Hell-in-a-Handbasket System Rescue – Part I: PGP WDE

Some time ago in a previous post, I alluded to a series of lesson-learned posts I had regarding a particularly brutal system rescue.

I doubt anyone even remembers it, but it was so worthwhile to me that I felt obligated to post.

So here is Part I of this saga.

Hell-in-a-Handbasket System Rescue

The day started like any other typical day.  One of our VIP users brought to us his PGP Whole Disk Encryption (WDE) encrypted laptop.  It held one physical drive with two Windows NTFS formatted partitions. Both included in the whole-disk encryption.

It apparently experienced a HDD crash/failure of some sort which upon reboot caused PGP’s BootGuard pre-boot authentication wrapper to not accept the user’s PGP passphrase.  There was little doubt that the passphrase was good and known to user.  The user reported they were doing (local to system) database maintenance work when the system locked up hard—totally non-responsive.  The user hard-powered the laptop off and then back on.  When the system came back on, it appeared to end-user that BootGuard was damaged (?) as it would now not accept his known-good passphrase on the offered authentication screen.

The system contained local logs, reports, and database files of an organizationally critical nature.

The first-level technician attempted to fix the problem by using a Windows Setup disk from the Repair Console to check-disk (CHKDSK /R) to scan for and repair sector errors.  Unfortunately this seems to have caused additional errors and rendered BootGuard damaged.  A final pass at using a Windows XP Recovery console to FIXMBR (prior to decryption) left BootGuard seemingly no longer present.

It was at this stage that I got involved, apparently seen as being one of the PGP WDE mojo holders.

Off-line booting the system with my pgpwde injected PE Boot disk and executing the “pgpwde --disk # --status” command showed that drive was still reporting as PGP “instrumented” but would not boot to BootGuard.

Using the command-line pgpwde –auth --disk # --passphrase 'user passphrase' command failed.  This was unsettling as I frequently use this with great success to access a PGP WDE system “off-line” on the fly with no issues.

The user was also quite concerned at this point.

Step Two: The Tease

I attempted to use a PGP WDR boot-disk but it did not seem to allow any options to perform recovery or decryption of drive…for whatever reason, it was not recognizing drive as PGP encrypted.

At this stage it looked like the data was a total loss.

I checked in with our Enterprise level PGP support consultant who suggested that it appeared we had covered all the known bases.  The only alternative suggested was to send it to a professional data-recovery company (at considerable cost) and see if they could recover the system.  (Big Sigh) That was a non-starter despite the fact this was a critical system for this user and the production group he supports.

So I set the system aside, took a very deep breath, and hit the books.

Step Three: Hope!

Combing through the Internet and PGP Forums I seemed to find some leads that there existed an apparently undocumented command line argument to pass the pgpwde driver to attempt recovery of the PGP key/geometry from a backup sector on the encrypted drive.

It took me the better part of a day to work it out, but by Friday I felt confident enough to toss it at the system.  We had done everything else.  There was little to loose and after a week of not having his system back, the user was quite resigned that the ultimate result was total loss of the data. (BTW, he was not making backups….)

I again used my custom Win PE 3.0 pgpwde injected boot disk to boot the laptop “off-line’ then the undocumented PGP WDE “recovery” command.  (See a bit further down in the post for the technique.)

It scanned through the physical drive for the better part of a half-hour and eventually seemed to report that it had found and repaired the damaged (?) PGP WDE geometry references.

It still would not allow me to use pgpwde to authenticate to the encrypted volume.

I was mentally exhausted by this point at the end of the day and recognized I was a bit “punchy”.  I decided to sleep on it before doing anything else.

Step Four: Decryption 

On a hunch, first thing the next morning, I then again attempted to use the official PGP Recovery Boot Disk to decrypt the physical drive with the user’s known-good passphrase.

It now recognized his passphrase and began the decryption process! Hurrah!

I locked it down, ensured the A/C source was stable, and left it going.  By the end of the day on Friday, the progress meter was still at 99% encrypted (8-hours later) but the drive indicator light was churning away.

Hoping for the best, I left it secured and running over the three-day holiday weekend.

When I came back, the PGP Recovery boot disk had a message that it had successfully decrypted the physical drive.

I was pleasantly stunned and amazed.

Back from the brink.

But the story is only half-way through.  What would I find next on the unencrypted drive?  Stay tuned for Part II.

…as well as my thoughts about a root-cause analysis on what happed to start the cascaded failure.

Now on to the technical lessons….

Using the –Recovery command argument: Explanation #1 from Claus Valca

I’ve cobbled the following below together from various PGP technical and support form pages (liked at the end of the post) as well as my own field notes.

Symptoms

On rare occasions internal or external disks that are Whole Disk Encrypted may experience the following issues:

• Inability to decrypt or read the contents of a secondary or non-system disk.
• System displays "Error loading operating system_" after entering the passphrase at the WDE Login screen.
• Master Boot Record (MBR) corruption causing the system to no longer boot.
• After starting the system with the hard disk encrypted to a passphrase and an eToken, valid passphrases are not accepted.
• Using a PGP Recovery disk displays a “Internal error accessing disk, 0×80" error.

The following commands will help diagnose and decrypt the disk.

(Important Note!: These steps all assume you have “slaved” the encrypted drive to another system that has PGP WDE installed and running.  In my case I didn’t do that, instead I used my own pgpwde injected PE Boot disk although you could also use PGP’s instructions PGP WDE: Customizing the PE for PGP Whole Disk Encryption to build your one BartPE based version as well.)  

1. To begin working with the PGPWDE interface open a command prompt and change to the PGP installation directory (default directory shown) C:\Program Files\PGP Corporation\PGP desktop.

2. To list all installed hard disks in the system type: pgpwde --enum. Entering this command will give us a list of disks with numbers we will use in the next few steps.

3. Now type pgpwde --status --disk #. Substitute the WDE disk number listed in the previous step for the number # in the command if different. The output of this command will tell us whether the disk is still encrypted.

    * If the disk is not encrypted, "Disk 1 is not instrumented by bootguard" will be the output.
    * If the disk is encrypted, the output will display:
          o "Disk 1 is instrumented by Bootguard."
          o The total number of sectors.
          o A Highwater value (number of sectors encrypted).
          o Whether the current key is valid.

4. Type pgpwde --list-user --disk #. This will tell us the user information contained on the disk. This will help in multi-user environments to determine which user passphrase was used to implement WDE.

5.  Type pgpwde --recover --disk # --passphrase “xxxxxxx”     --recover will search your entire drive looking for the file information that contains the data for authenticating your disk and attempt to rebuild/restore them. This is necessary when the references that are stored become corrupted on your machine. It does not necessarily restore/repair damaged Boot Guard instrumentation.

Now you have some more choices to make.

• you could place the “repaired” drive back in the original system and use your PGP Whole Disk Encryption Recovery Disk Image boot disk to decrypt the drive, or
• try the following from either the working system you have slaved the drive to, or
• try the following from your PGP injected Windows PE boot disk in the original system.

6. Type pgpwde --decrypt --disk # --passphrase “xxxxxxx”  This will start the decryption process. To view progress, type the status command listed in step 3 and note the “highwater” number.  This number will get smaller and smaller as the number of sectors encrypted decreases.   . --decrypt expects the “recover” references to be correct, and therefore sometimes cannot locate the data in order to check the passphrase.

Clear?

If not look below.

Using the –Recovery command argument: Explanation #2 from the University of Alabama at Birmingham IT Department

Only later after I worked out the above culling though the Net and PGP forums did I discover the following PGP Guide for Campus Administrators which had a clear “how-to” use of the –Recovery command:

Hard Drive Recovery

If you have the drive slaved to a working machine with the same version of PGP Desktop try the following:

1. Open a CMD prompt.
2. Go to: c:\Program Files\PGP Corporation\PGP Desktop\
3. Run pgpwde -enum (this will list all the drives available on your machine, find the drive number for the encrypted drive, the first will be disk 0 (your boot drive) then disk 1, then disk 2 and so on)
4. Once you have your disk number, try: pgpwde disk #(one u found) --recover (so if its disk 1 it would be: pgpwde --disk 1 --recover), the pgpwde will search your disk for a backup sector, if it finds one it will restore it.
5. If it restores the sector, then do: pgpwde --disk # --decrypt --passphrase “enter within double-quotes”
6. To determine whether the drive is still instrumented (MBR Swapped) run: pgpwde –status –disk #
7. If the disk is instrumented, run: pgpwde --uninstrument --disk #

Whew!  Either one should give you a better chance and understanding on how to use and apply this powerfully useful argument.

Claus’s Lessons Learned

In reading around, it seems the preferred method of such a recovery is to “slave” the PGP damaged drive to a working system that has PGP WDE installed.  Apparently the time to decrypt may be much faster than running it from/with the PGP WDR boot disk due to it occurring under a x32 bit OS rather than the x8 or x16 bit (I’m not sure which) OS that the PGP WDR boot disk operates under.  I could be wrong on that and stand ready to be corrected by any in the know.  It seems to me that using a Windows PE boot disk with PGP WDE pgpwde support injected in it would see similar performance as if it were “slaved” to a working system.  This would still be my own preferred solution.

Regardless, if you do use the PGP Recovery boot disk to search drive and/or repair/decrypt it can take a VERY long time….days.  Seriously.

Let it run and step away.  It stayed on 99% decrypting for almost 8 hrs. when I went home.  Sometime in the intervening three days later timeframe, it had completed without observation.

In hindsight, this was probably the case for when it is searching through a PGPMBR damaged drive for recovery with the PGP WDR boot disk, prior to requesting authentication.  I had thought it was non-responsive but it probably was (very, very) slowly churning through the encrypted drive’s contents looking for the backup data file section needed for recovery.  Had I let it complete I suspect it might have then offered me a chance to authenticate and decrypt without going through all this fuss. Unfortunately I wasn’t experienced with the process at that stage and was both impatient and frustrated by the lack of “official” documentation on the PGP site. So regardless, if you are recovering/decrypting a PGP encrypted drive, you need to seriously give it LOTS of time to run/complete.

Stay tuned for Part II where I then transition to attempting to salvage the data off the system.

It’s almost as good as I hope this post has been!

Cheers and happy --recover ‘ing

Claus V.

Bonus Linkage

Supporting PGP WDE “Recovery” linkage and reference material for the curious or desperate offered kindly below to save anyone time Googling this all up on you own.  I promise it is all valuable stuff!

• PGP Guide for Campus Administrators – University of Alabama, Birmingham.
• PGP Whole Disk Encryption Command Line for Windows (PDF) – Official User’s Guide from PGP Corporation that documents many awesomely useful pgpwde command line operations and explains the terms PGP uses for its WDE solution.  It doesn’t seem to explain, however, use of the --recover command.  I’d call that a major FAIL.
• Recovering a PGP Whole-Disk-Encrypted Drive – Securism Blog.  Great and encouraging post by Jon Janego on his own frustrating attempt (eventually successful) to work out how to recover a borked PGP WDE drive.  Slightly different technique than mine documented here, but all good and painfully similar in lessons learned.
• PGP WDE: Customizing the PE for PGP Whole Disk Encryption – PGP Corporation Knowledgebase Answer.
• PGP WDE will not boot - Tried Most Solutions - HELP - PGP Whole Disk Encryption for Macintosh – PGP Forum Post.
• WDE Recovery: "Boot harddisk is not instrumented; advanced recovery is needed" - PGP Whole Disk Encryption for Windows – PGP Forum Post.
• Master boot record became deleted - PGP Desktop 9.x for Windows – PGP Forum Post.
• PGP Whole Disk Encryption Recovery Disk Image(s)– PGP Corporation Knowledgebase Answer.
• PGP Whole Disk Diagnosis and Recovery - Windows– PGP Corporation Knowledgebase Answer.
• PGP Whole Disk Encryption: Data Recovery (Mac OS X)– PGP Corporation Knowledgebase Answer.
• List Of Commands/Options for PGP (8.x) – PGP Corporation Knowledgebase Answer.
• Still seeing bootguard after decrypting whole disk encrypted hard drive – PGP Corporation Knowledgebase Answer.
• HOW TO: Uninstall PGP Products in Windows Safe Mode – PGP Corporation Knowledgebase Answer.
• PGP Whole Disk Encryption - Barely Acknowledged Intentional Bypass – Securology Blog.  Not related (except in that it is another “undocumented” pgpwde command-line argument that is powerfully useful to technicians and system admins who work in a PGP WDE deployed environment.  I’ve used it in a few situations when remotely servicing a system over-the-wires and the user needed to take off for a lunch-break.

--CV

Read More

Rainy-Day Linkfest

I can’t believe it but it is raining!

Good hard rain and thunderstorms.

Haven’t seen measurable rain in almost a month (or so it feels).

Here are some links that caught my eye this past month.

• Mark’s Blog : Pushing the Limits of Windows: Process and Threads – In-depth look at how processes and threads operate and the factors that limit them.

• Microsoft® Tech·Ed Online – Case of the Unexplained 3. Video media presenation by Mark Russinovich on Windows issues tracked down and solutioned using Windows Sysinternals tools and an understanding of focused troubleshooting techniques.

• Sysinternals Site Discussion : New Tools: ProcDump v1.0 | Updates: Autoruns v9.51, VMMap v2.1, PsExec v1.96 new and updated tools to help manage and troubleshoot Windows systems.

• ProcDump – freeware – New command line tool from Sysinternals “…whose primary purpose is monitoring an application for CPU spikes and generating crash dumps during a spike that an administrator or developer can use to determine the cause of the spike. ProcDump also includes hung window monitoring (using the same definition of a window hang that Windows and Task Manager use) and unhandled exception monitoring. It also can serve as a general process dump utility that you can embed in other scripts.”

• How to bypass the web page to save Internet Explorer 7 settings. – Ask the IE Team support blog.   This is a great fix for a “nuisance” issue I deal with in making Windows system images.  When the image is deployed, our techs have to re-do the IE 7 setup for each new user.  This technique prevents the new settings page from launching.  Not sure if it works for IE8 or not, though I don’t see why not at this point.  We are just now deploying IE 7 across our systems but IE 8 will be a while making it to desktops so it really isn’t a big concern yet.

• Creating Virtual Hard Disks with Windows Virtual PC. – Virtual PC Guy’s WebLog.  Now you know.

• Vista x86 patch to address 4GB+ of RAM – The Back Room Tech blog.  Julie points us to a technique worked out by Remko Weijnen which is a kernel patch to get x86 versions of Windows Vista to address 4GB + of system RAM; something not supported by Microsoft.  I don’t have any systems with main-boards capable of handling more than 2 GB RAM so I don’t get a chance to try it out.  However if you are curious, Julie kindly provides a link to Remko explaining how his patch works.

• Upgrading my Lenovo W500 to a OCZ Vertex 250GB SATA II Solid State Disk (SSD). – Scott Hanselman’s Computer Zen brags and rubs hard-disk performance in our faces with his new SSD drive.  Cold boot to desktop in under 20 seconds.  That’s insane!  More on his new laptop rig in this Lenovo W500 post.  I am so jealous.  It’s the human condition to be envious I suppose.

• Java Portable 6 Update 14 Released – PortableApps.com – Finally, a version of Java that you can keep on your USB stick for running Java needs on a system that Java is-not/cannot be installed on.  I’m thinking it would be useful on Win PE 3.0 USB-booted system for apps that use/depend on Java.

• LiberKey – freeware – Over 200 applications in a single package to drop on your USB stick (or system) that don’t need “installation”.  It’s one of the most well-rounded “portable-app” packages I’ve yet come across.  Available in “Basic”, “Standard” or “Ultimate” packages depending on the type and number of applications you need.  The only concern I see (and it is a typical one with these packages) is if it satisfies the individual software developer’s rules about redistribution of their applications.  That major issue aside, it is a great option for technicians and troubleshooters to seed their collection of tools and utilities.

• Malzilla: Exploring scareware and drive-by malware. – HolisticInfoSec.org. – Announcement of a new tool that will help analyze and dissect potential malware.  From the post: “Malzilla is best described as a useful program for use in exploring malicious pages, allowing you to choose your own User Agent and referrer and use proxies. While it downloads Web content, it does not render it, so it is not a browser. Think of it as WGET with a user interface and some very specific talents. In Using Malzilla, we’ll take a close look at rogue AV tactics and exploit sites in order to study the infection process utilized.”

• EnScript to Export files by extension – Computer Forensics, Malware Analysis & Digital Investigations blog.  Now I am just plain frustrated!  I don’t use EnCase as part of my job functions.  However this EnCase EnScript would be awesome to have as a system administrator!  Simply put it “…will export all the files with matching extensions (case insensitive) to the folder you specify. A subfolder for each extension is made and the corresponding files are placed into their respective folders.”  Golden!  Only I can’t find a similar Windows utility.  Or know of a way to run an EnScript without EnCase.  This feature would be awesome in recovering user-data from a tanked system.  I guess there could be a batch-file solution perhaps.  Any tips or suggestions?  For a tease on an upcoming system recovery post, I do know and have used the incredibly clever PhotoRec Sorter utility, but it doesn’t quite match this script by Lance Mueller  See Lance’s updated post: EnScript to Export files based on Extension v1.1 for an update.

• eXpress FreshFiles Finder – freeware – Utility I found while looking for a standalone tool to do the features in the above.  This useful “standalone” tool will provide a list of the most recently updated files on your target system.  Good for first-pass analyzing a system in an incident response scenario. Install the application, copy the created program folder to your USB stick, then uninstall.  It ran fast and fine on my Windows 7 x64 bit system and says it is XP/Vista compatible as well. It couldn’t access some normally protected folders, even running as Administrator level.  I’ll try later to see how it works if elevated to System level.  Still useful.

• FolderWorks – freeware – ShadWorld.  Another related tool that for counting files and categorizing them by extensions or file types.  No files are actually copied or moved.  Solely useful for documentation and assessment work on a system.

• BareGrep - Free grep for Windows – Bare Metal Software.  Great tool for advanced and complex system and file searching for only 246 kB in size but very fast and very advanced for the most demanding system-inspecting needs.  Simply amazing.  Oh yes. It’s a single non-installing exe file and fully portable. Works great on XP through Windows 7 systems. 

• Quickpost: TrueCrypt’s Boot Loader Screen Options – Neat tip by Didier Stevens on how to configure TrueCrypt’s boot loader screen to display a “NTLDR is missing” error when booting a TrueCrypt encrypted hard drive.  Should obscure the system from further examination by only the most seasoned techies or investigators.  Of course the thing unravels fast if the actual drive is analyzed at the sector level (or forensically) when the TrueCrypt bootloader is discovered.  That knowledge still won’t help the curious get into the TrueCrypt protected layer, but the gig will be up at that point.  Certainly clever and a reminder to techies and incident response folks that what you see may be deceptive so you need to keep an open mind and be willing to dig a bit deeper.  For the record, the legitimate error message would be “NTLDR is missing.  Press Ctrl+Alt+Del to restart”

Nice being back in the blogging saddle!

Cheers!

--Claus V.

Read More

Inspiring Designs

Digressing from tech again for a moment.

Somewhere in the Valca home, I have a house-plans magazine that contains a small cottage-style lake house design that totally would be a dream-home.

It is small and compact, has wood-shingle style exterior cladding. It is two-story with two under-roof bedrooms and a shared bath upstairs.  Downstairs is a wide galley-style kitchen spilling into an informal country dining area.  To the opposite side is a cozy craftsman-style casual living room anchored by two half-height built-in bookcases with windows above and a river-stone fireplace in-between.

It just seems the type of place I could sink into to escape.  Nothing techy or modern about it.

In contrast to the lake-side cottage style that seems warm and inviting, the Germanic blood in me still gets excited and inspired by these efficient and modern designs.  I think the theme in them all that appeals to me is the logical lines and the blending of the outdoors and indoors.  Living on the Gulf-Coast, I love air-conditioning.  Couldn’t imagine living without it.  That said, most of the normal designs down here are enclosed and isolate the occupant from the natural outdoors.

These recently posted designs--as caught on my favorite architectural blog Arch Daily--seem to successfully bring the outdoors in; boldly.

• Big Dig House / Single Speed Design – ArchDaily
• Six Ramsgate / Wallflower Architecture + Design – ArchDaily
• Cabin Nordmarka / JVA – ArchDaily
• Anglesea House / Andrew Maynard Architects – ArchDaily
• House K / Tham & Videgård Hansson Arkitekter – ArchDaily
• House C - Prax Architects – ArchDaily
• Kübler House / 57 STUDIO – ArchDaily
• Open-air sculpture / MRA – ArchDaily

Bonus find: MUJI USA.  Wonderfully simple designed products for practical living.

--Claus V.

Read More

Dead End Linkage

cc credit: Headstones by notratched on Flickr

Nothing to see here.

Just some dead-end linkage for a project I was working on that I ran out of current levels of time and patience for.

I may come back to it later.  Or not.

• You cannot extract the contents of a Microsoft Update Standalone Package for Windows Vista – Microsoft Help and Support Article ID 928636
• what is an .msu file? - Scribblings of a TechnoBuff.
• Description of the Windows Update Stand-alone Installer (Wusa.exe) and of .msu files in Windows Vista and in Windows Server 2008 – Microsoft Help and Support Article ID 934307
• Different Application Install for Different OS – Deployment Forum
• Extract and View Contents of Microsoft Update Standalone Package (MSU) for Windows Vista – My Digital Life.

Left for archival and reference purposes.

Moving on…

Claus V.

Read More

VAIO Upgrade – Passing it On

First weekend in a very, very, very long time that I’ve been able to come up for both air and mental harmony to allow myself a chance to drop a few blog posts.

Thanks for your patience.  I assure you my “To Blog” hopper is quite full.

A Sony branded Gift Horse

About a month ago, by brother decided to upgrade his laptop to a more powerful version.

That left his previous Sony VAIO laptop out on the street looking for a good home.

He offered it to us but with one desktop system and three pretty current, x64 supported laptops (two of which are dual-core), I really couldn’t justify adopting it for our family.

Luckily I recalled an earlier conversation with a couple from Lavie & I’s younger days who were visiting our church.

They lead a ministry supporting families living in some of the poorest villages in Mexico by bringing and distributing household goods and staples that most Americans wouldn’t think twice about tossing in their shopping carts; feminine products for the ladies, shoes for the kids, TP, shampoos and soaps, stuff like that.

They had mentioned how they were looking for a laptop to help organize their ministry efforts.  It needed to be modern enough to be useful, but nothing they would regret if it got battered in the process.

I mentioned this need and bro. enthusiastically OK’ed the hand-off to them.

So the passing-on-of-kindness operation ensued.

Plan XP

It is a Sony VAIO PCG-792L model. 1.0 GB RAM, a 1.73 GHz Intel Centrino processor, a 90 GB HHD, and both Ethernet and Wi-Fi support.  Not a bad system.  Only things of note were a stain of sorts around the edges of the LCD display…but no dead/busted pixels so it is almost not noticeable.  Also, the power-cord plug is a bit cat-nibbled.  Other than that is is good as new.

Bro had already data-wiped the drive.

The system had the OEM XP Home key on a MS sticker on the bottom.

I used a slipstreamed XP Home SP3 setup disk to get it going.  It’s been a while since I did a scratch-install of XP so I forgot how long it took—even with a slipstreamed disk.

All was well except for one issue: no NIC drivers.  I spent the day scouring Sony’s site, the Internet, and even trying other model drivers from other VIAO systems.  No dice.  Bro couldn’t find the OEM driver disk (may have been purged) so it looked like the XP load was scrubbed.

Plan 7

So for an alternative solution I tossed on a Windows 7 RC (x32) load.

I wish I could provide you an exciting, tooth-and-nail technical troubleshooting story filled with excitement and cleverness working around near insurmountable issues.

No such luck this time.

In about twenty minutes the system was up and fully updated from the Internet.  No driver issues at all.  Again the driver support (out of the box) for Windows 7 continues to amaze me; particularly on laptops.

I tossed on the Microsoft Security Essentials beta release, Open Office, Safari 4, Firefox 3.5.1, and Foxit Reader just to get them rolling.

I installed Flash Player and Java for good measure.

It really was remarkably fast (the system on Windows 7).  I should have run a Windows performance rating test on it, but I was in a hurry to start my blogging work.  I’ll update this post later when I do.

So this OS should keep them happy until March when it starts to do the auto-shutdowns.  I figure by that time they will have likely picked up a retail version of Windows 7 and will be good to go.

So a used system is kept out of the landfill for a bit longer and finds new life spreading love and compassion in the world.

Something all to often it seems, is in short supply.

Claus V.

Read More

Security and Forensics Linkfest

I got to confess, a few weeks ago while I was working on a rather challenging data-rescue project over the course of a week or so, I was having a blast.

Then I shifted gears and had the opportunity to work on a high-level workgroup and provide documentation support.

I really miss it when I’m not “getting my hands dirty” directly on systems.

Working an issue with trusted tools or searching for just the right new one to do a task better is so much fun.

Here’s a well-rounded selection of security and forensics tools and resources that are almost certainly will have you scrabbling around for a system or two to throw them at.

• More Links - Windows Incident Response – Harlan has a most excellent and jam-packed post full of forensics goodies such as a reference to a new Windows memory imaging tool update for the free Win32dd.  Also in that post was introduction (to me) of a new system info-gathering tool called MIR-ROR.  Like similar “collective” tools such as his own RegRipper, Security Database’s Evidence Collector, and Mandiant’s First Response these multi-function info collection tools aren’t solutions in themselves, but they can make the collection of first-pass level logs and information simpler.  Armed with these after careful analysis by the responder, more surgical system analysis can take place with task-specific tools. I’ll let Harlan’s own words on MIR-ROR speak for themselves…

I recently heard about a tool called MIR-ROR, put together originally by Troy Larson and then expanded by Russ McRee, both of Microsoft. Russ blogged about it here, and there's a toolsmith article available on it, as well. MIR-ROR is a batch file that is useful for running tools on a system as part of incident response; what I like about this is that Russ isn't sitting back hoping that someone does something like this, he's taking advantage of his knowledge and capabilities to put this together. And he's made it available to the public, along with instructions on how to run it. I like tools like this because they're self-documenting...properly constructed and commented, they serve as their own documentation. As always, the standard caveat applies...use/deploy tools like this as part of an incident response plan. If your plan says you need to acquire a pristine image of the drive first, you will want to consider holding off on using a tool like this...

You will have to collect many of the executables that are needed and assemble them into the package.  The documentation is great.  As I recall I found a few references that were off but some patient Googling turned up the correct locations and I soon had it all put together.

• Memory Acquisition for First Responders – Forensic Incidence Response blog – Since I just mentioned win32dd this post by hogfly came at an opportune time.  I believe that while memory acquisition and imaging is still primarily of use to forensic examiners, system admins can use the same lessons and apply them when doing incident response to a malware-infected system.  As I say over and over again, too many IT Techs when getting a report of a virus/trojan/malware infection just run roughshod over the system with anti-virus/anti-malware cleaning tools and remove critical information to help understand WHAT is going on and WHY. There are LOTS of great Windows-based tools to capture memory images and data…many of them free (another post) so there’s little excuse not to capture an image of the memory of an infected system before going to town on the cleaning.  Getting a sector-based image of the physical drive could also be valuable as well.  This gets the end-user up and producing again and lets the analysts have more time in the lab dissecting the cadaver without everyone breathing down their neck with impatience.

• Live Analysis Part I - Changing of the Guard - The Digital Standard – Thoughtful post by cepogue on just that prior theme. Sometimes some incidents (or organizational attitudes/processes just don’t support the “by-the-book” Incident Response handling methodologies.  Managers want the system cleaned and up and running, users complain about loss productivity, you can’t convince anyone who matters about the need to determine what if any data may have leaked. So many techs (and “my-blood-runs-IR” analysts) have to do a crash-n-dash response.  That said, with skill and pre-planning, you can still make the best of a bad IR situation and hopefully walk away with valuable info despite the organizational “head-in-the-sand” culture.  I’m looking forward to Part II.

• Forensics 101: Acquiring an Image with FTK Imager – SANS Forensics blog – Great how-to post on using FTK Imager to perform a GUI-based image pull from a system or storage device.

• Directory Link Counts and Hidden Directories – SANS Forensics blog – This post was a neat review of Unix file-structure handling and how to leverage it for searching for hidden directories. I was wondering if there was a Windows-supported solution.  I saw in the comments note that OSSEC has this ability and in poking around found an agent tool compatible with Windows in the Downloads section.  Though not exactly the same there is Joanna’s tool FLISTER from her invisiblethings.org tools page which might be worth looking into as well for Windows folks.

•  Getting your fill of Reverse Engineering and Malware Analysis  - Room362.com. An outstanding collection of links to sites/sources for reverse engineering and malware analysis tools, techniques and news.  Quite bookmark-worthy.

• New BackTrack 4 “Forensics Mode” - CyberSec.eu.  News that the next version of BackTrack (security and pen-testing LiveCD) will offer a “forensics-mode” boot-option from the Grub loader.  Nice to have this option available to a venerable security minded LiveCD. If you just can’t wait, Remote-Exploit has made the BackTrack 4 Pre Release download ISO (fyi-DVD sized) available at that link.  For even more info check out the release pdf and Introduction Video.

• Helix3 2009R1 FREE is once again available for download from the developers.  Please see this GSD post Helix3: Thanks for the memories… to come up to speed on the issue.  A recent comment by Lauren on that post got me looking around (and I did have to look hard to find it!) for the download link on the e-fense site.  It can be found here. Registration is required to get to the download page, but if you hadn’t already tucked away a ISO file of the last free version, you do now have a safe option to get it fresh.  Of course, to e-fense’s credit, they would rather you pony up some $ to get the newest (non-free) version of HelixPro and depending on your needs, that might be a better thing to do.  Either way, it’s nice having the choice again.

• Download HelixCE200401brc1.iso RC1!!! Updated – Meanwhile, out of the previous “Helix going commercial” drama mentioned above, Charles Tendell struck on a new Helix “Community Edition” version.  Due to licensing and other issues (RE: IAMAL) , he had to strip out some e-fense specifically-developed apps from his build that were present in the original Helix project builds. However he continues to plug away at filling the voids with new tools from other sources. Check it out including these screenshots and application list.

• Explorer Suite (PE analyzer) III – NTCore – A jam-packed tool to allow analysis and review of executable PE files.  From the developer:

Created by Daniel Pistelli, a freeware suite of tools including a PE editor called CFF Explorer and a process viewer. The PE editor has full support for PE32/64. Special fields description and modification (.NET supported), utilities, rebuilder, hex editor, import adder, signature scanner, signature manager, extension support, scripting, disassembler, dependency walker etc. First PE editor with support for .NET internal structures. Resource Editor (Windows Vista icons supported) capable of handling .NET manifest resources. The suite is available for x86, x64 and Itanium. 

• Ophcrack 3.3.0 and Ophcrack LiveCD 2.3.0. – New versions of these password auditing/cracking tools are now available. Don’t let the unsync’ed versioning fool you. The main program is version 3.3.0 and the LiveCD version 2.3.0 contains the program version 3.3.0. Go figure. Changes in the new version are described on their News page as follows:

Ophcrack version 3.3.0 includes support for our new tables vista_seven. These tables crack 99% of passwords of length 7 composed of almost any character including special characters. This table set will be included in our professional tables bundle.

New features have been added like the table size verification in order to warn the user if the tables have not been fully downloaded for example. It is also possible to tune how the preloading should be done.

An important effort was made to release a brand new LiveCD. A very interesting and refreshing distribution called Slitaz was customized to make a lighter than ever ophcrack LiveCD. It should enable us to update the LiveCD more often and to make your experience much better too. We would like to thank Slitaz team for their support in making this LiveCD. Do not hesitate to give a look at their stable distribution!

• NetworkMiner v0.88 – New release on this awesome packet-capture management tool. What I really like about it is the ability to parse PCAP files for offline study as well as the ability to extract and save media files (such as audio or video files) which are streamed across a network. Supported protocols for file extraction are FTP, HTTP and SMB.  I don’t have to packet-sniff often, but when I do and I need to analyze a lot of the content being moved, this is the first tool I reach for…hands down!
• Wireshark version 1.2 – Speaking of network packet capturing..Wireshark got a bump to version 1.2.  According to the Release notice:

This is the new stable release branch of Wireshark and many new and exciting features have been added since 1.0 was released.

In this release

• Wireshark has a spiffy new start page.
• Display filters now autocomplete.
• A 64-bit Windows (x64) installer is now provided.
• Support for the c-ares resolver library has been added. It has many advantages over ADNS.
• Many new protocol dissectors and capture file formats have been added.
• Macintosh OS X support has been improved.
• GeoIP database lookups.
• OpenStreetMap + GeoIP integration.
• Improved Postscript(R) print output.
• The preference handling code is now much smarter about changes.
• Support for Pcap-ng, the next-generation capture file format.
• Support for process information correlation via IPFIX.
• Column widths are now saved.
• The last used configuration profile is now saved.
• Protocol preferences are changeable from the packet details context menu.
• Support for IP packet comparison.
• Capinfos now shows the average packet rate.

For a complete list of changes, please refer to the 1.2.0 release notes.

• VirtualBox 3.0 Beta 1 released. – While Sun’s VirtualBox public (stable) release version is at Version 2.2.4, this new 3.0 Beta 1 version brings a whole mess of exciting (and probably unstable) features!  Along with lots of tweaks, bug-fixes, and enhancement, the following new features are on their way in this version:

Version 3.0 will be a major update. The following major new features were added:

• Guest SMP with up to 32 virtual CPUs (VT-x and AMD-V only)
• Windows guests: ability to use Direct3D 8/9 applications / games (experimental)
• Support for OpenGL 2.0 for Windows, Linux and Solaris guests

For more information on VirtualBox betas, drop into and monitor the VirtualBox Beta Feedback forum.

Cheers!

--Claus V.

Read More

Browser News and Tips

Miscellaneous news and happenings in the world of web-browsers.

Firefox First

Firefox 3.5 RC1? and Firefox 3.5 Release Candidate 2 Released - The Firefox Extension Guru’s Blog – If you blinked this week you probably missed 3.5 RC1.  I saw it was coming and pulled it down by doing a manual Check for Updates.  If you didn’t or were waiting for a big public announcement…you probably missed it!

First look to Firefox 3.5 RC2 - Mozilla Links blog opens up with news that the first RC wasn’t that big a deal and this one doesn’t add much more to the party…then goes on to long-list all the neat and improved features it provides…whazz-up?  It’s a good rundown and 3.5 RC2 has been rock-solid on all my various (and I do mean various) Windows systems.

But really…why the fast RC1 to RC2 release jump?  Mozilla is usually very cautious and deliberate in these semi-public official releases.  There has to be a story behind the story. Right?

Maybe so…

Mozilla posts yet another Firefox 3.5 Release Candidate – Betanews’ Scott M. Fulton, III digs around and comes up with this information in a really brief post.

It was apparent yesterday, after a test of the organization's latest private daily build of the Firefox 3.5 browser, that Mozilla's developers had discovered a jackpot of performance improvements in some specific areas: JavaScript math, RegEx (regular string expression) searches, and general control flow. Betanews tests yesterday gave the Thursday morning build 8% better overall speed in Windows 7 RC, and a better overall performance index score on that platform of 9.35 versus 8.81, relative to the performance of Microsoft Internet Explorer 7 on Windows Vista on the same physical machine.

Now it appears the team is willing to capitalize on that find. This morning, Mozilla's servers made available Release Candidate 2 of Firefox 3.5 to the general public. Again, the team makes these public builds available prior to a formal announcement, though word from Mozilla about RC1 was actually rather quiet this week. The possibility of an RC2 in the near term -- just days later -- may have been why.

Firefox web browser 3.5 RC2 Public Link – Mozilla’s latest public Release Candidate can be found here if you are still on the 3.0.x builds and are curious.  Most of the popular extensions for 3.0 builds have been updated to support 3.5 so it might be a good time to try it out if you are curious.  More technical news and warnings here: Mozilla Developer News » Firefox 3.5 Preview now available for beta users

The new Firefox icon - Mozilla Links – Besides the speed and other feature enhancements, this RC version now brings with it the updated Firefox icon.  As silly as it sounds, it really does stand out as I have multiple versions of Firefox on some of my systems and seeing the icons side-by-side on my desktop the differences are clear.  Well done!

Firefox/Sprints/about:me – MozillaWiki – very preliminary work on an extension that provides drill-down data on your Firefox browsing patterns.  Scary stuff for some but a goldmine for OCD Firefox users. I was curious to install the very early version on my system.  I read (somewhere but didn’t save the link) in this post Firefox.next peek: profiling yourself at Mozilla Links blog that this might be added in as a “feature” of future Firefox versions (Danger Will Robinson…Feature Bloat Detected…Danger Will Robinson!)

Description

 

A statistical analysis of the user's history, average tab load, etc. Like Google Zeitgeist, but based on their Places database.

• Dietrich has an add-on that does some of this already. screenshot

Introducing Add-on Collections - Mozilla Add-ons Blog.  In a effort to make the power of Firefox's extensibility even more easy for Firefox virgins to join in on, Mozilla now has a project called “Add-on Collections” that bundle popular extensions in singularly-downloadable package sets.  That a Cool Thing.  It’s a cool idea.  If you find some collections you really like, you can add them to your RSS feed-reader to monitor changes.

….install the Add-on Collector extension for Firefox. The Collector turns your favorite collections into subscriptions in your browser, where you’ll be notified as soon as new add-ons are published to one of your collections. The extension has a number of other features, including the ability to share an add-on you have installed with a friend by e-mail, publish an add-on to one of your collections, and set up a collection that is automatically kept up to date with your installed add-ons.

We’ve made video demos of creating a collection and setting up an auto-publisher collection to show how easy it is dive in to collections.

Pop over to the Mozilla Collection Directory to see what this latest news is all about.

mozdev.org - newsfox: installation and Newsfox - Release candidate: NewsFox 1.0.5rc2 is out.  My fave RSS news reader for Firefox continues to mature and become more stable and stunning each time!

Disable Firefox 3.5’ Location-Aware Browsing – Privacy – Lifehacker – Firefox 3.5 now comes with Geo-locating features.  This might make some privacy browsing folks a bit uncomfortable. Lifehacker shares a simple tweak from How-To Geek site writer Asian Angel.

1. Go to about:config
2. Change the geo.enabled value to false by double-clicking on the key.

In fairness, as Lifehacker points out, even with this “Geo-Loco” feature left enabled, you would still have to (theoretically) grant your consent when prompted to share your Geo-Loco-ness info with the site.

At least you know….

Opera Sings…off key?

Opera Desktop Team - Welcome to Opera 10 Beta 1 – Opera Desktop Team blog – Nice shiny new version. Some bells-n-whistles. Opera remains nice but here in the States has quite a job ahead getting noticed with Mozilla/Firefox, Internet Explorer, and Chrome/Chromium still ruling the sand-lot.

Opera Unite – New feature embedded in Opera 10 allows for file sharing and other typically “server” based operations.  It’s pretty easy to set up and configure. The API will allow other developers to publish “widgets” to interact and leverage this feature.  Could be cool…or is it a sinister threat to end-user/organizational security?  See two links down…

Freedom – Opera Desktop Team blog – The development team work hard to introduce this feature and convince us all what joy will come our way.  Clearly they have worked hard and are proud of the accomplishment.

How secure is Opera Unite? – Betanews.  Scott M. Fulton, III analyzes Opera Unite and shares some real concerns.  Does the average consumer end-user really need (or want) a server embedded in their web-browser? What if someone publishes an “non-Opera approved” widget on their own website that unbeknownst to the user actually serves malware or scrapes the user’s key files/documents/pictures from their system?  In fairness it’s the same charge that has been leveled at Firefox extensions, and from time to time a rouge extension for Firefox is uncovered.  I’m not sold and from a sysadmin’s perspective this adds just one more layer of headache to policing the desktop systems. On the other-hand, for sophisticated browser users, these might be powerful and useful features.  Jury is still out on this one.

And an Apple drops from the tree…does anyone but Newton notice?

Recently Apple took the “beta” tag off Safari for Windows 4.

Apple - Safari - Introducing Safari 4

Safari 4 final: no top tabs, performance updates for 10.6 - Ars Technica

I’ve loaded it on the Vista Home Premium 32-bit with no issues.  Haven’t cared enough to put it on Windows 7 64-bit.

It’s quite nice but still ranks way down my list of browsers to use, despite being installed.

--Claus V.

Read More