Excel Files From Web Won't Open

I had an interesting issue creep up a bit ago with Excel files that were created by a web application not opening in Excel.

I had a ColdFusion app that would generate reports on the fly for users.  We were using CFHEADER and CFCONTENT to deliver table formatted data as XLSX files.  It had been working fine right up until it didn't.  We hadn't made any changes to the code and checked and confirmed that there were no changes/patches to the system since the last known good report was generated.

As it turns out, in mid-July Microsoft upgraded the security in Excel concerning how it handled HTML files with XLS or XLSX extensions from untrusted locations. Previously, Excel would warn you about the file having a type mismatch and would let you accept opening the file.  From the update, Excel would no longer allow the file to be opened and offered no explanation or error message.

There are a couple of workarounds to open the files:
The first is on a file by file basis -

• Once you have the file, Right-Click on it to get the context menu and select ‘Properties’
• On the ‘General’ tab, click ‘Unblock’ and then ‘OK’
• Open the file as usual. You’ll get this message - 'The file format and extension of filename don't match. The file could be corrupted or unsafe. Unless you trust its source don't open it. Do you want to open it anyway?'
• Click ‘Yes’
• The file will open

Another workaround is to change the Trusted Locations settings in Excel

• Open File > Options > Trust Center > Trust Center Settings > Protected View
• Clear the check-marks from  "Enable Protected View for file originating from the Internet" and “Enable Protected View for files located in potentially unsafe locations”.
• Files pulled from the Internet will open.

If you've been building spreadsheets in ColdFusion with CFCONTENT and CFHEADER, it's time to start using CFSPREADSHEET and the associated functions.

Continue reading →

Apple Mobile Devices - Patch 'em Up NOW

Apple has issued an "important security update", iOS 9.3.5, to neutralize a new piece of malware that can remotely jailbreak iPhones allowing an attacker full access to your device to read texts and email, record calls, track your location and activate your phone's camera and microphone.

The update patches the three previously unknown zero-day vulnerabilities that together are referred to as "Trident".

To check if you're at risk look at Settings > General > About > Version   If you're on version 9.3.5 then you're OK.  If you're on a different version you should update now.  You can pull the update through Settings > General > Software Update then just follow the instructions to download and install it.

For those interested we'll go into the details a little:
The three exploited vulnerabilities are:

• CVE-2016-4655, Memory Corruption in Webkit 
• CVE-2016-4656, Information leak in Kernel 
• CVE-2016-4657, Kernel Memory corruption leads to Jailbreak.

The issue was found by cyber security firms Lookout and Citizen Lab, who were tipped off to unusual text messages received by an iPhone user in the United Arab Emirates.
Lookout and Citizen Lab worked with Apple on the patch before releasing information on the vulnerability.
The Trident vulnerabilities are exploited in a spyware package called Pegasus which is widely available throughout the world

Continue reading →

Windows God Mode

Just the other day I was helping a friend set up their computer after doing a full reinstall of the OS.

Now configuring a system can get to be a bit tedious with all of the clicking necessary to get to all of the settings and tools.  So to make things a little easier, I clued him into Windows' God Mode.

God mode puts all of the the things you can customize together in one place on your Windows machine, and it is available from Windows Vista through Windows 10.

Getting to God Mode is easy; just create a folder anywhere you like and name it God Mode.{ED7BA470-8E54-465E-825C-99712043E01C}

Actually, you can name it anything you like before the dot.  the important part is what comes after the dot.  Don't change that part.

Once you rename the folder, open it up and you'll find a wealth of tweaks and tools.

Give it a look if you're of the mind.  If you find it convenient, enjoy.  If it's not for you, just delete the folder and it's gone.

Continue reading →

GHOST Buffer Overflow Vulnerability

A critical vulnerability that impacts a majority of Linux servers has been identified.  This vulnerability, named "GHOST", affects the GNU C library (glibc) that is used by Linux applications to interface with the Linux operating system via a series of function calls. The “buffer overflow” vulnerability in a pair of glibc’s functions can allow a remote attacker to exploit this flaw to execute arbitrary code on the system.  

Details of the discovery in this posting on Openwall and, Red Hat provides a detailed description of the vulnerability and updates to resolve the issue.

Continue reading →

Apple Releases OS X Bash/ShellShock Patch

The official patches for the UNIX shell vulnerability have been released.
You may see them listed under 'Software Update' or you may get system notifications alerting you to them.
You can also grab them yourself here:

·              Mavericks v10.9.5+: http://support.apple.com/kb/DL1769

·              Mountain Lion v10.8.5: http://support.apple.com/kb/DL1768

·              Lion v10.7.5: http://support.apple.com/kb/DL1767

Continue reading →

CSRF/XSRF Protection in ColdFusion 9

Here's another little thing that's come across my desk and I hope my solution can be of some help to others.

I was asked to provide a solution to protect a site from Cross Site Request Forgery (CSRF or XSRF) attacks.  Specifically, there were forms on the site that were considered at-risk for exploitation.  I won't get into great detail on what CSRF is, but basically it's an attack vector that attempts to exploit the trust that a website has in the user's browser to allow malicious actions to take place on the server.  

CF10 has methods for CSRF protection available built in, but the site I was asked to chime in on is on CF9.

So, the forms were vulnerable to a CSRF attack because a malicious user could cause a legitimate, authenticated user to unwittingly submit them.  In order to protect the public facing forms, it's necessary to set up a condition where the server can trust that the form submission is from the legitimate user during their session.  The method CF10 uses is to send a token with the form and check for it on submission.  We can do the same thing by adding just a few lines of code to our forms.

Here's a typical self-posting form:

<cfif structKeyExists(form, 'sendInfo')>

       <p>Your information has been received.</p>

    <cfelse>

      <cfform>

            <label for="fName">First name:</label><cfinput name="fName" type="text"><br>

            <label for="lName">Last name:</label><cfinput name="lName" type="text"><br>

            <input type="submit" value="Submit" name="sendInfo">

      </cfform>

    </cfif>

Let's add a token to the form that the server can check for:

<cfif structKeyExists(form, 'sendInfo')>

       <p>Your information has been received.</p>

    <cfelse>

      <cfset session.foobar = createUUID()>

      <cfform>

            <cfoutput><input type="hidden" name="foobar" value="#session.foobar#"></cfoutput>

            <label for="fName">First name:</label><cfinput name="fName" type="text"><br>

            <label for="lName">Last name:</label><cfinput name="lName" type="text"><br>

            <input type="submit" value="Submit" name="sendInfo">

      </cfform>

    </cfif>

Next, we want the form processor to check for the token:

<cfif structKeyExists(form, 'sendInfo')>    

    <cfif structKeyExists(session, 'foobar') and form.foobar is session.foobar>

       <p>Your information has been received.</p>

       <cfelse>

           <p>The form has a problem</p>

       </cfif>

    <cfelse>

      <cfset session.foobar = createUUID()>

      <cfform>

            <cfoutput><input type="hidden" name="foobar" value="#session.foobar#"></cfoutput>

            <label for="fName">First name:</label><cfinput name="fName" type="text"><br>

            <label for="lName">Last name:</label><cfinput name="lName" type="text"><br>

            <input type="submit" value="Submit" name="sendInfo">

      </cfform>

    </cfif>

And finally, we want to do a little housekeeping by dropping the token from the session when we're done with it:

<cfif structKeyExists(form, 'sendInfo')>    

    <cfif structKeyExists(session, 'foobar') and form.foobar is session.foobar>

       <p>Your information has been received.</p>

       <cfelse>

           <p>The form has a problem</p>

       </cfif>

    <cfset structDelete(session, 'foobar')>

    <cfelse>

      <cfset session.foobar = createUUID()>

      <cfform>

            <cfoutput><input type="hidden" name="foobar" value="#session.foobar#"></cfoutput>

            <label for="fName">First name:</label><cfinput name="fName" type="text"><br>

            <label for="lName">Last name:</label><cfinput name="lName" type="text"><br>

            <input type="submit" value="Submit" name="sendInfo">

      </cfform>

    </cfif>

So there ya' go.  A handful of code and you've got your server recognizing your forms for a one-time post and bouncing them on any attempted re-posting.

Continue reading →

Dude, Where's My Phone (or Tablet)?

Earlier this week Google released Android Device Manager, an online tool to locate misplaced Android devices.  This handy little tool will let you:

• locate your phone or tablet on a map in real time  (if you think you left it somewhere),
• ring it at max volume (if it’s misplaced - yes, you could call it from another phone, but this will override ‘Silent’ or ‘Vibrate Only’ so it will ring , or
• erase it (if it's been stolen or is otherwise unrecoverable).

You will need to set up the erase feature on your device, but the locator and ring features work without any setup.

You can read the announcement or just go ahead and play with it.

Continue reading →