Links of the Week

Here is a hodge-podge of links that stood out this week.

Tr3Secure Data Collection Script Reloaded - Journey Into Incident Response blog - Corey Harrell has new news and updated on the Tr3Secure Volatile Data Collection Script he developed some time ago.

Tr3Secure Data Collection Script Reloaded - Journey Into Incident Response blog - Corey then follows up with a “real-world” walkthough of the Tr3Secure Volatile Data Collection Script after purposefully a lab pc for the sake of the discussion. It’s one thing to read about what a tool and process can do, it is a real treat to have the author lead a guided walkthough of the tool in action. As always, don’t forget to follow up with a comments reading as well.

plaso - super timeline - from the website “Plaso (plaso langar að safna öllu) is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.”  Spotted via this CDF at Champlain post.

Microsoft Security Essentials: Aiming low? - ZDNet - Larry Seltzer offers some thoughts on Microsoft’s free AV solution. He really doesn’t thrash MSE but does point out that there are many other free alternatives that tend to perform higher. It seems like a pretty reasonable perspective.  FYI, I have been debating making a change from Microsoft Security Essentials to Bitdefender Antivirus Free. Yesterday I uninstalled MSE and replaced it with BAF. The changeover went very smooth. The deciding factor for me was the ongoing poor post-boot performance of my system.  While I don’t have a SSD drive in my laptop, I is running an Intel i7 CPU with 8 GB RAM. After boot, MSE scans on the post boot environment seem to be leading to slower post-boot launch of a number of my applications for a while as processes and files get scanned. Now that I am on BAF, I don’t see those post-boot application hangs. That said, I will continue to primarily recommend MSE to family and friends unless repeated infections indicate a need for the advance protection BAF may provide.

Before moving on from Microsoft Secuirty Essentials and Windows Defender (for Win 8), I thought this post Windows Defender and context menu for file check? (GTranslated) at Borns IT and Windows Blog was very insightful.  Some time ago I posted a number of Windows Defender tweaking tips Advanced Tips for Windows Defender with Windows 8, one of which was how to add a scan with Windows Defender to the context menu list in Win 8.  Born’s acknowledges that is a popular request and go though how it is accomplished. However, as he points out, the way Windows Defender operates, when a file is accessed via the (File) Explorer, Windows Defender already scans it before allowing access. If it is infected then you don’t get to fiddle with it.  Same thing with downloaded files; again pre-scanned by Windows Defender.  So, you can manually scan them again if you want, but know that if you do use Windows Defender in Win 8, it has already scanned the file.

Message Analyzer has Released – A New Beginning and Message Analyzer: Why so different from Network Monitor? - MessageAnalyzer Blog - Final release now public for Microsoft’s network capture analysis tool. I’m not sure it will replace Wireshark, but the approach is a step up from their older Network Monitor capture tool and is at the very minimum a great supplemental network capture tool for packet analysis.

Plugin Activation in Firefox - Mozilla Add-ons Blog - basically in a future version of Firefox, all plugins (except Flash) will become “click-to-activate”. This may or may not be a great thing depending on your security versus convenience perspective.

Wendel's Small Hacking Tricks - Killing Processes from the Microsoft Windows Command Line interface - SpiderLabs Anterior - I’m always looking to find a way to do something without a third-party tool so this is handy information to be familiar with.

Universal USB Installer (also YUMI) USB Flash drive does not boot on EeePC - RMPrepUSB, Easy2Boot and USB booting... blog - This is a pretty esoteric technical post for most folks, however if you are into USB-based system booting, it is interesting.

When setting up Windows 8.1, Microsoft appears to do all it can to shove you to create/use an on-line Microsoft account rather than a local one.  For some folks that might be fine but others (particularly the old-school crowd) will find this process similar to a cattle chute. If you are a thinking cow, it probably isn’t a very pleasant experience. Fortunately, there seem to be a number of outs if you know the game ahead of time.

• How To Install Windows 8.1 Without Microsoft Account - Into Windows
• Use Windows 8.1 with a local account instead of a Microsoft account - 4sysops
• How to setup local account in Windows 8.1 - DeDoimedo.com
• Windows 8.1 How To Convert Windows Live Account To Local Account - Next of Windows

Group Policy Search Engine Gets Updated - Group Policy Central blog - From that post by Alan Burchill:

“The Group Policy Search Engine is a great web site that has all the different version of Microsoft Group Policy ADMX files that allows you to easily and quickly search for the policy setting. This site is one I use very frequently especially and is a must have bookmark for any Group Policy Administrator.

“Well, Stephanus from Microsoft who maintains the web site has just loaded the Windows 8.1 and Windows Server 2012 R2 policy setting meaning you can now look up all the new policy setting in the latest version of Windows. “

Group Policy Search - site homepage.

Google Static Map Maker: Static Maps on Steroids - noupe - Nice tool to create linkable custom static Google maps rather than using a screen-shot image or a embedded and modifiable one.

Google Static Map Maker - site homepage by Katy Decorah.

Cheers!

--Claus Valca

Read More

Network & Network Security Quickpost - Last call NFAT edition

I just couldn’t wrap up the weekend without sharing these links. I’m so going to be nodding off in my training class tomorrow. Must bring Thermos of extra coffee with me! Don’t want to make the teacher unhappy!

So many network tools, tricks, and nuggets came out last week I’m still exciting thinking about how to use them all!

Security Advisory: Two Vulnerabilities in NetworkMiner - NETRESEC Blog - Don’t let the boring post title fool you! Based on this, Erik Hjelmvik has released a new version of NetworkMiner! Now sparkling at version 1.5 (free/pro editions)

NetworkMiner packet analyzer - Download NetworkMiner version 1.5 (free) here.

While I was doing some super-fast (but apparently productive) beta testing for Erik on some Windows 7 and Windows 8/8.1 systems, I noticed I wasn’t getting great results from my test captures made with and being processed in NetworkMiner. My “doh”. Erik kindly reminded me of his post NETRESEC RawCap - A raw socket sniffer for Windows where he pointed out that using Windows raw socket sniffing has some problems. I had forgotten I didn’t yet install Wireshark/WinPcap on these particular test systems. From Erick’s post:

Microsoft's newer operating systems (later than WinXP) have limitations associated with raw socket sniffing of external interfaces, i.e. everything that isn't localhost. Known limitations in Windows Vista and Win7 are:

• Windows 7 - Can't capture incoming packets
• Windows Vista - Can't capture outgoing packets

Due to these limitations in the raw sockets implementations of Microsoft's current operating systems we suggest running RawCap on Windows XP if you need to capture from external interfaces.

Baselining Dropbox With Wireshark (by Tony Fortunato) - LoveMyTool blog video presentation.

Editing Tracefiles With TraceWrangler (by Tony Fortunato) - LoveMyTool blog video presentation. This short video presentation on a new (Alpha release) tool, TraceWranger blew me away. There are methods of sanitizing trace files for sharing/training but they are fraught with challenges for mere mortals. This new tool is amazing and I really hope the developer Jasper Bongertz gets the support needed to encourage his continued refinement and development of this valuable tool for analysts.

• TraceWrangler - (alpha software) - currently at build version 0.1.3. Standalone application. No installation needed. Unzip and go. Written by Jasper Bongertz.
• TraceWrangler Documentation - This is Must Read material if you are interested in using this tool properly
•  Starting TraceWrangler - the basics
• Anonymization Tasks - details for the options
• Trace File Sanitization NG - SEC-04_Trace-File-Sanitization-NG_Jasper-Bongertz (PDF) - Link to his presentation of the tool at Sharkfest 2013.
• Sharkfest 2013 - Trace File Sanitization (Jasper Bongertz) - YouTube. While PDF versions of presentations are nice, on a whim I decided to see if Jasper’s presentation was actually up on YouTube for viewing. It was!
• Trace file sanitization for network analysts - Packet Foo - Jasper’s blog post with additional details on his tool in case you missed the presentation.
• The notorious Wireshark “Out of Memory” problem - Packet Foo. Oh how this has hobbled me over the years! So much so that CLI based captures became my dearest friend!
• Packet Foo RSS - Yeah. It’s that good. Feed yourself on it!

Nmap - Now at version 6.40 - Free Security Scanner For Network Exploration & Security Audits.

• Nmap Change Log
• Download Nmap Security Scanner - for Linux/MAC/UNIX or Windows

Message Analyzer Beta3 Refresh has Been Released (Build 6215) - MessageAnalyzer - Lost in all the news was a quiet announcement of the next generation of Microsoft’s own network traffic analysis tool MessageAnalyzer getting a Beta 3 refresh release. The interface is very different (to me) from Wireshark, but since I used NetMon a ton to supplement my Wireshark work, it is taking some getting used to.

HolisticInfoSec: toolsmith: C3CM Part 1 – Nfsight with Nfdump and Nfsen - HolisticInfoSec blog - Russ McRee’s post rocks on so many levels. Well worth the read and review.

Firefox Developer Tool Features for Firefox 23 - Mozilla Hacks – the Web developer blog. In case you missed it, Firefox 23 was released last week. Included in it (besides the new app icon update) was a new network tool called “Network Monitor.” 

I so love this! “F12” is the new “must know” hotkey in these modern browsers!

If only Mozilla (or Chrome or IE 10) were “approved” web-browsers in our enterprise. This feature alone would so help with network and web-app diagnostics and troubleshooting from the end-user desktops.

What’s that you say? One single element of your cloud-based web-application seems to time out in IE 8, crashing your session? The network is fine, site bandwidth is fine. Your PC is fine. Seems like it could be a server-side application issue. Let me make a ticket for your issue and send it up. (Response often comes back, “There is no problem…must be a client-side issue…check the PC and bandwidth, follow our response template and let us know…”) (Sigh…)

• Network Monitor, now in Firefox Beta - Mozilla Hacks – the Web developer blog - More details on the feature.
• A look at Firefox's new Network Monitor - Ghacks - Martin Brinkmann does an outstanding job introducing it as well.

Turns out Chrome web browser can do this trick as well

• Evaluating network performance - Chrome DevTools — Google Developers
• Performance profiling with the Timeline - Chrome DevTools — Google Developers
• Chrome Dev Tools: Networking and the Console - Nettuts+
• Google Chrome Dev Tools: Network Panel - TechRepublic

Turns out that Internet Explorer (IE9, IE10, IE11) also have a “F12” feature for network analysis in the browser.

• Introduction to F12 Developer Tools (Windows) - IE Dev Center
• Navigating the F12 Developer Tools Interface (Internet Explorer) - IE Dev Center
• Internet Explorer's F12 Developers Tools: A feature walk-through - TechRepublic
• A Peek at Internet Explorer’s Developer Tools - Nettuts+
• Network Traffic Capturing with IE9 Developer Tools - LINQED.NET

And in IE11, it’s about to bring the house down on the competition!

Debugging and Tuning Web Sites and Apps with F12 Developer Tools in IE11- IEBlog. OMG!!! I am so crushing on the new “F12” profiling and responsiveness tool interface in IE 11! Please tell me this is going to be backwards compatible with Win 7. (Why yes, Virginia, it is…)

Anyway, back to more Firefox 23 release news and details.

• Firefox 23 lands with a new logo and mixed content blocking - Ars Technica
• Firefox Notes - Desktop - Mozilla.org
• Firefox 23 enables mixed content blocking, consolidates search settings - BetaNews
• A Look At What's New In Firefox 23 - Addictive Tips blog

Troubleshooting TCP/IP Connectivity Issues with This Command-Line Utility Portqry.exe - Next of Windows. Been using portqry.exe from the command line along with the PortQueryUI GUI fro some time. Dead helpful in a pinch!

PuTTY: a free telnet/ssh client - just released at version beta 0.63 for you console fans! See the extensive Changes page for all the details

• PuTTY Portable 0.63 - PortableApps.com build version as well is available and updated.

KiTTY - let’s not forget about this fork version of PuTTY that has some additional bells-and-whistles!

• News - latest KiTTY news is update 0.62.2.3 minor update in late May 2013.
• Recent changes - tracking site-changes at KiTTY’s house
• KiTTY Portable - why “yes” there is a PortableApps.com build version as well for KiTTY fans.

Finally, at home I run Mozilla Firefox, Portable Edition and Google Chrome Portable rather than installing them directly on my system. However I was trying to use some of NirSoft’s Browser Tools to explore and check my Google Chrome(ium) cache and wasn’t finding anything at all.

Strange.  Bug in the tool?

Turns out the answer was “of course not dummy” it’s the dummy’s bug.

Where is the Google Chrome Portable cache folder? - PortableApps.com. Bruce Pascoe kindly puts it like this:

Chrome Portable, like FFP, doesn't save the cache by default.

Note that unlike Firefox however, there's no way to turn the cache off completely in Chrome, so while it's running the cache is stored in the local temp directory (%TEMP%), but then it's immediately deleted when you exit Chrome.

So anyway, yeah, no surprise that you couldn't find it.

and cleared up a bit by “The MAZZTer”

The cache folder is saved in %TEMP%\GoogleChromePortable.

Where the %TEMP% is the user’s temporary file location under their profile.

This is interesting as it explains why the NirSoft tool ChromeCacheView wasn’t finding anything while pointing to the default user profile location in my Portable Apps application structure that ChromeHistoryView didn’t seem to have any issue with parsing. So even though the files were removed when the program terminated, it most likely did not “secure” delete them, so (depending on overwrite activity of the file system/free-space scrubber utilities) it might be possible to carve and recover them from a system that the portable-apps version of Chrome was used on. And that sounds like a challenge for another day…

Cheers!

--Claus Valca

Read More

Internet Explorer 10 (for Win 7), Firefox bits, and How Google Works

News of Microsoft’s release of Internet Explorer 10 for Windows 7 seemed to go off like a flare; lots of noise and brilliance…and then flickering out to nothing.

In my security posture of trying to keep all the web browsers installed on all our home systems current, I went ahead and jumped on IE 10 and installed it almost immediately after release on our Windows 7 systems. 

None of us (well except Alvis with her college portal) regularly use Internet Explorer.

I use still primarily use Firefox for my daily heavy-lifting at home, and supplement it with Chromium (a build version of Chrome).

Alvis prefers the public release version of Chrome…which self-updates BTW…so that is fine by me.

Lavie uses Firefox exclusively….also because of the bookmark sidebar feature.

But I leave Internet Explorer on our systems (for compatibility reasons with some applications and websites).

Anyway, it went on all out systems without much fuss…well, not really on mine. Lessons learned. If you want to manually put it on your system, just make sure of all the links you are offered, the one you are using is to the actual FINAL release installer and not one of the IE 10 “preview” release version installers. In my haste (and trust in the IE Blog post I used) I grabbed a preview version and had to go through a series of additional security updates and IE 10 release upgrades to eventually arrive at a fully updated version of IE 10.  I didn’t make that same mistake with subsequent installs on everyone else’s systems.

• Internet Explorer 10 finally released for Windows 7 - Ars Technica
• Internet Explorer 10 now available for more than 700M Windows customers - Exploring IE Blog
• IE10 for Windows 7 Globally Available for Consumers and Businesses - IEBlog
• RELEASED - Download Internet Explorer 10 for Windows 7 - Scott Hanselman’s ComputerZen
• Bloody well time, Microsoft releases Internet Explorer 10 for Windows 7 - BetaNews
• Internet Explorer For Windows 7: New Features & Improvements - Addictive Tips
• IE10 on Windows 7: 5 Essential Facts - Software -Information Week
• Download Internet Explorer 10 for Windows 7 (32-bit) - Official Microsoft Download Center
• Download Internet Explorer 10 for Windows 7 64-bit Edition and Windows Server 2008 R2 64-bit Edition - Official Microsoft Download Center
• Download Internet Explorer 10 Language Packs for Windows 7 and Windows Server 2008 R2 - Official Microsoft Download Center
• Release Notes - Microsoft
• Download Internet Explorer 10 - Microsoft Windows - Worldwide installation packs

Meanwhile, these Firefox articles were pretty timely.

• Prepare Mozilla Firefox for Enterprise Deployment and Virtualization - Aaron Parker
• The Firefox Extension Guru's Blog links to this How to make Firefox the Fort Knox of browsers - over at Ghacks.

And Google has some great presentations to help you understand how their email and search services work.

• Follow an email’s journey with Story of Send - Google Official Blog
• The Story of Send - Google
• Google Releases Interactive Infographic: "How Search Works" - Search Engine Land
• How Search Works - Google

Stay informed & Browse safe.

Claus Valca

Read More

Google Reader’s Demise: A Big Deal for being not that big a deal

At first I almost overlooked notice that Google Reader service was shutting down this summer.

Fortunately for me a wealth of articles burst forth on the Web and the noise couldn’t be missed.

• A second spring of cleaning - Google’s Official Blog
• Google announces Reader’s imminent demise - Ars Technica
• Google Reader Is Shutting Down; Here Are the Best Alternatives - LifeHacker
• Poll Technica: Where should we go when Google Reader is put out to pasture? - Ars Technica
• Google plans to execute Reader, among other apps - BetaNews
• End of an Era: Google shutting down Reader - Justinsomnia
• The End of Google Reader - NT Blog
• Google Reader Going Away - Standalone Sysadmin
• Users rally against Google's plans to shut down Reader - BetaNews
• R.I.P Reader: Google giveth, and Google taketh away - TechBlog
• Google Reader may very well rise again… as part of Google+ - Ars Technica
• Why We Mourn Google Reader - And Why It Matters – ReadWrite
• How to export and transfer your Google Reader feeds to another RSS service on iPhone and iPad - iMore.com
• Google Reader Alternatives - Caschys Blog (GTranstated)
• Google Reader: Feedly will allow seamless transition - Caschys Blog (GTranstated)
• Digg to Build RSS reader with 'Best of Google Reader's Features' - TheNextWeb
• Best Free Google Reader Alternatives For Web, Windows & Mac - Addictive Tips
• Three Reasons why Google Reader shutting down may not be such a bad thing - freewaregenius.com
• Why Google killed off Google Reader: It was self-defense — Gigaom
• More than 500,000 Google Reader users flock to Feedly in two days - The Verge
• Five Best Google Reader Alternatives - LifeHacker
• 5 iOS news app alternatives to Google Reader — Gigaom

I’ve enjoyed reading the perspective and comments left by users of RSS and Google Reader in most all of the above articles I’ve found.

As a very recent user of Google Reader, my perspective is a bit unusual.

Very early on, I realized the power and usefulness of RSS/Atom feeds to collect, centralize, and allow rapid mass monitoring of consumption of the wealth of material on the web.

Without RSS/Atom feeds that I subscribe to, I seriously doubt I could process the 90-120 sites I go to for news, tips, and areas of interest.  On any given day, they provide me between 300-400 articles to sift through.  And because of RSS/Atom feeds, I can usually complete that process in about 30 minutes or less.

There is no way I could do that by checking each site directly via bookmarked web-pages. I would miss tons of updated content and probably get loose hours of my time trying to do so.

For years I have relied upon Windows RSS feed reader clients running on my system.

First I used Sage which is an add-on for FIrefox. for a while development slowed and a few issues pushed me to the NewsFox add-on next. It worked very good.

I had flirted back in 2008 and did a RSS Reader Roundup…Valca Style. There were lots and lots of feature-rich RSS feed reader clients for Windows back then.  But I kept with reading my feeds in Firefox through the add-ons.

Eventually, however some of the peculiarities of running a RSS feed reader in your primary browser began to create issues.  It would run in a background tab session, but would “lock-up” the browser as it pulled feeds down during refreshing.

So in 2012, I revisited the search for a desktop Windows RSS feed client and eventually found that Omea Reader fit the bill for me a bit better than my runner-up choice, Feedreader.

Since I am using a local-client-based RSS feed reader, Google Reader was a service I was aware of but didn’t care about. When I found a new site to follow, I would subscribe directly in my client to the RSS/Atom feed and move on.  If you use RSS/Atom feed reading with this approach you too might overlook or care very little for the status of Google Reader.

But here is where the impending loss of Google Reader does matter to me, a lot; I got an iPhone.

This is the rub. While I am feed reading directly on my PC, my feed client does all the work pulling in and managing the individual feeds.

When I got my iPhone, I looked at the RSS iOS apps available and they all seemed to require some third-party back-end API to manage the feed subscriptions, and would then pull the article/feed information down and present it.

So I got my Google Reader set up by exporting my Omea Reader’s subscription pile as a single OPML file, imported it into Google Reader, downloaded Phantom Fish - Byline. Ironically, “Google Reader on the go” is their product tag-line.  Then I connected Byline to my Google Reader and away I went with my RSS feeds on the road.

While I can live without checking my RSS feeds during the day (as I survived just fine before my smartphone adoption), it does make the time spent at the end of the day on my local PC client reader that much faster since I come at it mostly caught up.

However, at this time Byline hasn’t seemed to offer any information about their plans to cope with the shut-down of Google Reader.  Reeder for iOS also looks pretty good, but it also can use Google Reader. Feedly is working on a back end API that hopefully will mimic Google Reader. I like the thought very much, but the iOS app itself is a bit too GUI/graphic intensive. I like the streamlined, more text-based format of Byline and Reeder. Is it possible to recreate a Byline/Reeder experience in Feedly?

There are lots and lots of RSS apps for iOS. However they all seem to leverage a back-end API to collect the feed subscriptions from.

What I really would like is to find a RSS iOS app that allows me to import my OPML file directly to it, and let it operate as a “standalone” RSS feed client directly in-app (like my desktop RSS feed reader) and not need to depend on a third-party API to pull the feeds down from.

I’m confident that other developers will step into the void, and as Samer Kurdi at freewaregenius posted, this might indeed turn out to be a good thing.

It’s just going to cause a fair amount of anxiety and chatter among hard-core RSS feed users until it sorts itself out.

At least we have until July 2013 to see who steps up and delivers, both for the RSS feed ecology in general and the iOS/smartphone app ecosystem in particular.

Until then I will keep on RSS-feeding with my desktop client with nary a worry, but obsess about a future without RSS feeding on my iPhone until a savior is found.

Cheers.

--Claus Valca

Read More

Threats, Updates, and iOS App struggles

Quick post to clear out last week’s inbound material.

Threats (and fixes/updates)

• Update Palooza - ISC Diary - (Adobe Acrobat Reader now at 11.0.02, Thunderbird 17.03 out, iOS 6.1.2, Java 7.15, Java 6.41, Firefox 19, Adobe Flash Player 11.6.602.168). If you are impacted, get busy patching!
• Oracle plugs security holes: Updates for Java 1.4 to 7 - The H Security: News and Features - more technical details on the update fixes.
• Adobe patches Acrobat and Reader, Mozilla debuts Firefox built-in PDF viewer - Help Net Security
• Timeline: Hacks Related to Apple - F-Secure Weblog : News from the Lab
• Dev site behind Apple, Facebook hacks didn’t know it was booby-trapped - Ars Technica
• NBC.com hacked, serving up Citadel malware - HitmanPro blog - Note: threat now appears to be fixed.
• NBC.com hacked, briefly compromised with RedKit malware - ZDNet - Note: threat now appears to be fixed.
• NBC Website HACKED – Be Careful Surfing - Sucuri Blog - Note: threat now appears to be fixed.
• IWhen web sites go bad: bible . org compromise - ISC Diary - Note: threat now appears to be fixed.
• Mandiant Exposes APT1 – One of China’s Cyber Espionage Units & Releases 3,000 Indicators - M-unition - Super Duper threat analysis report from Mandiant. Download the PDF report file directly and take your time reading. MD5/SHA-1 hashes for the valid file provide…because…
• Fake Mandiant APT Report Used as Malware Lure - ISC Diary
• Threat Actors Using Mandiant APT1 Report as a Spear Phishing Lure - M-unition
• Mandiant APT1 report used as a lure in phishing campaigns - Help Net Security
• Malicious Mandiant Report in Circulation - Symantec Connect Community
• Mandiant APT2 Report Lure - 9b+

Updates

DEFT 8 Roadmap and features - DEFT Linux - Computer Forensics live cd - Coming mid April 2013

Update XORSearch V1.8.0: Shifting - Didier Stevens

USB Image Tool 1.60 - Alex’s Coding Playground - There are more than one way to image a USB drive, but this tool by Alexander Beug is IMHO one of the very, very best for ease of use and reliability. I would be lost without it. Alex has worked hard on this update and it brings auto-admin elevate request at launch, now supports non-removable USB devices such as hard-drives or card-readers, and it has a “reset” feature to overwrite the bootsector of the selected device with zeros to allow Windows to reformat the device to the original size (something USB Image tool can’t do). See the changelog for more details.  As an alternative, also consider the free OSForensics tool ImageUSB.

iOS App trials, tribulations, and tips

An iOS Byline Issue - worked around

I’ve been gushing for some time about how I think Phantom Fish’s Byline app for iOS is super great. It is really fast pulling feeds and the interface is easy to navigate. It has really helped me stay in-touch with tech goings on during the day as I can now check all my RSS feeds on my personal iPhone. Before I was having to wait to the end of the day when I got home to check my personal feeds for news updates.

So last week I ran into my first problem with it.

I normally have it set to show 2,000 items; this allows me to go back and search for past feed articles after the fact. Additionally, I manage “Caching” with “Wi-Fi” only, images “on”.  That’s pretty much it. There aren’t a lot of settings but they are enough.

So the problem was that mid-week, after the updating of the feeds occurred, the caching followed, but kept getting stuck showing “1 of 200”.  It wouldn’t ever stop or move on.

It looks like a bad feed article was causing the caching to stop.

I sent an email to the Byline help team but still haven’t seen a response.  It was super frustrating and I found a few others on the net who also had encountered the problem.

So what to do?

Eventually I figured out a workaround to allow the feeds to continue to drop and cache again without getting “frozen” so-to-speak.

I went back into the settings and changed my All Items option to “Show 200 items”.

What this let me do is to get past the stuck item by not caching it.

I’m not sure which one it is, but right now it is somewhere between the 200 and 500th feed item. If I set at “200” I’m fine. If I set at 500 (the next highest increment) it locks when it hits the bad feed.

Considering that on any given week-day, my feed count pull results in about 350 new article feeds, I project that by the end of next week I will have way-more new feeds and the bad one will have been shoved off the bottom of the stack.

It isn’t a "pretty” fix but it works and restores a level of functionality with caching of feeds in Byline in the meantime.

Recommendations to the Phantom Fish coders for the next Byline update:

1. Code for an auto-skip of a feed if it doesn’t cache within a set/variable number of seconds; letting the user set the timeout period would be even better.
2. Allow greater granularity of number of items to show. The stock choices of 100, 200, 500, 1000, and 2000 items may make sense, but I’d like to set my own custom number of feeds…especially if the first recommendation cannot be implemented.

That’s pretty much my only requests for an otherwise stellar application.

A Gmail App Badge notification issue - cleared

My second issue this week was when I was surprised to have my iOS Gmail App badge still showing “1” unread item, despite no unread messages showing in any of my accounts.

Hmm.

This really frustrated me.

Eventually I found others who have experienced this same issue and the workaround solution to clear it. Apparently it is not an unknown issue and has been present for some time.

How to reset/clear ios badge - Google Groups

Bruno O. Barros (llustreBOB) provided the “solution” to clearing it midway down in the thread:

The only solution working here is the one where I move the rogue message back to inbox, mark it as unread and then mark it as read again.

Sure enough. Since I remembered the last message I managed, in my iOS Gmail app, I moved the message back to the inbox, marked it “unread”, marked it “read” and then archived it again.

The notification message “1” cleared off my Gmail badge.

Dave Churchill --just a bit up in that same thread -- shows how to replicate the issue/fix if you want to play with it (though I don’t know why you would if the solution works).

I can reproduce this by doing this:

1. Gmail app on iPhone has no badge.
2. Send email to self on laptop
3. Wait for Gmail on iPhone to receive email and show badge
4. Read and archive the email on the laptop
5. Open Gmail app to note there are no messages in inbox, refreshing still shows no messages, checking list of labels shows no unread messages.
6. Press Home button to exit Gmail, badge remains at 1.
7. Open Gmail again on iPhone.  Navigate to All Mail, open the message (which is correctly displayed as already read).  Badge still shows 1.
8. Mark message as unread exit, badge still shows 1.
9. Read message, exit, badge still shows 1.
10. Move message to inbox.  Badge now cleared.

Bump

Are you an iOS user feeling a bit jealous of those sexy Samsung phone-bump-transfer features?

I spotted this new (to me) app last week. I haven’t pulled the trigger on installing as I don’t really have a need for it just yet but it does seem like a cool and handy feature. So I’m keeping it on my “watch list”. Anyone have any experience or feedback with it yet?

• Bump for iPhone, iPod touch, and iPad - iTunes App Store
• Get Bumpin' With Bump For iPhone: Your Easy, Instant File Sharer [iPhone] - MakeUseOf blog.
• Bump - Home

Cheers!

--Claus Valca

Read More

In Setting up a new Windows 8 System…

In less than three week’s time, I have now had the opportunity to set up Windows 8 systems for home users. Both happened to be Dell systems.

One was for a family friend. The other was for Lavie who had become frustrated with display issues on her “old” Windows 7 laptop.  It appears that in the act of opening her monitor lid  over the past few years, the display had gotten flaky and started flashing red and other signal color lines from time to time.

The only reasonable home-user OS options for these Windows-only folks was to bite the bullet and move to Windows 8.

The new local-user account setup process was pretty simple. Not painful at all.

Neither was impressed by the Start interface and needed to be directed back to the “desktop” experience.

To make that simple (and solve 95% of their learning curve challenges with Windows 8) I downloaded and installed IObit StartMenu8 Free.

I set it to load the desktop immediately after boot.

Instantly they felt back at home and the anxiety passed.

I showed them how to return to the desktop if they got back to the Start.

Both wanted to continue using MS Security Essentials. OK. Although I did follow a tip on “How to Add “Scan with Windows Defender” to the Context Menu in Windows 8” I found over at How-To Geek.

I am also still running (and recommending despite the chatter (link-1 & link-2) MS-SE on my Windows 7 systems. I am trying out the Bitdefender Antivirus Free product on my virtual Windows 8 system to check performance and operation. So far so good.

Sure there were application installations, updates, user-data migration work to be done, etc. but that was pretty much it.

I did not install Java. They didn’t need it and the security issues have made it too risky for me to recommend installation on home-user systems unless they have a specific Java application they need. Neither did.

I did not install the Flash plugins. IE 10 comes with it’s own Flash plugin as does Chrome.

Lavie needed some help finding a tool to help her deep-dim her laptop display for those late-night fan-fic reading sessions. These are adjustments beyond the hardware-based brightness settings.

• f.lux - changes the color warmth of the display automatically depending on location/time-of-day. We loaded this and she really liked it.
• DimScreen - 1 Hour Software by Skrommel - DonationCoder.com - Loaded this one too.
• Dimmer - Nelson Pires. We added this one also, but Lavie liked the navigation options in DimScreen a bit more.

Dell has a track-pad sensitivity manager to keep the cursor from jumping when thumbs hover over the pad, but we also tried the touchfreeze - Utility for Windows. Worked great as well as the Dell solution.

Too easy? Want more?

• 102 simple steps for installing and configuring a new Windows 8 machine - Troy Hunt’s blog

I’m still in no hurry to upgrade Alvis and my Windows 7 systems to Windows 8. I don’t see the need (yet).

But if a new system comes with Windows 8, it’s no biggie anymore.

Cheers,

--Claus V.

Read More

Thoughts on Chrome(ium) Privacy Attainment

It is no secret to GSD blog fans that I’m a heavy supporter/user of Firefox browser. It remains my primary workhorse for web surfing. Updates come pretty steadily and performance and stability issues haven’t been an issue for me. Plus the specialized add-ons I use make it super-handy.

That said, the Google Chrome -- specifically Chromium Dev build -- is the browser I launch when I want to do mindless web surfing, or leave a full-screen web-page up while I am monitoring something specific.

When I help a friend/family-member set up a new system, I always install and give a walkthrough of Chrome. More times than not they quickly come to prefer it over Internet Explorer.

In fact, one of the only reasons I don’t use Chrome(ium) more is the continued (and probably “forever”) lack of a bookmark-sidebar option that Firefox has.  With my personal bookmarking/blogging habits, that feature is a “must-have.” Lacking that, hard-core regular usage of Chrome remains an exercise in frustration.  More on my attempts to overcome this in a follow-up post.

On my system I have kept two (portable) build versions of Chrome; Chromium (Dev) and SRWare Iron.

I use and prefer Chromium builds because they are updated quite frequently. I have been a long user of SRWare Iron because the developer has offered out a list of specific privacy feature enhancements under the hood that you don’t get with Chrome versions.

Additionally, there is Comodo Dragon Web Browser also based on Chrome and providing some additional security/privacy features. However I don’t use this version.

Chrome Flavors - Full Install versions

These versions will install a “full” version directly onto your Windows system

• Chrome Browser - Download current Chrome browser release version
• Chromium - The Chromium Projects (overview)
• Download Chromium - Download current Chromium browser release version
• SRWare Iron - Download a “privacy-enhanced” version build of Chromium
• Dragon Internet Browser - Download a “privacy-enhanced” version build of Chromium; includes “Domain Validation” feature from Comodo, cookie/web-tracking & browser download tracking for privacy.

Chrome Flavors - Portable versions

These “no-install” versions allow you to take your Chrome-browser with you on a USB stick…or if you just want to run it locally without installing onto your Windows system.

• Google Chrome Portable - PortableApps.com.  The main version level is right there at the top. This is the “mainstream” Chrome version. Scroll down a bit on the page and you will find  additional download links for portable versions of Chromium (Dev) and Beta release versions. This is the source of the Portable Chromium (Dev) package I use/update.
• Chromium Portable - This is another portable Chromium (Dev) package another group maintains.
• Iron Portable - Download the PortableApps.com version of SRWare Iron
• SRWare Iron - Look carefully and there is portable version (zip) offered on the developer’s download page.
• Comodo Dragon Portable - Basically this forum tip says to just download the regular version and pay attention to choose the “portable” version install option while doing so.
• Sandcat Browser - Syhunt. This is a specialized portable penetration-testing oriented web-browser based on the Chromium browser. Supports live HTTP Headers, request editor, fuzzer, JavaScript Executor, Lua executor, PageInfo extension, HTTP brute-force, CGI scanner scripts, and much more

Updating Challenges

I also have a bit of an OCD app updating problem. If there is a newer version out -- particularly important with browsers and browser-plugins for security reasons -- I download and apply.

This is a challenge for both my portable Chromium and portable SRWare Iron builds as they don’t have/support in-app updating. So I have to watch the webs/feeds for signals a new version is released then manually update them.

As of this post date, Chromium Dev is at 25.0.1364.29. SRWare Iron is at 23.0.1300.0.

So to remedy the issue I keep an eye open of the Chrome Release blog (via my RSS feed reader). Then I pop over and check the direct download page for the source of the particular portable version I use and snag it when it appears..usually just a few days later.

• Chrome Releases - Chrome release notice blog
• Google Chrome PortableApps / Additional Versions - SourceForge.net file repository downloads
• Chromium Portable - SourceForge.net file repository downloads
• SRWare.net • View forum - SRWare Iron Support (English) - New version releases noted at the top.

Rolling your own Privacy Build of Chrome - Overview

So, what I want to have is all the privacy enhancements of SRWare Iron but in the “current” level of Chromium (Dev) and on a regular basis. Could I manually tweak-out a Chromium installation to achieve the same (or similar) privacy gains? 

One of the nice things of SRWare Iron is that the developer does all this work for you under the hood. But if like me you are comfortable making lots of browser configuration changes manually, and don’t mind doing some research, maybe you can get to the point of having an up-to-date Chrome-based browser with most/all of the features the SRWare Iron version has.

Aside: This isn’t really meant to be a discussion on creating an “ultra-secure/private” web-browsing experience in Chrome. I’m not seeking a completely “stealth” web-browsing experience. I’m not interested in setting up proxy/TOR sessions to try to bypass network/ISP tracking, nor is it to discuss the merits of “in private” mode browsing and all that. Who really knows what/how-much deep-packet inspection and logging at ISP’s may be going on. Rather, this attempt is to reasonably minimize the number of tracking features normally encountered in standard web browsing sessions. Yes, those “features” can be used by ISP/web-sites/content-providers to “enhance” your browsing experience in serving customized web-content, advertisements, and search-results specific to your browsing habits. That may be a good thing or not depending on you perspective. I personally to prefer to pour my coffee black and then add cream/sugar/etc depending on my mood. Same with my browser.

I started looking at the list of primary feature comparisons provided by SRWare; Chrome vs Iron.

Once I was familiar with these items, I started hitting Google to see how I could make each change manually. I soon found what I was looking for.

My plan was to post a link to explain how to achieve each setting.

But then as I dug just a bit deeper, I started finding some interesting discussions about recommended security and policy settings for Chrome builds; as well as some updated comments on the relevancy of the items targeted in SRWare Iron.

So instead, I’m posting links to those as I think this approach will allow someone to better (and more easily) create a customized privacy/browsing configuration for their own Chrome usage needs.

• Google Chrome Privacy Whitepaper - Provided by Chrome, this excellent web-page outlines just about all the most critical features in Chrome/Dev that interface with Google and/or third-party services and sites including,
  • “Ominibox” predictions - how to enable/disable
  • “Chrome Instant” - search results and in-line prediction serving/logging
  • Google search locale
  • Phishing/malware protections - how to enable/disable
  • Navigation error tips - enable/disable
  • Google Update - (and those component ID tags)
  • Installation tokens, Promotional tags/tokens
  • Usage stats and crash reports - enable/disable
    
• SRWare Iron Browser - A Private Alternative To Chrome? - InsanityBit - I found this post to be very helpful in understanding the benefits that I was seeking to have in SRWare Iron. It is pretty clear the writer takes a position against SRWare Iron’s advertised benefits over stock Chrome/Chromium builds. After reading you can do additional research and come to your own conclusions. I found it very helpful and it led me to personally drop using SRWare Iron and just stick with my own tweaked-out version of Chromium.
  
• Chrome vs Iron (Privacy Comparison) with Poll for Chrome users - MalwareTips forum - This discussion thread contains discussion (and content) based on the previous link. It also touches on the Dragon build version, and has some screen shots of privacy features options in Dragon.
  
• Google Chrome Security Settings and Configuration Guide for Enterprise - Root777 - Ajit Gaddam has a really super post that outlines recommendations for a more secure enterprise deployment of Chrome. Even if you aren’t deploying it in an organization, I found the discussion and points super-helpful. Lots of background information. Some changes are made in Group Policy Editor, but there are tips that can be followed for manual configurations.
  
• Policy List - The Chromium Projects - List of policies that Chrome refers to and uses. Note that Chrome and Chromium policy settings will have different locations in the Registry depending on build.

Rolling your own Privacy Build of Chrome - Assistive Tools and Tips

If you don’t like the idea of making a lot of manual setting and configuration changes, then there are a number of excellent utilities and Chrome extensions that can assist you with the process.

In fact, these may be the only tools and tips most average privacy tweakers of Chrome need.

• How to remove Google Chrome installation ID for anonymous surfing? - TechTrickz - These are two older tools that remove the unique “client_id” for your chrome browser. I can’t find a direct link to Abelssoft’s UnChrome tool any longer but some download sites still have it. Chrome Privacy Protector from Aquila is still around Chrome Privacy Protector. I don’t know if these will work with “portable” versions of Chrome or not.  In fact, according to this post Chrome to ditch unique ID, sort of via The Download Blog back in 2010, this feature should now be ditched.
  
• Privacy manager - Chrome Web Store - I really like this Chrome add on. It provides awesome granular control over primary privacy settings, cookie handling, and some network behavior. I can’t believe I haven’t been using this tool from the very beginning! For a deeper review, see this AddictiveTips blog post: Privacy Manager: Chrome Security Settings & Junk Data Cleaning.
  
• Privacyfix by Privacychoice - Chrome Web Store - this Chrome add-on allows you to make specialized privacy setting tweaks to your Chrome browser. It is really easy to follow and does a great job explaining the options and makes it easy to change/restore the settings depending on what you need to accomplish.
  
• Adblock Plus - Chrome Web Store - Block most ads in Chrome and the tacking stuff that comes with them.
  
• FlashBlock - Chrome Web Store - Block Flash media from auto-launching without your permission.
  
• Google Analytics Opt-out Add-on (by Google) - Chrome Web Store - Use to instruct Google Analytics JavaScript to not sent any info about the website you are on to Google Analytics. More tips and background on this particular privacy subject here: Keep Google From Tracking Your Every Move Online - How-To Geek
  
• How to Optimize Google Chrome for Maximum Privacy - How-To Geek - Additional tips and info on tweaking Chrome for privacy.
  
• How to Set your Google Chrome for Maximum Privacy|Set google for privacy - Hack How - Additional tips and info on tweaking Chrome for privacy.

Cheers

--Claus V.

Read More

For-Sec & Utility Jumble Linkfest

The short weekend is done. The “Sandy Watch” is on for what could be -- for our northeastern friends -- a storm event to be remembered for many years to come. So comes a pile of security/forensic and utility-minded links spill out below for the curious and information hungry.

Forensics and Security

Girl, Unallocated: Be Very Quiet... I'm Tracking Emails Through Headers - Girl, Unallocated Blog. The Girl has a great post looking at email headers and their bits and perils. One gem is a report (PDF) from Stroz Friedberg and a particular focus on email headers. The report as a whole is a great read and again provides a lesson in technical report writing and presentation as well as some forensics pushback on anti-forensics techniques. At 102 pages, it isn’t a brief, but well worth the time to download and study.

The Girl’s post reminded me of another great publicly-available report that addressed emails in a forensic investigation.  In my GSD post Interesting Malware in Email Attempt - URL Scanner Links, I wrote the following bits at the end:

A recent Digital Forensics Case Leads post has mention of a super-fantastic investigation/forensic report involving anonymous emails. This is must-read material, not just in terms of the investigative methodology but also the way the report was composed and presented. Very clearly done!  I’m keeping a saved copy of the report for future reference; both technically and as a report template. From the post via the link above:

“University of Illinois recently released a detailed investigation report (PDF) regarding anonymous emails allegedly sent by its Chief of Staff to the University's Senates Conference. The report is an interesting read, and also serves as a potentially useful model for those looking for report samples and templates.”

How a Google Headhunter's E-Mail Unraveled a Massive Net Security Hole - Threat Level @ Wired.com.  I almost overlooked Kim Zetter’s post on how Mathematician Zach Harris -- as an exercise -- discovered a flaw in some providers user of a weak DKIM key to sign emails originating from them. Fascinating and short read.

DEFT 7.2 and DEFT english manual, ready for download! DEFT Linux - Computer Forensics live cd . New DEFT version out. Last one in x32 bits. Future versions will be strictly x64 flavored.

Xplico – Xplico 1.0.1 - Xplico new version release just dropped. From the brief post:

ChangeLog:

• nDPI integration
• performace improved
• FTP dissector improved
• Added the prism dissector
• CLI execution bug fixed
• PCAP-over-IP SSL encryption
• IRC dissector improved
• File reconstruction from Fragmented Payloads improved
• FaceBook Chat updated
• FaceBook Message (partial)
• HTTP without initial packets (packets lost)
• RTP dissector improved
• PCAP2WAV, RTP2WAV interface added

And don’t forget! Now you can update/get via apt-get! for Ubuntu 11.04 and higher.  Sweet!

sudo bash -c 'echo "deb http://repo.xplico.org/ $(lsb_release -s -c) main" >> /etc/apt/sources.list'
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 791C25CE
sudo apt-get update
sudo apt-get install xplico

LastActivityView - Nirsoft brand new utility! - Use this new tool to view the latest computer activity in Windows operating system. Nir Softer has some more details on his NirBlog: New utility that shows general computer activity. Could be useful for incident response and analysis and other “quick peeks” for key system activity indicators to narrow down the search.

FileAlyzer Portable 2.0.5.57 (detailed file analyzer) Released -PortableApps.com

Hacking KeyLoggers - Open Security Research has a great post that not only identified a USB keylogging device, but takes it to the next level in hacking it to determine the impact of the device and when it might have been dropped. Clever stuff.

Attacking TrueCrypt - The H Security: News and Features. Another interesting post that almost slipped by me. Interesting by itself but also shows the benefit of using “cascaded algorithms” in TrueCrypt to thwart current attacks…for now.

Restoration of defocused and blurred images - Yuzhikov.com. This is super cool.  Vladimir Yuzhikov hasn’t just done a proof of concept for de-fuzzing blurred imaged (either out of focus or those blurred with a mathematical algorithm), no, he has actually released a free Windows app to demonstrate the possibilities. Besides images, text that is out of focus can be unblurred as well. This is very fascinating and could assist investigators facing images and other digital files with blurred faces or content. It’s not exactly easy or guaranteed to work, but it is very promising start and Vladimir notes he is continuing development and refinement. Read his work please and snag the download.

Google Drive opens backdoor to Google accounts - The H Security: News and Features . Quoting from the post, “The Windows and Mac OS X desktop clients for Google's Drive file storage and synchronisation service open a backdoor to users' Google accounts which could allow the curious to access a Drive user's email, contacts and calendar entries.”  read the post for more info. As usual it seems to be a convenience versus security trade-off again. Choose your cake wisely. I stick with using only the web interfaces and pass on the client versions of these cloud-based storages services…for now.

Virtualization

The TinyApps bloggist has been hard at work digging out great tips and techniques for importing the virtualized “Windows XP Mode” into popular virtualization software. As always, the posts are impeccable with lots of details and supporting source documentation for additional study and research.

• Import Windows XP Mode into VMWare Player - TinyApps.org blog
• Import Windows XP Mode into VirtualBox - TinyApps.org blog
• Must-have tool for VirtualBox users - TinyApps.org blog.

Oracle VM VirtualBox - Version 4.2.4 just dropped…by the way. I almost missed it were it not for my RSS feed filters. See the changelog for more details.  And be sure to grab the 4.2.4 VM VirtualBox Extension Pack as well.

Miles’ posts reminded me of an earlier GSD summer post Virtual Solutions and his great post comment guiding me to getting MS’s IE VirtualPC images running in Virtual Box.

How to run Microsoft’s IE VPC images in VirtualBox
http://tumblr.jonthornton.com/post/11405634980/how-to-run-microsofts-ie-vpc-images-in-virtualbox

ievms - Automated installation of the Microsoft IE App Compat virtual machines
https://github.com/xdissent/ievms

Browser Plugin Update Time…Again.

Yes dear readers, it is “Jack and Jill” time again. Bother.

Adobe Shockwave got updated, as of this post, the newest (Windows) version of Adobe Shockwave is currently 11.6.8.638.

• Adobe - Adobe Shockwave Player - direct download
• Adobe - Security Bulletin: APSB12-23 - Security updates available for Adobe Shockwave Player - Adobe
• Adobe patches 6 critical security flaws in Shockwave - ZDNet
• Adobe fixes critical Shockwave vulnerabilities - The H Security: News and Features

Adobe Flash was updated as well. Newest (Windows) version is currently 11.4.402.287.

• Adobe - Flash Player - version information
• Adobe releases 25 critical Flash patches - The H Security: News and Features
• Adobe - Security Bulletins: APSB12-22 - Security updates available for Adobe Flash Player - Adobe

Java also got a quick update to both build versions. Windows Java updates are available in 1.6.0_36 and 1.7.0_09.

• Java SE 6 Update Release Notes - Oracle
• Java SE 7 Update Release Notes - Oracle
• Java SE Downloads - Direct download

Trying to figure out if all your browser plug-ins are current can be a super-pain for the inexperienced and geekless.

My go-to recommendation remains to pop over to Qualys BrowserCheck in each of your installed web-browsers, be it Chrome, Windows IE, or Firefox. Alas, Opera, Safari, and other browsers are not currently supported, however a check in one of the supported browsers may quite likely uncover a outdated plug in, patching it may fix the others in the process.  For a backup check, hope over next to The Secunia Online Software Inspector for a second opinion.

If you want a good all-in-one location to manually download your plugs, check out Browsers and Plugins Downloads over at FileHippo.com.

Utility and SysAdmin Finds of the Week

Defrag Tools: #13 - WinDbg - Defrag Tools @ Channel 9. New video on Sysinternals tool usage; specifically integrating Debugging Tools for Windows.

Case of the CertUtil Import Refusing The Correct Password - chentiangemalc. Great practicum post on troubleshooting a strange password error where the password was correct but not being taken.

SpeedyFox - Boost Firefox,Skype,Chrome,Thunderbird in a Single Click! - CRYSTALIDEA Software . It has been forever…like dinosaurs roaming the earth eras ago…since I last saw any post anywhere on speeding up a pokey Firefox browser by “optimizing” the JSON databases. This is a dead-simple process to improve launch-time for a well-used Firefox browser. It’s been months since I last optimized mine. When I went to run SpeedyFox, my favorite tool to do so, I wondered if there had been an updated release. My version was at least a year old.  Happily I found there was a newer version, and that it now supports optimizing Chrome-based browsers as well. It remains available as a free edition. Current version is 2.0.3 but while I was sleeping, the developers have been adding support for Skype, Chrome (including SRWare Iron and Pale Moon), Mozilla Thunderbird, and Firefox (including Epic Browser). There is a Mac version (Firefox only) also.

If you use Firefox/Chrome/Thunderbird, stop, drop and run right now!  Did I mention it supports custom paths to your browser profiles so you can optimize portable versions on your drive/disks? Sweet baby Jebus!

CR2 Converter - I shot a lot of photos for Lavie and her family last weekend with the Canon 5D Mark II.  Pops asked for copies and when I was getting ready to pass them off, I realized I had not changed the setting from “RAW” only to RAW+JPEG. So I had over 300 digital images in RAW .cr2 format that his computer cannot read and that are not really a practical format for him anyway to use. Sure, I could batch-convert them in Lightroom/Photoshop, but I really just needed to get them quickly on a CD for him.  I have more than a few RAW freeware tools for tweaking individual RAW file images but that was too time-consuming to use. Luckily, with just a bit of Google diving, I found the freeware Canon RAW Image Converter “CR2 Converter”.   It supports batch-conversion and did an acceptable job for this task. My i7 x64 8 GB RAM system chewed through converting the files in no-time.  To my eyes the resulting images were a bit lightly purple-tinted…not bad or unpleasant but definitely noticeable when compared to the RAW file. Nothing that some simple color correction can’t fix if really important. For Pops it wasn’t but YMMV.  I wouldn’t use it everyday for batch processing but for quick-n-dirty RAW .cr2 to JPEG/JPG/GIF/BMP/PNG/TIFF conversions it is a super time-saver. Tuck it away for when needed in a pinch.

Cheers and hopes and prayers for the very best across the north-east seaboard as Sandy rolls in.

--Claus V.

Read More

Pile ‘o Linkage

CC attribution: "Chain links" by HowardLake on flickr.

Time to unload them…

Forensics

• Windows 8 Forensics - A First Look - YouTube video from ForensicFocus presented by Josh Brunty. appx 40 min.
• Digital Forensics Stream: VSC Toolset - GUI tool for executing batch files against a volume shadow copy. More details on the latest version in this VSC Toolset Update: File Recovery blog post.
• Windows Incident Response: Forensic Scanner - Windows Incident Response blog - Harlan has recently released a super assessment tool to get a fast big-picture view report of a system being examined. It is very simple to use and provides great data for figuring out if there are any important indicators to spend more time in a closer examination of the system. Download available at forensicscanner - ASI Forensic Scanner via Google Project Hosting
• Network Artifacts found in the Registry - Windows Incident Response blog - This is a RegRipper focused post but the previously mentioned Forensic Scanner also provides some network information; the WiFi info is quite useful on laptops to see where they have been traveling and connecting to.
• From Malware Analysis to Portable Clam AV - Journey Into Incident Response - Corey Harrell has a fun post read on identifying a malware binary and then creating a custom AV signature in ClamAV.
• New Archive of RegRipper Plugins - RegRipper has a new collection of current/updated plugins available if you haven’t snagged them recently.
• Live forensics: prefetch and powershell - 8 bits blog - using PowerShell in incident response.
• CAINE Live CD - computer forensics digital forensics - Release version 3.0 “QUASAR” is out with some updates and application additions.

Adobe Reader XI (11)

• Announcing Adobe Reader XI - New version of Adobe Reader is out…just when you were probably getting your apps finally coded to interact with Adobe X (10).
• Adobe Reader XI Deployment - Stealthpuppy’s Aaron Parker has some excellent as always tips on deploying it; including some customizations.
• How to configure Group Policy for Adobe Reader XI - Group Policy Central - Not to be outdone by Aaron, Alan Burchill also has some tips for using it with GP.

Network Bits

• Meet the successor to Microsoft Network Monitor! - MessageAnalyzer - TechNet Blogs. The successor to Microsoft’s NetMon packet trace tool is out in beta. I believe it is only supported on Win7/8. I’ve played with it a bit and NetMon users should quickly feed comfortable in it, although the GUI is significantly different in many ways. Testing captures on a Win8 RC virtual machine have gone pretty well. I’ve had a few crashes so more work does need to be done before final release in mid-2013. Definitely worth checking out though not likely to replace Wireshark or your other favorite network packet capture tools quite yet.
• New Release: Cisco Discovery for Windows v1.3 -What the.....? blog. - I’ve posted before of various ways you can trace down what switch port is connected to, all usually multi-stepped. If you have a Cisco based switched network, this new-to-me tool in a single executable might save a whole lot of frustration if kept handy on a USB stick.  Run it, pick your interface, get your CDP data…switch/port will be magically revealed. Sweet! Get the WinCDP tool here.
• WinsockServicesView - NirSoft - is a New utility to view, disable, and enable the installed Winsock service providers. Nir does it again with a super easy-to-use and helpful tool to catalog Winsock service providers on a system.
• Install NetworkMiner with apt-get - NETRESEC Blog. Yeah. It’s now that easy. Not like before in a previous GSD post: Network Miner Updating on Ubuntu 12.04
• Wireshark Tutorial Series. Tips and tricks used by insiders and veterans - Sniff free or die blog details a new Hands on with Wireshark YouTube video (11 min) by RiverbedTechnology that covers some basic usage tips.

For the SysAdmins

• How to find latest Microsoft Knowledge Base articles for Windows 8 and Server 2012 - Anything about IT
• FREE: Group Policy Search – Find Group Policy settings - 4sysops - Via this MSDN site: Group Policy Search
• DOWNLOAD: Group Policy Settings Reference for Windows (8) and Windows Server (2012) - Kurt Shintaku's Blog - See also: Group Policy Settings Reference Spreadsheet - Group Policy Team Blog
• Crash Course in Active Directory Organizational Unit Design - Windows Networking site.
• Case of the Domain Join Failure followed by Case of the Domain Join Failure II–Object Already Exists - chentiangemalc
• Enterprise Wireless Security – An overview - 4sysops
• Get Files Out of a Running Virtual Machine - Ben Armstrong Virtual PC Guy Blog
• How to diagnose Windows sleep problems - Tenniswood Blog
• 7 Cool Useful Command Prompt Tips You May Not Know - Windows7hacker
• Beyond good ol’ Run key, Part 2 - Hexacorn blog
• Windows PowerShell 3.0 download - Bink.nu summary of the new features in PS 3.0
• Download: WMF 3.0 - Microsoft Download Center
• PowerShell 3.0 - 4sysops - Krishna Kumar offers a overview of some of those newest features.
• PowerShell 3.0 overview – Part 2 - 4sysops - the review continues….

Utilities

• Updates: Autoruns v11.34, ProcDump v5.0, Sigcheck v1.8, VMMap v3.11 - Sysinternals Site blog
• Process Explorer v15.23 - Sysinternals
• PsPing - Sysinternals new CLI tool to measure network performance including bandwidth available between systems. Also can generate histograms of results.
• Rapid Environment Editor - Most folks won’t have any need to ever edit their Windows environment variables. But if you are a tweaker or geek or sysadmin, you might need to. This looks to be the tool for you! in addition it provides Error checking to highlight any problems with the entries. I had two “abandoned” items in my system I cleaned up with it. Really a nice portable tool to keep handy.
• MetroTextual 1.1 - SingularLabs - Minor update to a Win8’ish style notepad tool. I posted quite a bit about it earlier MetroTextual - Spirit of the notepad known as Bend...  This new version has some fixes and feature enhancements. However I noticed on my Win7 x64 system that while v1.0 seemed OK, version 1.1 garbles selected text. I like the newest feature adds but it remains a work in progress…which raises the same question Scott Hanselman of ComputerZen pondered: A Bug Report is a Gift.  What is the best way to report it to the developers…from within the app?
  
  before text selection…
  
  
  after text selection…
  Curious…
  
• HexDive 0.5 – Adding a bit of a context… & HexDive 0.6 – new strings and more -Context… - Hexacorn continues to make great leaps of improvement in the free and super-useful HexDive tool to look for interesting string patterns in files. Check it out!
• PeStudio 4.10 - Winitor - Speaking of binary analysis, PeStudio is a new-to-me tool to aid in application binary analysis. Cool!

New “Defrag” Tools Videos (and others also)

Microsoft/Sysinternals and their Channel9 team have really scored a home-run with their “Defrag Tools” video series. Each week (or sooner) a new quality video comes out..with clear file download links/formats…that reviews or expands an in-depth review of Sysinternals tools and usage.  I’ve already posted links for Episodes 1-6 and now we have 7-12 out.  I download these at home and tuck them away for replay on rainy days or presidential debates. Even when I consider myself very comfortable using a particular Sysinternals utility, walkthroughs such as these always leave me with a new tip/trick/configuration tweak that I didn’t have before.

• Defrag Tools: #7 - VMMap
• Defrag Tools: #8 - Mark Russinovich
• Defrag Tools: #9 - ProcDump
• Defrag Tools: #10 - ProcDump - Triggers
• Defrag Tools: #11 - ProcDump - Windows 8 & Process Monitor
• Defrag Tools: #12 - TaskMgr and ResMon

A great supplemental Channel 9 is The Defrag Show

See also this WEBCAST: Maximizing Windows 7 Performance: Troubleshooting Tips (1hr 1min) as found by Kurt Shintaku and add it to your video bag as well.

Google Fonts

Font geek? Me too!

I frequently hit the following sites looking for new and impactful free-use fonts for maximum impact on presentations and documents where having just the right font can add a punch of enhancement.

• 1001 Free Fonts
• Font Squirrel
• dafont.com
• Font Freak

So I got really excited when I found that Google has a web font collection (500+) under the Open Font License.

• Google Web Fonts - Google
• Google Fonts directory - Google
• Download and Install Google Fonts on your Computer - Digital Inspiration
• Download Reference Posters for Google Web Fonts- Digital Inspiration

Now this is really cool!.

Cheers!

--Claus V.

Read More