Forgot your password?
typodupeerror
Bug Security Windows

MS Virtual PC Flaw Defeats Windows Defenses 141

Posted by kdawson
from the around-the-maginot-line dept.
Coop's Troops writes "An exploit writer at Core Security Technologies has discovered a serious vulnerability that exposes users of Microsoft's Virtual PC virtualization software to malicious hacker attacks. The vulnerability, which is unpatched, essentially allows an attacker to bypass several major security mitigations — DEP, SafeSEH and ASLR — to exploit the Windows operating system. As a result, some applications with bugs that are not exploitable when running in a not-virtualized operating system are rendered exploitable if running within a guest OS in Virtual PC."
This discussion has been archived. No new comments can be posted.

MS Virtual PC Flaw Defeats Windows Defenses

Comments Filter:
  • If you want security, unplug the 'net. You ain't gonna get it any other way.

  • Makes one wonder if the disabling of these crack-thwarting mechanisms are also killed in other desktop hypervisors. Bad news.

    • It's probably just a bug in the way VirtualPC handles the virtual TLBs or some such. It's not even present on Hyper-V, also from Microsoft, so I think the danger here is pretty low.

      It's not like this actually makes the host OS vulnerable, either. I doubt it can even crash the VM software, although it could certainly lead to crashing the virtualized OS.

      • Re: (Score:3, Interesting)

        by postbigbang (761081)

        That's what I'm wondering. Does randomized address still occur on VPC7's competitors? And if VPC is this way, then does Hyper-V thwart host address randomization, and so on? What's the difference in architecture that allows VPC to thwart this, and others go merrily on their way-- with whatever memory ring permitting the randomization of kernel access? Hmmmmm.

      • by sjames (1099)

        So as long as it's just the guests providing the critical services that get crashed or subverted, it's OK since the mere container for those guests is OK?

        That doesn't make a lot of sense.

        • by Carnildo (712617)

          It's OK because you can't step out of the sandbox. If the guest OS running the DNS server gets compromised, the compromise code can't step out of its sandbox and attack the guest OS running the webserver, or reach into the guest OS running the Active Directory server and grab the password list.

          An attack that can break out of a virtual machine is a much, much bigger problem than one that stays contained inside the VM. If a guest gets compromised, you restart it from a known-clean state. If the host gets c

          • by sjames (1099)

            You're still missing the point, the CRITICAL SERVICE running on the guest OS is now vulnerable to attack, including slow and subtle corruption of the data. If the critical service dies or the data is corrupted to unusable, it hardly matters if the host OS is still OK.

            In other words, when all the gold comes up missing, how many people will be relieved to hear the vault isn't damaged?

            • by Carnildo (712617)

              No, you're the one missing the point: Even though the gold in this vault has been replaced with pyrite, the gold in the next vault over is still fine.

              • by sjames (1099)

                Except that it too is subject to the weakened security. It may be full of gold now, but it could easily contain pyrite tomorrow, but the vault will be unharmed. Not much comfort.

    • by vegiVamp (518171)

      A random guess would be that some developer took a few shortcuts so he could show off the performance improvements he made on the hypervisor.

  • by Ben4jammin (1233084) on Tuesday March 16, 2010 @07:11PM (#31502824)
    Arce said Core reported the flaw to Microsoft last August... Microsoft officials declined to comment until they had a chance to review Core’s advisory on the issue

    So how many months do you need to review once you are told about it???
    • by ircmaxell (1117387) on Tuesday March 16, 2010 @07:19PM (#31502910) Homepage

      So how many months do you need to review once you are told about it?

      Simple. How many months will you give them before you go public?

      At the possibility of being flamebait here, how the heck does MS keep publishing products full of security holes? I know Linux and Mac have had their share of holes, but it seems as if every week there's a new announcement about some MS product that has either a 0 day flaw, or another MAJOR flaw? And even worse is their failure to deal with them in a reasonable amount of time! I mean 6 months to COMMENT on an advisory? That's ridiculous... Sure, they may have a lot of notices to work through, but if that's the case, hire more developers to deal with the security issues! They are out spreading the message that you can depend on MS products, and then leave gaping holes open for months... Not to long ago (within the month), they delayed a patch --well, wanted to anyway before they were called out on it-- for a 0-day in IE by 3 weeks, so that they could put it in a "planned update to IE"... If this was a popular open source project trying to pull this stuff, how quickly would a fork surface? Then again, it's all about placating the sheeple, right?

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        The moment they put out a patch that breaks anything, or makes things worse the uproar will be greater. Its also amazing how it will work find in say, the spanish version, but not on the chinese versions. So many things and so many different products.

        • by Nikker (749551)
          I understand in programming there is always a possibility of a bug creeping up but common, Microsoft is one of the largest companies in the world, they have been working on the operating system for 20+ years now. They higher the worlds top PHD's to engineer the whole thing and pay them accordingly. Even the code monkeys are MIT grads with specialties in these core systems. When as a company you do one thing and get as much money as they do to do it there is an expectation of them and when you claim to be
          • I could make my wife's car theft proof by removing cables from the engine management system and bolting it to the garage floor but then she would never be able to drive it.

      • Well, OS X has the luxury of knowing exactly what type of limited hardware set the system it will be running on is using, and not a lot of variety. Linux doesn't have to worry about breaking thousands of applications every time they update the core OS. Microsoft has neither of these luxuries. Microsoft is also king in the corporate desktop arena, and if a business application breaks, it will be far worse for them and the corporate application users compared to the way it currently is set up. And even with a
        • Re: (Score:3, Informative)

          I've upgraded "linux" (OS, libs, and what not) literally thousand of times in the ca. 15 years I've been using it, and I doubt there were 5 times where I has a real problem with the many apps I use stopping working...
          • by Rockoon (1252108)
            So there were times when you upgraded Linux and software broke?

            Thats his point. When Microsoft breaks things to fix something else, people are in in arms.
            • In the past 5 years of managing both production linux boxes and Windows boxes, I can honestly say I've seen more Windows updates break things than Linux updates break things. Typically, it's due to some rogue program that was either misusing an API, or relied on string results returned from a particular API call (rather than using the proper API, or a constant)... Who do I blame for that? I don't blame MS. I blame the offending software vendor. It's typical practice (that I follow) to wait on all non-c
          • True that. Renting an OS (yes you don't buy the OS from MS), you hold the owners accountable for bad shit happening. Open source plays less point-the-finger and more help-another.

            • by trapnest (1608791)
              As long as by help-another (what) you mean:
              1. Works for me
              2. Not my distro
              3. Did you read the man page?

              Then yeah, Linux has that down.
      • by obarthelemy (160321) on Tuesday March 16, 2010 @08:28PM (#31503462)

        Let's play devil's advocate:

        MS has quite a lot of competing agendas:
        - keep backwards compatibility, v1. That means a bunch a old APIs, services, apps... Not only was security not much of a concern back when those were written, but any change in the environment risks unveiling new vulns. These pooor guys are actually supposed to maintain IE 6, IE7, and IE 8.
        - keep backwards compatibility, v2. MS can't really change the security model or the way they expose it without, again, breaking apps. Since NT, Windows's security model is not bad. But MS can't really implement it fully (no apps changing system-wide ressources, no writing outside of a handful of approved dirs...) without, again, breaking apps.
        - add features
        - maintain an incredibly wide array of software. MS = Oracle + Linux+ php + Apache + OOo + Firefox + ...

        So yes, I really hate the pain that managing MS systems is. I, and they, know they could make things better by breaking a lot of apps. They choose not to... prolly because their customers want them not to. I can understand that.

        • Re: (Score:3, Interesting)

          by peragrin (659227)

          then with windows vista why didn't MSFT include an XP mode, than ran in it's own self contained section while using the higher security of a modern OS?

          MSFT is trying to maintain compatibly with single user OS's in a networked world and failing miserably. Apple simply included a backwards compatibility mode and with every release slowly stopped installing.

          • by Josh04 (1596071)
            Actually, they're doing remarkably well on the compatibility one.
          • Re: (Score:3, Insightful)

            by Mr2001 (90979)

            then with windows vista why didn't MSFT include an XP mode, than ran in it's own self contained section while using the higher security of a modern OS?

            Windows 7 Professional/Ultimate includes exactly that. But it's implemented using Virtual PC, which is where this flaw was discovered.

          • by TRRosen (720617)

            He said they NEEDED to... not that they WOULD.

          • And I told people at the time that I expected Microsoft to take _at_least_ 10 years to be able to do that consistently. 15 years wouldn't surprise me.

            While I have not yet tried out Win7 or IE8 myself, everything that I've read says that they've made remarkable progress in improving their overall security stance. They just might finish up nearer the shorter end of my estimate than I thought at the time. :)

        • Re: (Score:3, Insightful)

          by ircmaxell (1117387)
          Don't forget, you're talking about a monolith of a company. They have more than enough resources to pour into security. Yet they don't... I refuse to cut them any slack, when open source projects which are powered by volunteers (I know not all are, but a significant number are) can produce (and do produce) results SIGNIFICANTLY faster than MS typically does... If a bunch of volunteers with VERY limited resources can do it, why can't a company with practically unlimited resources handle it?
          • by Anpheus (908711)

            Mythical man month much?

            Pouring more resources into security doesn't make it happen. Sorry.

            • Re: (Score:3, Informative)

              by ircmaxell (1117387)
              Pouring resources into one particular project doesn't work. But pouring resources into a pile of otherwise unrelated projects does. IF it's a problem of overload (where they have 1000 outstanding issues to investigate/fix, and less than 1000 people to work on it, you could gain something by adding resources... The "Mythical Man Month" is about adding resources to one project (where everyone's work depends on everyone else's)...
              • by Anpheus (908711)

                It's not about fixing 1000 issues, if you tackle security like that, you'll be fixing 1000 issues every month until the end of time. And your problem will grow as your company and the amount of code you write grows. So theoretically you could eventually break even, but the worst security issues will be the ones you don't know about, the ones you can't measure in your tickets closed per month metric. So what if you closed 1000 bug tickets in a month? Anyone can do that, how about you go an entire month witho

                • Well, that's quite fair... Perhaps then it's time for MS to invest the resources needed to revamp their development process (Changing policy and workflow, perhaps firing some people and hiring others, etc). Either way, I think at least part of my OP is correct, in that they have the resources needed to change things to make it better. Yet they haven't (well, at least that the public has seen)...
                  • by Anpheus (908711)

                    Well then we'll have to agree to disagree. I think Vista was an important and painful step forward for security, and that Windows 7 is probably about as secure as Linux 2.6.x. (Nothing can stop a user from wanting to see the dancing bunnies, etc.)

                    In Linux for example, gksudo is not a secure way to enter your password, and neither is entering your password into a sudo prompt in a shell. In Windows, you'd need to have already exploited the computer in order to read a UAC prompt.

                    • Just for clarification, I wasn't talking about that kind of security vulnerability. I'm talking about true zero days that require no unusual action on the part of the user. Such as the case of simply vising an infected site, or a remote exploit. For what you are talking about, I agree 100%...
                    • by Anpheus (908711)

                      I think it's important to remember that the vast majority of online linux boxes are going to be servers which are already locked down, being run by at least semi-competent admins and probably with almost all the ports blocked except 80, 443, 21, an SSH port, etc. Essentially, they have a very small surface area, and even if there was a zero day, it's very easy for you to say "ah, that's not Linux's fault, that's Apache's fault. Even running OpenBSD would not have saved them."

                      So it's very hard to compare "Wi

      • by anss123 (985305)

        At the possibility of being flamebait here, how the heck does MS keep publishing products full of security holes?

        Because many security flaws are in old software - which they aren't "pushing" any more. Today's flaw is a exception but requires a user that use XP mode in such a way that an attacker can get at it (say - if you're running an old insecure version of Firefox in XP mode) which, you have to be honest here, is not all that likely since XP mode will be more used for old games and business apps.

        As for the the "0day flaw" you mentioned, if it was an Open Source project you'd likely been asked to update to IE8 i

  • by mlts (1038732) * on Tuesday March 16, 2010 @07:17PM (#31502884)

    The good news is that this doesn't affect the big iron (Hyper-V). However, for people who have Windows 7 and XP mode, using it for Web browsing, this will cause them a world of hurt.

    Since this essentially doesn't affect servers, I'm going to recommend to people that they move to VMWare Workstation if they want commercial support, or VirtualBox if they desire an open source solution. Either one of these has as many features as VirtualPC (although VirtualPC has one nice advantage -- it drops changes to the undo disk fast compared to the 2-3 minutes VMWare does.)

    A hole in a hypervisor is a really bad thing. A lot of people use VMs for honeypots, and this would cause unintended infections, or other damage, perhaps catastrophic.

    • Re: (Score:3, Funny)

      Dude, like, stop being so reasonable - you're gonna park a cloud over our MS bashing and 'I told you so' evangelism. It's not everyday we get to trash MS over a security issue.
    • by Anonymous Coward on Tuesday March 16, 2010 @07:41PM (#31503088)

      The hole is not in the hypervisor. The GUEST OS is the one that is compromised, not the OS running the VM.

      • by julesh (229690)

        The hole is not in the hypervisor. The GUEST OS is the one that is compromised, not the OS running the VM.

        The hole is in the hypervisor; if the hypervisor worked correctly, the guest OS would behave identically whether or not it was running as a guest.

        But, yes, it would appear that this flaw does not provide a way guest code can escape the virtual environment. Essentially: local privelege escalation bug restricted to virtual machine guests.

    • by cbhacking (979169) <been_out_cruisin ... y a h o o . c om> on Tuesday March 16, 2010 @07:46PM (#31503138) Homepage Journal

      Honeypots are designed to get hit. This bug doesn't make the host system vulnerable, it just means that the client OS is easier to exploit.

      If it worked on Hyper-V, this would be a big problem; that's a server-level technology where even the clients are expected to remain secure. On the other hand, Virtual PC isn't even a hypervisor; it requires a full OS onderneath it, running itself as just another Windows app. Up until 2007 didn't even require hardware support for virtualization.

      • 2007 doesn't require hardware virtualization either, only the Windows 7-only version does.
        • by RulerOf (975607)

          2007 doesn't require hardware virtualization either, only the Windows 7-only version does.

          There was a bit of upset about that point when XP mode got reviewed. Since it's based on VPC and not Hyper-V, it shouldn't require x64 and AMD-V or Intel-VT, but for some reason, it does. A lot of people considered that to be all sorts of bullshit because Intel uses their VT feature to differentiate product lines; I.E., moderately priced business desktops don't support XP mode. Of course, that bullshit is actually Intel's fault, so I tend to cast a more glaring eye at them when I think about it.

          • by Mr2001 (90979) on Wednesday March 17, 2010 @12:04AM (#31504790) Homepage Journal

            A lot of people considered that to be all sorts of bullshit because Intel uses their VT feature to differentiate product lines; I.E., moderately priced business desktops don't support XP mode.

            Moral: if you're looking for something modestly priced, go with AMD processors. Not only are they cheaper, but nearly all the ones you can find today support virtualization.

          • by cbhacking (979169) <been_out_cruisin ... y a h o o . c om> on Wednesday March 17, 2010 @01:01AM (#31505036) Homepage Journal

            I actually had a chance to talk with one of the guys behind Wirtual PC (including the one that powers Virtual XP Mode) a few months back. His answer was that when MS started work on the Windows Virtual PC (WVPC, the current version) 3 years ago (roughly when VPC2k7 shipped), they contacted Intel and AMD and asked if they were going to offer hardware virtualization on all models going forward. Both companies answered Yes, so to save development and testing costs, the (large block of tricky) code that enabled vitrualization on CPUs without hardware support was cut from WVPC. Skip forward a couple years to WVPC getting ready for release, and... still a lot of Intel CPUs without support for virtualization. At that point it was too late to add the feature without delaying shipping, so they didn't.

            I asked whether they would add it in later, and he said they weren't planning to but might change their mainds if it became clear that this was a problem for enough of their customers. In the meantime, they were telling Intel to get its shit together the way it had said it would three years earlier, and he personally recommended going with AMD chips.

            On a side note, I didn't hear anything at all about it requiring x64. According to http://www.microsoft.com/windows/virtual-pc/download.aspx [microsoft.com], it works just fine on x86.

          • by tlhIngan (30335)

            There was a bit of upset about that point when XP mode got reviewed. Since it's based on VPC and not Hyper-V, it shouldn't require x64 and AMD-V or Intel-VT, but for some reason, it does. A lot of people considered that to be all sorts of bullshit because Intel uses their VT feature to differentiate product lines; I.E., moderately priced business desktops don't support XP mode. Of course, that bullshit is actually Intel's fault, so I tend to cast a more glaring eye at them when I think about it

            You don't nee

      • On the other hand, Virtual PC isn't even a hypervisor; it requires a full OS onderneath it, running itself as just another Windows app

        So ... install Virtual PC in a Virtual PC virtual machine.

        I haven't tried, as it is slow enough

      • by X0563511 (793323) on Tuesday March 16, 2010 @09:45PM (#31503918) Homepage Journal

        If someone is using VirtualPC for a honeypot, they are an idiot.

        The idea of a honeypot is that it is indistinguishable from "the real thing."

        That this flaw even exists means it is identifiable as a virtual machine.

    • by NSIM (953498)
      And what makes you think that other desktop hypervisors don't have similar vulnerabilities?
    • > VMWare Workstation if they want commercial support, or VirtualBox if they
      > desire an open source solution.

      You know very well that commercial support is available for Open Source.

    • by PFAK (524350) *

      It's a good thing this vulnerability doesn't allow the host system to be compromised, otherwise we'd be in real trouble!

      (AKA: Parent poster is wrong.)

  • This is definitley a bug, but all it does is allow bypassing of security features in the virtualized system. In other words, you can exploit the VM client, but you still can't get at the host.

    It's worth of a patch, but not of a panic. If you're virtualizing for security, you don't really care what happens to the virtual system (that's the point). If you're virtualizing so you can run an old OS, it's going to be full of holes anyhow. If you're virtualizing for any other reason, why the hell are you using consumer-grade virtualization software?

    • Most people don't utilize the function of an "undo disk" in VPC, which allows you to restore a VM to a previous state when you turn off the VM.

      So the infection will stay there, if somebody use it as a spam or phishing server, the FBI will be knocking on your door.

    • Out of interest, I develop on two XP SP3 VPC's, against older systems that do not support XP+. It's a bit worrying, doing production work in these environments.

  • Credits (Score:5, Informative)

    by aurelianito (684162) on Tuesday March 16, 2010 @07:51PM (#31503182) Homepage Journal
    From TFA:

    An exploit writer at Core Security Technologies has discovered a serious vulnerability that exposes users of Microsoft's Virtual PC virtualization software to malicious hacker attacks.

    I would like to add that the exploit writer at Core Security Technologies that discovered this vulnerability is Nicolás Economou [coresecurity.com] and congratulate him on the great work he has made.

    Disclaimer: I also work at Core

  • by jim_v2000 (818799) on Tuesday March 16, 2010 @08:10PM (#31503322)
    I mean, talk about small targets. I highly doubt that any hacker would find it worth his time to attempt to exploit this. I mean, first you have to find someone running XP mode. Then you have to get them to open an executable (or exploit some other vulnerability to get onto the system) on the guest OS instead of the host OS. Then the person still has to have more than 2 gigs of RAM and be utilizing more than 2 gigs at once. Then, after all that, you only have access to the XP VM, which may or may not have anything of worth on it.

    I'm not surprised that MS shrugged it off for now.
    • Re: (Score:3, Interesting)

      by Anonymous Coward

      I mean, talk about small targets. I highly doubt that any hacker would find it worth his time to attempt to exploit this. I mean, first you have to find someone running XP mode. Then you have to get them to open an executable (or exploit some other vulnerability to get onto the system) on the guest OS instead of the host OS. Then the person still has to have more than 2 gigs of RAM and be utilizing more than 2 gigs at once. Then, after all that, you only have access to the XP VM, which may or may not have anything of worth on it.

      I'm not surprised that MS shrugged it off for now.

      Sorry, nice try, but you don't seem to understand the issue here. You don't need to "get them to open an executable" - the point is that this vulnerability makes it possible to exploit existing vulnerabilities by bypassing mitigation techniques such as SafeSEH, DEP, and ASLR. It also has nothing to do with the amount of physical RAM on the system or how much is being used - the mentions of memory accesses refer to a process's virtual address space.

      I agree that this doesn't have nearly the same impact as i

      • Re: (Score:3, Informative)

        by jim_v2000 (818799)
        RTFA and re-read what I said:

        Article: "It causes memory pages mapped above the 2GB level to be accessed with read or read/write privileges by user-space programs running in a Guest operating system."

        Me: "Then you have to get them to open an executable (or exploit some other vulnerability to get onto the system)"
    • The target isn't that small. The fact that being virtualized breaks their security models is a big issue, and indicative of other big issues. (Using virtualization to break copy protection is one of my personal favorites.) And there are plenty of home and business users who have gotten Windows Vista machines foisted onto them who use and need to use Windows XP for software compatibility reasons, and who therefore run old games or critical applications in Windows XP under Virtual PC. I've done it myself for

    • No kidding (Score:4, Interesting)

      by Sycraft-fu (314770) on Wednesday March 17, 2010 @12:39AM (#31504948)

      To the extent we use it at work, it is for running stubborn old software that won't run in Windows 7 and/or 64-bit OSes. To date, we've discovered two applications like that. We also set them up to run seamless in the host OS (their window appears along any other window) where you don't see or play with the guest VM. It's easier for the user, and less potential trouble. They generally don't even know (or care) that the program is running in a VM.

      So yes, it requires some fairly edge situations to exploit. Not many people use XP mode in the first place (most apps run natively in 7), if they do, reasonable bet they are just using it for compatibility for one or two old apps, not on a regular basis. So you have to convince them to get your exploit, and run it in their XP system. While I suppose you could craft it so that it doesn't run in 7, they may just say "Eh, do not want," and ignore it. If not they might wonder why a new app would have that problem. Either way you've got to get them to use it in XP mode and then... Well I guess you can own their XP VM. Wonderful, that does you a whole lot of nothing in general.

      Also this isn't a case of "Bypasses any and all security," it just gets by some additional protections that can help in some cases. DEP, for example, doesn't do anything to stop malware, it doesn't check the "evil bit" and stop programs from running. All it does is prevent buffer overflows in some cases. You can't execute code in the data area of a program's memory. Ok, fine, however to even matter at all you have to have a program that is vulnerable to that kind of thing. If programs are checking their inputs and so on, then DEP never even comes in to play.

      Don't get me wrong, I'm happy that MS has added some additional protections to make common problems harder to exploit, however they are not the first, last, and only line of defense. They are just things that cause additional problems for various sorts of exploits. Something has to find a way to try and get in to the system in the first place before they even matter.

      I can't see this as any kind of big deal. I'm certainly not at all concerned with regards to the computers that use it at work.

  • Its like they do this on purpose...

  • Aren't those called "exploits"?

    • Re: (Score:3, Informative)

      by julesh (229690)

      Aren't those called "exploits"?

      No, you're misunderstanding the article. A "security mitigation" is something that stops exploits working without actually removing the hole that allows the exploit. Stuff like checking your stack is still intact before returning from a function in order to make stack overflow exploits fail: the stack can still be overflowed, but you can't (easily) exploit this any more.

  • Not a vulnerability (Score:3, Informative)

    by poppycock (231161) on Wednesday March 17, 2010 @02:44AM (#31505392)

    This is really a vulnerability in any meaningful sense of the word. Rather, this means that certain advanced protections that Windows uses are less effective in a Virtual PC. Microsoft is actually in a leading postion when it comes to memory protection features as compared to anyone this side of OpenBSD.

    What isn't someone issuing an "advisory" that the MacOS implementation of things like GS, ALSR, early-heap-termination and SafeSEH are either weak or nonexistent?

    ASLR could use more entropy. Stack coookies could be present in every function, instead of just some. Every defense can be improved, and I don't think Microsoft has ever claimed that ASLR or GS is a reason NOT to produce a patch.

    IMHO, Microsoft is completely correct to not issue a bulletin for this since that is an indication of a severe issue. And Core is free to make the issue known publically as well, and people can decide for themselves. But the Slashdot title is midleading at best.

  • Alltough I never got this working: booting from a VHD :, it occurs to me that are a lot of people doing this for different purposes...

    http://www.sevenforums.com/tutorials/2953-virtual-hard-drive-vhd-file-create-start-boot.html [sevenforums.com]

    Would this be affected too?

  • I love how the summary has to point out that the vulnerability is "unpatched". Well no shit, it wouldn't be a vulnerability if it was patched.
  • Not sure if anyone knows about these but...

    The document and settings transfer wizard in Windows 7 did not ask me to authenticate for the other profiles I transferred. So I assume that if one were to examine that program there might be something in there.

    When I installed Windows 7 on my laptop - at the point where it asked me for the Key I unplugged to take the laptop to my desk to get the key - and the Key dialog was simply bypassed! I was on the next screen. So I still haven't entered my key. Maybe th

MATH AND ALCOHOL DON'T MIX! Please, don't drink and derive. Mathematicians Against Drunk Deriving

Working...