LastPass Password Management

I've been really pleased with LastPass as a password management plugin for Chrome. It has the ability to store and generate complex passwords for all your sites as well as store encrypted notes about each one.

Just make sure to turn off the "Automatically Fill Login Information" option if you work in Systems Administration. Just the other day it updated this information on a site I was using without me noticing. I had to scramble for the valid username and password before systems started throwing alerts.

New Remote Desktop for Mac (about time)

Apple and Microsoft have released a new client for Remote Desktop for the Mac. The old client has been in sore need of an update for years and the new client with IOS and Android versions is a welcome improvement.

https://itunes.apple.com/us/app/microsoft-remote-desktop/id715768417?mt=12

Apparently you can't save shortcuts with passwords, or at least I haven't figured it out yet. There will certainly be a learning curve and maybe a few updates (now that it's in the App store) but I sure hope I can have shortcuts with passwords, or maybe I should just rethink that from a security stand point anyway.

Here's all the crapware that comes with new Windows 8 PCs | ITworld

Great little fact that has always bugged me. One more reason to use a Mac.

Here's all the crapware that comes with new Windows 8 PCs | ITworld:

The PC Decrapifier Wipes Unwanted Junk | The PC Decrapifier

The PC Decrapifier Wipes Unwanted Junk | The PC Decrapifier:

Researcher advises against use of Sophos antivirus on critical systems

Any exploit of any piece of software that remains un-patched is dangerous. If you have software that's deployed on an enterprise level, it makes it that much more important to have layers of security and excellent patching processes for ALL of your software.

If Sophos fails to patch exploits in a timely matter, that's a different story.

From Slashdot.

From Arstechnica.

Antivirus provider Sophos has fixed a variety of dangerous defects in its products that were discovered by a security researcher who is recommending many customers reconsider their decision to rely on the company.

"Sophos claim that their products are deployed throughout healthcare, government, finance, and even the military," Tavis Ormandy wrote in an e-mail posted to a public security forum. "The chaos a motivated attacker could cause to these systems is a realistic global threat. For this reason, Sophos products should only ever be considered for low-value non-critical systems and never deployed on networks or environments where a complete compromise by adversaries would be inconvenient."

A more detailed report that accompanied Ormandy's e-mail outlined a series of vulnerabilities that attackers can exploit remotely to gain complete control over computers running unpatched versions of the Sophos software. At least one of them requires no interaction on the part of a victim, opening the possibility of self-replicating attacks, as compromised machines in turn exploit other machines, he said. The researcher provided what he said was a working exploit against Sophos version 8.0.6 running Apple's OS X. Attackers could "easily" rewrite the code to work against unpatched Sophos products that run on the Windows or Linux operating systems, he said.

A post published to Sophos's Naked Security blog around the same time Ormandy released his report thanked the researcher for privately disclosing the vulnerabilities so they could be fixed before attackers have the knowledge required to exploit them.

"The work of Tavis Ormandy, and others like him in the research community, who choose to work alongside security companies, can significantly strengthen software products," the post stated. "On behalf of its partners and customers, Sophos appreciates Tavis Ormandy's efforts and responsible approach."

The Sophos post detailed eight fixes that were released from 42 days to 55 days after Ormandy privately brought them to the attention of Sophos engineers. For his part, Ormandy concluded that the amount of time it took to release the patches was excessive.

"Sophos simply cannot react fast enough to prevent attacks, even when presented with a working exploit," he wrote. "Should an attacker choose to use Sophos Antivirus as their conduit into your network, Sophos will simply not be able to prevent their continued intrusion for some time, and you must implement contingency pans to handle this scenario if you choose to continue deploying Sophos."

A security researcher at Google, Ormandy stressed that his report and comments were entirely his, and not those of his employer.

With marked improvements in the security of browsers and Adobe's Reader and Flash applications, it wouldn't be surprising for attackers, particularly well-funded ones targeting a specific corporation or government agency, to turn their attention to AV programs. The detailed interactions AV programs have with browsers and sensitive operating system regions means there's plenty of opportunity.

It's unclear if Ormandy has analyzed the security of other antivirus products so he can arrive at an assessment of how they compare to Sophos. He didn't respond to an e-mail seeking comment for this post.

E-mail shines in Windows 8 with radical overhaul of mail client

E-mail shines in Windows 8 with radical overhaul of mail client:

The Windows 8 Consumer Preview comes with a pre-installed e-mail client for webmail and Exchange. While it's designed with the touch-friendly Metro interface in mind, it's quite usable even in traditional desktop mode, at least for the basic tasks of reading and writing messages.

Windows 8 Mail is an alternative to the mail client in Windows Live Essentials, a free productivity suite for download on the stable versions of Windows in use today. Microsoft has not yet released a Windows 8-specific version of Outlook, the fee-based, business-class e-mail client that is part of Office. A beta version of "Office 15" is expected this summer, Office President Kurt DelBene said this week.

Impressions: Windows Sysinternals Administrator's Reference

Impressions: Windows Sysinternals Administrator's Reference: Mark Russinovich and Aaron Margosis have written another awesome addition to the Microsoft Press catalog, Windows Sysinternals Administrator's Reference. Per my policy, because I did not read the whole book I am only posting "impressions" here and not a full Amazon.com review.
In brief this book will tell you more about the awesome Sysinternals tools than you might have thought possible. One topic that caught my attention was using Process Monitor to summarize network activity (p 139). This reminded me of Event Tracing for Windows and Network Tracing in Windows 7. I remain interested in this capability because it can be handy for incident responders to collect network traffic on endpoints without installing new software, relying instead on native OS capabilities.
I suggest keeping a copy of this book in your team library if you run a CIRT. Thorough knowledge of the Sysinternals tools is a great benefit to anyone trying to identify compromised Windows computers.
Tweet

Copyright 2003-2011 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)

Windows Log Parsing

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=24659 – logparser 2.2 from MS

http://martin77s.wordpress.com/2010/01/16/evtlogparser/ - someone wrote an overlay for logparser

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=18465 – EventCombMT is what I used to use.

http://www.eventid.net/ - this is good if trying to find esoteric event codes

Thanks Charles!

PaperCut 11.5 is now available for download

PaperCut 11.5 is now available for download:

Cashier Updated!

Along with usual collection of enhancements and fixes comes PaperCut Web Cashier. This feature will be useful for educational institutions and other organisations who want to offer a simple mechanism for users to purchase good and services, such as binding, using PaperCut accounts. As well as purchasing items, users can also make over the counter deposits.

Behind the scenes at PaperCut we have new staff member in Australia. Alec is joining the team as a technical project manager and many customers will get to hear from him over time. Not only he is already planning the next release but also committing code to our Subversion repo (using git-svn). Even the project managers need to be geeks here! Alec’s details have already been added to the about page so head on over if you want to see his important qualifications in coffee appreciation.

The full list of changes in version 11.5 can be found on the release history pages:

• PaperCut NG Release History
• PaperCut MF Release History

Photo credit: Ivy Dawned. CC Licensed

Geektool and Todotxt Desktop

I recently started using Geektool on my Mac for my background. I can't say enough about it. It really makes my desktop look nice. Apple should really look at incorporating this into the operating system if they haven't already.

One thing I have done that I haven't seen on many other examples is using the Todotxt todo list application for displaying my Todo list right on my desktop. I have it set to update every 30 seconds so it keeps things up to date and lets me know what to do next.

Just create a shell tool and have it run todo.sh. It is very simple and easy with no custom scripts or tools. Using custom shell scripts you could create many lists that display different projects, locations and priorities.

Here are a couple examples.

Tasks to do around the house:
todo ls @home

Stuff to do at work:
todo ls -@home

Buddhist task list:
todo ls @monastery + renunciation +harmlessness +goodwill

Another Malware Victim

Yesterday I had a visit from a family friend and of course, they brought along an infected laptop. His daughter's new Toshiba laptop was all shiny and fresh out of the box but it just wasn't working like it used to. Of course not; it had over 50 infections of various breeds of malware and trojans.

This was a brand new PC running the latest version of Windows and fully patched. There were two well known AV programs installed not to mention Microsoft Security Essentials.  The reason she was infected is simple: "click this box to save the world".  No amount of security in the world will protect people from their own infallible minds.  We can try to protect people from all sorts of threats in the world; virus, terrorists, crime, even taxes but in the end we are all victims of our own gullible minds. Let's face it, if bad people can design a web page to look legit, they can just as easily make an application look identical to any number of seemingly safe applications. One errant click and "it's goodbye Seattle" --Steve Martin. 

Microsoft Security Scanner is a frequently updated tool (it is only valid for 10 days) that can be downloaded and copied to an infected system either in safe mode or from a secondary boot method. This tool should find and remove most malware or virus.

PuTTY version 0.61 is released

PuTTY version 0.61 is released
------------------------------

All the pre-built binaries, and the source code, are now available
from the PuTTY website at

    http://www.chiark.greenend.org.uk/~sgtatham/putty/

It's been more than four years since 0.60 was released, and we've had
quite a lot of email asking if PuTTY was still under development, and
occasionally asking if we were even still alive. Well, we are, and it
has been! Sorry about the long wait.

New features in 0.61 include:

- Support for SSH-2 authentication using GSSAPI, on both Windows and
   Unix. Users in a Kerberos realm should now be able to use their
   existing Kerberos single sign-on in their PuTTY SSH connections.
   (While this has been successfully deployed in several realms, some
   small gaps are known to exist in this functionality, and we would
   welcome further testing and advice from Kerberos experts.)

- On Windows: PuTTY's X11 forwarding can now authenticate with the
   local X server, if you point it at an X authority file where it can
   find the authentication details. So you can now use Windows PuTTY
   with X forwarding and not have to open your X server up to all
   connections from localhost.

- On Windows: the Appearance panel now includes a checkbox to allow
   the selection of non-fixed-width fonts, which PuTTY will coerce
   into a fixed-width grid in its terminal emulation. In particular,
   this allows you to use GNU Unifont and Fixedsys Excelsior. (Thanks
   to Randall Munroe for a serious suggestion that inspired this.)

- On Unix: the GTK port now compiles with GTK version 2, which is
   generally shinier and in particular provides access to client-side
   scalable fonts. (Though, unlike some GTK 2 applications, we have
   retained support for old-style X11 server-side bitmap fonts too.)

   Some Linux distributions have been shipping pre-release versions of
   GTK 2 PuTTY for years, so this won't be a surprise to anyone using
   Unix PuTTY or pterm via Debian or Ubuntu. But this is the first
   official release containing that functionality.

- A small but important feature: you can now manually tell PuTTY the
   name of the host you expect to end up talking to, in cases where
   that differs from where it's physically connecting to (e.g. when
   port forwarding). If you do this, the host key will be looked up
   and cached under the former name.

- Assorted optimisation and speedup work. SSH key exchange should be
   faster by about a factor of three compared to 0.60; SSH-2
   connections are started up in a way that reduces the number of
   network round trip delays; SSH-2 window management has also been
   revised to reduce round trip delays during any large-volume data
   transfer (including port forwardings as well as SFTP/SCP).

- Support for OpenSSH's security-tweaked form of SSH compression (so
   PuTTY can now use compression again when talking to modern OpenSSH
   servers).

- Support for Windows 7's new user interface features. The new Aero
   window management should now play nicely with PuTTY's complicated
   window resize handling, and Windows 7 jump lists are now supported
   so you can launch saved sessions directly from the taskbar.

Bug fixes include:

- Better support for importing OpenSSH private keys in PuTTYgen: we
   now support key files encrypted with AES, and we cope with keys
   whose primes are listed in the opposite order from the one we
   expect.

- Corruption of data transferred over port forwardings is _probably_
   fixed (though there is the possibility that it was due to more than
   one bug, so we want to hear about it if it's still happening).

- Crashing when the server unexpectedly closes the network connection
   should be fixed. On Windows Vista and 7, PuTTY also no longer goes
   into a tight loop in this situation.

- PSCP and PSFTP should no longer hang on exit in some failure cases.

- On Windows: fixed a hang in the serial port back end.

- On Windows: PuTTY reads from the clipboard in a separate thread
   from its main one, which fixes a deadlock when trying to cut and
   paste into PuTTY from an X11 application or Remote Desktop session
   tunnelled through the same instance of PuTTY.

- Many, many other bug fixes.

Enjoy using PuTTY!

Sophos offers Free Anti-Virus Home Edition for Mac

Sophos offers Free Anti-Virus Home Edition for Mac: "World's first free business-strength security solution for Macs."

Five awesome Automator tips

Five awesome Automator tips: "Think Apple’s built-in automation tool, Automator, is more trouble than it's worth? Think again. Not only can Automator perform wondrous feats, but with these tips it's also easy to make it happen."

Blackboard to Buy Two Education-Software Companies—Elluminate and Wimba

Blackboard to Buy Two Education-Software Companies—Elluminate and Wimba:
Blackboard has a habit of acquiring an education-technology company every year, but this year it bought two—both of which offer similar services.

Home Computing Necessities

I have updated the Home Computing box on the right. It now contains links to suggested software for any home.

Firefox: For the safest browsing around. Make sure to set your history to clear on exit. See below for suggested addons.

Adblock Plus: The Web has never looked better (and safer).

Noscript: I am always stunned at the number of sites wanting to run a script on my machine. You will be too.

OpenDNS: If you have kids on the web, this is a great resource for protecting them from errant clicks. And saving you from hours of re-installing software.

The rest of the links are great resources for Home Computing. Feel free to write if you have any questions or suggestions.

Save Disk Space in OS X: Monolingual

I am always amazed at how much space the Multi-Lingual files take up when installing OS X (let's not mention the print drivers). So why should I be surprised when I save so much space using this application? It managed to trim off 2.3GB in just a few minutes. That's not a lot in this era of 500GB drives but every little bit helps. That's a whole movie burned to disk!

I know I should be ashamed for using the default install in the first place. Like everyone who gets a new MacBookPro I was a little eager to start using it. The last thing I wanted to do was wait for a new install. Now if it was a new Dell it would be a different story. I have no qualms about booting right from a DVD when a new Dell shows up.

http://monolingual.sourceforge.net/

Thanks Tyler!

Google Toolbar Tracks Your Browsing, Even When Off

Are we supposed to be surprised? Isn't this what it's designed to do?

---

Google Toolbar Tracks Your Browsing, Even When Off: "garg0yle writes 'Google's Toolbar is supposed to allow the user to disable it. However, it was discovered by a researcher that it was still sending information even when disabled. A patch is now available, and Google claims this was just a bug, not a feature.'

Microsoft Steady State

For years I have replied upon the Faronic's product, DeepFreeze, for supporting public computer labs. Recently I found Microsoft Steady State and it looks promising. One of the problems I recently ran into with DeepFreeze was the lack of interaction with the operating system. This can be good in some cases but bad in others. I am hoping that Microsoft has solved some of these issues Steady State seeing as they have pretty good access to the code. Hopefully I can post some results here when I get the chance.

Online Charts and Diagrams

Lovely Charts is a great online resource for creating a number of quality online flowcharts, network diagrams and the like. The free account allows you to save one project on the site. You can still create new projects and save/export them as much as you like. You can only save one though. If you update your account (for a very reasonable fee) you can save many projects and edit them online.

It's a very useful tool for those of us who rarely dabble in the art of network diagrams and flowcharts but sometimes need a graphic to support an idea to upper management. Let's face it, Visio just isn't worth it and there are few substitutes. This is a great one.