Some Notes for a Certain Project

Just some scratch notes for a special project I am working on.

Nothing of interest for most other folks.

Remote Desktop and Automatic Login - Microsoft Visual Studio Forum

try using this
   mstsc /admin /v:ComputerName

or these
   mstsc /console /v:ComputerName

Be sure to “Log Off” rather than click the “X” to leave the session running if you aren’t coming back. Kinda like your mom telling you to shut the door behind you on the way out of the house when you were a kid. Heard it all the time…

Generally it seems you cannot use Microsoft’s Remote Desktop Connection service to establish an interactive remote control session with the logged in/active user’s desktop (session 0 ?)  unless you do it with the appropriate above arguments. However doing so may make a mess of things depending on how you exit…at least this appears to be my current understanding.

• Use command line parameters with Remote Desktop Connection - Microsoft Windows.
• Access Remote Desktop Via Commandline - TechNet Articles - TechNet Wiki
• Mstsc - Microsoft TechNet - Windows Server
• MSTSC - RDP / Terminal Server Connection - SS64.com

Just because you can doesn’t mean you should, and if you don’t log off properly…like I said you can make a mess for others coming behind you. If you find just such a mess, these tips might help clean things up.

• How to Remotely Terminate and Disconnect Remote Desktop (Terminal Services) Connections or Sessions -My Digital Life
• How to logoff remote desktop sessions via command line tools? - ..:::: Anand ::::..
• Kill a remote user session remotely - Kode’s thoughts

In the end, RDC/RDP might be great or it might be messy.

If you are fortunate to be able to run UltraVNC services on some of your systems, you have some more options…especially if you are making a “headless” server box on a desktop OS platform. I’m personally more of a TightVNC guy myself but hey, close enough.

One of the problems might be that you want it to be a secure (AD/Domain) authenticated connection, but you don’t want someone to have to click “Allow/Disallow” on the headless system to approve that connection.

Fortunately there are options!

• Can you disable the "Accept - Reject" window? - UltraVNC Forum - Yes, yes you can..
• Install - UltraVNC
• UltraVnc Configuration - UltraVNC
• First Server Run - UltraVNC
• Rolling out UltraVNC - pre configure VNC Password - UltraVNC Forum
• ultravnc.ini - UltraVNC

And then…

• Deploying UltraVNC within an Active Directory environment using Group Policy - Virtually Impossible
• How do I setup MS Logon I or II? - UltraVNC Forum

User Redge wrote:

configure and set MS Logon I or II required only at VNC server.
a) following the doc...
http://www.uvnc.com/features/authentication.html
b) no if the UltraVNC setup was followed and exactly.
http://www.uvnc.com/install/installation.html
c) MS Logon I = Require MS Logon
http://www.uvnc.com/features/authentica ... l#mslogon1
d) MS Logon II = New MS Logon
http://www.uvnc.com/features/authentica ... l#mslogon2
Should set and required only at vnc server.
Important:
do not set vnc server as New MS Logon II on XP Home, won't work at all.

MSLogon can work, require turn OFF simple file sharing
windows XP

Open an Explorer window>Tools>Folder Options>View>The bottom check box

Headless systems are a pain…even if a modern BIOS can support booting without keyboard/mouse attached, and even if you can admin-pw lock the BIOS settings to prevent the USB ports from being active and used. Your system still may not boot if the NTLDR doesn’t see a proper video driver.

Headless System (Windows Embedded Standard 2009)  - Microsoft Developer Network post

• Creating headless systems - Windows Embedded Blog

In Windows Embedded Standard 2009 the support for headless devices starts with the availability of null-drivers for the standard MMI devices. Of course, the BIOS needs to support this kind of configuration, as well, but this should not be a problem on recent systems. The generic keyboard and mouse drivers in Standard are still present as well, when no hardware is connected, but the null driver for the VGA adapter needs to be added to the configuration. This requires the following components:

VGA Save could be left out, if there really is no VGA compatible chip on the board. This will create a dependency error, which in this case can be disregarded. Nevertheless, the benefit of having VGA Save in the image is that any time a graphics adapter card is plugged into the system VGA Save gets loaded instead of the Headless VGA driver. This enables screen output e.g. for field personnel troubleshooting the device. The VGA Boot Driver is required by NTLDR at boot time.

• Making the Server Appliance Headless - Microsoft Developer Network post
• Headless VGA Driver - Microsoft Developer Network post
• Headless Device Video Driver Processing - Microsoft Developer Network post
• Adding Support for a Headless System to your Configuration ... - Microsoft Developer Network post
• Headless VGA driver - Setting display resolution - Windows XP ... - RealGeek

One last element,

The BIOS should be configured to “re-spawn” like a good digital soldier in the event that the power is lost (even a UPS dies if power is off too long) or if someone hits the Power-off button perchance.

Likewise, if the Windows system is NOT on an AD Domain, and logging into a local workstation/workgroup account profile, then you lock it down pretty well (to the bare minimums to function, and enable the auto-login to the set profile: Tip: Auto-Login Your Windows 7 User Account | Cool Stuff | Channel 9. Pretty easy stuff for the auto-login.

The challenge comes up if you want to add it to the AD Domain and use a domain-based account for security/auditing purposes.

There are a number of ways to do this, each with their nuances. Some work better than others. Some are more secure than others. Consider the risk carefully before choosing grasshopper!

[SOLVED] Windows 7 - Auto Logon With Domain Computer - Mockbox.net post.  Easy enough with this registry-based solution BUT the user account and password are stored in the registry in clear-text.  You can roll your own .REG files for deployment with this method. However this could be a big security risk!

WindowsAutoLogin - freeware - IntelliAdmin. One nice feature of this application is that you can also control the number of times it allows an auto-login to occur and then after that “X” number of logins specified, it becomes disabled. That could be handy for some unattended (but brief) service events that require multiple reboots.

Autologon - Microsoft Sysinternals - Much better and easy enough to use. Per this post Safely setting autologon for Windows from the “Confessions of a Microsoft Consultant” TechNet Blog, we learn that AutoLogin saves the account/password string in the registry as a LSA secret.  That’s better than storing it in the Registry in plain-text, but it still is “easy enough” to penetrate and capture:

• LSASecretsDump - Dump LSA secrets from the Registry - NirSoft utility
• Use PowerShell to Decrypt LSA Secrets from the Registry - Hey, Scripting Guy! Blog - Why not since we are trying to learn PowerShell here too!
• Dump Windows password hashes efficiently - Part 1 - Bernardo Damele A.G. weblog
• Dump Windows password hashes efficiently - Part 2 - Bernardo Damele A.G. weblog
• Dump Windows password hashes efficiently - Part 3 - Bernardo Damele A.G. weblog - LSA Secrets info is here.
• Dump Windows password hashes efficiently - Part 4 - Bernardo Damele A.G. weblog
• Dump Windows password hashes efficiently - Part 5 - Bernardo Damele A.G. weblog
• Late night thoughts on security: LSA Secrets - ins3cure blog “Late night thoughts on security”
• LSA Secrets - WindowsNetworking.com
• Microsoft Windows Security Fundamentals: For Windows 2003 SP1 and R2 - Page 41 - Google Books Result

Autologon - commercial product from LogonExpert . I haven’t tried this product but it says it stores the logon information encrypted in AES 256, interacting directly with the WinLogon service to ensure nothing can grab the data. It has some really, really neat features.  The author has an overview of Free Solutions like what I have outlined above, as well as a Learn More about the product. There is an active download link from the page but I’m not sure if it is a limited-trial version or what. This may be a product that can provide both the “setup” features to enable AD-based auto-login and the security-needed for implementation. I’m really intrigued by this particular product.

Use this information wisely!

--Claus Valca

Read More

File under “That’s one way to do it.”

A KACE solution is used to produce a multi-platform image of our systems.

I’m not exactly sure how they make the master editions. The Home Office works behind closed doors once every few months when the moon cannot be seen at midnight. I guess it’s an “eye of newt, toe of toad” thing.

Anyway, we get the master USB stick, deploy it with much chanting and spinning to a local system, then pass some Latin command-line FU to the all powerful “Run" box. About 3-4 hours later a completely built KACE system (re)imaging stick spawn results. Then we have to repeat to build the next storm trooper clone.

It’s a time consuming process, and since I don’t have a physical multi-USB drive replication device, it can take up to a week (while multi-tasking) to update all the drives our team carry for system reimaging when a new refresh occurs.

So what I do is to to build a single updated one, then use Alex’s awesome USB Image Tool to capture a full image of the built stick. For the standard 16 GB stick we use, it doesn’t take too long to capture the “IMG” file back to the system HDD.

Once I have that, I just turn around and write that image back to each of the follow-on USB sticks. The process still takes up to an hour per stick to write back out, but that’s several hours faster than the standard process takes.

One alternative is OSForensics - ImageUSB. I like it and USB Image Tool as they allow you to take an image and write an image all with the same tool.  I also found Flash Drive Image Creator which just lets you take an image, and Win32 Disk Imager or USBWriter which then allow you to write that image to a USB drive. I haven’t used them unlike ImageUSB or USB Image Tool so YMMV.

All this is well and good until recently we got some 64 GB USB sticks to use.

The stock scripted process we follow from the master set of building files works fine with them…up to a point. See when done, it results in a 16 GB formatted partition. The remaining volume space is left unallocated in the process.

As I understand it (but haven’t verified myself) the process the KACE tool uses to create each of the sticks using the long-process uses UFDPREP.EXE to do the target USB drive’s formatting and conditioning to make it bootable to the KACE PE (just a custom WinPE) environment from which the image deployment scripts run out of.

It has been said (again I haven’t been able to find documentation to support) that UFDPREP only supports setting the formatting size for the flash drive up to 16 GB.  As I haven’t tested it independently, it might be that the script that the UFDPREP runs for in the drive building process is set somewhere to just use a 16 GB size. Changing its “/size=n” argument value to /size=65536 might work. Maybe.

(Side note: yes I know there are lots of ways and tons of tools to accomplish the formatting and boot-support prepping of a flash drive to almost whatever upper size you want limited only by the physical memory capacity of the device. The challenge here is that the official tool/process automates use of UFDPREP at the very onset of the scripted build process to the target device. So a maximum 16 GB formatted partition is what you get on the output if you want to also get the built image deployment tools and files with it.)

Anyway, I didn’t have the spare time to look into this too deeply. I needed a solution now.

So what I did was take my previously captured IMG file of a 16 GB built USB imaging stick and used “USB Image Tool” to restore it to one of the 64 GB sticks.

It went on fine and quick and resulted (as expected) in a fully functional USB stick for imaging purposes that had a 16 GB volume (just like the original it was captured from) with the remainder unallocated space. That would work “as is” for image deployments but we can’t let that unallocated space go to waste can we?

So I then booted a lab system with a Parted Magic “LiveCD”.

I attached the 64 GB stick and used the “Partition Editor” utility to first locate the device (I think it was listed as “/dev/sdb”), then went though the process to resize the 16 GB partition to take in the remaining unallocated space. I ran the operation and after a warning that it might screw up the data it completed with no fuss. See a visual walkthrough on the process concept below.

• Using Parted Magic to resize a partition - Draalin - Basically it is just like this but you are looking for the USB device not a fixed internal disk. Other than that, it’s the same thing.

When the properties for the updated device were checked on a Windows system, the full 64 GB size available on the stick partition was now showing!  Further testing in image deployments found that no corruption to the files/data occurred. It worked great.

I understand that if instead of XP we were running Windows 7 (or Vista) -- which we are not -- then I could have accomplished the same thing natively with the Disk Management tool. Maybe that day will come soon.

I found using Parted Magic a breeze. It was super fast and has been dead-on reliable all the years I have used it to clean up and fiddle with drive partitions.

However there are some other free partition management software tools that run natively in Windows. Check the licensing requirements to make sure they are not “personal use only” and respect accordingly. Some of the free versions have stripped down feature from the “pro” paid version the same company offers.

I keep one or two of these on my USB utility stick as a “just in case” if either DISKPART or Parted Magic fail me. But they really aren’t the butter for my bread.

That said, they look like they could do the same thing that Parted magic is delivering if Linux isn’t your thing.

• Best Free Partition Management Software - Gizmo’s Freeware - List of multiple free GUI-based partition management applications.
• MiniTool Free Partition Manager - this tool seems to get pretty positive comments in various net forums.
• EaseUS Partition Master Free Edition - EaseUS continues to make inroads to the partition software area with their great Windows tools.
• Paragon Partition Manager Free Edition - Another nice looking and easy to navigate partitioning tool.

Like I said, file this under “that’s one way to do it” for using a USB IMG file created from a smaller sized partition on a larger sized USB flash drive, then restoring the additional unallocated space.

If any GSD readers have any additional ways to accomplish the same thing via Windows Command-Line Fu or a small GUI utility I’d love to hear your suggestions; especially if the utilities are freeware/open-source or command-line only and especially if they would work in XP.

Also, if anyone can find documentation on any formatting size limitations that UFDPREP.EXE carries, I’d love to see the linkage. My Google search skills are not too shabby but I haven’t had luck with the right key search terms just yet. I’d like to know formatting limits of the tool before I tear into the actual process to see if our method is passing it a hard-coded \size=16384 or not.

Cheers.

--Claus V.

PS: Misc links I found in the process of searching for info on UFDPREP.EXE that might be interesting to someone:

WinPE Bootable USB - Creating from XP - The CD Forum - Walkthrough on where to get the binary file (from original source) and how to extract it (note it involves Microsoft’s Windows Embedded feature pack).

A Deep Dive into USB Boot - msdn - How UFDPREP actually does it’s magic.

Read More

God Made a SysAdmin…and a linkfest to feed them

One of the best 2013 ads I saw so far this year was this one during a small little scratch football game.

It worked for me on several levels.

However, soon a "parody” of sorts soon followed. First the words were developed by Chester Gifford and -- inspired - Matt Simmons of the great Standalone Sysadmin blog tossed together some images, and finally Drew Stemen contributed the voice-over.  The whole story is here; God Made a SysAdmin | Standalone Sysadmin

Full text at website God Made a Sysadmin

Brilliant!  I want to personally thank all those who appeared in the piece as well as the creative work and toil from Chester, Matt, and Drew. Who knows how much extra un-recorded time went into this project’s success? Well, a sysadmin would, naturally!

More Tips & Rumors

• Reset Your Forgotten Windows Login Password The Easy Way - Addictive Tips
• How to reset a Windows 8 password - 4sysops
• How to reset a Microsoft account password (connected account) - 4sysops
• Offline enable the Windows 8 built-in administrator account - 4sysops
• Triple Your Speed: How to Install an mSATA SSD Boot Drive in Your Laptop = LaptopMag blog
• Seagate is done making 7200rpm 2.5-inch pure hard disk drives - Ars Technica

Networking News

• Chrome's Developer Tools for HTML Analysis - LoveMyTool blog by Tony Fortunato
• Network Capture is Dead! - MessageAnalyzer - This post highlights how MessageAnalyzer (the next generation Microsoft capture tool evolving from Network Monitor) doesn’t just focus captures on network “traffic” but also can monitor and analyze Event Tracing for Windows data as well. Pretty cool.
• Sniffing Traffic on the Wire with a Hardware Tap - Open Security Research blog
• Wireshark Security Updates -ISC Diary post
• Wireshark · Download - Versions 1.8.6 stable, 1.6.14 (old stable), and 1.9.1 (Dev release)

Toys and Wonders

• Kali Linux - New Sec/PenTest distro built on the back of BackTrack Linux and developed specifically for enterprise environments supporting penetration testing and security auditing. According to the distro documentation, it has over 300 tools baked in, will be free, sports many wireless devices, and has ARMEL/ARMHF support for “non-standard” hardware platforms such as Raspberry Pi, a VMWare Image, and the Samsung Chromebook. Pretty snazzy!
• Kali Linux - Downloads
• Kali Linux - Documentation
• Kali Linux arrives as enterprise-ready version of BackTrack - The H Security: News and Features
• Kali Linux Cracks Passwords and Finds Security Exploits on the Enterprise Level - Life Hacker
• Piriform pushes out minor update for CCleaner, version 4 coming soon -  BetaNews
• CCleaner v3.28 - Piriform News
• Easily Download & Launch Sysinternals & Nirsoft Utilities With WSCC - Addictive Tips. Previously mentioned back in this Windows System Control Center (WSCC): Awesome Cool! GSD post.
• VirtualBox update fixes problems, makes the virtualization tool more stable - BetaNews - Yeah, go get your update… Downloads - Oracle VM Virtualbox
• Changelog – Version 4.2.10 - Oracle VM VirtualBox
• Upgrading Linux Guests - The Fat Bloke Sings blog
• Alternative Flash Player Auto-Updater - pXc-coding - now at version 1.1.0.2 - Works on XP,Vista. Win 7, Win 8, can work without user interaction (handy); of course Flash does have the option imbedded to auto-update. As I understand it, Flash auto-checks every seven days while this app can check for Flash updates at every reboot (or every two hours) if you are patch twitchy.
• Uninstall Flash Player - Windows - Adobe - Can’t get Flash out of your Windows system using Add/Remove/Programs & Features? Or want to roll back to and older version and Flash won’t let you? Use the official Flash Uninstall utility to remove all traces.
• JavaRa - SingularLabs - Fantastic all-in-one utility to update Java runtimes, remove Java runtimes, and clean up logs/temp-files used by Java runtimes.
• USB Image Tool 1.61 - alex's coding playground - Fast arriving update to fix a bug, use user-defined date/time formats for file name suggestions, and once an image restore is completed, automatically rescans for all devices to be detected.
• UEFI MULTI 72 - reboot.pro - Project to make a multi-boot USB-harddisk to boot systems with BIOS or UEFI firmware.
• IntegrateDrv - reboot.pro - Project for utility tool to integrate mass-storage or PNP drivers into Windows setup. This is a little bit different than the WinPE/DISM driver integration tools such as DISM GUI - Download: DISM GUI 3.1.1, and Je Jin's DISM Tool, and GUI Dism ELDI v3.0.2. I covered use of those in my GSD post Scratching at a SCSI Drive Itch - Part II - WinPE Redux .

Cheers and may you have a marvelous work-week!

Claus Valca

Read More

…and an alternative solution is confirmed

In the last post I mentioned the challenge encountered when a user set a local account password on their new Windows 8 system…and forgot it.

A factory re-image got us rolling, but in theory I should have been able to off-line boot the system with one of my WinPE USB sticks (had I had it on hand) and used a utility to blank out the password in the local user’s account.

Last night I wanted to confirm this would work.

So I booted by VMWare-hosted Windows 8 system and confirmed my local user-account did have a working account password on it.

I shut it down and tried to boot it by using one of my custom WinPE USB sticks.

Only VMWare doesn’t support booting from a physically attached USB drive.

So I had to boot from a Plop boot manager first.

Only that didn’t work too well as the VMWare BIOS booted so fast I couldn’t catch it to change my VMware boot order.

So I had to edit my Windows 8 .vmx file to increase the timeframe it allows during the BIOS boot process so I could select more options…such as boot from my mounted Plop ISO file.

That done, I was able to boot the VMWare image, select to boot from Plop, attach the bootable USB stick in VMWare, return to Plop and select the option to boot from USB, and voilà! my WinPE was running in VMware.

Once it settled down, I launched the latest version of NTPWEdit (v 0.4) released in Oct 2012 in both x32 and x64 bit versions and supports Win8.

I passed it to the SAM file location, it found my local account and I used it to blank the password.

I rebooted and let Windows 8 come up.

Sure enough, my password had been successfully removed!

I then went and restored it again.

All is well and some more confirmed techniques are filed away for future reference.

• Change boot sequence in VMWare - Marten’s Blog
• How to Increase the VMWare Boot Screen Delay - How-To Geek
• Accessing the BIOS when the POST screen clears too quickly - VMware KB
• How to Boot a VMware Virtual Machine from a USB Drive - How-To Geek
• Plop - Documentation / Manual / Examples - Free Boot Manager
• USB Boot Without BIOS Support - What the.....?
• NTPWEdit 0.4

Cheers.

--Claus V.

Read More

Innounp Update Tip

I use Universal Extractor from LegRoom.net pretty often to tear open setup packages of software.

There are lots of install packages that use 7-ZIP formats, quite a few MSI based installers, primarily from Microsoft, but more time than not, many packages are wrapped by Inno Setup.

Universal Extractor hasn’t been updated for quite some time. And in many cases, if you stick with the default package, you will encounter a Inno packed set that it can’t open up.

Luckily, because there are so many supported formats Jared Breland has packed in there, it generally is pretty easy to figure out what component you need to update, check that source location, and swap the older one out with a newer one.

Accordingly, I keep a very close eye over at innounp so I can always have the newest version of an Inno unpacker tucked into my Universal Extractor.

Current version of Innounp is 0.37 supporting Inno Setup versions 2.0.8 to 5.5.0.

Cheers.

--Claus V.

Read More

Greased Monkey Business

It’s no secret that one of the major ways I manage to keep up with “goings-on” in the world of Technology and culture is with the use of a RSS feed reader.

Generally it goes something like this:

• Launch Feed reader (Newsfox or Omea Reader),
• Pull down article feeds,
• Read, review and analyze,
• Open feeds to be saved for later processing in web-browser, and
• Bookmark article/link.

Later I might do some sorting of the saved bookmarks by subject or category or blog-post idea.

When it comes time to actually compose a post, I will open up Windows Live Writer on one side of my screen and my web-browser in the other.

Then I do a combo of composing the text body as well as some drag/drop action from the saved bookmark links.

That’s all well and good except for a tiny gotcha I figured out about a year ago.

See, many (but not all) of my RSS feeds actual open up to a page link that was seeded with some extra feed-tracking data code.

For instance:

This article appeared in my RSS feed list, was interesting, so I launched the full article in my browser and bookmarked it: Design and create with nanoCAD, a totally free CAD solution - freewaregenius.

However if you take a look at the actual URL provided by the RSS feed link in the browser was:

http://www.freewaregenius.com/2012/07/03/design-and-create-with-nanocad-a-totally-free-cad-solution/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Freewaregeniuscom+%28freewaregenius.com%29

…rather than the direct URL of:

http://www.freewaregenius.com/2012/07/03/design-and-create-with-nanocad-a-totally-free-cad-solution/

I added emphasis in the first link to show the extra sauce the RSS link path adds.

That’s not really a problem, but adds a bunch of extra code (and tracking data) that doesn’t really need need to be present in the blog links that everybody jumps from. I’m all for fair tracking and they get my “ding” when I view the full page the first time within my RSS feed reader.

So what I had been doing is cleaning up the link first in the bookmark properties before adding it to a post.

Only sometimes I forget.

Well, actually, many times I forget and it can be a lot of work cleaning them up.

Too bad I couldn’t automate cleaning up the bookmarks somehow.

Although I couldn’t figure a easy way to do that, I did eventually find a brilliant Greasemonkey script that did one better.

It actually intercepts the RSS feed-load in Firefox and cleans it up before loading in the tab. Sweet!

Removing UTM data from URLs automatically for cleaner bookmarks -Christian Heilmann. From his post page:

“I’ve come across lots of delicious bookmarks that still have all that campaign monitoring stuff in them, which is annoying. To work around that I’ve just written myself a tiny GreaseMonkey script:

Install un-UTM for GreaseMonkey

“If the browser now opens a link that has UTM data in it, it removes the information and reloads the page without it to make for a cleaner URL.”

Christian is clearly brilliant and his solution works perfectly. No more tracking data appending of URL’s to my saved bookmarks!

Related:

• How to convert Greasemonkey scripts to Firefox add-ons? -WEDYN
• Tampermonkey (Greasemonkey for Chrome) - Chrome Plugins
• How To Install And Use Greasemonkey Scripts In Google Chrome -pcmastero.com

Mischief managed.

--Claus V.

Read More

Interesting Malware in Email Attempt - URL Scanner Links

Last weekend I spent some time with extended family helping confirm for them that their on-line email account got hacked and had been used to send some malware-linking spam emails to users in their contact list.

Yesterday our family email account was on the receiving end of someone -- possibly -- who fell victim to an email account hack as our email address was amongst several others included together receiving the email. I say possibly as none of us recognized the sender’s email address and it wasn’t in any of our address books. Possibly our along with the other’s email addresses had been harvested somehow and this was a fake spamming account. The “show-as” name was definitely non-standard and used some letters that related to that in the subject line.

It was pretty evident to me this was probably a dangerous site to go to, but being curiously-minded, I couldn’t pass up the chance to do some detective work.

The email originated from a yahoo mail account.

The Subject line was baited “ACH Transfer Canceled…” and the display name in the email address contained the letters “NACHA.”

ACH is meant to refer to the “Automated Clearing House” which handled financial transactions in the US overseen by the NACHA.  To most Americans, I’m betting these acronyms mean very little and they would be more taken with a sudden urge to grab some NACHOES instead. Maybe Europeans would be a little more anxious emails purporting to come from ACH and NACHA. I digress.

First thing I looked at was the message header. Lots of goodies there. We can follow the bounce between the yahoo mail sender to our ISP’s email servers. Times/dates of transmission.

Since this was a Yahoo mail account, it appears the header may actually contain the IP address of the the location the mail account was logged into from. This is the first time I have seen this so I need to do more research. The IP associated with this particular email is located in France.

The website IP Address Locator has lots of good tools for locating IP addresses as well as a feature that allows a copy/paste/analyze of email headers.

The content of the email was very thin, a single line with all the text ran together. There is a URL link markup there, however it misses getting all the characters. Hmm.

Toggling between the different modes of viewing email content in Thunderbird reveals odd results. If I look at it in original html mode I see a single line of text with an hyperlink in the middle.

If I view it in simple html most of the text is the same but a few characters are different.

If I view it in plain text, there is nothing showing.

Hovering over the hyperlink displayed shows a URL shortner link. Hmm. Set that aside for a moment.

So I back and look at the full header view again and find this in the message body:

Content-Type: text/html; charset=ISO-8859-5
Content-Transfer-Encoding: base64

Ah! So I copy/paste that large text block that follow that into this base64 online encoder / decoder and get a binary file to download! 

(More regarding content encoding methods here Content-Transfer-Encoding - MSDN, here The Content-Transfer-Encoding Header Field via freesoft.org and here Decoding Internet Attachments - A Tutorial by Michael Santovec.)

Opening that binary file in Notepad++ reveals the html code with the same actual URL embedded.

Guessing here they are using base64 coding for the content to try to get around email scanners.

OK, so let’s check out that URL.

Turns out it is using Google’s own URL shortning service: Google URL Shortener.  More info here. Google URL shortener - Web Search Help

Turns out this is a pretty cool choice from both sides of the security fence. By appending the URL with “.info” at the end of a Goog.le shortened URL we can find out the stats from Goo.gl URL shortener (Google Groups)

This is good from an attacker standpoint as they can easily monitor their success rate on the nibbles of this hook and any “hits” to the actual URL. Researchers can get info as well by monitoring the same info and how fast/long the “click-through” may happen.

Neat isn’t it?

Now that I’ve got the actual long URL that this points to, we can start tossing the URL at some on-line link analysis/scanner tools.

VirusTotal shows both TrendMicro and SCUMWARE.org report the long URL as a Malware/Malicious site.

Quttera reports it as serving up a suspicious javascript content via HTML page code.

Anubis: Analyzing Unknown Binaries provided a deeper review of the URL by capturing Windows system events in a virutal sandbox system. It accesses the Windows registry, mucks with some keys, created a cookie, reads the autoexec.bat file, mods some files and maps dll’s to memory and appears to try to download more stuff. The report is available in HTML, XML, PDF, and TXT formats.  Also, they offer a traffic.pcap file to download so you can examine the network traffic generated and perform any NFA you want to do.  This site/tool rocks from a depth of information standpoint.

urlQuery gives some more report feedback when it is sandboxed. Lots of Java script stuff. Another strong URL analysis reporting site.

Trying it a few more times changing the browser type/java version/flash version gets different results and the URL serving code reflects all kinds of different IP’s each time so that long URL seems to be hosted at a dynamic IP host allowing it to bounce around (serving up HTTP redirects) and serve up the malware code depending on platform from all over the place making it harder to track down the source.

urlQuery actually identified the network traffic code as being detected as Blackhole exploit kit v1.2 HTTP GET request.  Another clue.

I tossed the pcap file I got from Anubis into NETRESEC NetworkMiner. Nothing very interesting but my Microsoft Security Essentials alerted when the HTML page was reassembled by NetworkMiner and quarantined the file. It identified the page code as being Exploit:JS/Blacole.AR. (MS’s way of saying “blackhole” I suppose…)

Here are a series of links regarding these kinds of email spam threats in general as well as Blackhole info in particular as it relates with email spam campaigns, if you are curious.

• Prevalent Exploit Kits Updated with a New Java Exploit - M86 Security Labs Blog
• An analysis of the ACH spam campaign - M86 Security Labs Blog
• Cutwail Spam Campaigns Lure Users to Blackhole Exploit Kit - M86 Security Labs Blog
• “Steve Jobs Alive!” Spam Campaign Leads To Exploit Page - M86 Security Labs Blog
• All Posts tagged Malicious Spam - M86 Security Labs Blog
• Malicious email scam "Re: Scan from a Xerox W. Pro #XXXXXXX" returns with a new face - IT Secure Site more on a related Blackhole email spam attempt.
• Blackhole exploits kit attack growing - Zscaler Research
• Exploit Kit in my Morning Email (BlackHole Exploit Kit . . . Maybe) - ReverSecurity

I doubt this is the last our email inbox will see of these things, but the whole process has been quite fun to follow.

I’ve decided to leave out links/images of the actual email and the header-code/URL (short/long) but have passed it along to a number of security-spam websites in case it is of use.

A long time ago I had a list of URL-testing sites to feed a URL into to see if they were safe or not.  Most seem to have gone away, however the following forums had a number of new ones worth bookmarking. Hat tip to “PROROOTECT” for the legwork!

• Free Online On-demand URL Security Scanners - MalwareTips forum
• FREE ONLINE SECURITY SCANS For Suspicious URL Link - Sysinternals Forums

Here is a combined and cleaned up list based on the collective work there from PROROOTECT in both places and at least one or two I’m tossing in and a few from those lists I removed that seem dead/redirected incorrectly.  PROROOTECT does make a great point that the effectiveness of these vary, so a “bad” URL in one may come back as “clean” in another. So it’s best to run your URL through multiple sources.

Note, these are URL/web-page scanners. They are a bit different than on-line file-scanners/sandboxes used to analyze malware samples. Though a few seem to come pretty darn close with the depth of their reports/analysis.

Not “necessarily” ordered in order of usefulness.

• IP Address Locator - Track IP, Search IP, Find IP, Trace IP Lookup, What Is My IP Address Location
• TrueURL - decode short URLs
• Decode Short URL Decoder - cekPR.com - decode short URLs
• TinyURL.com - preview a TinyURL
• LongURL - decode short URLs
• Untiny - decode short URLs
• base64 online encoder / decoder - decode base 64 code in emails
• Quttera - FREE Online Heuristic URL Scanner
• Anubis - Analyzing Unknown Binaries
• vURL Online - Quickly and safely dissect malicious or suspect websites
• HTTP Web-Sniffer 1.0.37 - view HTTP request/response headers
• Wepawet - analyzes URLs for javascript/PDF or Flash exploits.
• Finjan URL Analysis - URL analysis
• VirusTotal - Free Online Virus, Malware and URL Scanner
• UrlVir.com - URL scanner using domain, IP or MD5 hash value. Hosted by NoVirusThanks
• SURBL Blacklist lookup - check database for known websites that have appeared in unsolicited (spam) emails. More on the program here: SURBL
• URLVoid.com BETA - scan website for malware, threats and other bad things.
• URL & Link Scanner - Scan URLs for malicious code - URLVoid.com BETA to scan URL with multiple AV engines.
• WAVE - Web Accessibility Evaluation Tool - may not tell you if a site is “malicious” but provides a visual report on the site as well as any funky coding going on.
• Comodo Site Inspector - scan page to see if it generates malicious activity or hosts malware.
• Website Security Check - Unmask Parasites. Scans site for evidence of exploit code.
• Norton Safe Web, from Symantec - is a site safe?
• Dr.Web - is a site safe?
• Trend Micro Site Safety Center - is a site safe?
• AVG LinkScanner Online- is a site safe?
• F-Secure Browsing Protection Portal - Can you trust a site?
• AVG Online Virus Scanner | Scan Web Pages | AVG LinkScanner Drop Zone - Can you trust a site? (Aussie edition)
• Online Link Scan - Virus, Trojan, Adware and Malware Scanner using a variety of scanning engines.
• PhishTank - site to report suspicious/phishing URL sites.
• Check page for sh*t - resources including a URL check in Google spyware checker.

PROROOTECT’s suggestion to use an online URL screenshotting service to capture the displayed URL safely is some good outside the box thinking. Kinda a “look-before-you-leap” thing if all the above items pass OK.

• Shotbot - Screenshot Bot | Ascreen Generator - generates jpeg thumbnails of public websites.
• IE NetRenderer - Browser Compatibility Check - I like this one in that you can pick your browser version from a selection. If the URL/page responds differently based on your browser, then this might show it.
• thumbalizr - thumb your webpages
• url2png - website screenshot service
• loads.in - webpage load screenshots in multiple browser with option to pick from from over 50 locations worldwide
• ShrinkTheWeb - website screenshot service
• Browsershots - supports/mimics so many different browser types and OS’s and allows defining Javascript/java/flash versions that it’s just plain coolly obscene!

Fun trip if it wasn’t so serious…

--Claus V.

Update: I meant to add this in to the original post but got sidetracked. A recent Digital Forensics Case Leads post has mention of a super-fantastic investigation/forensic report involving anonymous emails. This is must-read material, not just in terms of the investigative methodology but also the way the report was composed and presented. Very clearly done!  I’m keeping a saved copy of the report for future reference; both technically and as a report template. From the post via the link above:

University of Illinois recently released a detailed investigation report (PDF) regarding anonymous emails allegedly sent by its Chief of Staff to the University's Senates Conference. The report is an interesting read, and also serves as a potentially useful model for those looking for report samples and templates.

Read More

Mostly for Sysadmins and Windows Tweakers

One last linkfest dump before I turn my attention back to a freshly arrived hardback copy of George R. R. Martin’s A Game of Thrones to close out this dark, drizzly and fast-chilling night here on the Gulf Coast. My brother is deep into the book/HBO series and I think he runs an underground distributed book club network of sorts on it. Hence his gifting me this newfound wonder.

This linkfest is a collection of stuff mostly of interest to system administrators and Windows tweakers…your interest level may vary.

Looking at page hits (which I rarely do) it seems that the following posts remain all-time GSD favorites for some reason.

Blocking IE 8 "InPrivate" Mode

Blocking IE 8 "InPrivate" Mode – Updated

Some folks had issues following the steps to make their own REG files to enable/disable “InPrivate” mode on their own system, so I did some and posted the download linkage in the comments section.

I've created the registry keys myself and uploaded them to a shared folder on box.net. http://www.box.net/shared/b0fr5x0qg2

Click that link (or copy/paste it into your browser address bar) then download the "IE8InPrivateMode-Disabled.reg" file directly to your PC.

Depending on your anti-virus application it may complain as .reg files could be malicious. If you want to check, simply open it in Notepad to see that it matches what I have listed on my blog post.

Once you have it download it, right-click on the file and select the "Merge" option.
Depending on your version of Windows and the user-rights of your profile, you may have to confirm some warnings. If all goes well it should be added to the registry and when you re-launch IE8, you should see the option grayed out.

The other registry key in that folder re-enables the option. Follow the same steps and it will allow InPrivate Mode option to work again, unless blocked differently by one of Microsoft's Family Safety programs...

They work on both IE 8 and IE 9 by the way despite the posts being IE 8 centric at the time.

Anyway, the other day I noted this post Internet Explorer InPrivate Browsing Enable or Disable - Windows 7 Forums.  In it, “Brink” also offered some download REG files for merging into the registry.  Out of curiosity I compared them and they were pretty much the same except where my REG files just cover the HKEY_LOCAL_MACHINE key location, Brinks keys have that as well as one for the HKEY_CURRENT_USER key location as well. So basically with Brink’s you get a two-fer deal.

Mine or Brinks…take your pick.

How to REALLY hurt yourself with PSEXEC - Deleting the Undeletable Registry Key and More - Scott Hanselman Computer Zen- Scott’s battle with a “undeletable” registry key makes for a fun read. That said, while his PsExec method worked, I’ve had fantastic success when I’ve run into similar keys on malware-infected systems by using Malwarebytes : RegASSASSIN. I don’t know for sure if it would have helped in Scott’s issue, but I would try that first via the GUI it offers before dropping to the PsExec CLI work (though it is really cool). Related for difficult to delete files: Malwarebytes : FileASSASSIN.

It has been over 4 years now since I set Dad up on his Vista system at his house. In that process I ran into a challenge; how to get his and his wife’s profiles to display at different screen resolutions? She liked a relatively low resolution to see things larger, while dad liked the highest resolution to get the best screen display quality.  In my post of my fix Vista/XP Quick Screen Resolution Toggle Tip I used ResSwitch & ResCopy to create custom desktop icons that lets them just click-to-set the display level at their preference rather than digging into the properties each time.  So when I read this post at Windowshacker How To Set Different Screen Resolution for Individual User in Windows 7, I was curious.  Turns out there is a neat freeware product called Carroll that almost automagically can set individual screen resolution for every user when they log in.  No more clicking desktop icons. And it only took 4 years to get here!

Just in case it keeps you up at night fretting about the text for your Windows desktop icons being underneath them, the Windows Club offers a tip on D-Color which can Display Desktop icons text on the side in Windows 7. Now you can sleep easier.

Decoding Intel’s Laptop Processor List [Technology Explained] - MakeUseOf blog.  Nice explanation.

Dynamic Computer Naming in ZTI Deployments - The Deployment Guys - For you Zero Touch Installation (ZZTI) fans with that issue and need.

Any tech mystery that can combine low-level Windows troubleshooting and analysis with Hello Kitty makes it a Must Read in my book!  Submitted for your education--seriously.

• The case of the broken Hello Kitty IZMO toy (Part 1 of 2) - Within Windows blog
• The case of the broken Hello Kitty IZMO toy (Part 2 of 2)- Within Windows blog

Need more standard low-level troubleshooting tips? How about this exercise.

• The case of the vanishing print jobs - Ask the Performance Team

I’m not yet a Hyper-V guy, but I think it is really cool stuff and read up when I can.  I found this Series: Hyper-V upgrade posts at 4sysops to be helpful stuff.

Tenniswood Blog serves up some awesome remote access card P0rn with a nice Review: HP Microserver Remote Access Card.

Create internet bookmarks as browser-independent files on your desktop with HTMtied - Freewaregenius.  I’ve always found it frustrating that I can’t do this as easily as it seems it should be. Turns out the free tool HTMtied can assist with that process and make it a bit more bearable to do.

How to fix incorrect logon information for Windows XP mode - Virtual PC Guy's Blog - Ben’s solution is pretty easy to follow and will get you running again in no time.

Windows 7 Background Customization - The Deployment Guys blog. There are a number of ways to change the background image in Windows 7, doing so is a “signature tweak” I like to perform on all the systems I am asked to help set up for friends and family members; leaving them with an image that reflects their home/personality is a nice touch.  This post is a bit more technical and geared for pushing such changes for enterprise branding and such. Still good stuff.  I personally prefer to use Julien Manici’s free Windows 7 Logon Background Changer but there is also the Tweaks.com Logon Changer for Microsoft Windows 7 and the Windows 7 Logon Screen Tweaker 1.5. Many Windows7 tweaking suites also include this feature in them.

FREE Download Preassembled Windows 7, Vista, and XP VPC Images From Microsoft - Windows7hacker. I try to always keep the latest versions of these handy for ad-hoc testing in Virtual PC. Although at home we now exclusively run WIndows 7, there may be times when I want to trial something in XP or Vista. Rather than dual-booting or keeping another physical test-bed around, I just fire up one of these in a virtual session and away we go! They do have some operational limits baked in, but nothing that should be too much of a headache if you use em regularly.

FREE: Delprof2 – Reliably delete a user profile - As reviewed by 4sysops.  Seriously, if you ever deal with Windows user profiles and occasionally deleting them, you really need to refresh yourself on this post as well as the great freeware tool Delprof2.  While you are there, check out some of the other cool Free Tools from Helge Klein such as DiskLED and ListRegistryLinks which could be handy when doing some incident response work.

MoonPoint Support Weblog - List Installed Programs - This post tips us to a Bill James VBScript script, InstalledPrograms.vbs which when run from the command line prompts for a IP or PC name to remotely check for installed software (or leave blank to check your own). Save the resulting text file for review.  There are a number of “system audit” programs that can do something similar for local systems, but this is the first I’ve seen quite like this.  For generating a list of installed Windows programs on a local machine for reporting purposes and review, I prefer Nir Sofer’s MyUninstaller which seems to be significantly faster than Add/Remove Programs (XP) or Programs and Features (Win7) anyway for adding and removing programs. With MyUninstaller, after running I just select all and save the file in whatever supported format I prefer (usually tab-delimited).

Cheers,

--Claus V.

Read More

Quick Web Screen Grabs

One of the processes we have in the shop is to archive a series of network graphs for various URL locations that are created in a specialized MRTG - Multi Router Traffic Grapher deployment.

Once the web-page screen shots with the graphs are each captured, they are combined into a single Word document for that day which is then archived for historical reference and distribution to management.

The result is the daily tasking of an analyst for about an hour clicking through a large Excel table that contains each of the URL links, grabbing a screen shot, pasting it into the Word document, then moving on to the next URL.

This has been going on for some time and unfortunately, the madness of my other projects has kept me from turning my attention onto addressing it for a more efficient process.

Last week was a bit lighter at my workbench so I could consider the issue for a few minutes.

It took me about five minutes to come locate the free command-line tool IECapt - A Internet Explorer Web Page Rendering Capture Utility coded by Björn Höhrmann.

It’s just 102 kB unpacked and though it requires the gdiplus.dll, I had no problem finding that file already present on our XP Pro systems (and about fifteen others in various portable utility program folders on my own system).

My solution for this daily task was very simple.

I created a folder “C:\graphdumps” and copied both the IECapt.exe and (for good measure a gdiplus.dll I had on my system) into it.

I then created a batch file that had a line for each of the separate MRTG page URL’s we need to access.  In my case I had approximately 50 or so URLS each on their own line.

As an example, each line in the batch file has something along the following (all on a single line):

IECapt --url=http://www.uhcougars.com/ --out=GoCougs.jpg --min-width=800 --delay=5 --silent

I also choose an simple output filename for each URL line that was clearly indicative of the logical location each URL represented.

For now, I’m outputting as a jpg file format for maximum compatibility with the folks who would receive the final file, however IECapt supports a number of output formats such as .png, bmp, jpeg, emf, and probably a few other formats not listed in the help.  I like the idea of using a PNG format instead and may do some comparisons between the two formats moving forward.

I did have one “gotcha” I had to overcome first.

Every time I ran the batch file, I would get an output error unable to generate the thumbnail image.

I checked around and found this forum post IECapt does not work when --url contains a query string which did seem to confirm the issue was that the URL’s I was using in my batch file contained query strings.  I didn’t really like the options (recode the program or use a url-shorting service).  On a hunch I wondered what would happen if I encapsulated the URL parameter in double-quotes.

It worked perfectly.  So for example, each line in my batch file was now changed to add the “  “ accordingly.  It now looked more like the following on a single line.

IECapt --url=”http://weather.chron.com/radar/station.asp?ID=HGX19&NOHEADER=1#MAPZOOM” --out=radar.jpg --min-width=800 --delay=5 --silent

My test run of the batch-file took just under 1.5 minutes to complete the pulling and saving of all the pages.  I then opened up a blank Word document, selected all the output jpg files that had just been generated in my folder, and dragged/dropped them into the Word doc.  I then saved it with the daily file name and was done. From about 60 minutes of dreary click-saving URLs to under 2 minutes of mostly-automated grabbing and pasting. Sweet.

Now if I could just find a way to automatically import these images into a templated Word/RTF format document (with images embedded not linked) I will be set.  I’ve looked at “mail-merging images” into Word but I’m not sold yet on the process. There should be an easier way to just pipe the output into an RTF “word pad” document but I haven’t figured that out yet.  This way alone is a big improvement so for now a little drag/drop into Word isn’t a deal-breaker.  Thoughts/suggestions?

Additional notes:

I considered using the robust freeware tool SiteShoter by Nir Sofer.  It supports both a GUI and a CLI mode and is pretty sophisticated. However, for this application, IECapt worked perfectly and is dead-trim. SiteShoter can read out URL’s from a text file to act on, so SiteShoter is a different technique that could be better in some circumstances.

How to automatically capture images of a series of web sites and create thumbnails of the resulting image files. - Post by Paul Bradley that put me onto IECapt and how easy the CLI is to use.

Remembering to actually stop what we are in the middle of doing (especially annoying in the middle of a meeting) when the established URL capture hour comes around is quite challenging as well. More than a few days the designated team-member has forgotten and had to run the captures a few hours later.  Because this process uses a batch-file, one can easily set the batch-file to execute as a scheduled task automatically when the capture-hour occurs.  Then (as long as the system is running) we can come back later that afternoon and assemble the archive document from the jpg’s that were automatically generated. Super-sweet.

Cheers!

Claus V.

Read More

DCCU–Power for the BIOS!

This past week as I was prepping and arranging for the deployment of some specialized network traffic capture systems a thought suddenly struck me; what happens if the power goes out?

These are “headless” desktop systems that are deployed along side our other network servers.  We had already deployed seven or so around our service areas and had lots to go.

I suppose we could request a local site user to go in and punch the “on” button for us, but we really want to keep the systems low-key and blending in with the other items.  And yes, they are on UPS units…but sometimes those don’t last for an entire outage period….

Wouldn’t it be nicer it there was a way they could “auto-on” if power was restored?  And/or maybe enable “wake-on-LAN”?  Or even auto-power themselves on (in the event of a extended power failure/recovery) at a particular time?

Turns out they can…via BIOS settings on these Dell systems.

I thus made the changes on those that were still on my desk waiting pickup for deployment.

But what about all those that were already deployed, or the many more sitting in a shelf already boxed up for deployment?  I didn’t relish pulling them all out again, just do do BIOS tweaks.  Nor did I want to drive all over the area, making BIOS tweaks on a single system.

Wouldn’t it be nice to update the BIOS remotely?

Guess what?  Because they are Dell systems I could!

Dell Client Configuration Utility – Dell

The DCCU tool is offered on the Dell Tools and Utilities page. It is a free administrative tool that allows you to “build” a custom executable package of BIOS settings and/or BIOS flash updates.

It supports Dell OptiPlex, Latitude, and Precision systems.  It does require .NET be present on the administrator’s system you are installing/building the DCCU packages with.  It does not need to be on the “client” systems you choose to deploy the packages on.

You can perform complex operations in each of the following BIOS areas:

• BIOS Update – Yep.  Upgrade (or downgrade) your BIOS remotely.
• BIOS Inventory – Collect a survey of the BIOS settings on the machine you run the executable against. Import the results file into the DCCU to read.
• BIOS Settings – Make your changes/tweaks accordingly!

Once you have selected your options and rolled up the package, a single EXE file is generated which is custom to your choices.  It is extremely intuitive but it helps to know a bit which BIOS options your particular hardware platform supports.  Not all Dell BIOS options are the same from system to system.

However, if you don’t know, you can even use the tool to perform a “BIOS Inventory”

BIOS Inventory: No substantial changes from the previous version. This simple option creates an executable that you can run on the client. Running the executable creates a results file (TaskResult.xml) in the same directory as the executable that you can import into the DCCU to view the current settings and their various options. The only change now is that the executable file no longer self destructs, and this change allows you to run it multiple times.

Then, in my case, I just remotely copied the custom EXE package I built to each of the remote systems needing the BIOS tweaks.  I created a “dell_BIOS” folder on the root of the systems for the file, then I ran the executable.  It will unpack a load of files and then you can reboot the system.

Once the reboot happens, the BIOS changes are made and the system comes back up.  The files are removed except for just a few and this is how you know the changes were done.

Wicked cool!

It is very easy to use and very powerful.

Here are some additional links I found to give you a sense of what to do and how to use it.

• Dell Client Configuration Utility 3.0 - The Dell TechCenter – With screen shots.  Here is the toy utility in all its power and glory!
• Configuring the BIOS using the Dell Client Configuration Utility (DCCU) - The Dell TechCenter – Earlier version than the current DCCU version 3.0 A00 dated 10/09/2008) but gives you an intro.
• Enable Wake On Lan with DCCU - The Dell TechCenter – This was one (of many) tweaks I did to improve system recovery and control in the event the system shuts down due to a power failure.
• Standardizing BIOS Settings in a Dell Shop – Windows IT Pro article contains a few deployment ideas and tips for DCCU BIOS update packages.

How cool is this!!!

Cheers!

--Claus V.

Read More

Super-Fast Linkfest Throw-down: Pt I

07/31/10: More updates posted at the bottom of this page regarding the .LNK vulnerability.

I had planned for a sleepy weekend.  You know, the kind to recharge your batteries after a crazy-insane work-week?

Yeah right.  Like that would come to pass….work responses required weekend dedication.  Bummer

So I offer only several rapid-fire posts to get the linkage unblocked.

Part I here continues with additional information I’ve saved on the Windows LNK exploit; building upon the my previous post: Windows zero-day exploit?: USB storage + .lnk file...

Unless something radical drops, this will probably be the last on this theme.  I’ve found it an interesting look into incident response, knowledge-sharing/growth, and a few more cool tools.

• (Windows) Shellshocked, Or Why Win32/Stuxnet Sux… -- ESET ThreatBlog (filed under perspective)
• It Wasn’t an Army -- ESET ThreatBlog (filed under perspective)
• Mitigating .LNK Exploitation With Ariad-- Didier Stevens (filed under cool tool/utility)
• Mitigating .LNK Exploitation With SRP-- Didier Stevens (filed under cool tool/utility)
• linkiconshim - Project Hosting on Google Code (filed under cool tool/utility)
• Novel New USB Attack | Optimal Security -- The Lumension Blog (filed under perspective)
• Code for Shortcut Zero-Day Exploit is Public - F-Secure Weblog : News from the Lab (filed under perspective)
• Shortcut mitigation and certificate revocation -- Chester Wisniewski’s Blog (filed under advice)
• Microsoft revised Security Advisory (2286198) Vulnerability in Windows Shell Could Allow Remote Code Execution – Donna’s SecurityFlash (filed under MS vulnerability clarifications)
• Preempting a Major Issue Due to the LNK Vulnerability - Raising Infocon to Yellow (filed under advice)
• siemens to scada users – don’t change that default password – yikes! – ParanoidProse - (filed under perspective)
• Tool Blunts Threat from Windows Shortcut Flaw — Krebs on Security (filed under perspective)
• Stuxnet Memory Analysis and IOC creation – M-unition Blog (filed under threat analysis)
• LNK Vulnerability: Embedded Shortcuts in Documents - F-Secure Weblog : News from the Lab (filed under new vector possibilities)
• Applied Fix It Solution 50486 (KB2286198) in Vista and Windows 7... – Donna’s SecurityFlash (filed under it worked for me) 
• Microsoft Security Advisory: Vulnerability in Windows Shell could allow remote code execution – Microsoft Support (filed under cool tool/utility)  Note:  links to MS “Fix it” one-click solution 50486 (to apply workaround) and 50487 (to remove workaround).  You also still have to manually disable the WebClient Service in Vista or Win7 to cover those bases as well; see Donna’s link above on that.
• Code signing certificates used in repeat attacks -- Tim Callan's SSL Blog - Online Security (filed under perspective)
• New Stuxnet-Related Malware Signed Using Certificate from JMicron - Points to a highly sophisticated industrial espionage operation – Softpedia (filed under perspective)
• VeriSign working to mitigate Stuxnet digital signature theft –The Tech Herald – Security (filed under perspective)
• Incorrect Information in MS09-014 -- Fortinet Security Blog (filed under perspective and analysis)
• Stuxnet: A Comprehensive FAQ -- Fortinet Security Blog (filed under maybe-I-should-have-titled-this-post-a-FAQ)
• Win32/Stuxnet: more news and resources -- ESET ThreatBlog (filed under I –wish-I –had-time-to-write-pithy-summaries-like-David)
• Microsoft LNK Attack and Defense -- Hurricane Labs Engineering Notes (filed under attack and defense analysis)
• Default Passwords and SCADA: Siemens Fails – /dev/null blog (filed under not-my-fault aka “the BP” defense)
• Exploiting MS “LNK” Vulnerability -- Information Technology Enthusiast (filed under attack and defense analysis)
• More malware exploiting Windows shortcut vulnerability -- Graham Cluley’s blog (filed under the-LNK-slick-grows)
• Protection for New Malware Families Using .LNK Vulnerability - Microsoft Malware Protection Center (filed under small-victories)

07/31/10: More updates

Out of band Microsoft update to fix the .LNK vulnerability exploit coming August 2, 2010.  Just be aware, no soup for XP-SP2 and W2K systems!

• Out of Band Release to address Microsoft Security Advisory 2286198 - The Microsoft Security Response Center (MSRC)
• Stuxnet, malicious .LNKs, ...and then there was Sality - Microsoft Malware Protection Center
• Microsoft to Issue Emergency Patch for Critical Windows Bug — Krebs on Security
• Microsoft issues out of band update for LNK - The Laws of Vulnerabilities

Saddle up!

--Claus V.

Read More

Threat Vector: Xerox WorkCentre Pro scanned to email documents?

I was checking my security feeds this weekend and found a nice little nugget via Donna’s SecurityFlash

• Criminals pushing Rogue anti-Virus disguised as scanned documents – The Tech Herald, post by Steve Ragan

Seems the Tech Herald’s offices got hit with an email scam claiming to have a file sent by a local Xerox WorkCentre Pro multifunction device.

More and more organizations are deploying these devices than can function as a fax, copier, network printer, and scanner resource.  By combining multiple features in a single networked device, I’m sure businesses are hoping to leverage cost savings and production efficiencies to their employees.

Overall, while they can be an IT management headache to manage, configure, monitor, update, and support…that’s why the company pays the vendors and IT department all those big bucks we see monthly, right?

Anyway, a quick examination of the email set of warning signs…the scanned document was presented as a “ZIP” compressed file, rather than as a more common PDF file (or TIFF or XPS format as mentioned).  Plus the message body didn’t quite match.

When the attachment embedded in the ZIP file was unpacked and scanned with malware tools, it was flagged immediately as a trojan in Microsoft Security Essentials though, as Steve points out, many other vendor scans via Virus Total at the time didn’t identify it as such.

Using emails as a malicious infection-vector isn’t new by any means.  However, with the increase in these multi-function devices to workplace environments, coupled with many employees receiving little to no training, the risks seem higher.

Image the following scenario.

Users at the mythical industrial leader CorporationX (I just made that up) recently have a similar multi-function device installed across their organization.  Besides network printing, they do experience great buy-in upon learning of the “scan-to-email” feature.  Previously only certain executives and their administrative-support pool had access to document scanners.  Now they can all digitize hard-copy material simply by placing it on the machine, selecting the scan-to-email feature, and putting in their email address.

Automagically when they go back to their desk, there is a standard email with their PDF document waiting!

Who wouldn’t like the idea of being freed from hard-copy handling and moving finally to the digital world?

Only in this case, multiple administrative and executive users at CorporationX got an email from a Xerox system that they themselves didn’t initiate/scan to themselves.  No matter.  It looks legit and because the default setting allows the email to go out with a generic “From” Xerox sender, a few of them figure that maybe one of their peers was copying them in (you can enter other email address names besides your own when sending the scanned document).

Must be some important corporate info!

Better open it up and take a peek immediately!

Strangely, Adobe Reader opened the document, flashed briefly then closed.  Then reopened with a document that had nothing to do with CorporationX.

Oh well, think all the users, someone must have scanned in the wrong document…

Unfortunately, the email (like that received by The Tech Herald) was in fact, not sent from within CorporationX but was a spoofed/forged email.

Embedded within this PDF was specially crafted exploit code that ended up dropping a root-kit/trojan on the system.  Now CorporationX was serving its secrets right out the back door.

It wasn’t until an IT team-member also received the email, questioned the authenticity and first checked the message header code that they discovered the email had been spoofed and came from an external source, and not from a CorporationX Xerox device. 

Additional investigation found the PDF was in fact embedded with malicious code, and off-line scans of some sample corporate field systems did find evidence of the root-kit/trojan.

So a formal incident-response kicked off and the migraines began for CorporationX as they now tried to determine what corporate info had leaked and what the damage might be and starting trying to find infected systems across the thousands they manage.

Bummer.

Still don’t believe an unsolicited/spoofed PDF attachment is a potential threat vector?

• PDF Most Common File Type in Targeted Attacks - F-Secure Weblog : News from the Lab
• Targeted Attacks – F-Secure YouTube video (9:33 min)
• F-Secure Lab tour: How PDF and Word attacks happen – YouTube video (2:14 min) uploaded by terolehto
• Demo of a PDF exploit – YouTube video (1:45 min) uploaded by hapokas7a

And I would be remiss to mention all of Didier Stevens’ extremely detailed work on PDF exploit research in the same breath.

To be very clear, I’m not at all positing that Xerox WorkCentre systems are bad or a threat (they are in fact just one manufacturer/model of many such option-capable devices in this crowded office-machine category). No I am not picking on Xerox in particular, all such scan-to-email devices can lead to the same complacency and attack vector via email spoofing.

Pretty useful things, they are.  However, their ubiquitous nature (it’s just a fancy copy machine) and the fact that the default configuration sends messages that are so cookie-cutter standardized, really sets up users for some social-engineering FAIL.  How can one expect the average user to first authenticate that the message is valid and legitimate if they are sending them daily to themselves safely, and others can include them as well?  And no one is adding their personal “From” identification into it?

Couple that with the potential threats from malware-hacked PDF file exploits (even more so if the Adobe Reader versions installed haven’t been updated/patched in a very long time) and it could be a nightmare.

I’m still not sure about solutions…disabling scan-to-email and using the more administratively managed “scan-to-mailbox” feature might be one method, or putting in place policy that requires users who do scan such documents to manually put in a valid identifying word or phrase in the subject line, or requiring them to put in their own corporate email address rather than using the default machine one might be a start.  Perhaps a more detailed system deployment that changes the default Scan to Email configuration so that a custom “WorkCentre Email address” name is used that better legitimizes the email notices by checking the “From” field on emails supposedly sent from the corporate device(s)?  Or even the “signature” line?  Check out this Scan to Email (PDF…I know…) quick configuration guide for some of the customization options available on many Xerox WorkCentre systems.  Please do something, anything, to make your internal scanned emails special and identifiable to your employees as being more legitimate.  That will help set the spoofed ones apart much more clearly from your users.

That’s not to say that end-user education, a strong A/V software solution installed on the user system desktops, security software that scans attachments at the email server level, and an IT policy that ensures Adobe Reader is kept current and patched also would be good practices.

I personally get a few “unsolicited” PDF’s scanned from Xerox systems in my email a week.  And I promise you, I check them all very carefully before actually opening the attachment.

So far I’ve not seen any such malware personally, but I think an ounce or two of caution is a Good Thing in this case.

Constant Vigilance!

--Claus V.

Read More