劍橋大學學生發現晶片卡交易機制的漏洞

劍橋大學學生發現晶片卡交易機制的漏洞


竹科工程師~~晶片卡上網轉帳 恐遭盜款

 

實用GPO的SCRIPT指令碼分享

附上 JosephPhoto 的 網路日誌我的網誌 - Windows Server 2003：陰影複製 Volume Shadow Copy Service (VSS) 管理服務 大大教的機碼，這機碼可以讓使用者端無法看到陰影複製回復的選項，以防意外發生......只讓特定電腦排除這GPO，才看的到陰影複製回復選項。為了必免每台電腦都每次開機都會重複執行，所以我還做了判斷，當file://filesrv-vm/gpowork/CloseShadowCopy.txt指定檔案內有該台電腦名稱，則跳過不執行，否則執行後再將該台電腦明稱寫入 \\filesrv-vm\gpowork\CloseShadowCopy.txt 檔案內，下次就不會執行了，這樣做的好處還可以看有那幾台電腦執行過，很方便，可應用在很多SCRIPT上。

===========================================================================================

@echo off

@type \\filesrv-vm\gpowork\CloseShadowCopy.txt find/I "[%COMPUTERNAME%]" > nul 2>&1

if %errorlevel% == 0 goto End

REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer /V NoPreviousVersionsPage /T REG_DWORD /D 1 /F

REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer /V NoPreviousVersionsRestore /T REG_DWORD /D 1 /F

echo [%COMPUTERNAME%] >> \\filesrv-vm\gpowork\CloseShadowCopy.txt

exit

:End

===========================================================================================

Access deny Terminal Service Mapping Local computer hard disk(device)

 

access deny Terminal Service Mapping Local computer hard disk(device)

如此可防止user將網路之file copy走

Configure settings for mapping client devices

Updated: January 21, 2005

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

To configure settings for mapping client devices

• Using Group Policies (best practice)
• Using Terminal Services Configuration

Using Group Policies (best practice)

1.     Open Group Policy.

2.     In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, Client/Server data redirection double-click the specific setting for the feature you want to configure, and then click Enabled.

Important

·         You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

·         To disable the redirection of clipboard data between server and client in Terminal Services sessions, enable Do not allow clipboard redirection.

·         To enable the redirection of audio data between the server and the client in Terminal Services sessions, enable Allow audio redirection. (Note that audio redirection is disabled by default in Terminal Server).

·         To disable the mapping of client COM ports in Terminal Services sessions, enable Do not allow COM port redirection.

·         To disable the mapping of client printers in Terminal Services sessions, enable Do not allow client printer redirection.

·         To disable the mapping of client LPT ports in Terminal Services sessions, enable Do not allow LPT port redirection.

·         To disable the mapping of client drives in Terminal Services sessions, enable Do not allow drive redirection.

·         To disable specifying of the default client printer as the default printer in a Terminal Services session, enable Do not set default client printer to be default printer in a session. The client printer is designated as the default printer for a Terminal Services session.

Note

·         Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Note

• These policies affect every client that connects to the terminal server. To define client device settings on a per-user basis, use the corresponding policies under User Configuration.

Using Terminal Services Configuration

1.     Open Terminal Services Configuration.

2.     In the console tree, click Connections.

3.     In the details pane, right-click the connection for which you want to configure client device mappings, and then click Properties.

4.     On the Client Settings tab, under Disable the following, select the appropriate check boxes:

·         Drive mapping to disable client-drive mapping. By default, Drive mapping is enabled (cleared).

·         Windows printer mapping to disable client Windows printer mapping. By default, Windows printer mapping is enabled (cleared). When enabled, clients can map Windows printers, and all client printer queues reconnect at logon. However, when both LPT and COM port mappings are disabled, you will be unable to manually add printers. When Windows printer mapping is disabled (checked), clients are unable to map Windows printers and client printer queues are not reconnected at logon. However, you will be able to manually reconnect printers if LPT port mapping or COM port mapping is enabled (cleared).

·         LPT port mapping to disable client LPT port mapping. By default, LPT port mapping is enabled (cleared). When enabled, client LPT ports are mapped for printing and are available in the port list of the Add Printer wizard. You need to manually create the printer to the LPT port using the Add Printer wizard. When LPT port mapping is disabled (checked), client LPT ports are not automatically mapped. You will be unable to manually create printers using LPT ports.

·         COM port mapping to disable client COM port mapping. By default, COM port mapping is disabled (cleared). When enabled, client COM ports are mapped for printing and are available in the port list of the Add Printer wizard. You will need to manually create the printer to the COM port using the Add Printer wizard. When COM port mapping is disabled (checked), client COM ports are not automatically mapped. You will be unable to manually create printers using COM ports.

·         Clipboard mapping to disable client clipboard mapping. By default, Clipboard mapping is enabled (cleared).

·         Audio mapping to disable client audio mapping. By default, Audio mapping is disabled (checked).

Note

·         To open Terminal Services Configuration, click Start, click Control Panel, double-click Administrative Tools, and then double-click Terminal Services Configuration.

Notes

• To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure. For more information, see Default local groups, Default groups, and Using Run as.
• Group Policy overrides the configuration set with the Terminal Services Configuration tool.

Information about functional differences

• Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. For more information, see Viewing Help on the Web.

 

Outlook 亂碼問題

以下內容由子璉Blog轉載
Outlook 亂碼問題

話說在論壇常常看到有人問到收到郵件亂碼，這個亂碼問題要配圖檔比較好說明。
說明之前先說，因為搞太多了，所以我自己有很多寄信收信的小工具，也可以當成是郵件軟體，以一個郵件軟體開發者的角度來說這件事，不要當成這是經驗談或偏方，有時在論壇上就有人要用經驗跟我揮，乾脆叫對方貼出信頭還比較快。

電子郵件從寄件者電腦郵件軟體輸出成專用的 MIME 郵件後，一路使用 SMTP 遞送，經過寄件伺服器 [> 叢集可能還會有對外主站] > 收件伺服器 [> 叢集可能還會有對內分站] 保留在收件伺服器上。
收件者再以郵件軟體使用 POP3 到收件伺服器上下傳接收。
註：中括號表示可有可無

每經過一台 SMTP 轉送，包含收件伺服器分站，就會在信件最上方加上經過伺服器的記錄，所以若要追蹤各伺服器的時間、路徑，就可以從信頭來看，越上方的越後經過，越靠近收信者。
當然倒回推的時候，若是中間不是經過大型可信賴的郵件伺服器，可能會被偽造，比如說有些大企業內部可能有多個 Mail Server ，可能路徑是：
部門 Mail Server > 公司 Mail Server > 轉信站 (ISP 業者) ...
而一般使用者可能直接透過 ISP 業者寄出，所以一般使用者若知道某些大企業的信頭 (Mail Header) 找出路徑時，就可以仿造透過程式方式送出不存在的 Mail 記錄，佯裝是部門 Mail Server 寄出。

所以信頭很多不可靠，但是反過來說，一封郵件能不能正確的解讀，就要看信頭。

下面這張圖是一封信頭的結構圖，這是屬於 MIME 格式，詳情可參考 RFC1521 ，這種格式可以內崁，也就是一封郵件裡面可能還有多封郵件或檔案，比如說附加檔就是以 MIME 格式崁入在信件的 MIME 格式中。



而一封郵件是否能正確解碼，就看郵件是否有崁入編碼。

早期郵件通常是本國寄來寄去，但隨著國際化，跨國郵件越來越多，所以編碼的問題也越加重要，但這類軟體多半是英語系國家開發，所以包含 Outlook Express / Windows Live Mail / Outlook 的預設值，都是不寫入國際編碼資訊，而收信時若信頭沒有標記國際編碼時，就會依據控制台地區語言來假定這封郵件的編碼，當寄件者使用多國語言時，就容易發生亂碼。

最簡單的方法，就是請寄件者在 Outlook 外寄郵件編碼中，設定為 utf8 ，這邊不是指單封郵件的編碼，而是整套軟體的設定。整套軟體的設定會套用在整封郵件上，信件的編碼只會套用在 Mail Body 上，並不會影響到 Mail Header ，也就是說整封郵件的 MIME 編碼方式可以與內崁的附件採用不同的編碼方式，比如說你內文要用簡中，但你不需要把 Outlook 的設定變更為簡中，只需要把該封郵件的編碼變更為簡中即可。

特別的狀況：
假設簡中寄件者沒設定外寄的郵件編碼，會以 GB 編碼寄出，這個編碼相容 ANSI ，繁中收件者用 ANSI 相容的 Big5 就會解出一堆亂碼，但若使用者有安裝 Unicode 補完計畫，就會因為 ANSI 轉 big5 映射到 Unicode 後，顯示出部分正確的編碼，不過要注意，這只是剛剛好，不是通解。
正確的方法簡中寄件者發出郵件經過 Unicode 適用於網路傳輸的 utf8 邊碼寄送，到了使用者電腦就會用 utf8 解整封郵件，再依據內崁的內容顯示出簡體中文。

注意的部分：
Win9x(95/98/SE/Me) 是 ANSI Windows ，WinNT(2k/XP/2003/Vista/2008/7) 是 Unicode Windows ，Outlook 2002 以前是 ANSI Windows (所以才能安裝在 WinMe 以前) ，Outlook 2003 以後是 Unicode Windows ，只有 Outlook 2003 與 Windows 2000 以後才是純 Unicode 環境，能把亂碼問題減少到最少，此外若碰到掉字，可能是對方使用到 Unicode 3.1 以後的字元，Win2k/XP/2003 是 Unicode 2.0 ，WinVista/2008/7 是 Unicode 5.0 ，若使用到 Unicode 5.0 的字元，在舊版的環境下會無法顯示，哪些是 Unicode 3.1/5.0 的字元呢？先前這篇有，新注音輸入法中不是黑色的都是：
[測試記錄] UTF32 位元組數與 Char 型別~