[Full-disclosure] Vista Reduced Function mode triggered&[EMAIL PROTECTED]

2007-01-02 Thread xploitzz

Vista apparently needs to call the mother ship quite frequently or it will
go back into reduced operation mode.

You can get around it by putting in a KMS server which calls home for you
once every 6 months, or you can download an image of an already activated
KMS vmware image, and with a few settings chganges you only need to start it
up once in a while to ensure your machines stay enabled.

http://www.mydigitallife.info/2006/12/14/kms-crack-method-to-activate-windows-vista-business-or-enterprise-edition-with-local-spoof-kms-server/

Joy
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Vista Reduced Function mode triggered

2007-01-02 Thread Geo.

> Yeah, probably - but just for the fun of it I'm curious what happened
> (unless it's some dumb user error).

Well I've been running NT flavors of windows since 1994 but I'm not beyond 
dumb user errors. So what sort of dumb user error (besides telling the 
machine NO you may not have full internet access) do you think would cause 
reduced functionality mode to kick in? And why would it kick back off with 
such stealth? I mean shouldn't there be some sort of notification so admins 
don't spend lifetimes trying to track down why solitaire stops working?

I did disable a bunch of unneeded services like ssdp discovery, upnp, 
windows defender, the windows firewall, ICS and BITS and stopped and started 
others like media center launch and media center extender. But the disabled 
services are still disabled and there were plenty of reboots prior to 
reduced functionality mode kicking in.

If it takes more than simply roping the computer to a fraction of the 
internet then it could be any combination of things, I mean I played with it 
for over a week before it went into reduced functionality mode.

Geo. 

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Re: [Full-disclosure] Vista Reduced Function mode triggered

2007-01-01 Thread Jason Miller

lol i want to see this happen in a .edu unit where you can only access the
internet by going through a limited HTTP proxy that does not allow the
connect function, think it would give humourous results. unless it 'phones
home' by visiting a page and printing said info, which in that case it would
probably be simple enough to modify the server it goes to and make it think
its going to microsoft, in that event you could easily get cd keys if thats
how it verifies its a real vista copy.

On 1/1/07, Geo. <[EMAIL PROTECTED]> wrote:



> It just can't be that simple. There has to be more to what happened to
> the guy. Lots of computers are offline for several days at a time, it's
> inconceivable that they didn't test that.

Ok, as complete as I can be in the few minutes I have to post this.

During those three days I did a lot of poking around, stopping and
starting
services, switching from wired to wireless and back, trying to view high
def
video (which I still am not able to do in any video player except WMP for
some reason) installing codecs and software, running into the event ID
4226
tcp security connect limit, etc.

However I never got any notification of deactivation or any problem of
that
sort. Then on the third day suddenly solitaire would not start up and I
couldn't get into network properties. I did a bunch of rebooting and
trouble
shooting trying to figure that out but got nowhere.

So I went back to trying to get high def video to work in Media player
classic and figured perhaps it was trying to download a codec so I removed
the routes. It didn't help the video but I quickly found network
properties
started working. So then I tried solitaire and it worked. This was all
directly after removing the routes, there wasn't but a few minutes between
letting it talk to the net and these apps starting to work again.

I decided this was probably reduced functionality in action but since I
had
never seen it before I needed some way to trigger it so I could compare
since it would take 3 days to reproduce with route blocking. I disabled
the
software licensing service since it claims disabling that service will
kick
off reduced functionality mode. Nothing happened immediately but 24 hours
later solitaire and network properties (and now control panel) would not
start up. It was exactly the same apps and behavior. I enabled and started
the software licensing service and in seconds things returned to fully
functional just like removing the routes did.

So it's possible the routes didn't trigger it, but removing them sure
cured
it quickly so that is my guess at this point. Further testing is needed. I
won't be testing it for a couple days as I need the laptop connected to
other networks to try some other software I need to test. (that tcp limit
may prove a problem for network monitoring)

Geo.

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Vista Reduced Function mode triggered

2007-01-01 Thread Geo.

> It just can't be that simple. There has to be more to what happened to
> the guy. Lots of computers are offline for several days at a time, it's
> inconceivable that they didn't test that.

Ok, as complete as I can be in the few minutes I have to post this.

During those three days I did a lot of poking around, stopping and starting 
services, switching from wired to wireless and back, trying to view high def 
video (which I still am not able to do in any video player except WMP for 
some reason) installing codecs and software, running into the event ID 4226 
tcp security connect limit, etc.

However I never got any notification of deactivation or any problem of that 
sort. Then on the third day suddenly solitaire would not start up and I 
couldn't get into network properties. I did a bunch of rebooting and trouble 
shooting trying to figure that out but got nowhere.

So I went back to trying to get high def video to work in Media player 
classic and figured perhaps it was trying to download a codec so I removed 
the routes. It didn't help the video but I quickly found network properties 
started working. So then I tried solitaire and it worked. This was all 
directly after removing the routes, there wasn't but a few minutes between 
letting it talk to the net and these apps starting to work again.

I decided this was probably reduced functionality in action but since I had 
never seen it before I needed some way to trigger it so I could compare 
since it would take 3 days to reproduce with route blocking. I disabled the 
software licensing service since it claims disabling that service will kick 
off reduced functionality mode. Nothing happened immediately but 24 hours 
later solitaire and network properties (and now control panel) would not 
start up. It was exactly the same apps and behavior. I enabled and started 
the software licensing service and in seconds things returned to fully 
functional just like removing the routes did.

So it's possible the routes didn't trigger it, but removing them sure cured 
it quickly so that is my guess at this point. Further testing is needed. I 
won't be testing it for a couple days as I need the laptop connected to 
other networks to try some other software I need to test. (that tcp limit 
may prove a problem for network monitoring)

Geo. 

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Re: [Full-disclosure] Vista Reduced Function mode triggered

2007-01-01 Thread php0t
> It just can't be that simple. There has to be more to what happened to
the guy. Lots of computers are offline for several 
> days at a time, it's inconceivable that they didn't test that.

Yeah, probably - but just for the fun of it I'm curious what happened
(unless it's some dumb user error).






___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Re: [Full-disclosure] Vista Reduced Function mode triggered

2007-01-01 Thread Larry Seltzer
>>if you cut a vista's internet access after it's been activated, does
it go to reduced mode because of not being able to phone home? 

It just can't be that simple. There has to be more to what happened to
the guy. Lots of computers are offline for several days at a time, it's
inconceivable that they didn't test that.

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.eweek.com/blogs/larry%5Fseltzer/
Contributing Editor, PC Magazine
[EMAIL PROTECTED] 

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Re: [Full-disclosure] Vista Reduced Function mode triggered

2007-01-01 Thread php0t

> One thing you might try is instead of cutting it off entirely from the
internet, use an external device to limit what internet 
> addresses it can talk to so that it has a valid and working gateway
but it can't phone home.

I doubt Vista wants to google for porn instead of phoning home.

After reading the other posts, I think the question is still there, if
you cut a vista's internet access after it's been activated, does it go
to reduced mode because of not being able to phone home? Anybody with
certain results on this?







___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Re: [Full-disclosure] Vista Reduced Function mode triggered

2007-01-01 Thread Geo.
> In the short, I am unable to repro this. I'm currently running Vista on
> two
> systems; the other system is in a sandbox. (However, was "open" during the
> activation process.)

One thing you might try is instead of cutting it off entirely from the
internet, use an external device to limit what internet addresses it can
talk to so that it has a valid and working gateway but it can't phone home.

Also, it didn't happen immediately, I implemented the routing and then it 
was 3 days before I noticed things weren't working (may have been less but I 
just didn't notice till then), tried rebooting to cure the problems, poked 
around at other things, nothing helped. Then upon removing the routing and 
letting it talk to the whole net it was only minutes before everything was 
working again.

Geo.

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Re: [Full-disclosure] Vista Reduced Function mode triggered

2007-01-01 Thread Jay Sulzberger


On Mon, 1 Jan 2007, Poof <[EMAIL PROTECTED]> wrote:

> The issues that the original poster is having don't sound anything like
> normal behavior. One of the scenarios expected in Vista would be a Laptop
> that's been activated being used in a restricted internet work zone. And if
> that laptop has been activated normally (The 1-time activation as provided
> with the Windows install.) it shouldn't go to reduced mode. Further, it'll
> give a 30 day warning prior to going to reduced mode if it's suddenly
> deactivated asking for it to be reactivated. (Say a hardware change/etc.)
>
> In the short, I am unable to repro this. I'm currently running Vista on two
> systems; the other system is in a sandbox. (However, was "open" during the
> activation process.)
>
> Erm, from what I can see from the requirements, Internet is not required as
> it's in the same format as Audio.

The issue is not: How Microsoft treats those whose boxes Microsoft has
Tojaned.

The issue is: Microsoft should not be root on my computer.

And no EULA can take away root from me and grant root to
Microsoft on any computer I own.

oo--JS.


>
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of Geo.
> Sent: Monday, January 01, 2007 3:35 PM
> To: full-disclosure@lists.grok.org.uk
> Subject: Re: [Full-disclosure] Vista Reduced Function mode triggered
>
>
>> anything in vista's agreement in legalish that could be translated into
>> 'you agree that you feed your software internet' ?
>
> http://www.microsoft.com/windowsvista/getready/systemrequirements.mspx
>
> Yep, specifies "internet" under requirements. Should specify unrestricted
> internet access if you ask me.
>
> Geo.
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Re: [Full-disclosure] Vista Reduced Function mode triggered

2007-01-01 Thread Poof
The issues that the original poster is having don't sound anything like
normal behavior. One of the scenarios expected in Vista would be a Laptop
that's been activated being used in a restricted internet work zone. And if
that laptop has been activated normally (The 1-time activation as provided
with the Windows install.) it shouldn't go to reduced mode. Further, it'll
give a 30 day warning prior to going to reduced mode if it's suddenly
deactivated asking for it to be reactivated. (Say a hardware change/etc.)

In the short, I am unable to repro this. I'm currently running Vista on two
systems; the other system is in a sandbox. (However, was "open" during the
activation process.)

Erm, from what I can see from the requirements, Internet is not required as
it's in the same format as Audio.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Geo.
Sent: Monday, January 01, 2007 3:35 PM
To: full-disclosure@lists.grok.org.uk
Subject: Re: [Full-disclosure] Vista Reduced Function mode triggered


> anything in vista's agreement in legalish that could be translated into
> 'you agree that you feed your software internet' ?

http://www.microsoft.com/windowsvista/getready/systemrequirements.mspx

Yep, specifies "internet" under requirements. Should specify unrestricted 
internet access if you ask me.

Geo. 

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Re: [Full-disclosure] Vista Reduced Function mode triggered

2007-01-01 Thread Geo.

> anything in vista's agreement in legalish that could be translated into
> 'you agree that you feed your software internet' ?

http://www.microsoft.com/windowsvista/getready/systemrequirements.mspx

Yep, specifies "internet" under requirements. Should specify unrestricted 
internet access if you ask me.

Geo. 

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Re: [Full-disclosure] Vista Reduced Function mode triggered

2007-01-01 Thread php0t

  Didn't have the chance / interest to meet Vista myself as of yet, but
if what you wrote isn't user error or something specific and limited to
only a few computers then excuse me a moment while i lmao. BTW, is there
anything in vista's agreement in legalish that could be translated into
'you agree that you feed your software internet' ? Maybe micro$ says
that this is needed to verify that you're running a legal OS every now
and then, so $uck it ? :-) Sorry for not having ideas just raising more
questions, hope somebody replies in a few pointing out the obvious.



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Geo.
Sent: Monday, January 01, 2007 8:27 PM
To: full-disclosure@lists.grok.org.uk
Subject: [Full-disclosure] Vista Reduced Function mode triggered


The other day I used my router to limit my Vista laptop from talking to 
anything but one subnet on the internet. 3 days later suddenly some
things 
would not work.

Solitaire failed to start, click on it and you get the magic donut
showing 
it's starting up then nothing.

Right click on network and pick properties you get the magic donut
showing 
it's starting up then nothing.

So I removed the routes so Vista could once again phone home and within
a 
minute or two both solitaire and network properties worked just fine.

Now this Vista system is less than 30 days old and has already been 
activated. So the claims that Reduced Function mode only kicks in if you

don't activate within 30 days is bunk if this is Reduced Function mode.

So I decided to trigger RF mode on purpose to see how it responds. I
stopped 
the Software License service which claims that doing so will trigger RF 
mode. 24 hours later solitaire, network properties, and control panel
all 
show the same behavior, the magic donut showing they are starting up
then 
nothing. No events in event log, nothing.

I then started the Software License service and presto like magic these 
functions work again. So I'm convinced that the machine being routed so
it 
can't talk to MS triggered RF mode within a few days. Now to me this
seems 
pretty clear even though it wasn't a real scientific method of testing.
And 
further, this looks to me like an accident waiting to happen. I mean
imagine 
if MS fell off the planet we would have a pretty major problem as the
bulk 
of the worlds computers started shutting down, talk about a security
issue?

So anyone here with a bit more technical expertise want to pick up this
ball 
and run with it?

Geo. 

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/




___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


[Full-disclosure] Vista Reduced Function mode triggered

2007-01-01 Thread Geo.
The other day I used my router to limit my Vista laptop from talking to 
anything but one subnet on the internet. 3 days later suddenly some things 
would not work.

Solitaire failed to start, click on it and you get the magic donut showing 
it's starting up then nothing.

Right click on network and pick properties you get the magic donut showing 
it's starting up then nothing.

So I removed the routes so Vista could once again phone home and within a 
minute or two both solitaire and network properties worked just fine.

Now this Vista system is less than 30 days old and has already been 
activated. So the claims that Reduced Function mode only kicks in if you 
don't activate within 30 days is bunk if this is Reduced Function mode.

So I decided to trigger RF mode on purpose to see how it responds. I stopped 
the Software License service which claims that doing so will trigger RF 
mode. 24 hours later solitaire, network properties, and control panel all 
show the same behavior, the magic donut showing they are starting up then 
nothing. No events in event log, nothing.

I then started the Software License service and presto like magic these 
functions work again. So I'm convinced that the machine being routed so it 
can't talk to MS triggered RF mode within a few days. Now to me this seems 
pretty clear even though it wasn't a real scientific method of testing. And 
further, this looks to me like an accident waiting to happen. I mean imagine 
if MS fell off the planet we would have a pretty major problem as the bulk 
of the worlds computers started shutting down, talk about a security issue?

So anyone here with a bit more technical expertise want to pick up this ball 
and run with it?

Geo. 

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/