New Software Updates + VMware Tools Update fix

The Valca household has survived last week’s torrential rain event. Unfortunately both our vehicles took a hit.

No…no cars were flooded due to poor driving decisions…they stayed high-and-dry…but they did suffer some incidental damage.

My beloved Saturn Ion apparently had material in the catalytic converter come loose and cause a blockage in the exhaust system.  That led to a significant power-loss -- I was only able to nurse it up to 55-60 MPH on the freeway. That’s a life-threatening highway speed here in Texas. I found a new local repair shop that was able to diagnose it (and +1 point for my dad who also guessed that would be the issue). So it awaits a new cat-converter install…and for good measure I’m having the front struts replaced as well as they are OEM and the front suspension is all clunky over road bumps and RR tracks. With almost 200,000 miles on it, I guess it is time.

Meanwhile, I got in Lavie’s car yesterday to borrow it while mine is in the shop. She doesn’t drive it much. It is a 2001 Nissan Altima with barely 43,000 miles on it. All was well until I went to unplug and toss her cell-phone charger on the passenger side foot-well floorboard…and found it full with 1.5” of standing water. Gasp!  Luckily I hadn’t put the car in reverse yet to slosh it out. Bother.  After some extensive wet/dry vac work it was only damp and between a few sunny dry days and some well placed Damp Rid containers I think we will be good. The windshield has some cracks in it that might cause it to not pass this month’s due vehicle safety inspection so the decision was made to schedule a windscreen replacement…which will result in all new weather seals.  The rest of the car was bone-dry so I really don’t think it was a seal that failed. My guess is the torrential rains (appx 3.5 inches in 24 hours) cascading down the windshield may have poured into the fresh-air intake vent under the hood which ran down into the passenger side foot well.  Not sure why it was just that side and not the driver’s as well. Thoughts?

So with one car finishing the air-out process and the other in the shop, it has been a bit stressful. Fortunately family and friends and Boss have been supportive and encouraging…and our older but beloved (and paid for) vehicles will continue to drive on a while longer.

Anyway…enough boring personal stuff…here is small collection of updated software you might want to check out as well as a fix for an aggravating VMware Player problem I ran into this morning after updating the main VMware Player application.

VMware Player Plus - Now updated to version 6.0.1. Note that VMware Player Plus is the $ version for commercial license usage. The free for personal use VMware Player is still around, but you just have to confirm that option during the setup. I prefer to use this VM software platform for my Windows guest clients and VirtualBox for my Linux-based ones.

• Download VMware Player 6.0
• VMware Player 6.0.1 Release Notes

One curious thing about this most recent version that I hadn’t encountered until now.

I had just upgraded to this latest VMware Player (host) software on Windows 7 and then launched an XP client so I could update the VMware Tools as well.

Strangely the Windows XP guest I started up reported it was stuck downloading the tools. On boot up of the VM guest, it offered me the upgrade tools option at the bottom of the window, and when I selected that action button, it popped a dialog window that said "VMware Tools installation cannot be started until the current download finishes." If I go to the VMware host’s menu, it says "Downloading VMware Tools" where it should say Upgrade/Reinstall VMware Tools.

I took matters into my own hands and was able to map the virtual CD ROM in my virtual XP client to the VMWare Tools ISO file for Windows at "C:\Program Files (x86)\VMware\VMware Player\windows.iso" figuring that it was the latest version and came down for the ride when I updated the host client software.

Once "mounted" it auto-started the VMWare Tools setup wizard in the XP guest session which I ran though and installed with no issues. A reboot and it was current in the XP VM.

However....on reboot VMware Player host software still was reporting the upgrade tools option at the bottom of the window, and when I selected that again, it said "VMware Tools installation cannot be started until the current download finishes."

Here's how I cleared it in VMWare Player (based on this forum thread I found and solution offered by John Swanagon).

• Launch VMware Player.
• Click "Player"
• Click "File"
• Click “Player Preferences”.
• Under "Software updates” section.
• Click “Connection Settings”.
• In the “Connection Settings” window, change the proxy from “No proxy” to “Windows proxy settings”.
• Click OK.
• Click OK.
• Open Internet Explorer. (note these IE steps may vary based on your IE version)
• Click "Tools" then select “Internet Options”.
• Click the “Connections” tab.
• Click the “LAN settings” button.
• Confirm/Select the “Automatically detect settings” option.
• Click “OK”.
• Click “OK”.
• Close Internet Explorer.
• Exit VMware Player.
• Run VMware Player as an Administrator.
• Click "Player"
• Click "File"
• Click “Player Preferences”.
• Under "Software updates” section.
• Click “Edit” -> “Preferences”.
• Click “Download All Components Now”.

Additional components for other guest OS systems downloaded and when done, and VMware player re-launched, the message at the bottom of the screen finally was cleared!

Updates: PsExec v2.0, RAMMap v1.3, Sigcheck v2.0  - Sysinternals Site Discussion Blog

Updates: RAMMap v1.32, Sigcheck v2.01 - Sysinternals Site Discussion Blog

New Utility - QuickHash - Foolish IT LLC

OSFMount - updated 10-22-13 - version 1.5.1014.

• Fixed issue with detecting partitions for ImageUSB images
• Windows dynamic disks are now supported
• Fixed issue with mounting via OSFMount command line with "-o rw" option
• Fixed issue with mounting multiple partitions in an image file as writable due to file sharing permissions
• Fixed issue with mounting multiple partitions in an image file from command line
• Drive letters 'A' and 'B' can now be used
• Propagated changes from Imdisk v1.7.5 including some key fixes:
  • Disks with "lost" drive letters can now be removed
  • Notifications hanging on drive creation and removal

I personally prefer to use Olof Lagerkvist’s ImDisk Virtual Disk Driver, also recently updated on 10-25-13 to build version 1.7.6.

Why do I mention that? well the OSFMount utility is based on Olof’s ImDisk software. That’s all.

mozdev.org - newsfox: installation - My favorite Firefox RSS reader is updated to 1.0.8.4.4.  Release notes

Speaking of Mozilla, Firefox was updated to version 25.0 and Thunderbird was updated to 24.1.0

Also, I’ve gone to a 3-monitor setup at home with my laptop. My desk is quite full!

I’m running my primary display from the attached Dell Studio 15 HD laptop display. It is super-sharp and has great resolution.

My secondary display is one of a pair of older Samsung SyncMaster 930B-A displays I got a long time ago as a gift from my brother. Maximum resolution is just 1280x1024 so it looks a bit under-scaled with the other displays but it seems to work great for text which is fine when I am pounding out blog posts. No OEM Win7 x64 bit hardware drivers exist for it either so it’s running the standard Microsoft PnP display driver just fine. The 4:3 ratio (the others are wide-screen format) also makes composing text documents more comfortable.

Since (like most Dell laptops) the laptop can only drive a maximum of two display outputs natively, I’m running this display with a StarTech USB 3.0 to DVI Adapter. I didn’t have any issues getting the drivers installed and the system up and running. It’s a must-have hardware accessory if you are running multiple monitors with a laptop and can’t toss in another hardware card internally.

My third display is a HP Pavilion 22bw 21.5-inch Diagonal IPS LED Backlit Monitor(C4D29AA) that I picked up some time ago on sale at a big-box outlet. Not a lot to say. It is HD and I am running it off the HDMI port on my laptop. Overall it is decent, but I am disappointed in the text-clarity of the display. Watching a video on it is fine, but for extended text-composition on it, it just isn’t as clear as I would prefer.

In good news, under Windows 7 (at least) you can set the ClearType text on a per-monitor basis!

That has helped a bit but the text still doesn’t compare with my primary laptop display.

Cheers!

Claus Valca.

Read More

Links of the Week

Here is a hodge-podge of links that stood out this week.

Tr3Secure Data Collection Script Reloaded - Journey Into Incident Response blog - Corey Harrell has new news and updated on the Tr3Secure Volatile Data Collection Script he developed some time ago.

Tr3Secure Data Collection Script Reloaded - Journey Into Incident Response blog - Corey then follows up with a “real-world” walkthough of the Tr3Secure Volatile Data Collection Script after purposefully a lab pc for the sake of the discussion. It’s one thing to read about what a tool and process can do, it is a real treat to have the author lead a guided walkthough of the tool in action. As always, don’t forget to follow up with a comments reading as well.

plaso - super timeline - from the website “Plaso (plaso langar að safna öllu) is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.”  Spotted via this CDF at Champlain post.

Microsoft Security Essentials: Aiming low? - ZDNet - Larry Seltzer offers some thoughts on Microsoft’s free AV solution. He really doesn’t thrash MSE but does point out that there are many other free alternatives that tend to perform higher. It seems like a pretty reasonable perspective.  FYI, I have been debating making a change from Microsoft Security Essentials to Bitdefender Antivirus Free. Yesterday I uninstalled MSE and replaced it with BAF. The changeover went very smooth. The deciding factor for me was the ongoing poor post-boot performance of my system.  While I don’t have a SSD drive in my laptop, I is running an Intel i7 CPU with 8 GB RAM. After boot, MSE scans on the post boot environment seem to be leading to slower post-boot launch of a number of my applications for a while as processes and files get scanned. Now that I am on BAF, I don’t see those post-boot application hangs. That said, I will continue to primarily recommend MSE to family and friends unless repeated infections indicate a need for the advance protection BAF may provide.

Before moving on from Microsoft Secuirty Essentials and Windows Defender (for Win 8), I thought this post Windows Defender and context menu for file check? (GTranslated) at Borns IT and Windows Blog was very insightful.  Some time ago I posted a number of Windows Defender tweaking tips Advanced Tips for Windows Defender with Windows 8, one of which was how to add a scan with Windows Defender to the context menu list in Win 8.  Born’s acknowledges that is a popular request and go though how it is accomplished. However, as he points out, the way Windows Defender operates, when a file is accessed via the (File) Explorer, Windows Defender already scans it before allowing access. If it is infected then you don’t get to fiddle with it.  Same thing with downloaded files; again pre-scanned by Windows Defender.  So, you can manually scan them again if you want, but know that if you do use Windows Defender in Win 8, it has already scanned the file.

Message Analyzer has Released – A New Beginning and Message Analyzer: Why so different from Network Monitor? - MessageAnalyzer Blog - Final release now public for Microsoft’s network capture analysis tool. I’m not sure it will replace Wireshark, but the approach is a step up from their older Network Monitor capture tool and is at the very minimum a great supplemental network capture tool for packet analysis.

Plugin Activation in Firefox - Mozilla Add-ons Blog - basically in a future version of Firefox, all plugins (except Flash) will become “click-to-activate”. This may or may not be a great thing depending on your security versus convenience perspective.

Wendel's Small Hacking Tricks - Killing Processes from the Microsoft Windows Command Line interface - SpiderLabs Anterior - I’m always looking to find a way to do something without a third-party tool so this is handy information to be familiar with.

Universal USB Installer (also YUMI) USB Flash drive does not boot on EeePC - RMPrepUSB, Easy2Boot and USB booting... blog - This is a pretty esoteric technical post for most folks, however if you are into USB-based system booting, it is interesting.

When setting up Windows 8.1, Microsoft appears to do all it can to shove you to create/use an on-line Microsoft account rather than a local one.  For some folks that might be fine but others (particularly the old-school crowd) will find this process similar to a cattle chute. If you are a thinking cow, it probably isn’t a very pleasant experience. Fortunately, there seem to be a number of outs if you know the game ahead of time.

• How To Install Windows 8.1 Without Microsoft Account - Into Windows
• Use Windows 8.1 with a local account instead of a Microsoft account - 4sysops
• How to setup local account in Windows 8.1 - DeDoimedo.com
• Windows 8.1 How To Convert Windows Live Account To Local Account - Next of Windows

Group Policy Search Engine Gets Updated - Group Policy Central blog - From that post by Alan Burchill:

“The Group Policy Search Engine is a great web site that has all the different version of Microsoft Group Policy ADMX files that allows you to easily and quickly search for the policy setting. This site is one I use very frequently especially and is a must have bookmark for any Group Policy Administrator.

“Well, Stephanus from Microsoft who maintains the web site has just loaded the Windows 8.1 and Windows Server 2012 R2 policy setting meaning you can now look up all the new policy setting in the latest version of Windows. “

Group Policy Search - site homepage.

Google Static Map Maker: Static Maps on Steroids - noupe - Nice tool to create linkable custom static Google maps rather than using a screen-shot image or a embedded and modifiable one.

Google Static Map Maker - site homepage by Katy Decorah.

Cheers!

--Claus Valca

Read More

Network & Network Security Quickpost - Last call NFAT edition

I just couldn’t wrap up the weekend without sharing these links. I’m so going to be nodding off in my training class tomorrow. Must bring Thermos of extra coffee with me! Don’t want to make the teacher unhappy!

So many network tools, tricks, and nuggets came out last week I’m still exciting thinking about how to use them all!

Security Advisory: Two Vulnerabilities in NetworkMiner - NETRESEC Blog - Don’t let the boring post title fool you! Based on this, Erik Hjelmvik has released a new version of NetworkMiner! Now sparkling at version 1.5 (free/pro editions)

NetworkMiner packet analyzer - Download NetworkMiner version 1.5 (free) here.

While I was doing some super-fast (but apparently productive) beta testing for Erik on some Windows 7 and Windows 8/8.1 systems, I noticed I wasn’t getting great results from my test captures made with and being processed in NetworkMiner. My “doh”. Erik kindly reminded me of his post NETRESEC RawCap - A raw socket sniffer for Windows where he pointed out that using Windows raw socket sniffing has some problems. I had forgotten I didn’t yet install Wireshark/WinPcap on these particular test systems. From Erick’s post:

Microsoft's newer operating systems (later than WinXP) have limitations associated with raw socket sniffing of external interfaces, i.e. everything that isn't localhost. Known limitations in Windows Vista and Win7 are:

• Windows 7 - Can't capture incoming packets
• Windows Vista - Can't capture outgoing packets

Due to these limitations in the raw sockets implementations of Microsoft's current operating systems we suggest running RawCap on Windows XP if you need to capture from external interfaces.

Baselining Dropbox With Wireshark (by Tony Fortunato) - LoveMyTool blog video presentation.

Editing Tracefiles With TraceWrangler (by Tony Fortunato) - LoveMyTool blog video presentation. This short video presentation on a new (Alpha release) tool, TraceWranger blew me away. There are methods of sanitizing trace files for sharing/training but they are fraught with challenges for mere mortals. This new tool is amazing and I really hope the developer Jasper Bongertz gets the support needed to encourage his continued refinement and development of this valuable tool for analysts.

• TraceWrangler - (alpha software) - currently at build version 0.1.3. Standalone application. No installation needed. Unzip and go. Written by Jasper Bongertz.
• TraceWrangler Documentation - This is Must Read material if you are interested in using this tool properly
•  Starting TraceWrangler - the basics
• Anonymization Tasks - details for the options
• Trace File Sanitization NG - SEC-04_Trace-File-Sanitization-NG_Jasper-Bongertz (PDF) - Link to his presentation of the tool at Sharkfest 2013.
• Sharkfest 2013 - Trace File Sanitization (Jasper Bongertz) - YouTube. While PDF versions of presentations are nice, on a whim I decided to see if Jasper’s presentation was actually up on YouTube for viewing. It was!
• Trace file sanitization for network analysts - Packet Foo - Jasper’s blog post with additional details on his tool in case you missed the presentation.
• The notorious Wireshark “Out of Memory” problem - Packet Foo. Oh how this has hobbled me over the years! So much so that CLI based captures became my dearest friend!
• Packet Foo RSS - Yeah. It’s that good. Feed yourself on it!

Nmap - Now at version 6.40 - Free Security Scanner For Network Exploration & Security Audits.

• Nmap Change Log
• Download Nmap Security Scanner - for Linux/MAC/UNIX or Windows

Message Analyzer Beta3 Refresh has Been Released (Build 6215) - MessageAnalyzer - Lost in all the news was a quiet announcement of the next generation of Microsoft’s own network traffic analysis tool MessageAnalyzer getting a Beta 3 refresh release. The interface is very different (to me) from Wireshark, but since I used NetMon a ton to supplement my Wireshark work, it is taking some getting used to.

HolisticInfoSec: toolsmith: C3CM Part 1 – Nfsight with Nfdump and Nfsen - HolisticInfoSec blog - Russ McRee’s post rocks on so many levels. Well worth the read and review.

Firefox Developer Tool Features for Firefox 23 - Mozilla Hacks – the Web developer blog. In case you missed it, Firefox 23 was released last week. Included in it (besides the new app icon update) was a new network tool called “Network Monitor.” 

I so love this! “F12” is the new “must know” hotkey in these modern browsers!

If only Mozilla (or Chrome or IE 10) were “approved” web-browsers in our enterprise. This feature alone would so help with network and web-app diagnostics and troubleshooting from the end-user desktops.

What’s that you say? One single element of your cloud-based web-application seems to time out in IE 8, crashing your session? The network is fine, site bandwidth is fine. Your PC is fine. Seems like it could be a server-side application issue. Let me make a ticket for your issue and send it up. (Response often comes back, “There is no problem…must be a client-side issue…check the PC and bandwidth, follow our response template and let us know…”) (Sigh…)

• Network Monitor, now in Firefox Beta - Mozilla Hacks – the Web developer blog - More details on the feature.
• A look at Firefox's new Network Monitor - Ghacks - Martin Brinkmann does an outstanding job introducing it as well.

Turns out Chrome web browser can do this trick as well

• Evaluating network performance - Chrome DevTools — Google Developers
• Performance profiling with the Timeline - Chrome DevTools — Google Developers
• Chrome Dev Tools: Networking and the Console - Nettuts+
• Google Chrome Dev Tools: Network Panel - TechRepublic

Turns out that Internet Explorer (IE9, IE10, IE11) also have a “F12” feature for network analysis in the browser.

• Introduction to F12 Developer Tools (Windows) - IE Dev Center
• Navigating the F12 Developer Tools Interface (Internet Explorer) - IE Dev Center
• Internet Explorer's F12 Developers Tools: A feature walk-through - TechRepublic
• A Peek at Internet Explorer’s Developer Tools - Nettuts+
• Network Traffic Capturing with IE9 Developer Tools - LINQED.NET

And in IE11, it’s about to bring the house down on the competition!

Debugging and Tuning Web Sites and Apps with F12 Developer Tools in IE11- IEBlog. OMG!!! I am so crushing on the new “F12” profiling and responsiveness tool interface in IE 11! Please tell me this is going to be backwards compatible with Win 7. (Why yes, Virginia, it is…)

Anyway, back to more Firefox 23 release news and details.

• Firefox 23 lands with a new logo and mixed content blocking - Ars Technica
• Firefox Notes - Desktop - Mozilla.org
• Firefox 23 enables mixed content blocking, consolidates search settings - BetaNews
• A Look At What's New In Firefox 23 - Addictive Tips blog

Troubleshooting TCP/IP Connectivity Issues with This Command-Line Utility Portqry.exe - Next of Windows. Been using portqry.exe from the command line along with the PortQueryUI GUI fro some time. Dead helpful in a pinch!

PuTTY: a free telnet/ssh client - just released at version beta 0.63 for you console fans! See the extensive Changes page for all the details

• PuTTY Portable 0.63 - PortableApps.com build version as well is available and updated.

KiTTY - let’s not forget about this fork version of PuTTY that has some additional bells-and-whistles!

• News - latest KiTTY news is update 0.62.2.3 minor update in late May 2013.
• Recent changes - tracking site-changes at KiTTY’s house
• KiTTY Portable - why “yes” there is a PortableApps.com build version as well for KiTTY fans.

Finally, at home I run Mozilla Firefox, Portable Edition and Google Chrome Portable rather than installing them directly on my system. However I was trying to use some of NirSoft’s Browser Tools to explore and check my Google Chrome(ium) cache and wasn’t finding anything at all.

Strange.  Bug in the tool?

Turns out the answer was “of course not dummy” it’s the dummy’s bug.

Where is the Google Chrome Portable cache folder? - PortableApps.com. Bruce Pascoe kindly puts it like this:

Chrome Portable, like FFP, doesn't save the cache by default.

Note that unlike Firefox however, there's no way to turn the cache off completely in Chrome, so while it's running the cache is stored in the local temp directory (%TEMP%), but then it's immediately deleted when you exit Chrome.

So anyway, yeah, no surprise that you couldn't find it.

and cleared up a bit by “The MAZZTer”

The cache folder is saved in %TEMP%\GoogleChromePortable.

Where the %TEMP% is the user’s temporary file location under their profile.

This is interesting as it explains why the NirSoft tool ChromeCacheView wasn’t finding anything while pointing to the default user profile location in my Portable Apps application structure that ChromeHistoryView didn’t seem to have any issue with parsing. So even though the files were removed when the program terminated, it most likely did not “secure” delete them, so (depending on overwrite activity of the file system/free-space scrubber utilities) it might be possible to carve and recover them from a system that the portable-apps version of Chrome was used on. And that sounds like a challenge for another day…

Cheers!

--Claus Valca

Read More

New Apps and Utility Updates

Submitted here for your frustration is a jumble of new and updated software applications I’ve collected over the past couple of weeks.

Think of it like the “pot-luck” box where everything is free for the taking after the week-long garage sale has concluded.

Only you might really want something in this mix.

MetroTextual 1.5 - SingularLabs - slick notepad replacement has some new improvements in this edition. Including Transformers (Plugins).

SpeedyFox - CRYSTALIDEA Software - Some time back got bumped to version 2.0.4. I run this regularly to clean up my Firefox/Chrome/Thunderbird databases. It really helps with launch speed. See also SpeedyFox Portable - PortableApps.com

CPU Meter Pro - Microsys - The GUI is very nice though the level of detail might be a bit less than some sysadmins might prefer.

DLL UnInjector - NoVirusThanks - unload DLLs within a selected process. More at this Unload loaded DLLs with DLL UnInjector post.

Download Backup Thunderbird - free tool to back up Thunderbird email clients spotted in this AddictiveTips post Easily Backup & Restore Your Mozilla Thunderbird Accounts & Their Data. I personally have always relied on MozBackup.

NetworkLatencyView - Nirsoft - New tool that calculates the network latency. Some details in this NirBlog post: New utility that calculates the network latency of every TCP connection. Looks pretty cool for you network troubleshooting and monitoring geeks.

TightVNC version 2.7.10. - What's New in TightVNC

LibreOffice 4.1 is here! - LibreOffice.org

LibreOffice - Home

LibreOffice Productivity Suite Download - LibreOffice

LibreOffice 4.1.0 Portable - PortableApps.com

Opera Next 16 hints at new features - BetaNews. I don’t really follow Opera web-browser development very closely any longer. Most of my time is focusing on Firefox/Chrome/Chromium/Internet Explorer. Hover there are some detail here that might be worth noting.

Network monitor debuts in latest Firefox beta - Mozilla Links. I really, REALLY like this addition…browser-bloat or not.

SMF v 5.0 – Search my Files - funk.eu - I’ve got more than many Windows file finders, searchers, and file indexing apps that I can summon at will. However funk’s SMF and NirSoft’s SearchMyFiles tools are my go-to file finders without peer. They both have been recently updated with loads new features and rather than see them as competitors, I see them as complimentary utilities depending on the search need at hand.

Intel® Driver Update Utility - Back while I was working on my “What is this “PC-Doctor Module” you speak of?” post, I noted Lavie’s system had the Dell Support Center software installed and how it can help with keeping OEM drivers updated. I checked my own system and the software wasn’t there. Maybe I uninstalled it? Anyway, this Java based application from Intel will do a scan of your system and report if any Intel-based hardware components are present and if a newer driver is available. Sometimes the OEM-branded driver will be preferred, however in most all cases, I have found the Intel driver is much, much fresher and more improved than the OEM version. Yesterday it told me my IntelProNic/WiFi network driver was way old so I updated it to the latest Intel driver version. No issues.

View DELL Service Tag and Express Service Code From Linux and Windows - The Geek Stuff.  Because sometimes it’s a hassle to flip your Dell laptop/desktop around to look for the codes:

1. Get DELL Service Tag on remote Windows system

Login to the Windows remote-host using VNC or remote desktop connection. Use WMIC on Windows to get service tag as shown below.

C:\>wmic bios get serialnumber
SerialNumber
ABCDEF1

Following WMIC command will give make and model number along with service tag.

C:\>wmic csproduct get vendor,name,identifyingnumber
IdentifyingNumber    Name                Vendor
ABCDEF1              PowerEdge 2950      Dell Inc.

If VNC or remote desktop connection to the remote-host is not available,  execute the following from the local-host to get the service tag of the remote-host.

C:\>wmic /user:administrator /node:remote-host bios get serialnumber
SerialNumber
ABCDEF1
[Note: Replace remote-host with the machine name of your remote-host.]

PeStudio 7.26 - winitor - (updated) - “PeStudio is a free tool to perform static analysis and investigation of any Windows executable file. A file being analyzed with PeStudio is never launched. Therefore, you can evaluate unknown executable files and even malware with no risk. PeStudio runs on any Windows platform and is fully portable, no installation is required. PeStudio does not change the system or leave anything behind.”

SoftPerfect Network Scanner - version 5.4.12 - a free network scanner, tweaked and updated. It’s one of my all-time favs.

Get the Start menu back in Windows 8 and 8.1 with Classic Shell - BetaNews - Tip from Mike WIlliams that Classic Shell 3.9 beta has improved their flagship tool for reclaiming the ground lost by users everywhere in the ongoing battle for Win8 Start Menu hill against Microsoft. I really like the way this looks. Pop over to Classic Shell directly to download the beta bits if you are interested. I find that I still (for now) prefer IObit Start Menu 8 Free for my Windows 8 tweaking. One of these days I’ll get caught up and empty out my lethargic Windows 8 post-launch pile-o-links that has more than a few additional alternatives. My little brother recommends Stardock’s $ Start8 application for what it’s worth.

Cheers.

--Claus Valca

Read More

Browsers Browsers Everywhere!

…and in browser news and trends, things are getting pretty interesting…

Firefox/Mozilla

• Firefox turns 20—version 20, that is - Ars Technica
• Firefox 20.0: Find out what is new - GHacks.net
• New In Firefox 20: Private Window, Improved Download Manager & More - AddictiveTips blog
• Download Manager Tweak - Firefox Extension Guru's Blog. I actually like the new Download Manager feature a lot, still haven’t yet shed my Download Statusbar Add-on in Firefox. But I probably could and likely will.
• Download Manager Tweak - Firefox Extension Guru's Blog
• Samsung teams up with Mozilla to build browser engine for multicore machines - Ars Technica
• Mozilla and Samsung team up to kill Chrome mobile - BetaNews
• Newsfox: 1.0.8.4.2 - RSS reader Add-on for Firefox just got some updates. Release notes 
• Firefox Stub Installer on Beta Channel - Firefox Extension Guru's Blog. As The Guru points out, newer versions of Mozilla Beta/nightly releases download a small “stub” and than then downloads and installs the main binary sets over the wire. This does keep initial download sizes low, but also can wreak havoc on controlling custom deployments of some of these packages. Chrome does the same thing and they also “hide” their Chromium Dev download sources very well so now I have ended up dropping over to PortableApps.com: Google Chrome Portable/Additional Versions at SourceForge.net to snag and apply my portable Dev builds. Not impressed…especially now that Mozilla is rolling that direction as well. More info here on the Mozilla nightly stub-installer background if you are curious: Mozilla Adds Chrome-Like Downloader to Streamline Firefox Installs - TheNextWeb & Stub Installer in Firefox Nightly – Try it out, Give feedback, and Test it! - QMO – quality.mozilla.org
• Firefox prefetching: what you need to know - Firefox Extension Guru's Blog - Great tweaking tips from The Guru.

…meanwhile over at the other hot-rod shop…

• Google going its own way, forking WebKit rendering engine - Ars Technica
• Blink: A rendering engine for the Chromium project - Chromium Blog
• Does WebKit face a troubled future now that Google is gone? - Ars Technica
• Blink - The Chromium Projects

Sadly, I remain terribly frustrated that Chrome developers just will not add a “sidebar” feature for bookmark management to Chrome like Mozilla has. This is a soapbox I just can’t seem to climb down from with Chrome. Again I say, if it were not for this one missing feature, I might jump to using Chrome/Chromium as my primary browser and relegate Firefox to the #2 slot.

The closest “solution” I have found are tree-style tab organizers…but the drawback of them is having to leave the tabs open.  Something I don’t like doing.

Sigh.

• Get A Tree Style View Of Chrome Tabs; Group & Hibernate Them - AddictiveTips blog. 
• Sidewise Tree Style Tabs - Chrome Web Store
• Tabs Outliner: the ultimate Chrome tab management extension? - GHacks blog
• Tabs Outliner - Chrome Web Store

Finally…it’s a bit older post, but I really found this post by Alex Limi very fascinating from a power user’s standpoint in using a browser. I don’t at all like the idea of removing control and configuration settings from access. That said, as a sysadmin, you can certain spend many frustrating hours troubleshooting a user’s web-experience problems before finding a buried browser setting that was causing the issue.

• Checkboxes that kill your product — Alex Limi

Cheers,

--Claus Valca

Read More

Internet Explorer 10 (for Win 7), Firefox bits, and How Google Works

News of Microsoft’s release of Internet Explorer 10 for Windows 7 seemed to go off like a flare; lots of noise and brilliance…and then flickering out to nothing.

In my security posture of trying to keep all the web browsers installed on all our home systems current, I went ahead and jumped on IE 10 and installed it almost immediately after release on our Windows 7 systems. 

None of us (well except Alvis with her college portal) regularly use Internet Explorer.

I use still primarily use Firefox for my daily heavy-lifting at home, and supplement it with Chromium (a build version of Chrome).

Alvis prefers the public release version of Chrome…which self-updates BTW…so that is fine by me.

Lavie uses Firefox exclusively….also because of the bookmark sidebar feature.

But I leave Internet Explorer on our systems (for compatibility reasons with some applications and websites).

Anyway, it went on all out systems without much fuss…well, not really on mine. Lessons learned. If you want to manually put it on your system, just make sure of all the links you are offered, the one you are using is to the actual FINAL release installer and not one of the IE 10 “preview” release version installers. In my haste (and trust in the IE Blog post I used) I grabbed a preview version and had to go through a series of additional security updates and IE 10 release upgrades to eventually arrive at a fully updated version of IE 10.  I didn’t make that same mistake with subsequent installs on everyone else’s systems.

• Internet Explorer 10 finally released for Windows 7 - Ars Technica
• Internet Explorer 10 now available for more than 700M Windows customers - Exploring IE Blog
• IE10 for Windows 7 Globally Available for Consumers and Businesses - IEBlog
• RELEASED - Download Internet Explorer 10 for Windows 7 - Scott Hanselman’s ComputerZen
• Bloody well time, Microsoft releases Internet Explorer 10 for Windows 7 - BetaNews
• Internet Explorer For Windows 7: New Features & Improvements - Addictive Tips
• IE10 on Windows 7: 5 Essential Facts - Software -Information Week
• Download Internet Explorer 10 for Windows 7 (32-bit) - Official Microsoft Download Center
• Download Internet Explorer 10 for Windows 7 64-bit Edition and Windows Server 2008 R2 64-bit Edition - Official Microsoft Download Center
• Download Internet Explorer 10 Language Packs for Windows 7 and Windows Server 2008 R2 - Official Microsoft Download Center
• Release Notes - Microsoft
• Download Internet Explorer 10 - Microsoft Windows - Worldwide installation packs

Meanwhile, these Firefox articles were pretty timely.

• Prepare Mozilla Firefox for Enterprise Deployment and Virtualization - Aaron Parker
• The Firefox Extension Guru's Blog links to this How to make Firefox the Fort Knox of browsers - over at Ghacks.

And Google has some great presentations to help you understand how their email and search services work.

• Follow an email’s journey with Story of Send - Google Official Blog
• The Story of Send - Google
• Google Releases Interactive Infographic: "How Search Works" - Search Engine Land
• How Search Works - Google

Stay informed & Browse safe.

Claus Valca

Read More

Saturday Linkfest - Cold Pizza Edition

The other night on my way home from work, I was tired and exhausted. I didn’t feel like going grocery shopping for dinner so I punted.

I stopped by the pizza parlor, grabbed three large pies. We ate one for dinner, then have been snacking on cold-pizza leftovers for the past two days.

I’m almost out of slices so I guess it will be to the grocery store tomorrow for some real food again.

USB-based Windows System Install Options

The other day at work, a co-worker asked me for some feedback on a particular problem they had at home.

Seems that he had decided to upgrade (actually a fresh install) a laptop from Windows XP to Windows 7. Only problem was the CDROM drive was in pretty bad shape, and all he had was optical install disks. So how could he get the upgrade on.

Although I supposed he could find an external USB-based CD/DVD-ROM drive to use, that seemed like an unnecessary purchase. He did have a working Windows desktop system, however, so the solution seemed quite simple: create a bootable USB drive with the installation media present. Boot the laptop from the USB drive and install away!

So here are three methods to accomplish that task; full-hands on, Windows tool, and automated utilities.

If you are game and want to learn a bit of the structure of creating such a tool, then this TechRepublic post is perfect: How do I ... create an installation flash drive for Windows 7? I noticed it doesn’t have instructions to make the partition/device bootable via bootsect. BOOTSECT /NT60 <usb drive letter>    (Where <usb drive letter> equals your USB device).

Microsoft has a nice and simple tool to assist you with the process: Windows 7 USB/DVD download tool.  This guide How To Create Bootable Windows 7 USB To Install Windows 7 From USB Flash Drive (Using Windows 7 DVD/USB Tool) from Into Windows provides a nice walkthrough of the process.

Finally, there are some specialized utilities that give you a bit more control over the creation process. I particularly like these two:

• WinToFlash - Install Windows from usb - Home page
• Rufus - Create bootable USB drives

Piece of cake.

ForSec Bits

• EMET 3.5: The Value of Looking Through an Attacker's Eyes - ISC Diary - This was a fascinating post about the Microsoft Enhanced Mitigation Experience 3.5 toolkit and how it can leverage additional anti-malware protection on systems. I’m not sure a site-wide deployment would make a lot of sense, but for workbench systems and testing it might be a smart move to consider.
• Hunting Down and Killing Ransomware - Mark's Blog. Mark Russinovich provides an excellent technical review on dealing with scareware/ransomware infections on a system.
• A picture worth a 1000 barcodes? - ISC Diary - be careful what you post!
• Adobe Security Bulletins Posted - Adobe Product Security Incident Response Team (PSIRT) Blog
• Microsoft and Adobe close almost 40 holes - The H Security: News and Features. Time to patch Windows and Adobe holes again!
• Carving Station – RAR Files - M-unition. Mary Singh has a highly in-depth post coving file-carving from unallocated disk space. Not exactly light reading, Mary provides some excellent coverage on this topic.
• Freeware Release: Redline 1.7 - M-unition. New version released. download page
• TeamViewer 8 - Forensic Artifacts - Useful information on system artifacts left by TeamViewer 8 usage.
• You down with LNK? - SpiderLabs Anterior

Installing Stuff

• How to install Ubuntu on Acer’s $199 C7 Chromebook - Ars Technica
• Installing Windows XP to SSD - TinyApps.org
• Repurpose PCs with Windows ThinPC - Anything about IT (via tip from TinyApps bloggist).  See also AnandTech - Windows Thin PC: Windows, Slimmed Down

Tips for Techs

• No sound from Google Chrome: Adobe Flash issue and workaround - MarkWilson.it
• Easily Fix Or Delete Broken Desktop & Start Menu Shortcuts - AddictiveTips. Uses NirSoft tool ShortcutsMan for housecleaning.
• Free e-books for Windows administrators (updated) - 4sysops
• 150 Best Windows Apps Of Year 2012 - AddictiveTips
• Standalone Sysadmin - blog.  TinyApps bloggist pointed me to Matt Simmon’s great website a while ago. In addition to the great posts, Matt also provides a super-handy List of Subscribed Feeds covering all kinds of tech/sysadmin/forsec goodness. If you are new to RSS feeds and need a great “seed list” to get started with, look no further. Matt also provides a more current OPML file for use. Whew!

Network Monitoring

• PCAP Files Are Great Arn't They?? - SpiderLabs Anterior - fantastic examples of tshark-fu and other tricks for extracting great data-points out of PCAP files.
• Filtering with Message Analyzer - MessageAnalyzer Blog. It’s been a while since we have seen much chatter regarding the replacement for Network Monitor. Paul E Long has some great tips for filtering in the new tool; especially useful for those used to filter use patterns in Network Monitor. More posts promised soon.
• Installing Wireshark 1.8.4 and WinPcap 4.1.2 on a Windows 8 System - Moon Support Weblog

Tools, Utilities, and Updates

• Updates: Autoruns v11.4, ProcDump v5.12, SDelete v1.61 - Sysinternals Site Discussion
• GMER 2.0 arrives - BetaNews review. Rootkit detection tool now adds support added for Windows 8 and x64 systems. GMER download pager
• JavaRa Definitions Updated - SingularLabs - Use these with JavaRa to help install/update/remove Java Runtime Environment installations on your systems.
• Dev Eject - version 1.0.26 beta - this is a fantastically clever tool that can not only help you eject removable devices from Windows, but it also can tell you specifically what is causing (locking) the device from ejection.
• Oracle VM VirtualBox - Now at version 4.2.6. Overview of significant changes: VirtualBox 4.2.6 delivers many fixes - BetaNews.
• TightVNC: What's New in TightVNC - Now at version 2.6.4. Download TightVNC
• DMDE (DM Disk Editor and Data Recovery Software) - free/$ versions - Interesting advanced file recovery tool. The free version is pretty limited but is a good place to start and play around with. Portable so no installation required. DMDE is a handy free data recovery tool for Windows experts - BetaNews review.

Firefox News

• Mozilla to Continue 64-Bit Windows Firefox Builds - Firefox Extension Guru's Blog
• Private windows coming to Firefox - Mozilla Links

Cheers!

--Claus Valca

Read More

For-Sec & Utility Jumble Linkfest

The short weekend is done. The “Sandy Watch” is on for what could be -- for our northeastern friends -- a storm event to be remembered for many years to come. So comes a pile of security/forensic and utility-minded links spill out below for the curious and information hungry.

Forensics and Security

Girl, Unallocated: Be Very Quiet... I'm Tracking Emails Through Headers - Girl, Unallocated Blog. The Girl has a great post looking at email headers and their bits and perils. One gem is a report (PDF) from Stroz Friedberg and a particular focus on email headers. The report as a whole is a great read and again provides a lesson in technical report writing and presentation as well as some forensics pushback on anti-forensics techniques. At 102 pages, it isn’t a brief, but well worth the time to download and study.

The Girl’s post reminded me of another great publicly-available report that addressed emails in a forensic investigation.  In my GSD post Interesting Malware in Email Attempt - URL Scanner Links, I wrote the following bits at the end:

A recent Digital Forensics Case Leads post has mention of a super-fantastic investigation/forensic report involving anonymous emails. This is must-read material, not just in terms of the investigative methodology but also the way the report was composed and presented. Very clearly done!  I’m keeping a saved copy of the report for future reference; both technically and as a report template. From the post via the link above:

“University of Illinois recently released a detailed investigation report (PDF) regarding anonymous emails allegedly sent by its Chief of Staff to the University's Senates Conference. The report is an interesting read, and also serves as a potentially useful model for those looking for report samples and templates.”

How a Google Headhunter's E-Mail Unraveled a Massive Net Security Hole - Threat Level @ Wired.com.  I almost overlooked Kim Zetter’s post on how Mathematician Zach Harris -- as an exercise -- discovered a flaw in some providers user of a weak DKIM key to sign emails originating from them. Fascinating and short read.

DEFT 7.2 and DEFT english manual, ready for download! DEFT Linux - Computer Forensics live cd . New DEFT version out. Last one in x32 bits. Future versions will be strictly x64 flavored.

Xplico – Xplico 1.0.1 - Xplico new version release just dropped. From the brief post:

ChangeLog:

• nDPI integration
• performace improved
• FTP dissector improved
• Added the prism dissector
• CLI execution bug fixed
• PCAP-over-IP SSL encryption
• IRC dissector improved
• File reconstruction from Fragmented Payloads improved
• FaceBook Chat updated
• FaceBook Message (partial)
• HTTP without initial packets (packets lost)
• RTP dissector improved
• PCAP2WAV, RTP2WAV interface added

And don’t forget! Now you can update/get via apt-get! for Ubuntu 11.04 and higher.  Sweet!

sudo bash -c 'echo "deb http://repo.xplico.org/ $(lsb_release -s -c) main" >> /etc/apt/sources.list'
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 791C25CE
sudo apt-get update
sudo apt-get install xplico

LastActivityView - Nirsoft brand new utility! - Use this new tool to view the latest computer activity in Windows operating system. Nir Softer has some more details on his NirBlog: New utility that shows general computer activity. Could be useful for incident response and analysis and other “quick peeks” for key system activity indicators to narrow down the search.

FileAlyzer Portable 2.0.5.57 (detailed file analyzer) Released -PortableApps.com

Hacking KeyLoggers - Open Security Research has a great post that not only identified a USB keylogging device, but takes it to the next level in hacking it to determine the impact of the device and when it might have been dropped. Clever stuff.

Attacking TrueCrypt - The H Security: News and Features. Another interesting post that almost slipped by me. Interesting by itself but also shows the benefit of using “cascaded algorithms” in TrueCrypt to thwart current attacks…for now.

Restoration of defocused and blurred images - Yuzhikov.com. This is super cool.  Vladimir Yuzhikov hasn’t just done a proof of concept for de-fuzzing blurred imaged (either out of focus or those blurred with a mathematical algorithm), no, he has actually released a free Windows app to demonstrate the possibilities. Besides images, text that is out of focus can be unblurred as well. This is very fascinating and could assist investigators facing images and other digital files with blurred faces or content. It’s not exactly easy or guaranteed to work, but it is very promising start and Vladimir notes he is continuing development and refinement. Read his work please and snag the download.

Google Drive opens backdoor to Google accounts - The H Security: News and Features . Quoting from the post, “The Windows and Mac OS X desktop clients for Google's Drive file storage and synchronisation service open a backdoor to users' Google accounts which could allow the curious to access a Drive user's email, contacts and calendar entries.”  read the post for more info. As usual it seems to be a convenience versus security trade-off again. Choose your cake wisely. I stick with using only the web interfaces and pass on the client versions of these cloud-based storages services…for now.

Virtualization

The TinyApps bloggist has been hard at work digging out great tips and techniques for importing the virtualized “Windows XP Mode” into popular virtualization software. As always, the posts are impeccable with lots of details and supporting source documentation for additional study and research.

• Import Windows XP Mode into VMWare Player - TinyApps.org blog
• Import Windows XP Mode into VirtualBox - TinyApps.org blog
• Must-have tool for VirtualBox users - TinyApps.org blog.

Oracle VM VirtualBox - Version 4.2.4 just dropped…by the way. I almost missed it were it not for my RSS feed filters. See the changelog for more details.  And be sure to grab the 4.2.4 VM VirtualBox Extension Pack as well.

Miles’ posts reminded me of an earlier GSD summer post Virtual Solutions and his great post comment guiding me to getting MS’s IE VirtualPC images running in Virtual Box.

How to run Microsoft’s IE VPC images in VirtualBox
http://tumblr.jonthornton.com/post/11405634980/how-to-run-microsofts-ie-vpc-images-in-virtualbox

ievms - Automated installation of the Microsoft IE App Compat virtual machines
https://github.com/xdissent/ievms

Browser Plugin Update Time…Again.

Yes dear readers, it is “Jack and Jill” time again. Bother.

Adobe Shockwave got updated, as of this post, the newest (Windows) version of Adobe Shockwave is currently 11.6.8.638.

• Adobe - Adobe Shockwave Player - direct download
• Adobe - Security Bulletin: APSB12-23 - Security updates available for Adobe Shockwave Player - Adobe
• Adobe patches 6 critical security flaws in Shockwave - ZDNet
• Adobe fixes critical Shockwave vulnerabilities - The H Security: News and Features

Adobe Flash was updated as well. Newest (Windows) version is currently 11.4.402.287.

• Adobe - Flash Player - version information
• Adobe releases 25 critical Flash patches - The H Security: News and Features
• Adobe - Security Bulletins: APSB12-22 - Security updates available for Adobe Flash Player - Adobe

Java also got a quick update to both build versions. Windows Java updates are available in 1.6.0_36 and 1.7.0_09.

• Java SE 6 Update Release Notes - Oracle
• Java SE 7 Update Release Notes - Oracle
• Java SE Downloads - Direct download

Trying to figure out if all your browser plug-ins are current can be a super-pain for the inexperienced and geekless.

My go-to recommendation remains to pop over to Qualys BrowserCheck in each of your installed web-browsers, be it Chrome, Windows IE, or Firefox. Alas, Opera, Safari, and other browsers are not currently supported, however a check in one of the supported browsers may quite likely uncover a outdated plug in, patching it may fix the others in the process.  For a backup check, hope over next to The Secunia Online Software Inspector for a second opinion.

If you want a good all-in-one location to manually download your plugs, check out Browsers and Plugins Downloads over at FileHippo.com.

Utility and SysAdmin Finds of the Week

Defrag Tools: #13 - WinDbg - Defrag Tools @ Channel 9. New video on Sysinternals tool usage; specifically integrating Debugging Tools for Windows.

Case of the CertUtil Import Refusing The Correct Password - chentiangemalc. Great practicum post on troubleshooting a strange password error where the password was correct but not being taken.

SpeedyFox - Boost Firefox,Skype,Chrome,Thunderbird in a Single Click! - CRYSTALIDEA Software . It has been forever…like dinosaurs roaming the earth eras ago…since I last saw any post anywhere on speeding up a pokey Firefox browser by “optimizing” the JSON databases. This is a dead-simple process to improve launch-time for a well-used Firefox browser. It’s been months since I last optimized mine. When I went to run SpeedyFox, my favorite tool to do so, I wondered if there had been an updated release. My version was at least a year old.  Happily I found there was a newer version, and that it now supports optimizing Chrome-based browsers as well. It remains available as a free edition. Current version is 2.0.3 but while I was sleeping, the developers have been adding support for Skype, Chrome (including SRWare Iron and Pale Moon), Mozilla Thunderbird, and Firefox (including Epic Browser). There is a Mac version (Firefox only) also.

If you use Firefox/Chrome/Thunderbird, stop, drop and run right now!  Did I mention it supports custom paths to your browser profiles so you can optimize portable versions on your drive/disks? Sweet baby Jebus!

CR2 Converter - I shot a lot of photos for Lavie and her family last weekend with the Canon 5D Mark II.  Pops asked for copies and when I was getting ready to pass them off, I realized I had not changed the setting from “RAW” only to RAW+JPEG. So I had over 300 digital images in RAW .cr2 format that his computer cannot read and that are not really a practical format for him anyway to use. Sure, I could batch-convert them in Lightroom/Photoshop, but I really just needed to get them quickly on a CD for him.  I have more than a few RAW freeware tools for tweaking individual RAW file images but that was too time-consuming to use. Luckily, with just a bit of Google diving, I found the freeware Canon RAW Image Converter “CR2 Converter”.   It supports batch-conversion and did an acceptable job for this task. My i7 x64 8 GB RAM system chewed through converting the files in no-time.  To my eyes the resulting images were a bit lightly purple-tinted…not bad or unpleasant but definitely noticeable when compared to the RAW file. Nothing that some simple color correction can’t fix if really important. For Pops it wasn’t but YMMV.  I wouldn’t use it everyday for batch processing but for quick-n-dirty RAW .cr2 to JPEG/JPG/GIF/BMP/PNG/TIFF conversions it is a super time-saver. Tuck it away for when needed in a pinch.

Cheers and hopes and prayers for the very best across the north-east seaboard as Sandy rolls in.

--Claus V.

Read More

Java does a “Jack and Jill”

CC attribution: illustration "Jack and Jill" by "perpetualplum" on flickr.

So here is the way I saw the Java drama roll downhill like Jack and Jill over the last two weeks from security standpoint.

So we started out safely headed up the hill to fetch our water shod with Oracle’s Java 1.7 update 6.

08/27/2012 - Starting up the hill…

• Quick Bits about Today's Java 0-Day - ISC Diary
• Research & Analysis of Zero-Day & Advanced Targeted Threats:Zero-Day Season is Not Over Yet - Malware Intelligence Lab from FireEye
• Java 7 0-Day vulnerability information and mitigation - DeepEnd Research
• Attackers Pounce on Zero-Day Java Exploit - Krebs on Security
• Researchers: Java Zero-Day Leveraged Two Flaws - Krebs on Security

Oh noes! Jack has stumbled!

(It wasn’t really clear at first, but Java 1.6.34 was also vulnerable.)

08/30/2012 - Java Jack Recovers

Fortunately Java Jack just had a stumble, the pail and his crown are still safe after catching himself.

• Oracle Releases Java Security Updates - ISC Diary
• Vulnerability Note VU#636312 - Oracle Java JRE 1.7 Expression.execute() and SunToolkit.getField() fail to restrict access to privileged code - US-CERT
• Alert for CVE-2012-4681 - Oracle
• Java SE 7u7 AND SE 6u35 Released - F-Secure Weblog : News from the Lab
• Oracle patches critical Java bugs used to commandeer computers -  Ars Technica

So we all rush out and download Java 1.7.7 and/or Java 1.6.35.

Whew! That was close.

08/31/2012 - Java Jack Takes a Dive bringing Jill with him

Jack…Stop looking at that frisky rabbit and getting ideas and pay attention dude! You’re about to step into some of its…

Oh snap! You did and you slipped in it.

• Not so fast: Java 7 Update 7 critical vulnerability discovered in less than 24 hours - ISC Diary
• Critical bug in newest Java gives attackers complete control of PCs - Ars Technica
• Latest Java sandbox is still vulnerable - The H Security: News and Features
• Blackhole targeting Java vulnerability via fake Microsoft Services Agreement email phish - ISC Diary

Seriously Jack. Really?

You should have been paying better attention to your hill-climbing technique; or at the very least dear Jill and not the rabbit.

Now you’ve taken Jill out in your folly and broken your crown; again.

Still Want That Water?

So where does that leave us now that we are holding the pail to safely quench our thirst?

Here is some sound advice.

• 6 ways to protect against the new actively exploited Java vulnerability - Security - InfoWorld
• You don't need Java - BetaNews
• Tips For Java Junkies - F-Secure Weblog : News from the Lab

Me? I just disabled my Java browser plugins for IE/Chrome/Firefox and run NoScript in Firefox. However I didn’t uninstall my Java applications (1.6.35/1.7.6) as I do use a handful of true Java applications on my system.

I figure that will have to do for now until the next round of updates rolls.

No word when Jack will be out of the ER yet. Jill remains pouty.

Other Java-related tools you might be interested in while you wait…

• JavaRa - SingularLabs - great third-party freeware utility to manage your Java RE build installations. More here at ghacks.net.
• Jarfix - Johann N. Löfflmann’s tiny app to fix Java “JAR” file associations on Windows after a Java update borks them.
• Java SE Downloads - Oracle - Java SE (Standard Edition) 7u7 JRE (Java Runtime Environment) and Java SE 6 update 35 JRE download links available from this link. When new updates are available you should be able to get them here.

Oh, did I mention that we just completed a massive rollout of Java 1.6.31 a few weeks ago across our enterprise to bring us to a new operational standard?

I lovingly refer to it as Project Maginot Line.

à revoir! from the bunker,

--Claus V.

Read More

Power Pile of Links

CC attribution: "Chain links" by HowardLake on flickr.

Got to go into the office tomorrow for one of those rare (for me) weekend special project rotations.

So I’m afraid a have just a bit less time that usual to spend on the blogging front.

Today’s offering is a large mix that covers LiveCD’s, some WinPE stuff, virtualization, new utility “how to” videos, third-party plugin updates, browser bits, networking, admin tips, password hint leakage, forsec, and a bit of graphical goodies.

ForSec LiveCD’s 

PALADIN 3.0.1 Forensic Software - Paladin just released version 3.0 of their LiveCD. You must have set up a free user account first and log in to access the PALADIN Download page. Changes in 3.0 & 3.0.1 are:

Version 3.0 New Features -

-- PALADIN Toolbox has been ported to Ubuntu 12.04

-- Network Share Icon has been added to the desktop to access network volumes that have been added via the MOUNT Tab

-- Boot support for current Intel Macs (including the newer MacBook Airs)

Release Notes

3.0.1 - Fixed issue where Unallocated Image function was producing 0 byte files.

Road to DEFT 7.2 and more DEFT Linux - Computer Forensics live cd - Deft 7.2 is scheduled for release in September 2012 and will mark a milestone of sorts. It will be the last x32-bit system release. Starting with 8.0 builds, they are going for x64 system support builds only. Shouldn’t be a deal-breaker, just keep a 7.x version handy as well.

DEFT 7 Cyber Forensic Tool Overview (by Casey Mullis) - LoveMyTool blog. Since we were speaking of DEFT, Casey Mullis gives a nice walkabout of DEFT 7 with nice screenshots if you are interested.

ESSPEE - Penetration Testing & Forensics - SourceForge.net - Updated to “R1 x86”. This is a new distro to me and is based on BackTrack 5 for pentest/for/sec work. Uses the “Unity” desktop interface.

Back|Track 5 R3 - new release. More details BackTrack 5 R3 Released!, BackTrack 5 R3! — PenTestIT, and from this H Security: News and Features post, BackTrack 5 R3 adds tools for Arduino and Teensy attacks. Choose your path carefully! Available in both KDE or Gnome flavors, with x32 or x64 platforms. In case you can’t decide, you may want to first look at this general KDE and Gnome Comparison post by ubuntucat.

WinPE Stuff

The few of you who regularly read this humble blog may have seen some recent activity in the comments sidebar. Turns out we had a recent celebrity visitor "Steve” from RMPrepUSB who posts a crazy-number of posts and tips on WinPE and USB booting in general.

Steve left a tip regarding use of the imagex.exe argument “/norpfix” switch when capturing images…specifically as it applies to junctions when the image is applied to a differently-named volume.

What is /norpfix switch, and what does it do? - Blogs from Zhou, Minxiao

In case you are interested, RMPrepUSB is a super cool tool to format and create bootable USB media. Lots of bells and whistles here and extreme tippage and tutorials for you WinPE fans.

• Create Bootable Windows or Linux USB with RMPrepUSB - ghacks.net
• RMPrepUSB (and USB booting) - RMPrepUSB blog

If I’m not careful I can loose hours at a time gong though Steve’s extensive tutorials. Here are justa few you might find interesting:

• 16 - How to boot to different WinPE versions using a single boot.wim that contains multiple images
• 83 - Download ImageX, BCDBoot and other WAIK tools - RMPrepUSB
• 53 - Windows 8 To Go (boot Windows 8 from a USB drive!) - RMPrepUSB

Windows 8 and WinFE - Windows Forensic Environment blog. Brett Shavers tips us to a cmd script from Troy Larson (The WinFE dude) that allows creation of a WinFE build from Windows 8 RTM. New to WinFE building? Well then, see also:

• Build questions - Windows Forensic Environment blog.
• WinBuilder - Windows Forensic Environment blog.
• Colin’s Final Version of his write protect application - Windows Forensic Environment blog.
• Winbuilder Tutorial - Windows Forensic Environment blog.
• Windows Forensic Environment - Colin Ramsden’s site for WinFE Lite building.

How to sync time in Windows PE - WindowsNetworking.com

VirtualBox and VMware Player updates

Pretty good synchronization getting these updates out guys!

First up, VirtualBox 4.1.20 is out.

• Oracle releases VirtualBox 4.1.20 - BetaNews review by Nick Peers.
• Download VirtualBox 4.1.20.80170 - FileHippo.com - (sometimes faster)
• Oracle VM VirtualBox - Download from Oracle
• Changelog – Oracle VM VirtualBox

Next, VMwarePlayer is rolled up to v5.0 with some significant changes.

• Download VMware Player 5.0 - Get it from VMware direct, or..
• Download VMware Player 5.0.0 - FileHippo.com
• VMware Player 5 Release Notes
• VMware releases Workstation 9, Fusion 5 and Player 5 - BetaNews
• VMware Player angetestet 5 - Borns IT & Windows Blog (Google Translated)

For VirtualBox, be sure you download and upgrade your Oracle VM VirtualBox Extension Pack at the same time. Likewise VMware users should also be sure to install the latest VMware Tools in your VMware hosted virtualized client OS for peak performance.

Defrag Tools Video

Defrag Tools - Microsoft Channel 9 - neat source for fresh reviews of MS tools and techniques now has two more quality videos up.

• Defrag Tools: #3 - Process Monitor
• Defrag Tools: #4 - Process Monitor - Examples

Update those Browser Plugins!

I’m thinking I’ve put in close to three hours this past week updating our home systems as well as Dad’s system to ensure they have the latest Flash/Java/etc. updates.

Adobe closes numerous critical holes in Reader and Acrobat - Update - The H Security: News and Features

There are lots of places and ways to download and get the updates; inside app updaters, direct from the software builder’s site, or from third-party locations like filehippo or majorgeeks.

I generally tend to just rock over to filehippo and pull them down. I suppose there is a risk they could have been corrupted or “seeded” with unwanted bits, but so far I’ve not had any problems and their Plugins Downloads page makes nice “one-stop” shopping.

At work it is hard keeping up with what “build” version we need to upgrade these to as for Flash there are both 11.3.x and 11.4.x versions which may cause problems for certain in-house software applications if compatibility is not verified first. However, most home-users should probably be on the 11.4.x run right now.

Likewise there are both Java 1.6.x builds and 1.7.x build branches. Again, most home-users should probably be on the 1.7.x builds.

• Download Shockwave Player 11.6.6.636 - FileHippo.com
• Shockwave Player - Adobe.com
• Download Flash Player 11.3.300.271 (IE) - FileHippo.com
• Download Flash Player 11.3.300.271 (Non-IE) - FileHippo.com
• Download and install the latest Flash Player version - Adobe.com
• Web Player Download for All Operating Systems - Adobe.com
• Download Java Runtime Environment 1.7.0.6 - FileHippo.com
• Java Downloads for All Operating Systems Version 6 Update 34 - Java.com
• Java Downloads for All Operating Systems Version 7 Update 6 - Java.com

Regardless, once you are done with your patching, hop your Windows IE, Mozilla Firefox, and Google Chrome browser(s) over to Qualys BrowserCheck and run a quick free check to make sure they are sufficiently patched.

Additional Browser Notes

In my recent post Greased Monkey Business I celebrated the joy of finally finding a custom Grease Monkey script I could use that would justify adding it to my Firefox browser; Removing UTM data from URLs automatically for cleaner bookmarks. It has been a lifesaver to my blogging work.

So this past week I gave a second banana to the Monkey; Scrub Google Redirect Links for Greasemonkey from “ping”.

Check out this MakeUseOf post that goes into the details: How To Copy Crap-Free URLs From Google’s Search Results

Comodo IceDragon 14.0 released -- get it NOW! - BetaNews notice of the Comodo tweaked Firefox 14 browser release. (actually it is version 14.0.3). Direct download is available from this Comodo forums link: Comodo IceDragon ver. 14.0.3 is now available for download!!

BrowsingHistoryView - Nirsoft - Version 1.0 new utility release to view browsing history of all your web browsers. Nir Sofer has been offering browser-specific utilities to view browsing history, but this gem covers the four major ones at once; Internet Explorer, Mozilla Firefox, Google Chrome, and Safari. New Web browser history viewer - NirBlog

Network Fun

NetworkMiner 1.4 Released - NETRESEC Blog - New release improves handling of fragmented IPv4 packets. Hurray! Also no longer checks for pcap extension; works as long as it is a valid libpcap file, DHCP options are extracted, new parser for a particular protocol. There are also some nice GUI improvements.

Trace File Case Files - Sharkfest 2012 (by Jasper Bongertz) - video presentation of using Wireshark to trace out real-world problems and solve them.

Wireshark Security Update - ISC Diary. Wireshark builds got updated to squash bugs and patch vulnerabilities. Go get busy…Wireshark · Download

Notes for the Sysadmins

Simple but Extremely Useful Windows Tricks - Open Security Research - Nice list of handy Windows tips.

Why The Size of My Partition is Maxed Out at 2 Terabyte and How to Get Over it - Windows7hacker. Just guided Dad though adding a second internal HDD to his Vista system. He’s getting into digital photography and while he has lots of room left on his OEM primary HDD, adding a 2nd drive gives him an exclusive place to drop the files. I guess we could have gone with a external USB drive, but the internal was faster in the long run for large file transfers. Talked him into a 7200 RMP 1TB SATA drive. With some guidance got him to get it successfully installed. Then via a quick remote-control session, got it formatted, labeled, and added to the OS fine. Considered going for a 2+TB drive for a few more bucks, but this was easy enough. Next time I will have to follow the link tippage and set up a GPT disk if the conditions warrant.

Microsoft updated SkyDrive.com - Borns IT & WIndows Blog (Google Translated) - Nice review of the new SkyDrive updates.

RegKeyFixer - reboot.pro - sweet little tool by Joakim similar to Sysinternal’s RegDelNull. Related: Reghide

ForSec Links

Password hints easily extracted from Windows 7, 8 - Ars Technica

All Your Password Hints Are Belong to Us - SpiderLabs Anterior

A Fistful of Dongles: AFoD Interview with Eric Zimmerman - A Fistful of Dongles - Eric Huber interviews F.B.I Special Agent Eric Zimmerman. Great article (and Eric wears a mean flat-top to boot!). Many years ago I had applied to the F.B.I. hoping for a career there following in the steps of my grandfather who was a former Special Agent under Hoover. Alas…it was a path not to be.

ShellBag Analysis - Windows Incident Response Blog

SetRegTime - Windows Incident Response Blog

Linkz for Tools - Journey Into Incident Response Blog - Corey Harrell has some info on this post, particularly those tipping us time-challenged guys to the Time Zone Converter – Time Difference Calculator and Time Zone Map. Also valuable is the final section “Process, Process, Process” which strikes home the critical value of knowing in advance HOW you are going to do exactly WHAT it is you want to accomplish; supporting examples include links to the Forensic Process Lifecycle (PDF) from Lance Mueller at ForensicKB, the previously GSD blogged SANS DFIR Poster 2012 (PDF) download, and Corey’s own Journey into IR Methodology scratchpad.

Man versus AntiVirus Scanner - Journey Into Incident Response Blog - Corey shows of the value of having skillz and technique and a rock-solid process in a John Henry’esqe dance against an anti-malware scanner. Really a great tutorial and exercise.

Registry Decoder 1.4 Released and Updated Registry Decoder Live - New versions are available. I noticed that in the past separate downloads were available for x32 and x64 however I don’t see that in this release. I’ve not followed up yet to see if the newer version handles both automatically or not.

Generating computer forensic supertimelines under Linux: A comprehensive guide for Windows-based disk images - Forensic Focus. ForenicsRichard has also released the Shell (Bash) and C Source code as well.

Finding Smoking Gun and going beyond that – Helpful Forensic Artifacts - Hexacorn blog - another strong article supporting previously mentioned themes of having a process to use in looking for clues which here are referred to has HFA’s (Helpful Forensic Artifacts) to guide the overall investigative and analysis journey and discovery.

HexDive 0.4 - New update at Hexacorn to a tool which extracts strings from a file/sample for additional review. Corey recommends using BinText or Strings to further review the output.

The “Hikit” Rootkit: Advanced and Persistent Attack Techniques (Part 1) - Mandiant M-unition blog

The “Hikit” Rootkit: Advanced and Persistent Attack Techniques (Part 2) - Mandiant M-unition blog

Grab Bag

Change the Windows Logon Screen Background - CybernetNews tips us to Luke Payne Software » Logon Screen Rotator. While I do rotate my Win 7 desktop login picture periodically, (right now it it Tardis based), generally I keep it stable. This is a cool tool however for those who like a bit more variety.

Organize & Manage Huge Photo & Video Databases Using Snaps - AddictiveTips reviews the Snaps - Photo management application.

Microsoft Reimagines Paint - Next at Microsoft - New “version” of the perennial “Paint” app. (Win 8 only).

Tip o' the Week #133 - The Art of Cut n' Paste - The Electric Wand

Cheers!

--Claus V.

Read More