Internet Explorer 7 Is an Open Door for Attacks

Internet Explorer 7 on Windows XP and Windows Server 2003 is nothing short of an open door for attacks. Microsoft informed that it is currently investigating a remote code execution vulnerability in various versions of XP and Windows Server 2003 running Internet Explorer 7. The Redmond company added that Windows Vista users are safe, although the operating system comes with IE7 built in by default. Windows XP SP2, XP Professional x64 Edition, Professional x64 Edition SP2; Windows Server 2003 SP1 and SP2, Windows Server 2003 x64 Edition and SP2 and Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems are all vulnerable to the security flaw, provided they are running IE7. The vulnerability is related to the way the Windows operating system handles Uniform Resource Identifiers (URIs).

“When a user clicks a link to a URI, the application showing that link to users decides how it is supposed to be handled. For traditionally “safe” protocols like mailto: or http: applications often just verify the prefix and then choose to call into the Windows shell32 function ShellExecute() to handle it. This has been the case for a number of years. Windows then launches Internet Explorer passing the URI or launches the preferred email client passing the email address etc. With IE6 installed, ShellExecute() passes the URI to IE which accepts it and inside IE determines it to be invalid. Navigation then fails harmlessly. With Internet Explorer 7 installed, the flow is a bit different”, explained Jonathan Ness with the SWI team at Microsoft Security Response Center.

With IE7, Microsoft has implemented additional validation in the process of rejecting a malformed URI. Essentially, malformed URIs will no longer be rejected up front, and instead would be moved to ShellExecute() in order to be fixed. When ShellExecute() is handling URIs in order to make them usable, the process is not safely managed. In Vista, for example, ShellExecute() also rejects the URI, but the copies of Windows XP and Windows Server 2003 do not deliver a similar behavior. Microsoft emphasized that the vulnerability can be successfully exploited only in the limited contexts described above, and that other versions of the Windows operating system with IE7 installed are not affected.

“Our plan is to revise our URI handling code within ShellExecute() to be more strict. While our update will help protect all applications from malformed URI’s, application vendors who handle URI’s can also do stricter validation themselves to prevent malicious URI’s from being passed to ShellExecute(). We have seen several vendors introduce additional validation as a way to protect their customers from this issue”, Ness added.

Clean out unneeded Services quickly

Windows Vista has around 130 services. True, not all of them are running, but most are set to default to run when necessary. Over half of them start up on a default machine. Your first step towards tweaking vista should be to disable services that you frankly have no need for. They are just running aimlessly.

There are two options here. You can manually go through all 129 services with the aid of our In-depth guide to help you determine if you might need a service (dependencies and what depends on a given service are listed), or you can run one of our custom Registry files which will allow you to try out several tweaked settings. Don’t worry, if you mess up your services, or you don’t like the results of the tweaked settings, you can always go back to the default settings with one of the handy default reg files on the same page.

Thats pretty much it. Realize that:

* Default: The service will not run on default, but if requested to by any other process, it will start up.
* Automatic: Start up this service right on computer load.
* Automatic (Delayed Start):Start up this service on computer boot, but starting it up can wait until after user is logged in. The startup of the process can be delayed/set to a lower priority.
* Disabled: The service will not run, even if requested to.

Speed up Aero by Disabling Minimize/Maximize

Some performance increases have nothing to do with strain on hardware, or amount of processing. Sometimes, things are designed to take longer than they should, though only maybe 1/2 a second, but the end result to the user is a faster machine. This is one of those tweaks. Minimizing and maximizing does an animation. Watch closely. Pretty quick eh? Still, it does slow you down, and, really, what does it add to your experience? I am all about vanity and aesthetics, but this feature has got to go.

Relish in the fact you will be increasing your productivity by 0.2 seconds per minimize/maximize.

* Open your start menu, go to run, and type in ’systempropertiesperformance’
* From the Visual Effects tab, uncheck ‘Animate windows when minimizing and maximizing’
* While you are here, might as well check out the other goodies you can disable.

How to Manage Your Gmail Storage Size

Recently, the Mountain View company Google received a new service which allows users to buy additional storage size for their account but is currently compatible only with Gmail and Picasa Web Albums. Because the purchased storage space addresses the Google account, you can use it for any service you need. But there is a problem. Some of the users are interested in using the Gmail storage size, the one offered for free by Google, for Picasa Web Albums or vice-versa. Well, that’s simply not possible. Google permits the users to share the storage size only if they bought additional space so if you want to split the Gmail storage in order to use it for Picasa photos, you can’t.

“Paid storage is designed to give you more space across all Google services that support extra storage (currently Picasa Web Albums and Gmail). If you run out of free storage in either service, you’ll automatically use the space you’ve purchased to store more pictures and messages up to your new storage limit,” Google explains in the Gmail FAQ.

“The free storage for each service is for that service only. Picasa Web Album’s 1 GB of free storage is for pictures only, and Gmail’s 2.9 GB (and counting) are just for Gmail messages. You can’t set aside shared storage space for one service - it will be used by any service that’s over its free storage quota on a first-come, first-served basis.”

At this time, you can easily buy new Google account storage size by paying $20 per year for 10 GB, $75 per year for 40 GB, $250 per year for 150 GB and $500 per year for no less than 400 GB. However, the Mountain View company recently announced that the storage size counter has been modified so the Gmail users will surely receive more space very soon.

Windows Vista Users in Trouble With the New Firefox

Mozilla rolled out Firefox 2.0.0.8 a few days ago, being a version which was supposed to patch approximately 200 glitches. Although it fixed most of them, it appears that it also caused some others making the application a little buggy. However, Mike Beltzner of Mozilla wrote on the company’s blog that Firefox 2.0.0.9 is currently in labs and might be released next week for all the users. The matter can be called “an update to fix the update” because the new patches will be released to repair the fixes which were launched a few days ago.

“The 2.0.0.8 release fixed some 200 issues, but accidentally regressed a few things. Most users won’t see any difference or experience any problems, and those 200 fixes make the 2.0.0.8 update very valuable, but you should never have to choose functionality over security. So we’re working fast to understand and fix these problems, and will shortly be issuing a 2.0.0.9 update to address them,” the Mozilla official wrote on the company’s blogs.

According to the blog post, one of the main problems of the 2.0.0.8 release of Firefox is the Java compatibility with Windows Vista, the latest operating system powered by the Redmond-headquartered company. It seems like every time a user tries to load a Java applet in the new Firefox, he gets an error saying “Java not found” or “Java not working”. It can be easily fixed by “right-clicking the Firefox icon and “Run as administrator”, then browsing to a page with a Java applet — doing this once will fix the problem and permanently restore Java functionality.” However, Mozilla wants to fix this by default so all the users would be able to access Java applets.

Windows Vista Users in Trouble With the New Firefox

Mozilla rolled out Firefox 2.0.0.8 a few days ago, being a version which was supposed to patch approximately 200 glitches. Although it fixed most of them, it appears that it also caused some others making the application a little buggy. However, Mike Beltzner of Mozilla wrote on the company’s blog that Firefox 2.0.0.9 is currently in labs and might be released next week for all the users. The matter can be called “an update to fix the update” because the new patches will be released to repair the fixes which were launched a few days ago.

“The 2.0.0.8 release fixed some 200 issues, but accidentally regressed a few things. Most users won’t see any difference or experience any problems, and those 200 fixes make the 2.0.0.8 update very valuable, but you should never have to choose functionality over security. So we’re working fast to understand and fix these problems, and will shortly be issuing a 2.0.0.9 update to address them,” the Mozilla official wrote on the company’s blogs.

According to the blog post, one of the main problems of the 2.0.0.8 release of Firefox is the Java compatibility with Windows Vista, the latest operating system powered by the Redmond-headquartered company. It seems like every time a user tries to load a Java applet in the new Firefox, he gets an error saying “Java not found” or “Java not working”. It can be easily fixed by “right-clicking the Firefox icon and “Run as administrator”, then browsing to a page with a Java applet — doing this once will fix the problem and permanently restore Java functionality.” However, Mozilla wants to fix this by default so all the users would be able to access Java applets.

Speed Vista: Tweak your services

Well, this one is arguable. Many sites preach service tweaking as the end all of tweaks, and Vista does have a lot of services (like 130). However, a good portion of them are set to manual or disabled by default. Manual will only start the service when the operating system thinks it needs to use that program. However, Vista does have a lot of services set to Automatic by default that are not needed for many people. Granted, they are usually sleeping, not using any CPU, and if they use memory, they usually get paged out to disk pretty fast. But, regardless, it is fairly quick to do, and will gain you some improvement.

First off, how to tell what you should really be worried about. One new feature in Vista is the ‘Go to Service’ feature in Task Manager (or at least I never noticed it before). Open Task Manager, Processes tab, right click on a particularly heavy process, and select ‘Go to Service (s)’. This will jump you over to the services tab, and select all the services that are running under that process (multiple ones are usually running under svchost.exe, many of the others only map to one service).

It also works in reverse (select service, right click and go to process) I have something like 75 services running at this very moment. Many of them I have exactly zero use for. I do not have a printer, but print spooler is running and using a whole whopping 1MB of my ram at the moment. There are heavier examples, but even if you can remove 20 of these, is it worth your time? Well, yes and no. Like I said, many of them are already paged out, so they really aren’t affecting your system’s memory. There is added overhead because the scheduler still needs to manage them, but I cannot for the life of me remember how it is done in Windows.

Overall maybe minimal, but if you are going for every ounce of tweak-ness, give it a shot. I’d recommend Speedyvista look for their cheatsheet or registry files pages so you can keep a copy of the default services around for when/if you mess it up and need to get back to default.