ForSec News Roundup

Final GSD post of the weekend. 

Strategies of a world-class computer security incident response team - Help Net Security - Carson Zimmerman presents “…ten fundamental qualities of an effective CSIRT that cut across elements of people, process, and technology.” Run-time is just over 33 min.

ProcDOT - Visual Malware Analysis - SANS Computer Forensics and Incident Response blog. Christian Wojner introduces it thusly…“It correlates Procmon logfiles and PCAPs to an interactively investigateable graph. Besides that ProcDOT is now also capable of animating the whole infection evolution based on a timeline of activities. This feature lets you even quickly find out which server or which requests were responsible that specific data/code got on the underlying system, by which process it was written, how often, who injected what, which autostart registry key was set, what happened when, and so forth ...” Get it via ProcDOT - CERT.at

From the ProcDOT project page:

Screenshot

Instruction-Media

The User Interface
Tutorial-Video 1: The User Interface
Tutorial-Video 2: The Graph
Tutorial-Video 3: Analysis (Part 1)
Tutorial-Video 4: Analysis (Part 2): The Timeline

Over at the ISC Diary blog, Mark Baggett has been posting a great series of articles examining the tug-and-pull between those in IT/Sec who advocate a full OS wipe/reload after a malware infection and those who say “save-time-and-clean-it” by removing the malware infection, but not reimage the system. There still seems to be some kind of mysterious desire by staff to possibly prove what a clever IT person we are by digging an infection out of a system rather than just recovering the user’s data, wiping the system, then restoring it from a clean image and putting the data back. Maybe we all want to be a hero. However, as Mark’s posts show, if not done properly and effectively, the malware may remain persistently hidden but functional and you may be back before you know it (and the rest of your data secrets lifted or network exploited). These posts are a good guide and gut-check for how challenging these threats can play hide-and-seek. Familiarity with these techniques might be your last line of defense if your shop doesn’t have a fast-n-hard policy of recover/wipe/restore remediation.

• Wipe the drive! Stealthy Malware Persistence Mechanism - Part 1 - ISC Diary blog
• Wipe the drive! Stealthy Malware Persistence - Part 2 - ISC Diary blog
• Wipe the drive! Stealthy Malware Persistence - Part 3 - ISC Diary blog
• Wipe the drive! Stealthy Malware Persistence - Part 4 - ISC Diary blog

Tracking Down Persistence Mechanisms - Journey Into Incident Response blog - Not to be outdone, Corey Harrell does a great companion-piece to the ISC Diary blog posts above.  Corey details how he uses Microsoft Autoruns utility in that process.

From one of the comments there, we jump over to Finding Evil: Automating Autoruns Analysis post over in the trustedsignal blog from Dave Hull.

And then in spot-on timing within the ForSec community, Mark Woan at woanware releases a new utility called autorunner. 

“Autorunner is based upon the AutoRuns tool by the Sysinternals/Microsoft gurus. It is designed to perform automated Authenticode.aspx) checking for binaries designed to auto-start on a host. Its primary purpose is to aid forensic investigations.

“…autorunner is designed to work around all of these issues. It will check against all user profiles associated with the host. It will parse out LNK files to the actual binary (one level down). It allows the user to specify multiple drive mappings, so that if the forensic image contains multiple partitions you can map the original drives to mounted drives on the forensic workstation.

“The application should be used against a forensic image that has been mounted using whatever method you desire.”

Securely wiping an SSD - TinyApps blog - Getting back to the drive-wiping thought, this quick-post reminds us of some of the hazards of attempting to sanitize a SSD device. Some might think using a SSD device to hold image captures might be a good idea but if you do, be sure it is one you can truly “zero-out” and sanitize before porting your image over to it! Does anyone use SSD devices yet for that purpose? What other challenges (cost aside) would this present. Are there any benefits to a SSD over a HDD for storing or capturing disk images?

Placing the Suspect Behind the Keyboard – NEW BOOK! - Windows Forensic Environment - Congratulations to Brett Shavers for his new book! It’s been added to my Amazon.com wish-list queue for triggering once my next Amazon.com gift certificate ship comes into port.

Tool Time - The Hacker Factor Blog - A great post in the theme of “know your tools” before you trust the results they provide. One of the gem finds in Dr. Neal Krawetz’s post is his link to the National Institute of Standards and Technologies (NIST) and National Institute of Justice (NIJ) 2012 Computer Forensics Tool Testing Handbook from their computer forensic tool testing program. It’s got 173 pages of goodness to review. The latest publications can be found on this Topical Collection: Computer Forensic Tool Testing Publication Database | National Institute of Justice.

4:mag Issue #1 - Forensic 4cast. A very nice and slick digital publication debuts. This edition covers topics in iOS device/application data & malware, starting out in the digital forensics field, and hard-drive secrets.

The students over at the Champlain College Computer & Digital Forensics department have been busy working on papers addressing Private Browsing. Expect more in this series:

• Private Browsing Forensics: Introduction - (PDF Link) Private Browsing Forensics: Introduction
• Private Browsing Part 2 - (PDF Link) Private Browsing Part 2

RegRipper Ripper (3R) and the list of reg keys covered by RR plugins - hexacorn bog.

RegRipper Consolidation - Windows Incident Response blog. Harlan and crew have been super-busy trying to clean house and tie up some loose ends in the RegRipper landscape. This new effort should help make “one-stop-shopping” and development support for RegRipper and plug-ins much easier. Additionally, Harlan has been working hard on the blog to post additional background information on some of myriad (Cory referred to 280+ in his post) RegRipper plug-ins.

Forensic 4cast Awards 2013 – Meet the Nominees - Forensic 4cast. Voting is now open. You can place your votes here.

Encrypted Disk Detector Version 2 - SANS Computer Forensics and Incident Response blog - Chad Tilbury announces and introduces a new version that is out. Get it here over at Magnet Forensics.

What is "up to date anti-virus software"? - ISC Diary.Great post and great discussions in the comments.

Case Leads: LivingSocial Hack, New Cyber Warriors, analyzeMFT update and more... - SANS Computer Forensics and Incident Response blog

Cheers!

--Claus Valca.

Read More

Rain-Delay Linkfest

After an exceptional season of drought here in Texas, it looks like things are starting to change. We are facing at least five days of rain; heavy downpours mixed with long periods of light grey drizzles.

Planned yard-work long since abandoned.

Perfect weather for emptying the “to-be-blogged” hopper.

System Security

Time for new Flash updates. These are for the mainstream 11.1.x line of Flash builds. If you are running the 11.2.x line of beta Flash, I figure you are keeping up with those already.

Flash vulnerability exploited to deliver malware - Help Net Security has some good details about a threat that was patched as well as how it was flagged and described by security researcher Mila Parkour. While this Adobe rushes out critical Flash update post over at Ars Technica has some more details about “…the vulnerability, discovered by Tavis Ormandy and Fermin Serna of Google's security team, affects Flash players on Windows, Mac OS X, Linux, and Solaris operating systems, as well as Google Chrome and Android.”

I use these links from File Hippo for my Flash updating needs. Whatever source you prefer to use go get’em.

• Download Flash Player 11.1.102.63 (IE) - FileHippo.com
• Download Flash Player 11.1.102.63 (Non-IE) - FileHippo.com

PSI 3.0 Beta Launch -Secunia is rebuilding their Personal Software Inspector tool to now not only find and notify you about missing security updates and patches needed for applications and plug-ins on your system, but also make it easier to apply those found patches and updates in-application rather than hunting them out yourself. It is still a work in progress but should provide a good tool to help in the process.

Microsoft Security Bulletin Advance Notification for March 2012 - Microsoft Security TechCenter. MS Windows updates coming soon to a system near you!

Getting Inside the evil

I’ve really been enjoying Troy Hunt’s writings, both current and browsing through the archive material. These two posts were exceptionally eye-opening. Troy does an excellent job showing the process by which these scams work. Get out the notepad.

• Scamming the scammers – catching the virus call centre scammers red-handed - Troy Hunt
• Anatomy of a virus call centre scam - Troy Hunt

Introducing Adobe SWF Investigator - Adobe Developer Connection. New beta tool making the rounds on various security sites. Based on the Adobe AIR platform, it will help with SWF analysis from both static and dynamic angles.

Examining VSCs with GUI Tools - Journey Into Incident Response blog. Corey Harrell does a great job in showing methods to work with Volume Shadow Copies containers.

Browser Things

Password Generation - The Chromium Projects. We’ve touched on passwords here at GSD quite recently. This new component of Chrome development is pretty interesting. Having the built-in-browser ability to quickly and easily generate complex passwords is pretty cool. I hope some form of this feature matures into the mainstream builds.

Speaking of Chrome, for the longest time I have been using a portable build of Chromium (DEV builds)coupled with an updater application from Caschys Blog. Once a week or so I hit the updater and it finds and downloads/installs the newest version available from the source repositories. Unfortunately I wasn’t paying attention to what (or what not) was actually happening. When I recently saw the latest DEV build level in a RSS feed, I finally went back and checked what my Chrome DEV build was and it was WAY behind. Seriously WAY WAY behind. Bother. So now I am using this Google Chrome Portable page and scrolling down the the portable DEV build link. Updating is just a matter of downloading the file, and pointing it to the exiting location and overwriting it. If you are porting over your profile and extensions over from a previous portable version, the location they go into turned out to be quite different from the earlier portable DEV build I had been using.

It is now located in this folder location: “ …\GoogleChromePortableDev\Data\profile\Default”

Once I had my Chrome profile ported out of the old DEV version and into the new one, the difference in the builds was significant.

Mozilla’s Collusion tells who’s tracking you - Mozilla Links. Worth a look.

2-step verification - Google Apps Help. Google has a optional 2-step verification option to enhance the security of your account login process. FYI.

Freeware of Note

usboblivion - Google Project Hosting. Anti-forensics-like tool to purge USB history of USB-connected drives from Windows registry. Question: does use of the tool leave any tracks of its own behind? Spotted via this Addictive Tips blog post: Delete Record Of Previously Connected USB Devices Using USBOblivion

Rufus - Create bootable USB drives - Really neat and slick bootable USB creator tool. More details on these reboot.pro pages: Rufus and Rufus (introduction topic).

NTFS Permissions Reporter - Cjwdev - offered in both free and $ versions. Windows already has built-in methods to look at NTFS permissions but this is a nice GUI tool that some might find more useful at providing a wider-view on the permissions. Spotted via this Addictive Tips blog post: NTFS Permissions Reporter: View Access Permissions Applied On Folders.

regshot - Via SourceForge. Another tool to do before and after registry diff’ing. More details at this CybernetNews post: Monitor Registry Changes in Windows.

File Extension Monitor - NoVirusThanks - free/portable tool that allows real-time monitoring and logging of files created in the system. Great to run during setup files or to trace droppers/activity. Spotted via this Addictive Tips blog post: Monitor File Creation Activity Across Disk Volumes With File Extension Monitor.

HijackThis was my #1 go-to malware busting tool in the very early days of my IT career. I would use it slice-n-dice auto-run entries and bring back law-and-order to a malware-hijacked system. Over the years as my knowledge and skillset grew and tools matured, I’ve come to rely much more now on the Sysinternals Utilities. A one-two punch with Autoruns and Process Explorer coupled with the all-seeing-eye of Process Monitor typically provides me the hammer needed to bust into a hijacked system. So it was with fondness that I read this HijackThis now open source post at The H Security. I really hope that this move now gives new life and capability to this classic tool.

Peeking at NAFT - Didier Stevens is going crazy teasing us with a new project; a new forensic toolkit he is developing the “Network Appliance Forensic Toolkit (NAFT)”. Ooohhh!

Ezvid - Free Movie Maker and Slideshow Creator For YouTube. Spotted via this Addictive Tips blog post: Create Image & Video Slideshows With Narration Using ezvid.

Microsoft Research Cliplets - Neat project from MS Research that takes a digital video short, and allows you to isolate just a section of the motion. When exported the result is a static image with a section of movement. It’s a cool effect.

Multi-Image Fusion - This Microsoft Research project appears to be aiming as the next generation of Microsoft Image Composite Editor, or ICE. They have a 305-image composite on the page as a teaser. I love ICE but sometimes when I have a complex series of images and try to drag/drop them into ICE, it cannot stich non-sequential images into a composite. Related: Hugin - Panorama photo stitcher

For Sysadmins

BETA: PowerShell v3 Technical Guide (CTP2) - Kurt Shintaku's Blog

Service overview and network port requirements for the Windows Server system - Microsoft Support Article ID 832017.

[Review] God's Jury: The Inquisition, IT & Privacy - ReadWriteWeb. Curt Hopkins has a book review. What is really fascinating to me is how new technology can make the evils of dark history past relevant and accessible again with the dizzying pace (again) of information aggregation. Amazon has a Kindle version that will soon be making an appearance here in the Valca home.

Network Stuff

Nmap 5.61TEST5 released with 43 new scripts,improved OS & version detection, and more available for download - ISC Diary

Wireshark and Pcap-ng - Wireshark blog - news that Wireshark 1.8.0 will have two new features: concurrent capture from multiple interfaces and packet annotation. These changes appear to rely on pcap-ng file formats. Hopefully applications that rely on the pcap format will adjust and add compatibility for the pcap-ng format but if not, be sure you save your captures in a format that can be imported (or exported into) a file format compatible with your NFA tools.

Detecting sniffers with HSD - Hexacorn blog. Free tools and techniques for detecting the presence of network sniffing activity.

Tony Fortunato over at the LoveMyTool community blog has a video showing Using Pathtest for Performance Measurement. PathTest is a free tool to test network bandwidth capacity between two endpoints using packet-flooding techniques. This is a serious tool so use carefully and during non-production hours unless you (and your customers) really, really know what you are doing and why you need to do so. Cool tool!

Cheers!

--Claus V.

Read More

Solving the DSL<-->WiFi<-->Nook<-->In-Laws Equation

The Valca home is and has been an Amazon Kindle only zone for some time now; thank you very much.

So last year Lavie decided that the E Ink keyboard one (of two) that we had was a bit uncomfortable for her (and not back-lit). She decided to move over to a B&N NOOK Color model. This was in the pre Kindle Fire days so I guess we could tolerate its presence.

The Nook Color served her well enough but when the Kindle Fire came out she had to swing back. It finally arrived last week as a back-ordered Christmas present.

Fortunately, she hadn’t purchased very many books for the Nook so we didn’t deal with trying to see if there were any options for porting her books over to the Kindle. It was an opportunity for a fresh start.

So, she passed her Nook on to her parents a few weeks ago and they loved lot. A lot.

They are on a DSL broadband service, and have a wired XP desktop system. One cable to rule all Internet service. No WiFi except when we stop in for an extended visit and I bring my D-Link DAP-1350 Wireless N pocket router and take over their single network connection for the weekend. Nice but not a permanent WiFi solution.

I suppose we could have just taught them to connect the Nook Color to their desktop via USB and manage it directly but it seemed time to add a WiFi router to their humble network and just do it right.

So that was this Saturday’s “honey-do” and this post is the process we had to go through to upgrade their DSL network and get the hand-me-down Nook color fully transferred over and set up for them.

First Part of the Equation: DSL<-->WiFi

First I picked up a WiFi router. I went with what has become my perennial favorite: DIR-655 Xtreme N Gigabit Router from D-Link 

I’ve had this unit personally for a number of years and is rock solid, has both the “N” and older wireless standards, has a rockin-long range, and is super-easy for configuration. The power was important in this case as the location of their DSL modem is on a second floor above-garage room pretty far away from their usual living areas. The signal will carry all the way downstairs and up. Check. And since it is the model I also own and maintain, I know and am comfortable mucking around in the settings. Makes providing extended support much simpler when a problem arises.

Typically I’ve been able to get away with just unbox, connect, run-wizard from CD config, then go and make some manual setting tweaks afterwards. However, this 2-wire DSL modem was a real headache. I could set up the internal network and WiFi perfectly. Just couldn’t get to the Internet through the DSL modem. Plugged the DSL modem Ethernet back to the PC and it was working, reconnect to the DIR-655 and it wouldn’t'.

Long story short, I eventually figured out that for their particular hardware and provider, I had to do a few more custom tricks.

I had to set the Internet Connection Type to PPPoE and enter their DSL username/password. (I got that from their email client settings.)  D-Link has a nice Emulator for this router to play around with: D-Link DIR-655 RevB Emulator

Then I had to go into the Network Settings and change the router IP Address to use 192.168.1.1 from the default IP address of 192.168.0.1   Turns out that the default IP address was conflicting with the internal Ethernet-facing IP address provided by the DSL router. This was the real trick.

Once I got the network stabilized, I tested the configuration survivability by powering off both the DSL modem and the D-Link (to simulate a power-failure), then powered them back and and made sure the PC could get to the Internet. Check.

This one was actually a DIR-655 RevB model so I then saved my configuration file, downloaded the latest firmware and ran an upgrade. Success. Naturally it lost all of my settings, so I had to upload my saved config file and it was back to normal. Yea me!

More helpful notes I had to find to work out that issue:

• DIR-655 & ATT DSL - D-Link Forum
• [Solved] Dir 655 problems - Setup-Configuration-Security - Wireless-Networking
• 3.15 D-Link Info AT&T Southeast Forum FAQ - DSLReports.com, ISP Information

So now I had taken care of the DSL<-->WiFi router part of the equation. Next the Nook.

Second Part of the Equation: Nook<-->In-Laws

This actually was almost harder than getting the router added.

Because the Nook was a hand-me-down, Lavie had it configured with our WiFi settings, her name, and the account information. She said she didn’t mind if her parents just kept it that way and we just change the billing information on the account. However, she had followed bad password security and used the same information she has used on several other of her on-line accounts. I needed to break that clean.

The rub was that Lavie had already purchased some books for her dad under her Nook account and I didn’t want to loose them. What I wanted to do was to figure out if/how I could transfer the B&N account she had set up over to them and remove Lavie’s information and add-in theirs.

Here’s what I had to figure out doing to keep the original Nook account (and purchased items) but swing it fully over to the in-laws “clean”. Note this was a serious trial-n-error process that took almost two-hours longer than it should have (by my reasoning). This is the “clean” version and from what I later read on the web, seems to be the only way currently I know of to “transfer” a nook from one email/owner to another one while preserving the purchased items.

Note: Lavie didn’t have any files or items on her Nook that were not already associated in her Nook account (like manually installed music/videos/pictures/stuff) so I didn’t have to deal with the loss of those in this process. If you have those on your nook and want to preserve them, you probably want to off-load/copy them to your PC first before beginning this process. Again, this assumes everything you want to keep is safe and and associated in the B&N account you will be restoring from. YMMV. So you were cautioned, so you were warned.

1. Take your Nook (the one you want to change the owner name/email account info on) and go into the settings and find the option to Unregister/Erase your Nook. Do this first. Really. BEFORE you do ANYTHING ELSE. It sounds serious and I guess it is, but that’s how the Nook rolls.
2. Once your Nook is reset, log into your B&N account from the BN.com page. If you can find the login link on the page. Seriously. I was using Chrome and it took me ten minutes to realize that tiny gray bar (which perfectly matches the address bar gradient and bookmark text in Chrome at the very top of the page) with the tiny text is the login location. Sheesh. Hey B&N. Can you make it a bit more obvious please?
   
3. Now change your name in the account. I changed it over from Lavie’s name to the in-law’s.
4. Change to your new email address in the account. Changed from Lavie’s to the in-law’s.
5. Change the password if you desire…I did so desire and changed to a complex full 15-character (most allowed by B&N) password.
6. Change the Shipping/Billing addresses as needed. Now set to the in-law’s.
7. Change your secret challenge question if needed. Selected and changed as picked by the in-law.
8. Update the associated credit card information. Definitely the in-law’s here!
9. Etc.
10. Once all the account information is updated to the way you want it and saved, make sure you can successfully log-in/out of the account. Good? Great.
11. Next fire up the now reset Nook and go through the setup process from scratch.
12. Accept the Terms of Service.
13. Set the Time Zone.
14. Connect to a WiFi network. It found the WiFi network I had earlier got working, I fed it the secure passphrase and it connected perfectly and strongly.
15. Register the Nook. (I passed it the updated email address from above and the new password.)
16. It Registered and identified perfectly as the in-law’s nook now.
17. Yea me!
18. We went to the Library and told it to refresh and all the books previously associated with the account flowed back down and “installed” without any issue.
19. I then went to the applications and downloaded the waiting previously purchased/associated apps. Perfect!
20. The Nook was now fully theirs.

Equation Solved: DSL<-->WiFi<-->Nook<-->In-Laws

We spent another hour or so going though the list of free NOOK Books at Barnes & Noble. We found a good selection of mystery and history classics to keep them both occupied for the next couple of months. Pop also found a good old-west history book to purchase as well. It was good training process and confirmed the purchase/credit-card association with the account worked.

Mission accomplished, five hours (and one super-awesome BBQ baked-potato for lunch) later, the equation was solutioned.

Additional Notes:

• Daughter hovering over your shoulder on the back of the couch while you have your laptop and the Nook balanced on your lap troubleshooting. Like a vulture lurking. Not helpful.
• Daughter making organic microwave popcorn and snuggling up munching away while you have your laptop and the Nook balanced on your lap troubleshooting. Also not helpful.
• Daughter not asking once to borrow your laptop to check out the WiFi and Facebook while you are troubleshooting. Very helpful and appreciated.
• Sense of patience and humor from all participants; self, daughter, in-laws. Very helpful.
• Extended road-trip to in-laws up and back with daughter on beautifully clear and cool day through the east-Texas pines lined country roads. Priceless.

Final thoughts.

Lavie had successfully set up her Kindle Fire just fine by herself (thank-you-very-much) so I didn’t get to participate in that except for applying a smokin-hot DecalGirl skin she had picked out for her Kindle (my hands are super-steady for such things). She had also picked up screen protector but turns out that it is a full edge-to-edge cover which would cause issues with the DecalGirl skin on the front (which frames the blacked-out display edge portion). I suggested trimming it down so it fits inside the DecalGirl border but she passed on that for now…so it remains uninstalled at the moment.

Alvis and I both have the WiFi-only version of the E Ink Kindle model and we love them. Light, super-durable, and the charge lasts a long time.

Last night Lavie did ask me to copy some songs from her iTunes playlist to the Kindle Color. You can do it a few ways, apparently most popular is to upload music from your PC/Laptop to the Amazon Cloud Player service. What I ended up doing was to connect Lavie’s Kindle Fire directly to my PC (which holds our iTunes library) via USB, then opened iTunes, opened her play-list, sorted it by album, then I selected a song, hit the three key-combo “Ctrl-Shift-R” which opened up the location of the file itself on the library, selected any additional songs in her playlist from that album, copied, then pasted them in the Music folder on her Fire. Repeat as needed.  It was a bit slower but got the job done. All of them appeared to be in the compatible .m4a format and I didn’t find any .m4p that would not have been supported.

She was jammin…though I left her to work out creating a new playlist from those songs directly from within the Kindle itself.

Adding photos/videos would be the same process, locate on your PC, drag/drop into the correct folder on the Kindle when it is attached via USB and shows as an external storage device. Piece-o-cake.

Based on the (admittedly still limited) time I spent on both the Nook Color and the Kindle Fire, I found the Kindle Fire was more to my liking. I could navigate around the Nook Color and it was pretty intuitive (never did get around to reading any manuals on either one) but I did like the “hand-feel” of the Kindle Fire better. And the navigation just subjectively felt better to me on the Kindle Fire than the Nook.

Since I am (for now) a hard-core Kindle E Ink format lover, the extra bells-n-whistles of the Kindle Fire haven’t captured my eye yet, so I cannot comment on app-support and performance of videos/games/applications between the Nook Color and Kindle Fire.

The other think I noticed while helping set up the in-law’s Nook was the apparent lack of easily found free E Books directly within the B&N Nook store. Searching for E-books at B&N was a super-pain as well. In the end I had to do a Google Search to find this “all-in-one-place” location for Free NOOK Books.

When I first got my Kindle, right on the Amazon Kindle pages I found this Amazon.com: Free Book Collections: Kindle Store link. In no time flat I had downloaded almost twenty amazingly awesome classics from literature, philosophy, religion, and reference. All free. I’ve since moved on and expanded my collection to include many additional eBooks I’ve found scattered on the net including some great ones in PDF formats and I have made a number of eBook purchases for the Kindle as well. That smooth and awesome experience jumping into the Kindle right-out-of-the-box probably helped solidify my personal leanings towards the Kindle platform. I’m sure there are lots of additional Nook-compatible ebook formats and ways you can get them to your Nook, but for the in-laws, having in-store access to locate and select-to-download-direct to their Nook has a lot of appeal.

I’ve got a lot of great Kindle resource links saved and building for a GSD Kindle post…along with some cool technical and for/sec bits related to the device I have found as well. Hopefully that will come soon.

Anyway, hope this helps someone else trying to get their DSL <-->WiFi<-->Nook<-->In-Laws equation to balance out and solution properly.  Now I remember why I found Calculus so challenging. It was a real love/hate relationship and this turned out to be very much the same.

Cheers!

--Claus V.

Read More

Books, Networks, Security, and Forensics

The little-brother endowment for big-brother improvement has allowed for the recent expansion of my technical library by three more volumes.

I have just ordered the following books after a long wait in my wish-list pile:

• Network Warrior: Everything you need to know that wasn’t on the CCNA exam by Gary A. Donahue (Amazon.com)
• Mastering Windows Network Forensics and Investigation by Steven Anson, Steve Bunting (Amazon.com), and
• Windows Forensic Analysis DVD Toolkit, Second Edition by Harlan Carvey (Amazon.com)

I had flirted with also picking up the Wireshark Network Analysis: The Official Wireshark Certified Network Analyst Study Guide by Laura Chappell, Gerald Combs (Amazon.com) but decided instead to invest in a Canon Speedlite 270EX Flash (Amazon.com) for our Canon Rebel DSLR as all work and no play makes Claus a cranky boy.

The first two selections reflect an expansion and recognition that understanding and analyzing network traffic can not only complement Windows systems forensics and incident response, but in some cases be the canary in the mine that signals something much larger is going on worthy of focused investigation at the machine level.

A recent series of events have driven both these points home to me in a very powerful way.  So I really am excited waiting for their arrival.

As for Harlan’s book, it really is one of the cornerstone books of Windows forensics and I’ve really felt weaker for not having read it yet.  I’m truly honored and stoked to be adding it to my bookshelf.

The nature of my work demands that I approach things from an holistic approach and I really hope that the combination of these materials gives me a sharper edge in analysis as well as how all the parts can better fit together.

In the News:

(IN)SECURE Magazine issue 27 released - Great security and risk-management articles in portable PDF reading format.  I’m always waiting for the next edition!

Hiberfil Xpress and FTK Imager 3 posts - Forensics from the sausage factory.  DC1743 tears into the Hiberfil and touches on it’s compression as well as new support (script) for examination via EnCase.  The second post points out the awesome and free forensic image capture tool (and then some!) FTK Imager 3 is now out from AccessData.  This newest version does require a system-install, but they have also released a bumped version of their free/portable “Lite” version to 2.9.0. Go get’em!  AccessData Product Downloads

CAINE 2.0 Live CD - “NewLight” computer forensics digital forensics - LiveCD Distro - I was unexpectedly surprised to discover CAINE 2.0 “NewLight” was released in the past few weeks.  CAINE and DEFT both are my current favorites for Linux-based “LiveCD” distros and are jam-packed with complimentary toolsets.  CAINE 2.0 has a fresh look and updated features all the way around.  I’ll save post-space here by not posting a list of all the new and updated feature-sets, but suffice it to say, it really  is super-slick and just like mighty-mouse, lots of power in a small size!

Gift Card FAIL: What do sequential numbers and shopping sprees have in common? - PaulDotCom - Yeah…worrying.  Besides the obvious issues, what really stands out to me is that I’m not the only one who can’t seem to turn their brain off from security/incident response musings…even when off-the-clock.  Every situation and every place presents opportunities for mental security pushup work.

Asset Tags For Dummies - Liquidmatrix Security Digest.  Part II from the theme above.  Really, we also stick honking-big asset tag stickers prominently on our equipment that can be read from 10 yards or greater away, with enterprise name and everything.  Plus the brand of our whole-disk encryption provider on a separate sticker.  “So we can tell which systems are whole-disk-encrypted” easily by just looking at the case.  At least that was the justification provided.  Really?  Can we?

Memory forensics on Windows 7 (x86 and x64) and Windows 2008 x64 and Avoid the Knee Jerk Reaction -M-unition Blog.  Two great posts from the MANDIANT gang including the announcement of the release of Memoryze 1.4.2900 which has added support for Windows 7 64-bit, Windows 7 32-bit, and Windows 2008 64-bit along with the previously supported platforms.

Free Malicious PDF Analysis E-book - Didier Stevens.  Go grab it now!

FireMaster : The Firefox Master Password Recovery Tool - SecurityXploded.  Free tool to recover the master password from Firefox.

Symantec’s w32_stuxnet_dossier (PDF) is a perfect model of how a incident/threat analysis report should be written.  It seems to set a new gold-standard for informative analysis and technical writing for malware/threats.  Wow!

Tshark/Wireshark SSL Decryption - Lessons Learned - PaulDotCom - Mark Baggett has written a great tutorial on how to configure Wireshark to decrypt SSL packets.  Great stuff.

PrefetchForensics v1.0.3 : woanware - Mark Woan has made some improvements to this free Windows Prefetch file analysis tool.  Update your copy now!

Forensic analysis of "Frozen" hard drive using Deep Freeze - Computer Forensics, Malware Analysis & Digital Investigations.  Deep Freeze is one of several “steady-state” system solutions that “restore” a Windows system back to a predefined configuration when the user’s session is over.  In theory this should erase all tracks, but as all good forensicators know, there’s gold in in the streambed one you dig just under the surface a bit!

Xplico » Xplico 0.6.0 - Just released!  Xplico is a Linux-based tool that allows for reassembly of network traffic browsing sessions.  I’ve been having to use it quite a bit lately and find as I get to know its capabilities better, I am floored by the power and benefit having this tool in my arsenal brings me.  I’m planning a followup post on Xplico very soon here at GSD.  Stay tuned!

Happy Digging!

--Claus V.

Read More

Just a Note or Two and some SteamPunk

cc attribution: Notebooks by See-ming Lee 李思明 via flickr

Wow.  Can’t believe it has been this long since the last post!  What’s sad is that very little of it has been spent on the new laptop.

Mostly bad-crazy work stuff leading me to be exhausted by the time I get home from work. Then honoring time and family commitments on the weekends.  So much to post…so little time.

On the plus-side I’ve been able to really put some of the tools and techniques I blog about into incident response action lately.  While it is never a “fun” thing to have to do, it is pretty cool when you get to apply your knowledgebase in extreme situations.  While (unfortunately) it’s very doubtful I will share any information at all, I do expect to share some more information on tools and techniques I found valuable in the process.

I’m taking a break at the moment from technology posts to go a bit “old-school”.

While I generally use QCC’s freeware tool CaseNotes to document my incident response activities, and find it really does an excellent job fitting my needs I almost always keep a pen and micro-sized paper notebook on my person as well.  Beats writing on my hand and is great for jotting down phone numbers, bits of data, field observations, quotes, URL links, etc.

I’ve been thinking of this lately as I saw some Moleskine mini-notebooks a few weeks ago when visiting the bookstore with mom.  I didn’t pick any up but they did catch my attention.

Then The Art of Manliness blog ran a series of articles that really encouraged me to use them that much more:

• Pocket Notebooks: A Brief History
• The Pocket Notebooks of 20 Famous Men

The comments in the first post were a treasure-trove of links and materials for the notebook carrying fan.  I found a number of great sources for fun and functional mini-notebooks.

Field Notes - Seemed to be one of the most popular sources for no-frills “common-man” notebooks.

Rite in the Rain - Was praised by field workers, outdoorsmen, military/LE, and other extreme environment folks.

Moleskine - This brand seems to have splashed onto the market with much fan-fare.  The quality and variety seems to make them very popular with note-takers and artists alike.

Right now, I am using these Top Flight Sewn Mini-Marble Composition Books (Amazon.com) that Alvis tossed my way.  They fit unobtrusively in my front pocket and are surprisingly durable.  They are very cheap…so I tend to toss them when all the note taking is over and they are filled up.  Not really archival material.

I had been using these Mead Wirebound Memo Books (Amazon.com) but the wire ring would get crushed after a few days in my pocket and the pages tore out too easily.  So I just keep one in my car only for quick notes but that’s it.  It will likely be replaced soon.

These Writersblok Bamboo Mini Notebooks looked like a cheap and nice alternative to my current notebook fare. Made by K I K K E R L A N D, they seem high quality and fit the quirky and fun other products offered by them.

Turns out there is a whole fan-following of notebook bearers!

I’ve scored a few new RSS links for some sites that live and breath all things creative and useful with notetaking and notebooks.

• moleskinerie - a  bit spare in style but I think that’s the point.
• Notebook Stories: A Blog About Notebooks, Journals, Moleskines, Blank Books, Sketchbooks, Diaries and More - definitely worth saving and checking in on.
• Rhodia Drive - That little orange notebook.  I like the detective-style hard flip cover.
• The Notebook Addict - Reviews and perspectives.
• The Well-Appointed Desk - Writing and Work Desk candy.
• ’skine.art - Moleskine Art - I sooo wish I could do this.
• notebookism - tips, leads, hacks, and the smell of fresh paper and bindings…
• Trains, pens and planners - thoughtful thoughts on notes, life, and mono-no-aware.
• Museum of Notebooks - Notebooks from around the world.
• Urban Sketchers - I so really need to dig out my sketchbook an ink-pen set……

The Little Black Book by Pad&Quill - This was pretty clever…and inspired me.  I’m overwhelmed at the moment with ballistic nylon carrying cases for all my portable hard drives and gizmos.  After looking at this, I was struck with how easy it would be to stop by ye-old/used-bookstore and pick up some tomes that had outward character to their binding and cover.  Then hollow them out to make carry-cases for the portable USB HDD I carry.  Some glue and some tiny metal/magnets to hold the lid shut and bam--pretty neat carry-case!

SteamPunk Resources

As a Sherlock Holmes fan, I appreciate the romantic notion of the Victorian era (but accept the Dickensian reality).  Add to that the fact that Last Exile is based heavily on a “SteamPunk” styling and my artistic eye is smitten.

Turns out there is a whole fan-base devoted to making and living SteamPunk style.

Steampunk Wallpaper is a very recent find that has provided a ton of awesome high-quality desktop wallpapers in the SteamPunk/grungish style.  Really stunning work here by the artists.  Even if you aren’t a fan, you are bound to find something appealing.

The Steampunk Workshop | Technology & Romance - Fashion, Style, & Science - Ongoing web-site filled with the very best examples and guides to SteamPunk hardware and software.

The Steampunk Home - Neat ways to add that anachronistic touch of class to your home; many with commonly available materials repurposed.

SteamPunk Magazine » Downloads - Free PDF downloads of SteamPunk Magazine.   Very interesting articles and perspecitves…to say the least!

Happy notetaking and jotting!

--Claus V.

Read More

Been too long…

Yep still here.

As Alvis has commented more than once recently in a wicked tone, “Dad’s been busy getting to know his new mail-order-bride.”

While not nearly as salacious as it sounds coming from her, I’ll save that info for a follow up post. However she is partially correct.

Last Monday, I had planned a relaxing Labor Day holiday chilling out at home catching up on blogging and clearing some pieces of work.  Mom had called however and decided she needed some out-and-about activity with son #1 since son #2 was living large in Colorado on a respite before leaving fair Texas for an long term work-assignment in a foreign country; Baton Rouge, LA.

So mid-morning I drove over to Mom’s, loaded up the car and pointed it to the shadow of downtown Houston.

She had caught a local news piece on the local Houston connection to the movie Mao’s Last Dancer and was determined to see it before it left the single screen that was showing it.  It’s got flashbacks to communist China and the humblest of villages, ballet, opera, love, ballet dancers, Houstonians, Houston sights and scenes, ballet dancers, a famous local lawyer and an international showdown.  And the F.B.I. makes an appearance at least once.  What’s not to love! Right?

Anyway I’d seen neither the trailer nor the news piece so was suspicious but a good sport.

We drove over the the 1930’s-era River Oaks Theatre, found one of the few parking spots that didn’t have a “30-min shopping only” sign painted boldly on the hot black pavement and stood in line for the tickets.  (Only later would I spy the nice super-new parking garage hidden across the street from the theatre. Oh well…next time…)

While I have known and heard of the River Oaks Theatre, I’d never been inside.  It reminded me instantly of a similar home-town one long since crumbled that I used to go to as a kid.  This one has been lovingly cared for by a devoted staff and brings back an instant ambiance of the golden-screen days.  The seating was very comfortable and I felt we were falling back in time. Well, had it not been for the fancy Hagan-Daas ice-cream bar mom was munching on.  The theatre specializes in international, art, and foreign films that would almost never see the light of projectors in the local mega-movie-plex.

It was a very full house.  And the movie was really good.  Sure, some of the Houstonian stuff seemed a bit over the top, but I guess that’s how most of the world thinks we talk. (We don’t.) And there were some local scenes in the background shots that were not period to the ‘80s.  But small quibbles aside, it was a very impactful movie.  Like most in the audience, I was leaking man-eye-sweat at the end of the film.  Definitely recommended and worth seeing.

Afterwards, Mom wanted to go across the street to the B&N to replace a Julia Childs book she has lost.  I got a bit sentimental (maybe it was from the movie) but it was strange.  Right inside the entry was a kiosk where a clerk was demonstrating the benefits of an e-book reader to folks, selling units, and books.  Time is turning my friends.

I worked in the local library growing up in my teen years and used to love the proximity and time spent among the shelves.  It was a perfect job. Now I seem to dash into the bookstore for a technical book, and dash right out.  Not with mom.

We lingered.

She looked at the tables, opened up random books, chatted away, and just was present there.

That forced me to be so as well.

And I noticed lots of books again; history books, cartography books, novels.  Their covers carefully planned to invite and entice.  Best sellers and bargain buys.  One shelf was filled with strange and unique books, selected by the local employees, with little cards on the shelf edge. The cards had the staff-member’s name and a single sentence why they loved it so much and recommended it.  The comments were more wonderful and mysterious than any ad-campaign or glitzy display. It was humble and seemed genuine.

And as I stood there surrounded by all the books two things struck me; that these books represented so many new authors trying to get started and old ones firmly established, all telling their own, special story, and that I probably was like many now, in too much of a rush to linger and let the books and stories seduce me as they used to so passionately, instead being addicted to the mad-hose-pipe flow of RSS feeds, Internet media, and that damned moving picture screen in our living-room.  What will such book stores look like 10 years from now? The same? or will they have been replaced by the Kindles and Nooks and the warmth of the pages on a cold winter’s night be replaced by the cool plastic.

I mean I get it. Really.  While I don’t (yet) have an e-book reader in our house, I see and understand the convenience and flexibility of having so many stories and such available on download demand, but real books are still touchstones, for now.  And it has been too long since I slowed down enough to just hang out with them and let them try to lure me away from the straight and narrow, to Timbuktu’s and fields and fen.

Anyway, by now mom was hungry so I suggested a local Mexican eatery in the East End or maybe a local BBQ place.

No.  Mom would have nothing of that.

We re-crossed the street (sorry Houston, you still have a long way to go to being a pedestrian-friendly town) and mom led the way over to the nearby La Madeleine café.

While familiar, I’d never eaten there yet.  Mom had and soon she had picked her quiche and tiramisu while I had scored a French-dip sammy and a cup of French roast coffee.  We sat at a small table, chatted, and took our time eating.  Both the time and the food was delicious.  And the people watching was quite entertaining.

Eventually we ended the early afternoon and we braved the now impending downpours of what was left of Tropical Storm Hermine as she started her two-day deluge of our bayou-based city.  We made it home, but there was some major ponding on the freeway lanes.  Only good timing and fortune allowed us to have our walkabout without a single drop falling until we were headed home.

Been a long time since I spent that kind of long, lingering day.  And I guess Mom knew I needed it even more that I realized.

Moms are so wonderful…

--Claus V.

Read More

A Toilet Tip and some Self-Centered Links

Mmmm.  Potty talk.

Please tune to another blog post if you want.  Nothing to see here but some really mish-mash linkages and ramblings….

Toilet Bowl Black Streaks - Q&A - Mosby Building Arts – Yeah. I know.  How gross can we get?  Only for the past year I have been fighting an ongoing battle with the toilets trying to get these Amityville Horror-esque black streaks from re-spawning under the rims.  I’ve tried every under-rim bowl cleaner I could find, dumped bleach down the tank-tube to try to nuke the mildew-growth out of existence.  But despite my weekly deep-cleanings, the sparking bowl became re-streaked in less than a week.  It was gross and frustrating.

I was about ready to rip them out and replace the entire toilet.

Then I read that tip that claimed the mildew problem (that I knew) was caused by hard-water deposits.  I took the advice offered, and found some Lime-A-Way under-rim toilet cleaner at the grocery store and gave them a good coating at bed-time one night.  For good measure I also dropped about a 1/2 cup down the overflow/fill-tube in the tank as well that feeds water down the rim-holes and into the bowl to get the inside run above the holes coated and cleaned as well.

In the morning I flushed well, re-scrubbed with standard toilet-bowl cleaner and waited.

Months later the black streaking still hasn’t returned and the bowls seem to stay cleaner longer as well!

What do you know!

I’m continuing with a bi-monthly application just to be safe as we do have a mineral-deposit problem with the local municipal water supply in our area (also tends to be iron-heavy).  But I think the problem is solved.

Thanks to Tug over at The Undershirt Guy Blog, I think I have found my long-lost solution to a clothing issue I have also been working on for years.  Long time ago I got a short-sleeved mock-turtleneck shirt from Lavie’s mom.  I quickly found it looked great (to me) under polo's, particularly in the fall and winter months.  I really liked the way the higher collar worked with polo shirts.  The fabric was too heavy though and it wasn’t comfortable for summer.  So I have been searching for a high-collared style t-shirt ever since and never found exactly what I was looking for.  I did find some high-end t-shirts such as in the UnderArmour line and some tactical (police-grade) t-shirts that came close, but they were very pricy and still not a “true” turtle-neck high collar.

Leave it to Tug.  I run his blog’s RSS feed and recently spotted his post Ask Tug Update: Undershirts with a high, tight collar that don’t stretch out or sag.

Turns out Jockey makes a higher-necked collar for the common man. 

Jockey Short Sleeve Mock Neck T-Shirt 8351

Priced at just $7 each, they are from a trusted and quality manufacturer and are easy on the budget.  I just finished ordering several in white and black.  I can’t wait for them to come in.  So if you are law-enforcement, military, work-uniform wearers, or just plain strange like me, this might just be a rare and golden find.

one hundred push ups – Just found this site.  Who knew this task was big enough to rate?  Back in high-school I did a lot of push ups.  And I set the challenge to myself to be able to accomplish 100 reps non-stop.  It took me a while, but I did get to where I could crank out 100-rep sets nightly.  No biggie.

I tried again the other night after hitting this site and was only able to turn out forty five before my arms gave out.

I find that it isn’t just a matter of physical strength but also mental strength to push-up through the pain and “quit” that my shoulders feed to my central cortex.

So starting tonight I plan on reclaiming that goal from high-school.  I’ll keep you posted on my progress.

Men’s Health - Eat This, Not That - 20 Worst Foods of 2009 – I pulled this link the other day and read through the items.  Horrible!  Now I don’t calorie-count (usually) but do try to make healthy choices with food items, snacking, and work to eat in moderation. But it was still as shock to find out just how many calories are packed in some food products.

From that article:

• Worst Burger of 2009 - Chili’s Smokehouse Bacon Triple-The-Cheese Big Mouth Burger with Jalapeno Ranch Dressing - 2,040 calories
• Worst Chinese Entrée of 2009 - P.F. Chang’s Tam’s Noodles -1, 678 calories
• Worst Supermarket Meal of 2009  - Marie Callender’s Creamy Parmesan Chicken Pot Pie - 1,060 calories
• Worst Ribs of 2009 - Outback Steakhouse Baby Back Ribs (full rack) - 2,260 calories
• The Worst Food in America of 2009 - Baskin Robbins Large Chocolate Oreo Shake - 2,600 calories

Now we eat at all these places and have consumed these items from time to time. Nothing wrong there.  To be fair, everyone likes their indulgences and in Texas, we like our cow cooked and big portioned.  But this information does provide helpful context for dining decisions.  Say, spend a few days eating lighter, low-cal fare before satisfying your desires on one of these items.

Me? I usually get the standard hamburger when eating out at Chili's or Outback and ask for some steamed broccoli on the side.  That gets nods from the family and usually impresses the waitresses (and the waistline).

mandolux | desktops | flags | Hope – I love this dual-monitor desktop from Mandolux.  The colors and textures in Old Glory are fantastic!  And yet the simple field provides a great desktop wallpaper without loosing desktop icons which sometimes can occur with some wallpaper designs.Full size, single-image download available over on Mando’s Flickr page if you want to crop one up on your own.

The Longstockings – Fun blog maintained by a number of teen/tween authors.  I don’t know if I will ever get around to writing that novel, but these folks provide great and honest feedback on the real-life of writing.  It’s fun, frustrating, and glamorous.  Well, probably just the first two.  Great source for finding new teen/tween novels that you might not encounter by looking on the shelves of the local “Fox Books” store.

Are you going to believe me, or your lying eyes? – Dan over at Dan’s Data and his also amusing How To Spot A Psychopath blog goes on a great and thoughtful rant.  This one is aimed primarily at geeks who appear to continually have a need to do hardware-upgrades on their system with little thought behind the real cause of their performance woes.

I love this quote:

My own motto, though, is that if something's worth doing, it's worth knowing what you're doing, and why, and how you can tell if it's really working.

Dan the Dude nails it.  And that’s a motto that you can apply pretty well across life.

--Claus V.

Read More

Inkheart…see the movie, but buy the books

Welcome to the Inkworld

Saw Inkheart last night as scheduled.  The theatre was half full which was surprising for an early Saturday night screening.

Basically the plot revolves around a man who can read elements of fictional stories into real life. Only when something comes out, someone usually goes in.  When Mo (Brendan Fraser) last read out loud, three dark characters came out of the “Inkworld” story and he lost his wife into it.  Thus the story develops as their daughter (and her aunt) learn the truth, Dustfinger (a troubled good-guy) searches out Mo to be read back into his world, and Capricorn and his henchmen try to force Mo into reading out ultimate evil into the “real world” from theirs for added power.

Overall it was a fun movie.  I would call it light fantasy/adventure.  It does bring a lot of family-friendly themes; father-daughter bonding, the love of a mother, family going extra miles for each other.

The danger never was too threatening from the “bad-guys” so the urgency of the plot seemed a bit weak.

Alvis really enjoyed it and Lavie and I had a great time escaping.

The only problem for us was that we had already read Cornelia Funke’s Inkworld trilogy.  And the movie takes incredible liberties with the plot, the characters, and the general tone of the story. In the Harry Potter book/movie series, the balance between film and page is handled quite well and both seem to co-exist amicably despite the liberties taken.  With Inkheart, sad irony considering the plot, making the fictional real might do more harm to the written word.

Funke’s Inkworld is a deep and layered series of fantasy books.  We have always read stories out loud at bedtime as a family, and when I learned of the plot of a father who reads out loud and things happen, well the storyline intrigued me.

Unlike the His Dark Materials (trilogy) which brought us The Golden Compass, this fantasy series brings no religious controversy or political baggage along with it.  The Inkworld series is as pure in its message of friendship, family, and overcoming darkness (within and without) as it is bold in creating another world, not unlike our own, but magically different.  All actions have consequences (even the best intended), and some are plainly brutal and final. But where there is hope and inspiration, there is always wonder and love.

Major characters in the book were glossed over or became minor ones in the movie.  Elements were added to the movie that were totally non-existent in the books.  The relationship between Mo, Meggie, and Dustfinger in the books is very rich and nuanced.  Something that didn’t translate at all in the movie with Mo being much more pensive and flighty than the character he was in the books.  I would say that only the characters of Farid, Fenoglio, and Elinor successfully translated honestly from their written to on-screen characterizations.

And for readers of the series, some things just stuck out horribly…like Farid’s acceptance of shoes (he refused to wear them in the books) and when Inkworld author Fenoglio gets an inspiration from Mo and decides to create a character called “The Bluejay” mid-way through the movie.  And by the way, Mo wasn’t a “silvertounge”, Mo is “Silvertounge.”   In the books, we don’t meet “The Bluejay” until the last volume, with complicated and lasting consequences.  I guess this “foreshadowing” is clearly meant to be a sign we can expect two more movies to be made.

Although marketed towards advanced youth readers here in the States, we found the Inkworld trilogy was much more adult-centered in tone and content.  The writing is very structured and heavy with details and descriptions.  After reading Harry Potter for years, the word-flow and rhythm was much more challenging to read aloud.  While both Funke and J.K.Rowling are accomplished and gifted writers, they provide a great comparison on how the author’s writing style itself contributes to the tone and timbre of their creations.

That said, all three books, Inkheart, Inkspell, and Inkdeath present a rare and rich read that demonstrates that there is power not just in the written world, but also in the spoken one as well.

See the movie for fun, then go and read the books to be amazed and captivated by the real Inkworld and its characters. 

You might just find it’s someplace you won’t ever be able to leave either.

Inkheart the movie – See it and forget it.

Inkheart, Inkspell, and Inkdeath the books – buy and read them and you will never put them down again.

--Claus V.

Read More