Apr 222010
 

For the longest time I’ve been on Fido with a unlocked (direct from Sony) Xperia X1a. I’ve never had any problems with it at all. Everything worked flawless. It was a great setup. Exchange, connecting to my VPN, etc…

Recently I setup a corporate plan with Rogers. Ended up getting a bunch of Xperia X1s at a discounted rate since I signed a 3 year on a bunch of lines… Turns out Rogers charges you for an “external IP” that you can use to connect to your business VPN. If you don’t add this option you will not be able to connect to a VPN.

After setting up the VPN.com apn on the new rogers (rogers firmware) Xperia X1s, I noticed that everything worked except simple web page browsing (in both browsers). No errors, just loaded completely blank pages. When changing apn back to internet.com everything worked fine. I automaticly assumed this was related to a “hidden proxy” configured somewhere on the phone.

From this behavior I went ahead and checked the config on the device, no proxies were configured anywhere. Rogers denied the proxy existed, I’m not sure if they do this because they don’t want anyone knowing their internet is being filtered/monitored, or if tech’s simply do not know.

While waiting for a call back from Tier 2 support, I went ahead and started fishing through the registry. I found a bunch of very odd registry entries pertaining to proxies. There was a SOCKS proxy configured, along with what appeared to be a HTTP Proxy, a few other entries also existed which were configured.

After removing these “odd” proxy registry keys, all of a sudden everything started working. Please note that if you modify these settings, you may break your configuration. Any of your providers “online” services (such as ring tone marketplace, application marketplace, etc…) also may cease to function properly (as these services are probably being hosted on their internal network).

To Remove:

1. Open your phone’s registry using any Windows Mobile Registry editor. I use “CeRegEditor” available at: http://ceregeditor.mdsoft.pl/

2. Open “HKEY_LOCAL_MACHINE”, then open “Comm”, then open “ConnMgr”. Under this value, you should be able to see all the devices configured GPRS/HSPA/HSDPA data connections. Browse through the folders and look for a “Proxy” entry. The “Proxy” entry is the configured hidden proxy. I simply deleted this key. If you find anything that has a value of “inet-new” or “inet-corp” you can safely ignore these as I have found they are part of the standard Windows Mobile firmware.

3. Take a look at the other folders under “ConnMgr”, you may notice a few items called “SOCKS”, and “HTTP”. Go into these folders, and remove the proxy values. As I mentioned before if you see any keys with the values “inet-new” or “inet-corp” you can safely ignore these.

Please note that this worked in my specific case. Your results may vary. Also insure that you have made a backup of the keys you have modified in case you need to revert back. Depending on the way your provider has configured your device you may also be tampering with other services (ie. MMS, WAP).

Apr 222010
 

Recently with the new vulnerabilities with Java, I needed to push the latest Java update remotely to all of my clients currently using my companies “Managed Services”.

The upgrade was being scheduled for certain dates per location, however as of Tuesday morning I noticed that some computers were being hit with some of the newer vulnerabilities recently discovered.

This all of a sudden changed the priority from “high priority” to “emergency”. I needed a  quick and efficient means of pushing this update to computers at client sites.

Active Directory allows system administrators to push, allow, or make available software installations to users. This is all controlled inside of Active Directory Group Policy Management.

To push the latest Java update to all computers on a network, I had to perform the steps below:

1. Download the “Offline Installation” of Java from the Java website. Open the file, do not proceed to continue the installation. (You will simply hit cancel after you extract the MSI and other files needed).

2. Open a explorer and browse to C:\Users\%USERNAME%\AppData\LocalLow\Sun\Java\jre1.6.0_20. After navigating to this location copy “Data1.cab”, “jre1.6.0_20.msi”, and “sp1033.MST” to a new folder (I chose a folder on my desktop).

3. Log into the remote server, create a file share (for example NetInstall), and configure users read access only.

4. Copy the folder you created on your desktop to the new file share on the server. Remember to use a naming scheme for the applications you wish to push so that they all make sense and can be organized.

5. On the server, go to Start -> Administrative Tools -> Group Policy Management

6. Either create a new GPO, or use an existing on that you have configured. If you are unfamiliar with this, it may be worth while doing some online research on GPOs. In my case I right clicked, and chose edit on the “Windows SBS Client Policy” GPO on SBS 2008.

7. Expand Computer Configuration, policies, Software Settings, Software installation. Right click on “Software Installation” and select new package. Follow the instructions.

8. When choosing the location of the .msi file, PLEASE make sure that you browse to it using your UNC network path. This location has to be somewhere where all the computers have access to. (I.E. don’t use C:\Folder\file.msi, you would rather use \\servername\sharename\programname\file.msi).

At this point you have now configured the server to force install Java on all the computers that apply to that GPO. This is perfect to make sure that all your clients are running the latest versions of free software available. It will also help with managing vulnerabilities with aging software, etc…

Please note: If this doesn’t work right away it is because the client workstations need to refresh their GPO. After the GPO is refreshed on the client workstation side, the system should install the package on next reboot.

There are some other neat things you can do with GPOs, and pushing applications on your network, however I’m not covering it in this document. For example instead of using “Computer Configuration”, you could use “User Configuration”, and instead of forcing applications you could actually make applications available for install through “Add/Remove Programs” for users to install.

Please always make sure that any applications you use are properly paid for and/or licensed.