Internet Explorer 8 Beta 2 at a glance

IE8 Beta 2 at a glance
It's been nearly two years since Microsoft released its last major update to Internet Explorer. With the release of a feature-complete Beta 2 of IE8, the reason for the long gestation period is obvious. This is a top-to-bottom makeover of Microsoft's flagship web browser, with dozens of new usability and security features and a newfound adherence to web standards. In this gallery, I introduce the highlights of IE8 in action.In this overview screen you can see color-coded tab groups, links to previously closed tabs, improvements to the search box in the top right corner, and the new inline search feature. But there's much more
Smart Address Bar:
When you start typing in the IE8 Address bar, a drop-down list suggests destinations you might want to visit. The big improvement over the Firefox 3 Awesome Bar is that the results are categorized and grouped, allowing you to see Autocomplete suggestions as wells as entries from your Favorites folder and your browsing history. Coolest feature of all? If you inadvertently mistype an address, you can click a red X to delete it permanently from the history or suggestion list.
Improvements in tabbed browsing:


IE8 adds tabbed browsing features that previously required third-party add-ins, including the ability to duplicate a tab or reopen a closed tab. Unique to IE8 is the concept of tab groups, which use color codes to identify tabs opened from a common page.
Crash recovery and tab history:
A buggy add-in or poorly written web page can crash the browser, potentially taking every other tab with it. IE8 builds in crash recovery tools and keeps track of pages from the current and previous session. In my testing, I found that the Tab Isolation feature works well; in most cases a crashed page only takes down the current tab, leaving other open tabs untouched.
Adding functions:
Accelerators are the IE8 term for browser add-ins that can be installed and made available directly from a web page. The default selection includes an extensive array of options, including several from Microsoft arch-rival Google and other third parties like Yahoo, eBay, and Yahoo.



Accelerators in action:
Any Accelerators you've set up are available for use with any selected text. In the web-page snippet at the top of this page, the Accelerator menu indicatoror is visible because I've highlighted the phrase Miami-Dade County. Clicking that indicator takes me to a menu where I can choose from any available action; in this example, I'm about to send the selection to Google Maps, which will open in a new browser tab.
InPrivate browsing:
If you'd prefer to leave no traces of your current browsing session, turn on InPrivate browsing. The new session opens in a separate window, with an indicator at the left of the address bar as shown here. When you close that window, all cookies, cached files, and form data are wiped out completely




Inline search (finally):
In line search has been one of the most glaring omissions in IE for its entire life. It's implemented in IE8 with the features you'd expect, including highlights that can be toggled on or off and an indicator of the number of hits for the current search term.
Web search improvements:



The search box in the top right corner of the IE8 window has some nifty improvements. As shown at the top, it shows history items that match the search term, and also allows you to switch to a different search provider by clicking an icon. For sites that support the new Visual Search feature (such as Wikipedia and Amazon, shown here), a drop-down list of search results allows you to skip the list of search results completely and go straight to the desired page.
Web slices:
With a few lines of code, a website developer can turn a module on a page into a "Web slice." In the example at the top here, I've clicked the Web slice indicator for a local weather report from Live Search. Clicking the associated link on the new Favorites bar displays the contents of that slice without having to load a full web page or even leave the current page.
Managing add-ons:
The new add-on management console provides one-stop access to toolbars, ActiveX controls, plugins, and Accelerators. You can easily rearrange groups and set non-Microsoft controls as the default for particular actions, as I've done here with Google's Blogger and Google Maps tools.
Compatibility view:
IE8's new adherence to web standards means that many sites coded for earlier IE versions will render improperly in the new browser. A compatibility button on the Address bar allows you to switch to compatibility mode for all pages on that domain. Unlike earlier betas, you don't have to restart the browser to switch compatibility mode on or off.
Developer tools:
The Developer Tools option on the Tools menu (also available via the F12 keyboard shortcut) pulls up this remarkably detailed console for examining, tweaking, and debugging source code, CSS style sheets, and script on any web page.
Blocking unsafe sites:
IE8's phishing filter gets a new name, SmartScreen Filter, and a blood-red border that makes it difficult to ignore a potentially dangerous site. The protection extends to downloaded files as well; any download attempt from a site flagged asunsafe will be blocked in equally emphatic style.

Surf jacking makes it vulnerable:HTTPS:

Cookies and redirection seem to be this year’s “attack vector du jour.” At DefCon, Mike Perry gave a rather disconcerting talk about surf jacking and how it can be used to capture SSL session cookies. Michael Kassner would like to explain how surf jacking compromises HTTPS security
The infamous cookie causes yet more grief
In reality, it’s not the cookie that causes the problems; they are just an easy way to subvert HTTP and now HTTPS connections. There are two major categories, persistent cookies and session cookies. It’s important that we know the difference between the two when discussing how surf jacking works:
Persistent cookies are so named because they have a time-to-live that lasts longer than the current Web-browsing session. The first- and third-party cookies I discussed in my article about Behavioral Targeting and Deep Packet Inspection would be considered persistent cookies. Persistent cookies have very little to do with the actual Internet connection.
Session cookies only last the length of a Web-browsing session. More importantly, they carry information that validates the Web browser to the Web server.
To help explain, let’s look at the life of a session cookie in the following example:
Using my Web browser, I log on to https://www.mybankxy.com.
The mybankxy.com Web server authenticates my credentials and places a small text file on my computer, called a session cookie. The session cookie contains pertinent user log-on and security information.
After the portal Web page opens, I click on a link for the Web page with my savings information.
My Web browser sends the Web page query and my session cookie back to the mybankxy.com web server.
The session cookie allows the Web server to reverify who I am. If everything is in order, the Web server then sends the Web page I asked for. Without the session cookie, I’d have to log in each time a new Web page was served up.
After I complete my transactions, I log off the Web site https://www. mybankxy.com. The session cookie then invalidates itself and is deleted.
So, session cookies are useful — browsing the Web without them would get annoying real fast. Another function of session cookies is to remember actions that take place on a Web page. This is especially important if session information may be needed on a different Web page on the same Web server. A prime example of this would be a Web site that uses shopping carts; without session cookies the items purchased wouldn’t be remembered when the Web browser asked for the check-out Web page.
301 Moved Permanently
Now, I’d like to take a look at HTTP redirection. In that same article about Behavioral Targeting and Deep Packet Inspection, I talked about redirection being a key component to getting illegitimate cookies installed on a computer. As you will see in the following example, surf jacking also uses redirection, but a slightly different version of it called the “301 Moved Permanently” HTTP error. As the name suggests, the 301 redirection is considered permanent. The code also contains the URL of the missing or renamed page as well as the URL of the new page.
Surf jacking
First a little history, almost a year ago Robert Graham introduced “Side Jacking” at Black Hat 2007. It was such an interesting concept that I covered it in the article “Can Your Wireless Network Be Sidejacked?” Side jacking is a clever way of stealing HTTP session cookies, allowing the attacker to actually hijack a HTTP session without knowing any log-on credentials. That was a year ago, and now there are proof-of-concept attack tools to do the same thing with SSL connections, which is scary. However, knowledge is power, so let’s take a look at how surf jacking works by following the steps of an attack:
I log in to my online bank at https://www.mybankxy.com. I need to move some money to my debit card as I’m buying something online.
Once again the mybankxy.com Web server authenticates me and places a small text file on my computer, called a session cookie.
I forgot the amount I needed, so I open a new browser window and go to http://www.commercexy.com.
Just my luck there’s an attacker sniffing traffic on the same Wi-Fi hotspot. So the attacker already knows that I have an active HTTPS (encrypted) session to www.mybankxy.com and that I just opened a HTTP (in the clear) session to www.commercexy.com. It’s a perfect opportunity to run the surf jacking attack.
The attacker sends back a “301 Moved Permanently” in response to the Web page query I sent to www.commercexy.com.
The redirection now occurs as the 301 response contains the header http://www.mybankxy.com. This is telling my Web browser it needs to go to http://www.mybankxy.com to find the http://www.commercexy.com Web page I was looking for. Notice that the response is using HTTP and not HTTPS.
My Web browser now starts a new and unsecured connection by sending a query to http://mybankxy.com, and since my first HTTPS session to www.mybankxy.com is still open, the session cookie is valid. Therefore, this second query contains that same session cookie.
Since the attacker is sniffing all my traffic via the open Wi-Fi hotspot, the session cookie is captured. Done deal.
In order to give the appearance that nothing happened, the attacker then sends another “301 Moved Permanently” finally sending my browser to the Web site http://www.commercexy.com.
That’s the attack. Granted, there are certain conditions required to pull the attack off, but it’s entirely possible. I wouldn’t want an attacker going to https://mybankxy.com and using the captured session cookie to change my log-on credentials or even worse. For more details on the attack, please go to the “Enablesecurity.com” Web site and watch the demonstration. It shows how surf jacking can be used against a vulnerable Gmail account.
Prevention consists of two parts
The immediate solution to surf jacking is easy, just never open a HTTP session if you have an active HTTPS session. The long-term solution is more complicated and involves Web site developers. Sandro Gauci of Enablesecurity mentions how the attack can be mitigated, along with some potential rollout issues:
“Cookies can have a flag called “secure,” which when present causes the browser cookie to be sent only through encrypted channels. When the web browser is redirected to a clear text channel (HTTP rather than HTTPS), such cookies are not included in the HTTP request. This behavior solves the problem described and can be easily implemented on web services that separate services that need encryption from those that do not. One such service is E-banking, which is normally segregated on a web site such as https://secure.bank.com/.
However there are cases where setting the Cookie secure flag is not an easy option. A web service such as Google shares a session and credentials across various domains and switches between HTTP and HTTPS depending on the service. In this case, the solution is not as easy as setting the Cookie to “secure” because that would not scale well with the rest of the infrastructure. Google appears to be have mitigated this for Gmail by providing the “use only HTTPS” option - but other Google services such as Google Docs remain vulnerable to attack.”
Final thoughts
Surf jacking as an attack vector is serious. Hopefully, this article will be a reminder to always use good Web-surfing practices, especially now making sure to only have one Web-browser session open if it’s a HTTPS connection. I realize that surf jacking requires an attacker to be in a position to capture traffic, but theoretically that can take place anywhere along the traffic’s path. I just wouldn’t want to take a chance on having personal information stolen or worse yet trying to figure out why my bank accounts are empty.

How do I... Set up multiple network interfaces in Windows XP?

The age of a single network interface with a single IP address assigned to it is a thing of the past in many situations. As more networks are rolled out and more computers are shipped with multiple connection methods, the need for a workstation to participate in more than one network is becoming more common. Scott Lowe shows you how to set up and manage multiple network interfaces in Windows XP.

Please refer below pdf for complete reference.
http://i.t.com.com/i/tr/downloads/home/slowe_hdi_multiple_networks.pdf

10 dirty little secrets you should know about working in IT

If you are preparing for a career in IT or are new to IT, many of the “dirty little secrets” listed below may surprise you because we don’t usually talk about them out loud. If you are an IT veteran, you’ve probably encountered most of these issues and have a few of your own to add — and please, by all means, take a moment to add them to the discussion. Most of these secrets are aimed at network administrators, IT managers, and desktop support professionals. This list is not aimed at developers and programmers — they have their own set of additional dirty little secrets — but some of these will apply to them as well.
10.) The pay in IT is good compared to many other professions, but since they pay you well, they often think they own you
Although the pay for IT professionals is not as great as it was before the dot-com flameout and the IT backlash in 2001-2002, IT workers still make very good money compared to many other professions (at least the ones that require only an associate’s or bachelor’s degree). And there is every reason to believe that IT pros will continue to be in demand in the coming decades, as technology continues to play a growing role in business and society. However, because IT professionals can be so expensive, some companies treat IT pros like they own them. If you have to answer a tech call at 9:00 PM because someone is working late, you hear, “That’s just part of the job.” If you need to work six hours on a Saturday to deploy a software update to avoid downtime during business hours, you get, “There’s no comp time for that since you’re on salary. That’s why we pay you the big bucks!”
9.) It will be your fault when users make silly errors
Some users will angrily snap at you when they are frustrated. They will yell, “What’s wrong with this thing?” or “This computer is NOT working!” or (my personal favorite), “What did you do to the computers?” In fact, the problem is that they accidentally deleted the Internet Explorer icon from the desktop, or unplugged the mouse from the back of the computer with their foot, or spilled their coffee on the keyboard.
8.) You will go from goat to hero and back again multiple times within any given day
When you miraculously fix something that had been keeping multiple employees from being able to work for the past 10 minutes — and they don’t realize how simple the fix really was — you will become the hero of the moment and everyone’s favorite employee. But they will conveniently forget about your hero anointment a few hours later when they have trouble printing because of a network slowdown — you will be enemy No. 1 at that moment. But if you show users a handy little Microsoft Outlook trick before the end of the day, you’ll soon return to hero status.
7.) Certifications won’t always help you become a better technologist, but they can help you land a better job or a pay raise
Headhunters and human resources departments love IT certifications. They make it easy to match up job candidates with job openings. They also make it easy for HR to screen candidates. You’ll hear a lot of veteran IT pros whine about techies who were hired based on certifications but who don’t have the experience to effectively do the job. They are often right. That has happened in plenty of places. But the fact is that certifications open up your career options. They show that you are organized and ambitious and have a desire to educate yourself and expand your skills. If you are an experienced IT pro and have certifications to match your experience, you will find yourself to be extremely marketable. Tech certifications are simply a way to prove your baseline knowledge and to market yourself as a professional. However, most of them are not a good indicator of how good you will be at the job.
6.) Your nontechnical co-workers will use you as personal tech support for their home PCs
Your co-workers (in addition to your friends, family, and neighbors) will view you as their personal tech support department for their home PCs and home networks. They will e-mail you, call you, and/or stop by your office to talk about how to deal with the virus that took over their home PC or the wireless router that stopped working after the last power outage and to ask you how to put their photos and videos on the Web so their grandparents in Iowa can view them. Some of them might even ask you if they can bring their home PC to the office for you to fix it. The polite ones will offer to pay you, but some of them will just hope or expect you can help them for free. Helping these folks can be very rewarding, but you have to be careful about where to draw the line and know when to decline. For help, take a look at TechRepublic’s free download “Ten ways to decline a request for free tech support.”
5.) Vendors and consultants will take all the credit when things work well and will blame you when things go wrong
Working with IT consultants is an important part of the job and can be one of the more challenging things to manage. Consultants bring niche expertise to help you deploy specialized systems, and when everything works right, it’s a great partnership. But you have to be careful. When things go wrong, some consultants will try to push the blame off on you by arguing that their solution works great everywhere else so it must be a problem with the local IT infrastructure. Conversely, when a project is wildly successful, there are consultants who will try to take all of the credit and ignore the substantial work you did to customize and implement the solution for your company.
4.) You’ll spend far more time babysitting old technologies than implementing new ones
One of the most attractive things about working in IT is the idea that we’ll get to play with the latest cutting edge technologies. However, that’s not usually the case in most IT jobs. The truth is that IT professionals typically spend far more time maintaining, babysitting, and nursing established technologies than implementing new ones. Even IT consultants, who work with more of the latest and greatest technologies, still tend to work primarily with established, proven solutions rather than the real cutting edge stuff.
3.) Veteran IT professionals are often the biggest roadblock to implementing new technologies
A lot of companies could implement more cutting edge stuff than they do. There are plenty of times when upgrading or replacing software or infrastructure can potentially save money and/or increase productivity and profitability. However, it’s often the case that one of the largest roadblocks to migrating to new technologies is not budget constraints or management objections; it’s the veteran techies in the IT department. Once they have something up and running, they are reluctant to change it. This can be a good thing because their jobs depend on keeping the infrastructure stable, but they also use that as an excuse to not spend the time to learn new things or stretch themselves in new directions. They get lazy, complacent, and self-satisfied.
2.) Some IT professionals deploy technologies that do more to consolidate their own power than to help the business
Another subtle but blameworthy thing that some IT professionals do is select and implement technologies based on how well those technologies make the business dependent on the IT pros to run them, rather than which ones are truly best for the business itself. For example, IT pros might select a solution that requires specialized skills to maintain instead of a more turnkey solution. Or an IT manager might have more of a Linux/UNIX background and so chooses a Linux-based solution over a Windows solution, even though the Windows solution is a better business decision (or, vice versa, a Windows admin might bypass a Linux-based appliance, for example). There are often excuses and justifications given for this type of behavior, but most of them are disingenuous.
1.) IT pros frequently use jargon to confuse nontechnical business managers and hide the fact that they screwed up
All IT pros — even the very best — screw things up once in a while. This is a profession where a lot is at stake and the systems that are being managed are complex and often difficult to integrate. However, not all IT pros are good at admitting when they make a mistake. Many of them take advantage of the fact that business managers (and even some high-level technical managers) don’t have a good understanding of technology, and so the techies will use jargon to confuse them (and cover up the truth) when explaining why a problem or an outage occurred. For example, to tell a business manager why a financial application went down for three hours, the techie might say, “We had a blue screen of death on the SQL Server that runs that app. Damn Microsoft!” What the techie would fail to mention was that the BSOD was caused by a driver update he applied to the server without first testing it on a staging machine.

Five things that suck about working in IT

Working in IT is one of the world’s most challenging jobs — and not always in a good way. Here are five reasons why working in IT can really suck sometimes.
The reality show America’s Toughest Jobs debuts on Monday. Contestants will be logging, oil drilling, building bridges, and bullfighting. All of those jobs are rough and flashy and that stuff makes for good television, but if you want to talk about the toughest jobs in America then I think IT deserves a place on the list.
I often tell people that working in IT is one of the toughest jobs in world, and TechRepublic is here to make it a little easier for the 10 million IT pros on the planet. There’s often not a lot of sympathy for IT as a hard job because IT workers are typically well paid, and it is a desk job, after all. So, I’ve put together the following list of five things that can make working in IT tortuous at times.
5. You get a lot of fingers pointed at you
When error messages pop up and system outages occur, employees and managers quickly start pointing fingers at IT and the pressure is intense to get things fixed quickly to keep users from losing productivity. That’s part of the job and you have to always be prepared for it. In fact, some IT pros even get an adrenaline rush from this type of high-pressure stakes.
The problem is that IT pros hear loud and clear when things aren’t working, but they rarely get much appreciation during the other 99% of the time when systems are running smoothly.
4. People assume you’re an expert in all things tech
When you’re an IT worker, non-techies tend to assume that you know everything about all tech subjects. For example, if you’re a help desk technician you get questions about how the company’s Web site is built. And if you’re a Java developer you can expect to field questions about how to deal with spam and spyware on an employee’s machine.
There are obviously tactful ways to handle this, but many IT pros can’t help but get a little frustrated by this, or even feeling a little inadequate. Worse, because you’re a techie, a lot of your co-workers will come to you for advice on buying PCs, digital cameras, and TVs. Some will even ask you to fix their PC for free or help troubleshoot a problem with their cable modem.
3. You have to continually re-train, on your own dime
I think it’s fair to say that no profession on earth is changing faster than the IT field right now and that’s not likely to change any time soon. The pace of development and innovation in hardware and software products is staggering. As a result, the knowledge that it takes just to keep your current job is always growing and morphing, and IT pros have to take responsibility for their continuing education or risk having their skills and knowledge become obsolete within a few short years.
This is a constant struggle. The big challenge is that many companies don’t officially recognize this problem, and so IT pros have to use free resources like TechRepublic to stay current, or pay for training out of their own pockets. In the past, TechRepublic surveys have shown that over 50% of IT pros pay for their own training.
2. The hours are long and irregular
Lots of jobs in the knowledge economy require long hours, so it’s not unique that many IT professionals — from developers to administrators to systems integrators — have to work overtime on a regular basis. However, what does set IT apart is the scattered irregularity of those hours. Most IT workers are always on call, or are at least part of an on-call rotation, in case critical systems go down during off-hours.
In addition, many IT pros have tasks that they need to do when there aren’t as many users on the system. That means coming in early to run backup routines or staying late to update an application or patch a server after most of the users have logged off at the end of the day.
1. The job market is tumultuous and in transition
During the late 1990s, people flooded into IT, chasing the promise of $65K/year jobs that were going unfilled because of the lack of qualified candidates. IT professionals who were already in the field could hop jobs and get significant pay raises. IT pros were in demand. But, it didn’t last. The dot com implosion and the wrap up of the Y2K fixes meant that a lot of tech jobs disappeared.
Since then, the off-shore outsourcing phenomenon and the H1B visa issue have put further strain on the IT job market in the U.S. and abroad. Many IT professionals run the risk of building their skills, experiences, and their careers, only to have their jobs shipped overseas to save costs. That means IT professionals have to be particularly adept at managing their own careers in order to avoid being unemployed or underemployed.

"InPrivate" with IE 8

When Microsoft’s Internet Explorer 8 browser makeover ships later this year, it will feature several nifty privacy features aimed at giving surfers control over their Web footprints.One week after bloggers discovered clues that IE 8 will include a private browsing (ahem, porn mode), Microsoft used the official IE blog to discuss four new granular controls in the browser.They include:
InPrivate Browsing: This lets you control whether or not IE saves your browsing history, cookies, and other data. Delete Browsing History: This helps you control your browsing history after you’ve visited Web sites. InPrivate Blocking: This informs you about content that is in a position to observe your browsing history, and allows you to block it. InPrivate Subscriptions: This feature allow you to augment the capability of InPrivate Blocking by subscribing to lists of Web sites to block or allow.

Anti-malware blocker, cross-site scripting protections coming in IE 8 :

When Microsoft’s Internet Explorer 8 hits the Beta 2 milestone in August, the browser makeover will feature a full-fledged anti-malware blocker and new protections against some forms of cross-site scripting attacks.
The existing phishing filter IE 7 has been renamed SmartScreen Filter and will include blacklist-based blocking of known exploit sites.
The SmartScreen anti-malware feature is URL-reputation-based, which means that it evaluates the servers hosting downloads to determine if those servers are known to distribute unsafe content. SmartScreen’s reputation-based analysis works in concert with other signature-based anti-malware technologies like the Malicious Software Removal Tool, Windows Defender, and Windows Live OneCare, in order to provide comprehensive protection against malicious software.
Data from Microsoft’s existing security partners will be used to power the new SmartScreen Filter and there is a chance that new third-party providers will be included. Google’s blacklist, which now powers the anti-malware blocker in Firefox 3, is not included.
Also new in IE 8 Beta 2 is an XSS Filter to detect Type-1 (reflection) attacks that can lead to cookie theft, keystroke logging, Web site defacement and credentials theft:
The XSS Filter operates as an IE8 component with visibility into all requests / responses flowing through the browser. When the filter discovers likely XSS in a cross-site request, it identifies and neuters the attack if it is replayed in the server’s response. Users are not presented with questions they are unable to answer – IE simply blocks the malicious script from executing.

Microsoft program manager Andy Zeigler provides all the details on the new features and my colleague Mary Jo Foley has some additional commentary.The new beta refresh will also include support for safer Web 2.0-type mashups, DEP (data execution protection) turned on by default in Windows Vista SP 1, domain highlighting to help flag phishing attacks and changes to the way ActiveX controls are handled.

Xobni -Quickly find e-mail messages and attachments in your Outlook Inbox.

Xobni is the Outlook plug-in that saves you time finding email conversations, contacts and attachments. After a quick install, you'll see the new Xobni toolbar appear in Outlook - and suddenly information will become much easier to find. When a new email arrives, the sender's full communication history appears in the Xobni sidebar, including past conversations, attachments and contact details. Xobni also includes a blazing fast email search tool. This is the first version available on CNET Download.comVersion 4024 beta now adds photos and profile information for contacts registered on LinkedIn.
To download use the below URL,
http://www.xobni.com/download

LogMeIn Free -Remote Access from any where

Free remote access is a reality with LogMeIn. Secure and ease-of-use come together in a powerful remote control solution that's 100% free and gives you full control of your home or work PC from anywhere you are with an Internet connection.
To download LogMeIn use the below URL
https://secure.logmein.com/home.asp?lang=en



LogMeIn is Web-based so it's far easier to use than alternatives - yet offers layers of security that others just don't including end-to-end 256-bit SSL encryption, dual authentication and RSA SecureID. Control your PC from anywhere quickly, easily, and securely