboots, I figure what they did must have caused that to happen. 4G starts working so I’m happy… until a few days later, where the internet connection fails for 3G. I reboot the phone to fix that issue.

In the meantime, the phone itself has started to reboot randomly, roughly once a day on average. Sometimes I’ll take it out of my pocket or just look over at my phone and see the lovely startup screen:

clipboard3d1

 

Other times the phone will just freeze during operation, and I’ll have to hard reset it by holding down the power button and volume down button to get some life into it.

I decide to call Nokia Care Australia to see what they have to say about all this. This is where I am now, at the time of writing. I list off all the issues, and the first suggestion from their support is that maybe I have too many apps running.

I’m somewhat surprised by that statement, and they say to hold down the arrow button and go back to get rid of any open apps. I told her that wouldn’t explain all the other issues I’m having – so she then says to reset the phone to factory settings.

I go through that fun process but after going through it 4G doesn’t work again. The next gem of information given to me is the explanation that it’s a coverage issue, and I must be in an area that doesn’t have 4G. I tell her that I am because I have other devices on 4G next to me working fine through the same carrier, but also that the only reason the phone will display 4G up the top is if it has 4G signal. She disagrees, is still sure that it’s just the setting enabled and continues to say it’s a carrier issue in her broken English explanation. I ask why it goes back to 3G when I go home without me changing any settings. She isn’t sure, but still ‘knows’ it’s to do with the coverage.

Annoyed, I give up asking about it and get the phone functional on 3G. She then tells me if there’s any issue to call back, and hangs up the phone.

Now I’m rebuilding the phone, and finding out the tedious way to re-download your apps is via this method.

TL;DR version of the phone’s issues:

  • Random phone reboots
  • Random phone freezes
  • Random bluetooth dropouts
  • Bluetooth freezing when being turned off
  • 4G data not working
  • 3G/4G data not working until phone reboot

Anyway – this is my experience with a single Nokia Lumia 1020. Maybe it’s faulty, maybe the factory reset will fix it. Yes it’s a whinge, but it’s been a frustrating process to go through. Plus this is a blog about my experiences :) If you’ve had a similar or different experience, I’d love to know.

 

Update 10/10/2013: Phone was still rebooting randomly, freezing, mobile data fails and dropping bluetooth. Called the carrier who very quickly organised a replacement phone to be sent out (after first convincing them it was still under warranty, and then convincing them that it’s < 30 days so should be a swapout rather than a repair job). New phone arrived the next day…

New phone had the 4G issue, which I got back onto the carrier. My sim card needed to be swapped over, which then completely fixed the 4G issue. Thought all was well, but after trying to wireless charge with the wireless backplate fitted, nothing happened. Tried 3 different wireless charging stands and no luck, but don’t have a spare wireless backplate to test. It worked perfectly on the last phone though.

Called carrier again, they’re now organising for a 3rd replacement handset to be sent out. 3rd time lucky?

 

Update 15/10/2013: 3rd phone arrived a few days ago, and it’s been perfect. Wireless charging works. 3G/4G is fine. Not a single unexpected reboot or freeze. Bluetooth hasn’t dropped out at all. I’m calling it as being faultless! An extra note for at least those in Australia – if it’s less than 30 days and you find your phone faulty, ring the carrier you got it from and ask for a replacement rather than a repair. They may offer the repair, but should do an instant swap if you ask. Otherwise, a repair can take weeks.

3rd time IS lucky!