feed on feeds - 2016/10/31 - items 0 to 15

Google drops a zero-day on Microsoft: Web giant goes public with bug exploited by ha SANS ISC SecNewsFeed(cached at October 31, 2016, 11:30 pm)

I just spent a fair bit of time preparing to take the GIAC Security Expert exam as part of the requirement to recertify every four years. I first took the exam in 2012, and I will tell you, for me, one third of the curriculum is a use it or lose it scenario. The GSE exam covers GSEC, GCIH, and GCIA. As my daily duties have migrated over the years from analyst to leadership, I had to relearn my packet analysis fu. Thank goodness for the Packetrix VM and the SANS 503 exercises workbook, offsets, flags, and fragments, oh my! All went well, mission accomplished, Im renewed through October 2020 and still GSE #52, but spending weeks with my nose in the 18 course books reminded of some of the great tools described therein. As a result, this is the first of a series on some of those tools, their value, and use case scenarios.

Ill begin with snapshot.ps1. Its actually part of the download package for SEC505: Securing Windows and PowerShell Automation, but is discussed as part of the GCIH curriculum. In essence, snapshot.ps1 represents one script to encapsulate activities specific to the SANS Intrusion Discovery Cheat Sheet for Windows.

The script comes courtesy of Jason Fossen, the SEC505 author, and can be found in the Day 5-IPSec folder of the course download package. The script dumps a vast amount of configuration data for the sake of auditing and forensics analysis and allows you to compare snapshot files created at different times to extract differences.

To use snapshot.ps1 place the script into a directory where it is safe to create a subdirectory as the script creates such a directory named named for the computer, then writes a variety of files containing system configuration data. Run snapshot.ps1 with administrative privileges.

The script runs on Windows 7, Server 2008, and newer Windows operating systems (I ran it on Windows 10 Redstone 2) and requires PowerShell 3.0 or later. You also need to have autorunsc.exe and sha256deep.exe in your PATH if you want to dump what programs are configured to startup automatically when your system boots and you login, as well as run SHA256 file hashes. That said, if you must make the script run faster, and I mean A LOT FASTER, leave file hashing disabled at the end of the snapshot.ps1 for a 90% reduction in run time. However, Jason points out that this is one of the most useful aspects of the script for identifying adversarial activity. He also points out that toolsmith #112: Red vs Blue - PowerSploit vs PowerForensics, after importing PowerForensics, you could add something like Get-ForensicTimeline | Sort-Object -Property Date | Where-Object { $_.Date -ge 12/30/2015 -and $_.Date -le 01/04/2016 } | WriteOut -FileName Timeline which would give you a file system timeline between the 12/30/2015 and 01/04/2016.But wait, theres more! Want to get autoruns without needing autorunsc.exe? Download @p0w3rsh3lls AutoRuns module, run Import-Module AutoRuns.psm1, then Get-Command -Module AutoRuns to be sure the module is on board, and finally comment out autorunsc.exe -accepteula -a -c | Out-File -FilePath AutoRuns.csv then add Get-PSAutorun | WriteOut -FileName AutoRuns.

th c:\ -Hidden -Recurse -ErrorAction SilentlyContinue | Select-Object FullName,Length,Mode,CreationTime,LastAccessTime,LastWriteTime | Export-Csv -Path FileSystem-Hidden-Files.csv. The resulting CSV is like a journey down evil memory lane, where all the nuggets I">|">@holisticinfosec (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

I just spent a fair bit of time preparing to take the GIAC Security Expert exam as part of the requirement to recertify every four years. I first took the exam in 2012, and I will tell you, for me, one third of the curriculum is a use it or lose it scenario. The GSE exam covers GSEC, GCIH, and GCIA. As my daily duties have migrated over the years from analyst to leadership, I had to relearn my packet analysis fu. Thank goodness for the Packetrix VM and the SANS 503 exercises workbook, offsets, flags, and fragments, oh my! All went well, mission accomplished, Im renewed through October 2020 and still GSE #52, but spending weeks with my nose in the 18 course books reminded of some of the great tools described therein. As a result, this is the first of a series on some of those tools, their value, and use case scenarios.

Ill begin with snapshot.ps1. Its actually part of the download package for SEC505: Securing Windows and PowerShell Automation, but is discussed as part of the GCIH curriculum. In essence, snapshot.ps1 represents one script to encapsulate activities specific to the SANS Intrusion Discovery Cheat Sheet for Windows.

The script comes courtesy of Jason Fossen, the SEC505 author, and can be found in the Day 5-IPSec folder of the course download package. The script dumps a vast amount of configuration data for the sake of auditing and forensics analysis and allows you to compare snapshot files created at different times to extract differences.

To use snapshot.ps1 place the script into a directory where it is safe to create a subdirectory as the script creates such a directory named named for the computer, then writes a variety of files containing system configuration data. Run snapshot.ps1 with administrative privileges.

The script runs on Windows 7, Server 2008, and newer Windows operating systems (I ran it on Windows 10 Redstone 2) and requires PowerShell 3.0 or later. You also need to have autorunsc.exe and sha256deep.exe in your PATH if you want to dump what programs are configured to startup automatically when your system boots and you login, as well as run SHA256 file hashes. That said, if you must make the script run faster, and I mean A LOT FASTER, leave file hashing disabled at the end of the snapshot.ps1 for a 90% reduction in run time. However, Jason points out that this is one of the most useful aspects of the script for identifying adversarial activity. He also points out that toolsmith #112: Red vs Blue - PowerSploit vs PowerForensics, after importing PowerForensics, you could add something like Get-ForensicTimeline | Sort-Object -Property Date | Where-Object { $_.Date -ge 12/30/2015 -and $_.Date -le 01/04/2016 } | WriteOut -FileName Timeline which would give you a file system timeline between the 12/30/2015 and 01/04/2016.But wait, theres more! Want to get autoruns without needing autorunsc.exe? Download @p0w3rsh3lls AutoRuns module, run Import-Module AutoRuns.psm1, then Get-Command -Module AutoRuns to be sure the module is on board, and finally comment out autorunsc.exe -accepteula -a -c | Out-File -FilePath AutoRuns.csv then add Get-PSAutorun | WriteOut -FileName AutoRuns.

th c:\ -Hidden -Recurse -ErrorAction SilentlyContinue | Select-Object FullName,Length,Mode,CreationTime,LastAccessTime,LastWriteTime | Export-Csv -Path FileSystem-Hidden-Files.csv. The resulting CSV is like a journey down evil memory lane, where all the nuggets I">|">@holisticinfosec (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

An anonymous reader quotes a report from Ars Technica: The Federal Communications Commission has given a helping hand to Louisville, Kentucky, in the city's attempt to enforce local rules that would make it easier for Google Fiber to compete against ATT. ATT sued the local government in Louisville and Jefferson County in February to stop a One Touch Make Ready (OTMR) ordinance designed to give Google Fiber or other new competitors faster access to utility poles. Today, the US government submitted a statement of interest (full text) on behalf of the FCC, which says that one of ATT's primary legal arguments is incorrect. ATT -- also known as BellSouth Telecommunications in Kentucky -- argued that the Louisville ordinance is preempted by the FCC's pole-attachment rules. The local ordinance "conflicts with the procedures created by the FCC, and upsets the careful balances struck by the FCC in crafting its pole attachment regulations," ATT's lawsuit said. But that is false, the FCC says. The FCC does have rules ensuring reasonable access to utility poles, but states are allowed to opt out of the federal pole-attachment rules if they certify to the commission that they regulate the rates, terms, and conditions of pole attachments. Kentucky is one of 20 states that has opted out of the federal regime and imposed its own rules, the FCC noted. Accordingly, the federal pole-attachment regulations enacted under Section 224 [of the Communications Act] simply do not apply here," the FCC wrote. More generally, One Touch Make Ready rules are consistent with federal communications policies and regulations that seek expanded broadband deployment, the FCC also wrote.

Read more of this story at Slashdot.

This is the moment in the science fiction book when the alien spacecraft reveal their presence over the major cities of Earth.

Archaeological remains at wetland sites across the world could be at risk of being degraded and lost to environmental change, say scientists.

Ken Segall, a long-time adviser to Apple, has some harsh words for the Siri Remote bundled with the fourth-generation Apple TV. He likens it to the infamous “hockey puck” mouse included with the original iMac since both are overly symmetrical, pointing out that it’s difficult to know which way you’re holding the Siri Remote, especially in a dim room. He also criticizes its touchpad for being both too easy to engage accidentally and not as accurate as traditional directional buttons. However, Segall hopes that, as with the iMac mouse, Apple eventually sees the error of its ways and redesigns the Siri Remote.

Read the full article at TidBITS, the oldest continuously published technology publication on the Internet. To get a full-text RSS feed, help support our work and become a TidBITS member! Members also enjoy an ad-free version of our Web site, email delivery of individual articles, the ability to make long comments with live links, and discounts on Take Control orders and other Apple-related products.

Ken Segall, a long-time adviser to Apple, has some harsh words for the Siri Remote bundled with the fourth-generation Apple TV. He likens it to the infamous “hockey puck” mouse included with the original iMac since both are overly symmetrical, pointing out that it’s difficult to know which way you’re holding the Siri Remote, especially in a dim room. He also criticizes its touchpad for being both too easy to engage accidentally and not as accurate as traditional directional buttons. However, Segall hopes that, as with the iMac mouse, Apple eventually sees the error of its ways and redesigns the Siri Remote.

Read the full article at TidBITS, the oldest continuously published technology publication on the Internet. To get a full-text RSS feed, help support our work and become a TidBITS member! Members also enjoy an ad-free version of our Web site, email delivery of individual articles, the ability to make long comments with live links, and discounts on Take Control orders and other Apple-related products.

Many people are angry about Apple’s special event last week, mainly due to Apple ignoring desktop Macs, but also because of the new MacBook Pros lacking a dedicated Esc key, having only Thunderbolt 3 ports, and being limited to 16 GB of RAM. But Apple veteran Chuq Von Rospach has penned a reasoned response to all those critiques, suggesting that Apple could have avoided much of the controversy simply by acknowledging desktop Macs and hinting at future updates. But Rospach says the bottom line is that the Mac is increasingly becoming a niche product again, and many of Apple’s design decisions reflect that.

Read the full article at TidBITS, the oldest continuously published technology publication on the Internet. To get a full-text RSS feed, help support our work and become a TidBITS member! Members also enjoy an ad-free version of our Web site, email delivery of individual articles, the ability to make long comments with live links, and discounts on Take Control orders and other Apple-related products.

Many people are angry about Apple’s special event last week, mainly due to Apple ignoring desktop Macs, but also because of the new MacBook Pros lacking a dedicated Esc key, having only Thunderbolt 3 ports, and being limited to 16 GB of RAM. But Apple veteran Chuq Von Rospach has penned a reasoned response to all those critiques, suggesting that Apple could have avoided much of the controversy simply by acknowledging desktop Macs and hinting at future updates. But Rospach says the bottom line is that the Mac is increasingly becoming a niche product again, and many of Apple’s design decisions reflect that.

Read the full article at TidBITS, the oldest continuously published technology publication on the Internet. To get a full-text RSS feed, help support our work and become a TidBITS member! Members also enjoy an ad-free version of our Web site, email delivery of individual articles, the ability to make long comments with live links, and discounts on Take Control orders and other Apple-related products.