Thomas’s posterous

Lock Down IE on Windows, Even If You Don't Use It.

Listening to Security Now today, Steve Gibson hands out an important point about Internet Explorer on Windows. Whether or not you're using it, it's still there. And if you're forced to use Outlook at work as I am, IE vulnerabilities can still bite you.

What Steve suggests is locking down IE so that it is useful only as a Windows Update tool, which is important in Windows XP. If you're a Windows 7 or Vista user, you can skip the second half of this trick. Everyone should be following the first part, though.

Open up Internet Options and adjust the slider to "High" for "Internet" and "Local Intranet." This will disable Javascript and practically every other browser option for any non-trusted website that you, or IE, visit. While you're there, make sure that "Trusted Sites" and "Restricted Sites" have their default settings.

Once that's done, select "Trusted Sites" and then click the "Sites" button. To make Windows Update work on Windows XP, you'll need to add the following to the list:

• *.microsoft.com
• *.windowsupdate.com

If you have any sites that specifically require IE to function, you'll also want to add those sites to the zone. For my own sanity I had to disable the "Require https:" option for some of the sites my workplace requires IE.

Now, when other applications like Outlook access the IE components to render content, that content should be rendered under the "High" security settings that we set earlier, and things like Flash, Javascript and ActiveX shouldn't be issues. This doesn't mean IE becomes invulnerable, but it's a simple trick to reduce your risk surface, so no reason not to do it.

Quick Tech Note - Managing Privacy in Firefox

www.mozilla.com/en-US/firefox/all-beta.html">Firefox 3.6 Release Candidate 1 came out recently, after which I decided to poke through my extensions and plugins and trim the fat. I usually use a Release Candidate as a good excuse to do this, and to research other plugins that may have cropped up since I last went looking. 3.6 RC1, by the way, is fantastic and you should go ahead and install it if you're on a Mac.

There are three Firefox Extensions that give me a reason to stay with Firefox over Chrome. One of them is called CookieSafe and while it's not the most user-friendly little guy, I think it's important. Cookies are pieces of information that web sites you visit can store in your browser to identify you. This is how, for example, Amazon keeps you logged in even though you close your browser and re-open it. And I like Amazon.com having that kind of power, but do I want any of the other random sites I visit to be able to do the same? Not usually. CS makes it easy to Allow or Deny particular sites cookies. I set it to Globally block everything, and then enable sites that I want to be able to keep up with me.

The second is a neat little guy is called NoScript. The idea is the same as CookieSafe above, but for Javascript. Javascript is what makes the web work these days, but it's a fundamentally scary thing. If you leave it universally on, any site you visit basically hands your browser tiny programs for it to execute. Almost all security vulnerabilities that crop up in browsers these days and compromise machines utilize javascript in one way or another. NoScript allows you to say "Sure, let Amazon.com run Javascript but don't load the Javascript from that ad agency." Again as above, I block all and then allow the ones I trust.

The third is called Flashblock, and it is the most user friendly of the three. Instead of automatically loading and playing Flash (such as those giant moving ads or embedded videos) Flashblock lets you selectively load Flash objects. So you go to a website using egregious Flash ads and has an embedded video, neither will load. But you can click on the Flashblock symbol where the video is located, and it'll play for you. This also makes pages load a lot faster, sometimes.

And now I have another to add, discovered yesterday.

It's called Better Privacy, and I got really excited seeing it. One of the problems with all the methods above, and with browsers in general, is that they don't deal with so-called "Flash Cookies." Flash cookies are the same as cookies mentioned above, but specific to Flash (which powers sites such as Youtube, and just about every current video player..) and are NOT cleared when you clear out your cookies through the browser setting. They are, technically, not a part of the browser. Because Flash is a plugin, they exist within the plugin and are generally not talked about. The problem with these Flash Cookies, is that ad agencies and web sites use them to track you. These companies realized that people have started clearing cookies and using things like CookieSafe, so they are using this workaround to track people who specifically don't want to be tracked. And just about every ad agency and web video service (cough, Youtube, Cough) does this.
Better Privacy, though, clears them for you. No web site uses these things for legitimate reasons, such as keeping your shopping cart current. The only reason to use these things is to track you without your consent. Load up Better Privacy and you will be dismayed to discovered how many sites are doing this, and not talking about it. These suckers even bypass the "Private Browsing" options for Firefox and Chrome. So, I set BP to clear the things out every time I close my browser.

I also discovered TACO, which is a simple-but-brilliant idea. Cookies can be used by ad agencies to track and spy on you, but many ad agencies allow you to specifically opt-out of their networks. These links are hard to find and a pain to manage... unless you have TACO! TACO makes sure that these cookies are set for you at all times, just as an extra little bit of protection.