ForSec Linkfest - 2013 DST Fallback Edition

FYI…tomorrow morning at 2 AM here in the United States of America it will be time to “fall back” from DST. One more hour of sleep and then it’s weeks of trying to get the body’s timeclock to readjust.

So as you get ready to find all the clocks you need to manually adjust (don’t forget the vehicles!), here is some linkage to distract you from that task. Please note I’ve also sprinkled in some networking items as well to keep you on your toes!

• Wireshark 1.10.3 and 1.8.11 Released - Wireshark website
• Wireshark - Official site Download
• Reviewing Wireshark's Capture Pane (by Tony Fortunato) - LoveMyTool blog
• Using PowerShell to Automate Tracing - MessageAnalyzer blog
• Nmap cheat sheet - HelpNet Security blog - From the notice:
• Counter Hack founder and SANS instructor Ed Skoudis and his team created a helpful cheat sheet for Nmap, which includes notable scripts of the Nmap Scripting Engine, script categories, instructions for scan types, probing options, and more.
• How A Wireless Issue Looks Like a Wired Issue (by Tony Fortunato) - LoveMyTool blog
• NAFT: The Movie - Didier Stevens
• New utility to quickly set the DNS servers of your Internet connection - QuickSetDNS utility from Nir Sofer's workbench.
• On getting Pineappled at Web Directions South - Troy Hunt’s blog
• Disassembling the privacy implications of LinkedIn Intro - Troy Hunt’s blog
• Command-line Forensics of hacked PHP.net - NETRESEC Blog
• iOS apps can be hijacked to show fraudulent content and intercept data - Ars Technica
• Your iPhone knows where you’ve been, puts it on a map - Chron.com’s TechBlog
• What's New in the Prefetch for Windows 8?? - Invoke-IR blog
• Re-Introducing the Vulnerability Search - Journey Into Incident Response blog
• Links - Windows Incident Response blog
• Incident Response Teams are the New (Security) Black - Speaking of Security - The RSA Blog and Podcast
• Red Alert: 10 Computer Security Blogs You Should Follow Today - MakeUseOf blog
• New Security Intelligence Report, new data, new perspectives - Microsoft Malware Protection Center blog
• Meet “badBIOS,” the mysterious Mac and PC malware that jumps airgaps - Ars Technica
• Hacking a Reporter: Writing Malware For Fun and Profit (Part 1 of 3) - SpiderLabs Anterior
• Treasure Hunting with FTK, EnCase, and SQLite Databases - Computer & Digital Forensics at Champlain blog
• Add the CAINE ISO to your E2B drive - RMPrepUSB, Easy2Boot and USB booting

Cheers,

Claus Valca

Read More

Microsoft Remote Desktop for iOS

At work we cannot (yet) use Microsoft Remote Desktop for iOS to connect to end-user systems for troubleshooting support.

At home, the Windows versions we have for daily use are “Home” editions and really don’t support Microsoft Remote Desktop sessions…at least not without some clever hacks that I don’t really need or care to implement.

So for now, at work remote control of end user systems from iOS devices remains a dream.

And at home, I find that running TightVNC works super-spiffy and that the Mocha VNC iOS app works just fine to allow me to remote-control our home Windows systems at will from my iPhone 5.

So for now, I really don’t have an environment where I can give the newly acquired/released Microsoft Remote Desktop client for iOS devices a shake. Maybe I’ll see if it can get it going with one of the Win7/8 Enterprise IETester virtual machines I have and use for testing at home.

So, if you are curious, here are some links regarding the subject.

• Microsoft Launches Remote Desktop App for Android and iOS - The Next Web
• Microsoft Remote Desktop App For Android & iOS Available For Download - AddictiveTips
• Microsoft quietly announces new Remote Desktop apps for Android and iOS - BetaNews
• Microsoft to launch new remote desktop apps for iOS, Android - ZDNet

And if you want some interesting background, according to Kurt Shintaku, the app came from iTap via HLW Software Development which had been kicking around for a while, and was bought  by Microsoft.

INFO: Yeah, the Remote Desktop apps for Mac OS X, iOS & Android came from iTap technology acquired from HLW - Kurt Shintaku's Blog

Very interesting…

Claus Valca

Read More

More iOS 7 tips and notes

I still haven’t upgraded my iPhone 5 to iOS 7 yet.  So far I have 5 apps that I cannot update as they require iOS 7 to load. None of them are critical.

Neither of the girls in the Valca home have their iPhone 4 units on iOS 7 either.  Alvis did upgrade her iPad to iOS 7 without any drama and her beau just got his new iPhone 5s the other day. It’s kicking fast.

My bro just successfully upgraded his iPhone 5 to iOS 7 today and had no issues so I think I will get him to give me a tour and play on it a bit since we have the same model.

I had planned to do the upgrade this weekend as I expected some patches to come out in the period before the first release and now that was true (current version of post time is iOS 7.0.2).

But now I am reading rumors that an iOS 7.1 build might come out in a few more weeks so I think I will try to hold off the upgrade just a bit longer, especially since once you upgrade you can’t roll back to iOS 6 since Apple killed their signed firmware certificates for it.

So here is a collection of iOS 7 linkage I have grabbed so I can continue to review and pre-study and then refer-back to once I do the jump for some possible tweakage.

Downgrading from iOS 7 to iOS 6: Why Apple won’t let you - ExtremeTech

iOS 7, thoroughly reviewed -Ars Technica

Linkpost | 9.18.2013 - Chron.com’s TechBlog  - chock full of iPhone 5s/5c news and links!

Death to textures: iOS 6 and iOS 7 compared in pictures -Ars Technica

iOS 7 Review: Pretty Is as Pretty Does - Gizmodo

All The Apps Optimized for iOS 7 - Lifehacker

iOS 7 vs. iOS 6: A Look At The Major Interface Changes - Addictive Tips

iOS 7's Biggest Annoyances (and How to Fix Them) - Lifehacker

New lease on life or death sentence? iOS 7 on the iPhone 4 - Ars Technica

Upgraded to iOS 7? 5 Shiny New Things To Check Out Right Away - MakeUseOf

How to turn off iOS 7 frequent location tracking and increase your privacy - iMore

iOS 7 Smart Multitasking & Background App Refresh Explained - Addictive Tips

Everything You Need to Know About the iOS 7 Upgrade - Kinja

Linkpost | 9.19.2012 - Chron.com’s TechBlog

Eight things to love about iOS 7 [Updated] - Chron.com’s TechBlog

Here’s how to prepare for iOS 7 - Chron.com’s TechBlog

Before and after: The best iOS 7 app redesigns (Updating) - The Next Web

How to access list view in the Calendars app on your iPhone or iPad running iOS 7 - iMore

Lesser Known New Features & Changes In iOS 7 - Addictive TIps

How to disable Control Center access on the iOS 7 Lock screen - iMore

How to delete individual iMessages and texts in iOS 7 - iMore

iOS 7 lock screen bypass flaw discovered, and how to fix it - ZDNet

iPhone 5s Teardown - iFixit

Apple iOS 7 Uses New Multi-path TCP Protocol Extension - Daniel Miessler

Top 10 Secret Features of iOS 7 - Lifehacker

How to bring the bold fonts back to iOS 7 - iMore

iOS 7.0.2 now available, fixes Lock screen passcode bypass - iMore

Apple releases iOS 7.0.2 with fix for Lock screen passcode bypass flaw - 9to5Mac

iOS 7.0.1, iOS 7.0.2, and iOS 7.1 already seeing widespread testing inside Apple - 9to5Mac

Cheers

--Claus Valca

Read More

iOS 7 - Coming to something near you soon

I hesitated to post this linkfest on iOS 7.

Some of the links are old and some are geeky and not everybody who stops by GSD even has an iPhone/iPad/iWhatever device…and probably could care less.

So please indulge me with the link-dump on iOS 7.  No gushing (yet) shall occur.

I’m personally going to hold off dumping it on my iPhone 5 device for a few weeks until the blog-0-sphere settles down and the dust (and commenting/review/feedback) has been kicked up and spread around.

So this is for reference purposes only.

(And so I can figure out what to do when all the users I support at work with enterprise-issued iPhone 4S devices manually upgrade their devices and then tell me they don’t know how to work them in the new iOS version on Sept 19th.)

Fresh linkage I had saved on iOS 7 (& new iPhone model) news

• All the New Stuff in iOS 7 - Lifehacker
• iOS 7: what's changed since June? - The Verge
• Apple iPhone 5S: Everything You Need to Know - Gizmodo
• What's The Difference Between The iPhone 5S and 5C? – ReadWrite
• A tale of two iPhones: Hands-on with the iPhone 5S and iPhone 5C (update: video!) - Ars Technica
• iPhone 5s vs. iPhone 5c vs. iPhone 4s: Which iPhone model should you get? - iMore
• Potential Security Applications of the iPhone 5S M7 Motion Coprocessor - Lenny Zeltser on Information Security
• Apple gets ready for iOS 7 shock - TechBlog’s Dwight Silverman
• Apple introduces the iPhone 5S and 5C; iOS 7 update coming Sept. 18 - TechBlog’s Dwight Silverman
• iOS 7 Ships September 18 - AllThingsD blog
• Here’s who should (and shouldn’t) buy the iPhone 5S - TechBlog’s Dwight Silverman

Older linkage I had saved on iOS 7 news

• iOS 7 Feature: Multi-tasking in Landscape mode - The4Cast blog
• WWDC 2013 and iOS 7: What we didn't get - iMore.com
• A Complete Summary Of Major New Features & Changes In iOS 7 - AddictiveTips blog
• Flattened: An iOS 7 design gallery - Ars Technica
• Sure, iOS 7 Looks Awfully Familiar. It Also Looks Like A Winner – ReadWrite
• Apple's New iOS 7: What You Need To Know Now – ReadWrite
• Apple Announces iOS 7: New Design, Multitasking & Many New Features Are Coming Your Way [Updates] - MakeUseOf blog
• iOS 7 - Matt Gemmell
• Why does the design of iOS 7 look so different? - The Next Web
• iOS 7 preview: Notification Center - iMore.com

Whatever…

--Claus Valca

Read More

iPhone Traffic - ZAP’ed, Security, and Network Tap Tap Tapping

This week brought in a very interesting post from web security/developer Troy Hunt.

 Unearthing the hidden shortcomings in Aussie mobile app security - Troy Hunt’s blog

Please go read then come back.

Interesting isn’t it?

I know most GSD readers probably wouldn’t be surprised to find some of their favorite mobile-apps leak user ids and passwords in plain-text, but for those who don’t know, some do.

Case in point (that has now been reported as fixed!):  Zscaler Research: Mobile App Wall of Shame: ESPN ScoreCenter

Naturally that got me thinking about a common mantras in the For/Sec world; “know your tools” & “verify, verify, verify”.

What I want to do is some benchmarking and analysis of the mobile apps I use on my own iPhone to have a better understanding on what is happening with their network traffic. This would be valuable information to know for general usage, and critical knowledge in case you unknowingly encounter a Wi-Fi Pineapple in the wild or a more complex man-in-the-middle Wi-Fi attack and get your network traffic captured.

One super-easy (and lazy) way I have found is to use ZAP - Zscaler Application Profiler.  From the “About” page link:

About ZAP

Zscaler Application Profiler (ZAP) is web based tool designed to streamline the capture and analysis of HTTP(S) traffic from mobile applications. ZAP is capable of analyzing traffic from both iOS and Android applications and includes the following functionality:

• Search: View summarized historical results for past scans.
• Scan: Proxy traffic from a mobile device through the ZAP proxy and the mobile app traffic will be automatically captured and analyzed
• iPCU: Upload your iOS device configuration file(.deviceinfo) to check risk score of installed application. It will give you overall risk score of your device. The information provided is based on out knowledge base.

ZAP classifies traffic into the following buckets and calculates an overall risk score for the application:

• Authentication: Username/password sent in clear text or using weak encoding methods.
• Device Metadata Leakage: Data that can identify an individual device, such as the Unique Device Identifier (UDID).
• Personally Identifiable Information Leakage: Data that can identify an individual user, such as an email address, phone number or mailing address.
• Exposed content: Communication with third parties such as advertising or analytics sites.

Zscaler also has a detailed video on this service on their blog: Zscaler Research: Introducing ZAP.

So you can either check their historical report data on apps already researched, you can connect your device to their proxy to do a scan on a new app/version not already captured historically, or even upload your own iOS device config file.

Wow.  Bookmark this resource link now!

However, there may be cases you want to do your own local network traffic capture and analysis…because you like pain and frustration (and hands-on learning perhaps).

Part I - In Which Hardware TAP Options are narrowed down

At work (when & where authorized) we can set up network packet captures either on a specific system or on the LAN using port-SPAN.

At home, I don’t have a managed switch (or dumb hub) that can do that.  I suppose I could buy a USB-NIC (so I can have two wired network ports on my laptop) and then capture traffic temporarily though one of these messy devices (home-built or purchased) but that isn’t quite as elegant as I would prefer.

Or (as the TinyApps bloggist kindly just reminded me) use Cain & Abel.

• Capturing Packets on a Broadcom Card - The Flying Frank
• Configuration - OXID.I

Instead I decided I'll pick up a specialized device that support a network TAP.  This way I can just hook it in line between my Wi-Fi router and the cable modem and capture everything that passes though. It may not be 100% on packet captures, but I think it will be good enough for my home testing.

So the next question is what device?

I’ve settled on the following options:

• Dualcomm DCSW-1005 USB Powered 5-Port 10/100 Fast Ethernet Switch TAP (Port Mirroring) - Amazon.com link
  • Dualcomm DCSW-1000/1005PT - Dualcomm product page
• Dualcomm DCGS-2005L 5-Port 10/100/1000 Gigabit Ethernet Switch Network TAP (Plastic Case) - Amazon.com link
• Dualcomm DCGS-2005 5-Port 10/100/1000 Gigabit Ethernet Switch Network TAP (USB Powered, Port Mirroring, PoE Pass-Through) - Amazon.com link
  • Dualcomm DCGS-2005/DCGS-2005L - Dualcomm product page

The DCSW-1005 model is an attractive basic option. It supports port-mirroring, is USB powered, and has 5-ports. (note only port #1 is mirrored to port #5).  The price is good.  The only “drawback” I see is that it only supports 10/100 speed on the network.  While I seriously doubt I would ever approach over 100 Mbps and cause a bottleneck on my home network…most all my other network equipment is 1000 Mbps capable.  So thinking forward, this could be slightly limiting down the road, or if I am asked by family/friends/associates to do some network troubleshooting on a “true” 1000 Mbps network, or tapping in between two network devices actually running at 1000 Mbps.  So there is that. Also, the buffer memory used by the device in the mirroring process is 256 KB. So if that gets saturated, there is the possibility of dropped packet captures.

The only difference between the DCGS-2005/2005L seems to be the “L” model has a metal cabinet while the other doesn’t. Of course, that option comes with a $20 markup as well.  I’m pretty sure the plastic cabinet would be just fine, but the vanity in me just likes the metal cabinet appearance a bit more. Probably just a bit more durable when tossed around in a go-bag and maybe it might dissipate heat a bit better? This model does support up to 1000 Mbps so there is that benefit since it is (at least $100 more expensive) but the buffer memory is just 104 KB. Hmmm. 

Should I be concerned about overloading either of the devices’ memory buffer when capturing home-network traffic? Probably not but what say you pros?

I did find these pretty basic and older reviews, including one from the guru of network security Richard Bejtlich.  I really didn’t find any more recent reviews of the device so if/when I get my hands on one, you can be assured I’ll have a write-up review.

• DualComm Port Mirroring Switch - TaoSecurity - (Sept. 2010)
• Review of Dualcomm 5-Port Pass-Through Port Mirroring Switch - LoveMyTool - Betty DuBois - (April 2010)
• Network Security Monitoring with Dualcomm DCSW-1005PT - CyberArms - D.Dieterle - (Nov. 2010)

Part II - In Which Other Alternatives are discovered

So let’s assume that you are already comfortable with network packet captures, installing network software, and making network configuration changes to Wi-Fi devices.

Are there any options to capture iPhone network traffic without going to the trouble and expense of picking up TAP hardware just for that task?

Yep.

First option is a tool called Paros. It is Java based (I know, I know..) and can assess web application vulnerabilities. The link has a Windows binary that appears back from August 2008.

Here is a nice walkthough on using Paros Sniff Your iPhone's Network Traffic by Jerod Santofrom to give you some introduction to it.

There was a comment on the Paros page providing information to a very current “fork” of Paros: ZAP

(Note: Not to be confused with the Zscaler ZAP service)

OWASP Zed Attack Proxy Project - OWASP - OWASP.org

There are tons of information on that page on this tool:

• Screenshots
• wiki videos page
• project pamphlet - a very quick intro
• project presentation - longer presentation

And here are some quick links on ZAP usage:

• Owasp ZAP - InfoSec Institute post
• Debugging SSL on Both iOS Devices and Simulators with Man-in-the-middle Proxies - CodeProject
• Intercepting iPhone traffic with your MacBook - Shaun Zinck’s blog

Next up, we have Fiddler, a free web debugging proxy from Telerik

• Capturing HTTP traffic on an iPhone with Fiddler - Scott Wojan’s DotRant blog
• Configuring Fiddler to Capture Web Traffic from an iPhone/iPad Device - ESRI Support Services blog
• How To Sniff iPhone Network Traffic - Matt McClure’s blog

Finally, if you are hard-core, just go use Wireshark.

• iPhone Meets Wireshark – Capture Wireless Network Traffic from Mobile Devices - EtherLook

Part III - Resources, References, & Pineapples

Here are some additional links related to all of the above discussions including the Dualcomm products, SPAN/TAP considerations, and the next network device I’m interested in picking up to play with; the Wi-Fi Pineapple.

SPAN Out of the Box (PDF Link) - John He’s Dualcomm Technology PowerPoint presentation at SharkFest 2010. Goes into details about SPAN/TAP considerations and specifics on what DualComm feels makes their product super special. SPAN out of the Box (Blip video)

B-7 (Battaglia) TAPS Demystified (PPT Link) - Samuel Battaglia’s Network Critical PowerPoint presentation at SharkFest 2010.

SPAN Port vs TAP (Video) - Betty DuBois- SharkFest 2009 presentation. PowerPoint presentation here (ZIP).

SPAN Port or TAP? CSO Beware - LoveMyTool blog - Tim O’Neill

Network Monitoring Madness: Poor Man’s Resource Linkfest - GSD blog post from 2010.

Let’s Get For/Sec-Motivated! - GSD blog post from 2011.

The beginners guide to breaking website security with nothing more than a Pineapple - Troy Hunt’s blog.

Your Mac, iPhone or iPad may have left the Apple store with a serious security risk - Troy Hunt’s blog.

Pineapple Surprise! Mixing trusting devices with sneaky Wi-Fi at #wdc13 - Troy Hunt’s blog.

Netgear DS104 4-Port 10/100 Dual Speed Hub with Uplink Button (Amazon link) - recommended to look into as well by TinyApps bloggist who reports he had good experience with it.

CaptureSetup/Ethernet - The Wireshark Wiki

CaptureSetup/WLAN - The Wireshark Wiki

Cheers!

--Claus Valca

Read More

iPhone Tips - When you don’t care to RTFM

Just for my reference….moving on.

Understanding iOS Status Bar Symbols - Apple Club

hyperlink - What is "mt=8" in iTunes links for the appstore? - Stack Overflow. From that link:

Apple designates a number of different Media Types (mt values):

1 Music
2 Podcasts
3 Audiobooks
4 TV Shows
5 Music Videos
6 Movies
7 iPod Games
8 Mobile Software Applications
9 Ringtones
10 iTunes U
11 E-Books
12 Desktop Apps

So, to answer your question, the "mt=8" in iTunes links simply identifies it as being of type 'Mobile Software Applications'.

and further in those comments:

For the commenter above, in case you haven't figured out, ls=1 means the URL will try and open iTunes and follow the link. If ls=1 is not included it will simply load the web page for that particular media asset.

safari safe browsing data what is it? - Apple Support Communities

Q: what is the safari safe browsing data when you sync you phone after the iOS 5 update??

A: Google Safe Browsing Data Syncs to iOS Devices Via iTunes - The Mac Security Blog

--Claus V.

Read More

Claus’s iPhone App List - Updated

Updated September 2013

Here is an updated listing, semi-categorized, of iOS iPhone apps I’m using on my iPhone 5. I’ve had it now for just over six months and I have really jumped on the value and convenience it and the applications have provided me. Don’t know how I lived without a smart-phone for so long.

All links will be to the iTunes App Store page unless otherwise noted. I’ve updated the permanent link on the sidebar under “Claus’s Toolbox”.

I’m only listing Apps that I use (or plan to purchase relatively soon for use). This post is for me to self-reference and primarily be a way to recommend/share Apps with the few family and friends who have iPhone discussions with me.

A mini price-range key:

• free = free. May or may not be ad-supported. That said, if it is ad-supported or pop-up in-app notifications to upgrade to a paid-version are too annoying or obtrusive, the app is deleted.
• $ = $.99 to $2.99 range.
• $$ = $3 to $7.99 range.
• $$$ = $8 to $9.99 range
• $$$$ = over $9.99

Note that when posted, some apps may be on a special pricing discount for holiday or promotions. I’ll try to keep an eye on things but it’s only a rough guide.

“Default” apps that come installed/bundled with the iOS don’t get listed.

I have a few great Apps I won’t list for privacy reasons; banking/insurance/shipping/specific shopping/vendors, etc. Just because you don’t see those listed, doesn’t mean I don’t use them.

Finally, just because all these apps fit on and run on my iPhone 5 (64 GB), currently iOS 6.0.2, doesn’t mean they will all fit on your own iPhone.

Finally, I don’t know the impact iOS 7 will have on this list. I generally/guardedly like what I am seeing and hearing on iOS 7 but time will tell. 

Here’s the list.

Core Apps

• Reeder - free (for now) though I gladly and joyously paid $ for it a few months ago before it became free. Now supports “standalone” RSS feeds rather than one of many supported on-line RSS services. The addition of that feature makes it my #1 Valca-cool app of awesomeness. Power to the People! You are brilliant and you are the master, Mr. Silvio Rizzi! You are a Rock Star for adding that feature! Enough said.
• Chrome - free
• Gmail - free
• Google Maps - free
• MiniKeePass - free
• Naturespace - free/in-app $ (and I purchase a LOT of these tracks)
• Wave Alarm - free (note I sprung for the in-app $ paid version). Wakes me up every day!
• Wave Timer - free (note I sprung for the in-app $ paid version)

Productivity/Organization Apps

• Agenda Calendar - $ - my core calendar app; supports reminders. Hard to view upcoming scheduled events at a glance
• Fantastical - $$ - I love the at a glance calendar event layout view (missing in Agenda) but lack of reminder support is serious. -2 on the scoring. Still becoming friends with this app.
• Clear - $
• Due - $$
• Easy Note + To Do - $
• Grocery List - Buy Me a Pie! - $

Weather Apps

• Weather Underground - free - (I paid $ for a 1-year in-app removal of ads) “realtime” radar data map display makes this app priceless to me! + it comes with lots of tropical weather (hurricane) tools and links so I may not need to purchase a hurricane-specific app.
• WeatherMap+ - $ - Super cool forecast data projections. Awesomeness!
• The Weather Channel® Max - $$
• NOAA Hi-Def Radar - $ - beautiful image quality but radar data lags from several to +5 min behind current time. I want near real-time radar data please!

Text/Reading Apps

• Adobe Reader for iPhone - free
• Byword - $
• Documents by Readdle - free - I love I can connect wirelessly between PC and iPhone for document transfers.
• Google Translate - free
• Kindle - free

Networking/IT/SysAdmin Apps

• Deep Whois - free
• Emerald Time - free
• Fing - Network Scanner - free
• Mocha iSys - free
• Mocha VNC for iPhone - $$
• IPv4 Subnet Calculator - $
• Network Ping Lite - free
• Networking Toolkit - free
• Nice Trace - traceroute - $
• Speedtest.net Mobile Speed Test - free
• TeamViewer HD for Remote Control - free - (note seems to work best on the remote system with an installed version of TeamViewer rather than TeamViewer Portable…maybe that was just me…)

Faith Apps

• Bible! (Logos) - free
• PocketSword - free
• Bible Study With Accordance - free

Media & Sports Apps

• ABC Player - free
• CBS - free
• ESPN College Football - free - (requires free account registration. What can I say. I love college football.)
• ESPN ScoreCenter - free - (using again after registering for free account).
• KUHF News/Classical 91.7 - free
• NBC - free
• NPR Music - free
• NPR News - free
• Pandora Radio - free/$$-subscription
• PBS - free
• PRI - free
• Science Friday - free
• SomaFM Radio Player - $$
• TED - free
• TV.com - free
• Vimeo - free
• XFINITY™ TV Player - free/requires Xfinity customer account
• YouTube - free
• The Masters Golf Tournament - free

Specialized Utilities

• Teslameter 11th - $ - cheap EMF/magnetometer detector.
• Converter Plus - free
• Decibel 10th - free
• DuckDuckGo Search & Stories - free
• Find My iPhone - free
• How to Cook Everything Essentials - free
• iHandy Carpenter - $
• Spyglass -$$
• Survival Guide - free

Photography/Art

• Adobe Photoshop Express - free/in-app $ upgrade
• Ink - free
• Paper (miSoft) - $

Health/Fitness/Education/Fun

• 7 Minute Workout - free
• 7 Minute Workout “Seven” with High Intensity Interval Training Challenge - free
• iHikeGPS - $$
• Learn German: Babbel - free
• Mind - free

Hardware Support
These are the primary “hardware” items I use (or will be using) with my iPhone. Note: Price rating system suspended here. Do the research if you are curious.

• Bluetooth Headset, Jabra WAVE - Got this in lieu of a Jawbone ERA. The reviews were good but the two factors that really sold me on this replacement headset for my battered Jawbone were the ability to connect/pair it to TWO iPhones at once (I now carry two, one from work and one is my personal) so hands-free car-driving is a joy again…and the fit around my ear due to the design means it stays fast and put when I am working and playing…no sag like the Jawbone ear loop does after a while. Highly Valca recommended device. Call quality is quite good (my own experience and feedback from family/friends on the far end).
• Jawbone JAMBOX Wireless Speaker - Christmas present from Lavie. GSD post: It just has to be bigger on the inside…
• Lightning Digital AV Adapter - Lightning to HDMI - Apple Store (U.S.) - Hey Mom, seen movie (insert title here) yet? Nope? Want to watch it right now off my iPhone on your HDMI TV? Great! Let’s go!
• Jawbone (version 2) - (obtained back in 2008) - still running strong, though highly battered. Now retired but still works in a pinch.

Previously Used Apps (free) Upgraded to Purchased Versions or Alternatives
These are apps that I previously had on my iPhone but later upgraded to purchased versions and/or removed to make way for another/different version of the same app function. They are still highly recommended.

• Byline - $ - dropped for now as they don’t support “standalone” RSS feed reading and Google Reader has gone bye-bye which is what I used with it for feed reading.
• Commander Compass Lite - free
• iHandy Level Free - free
• Mocha VNC Lite - free
• MapQuest - free
• MyRadar Weather Radar - free
• Alarm Clock - ZenAwake - $

Still pending purchase/installation - (sooner or later)

• Mailbox - free
• Hurricane Tracker - $
• Hurricane - $
• iFileExpress - free
• Documents To Go - $$$
• Photo Manager Pro - $

Hope you find this helpful.

--Claus V.

Read More

ForSec News Roundup

Final GSD post of the weekend. 

Strategies of a world-class computer security incident response team - Help Net Security - Carson Zimmerman presents “…ten fundamental qualities of an effective CSIRT that cut across elements of people, process, and technology.” Run-time is just over 33 min.

ProcDOT - Visual Malware Analysis - SANS Computer Forensics and Incident Response blog. Christian Wojner introduces it thusly…“It correlates Procmon logfiles and PCAPs to an interactively investigateable graph. Besides that ProcDOT is now also capable of animating the whole infection evolution based on a timeline of activities. This feature lets you even quickly find out which server or which requests were responsible that specific data/code got on the underlying system, by which process it was written, how often, who injected what, which autostart registry key was set, what happened when, and so forth ...” Get it via ProcDOT - CERT.at

From the ProcDOT project page:

Screenshot

Instruction-Media

The User Interface
Tutorial-Video 1: The User Interface
Tutorial-Video 2: The Graph
Tutorial-Video 3: Analysis (Part 1)
Tutorial-Video 4: Analysis (Part 2): The Timeline

Over at the ISC Diary blog, Mark Baggett has been posting a great series of articles examining the tug-and-pull between those in IT/Sec who advocate a full OS wipe/reload after a malware infection and those who say “save-time-and-clean-it” by removing the malware infection, but not reimage the system. There still seems to be some kind of mysterious desire by staff to possibly prove what a clever IT person we are by digging an infection out of a system rather than just recovering the user’s data, wiping the system, then restoring it from a clean image and putting the data back. Maybe we all want to be a hero. However, as Mark’s posts show, if not done properly and effectively, the malware may remain persistently hidden but functional and you may be back before you know it (and the rest of your data secrets lifted or network exploited). These posts are a good guide and gut-check for how challenging these threats can play hide-and-seek. Familiarity with these techniques might be your last line of defense if your shop doesn’t have a fast-n-hard policy of recover/wipe/restore remediation.

• Wipe the drive! Stealthy Malware Persistence Mechanism - Part 1 - ISC Diary blog
• Wipe the drive! Stealthy Malware Persistence - Part 2 - ISC Diary blog
• Wipe the drive! Stealthy Malware Persistence - Part 3 - ISC Diary blog
• Wipe the drive! Stealthy Malware Persistence - Part 4 - ISC Diary blog

Tracking Down Persistence Mechanisms - Journey Into Incident Response blog - Not to be outdone, Corey Harrell does a great companion-piece to the ISC Diary blog posts above.  Corey details how he uses Microsoft Autoruns utility in that process.

From one of the comments there, we jump over to Finding Evil: Automating Autoruns Analysis post over in the trustedsignal blog from Dave Hull.

And then in spot-on timing within the ForSec community, Mark Woan at woanware releases a new utility called autorunner. 

“Autorunner is based upon the AutoRuns tool by the Sysinternals/Microsoft gurus. It is designed to perform automated Authenticode.aspx) checking for binaries designed to auto-start on a host. Its primary purpose is to aid forensic investigations.

“…autorunner is designed to work around all of these issues. It will check against all user profiles associated with the host. It will parse out LNK files to the actual binary (one level down). It allows the user to specify multiple drive mappings, so that if the forensic image contains multiple partitions you can map the original drives to mounted drives on the forensic workstation.

“The application should be used against a forensic image that has been mounted using whatever method you desire.”

Securely wiping an SSD - TinyApps blog - Getting back to the drive-wiping thought, this quick-post reminds us of some of the hazards of attempting to sanitize a SSD device. Some might think using a SSD device to hold image captures might be a good idea but if you do, be sure it is one you can truly “zero-out” and sanitize before porting your image over to it! Does anyone use SSD devices yet for that purpose? What other challenges (cost aside) would this present. Are there any benefits to a SSD over a HDD for storing or capturing disk images?

Placing the Suspect Behind the Keyboard – NEW BOOK! - Windows Forensic Environment - Congratulations to Brett Shavers for his new book! It’s been added to my Amazon.com wish-list queue for triggering once my next Amazon.com gift certificate ship comes into port.

Tool Time - The Hacker Factor Blog - A great post in the theme of “know your tools” before you trust the results they provide. One of the gem finds in Dr. Neal Krawetz’s post is his link to the National Institute of Standards and Technologies (NIST) and National Institute of Justice (NIJ) 2012 Computer Forensics Tool Testing Handbook from their computer forensic tool testing program. It’s got 173 pages of goodness to review. The latest publications can be found on this Topical Collection: Computer Forensic Tool Testing Publication Database | National Institute of Justice.

4:mag Issue #1 - Forensic 4cast. A very nice and slick digital publication debuts. This edition covers topics in iOS device/application data & malware, starting out in the digital forensics field, and hard-drive secrets.

The students over at the Champlain College Computer & Digital Forensics department have been busy working on papers addressing Private Browsing. Expect more in this series:

• Private Browsing Forensics: Introduction - (PDF Link) Private Browsing Forensics: Introduction
• Private Browsing Part 2 - (PDF Link) Private Browsing Part 2

RegRipper Ripper (3R) and the list of reg keys covered by RR plugins - hexacorn bog.

RegRipper Consolidation - Windows Incident Response blog. Harlan and crew have been super-busy trying to clean house and tie up some loose ends in the RegRipper landscape. This new effort should help make “one-stop-shopping” and development support for RegRipper and plug-ins much easier. Additionally, Harlan has been working hard on the blog to post additional background information on some of myriad (Cory referred to 280+ in his post) RegRipper plug-ins.

Forensic 4cast Awards 2013 – Meet the Nominees - Forensic 4cast. Voting is now open. You can place your votes here.

Encrypted Disk Detector Version 2 - SANS Computer Forensics and Incident Response blog - Chad Tilbury announces and introduces a new version that is out. Get it here over at Magnet Forensics.

What is "up to date anti-virus software"? - ISC Diary.Great post and great discussions in the comments.

Case Leads: LivingSocial Hack, New Cyber Warriors, analyzeMFT update and more... - SANS Computer Forensics and Incident Response blog

Cheers!

--Claus Valca.

Read More

It just has to be bigger on the inside…

 

Last Christmas, Lavie gifted me with a cute little Jawbone JAMBOX unit.

I thought it was pretty cool. It uses a Bluetooth connection to join from your supported device and provides significantly better sound quality than most “on-board” device speakers do.

But then I use and enjoy the latest Apple ear Pods that came with my iPhone 5 so I was skeptical on just how much use I would get out of.

Turns out Lavie knows me better that I do as the answer to that turns out to be “a lot.”

My use of it started out simple.  I synced it with my iPhone 5 and left it on my bed stand. At night going to bed I would play it with my Naturespace app playing on a timer to fall asleep to relaxing sound loops. The sound quality was so full and rich it provided a great immersive experience. Some of my favorite rainstorm and wind-blowing-in-the-tree loops sounded like I was right there. Since I wasn’t wearing ear pods, I could fall asleep without care.  So with the Wave Alarm to get me up in the morning and Naturespace to lull me to sleep, the bedside digital clock I’ve had for years got removed and went into the garage-sale box.

About a month later, I was finally able to get Lavie interested in watching a DCI Banks series I had enjoyed on PBS. Only it has long-past run. Fortunately I found it still available on a PBS streaming channel and we watched it on the laptop…but the sound quality from the laptop speakers wasn’t quite as nice as desired. So I synced the little Jambox up to the laptop’s Bluetooth and the sound was totally super.

Lately I’ve been now hauling it to work with me each day. Sure, I could connect my iPhone to some spare pc speakers with the mini-plug but the sound from them just doesn’t compare to that coming from the little box. It really fills my cubicle space up with the Naturespace sound loops or tunes from the iPhone library, but because it is so rich, I don’t have to crank it up loud at all and worry about disturbing my fellow cubicle mates or even turning it down/off when incoming phone calls roll in.

The only drawback was the loud “syncing” speaking dialog and sounds when it would establish the Bluetooth device connection.  That was really annoying.

While poking around on the JAWBONE site looking for a new headset a few weeks ago, I took a chance look at the Jambox page and found their MyTALK page. Turns out, you can register for free and then download upgrade software packages to your device that really expand the feature sets. First I upgraded (over USB wire) the firmware for my Jambox. Then I was able to customize a bunch of settings, such as disable the paring vocalizations (this is called Silent Mode) that were irritating me. You can also load different voices if you like the vocalization but just not the voice itself. There are a variety of female and male voices with different accents to pick from. There are also some “apps” that expand features such as using it as a speakerphone to name just a few.

Maybe if I read the manual that came with it I would have figured this out sooner, but if not, and if you do have a Jambox unit, I really encourage you to check out the MyTALK features and easily expand the capabilities of the device.  That’s really the point of this post, to tip off other users of a Jambox who might not have uncovered this ability to update and customize the internals of their device.

It isn’t the only Bluetooth portable speaker device on the market, but it has awesome sound and is very high-quality and solid. And there is just so much high-quality sound pack into that little bitty box, you would swear it must be using Time Lord technology…

Cheers!

Claus V.

Read More

Google Reader’s Demise: A Big Deal for being not that big a deal

At first I almost overlooked notice that Google Reader service was shutting down this summer.

Fortunately for me a wealth of articles burst forth on the Web and the noise couldn’t be missed.

• A second spring of cleaning - Google’s Official Blog
• Google announces Reader’s imminent demise - Ars Technica
• Google Reader Is Shutting Down; Here Are the Best Alternatives - LifeHacker
• Poll Technica: Where should we go when Google Reader is put out to pasture? - Ars Technica
• Google plans to execute Reader, among other apps - BetaNews
• End of an Era: Google shutting down Reader - Justinsomnia
• The End of Google Reader - NT Blog
• Google Reader Going Away - Standalone Sysadmin
• Users rally against Google's plans to shut down Reader - BetaNews
• R.I.P Reader: Google giveth, and Google taketh away - TechBlog
• Google Reader may very well rise again… as part of Google+ - Ars Technica
• Why We Mourn Google Reader - And Why It Matters – ReadWrite
• How to export and transfer your Google Reader feeds to another RSS service on iPhone and iPad - iMore.com
• Google Reader Alternatives - Caschys Blog (GTranstated)
• Google Reader: Feedly will allow seamless transition - Caschys Blog (GTranstated)
• Digg to Build RSS reader with 'Best of Google Reader's Features' - TheNextWeb
• Best Free Google Reader Alternatives For Web, Windows & Mac - Addictive Tips
• Three Reasons why Google Reader shutting down may not be such a bad thing - freewaregenius.com
• Why Google killed off Google Reader: It was self-defense — Gigaom
• More than 500,000 Google Reader users flock to Feedly in two days - The Verge
• Five Best Google Reader Alternatives - LifeHacker
• 5 iOS news app alternatives to Google Reader — Gigaom

I’ve enjoyed reading the perspective and comments left by users of RSS and Google Reader in most all of the above articles I’ve found.

As a very recent user of Google Reader, my perspective is a bit unusual.

Very early on, I realized the power and usefulness of RSS/Atom feeds to collect, centralize, and allow rapid mass monitoring of consumption of the wealth of material on the web.

Without RSS/Atom feeds that I subscribe to, I seriously doubt I could process the 90-120 sites I go to for news, tips, and areas of interest.  On any given day, they provide me between 300-400 articles to sift through.  And because of RSS/Atom feeds, I can usually complete that process in about 30 minutes or less.

There is no way I could do that by checking each site directly via bookmarked web-pages. I would miss tons of updated content and probably get loose hours of my time trying to do so.

For years I have relied upon Windows RSS feed reader clients running on my system.

First I used Sage which is an add-on for FIrefox. for a while development slowed and a few issues pushed me to the NewsFox add-on next. It worked very good.

I had flirted back in 2008 and did a RSS Reader Roundup…Valca Style. There were lots and lots of feature-rich RSS feed reader clients for Windows back then.  But I kept with reading my feeds in Firefox through the add-ons.

Eventually, however some of the peculiarities of running a RSS feed reader in your primary browser began to create issues.  It would run in a background tab session, but would “lock-up” the browser as it pulled feeds down during refreshing.

So in 2012, I revisited the search for a desktop Windows RSS feed client and eventually found that Omea Reader fit the bill for me a bit better than my runner-up choice, Feedreader.

Since I am using a local-client-based RSS feed reader, Google Reader was a service I was aware of but didn’t care about. When I found a new site to follow, I would subscribe directly in my client to the RSS/Atom feed and move on.  If you use RSS/Atom feed reading with this approach you too might overlook or care very little for the status of Google Reader.

But here is where the impending loss of Google Reader does matter to me, a lot; I got an iPhone.

This is the rub. While I am feed reading directly on my PC, my feed client does all the work pulling in and managing the individual feeds.

When I got my iPhone, I looked at the RSS iOS apps available and they all seemed to require some third-party back-end API to manage the feed subscriptions, and would then pull the article/feed information down and present it.

So I got my Google Reader set up by exporting my Omea Reader’s subscription pile as a single OPML file, imported it into Google Reader, downloaded Phantom Fish - Byline. Ironically, “Google Reader on the go” is their product tag-line.  Then I connected Byline to my Google Reader and away I went with my RSS feeds on the road.

While I can live without checking my RSS feeds during the day (as I survived just fine before my smartphone adoption), it does make the time spent at the end of the day on my local PC client reader that much faster since I come at it mostly caught up.

However, at this time Byline hasn’t seemed to offer any information about their plans to cope with the shut-down of Google Reader.  Reeder for iOS also looks pretty good, but it also can use Google Reader. Feedly is working on a back end API that hopefully will mimic Google Reader. I like the thought very much, but the iOS app itself is a bit too GUI/graphic intensive. I like the streamlined, more text-based format of Byline and Reeder. Is it possible to recreate a Byline/Reeder experience in Feedly?

There are lots and lots of RSS apps for iOS. However they all seem to leverage a back-end API to collect the feed subscriptions from.

What I really would like is to find a RSS iOS app that allows me to import my OPML file directly to it, and let it operate as a “standalone” RSS feed client directly in-app (like my desktop RSS feed reader) and not need to depend on a third-party API to pull the feeds down from.

I’m confident that other developers will step into the void, and as Samer Kurdi at freewaregenius posted, this might indeed turn out to be a good thing.

It’s just going to cause a fair amount of anxiety and chatter among hard-core RSS feed users until it sorts itself out.

At least we have until July 2013 to see who steps up and delivers, both for the RSS feed ecology in general and the iOS/smartphone app ecosystem in particular.

Until then I will keep on RSS-feeding with my desktop client with nary a worry, but obsess about a future without RSS feeding on my iPhone until a savior is found.

Cheers.

--Claus Valca

Read More

Threats, Updates, and iOS App struggles

Quick post to clear out last week’s inbound material.

Threats (and fixes/updates)

• Update Palooza - ISC Diary - (Adobe Acrobat Reader now at 11.0.02, Thunderbird 17.03 out, iOS 6.1.2, Java 7.15, Java 6.41, Firefox 19, Adobe Flash Player 11.6.602.168). If you are impacted, get busy patching!
• Oracle plugs security holes: Updates for Java 1.4 to 7 - The H Security: News and Features - more technical details on the update fixes.
• Adobe patches Acrobat and Reader, Mozilla debuts Firefox built-in PDF viewer - Help Net Security
• Timeline: Hacks Related to Apple - F-Secure Weblog : News from the Lab
• Dev site behind Apple, Facebook hacks didn’t know it was booby-trapped - Ars Technica
• NBC.com hacked, serving up Citadel malware - HitmanPro blog - Note: threat now appears to be fixed.
• NBC.com hacked, briefly compromised with RedKit malware - ZDNet - Note: threat now appears to be fixed.
• NBC Website HACKED – Be Careful Surfing - Sucuri Blog - Note: threat now appears to be fixed.
• IWhen web sites go bad: bible . org compromise - ISC Diary - Note: threat now appears to be fixed.
• Mandiant Exposes APT1 – One of China’s Cyber Espionage Units & Releases 3,000 Indicators - M-unition - Super Duper threat analysis report from Mandiant. Download the PDF report file directly and take your time reading. MD5/SHA-1 hashes for the valid file provide…because…
• Fake Mandiant APT Report Used as Malware Lure - ISC Diary
• Threat Actors Using Mandiant APT1 Report as a Spear Phishing Lure - M-unition
• Mandiant APT1 report used as a lure in phishing campaigns - Help Net Security
• Malicious Mandiant Report in Circulation - Symantec Connect Community
• Mandiant APT2 Report Lure - 9b+

Updates

DEFT 8 Roadmap and features - DEFT Linux - Computer Forensics live cd - Coming mid April 2013

Update XORSearch V1.8.0: Shifting - Didier Stevens

USB Image Tool 1.60 - Alex’s Coding Playground - There are more than one way to image a USB drive, but this tool by Alexander Beug is IMHO one of the very, very best for ease of use and reliability. I would be lost without it. Alex has worked hard on this update and it brings auto-admin elevate request at launch, now supports non-removable USB devices such as hard-drives or card-readers, and it has a “reset” feature to overwrite the bootsector of the selected device with zeros to allow Windows to reformat the device to the original size (something USB Image tool can’t do). See the changelog for more details.  As an alternative, also consider the free OSForensics tool ImageUSB.

iOS App trials, tribulations, and tips

An iOS Byline Issue - worked around

I’ve been gushing for some time about how I think Phantom Fish’s Byline app for iOS is super great. It is really fast pulling feeds and the interface is easy to navigate. It has really helped me stay in-touch with tech goings on during the day as I can now check all my RSS feeds on my personal iPhone. Before I was having to wait to the end of the day when I got home to check my personal feeds for news updates.

So last week I ran into my first problem with it.

I normally have it set to show 2,000 items; this allows me to go back and search for past feed articles after the fact. Additionally, I manage “Caching” with “Wi-Fi” only, images “on”.  That’s pretty much it. There aren’t a lot of settings but they are enough.

So the problem was that mid-week, after the updating of the feeds occurred, the caching followed, but kept getting stuck showing “1 of 200”.  It wouldn’t ever stop or move on.

It looks like a bad feed article was causing the caching to stop.

I sent an email to the Byline help team but still haven’t seen a response.  It was super frustrating and I found a few others on the net who also had encountered the problem.

So what to do?

Eventually I figured out a workaround to allow the feeds to continue to drop and cache again without getting “frozen” so-to-speak.

I went back into the settings and changed my All Items option to “Show 200 items”.

What this let me do is to get past the stuck item by not caching it.

I’m not sure which one it is, but right now it is somewhere between the 200 and 500th feed item. If I set at “200” I’m fine. If I set at 500 (the next highest increment) it locks when it hits the bad feed.

Considering that on any given week-day, my feed count pull results in about 350 new article feeds, I project that by the end of next week I will have way-more new feeds and the bad one will have been shoved off the bottom of the stack.

It isn’t a "pretty” fix but it works and restores a level of functionality with caching of feeds in Byline in the meantime.

Recommendations to the Phantom Fish coders for the next Byline update:

1. Code for an auto-skip of a feed if it doesn’t cache within a set/variable number of seconds; letting the user set the timeout period would be even better.
2. Allow greater granularity of number of items to show. The stock choices of 100, 200, 500, 1000, and 2000 items may make sense, but I’d like to set my own custom number of feeds…especially if the first recommendation cannot be implemented.

That’s pretty much my only requests for an otherwise stellar application.

A Gmail App Badge notification issue - cleared

My second issue this week was when I was surprised to have my iOS Gmail App badge still showing “1” unread item, despite no unread messages showing in any of my accounts.

Hmm.

This really frustrated me.

Eventually I found others who have experienced this same issue and the workaround solution to clear it. Apparently it is not an unknown issue and has been present for some time.

How to reset/clear ios badge - Google Groups

Bruno O. Barros (llustreBOB) provided the “solution” to clearing it midway down in the thread:

The only solution working here is the one where I move the rogue message back to inbox, mark it as unread and then mark it as read again.

Sure enough. Since I remembered the last message I managed, in my iOS Gmail app, I moved the message back to the inbox, marked it “unread”, marked it “read” and then archived it again.

The notification message “1” cleared off my Gmail badge.

Dave Churchill --just a bit up in that same thread -- shows how to replicate the issue/fix if you want to play with it (though I don’t know why you would if the solution works).

I can reproduce this by doing this:

1. Gmail app on iPhone has no badge.
2. Send email to self on laptop
3. Wait for Gmail on iPhone to receive email and show badge
4. Read and archive the email on the laptop
5. Open Gmail app to note there are no messages in inbox, refreshing still shows no messages, checking list of labels shows no unread messages.
6. Press Home button to exit Gmail, badge remains at 1.
7. Open Gmail again on iPhone.  Navigate to All Mail, open the message (which is correctly displayed as already read).  Badge still shows 1.
8. Mark message as unread exit, badge still shows 1.
9. Read message, exit, badge still shows 1.
10. Move message to inbox.  Badge now cleared.

Bump

Are you an iOS user feeling a bit jealous of those sexy Samsung phone-bump-transfer features?

I spotted this new (to me) app last week. I haven’t pulled the trigger on installing as I don’t really have a need for it just yet but it does seem like a cool and handy feature. So I’m keeping it on my “watch list”. Anyone have any experience or feedback with it yet?

• Bump for iPhone, iPod touch, and iPad - iTunes App Store
• Get Bumpin' With Bump For iPhone: Your Easy, Instant File Sharer [iPhone] - MakeUseOf blog.
• Bump - Home

Cheers!

--Claus Valca

Read More

Claus’s iPhone App List

As promised, here is a listing, semi-categorized, of iOS iPhone apps I’m using on my iPhone 5.

All links will be to the iTunes App Store page unless otherwise noted. I’ve added a permanent link on the sidebar under “Claus’s Toolbox”.

I’m only listing Apps that I use (or plan to purchase relatively soon for use). There very well may be “better” apps of a similar function, but the point is these are the ones I am using. If you want to drop a comment on a recommendation of your own, that’s fine and if it is on-topic and something I would actually consider using, I might just approve it. If the comment seems like comment spam or is for an App that I’m not at all interested in for whatever reason, it probably won’t be added. This post isn’t to create a marketplace; it’s for me to self-reference and primarily be a way to recommend/share Apps with the few family and friends who have iPhone discussions with me.

A mini price-range key:

• free = free. May or may not be ad-supported. That said, if it is ad-supported or pop-up in-app notifications to upgrade to a paid-version are too annoying or obtrusive, the app is deleted.
• $ = $.99 to $2.99 range.
• $$ = $3 to $7.99 range.
• $$$ = $8 to $9.99 range
• $$$$ = over $9.99

Note that when posted, some apps may be on a special pricing discount for holiday or promotions. I’ll try to keep an eye on things but it’s only a rough guide.

I’m not sure I have my categorizations really dialed in quite the way I want yet. Those may change.
I’ll eventually get around to adding very-short app descriptions.

“Default” apps that come installed/bundled with the iOS don’t get listed.

I have a few great Apps I won’t list for privacy reasons; banking/insurance/shipping/specific shopping/vendors, etc. Just because you don’t see those listed, doesn’t mean I don’t use them.

Finally, just because all these apps fit on and run on my iPhone 5 (64 GB), currently iOS 6.0.2, doesn’t mean they will all fit on your own iPhone.

Here’s the list.

Core Apps

• Byline - $
• Chrome - free
• Gmail - free
• Google Maps - free
• MiniKeePass - free
• Wave Alarm - free (note I sprung for the in-app $ paid version)
• Wave Timer - free (note I sprung for the in-app $ paid version)

Productivity/Organization Apps

• Agenda Calendar - $
• Clear - $
• Due - $$
• Easy Note + To Do - $
• Grocery List - Buy Me a Pie! - $

Weather Apps

• NOAA Hi-Def Radar - $
• The Weather Channel® Max - $$
• WeatherMap+ - $

Text/Reading Apps

• Adobe Reader for iPhone - free
• Byword - $
• Kindle - free

Networking/IT/SysAdmin Apps

• Deep Whois - free
• Emerald Time - free
• Fing - Network Scanner - free
• Mocha iSys - free
• Mocha VNC for iPhone - $$
• IPv4 Subnet Calculator - $
• Network Ping Lite - free
• Networking Toolkit - free
• Nice Trace - traceroute - $
• Speedtest.net Mobile Speed Test - free
• TeamViewer HD for Remote Control - free - (note seems to work best on the remote system with an installed version of TeamViewer rather than TeamViewer Portable…maybe that was just me…)

Media Apps

• ABC Player - free
• ESPN ScoreCenter - free
• KUHF News/Classical 91.7 - free
• Naturespace - free/in-app $
• NBC - free
• NPR Music - free
• NPR News - free
• PBS - free
• PRI - free
• Science Friday - free
• SomaFM Radio Player - $$
• TED - free
• TV.com - free
• Vimeo - free
• YouTube - free

Specialized Utilities

• Converter Plus - free
• Decibel 10th - free
• Find My iPhone - free
• iHandy Carpenter - $
• Spyglass -$$
• Survival Guide - free

Photography

• Adobe Photoshop Express - free/in-app $ upgrade

Health/Fitness/Education/Fun

• iHikeGPS - $$
• Learn German: Babbel - free

Hardware Support
These are the primary “hardware” items I use (or will be using) with my iPhone. Note: Price rating system suspended here. Do the research if you are curious.

• Jawbone JAMBOX Wireless Speaker - Christmas present from Lavie.
• Jawbone (version 2) - (obtained back in 2008) - still running strong, though highly battered.
• Jawbone ERA - I don’t have this unit yet but will almost certainly be purchasing it in the next few weeks. Since my original Jawbone unit is almost six years old, has survived numerous traumas and still works great, I’m pretty much sold on the quality and performance of this manufacturer rather than others out there. I’m mostly just upgrading to the ERA model since it can support Bluetooth syncing with two devices concurrently. That is a must -- having multiple phones on my person. I considered the ICON model as well but I’ve come accustomed to the version 2 size so there you go.

Previously Used Apps (free) Upgraded to Purchased Versions or Alternatives
These are apps that I previously had on my iPhone but later upgraded to purchased versions and/or removed to make way for another/different version of the same app function. They are still highly recommended.

• Commander Compass Lite - free
• iHandy Level Free - free
• Mocha VNC Lite - free
• MapQuest - free
• MyRadar Weather Radar - free

Still pending purchase/installation - (sooner or later)

• Hurricane Tracker - $
• Hurricane - $
• iFileExpress - free
• Documents To Go - $$$
• Photo Manager Pro - $

Hope you find this helpful.

--Claus V.

Read More

iSurrender: iPhone Linkfest

Enough iOS already! It’s following me around and multiplying!

I love the iPhone 5 I now carry and am getting very comfortable using it. I confess I’m still not yet scratching the surface of the features it is capable of, but I no longer consider an iPhone noobie and that is saying a lot.

iPhone 4’s got delivered to work. I’ll be working on a project very soon to migrate our BlackBerry users to them.

Alvis announced she bought (on her own, the little scullery-maid!) an iPad Mini from the Apple-store online for a Christmas-cash present. Delivery expected this week. Fortunately she publically went on the record that she is an iOS girl and has no love or desire for Mac laptop/desktop platforms or OSX so she didn’t receive a grounding for her cheekiness.

And I now subscribe to a number of RSS feeds for iOS matters to stay on top of tips/apps and iOS trends.

iOS News and Scuttlebutt

• In bringing Office to iOS, Microsoft is playing a dangerous game - Ars Technica. I’ve not installed any apps yet to deal with MS Office document viewing/editing yet. I’ve been considering Documents To Go & Documents To Go® Premium, but if the Verge is accurate, Microsoft may soon be dropping a set of free apps to allowing viewing of those files on iOS. That would be good enough for me.

In case you are an iOS user and been living under a rock lately…Google Maps for iOS dropped a few weeks ago. I love it but miss not having a terrain layer provided. Hopefully that will get added in eventually by the Google Map App team. Yes there is a way to get it via Cydia but that’s way past my comfort level so I personally won’t be making any recommendations with Cydia anytime soon.

• Google Maps is now available for iPhone - Official Google Blog
• Official Google Maps App For iPhone With Street View, Voice Directions - AddictiveTips
• Google Launches Native Maps For iOS, And Here’s The Deep Dive On Navigation, Info Sheets And More - TechCrunch
• First impressions: Google Maps for iOS [Updated] - TechBlog
• Here’s why you can see that iPhone app, but can’t yet grab it - TechBlog
• Google Maps for iPhone shows Apple how to do mapping right - Ars Technica 

Then came an iOS minor upgrade…Hurrah!

• Apple releases iOS 6.0.2 software update, bug fixes - iMore.com
• Apple addresses another Wi-Fi bug with iOS 6.0.2 update - Ars Technica
• Apple Releases iOS 6.0.1 Update For iPhone 5, iPad Mini - The Next Web

…which may cause battery-drain issues…oh-noes!

• Is there a problem with iOS 6.0.2? - Borns IT & Windows Blog
• iOS 6.0.2 suspected of draining batteries - Ars Technica
• Apple: iOS 6.0.2 provides shorter battery life for iPhone 5 and iPad Mini - Caschys Blog
• Iphone 5 and IOS 6.0.2 is draining my battery! - Apple Support Communities. May have a “fix” until the next iOS update comes out to fix this problem…if there is a problem.

At first I thought I was also having this post iOS 6.0.2 update battery-drain issue, but now I’m not convinced. Is the battery actually draining faster? Or am I just more conscious of battery usage levels when I’m using my iPhone 5 to do light-web surfing around the house when I’m too lazy to use my main laptop system?  That Retina display rocks and dazzles and probably gobbles up the juice.  Maybe with a more stable Wi-Fi connection I’m just using it more that I realize….

Tips and Tricks

One of the challenges with “new-to-me” technology is getting up to speed so I feel I have some level of mastery of it. I’ve always had fun being challenged by new things and becoming comfortable in using and managing them.

Needless to say, the iOS environment is certainly rich with opportunity for learning both basic and new things!

• Top 10 Handy iOS Tweaks That Don't Require Jailbreaking - Lifehacker
• How to Turn Any Song Into a Ringtone for Your iPhone or Android (for Free) - Lifehacker.
• Beyond the Silence: How to create ringtones for iPhone (m4r) for free - Beyond the Silence. This process works like a charm and once you get comfortable doing it it’s hard to justify purchase of a utility to do so.
• The Best Desktop File Explorer for iPhone (And All the Cool Things You Can Do with It) - Lifehacker.  See the main product page: i-FunBox v2.1 and the supplemental iOS app iFileExpress. Both free.
• How to edit Inbox order on your iPhone and iPad - iMore.com
• How To: Take a Screenshot With the iPhone - iMore.com
• iPhone 4S: Ultimate DIY repair guide - iMore.com
• Best paid iPhone apps - iMore.com
• Siri: The ultimate guide - iMore.com

iOS Apps I’ve Installed (and kept) since Last Posting

Once in a blue moon I will purchase a video (movie/TV show) from the iTunes store. Generally we buy BluRay disks and drop a few more dollars for the package that includes a digital copy. That works for us. I like the idea of iTunes rentals but the prices are (generally) crazy for the super-short rental “lifespan.” That doesn’t work for me.  I will pick up music (usually singles) from time to time. Again if I really “like” an album, I tend to order the physical CD and then import it into iTunes.

If I find a must-have, not-free app, I prefer to buy an iTunes card at a local store and then use that to purchase the app.

Otherwise, despite the number of iOS apps I’ve added/purchased recently as a new iPhone owner, I generally just wait until someone drops me an Apple iStore/App/Tunes gift card or I find a $20 for some “mad-money” and then splurge on some apps.

So the paid app purchases below are from Alvis’s Christmas gift card to me. Thank you Alvis!

• Google Maps - free - iTunes App Store. Enough said.
• Emerald Time - free - iTunes App Store. I’m a time junkie. Maybe from watching too many Dr. Who episodes? Anyway, while I can’t adjust the time on my iPhone, at least I can compare it to several NTP servers. It also lets you quickly see what the GMT time is. Geeky free app.
• Networking Toolkit - free - iTunes App Store. Paul Borghese’s app is top-shelf stuff for networking admins. Super handy.
• Due - $$ - iTunes App Store. Took me a while to find this one, and at $4.99, it isn’t “cheap” by most iOS app standards. Allows for creation of highly customized reminder alerts and timers. Lavie has a medication she must take every three days and sometimes we forget when the last dosage was given. This app allowed me to easily set a recurring three-day reminder. The UI is great and its power lies in its simplicity. Highly recommended.
• IPv4 Subnet Calculator - $ - iTunes App Store. There are lots and lots of “free” IP Subnet Calculators out there. I have a few Windows utilities on my systems for the heavy network planning I do. However, while the Networking Toolkit already mentioned above met my basic -- in case of emergency needs, when I say Alex Buzov’s app, I couldn’t help but buy it. It is drop-dead gorgeous and practical at the same time. I don’t expect we will be dabbling in IPv6 anytime soon, but hopefully when that time comes, Alex will have a version released. I’ll stand in line to buy it!
• Clear - $ - iTunes App Store.  Currently 50% off for a limited time. My brother tipped me off to this little gem. While I already have a note management app, and there is “Due” for reminders, this super beautiful fun app makes creating To-Do action lists fun. No, you cannot set calendar items or reminders but if you want a easy way to make lists you will come back to, this app is worth checking out.
• Byword - $ - iTunes App Store. For when you need a more full-featured and full-sized app for composing text. It doesn’t do a who lot, but covers the basics of creating and editing larger text-based documents much more comfortable.
• Grocery List - Buy Me a Pie - $ - iTunes App Store. There are a lot of free and $ “grocery/shopping-list” makers out there. What sold me on this one was a simple and easy to organize/navigate interface couple with the ability for me to share an on-line account with Lavie and Alvis to use to add needed items to the weekly grocery list. Sure, my handwritten 3x5 index card grocery list making system seems to work OK but hopefully this can help supplement it a bit. Multiple lists are supported so it doesn’t have to be limited for lists at the grocery store.
• Naturespace - free/$ - iTunes App Store. The free app comes with a small set of nature-sound loops. Additional sound-atmosphere loops can be purchased in-app for a few dollars per sound loop.  There are more free sound-loop apps out there and I haven’t really scratched the surface but this one came highly recommended mostly based on the quality of the free app player as well as the quality of the sound loops themselves. Just wished they would have tossed in a rain/thunder-storm loop in the free package as well. That’s more my thing for relaxation but guess that’s how they get us hooked!
• iFileExpress - free - iTunes App Store. Extend the ability to manage and share files between your iOS device and your PC/Mac system. Mainly for the geeks.

Coming soon I’ll be working on getting up a regularly maintained post to track and list my iOS iPhone apps in a single place for quick reference and for the curious.

Cheers,

--Claus Valca

Read More