Java does a “Jack and Jill”

CC attribution: illustration "Jack and Jill" by "perpetualplum" on flickr.

So here is the way I saw the Java drama roll downhill like Jack and Jill over the last two weeks from security standpoint.

So we started out safely headed up the hill to fetch our water shod with Oracle’s Java 1.7 update 6.

08/27/2012 - Starting up the hill…

• Quick Bits about Today's Java 0-Day - ISC Diary
• Research & Analysis of Zero-Day & Advanced Targeted Threats:Zero-Day Season is Not Over Yet - Malware Intelligence Lab from FireEye
• Java 7 0-Day vulnerability information and mitigation - DeepEnd Research
• Attackers Pounce on Zero-Day Java Exploit - Krebs on Security
• Researchers: Java Zero-Day Leveraged Two Flaws - Krebs on Security

Oh noes! Jack has stumbled!

(It wasn’t really clear at first, but Java 1.6.34 was also vulnerable.)

08/30/2012 - Java Jack Recovers

Fortunately Java Jack just had a stumble, the pail and his crown are still safe after catching himself.

• Oracle Releases Java Security Updates - ISC Diary
• Vulnerability Note VU#636312 - Oracle Java JRE 1.7 Expression.execute() and SunToolkit.getField() fail to restrict access to privileged code - US-CERT
• Alert for CVE-2012-4681 - Oracle
• Java SE 7u7 AND SE 6u35 Released - F-Secure Weblog : News from the Lab
• Oracle patches critical Java bugs used to commandeer computers -  Ars Technica

So we all rush out and download Java 1.7.7 and/or Java 1.6.35.

Whew! That was close.

08/31/2012 - Java Jack Takes a Dive bringing Jill with him

Jack…Stop looking at that frisky rabbit and getting ideas and pay attention dude! You’re about to step into some of its…

Oh snap! You did and you slipped in it.

• Not so fast: Java 7 Update 7 critical vulnerability discovered in less than 24 hours - ISC Diary
• Critical bug in newest Java gives attackers complete control of PCs - Ars Technica
• Latest Java sandbox is still vulnerable - The H Security: News and Features
• Blackhole targeting Java vulnerability via fake Microsoft Services Agreement email phish - ISC Diary

Seriously Jack. Really?

You should have been paying better attention to your hill-climbing technique; or at the very least dear Jill and not the rabbit.

Now you’ve taken Jill out in your folly and broken your crown; again.

Still Want That Water?

So where does that leave us now that we are holding the pail to safely quench our thirst?

Here is some sound advice.

• 6 ways to protect against the new actively exploited Java vulnerability - Security - InfoWorld
• You don't need Java - BetaNews
• Tips For Java Junkies - F-Secure Weblog : News from the Lab

Me? I just disabled my Java browser plugins for IE/Chrome/Firefox and run NoScript in Firefox. However I didn’t uninstall my Java applications (1.6.35/1.7.6) as I do use a handful of true Java applications on my system.

I figure that will have to do for now until the next round of updates rolls.

No word when Jack will be out of the ER yet. Jill remains pouty.

Other Java-related tools you might be interested in while you wait…

• JavaRa - SingularLabs - great third-party freeware utility to manage your Java RE build installations. More here at ghacks.net.
• Jarfix - Johann N. Löfflmann’s tiny app to fix Java “JAR” file associations on Windows after a Java update borks them.
• Java SE Downloads - Oracle - Java SE (Standard Edition) 7u7 JRE (Java Runtime Environment) and Java SE 6 update 35 JRE download links available from this link. When new updates are available you should be able to get them here.

Oh, did I mention that we just completed a massive rollout of Java 1.6.31 a few weeks ago across our enterprise to bring us to a new operational standard?

I lovingly refer to it as Project Maginot Line.

à revoir! from the bunker,

--Claus V.

Read More

Trouble with The TEDinator

One of the weekly doses of encouragement, motivation, and inner growth I take in are the regular presentations on TED.

However, I don’t yet have a data-plan on my growing-older mobile phone and I cannot always count on WiFi availability running around.

What does work is downloading TED talks locally and then keeping them on my laptop for later viewing or conversion/transfer to my phone.

To aid in that process I have been relying on an awesome tool called The TEDinator coded by Obin Shah.

Obin updated it back in May to version 3.0 and it really has rocked.

So when I recently learned about an older 2005 TED presentation, Richard St. John's 8 secrets of success - TED.com, I went to The TEDinator to fetch it…and was greeted with this error:

The TEDinator error was:

Ouch!!! We just had a Boo-Boo!!
Length cannot be less than zero.
Parameter name: length

Granted, at least Obin coded it as a “kind” error. That was a nice touch.

I checked the settings and everything looked cool.

Usually the primary problem I find with these “download” helpers is that the provider has changed their URL patch format slightly requiring the developer to tweak it again to keep up.

I checked the version and it was listed as Version - 3.0.0.0

So I then hopped over to Obin’s site Scenario-Solution to look for an updated version.

No dice. Still listed as V3.0 from July 1, 2012.

However, I was curious to see if others had been running into the same issue and dove into the comments.

I found a brief thread from August 30th about someone else having the same issue.

There wasn’t any mention of a fix, but on a whim I went ahead and downloaded The TEDinator again from the link on the page which hosts the download over on bitbucket.

And the downloads worked again!

So what up?

I checked the version number of the working one.

Still the same version 3.0.0.0.

However the binaries are clearly different. 

First the non-working TEDinator properties:

File version 3.0.0.0
Size: 679 KB
Original filename: TEDinator.exe

Next the working TEDinator properties:

File version 3.0.0.0
Size: 601 KB
Original filename: TEDinator.exe

Clearly they are different binaries despite the same internal file version listing.

I am a bit surprised that Obin didn’t seem to clearly post information that a version change was made. This might be confusing other TEDinator fans who are running into the same problem.

Solution: Just hop over and redownload the “updated” version 3.0.0.0 TEDinator binary and you should be good to go.

I’m hoping that Obin will kindly provide some brief changelog or explanation as well as bump the version number to be more clear internally or from his TEDinator page that this is an updated version to fix a problem with the older one. Some of us geeks like that sort of thing and find it helpful.

TEDinator V3.0.0.0 (the updated one): Highly Valca recommended.

Cheers!

Claus V.

Bonus: Richard St.John also provides some motivational wallpapers based on the principles in his “Eight Secrets of Success” presentation.

I like the iconic style of them from a graphic design perspective and may need to come up with my own custom wallpaper based on my own set of core values and processes.

Originally spotted via The Eight Secrets of Success, According to TED Attendees - Lifehacker

Read More

A Little Bit All Over the Place

I’ve run into a few IT-related challenges over the past two weeks.

Fortunately, I’ve not only been able to overcome them, but walked away with a number of amazing software finds in the process.

Those posts are currently pending due to the awesomeness (to me) of getting things organized for public consumption as my mental and lab process notes leave much to be desired.

So since my brain is mush right now here are some appetizers to hold you over.

Last month, Microsoft released a number of updates to their Windows Essentials bundle. The public focus were a host of changes touted in the Photo Gallery and Movie Maker components.  However, they were sneaky and made an update to the Live Writer application.  What updates? Your guess is as good as mine as asking for provision of a “change log” is likely to bring a beating.

• Windows Live Writer 2012 Released – Nothing is new or fixed. - LEHSYS
• Windows Live Writer 2012: Anyone happen to notice this? - LEHSYS Side Notes

LEHSYS’s Larry Henry seems to like WLW and be just as frustrated as me lately.

One thing I have noticed with this new release is that I can make it “fake-crash” very easily while composing.

What do I do?  Simply make the mistake of hitting the delete key too many times and sucking an existing  hyperlink into the delete vortex. Bam! Crash window.

Only it’s a fake-crash. The first time I encountered it I freaked as I had composed a long post and was in fear of loosing my material--well up the the last save point. However I soon learned that it didn’t matter if I clicked the red “X” or “Close program” button, WLW would keep on trucking. No loss occurred and despite the warning, Windows did not attempt to close Windows Live Writer.

I didn’t have this issue before the “upgrade”.  I wish I could somehow roll back to the previous version. Anyone figure out how to “off-line install” older versions of Windows Essentials/Windows Live Writer?

GSD Sidebar:

I did finally find links to the full “off-line” installer for the Windows Essential packages!

• How do I install Windows Essentials while offline? - Install offline - Microsoft Essentials
• Windows Live Essentials 2011 deployment options using offline installer - TechNet - Has lots of command-line arguments for installation help!
• Offline installer for Windows Live Essentials - WLSetup-All.exe - Scott Hanselman
• Deploying Windows Live Essentials 2011 - The Angry Technician
• Install Windows Live Essentials 2012 offline - morganjayp

What I find interesting is that the “wlsetup-all.exe” from the MS site is 131 MB in size and is served from http://g.live.com/1rewlive5-all/en/wlsetup-all.exe but the one linked in Scott’s original post near the bottom is 134 MB and served from http://g.live.com/1rewlive3/en/wlsetup-all.exe.

So these are different “off-line” WL setup binaries.  In fact, if you look at the path, you can see a “pattern”. On a whim I tried http://g.live.com/1rewlive4-all/en/wlsetup-all.exe and got a good download as well.

Googling that URL template, I found this very helpful post Windows Live Downloads « The Field Guide which details these indicate which “wave” release it was.

• Wave5 = Microsoft Essentials 2012
• Wave4 = Windows Live Essentials 2011
• Wave3 = Windows Live Essentials 2009

I’ll play with these and likely roll-back to the Wave4 WLW version to see how things go.

(The text in the fake blog post above came from the awesome Samuel L Ipsum site. It is one of a number of fantastic alternative Lorem Ipsum generators listed in this post: 30 Alternatives to Lorem Ipsum found by Splashnology. Zombie Ipsum has to be a close second.)

I’ve been taking a lot more digital photos lately since getting a Canon S95. This has led to a new issue which is managing my growing photo library. It is a super joy to shoot with and handles low-light/no-flash captures wonderfully. I haven’t scratched the surface of it’s capabilities but the small format really lends itself to being kept on my person for random shots (examples of photos I took with the S95 around town below no post-process done).

This will probably multiply now that my dear brother has lent me use of his “old” EOS 5D and a super cool set of lenses and Speedlight. I’m a bit overwhelmed with it all. We are planning some nature stalking as we have found we feed off each other when photo-walking together.

He uses Adobe Photoshop Lightroom 4 which is very high end. Then again he does some amazing photography work and has amassed a tremendous digital library over the years. He is also a Photoshop wiz so it works for him quite well. Dad is making the transition from a old-school 35-mm SLR format guy to the new DSLR world. As such, he is focusing on the transition and uses ACDsee.

I’ve got a pretty large collection of photo editing and management apps I have been using for some time (that’s another post to list them all!). Primarily I use FastStone Image Viewer which has borne the brunt of my digital image management and basic manipulation work. It’s great but I think I need something a bit more beefy.

I do have Adobe Bridge, although it is a CS4 version. I may just need to learn it. Got a few books on it already in my home library. It is really fast on my system and fairly intuitive. XnView works well and I am learning it also. Of course, I do have Microsoft Essentials Photo Gallery. It is a fairly nice interface and has some nice features, but it doesn’t seem as “serious” as Adobe Bridge or other tools for some reason to me.

Before FastStone’s tool, I had used ImageWalker which was cool as it contained a amazing collection of photo-effects to apply. I eventually turned to PhotoFiltre for that task.

So it was with excitement I stumbled on the updated ImageWalker replacement Diffractor. It is super slick and has just enough editing tools to be handy to use.  I love the interface and while the menu/navigation system takes a while to get used to, once learned it is really fun to use. It even includes a timeline generator view! Definitely recommended for use!

Picasa from Google is pretty neat. It is very fast and operates smoothly. I didn’t feel like installing it (yet) and found (like many Google products) the installation exe could be extracted with 7-Zip. I’m going to spend some time with this application as well.

I quickly found a super-neat photo workflow application called darktable. The problem was that while I could install it pretty easily into my Ubuntu 12.04 build, all my photos were in my Windows OS and while I use Ubuntu and can work in it comfortably, this wasn’t quite how I wanted to do things smoothly. Alas, there is no Windows build (yet?). See this Noupe post Darktable: The free Alternative to Photoshop Lightroom goes Mac OS X for more info.

I found the Open Source photo management application digiKam. Supported platforms include Linux, FreeBSD, Mac OSX and Windows. The screenshots and features look very promising. It does seen to be a bit “crash-y” on my Win7 x64 system…so the search goes on.

Other Canon stuff I probably shouldn’t mess with just yet but am tempted to:

• MagicLantern.fm - Home - software to modify the camera controls and features for Canon EOS cameras
• CHDK - Canon Hack Development Kit to add additional controls and features to select PowerShot cameras

Moving on to another topic, I had recently was banging my fist on a USB flash drive that was presenting some issues. In the process of troubleshooting, I found a few of my favorite USB tools had been updated fairly recently.

• Dev Eject - v. 1.0.24 - lists removable media, allows ejection of devices, and shows files that are open and preventing ejection.
• HotSwap! - v. 6.1.0.0 - Helps with USB device removal..and a whole lot more!
• USB Disk Ejector - v. 1.3.0.3 - Helps with USB device removal in a pleasant GUI/system tray.

Some cool Windows Tweaking utilities I found this past week are:

• Librarian - a powerful libraries manager for Windows 7 and Windows 8.
• Taskbar Pinner - a universal pinner software for your taskbar. Pin a file, a folder, a shell object, or a library to your Windows task bar.

There are a whole lot more tweaking tools for Win7/Win8 over at WinAero. Check out their downloads/software page for more.

I still use Jumplist-Launcher over at Hedgehog's Blog as well. It hasn’t been updated for a long time but still does a great job. Between the jumplist I made with this tool and Winstep Nexus Dock everything I need is pretty much in quick access reach on my Win 7 systems.

Finally, I’m playing with Baralga to get use to trying to better document and track the time I spend working on various projects. It’s a Java-based app so it is quite portable and flexible. I checked out a long list of time-tracking apps and this seemed to fit my needs the closest.

Cheers

Claus V.

Read More

Power Pile of Links

CC attribution: "Chain links" by HowardLake on flickr.

Got to go into the office tomorrow for one of those rare (for me) weekend special project rotations.

So I’m afraid a have just a bit less time that usual to spend on the blogging front.

Today’s offering is a large mix that covers LiveCD’s, some WinPE stuff, virtualization, new utility “how to” videos, third-party plugin updates, browser bits, networking, admin tips, password hint leakage, forsec, and a bit of graphical goodies.

ForSec LiveCD’s 

PALADIN 3.0.1 Forensic Software - Paladin just released version 3.0 of their LiveCD. You must have set up a free user account first and log in to access the PALADIN Download page. Changes in 3.0 & 3.0.1 are:

Version 3.0 New Features -

-- PALADIN Toolbox has been ported to Ubuntu 12.04

-- Network Share Icon has been added to the desktop to access network volumes that have been added via the MOUNT Tab

-- Boot support for current Intel Macs (including the newer MacBook Airs)

Release Notes

3.0.1 - Fixed issue where Unallocated Image function was producing 0 byte files.

Road to DEFT 7.2 and more DEFT Linux - Computer Forensics live cd - Deft 7.2 is scheduled for release in September 2012 and will mark a milestone of sorts. It will be the last x32-bit system release. Starting with 8.0 builds, they are going for x64 system support builds only. Shouldn’t be a deal-breaker, just keep a 7.x version handy as well.

DEFT 7 Cyber Forensic Tool Overview (by Casey Mullis) - LoveMyTool blog. Since we were speaking of DEFT, Casey Mullis gives a nice walkabout of DEFT 7 with nice screenshots if you are interested.

ESSPEE - Penetration Testing & Forensics - SourceForge.net - Updated to “R1 x86”. This is a new distro to me and is based on BackTrack 5 for pentest/for/sec work. Uses the “Unity” desktop interface.

Back|Track 5 R3 - new release. More details BackTrack 5 R3 Released!, BackTrack 5 R3! — PenTestIT, and from this H Security: News and Features post, BackTrack 5 R3 adds tools for Arduino and Teensy attacks. Choose your path carefully! Available in both KDE or Gnome flavors, with x32 or x64 platforms. In case you can’t decide, you may want to first look at this general KDE and Gnome Comparison post by ubuntucat.

WinPE Stuff

The few of you who regularly read this humble blog may have seen some recent activity in the comments sidebar. Turns out we had a recent celebrity visitor "Steve” from RMPrepUSB who posts a crazy-number of posts and tips on WinPE and USB booting in general.

Steve left a tip regarding use of the imagex.exe argument “/norpfix” switch when capturing images…specifically as it applies to junctions when the image is applied to a differently-named volume.

What is /norpfix switch, and what does it do? - Blogs from Zhou, Minxiao

In case you are interested, RMPrepUSB is a super cool tool to format and create bootable USB media. Lots of bells and whistles here and extreme tippage and tutorials for you WinPE fans.

• Create Bootable Windows or Linux USB with RMPrepUSB - ghacks.net
• RMPrepUSB (and USB booting) - RMPrepUSB blog

If I’m not careful I can loose hours at a time gong though Steve’s extensive tutorials. Here are justa few you might find interesting:

• 16 - How to boot to different WinPE versions using a single boot.wim that contains multiple images
• 83 - Download ImageX, BCDBoot and other WAIK tools - RMPrepUSB
• 53 - Windows 8 To Go (boot Windows 8 from a USB drive!) - RMPrepUSB

Windows 8 and WinFE - Windows Forensic Environment blog. Brett Shavers tips us to a cmd script from Troy Larson (The WinFE dude) that allows creation of a WinFE build from Windows 8 RTM. New to WinFE building? Well then, see also:

• Build questions - Windows Forensic Environment blog.
• WinBuilder - Windows Forensic Environment blog.
• Colin’s Final Version of his write protect application - Windows Forensic Environment blog.
• Winbuilder Tutorial - Windows Forensic Environment blog.
• Windows Forensic Environment - Colin Ramsden’s site for WinFE Lite building.

How to sync time in Windows PE - WindowsNetworking.com

VirtualBox and VMware Player updates

Pretty good synchronization getting these updates out guys!

First up, VirtualBox 4.1.20 is out.

• Oracle releases VirtualBox 4.1.20 - BetaNews review by Nick Peers.
• Download VirtualBox 4.1.20.80170 - FileHippo.com - (sometimes faster)
• Oracle VM VirtualBox - Download from Oracle
• Changelog – Oracle VM VirtualBox

Next, VMwarePlayer is rolled up to v5.0 with some significant changes.

• Download VMware Player 5.0 - Get it from VMware direct, or..
• Download VMware Player 5.0.0 - FileHippo.com
• VMware Player 5 Release Notes
• VMware releases Workstation 9, Fusion 5 and Player 5 - BetaNews
• VMware Player angetestet 5 - Borns IT & Windows Blog (Google Translated)

For VirtualBox, be sure you download and upgrade your Oracle VM VirtualBox Extension Pack at the same time. Likewise VMware users should also be sure to install the latest VMware Tools in your VMware hosted virtualized client OS for peak performance.

Defrag Tools Video

Defrag Tools - Microsoft Channel 9 - neat source for fresh reviews of MS tools and techniques now has two more quality videos up.

• Defrag Tools: #3 - Process Monitor
• Defrag Tools: #4 - Process Monitor - Examples

Update those Browser Plugins!

I’m thinking I’ve put in close to three hours this past week updating our home systems as well as Dad’s system to ensure they have the latest Flash/Java/etc. updates.

Adobe closes numerous critical holes in Reader and Acrobat - Update - The H Security: News and Features

There are lots of places and ways to download and get the updates; inside app updaters, direct from the software builder’s site, or from third-party locations like filehippo or majorgeeks.

I generally tend to just rock over to filehippo and pull them down. I suppose there is a risk they could have been corrupted or “seeded” with unwanted bits, but so far I’ve not had any problems and their Plugins Downloads page makes nice “one-stop” shopping.

At work it is hard keeping up with what “build” version we need to upgrade these to as for Flash there are both 11.3.x and 11.4.x versions which may cause problems for certain in-house software applications if compatibility is not verified first. However, most home-users should probably be on the 11.4.x run right now.

Likewise there are both Java 1.6.x builds and 1.7.x build branches. Again, most home-users should probably be on the 1.7.x builds.

• Download Shockwave Player 11.6.6.636 - FileHippo.com
• Shockwave Player - Adobe.com
• Download Flash Player 11.3.300.271 (IE) - FileHippo.com
• Download Flash Player 11.3.300.271 (Non-IE) - FileHippo.com
• Download and install the latest Flash Player version - Adobe.com
• Web Player Download for All Operating Systems - Adobe.com
• Download Java Runtime Environment 1.7.0.6 - FileHippo.com
• Java Downloads for All Operating Systems Version 6 Update 34 - Java.com
• Java Downloads for All Operating Systems Version 7 Update 6 - Java.com

Regardless, once you are done with your patching, hop your Windows IE, Mozilla Firefox, and Google Chrome browser(s) over to Qualys BrowserCheck and run a quick free check to make sure they are sufficiently patched.

Additional Browser Notes

In my recent post Greased Monkey Business I celebrated the joy of finally finding a custom Grease Monkey script I could use that would justify adding it to my Firefox browser; Removing UTM data from URLs automatically for cleaner bookmarks. It has been a lifesaver to my blogging work.

So this past week I gave a second banana to the Monkey; Scrub Google Redirect Links for Greasemonkey from “ping”.

Check out this MakeUseOf post that goes into the details: How To Copy Crap-Free URLs From Google’s Search Results

Comodo IceDragon 14.0 released -- get it NOW! - BetaNews notice of the Comodo tweaked Firefox 14 browser release. (actually it is version 14.0.3). Direct download is available from this Comodo forums link: Comodo IceDragon ver. 14.0.3 is now available for download!!

BrowsingHistoryView - Nirsoft - Version 1.0 new utility release to view browsing history of all your web browsers. Nir Sofer has been offering browser-specific utilities to view browsing history, but this gem covers the four major ones at once; Internet Explorer, Mozilla Firefox, Google Chrome, and Safari. New Web browser history viewer - NirBlog

Network Fun

NetworkMiner 1.4 Released - NETRESEC Blog - New release improves handling of fragmented IPv4 packets. Hurray! Also no longer checks for pcap extension; works as long as it is a valid libpcap file, DHCP options are extracted, new parser for a particular protocol. There are also some nice GUI improvements.

Trace File Case Files - Sharkfest 2012 (by Jasper Bongertz) - video presentation of using Wireshark to trace out real-world problems and solve them.

Wireshark Security Update - ISC Diary. Wireshark builds got updated to squash bugs and patch vulnerabilities. Go get busy…Wireshark · Download

Notes for the Sysadmins

Simple but Extremely Useful Windows Tricks - Open Security Research - Nice list of handy Windows tips.

Why The Size of My Partition is Maxed Out at 2 Terabyte and How to Get Over it - Windows7hacker. Just guided Dad though adding a second internal HDD to his Vista system. He’s getting into digital photography and while he has lots of room left on his OEM primary HDD, adding a 2nd drive gives him an exclusive place to drop the files. I guess we could have gone with a external USB drive, but the internal was faster in the long run for large file transfers. Talked him into a 7200 RMP 1TB SATA drive. With some guidance got him to get it successfully installed. Then via a quick remote-control session, got it formatted, labeled, and added to the OS fine. Considered going for a 2+TB drive for a few more bucks, but this was easy enough. Next time I will have to follow the link tippage and set up a GPT disk if the conditions warrant.

Microsoft updated SkyDrive.com - Borns IT & WIndows Blog (Google Translated) - Nice review of the new SkyDrive updates.

RegKeyFixer - reboot.pro - sweet little tool by Joakim similar to Sysinternal’s RegDelNull. Related: Reghide

ForSec Links

Password hints easily extracted from Windows 7, 8 - Ars Technica

All Your Password Hints Are Belong to Us - SpiderLabs Anterior

A Fistful of Dongles: AFoD Interview with Eric Zimmerman - A Fistful of Dongles - Eric Huber interviews F.B.I Special Agent Eric Zimmerman. Great article (and Eric wears a mean flat-top to boot!). Many years ago I had applied to the F.B.I. hoping for a career there following in the steps of my grandfather who was a former Special Agent under Hoover. Alas…it was a path not to be.

ShellBag Analysis - Windows Incident Response Blog

SetRegTime - Windows Incident Response Blog

Linkz for Tools - Journey Into Incident Response Blog - Corey Harrell has some info on this post, particularly those tipping us time-challenged guys to the Time Zone Converter – Time Difference Calculator and Time Zone Map. Also valuable is the final section “Process, Process, Process” which strikes home the critical value of knowing in advance HOW you are going to do exactly WHAT it is you want to accomplish; supporting examples include links to the Forensic Process Lifecycle (PDF) from Lance Mueller at ForensicKB, the previously GSD blogged SANS DFIR Poster 2012 (PDF) download, and Corey’s own Journey into IR Methodology scratchpad.

Man versus AntiVirus Scanner - Journey Into Incident Response Blog - Corey shows of the value of having skillz and technique and a rock-solid process in a John Henry’esqe dance against an anti-malware scanner. Really a great tutorial and exercise.

Registry Decoder 1.4 Released and Updated Registry Decoder Live - New versions are available. I noticed that in the past separate downloads were available for x32 and x64 however I don’t see that in this release. I’ve not followed up yet to see if the newer version handles both automatically or not.

Generating computer forensic supertimelines under Linux: A comprehensive guide for Windows-based disk images - Forensic Focus. ForenicsRichard has also released the Shell (Bash) and C Source code as well.

Finding Smoking Gun and going beyond that – Helpful Forensic Artifacts - Hexacorn blog - another strong article supporting previously mentioned themes of having a process to use in looking for clues which here are referred to has HFA’s (Helpful Forensic Artifacts) to guide the overall investigative and analysis journey and discovery.

HexDive 0.4 - New update at Hexacorn to a tool which extracts strings from a file/sample for additional review. Corey recommends using BinText or Strings to further review the output.

The “Hikit” Rootkit: Advanced and Persistent Attack Techniques (Part 1) - Mandiant M-unition blog

The “Hikit” Rootkit: Advanced and Persistent Attack Techniques (Part 2) - Mandiant M-unition blog

Grab Bag

Change the Windows Logon Screen Background - CybernetNews tips us to Luke Payne Software » Logon Screen Rotator. While I do rotate my Win 7 desktop login picture periodically, (right now it it Tardis based), generally I keep it stable. This is a cool tool however for those who like a bit more variety.

Organize & Manage Huge Photo & Video Databases Using Snaps - AddictiveTips reviews the Snaps - Photo management application.

Microsoft Reimagines Paint - Next at Microsoft - New “version” of the perennial “Paint” app. (Win 8 only).

Tip o' the Week #133 - The Art of Cut n' Paste - The Electric Wand

Cheers!

--Claus V.

Read More

Video Encoding tip…if at first you don’t succeed…

Our place of worship records video/audio records of the services as well as some special events.

The setup is pretty low-quality and simple.

Multiple remote-controlled cameras feed their signals into a standard video mixing board (Panasonic AV-HS400AE) where we can flip between signal inputs and do some standard wipes/PIP/transition-fades,etc.

From there we output the “mixed” SD signal into a consumer-grade DVD recorder along with audio out of the audio sound board.

When the event is over we finalize the DVD disk.  We can then make copies upon request for the membership.

So last Sunday, one of the young college-aged men in the church proposed to his girlfriend in a pretty spectacular way after the service was over. Since it was in the sanctuary, we got it all on video.

We made some copies of the DVD, but he also wanted to have a digital copy to upload and share with family around the country.

So I had to convert the DVD into a digital file version.

No problem…done it lots of times.

I popped the DVD into our A/V system PC, fired up VLC Media Player and verified the DVD played and the material was actually captured to DVD as expected; it was.

Then I ran Format Factory and selected the option to covert DVD to a digital file format; I think I picked WMA at first. I’ve used Format Factory for quite a while and it has always proved useful in ease of use, configuration details and conversion formats available. Never had any issues.

The conversion completed without errors, however when I went to replay it in VLC, it played fine for a bit, but then started to grind to a halt on the video playback.  I skipped ahead and it played fine but then started grinding to a halt. Hmm.  The system is x64 Win 7 with a i7 processor and 8 GB RAM and a high-end video card, so resources weren’t the problem.  I tried recoding it again in a few different formats and with different quality and sizes and the problem kept happening.

I was able to determine that the grind-down happened during fades between camera shots. Hmm.

I apologized that I couldn’t seem to do an immediate conversion that same day, but would try some more at home over the weekend to see if I could resolve the issue.

I have more than a few additional video format converters I use from time to time;

• Free Video Converter
• XMedia Recode 3.1.1.8
• Pazera Video Converters Suites
• Hamstersoft Video Converter

Each have their own pros/cons.

However for some reason I reached for Kirara Encoder; probably because it runs natively in x64 and I wondered if the additional encoding juice might help.

I fired it up, noted an update was available, snagged it and brought it current and relaunched.

I had also noticed a lot of optical drive activity while encoding before, so back at home I first ripped the optical DVD into an ISO file format to hopefully speed up the file access process.

Then I mounted the ISO file as virtual DVD.

Then I pointed Kirara Encoder to the virtual DVD, selected the VOB file (160MB), and after selecting the video output format (AVI) I wanted, let it rip.

Kirara chewed up the file and had it converted so fast on my laptop (i7,8GB RAM,X64) it amazed me. It was really, really fast.

I then went to replay the converted video file in VLC and it played smooth as buttah! Hurray!

That was so fast I then converted it into MOV, MP4, WMV and FLV formats for good measure. Too easy! All played perfectly with no issues. Quality was fantastic.

Feeling way ahead of the game at this point, I launched Windows Essentials Movie Maker and imported the AVI file, trimmed it up a bit, added an opening title and closing credits. I then exported it in both MP4 and WMV formats optimized for uploading to YouTube and/or Facebook, whichever.

I then burned all the files (including the ripped DVD ISO file) to a CD ROM disk for hand-back to the young groom to be.

For some reason, Format Factory just couldn’t easily encode the DVD video file during the fade transitions. If I had a deeper technical knowledge of what I was doing I probably could have customized the settings to work past it. However, Kirara let me be a hero-monkey (monkey sees the light come on, monkey presses the correct button, monkey gets the banana) without any drama.

So now, Kirara has moved to the top of the heap of video converters I will reach for the next time I need to do any video conversions.  It also has some advanced settings to change image quality (hue/saturation/gamma/contrast/brightness) and stuff.

More views and reviews on Kirara here:

• Kirara Encoder - download page - SourceForge.net
• Kirara Encoder, Free Portable Video Encoder For Windows - ghacks.net
• Kirara: Portable Video Encoder With Comprehensive Editing Features - AddictiveTips

Cheers!

--Claus V.

Read More

I’m probably the only Sysadmin bothered by this TV ad

A certain American automaker is running a summer advertising series you may have seen in some edited form or other where the host mills around and “interviews” various folks.

In the main advertisement opening there is a very brief shot of the well-known and respected host quipping about grillin’.

And it bugs me every time!

My what a nice rack you have there Mike!

Luckily, both Brian Adkins (who kindly provided the video above to YouTube) and Gizmodo writer Sam Biddle also seem to be eagle-eyed on this particular grilling technique likely learned from a hungry sysadmin trapped in a network room with a lot of food but no pit.

• Discovery Channel Superstar Is Grilling on a Shelf, Not a Grill - Gizmodo

While Mike’s technique and equipment probably won’t earn him a guest spot on Barbecue University with host Steven Raichlen anytime soon, I have to confess, it appears that use of a “baker’s” wire rack (also seen in network rooms holding server and system equipment) apparently is not completely a made-for-TV gimmick after-all.

…though I have to confess, Warren Schwartz’s rack and technique looks more sexy!

That one actually looked quite professional and culinary-grade. Never one to shirk from a mystery, it took me just a bit of detective work, but between shots of the grill seen above used by chef Warren Schwartz and images in the Gizmodo comment section I was able to trace down what is probably the actual grill used by Warren.

Turns out it seems to be a Big John 5 foot Charcoal Grill from Big John Grills & Rotisseries.

Who knew?!

So the next time you sysadmins want to impress the other techies at your backyard barbeque, see if you can pull one of these Big John babies out!  Who knows, maybe Mike will show up and help you flip.

However, judging from his grill work in the ad versus his handiwork as seen in his role as a host in another show, his dirty-job handling skills might be better put to use opening up your PC and server cases and blowing out all the dust and guck from inside them while he’s there!

CC attribution: by "eurleif" (Leif K-Brooks) on flickr.

Now that’s a dirty job!

Though in my mind, Mike’s grill will still be associated with use as a server rack.

--Claus V.

Bonus Link: What’s on the grill in France? via Justinsomnia

Now that’s my kind of grill and delectables! -Yummers

Read More

Windows 8 Linkage: In Which a Name is Chosen

CC attribution: The Window by Tiberiu Ana on flickr.

As you may recall, when we last left the Windows 8 naming saga, there was much prognosticating and reading of those chicken gizzards in a cast-iron pan out in the back shed with herbs over a fire…oh…wait…the announcement is in? All right! Out with it man!

• "Metro" is now called "Windows 8" - Borns IT & Windows Blog (Google Translated)
• Windows 8: From Metro UI is Modern - Caschys Blog (Google Translated)
• Microsoft's Massive Metro Mistake - PCMag.com
• Microsoft: Don't call it Metro. Call it 'Windows 8' - ZDNet
• Microsoft’s new rule: no “Metro”-named apps (updated: clause removed) – istartedsomething

Well…that was a bit of a letdown.

-10 for originality Redmond. Really?

Moving on…now…where did I put that ground cornmeal and hushpuppy mix? That divination work out back was making me hungry…

Here is the latest collection of Windows 8 linkage for review, education, and general future reference if the Valca clan ever decided to roll this way.

Still not convinced yet. I’m betting Windows 7 is the new Windows XP.

Win8 - Start Here - Get It

• Prepare your computer for Windows 8 - BetaNews
• 90-day trial version of Windows 8 now available to download - The Verge
• Windows 8 final ready for download, and there’s a 90-day trial - TechBlog
• Windows Upgrade Offer Registration Now Available - Windows Team Blog
• Windows 8′s new licenses: simpler, saner, better - Ars Technica
• How To Get Windows 8 For The Lowest Possible Price - MakeUseOf Blog

Win8 - Related Products and Services

• New in Windows Server 2012 – Part 5: Active Directory - 4sysops

Win8 - Install It

• 4 Best Ways to Try Out Windows 8 - Windows7hacker
• Installing Windows 8 in A Virtual Environment with VMware Player - Windows7hacker
• Installing Windows 8 in A Virtual Environment With Oracle VirtualBox - Windows7hacker
• Use Oracle VirtualBox to test Windows 8 Enterprise edition - BetaNews
• Surprise! What you can expect from Windows 8 RTM - ZDNet’s Ed Bott
• Install Windows 8 without a key? - Born’s IT & Windows Blog (Google Translated)
• Windows 8: can not install without a serial number - Caschys Blog (Google Translated)
• How To Change Windows 8 Product Key To Complete Activation - Windows7hacker
• How To Skip Product Key When Installing Windows 8 - Windows7hacker
• The Best Way to Run Windows 8 on a Mac is via VMware Fusion 4 Boot into Boot Camp Partition - Windows7hacker

Win8 - Under the Hood

• Windows 8: Reset Explorer - Caschys Blog (Google Translated)
• Microsoft radically overhauls license agreements for Windows 8 - ZDNet’s Ed Bott
• 10 Windows 8 features you should know about - BetaNews

Win8 - To Go

• HOWTO: Create a Windows-to-Go bootable USB stick with the Windows 8 Enterprise (RTM/Release) - Kurt Shintaku's Blog
• Top 10 Windows 8 Features #4: Windows To Go - ReadWriteWeb/Enterprise

Win8 - Tweaks 

• Microsoft said to block ability to boot straight to desktop in Windows 8 - ZDNet’s Mary Jo Foley
• 3 Way to Skip Start Screen and Boot Straight to Desktop in Windows 8 - Windows7hacker
• How to Boot to the Desktop in Windows 8 & Skip the Start Screen - 7 Tutorials
• Windows 8 Start Menu with a new Classic Shell ? - Born’s IT & Windows Blog (Google Translated)
• 8 things to do right away after you set up Windows 8 - ZDNet’s Ed Bott
• Disable the Windows 8 Charms bar - BetaNews
• Bypass Start Screen, Disable Charms Bar & Switch List In Windows 8 - Skip Metro Suite - AddictiveTips
• Skip Metro Suite bypasses the Windows 8 Start screen - BetaNews
• WinAero: Skip Metro Suite - Freeware App from WinAero
• Classic Start menu for Windows 8 - Caschys Blog (Google Translated)
• Trick for Windows 8 Desktop found boot? - Born’s IT & Windows Blog (Google Translated)

Win8 - Deeper Insights

• Found my first GUI bug in Windows 8 RTM - Bink.nu Blog
• Microsoft's security software modifies HOSTS file - The H Security: News and Features
• Windows 8: Defender blocking hosts changes - Born’s IT & Windows Blog (Google Translated)
• Windows 8 Defender resets hosts change - Caschys Blog (Google Translated)
• Windows 8 Tells Microsoft About Everything You Install, Not Very Securely - Nadim Kobeissi
• Windows 8 petzt software installation on MS - Born’s IT & Windows Blog (Google Translated)

Win8 - Usage Tips

• Windows 8 picture password - 4sysops
• How manage Published (a.k.a Metro) Apps in Windows 8 using Group Policy - Group Policy Central blog
• How To Shut Down Windows 8 - MakeUseOf blog
• Shut down Windows 8 faster - BetaNews
• Windows 8 Tip: Enable/Disable File Delete Confirmation Dialog Box - Windows7hacker
• How To Install An Un-Signed 3rd Party Driver in Windows 8 - Windows7hacker

Win8 - Miscellanea, Rumors, & General Grumblings

• Windows 8 deserves a chance - BetaNews
• Is Surface Microsoft’s confession that Windows 8 isn’t really cut out for tablets? - Ars Technica
• If you don't like the direction Microsoft is taking Windows 8, tough luck, Team Sinofsky knows they have you - BetaNews
• How Much Will Windows 8 Matter to You? - ReadWriteWeb/Mobile
• When and Where Will Windows 8 Matter For PC and Tablet Users? - ReadWriteWeb/Mobile
• The M word – istartedsomething
• Hands on with Windows 8 RTM: software is finished, the experience ain’t - Ars Technica
• NEWS: The early returns on Windows 8 - Kurt Shintaku's Blog
• Is Windows Getting Cheaper? - ReadWriteWeb/Mobile
• 5 features I wish were in Windows 8 but are not - BetaNews
• Top 10 Windows 8 Features #4: Windows To Go - ReadWriteWeb/Mobile
• Eight good reasons to upgrade to Windows 8 - BetaNews
• Eight reasons why Windows 8 Is NOT for you - BetaNews

Windows 8 - GSD Previously Posted

• Windows 8 Linkage: “Majestic Metro” version - GrandStreamDreams blog
• Windows 8 Linkage: “Passage Public Metro” version - GrandStreamDreams blog
• Windows 8 Linkage: “Metro Santiago” edition - GrandStreamDreams blog
• Windows 8 Linkage: “Metro at Nightfall” edition - GrandStreamDreams blog
• Windows 8 Linkage: Product Name “Something or Another” - GrandStreamDreams blog

Cheers!

--Claus V.

Read More