Possible Security Issue in IE on Windows XP

Conventional wisdom states that users should use non-administrative accounts for day-to-day usage on Windows XP machines to minimize exposure to malware. Windows XP even has a nice feature where an application can be executed using another user’s credentials if that application needs to run with special privileges.

An example of something that cannot be done with a non-administrative account is using Windows Update. To use Windows Update a user will typically right-click on the Internet Explorer (IE) icon, select Run As, and enter the credentials of an administrative account.

If that IE window is left open and a user clicks on a URL that appears in an e-mail message, the page will appear in the IE window with the administrative privileges instead of an IE window running as the user that is logged in. This would be very bad if the page that was loaded contained malware.

I expected Windows would open the URL in an IE window running under the logged-in users credentials. Unfortunately, IE opens the URL in the most recently opened IE window, even if that IE window is running under a different user’s credentials. This seems like a security issue to me.

.NET Left & Right Replacements

Back in the days of VB6 there were two trusty functions that programmers could rely on to truncate string: Left and Right. These functions live on in the .NET Framework, but they live in the dreaded Microsoft.VisualBasic namespace, a namespace both shunned and feared by many. But do not loose hope, fair .NET programmer, for there is a “pure” way to easily reproduce the functionality of the Left and Right function with out resorting to the Microsoft.VisualBasic namespace methods.

All silliness aside, there is a simple way to reproduce the functionality of the Left and Right functions using non-Microsoft.VisualBasic namespace methods. The typically answer to this question is to use the Substring method, but the Substring method requires to use valid startIndex and length arguments.

In VB6 if you had a three-character string called TestString and called Left(TestString, 5), you would get your three-character string back. In .NET if you were to have this same string and call TestString.Substring(0, 5) method, you would get a ArgumentOutOfRangeException exception.

I colleague of mine came up with the following way to reproduce the functionality of the old VB6 Left function: TestString.Substring(0, Math.Min(5, TestString.Length))

The old VB6 Right function can be reproduced by using the following: TestString.Substring(TestString.Length – Math.Min(5, TestString.Length), Math.Min(5, TestString.Length))

Virtual Memory and Performance Counters

A few months ago my PC at work, which is running Windows XP SP2, was upgraded from 1 GB of RAM to 3 GB of RAM. I though, "Wow! With 3 GB of RAM I will not even need any virtual memory." So I went to my computer’s System Properties and turned off the paging file. After a quick reboot I was running with just 3 GB of RAM and no virtual memory, and everything was running just fine.

I happened to be working on adding some performance monitoring statistics to a Windows Service I was writing in VB.NET at the time I turned off my virtual memory, so I was using the Performance Administrative Tool that is part of Windows XP a lot. The next time I opened the Performance Administrative Tool only the "Avg. Disk Queue Length" counter was shown. The "Pages/sec" and "% Processor Time" counters were missing. When I tried to add them back to the graph, I discovered the Memory and Processor performance objects were missing from the list.

I though maybe I did something in my code to break them (although I did not really think my application would be able to affect system counters like that). I did a little research and discovered a nice tool that is part of the Windows 2000 Resource Kit called the Extensible Performance Counter List (Exctrlst.exe). You can read more about this tool at http://support.microsoft.com/kb/927229 https://web.archive.org/web/20130327215623/http://support.microsoft.com/kb/927229 and http://technet2.microsoft.com/WindowsServer/en/library/
48edd368-2bde-4647-9fea-1b5f28a23ca91033.mspx?mfr=true https://web.archive.org/web/20080223113806/http://technet2.microsoft.com/windowsserver/en/library/48edd368-2bde-4647-9fea-1b5f28a23ca91033.mspx?mfr=true. By using this tool I discovered that the perfos.dll was disabled. I re-enabled the perfos.dll and restarted the Performance Administrative Tool. The "Pages/sec" and "% Processor Time" counters were back, but as soon as I tried to add an additional counter, the "Pages/sec" and "% Processor Time" counters would stop working. If I were to exit and restart the Performance Administrative Tool, the counters would be missing once again.

At this point I was pretty sure my application was not causing the disappearance of these counters and the disabling of the perfos.dll. I then remembered that I had disabled my virtual memory and decided to try re-enabling my virtual memory. Once my machine’s virtual memory and perfos.dll had been re-enabled, the "Pages/sec" and "% Processor Time" counters came back for good.

I have not been able to find any documentation to collaborate this discovery, but it seems that the performance counters hosted by the perfos.dll will not work unless you have virtual memory enabled. I have only tried this on Windows XP SP2 machines at this time. Please let me know if you have every experienced anything similar to this. I would like to hear your stories.