Lightning talk on modern browser security tomorrow

I'll be giving a lightning talk at the Roots Conference Bergen 2011 tomorrow. I'm excited, I've given quite a few talks but never a lightning talk. It's always fun to take on new challenges!

It'll be interesting to attend the rest of the program as well. If you haven't registered already, you're out of luck. The conference is sold out. Better luck next year! :)

Serving pac files from IIS

IIS refuses to serve static files that cannot be mapped to a particular MIME type. Since I'm a Windows n00b I spent some time figuring this out for myself. Here's what happened, and how to deal with it.

I tried to serve a proxy.pac file from the IIS on my localhost (IIS 7.5/Windows 7), to test some changes to a proxy auto-configuration script. IIS gave me a 404 error instead of serving the file. After fiddling about with various security settings for quite some time, I was eventually able to figure out the problem. If IIS lacks a configured MIME type for a file then it will refuse to serve it — returning a 404 error instead. I suspected MIME types could have something to do with it after I found out that IIS happily served the file as a regular text file if the file was named proxy.txt. As always with Microsoft, when you've successfully pinpointed the problem yourself, you're finally able to launch a Google search that reveals something useful...

Enabling IIS log files on Windows 7

I'm baffled. IIS 7.5 does not log to files by default, you have to enable the feature manually. In the settings it's called "HTTP logging", here's how to enable it:

If you can't find IIS log files in C:\inetpub\logs you should open your IIS Manager and check if the logging option is present in the IIS menu section (top right in the screenshot).

If you can't find the Logging option, go to: Control Panel\Programs -> Turn Windows Features on or off to enable IIS logging.

Talk on online banking trojans today!

I'll be giving a talk today at a member meeting for The Norwegian computer society, The Norwegian information security forum, and the ISACA Norway chapter in Bergen, Norway. The talk will be given in Norwegian. Hope to see you there!

The talk is titled: Online banking Trojans — Recent developments and countermeasures