Microsoft Offers Linux Certification

Microsoft and the Linux Foundation have announced a new Microsoft Certified Solutions Associate (MCSA): Linux on Azure certification. The new certification is designed to ensure that the recipient is qualified to deploy and manage Linux systems in Microsoft's Azure cloud. To qualify for the certification, an applicant needs to pass both the Microsoft 70-533 exam (Implementing Microsoft Azure Infrastructure Solutions) and the Linux Foundation Certified System Administrator (LFCS) exam.

The idea of Microsoft offering a Linux certification might come as a shock to those who remember the old days, when Microsoft CEO Steve Ballmer called Linux "… a cancer that attaches itself in an intellectual property sense to everything it touches." In fact, Redmond has been on the rebound for years. In many ways, it was inevitable that Microsoft would eventually offer a certification in Linux when they put Linux in the Azure cloud.

According to Linux Foundation's Jim Zemlin, Microsoft's recent steps represent a genuine effort to be part of the community: "From participating in Node.js, the Core Infrastructure Initiative and other Collaborative Projects at Linux Foundation to its recent partnerships with Red Hat and SUSE, Microsoft is demonstrating a sincere, smart and practical approach to how it builds new technologies and supports its vast customer base. Microsoft open sourced .NET; it open sourced key parts of its web browser; and it uses Linux for its Azure Cloud Switch. The Linux Foundation and Microsoft share a common, strategic approach to technology development: balance internal R&D with external R&D to create the most important technologies of our time."

Sunshine up ahead?

New Attack Sucks Information from HTTPS

Bicycle attack technique can determine password length and other clues to simplify a dictionary attack.

Security expert Guido Vranken has published a paper on an attack that can successfully extract meaningful information from a captured TLS traffic session. Although the so-called HTTPS Bicycle attack does not provide direct access to encrypted data, it can determine the length of parts of the data, such as the cookie header or the payload of an HTTP POST request. An attacker can even employ this technique to determine the length of a password used to access an online account. Knowing the length of the password can greatly simplify a dictionary attack.

The attack has no known antidote; however, using a high-quality password and/or some form of two-factor authentication will make it more difficult for the attacker to succeed. See Guido Vranken's blog for a summary of the attack technique, or you can download the whole paper in PDF form.

Microsoft Announces New PowerShell

Microsoft has announced the release of Windows Management Framework (WMF) 5.0. The best known component of WMF is the PowerShell command shell and scripting language.

The preview version of WMF 5.0 has been around since February, so many users are already familiar with it. According to Microsoft, new features in the latest edition include the Just Enough Admin (JEA) role-based access control system, PowerShell classes, and a new package management tool. The latest version also comes with enhancements to PowerShell script debugging and software inventory logging.

You can download WMF 5.0 from the Microsoft Download Center. Current versions run on Windows Server 2012 R2, Windows Server 2012, Windows 2008 R2 SP1, Windows 8.1, and Windows 7 SP1. You'll also need the .NET Framework 4.5.