Password creation – Tips and Myths

Not all use complex password. Us humans tend to use simple (read very simple) words for passwords (such as password) for most non critical logins, gets deep into our system of using passwords and becomes a habit (which is pretty hard to break). This causes lots of unwanted issues when the third party system (which obviously we trust) leaks the passwords or the hashes (any type. Strength is not a problem). Some advocates state that a hashing should be used with a salt, but does not really improve the security if the database gets compromised and the salt values are known to attacker.

Most of the common password cracking aka brute forcing tools has an option to specify the salt to check. It really does not improve any security if the user uses “password” as the password. The top passwords list is tried first to crack the so obvious accounts within seconds and a larger dictionary is employed for the rest. With the advent of CUDA / OpenCL the time to brute has reduced leaps and bounds. I have written a password cracker in CUDA which can crack some hashes like NTLM at a whopping hashes per second. Though it is used only for private use, I am sure more such tools like HashCat / oclHashCat which are available freely can be employed by any one who has a decent hardware or it can be rented from the cloud.

What really secures the password? Okay. Do not say the answer is the Google Ring! I will not use it! Instead the following might be of some help. Though I might not be the expert (disclaimer!!!), I have been following what I am going to preach.

Not all passwords with special characters are safe if it is less than 14 characters. Common, a 14 character key space is not strong enough even if it employs special characters. Believe me, there are only a few special characters which most people use! :D. Armed with a little background on the frequency analysis, the keyspace gets drastically reduced lowering the security of the so called complex password.

A simple method of using longer, totally unrelated (but meaningful to you) sentences make a very good password. And it exceeds the common character limitation which you will find in a normal complex password. Multiply that by the number of sites for which you have use a unique password, only a tool like LastPass can offer some help! Even a sentence like “Attendingevening.school” can be a good password which is not forgotten, can be typed easily and offers a pretty decent security. Also, typing such passwords on to the mobile device is very easy! believe me!

Also always check out the password’s strength using some online tool like PasswordMeter!

Placing a random dot between words makes a lot of sense and improves the security. Really you don’t have to worry above the bla bla bla password policies and will still conform to most of the commonly used policies (Unless you are in a super special sterile environment!). I hope it makes a difference!

Be sure to checkout the Password Info graphic from ZoneAlarm! A pretty interesting read too on what not to use!

Diving into windows registry for forensic data

As a forensic examiner, looking at a cloned system for possible timestamps of a drive-by-download attack, windows registry has some small foot holes to gather evidence (real or not). Atleast, will surely give an idea about how, when the attack has happened. Trusting the system time was intact and all the sole purpose for this exercise was to learn, having a look at registry keys armed with some freeware tools provide some data. Correlation plays a key role in identifying how and when the devices were connected to the system.

Freeware tools used to achieve the above are:
USB Device Viewer - A tool which provides a complete history of all removable devices connected to a Windows based host.
http://www.nirsoft.net/utils/usbdeview.zip

Direct Registry Browser from
http://www.sysdevsoftware.com/soft/dreg.php which can be used to browse the registry in case of offline image based forensic analysis.

Registry Browser from SoftSpot Software.
http://www.softspotsoftware.com/pages/downloads/RegBrowser.zip which can be used to view the timestamps on the registry key. There is a Nirsoft tool to view the same, but I prefer using this software.

And lastly, the infamous ProcMon from Microsoft Sysinternals Lab.
The latest version can be downloaded from http://live.sysinternals.com/Procmon.exe
It can used to get knowledge about the registry keys being accessed during the use of the above tools.
Tip: Set a filter on the process names to reduce the output while using the above tools.

The rest is left as an exercise to the readers (??!!!) as how find out the usb devices connection time and et all!

Happy forensics!

Installing IE8 without the usual update process, scanning and et all!

I recently had a requirement where I had to test an application in Internet Explorer 8, but the rig had only Windows XP SP2 with IE6. When tried installing IE8 using the official installation, it was prompting to install a bunch of updates, malware scanning and was taking forever. Thought for a moment and tried the following steps which worked:

• Downloaded the IE8 installation from Microsoft.com
• Used the Universal Extracter and extracted the IE8 installer executable to a directory
• Copied the complete extracted directory to a thumbdrive and moved it to the testing rig
• Executed the iesetup.exe inside the update directory

Double clicked on the iesetup.exe and voila! Internet Explorer Installation screen greeted with the usual update option. Neglected the warning, options and clicked on install Internet Explorer 8.

After a few minutes, the system requested a reboot and IE8 was up and running.

 

While I was happy to have the system updated with IE8, it is definitely not recommended unless one knows what he/she are doing. Please read the above procedural steps with standard disclaimer and warning!
It might cause system instability / security issues will still be open and is not recommended at all. This post for documentation purposes only and to have an artifact that it can done!

If you require help in locating universal extractor, try  http://legroom.net/software/uniextract and it is free. Please scan the files if you download from any other sources.

IE8's official links are:
Windows XP (32 Bit): http://download.microsoft.com/download/C/C/0/CC0BD555-33DD-411E-936B-73AC6F95AE11/IE8-WindowsXP-x86-ENU.exe
Windows XP (64 Bit) : http://download.microsoft.com/download/7/5/4/754D6601-662D-4E39-9788-6F90D8E5C097/IE8-WindowsServer2003-x64-ENU.exe
Windows Vista (32 Bit): http://download.microsoft.com/download/F/8/8/F88F09A2-A315-44C0-848E-48476A9E1577/IE8-WindowsVista-x86-ENU.exe
Windows Vista (64 Bit) : http://download.microsoft.com/download/D/C/F/DCF5DACB-313F-40C6-889C-AD1F8546099D/IE8-WindowsVista-x64-ENU.exe
Windows Server 2003 (32 Bit) : http://download.microsoft.com/download/7/5/0/7507EBD5-0193-4B7F-9F14-9014C7EB5C67/IE8-WindowsServer2003-x86-ENU.exe
Windows Server 2003 (64 Bit) : http://download.microsoft.com/download/7/5/4/754D6601-662D-4E39-9788-6F90D8E5C097/IE8-WindowsServer2003-x64-ENU.exe
Windows Server 2008 (32 Bit) : http://download.microsoft.com/download/F/8/8/F88F09A2-A315-44C0-848E-48476A9E1577/IE8-WindowsVista-x86-ENU.exe
Windows Server 2008 (64 Bit) : http://download.microsoft.com/download/D/C/F/DCF5DACB-313F-40C6-889C-AD1F8546099D/IE8-WindowsVista-x64-ENU.exe

Happy days!

Truecrypt 7.0 gets Hardware Acceleration and more

Truecrypt - The free open source encryption tool which gives many commercial encryption tool providers to run for their money has once again proved it's worthiness! Just released Version 7.0 has got some really commendable features such as Hardware-accelerated AES, Auto Mounting of the encrypted volumes and partition/device-hosted volumes to utilise different sectors sizes. Though hardware-accelerated AES is currently applicable only for Intel Core i5 and Intel Core i7 processors, it is worthwhile to enable it because it provides up to 4-8 times faster performance compared to the normal open source version of the AES implementation.
It uses the embedded AES-NI (aka "AES New Instructions") instruction set for performing the crypto operations, but it is clear that the key generation does not use the AES-NI Instructions. (Thank god! :))
Check out more from http://www.truecrypt.org/
Use this amazing tool to safe guard your data be it confidential or not! You'll agree with me if you have the habit of carrying your portable Operating systems, Tools sets, Working data and Documents on multiple USB thumb drives wherever you go/roam! :)

Netsparker provides Free Web Application Vulnerability Scanner! No strings attached!!

While companies charge a hefty amount for web vulnerability scanners, Netsparker has made a difference by offering one of the best vulnerability scanner for free! (Free as in Free Beer! :)) No strings attached. The community edition of Netsparker Web Application vulnerability scanner is available for download. The community version too boasts the unique features of the commercial edition which includes False Positive Free, Javascript / AJAX / Web 2.0 support, SQL Injection, Cross Site Scripting.

It can be downloaded from: http://www.mavitunasecurity.com/communityedition/download/ site.

Metasploit 3.4.1 Released!

Metasploit - One of the most widely used penetration testing framework has released the Version 3.4.1 with adding 16 exploits, 22 auxiliary modules, and 11 meterpreter scripts. All 587 exploit modules have been updated to include the Disclosure Date field. Major features added since 3.4.0 include the RAILGUN meterpreter extension by Patrick HVE and the PHP Meterpreter payload by egypt. The Windows installer now ships with support for PostgreSQL database backends.

Get it from: http://www.metasploit.com/

v3.4.1 Release notes (copied from the above site):

Statistics

• Metasploit now has 567 exploits and 283 auxiliary modules (up from 551 and 261 in v3.4)
• Over 40 community reported bugs were fixed and numerous interfaces were improved

General

• The Windows installer now ships with a working Postgres connector
• New session notifications now always print a timestamp regardless of the TimestampOutput setting
• Addition of the auxiliary/scanner/discovery/udp_probe module, which works through Meterpreter pivoting
• HTTP client library is now more reliable when dealing with broken/embedded web servers
• Improvements to the database import code, covering NeXpose, Nessus, Qualys, and Metasploit Express
• The msfconsole "connect" command can now speak UDP (specify the -u flag)
• Nearly all exploit modules now have a DisclosureDate field
• HTTP fingerprinting routines added to some exploit modules
• The psexec module can now run native x64 payloads on x64 based Windows systems
• A development style guide has been added in the HACKING file in the SVN root
• FTP authentication bruteforce modules added

Payloads

•  Some Meterpreter scripts (notably persistence and getgui) now create a resource file to undo the changes made to the target system.
• Meterpreter scripts that create logs and download files now save their data in the ~.msf3/logs/scripts folder.
• New Meterpreter Scripts:
• enum_firefox - Enumerates Firefox data like history, bookmarks, form history, typed URLs, cookies and downloads databases.
• arp_scanner - Script for performing ARP scan for a given CIDR.
• enum_vmware - Enumerates VMware producst and their configuration.
• enum_powershell - Enumerates powershell version, execution policy, profile and installed modules.
• enum_putty - Enumerates recent and saved connections.
• get_filezilla_creds - Enumerates recent and saved connections and extracts saved credentials.
• enum_logged_on_users - Enumerate past users that logged in to the system and current connected users.
• get_env - Extracts all user and system environment variables.
• get_application_lits - Enumerates installed applications and their version.
• autoroute - Sets a route from within a Meterpreter session without the need to background the sessions.
• panda_2007_pavsrv53 - Panda 2007 privilege escalation exploit.
• Support for a dns bypass list added to auxiliary/server/fakedns. It allows the user to specify which domains to resolve externally while returning forged records for everything else. Thanks to Rudy Ruiz for the patch.
• Railgun - The Meterpreter "RAILGUN" extension by Patrick HVE has merged and is now available for scripts.
• PHP Meterpreter - A protocol-compatible port of the original Meterpreter payload to PHP. This new payload adds the ability to pivot through webservers regardless of the native operating system
• Token impersonation now works with "execute -t" to spawn new commands with a stolen token.

Known Issues

•  Interacting with a meterpreter session during a migration will break the session. See #1360.
• There is no simple way to interrupt a background script started by AutoRunScript
• Command interaction on Windows causes a PHP Meterpreter session to die. See #2232 
• 
  

Using NK2Edit to edit Oulook Autocomplete entries

When Outlook is used as an email client, at times, there might arise a need to edit the auto complete entries while selecting users. If any of the attributes needs to be changed in the selected email addresses or if an old entry needs to be removed, Microsoft has not provided any direct method. In such cases Nirsoft's NK2Edit comes in handy.
It can be used to edit the outlook's .NK2 files for any duplicate entries, stale entries, or for modifying any existing entries.
It can be downloaded from : http://www.nirsoft.net/utils/outlook_nk2_edit.html page.

Information from the site:

Every time that you type an email address or name in the message window of MS-Outlook, it automatically offer you a list of users and email address that you can choose. This feature is known as 'AutoComplete' and Outlook automatically build this emails list according to user activity and save it into a file with .NK2 extension.

In some circumstances, you may need to repair or modify the values appeared in the AutoComplete list, or you may want to remove unwanted email addresses and/or to add new email addresses. MS-Outlook doesn't provide any ability to edit this AutoComplete list, so this is where NK2Edit software can help you.

NK2Edit Features
Easily modify or fix all information stored in the NK2 file, including the display name, the email address, the exchange string, the Drop-Down display name, and the search string.
Easily remove unwanted single quote characters from the display name and from the Drop-Down list.
Delete unwanted emails, as well as add new emails, by typing them manually, or by choosing them from the address book of Outlook.
Copy NK2 records from one NK2 file to another - simply by copy and paste !
Build a completely new NK2 file and add the desired emails into it, by typing them manually, by adding them from your address book, or by copying records from another NK2 file.
Extract data from corrupted NK2 files that Outlook cannot read anymore (When Outlook AutoComplete stopped working) and even repair them so Outlook will be able to read them again.
Export all data stored in the NK2 file into a special Unicode text file in a stucture similar to .ini file of Windows. You can open it any text editor you like, make the changes you need, and then convert it back into NK2 file that Outlook can use.
Export the emails information stored inside NK2 file into HTML/Text/csv/xml file.
Copy the selected NK2 records in tab-delimited format and then paste the information into Excel.
Change the order of the records in the NK2 file, which also affects the order they appear in the drop-down. You can also sort the list in alphabetical order of the Drop-Down display names. (However, be aware that Outlook change the order again when the user send emails)
Command-Line Support: Write simple scripts that can add, remove, or modify records inside the NK2 file, without displaying any user interface.
NK2Edit is a portable application that can be used from any computer with Windows operating system (Starting from Windows 2000) without need of any installation process, and without making changes in the Registry.

System Requirements
NK2Edit works on any version of Windows, starting from Windows 2000 and up to Windows 7/2008. NK2Edit is a Unicode based application, and thus it cannot work under Windows 95/98/ME.
NK2Edit can read, write, and create NK2 files for Outlook 2003, Outlook 2007, and Outlook 2010 Beta.
Outlook installation is not required on the computer that you run NK2Edit, except of "Add Records From Address Book" feature, which cannot work without Outlook. NK2Edit can also be used to open, edit, and save NK2 files on remote computers in your network, as long as you have read/write permission to the remote NK2 file.