Exploit Update

Why do I work so hard to bolster the defense-in-depth of our home Windows systems?

• like keeping the browsers updated to their most current patch level?
• like keeping all the third-party plug-ins updated to their most current patch level?
• like running EMET, and Malwarebytes Anti-Exploit, and AV/AM software all at the same time?
• like keeping our Windows OS’s religiously patched?

Because all it takes is tripping onto just one “good/trustworthy” website that has been exploited to serve up malware to a vulnerability and your system could be compromised and hosed.

• Jamieoliver[dot]com still compromised, now drops digitally signed malware - Malwarebytes Unpacked

More web exploits and attempts to stem the tide by the pros…

• Report: all major download sites serve potentially unwanted programs - gHacks Tech News
• VIRLOCK Combines File Infection and Ransomware - Security Intelligence Blog by Trend Micro
• MSRT March: Superfish cleanup - Microsoft Malware Protection Center TechNet Blog
• Upatre update: infection chain and affected countries - Microsoft Malware Protection Center TechNet Blog
• Malware Snoops Through Your Home Network - Security Intelligence Blog by Trend Micro
• BSides Austin 2015 and Malware Analysis Training – Malwarebytes Unpacked

Constant Vigilance!

--Claus Valca

Harmonizing EMET and MBAE

In the GSD post “Anti-Virus Software Update - GSD Thoughts” I outlined the layered security approach I generally take on our Windows systems.

My layered use of the following products meets my own household needs but may not be adequate for less-than-advanced users.

1. Free Firewall Software by GlassWire - Monitors and logs network connections…more used for logging than “active firewall blocking”.
2. Sysmon - Sysinternals core service to log application/network executions
3. Enhanced Mitigation Experience Toolkit - EMET - TechNet Security
4. Microsoft Security Essentials - Microsoft Windows - Core AV protection
5. Malwarebytes Premium - Supplemental real-time AV/AM protection
6. (Optionally) Malwarebytes Anti-Exploit - Free Zero-Day Exploit Protection - browser layer protection

What I failed to clearly explain in that list is the following potential “gotcha” one may trip over.

Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) – while generally very compatible both with Malwarebytes and Malwarebytes Anti-Exploit (MBAE) – seems to prevent smooth launching of the Internet Explorer web-browser when both are using default settings.

On both my Win 7 x64 and Lavie’s Win 8.1 x64 systems Firefox, Chrome/Chromium, and Vivaldi browsers all seem to work just fine with EMET and MBAE running…though I just keep to the default EMET configurations on install and don’t specifically add custom protection for Firefox/Chrome/Vivaldi to EMET. Internet Explorer (iexplore.exe) is included in the default EMET protection. And the free version of MBAE protects Firefox, Chrome, Internet Explorer and Opera browsers.

Many MBAE users recommend just skipping (or uninstalling) EMET but I find they do compliment each other nicely with the exception of Internet Explorer so I continue to run them together at the same time. With the following conditions noted below.

On Lavie’s Windows 8.1 system I actually - though great trial and error – arrived at a combination of EMET iexplore.exe protection feature checks/unchecks to get IE running smoothing with no issues along site MBAE. (When I can get Lavie’s laptop away from her, I’ll update this post with a screen shot of her Windows 8.1 MBAE configuration.)

On both my Windows 7 systems I just punted and disabled EMET protection for Internet Explorer entirely as I almost never use IE myself and will just trust MBAE to cover the EMET opening I’ve created with that strategy.

Likewise if you have the paid version of MBAE, you could optionally disable the IE protection in MBAE and leave the EMET protection in place; the free version doesn’t allow adding of processes or disabling of protections.

There are some Malwarebytes MBAE forum threads that try to address the tweaking of EMET more methodically.

• Running EMET and MBAE together - News, Questions and Comments - Malwarebytes Forum

Again, I managed to do that on Lavie’s Win 8.1 system and will eventually get around (probably) to either confirming the configuration for iexplore.exe in EMET 5.1 noted in the forum post above. Or I will find the combo that works on my Win 7 systems and post an update here as well.

In case you are curious to know if MBAE is actually protecting  your system, they do offer a series of tests files you can use to trigger the MBAE protection alert for validation.

• How to verify that MBAE is working correctly - Anti-Exploit Product Support - Malwarebytes Forum

In case you are curious, while working on researching this post, I found a few notices that a new version of Malwarebytes Anti-Malware (2.1) will be on the way soon. It is currently available in a Beta form if you are daring.

• Malwarebytes Anti-Malware 2.1.x Beta - Malwarebytes Anti-Malware 2.1 Beta - Malwarebytes Forum
• Malwarebytes Anti-Malware 2.1 to ship with UI changes and feature improvements - gHacks Tech News

I’m looking forward to the changes and promised performance improvements.

Finally, in case you are interested, the Vivaldi browser I’ve been crushing on lately isn’t included in the free-version of MBAE protection. Again, if I was using the paid version, I’m pretty sure I could add the exe file to the list manually to provide customized protection. I imagine it should play well as it is based on Chrome/Chromium which does get protected by MBAE via its chrome.exe host process coverage.

I did pop into the Protection for new browsers - News, Questions and Comments Malwarebytes Forum and did the responsible thing by asking for vivaldi.exe to be added to the default protected browser list in MBAE.

Time will tell.

Cheers,

Claus Valca

Threat Watch Linkfest

Here is a smattering of linkage for threats that caught my attention recently.

MITM/Superfish threats

• Extended Validation Certificates - Warning Against MITM Attacks – TrendLabs Security Intelligence Blog
• EFF unearths evidence of possible Superfish-style attacks in the wild - Ars Technica
• Zero Day Weekly: Superfish attacks, FBI GameoverZeus bounty, Komodia in Lavasoft - ZDNet
• Lenovo promises to cut the crapware in the wake of Superfish debacle - Ars Technica

Thoughts on a VNC-based network probe

It’s not a good sign when the help desk starts getting calls from users asking why IT is trying to remote to their systems with a new “VNC” product. It’s especially not good when IT doesn’t use that product and is not making blanket network connections to our customers.  Someone better tell the little Dutch boy to go stick his finger in the perimeter dyke! 

Some users selected “OK” to allow the remote connection thinking it was the local IT shop. Most did not.

Data has been collected from the incident and I was able to identify some IOC’s to use to go back and search out other systems where users may have selected “OK” but didn’t call in afterward that they had taken the bait.

Looking at logs from some of those systems, it appears that although a remote connection window was presented to the user, the application logs register the inbound connection but do not indicate that a connection was successfully opened to the user’s system, despite the dialog window presentation and the user clicking “OK”.  More research/incident-triage would be beneficial but the order came in to wipe/reimage these systems immediately so…there we are.

My guess (and without additional information it is just an educated guess) is that something got left open on the perimeter, an automated ip/port scan for VNC got by and triggered the local VNC responses seen. The actual mechanism and tool used remains unclear.

Here are some articles and links about VNC-type based attacks for my reference and review.

• AGbot Attacks Internet VNC Servers - Fortinet Blog
• Remote Access Forensics for VNC and RDP on Windows Platform (PDF link) – Paresh Kerai with Edith Cowan University
• Tracing VNC And RDP Protocol Artefacts on Windows Mobile (PDF link) – Paresh Kerai with Edith Cowan University
• HowTo: Track Lateral Movement – Windows Incident Response blog
• VNC: Threats and Countermeasures - Dragon Research Group (DRG)
• ATLAS Attack Report: Global VNC network scanning activity – Arbor networks
• VNC Authentication - Metasploit Unleashed

Dyre Trojan New Variant

Dyre Targets More Websites - ThreatTrack Security Labs Blog – besides looking to steal banking credentials from infected systems, this variant now has expended to file hosting, job hunting, general commerce, and even some income tax service websites!

Previously noted on this GSD blog: Fighting a Hydra named Drye/Dyreza/Upatre

Crypto<insert-name-here>

• CryptoFortress, a TorrentLocker clone that also encrypts unmapped network shares – Bleeping Computer forums – This one is very interesting as it looks like it can connect to network shares not mapped to a drive letter and do file encryption. 
• New crypto ransomware in town : CryptoFortress - Malware don't need Coffee – Marc-Etienne M.Lévei
• CryptoFortress - Weblog Lexsi – in-depth analysis from Renaud Tabary
• Cryptowall ,again! - InfoSec Handlers Diary Blog

Turning the Tables

• Contemplating Malware Immunization via Infection Markers – Lenny Zeltser

Mr. Zeltser offers a very interesting approach to preventing malware infection of a system. By using known infection-markers and loading them into a clean system, he can inoculate the system from infection.  It uses the tendency of malware writers to check to see if a system is already compromised (or is virtualized) by looking at running processes, maybe registry keys, etc. If those indicators are present, they the payload delivery and infection gets skipped!  The thought here is that if you know what those are, drop the safe “bits” around a system, then when the malware attack comes it “passes-over” the system and the system stays clean.  Very clever indeed!

How Malware Generates Mutex Names to Evade Detection – SANS-ISC InfoSec Handler’s Diary – Great supplemental post to the above by Lenny Zeltzer

See also: Looking at Mutex Objects for Malware Discovery and Indicators of Compromise – SANS Digital Forensics and Incident Response blog – article by Lenny Zeltzer

Constant Vigilance!

Claus Valca

First (or Second) Pass AV/AM Scanner Tools

This past week at the church house, one of the secretaries reported some slowness on her system.

We did some troubleshooting and fixed a number of obvious issues, however the slowness persisted.

It was running Symantec AV and it had quarantined a few things. Those were deleted and removed, but time did not allow a second pass with a different AV/AM tool.

A few days later (and a few new SAV update packages) Symantec reported some more items were detected and quarantined.

I wasn’t able to get back to the system but another IT administrator at the church house did. This time Symantec reported finding a possible threat called “Kaeria Dust Remover”.

The core file name was “mvsbtej.exe” and here is some limited information on I was able to uncover:

• Malware scan of mvsbtsej.exe (Dust Remove) - herdProtect

To be sure things were cleaned, he installed (alongside Symantec) the 30-day trial of Kaspersky AV and kicked off a scan.

The user did report that once that malware was pulled off, the system performance returned to normal and things were so much better again.

While I don’t usually recommend installing more than one AV/AM product on a system at the same time (Malwarebytes excepted), if you aren’t planning on “nuking” a system (zero-out the drive, and reinstall the OS from source disks) it always is good to run a second or third AV scan from a different AV/AM vendor on a system.

There are some “standalone\light-install” and “cloud” based AV/AM scanners that can be used independently of the primary AV/AM software installed on a Windows system. I find these provide the perfect solution to getting a second/third opinion of a system’s post-infection status. Download or copy over to a system from a USB drive. Most do a temporary unpacking of the core scan engine files, may download the latest DAT files, and scan away. They typically quarantine anything they find, then you can delete the files once everything is done. 

Some other products pack the DAT files together with the scan engine. This can be handy if you don’t have a network connection either due to the attack or because you don’t want to place the system back on your network until you are sure it is remediated.

Then there are the cloud-based solutions than you can run and will upload the scan results to the vendor’s cloud server and match the files looking for issues. These may have a benefit of using the newest signature detection patterns available.

And by being “standalone\light-install” tools, the impact/conflict with an already-installed AV/AM product might be minimized.

• Bitdefender Adware Removal Tool for PC – Bitdefender (hat tip to Next of Windows)
• VIPRE Rescue - VIPRE Computer Recovery Solution – One of my favorite standalone AV/AM scan tools. Package/defs change daily.
• Kaspersky Removal Tool 2015 – Kaspersky Labs.
• See also this link: How to run a scan task in Kaspersky Virus Removal Tool 2015
• Kaspersky Virus Removal Tool 2011 – Kaspersky Labs
• Malicious Software Removal Tool (MRT) - Microsoft Safety & Security Center
• Microsoft Safety Scanner – Microsoft
• eScanAV Anti-Virus Toolkit (MWAV) - eScan
• Emsisoft Free Emergency Kit: Portable malware scanner – Emsisoft
• ERA (ESET Rogue Applications) Remover - ESET
• PC Cleaner - Avira Download Center (look at the bottom of the list)
• Stinger - McAfee Free Tools
• Software Removal Tool – Google – Mostly useful against Google browser hijacks

And here are some “cloud-based” AV/AM scanners. They typically still download some components to the local system before doing the threat-analysis work in the cloud.

• Bitdefender 60-Second Virus Scanner – Bitdefender
• Panda Security Tools - Panda Security. Panda Cloud Cleaner/Portable + with bootable versions as well
• Norton Security Scan - Norton
• HouseCall Antivirus - Trend Micro USA
• Free Internet Security Scan - Kaspersky Lab US
• Online Virus Scanner - ESET
• Comodo Cleaning Essentials (CCE) – Comodo
• herdProtect Anti-Malware - Reason Company Software Inc.

For a deeper look

• grand stream dreams: Anti-Malware Response “Go-Kit”
• grand stream dreams: “Advanced” Anti-Rootkit Tool List - Mostly Modern

Cheers,

--Claus Valca

Anti-Virus Software Update - GSD Thoughts

Quick post.

I’ve been doing some PC support for friends and family these past few weeks.

Some have had expired ($) AV products on their systems and weren’t getting current DAT downloads. Others were running good free solutions.

I’ve continued to use Microsoft Security Essentials on all our home systems coupled with a paid version of Malwarebytes Anti-Malware. I also run EMET so there is that.

I liked Bitdefender Antivirus Free when I ran it on my primary laptop at home for a while, but the whitelisting management was frustrating, particularly with my special tools that are often treated as PUP’s.

So I pondered this How to Install Free, Effective Antivirus Software (for Beginners) - post at Lifehacker that recommended Bitdefender Free again for general users and Avast Free for advanced users.

I then encountered an installation of Avast (2014) Free that one of those family members had on a PC they brought me. I upgraded it to Avast 2015 Free so it was current and generally liked what I saw.

It seems to have been since forever when I posted Freeware Anti-Virus Solutions for Windows so that led to this updated quick-reference post for Freeware AV solutions.

First, I recommend starting with the following resources to get some understanding of AV products and their general ratings/evaluations.

• AV-Comparatives Summary-Report - Dec 2014 - AV-Comparatives
• ICSA Labs - Certified Products

Neither of these will point you magically to the “perfect” solution, but it will give you some background on the lay-of-the-land across different AV vendor products.

My layered use of the following products meets my own household needs but may not be adequate for less-than-advanced users.

1. Free Firewall Software by GlassWire - Monitors and logs network connections…more used for logging than “active firewall blocking”.
2. Sysmon - Sysinternals core service to log application/network executions
3. Enhanced Mitigation Experience Toolkit - EMET - TechNet Security
4. Microsoft Security Essentials - Microsoft Windows - Core AV protection
5. Malwarebytes Premium - Supplemental real-time AV/AM protection
6. (Optionally) Malwarebytes Anti-Exploit - Free Zero-Day Exploit Protection - browser layer protection

However, if all this is too much, and I had to offer alternative AV/AM freeware products for family or friends, here is what I would go with:

• Bitdefender Antivirus Free
• Avast 2015 Free  (see this post that I found interesting: AVAST: NG causes high CPU load)
• AVG AntiVirus FREE
• Comodo for Virus Removal
• ClamWin Free Antivirus
• Microsoft Security Essentials (already mentioned above)
• Malwarebytes Free Anti-Malware (note that the free version doesn’t handle real-time protection/scanning. Only “on-demand” type of options. Still, even that offers a good backup tool to run manually.

I don’t tend to lean to the “Cloud-AV” protection camp, however, these cloud-based free AV/AM products might be worth considering.

• Avira Free Antivirus & Avira Protection Cloud
• Panda Cloud Antivirus Free
• Immunet™ Free Antivirus

Not directly related but I saw news this week that Google and Microsoft are working to create better whitelists for good files.

• Microsoft, Google join forces to tackle antivirus false flags - ZDNet
• Microsoft steps up in industry efforts on mitigating false positives - Microsoft Malware Protection Center
• Inside VirusTotal's pants: A first shot at false positives - VirusTotal Blog

Constant Vigilance!

--Claus Valca

Patch, Patch, Patch!

One of the biggest battles (and headaches) I find is trying to keep friends and family’s systems safe and secure (not to mention those at work).

One of the easiest ways to help fight that good fight is to keep web-browsers updated and ensure that any third-party plug-ins (Flash, Shockwave, Java, Air, Silverlight, etc.) are also kept current and fully patched.

Of course, there are additional tips like firewalls, AV/AM software layers, OS updating, and maybe focused OS security overlays such as Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) and Malwarebytes Anti-Exploit (MAE).

But again, the primary infection vector for most of the home/SOHO users I support comes though their web-browser. Certainly avoiding dodgy sites is a good place to start with protecting yourself online, but how do you know a site is dodgy? And most average PC user’s have never heard about malvertising and malware served via ads on trusted websites.

So, my web-browser/plug-in advice (and support to them) remains constant,

1. If your web-browsing experience can live without Flash and Shockwave, ditch them!
2. Unless you need the Java framework specifically for business or school purposes, ditch it!
3. If you must have Flash, Shockwave, or Java installed on your system, keep it patched and ensure the options offered allow for automatic self-updating of the application.
4. Check often for updated versions of your browser. Firefox offers notices when new versions are available, Chrome/Chromium offers self/silent updating features, and Internet Explorer typically gets updated along with Windows patch releases.
5. Stop by Qualys BrowserCheck regularly in each of your browsers. A great tip is to set their site as (one of) your browser home pages. That way it will remind you to check every time you launch.
6. Install (sadly the on-line scan is discontinued) the Personal Software Inspector (PSI) from Secunia.

Need more convincing?

• Java Patch Plugs 19 Security Holes — Krebs on Security
• Flash Patch Targets Zero-Day Exploit — Krebs on Security
• Yet Another Emergency Flash Player Patch — Krebs on Security
• Yet Another Flash Patch Fixes Zero-Day Flaw — Krebs on Security (this was the 3rd Flash patch release in two weeks!)

And if you are uninformed or just curious how the browser exploit works, here are some timely articles that showcase the process/threat.

• Low Hanging Fruit: Flash Player - F-Secure Weblog
• Major malvertising campaign spreads Kovter Ad Fraud malware – Malwarebytes Unpacked blog (note: this one surprised even me as one of my browser home-pages is set to “chron.com” which is listed among the affected websites!)
• Trend Micro Discovers New Adobe Flash Zero-Day Exploit Used in Malvertisements - TrendLabs Security Intelligence Blog
• New Flash zero-day targets Windows, Mac users – ZDNet Zero Day blog
• A Closer Look at the Exploit Kit in CVE-2015-0313 Attack - TrendLabs Security Intelligence Blog
• Analyzing CVE-2015-0313 - The New Flash Player Zero Day - TrendLabs Security Intelligence Blog
• BEDEP Malware Tied To Adobe Zero-Days | Security Intelligence Blog - TrendLabs Security Intelligence Blog
• HanJuan EK fires third Flash Player 0day - Malwarebytes Unpacked blog
• Universal XSS flaw in fully patched Microsoft Internet Explorer exposed – ZDNet Zero Day blog
• Internet Explorer Cross-Site Scripting Vulnerability Now Public - TrendLabs Security Intelligence Blog

All this leaves commentaries like this much stronger in their warning cry…

• Time To Die: Let's Resolve To Get Rid Of Flash Already - ReadWrite

Stay patched and stay safe!

--Claus Valca

Super-Scale ForSec Linkpost

I think this post is going to have the same number of URLs as Christmas tree ornaments and mantle decorations that I hung and set out this afternoon. That’s to say there are a lot, and I am quite behind when considering the calendar.

I’ve been collecting these for at least two months and there are too many now to continue to put off posting them for reference. I’ve tried to group them somewhat for consistency in theme.

Exploits

• POWELIKS Levels Up With New Autostart Mechanism – TrendLabs Security Intelligence Blog
• YARA Registry Scanner - Didier Stevens Videos – example is with poweliks.
• Operation Pawn Storm: Putting Outlook Web Access Users at Risk – TrendLabs Security Intelligence Blog
• Banking Trojan Targets South Korean Banks; Uses Pinterest as C&C Channel – TrendLabs Security Intelligence Blog – This was interesting as it used information seeded in Pintrest “comments” for command and control.
• Malvertising hits ‘The Times of Israel’ and ‘The Jerusalem Post’, redirects to Nuclear Exploit Kit - Malwarebytes Unpacked
• IRS phone scammers double up their efforts for the holidays - Malwarebytes Unpacked
• Here, Vishy Vishy… - Malwarebytes Unpacked
• Malware Detected by Malwarebytes Anti-Malware 2014-11-16 – MoonPoint Software blog
• Scan of Windows system with Malwarebytes Anti-Malware on 2014-12-07 – MoonPoint Software blog
• Rogue E-Books Could Pose Threat to Amazon Accounts - Malwarebytes Unpacked

Advice and Guidance

• You got the well-paid IT Security job. Now what? – Hexacorn blog
• Do you have a Data Breach Response Plan? – SANS Infosec Community Forums
• How to Track Your Malware Analysis Findings – Sans Digital Forensics and Incident Response blog
• The Human and Process Elements of an Incident Response Plan - Speaking of Security RSA blog
• Scalable Incident Response Strategies - Speaking of Security RSA blog
• Security Done the Right Way: Adaptive Defense - FireEye Blog
• Has your threat feed made you lazy – Handler Diaries
• Why breaches happen under IR teams noses – Hexacorn blog
• The 3 stages of 3ages – Hexacorn blog

AV/AM

• CryptoPrevent v7.3.x - Improved Protections and New Features! - Foolish IT LLC
• CryptoPrevent: Does it work on the NEW Crypto-whatever? - Foolish IT LLC
• Bitdefender Offers CryptoWall Vaccine – Bitdefender Labs
• Bitdefender releases free CryptoWall Immunizer – BetaNews
• Vinsula releases free tool to brute force ZeroLocker decryption keys – Bleeping Computer News
• Microsoft cloud protection - Microsoft Malware Protection Center blog
• Close means close: New adware detection criteria - Microsoft Malware Protection Center blog
• Staying in control of your browser: New detection changes - Microsoft Malware Protection Center blog
• Microsoft antimalware to lock down system settings - ZDNet
• The art of disrespecting AV (and other old-school controls) – Hexacorn blog
• The art of disrespecting AV (and other old-school controls), Part 2 – Hexacorn blog
• Researchers test EMET 5 protections, find them wanting – Help Net Security news

Analysis

• Two Sides to Every Story: Advanced Analytics in Security - Speaking of Security RSA blog
• The Targeted Forensics Series: Confirming Remote Desktop Connections (Part 1 of 2) - Speaking of Security RSA blog
• The Targeted Forensics Series: Confirming Remote Desktop Connections (Part 2 of 2) - Speaking of Security RSA blog
• Registry Analysis with CrowdResponse - Forensic Methods
• RegRipper v2.8 is now on GitHub - Windows Incident Response
• Windows Event Logs - Windows Incident Response
• Tr3Secure Collection Script Updated – Journey Into Incident Response
• Timeline Analysis by Categories – Journey Into Incident Response
• Prefetch File Meet Process Hollowing – Journey Into Incident Response
• CSIRT Request Tracker Installation Guide – Journey Into Incident Response
• File History Research - Part 1 - Random Thoughts of Forensics
• File History, Research - Part 2 - Deconstructing the Catalog. - Random Thoughts of Forensics
• Introducing Filescanner.exe - Didier Stevens
• FileScanner.exe Part 2 - Didier Stevens
• FileScanner.exe Part 3 - Didier Stevens
• FileScanner.exe Part 4 - Didier Stevens
• PDF Tools - Didier Stevens
• PDF Creation – Public Tools - Didier Stevens Videos
• Five Anti-Debugging Tricks That Sometimes Fool Analsysts - Malwarebytes Unpacked
• Beyond good ol’ Run key, Part 18 – Hexacorn blog
• Beyond good ol’ Run key, Part 19 – Hexacorn blog
• 3R updated to cover new RegRipper plug-ins – Hexacorn blog
• Regulex & Visualized regexes – Hexacorn blog
• Decompiling compiled AutoIT scripts (64-bit) – Hexacorn blog

Web Security

• Does an insecure website compromise the security of a payment system in an iframe? - Troy Hunt’s blog
• Watching “Have I been pwned?” Pastebin notifications in action - Troy Hunt’s blog
• “Have I been pwned?” – now with RSS! - Troy Hunt’s blog
• Introducing paste searches and monitoring for “Have I been pwned?” - Troy Hunt’s blog
• LinkedIn Feature Exposes Email Addresses - Krebs on Security
• Website Security - RSS Reveals Malware Injections - Sucuri Blog

Network Bits

• Bitdefender's BOX hardware protects your entire home network, not just your PC – PCWorld – Yes, we have now reached the point where network perimeter defense appliances have reached the home market. I expect this will be just the tip of a new round of such devices.
• Detecting irregular programs and services installed in your network - InfoSec Handlers Diary Blog
• Flushing out the Crypto Rats - Finding "Bad Encryption" on your Network –InfoSec Community Forums
• The Easy-to-Miss Basics of Network Defense - TrendLabs Security Intelligence Blog
• Verifying Chinese MITM of Yahoo - NETRESEC Blog
• toolsmith: HoneyDrive - Honeypots in a Box - HolisticInfoSec

In the Library (mostly whitepapers)

Note: Many of these are PDF links and will open in your web-browser as a PDF…

• (IN)SECURE Magazine issue 44 released – Help Net Security News
• The whitepapaer and .pdf presentation slides for GRR: Find All the Badness, Collect All the Things – Black Hat 2014
• Security Visibility in the Enterprise – SANS Reading Room (PDF link)
• MalwareD: A study on network and host based defenses that prevent malware from accomplishing its goals. – SANS Reading Room (PDF link)
• Forensic Images: For Your Viewing Pleasure – SANS Reading Room (PDF link)
• Home Field Advantage - Using Indicators of Compromise to Hunt down the Advanced Persistent Threat – SANS Reading Room (PDF link)
• A Guide on How to Find Cardholder Data without Automated Tools for PCI Assessors – SANS Reading Room (PDF link)
• Validating Security Configurations and Detecting Backdoors in New Network Devices – SANS Reading Room (PDF link)
• Creating a Threat Profile for Your Organization – SANS Reading Room (PDF link)
• Security Operations Centre (SOC) in a Utility Organization – SANS Reading Room (PDF link)
• Hardening Retail Security – SANS Reading Room (PDF link)
• Breaches Happen: Be Prepared – SANS Reading Room (PDF link)
• Finding the Advanced Persistent Adversary – SANS Reading Room (PDF link)
• Forensicator FATE - From Artisan To Engineer – SANS Reading Room (PDF link)
• Intelligence-Driven Incident Response with YARA – SANS Reading Room (PDF link)
• Security Skills Assessment and Training: The Critical Security Control that can make or break all others – SANS Reading Room (PDF link)
• Evidence Collection From Social Media Sites – SANS Reading Room (PDF link)

Live CD News

• CAINE Live USB/DVD - CAINE Computer Forensics Linux Live Distro
• CAINE 6.0 Dark Matter 64bit released! – CAINE Computer Forensics Linux Live Distro

Whew!

Cheers!

--Claus Valca

Shellshock/Bash-bug News and Linkage

Yes, it has been that kind of a week.

Here is my picks of news and link summaries for the Shellshock/Bash-bug exploit that hit the InterWebs this past week.

Again, like BadUSB, it pays to be familiar with these exploits and trends even if you “think” you are safe in a Windows environment.

Everything you need to know about the Shellshock Bash bug - Troy Hunt’s blog. And to address that “We’re on Windows so we are safe” thought, let me quote directly from Troy’s post above:

All our things are on the Microsoft stack, are we at risk?

Short answer “no”, long answer “yes”. I’ll tackle the easy one first – Bash is not found natively on Windows and whilst there are Bash implementations for Windows, it’s certainly not common and it’s not going to be found on consumer PCs. It’s also not clear if products like win-bash are actually vulnerable to Shellshock in the first place.

The longer answer is that just because you operate in a predominantly Microsoft-centric environment doesn’t mean that you don’t have Bash running on machines servicing other discrete purposes within that environment. When I wrote about Heartbleed, I referenced Nick Craver’s post on moving Stack Overflow towards SSL and referred to this diagram of their infrastructure:

There are non-Microsoft components sitting in front of their Microsoft application stack, components that the traffic needs to pass through before it hits the web servers. These are also components that may have elevated privileges behind the firewall – what’s the impact if Shellshock is exploited on those? It could be significant and that’s the point I’m making here; Shellshock has the potential to impact assets beyond just at-risk Bash implementations when it exists in a broader ecosystem of other machines.

FREE Pluralsight Course: Understanding the Shellshock Bash Bug - Troy Hunt’s blog. Troy offers a free 35+ minute training presentation going over the Shellshock Bash Bug. It should be a great review that everyone in the security or IT administration community should take advantage of.

The anatomy of a Shellshock attack in the wild - Troy Hunt’s blog.

So what harm could be done? Um…plenty.

• New bash bug could wreak havoc on Linux and OS X systems - Malwarebytes Unpacked
• Website Security - Shell Shock Vuln Actively Attacked - Sucuri Blog
• Shellshock a Week Later: What We Have Seen - SpiderLabs Anterior
• Shellshock in the Wild - FireEye Blog
• Inside Shellshock: How hackers are using it to exploit systems - CloudFlare blog
• Concern over Bash vulnerability grows as exploit reported “in the wild” [Updated] - Ars Technica
• Bash Vulnerability (Shellshock) Exploit Emerges in the Wild, Leads to BASHLITE Malware - Trend Micro’s Security Intelligence Blog
• Shellshock attacks spotted in wild [Updated Sept 26] - Zscaler Research
• The Shellshock Aftershock for NAS Administrators - FireEye Blog

Even more reading…

• Bash Vulnerability Leads to Shellshock: What it is, How it Affects You - Trend Micro’s Security Intelligence Blog
• ‘Shellshock’ Bug Spells Trouble for Web Security - Krebs on Security
• HP Security Research: GNU Bash vulnerability "Shellshock" (CVE-2014-6271) - HP Enterprise Business Community
• Shellshock - How Bad Can It Get - Trend Micro’s Security Intelligence Blog
• The Bash Bug Makes Every Mac Vulnerable; Here's How To Patch It - ReadWrite
• New “Shellshock” patch rushed out to resolve gaps in first fix [Updated] - Ars Technica
• Still more vulnerabilities in bash? Shellshock becomes whack-a-mole - Ars Technica

Constant Vigilance!

Claus Valca

BadUSB News and Linkage

I first noticed news about BadUSB in late July. A smattering of articles were appearing in my RSS feed.

I read them with curiosity but don’t believe I actively posted anything about them.

However, recent new events and at least one security software counter release that I am aware of (so far) have led me to go back into the RSS feed archives.

At the very basic level, someone using the BadUSB vector would modify (almost any) USB device firmware to execute very low-level code. Detection may be possible, but could be very difficult using current techniques. A common attack code examples used would be a keylogger, replicating network-card behavior for exploitation, and malware delivery.

The initial POC presentation was offered at the Black Hat USA 2014 conference “BadUSB - On Accessories that Turn Evil” by Karsten Nohl and Jakob Lell. Presentation from YouTube below and here.

This appears to be a summary from their website: Turning USB peripherals into BadUSB - Security Research Labs

And here is are the presentation slides.

Nohl and Lell did not release the modified firmware but did provide POC for Android devices.

However, just this past week, a different team did release source code for a BadUSB-like exploit. According to the Wired article linked below, this team did so to get the security community going on developing on detection/protection methods and for the USB standards that allow this exploit to be closed.

Considering the ubiquitous nature of USB devices, this will be no small task.  I expect to see either epoxy filled USB ports experience a fashion revival or even computing hardware (laptops/desktops/etc.) models that come sans USB ports entirely.

• The Unpatchable Malware That Infects USBs Is Now on the Loose - WIRED
• Thanks GitHub! Now Anyone Can Download This Unpatchable USB Malware - ReadWrite
• Sourcecode for "unpatchable" USB exploit now on Github - Boing Boing
• Researcher release BadUSB attack code - Help Net Security
• Known Unpatchbarer exploit for BadUSB (GTranslated) - Borns IT and Windows Blog
• BadUSB tools circulating on the Net, Attack Stick Build Your Own (GTranslated) - heise online

Here is some earlier and digestible linkage about the BadUSB concept as a security threat.

• USB firmware: An upcoming threat for home and enterprise users - Microsoft Malware Protection Center
• This thumbdrive hacks computers. “BadUSB” exploit makes devices turn “evil” - Ars Technica
• Why the Security of USB Is Fundamentally Broken - WIRED

My favorite USB brand, Kanguru, has come out with a statement about how their Kanguru Defender line of products isn’t impacted by BadUSB due to digitally signed secure firmware.

• Concerned about "BadUSB?" Don't Be. Kanguru Has You Covered - Kanguru Solutions

My only problem (so far) with these enhanced/encrypted high-security USB devices (like IronKey as well) is that I haven’t seen that you can make them into “bootable” USB devices for use with WinPE/WinFE type of configurations. While they can hold the data very secure, they can’t be used to load a bootable system onto and then “off-line” boot a target system. If anyone knows how to do so with IronKey or Kanguru Defender series device (even if limited to a specific model), please drop a reference/tip in the comments. I’d love to know!

Not to be outdone, one German company, G Data Software, has released a free anti-BadUSB software tool to help protect systems.

• USB KEYBOARD GUARD - G DATA Software, Inc.

According to my reading of the product description, running of the software before inserting a USB device allows it to benchmark the system state and then trigger an alert if a new keyboard device is detected loading when a USB device is connected. Initial access of the device is blocked allowing you to investigate before allowing.

I’ve not seen any “state-side” articles or postings about this software just yet, most all are German sourced but these may be a useful consideration. General consensus is that this is a kind and good first-effort by G DATA developers for basic attacks and that with time and contribution, a more hardened and expanded feature set of solutions could be developed.

• G Data BadUSB-Protector: Useful or snake oil? (Gtranslated) - Borns IT and Windows Blog
• Free G-Data tool protects against attacks BadUSB (Gtranslated) - heise online
• BadUSB: Free tool protection against new USB-gap (Gtranslated) - CHIP

So, time to add this threat to the watch-list, even if it isn’t likely to be that common for most folks, yet. For other high-value targets, it might be a nightmare just one seeded USB stick in the parking lot away.

Constant Vigilance!

Claus Valca

Mega malware-focused link-dump

OK.

Now we arrive at the malware-focused link-bin.  This one seems a bit all over the road despite my best efforts at categorizing them a bit.

• Improving Your Malware Forensics Skills - Journey Into Incident Response - Corey Harrell
• Intrusion Analysis Using Windows PowerShell - (PDF link) - SANS Institute Reading Room whitepaper by Michael J. Weeks.
• Creating a Baseline of Process Activity for Memory Forensics - (PDF link) - SANS Institute Reading Room whitepaper by Gordon Fraser.
• Malware Root Cause Analysis Dont Be a Bone Head Slide Deck - Journey Into Incident Response - Corey Harrell - Follow-on presentation to Corey’s Finding Malware Like Iron Man presentation.
  
• Malware Analysis with pedump - InfoSec Handlers Diary Blog
• Automating Malware Analysis with Cuckoo Sandbox - Malwarebytes Unpacked
• Using Sysinternals System Monitor (Sysmon) in a Malware Analysis Lab - SANS Digital Forensics and Incident Response Blog
• Signature Detection with CrowdResponse - Forensic Methods
• Mr Silverlight Drive-by Meet Volatility Timelines - Journey Into Incident Response - Corey Harrell
• The evolution of Rovnix: new Virtual File System (VFS) - Microsoft Malware Protection Center
• Lnk files in Email Malware Distribution - SpiderLabs Anterior
• PUPS are Persistent - Malwarebytes Unpacked
• Learning Exploitation with FSExploitMe - Open Security Research
  
• Keeping the RATs out: an exercise in building IOCs - Part 1 - InfoSec Handlers Diary Blog
• Keeping the RATs out: **it happens - Part 2 - InfoSec Handlers Diary Blog
• Keeping the RATs out: the trap is sprung - Part 3 - InfoSec Handlers Diary Blog
  
• OfficeMalScanner helps identify the source of a compromise - InfoSec Handlers Diary Blog
• Introducing Microsoft Threat Modeling Tool 2014 - The Security Development Lifecycle blog
• toolsmith: Microsoft Threat Modeling Tool 2014 - Identify & Mitigate - HolisticInfoSec blog
• Lorem Ipsum: Of Good & Evil, Google & China - Krebs on Security - Not at all related but very curious.

Cheers,

--Claus Valca

Ransomware News Updates

It has been quite a while since posting on ransomware trends.

Here is a quick roundup collected over the past few weeks.

CryptoPrevent v7.0 Released! - Foolish IT LLC - I really like the new interface of v7.x. It stays simple but can expand with additional more powerful options if needed. I continue to protect all of our home systems with this tool (and the layers of other av/am software as well). I highly recommend it for home users as an added level of prevention.

See also the unrelated Cryptolocker Prevention Kit (updated) from Spiceworks that offers an alternative protection solution. Get the download from here.

Finally, I kindly remind you of CryptoLocker Defense for Sysadmins - EventSentry Blog - new and interesting enterprise-class tool for detection of CryptoLocker threats.

Some rescue possible

FireEye and Fox-IT joined up and have started a free service that may allow some users infected with earlier variants of Cryptolocker to unlock their files at no cost.

• DecryptCryptoLocker - FireEye and Fox-IT
• New Site Recovers Files Locked by Cryptolocker Ransomware - Krebs on Security
• FireEye and Fox-IT tool can help recover Crilock-encrypted files - Microsoft Malware Protection Center blog
• FireEye, Fox-IT launch free service to combat Cryptolocker ransomware - ZDNet
• Decryption keys are now freely available for victims of CryptoLocker - Bleeping Computer News
• Free Service to Help CryptoLocker Victims by FireEye and Fox-IT - InfoSec Handlers Diary Blog

So is the ransomware threat gone? Hardly. If not gone, morphing into new variants, all the more dangerous.

• CryptoLocker ransomware intelligence report - Fox-IT International blog
• Meet CryptoWall, The New Ransomware Leader (with heatmap) - Spiceworks
• CryptoWall - A new ransomware from the creators of CryptoDefense - Bleeping Computer News
• Ransomware Race (Part 1): CryptoWall ups the ante - F-Secure Weblog : News from the Lab
• Ransomware Race (part 2): Personal media the next frontier? - F-Secure Weblog : News from the Lab
• Ransomware Race (Part 3): SynoLocker Under The Hood - F-Secure Weblog : News from the Lab
• Ransomware Race (Part 4): Adult Content, Browlock's Staying Power - F-Secure Weblog : News from the Lab
• Ransomware Race (part 5): SynoLocker's unkept promises - F-Secure Weblog : News from the Lab
• How-To-Decrypt PowerShell Ransomware flaw makes recovery impossible - Bleeping Computer News
• ZeroLocker - a new destructive encrypting ransomware - Bleeping Computer News

Continue to stay protected!

Cheers.

--Claus Valca

I’m sure there is a better way to accomplish this…

In my GSD blog post Anti-Malware Response "Go Kit" I outlined a variety of tool-sets and standalone tools that I carry on my USB flash drive for dealing with malware responses on friends/family systems.

Keeping the IR tool-sets (Confessor, MIR-ROR, rapier, TR3 Tool Kit v2, and triage-ir) updated is a lower priority for a number of reasons.

1. It’s a lot of work,
2. the developers often require (due to licensing) the end user (me and you) to download the supporting binaries directly from the developers’ sites, and
3. you always run the risk that a later utility update may break the way the scripts run on the package.

None of those are deal-breakers, but because of that, keeping those updated (aside from the main IR package) leads me to not update them as frequently, maybe once a quarter to biannually.

The ones that I do update frequently are the ones that are used to to sweeps for malware and/or viruses.

Most of these are signature based, and if they are updated, there there is a high likelihood a scan with an older tool may miss something critical!

So to keep them updated, I have a bookmark folder with URL links to all the tools. I then go down the list, click, download, copy to USB, rinse and repeat.

So yesterday I wondered if I could automate the process a bit. Kind of like a poor-man’s version of NirLauncher or KLS SOFT’s WSCC - Windows System Control Center.

I’m sure there is a better way to do this, but this was my “it works for me” result.  I’m not posting the actual files (at least in fullness for now) but will show you the basics so you can build your own if you want.

First, I considered (and may still go to) a process/script that uses Wget for Windows - GnuWin32.

But I wanted to start with what I knew (or thought I did) for now.

To get the ball rolling, I made a “landing zone” folder on my Windows system at C:\TEMP\AMW_Packages

This is where I wanted to download the updated files into. I wanted to keep it separate in case I decided I didn’t want to end up overwriting any of my previous files. So once all the packages are downloaded here, I will manually copy them over onto my USB drive folder where they reside full-time.

I then created a Windows BAT file called “a-AMW_Package downloader.bat”

It does a few things.

It deletes all the files/folders in the “C:\TEMP\AMW_Packages” location to get a clean start.

It then runs down a list of the utilities I need to get/update, and downloads them into the “C:\TEMP\AMW_Packages” folder using PowerShell. (I know! Cool!)

Then, there are some packages that have some fancy dynamic page tricks/EULA’s that make getting those binary files a bit of a hassle. Some of those I was able to work around with the PowerShell commands below. However others were not so cooperative. And that was OK.

So at the end of the BAT file, it calls a custom EXE called “a-BAT-IECall.exe”.  That file was a different PowerShell script block I came up with to open up all those “problem” site URL’s in a single Internet Explorer window session, each in a different tab; more on it in a bit.

The resulting automatically opened IE window allows me to review/download those “manually” as needed.  (I guess I could put it at the front so I could be manually downloading those as the script continues to run in the background. But this made sense to me. I also dropped some FYI URL pages as well there to remind me of some tricks I keep forgetting or to see if any new tools are available that I may want to add to my tool-kit.

Here is an abbreviated version of the BAT file “a-AMW_Package downloader.bat” contents. You should be able to get the gist of what I am doing and add more lines for other resources you may want/need.

:: Anti-Malware Response “Go-Kit” Downloader

:: Clean Up Download folder first

set folder="C:\Temp\AMW_Packages"
cd /d %folder%
for /F "delims=" %%i in ('dir /b') do (rmdir "%%i" /s/q || del "%%i" /s/q)

:: Now Let's Get the Files!

:: Process Explorer
powershell -Command "(New-Object Net.WebClient).DownloadFile('http://download.sysinternals.com/files/ProcessExplorer.zip', 'ProcessExplorer.zip')"
powershell -Command "Invoke-WebRequest http://download.sysinternals.com/files/ProcessExplorer.zip -OutFile C:\temp\AMW_Packages\ProcessExplorer.zip"

:: AutoRuns
powershell -Command "(New-Object Net.WebClient).DownloadFile('http://download.sysinternals.com/files/Autoruns.zip', 'Autoruns.zip')"
powershell -Command "Invoke-WebRequest http://download.sysinternals.com/files/Autoruns.zip -OutFile C:\temp\AMW_Packages\Autoruns.zip"

:: Microsoft Safety Scanner & Malicious Software Removal Tool  (+ download others manually in a bit)
powershell -Command "(New-Object Net.WebClient).DownloadFile('http://go.microsoft.com/fwlink/?LinkId=212732', 'msert.exe')"
powershell -Command "Invoke-WebRequest http://go.microsoft.com/fwlink/?LinkId=212732 -OutFile C:\temp\AMW_Packages\msert.exe"

::And so on, and so forth for all the other tools as needed

:: Trend Micro Anti-Threat Toolkit  (download manually in a bit)
:: VIPRE Rescue (download manually in a bit)
:: AdwCleaner (download manually in a bit)
:: ComboFix (download manually in a bit)
:: Rootkit Buster - x86 - Trend Micro  (download manually in a bit)
:: System Explorer (download manually in a bit)

:: Misc Tools and Utilities (Now we fire up IE via a PowerShell script) so we can launch IE and the link URLs in tabs for manual download if we need them.

a-BAT-IECall.exe

Exit

Just add more of those download lines for all the tools you need as long as the URL download links are functional with this method.

So next, about that “a-BAT-IECall.exe”

This took a bit of creative work to generate.  There are other ways to launch IE in a standard BAT file, but it ended up opening each URL in a separate IE window that cluttered up my system, despite my best attempts. So this way worked perfectly, and because: PowerShell!

The PowerShell script that is the heart of the engine looks like this:

$ie = New-Object -ComObject InternetExplorer.Application
$ie.Navigate2("http://systemexplorer.net/download.php")
$ie.Navigate2("http://www.vipreantivirus.com/live/",0x1000)
$ie.Navigate2("https://toolslib.net/downloads/viewdownload/1-adwcleaner/",0x1000)
$ie.Navigate2("http://www.bleepingcomputer.com/download/combofix/",0x1000)
$ie.Navigate2("http://www.bleepingcomputer.com/forums/t/403413/cannot-execute-exe-reg-regedit/",0x1000)
$ie.Navigate2("http://free.antivirus.com/us/rootkit-buster/index.html",0x1000)
$ie.Navigate2("http://www.microsoft.com/security/scanner/en-us/default.aspx",0x1000)
$ie.Navigate2("http://www.microsoft.com/en-us/download/malicious-software-removal-tool-details.aspx",0x1000)
$ie.Navigate2("http://windows.microsoft.com/en-us/windows/what-is-windows-defender-offline",0x1000)
$ie.Navigate2("http://esupport.trendmicro.com/solution/en-us/1059509.aspx",0x1000)
$ie.Navigate2("http://support.kaspersky.com/viruses/utility",0x1000)
$ie.Navigate2("http://firesage.com/mbrwizard.php?x=4x",0x1000)
$ie.Navigate2("http://freeofvirus.blogspot.com/2009/05/remove-fake-antivirus-10.html",0x1000)
$ie.Navigate2("http://www.bleepingcomputer.com/download/rkill/",0x1000)
$ie.Navigate2("http://www.bleepingcomputer.com/download/unhide/",0x1000)
$ie.Navigate2("http://www.bleepingcomputer.com/download/windows/security-utilities/",0x1000)
$ie.Navigate2("http://support.microsoft.com/kb/299357",0x1000)
$ie.Visible = $true
stop-process $PID
#

Add/remove/change URLs accordingly.

To create the EXE version for this PowerShell script to include the call to in your main BAT file:

1. Edit the PowerShell script block above to add/change/remove any URLs
2. Save it somewhere for quick future re-editing.
3. Launch the PowerGUI Script Editor.
4. Create a new workspace tab.
5. Copy those lines into it.
6. From the menu bar select “Tools” then “Compile Script…”
7. Select where you want to save it...should be same place as the “a-AMW_Package downloader.bat” BAT file…and what name you want to give it, for me I used “a-BAT-IECall.exe”
8. I left the Target framework set at “Microsoft .NET Framework 4.0” for my system.
9. I guess you could give it a cool custom icon if you wanted. I didn’t for now.
10. Select “OK” and let it build!
11. Close stuff out when done.
12. Find/test! (see result below)

Now, when I want to update my IR package tools, I just fire off the main BAT file and away it rips, leaving me to manually download just a few packages myself -- if desired -- from IE.

Misc Notes and references.

I wasn’t aware until composing this post that the PowerGUI project appears to have been taken over by Dell: Welcome to the New Home of PowerGUI. OK.

I’m sure there are WAY BETTER ways to deal with this with Wget, PowerShell, BAT files, but this works and I learned a lot in the process. I’m open to recommendations/suggestions.

The PowerShell commands in the BAT file are pretty flexible.

powershell -Command "(New-Object Net.WebClient).DownloadFile('URL-path-for-binary.file', 'binary.file’)"
powershell -Command "Invoke-WebRequest URL-path-for-binary-file -OutFile C:\temp\AMW_Packages\binary.file"

This one is straight forward with the pattern:

:: AutoRuns
powershell -Command "(New-Object Net.WebClient).DownloadFile('http://download.sysinternals.com/files/Autoruns.zip', 'Autoruns.zip')"
powershell -Command "Invoke-WebRequest http://download.sysinternals.com/files/Autoruns.zip -OutFile C:\temp\AMW_Packages\Autoruns.zip"

I was able to make changes to some of the “binary.file” names to change the name as it got saved, and in some cases the URL path didn’t actually contain a binary.file name in the path but it still handled it OK. Once you have the format down you can experiment a bit. See below for one example:

:: Microsoft Safety Scanner & Malicious Software Removal Tool  (+ download others manually in a bit)
powershell -Command "(New-Object Net.WebClient).DownloadFile('http://go.microsoft.com/fwlink/?LinkId=212732', 'msert.exe')"
powershell -Command "Invoke-WebRequest http://go.microsoft.com/fwlink/?LinkId=212732 -OutFile C:\temp\AMW_Packages\msert.exe"

Here are the URL’s of many of the sites/tips I reviewed to get me to this stage, and a few that I wanted to do but couldn’t quite get to work like I wished.

• Windows batch file file download from a URL - Stack Overflow - it was from the entry by “sevenforce” on Dec 9, 2013 that got me the started with using PowerShell for the download method selected.
• Batch file. Delete all files and folders in a directory - Stack Overflow - it was the script provided by morty346 on Oct 12, 2013 that got my folder cleanup section working.
• How to launch multiple Internet Explorer windows/tabs from batch file? - Stack Overflow - It was good in theory and I played with “ruste84”s method but never could get it to open in one IE session with multiple tabs…although this would have been easier.
• Opening multiple URLs in new tabs using batch file Solved - Windows 7 Help Forums
• IE: How to open multiple web links with a single shortcut? - Tom’s Hardware forums
• Batch Command to Open Two Tabs in IE - TechNet
• Batch Commands - to open multiple URL in one Internet Explorer in one tab - Stack Overflow - At this point I was getting ready to give up.
• Using PowerShell to open several tabs on start up - Super User - This was a new lead!
• Start daily programs – More n00bz fun with #Powershell! - The MidnightDBA Star-Times - Jen McCown’s script here was the clincher. I just took part of her script section dealing with the URL opening, experimented a bit to get it to flow better, and I was off to the races! Thanks Jen!
• Open Internet explorer 8 (and its tabs) using Powershell? -TechNet
• How to close active PowerShell Window, upon script completion. - TechNet - Now I had to get my PowerShell script window closed!
• Force powershell.exe console to exit from a script - TechNet
• Exit-PSSession - TechNet
• This command (as you saw above) was the trick “stop-process $PID” followed by a comment “#” on the next line so that one above would execute…and close the window.
• How to execute powershell commands from a batch file? - Stack Overflow - so I was originally trying to just add my PowerShell commands to open IE/URL-tabs directly in the BAT file…but that wasn’t going smoothly.
• PowerShell script in a .bat file - Dmitry's Blog: Cloud, PowerShell and beyond - Dmitry had lots of great tips and ideas, but I never could get the encoded script to generate the string. Obviously I’m a noobie and doing something wrong…
• Provide A Batch File To Run Your PowerShell Script From; Your Users Will Love You For It - Daniel Schroeder's Programming Blog - So I considered creating a separate powershell script file and calling to it from the BAT file but then I had the intuitive leap to just compile the script as an EXE in PowerGUI.  And that was game over!

Again, any tips, tricks or alternative suggestions would be appreciated!

Cheers!

--Claus V.

P.S. Microsoft has a number of tools for scanning/removing malware from a system.

Microsoft Malicious Software Removal Tool - This is on most all Windows systems as the MRT.EXE file. Type “MRT.exe” in the RUN bar and you will be off to the races (assuming Windows Updates are current, otherwise download the file manually above or effectiveness will be diminished.)

Then there is the heavy-duty version Microsoft Safety Scanner which gets updated every 10 days.

And, in my original post I mentioned the Microsoft Standalone System Sweeper from Microsoft that was available only via the Microsoft Connect site unless you went through a third-part download source. See this Utility Spotlight: Repair Your PC Infection from TechNet Magazine to get more info on it.

Working on the URL/Download location for this one led me to discover the Windows Defender Offline tool that may have replaced (?) the Microsoft Standalone System Sweeper.  This one is for most “modern” versions of Windows but if you are running Windows 8.1 you will need to jump to this Windows Defender Offline Beta build page.

--cv

The Valca Layered Security Experiment

Some notes on the current layered security approach I’m using on my laptop (Win 7) as well as Lavie’s (Win 8.1).

I keep the Microsoft OS’s regularly patched with all available MS updates.

I am using Windows Firewall for ease of administration rather than one of the multitudes of alternative (and more feature packed) firewall solutions. It’s strange as I used to be pretty heavy into the alternative firewall thing around this blog in the past. WF works well enough.

I don’t run Shockwave or Air any more.

I update Flash, Java, and regularly run Qualys BrowserCheck and the Secunia Software Inspector to look for critical software updates for these common threat vectors.

I do still run Microsoft Security Essentials despite having tried Bitdefender Antivirus Free and AVG Free Antivirus. They did great but the whitelisting was a pain and less than smooth.

I run Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) just updated to the final public release 5.0 version. I take the defaults (for now). More info below.

• Enhanced Mitigation Experience Toolkit - EMET - TechNet Security
• Announcing EMET 5.0 - Security Research & Defense
• Microsoft's EMET 5.0 blocks vulnerable plugins - Betanews
• Download Enhanced Mitigation Experience Toolkit 5.0 - Microsoft Download Center

I “inoculate” our systems against Crypto-type malware using CryptoPrevent from Foolish IT LLC.

• CryptoPrevent v6.0 released! - Foolish IT LLC
• NOTE: Anti-Malware Detection Warning - Foolish IT LLC

Recently I ponied up the $ for a few lifetime licenses of Malwarebytes Premium anti-malware and Internet security software. The new 2.0 version still needs some polish but performance is great and Lavie gets so exited when her nightly scans come back clean. Not sure why. It plays wonderfully with MSSE.

Malwarebytes recently released a supportive product called Malwarebytes Anti-Exploit

• Malwarebytes Anti-Exploit - Free Zero-Day Exploit Protection

It works by monitoring your system for zero-day exploits attacking your browser and other commonly found software. The free version just protects the web-browsers and Java, while the Premium version protects PDF readers, Microsoft office applications, medial players, and allows for creation of custom shields. It reminded be a bit of an old PCTools product (now retired) called ThreatFire. I’m not linking to it since it is old but you can search if you are curious.

I’ve not yet applied it to our “production” systems, but am running it on a Windows 7 Enterprise VM system that also has EMET 5.0 and AVG Free protection. Early alpha/beta versions did have conflicts with EMET but this public version seems to work fine with it. So far so stable. Once I am comfortable with it, I may try it on our primary laptops.

• Introducing Malwarebytes Anti-Exploit - Malwarebytes Unpacked blog
• Anti-Exploit Product Support - Malwarebytes Forum
• Why not intergrate - News, Questions and Comments - Malwarebytes Forum - basically - maybe sometime.
• Experimental MBAE Builds - Malwarebytes Forum

What else?

The HDD is “protected” with the last working version of TrueCrypt. Yes I know all about the drama.

As I have said, my primary concern is data loss from burglary or theft, less so from the multi-letter agencies.  When I get around to upgrading to a 1 TB SSD hard drive (prices please drop!) I may plunge in and do an upgrade to Windows 8.whatever at a level that would support Bitlocker so I could get off TrueCrypt. But that’s activity for a different day.

The take away here is that I’m keeping my systems updated and that I’ve layered the defenses. It’s become much more work than most standard users would do, but instead of fishing for a hobby, I sysadmin.

Cheers,

--Claus Valca

Footnotes:

• Malwarebytes Anti-Malware Free scores 100% in AV-TEST removal test! - Malwarebytes Unpacked
• Five Best Desktop Antivirus Applications - Lifehacker
• Windows Security Feature Abused, Blocks Security Software - TrendLabs Security Intelligence blog
• Malware uses Windows security feature to block security software - ZDNet