Security Policy Page 1 of 20
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Bitmap Graphics Model - Device Context • Windows Does Not Retain a Copy of What the Application Drew • Windows 3.0 (1990)
historie 08.11.2018 vjj 1 pravěk INPUT PROGRAM OUTPUT 08.11.2018 vjj 2 evoluce • dávkové zpracování • interaktivní práce • prompt • GUI 08.11.2018 vjj 3 evoluce INPUT PROGRAM OUTPUT 08.11.2018 vjj 4 evoluce Windows • bitmap graphics model - Device Context • Windows does not retain a copy of what the application drew • Windows 3.0 (1990) • bitmap graphics model - layered Device Context • Windows does retain a copy of the drawing as a bitmap • Windows 2000 (beta 1998) • .NET Framework (2001-2005) • vector graphics model – WPF (on DirectX) • tree of user-interface elements with objects representing graphical shapes • Windows Vista, .NET Framework 3.0 (2006) • Metro - deterioration • Windows 8, .NET Framework 4.5 (2012) 08.11.2018 vjj 5 1: Win32 API classique 08.11.2018 vjj 6 Uživatel Fronta zpráv GetMessage (mouse, keyboard) hardware interrupt DRIVER DispatchMessage System message queue WindowProc WindowProc RIT Raw Input Thread Fronta zpráv 8.11.18 vjj 7 WM_PAINT • každý ovládací prvek je samostatným oknem s vlastní procedurou na zpracovávání zpráv • celá stavba programu/algoritmu se točila kolem přípravy dat pro vykreslení obsahu okna vždy, když přišla zpráva WM_PAINT (a že chodila často) • během přímého kreslení se výstup do momentálně neviditelné části okna nikam nezapsal 08.11.2018 vjj 8 User Windows OS Invalidate... Program WM_PAINT GetDC Program Funkce GDI32 / GDI+ Graphics Card Frame Buffer for Screen Image data only retained as long as it remains visible on screen 08.11.2018 vjj 9 PROGRAM: direct Device Context OUTPUT PROGRAM PROGRAM PROGRAM PROGRAM PROGRAM WM_PAINT WM_PAINT WM_PAINT WM_PAINT WM_PAINT 08.11.2018 vjj 10 standardní funkce • TextOut • MoveToEx DrawText LineTo Rectangle Ellipse • DrawIcon Pie Arc Chord Polyline • BitBlt Polygon stretchBlt 08.11.2018 vjj 11 Device Context • standardní funkce pro kreslení do okna vyžadují hDC jako svůj první parametr • datová struktura popisující vlastnosti výstupu, např. -
Interaction Between Web Browsers and Script Engines
IT 12 058 Examensarbete 45 hp November 2012 Interaction between web browsers and script engines Xiaoyu Zhuang Institutionen för informationsteknologi Department of Information Technology Abstract Interaction between web browser and the script engine Xiaoyu Zhuang Teknisk- naturvetenskaplig fakultet UTH-enheten Web browser plays an important part of internet experience and JavaScript is the most popular programming language as a client side script to build an active and Besöksadress: advance end user experience. The script engine which executes JavaScript needs to Ångströmlaboratoriet Lägerhyddsvägen 1 interact with web browser to get access to its DOM elements and other host objects. Hus 4, Plan 0 Browser from host side needs to initialize the script engine and dispatch script source code to the engine side. Postadress: This thesis studies the interaction between the script engine and its host browser. Box 536 751 21 Uppsala The shell where the engine address to make calls towards outside is called hosting layer. This report mainly discussed what operations could appear in this layer and Telefon: designed testing cases to validate if the browser is robust and reliable regarding 018 – 471 30 03 hosting operations. Telefax: 018 – 471 30 00 Hemsida: http://www.teknat.uu.se/student Handledare: Elena Boris Ämnesgranskare: Justin Pearson Examinator: Lisa Kaati IT 12 058 Tryckt av: Reprocentralen ITC Contents 1. Introduction................................................................................................................................ -
Using the Component Object Model Interface
MQSeries for Windows NT V5R1 IBM Using the Component Object Model Interface SC34-5387-01 MQSeries for Windows NT V5R1 IBM Using the Component Object Model Interface SC34-5387-01 Note! Before using this information and the product it supports, be sure to read the general information under Appendix B, “Notices” on page 151. Second edition (April 1999) This edition applies to MQSeries for Windows NT V5.1 and to any subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation 1997,1999. All rights reserved. US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Contents About this book ..................................... v Who this book is for ................................... v MQSeries publications . vi MQSeries cross-platform publications ....................... vi MQSeries platform-specific publications ...................... ix MQSeries Level 1 product publications ....................... x Softcopy books . x MQSeries information available on the Internet .................. xii Where to find more information about ActiveX ................... xii Summary of changes ................................. xiii Changes for this edition ................................ xiii Chapter 1. Introduction . 1 MQSeries Automation Classes for ActiveX overview ................ 1 Chapter 2. Designing and programming using MQSeries Automation Classes for ActiveX .................................. 3 Designing -
Internet Explorer 9 Features
m National Institute of Information Technologies NIIT White Paper On “What is New in Internet Explorer 9” Submitted by: Md. Yusuf Hasan Student ID: S093022200027 Year: 1st Quarter: 2nd Program: M.M.S Date - 08 June 2010 Dhaka - Bangladesh Internet Explorer History Abstract: In the early 90s—the dawn of history as far as the World Wide Web is concerned—relatively few users were communicating across this Internet Explorer 9 (abbreviated as IE9) is the upcoming global network. They used an assortment of shareware and other version of the Internet Explorer web browser from software for Microsoft Windows operating system. In 1995, Microsoft Microsoft. It is currently in development, but developer hosted an Internet Strategy Day and announced its commitment to adding Internet capabilities to all its products. In fulfillment of that previews have been released. announcement, Microsoft Internet Explorer arrived as both a graphical Web browser and the name for a set of technologies. IE9 will have complete or nearly complete support for all 1995: Internet Explorer 1.0: In July 1995, Microsoft released the CSS 3 selectors, border-radius CSS 3 property, faster Windows 95 operating system, which included built-in support for JavaScript and embedded ICC v2 or v4 color profiles dial-up networking and TCP/IP (Transmission Control support via Windows Color System. IE9 will feature Protocol/Internet Protocol), key technologies for connecting to the hardware accelerated graphics rendering using Direct2D, Internet. In response to the growing public interest in the Internet, Microsoft created an add-on to the operating system called Internet hardware accelerated text rendering using Direct Write, Explorer 1.0. -
Guidelines for Designing Embedded Systems with Windows 10 Iot Enterprise
Guidelines for Designing Embedded Systems with Windows 10 IoT Enterprise Version 2.0 Published July 15, 2016 Guidelines for designing embedded systems 1 CONFIDENTIAL Contents Overview .................................................................................................................................................................................................... 4 Building a task-specific experience ............................................................................................................................................ 4 General Group Policy settings ....................................................................................................................................................... 4 Application control ................................................................................................................................................................................ 5 Application boot options ................................................................................................................................................................. 5 Auto-boot Universal Windows apps ...................................................................................................................................... 5 Auto-boot Classic Windows apps ........................................................................................................................................... 5 Limit application access with AppLocker ............................................................................................................................... -
Zero-Day Vulnerability in Desktop Window Manager (CVE-2021-28310) Used in the Wild | Securelist
4/14/2021 Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310) used in the wild | Securelist Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310) used in the wild securelist.com/zero-day-vulnerability-in-desktop-window-manager-cve-2021-28310-used-in-the-wild/101898 While analyzing the CVE-2021-1732 exploit originally discovered by the DBAPPSecurity Threat Intelligence Center and used by the BITTER APT group, we discovered another zero-day exploit we believe is linked to the same actor. We reported this new exploit to Microsoft in February and after confirmation that it is indeed a zero-day, it received the designation CVE-2021-28310. Microsoft released a patch to this vulnerability as a part of its April security updates. We believe this exploit is used in the wild, potentially by several threat actors. It is an escalation of privilege (EoP) exploit that is likely used together with other browser exploits to escape sandboxes or get system privileges for further access. Unfortunately, we weren’t able to capture a full chain, so we don’t know if the exploit is used with another browser zero-day, or coupled with known, patched vulnerabilities. The exploit was initially identified by our advanced exploit prevention technology and related detection records. In fact, over the past few years, we have built a multitude of exploit protection technologies into our products that have detected several zero-days, proving their effectiveness time and again. We will continue to improve defenses for our users by enhancing technologies and working with third-party vendors to patch vulnerabilities, making the internet more secure for everyone. -
Verified Implementations of the Information Card Federated Identity
Verified Implementations of the Information Card Federated Identity-Management Protocol Karthikeyan Bhargavan∗ Cédric Fournet∗ Andrew D. Gordon∗ Nikhil Swamy† ∗Microsoft Research †University of Maryland, College Park ABSTRACT We describe reference implementations for selected configurations of the user authentication protocol defined by the Information Card Profile V1.0. Our code can interoperate with existing implemen- tations of the roles of the protocol (client, identity provider, and relying party). We derive formal proofs of security properties for our code using an automated theorem prover. Hence, we obtain the most substantial examples of verified implementations of crypto- graphic protocols to date, and the first for any federated identity- management protocols. Moreover, we present a tool that down- loads security policies from services and identity providers and Figure 1: InfoCard: Card-based User Authentication compiles them to a verifiably secure client proxy. Categories and Subject Descriptors and (2) to check consistency between the reference implementation and the informal specification in the same way as for any imple- D.2.4 [Software Engineering]: Software/Program Verification mentation, via interoperability testing with other implementations. This paper reports the techniques underpinning the most com- Security, Verification General Terms plex examples to date of such verified implementations. Keywords Information Card Profile V1.0 (InfoCard). We have built and Cryptographic protocol verification, Verified implementations, Web verified reference implementations of various configurations of the Services Security, Federated identity management, CardSpace. card-based user authentication protocol defined by the Information Card Profile V1.0 [InfoCard Guide, Nanda, 2006]. We refer to this 1. INTRODUCTION protocol as InfoCard. InfoCard is the core of a federated identity-management frame- Verified Reference Implementations of Protocols. -
Cardspace Web Integration
A Guide to Supporting Information Cards within Web Applications and Browsers as of the Information Card Profile V1.0 December 2006 Author Michael B. Jones Microsoft Corporation Copyright Notice © 2006 Microsoft Corporation. All rights reserved. Abstract The Identity Metasystem allows users to manage their digital identities from various identity providers and employ them in different contexts where they are accepted to access online services. In the Identity Metasystem, identities are represented to users as “Information Cards” (a.k.a. “InfoCards”). One important class of applications where Information Card- based authentication can be used is applications hosted on web sites and accessed through web browsers. This paper documents the web interfaces utilized by browsers and web applications that support the Identity Metasystem. The information in this document is not specific to any one browser or platform. This document supplements the information provided in two other Information Card Profile references: the Guide to the Information Card Profile V1.0 [InfoCard-Guide], which provides a non-normative description of the overall Information Card model, and the Technical Reference for the Information Card Profile V1.0 [InfoCard-Ref], which provides the normative schema definitions and behaviors referenced by the Guide to the Information Card Profile V1.0. Status The Information Card Profile V1.0 was used to implement Windows CardSpace V1.0, which is part of Microsoft .NET Framework 3.0 [.NET3.0], and Internet Explorer 7. Other implementations following these specifications should be able to interoperate with the Microsoft implementation. Version 1.0 Page 1 of 13 Table of Contents 1. Introduction 2. -
Mastering Powershellpowershell
CopyrightCopyright © 2009 BBS Technologies ALL RIGHTS RESERVED. No part of this work covered by the copyright herein may be reproduced, transmitted, stored, or used in any form or by any means graphic, electronic, or mechanical, including but not limited to photocopying, recording, scanning, digitizing, taping, Web distribution, information networks, or information storage and retrieval systems except as permitted under Section 107 or 108 of the 1976 United States Copyright Act without the prior written permission of the publisher. For permission to use material from the text please contact Idera at [email protected]. Microsoft® Windows PowerShell® and Microsoft® SQL Server® are registered trademarks of Microsoft Corporation in the United Stated and other countries. All other trademarks are the property of their respective owners. AboutAbout thethe AuthorAuthor Dr. Tobias Weltner is one of the most visible PowerShell MVPs in Europe. He has published more than 80 books on Windows and Scripting Techniques with Microsoft Press and other publishers, is a regular speaker at conferences and road shows and does high level PowerShell and Scripting trainings for companies throughout Europe. He created the powershell.com website and community in an effort to help people adopt and use PowerShell more efficiently. As software architect, he created a number of award-winning scripting tools such as SystemScripter (VBScript), the original PowerShell IDE and PowerShell Plus, a comprehensive integrated PowerShell development system. AcknowledgmentsAcknowledgments First and foremost, I’d like to thank my family who is always a source of inspiration and encouragement. A special thanks to Idera, Rick Pleczko, David Fargo, Richard Giles, Conley Smith and David Twamley for helping to bring this book to the English speaking world. -
The Component Object Model Specification Version 0.9 October 24, 1995
http://scottge.wordpress.com The Component Object Model Specification Version 0.9 October 24, 1995 This document contains the specification to the Component Object Model (COM), an architecture and supporting infrastructure for building, using, and evolving component software in a robust manner. This specification contains the standard APIs supported by the COM Library, the standard suites of interfaces supported or used by software written in a COM environment, along with the network protocols used by COM in support of distributed computing. This specification is still in draft form, and thus subject to change. Note: This document is an early release of the final specification. It is meant to specify and accompany software that is still in development. Some of the information in this documentation may be inaccurate or may not be an accurate representation of the functionality of the final specification or software. Microsoft assumes no responsibility for any damages that might occur either directly or indirectly from these inaccuracies. Microsoft may have trademarks, copyrights, patents or pending patent applications, or other intellectual property rights covering subject matter in this document. The furnishing of this document does not give you a license to these trademarks, copyrights, patents, or other intellectual property rights. Copyright ? 1992-95 Microsoft Corporation. All Rights Reserved The Component Object Model Specification The Component Object Model The Component Object Model Specification Draft Version 0.9, October 24, 1995 Microsoft Corporation and Digital Equipment Corporation Copyright ? 1992-95 Microsoft Corporation. Microsoft does not make any representation or warranty regarding the Specification or any product or item developed based on the Specification. -
Windows Tweaks Guide
Windows Tweaks Guide For By Windows Geeks Team Introduction .......................................................................................................................................... 5 Important Notes on This Guide........................................................................................................... 5 Usage Instruction.................................................................................................................................. 5 No Warranty .......................................................................................................................................... 5 Hosting, Distribution & Translation ................................................................................................... 6 Tweaks for Windows XP ...................................................................................................................... 6 Before You Begin Tweaking XP ................................................................................................. 6 Tweaks for Startup ..................................................................................................................... 8 Tweaks for Shutdown .............................................................................................................. 10 Tweaks for Mouse .................................................................................................................... 10 Tweaks for Start Menu ............................................................................................................ -
A One-Page Introduction to Windows Cardspace Michael B
A One-Page Introduction to Windows CardSpace Michael B. Jones, Microsoft Corporation, January 2007 © 2007 Microsoft Corporation. All rights reserved. Many of the problems facing the Internet today stem from the lack of a widely deployed, easily understood, secure identity solution. Microsoft’s Windows CardSpace software and the “Identity Metasystem” protocols underlying it are aimed at filling this gap using technology all can adopt and solutions all can endorse, putting people in control of their identity interactions on the Internet. One problem people face is knowing whether they’re at a legitimate web site or a malicious site. This is an identity problem: a problem with reliably identifying authentic sites to their users. People also face numerous problems in identifying themselves to the sites they use. Username/password authentication is the prevailing paradigm, but its weaknesses are all too evident on today’s Internet. Password reuse, insecure passwords, forgotten passwords, and poor password management practices open a world of attacks by themselves. Combine that with the password theft attacks enabled by counterfeit web sites and man-in-the-middle attacks and today’s Internet is an attacker’s paradise. CardSpace is part of the solution to all of these problems. The Windows CardSpace software enables people to maintain a set of personal digital identities that are shown to them as visual “Information Cards”. These cards are easier to use than passwords. Furthermore, they employ strong cryptography, making them significantly more secure than passwords and other information typed into web forms. There are three participants in any digital identity interaction using CardSpace: Identity Providers issue digital identities for you.