Bits and Bytes

Busy day today. Chores to do inside the house and out. And links galore spilling out of my Firefox sidebar, ripe for posting.

Critical Updates

• Adobe: Critical security holes in Shockwave, Photoshop, Illustrator – ZDNet ZeroDay blog
• Adobe – Security Bulletins: APSB12-13 -Security update available for Adobe Shockwave Player.
• Adobe – Web Players – Links to download Adobe Flash Player and Adobe Shockwave.
• QuickTime for Windows update plugs security holes – The H Security: News and Features – And then when you are done with Adobe, go grab the latest QuickTime player update.

New Place to Report Fake Tech Support Scam Calls

As if the usual bane of telemarketers isn’t enough to wade through almost every day and night, now we are seeing a renewed push of the fake-tech-support calls. Enterprise IT shops are even having to now send notices across their employee-base to remind them that they haven’t been outsourced to these callers and that employees should always make sure they are talking to the right IT guys and gals. Some places are event starting to black-list some of these third-party remote control sites to clamp-down the borders against these calls.

Troy Hunt has a series of great posts that tell you just about everything you need to know about these scams. I’ve posted them before but Troy’s writings are so good, they need another mention.

• Anatomy of a virus call centre scam – Troy Hunt’s blog
• Scamming the scammers – catching the virus call centre scammers red-handed - Troy Hunt’s blog
• “Type www.” – “Ok, w-w-w-d-o-t”; antagonising call centre scammers – Troy Hunt’s blog

The guys and gals over at SANS have gotten into the game as well.

• Who’s tracking phone calls that target your computer? Stay Tuned to the ISC – ISC Diary

They have opened up two (same) locations for you to report any fake-tech-support calls you may get for intel-gathering purposes. Knowledge is power!

• (Red Theme) – Report Fake Tech Support Calls – SANS Internet Storm Center; Cooperative Network Security Community
• (Green Theme) – Report Fake Tech Support Calls – DShield; Cooperative Network Security Community

For the SysAdmins in the Audience

Kyle Beckman has written an outstanding series of posts at 4Sysops blog on folder redirection in Windows. Definitely worth taking some notes from.

• Folder Redirection – Part 1: Introduction – 4sysops
• Folder Redirection – Part 2: Setting up your file server – 4sysops
• Folder Redirection – Part 3: Explanation of folder permissions – 4sysops
• Folder Redirection – Part 4: Group Policy configuration – 4sysops
• Folder Redirection – Part 5: Best practices – 4sysops

In other news…

FREE: Veeam ONE Free Edition – Real-time Hyper-V and VMware monitoring – 4sysops

“Could not reconnect all network drives” – TinyApps.Org. Great tip and trick for delaying (slightly) the mapping of network drives until the network is fully available after login.

Windows Error Lookup Tool Portable 3.0.4 (get details on Windows error codes) Released – PortableApps.com

Batch-Convert XLSX To XLS Without MS Excel Or An Online Converter – New tool reviewed by AddictiveTips.  Get the tool here from the author.

Jarfix – free tool to fix broken “jar” file associations in Windows.  I needed this after the last Java Runtime update I applied to my system. After installation, I could no longer run the Java-based Software Protection Initiative – Encryption Wizard tool as I had before. I tried several times to update the file-associations but no dice. Then I found this tool, and once executed…problem solved!

Likewise, a few months ago I had re-installed Google Earth but for some reason, lost all indications on how to launch it…no icon on the desktop. None in my “Start” list. Nada. Uninstalled/reinstalled. Still the launcher icon was no-where to be found.  Finally found this link: Google Earth icon has disappeared from my PC : Fix my problem – Google Earth Help  Downloaded the Google Earth Icon Restorer and ran it. Again, problem solved!

Mirekusoft Install Monitor -freeware Installation management software. (Note site down at time of posting) – I have a number of system change monitor/detectors I rely on to monitor how and where a software install impacts a system. Each one takes slightly different approaches. So I read with interest about this new installation monitor/logger. It runs as a service so it catches all installations and documents where in the file-system and registry the bits go. Drawbacks? Maybe a bit unstable and if a program was already installed prior to installing this tool, it doesn’t well-catch the updated installation bits. All that said, it might be worth looking into…particularly in a lab/test-bench setting where you need to document where install bits go before deploying them.  See this CSArchive.Net Mirekusoft Install Monitor post for some screenshots while the main site is down. Alternative programs to consider: Total Uninstaller by martau.com (free-trial/$) or Revo Uninstaller Freeware.

Leelu Soft: Watch 4 Folder 2.3 and Track Folder Changes are two other utilities you may want to check out.

I’m not sure why I’m on this theme this week, but the freeware app GeekUninstaller came to my attention this week also. Free and available in both installable and portable versions, helps remove installed applications.  For a few more details and screen-caps, see this AddictiveTIps post: Geek Uninstaller Lets You Completely Wipe Off Any Application From PC

VMware Workstation Player 4.0.3 released / Workstation 8.0.3 – Born and Windows IT Blog – My own recent experience using VMWare Player 4.0.3 for a Win 8 CP run was outstanding. Definitely worth getting these updated bits. VMware Player 4.0

Group Policy Central – new blog to me about Group Policy topics, including some Win 8 items and findings. Doesn’t appear to be updated quite as frequently as I would like, but since it is new, I’ll probably find more than enough material here to keep me busy until the next post comes out.

Network Nuggets of Gold!

NetBScanner – New tool from NirSoft – NetBIOS scanner. Provide a IP range and get IP addresses, WS Names, Workgroup membership as well as MAC address. Super nice GUI. Add this right now to your network toolbox!  Reminds me of the CLI tools (work good for me) NBTScan and the similarly named nbtscan. More info on NetBScanner at this AddictiveTips review. 

wpic v1.0.0 – woanware – A “simple console web page capture tool based on Chromium project that captures an entire web-page. Reminded me of IECapt which is an IE based web-page capture tool that I use daily for some data archiving.

NETRESEC CapLoader – Not free – interesting tool to process large network PCAP files and filter flows of interest. See this CapLoader Demo – YouTube for more info.

Curiously, there was this related post The Adventures of Packet Tracy, PI over at wirewatcher blog on parsing down large PCAP sets for URLs of interest.

HolisticInfoSec: toolsmith: Buster Sandbox Anayzer – Detailed information and walkthrough regarding a new release of Buster Sandbox Analyzer back in April.

In a GSD post On the Hunt… I detailed a quite involved process in hunting down/validating network connections and mapping them to specific switch ports. Over at LoveMyTool blog, Tony Fortunato posted a short video on how to find out which switch port the client is connected to. Pretty standard stuff.  However, I’m always putting a sharp eye on these just in case I find a new or better technique. And I did! For whatever reason (Cisco IOS updates?) we’ve seriously lost our ability to search for MAC addresses in the Cisco Network Assistant product. We are not alone as others are encountering issues as well. Anyway, we have some workarounds in the GUI but they are a bit time intensive looking through many, many switch port connections.  So like Tony, I find it (generally) faster to just telnet to each switch, run a “show mac address-table” and list the MAC/Port associations and look for the target MAC. On 48-port switches, that is a lot of searching. Tony’s video taught me the following trick; “show mac address-table |include <mac address>”  Including the pipe-include lets me pop just the single MAC I want. Sweet!

More here: Cisco IOS “include” filter.  And for the full list of powerful Cisco CLI options, check out this Cisco IOS Terminal Services Configuration Guide, Release 12.2 – Regular Expressions  [Cisco IOS Software Releases 12.2 Mainline] at Cisco Systems . Note your Cisco IOS version may render some of these commands a bit different, if supported at all. You probably also want to tuck away this Regular Expressions (PDF) for reference as well.

Finally, over at Anything About IT blog, Alex Verboon posted this Script for finding Executables that are command-line programs via a free utility IsCommandLineApp by Helge Klein. Might be useful in incident-response.

For the ForSec crewmates

In my recent Forensically Sound: Quick Post #3 I posted a number of links touching on early forensic surveys of Windows 8 “release” builds. I warned that none of these observations are 100% guaranteed to be present and accounted for in the final baked version, but they are good starting points. Troy Larson wisely commented on that post “Regarding Windows 8 forensics: I would be careful of relying too much on the public preview versions for detailed forensic analysis. Offsets and formats can still change.” Noted! So with Troy’s perspective firmly fixed in mind, here are a few more links touching on early (very early) Win 8 forensic notes and observations.

• Windows 8 Forensics Part 3 -Post by Ethan Fleisher on file history saving.
• Digital Forensics Stream: Windows 8 TypedURLsTime by Jason Hale at the Digital Forensics Stream blog
• Random Thoughts of Forensics: Windows 8 – Refresh Excerpt – Random Thoughts of Forensics – Kenneth Johnson touches on “Windows 8 Refresh points” impact as well as “System Recovery”

Portable Agents to QuickScans: Tips on Using the Latest Version of Redline – Mandiant M-unition blog

SANS DFIR Wall Poster Preview – SANS

File Formats ZOO – Hexacorn blog – file sector header information for common file formats.

File Formats ZOO – Installers – Hexacorn blog – likewise for software installer files.

The Curious Case of the Forensic Artifact – Hexacorn blog – in which the process of solving a curiosity is illuminated.

RegRipper: Update, Road Map, How not to get p0wned by RR v2.5, and Approximating Program Execution via VSC Analysis with RegRipper – Windows Incident Response blog — my o my how RegRipper has grown!

More About Volume Shadow Copies – Journey Into Incident Response:  Corey Harrell dishes more on VSCs.

Related…VSC Toolset Update: Browsing Shadow Copies – Digital Forensics Stream post by Jason Hale with interesting comment thread follow up.

TypedURLs (Part 1) and TypedURLs (Part 2) – Crucial Security Forensics Blog posts by Paul Nichols.

Addressing Malware Issues from an Operational Perspective – Crucial Security Forensics Blog post by Michael Robinson. Great quick read on malware in the organization and changes that may be needed in operations.

Resurrecting “Dead” Images for Live Analysis – Crucial Security Forensics Blog post by Mark A. Wade.

Old Servers never die – unfortunately – Forensics from the sausage factory. Great “how-to” tips and results on imaging a server/system over the network, when you must…

Digital Forensics with Open Source Tools (Amazon link) – New book by Cory Altheide, Harlan Carvey. It’s a book after my own heart! Open Source/freeware (closed-source) tools for for/secs.

Windows Live Messenger – MessengerCache folder  Forensics from the sausage factory. This post was very interesting as it took a fresh look at what may be a commonly used application on some Windows systems.

“You Can’t See Me”…(my bad…I guess you can…)

A recent round of migrating users into a new AD domain (and some folder rcopy/redirection work on the side) has left a few users with missing data post-migration. I have tons and tons of tools to recover deleted data from a drive. The sysadmin I was working with reached for a new one to me in our troubleshooting work together, FreeUndelete over at OfficeRecovery.com. Did the job nicely and the customer had their files restored in no time. I offered my own recommendations in thank-you. In doing so I spotted that Kickass Undelete recently got bumped up to 1.3 beta version. Others I like include Recuva. I also learned (via this AddictiveTips blog post) about Orion File Recover Software Free. I also saw this review at AddictiveTips blog for Wise Data Recovery freeware software. For even more tools, check out this GSD post File Recovery Extravaganza.

PhotoGrok / Java

PhotoGrok: EXIF-Based Image & File Viewer With Metadata Filters – AddictiveTips blog. I have more than enough EXIF-data/File-Viewer apps than I really need, but I’m a sucker for a new utility so I went ahead and downloaded the PhotoGrok tool and was quite pleased with the effort. It’s a nice tool. However, when I went to try to uninstall it, it wasn’t listed in my Add/Remove program (errr, make that Programs and Features) list. Nor could I find a link to an uninstaller in my program file list.

Checking the desktop shortcut target location led me to

“C:\Windows\SysWOW64\javaws.exe -localfile -J-Djnlp.application.href=http://www.haplessgenius.com/photogrok/launch.jnlp “C:\Users\profilename\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\3b46d1a5-79989755″”

Now how do we uninstall this?  Unfortunately, the otherwise well-written FAQ didn’t seem to spell out the method. Yikes. Time for some deeper digging.

Turns out PhotoGrok is a Java WebStart application.

To remove you can follow the principle outlined in this post: How to Clear the Java Web Start Cache as explained by a different software vendor. This post Clearing the Java WebStart Cache by NGS has some better screen-captures (although they may be outdated a bit if you have a more recent Java build on your system…it should work well enough to get you what you need to know). Still not sure? See this final set of screen-caps for a newer Java build: Java Web Start 1.6 beta2 Review courtesy of UCWare.com.

See, no need to panic! Easy-peasy if you want to strike it from your system.

Reset that Windows Password! (or crack it with a new release of Ophcrack…)

So last week–a tech was having some issues having a pushed application install on their system. Turns out their domain account didn’t have admin group membership and was causing the bomb-out. No problem, let’s just add you to the…hmm…for some reason all the admin account passwords are different from our standard and the “fail-safe” account is disabled. Oh snap. I hear the drumbeats of a system reload! Can you say “too-bad, doo-dad?”

Luckily, I had a backup plan.  Booted the system in my custom WinPE, used the embedded tools to off-line authenticate to the whole-disk encrypted system drive, then used NTPWEdit 0.3 to update the Admin password accordingly. Reboot. On the local system admin account now, added tech to the admin group. enabled the disabled account, good to go.

See also Password Renew at sala source (which I understand doesn’t play well under WinPE).

Related: DistroWatch.com: Ophcrack LiveCD updated May 15th. More news about this build here: Distribution Release: Ophcrack LiveCD 3.4.0

“This new live CD includes the latest version of ophcrack 3.4.0. It is built on Slitaz GNU/Linux 4.0, the latest version of this great live CD. Christophe Lincoln from Slitaz helped us to enhance the scripts for partitions and tables detection. A new ncurses interface is also available to help users look for tables on other drives or interact with ophcrack. Finally a live CD without tables has been released as well for users that already downloaded or bought tables. The directory containing the table files must be placed inside another directory called tables in order for ophcrack to find them automatically.”

More Ophcrack release news here: news page

Now where’s my mop?

Cheers!

–Claus V.

Progress is being made on several piles of links I’ve come across but haven’t posted yet. It is actually turning out to be a good thing culling them down like these.

The links below were in a For/Sec/Net folder I was using to hold blog material under that subject until it got too full and too old for me to continue dropping items in there. Some went back to late 2011!

Yesterday I decided to do some Spring cleaning and deal with it.  I dumped a LOT of links that seemed either dated or just not as important now as they seemed to be back then.

What remains below are links that I still wanted to document for research/reference. I did update/supplement some of them with some new material if applications the original links I captured have been updated.

Anyway, here you go if you are interested.

Watching the Networks

• Using Wireshark to Support the Application (by Tim Poth) – LoveMyTool blog – video presentation on Wireshark techniques for troubleshooting network issues.
• Network Mystery #2 (by Betty DuBois) – LoveMyTool blog – video presentation on analysis of a slow network performance situation.
• Wireshark in the Large Enterprise (by Hansang Bae) – LoveMyTool blog – video presentation on the role Wireshark can play in a large network environment.
• Using Wireshark’s Editcap to Reduce Your Trace File Size (by Tony Fortunato) – LoveMyTool blog – short (7m) video on splitting capture files to make capture file more manageable.
• Ostinato: Craft and Play Packets (by Joke Snelders) – LoveMyTool blog – Overview of the packet crafter and traffic generator application Ostinato.
• PDD – Packet Dump Decode (by Joke Snelders) – LoveMyTool blog – packet/hexcode dumping/conversion too.
• NetworkMiner 1.3 Released – NETRESEC blog – old news for a great program.
• Security Onion includes NetworkMiner – NETRESEC Blog
• No more Wine – NetworkMiner in Linux with Mono – NETRESEC Blog – I just followed these steps and got NetworkMiner running perfectly in Ubuntu 12.04 this weekend. Sweet.
• Passive OS Fingerprinting – NETRESEC Blog
• NBTScan. NetBIOS Name Network Scanner. – I use this CLI tool each week. Works great. Mark Woan recommended this version as an alternate: nbtscan – NETBIOS nameserver scanner
• Magic Tree from Gremwell – Interesting tool to help manage network scan data. Works with nmap.
• Home of 0×4553-Intercepter and 0×4553-NAT or Intercepter-NG – very interesting pen-test/sniffing tool that can parse out quite a lot of items.

Tips, Tricks,and other Material

• Facebook Forensics – Help Net Security – Points to paper published by Valkyrie-X Security Research Group on Google Docs or download it in PDF format.
• How we found the file that was used to Hack RSA – F-Secure Weblog : News from the Lab
• Bypass Vulnerabilities in Squid and McAfee Web Access Gateway – SpiderLabs Anterior blog.
• Quickpost: Blocking and Detecting a Teensy Dropper – Didier Stevens
• Plug and Prey: Malicious USB Devices – IronGeek reference material
• Lost a Windows Registry key? Yaru can recover it – BetaNews blog – review of  (YARU) Yet Another Registry Utility tool.
• Carving Symantec VBN Files – Security Braindump – guide on using QExtract to remove SAV quarantined files for incident analysis. However it has limitations and Bugbear provides some tips on an alternative method of extraction.
• CSI:Internet – Controlled from the beyond – The H Security: News and Features
• Purchase information such as your e-mail address and name of iTunes song removed – Caschys Blog (GTranslated) – I’ve been meaning to post this for a while. Caschy illustrates how if you buy songs via iTunes the file gets embedded with the purchaser name/email address. I thought this might have some possible use when looking forensically at a system/files.
• (IN)SECURE Magazine

• DOWNLOAD ISSUE 33 HERE  – PDF Link
• DOWNLOAD ISSUE 32 HERE – PDF Link

Proceedings of The 9th Australian Digital Forensics Conference – I may have posted this before, but it contained a lot of great presentations and whitepapers I had to relink.

Scan it & Dump it!

• rootrepeal – Beta rootkit detector
• GMER – Rootkit Detector and Remover
• Live Memory Forensic Analysis – SANS Computer Forensics and Incident Response blog
• MoonSols DumpIt goes mainstream ! – MoonSols – ISC Diary | MoonSols Dumpit released…for free!
• Volatility: Advanced Memory Forensics – Released to version 2.0 back in August 2011.
• Hexacorn Application Monitor – Hexacorn Blog. Related blog post: How to use HAM?

Tools and Utilities

• TrID – Marc Pontello – Utility to ID files from their binary signature. Def database gets updated often so keep it fresh!
• FileMind Pro Beta 0.6 – Metability Software – Super cool tool to find/review/manage file metadata.
• FileMind QuickFix – Metability Software – and a free tool to scrub metadata from files.
• Know Your Files – Metability Software blog. Not updated recently but still good info.
• TZWorks LLC Prototype Downloads for Forensic tools – TZWorks list of lots of super-cool freeware utilities.
• Registry Decoder – from the project page — “Registry Decoder provides a single tool in which to perform browsing, searching, analysis, and reporting of registry hive contents. All functionality is exposed through an intuitive GUI interface and accommodates even novice investigators.“
• Free Computer Forensic Software downloads and Secuirty Tools – Forensic Computing Ltd. – Great list of tools.
• DarkComet RAT – Official – tool to extract information from browser history

Live ForSec CD’s

• CAINE Live CD – computer forensics digital forensics – “SuperNova” version 2.5.1 has been out.
• DEFT 7.1 ready for download – Released April 2nd with more than a few updated packages and fixes.
• Ubuntu – Now at 12.04 release version. I prefer to use this for my own self-installations of Xplico and Network Miner packages.
• Ubuntu 12.04 and VirtualBox Image – Xplico team has released a VirtualBox image built on Ubuntu 12.04 which includes their Xplico 1.0.0 version (if you don’t want to build it yourself!).
• ubuntu [Xplico Wiki] – Now you can use the Xplico Repository or one of several terminal scripts to easily (and I mean REALLY EASILY) get the Xplico NFAT application going! Super sweet.

Maltego

I first learned about Maltego when I read this fun post Using Maltego CaseFile to map The Spy Hunter at the wirewatcher blog.

Basically this tool lets you organize your intelligence and forensic investigation information in new and graphical manners to better show relationship between elements. Check out the bottom of this page for some screenshots and links to more presentations.

It comes in both a commercial and community edition.

• Maltego 3.1.1 Community edition released – Maltego Blog – info on the latest version release.
• Maltego Blog – Latest news
• Maltego Blog: Maltego CaseFile Beta released – has 10min video on an earlier version with links to the beta version 1.0 downloads.
• Maltego 3 > Community Edition – registration page. Registration is required to use the community edition.

Note: I’m still playing with the version 1.0 beta version and haven’t upgraded yet to the version 3.1.1 community edition.  The version 1.0 so far has been meeting my basic “play and learn” needs, FWIW.

Whew!

I feel better now.

Next up…new material fresh out of the bakery ovens.

Cheers!

–Claus V.

Adobe Systems Inc. today issued a security update to its Flash Player software. The company stressed that the update fixes a critical vulnerability that malicious actors have been using in targeted attacks.

Adobe classifies a security flaw as critical if it can be used to break into vulnerable machines without any help from users. The company said the vulnerability (CVE-2012-0779) fixed in the version released today has been exploited in targeted attacks designed to trick the user into clicking on a malicious file delivered in an email message, and that the exploit used in the attacks seen so far target Flash Player on Internet Explorer for Windows only.

Nevertheless, there are updates available for Flash Player versions designed for all operating systems that Adobe supports, including Mac, Linux and Android devices.

Adobe is urging users of Adobe Flash Player 11.2.202.233 and earlier versions for Windows, Macintosh and Linux update to Adobe Flash Player 11.2.202.235. Windows users of Flash Player 11.2.x who have selected the silent update option will receive the update automatically. Flash Player installed with Google Chrome is updated automatically, so no user action should be required for Chrome users. Users of Adobe Flash Player 11.1.115.7 and earlier versions on Android 4.x devices should update to Adobe Flash Player 11.1.115.8. Users of Adobe Flash Player 11.1.111.8 and earlier versions for Android 3.x and earlier versions should update to Flash Player 11.1.111.9.

To find out if you have Flash installed, or which version is on your system, visit this link. If you have trouble updating your Flash version, consider uninstalling the program using Adobe’s Flash removal tool, rebooting, and then reinstalling the latest version. Updates are available via the Adobe Flash Player Download Center. Direct links to the OS-specific downloads are here.

It has been a while since I updated the ISO files on my iodd external drive/ISO boot device.

I’ve amassed quite a collection of forensic, security, WinPE, and pen-test distros on it and unless something major gets released, I usually don’t pay close attention to keeping them current.

So during a slow Saturday, I figured I would surf the webs and grab the latest versions of the primary LiveCD distros I keep handy on it.

Turns out there are quite a few updates to be had; most all of them pretty recent!

DEFT 7.1 ready for download - DEFT Linux – Bug fixes, updated packages, new tools and exciting bells-n-whistles. Released around 03-30-2012.

CAINE 2.5.1 SuperNova – Forensic LiveCD version released 11-18-2011. I really like this one and as a added bonus, this distro includes an auto-run tool menu if used in a running Windows system: WinTaylor 2.5.1.

PALADIN 2.06 – Forensic LiveCD from SUMURI group. Free download but registration is required for download access. The LiveCD is free and there is a USB version also available at a nominal cost though you can make your own if you wish. I don’t think this is a “recent” release version, but it was newer than the previous version I had.

Raptor 2.5- Forensic LiveCD from ForwardDiscovery group. Current version released 02-26-012. Free download but registration is required for download access. The LiveCD is free and like Paladin, is also available as a pre-installed USB device for a small expense. Raptor is cool in that they have versions for both Intel and PowerPC systems.

Matriux 1.2 “Krypton” – The Open Source Security Distribution for Ethical Hackers and Penetration Testers LiveCD. Current version was released 02-16-2012. Check out the “arsenal” list for a full roundup of the included packages.

BackTrack 5 R2 Release – Penetration Testing Distribution – Latest release version came out around 03-01-2012. This is one of the largest and best for/sec distros out there and includes an amazing collection of tools with extensive documentation on the website and in the community.

GnackTrack – phillips321.co.uk – is (and apparently ever will be) frozen at the final release as the developer is moving on to newer things and since Back Track now comes in both Gnome and KDE flavors.

Blackbuntu Linux & BackBox Linux are new Sec distros to me but since phillips321 recommended them that makes them worth checking out in my book.

Security Onion 20120405 – LiveCD from Doug Burks is out and includes options for a local install if desired. If the file-naming and post date is any indication, then this release is just a few days out of the oven as of 04-05-2012. I deeply appreciate Doug’s work as he is super-good in keeping it fresh and updated frequently.

Windows Forensic Environment - WinFE – Last but definitely not least, Brett Shavers remains hard at work in the Windows PE (FE focused) WinFE building project. Though not an “off-the-shelf” ISO, the process for building your own is pretty straight-forward and all the hard work has already been done. Recent WinFE building work includes a neat GUI-based app from a script you can add into your WinFE building project.

Need some places to start with WinFE building?

These WinFE Blog posts by Brett are particular good.

• How easy (or difficult) is it to build a WinFE with WinBuilder? – Easy Peasy!
• Building your WinFE Update – Options
• Colin’s Write Protect Application – Handy Gui tool if you aren’t super-comfortable with DISKPART CLI. ForensicFocus has a WinFE (PDF) guide that is still quite good.
• WinFE Script Updated – Minor correction.

Finally, these last Linux LiveCD distros are really, exactly For-Sec but I’m really liking them for when I just need to pop-onto a system in my own secure environment and am not comfortable with just what is lurking on the “live” host system. Recently mentioned here on GSD but still sharing the goodness all the same. Besides, it just looks cool if anyone is shoulder-surfing.

Software Protection Initiative – Lightweight Portable Security.  This is a USAF/DOD project and is super-cool and super sharp.  The latest versions were released 02-16-2012. The “Deluxe” version is larger than the primary version as it also contains OpenOffice and AdobeReader software.

Selected info from the page linked above:

Lightweight Portable Security (LPS) creates a secure end node from trusted media on almost any Intel-based computer (PC or Mac). LPS boots a thin Linux operating system from a CD or USB flash stick without mounting a local hard drive. Administrator privileges are not required; nothing is installed. The LPS family was created to address particular use cases: LPS-Public is a safer, general-purpose solution for using web-based applications.

Read the LPS-Public Quick Start Guide. (PDF link)

Read the LPS-Public User’s Manual. (PDF link)

Easter Joy,

–Claus V.

It has been quite a while since I specifically visited the subject of Sync & Backup Tools (freeware).

Since then there have been lots of new tools and applications developed so I thought I would return with a link-dump of sorts.

Generally, my own personal backup strategy remains a bit pragmatic. Wish I could be much more organized like ComptuerZen’s Scott Hanselman.

• On Losing Data and a Family Backup Strategy – Scott Hanselman
• A basic non-cloud-based personal backup strategy – Scott Hanselman
• BACKUP YOUR CRAP: Missing Operating System, Backups, Disk Images, Home Servers, BootRec, BootMgr, RebuildBCD, FixBoot and Problems, Plural – Scott Hanselman

Here then are a few simple routines I use for different purposes, followed by a list-of-lists of various freeware backup programs.

Collections to USB

I have a few “production” folders on my main system that contain a deep collection of portable applications, how-to documents, reference materials, common third-party browser plugin updates, and incident response checklists and guides. These are replicated to a number of USB sticks and portable USB hard-drives for use in the field.

For this type of situation, what I need more is a synchronization program rather than a true “backup” application.

The one I always reach for is DSYNCHRONIZE from Dimo’s Tools. It has lots of options and is quite fast. AddictiveTips blog has recent post going over its finer points: Perform Real Time Sync, Backup Large Storage Mediums With DSynchronize.

This is the easiest by far type of “backup” process I have. I’m just replicating the master set of folders and files onto the USB sticks as needed and DSynchronize cleans up the changes I make in the main folders to the replicated spawn quite nicely.

“My Documents” to USB HDD Storage

The next set of things I have to back up are the “My Documents” folder for myself and the girls, as well as related personal files and folders.

This is where things get a bit more complicated.

I have a few USB hard-disk drives for backup duties. Each one is formatted into two partitions. The first partition is usually just around 100 MB or less. The second volume is the remaining GB’s.

I format the first partition NFTS and load it with a few critical portable software applications; most important of which is TrueCrypt.

The idea behind this first volume is that in the event I ever have to grab-n-get with the drive, all the tools I need to restore data from the drive to another system are on the drive itself. No hunting around.

I then use TrueCrypt to create an encrypted partition out of that second volume. The first partition is relatively tiny as it only needs to keep a few tools in the clear and helps keep me from being tempted with putting any important docs in the free and clear there. The second volume is fully encrypted and that’s where all the good stuff stays. I also put a copy of my portable backup application on it as well.

I then just need to attach the USB device to my system(s), allow it to find the first partition, run TrueCrypt and mount the second volume and attach to it. Then I can run my backup tool and put the backup files into the encrypted volume.

For the backup program itself, I’ve come to rely upon Back4Sure by Ulrich Krebs.

TinyApps recommended Back4Sure some time ago and that was good enough for me to check it out. I’ve become very pleased with it’s ease of use and reliability.  If I had to go with a second, Create Synchronicity might be a close second also recommended by TinyApps: Backup to drive label instead of drive letter.

Whole System Backup

This is kinda cheating, but once in blue-moon I will also use ImageX to create a full-disk image of my primary system and dump the image file into one of those TrueCrypt volumes as well.

This takes lots longer but is a good option for a catastrophic system failure.

Although I could use one of the more regular data backups to get another system going again, this allows me to hunt down and extract any bits-n-pieces of data that get scattered sometimes in weird places if the need ever arises.

List of Backup/Sync Tools

Here below is a list of additional freeware backup tools, programs, utilities and the like. Some are quite new and others are quite old. They are not really listed in any particular order. Take some time and click around. Sometimes the trick is finding one that has the right balance of ease-of-use with options needed for a particular job. Like me, you may find that using a combo of tools for different purposes may be the best solution.

These first ones are more in the class of focused file set backups. Though some could probably handle a system-wide backup job, they mostly would be better suited for backing up a specific subset of files/folders from a system rather than the whole enchilada.

• DSYNCHRONIZE – Dimo’s Tools
• Back4Sure by Ulrich Krebs
• Create Synchronicity
• Areca Backup – Official Website
• FreeFileSync
• Toucan – PortableApps.com – Portable software for USB, portable and cloud drives
• Personal-Backup – Rathlev
• Cobian Backup
• AceBackup
• Comodo Backup,
• 2BrightSparks – SyncBackSE
• FBackup
• PureSync – Synchronize and backup files and folders
• Hinx Software Backup Easy
• Handy Backup Software 7.0 – Back up Windows PC and Servers
• Dmailer Backup – Free backup software – Online storage service |Windows & Mac
• Everyday Auto Backup
• Zback homepage – portable backup and synchronize tool for Windows
• Freebyte Backup
• ICE Mirror
• Ocster Backup: Freeware Windows Edition – Free Backup Software for Windows (AddictiveTips review)
• DFIncBackup – Freeware incremental backup – (AddictiveTips review)

These next ones are more of the specialty enchilada menu-fare. These will cover more of a whole-drive backup rather than limited file/folder sets. That said, they still primarily run within the existing Windows system so should be familiar and dependable for geeks and grannies alike.

• Paragon Backup & Recovery Free Edition
• Macrium Reflect FREE Edition
• EASEUS Todo Backup
• GFI BackUp Freeware – (AddictiveTips review)
• Redo Backup and Recovery
• DriveImage XML Backup Software
• Carbon Copy Cloner – Features
• XXCLONE, A New Way of Cloning the Windows System Disk- (AddictiveTips review)

Finally, we can step off the well tread path and go to more geeky options that are system-backup and imaging tools for the tech-crowd.

• ImageX -GSD Blog posts tagged “ImageX”
• Clonezilla
• OSFClone – Open source utility to create and clone forensic disk images
• Disk2vhd
• Device Image
• Partition Saving
• Partimage
• G4L
• g4u – Harddisk Image Cloning for PCs
• Miray Software – HDClone
• Clone Maxx
• Seagate Technology – DiscWizard
• Seagate Technology – MaxBlast 5

I suppose if you were super-geeky or a forensicator, you could also use any of the various tools you probably are aware of for making sector-based drive images. However for personal “backups” I prefer to use file-based backup methods as having a forensically sound exact duplicate of my drive isn’t as critical as having the files I need available for easy restore or off-loading.

More information:

• Best Free Backup Program – Gizmo’s Freeware
• Best file and folder synchronization freeware for Windows 7 – The Windows Club
• Free Disk Image and Cloning Utilities – thefreecountry.com

Back it up,

Encrypt it if it’s personal (or even it it isn’t),

Cheers.

–Claus V.

You may recall that both GSD posts on secure wiping — Free Wipies and Wipies – Part II (Full Coverage Cleaning) – were both inspired by a blog post by the TinyApps.Org blogger.

Last night I received a kind message from this dear friend pulling my attention back to the deeper issue raised in that post, and while this isn’t a completely unknown issue, it is one that can be easily overlooked by the best of sysadmins in our zeal to “secure wipe the darn thing” and get on with our other daily grinds.

The TinyApps how-to post ATA Secure Erase (SE) and hdparm shares an added benefit for those who dare to tread that hard-drive wiping technique through the “enhanced secure erase” option.

(Very) Basically the issue comes down to this: hard drives may have bad sectors that have been found and so marked as well as additional “host protected area (HPA)s” both of which can be skipped by many “block-erase” wiping tools and utilities. The end result is the possibility of recoverable data left behind in these areas if a standard block-erase method is used.

• Host protected area – Wikipedia, the free encyclopedia
• Device configuration overlay – Wikipedia, the free encyclopedia

So even though you are diligently laying down your randomized data and/or zeros to all the (accessible) sectors of the drive, the drive itself may be actually hiding physical sectors from your software that will not get overwritten no matter how hard you try.

As TinyApps linked for me in the communication, even the almighty Darik’s Boot And Nuke clearly says in its FAQ that it must be used with knowledge to address some of these issues:

Does DBAN wipe remapped sectors? – Darik’s Boot And Nuke

Does DBAN wipe remapped sectors?

Use the ATA-6 wipe method if you want to wipe remapped sectors. Most methods do not wipe remapped sectors.

Does DBAN wipe the Host Protected Area (“HPA”)? – Darik’s Boot And Nuke

Does DBAN wipe the Host Protected Area (“HPA”)?

No.

Most vendors that are using the HPA have a toggle for it in the BIOS setup program. Future releases of DBAN may override or dishonor the HPA.

Why not now and why not by default?

Some vendors are using the HPA instead of providing rescue media.

Wiping the HPA would surprise and strand people that expect the HPA to have rescue materials, and it often results in OEM technical support marking and abandoning people that do it. The HPA is a low risk because it is not accessible during normal operations.

DBAN defaults are chosen to best protect people with a minimal understanding of this kind of problem. This point is still open for discussion in the help forum and in the appropriate bug ticket.

That’s not to say this information makes DBAN (or any of the others like it) a bad or faulty tool, just one with some limitations (like most all other block-erase wipe tools) that must be fully understood before deciding if its methods are sufficient for the use at hand.

For example, there are forensic drive access/capture tools that can detect these areas and ensure the investigator is able to respond to them.  That’s great news for the good guys and a warning that bad-guys can also take advantage of this as well: HPA/DCO Detection – WiebeTech Forensic Docks

Here (again) are links to two posts about the HPA/remapped sector issue with drive wiping well worth the read:

• Securely erase hard drives – ultraparanoid
• Can God Create a Rock So Heavy Even He Can’t Lift It? – ultraparanoid

I suppose one good place to start is pre-inspecting your drive before you get wiping to better understand what you are dealing with.

There are a few Windows-based tools that I am aware of that can let you look at either/both HPA area(s) as well as DCO info (if they exist).  In most cases, these do require specialized booting of the system either directly with a true DOS disk or a Linux tool to access the drive correctly.

• MHDD – HDDGuru
• HDAT2/CBL Hard Disk Repair Utility – Lubomir Cabla
• TestDisk 6.12 Release – CGSecurity

So, that brings us back to using a combo of tools and methods to wipe both check for the presence of  HPA/DCO and address/remove them first before using a block-erase wipe tool or to learn some new techniques for an “all-in-one” wipe method to get it all.

For “modern” hard disk drives that support this feature the “enhanced secure erase” method may be the only option short of extreme physical destruction (with prejudice and malice aforethought) of the drive to ensure all data is irrevocably cleared from the drive.

TinyApps “how-to” post is a great starting point at using a Linux Live CD to accomplish the process and what is happening :

• ATA Secure Erase (SE) and hdparm – TinyApps blog
• More background here at ATA Secure Erase – ata Wiki
• SSD Secure Erase with proper ATA command – mackonsti blog
• CMRR – Secure Erase tool – over at the Center for Magnetic Recording Research (CMRR) is another option, though a read through of many comments and other posts suggests this tool may have some performance issues…or not.
• Guide How to use HDDErase – OCZ Forum
• The Parted Magic LiveCD- I have learned – includes an ERASE tool which does support the “enhanced secure erase” protocol if the drive at hand does as well.  It takes care of a lot of the CLI work that might off-put casual wipers. How To Secure Erase Corsair SSDs With Parted Magic — Corsair Blog.  I’ve used Parted Magic quite a lot in the past but never for secure wiping and never realized it had this option.
• GParted can do this as well, though it doesn’t seem to have the “wizard” for hdparm that Parted Magic does: Use GParted to secure erase SSD – GSKILL TECH FORUM.
• Note: As TinyApps points out in his post, in-fact any Linux distro that includes hdparm at a version of 9.31 or greater would work; the lower versions have a 2-hour timeout which can leave the remaining portion of the disk unwiped.
• Guide Secure Erase for Windows – OCZ Forum
• Guide Secure Erase From Within Linux For Windows Users – OCZ Forum
• Guide How to Restore SSD performance WITHOUT using HDDErase – OCZ Forum

It is my understanding that Windows port of hdparm may work as well that is found in Cygwin. I’ve seen some forum posts discuss that some versions (the later ones) are better than earlier ones.

• The Win32/Cygwin version of ‘hdparm’ will tell you if you have HIPM or DIPM capabilities. – Aaron Tiensivu’s Blog

Christian Franke has also provided a native Win32 tool version if you just need it without Cygwin.

• Index of /hdparm – via Christian Franke

So to sum up from my perspective,

1. If you want to keep the OEM HPA area intact (maybe you have a Dell system with diagnostics loaded there) and plan to recycle the drive/system in your organization, then a simple whole-disk block-erase of the drive may be sufficient.  Updating the DCO information probably isn’t necessary and may help — in fact — preserve the previously found “bad sectors” info if it is present.
2. If you plan on giving the drive/system away then you should strongly consider attempting the “enhanced secure erase” method first to see if your drive supports it. If not, then you may have to settle for either a whole-disk block-erase wipe and hope for the best (that there is no sensitive data in any HPA/DCO areas (if present) or use one of many reliable, complete,  irrevocable, physically destructive methods.

Hopefully I have covered this sufficiently for you to Google on from here.

If not, as always your comments are welcome and appreciated.

And if anyone knows of any additional Windows/DOS/*Nix tools that can handle “enhanced secure erase” wiping of a modern drive, please leave a tip in the comments.

Cheers!

–Claus V.

I love finding, collecting and using specialized utilities.  It’s as much passion as compulsion.

And though I can go mad-crazy with my linkfest posts running down tool after tool, developing a comprehensive list of my favs and frolics remains a dream for a month-long sabbatical sometime in the future.

So it is with admiration and respect that I found Scott Hanselman of Computer ZEN fame has recently posted his annual “Best of” software tools and software list.

Scott Hanselman’s 2011 Ultimate Developer and Power Users Tool List for Windows

It is an amazing collection.

Scott has done some great organizational work in the post, such as highlighting the new items in Green.  Old favorites that have new back-links have been updated.

Categories include:

• “The Big Ten Life and Work-Changing Utilities”
• “Rocking Sweet Windows 7 Specific Stuff”
• “A (.NET) Developer’s Life”
• “The Angle Bracket Tax (XML/HTML Stuff)”
• “Visual Studio Add-Ins”
• “Regular Expressions”
• “Launchers”
• “Stuff I Just Dig”
• “Low-Level Utilities”
• “Websites and Bookmarklets”
• “Tools for Bloggers and Those Who Read Blogs”
• “Browser Add-Ins/Extensions”
• “Things Windows Forgot”
• “Outlook AddIns and Life Organizers”

I’m familiar with many of these tools, but as always, there were some great new discoveries for me in his lists.

Granted, many of the items lean to the programmer (since that is what Scott does) but even if you are not a coder by heart, there are lots of great finds here to pick through.

Most are free however there are some apps listed that are not ($).

Permalink: Hanselman Ultimate Tools List

Bonus Linkage:

obinshah / TED Talks Downloader – freeware – I’m a big fan of stretching my brain-cells and trying to take in new concepts in a wide range of fields and fauna. TED: Ideas worth spreading is a site that provides great (and sometimes provocative) conversations from some of the most interesting people today. Normally I just keep an eye on their site and view a particular video discussion as it calls me.  However, sometimes I want to keep one local for future reference or to view on the road.

TED Talks Downloader is a single EXE that offers a way to grab the list of TED Talks available and then after selection, lets you download them directly to your system in several different quality levels. Super great for when the road calls and you don’t have access to a network connection.  Spotted and described on this addictivetips blog post Batch Download All TED Videos With A Single Click via TED Downloader.

Gow – The lightweight alternative to Cygwin – GitHub – an alternative package to Cygwin. It uses an installer to deliver the goods (~130 UNIX CLI apps) to your system.  Adds a Windows Explore shell window to open a CMD window from a folder, easy install/remove, apps get included in your system’s PATH for easy access.  Not too shabby.

Cheers!

–Claus V.

…as in off-line system booting, not the GSD blog (despite the drought of posts strangely mirroring the lack of rain and rise in thee-digit temps here on the Texas coast).

I still continue to find joy and purpose for my portable iodd : Multi-boot madness device.  It is humming along and greedily continues to consume the bootable ISO files I toss at it.

I-Odd (South Korea) has released some newer firmware updates.  In summary, the i-odd is an external USB2.0/eSATA drive enclosure that allows you to store boot-disks in ISO format and then boot a system with any of them via the selector toggle.  The I-Odd site has gotten a refresh and much easier to navigate. They are offering firmware update versions 1.42.64N (for NTFS-formatted I-odd partitions, and 1.42.64F for the FAT32/exFAT formatted i-odd partitions. Download page.  There are also some utilities and whatnot listed there as well. Only drawback is that as none of the links are clearly time/date noted, it is hard telling if something is a new update or not.

The US i-odd site is (still) offering Firmware Version 1.42.48 (ISO) that supports either FAT32, EXFAT or NTFS partition handling for loading disk images.  I’m getting the feeling that this US branch isn’t providing a lot of product love considering the SK site is way ahead of their game.

The maintainer of TinyApps.Org Blog is the kind individual who first set me on notice and then use of the i-odd device.

Not too long ago he sent word of a Kickstarter project called the ISOStick which though not related to the iodd device, is likely to be a kissin’ kousin if all goes successfully.

• isostick – the optical drive in a usb stick by Elegant Invention  — Kickstarter.
• Isostick: the USB memory stick that thinks it’s an optical drive — ExtremeTech
• isosticks! — Flickr – Photo Sharing!

That last link is really cool as the developer shows all the work that is going into the design and development. It’s a neat behind-the-curtain look at what it takes to make and bring these magical but ubiquitous “flash-drive” units to life.

In the meantime, if you don’t have a iodd or ISOStick device, you might want to check out these additional neat boot from a flash-drive projects:

WinToFlash – Install Windows from usb

From that project page link:

“WinToFlash starts a wizard that will help pull over the contents of a windows installation CD or DVD and prep the USB drive to become a bootable replacement for the optical drive. It can also do this with your LiveCD.”

• WinToFlash Guide – Install Windows XP from USB Flash drive
• YouTube – ‪WinToFlash: Make a Bootable USB Installer for Windows 7 – XP and Vista by Britec‬‏

YUMI – Multiboot USB Creator (Windows) via USB Pen Drive Linux

From that project page link:

“YUMI (Your Universal Multiboot Installer), is the successor to MultibootISOs. It can be used to create a Multiboot USB Flash Drive containing multiple operating systems, antivirus utilities, disc cloning, diagnostic tools, and more. Contrary to MultiBootISO’s which used grub to boot ISO files directly from USB, YUMI uses syslinux to boot extracted distributions stored on the USB device, and reverts to using grub to Boot Multiple ISO files from USB, if necessary.”

The MakeUseOf Blog has a great review/how-to post on YUMI: Boot Multiple Live CDs From One USB Disk With YUMI [Windows]

LiveUSB MultiBoot – This is a French-based project but English-versions have been translated by community members.  It is a Linux boot CD project. Here is a Google Translate link for easier reading if you are interested.

Multi-booting systems via a USB device is still cool and useful, particularly for the sys-admin/incident responder crowds. While probably never to become a main-stream product for the masses, it is nice to see these projects and capabilities continue in development.

Cheers.

–Claus V.

cc attrib: The US Army on flickr, DoD photo by Air Force Tech. Sgt. Jacob N. Bailey

This season’s July 4th finds Lavie and I quietly resting at home watching “classic” revolutionary period movies on TCM. Alvis has flow the coop to a week-long church-youth camp. Firework sales and use have been banned by all the area counties and municipalities due to the record-busting Texas drought and heat.  We will probably have to suffice with watching celebratory events in HDTV-mode again tonight.

The weekend has been pretty light on tech-support calls. Dad wanted to give his father-in-law’s old cobbled-together “antique” PC system a refresh so I picked out a nice basic-home-user-grade Dell Inspiron 570 model that will be way sufficient for his pretty-much email-only PC needs.  Dad and little-bro set it up yesterday and did most of the pre-installation setup and file-transfer.  I’ll do some remote-support work this afternoon to lock it down and recover some account passwords and such off the old system and get them going on the new one.   And then yesterday I stripped-down the keyboard off Lavie’s laptop.  Seems a week or so ago, Lavie fell asleep with both a small tumbler of sweet tea and her laptop on her chest.  A very small portion of the tea ended up in the keyboard. Oops. (very) Fortunately the keyboard tray caught all of the spillage. (un) Fortunately, it was sweet (sugared) tea, so let’s just say the keys were less than responsive with spring-back action.  That restoration job took about three hours. Disassembly and cleaning was pretty straight-forward. However getting the scissor-action two-piece key travel parts re-mounted was very delicate work as I didn’t want to break any of them. It took me about twenty minutes to get the mating and mounting technique down before my pace picked up.  All is well now and Lavie is clickity-clicking again happily.

Offered here today is a forensic and security slanted linkfest.  This folder has been very, very full for a very long time.  What survives below are the best of the best as the blogging room floor is littered with editing cuts and discarded linkage that didn’t age well.

In the Reading Room

(IN)SECURE Magazine is a great source of security and network issues. I keep several of these PDF files on both my laptop and Kindle for go-to reading when things are slow. (IN)SECURE Magazine issue 29 and (IN)SECURE Magazine issue 30 are the most current. However, pop onto the Archive page to look for past issues that may have some gems.  For example, this early ISSUE 4 (PDF link) has a great article “Structured Traffic Analysis” on pg 6 written by network sec guru Richard Bejtlich. While the article could probably be updated with the newer network analysis tools made available since Oct 2005, the framework Richard lays out still works very well.

InfoSec Resources has lots of great articles to read and study. Check out their article archives for a really wide range of for-sec articles and whitepapers.

CERT Societe Generale – IRM (Incident Response Methodologies) as some good incident handling guides to review or keep filed within reach.

Dashboard | SANS Internet Storm Center – Security “dashboards” look cool and can communicate valuable information. I’ve got several I keep an eye on from time to time.  SANS has recently updated theirs.

Girl, Unallocated – Newly added forensics blog to my RSS feed list.  Fresh perspectives are always welcome at GSD!

VRT: A Close Look at Rogue Antivirus Programs – Post by Alain Zidouemba that contains PDF of the slides presented on his talk “A Close Look at Rogue Antivirus Programs” given at Hack in Paris conference.  I’ve lately been paying closer attention to articles on malware (particularly rogue-securityware) vectors.

Security Aegis has some great posts Real OSINT and OSINT, because knowing is half the battle on “open-source intelligence” work.  This is good stuff as when you are doing network traffic analysis, being able to attempt to track down and understand the names/handles seen in the traffic may provide additional clues in your incident response analysis.

The posts over at Malware Intelligence don’t come fast-enough for me, but when they do, they are golden. JAVA Drive-by [infection] On Demand actually got their hands on a “drive-by” generator and pick it apart. Neat.

Network Traffic: News and Reports

Lots and lots of goodies here!

The folks at Packet Life have posted some good material recently: Proving the Network is Not the Problem With iperf and Long-Term Traffic Capture With Wireshark offer great tips and techniques for you network jockeys.

Out of comments from those posts came a jump to the NetStress Network Benchmarking Tool and NetSurveyor Network Discovery Tool — both of which are offered for free by Performance WiFi.

LoveMyTool blog has the following juicy fruits: Microsoft Network Monitor 3.4: Search the Description Column (by Joke Snelders) and A Deeper Look into Your Network – Cool Tool (by Vivek Rajagopalan)

That second one points us to Trisul Network Metering and Forensics tool.  If you just need “near-time” network traffic reporting and analysis, then the Free rolling 3 day window version looks hard to beat.

TinyApps.Org Blog : Setup a virtual network lab brings to our attention the free Marionnet.org project for networking practice and study.  It is a very cool project.

The Case of the Great Router Robbery over at InfoSec Resources poses some deep thoughts about the importance of physically securing your routers.  It’s not just because many of they are outright high-dollar items to begin with, but the configuration data on them is golden for pen-attack reconnaissance and enablement. It closes with some good thoughts about securing your device if it is stolen and what you should do if loss does occur.

Network Mystery #1 (by Betty DuBois) at LoveMyTool has both a recorded presentation as well as slide-show PDF from Sharkfest 2011. It is appx 1:26 long so it isn’t a fast-view.  That said, Betty offers some great guided material for you network tracers.

“ … In this session, Detective Betty DuBois will review one of the elusive network cases she has solved using Wireshark and Pilot. There will be plenty of forensics evidence provided, and lots of practical information to help you solve your own network mysteries. This session will be a deep dive into the “Case of the Slow Network”. Betty will walk the attendees through how the data was captured (tshark & AirPcap), the methods used to isolate the problem (SMTP relay infection), and which users were infected … “

Network Traffic: Tools and Techniques

Solution to the Nitroba case – Erik Hjelmvik (Network Miner) on the NETRESC blog posts some great network forensics tips specific to the “Nitroba Case” exercise. I was fortunate enough to read the first-post version before some elements were modified. Regardless it is a great example of how NetworkMiner can be used to analyze and dissect network traces in investigatory work.

Tools for modeling the user-traffic – superlist of network traffic analysis tools over at comlab.uni-rostock.de.  Bookmarkable.

RawCap sniffer for Windows released – NETRESEC Blog. I’m sure I’ve posted this here. Erik released a CLI tool for raw-socket network captures. It’s a slim single-exe file and is pretty cool. No installation required. Definitely worth keeping on a USB stick.  I like that I could download it to a local (remote) system and run a targeted trace of that system’s network traffic without needing to install a larger app like Wireshark. Likewise, as Erik suggests in the post, one could “…use the Sysinternals tool PsExec to inject RawCap.exe onto the [remote system] and sniff the packets.”

Split or filter your PCAP files with SplitCap – NETRESEC Blog. Not a new tool, but an update to v1.6. This CLI tool can slice-n-dice very large PCAP files into smaller sets based on IP addresses or sessions. Sure, you can do filtering work in Wireshark and NetMon as well, but this is a very fast tool and makes bulk PCAP file splitting/filtering very easy.

York::Log all network traffic – The SZ Development.  Interesting network sniffing/logging tool.  Certainly not for Wireshark/NetMon pros; however the GUI and basic logging/websession monitoring features might make it more user-friendly for folks getting their feet wet.

NMTopProtocols Expert Released – Network Monitor Blog

Using Wireshark’s editcap to Remove Duplicate Packets Packets (by Tony Fortunato) – LoveMyTool guided post.

Bittwiste: pcap Capture File Editor (by Joke Snelders) – LoveMyTool – review and thoughts on how to use the Bit-Twist program for packet manipulation.

So Many Tools…So Little Time!

Windows Incident Response: Using RegRipper – WindowsIR blog. Harlan provides us an updated guide on how to effectively use his amazing RegRipper tool. See also the New Plugins from Harlan.

Kissin-Kousin of RegRipper is Woanware’s RegExtract.  I believe they complement each other nicely. Keeping up with the active updates to RegExtract can be challenging. Focusing on the most recent may cause you to overlook other features that have previously snuck in! See these: RegExtract v1.1.3, RegExtract v1.1.4, RegExtract v1.1.5, RegExtract v1.1.6, and the latest, RegExtract v1.1.7.

Also recently updated in the Woanware factory:

• ChromeForensics v1.0.4
• USBDeviceForensics v1.0.6
• PrefetchForensics v1.0.4

Dropbox Reader – by CyberMarshal. CLI tool collection for investigating DropBox cloud-storage software indicators.

DumpStrings.1sc – Didier Stevens shares a script that dumps ASCII and UNICODE strings found in a file. To be used with 010 Editor.

P2 Shuttle Free – Paraben Corporation – Free multi-tool to remotely mount disks, do live-system process reconnoiter, memory capture, machine searching, active file browsing of email, chant and IE history, and open a disk without mounting. This version does have some limitations so understand before relying on it too much.

P2 eXplorer Free – Paraben Corporation – Free utility to mount forensic disk images of many different formats.

Meanwhile the folks at Mandiant have been busy making material as well:

• MANDIANT Intelligent Response 2.0. See this MIR 2.0 Released post for more info. (not free)
• MANDIANT Redline – (free) – “Redline is a free utility from MANDIANT that accelerates the process of triaging hosts suspected of being compromised or infected while supporting in-depth live memory analysis. Designed to help find even the best-hidden malware, it analyzes and rates every running process on a system according to risk, combining Memoryze’s live memory analysis with MRI (Malware Risk Index) scoring. Redline makes memory forensics accessible to any investigator without relying upon easily-defeated signature-based detection.”
• Highlighter v1.1.2 Released

In both posts Windows Incident Response: Tools and Meetup, Tools and other stuff  – Harlan offers a great listing of for-sec tools.  I especially liked the discussion of “Jump Lists”.

Complementing that discussion is the new woanware tool JumpLister v1.0.0.  “JumpLister is designed to open one or more Jump List files, parse the Compound File structure, then parse the link file streams that are contained within. It uses the LNK parser I wrote so stuff like object ID’s and MAC addresses are handled.” Sweet!

The H Security announced that Microsoft releases Security Essentials 2.1.  Despite the fact that the recent system infections I had to clean were able to overwhelm (previous versions of) Microsoft Security Essentials, I still have lots of confidence in the product for home users. In these cases, outdated Java/Flash versions left the door to the barn open and MSSE couldn’t keep up with the attack. Any a new version has been quietly released.  It’s actually been out for about a week but Windows Updates and/or MSSE internal updating didn’t pick it up. However if you want it now (recommended) download the new version directly from the product page and run. It will do an in-place upgrade with no fuss. For more info or download locations:

• Microsoft Security Essentials 2.1.1116.0 released, Download Now – Windows Valley has the (slim) info on what this update brings.
• Virus, Spyware & Malware Protection – Microsoft Security Essentials main product page.
• Download Security Essentials 2.1.1116 – FileHippo.com (alt download link)
• Download and install Offline Updates for Microsoft Security Essentials – Windows Valley has a great tip and linkage on how to “off-line upate” the DAT files for MSSE. I figured this could be done but never took the time to hunt down the source locations. Here you go!

How-To’s and Info of Note

Create a Bootable DBAN USB Pen Drive – TrishTech – Vendor dude has a contract to secure(DoD) wipe our out-of-service system HDD’s before they are returned to the lessor. Most of the time he is running a bank of bases and tossing in a Darik’s Boot And Nuke (DBAN) CD and wiping away. Periodically however he would run into a system with a bad CD-ROM drive and would have to strip out the HDD and put it into another system to then run his CD.  I asked him why he didn’t just make a boot-USB version of DBAN. Brilliant, wasn’t it….  Here you go.

Security Braindump: Virtualizing Raw Disk Images – Because you know one day you will need to…

Windows Security Center: Under the Hood – Didier Stevens. Wish I had this post from Didier when I had composed this GSD post: How to Repair Windows Security Center List Items.

Tim Mugherini presents NTFS MFT Timelines and Malware Analysis – posted by John Strand at PaulDotCom.

Internet Explorer 9 Security Part 4: Protecting Consumers from Malicious Mixed Content – IEBlog.

For-Sec Live CD News

The world of “Live CD’s” is alive and healthy.

Security Onion 20110628 now available - I’ve only recently become acquainted with the tools and features of Security Onion distro. Very nice and has some great includes from Doug Burks.

PALADIN Download – Sumuri – Version 1.0 was released back in April 11. 

DEFT Linux 6.1 Computer Forensics live cd was also released back in April 11. See this new “draft” DEFT english manual if you are not already familiar with this distro.

BackTrack Linux 5.0 – Penetration Testing Distribution was released in May 11.  It’s a whopper so unless you got a big pipe, you may need to start the download when you put the cat out for the night.

As previously mentioned here on GSD, Brett Shavers the WinFE guy has been hard at work evangelizing on the WinFE distro.

• Sharing the love with WinFE – WinFE Blog
• How easy (or difficult) is it to build a WinFE with WinBuilder? – WinFE Blog

Offline Antivirus – How to run Microsoft Safety Scanner on Windows PE 3.0 – 4sysops

Whew!

Now this post is out of the way, I can turn attention back to an Xplico follow-up along with a collection of linkage that came out of a conversation with TinyApps on write-block hardware that has been gathering dust for quite a while.

Happy 4th!

–Claus V.

Adobe today issued more than a dozen security updates for its Acrobat and PDF Reader programs, including a feature update that will install future Reader security updates automatically. In addition, Adobe has shipped yet another version of its Flash Player software to fix a critical security flaw.

No doubt some will quibble with Adobe’s move toward auto-updating Reader: There is always a contingent in the user community who fear automatic updates will at some point force a faulty patch. But for better or worse, Adobe’s Reader software is the PDF reader software of choice for a majority of Windows computers in use today. Faced with incessant malware attacks against outdated versions of these programs, it seems irresponsible for Adobe to do anything other than offer auto-update capability to to Reader users more aggressively.

Adobe debuted this feature in April 2010, but at that the time Adobe decided to continue to honor whatever update option users had selected (the default has always been “download all updates automatically and notify me when they are ready to be installed”). With this latest update, Adobe will again prompt users to approve an auto-update choice, except this time the option pre-selected will be “Install Updates Automatically.”

I have long urged mere mortals (non-system administrators) to switch to a PDF reader that is less bulky and less targeted by cyber crooks and malware writers, such as Foxit, which also includes an auto-update mechanism. This advice is only reinforced when I read advisories like the one that shipped with today’s update, which may be decipherable by some but probably would completely mystify the average user:

“Adobe recommends users of Adobe Reader X (10.0.3) and earlier versions for Windows and Macintosh update to Adobe Reader X (10.1). For users of Adobe Reader 9.4.4 and earlier versions for Windows and Macintosh, who cannot update to Adobe Reader X (10.1), Adobe has made available updates, Adobe Reader 9.4.5 and Adobe Reader 8.3. Adobe recommends users of Adobe Acrobat X (10.0.3) for Windows and Macintosh update to Adobe Acrobat X (10.1). Adobe recommends users of Adobe Acrobat 9.4.4 and earlier versions for Windows and Macintosh update to Adobe Acrobat 9.4.5, and users of Adobe Acrobat 8.2.6 and earlier versions for Windows and Macintosh update to Adobe Acrobat 8.3.”

In short, this update fixes at least 13 security holes, including a zero-day vulnerability in Adobe’s Flash player software that the company patched last week (the same flaw is present in Reader and Acrobat). The patch also addresses the three flaws in Adobe Reader X for Windows that were previously fixed in the other supported versions of Adobe Reader and Acrobat. If you use either the Mac or Windows version of Adobe Reader or Acrobat, you should select “Help,” and then “Check for Updates.” If there is an update available, please apply it. Here’s hoping that Adobe’s auto-update feature will be timely (not wait weeks after a new version is available to update the installed product) and that it won’t foist additional software — browser add-ons, toolbars and security scanning tools that often have accompanied previous manual updates.

Adobe also shipped another version of its Flash Player software, the second security update for Flash in less than a week (last week Adobe pushed out an emergency update to fix a flaw that attackers were already exploiting). Adobe said it identified a critical flaw in Flash Player 10.3.181.23 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.185.23 and earlier versions for Android. Adobe urges users of Adobe Flash Player 10.3.181.23 and earlier versions for Windows, Macintosh, Linux and Solaris update to Adobe Flash Player 10.3.181.26, available now. Adobe expects to make available an update for Adobe Flash Player 10.3.185.23 and earlier versions for Android before the end of the week of June 13, 2011.

To find out what version of Flash you have installed, click this link. Updates are available from the Flash player download page. Windows users who browse with something other than Internet Explorer will need to apply the Flash patch twice, once by visiting the download page with IE and a second time with Mozilla or Opera. Google Chrome users should already have the latest Flash update (automatically updated to Chrome version 12.0.742.100 for all platforms).

Update, 8:51 a.m. ET: Added information about another Flash update.