Internet Explorer 10 (for Win 7), Firefox bits, and How Google Works

News of Microsoft’s release of Internet Explorer 10 for Windows 7 seemed to go off like a flare; lots of noise and brilliance…and then flickering out to nothing.

In my security posture of trying to keep all the web browsers installed on all our home systems current, I went ahead and jumped on IE 10 and installed it almost immediately after release on our Windows 7 systems. 

None of us (well except Alvis with her college portal) regularly use Internet Explorer.

I use still primarily use Firefox for my daily heavy-lifting at home, and supplement it with Chromium (a build version of Chrome).

Alvis prefers the public release version of Chrome…which self-updates BTW…so that is fine by me.

Lavie uses Firefox exclusively….also because of the bookmark sidebar feature.

But I leave Internet Explorer on our systems (for compatibility reasons with some applications and websites).

Anyway, it went on all out systems without much fuss…well, not really on mine. Lessons learned. If you want to manually put it on your system, just make sure of all the links you are offered, the one you are using is to the actual FINAL release installer and not one of the IE 10 “preview” release version installers. In my haste (and trust in the IE Blog post I used) I grabbed a preview version and had to go through a series of additional security updates and IE 10 release upgrades to eventually arrive at a fully updated version of IE 10.  I didn’t make that same mistake with subsequent installs on everyone else’s systems.

• Internet Explorer 10 finally released for Windows 7 - Ars Technica
• Internet Explorer 10 now available for more than 700M Windows customers - Exploring IE Blog
• IE10 for Windows 7 Globally Available for Consumers and Businesses - IEBlog
• RELEASED - Download Internet Explorer 10 for Windows 7 - Scott Hanselman’s ComputerZen
• Bloody well time, Microsoft releases Internet Explorer 10 for Windows 7 - BetaNews
• Internet Explorer For Windows 7: New Features & Improvements - Addictive Tips
• IE10 on Windows 7: 5 Essential Facts - Software -Information Week
• Download Internet Explorer 10 for Windows 7 (32-bit) - Official Microsoft Download Center
• Download Internet Explorer 10 for Windows 7 64-bit Edition and Windows Server 2008 R2 64-bit Edition - Official Microsoft Download Center
• Download Internet Explorer 10 Language Packs for Windows 7 and Windows Server 2008 R2 - Official Microsoft Download Center
• Release Notes - Microsoft
• Download Internet Explorer 10 - Microsoft Windows - Worldwide installation packs

Meanwhile, these Firefox articles were pretty timely.

• Prepare Mozilla Firefox for Enterprise Deployment and Virtualization - Aaron Parker
• The Firefox Extension Guru's Blog links to this How to make Firefox the Fort Knox of browsers - over at Ghacks.

And Google has some great presentations to help you understand how their email and search services work.

• Follow an email’s journey with Story of Send - Google Official Blog
• The Story of Send - Google
• Google Releases Interactive Infographic: "How Search Works" - Search Engine Land
• How Search Works - Google

Stay informed & Browse safe.

Claus Valca

Read More

Threats, Updates, and iOS App struggles

Quick post to clear out last week’s inbound material.

Threats (and fixes/updates)

• Update Palooza - ISC Diary - (Adobe Acrobat Reader now at 11.0.02, Thunderbird 17.03 out, iOS 6.1.2, Java 7.15, Java 6.41, Firefox 19, Adobe Flash Player 11.6.602.168). If you are impacted, get busy patching!
• Oracle plugs security holes: Updates for Java 1.4 to 7 - The H Security: News and Features - more technical details on the update fixes.
• Adobe patches Acrobat and Reader, Mozilla debuts Firefox built-in PDF viewer - Help Net Security
• Timeline: Hacks Related to Apple - F-Secure Weblog : News from the Lab
• Dev site behind Apple, Facebook hacks didn’t know it was booby-trapped - Ars Technica
• NBC.com hacked, serving up Citadel malware - HitmanPro blog - Note: threat now appears to be fixed.
• NBC.com hacked, briefly compromised with RedKit malware - ZDNet - Note: threat now appears to be fixed.
• NBC Website HACKED – Be Careful Surfing - Sucuri Blog - Note: threat now appears to be fixed.
• IWhen web sites go bad: bible . org compromise - ISC Diary - Note: threat now appears to be fixed.
• Mandiant Exposes APT1 – One of China’s Cyber Espionage Units & Releases 3,000 Indicators - M-unition - Super Duper threat analysis report from Mandiant. Download the PDF report file directly and take your time reading. MD5/SHA-1 hashes for the valid file provide…because…
• Fake Mandiant APT Report Used as Malware Lure - ISC Diary
• Threat Actors Using Mandiant APT1 Report as a Spear Phishing Lure - M-unition
• Mandiant APT1 report used as a lure in phishing campaigns - Help Net Security
• Malicious Mandiant Report in Circulation - Symantec Connect Community
• Mandiant APT2 Report Lure - 9b+

Updates

DEFT 8 Roadmap and features - DEFT Linux - Computer Forensics live cd - Coming mid April 2013

Update XORSearch V1.8.0: Shifting - Didier Stevens

USB Image Tool 1.60 - Alex’s Coding Playground - There are more than one way to image a USB drive, but this tool by Alexander Beug is IMHO one of the very, very best for ease of use and reliability. I would be lost without it. Alex has worked hard on this update and it brings auto-admin elevate request at launch, now supports non-removable USB devices such as hard-drives or card-readers, and it has a “reset” feature to overwrite the bootsector of the selected device with zeros to allow Windows to reformat the device to the original size (something USB Image tool can’t do). See the changelog for more details.  As an alternative, also consider the free OSForensics tool ImageUSB.

iOS App trials, tribulations, and tips

An iOS Byline Issue - worked around

I’ve been gushing for some time about how I think Phantom Fish’s Byline app for iOS is super great. It is really fast pulling feeds and the interface is easy to navigate. It has really helped me stay in-touch with tech goings on during the day as I can now check all my RSS feeds on my personal iPhone. Before I was having to wait to the end of the day when I got home to check my personal feeds for news updates.

So last week I ran into my first problem with it.

I normally have it set to show 2,000 items; this allows me to go back and search for past feed articles after the fact. Additionally, I manage “Caching” with “Wi-Fi” only, images “on”.  That’s pretty much it. There aren’t a lot of settings but they are enough.

So the problem was that mid-week, after the updating of the feeds occurred, the caching followed, but kept getting stuck showing “1 of 200”.  It wouldn’t ever stop or move on.

It looks like a bad feed article was causing the caching to stop.

I sent an email to the Byline help team but still haven’t seen a response.  It was super frustrating and I found a few others on the net who also had encountered the problem.

So what to do?

Eventually I figured out a workaround to allow the feeds to continue to drop and cache again without getting “frozen” so-to-speak.

I went back into the settings and changed my All Items option to “Show 200 items”.

What this let me do is to get past the stuck item by not caching it.

I’m not sure which one it is, but right now it is somewhere between the 200 and 500th feed item. If I set at “200” I’m fine. If I set at 500 (the next highest increment) it locks when it hits the bad feed.

Considering that on any given week-day, my feed count pull results in about 350 new article feeds, I project that by the end of next week I will have way-more new feeds and the bad one will have been shoved off the bottom of the stack.

It isn’t a "pretty” fix but it works and restores a level of functionality with caching of feeds in Byline in the meantime.

Recommendations to the Phantom Fish coders for the next Byline update:

1. Code for an auto-skip of a feed if it doesn’t cache within a set/variable number of seconds; letting the user set the timeout period would be even better.
2. Allow greater granularity of number of items to show. The stock choices of 100, 200, 500, 1000, and 2000 items may make sense, but I’d like to set my own custom number of feeds…especially if the first recommendation cannot be implemented.

That’s pretty much my only requests for an otherwise stellar application.

A Gmail App Badge notification issue - cleared

My second issue this week was when I was surprised to have my iOS Gmail App badge still showing “1” unread item, despite no unread messages showing in any of my accounts.

Hmm.

This really frustrated me.

Eventually I found others who have experienced this same issue and the workaround solution to clear it. Apparently it is not an unknown issue and has been present for some time.

How to reset/clear ios badge - Google Groups

Bruno O. Barros (llustreBOB) provided the “solution” to clearing it midway down in the thread:

The only solution working here is the one where I move the rogue message back to inbox, mark it as unread and then mark it as read again.

Sure enough. Since I remembered the last message I managed, in my iOS Gmail app, I moved the message back to the inbox, marked it “unread”, marked it “read” and then archived it again.

The notification message “1” cleared off my Gmail badge.

Dave Churchill --just a bit up in that same thread -- shows how to replicate the issue/fix if you want to play with it (though I don’t know why you would if the solution works).

I can reproduce this by doing this:

1. Gmail app on iPhone has no badge.
2. Send email to self on laptop
3. Wait for Gmail on iPhone to receive email and show badge
4. Read and archive the email on the laptop
5. Open Gmail app to note there are no messages in inbox, refreshing still shows no messages, checking list of labels shows no unread messages.
6. Press Home button to exit Gmail, badge remains at 1.
7. Open Gmail again on iPhone.  Navigate to All Mail, open the message (which is correctly displayed as already read).  Badge still shows 1.
8. Mark message as unread exit, badge still shows 1.
9. Read message, exit, badge still shows 1.
10. Move message to inbox.  Badge now cleared.

Bump

Are you an iOS user feeling a bit jealous of those sexy Samsung phone-bump-transfer features?

I spotted this new (to me) app last week. I haven’t pulled the trigger on installing as I don’t really have a need for it just yet but it does seem like a cool and handy feature. So I’m keeping it on my “watch list”. Anyone have any experience or feedback with it yet?

• Bump for iPhone, iPod touch, and iPad - iTunes App Store
• Get Bumpin' With Bump For iPhone: Your Easy, Instant File Sharer [iPhone] - MakeUseOf blog.
• Bump - Home

Cheers!

--Claus Valca

Read More

Weekend Linkfest

The Mars lander has been a fantastic success this week and the brainz has been on NASA overload. Couple that with some Perseid watching out back with Alvis last night and things are super fun.

Here is a fresh linkage roundup this week.  I recommend a slice of Key-Lime pie with it.

New Microsoft videos and Miscellaneous presentations

• "Defrag Tools" - a new Channel 9 series (that will talk a lot about Sysinternals utilities) - Aaron Margosis' "Non-Admin" and App-Compat WebLog
• Defrag Tools - Microsoft Channel 9 - neat source for fresh reviews of MS tools and techniques.
• Defrag Tools: #1 - Building your USB thumbdrive
• Defrag Tools: #2 - Process Explorer
• Black Hat USA 2012 Presentation – Targeted Intrusion Remediation: Lessons from the Front Lines - Mandiant M-unition blog. I highly recommend viewing Jim Aldridge’s presentation slide-show (PDF) along side the excellent whitepaper (PDF) for the best experience.
• Black Hat USA 2012 - Briefings - Great collection of materials over a wide-range of topics.

Network Bits

• Troubleshoot Network Issues with Netalyzr - CyberNet News - review of helpful site for network troubleshooting.
• Where did the Capture Filter go in Wireshark 1.8 (by Tony Fortunato) - LoveMyTool blog
• SoftPerfect Network Scanner - Updated to version 5.4.5 this week.

Tool and Utility Roundup

• DOWNLOAD: SysInternals Suite (Updated August 3, 2012) - Kurt Shintaku's Blog - Notice that Microsoft Sysinternals has updated their “package” suite of tools. Sysinternals Suite
• KLS SOFT - WSCC - Windows System Control Center - Neat handy program that organizes and manages both the tools from Sysinternals as well as from NirSoft. Great way to access as well as update these tools in a collective manner.
• ToolTip: FindUninstallString - Anything about IT blog - Handy tool to do a reg search for references to uninstall strings. FindUninstallString
• Windows Disco - Hexacorn blog. New free tool to walk “…through all processes and their windows and takes a screenshot of each window, then saves it to a temporary PNG file in a current subfolder (named disco); you may review all these files either in an application itself, or in an Explorer, IrfanView or other image viewer.” Good illustration of technique for hunting spy/key-logger apps that utilize a “hidden” window with their process.
• Detect Usermode Hooks with NoVirusThanks Ring3 Hook Scanner - NoVirusThanks new tool to help with malware analysis
• MMC has detected an error in a snap-in and will unload it - Ask the Performance Team - Hotfixes for this post July 2012 update issue (if it happens) are linked in the post.
• How To Build Your Own Image System with ImageX - Windows7hacker  - Old hat to me now but this guide is nice guide to the process with lots of images to help clarify the process.
• Do copy acceleration utilities actually lower file transfer speeds? Our tests say yes -freewaregenius.com - Confusing post title, but bottom line is that copy-helper apps may not result in quite as peak transfer rates as you would think. caveat emptor
• SRWare.net - New Iron-Version: 21.0.1200.0 Stable for Windows

Windows Live Essentials Updates

I was surprised to see news that Windows Essentials 2012 got some updating this week. The primary focus seems to be in Movie Maker and Photo Gallery. I thought most of it was to re-brand and distance from the “Live” naming, but there were some pretty big enhancements.

When I applied the Windows Essentials updater, I noted that many other Essentials apps also got an updating, including my fav Windows Writer. Unfortunately, trying to find a useful change-log for the updates is next to impossible, so your guess (at this time) is as good as mine as to what actually the upgrade enhances.

• Introducing the New Windows Photo Gallery and Movie Maker - Windows Experience Blog
• List of all new features in Windows Photo Gallery and Movie Maker 2012 - LiveSide.net
• Microsoft's Essentials 2012 drops Live branding, Vista support and pumps up Windows 8 - Betanews
• New Windows Photo Gallery & Movie Maker Add Auto Collage, Panorama & Enhanced Narration - AddictiveTips blog

The Web-Life

• How to Remove or Hide a Last Name from a Windows Live Profile - Windows Live Unplugged
• Google Adds Personal Gmail Results Into Search - Liz Gannes - AllThingsD - Creepy.
• Google quietly launches 'Account chooser' for easier multiple account login - The Verge
• Advanced sign-in security for your Google account - Official Google Blog
• How it works - Accounts Help (Getting started with 2-step verification) - Google Help
• One Factor, Two Factor, Three Factor, More - SpiderLabs Anterior

Just saying….

Security and Patching Watch

• Microsoft to close critical holes in August Patch Tuesday - The H Security
• Microsoft Security Bulletin Advance Notification for August 2012 - Microsoft
• APSB12-16 - Prenotification Security Advisory for Adobe Reader and Acrobat - Adobe Security Bulletins
• Adobe warns of critical holes in Reader, Acrobat - ZDNet
• An even more secure Flash Player for our Windows users - Google Chrome blog
• The road to safer, more stable, and flashier Flash - Chromium blog

Forensics

• Windows Incident Response: RegRipper Updates - Windows Incident Response blog
• Dropbox Forensics - Champlain College Computer & Digital Forensics report by Jake Viens

Cheers.

--Claus V.

Read More

Father’s Day Linkage - Tie Down Edition

cc image credit image by Fernando de Sousa on flickr

Happy Father’s Day!

Here is a real varied collection of links. Enjoy!

Security Solids

• Java 7u5 and 6u33 released - ISC Diary - Make sure you get your Java updates on. Despite all attempts, my Java app still doesn’t want to notify me updates are available (at home) so I keep a constant eye out for update notices and install them myself.
  
• Oracle Java Runtime Environment 7 Downloads - Oracle - Here’s one place to get them direct from source.
  
• Inside Flash Player Protected Mode for Firefox -Adobe Secure Software Engineering Team (ASSET) Blog - Adobe Flash Player also got updated, particularly impactful for Firefox users (see next tie-in grouping below). YMMV. You can get the very latest version for different platforms here at this Adobe - Web Players link. Or hop over to Major Geeks.
  
• (IN)SECURE Magazine - Issue #34 is now out in PDF format.
  
• How LogMeIn is enabling scammers to profit - Troy Hunt’s blog - Troy continues his ongoing battle against fake tech-help scams. This time he examines how “LogMeIn” could do more to help prevent their great service from being leveraged for The 3vil, if they chose to.
  
• Free cruise phone scam masquerades as political survey - ESET ThreatBlog - I’ve started to periodically get a few calls now on our cellulars from unknown numbers…they follow a pattern of tracing back to a cruise-operation. If it isn’t a number already in my contacts, I just don’t answer and if critical, the caller will leave a voicemail and I will call back immediately. If not…too-bad-do-dad!  So it was with interest I read this ESET post by Aryeh Goretsky and how an end-run may be going on around cellular do-not-call list participation.
  
• Close Call with a Caribbean Cruise Line Scam - IT Secure Site - More on the above.
  
• 'State-sponsored attackers' using IE zero-day to hijack GMail accounts - ZDNet’s Zero Day blog. I’ve seen the notice of “state sponsored attackers” recently and was wondering “what’s up with that?”. Now I know. more details at this Google Blog post: Security warnings for suspected state-sponsored attacks. Chron.com TechBlog’s Dwight Silverman has some advice and links to a Microsoft “hotfix” for the issue: Bad guys using unpatched Internet Explorer flaw to hack Gmail accounts.

Firefox Paisleys

In my last GSD post, I touched a bit on some issues I was having with Firefox 13 and Flash.  My issues may or may not have been related to these, however there are some serious headaches for Firefox 13 and Flash users.

• Firefox 13 tripped up by Flash patch - Update - The H Security: News and Features
  
• Inside Flash Player Protected Mode for Firefox - Adobe Secure Software Engineering Team (ASSET) Blog
  
• Flash 11.3 doesn't load video in Firefox - Firefox Help
  
• Flash 11.3 Video Issues In Firefox - Firefox Extension Guru's Blog
  
• Firefox 13.0 Release Notes - Mozilla Desktop
  
• Firefox 13.0.1 Released -Firefox Extension Guru's Blog. The Guru helpfully points out the following:
  
  ”Note: In regards to the Flash Bug (747683) this does NOT address issues related to Flash videos not playing in Firefox (which may also be affecting Firefox 12.0.x users as well) for Windows Vista and 7 users. “
  
• Wallpaper your Firefox new tab page - Mozilla Links. However all is not lost, you Firefox freakers can tweak your “new tab page” to display a wallpaper background image if desired.

Sysadmin Stripes

• Malware Hunting with the Sysinternals Tools -  TechEd North America 2012 \ Channel 9 - A new presentation video from Mark Russinovich on using Sysinternals Tools to do some malware thumpin! Watch streaming or pick from one of two formats for direct downloading and viewing later. This presentation includes real-case reviews as well as a live analysis of a Stuxnet infection. Sweet!
  
• Windows Exploratory Surgery with Process Hacker - SANS Windows Security Blog - Jason Fossen shares PDF version of his presentation primarily using the freeware tool "Process Hacker”.  It is a really great review of the different angles one can take with a limited tool-set.
  
  That got me thinking a bit. Process Hacker has matured quite a lot since I last downloaded a copy and the new one certainly has more polish on it. I went through my utility pile and offer below some other great freeware utility process-monitoring tools you may be interested in visiting again.
  • Process Explorer - Sysinternals - One ring to rule them all. Still the very first utility I place on my Windows systems and swap out the default Task-Manager with. It continues to be upgraded so if you haven’t got the latest version for a while, you are missing out!
  • System Explorer - This one also has grown up quite a bit from my last download a few years ago. I like the tabbed interface. The “Performance View” tab is very neat. Process Explorer’s graphs are still a bit more detailed looking but it doesn’t provide an all-in-one dashboard view like System Explorer offers.
    
    
    
  • Daphne - Not as GUI pretty as the others, but what it lacks in pretty it more than makes up in back-to-basics tightness.
  • Process Viewer for Windows - This project hasn’t been updated in a while but again, the “latest” update was still fresher than the one I’ve been carrying around for quite a while. This one is a bit more feature basic. If you aren’t ready for the power of some of these other process utility tools, but need more detail than the default Windows Task Manager (at least in XP) then this may be a friendly choice.
  • ProcessActivityView and  ProcessThreadsView - These two application from NirSoft compliment each other nicely.
  • NoVirusThanks EXE Radar Pro - Provides process monitoring and alerting as well as to kill processes on demand.
  • ESET SysInspector - This is a complex, single-file-executable. It provides detailed information on running processes as well heuristics reporting on items found. I find it particularly helpful in assessing a system. It may not tell me exactly what is going on, but it often will help be refine my focus a bit.
    
• WHITEPAPER: Windows PowerShell 3.0 and Server Manager Quick Reference Guides - Kurt Shintaku's Blog

I learned this week about a “honeypot” project that attempts to capture USB-seeking virus/malware by creating a virtual USB-drive honeypot. This is a cool project and I hope it continues to see success in development.

• Catching worms with ghost flash drives - The H Security: News and Features
• HPSoC Project 1 - Ghost USB Honeypot -The Honeynet Project
• ghost-usb-honeypot - A honeypot for USB malware - Google Project Hosting
• Ghost USB honeypot released - Help Net Security blog

More interesting tips for admins…

• Microsoft .NET Framework Repair Tool Download - Microsoft Downloads
  
• Windows 8 – Script for customizing WinPE 4.0 – Part 2 – Customizing the Wallpaper - Anything about IT
  
• Local admin accounts vs. the default Administrator account - Windows Networking
  
• Where is That Group Policy Setting? - Windows Networking
  
• Active Directory Replication Status Tool - Bink.nu
  
• Download: ADREPLSTATUS - Microsoft Download Center
  
• Video: User Rights - Server vs Domain Controller - Windows Networking
  
• INFO: Why the heck is my Outlook .OST so big? - Kurt Shintaku's Blog

Network Knitted

• ARP Scans - A Ping Alternative - LoveMyTool blog video presentation by Tony Fortunato.What’s really going on the wire with Colasoft MAC Scanner Free.
  
• Script to resolve hostnames to IP address - Computer Security Forum. Recently I was presented with a massive list of Hostnames for PC’s on our network. The assignment was quite simple, provide the associated IP addresses.  No problem, I could manually ping each one by hostname, copy the result (if alive) and paste into my spreadsheet. Well, no. I wanted to go home to my family that night. Instead I found and ran this nice simple script against a cleaned up text-file of the Hostnames. My success ratio for IP grabs was over 90%. The other 10% required some manual followup (systems turned off, shelved, etc.) but it made quick work. I wasn’t able to find a good free GUI-based alternative, but this did the job wonderfully.
  
• Extracting DNS queries - NETRESEC Blog - Either by Tshark or NetworkMiner.

Utility Dotted

• NTFSLinksView - View NTFS symbolic links and junction points - NirSoft utility update
  
• Backup Windows User Profile Folders & Web Browser Profiles - Auslogics BitReplica - AddictiveTips review and walkthough for a new profile backup utility.
  
• Backup for Windows 8 & Co: BitReplica - (Google Translated from German) - Caschys Blog
  
• BitReplica - A free tool for backing up files stored on your Windows PC
  
• Batch-Rename Files In Windows Using 8 Different Presets - AddictiveTips reviews the PDFN
  Batch File Rename Utility.
  
• Spreadsheet Compare - The Fool on the Hill - Neat little Microsoft Excel Add-in to compare and highlight two spreadsheets. As seen in this review How to Compare Previous Version of Excel Spreadsheet– A Diff for Spreadsheet over at Windows7hacker.
  
• VMware closes holes in its virtualisation products - The H Security: News and Features
  
• New VMware Workstation 8.0.4 and Player 4.0.4 - (Google Translated from German) - Born and Windows IT Blog. What I found interesting is Gunter’s catch of the EULA details that allow VMware to collect and use info about your use of software including IP address, hardware ID, OS information and other “non-personally identifiable” usage stats.  Also that by accepting the EULA and using the software you agree to a two-year post termination of software use agreement for folks to audit your books, records and computing devices to determine your compliance with the EULA and payment of license and support service fees.  I’m sure this is pretty standard stuff and proper use of the free software they make available shouldn’t concern the average user, but it is another reminder of what lives in the EULA’s. Just be aware.
  
• VMware Player: Run Windows 7, Chrome OS - Free Download for a Virtual PC - VMware
  
• Download VMware Player 4.0.4 - FileHippo.com - alternative download link

Foresensically Checked

• New Plugin – “TypedURLsTime RegRipper Plugin” - RegRipper
  
• Digital Forensics Stream: TypedURLsTime RegRipper Plugin - Digital Forensics Stream blog
  
• RegRipper Supplemental Plugins Updated (regripperplugins_20120528.zip) - RegRipper
  
• DEFT Pen ready for download DEFT Linux - 2GB and 4GB versions of DEFT “LiveCD” 7.x to load onto a USB pen-drive rather than the optical media version.
  
• WinPentest v1.3.0 - woanware - Major updates.
  
• Compromise Root Cause Analysis Model - Corey Harrell wonderfully thought-provoking post on DFIR concepts over at his Journey into Incident Response blog. There will be a pop-test after the review…
  
• Am I pwn3d? Windows *Non-Native* Tool Triage is a follow-up post to the Am I pwn3d? Windows *Native* Tool Triage on using “simple” tools to perform system triage. Posted on Foundstone’s Open Security Research blog.
  
• Red Rock Solutions - RRTX Blog: ShadowKit - Red Rock Solutions RRTX blog - Neat and easy-to-use tool for recovery of Windows Volume Shadow Copy files. I’ve got several tools like this, and having a few makes it easier for me to find the one that helps me best in a particular event.
  
• Windows 8 Forensic - File History - Random Thoughts of Forensics blog brief post with some backing linkage.
  
• Timeline Analysis and Timeline Analysis, and Program Execution - Two excellent posts over at Windows Incident Response blog.
  
• Prefetch Hash Calculator + a hash lookup table xp/vista/w7/w2k3/w2k8 - Hexacorn blog utility/technique.

Cheers!

--Claus V.

Read More

Rain-Delay Linkfest

After an exceptional season of drought here in Texas, it looks like things are starting to change. We are facing at least five days of rain; heavy downpours mixed with long periods of light grey drizzles.

Planned yard-work long since abandoned.

Perfect weather for emptying the “to-be-blogged” hopper.

System Security

Time for new Flash updates. These are for the mainstream 11.1.x line of Flash builds. If you are running the 11.2.x line of beta Flash, I figure you are keeping up with those already.

Flash vulnerability exploited to deliver malware - Help Net Security has some good details about a threat that was patched as well as how it was flagged and described by security researcher Mila Parkour. While this Adobe rushes out critical Flash update post over at Ars Technica has some more details about “…the vulnerability, discovered by Tavis Ormandy and Fermin Serna of Google's security team, affects Flash players on Windows, Mac OS X, Linux, and Solaris operating systems, as well as Google Chrome and Android.”

I use these links from File Hippo for my Flash updating needs. Whatever source you prefer to use go get’em.

• Download Flash Player 11.1.102.63 (IE) - FileHippo.com
• Download Flash Player 11.1.102.63 (Non-IE) - FileHippo.com

PSI 3.0 Beta Launch -Secunia is rebuilding their Personal Software Inspector tool to now not only find and notify you about missing security updates and patches needed for applications and plug-ins on your system, but also make it easier to apply those found patches and updates in-application rather than hunting them out yourself. It is still a work in progress but should provide a good tool to help in the process.

Microsoft Security Bulletin Advance Notification for March 2012 - Microsoft Security TechCenter. MS Windows updates coming soon to a system near you!

Getting Inside the evil

I’ve really been enjoying Troy Hunt’s writings, both current and browsing through the archive material. These two posts were exceptionally eye-opening. Troy does an excellent job showing the process by which these scams work. Get out the notepad.

• Scamming the scammers – catching the virus call centre scammers red-handed - Troy Hunt
• Anatomy of a virus call centre scam - Troy Hunt

Introducing Adobe SWF Investigator - Adobe Developer Connection. New beta tool making the rounds on various security sites. Based on the Adobe AIR platform, it will help with SWF analysis from both static and dynamic angles.

Examining VSCs with GUI Tools - Journey Into Incident Response blog. Corey Harrell does a great job in showing methods to work with Volume Shadow Copies containers.

Browser Things

Password Generation - The Chromium Projects. We’ve touched on passwords here at GSD quite recently. This new component of Chrome development is pretty interesting. Having the built-in-browser ability to quickly and easily generate complex passwords is pretty cool. I hope some form of this feature matures into the mainstream builds.

Speaking of Chrome, for the longest time I have been using a portable build of Chromium (DEV builds)coupled with an updater application from Caschys Blog. Once a week or so I hit the updater and it finds and downloads/installs the newest version available from the source repositories. Unfortunately I wasn’t paying attention to what (or what not) was actually happening. When I recently saw the latest DEV build level in a RSS feed, I finally went back and checked what my Chrome DEV build was and it was WAY behind. Seriously WAY WAY behind. Bother. So now I am using this Google Chrome Portable page and scrolling down the the portable DEV build link. Updating is just a matter of downloading the file, and pointing it to the exiting location and overwriting it. If you are porting over your profile and extensions over from a previous portable version, the location they go into turned out to be quite different from the earlier portable DEV build I had been using.

It is now located in this folder location: “ …\GoogleChromePortableDev\Data\profile\Default”

Once I had my Chrome profile ported out of the old DEV version and into the new one, the difference in the builds was significant.

Mozilla’s Collusion tells who’s tracking you - Mozilla Links. Worth a look.

2-step verification - Google Apps Help. Google has a optional 2-step verification option to enhance the security of your account login process. FYI.

Freeware of Note

usboblivion - Google Project Hosting. Anti-forensics-like tool to purge USB history of USB-connected drives from Windows registry. Question: does use of the tool leave any tracks of its own behind? Spotted via this Addictive Tips blog post: Delete Record Of Previously Connected USB Devices Using USBOblivion

Rufus - Create bootable USB drives - Really neat and slick bootable USB creator tool. More details on these reboot.pro pages: Rufus and Rufus (introduction topic).

NTFS Permissions Reporter - Cjwdev - offered in both free and $ versions. Windows already has built-in methods to look at NTFS permissions but this is a nice GUI tool that some might find more useful at providing a wider-view on the permissions. Spotted via this Addictive Tips blog post: NTFS Permissions Reporter: View Access Permissions Applied On Folders.

regshot - Via SourceForge. Another tool to do before and after registry diff’ing. More details at this CybernetNews post: Monitor Registry Changes in Windows.

File Extension Monitor - NoVirusThanks - free/portable tool that allows real-time monitoring and logging of files created in the system. Great to run during setup files or to trace droppers/activity. Spotted via this Addictive Tips blog post: Monitor File Creation Activity Across Disk Volumes With File Extension Monitor.

HijackThis was my #1 go-to malware busting tool in the very early days of my IT career. I would use it slice-n-dice auto-run entries and bring back law-and-order to a malware-hijacked system. Over the years as my knowledge and skillset grew and tools matured, I’ve come to rely much more now on the Sysinternals Utilities. A one-two punch with Autoruns and Process Explorer coupled with the all-seeing-eye of Process Monitor typically provides me the hammer needed to bust into a hijacked system. So it was with fondness that I read this HijackThis now open source post at The H Security. I really hope that this move now gives new life and capability to this classic tool.

Peeking at NAFT - Didier Stevens is going crazy teasing us with a new project; a new forensic toolkit he is developing the “Network Appliance Forensic Toolkit (NAFT)”. Ooohhh!

Ezvid - Free Movie Maker and Slideshow Creator For YouTube. Spotted via this Addictive Tips blog post: Create Image & Video Slideshows With Narration Using ezvid.

Microsoft Research Cliplets - Neat project from MS Research that takes a digital video short, and allows you to isolate just a section of the motion. When exported the result is a static image with a section of movement. It’s a cool effect.

Multi-Image Fusion - This Microsoft Research project appears to be aiming as the next generation of Microsoft Image Composite Editor, or ICE. They have a 305-image composite on the page as a teaser. I love ICE but sometimes when I have a complex series of images and try to drag/drop them into ICE, it cannot stich non-sequential images into a composite. Related: Hugin - Panorama photo stitcher

For Sysadmins

BETA: PowerShell v3 Technical Guide (CTP2) - Kurt Shintaku's Blog

Service overview and network port requirements for the Windows Server system - Microsoft Support Article ID 832017.

[Review] God's Jury: The Inquisition, IT & Privacy - ReadWriteWeb. Curt Hopkins has a book review. What is really fascinating to me is how new technology can make the evils of dark history past relevant and accessible again with the dizzying pace (again) of information aggregation. Amazon has a Kindle version that will soon be making an appearance here in the Valca home.

Network Stuff

Nmap 5.61TEST5 released with 43 new scripts,improved OS & version detection, and more available for download - ISC Diary

Wireshark and Pcap-ng - Wireshark blog - news that Wireshark 1.8.0 will have two new features: concurrent capture from multiple interfaces and packet annotation. These changes appear to rely on pcap-ng file formats. Hopefully applications that rely on the pcap format will adjust and add compatibility for the pcap-ng format but if not, be sure you save your captures in a format that can be imported (or exported into) a file format compatible with your NFA tools.

Detecting sniffers with HSD - Hexacorn blog. Free tools and techniques for detecting the presence of network sniffing activity.

Tony Fortunato over at the LoveMyTool community blog has a video showing Using Pathtest for Performance Measurement. PathTest is a free tool to test network bandwidth capacity between two endpoints using packet-flooding techniques. This is a serious tool so use carefully and during non-production hours unless you (and your customers) really, really know what you are doing and why you need to do so. Cool tool!

Cheers!

--Claus V.

Read More

Windows Utility Toy-Chest Roundup

Way back when I was a little tot, we got hauled every six months to the family dentist.

After a cleaning/filing as needed, we got the joy of picking something out of cardboard “toy-chest”.  It had the usual toothbrushes and dye pills to see what a sorry brushing job you did (great for Halloween and vampire play) along with some cheesy plastic toys, pencils, and if you were really lucky, you might be able to find a tiny (but functional) sytro-plane to punch-out and play with.

So this will be a real grab-bag of sorts, but I’m sure there is something here for everyone!

Video (mostly Flash)

I continue in my search to find a good/quality way to convert the standard-capture direct-to-DVD video output we are collecting at the sound/video desk at church into a more web/user friendly format.

For each service we capture video/audio feed and pipe it through a mid-level video mixing board into a DVD recorder which writes it to the disk; finalizing after the service.  I suppose we will eventually pipe the output instead into our PC system digitally and then edit/press it to DVD for church members when requested…but for now, I’m working with reprocessing already pressed DVD disks.

So what I have to do is to rip the DVD back into a digital video format, edit it in some cases, then resave in a more web/PC friendly file format.  I had been trying to convert into Windows Movie Maker friendly format but the quality is still not yet what I want.

So I decided to see if converting to a Flash format would work better, and in many ways I am much more pleased with the results, though it does bring new ones.

(Tips and suggestions welcome here from the GSD fans in the know of such things….)

Generally what I do currently is to import/convert the DVD Video_TS file into a FLV file.  Then I use an FLV editing app to trim it up a bit (or extract the message section if just that needed). Then I re-save and share the resulting FLV file.

While it is a bit different from my Windows Movie Maker work, I have found at least two decent freeware tools that allow simple editing of Flash video files:

• RichFLV – Apollo FLV Editing Tool and RichFLV – Apollo app updated - This is cool in that it is an Adobe Air based solution.  The results are quite good and it is fairly intuitive to work with.
• Moyea FLV Editor Lite - Also free and has quite a lot of features to do basic/medium-level FLV file editing.  The interface is easy to work with.
• Adobe - Flash Quick Starts: Using Adobe Media Encoder CS4 - NOT free and not really a FLV file editor, however leave it to Adobe to deliver a pretty powerful solution to import and encode video media into FLV format.
• Format Factory - I have traditionally used this program for my DVD to video file format converting. It is updated regularly but I am still trying to dial in the best conversion settings for best quality.
• Koyote Soft - Offering both a free FLV converter as well as a more robust Video converter application, I’m trying to see if these provide any better quality.
• Freemake Video Converter - Another free DVD ripper/file-converter I’m fiddling with.  Review here from Freewaregenius.
• Pazera Video Converters Suite 1.2 - This is amazing.  I have used other Pazera video converting software before (MP4-AVI) but this suite gives you everything for free.  They don’t use a lot of eye-candy but the no-nonsense approach gets the job done in a well organized manner..  Definitely worth keeping in your kit.
• Hamster - Another oft-mentioned freeware video format converter. Added to my download pile to review and testdrive soon.
• XMedia Recode (Google Page Translate) - Freeware German (English language support included) that is recently updated.  Features include auto-cropping, color correcting, drag-n-drop encoding, zooming (none, letterbox, media, pan/scan, fit-to-screen), volume correction/normalization, and many more). In both an installable and “portable” edition. Cool.
• WinFF - Free Video Converter - The real plus on this one is that it supports both Windows and various *Nix versions. It’s actually a GUI wrapper for the CLI video converter FFMPEG
• HandBrake - One of the major players in video conversion. New builds include x64 support. Drawback is that newer version also outputs to MP4 format so other desired video file outputs are not available, or have to be re-converted.  Earlier versions can still be found with wider output support, but without the enhancements from the newest versions.  But hey, it seems to be primarily geared to the Apple playback device support.
• Free FLV Player for Mac and PC - I love keeping this gem on my USB stick for fast FLV file playbacks.

For the Sysadmins

• Bossie Awards 2010: The best open source software of the year -- Open Source - InfoWorld.  Yep the 2010 BOSSIE’s are out.  I wasn’t as impressed with the offerings this year. Not to disparage any of the winners…they are great…but there weren’t that many smaller apps/utilities this year. Most are much larger platforms.
• FOG Project (screen shots page) - This was the only 2010 BOSSIE winner that caught my attention.  It offers a neat way to PXE push/pull images to systems.  I’m going to see if this has any possible applications in a mass-deployment scenario in our environment…say for getting a special post-disaster custom image onto a lot of boxes fast.
• DOWNLOAD: Windows Server Architecture Posters - Windows Live - Kurt Shintaku has a lot of links to cool MS reference posters (PDF) including one for Remote Desktop Services Component Architecture.
• More partner momentum around Microsoft RemoteFX in Windows Server 2008 R2 SP1 Beta -- via Network Steve blog - More news and linkage on Microsoft’s RemoteFX technology.
• Improving Your Image: Sector-Based, File-Based, and Sysprep - What Makes the Most Sense? Part 3: Deploy-time Build Automation and Recommendations - Windows SpringBoard Series Blog - Part 3 in discussion on imaging issues.
• The Compound Case of the Outlook Hangs - Mark’s Blog - Always awesome.  New post on how multiple techniques used to diagnose Outlook Server issues.  I learned lots of new things!
• Fix Windows 7 MBR « the back room tech - Julie has a series of great tips for getting a Win7 system back up and running.
• Windows XP or Windows 7 Won’t Boot into Safe Mode « the back room tech - Even more great tips to bookmark for future system recovery work!
• August 2010 | TechNet Magazine - Now out.
• Customising the MDT Task Sequence Editor - The Deployment Guys - MDT tips and suggestions.
• Remote Control From Anywhere – Beta 1 Release - IntelliAdmin has a beta trial now available to do internal remote control management.  Requires setup of an reflection server along with clients. If you like it get the pre-order license (unlimited systems) only $599.  Final version pricing will be a $59/per PC seat license.  Worth considering…and it looks like a neat product.
• Windows Logon Notifier (WLN) v1.0 Updated - I am JustNC - Good start at a customized Windows Logon notice builder.  I could do without a bit of the graphics but it’s a start.
• Create a logon message for users in Windows 7 - The Windows Club - Of course, if you run AD, you can make some edits to do so on Vista/Win7 via policy.  I think that XP also has a similar feature.
• Beta testing Microsoft RemoteFX in Service Pack 1 - Network Steve blog - Coming soon to a Windows 7 SP1 release…
• Windows 7 DX11 Receives a Boost in Performance - Network Steve blog - Win7 now can download a DX111 update to enhance performance.  Should be rolled into the SP1 update as I understand it.

Laptop Lust

I’ve been on the prowl for a new higher-end laptop for home to replace my bedraggled Gateway MT6451 Notebook.

I’ve actually bit the bullet and after much work, saving, and research picked out what I hope to be a portable-powerhouse.  I’m saving the big announcement for when it has arrived but until then, here are some systems I considered along with laptop review sources I found beneficial.

…and I’m finding it really hard to wait on FedEx!  Delivery may be mid-week.

• The MSI GX640 & the beauty of Device Stage -- Windows Experience Blog - This MSi systems laptop is quite sporty from both design and delivery.
• The ASUS U Bamboo: Naturally Beautiful -- Windows Experience Blog - Downright gorgeous from a design perspective. And Amazon has what appears to be a deal on them at $999.  I also checked out the other ASUS offerings as well since many are now including the newest USB 3.0 spec on ports.
• The Origin EON 18: Crush your enemies and see them driven before you -- Windows Experience Blog - Again, another example where design form seems to meet power-function. ORIGIN EON Custom Gaming Laptops 15 and 18.
• Toshiba Satellite® Laptop Computers - The local BestBuy had a few very nicely rolled up Toshiba Satellite systems. The design was good and the hardware included was pretty nice.  The discount price at the time was sub $1000 including an i7 core.
• The Dell Studio XPS 16 is music to my ears -- Windows Experience Blog - I really liked both the design as well as the performance for this system.  Though I ultimately didn’t spring for a SSD drive, I can see where if the capacity goes up (say 320-500 GB) but price drops to consumer-level purchasing, that I will want to put one in my soon-to-be-here system.
• Dell Studio 17 (Core i7) Review - A Review of the Dell Studio 17 (Core i7) -  Laptop Mag -- seriously.  An i7 Core in a $1000 range 17” laptop? That seems ridiculous!
• Notebookcheck: Review Dell Studio 1557 Notebook - Hold on.  Scratch that previous comment.  An i7 Intel core processor in a 15” laptop?  OK.  That doesn’t sound like a laptop. That’s a highly modded Corellian Engineering Corporation YT-1300 stock light freighter! (see also this link)

In my research and work I was particularly impressed by the following laptop review sites.  They were exceedingly thorough and helped me to make my final decision.

• Notebookcheck: Notebook & Laptop Reviews and News
• LAPTOP Magazine - Product reviews, tech news, buying guides, and more

Misc Utilities of Note this week

• AeroTweak is an option-filled tweaking app for Windows 7 - DownloadSquad offering for a Win7 tweaking tool.
• Create Synchronicity: “tiny” file backup and sync program.  See reviews at CyberNet News and Lifehacker for more details. Available in install and “portable” versions.
• ImageGrab - screenshotter for avi,mpeg, wmv, live video streams + others.  Pretty cool.  Spotted via Lifehacker post.
• 45 Free Applications For Designers And Developers - Noupe Design Blog. What a round-up for graphics and media folks.

Sound(s) Great!

Nature Sounds - Fun and clever (and easy to use) nature-sound generator.  Build your mix then export to file.  My favorite mix was “Creek” + “Darth Vader” + “Children Giggles” + “Cat Purr”. I could just imagine Vader sitting in a public park alongside a creek, chillin out watching kids play on the playground, chatting up with the moms, and petting his cat fluffy.  Spotted via Download Squad.

That post then introduced me to SimplyNoise - “The Best Free White Noise Generator on the Internet”.  Besides the quick white, pink, and brown noise generations, they also have some free “advanced” download file Soundscape - Thunderstorm (60m) for relaxation as well as others for a donate+download availability.

Browser News

• Firefox 4 Beta 4 Released - Firefox Extension Guru’s Blog.
• Firefox’s Awesome Tab Candy Renamed Panorama, to Be Included with Sync in Firefox 4 - Lifehacker.  Yep. I found it once manually enabling in my x64 Nightly release version of Firefox 4.  Remember, magic words for now? Ctrl + Alt + Space.
• Newsfox and mozdev.org - newsfox NEWEST: installation. Version 1.0.6.2 now out.  I download the .xpi file then drag/drop on my Add-ons window to install. Release notes
• Did Microsoft Russia leak the new Internet Explorer 9 user interface? (Download Squad) and Did Microsoft Russia leak the new Internet Explorer 9 user interface? (ars technica).  Truth or Fiction?
• Chromium Adds Web Store Placeholder, Labs, And An Awesome Expose-Like Feature - Network Steve blog - I’m using Chromium nightly builds so I decided to enable this “Apps” area feature just to play.  Took a bit of work:
• Install Google Web Apps in Google Chrome (Google System blog) - Had to do these steps to get it armed and loaded with the Chromium-included Google Mail, Calendar, and Docs apps.
• See also Weekend Project: Install Web Apps in Chrome or Chromium - ReadWriteWeb - More info.
• Developer’s Guide - Installable Web Apps - Google Code - Then did this to add in Google Maps app.
• You can also type “about:labs” to see some new stuff you could enable if desired. See this Google Chrome to get Gmail Labs-like experimental features post at Download Squad.
• Weekend Project: Install the New "Google Chrome Labs" - ReadWriteWeb - More info.
• Google adds more official themes for Chrome -- to the Extensions Gallery? -- Download Squad.  I know, right?
• Hardware Acceleration is Coming to Chrome - Try it Now - ReadWriteWeb - Read the post, then get a Chromium build and launch the application with the --enable-accelerated-compositing flag.  Performance results may vary.

Cheers!

--Claus V.

Read More

Browser Wars

I’ve got to admit I’ve been keeping my head down lately regarding the latest round of Windows web-browser releases.

While the EU has been hard at work making sure its proud members and residents have 12 Lucky Browsers to select from on their fresh Windows installs, I go the simple route and install Safari, Opera, Firefox, and Chromium to allow me some flexibility with things. Yesh, IE is still on my system as well.

So here is a roundup of browser-related bits I’ve collected for the interested recently.

Opera

• Opera browser – now sitting at version 10.10

• Opera Browser End-Users Request: Opera Installer Without Unite Feature – Donna’s SecurityFlash. I’m not convinced the security related issues of Unite are fully addressed, particularly when folks are able to download and install it themselves in a workplace environment without the blessing of the sysadmins.  Donna’s post contains this link to disable Unite via a rather clever though ugly manner.  Good information.

• From all of us to all of you– Opera Desktop Team – Link to download the 10.5 pre-alpha build along with their new JavaScript engine built from the ground up, faster startup/shutdown times, and some new tricks with “private mode tabs” and/or “private mode windows”.  Fair warning, the team reports memory usage is high, unexpected quits occur, and (gasp) Opera Unite is disabled.

• Opera Mini 5 beta 2 – I love Opera Mini on my Blackberry device.  Try out the new beta release.  I’ve been feelin the lovin!

Firefox

• Firefox 3.6b5 – Download the latest baked beta version for all you “cutting edge” browser fans.

• Firefox 3.6 beta 5 is out: Time to give it a try – TechBlog.  Firefox 3.6 Beta 5 Released – Firefox Extension Guru’s blog. Latest Firefox 3.6 beta fixes 133 bugs, promises faster page load times – Betanews.

• Mozilla Firefox, Portable Edition 3.6 Beta 5 --PortableApps.com. Try this version out if you want to run it on your system but don’t want to install over your current-release version of Firefox.

• Firefox 3.5.6 – Or download the current “stable” release version. Firefox 3.5.6 Released – FF Extension Guru’s blog and Releases/Firefox 3.5.6 – MozillaWiki have some info about this build.

• CheckPlaces :: Add-ons for Firefox – I really like this Add-on and use it weekly.  It checks for duplicated or invalid bookmarks in the new Favorites structure of the Firefox 3.x family of browsers.  It is fast, has more than a few options, and ensures that your bookmarks are current (and can get the favicons as well).  Very useful when you are manually syncing bookmark files between systems.  See this post How to Find duplicate and dead bookmarks in Firefox over at TechnoSpot for great how-to-use and screenshots.  In the past I used and recommended AM-DeadLink but though it rocked, it hasn’t been updated in quite a while and isn’t compatible with the newer SQL-based Firefox bookmark databases.  AM-DeadLink 4.0 Beta-1 is available in the site’s Beta section, but still no FF 3.x support. Read the post to see why.

• Voyage - “A Firefox Addon to Rediscover Your Web Browsing History” is a clever add-on to visualize your browsing activity and history.  I’m curious what benefit this could do for visualizing Firefox-based history usage in a forensics type response.  Maybe it could make presenting the user’s activity more “understandable” to the suits when presented in this format rather than a dry Excel timeline.  This visual timeline presentation might be worth exploring more…

• How to fix Firefox 3 freezing or heavy disk use – Confluence – I’m not sure if this is a real “fix” or not. Some say it helps wonderfully others…not so much.  I think the thought is that the way Firefox interacts with the malicious site database it keeps and checks URL’s against can cause “lockups” when FF reads it.  Of course, if you are a more savvy web-citizen, you might try disabling the malicious website checking features entirely in Firefox. See this Firefox 3 makes my hard drive thrash • mozillaZine Forums post for more on tips related to that.

• Memory Fox Helps Tame Memory Usage in Firefox – MakeUseOf blog.  I’ve got enough system RAM to not be so concerned about how much memory Firefox uses (still a lot).  I’m more aware of the maxed-out CPU rates I get.  Seems worse when NewsFox is checking RSS feeds.  This trick might help with RAM, but not so much with CPU control.

Chromium

• Chromium Blog: Extensions beta launched, with over 300 extensions! – Yep. The tidal wave cometh.  Extensions have arrived for Chromium.  Right now I am running just three: AdBlock, FlashBlock, and YouTube HTML5-ifier.

• Sadly missing (for now) is a true Bookmarks Manager/sidebar extension for Chromium.  If that one feature came to Chromium, I’m sure it would become my daily pleasure-surfing browser, while Firefox would be the one I use for hard-core blogging and work/web analysis work.  Sigh.  We all remain waiting….

• 18 Extensions Worth Downloading from Google Chrome’s Gallery – Lifehacker and Interesting Chrome Extensions – Google Blogoscoped help sort out the wheat from the chaff in the extension pile.

• Chrome extensions – Sorry, I forgot to link to the Chromium extensions page itself.

• hackademix.net » Why Chrome has No NoScript - “Eight months later, Chrome extensions are here but NoScript is not among them yet, and people are asking why. The reason is very simple: Chrome is still lacking the required infrastructure for selective script disablement and object blocking.”

Browser-Related

• YouTube "Feather" Beta – New “opt-in” beta to possibly improve YouTube video playback.  I’m pretty sure it is cookie based.  “The "Feather" project is intended to serve YouTube video watch pages with the lowest latency possible. It achieves this by severely limiting the features available to the viewer and making use of advanced web techniques for reducing the total amount of bytes downloaded by the browser. It is a work in progress and may not work for all videos.” Your mileage may vary…  Me?  YouTube works great on my laptops but for some reason I’m still not finding the sweet-spot with my AGP video card settings and Win7 RC build on the desktop.  Most of the videos are still showing up pixilated-pink.  However if I save the FLV file and do playback once downloaded, they are just fine.

• How to Fix Annoying YouTube Jumpiness in Firefox - Lifehacker.  Now this trick DID work for my laptops in Firefox where the YouTube freeze was painfully annoying.

  Many users, myself included, visit YouTube on an almost daily basis. Ever since Firefox version 2.0 implemented the session restore function, when you are watching a video on YouTube (perhaps on other video sites as well, I haven't really tested that), you may notice a tiny freeze-up of the video every 10 seconds or so. This happens because the session restore is by default set to save all open tabs every 10 seconds. This is especially noticeable if you happen to have a lot of tabs open at once.

  The quick fix for this problem, at least for my own sake, is to increase the time between each of the saves performed by session restore. By opening about:config in your Firefox address bar, then typing browser.sessionstore.interval in the filter box, you'll see a value of 10000, which is in milliseconds. (Meaning your session is saved every 10 seconds.) I changed this to 300000, or every 5 minutes, as I don't have the urgent need for tab restoration. If you feel like being more on the safe side, try increasing it to something a bit lower, say 120000, or every 2 minutes.

• Workaround to Manually Uninstall, Remove or Delete Firefox Addon With Add-Ons Uninstall Button Disabled - My Digital Life.  Because we all have it happen to us sometime or another by some “rogue” software installer “feature” add-in.  Me? I go the hard-case route and take workaround method #4 on the page.

• hp smart web printing in firefox - Google Search. So our HP Photosmart C6280 printer is really cool and everything, but like most HP products, to really use all the features, you can’t just use the default Windows driver for it (though Win7 has a nice one).  No, you have to install the full HP Photosmart C6280 All-in-One Printer driver/software package which adds in some “Smart Web Printing” features to Firefox and other browsers.  Trying to remove it manually is possible, though painful.  Instead just do a custom install of the HP software and while watching closely, find and de-select inclusion of this software in your install.  I always do a custom install of HP printer software and only pick the features I really need.

• Using Flash 10.1 beta? You may want to turn off crash logging - Within Windows.  If you recently downloaded and installed the latest 10.1 beta (or new Flash Player 10.1 beta 2 released 12-17-09) then you might notice some hard-drive thrashing.  Rafael Rivera worked out a way to disable crash logging pretty simply.  I’ve done the trick and while I didn’t really notice a problem to begin with, I’m a bit more comfortable now with it in place. It’s a painless and easily reversed trick.

• New in Labs: Default text styling – New Gmail feature.

• Pencil Project – Not for the general public but this project kinda brings a MS Visio-like diagramming experience to the Firefox browser as an add-on.  It is really sharp and cool.  For folks who can’t afford the full Visio experience, and don’t need the Dia Open Source alternative, this might be worth investigating for quick and at-hand diagramming.

• Google Analytics has been hard at work tweaking and improving their page-monitoring code.  Newest tricks added to the stable are.
  • Asynchronous Tracking - Google Analytics - Google Code.  “Asynchronous Tracking is an alternative way to track website visitors with Google Analytics. Unlike a traditional installation, asynchronous tracking optimizes how browsers load ga.js so its impact on user experience is minimized. It also allows you to put your Analytics snippet higher in the page without delaying subsequent content from rendering. The Asynchronous Tracking requires a different Analytics snippet and a different syntax for making tracking API calls.”
  • Tracking Sites - Google Analytics - Google Code – More tracking code tricks.
  • Google Analytics Blog: Google Analytics Now More Powerful, Flexible And Intelligent – More power-user features added.

Cheers.

--Claus V.

Read More

A Smackrel of Forensics Honey…

I’m baiting this pot of honey with a reflective post by John Sawyer, All Forensic Investigators Are Not Created Equal at the Evil Bytes Blog.

There are forensic "experts" who have a narrow specialization in investigating individuals. Some examples off the top of my head are law enforcement forensic examiners looking at a computer to see if it was used to send threatening e-mails, search for information on making bombs, or view child pornography. The primary, and often only, source of evidence is the suspect's computer that is sometimes accompanied with some corroborating information from the suspect's ISP or a Web/mail hosting provider.

On the extreme opposite end of the spectrum, you have those who work on a much larger scale, taking into consideration many sources of information. I'm not sure there's a good term for them -- security investigator or enterprise incident responder or similar title -- but they go far beyond looking at just one system. Logs from routers, firewalls, and a numerous other types of systems all come into play in order for the investigator to crack the case.

I can’t consider myself really in the same class as true/certified “forensics” specialists.  If I had to place myself somewhere, I guess it would be with those in the second paragraph; one of those “enterprise incident responders.”  I have to know enough about Windows systems, typical/non-typical user behaviors, network elements, and hardware stuff.  Then I have to be able to successfully integrate all those elements together when I approach and analyze a system.  Is it harmless? It is potentially criminal? I have to get hard-data to come to a supportable conclusion, then present that material in a manner that is clear, logical, and fair; often to folks who are not technical in their knowledge base.

Since I don’t have any “formal” forensics training, I have to rely of the stream of material from the real experts and apply that information to our operational environments.  We have a limited budget and a growing workload.  Luckily I’ve been able to thrive with many freeware/Open Source tools shared kindly with the community by the developers bringing them to life.  I’m very grateful for both the knowledge-sharing and the tool-sharing.  That alone helps encourage and drive me to blog so tirelessly.  It’s a way of paying it forward.

In John’s post, he references this Infosecurity (UK) - The black art of digital forensics post by Steve Gold. Steve starts out with dissecting issues of timeline building and the conflicts that can arise when dates are disparate.  Then he moves on to the new “GUI-based” (by that I think he is referring to all-in-one commercial forensic suites) that help “aid” the investigator by parsing out volumes of system data and auto-magically sorting it out (bow optional) for the investigator. He then counterpoints the benefits of such applications with leaving the investigator in a possibly weakened position if confronted by a skilled trial-lawyer who may bring doubt in if the investigation doesn’t know how the software arrived at the data. Finally he concludes with observing that many forensics experts have had to learn on their own how the systems are working, so they can parse out the data needed, interpret it accurately, and wrap it up.

After the IPSEC steps, he claims, it’s usually a simple matter to classify the data collated and then analyze it fully.

Good digital forensics, he says, is not rocket science, but it does take a lot of thought to be able to complete an investigation and research all the relevant angles thoroughly.

“The bottom line with good IT forensic analysis is that you need to think about what data you have and how you can use it to your best advantage”, he says.

I’m not sure about that last point “…you need to think about what data you have and how you can use it to your best advantage.”  In my possibly naive way of looking at things, you need to understand what data you have, and work with what it tells you.”  Depending on your collection skills and knowledge base, that may be very little or almost the whole story.

To me, the successful analyst/forensic expert, whatever their hat may be, must be first and foremost a successful knowledge integrator.  They have to understand what tools they have at their disposal, what data the system is/is-not capable of providing, and apply the first to the second to extract the key and correct data needed.  Only then can they tease out the story it tells.  And in many ways, a successful analyst/forensic expert isn’t just a technical expert, they must excel at being an accurate storyteller, spinning the truth and reassembling the plot from the pages of a book come unbound.

• RegRipper Wishlist – Harlan Carvey is taking suggestions for improvements to his RegRipper tool.  I’ve recently got to “live-fire” deploy it and found it incredibly useful for helping me go from a global-view of the system down to the specific areas I needed to focus on.  While it didn’t produce a smoking-gun by itself, it highlighted all the shell-casings (if you will) that moved the search along quickly.
• Stuff – Windows Incident Blog then focuses on highlighting some useful source material, tips, and technical papers.  Good reading material abounds.
• Tools for mounting images – Harlan then moves on to showcasing a list of (mostly) free tools that can be used to mount drive image files.  ImDisk is fitting my systems analysis needs quite nicely as I generally work with raw IMG format files, though a rare .dd image file still is captured from time to time.
• Thoughts on Tool Verification – Harlan then moves on to touch on one of the issues that Steve Gold pointed out earlier…that investigators don’t always know exactly what and how the tool they are using is working under the hood.  He has helped that process a bit by seeding output of RegRipper with some basic tips/guides in some key areas.  That’s a nice touch and certainly helps keep folks on track understanding what they are (or actually are not) seeing in the data.
• Mo’ Stuff  -- And Harlan teases me about my blogging output!.  He’s able to find time to post regularly during the week.  I have to save it up for the weekend!  In this post, among the many great tool finds, timeline incongruities and the NtfsDisableLastAccessUpdate value, as well as Mark Woan’s tools (more on that in a moment).  Back to timelines…on a system I was dissecting, I had observed two different login events that the timelines just didn’t make any sense on.  Instead of chalking it up as “just one of those things” I made note and set it aside.  Eventually, after additional analysis work and data collection I finally was able to realize that the event element wasn’t “wrong”, but that I had made the initial mistake of placing in the timeline where I expected it to normally be, rather than where in the timeline activity sequence it really happened at. Once I did that, I was back on the right track and a whole new door of system activity became clear and fell into place.  Data and the elements that lead to timelines can be manipulated, destroyed, or “spoofed” by skilled folks, but doing so globally is very challenging.  In the absence of evidence casting doubt on the validity of that data, sometimes you have to accept (with a grain of salt) what it is telling you and trust it to clear things up down the road if you are faithful to it.
• USB Key Analysis vs. USB Drive Enclosure Analysis and Updated: Computer Forensic Guide To Profiling USB Thumbdrives on Win7, Vista, and XP – two great posts on the SANS Computer Forensics, Investigation, and Response blog.  With the proliferation of portable storage devices, this is one area incident responders need to be familiar with.  BTW, many locations that deploy “whole disk encryption” may also be able to set policies to force encryption of attached USB storage devices.  I point that out because if the encryption policy is set with a remote server, that server may also contain log data of portable USB device usage on the local system.  That could be valuable “witness” information to corroborate findings on the local system. Regripper will provide great registry information on connected devices as will Nir Sofer’s free USBDeview utility.
• woanware – Amazing toolset collection – As mentioned earlier, via Harlan’s post, I tripped over to Mark Woan’s incredible collection of utilities.  Way too much to mention in this post.  However, I really have been focused on both RegExtract which contains at least 65 plugins to query a Windows Registry for “key” data as well as gmailparser to look for browser cache remnants of Gmail usage, and ChromeForensics for parsing data out of Google Chrome/Chromium usage.  The micro csv2html tool is one of those brilliant tools that simply does what it does (turn a CVS formatted file into HTML table format) very well. ipsorter, NetCalc, and NoteTaker might appeal to the broader sysadmin audiences as well. Hop over there and make Mark proud.
• ChromeAnalysis - Google Chrome Forensics from forensic-software.co.uk (and FoxAnalysis) could be useful in a pinch.  I always like having more than one tool that does the same thing so I can get a “second-opinion” if I’m not 100% sure about the validity of what I am capturing.  It also goes without saying that Nir Sofer’s collection of Browser Tools must be in your toolbox by this point.
• I’ve been banging my head on my cubicle desk lately as I’ve been having to process a disk IMG file or two and a few of the Nir tools (and others) that I have been needing to use are “verboten” by our Symantec AV solution.  I guess I could make a whole nother physical system sans Symantec but it’s a lot of work transferring my otherwise stocked utility kit to that system.  But executing, even in memory, any of those tools sets off a slew of “infection” alerts.  I finally arrived at a clever (to me) workaround.  As I am mounting the Image files (read-only mode) to my system, they then become visible as a drive letter.  So I created a Windows Virtual PC system, left off SAV, and configured it to attach (share) the same drive letter as my image file is using proper.  Then I can download/execute the particularly offensive system utilities safely and easily within the VM and point them to the “mounted” source image as needed. No alerts and I am able to use the tools.  It’s not elegant but it does the work in a pinch.
• Matthieu Suiche has put out a Call for Beta-Testers :: windd utility RC2 (32-bits & 64-bits). If testing out a memory-imaging tool is your thing, drop Matthieu a line. He specifically is looking for folks that have more than 4GB system RAM to test it with.  See also his Windd Windows Physical Memory Imaging Utility info page as well as his direct link to windd RC2.
• Decrypting a PointSec Encrypted Drive Using Live View, VMWare, and Helix -- SANS Computer Forensics, Investigation, and Response blog.  It’s a lot of work but it is in process a bit similar to what I have to do using my Custom Win PE Boot Disk geared for PGP WDE systems.  You can either decrypt the entire drive (long and time consuming), or you can boot with a PGP driver-injected PE disk, pass off the encryption authentication token/passphrase, and then rip an image (through the PGP driver) of the “unencrypted” physical drive at the sector level.  I’ve done a few and it works like a champ.
• Welcome to the Rule 26 Blog – interesting IT/forensics blog from the legal-eagle perspective.  IAMAL so a few of these sites go a long way to helping me appreciate the issues (and procedures) needed to keep on the good side of incident-response legal issues.  They also have some nice forensics-response material (tips) as well.  .
• EDD Update: The Death of Imaging – Eric Blank seems to be--what we as kids would say—hard at work  “…poking at a fire-ant bed with a stick too-short”.  That said he does make a few interesting observations, including the storage-space race to the 1TB level and beyond.  As these capacities become more and more common-place, the thought of taking a forensic image becomes more daunting.  Not impossible, but challenging; particularly when actually filled with that much data.  Instead Eric seems to prognosticate that “Live file extraction will become the de facto method of gathering ESI.”  In fairness, Eric does clearly acknowledge the value of bit-based imaging and the data it provides.  However he seems to suggest that live-file extraction (only those visible to the system) and not in the unallocated spaces will the the way to go.  Then drop down to the comments as Wayne Kerr reminds Eric that he is not addressing “live-image” forensic imaging software and methods.  I would add that I didn’t see forensic live memory captures or network forensic captures mentioned in the post either. Both provide critical additional data to understanding a suspect system that is volatile and when not captured, may vanish for good if not captured.  Eric’s response to Mr. Kerr was telling, “Live forensic imaging (as described in your comment) is an invitation to disaster and spoliation. … Live imaging exposes electronic data to inadvertent destruction and alteration.”  Eric does (point agreed) that network based live-imaging can be very slow as well.  However, in some cases, this might be the best and least intrusive manner to capture critical data that would otherwise be lost and destroyed…which is where the casenotes and detailed documentation comes into play.  And while by nature, executing code on a suspect system (memory image capture or “remote” disk-image sector capture) impacts it, if done correctly it could be minimized and the benefit might outweigh the “spoliation”.  Kudos to Eric for bringing the discussion to the table.
• Finally for all you Google Trends voyeurs watchers and Google search addicts, two posts from McAfee Avert Labs blog were a bit interesting from the security-watch front this past week:  Searching for Malware Data Likely to Lead to More Malware and Google Trends Suffering Abuse Today.  Bottom line is that rogue A/V makers are seeding Google with linkage back to their sites so that unwary users looking for solutions to malware, trojans, viruses may be tricked into visiting their sites looking for relieve but instead find themselves hammered with more virus/malware headaches than they had to begin with.  Sad.  Likewise, they also seem to be keeping an eye on hot Google Trends and seeding sites of their own creation in a way to also appear in the top of ‘hot search’ result pages as well.  Check those search-links carefully before you click that link!  Know where you are going and avoid those darker alleyways unless you really know what you are doing and are well shielded.
• Alex Eckelberry’s Sunbelt Blog has been an excellent digest of malware-related issues and topics.  It has traditionally been the place to go for information on emergent rogue anti-malware products plaguing users.  However, in case you missed the link in the item above, Sunbelt Software is now also hosting the Rogue Antispyware blog which provides a constant stream of current information regarding this particular “class” of malware infections.  Malwarebytes blog also identifies many of these rogues and provides removal tools and tips as well in most all of their “rouge” posts. Finally the Microsoft Malware Protection Center also details updates to their handy MSRT (Malicious Software Removal Tool) as well as providing interesting rogue/malware analysis details from time to time.  (Sadly, even the official MSRT tool isn’t immune from being spoofed by its own rogue version: Different Strategies of Win32/FakeAV - CA Security Advisor Research Blog).

In the wise words of HP world Auror Alastor Moody: “Constant Vigilance!”

Claus V.

Read More