Denim Group, Ltd.

.NET Code for Setting IE Preferences

By Dan Cornell

GregL from Denim Group spent a bunch of time solving a .NET coding issue last week.  Since he couldn't find the information he needed with a simple Google query I figured I would put some of it up here hoping to help folks who had to solve the same problem in the future.

The situation was this: He had a WebBrowser control that we were using in a Windows Forms application to display web pages inside an application that was essentially a custom web browser.  On a new Windows XP installation, the first time you try to submit a form to access the Internet you get the annoying message:

When you send information to the internet, it might  be possible for others to see that information.  Do you want to  continue?

First of all this is a pretty pointless message.  But whatever...

The problem he ran into was that the pop up windows didn't appear when it was initiated by the WebBrowser control, causing the application to hang while waiting for a response.  To get around this he wanted to set the registry key related to this error message so the system treated it as if the message had already been accepted.

To find the correct registry key, he used RegMon from SysInternals to watch for keys being written.  He limited his search to keys off of "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Interent Settings"  He also limited the search to only look at keys associated with iexplorer.exe's registry activity and to highlight all SetValue calls.  There were still a HUGE number of entries because IE is very chatty with the registry...

The code to do this ought to look something like this:

RegistryKey key = Registry.CurrentUser.OpenSubKey("\\Software\\Microsoft\\Windows\\CurrentVersion\\Interent Settings\\Zones\\3",true);
if (key == null)
{
    key = Registry.CurrentUser.CreateSubKey("\\Software\\Microsoft\\Windows\\CurrentVersion\\Interent Settings\\Zones\\3");
}
key.SetValue("1601", 0);

Zone 3 is for the "Internet" zone.
1601 is the message key we are zeroing out.

So this was fun stuff.  Many thanks to GregL for all the detective work tracking this down.

--Dan
dan _at_ denimgroup.com

Elections and Bailouts: "Interface" by Neal Stephenson

By Dan Cornell

Last week I re-read Interface by Neal Stephenson and J. Frederick George (both originally credited as Stephen Bury) because it seemed awfully relevant with the upcoming Presidential election and banking bailout in the news.

Basic plotline: The sitting President of the United States decides to cap the amount of interest the US will pay on the national debt.  Seeing as how this is the basis of a huge part of the international economy and most world investments a shadowy group of ultra rich investors decide to replace him at the next election.  They develop technologies so that they can get real-time feedback on the emotions of Americans spread across a variety of demographics and feed that political intelligence directly into the brain of a candidate who had undergone post-stroke surgery where electronic nerves had been implanted into his brain.  Hilarity ensues.

This isn't the best of Neal Stephenson'swork, but it is a still a great read and certainly timely.

--Dan
dan _at_ denimgroup.com

Denim Group's Paris Hilton Sighting

By Dan Cornell

Last week John Dickson and I were up in New York for OWASP's AppSec 2008 NYC conference.  Saw a lot of great presentations and met up with a bunch of folks so it was a great trip.

John and I had dinner with some folks Wednesday night, and when we left the restaurant there were a bunch of people outside with cameras:

All of them were yelling "Turn around, Paris" so I think "Hey - Paris Hilton is on that balcony.  Perhaps I can take a photo and become one of those exciting Paparazzi folks."  So I get out my trusty iPhone and snap a picture:

Strangely, I haven't receive any offers to buy this gem of a photo yet.  Perhaps I will stick to application security work for now...

I need to go back over my notes and post some more detailed thoughts on the conference, but I figured I would at least get my Paris Hilton sighting on the record.

 

--Dan
dan _at_ denimgroup.com