Port 25: The Open Source Community at Microsoft : Vista

Windows 7 and much, much more

Peter Galli — Tue, 28 Oct 2008 22:22:00 GMT

There was lots of news announced at PDC here in Los Angeles on Tuesday. From the first public demo of Windows 7, to how Microsoft is extending Office to the browser, to the release of the Silverlight Toolkit, and much, much more.

Rather than bore you all with too many facts and details, I thought I would simply provide a set of links to resources where you can get more information about all this news. I'll keep updating these as I find more useful links.

Windows 7:

Extending Office to the Web:

Silverlight:

Windows Server 2008 R2:

Bink.nu

Steve Ballmer's Executive Email:

A Platform for the Next Technology Revolution

Technical Analysis: Recovering Data from Windows systems by using Linux

jcannon — Tue, 20 Nov 2007 17:19:00 GMT

Abstract:
We have all run into cases where Windows fails to load for one reason or another. The problem may be hardware or a software failure, and the problem may seem to be irrecoverable. Yet often Linux can be used to help recover data that otherwise might be lost. Another application of using Linux recovery is in the creation of disk images for post-mortem analysis of security breaches. While such images are not created according to forensics standards (which usually requires special hardware) and would not be likely to be of help in legal cases, they are helpful in internal reviews following such incidents.

Note: This paper represents testing and documentation in a lab environment. User Account Control (UAC) is an essential security component to Windows and Microsoft does not recommend turning off UAC in production environments.

Windows Vista Beta/Linux IPsec Interop Testing

MichaelF — Wed, 09 May 2007 21:27:00 GMT

In addition to technical tips, blogs and video interviews, the Open Source Software Lab at Microsoft conducts a number of technical analysis and research projects throughout the year to help inform and solve key interoperability challenges between Microsoft and open source technologies. This particular research was conducted after reviewing data from our VPN research which was previously posted to Port 25.

Abstract:

This document provides an overview of Linux IPsec solutions as well as detailed discussions on configuring IPsec-Tools for interoperability scenarios between Red Hat Linux Enterprise 4 and Windows Vista Ultimate Beta.

Using Vista's Boot Manager to Boot Linux and Dual Booting with BitLocker Protection with TPM Support

MichaelF — Fri, 13 Oct 2006 19:57:00 GMT

Today we are introducing Cyril Voisin, Security Advisor for Microsoft in France where he has worked for 9 years. Cyril is a CISSP (Certified Information Security Systems Professional) and along with his work at Microsoft also teaches systems and network security in local schools as time allows. Cyril has started a blog, primarily focused on security (exact blog intent can be seen here) but occasionally dealing with interoperability as it relates to security.

Cyril has given us permission to syndicate his content on Port 25, the first example is below. Please feel free to post any questions or clarifications below or on Cyril’s blog.

We welcome Cyril to Port 25 and look forward to featuring his work and insight in the future.

-michael

-------------------------------------------------------------------------------------------------------

How to use Windows Vista’s Boot Manager to boot Linux

The Web is full of explanations on how to dual boot Windows and Linux using a Linux boot manager like GRUB or LILO. If you want to dual boot Windows Vista and Linux using Windows Vista’s Boot Manager, please read on. I will assume that you already have installed Linux on your machine using GRUB as your boot loader.

Step 1 – Install GRUB on the Linux partition (outside of MBR)

As Windows Vista will replace the Master Boot Record (MBR) with its own, we need to relocate GRUB elsewhere by running grub-install with the Linux partition as a parameter.

• On Linux, launch a Terminal with root privileges

• Find the name of the partition Linux is installed on by running fdisk –l (the partition you’re looking for is the one whose system is Linux, can be something like /dev/sda1 or /dev/hda1. For the rest of this post, I’ll use /dev/sda1)

• Install GRUB on the Linux partition by running : grub-install /dev/sda1

Step 2 – Get a copy of Linux boot sector

We will need to instruct Windows Boot Manager how to boot correctly Linux using Linux boot sector, which we will extract using dd.

• On Linux, launch a Terminal with root privileges

• Take a copy of Linux boot sector : dd if=/dev/sda1 of=/tmp/linux.bin bs=512 count=1

• Copy linux.bin on a FAT formatted USB key or any storage accessible from Windows Vista

Step 3 – Install Windows Vista

Step 4 – Configure dual booting in Windows Vista

We will create an entry for GRUB in Windows Vista boot configuration data store using bcdedit.

• On Windows Vista, launch a command prompt with administrative privileges (by right clicking on cmd and choosing Run as Administrator)

• Copy Linux boot sector on the root of the Windows boot (active) partition, namely the one containing bootmgr. If you don’t know for sure you can use diskpart or diskmgmt.msc to find out which one it is.

• Create an entry for GRUB :

o bcdedit /create /d “GRUB” /application BOOTSECTOR

o Note: bcdedit will return an ID for this entry that we will call {LinuxID} below. You will need to replace {LinuxID} by the returned identifier in this step. An example of {LinuxID} is {81ed7925-47ee-11db-bd26-cbb4e160eb27}

• Specify which device hosts a copy of the Linux boot sector

o bcdedit /set {LinuxID} device boot

• Specify the path to a copy of the Linux boot sector

o bcdedit /set {LinuxID} PATH \linux.bin

• Add Linux entry to the displayed menu at boot time

o bcdedit /displayorder {LinuxID} /addlast

• Let the menu be displayed 10 seconds to allow for OS selection

o bcdedit /timeout 10

Building a dual boot system with Windows Vista BitLocker protection with TPM support

Many people have wondered if it would be possible to dual boot a TPM-bitlockered instance of Windows Vista with Linux, or another OS. The answer is yes and the following procedure will hopefully help you setup your machine correctly.

Some (simplified) background on Bitlocker:

Bitlocker Drive Encryption allows encryption of Windows Vista’s partition and provides a secure startup process when in use with a TPM (a crypto chip on the motherboard). Basically the BIOS, the TPM, the MBR and the boot sector will collaborate to help verify that there was no modification to the boot sequence since Bitlocker was activated. This is done by using a function of the TPM to compute and store a hash of the code before executing it, at each of the initial steps of the boot sequence. Different hashes will be computed and stored in specific registers of the TPM. Then Windows Vista will ask the TPM to unseal its volume encryption key and the TPM will only provide this key if its registers are correctly set. Therefore if you replace Windows Vista’s MBR by a MBR that is not TPM aware, it won’t hash the boot sector before executing it and a register in the TPM won’t be populated. Same with the boot sector. Therefore Bitlocker will simply refuse to be enabled.

The underlying idea here is to have Bitlocker enabled with the original Windows Vista boot files. Another possibility would be to use a TPM-aware version of GRUB. However this would imply using files in the boot sequence that were not tested by Microsoft, which I would not recommend. Moreover, using original Windows Vista files offers you the benefits of code that went through the Security Development Lifecycle, which I personally find very valuable.

Note: I assume that you have a Bitlocker compatible machine (including TPM 1.2, TCG BIOS). See http://www.microsoft.com/technet/windowsvista/library/c61f2a12-8ae6-4957-b031-97b4d762cf31.mspx#BKMK_require

Step 1 – Install Linux

Note: be sure to leave enough unpartitioned space for Windows Vista: about 11 GB of free unpartitioned space and slots for 2 partitions are needed

Step 2 – Install GRUB on the Linux partition (outside of MBR)

See other post “How to use Windows Vista’s Boot Manager to boot Linux”

Step 3 – Get a copy of Linux boot sector

See other post “How to use Windows Vista’s Boot Manager to boot Linux”

Step 4 – Create partitions for Windows Vista

We need to create 2 primary NTFS formatted partitions on the disk: one active, 1.5GB size minimum and another larger (all the rest for instance with a minimum of 8.5GB). The former will be used to boot the machine (active partition) and will remain unencrypted while the latter will host Windows Vista and will be encrypted when we activate Bitlocker.

You can use diskpart tool to do this (available from Repair options on the Windows Vista DVD). Here is what the instructions may look like :

· select disk 1

· create partition primary size=2048

· active

· create partition primary

Step 5 - Install Windows Vista

Install Windows Vista on the largest NTFS partition.

Step 6 - Set up Windows Vista Boot Manager to boot Linux

See other post “How to use Windows Vista’s Boot Manager to boot Linux”.

Step 7 - Enable BitLocker on Windows Vista

See BitLocker documentation, like http://www.microsoft.com/technet/windowsvista/library/c61f2a12-8ae6-4957-b031-97b4d762cf31.mspx#BKMK_S3

Firefox Explorer (Or: Mozilla is Here)

MichaelF — Wed, 04 Oct 2006 11:47:00 GMT

So, as people are finding out, we at OSSL are doing things a little differently. One of those things Sam Ramji’s invite to the Mozilla guys to come up and help them making their products work on Vista better.

This was met with great criticism (Slashdot for example had people make all kinds of wild assumptions that started with suggestions all Mozilla folks flying on different planes to MS offering everybody jobs. And everything in between) and surprise.

Well, I am glad to report that the Mozilla guys are here. I have spent a really cool day in all kinds of meetings with the following guys from Mozilla; Robert Strong, Mike Schroepfer, Doug Turner, Vladimir Vukicevic, Scott Macgregor. (If I slaughtered anybody’s name I apologize for it in advance!!)

They are meeting with all kinds of people here, and it seems that both sides are learning greatly from each other. One thing that I noticed right away is that both the MS side and the Firefox side just love the technology and are hitting it off nicely.

The things we talked about today for example have been;

Cardspace; Mike Jones and Garrett Serack gave an overview of cardspace. Cardspace is a carrier of identity tokens. But you can read about it here as a nice starting point http://blogs.msdn.com/garretts/ . We spend some time talking about what it is providing, and that it is an effort from the industry to provide a way to provide identity management. Vista will include it out of the box, and .Net 3.0 will include the cardspace technology. Which will make it run on XP and 2003.

And we are currently looking to writing a plugin to make cardspace work inside of Firefox. (Like I said, we do things differently here at OSSL )

IE Lower Integrity Marked: IE will be running in a Low Integrity Marked setting, resulting in a greater security environment IE will run in. But it limits a whole bunch of places it can write to. (which is good) We talked with the IE people to the benefits and pitfalls of doing this, Mozilla is interested in checking into doing this for Firefox as well.

MS WPFE: the developers from the plugin had a conversation to make it work inside Firefox better. (I am not an expert on this, but this should give a better understanding of what it is; http://msdn.microsoft.com/winfx/reference/presentation/default.aspx )

MSI: MSI developers talked about the changes in and advantages of using the new MSI way of installing software in Vista. One of the things that came up was that some vendor have problems with their plugins (xpi files) such as Adobe. (Problem relating to global plugins) XPI can only be installed per user in Vista. I will talk more about this in a later blog

Windows Vista Shell: we went through a high level overview of the Windows shell in Vista.

If you want to know what the Mozilla folks thought of yesterday’s meeting, check out Vladimir’s blog http://blog.vlad1.com/

Well, I wanted to keep this short. But still let you all know what is going on. There is another day with them coming up tomorrow.

Btw, the chips have been implemented into the brains of all the Mozilla folks that have shown up here. And it looks like from Firefox 2.0 on it will be released on Windows exclusively.

Hank.

PSA: Vista RC1 available to the general public

MichaelF — Thu, 14 Sep 2006 17:15:00 GMT

We've received numerous inquiries regarding the Windows Vista Beta program so I wanted to make sure anyone subscribed to our RSS feed who also happens to be interested sees this before the program fills up.

http://www.microsoft.com/windowsvista/getready/default.mspx

In order to download the bits (3.0GB's for the 32-bit version to be exact) you will need a Windows Live account.

-michael

Open Source Applications on Windows Vista: Readiness Kit

MichaelF — Wed, 06 Sep 2006 02:19:00 GMT

http://www.devreadiness.org

· Guidance

· Technical Whitepapers

· Tools

· Demos

http://msdn.microsoft.com/windowsvista/reference/appcompat/default.aspx

· Thirty minute compatibility check

· Extended feature details

· Integration guidance

http://msdn.microsoft.com/windowsvista/reference

· Application compatibility

· Communications

· Interoperability and Migration

· Mobile PC

· Presentation

· Security

· System Services

Recently Mozilla’s Mike Beltzner suggested we provide: "Something like a checklist of the most common OS integration points that have changed from Windows XP would be extremely useful…"

Turns out there are some useful resources already available, see above, for those interested in developing Open Source applications for Windows Vista or ensuring that their current applications are compatible.

I took a few minutes to speak with Michael Shaw, Technical Evangelist, to get some additional details on the resources available at the sites listed above. The following is a short synopsis of our conversation.

What is http://www.devreadiness.org?

MShaw: The site is an aggregation of tools, whitepapers, presentations and videos intended to help developers understand how to make their existing Windows XP applications compatible with Windows Vista.

Are there other sites aside from devreadiness that developers can turn to?

MShaw: Yes, but many of the resources available on those sites are either linked from devreadiness or the tools/resources are also located on our site. Consider this a one-stop shop for Vista application compatibility resources.

Is there anything in particular that those interested should take a look at?

MShaw: Yes. I would first take a look at the Application Compatibility Cookbook that is located here: http://msdn.microsoft.com/windowsvista/reference/appcompat/default.aspx. This is the first document developers should look at concerning application compatibility. We have identified and addressed the major areas affecting applications when changing from Windows XP to Windows Vista. I’d like to point out the section on Computer Defaults as this is one big area that developers should take a close look to ensure compatibility for users.

Thanks to Michael Shaw for taking the time to talk with us and to Scott Laster who manages these sites. If you have specific questions about devreadiness or the Application Compatibility Cookbook, let us know.

-Michael