Linkfest for the SysAdmins

Here is some assorted linkage from the past week or two that might be of interest to the system administrators lurking around.

• US State Governments Can’t Shake IT Woes - IEEE Spectrum - This week in gooberment IT support and deployment silliness. Offered as object lessons for self-improvement.
• HealthCare.gov deferred final security check, could leak personal data - Ars Technica
• The seven deadly sins of HealthCare.gov - Ars Technica
• Can we trust the data brokers who store our most intimate private details? - Ars Technica
• Defrag Tools: #61 - Windows 8.1 - Disk Space, Sysinternals DU and RU - Defrag Tools on Channel 9
• PowerShell: Location, Location, Location - 4sysops
• Download Active Directory Replication Status Tool - Microsoft Download Center
• How to make your USB drive Write-protected under Windows - RMPrepUSB, Easy2Boot and USB booting
• Install Windows 8.1 on Oracle VirtualBox - BetaNews article from Wayne Williams
• Customizing the Windows 8.1 Start Screen? Don’t follow Microsoft’s guidance - Aaron Parker
• Windows 8.1 / Windows Server 2012 R2 - Updated Shell UI changes - Ask the Performance Team blog

Cheers,

Claus Valca

Read More

iPhone Traffic - ZAP’ed, Security, and Network Tap Tap Tapping

This week brought in a very interesting post from web security/developer Troy Hunt.

 Unearthing the hidden shortcomings in Aussie mobile app security - Troy Hunt’s blog

Please go read then come back.

Interesting isn’t it?

I know most GSD readers probably wouldn’t be surprised to find some of their favorite mobile-apps leak user ids and passwords in plain-text, but for those who don’t know, some do.

Case in point (that has now been reported as fixed!):  Zscaler Research: Mobile App Wall of Shame: ESPN ScoreCenter

Naturally that got me thinking about a common mantras in the For/Sec world; “know your tools” & “verify, verify, verify”.

What I want to do is some benchmarking and analysis of the mobile apps I use on my own iPhone to have a better understanding on what is happening with their network traffic. This would be valuable information to know for general usage, and critical knowledge in case you unknowingly encounter a Wi-Fi Pineapple in the wild or a more complex man-in-the-middle Wi-Fi attack and get your network traffic captured.

One super-easy (and lazy) way I have found is to use ZAP - Zscaler Application Profiler.  From the “About” page link:

About ZAP

Zscaler Application Profiler (ZAP) is web based tool designed to streamline the capture and analysis of HTTP(S) traffic from mobile applications. ZAP is capable of analyzing traffic from both iOS and Android applications and includes the following functionality:

• Search: View summarized historical results for past scans.
• Scan: Proxy traffic from a mobile device through the ZAP proxy and the mobile app traffic will be automatically captured and analyzed
• iPCU: Upload your iOS device configuration file(.deviceinfo) to check risk score of installed application. It will give you overall risk score of your device. The information provided is based on out knowledge base.

ZAP classifies traffic into the following buckets and calculates an overall risk score for the application:

• Authentication: Username/password sent in clear text or using weak encoding methods.
• Device Metadata Leakage: Data that can identify an individual device, such as the Unique Device Identifier (UDID).
• Personally Identifiable Information Leakage: Data that can identify an individual user, such as an email address, phone number or mailing address.
• Exposed content: Communication with third parties such as advertising or analytics sites.

Zscaler also has a detailed video on this service on their blog: Zscaler Research: Introducing ZAP.

So you can either check their historical report data on apps already researched, you can connect your device to their proxy to do a scan on a new app/version not already captured historically, or even upload your own iOS device config file.

Wow.  Bookmark this resource link now!

However, there may be cases you want to do your own local network traffic capture and analysis…because you like pain and frustration (and hands-on learning perhaps).

Part I - In Which Hardware TAP Options are narrowed down

At work (when & where authorized) we can set up network packet captures either on a specific system or on the LAN using port-SPAN.

At home, I don’t have a managed switch (or dumb hub) that can do that.  I suppose I could buy a USB-NIC (so I can have two wired network ports on my laptop) and then capture traffic temporarily though one of these messy devices (home-built or purchased) but that isn’t quite as elegant as I would prefer.

Or (as the TinyApps bloggist kindly just reminded me) use Cain & Abel.

• Capturing Packets on a Broadcom Card - The Flying Frank
• Configuration - OXID.I

Instead I decided I'll pick up a specialized device that support a network TAP.  This way I can just hook it in line between my Wi-Fi router and the cable modem and capture everything that passes though. It may not be 100% on packet captures, but I think it will be good enough for my home testing.

So the next question is what device?

I’ve settled on the following options:

• Dualcomm DCSW-1005 USB Powered 5-Port 10/100 Fast Ethernet Switch TAP (Port Mirroring) - Amazon.com link
  • Dualcomm DCSW-1000/1005PT - Dualcomm product page
• Dualcomm DCGS-2005L 5-Port 10/100/1000 Gigabit Ethernet Switch Network TAP (Plastic Case) - Amazon.com link
• Dualcomm DCGS-2005 5-Port 10/100/1000 Gigabit Ethernet Switch Network TAP (USB Powered, Port Mirroring, PoE Pass-Through) - Amazon.com link
  • Dualcomm DCGS-2005/DCGS-2005L - Dualcomm product page

The DCSW-1005 model is an attractive basic option. It supports port-mirroring, is USB powered, and has 5-ports. (note only port #1 is mirrored to port #5).  The price is good.  The only “drawback” I see is that it only supports 10/100 speed on the network.  While I seriously doubt I would ever approach over 100 Mbps and cause a bottleneck on my home network…most all my other network equipment is 1000 Mbps capable.  So thinking forward, this could be slightly limiting down the road, or if I am asked by family/friends/associates to do some network troubleshooting on a “true” 1000 Mbps network, or tapping in between two network devices actually running at 1000 Mbps.  So there is that. Also, the buffer memory used by the device in the mirroring process is 256 KB. So if that gets saturated, there is the possibility of dropped packet captures.

The only difference between the DCGS-2005/2005L seems to be the “L” model has a metal cabinet while the other doesn’t. Of course, that option comes with a $20 markup as well.  I’m pretty sure the plastic cabinet would be just fine, but the vanity in me just likes the metal cabinet appearance a bit more. Probably just a bit more durable when tossed around in a go-bag and maybe it might dissipate heat a bit better? This model does support up to 1000 Mbps so there is that benefit since it is (at least $100 more expensive) but the buffer memory is just 104 KB. Hmmm. 

Should I be concerned about overloading either of the devices’ memory buffer when capturing home-network traffic? Probably not but what say you pros?

I did find these pretty basic and older reviews, including one from the guru of network security Richard Bejtlich.  I really didn’t find any more recent reviews of the device so if/when I get my hands on one, you can be assured I’ll have a write-up review.

• DualComm Port Mirroring Switch - TaoSecurity - (Sept. 2010)
• Review of Dualcomm 5-Port Pass-Through Port Mirroring Switch - LoveMyTool - Betty DuBois - (April 2010)
• Network Security Monitoring with Dualcomm DCSW-1005PT - CyberArms - D.Dieterle - (Nov. 2010)

Part II - In Which Other Alternatives are discovered

So let’s assume that you are already comfortable with network packet captures, installing network software, and making network configuration changes to Wi-Fi devices.

Are there any options to capture iPhone network traffic without going to the trouble and expense of picking up TAP hardware just for that task?

Yep.

First option is a tool called Paros. It is Java based (I know, I know..) and can assess web application vulnerabilities. The link has a Windows binary that appears back from August 2008.

Here is a nice walkthough on using Paros Sniff Your iPhone's Network Traffic by Jerod Santofrom to give you some introduction to it.

There was a comment on the Paros page providing information to a very current “fork” of Paros: ZAP

(Note: Not to be confused with the Zscaler ZAP service)

OWASP Zed Attack Proxy Project - OWASP - OWASP.org

There are tons of information on that page on this tool:

• Screenshots
• wiki videos page
• project pamphlet - a very quick intro
• project presentation - longer presentation

And here are some quick links on ZAP usage:

• Owasp ZAP - InfoSec Institute post
• Debugging SSL on Both iOS Devices and Simulators with Man-in-the-middle Proxies - CodeProject
• Intercepting iPhone traffic with your MacBook - Shaun Zinck’s blog

Next up, we have Fiddler, a free web debugging proxy from Telerik

• Capturing HTTP traffic on an iPhone with Fiddler - Scott Wojan’s DotRant blog
• Configuring Fiddler to Capture Web Traffic from an iPhone/iPad Device - ESRI Support Services blog
• How To Sniff iPhone Network Traffic - Matt McClure’s blog

Finally, if you are hard-core, just go use Wireshark.

• iPhone Meets Wireshark – Capture Wireless Network Traffic from Mobile Devices - EtherLook

Part III - Resources, References, & Pineapples

Here are some additional links related to all of the above discussions including the Dualcomm products, SPAN/TAP considerations, and the next network device I’m interested in picking up to play with; the Wi-Fi Pineapple.

SPAN Out of the Box (PDF Link) - John He’s Dualcomm Technology PowerPoint presentation at SharkFest 2010. Goes into details about SPAN/TAP considerations and specifics on what DualComm feels makes their product super special. SPAN out of the Box (Blip video)

B-7 (Battaglia) TAPS Demystified (PPT Link) - Samuel Battaglia’s Network Critical PowerPoint presentation at SharkFest 2010.

SPAN Port vs TAP (Video) - Betty DuBois- SharkFest 2009 presentation. PowerPoint presentation here (ZIP).

SPAN Port or TAP? CSO Beware - LoveMyTool blog - Tim O’Neill

Network Monitoring Madness: Poor Man’s Resource Linkfest - GSD blog post from 2010.

Let’s Get For/Sec-Motivated! - GSD blog post from 2011.

The beginners guide to breaking website security with nothing more than a Pineapple - Troy Hunt’s blog.

Your Mac, iPhone or iPad may have left the Apple store with a serious security risk - Troy Hunt’s blog.

Pineapple Surprise! Mixing trusting devices with sneaky Wi-Fi at #wdc13 - Troy Hunt’s blog.

Netgear DS104 4-Port 10/100 Dual Speed Hub with Uplink Button (Amazon link) - recommended to look into as well by TinyApps bloggist who reports he had good experience with it.

CaptureSetup/Ethernet - The Wireshark Wiki

CaptureSetup/WLAN - The Wireshark Wiki

Cheers!

--Claus Valca

Read More

ForSec “Value Package” Linkfest - No coupons required!

One last Linkfest from a now exhausted GSD blogger this weekend.

Cleaning out the “to-be-blogged” hopper is always rewarding, but I tend to get very behind on the weekend chores. My saving grace this weekend has been frequent scattered showers and an equally tired Lavie who hasn’t been interested in going out for shopping, groceries, or dining out. The kitchen has been cleaned. The laundry has been done for the week.

Next stop, a few hours of rest, post-blogging, then a wind-down with Endeavour on PBS Masterpiece.

Too Funny Not To Miss

Bloody galah scammers still not getting the message - Troy Hunt’s blog. Security guru Troy Hunt has had his fair share of “this is (not) Microsoft cold calling you…your PC is infected…let me remote control it” scams and has picked them all apart to the bone.

This time he takes a new angle…in a way that only an Aussie could pull off!  This is a classic! Troy, please offer us some of those sound files or link to where we can get them!  I need to put together a Texan sound-effect package for similar fun with unwanted callers. Brilliant!

Microsoft Security News

Microsoft Releases New Mitigation Guidance for Active Directory - Microsoft Security Blog

Overview of Microsoft`s "Best Practices for Securing Active Directory" - SANS Computer Forensics and Incident Response blog’s Mike Pilkington does a great summary and takeaway of the new AD mitigation guidance.

Security Awareness Training: Your First Line of Defense (Part 4) - WindowSecurity.com’s Deb Shinder discusses evaluating training effectiveness short and long-term.

See also these previous series posts:

• Security Awareness Training: Your First Line of Defense (Part 1)
• Security Awareness Training: Your First Line of Defense (Part 2)
• Security Awareness Training: Your First Line of Defense (Part 3)

Network Security, News and Techniques

Wireshark 1.8.9 and 1.10.1 Security Update - ISC Diary

• Wireshark 1.10.1 - Release Notes
• Wireshark 1.8.9 - Release Notes
• Wireshark - Downloads

Next up are some great and detailed video presentations from Sharkfest 2013

• Sharkfest 2013 - Wireshark Network Forensics (by Laura Chappell)
• Sharkfest 2013 - Trace File Sanitization NG (by Jasper Bongertz)
• Sharkfest 2013 - Attack Trends and Techniques (by Steve Riley)
• Sharkfest 2013 - Capture Limit of a Laptop, When does it Drop Packets? (by Chris Greer)

Recent Forensically Focused Posts

• HowTos - Windows Incident Response blog
• HowTo: Malware Detection, pt I - Windows Incident Response blog
• HowTo: Data Exfiltration - Windows Incident Response blog
• HowTo: Add Intelligence to Analysis Processes - Windows Incident Response blog
• HowTo: Determine/Detect the use of Anti-Forensics Techniques - Windows Incident Response blog
• HowTo: Investigate an Online Banking Fraud Incident - Windows Incident Response blog
• Finding an Injected iframe - Journey Into Incident Response blog
• MS Excel and BIFF Metadata: Last Opened By - Digital Forensics Stream blog

Physical (In)Security?

Duplicate house keys online - Keys Duplicated - This is either freaking amazing or super-scary. I just can’t decide! According to their Security page, precautions are taken.

The Keys Duplicated Blog - A couple really cool and technical posts on the behind the scenes things that make their keys pretty good.

…as spotted on Lifehacker’s post: Shloosl Copies Your House Keys Using a Smartphone Photograph

When 'Smart Homes' Get Hacked: I Haunted A Complete Stranger's House Via The Internet - Forbes

ForSec LiveCD Distro News

• More on WinFE and Autopsy - Windows Forensic Environment blog
• DEFT Linux 8 stable with DART 2 is out! - DEFT Linux - Computer Forensics live cd
• Kali Linux Summer Update Release 1.0.4 - Kali Linux
• Pass the Hash toolkit, Winexe - Kali Linux
• Downloads - Kali Linux

AV/AM Bits

Microsoft Security Essentials quietly released version 4.3.216.0 engine update for their free antivirus scanning program. If you use MSSE, you should get it via the automatic updates…if you have them turned on…you do have them turned on right?

Download Microsoft Security Essentials - Microsoft Download Center - Like most things MSSE, trying to figure out just what got updated is next to impossible so let’s just say for now that this one must be better than the previous version and move on.

I’m still using MSSE around the Valca home on all our home systems. I also continue to recommend it to friends and family (generally everyone non-work-related) who I provide friendly IT support to. I find it is pretty non-threatening to the non-technical users I know and though it loves to alert on many of my security programs (potentially unwanted programs) since they can also be used for 3vil, it seems to do a more than adequate job security the systems.

For my Windows 8 systems, I’m instead relying on Bitdefender Antivirus Free. In some ways it’s a bit different model in that you need to sign up with an email address to set up your account. Then you can download the client to the system. What is nice is that if you manage multiple systems in your home, you can log into your account at their site and then get a console feedback on the status of those systems. That’s something that I do at work with another vendor’s enterprise AV client health/status management console. That’s super cool for a free product. I’m seriously leaning to expanding it’s coverage to my main Windows 7 laptop at home. Performance has been outstanding on my Windows 8 systems.

Kaspersky tops real world protection test - BetaNews - this post does point out that Bitdefender tied Kaspersky with a 99.9 % protection level in AV-Comparatives Independent Tests of Anti-Virus Software for July 2013. While Microsoft Security Essentials rated a 92.5 % protection level. There are some additional disclaimers so read the short BetaNews article carefully. Then head over to AV-Comparatives to dig deeper and see the full findings.

• AV-Comparatives Real-World Protection Test March-June 2013 - AV-Comparatives
• AV-Comparatives Real-World Protection Tests - AV-Comparatives

Finally, we wrap up this segment with this interesting discussion:

The evolution of Ronvix: Private TCP/IP stacks - Microsoft Malware Protection Center

It’s a bootkit infection that has its own private TCP/IP stack. By doing so it can be extra stealthy and bypass personal firewall hooks and can lurk unseen in standard tools and utilities (such as nbtstat). Doing so, depending on packet/network monitor off the infected machine may be ineffective. However, it still must talk ON the network, so an independent network monitoring and forensics analysis approach using a network monitoring appliance or span port capture may detect the traffic. This may be why comparing outside network traffic captures from a system on the network to network traffic captured on the system may be a useful exercise for incident response and monitoring purposes.

Legally Focused

I’ve been reading a wider range of subjects, and a small part of those touch on our legal system. Mainly they apply to digital law and crime but some are more general. I’m just tossing them out there for the interested or curious. Generally they tend to analysis of current events or provide a more detailed lawyer’s review than the talking/shouting legal heads we encounter on mass-media “news-like” entertainment outlets these days.

• CYB3RCRIM3 - Susan Brenner’s blog on cybercrime and cyberconflicts in technology and law.
• Popehat - group blog with a mostly legal focus (though topics can range far afield!)
• Le·gal In·sur·rec·tion - group blog with mostly legal and law-in-today’s-culture focus. Pretty vibrant opinions. Alignments may vary.
• Lowering the Bar - Sometimes lighthearted (though always serious at the core) look at some of the nonsense the legal system contains, or foists on others from time to time. Great site.
• Massad Ayoob - legal, cultural, and educational postings primarily dealing with legal private firearm ownership issues. Also analysis of public media trends and news stories.

Have a great week!

--Claus Valca

Read More

SysAdmin Linkfest - Chock'-o’-Videos Edition (G-rated version)

This is a super-heavy linkpost filled to the rim with video presentation linkages. Make sure you have some extra time and bandwidth set aside for all these.

Seriously. You think I’m joking, but all it takes is one sysadm running around careless with streaming video file links and then “bam” someone ends up loosing their bandwidth.

As tempting as it is, I’m just providing the links to the video rather than embeds of the video in a player itself. Not that Mark and the Defrag Tool guys aren’t handsome or anything, its more because I just hate seeing the Flash SWP pre-load in everyone’s web-browser when I then get behind in posting and you fans are hit with it when you land on a GSD blog page with embedded video and you aren’t using a Flash-blocking plugin, or have it disabled for my blog.

(the evidence as seen in Process Explorer as happened back from April 2013 - late June 2013 )

General philosophy: wipe the baby and keep it, toss the diapers

Why wiping decommissioned IT assets should be a must - Help Net Security - Duh.

The cost of cleaning up - ISC Diary

GrandStreamDreams blog has written heavily regarding securely wiping hard drives. It should be a no-brainer in today’s digital age…and coupled with some whole disk encryption (to boot). Likewise I just can’t grasp how it is cheaper to trash 170 PC’s because they were infected rather than having a secure-wipe/standard-image reload process. Don’t skip the ISC Diary article’s Comments section.

Sysinternals/Pass the Hash TechEd North America talks

Sysinternals - and Pass the Hash - at TechEd next week- Aaron Margosis' "Non-Admin" and App-Compat WebLog - These were five keynote talks back from June. In case you couldn’t stop by New Orleans last month, you got some serious catching up to do now!

• License to Kill: Malware Hunting with the Sysinternals Tools - Channel 9 - Mark Russinovich presenting
• Case of the Unexplained 2013: Windows Troubleshooting with Mark Russinovich - Channel 9 - Mark Russinovich presenting
• Sysinternals Primer: TechEd 2013 Edition - Channel 9 - Aaron Margosis presenting
• Pass the Hash and Other Credential Theft and Reuse: Preventing Lateral Movement and Privilege Escalation - Channel 9 - Aaron Margosis, Mark Simos presenting
• Defrag Tools: Live - TechEd USA 2013 - Channel 9 - Andrew Richards presenting

The Case of…

Case of the Slow Logon – Anti-Virus vs 3rd Party Application - chentiangemalc

Case of the Windows 8 Explorer Hang – Part 1 - chentiangemalc

Defrag Tools takes on Windows Performance Toolkit

You may recall the GSD blog post Case of the Unexplained Donut of Death where I started out using Windows 7 Xperf tool to do some performance troubleshooting. I then jumped from it to the new WPT set in Windows 8 SDK and outlined just how amazing the level of logging detail and analysis was.

As the time there was not a considerable amount of documentation out for us mere mortals on how leverage the true power the tools contained.

No more. The team at Channel 9 has hit the ground hard with a series of videos going into the details on the tool and its features. I suspect more will come. Now I can really start figuring out what all those indicators shown above really mean!

• Defrag Tools: #39 - Windows Performance Toolkit
• Defrag Tools: #40 - WPT - WPR & WPA
• Defrag Tools: #41 - WPT - Command Line
• Defrag Tools: #42 - WPT - CPU Analysis
• Defrag Tools: #43 - WPT - Wait Analysis
• Defrag Tools: #44 - WPT - DiskIO Analysis
• Defrag Tools: #45 - WPT - File & Registry Analysis
• Defrag Tools: #46 - WPT - Driver Analysis
• Defrag Tools: #47 - WPT - MiniFilter Analysis
• Defrag Tools: #48 - WPT - Memory Analysis - Pool

Offline Windows Updating

WSUS Offline Update - I have been a longtime fan of this tool, updated a few days ago to version 8.5. I never leave my cubicle to respond to a system or re-image/deployment without it on my USB stick. It is the #1 tool I know of to help conserve bandwidth and minimize impact at a site where we are doing a deployment. It remains highly Valca recommended! If you are a Windows PC deployment tech or analyst and you don’t have this tool, you either have some super-big circuits, an internal WSUS server, or you can swagger like Beckham and just don’t care.

Portable Update - This “bravo-ware” tool is new to me. Like WSUS Offline Updater, once built you can use it to redeploy Windows/MS patches to a target system. The process seems considerably different that USUS-OU but it may work better for your needs. I’m hoping to test it soon and have a better side-by-side experience to compare them against. For more information on the tool check out the application’s How to use page as well as this AddictiveTips post: Apply Windows Update To Multiple PCs From A USB Drive While Offline.

SysAdmin Tips

Run any app under the NT Authority\Local System account - TinyApps.org - Comparison between ETS (Elevate To System) tool (it has an optional GUI) and psexec.exe from Sysinternals.

FREE: Get Local Admins GUI – Find users with administrator rights - 4sysops

How To Make UEFI Bootable USB Flash Drive to Install Windows 8 - Next of Windows

Making a better, somewhat prettier, but definitely more functional Windows Command Line - Scott Hanselman’s ComputerZen blog

How To Quickly Unlock Local Administrator Account in Windows 8 - Next of Windows

Finally a Windows Task Manager Performance tab blog! - Ask the Performance Team

SysAdmin Utility & Software Leads

Updates: Mark's TechEd Sessions, Autoruns v11.61, Strings v2.52, ZoomIt v4.5 - Sysinternals Site Discussion

Updates: Autoruns v11.6, Procexp v15.31, Procmon v3.05, Sigcheck v1.92 - Sysinternals Site Discussion

Update: Autoruns v11.62 - Sysinternals Site Discussion

Free Windows virtual machines for Mac, Linux, or Windows - TinyApps.org blog - Official developer virtual machine files for XP, Vista, WIn7 and Win 8. These are really for Internet Explorer developers but are great for other software testing purposes. Even more details here: Making Internet Explorer Testing Easier with new IE VMs - Rey Bango.  Main VM’s download link here.

CopyToFlash - Foolish IT - This could be really dangerous. REALLY dangerous. Like most stuff over at Foolish IT. However it could just be dead-helpful for the right audience and application. Basically it just starts a drive monitoring process and then (with a few configuration actions) will copy the contents of a monitored source folder location to any USB flash drive that attaches to the system. Yeah. Dangerous but helpful if you are responsible for updating new content to tons of USB sticks. Oh, did you know it uses RoboCopy? Yep.

Office 2010 Service Pack 2 Released…(mostly)

Just in time after a major Office 2010 rollout at our coal-mine. Nice timing guys…

Microsoft delivers Office 2010 Service Pack 2 - ZDNet - Mary Jo Foley

Office 2010 and SharePoint 2010 Service Pack 2 Availability - Office Sustained Engineering Blog

Description of Office 2010 SP2 - Microsoft Support

How to obtain and install the service pack

Method 1: Microsoft Update (recommended)

Note In addition to the products in the Office 2010 suite, the service pack 2687455 also updates Microsoft Project 2010, Microsoft Visio 2010, and Microsoft SharePoint Designer 2010.

To download the service pack from Microsoft Update, go to the following Microsoft website:

Microsoft Update

You can opt in a computer to the Microsoft Update service, and then register that service with the Automatic updates to receive the SP2 update. Microsoft Update will detect which products that you have installed, and then apply all updates to the products.

Method 2: Download the SP2 package from Microsoft Download Center

The following files are available for download from the Microsoft Download Center:

• Download the Microsoft Office 2010 Service Pack 2 32-bit package now.
• Download the Microsoft Office 2010 Service Pack 2 64-bit package now.

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to obtain Microsoft support files from online services

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

For more information about a complete list of all released SP2 desktop packages, click the following article number to view the article in the Microsoft Knowledge Base:

2687521 List of all Office 2010 SP2 packages

Cheers,

Claus Valca

Read More

PowerShell Reference Post: The Train Cometh Near…

Ever have that experience when you wake up and realize that event, or project, or whatever that you have been working hard at avoiding or denying is “Upon You”?

Very, very soon down in the coal mine, the opportunity to have Windows PowerShell natively installed on all our Windows desktop system will be realized.

I’ve been doing some old-school “BAT” files and even some very light VBS scripts for a while now to help automate some IT sysadmin functions from the CLI to avoid use of EXE based third-party tools and utilities where possible. Sometimes this has proved wildly successful. Other-times, not so much.

What I probably need to do is hunker down and pound my head into the desk and keyboard and learnz me some Ruby or Perl or Python.

However, for whatever reason, those still seem super-overwhelming to try to figure out how to tackle.

Instead (for now), what I think I really need to do is take the big-boy step of getting some basic familiarity and comfort with PowerShell usage under my belt.

Since the base PowerShell should be on all our deploying Windows 7 systems (and upgradable to what, PS 4.0 now?) that would present a great opportunity to extend system and network administration tasks and increase efficiency.  And since I’m fairly comfortable with the Windows BAT file writing/debugging process, this jump may be a bit easier to make.

So anyway, this is just a list of initial PowerShell references I’m dumping so that I can start my learning process.

If my dear readers have any additional recommendations -- books, URL’s, on-line videos, blogs, etc. -- for helping someone get up to speed with learning PowerShell and its support for system and network administration tasks, please drop your tips into the comment jar.

Windows PowerShell - TechNet Script Center Introduction - Windows PowerShell 2.0, Windows PowerShell 3.0, Windows PowerShell 4.0

Getting Started with PowerShell 3.0 | Channel 9 - A nine-part Microsoft video series - “This Jump Start is designed to teach the busy IT Professionals about this powerful management tool. Learn how PowerShell works and how to make PowerShell work for you from the experts Jeffrey Snover, the inventor of PowerShell, together with Jason Helmick, Senior Technologist at Concentrated Technology. IT Professionals, Admins, and Help Desk persons learn how to improve your management capabilities, automate redundant tasks and manage your environment in scale.”

Advanced Tools and Scripting with PowerShell 3.0 - Windows Virtualization Team Blog - Coming August 1st - Free Microsoft Virtual Academy online presentation training event -- “Find out how to turn your real time management and automation scripts into useful reusable tools and cmdlets. You’ll learn the best patterns and practices for building and maintaining tools and you’ll pick up some special tips and tricks along the way.” I expect it will also be up on Channel 9 a week or so later.

PowerShell Script to Manage Java Browser Plug-In and Java Security Level - SANS Windows Security Blog

Download Windows PowerShell Quick Reference - Microsoft Download Center - “Quick-reference guide to commonly-used Windows PowerShell commands.”

Download Windows PowerShell 3.0 Step By Step Guide - Microsoft Download Center - “Microsoft by default has decided to display Windows PowerShell in the Windows 8.1 WinX Power Menu, although you can change it back to Command Prompt, if you wish. But for those of you who’d like to try you hand at learning Windows PowerShell 3.0, you can download these step by step guides released by Microsoft.”

The Windows PowerShell Toolbox - TechNet Script Center - Loads of links and references for using Windows PowerShell

Scripting with Windows PowerShell - TechNet Script Center - Webcast series links and references, scripts, download sources and usage guides.

Discover the Easy Way to Begin Learning Windows PowerShell - Hey, Scripting Guy! Blog

Windows PowerShell Team Blog

Download Windows Management Framework 3.0 - Microsoft Download Center - Contains Windows PowerShell 3.0 among other bits.

Download Windows Management Framework 4.0 Preview - Microsoft Download Center - Not yet ready for production release, this contains the bits for the next generation of Windows PowerShell.  Consider carefully before deployment as some big system incompatibilities haven’t yet been resolved.

Windows PowerShell 4.0 Preview - Rick Barber's Blog. From Rick’s brief summary post…

“You should note that the supported operating systems do not include Windows 8 or anything earlier than Windows 7 SP1.  Sources tell me that PowerShell 4.0 will be included with Windows 8.1 when it is released as well as Windows Server 2012 R2.

“Pay close attention to the link above as the Management Framework 4.0 Preview is not compatible with some Microsoft Server applications including all versions of Exchange server, SharePoint server, and other applications.  You really shouldn’t be installing a preview in a production environment, anyway, but rather using it locally on your workstation or laptop for testing and familiarization.“

PowerGUI.org - Free Windows Powershell Community. When we did a big rollover from Novell to Active Directory, the AD pros who were brought in had PowerGUI prominently displayed on their secondary monitor as they powered through the transitional operations.

PowerShell Pro! - website with tons of on-line tutorials for Windows PowerShell. It doesn’t look like it has been updated for a number of years, but if you are just getting started from the ground up, most of the material here should still be valuable, especially considering the rich illustrations and screen captures that accompany the primary guide texts.

PowerShell Analyzer - (now free) GUI tool to manage PowerShell scripting. Old TechNet Mag review here: Toolbox: New Products for IT Pros

PowerShell.com – PowerShell Scripts, Tips, Forums, and Resources. Community website.

learn windows powershell - YouTube search results on the terms

learn windows powershell - DuckDuckGo search results on the terms.

Cheers!

Claus Valca

Read More

Fun with Lightworks, the Canon 5D Mark II, and little Bro

A few weeks ago, an exciting opportunity came up.

I had the chance to publically record a nationally-winning high-school student’s (re)performance of his work under controlled settings.

So out came the Canon EOS 5D-Mark II, lenses, and a solid tripod.

My brother had just moved back in town so he got an invite too.

He set up from a different angle with his own amazing Canon EOS 60D.

Someone yelled “action” and we both started shooting HD video on our Canons.

Side note: I am continually surprised and amazed when I learn of feature movies and video productions being shot with the Canon 5D Mark II/III.  I am humbled that I am carrying such a amazing piece of hardware in my camera bag now. Thanks bro! It’s inspiring!

There was one minor flub in the performance so I shot a tight retake of that section with the actor.

Data video files were downloaded and shared. It was grand fun.

A week or two later I sat down at my laptop and faced the daunting task of somehow editing the video from two different camera angles, and the two different audio tracks into a single video performance.

I had a lot of options, both new software and old ones.

In the end I decided to jump off the proverbial cliff and went with the free community version of Lightworks.

The learning curve was very, very high, but I had done due-diligence by spending a few days re-reading the PDF manuals downloaded earlier, I then watched (with full attention) the official Video Tutorials. Peter Bridgman did a bang-up job showing all the core features and things to know to quickly get grounded in the application.

From there I just jumped in (with significant text-messaging support from my brother throughout the day), imported the multiple 4 GB MOV files each of the Canons had captured and started working away.

I had planned on using some of the audio/video syncing features it carries, but in the end the time codes were not quite perfect between the cameras so it took a bit of trial-and-error to manually make all the angle cuts sync smoothly. IU

The different angles and lenses also caused some differences in the color. I was able to edit the color in both to match very closely for continuity.  Even the section of performance “retake” slipped in seamlessly.

The final challenge was exporting the video. My first attempt resulted in almost a 80GB AVI file. Wow!

Another go with some different export settings knocked it down to a more manageable 40 GB size. I still had to run it through a secondary audio/video re-coder app to bring it down to a final 127 MB video file size so that it could play on a DVD format without stuttering.

The end result was a pretty awesome HD video production shot with my bro, after at least 12 hours of learn-as-you-go video editing and post processing. The family of the student we shot the video for were blown away with the results, as were my brother and other family who got to share in the final production.

Through it all Lightworks (x64 bit build 11.1) never choked or had any problems. My Intel i7 processor with 8 GB system RAM kept up with the workload as well.  I’m super glad I made that investment at the time of purchase. It hardly broke a sweat!

For being an amateur videographer on a first foray into HD video recording and editing, it was a lot of fun and I’ll definitely have much more confidence the next time we roll into the field.

Not soon after I was done, I spotted news about Adobe Premiere Pro’s own features and multi-video sync support:

Adobe Premiere Pro CC Hands-On: Multi-GPU Support and More - Windows Extreme Blog

While Lightworks isn’t probably going to win most home users away from more friendly video-editing apps, it is a truly professional-grade video editing platform…and the free version will probably be way beyond most average users’ ability to exceed it’s options.

More:

• Importing and synching non-standard video clips into Lightworks - YouTube
• Lightworks - Sync group and live editing basics - YouTube
• Sync audio in Lightworks tutorial / Synkronisera ljud i Lightworks instruktionsvideo - YouTube
• Multi tracks video edit - How to ? - Lightworks
• TOPIC: Importing audio - Lightworks
• EOS 5D Mark II best video on Vimeo
• CANON EOS 60D Channel on Vimeo

And the New Lightworks Version 11.1.1.e Now Available as Public Beta looks even more amazing!

Lightworks NLE free edition - Highly Valca Recommended!

--Claus Valca

Read More

Short List of free video-editing apps

It’s been quite a while since my Video-Editing Resource Roundup back in 2009. Check that link out for a recap, though quite a few have disappeared in the time since that post first was written.

There are tons of resources, but these (beyond the Microsoft ones that come on/with Windows) are the primary free versions that I am playing with nowadays.

• Shotcut by MLT Framework - a free, open-source cross-platform video editor. It has a nice GUI and runs on Linux, OS X, and Windows. For a brief introduction, take a look at this review by AddictiveTips blogger Waqas Ahmed. Shotcut: Nifty Multi-Platform Video Clip Editor With Custom Filters
• Lightworks - Wow. This one still amazes me. The free version is a bit stripped down with some of the supported features but for most wanna-be video-editors, it’s a great place to get your feet wet and have the water go quickly over your head. Download. The newest version requires activation, but you can register for a free account to activate it.
• Avidemux - free and no-frills video editor do to basic cutting/filtering/encoding. Latest version is 2.6.4 released May 09 2013 so it is still being updated regularly. Good place if you want an alternative video editor but don’t need all the bells and whistles of the big-boy-toys.
• VirtualDub - video capture software that also lets you do pre/post processing. Pretty cool if you don’t want to use the manufacturer’s software that come with the video device.

Moving on now…

Claus V.

Read More

…you’re getting warmer!

“Escape” on flickr. CC 2.0 attribution: Photo © 2010 J. Ronald Lee.

In a new development that warms my heart -- much like my last post of realizing the additional rental charge for the cable broadband modem -- we have now found Comcast/Xfinity is charging us $1.99 (+tax) for each of the previously “free” basic digital adapter boxes they gave us. We have 2 units in other rooms that supplement the primary HD/DVR unit in our living room which we rent.

We got these last year when Comcast switched from carrying analog signals for many of their channels to digital-only; their “Digital Migration” project. Want to get all those cable channels that aren’t “over-the-air” broadcasts?  Too bad. You need to use our digital adapter box.  But don’t be sad. We will give it to you for free! See? No pain!

Well that was a bait-and-switch.  Comcast is now charging for those previously-issued “free” digital adapter boxes.

And the frustration is sweeping users and communities across the Comcast service area.

comcast digital adapters - Google Search

From some articles I have read, Comcast “might” be rolling out better models of these first-generation digital adapters…some with HD signal support. Bet they come with an even higher price-tag. Not sure of the accuracy of the reports as you can already rent HD set-top receivers and HD/DVR units from Comcast.

I don’t know.  I brought up the topic of just ditching all our cable services except the broadband internet (which would go up more if we stopped bundling it with other services), but was immediately out-voted by the other family members who wouldn’t be able to get all their favorite TV/movies, even over the Internet.

What is so frustrating is not so much that we need to pay for equipment usage -- that’s fair and the American Way ™ -- what doesn’t feel right is getting something for nothing (which was fair because the service delivery method was a forced change on the customers) but then having to pay for it after the rollout. What would have been more fair and probably generated customer good-will (and enthusiasm) would have been to say:

• So sorry, we have to convert our analog signal delivery to digital to increase capacity for your benefit and to enhance signal security and delivery control for us.
• We are giving you up to two basic digital adapter boxes for free; bear with us though the transition process. We know you have some other choices and we want you to be proud to be our customer.
• Thanks for sticking with us through the transition to digital signal delivery! Hurray! We made it!
• Now that we are on the other side we have some exciting options for you.
• You can keep on using the free basic digital adapter boxes -- still no charge for our loyal existing customers! You are “grandfathered” in.
• Or, if you would like, you can swap them out for a new next-gen basic digital adapter box that will allow you to also get HD channels for your subscription tier -- at only $4.99/ea. a month!
• Want even more features? Check out our full lineup of HD set-top cable boxes.

That would have been brilliant!  Sign me up!  Here’s my checkbook!  More money for you and more happiness for me!

So I guess Comcast has me exactly where they want me.

Simmering in their pot paying for the privilege of keeping two “free” digital adapter boxes for with two unhappy house-mates who aren’t pleased with quality of the new digital-only signal and clamoring for HD receiver set-top boxes now. Seems like the one HD/DVR in the family room may not be enough any longer.

All hail the great Digital Revolution and the power it brings to the consumer.

Claus V.

PS:

About that image/frog; per the photographer, no frogs were harmed in the photo-shoot.

See also: Boiling frog - Wikipedia.

Read More

For-Sec & Utility Jumble Linkfest

The short weekend is done. The “Sandy Watch” is on for what could be -- for our northeastern friends -- a storm event to be remembered for many years to come. So comes a pile of security/forensic and utility-minded links spill out below for the curious and information hungry.

Forensics and Security

Girl, Unallocated: Be Very Quiet... I'm Tracking Emails Through Headers - Girl, Unallocated Blog. The Girl has a great post looking at email headers and their bits and perils. One gem is a report (PDF) from Stroz Friedberg and a particular focus on email headers. The report as a whole is a great read and again provides a lesson in technical report writing and presentation as well as some forensics pushback on anti-forensics techniques. At 102 pages, it isn’t a brief, but well worth the time to download and study.

The Girl’s post reminded me of another great publicly-available report that addressed emails in a forensic investigation.  In my GSD post Interesting Malware in Email Attempt - URL Scanner Links, I wrote the following bits at the end:

A recent Digital Forensics Case Leads post has mention of a super-fantastic investigation/forensic report involving anonymous emails. This is must-read material, not just in terms of the investigative methodology but also the way the report was composed and presented. Very clearly done!  I’m keeping a saved copy of the report for future reference; both technically and as a report template. From the post via the link above:

“University of Illinois recently released a detailed investigation report (PDF) regarding anonymous emails allegedly sent by its Chief of Staff to the University's Senates Conference. The report is an interesting read, and also serves as a potentially useful model for those looking for report samples and templates.”

How a Google Headhunter's E-Mail Unraveled a Massive Net Security Hole - Threat Level @ Wired.com.  I almost overlooked Kim Zetter’s post on how Mathematician Zach Harris -- as an exercise -- discovered a flaw in some providers user of a weak DKIM key to sign emails originating from them. Fascinating and short read.

DEFT 7.2 and DEFT english manual, ready for download! DEFT Linux - Computer Forensics live cd . New DEFT version out. Last one in x32 bits. Future versions will be strictly x64 flavored.

Xplico – Xplico 1.0.1 - Xplico new version release just dropped. From the brief post:

ChangeLog:

• nDPI integration
• performace improved
• FTP dissector improved
• Added the prism dissector
• CLI execution bug fixed
• PCAP-over-IP SSL encryption
• IRC dissector improved
• File reconstruction from Fragmented Payloads improved
• FaceBook Chat updated
• FaceBook Message (partial)
• HTTP without initial packets (packets lost)
• RTP dissector improved
• PCAP2WAV, RTP2WAV interface added

And don’t forget! Now you can update/get via apt-get! for Ubuntu 11.04 and higher.  Sweet!

sudo bash -c 'echo "deb http://repo.xplico.org/ $(lsb_release -s -c) main" >> /etc/apt/sources.list'
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 791C25CE
sudo apt-get update
sudo apt-get install xplico

LastActivityView - Nirsoft brand new utility! - Use this new tool to view the latest computer activity in Windows operating system. Nir Softer has some more details on his NirBlog: New utility that shows general computer activity. Could be useful for incident response and analysis and other “quick peeks” for key system activity indicators to narrow down the search.

FileAlyzer Portable 2.0.5.57 (detailed file analyzer) Released -PortableApps.com

Hacking KeyLoggers - Open Security Research has a great post that not only identified a USB keylogging device, but takes it to the next level in hacking it to determine the impact of the device and when it might have been dropped. Clever stuff.

Attacking TrueCrypt - The H Security: News and Features. Another interesting post that almost slipped by me. Interesting by itself but also shows the benefit of using “cascaded algorithms” in TrueCrypt to thwart current attacks…for now.

Restoration of defocused and blurred images - Yuzhikov.com. This is super cool.  Vladimir Yuzhikov hasn’t just done a proof of concept for de-fuzzing blurred imaged (either out of focus or those blurred with a mathematical algorithm), no, he has actually released a free Windows app to demonstrate the possibilities. Besides images, text that is out of focus can be unblurred as well. This is very fascinating and could assist investigators facing images and other digital files with blurred faces or content. It’s not exactly easy or guaranteed to work, but it is very promising start and Vladimir notes he is continuing development and refinement. Read his work please and snag the download.

Google Drive opens backdoor to Google accounts - The H Security: News and Features . Quoting from the post, “The Windows and Mac OS X desktop clients for Google's Drive file storage and synchronisation service open a backdoor to users' Google accounts which could allow the curious to access a Drive user's email, contacts and calendar entries.”  read the post for more info. As usual it seems to be a convenience versus security trade-off again. Choose your cake wisely. I stick with using only the web interfaces and pass on the client versions of these cloud-based storages services…for now.

Virtualization

The TinyApps bloggist has been hard at work digging out great tips and techniques for importing the virtualized “Windows XP Mode” into popular virtualization software. As always, the posts are impeccable with lots of details and supporting source documentation for additional study and research.

• Import Windows XP Mode into VMWare Player - TinyApps.org blog
• Import Windows XP Mode into VirtualBox - TinyApps.org blog
• Must-have tool for VirtualBox users - TinyApps.org blog.

Oracle VM VirtualBox - Version 4.2.4 just dropped…by the way. I almost missed it were it not for my RSS feed filters. See the changelog for more details.  And be sure to grab the 4.2.4 VM VirtualBox Extension Pack as well.

Miles’ posts reminded me of an earlier GSD summer post Virtual Solutions and his great post comment guiding me to getting MS’s IE VirtualPC images running in Virtual Box.

How to run Microsoft’s IE VPC images in VirtualBox
http://tumblr.jonthornton.com/post/11405634980/how-to-run-microsofts-ie-vpc-images-in-virtualbox

ievms - Automated installation of the Microsoft IE App Compat virtual machines
https://github.com/xdissent/ievms

Browser Plugin Update Time…Again.

Yes dear readers, it is “Jack and Jill” time again. Bother.

Adobe Shockwave got updated, as of this post, the newest (Windows) version of Adobe Shockwave is currently 11.6.8.638.

• Adobe - Adobe Shockwave Player - direct download
• Adobe - Security Bulletin: APSB12-23 - Security updates available for Adobe Shockwave Player - Adobe
• Adobe patches 6 critical security flaws in Shockwave - ZDNet
• Adobe fixes critical Shockwave vulnerabilities - The H Security: News and Features

Adobe Flash was updated as well. Newest (Windows) version is currently 11.4.402.287.

• Adobe - Flash Player - version information
• Adobe releases 25 critical Flash patches - The H Security: News and Features
• Adobe - Security Bulletins: APSB12-22 - Security updates available for Adobe Flash Player - Adobe

Java also got a quick update to both build versions. Windows Java updates are available in 1.6.0_36 and 1.7.0_09.

• Java SE 6 Update Release Notes - Oracle
• Java SE 7 Update Release Notes - Oracle
• Java SE Downloads - Direct download

Trying to figure out if all your browser plug-ins are current can be a super-pain for the inexperienced and geekless.

My go-to recommendation remains to pop over to Qualys BrowserCheck in each of your installed web-browsers, be it Chrome, Windows IE, or Firefox. Alas, Opera, Safari, and other browsers are not currently supported, however a check in one of the supported browsers may quite likely uncover a outdated plug in, patching it may fix the others in the process.  For a backup check, hope over next to The Secunia Online Software Inspector for a second opinion.

If you want a good all-in-one location to manually download your plugs, check out Browsers and Plugins Downloads over at FileHippo.com.

Utility and SysAdmin Finds of the Week

Defrag Tools: #13 - WinDbg - Defrag Tools @ Channel 9. New video on Sysinternals tool usage; specifically integrating Debugging Tools for Windows.

Case of the CertUtil Import Refusing The Correct Password - chentiangemalc. Great practicum post on troubleshooting a strange password error where the password was correct but not being taken.

SpeedyFox - Boost Firefox,Skype,Chrome,Thunderbird in a Single Click! - CRYSTALIDEA Software . It has been forever…like dinosaurs roaming the earth eras ago…since I last saw any post anywhere on speeding up a pokey Firefox browser by “optimizing” the JSON databases. This is a dead-simple process to improve launch-time for a well-used Firefox browser. It’s been months since I last optimized mine. When I went to run SpeedyFox, my favorite tool to do so, I wondered if there had been an updated release. My version was at least a year old.  Happily I found there was a newer version, and that it now supports optimizing Chrome-based browsers as well. It remains available as a free edition. Current version is 2.0.3 but while I was sleeping, the developers have been adding support for Skype, Chrome (including SRWare Iron and Pale Moon), Mozilla Thunderbird, and Firefox (including Epic Browser). There is a Mac version (Firefox only) also.

If you use Firefox/Chrome/Thunderbird, stop, drop and run right now!  Did I mention it supports custom paths to your browser profiles so you can optimize portable versions on your drive/disks? Sweet baby Jebus!

CR2 Converter - I shot a lot of photos for Lavie and her family last weekend with the Canon 5D Mark II.  Pops asked for copies and when I was getting ready to pass them off, I realized I had not changed the setting from “RAW” only to RAW+JPEG. So I had over 300 digital images in RAW .cr2 format that his computer cannot read and that are not really a practical format for him anyway to use. Sure, I could batch-convert them in Lightroom/Photoshop, but I really just needed to get them quickly on a CD for him.  I have more than a few RAW freeware tools for tweaking individual RAW file images but that was too time-consuming to use. Luckily, with just a bit of Google diving, I found the freeware Canon RAW Image Converter “CR2 Converter”.   It supports batch-conversion and did an acceptable job for this task. My i7 x64 8 GB RAM system chewed through converting the files in no-time.  To my eyes the resulting images were a bit lightly purple-tinted…not bad or unpleasant but definitely noticeable when compared to the RAW file. Nothing that some simple color correction can’t fix if really important. For Pops it wasn’t but YMMV.  I wouldn’t use it everyday for batch processing but for quick-n-dirty RAW .cr2 to JPEG/JPG/GIF/BMP/PNG/TIFF conversions it is a super time-saver. Tuck it away for when needed in a pinch.

Cheers and hopes and prayers for the very best across the north-east seaboard as Sandy rolls in.

--Claus V.

Read More

Displaying digital media on an older HDTV - Dad Approved

CC attribution: by Daniel Oines (dn1967b) on flickr.

Being a child of the 70’s and 80’s, one common family event was family “slide show” time. Dad, being a hard-core amateur photographer (we had a dark room, chemicals, print paper, etc.) took lots of SLR photos. So naturally we had lots of slides.  That meant after trips or for family get-togethers, down would come the project screen, up would go the slide projector, and out would come the boxes upon boxes of slide carousels.

Hummm…and in the next slide…ca-chuka-chucka…we can see…first young Claus proudly showing his tiny perch caught on his bamboo fishing pole…and in the next…ca-chuka-chucka…Claus has fallen off the pier into the lake. See how the pole floats? Alas, Claus does not. Ha-ha, dad.

Ain’t technology grand?

Fast forward to 2012.  Dad is now well into the transition from 35mm SLR photography to DSLR photography. That is generating a lot of digital photos from his vacation trips and amateur anthro/paleo field-work. Not to mention digital photos from iPhones and point-n-shoot cameras he and his wife both have and use for the daily life and family events.

Up to now, he has been able view them quite successfully on his desktop PC at home. However when there is a large family gathering at his house, he has to fetch the correct camera, connect it to his Sony Bravia KDL52W4100 HDTV via a low-quality video-in (yellow RCA) plug. While serviceable, Dad’s got a sharp eye and the high quality of his digital shots isn’t done justice with the low-quality of the input method.  This older HDTV doesn’t have any slots for USB/memory cards like his PC does. Bummer.

So he asked me for advice.

I needed to find a dead-simple solution to bring him the ability to show his great digital photographs as close to HD as possible on his older HDTV.  Maybe move the desktop PC to the living room or use a super-long D-sub VGA output cable from the den to the back of the TV?  Well, yes…but…

Here’s what we did.

Part 1 - IncrediSonic Ultra Play IMP150

I advised him to pick up a IncrediSonic Ultra Play IMP150 (Amazon link) multi-media player. It has a USB port and supports HDMI output. (The same model is on Newegg.com).  There is the unit, a remote, an A/C adapter, and some low-def audio/video cables in the box.

I recommended this one to him for few reasons. First the Amazon product page has a mini-review video. I wanted him to be able to view the video to make sure the operation seemed logical and non-techy to use for him. The sub $40 price was great. It had an HDMI output that supported 1080p. Dad isn’t using all his HDMI ports on his Bravia TV so connecting it in HD output would be supported.  Not only would it support his digital image files, but it also could support many video file formats as well. It supported SD media sticks (from the point-n-shoot cameras). It has a USB port so media on a non-supported memory card format could be copied to a USB stick for display. Finally, the menu-interface and navigation seemed pretty intuitive.

More videos of that product in action:

IncrediSonic Ultra Play HD Media Player - MyKeyReviews - YouTube

Vorstellung des Incredi Sonic Ultra Play IMP150 - HD TV Digital Mini Media Player (HDMI,USB,1080 p) - YouTube

Note, there are quite a few other similar products that have pretty much the same features if you like this solution but want to explore other products, take your pick.

Part 2 - Patriot Xporter XT Rage 32 GB USB stick

Patriot Xporter XT Rage 32 GB USB 2.0 High Speed Flash Drive - Amazon product link

Patriot Xporter XT Rage 32GB USB 2.0 Flash Drive Model PEF32GRUSB - NewEgg product link

Dad does have a number of USB sticks that could have been used, but I recommended he use a new dedicated stick just for showing his digital photos/media on this unit.  There were probably even faster USB sticks than this one, but I have been pleased with my Patriot Xporter flash drive for many years. This 32 GB model has lots of storage room over his 4 GB models, and the smaller format would (hopefully) mean it wouldn’t stick out of the USB port on the IncrediSonic device like a standard USB stick would and risk over-torque/breaking of the USB port connection soldier points to the device system-board if dropped/banged/etc.

I could have found an even smaller USB micro-plug but then I was worried about possible loosing of it, or it being hard to manipulate on the desktop system.

The storage size and physical size of this unit seemed the best balance for his particular needs; adjust accordingly.

Part 3 - HDMI Cable(s)

So here is where my plan came together.

I pointed Dad to this AmazonBasics 2-Pack, High-Speed HDMI Cables 6.5 feet cable set. NewEgg also has more than a few HDMI cable picks as well.

This would so be easier and better quality than continuing to use that silly yellow video out/in RCA plug connection!

I went with the 6.5 ft length so he could leave it plugged in on the back input panel of the HDTV display and then tuck the cord away when not in use. Then there would be enough length to allow it to stretch to where he could put the IncrediSonic device close enough to a A/C source and high-enough for the remote signal to reach it.

The 2-pack was recommended so he could leave one permanently attached to the back of the TV as mentioned but the “spare” could be kept in the box/bag with the IncrediSonic so he could take it on the go when he visited other family members who also had a HDTV with HDMI inputs. This way the show could conveniently go on the road!

Dad ordered the set the next day from my recommendations and a few days later had the whole thing running perfectly. He was beyond pleased with the quality of the display.

I reminded him that according to the reviews, it defaults to 720p HD format but if the HDTV supports 1080p, he can change a setting on the device to get even better display quality for his DSLR digital photos.

This or a similar “kit” might be really valuable for ForSec and/or other digital media users who need a standby for showing digital media presentations…just in case that laptop doesn’t work, or that TV/display provided isn’t what they said it would be, or if the one cable you need to use your standard setup goes bad. This particular combo came in a just under $100. Not bad.

Definitely Valca Sr. approved.

--Claus V.

Read More

Pile ‘o Linkage

CC attribution: "Chain links" by HowardLake on flickr.

Time to unload them…

Forensics

• Windows 8 Forensics - A First Look - YouTube video from ForensicFocus presented by Josh Brunty. appx 40 min.
• Digital Forensics Stream: VSC Toolset - GUI tool for executing batch files against a volume shadow copy. More details on the latest version in this VSC Toolset Update: File Recovery blog post.
• Windows Incident Response: Forensic Scanner - Windows Incident Response blog - Harlan has recently released a super assessment tool to get a fast big-picture view report of a system being examined. It is very simple to use and provides great data for figuring out if there are any important indicators to spend more time in a closer examination of the system. Download available at forensicscanner - ASI Forensic Scanner via Google Project Hosting
• Network Artifacts found in the Registry - Windows Incident Response blog - This is a RegRipper focused post but the previously mentioned Forensic Scanner also provides some network information; the WiFi info is quite useful on laptops to see where they have been traveling and connecting to.
• From Malware Analysis to Portable Clam AV - Journey Into Incident Response - Corey Harrell has a fun post read on identifying a malware binary and then creating a custom AV signature in ClamAV.
• New Archive of RegRipper Plugins - RegRipper has a new collection of current/updated plugins available if you haven’t snagged them recently.
• Live forensics: prefetch and powershell - 8 bits blog - using PowerShell in incident response.
• CAINE Live CD - computer forensics digital forensics - Release version 3.0 “QUASAR” is out with some updates and application additions.

Adobe Reader XI (11)

• Announcing Adobe Reader XI - New version of Adobe Reader is out…just when you were probably getting your apps finally coded to interact with Adobe X (10).
• Adobe Reader XI Deployment - Stealthpuppy’s Aaron Parker has some excellent as always tips on deploying it; including some customizations.
• How to configure Group Policy for Adobe Reader XI - Group Policy Central - Not to be outdone by Aaron, Alan Burchill also has some tips for using it with GP.

Network Bits

• Meet the successor to Microsoft Network Monitor! - MessageAnalyzer - TechNet Blogs. The successor to Microsoft’s NetMon packet trace tool is out in beta. I believe it is only supported on Win7/8. I’ve played with it a bit and NetMon users should quickly feed comfortable in it, although the GUI is significantly different in many ways. Testing captures on a Win8 RC virtual machine have gone pretty well. I’ve had a few crashes so more work does need to be done before final release in mid-2013. Definitely worth checking out though not likely to replace Wireshark or your other favorite network packet capture tools quite yet.
• New Release: Cisco Discovery for Windows v1.3 -What the.....? blog. - I’ve posted before of various ways you can trace down what switch port is connected to, all usually multi-stepped. If you have a Cisco based switched network, this new-to-me tool in a single executable might save a whole lot of frustration if kept handy on a USB stick.  Run it, pick your interface, get your CDP data…switch/port will be magically revealed. Sweet! Get the WinCDP tool here.
• WinsockServicesView - NirSoft - is a New utility to view, disable, and enable the installed Winsock service providers. Nir does it again with a super easy-to-use and helpful tool to catalog Winsock service providers on a system.
• Install NetworkMiner with apt-get - NETRESEC Blog. Yeah. It’s now that easy. Not like before in a previous GSD post: Network Miner Updating on Ubuntu 12.04
• Wireshark Tutorial Series. Tips and tricks used by insiders and veterans - Sniff free or die blog details a new Hands on with Wireshark YouTube video (11 min) by RiverbedTechnology that covers some basic usage tips.

For the SysAdmins

• How to find latest Microsoft Knowledge Base articles for Windows 8 and Server 2012 - Anything about IT
• FREE: Group Policy Search – Find Group Policy settings - 4sysops - Via this MSDN site: Group Policy Search
• DOWNLOAD: Group Policy Settings Reference for Windows (8) and Windows Server (2012) - Kurt Shintaku's Blog - See also: Group Policy Settings Reference Spreadsheet - Group Policy Team Blog
• Crash Course in Active Directory Organizational Unit Design - Windows Networking site.
• Case of the Domain Join Failure followed by Case of the Domain Join Failure II–Object Already Exists - chentiangemalc
• Enterprise Wireless Security – An overview - 4sysops
• Get Files Out of a Running Virtual Machine - Ben Armstrong Virtual PC Guy Blog
• How to diagnose Windows sleep problems - Tenniswood Blog
• 7 Cool Useful Command Prompt Tips You May Not Know - Windows7hacker
• Beyond good ol’ Run key, Part 2 - Hexacorn blog
• Windows PowerShell 3.0 download - Bink.nu summary of the new features in PS 3.0
• Download: WMF 3.0 - Microsoft Download Center
• PowerShell 3.0 - 4sysops - Krishna Kumar offers a overview of some of those newest features.
• PowerShell 3.0 overview – Part 2 - 4sysops - the review continues….

Utilities

• Updates: Autoruns v11.34, ProcDump v5.0, Sigcheck v1.8, VMMap v3.11 - Sysinternals Site blog
• Process Explorer v15.23 - Sysinternals
• PsPing - Sysinternals new CLI tool to measure network performance including bandwidth available between systems. Also can generate histograms of results.
• Rapid Environment Editor - Most folks won’t have any need to ever edit their Windows environment variables. But if you are a tweaker or geek or sysadmin, you might need to. This looks to be the tool for you! in addition it provides Error checking to highlight any problems with the entries. I had two “abandoned” items in my system I cleaned up with it. Really a nice portable tool to keep handy.
• MetroTextual 1.1 - SingularLabs - Minor update to a Win8’ish style notepad tool. I posted quite a bit about it earlier MetroTextual - Spirit of the notepad known as Bend...  This new version has some fixes and feature enhancements. However I noticed on my Win7 x64 system that while v1.0 seemed OK, version 1.1 garbles selected text. I like the newest feature adds but it remains a work in progress…which raises the same question Scott Hanselman of ComputerZen pondered: A Bug Report is a Gift.  What is the best way to report it to the developers…from within the app?
  
  before text selection…
  
  
  after text selection…
  Curious…
  
• HexDive 0.5 – Adding a bit of a context… & HexDive 0.6 – new strings and more -Context… - Hexacorn continues to make great leaps of improvement in the free and super-useful HexDive tool to look for interesting string patterns in files. Check it out!
• PeStudio 4.10 - Winitor - Speaking of binary analysis, PeStudio is a new-to-me tool to aid in application binary analysis. Cool!

New “Defrag” Tools Videos (and others also)

Microsoft/Sysinternals and their Channel9 team have really scored a home-run with their “Defrag Tools” video series. Each week (or sooner) a new quality video comes out..with clear file download links/formats…that reviews or expands an in-depth review of Sysinternals tools and usage.  I’ve already posted links for Episodes 1-6 and now we have 7-12 out.  I download these at home and tuck them away for replay on rainy days or presidential debates. Even when I consider myself very comfortable using a particular Sysinternals utility, walkthroughs such as these always leave me with a new tip/trick/configuration tweak that I didn’t have before.

• Defrag Tools: #7 - VMMap
• Defrag Tools: #8 - Mark Russinovich
• Defrag Tools: #9 - ProcDump
• Defrag Tools: #10 - ProcDump - Triggers
• Defrag Tools: #11 - ProcDump - Windows 8 & Process Monitor
• Defrag Tools: #12 - TaskMgr and ResMon

A great supplemental Channel 9 is The Defrag Show

See also this WEBCAST: Maximizing Windows 7 Performance: Troubleshooting Tips (1hr 1min) as found by Kurt Shintaku and add it to your video bag as well.

Google Fonts

Font geek? Me too!

I frequently hit the following sites looking for new and impactful free-use fonts for maximum impact on presentations and documents where having just the right font can add a punch of enhancement.

• 1001 Free Fonts
• Font Squirrel
• dafont.com
• Font Freak

So I got really excited when I found that Google has a web font collection (500+) under the Open Font License.

• Google Web Fonts - Google
• Google Fonts directory - Google
• Download and Install Google Fonts on your Computer - Digital Inspiration
• Download Reference Posters for Google Web Fonts- Digital Inspiration

Now this is really cool!.

Cheers!

--Claus V.

Read More