Mostly Wi-Fi and Network Security: Linkfest

Ok. In the time it took me to work on that last post (mostly), I was able to cycle some laundry through the machines AND get my VMWare Player build of Windows 8.1 up and running.

It tossed me a few curves, but nothing that big a deal.

I tried the new and updated “Windows Start button” all for five minutes before ditching it for the free IOBit StartMenu8. Went on with no issues. Tossed on Google Chrome (Dev), FreeCommanderXE beta, dropped some snazzy wallpapers on to cycle through, added Process Explorer to run in the system tray, and while I kept Windows Defender this time, I supplemented it with Microsoft's EMET 4.0.

That’s it for now, more tweaking and testing and twisting it in the weeks to come. Expect some follow-up Windows 8/8.1 posts as well around here.

So now let’s turn to the world of Wi-Fi (in)Secuirty and networking in this GSD Link Fest edition:

Wi-Fi, Web, and Networking Security Headaches Galore - Pineapple Flavored!

• Your Mac, iPhone or iPad may have left the Apple store with a serious security risk - Troy Hunt’s blog
• iPhones can auto-connect to rogue Wi-Fi networks, researchers warn - Ars Technica
• Pineapple Surprise! Mixing trusting devices with sneaky Wi-Fi at #wdc13 - Troy Hunt’s blog
• The beginners guide to breaking website security with nothing more than a Pineapple - Troy Hunt’s blog
• Your login form posts to HTTPS, but you blew it when you loaded it over HTTP - Troy Hunt’s blog
• Understanding the risk of mixed content warnings - Troy Hunt’s blog
• iOS Personal Hotspot passwords vulnerable to brute force attacks - iMore.com
• VIDEO: Targeted Attacks Video Series from TechNet - Kurt Shintaku's Blog. From that post:

  We have a new security video resource called the Targeted Attacks Video Series  on Advanced Persistent Threats (APTs), or what we at Microsoft call Targeted Attacks by Determined Human Adversaries. These five short informational videos summarizes three security whitepapers, Determined Adversaries and Targeted Attacks, Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques, and Best Practices for Securing Active Directory. The five short videos are:

  1. Introduction to Determined Adversaries and Targeted Attacks: Tim Rains, Director, Microsoft Trustworthy Computing, provides background information on these types of attacks and set the context for the rest of the video series.
  2. Mitigating Pass-the-Hash Attacks: Patrick Jungles, Security Program Manager, Trustworthy Computing, explains what a Pass-the-Hash attack is and some tested mitigations to help manage the risk associated with credential theft attacks.
  3. Anatomy of a Cyber-attack Part 1: Sean Finnegan, CTO of the Microsoft Consulting Services Cybersecurity Practice, walks through a typical targeted attack, step by step, describing how attackers perpetrate these attacks.
  4. Anatomy of a Cyber-attack Part 2: Sean Finnegan finishes his briefing on how determined adversaries commit targeted attacks.
  5. Importance of Securing Active Directory: Bret Arsenault, Microsoft CISO, discusses the importance of protecting your Active Directory in the context of target attacks.

All great videos to watch on your own or with your IT team for a mini training & discussion session.

Networking Tools

There have been a number of nice networking tool updates recently:

• SoftPerfect Network Scanner: fast and free network scanner - Now updated to version 5.4.11 (May 08 2013)
• DNSQuerySniffer - DNS queries sniffer - New free app from Nir Sofer’s Nirsoft factory that shows the DNS queries sent by your system (x32/x64 bit flavors are available).
• Wireshark - Now at stable release version 1.10.0.  For more info see these 1.10.0 Release Notes
• toolsmith: Visual Malware Analysis with ProcDOT - HolisticInfoSec - I’m still getting my courage up to start working with this gem that mind-melds Process Monitor data with GraphViz. Super cool.
• TightVNC 2.7.7 is now out and released. download
• Deep Dive Packet Analysis (by Hansang Bae) - Sharkfest 2013 session- Video presentation on using and analyzing challenging network issues.

Microsoft Message Analyzer Beta 3 Released!

The next beta version of Microsoft’s answer to Wireshark is out.

• Microsoft Message Analyzer Beta 3 is released (Build 6211)! - MessageAnalyzer blog

It is a far and different animal from the old MS Network Monitor platform and takes a lot of work getting used to.

Tip: you have to be registered on the Microsoft Connect site to get the non-public download. I have been from some time but when I tried to find the actual MA Beta 3 bits for download on the project page, I couldn’t find them. I looked, waited a few days, looked some more, nada.

Finally I backed out a bit and found a “new” (3rd) “Message Analyzer, Network Monitor and Protocol Test Suites” product program listed that I wasn’t joined to. I joined it and there were the bits. Ok…I guess that was my bad by assuming that just because I had joined a particular Product, that other Programs could be added without me realizing it. Oh well.

Note: I believe it requires a Windows 7/8 platform as well as some .NET packages. It definitely doesn’t seem to be supported on XP. Come-on team, time to upgrade that OS!

Wi-Fi Tools and Updates

• Wi-Fi Inspector - Xirrus - Neat and techy-looking free Wi-Fi signal scanner. Now updated to version 1.2.1.4. I keep this on handy
• inSSIDer for Home - MetaGeek - This seriously-updated edition of inSSIDer really rocks! This is the free version for home users but they also offer a super-cool Office version that has some additional graphing and reporting features, Finally they also offer some super-beefy enterprise-level Wi-Fi assessment and troubleshooting software tools. Neat stuff here.
• HeatMapper - Ekahau’s free Wi-Fi coverage mapping tool for homes and small offices. Simple registration required for the free download. Current version 1.1.4 (March 03 2012) with Win8 Consumer preview support.
• Cisco Meraki - WiFi Mapper - Cisco product that can run in a browser session via a Java application. Nice basic review here: Wi-Fi Testing and Mapping Apps for Techs via Technibble
• WifiInfoView - free NirSoft tool to capture information on Wi-Fi networks that are broadcasting in your vicinity. This version works on Windows Vista - Windows 7/8. Not XP, however.
• WirelessNetView - free NirSoft tool that also captures broadcasting Wi-Fi network details. This one does run on XP.
• Wireless Network Watcher - free NirSoft tool that shows who is connected to your wireless network.
• SoftPerfect WiFi Guard - free app that also shows who is on your wireless network, but has an added feature of alerting you if a new device joins that is unknown

Stay safe and remain watchful!

Claus Valca