Download HD Download MP4

If you're into Hak5 you'll love our new show by hosts Darren Kitchen and Shannon Morse. Check out HakTip!

Whether you're a beginner or a pro, HakTip is essential viewing for current and aspiring hackers, computer enthusiasts, and IT professionals. With a how-to approach to all things Information Technology, HakTip breaks down the core concepts, tools, and techniques of Linux, Wireless Networks, Systems Administration, and more

And let's not forget to mention that you can follow us on Twitter and Facebook, Subscribe to the show and get all your Hak5 goodies, including the infamous WiFi Pineapple over at HakShop.com. If you have any questions or suggestions please feel free to contact us at feedback@hak5.org. ]]> http://Hak5.org/episodes/hak5-1025-2/feed 12 http://Hak5.org/episodes/hak5-1023 http://Hak5.org/episodes/hak5-1023#comments Fri, 03 Feb 2012 06:57:41 +0000 Jason http://Hak5.org/?p=4488 ]]>

This time on the show we're automating everything! Darren shows off intelligent scripting with expect for Linux. Then I'll be encrypting folders from a context menu in Gnome, pairing 'em with some cloud services and boom, you've got secure backups. Plus, multi-core GCC compiling, directory size scripting and can USB drives be trusted? All that and more this time on Hak5!

Download HD Download MP4

If you're into Hak5 you'll love our new show by hosts Darren Kitchen and Shannon Morse. Check out HakTip!

Whether you're a beginner or a pro, HakTip is essential viewing for current and aspiring hackers, computer enthusiasts, and IT professionals. With a how-to approach to all things Information Technology, HakTip breaks down the core concepts, tools, and techniques of Linux, Wireless Networks, Systems Administration, and more

And let's not forget to mention that you can follow us on Twitter and Facebook, Subscribe to the show and get all your Hak5 goodies, including the infamous WiFi Pineapple over at HakShop.com. If you have any questions or suggestions please feel free to contact us at feedback@hak5.org. ]]> http://Hak5.org/episodes/hak5-1023/feed 4 http://Hak5.org/episodes/haktip-30 http://Hak5.org/episodes/haktip-30#comments Fri, 02 Sep 2011 22:00:29 +0000 Jason http://Hak5.org/?p=4071 ]]>

I’ve lost my flashdrive! And if an honest person found it I can use this script to send them a message and contact info!

Download HD Download MP4 Download WMV

I recently lost my 16 gig flash drive during my travels and have yet to find it. For all I know some random person picked it up and decided, ‘Sweet! Free flashdrive!’. Now, although this is a bummer for me, I now have a new drive and need some sort of security feature and way to claim it as my own. Luckily, the good people of ‘Daily Cup of Tech’ came up with a solution.

First they thought of just sticking a text file on the drive that says ‘Help.txt’ or ‘ImLost.txt’ but whose to say that the founder will read that? Using an AutoIT script, the creator made an auto run file that the user can click on. The Icon displays ‘Help! I’m Lost!’ and when it’s clicked on, it displays a message of your choice- whether that is your address or a reward for returning the drive, etc. If you right click on the drive in My Computer, the same thing shows up.

Because of the high interest in this code, there is now a downloadable .zip file with all you need to get started. Simply download the zip file, extract the files to the root of your flashdrive, and change the readme.txt to say whatever you want. Now, when you plug in your drive, it’ll be named ‘Help! I’m Lost!’ and have several files that can pop up and state the same thing. No matter how curious the person who found the drive is, they’ll want to know what the .txt has to say.

But what if you lost your USB drive and there was sensitive data on it? I have a tip on securing your drive as well.

Now the problem I find with my flash drives that I have on hand is none of them have any sort of security features. Sure, I could shell out lots of cash for an encrypted super drive, but why do that when I could encrypt mine for free? Enter TrueCrypt. If you haven’t played with truecrypt before, I explained how to encrypt your entire harddrive on an episode of Hak5. Those same steps can be used to encrypt a partition or a volume, even a flash drive. Encrypting your documents and important data inside a drive won’t keep people from stealing it or yourself from losing it, but at least then your data can’t be accessed without the proper password.

Ok, so I want to hear your feedback. How do you protect your flashdrive? Let me know what you think or what program you use by emailing me — tips@hak5.org or send me a note in the comments below.

And be sure to check out our sister show, Hak5 for more great stuff just like this.

This time on the show I’m reviewing my top five Security Extensions for my favorite browser, Google Chrome.

Download HD Download MP4 Download WMV

5. PasswordFail. This extension for Chrome warns you to back away whenever you start to log into a site that sends your password as clear text. A lot of sites don’t encrypt or hash your text and just send your password to a database completely open and ready for hackers or curious folk. PasswordFail will call these sites OUT on their crappy security and hopefully help you from losing sensitive data.

4. KB SSL Enforcer. Some sites offer HTTPS or Secure Sockets Layer logins. This extension will force those sites to automatically go to HTTPS instead of HTTP so you have more security and encryption in case you forget to check.

3. View Thru. A lot of times on twitter and whatnot, people post tiny.url’s or bit.ly’s and I have no clue what they are. But, I’m a curious cat, and I always click the link anyways even though I don’t know what kind of site I’m going to stumble onto. View Thru pops up a little blurb that shows you the page you’re about to visit when you hover on a tiny URL address. When testing this on my twitter feed, not only does it work, but it’s also not annoyingly overdramatic.

2. LastPass. LastPass gives you an easy way to fill out forms (with autofill) and remember passwords. Passwords are stored locally, so even the LastPass team cant access your passwords. Using lastpass gives you a vault where only a master password will unlock your data. For more info on LastPass, check out HakTip number 20.

1. Web of Trust (or WOT). This small extension gives you a small icon in the top right corner of your browser that shines either Red, Yellow, or Green. Red means bad and green means good. The cool thing about Web of Trust is all the sites ratings are submitted by user feedback, not a virus detector or a corporate affiliation. You can add your own feedback by left clicking on the icon, and choosing the color you think the site deserves. Hak5 gets green all the way!

Ok, so I want to hear your feedback. What Chrome extensions for security and / or privacy are your favorite? Let me know what you think or what extensions to check out by emailing me — tips@hak5.org or send me a note in the comments below.

And be sure to check out our sister show, Hak5 for more great stuff just like this.

This time on the show Shannon is comparison shopping! Which is better? KeePass or LastPass?

Download HD Download MP4 Download WMV

Your passwords are crucial to protect, so I love checking out software and tools that can help. Sadly, my memory only goes so far!

The first on my list is LastPass. With this program, your Master Password is the only password you’ll ever need to type in, only when you’re first logging into LastPass. Since your Master Password is encrypted on your machine and only you have access to it to unlock data, it’ll protect you from theft. By using your LastPass account, available at lastpass.com, you can synchronize across a bunch of different browsers and computers. They also have a service for $1/month for your mobile devices. You can securely store notes, automatically fill out forms, import/export already existing passwords, generate hack-proof ones for new sites, and you can try out a portable USB version that is compatible with Firefox and Chrome Portable apps.

To use it, first download the version for your OS. You’ll need to create a Master Password when creating the new account, so make sure this is a very secure one. LastPass doesn’t keep a backup or copy of the master password, so they don’t know what it is. You can let LastPass find unsecure data on your computer, import those items, and It’ll let you delete them as well. Restart your browser and click on the little lastpass star in the corner. Login. Then start browsing the internets as usual and LastPass will remember your passwords as you enter them.

When you first go to a website you’ll have to enter your username and password like usual. Then, a bar shows up at the top asking you to save the password in LastPass. Choose Save Site, and you are redirected to a LastPass form. Here, keep the URL, enter a Name (J!nx), group (Shopping), your Username and Password, and any notes. Then, if you want it to Auto Login, Prompt for PW, etc, just click the boxes and click Save. Now, when you log out and go back to that main page- you’ll see your changes take effect. I chose auto login, so it logs me in and I don’t even have to do anything.

Click on the Red star and it’ll show you a drop down of your preferences, Vault, and other stuff like auto filling forms and whatnot. If you choose your Vault, you can double click on the groups and click on a site to go to it and log in.

Now, if you’re out and about and need to access your Vault from a public computer, you can log into LastPass via their website. Worried about keyloggers? Use the virtual keyboard to enter your password with your mouse.
LastPass is pretty cool when it comes to remembering your passwords, but what about KeePass?

KeePass is a powerful free and open source security tool designed to keep your passwords- and usernames- secure. Everything is encrypted inside a database, kind of like LastPass’s vault, that you can access with a master key password.

KeePass features drag and drop, clipboard copy, a password generator, auto-locking, auto-typing, import and exports of your database, and more. It encrypts everything in AES 256 or Twofish. Did I mention it’s free? Like LastPass, KeePass also can organize your entries into categories.

It’s available in Classic or Professional Editions, with the main difference being the supported OS’s. Professional supports Windows, Mac, and Linux.

After you download the program, first save your new database to begin working on it. You’ll need to create a master key, but you can also access your database with a Windows login or by inserting a key disk. Next you can create a description, name and color, and choose what to protect. Click ok and right click on the sample list. From here, you can add, edit, and delete websites and usernames or passwords.

To use a password or username, click copy username, password, or site by right clicking. This’ll copy it to the clipboard for 12 seconds before wiping it clean. You can also move the new entries into the tabbed categories to the left by dragging and dropping.

Although I do like the fuctionality of LastPass way more than KeyPass, specially it’s ease of use, KeePass is still open source, completely free, and has a portable version as well as it’s mobile version.

I want to hear your feedback. Which one is your favorite? I like both of them for different reasons. Let me know what you think or what program you use by emailing me tips@hak5.org or send me a note in the comments below.

And be sure to check out our sister show, Hak5 for more great stuff just like this.

This week we wrap up Hak5 season 8 with the conclusion of our Shmoocon 2011 conversations. Search and Siezure, Evite pwnage and printer attacks! Be sure to tune in next week for a very special Hak5 season 9 premiere!

Download HD Download MP4 Download WMV

Keep up with the latest on Hak5 by follow us on Twitter or Facebook. Subscribe and get your weekly technolust delivered automatically. Or show your support and grab some swag from the HakShop – including the new airport friendly WiFi Pineapple and hoodie. Finally if you’d like to suggest a topic
for ask a question feel free to hit up feedback@hak5.org.sc

Make your home network scream with a high performance router and firewall. Darren builds a custom network appliance using cheap parts, free and open source software and more power tools than he’s typically allowed to touch. Plus, need an online backup solution? Fancy 50 gigs in the cloud for free? Shannon’s got the hookup.

Download HD Download MP4 Download XviD Download WMV

Chuck that plastic router

Sure you could go out to your local big box store and pickup a cheap plastic box that claims to route packets for you and your dozen Internet loving devices, but unless you fancy your multi-core gaming rig being limited by a network-toy with a smart phone processor it’s time to step it up a notch. This week we’re breaking out the mini-itx boards and, wait, someone let Darren touch the power tools?

—

Trivia

While Tux the penguin may be the official Linux mascot, Larry the Cow is the unofficial mascot of which Linux distribution?

Enter for your chance to win a super sweet new Hak5 sticker pack set by submitting your answer at hak5.org/trivia

—

Domain.com

I like Domain.com’s Deluxe web hosting plan that’s only $8.75/mo. One click install of all the popular open source programs like WordPress, Joomla, and Drupal, and more! Unlimited traffic

Free website builder with unlimited pages, Easy and affordable to get your sites online with Domain.com. Domain.com offers blistering fast DNS and hosting infrastructure, the lowest prices on the web AND the highest quality. Thanks to Hak5 fans, Domain.com is one of the fastest growing domain and hosting companies in the world. Got a great idea? It all starts with a great domain. Domain.com! Don’t forget to use coupon code HAK5 at checkout to get 15% off your order.

—

Building a cheap acrylix mini-itx case

Why pay for a fancy mini-itx case when you can easily build one out of scrap parts for next to nothing? In this segment Darren breaks out the power tools to find out just how skillful he can be. Be forewarned that Darren makes no claims at being handy. Please send all hate mail to aardwolf+ignore@gmail.com

—

Innovative Online Storage

Props to JPG for sending this in!

Lets face it, local backups only get you so far. And unless you’re shipping hard drives to grandma’s place every other week a true offsite backup solution is, unfortunately, not commonplace. Of course there are services like dropbox and sugarsync, but with a paltry 2 gigs with the free accounts it beacons back to the 2 meg days of Geocities. And don’t get me started about Geocities Thankfully there is a service that, if you’re willing to contribute to, will offer you up to 50 gigs of cloud storage.

Wuala is a service by Lacie that let’s you store a gig of data up in the cloud. Of course like any other similar service you won’t be backing up operating system or program files, this is just for the priceless material. Photos, documents, and. Um. Maybe music.. Anyway, what sets Wuala apart from the rest is the ability to trade gigabytes of local storage on your own personal hard drive for storage in the cloud.

Some of Wuala’s features include:
Ad free
private, shared and public modes
personal folders and groups
secure file storage
Pro users get version control

If you’re not keen on sharing your precious hard drive with others there is a paid version of the service that starts at $25/year for 10 GB and ramps up to $1000/year for a terabyte. Personally if you’ve got that much stuff that needs a home on the web you might be better off with Amazon’s S3 storage solution — as long as you don’t need to upload and download it frequently.

Wuala is available for Windows, Mac, and oh yes, Linux. Thanks to Go To Assist Express I can easily walk you through the simple Windows setup on one of our Hak5 cloud labs boxes. Downloading Wuala is very easy, you just follow the steps that pop up and tada! You’re done. I would suggest checking out the included tutorial for a very quick look at how to use Wuala in a nutshell.

To upload a picture I simply click add files, choose my image, and open it. Once the image is uploaded, it’ll have a little green bullet next to the file. You can also drag and drop a folder or file into Wuala. To change the privacy settings of a folder, right click, go to properties, change the visibility by clicking change, and choose private, shared, or public. I’ll choose shared, then I’ll select ‘all’ friends. Since I dont’ have any yet, just picking this will include all my future friends. if you have friends already, it’ll list them in that popup. I save, and in a few seconds my folder will turn red, showing me it’s a ‘shared’ folder.

Wasn’t that easy, now your essential files are backed up to the cloud using industry standard encryption. I <3 online backups nearly as much as I <3 portable apps. Do you? What are you using? Email me at feedback@hak5.org with any of your thoughts!

—

GoToAssist Express
Their computer. Your brain. How do you get the two together without wasting time and money traveling? Use Go To Assist Express to view and control your customer’s computer ONLINE so you can fix the problem on the spot! Save time and money on travel. Satisfy customer quickly and efficiently. Then move on to other tasks! Try Go To Assist Express FREE for 30 days! For this special offer, you must visit GoToAssist.com/Hak5 for a FREE trial.

—

Installing Smoothwall

With our hardware built our focus shifts to setting up the software for our spiffy new router. There are quite a few free open source solutions to choose from, including m0n0wall, Smoothwall and pfsense. I’m a big fan of Smoothwall so in this segment I’ll be guiding you through the interactive installer.

—

Netflix

Netflix delivers movies directly to your home saving you time, money and hassle. As a Netflix unlimited member you get DVDs by mail in about 1 business day. Plus, you can instantly watch thousands of TV episodes and movies streamed directly to your PC, Mac or right to your TV via a Netflix ready device like the Xbox 360, PS3, and Nintendo Wii console. Watch as many movies as you want! Shipping is FREE and there are never any late fees or no due dates. Keep the movies as long as you like. DVDs by mail – Plus, instantly right to your TV. Get unlimited movies 2 ways for only $8.99 a month. As a new member and a Hak5 viewer, you can get a FREE Trial membership. Go to www.netflix.com/Hak5 and sign up NOW! . . Be sure to use this URL so that they know we sent you!

—

Rememebr we’re in LA for E3 this week. Darren Kitchen and Jenn Cutter will be bringing the Hak5 perspective from the show.

If you want to know the latest on Hak5 be sure to follow us on Twitter or Facebook.

Also, now is also a great time to grab some swag from the HakShop – including the new airport friendly WiFi Pineapple with free world-wide shipping.

And finally if you’d like to suggest a topic for a future show feel free to hit up feedback@hak5.org

This week Darren is joined by Rob Ruller, aka Mubix for a little fun with Man-in-the-middle javascript keylogger using the Middler, and pwning with the Social Engineering Toolkit. Plus using Spotify in the US without a proxy, Mac Address spoofing in Linux or Windows, Virtual Appliances for VirtualBox, and much more! Take an hour lunch and prepare to feed your technolust!

Download HD Download MP4 Download XviD Download WMV

Cross Platform Encryption

Mahmoud, as well as many others, wrote in to ask about the cross-platform compatability of the encryption set setup on Hak5 episode 620 using cryptsetup.

The short answer is, no, it’s just for Linux. If you’re looking for something both open source and cross platform look no further than Truecrypt

Spotify in the United States without a proxy

Following up on last week’s question about IP spoofing so users in the US can try out Spotify, we’ve got just the trick without a proxy. Ok, well sorta. If you happen to have a beta invite and a friend, perhapse on IRC, in an allowed country it’s just a matter of having them sign up for you. The only limitation is that you’ll need to have your account signed into from your “home country” every 14 days. On the other hand if you decide to spring for the €9,99/mo premium account you, supposedly, don’t have such limitations. Thanks to Jouni in Finland for hooking me up. I’ll be sad when its game over in two weeks. Or will it?

Virtual Appliances for VirtualBox

If you’re a fan of VirtualBox then you’ll love VirtualBoxImages.com. They’ve got pre-packaged VirtualBox VDI’s ready for your enjoyment.

Javascript Keylogger via Man-in-the-Middle Attack

When it comes to man-in-the-middle attacks just about anything is possible. In this segment Darren explores InGuardians tool the Middler. Using a plugin architecture for manipulating (among others) http traffic, we attempt to get the infamous javascript onKeyPress keylogger going. Without much success in that department Darren goes on to demonstrate iframe injection and ponders ways to make the borked plugin behave.

Social Engineering Toolkit

Hacking isn’t just about remote code execution. Well, I mean, that’s fun and all but rather than exploiting the server, how about exploiting the Human OS. In this segment Mubix demonstrates David Kennedy (aka Rel1k)’s tool, The Social Engineering Toolkit. Despite some challenges with clients that werent setup with Java, Mubix successfully demonstrates meterpreter in conjunction with a cloned site.

Mac Address Spoofing

@Bluesmanchukk writes in to ask about Mac Address Spoofing. Darren and Rob discuss their favorite tools for the job: ifconfig (Linux), GNU MAC Changer (Linux), MadMACs (Windows), Mac Randomizer (Linux).

Multi-Player Notepad

Stoned33 wrote in to ask for our picks for simple online collaboration. Aside from the obvious Google Wave, Rob recommends the recently Google-Acquired yet still operating Etherpad. This real-time document editor is like multi-player notepad on crack. Give it a shot.

On this episode of Hak5 Darren joins Jenn Cutter in Toronto to talk IP Spoofing, Tethering Terms of Service, World of Goo mods, Linux Drive Encryption, 13″ Ultralight notebooks and more.

Download HD Download MP4 Download XviD Download WMV

Tethering TOS and IP Spoofing

Brice writes “Thanks for showing how to tether Droid with Ubuntu. I use them both quite often.
I was wondering if tethering the Droid is against the TOS/Verizon contract.”

Well Brice, technically it may be a violation of your carriers terms of service. I know at least with Verizon’s Wireless business accounts there is an additional fee, around $30/mo I believe, for tethering with a smartphone like a blackberry.

I can also say from personal experience having tethered since 2001 on both Sprint and Verizon, that as long as you stay under the 5-gig cap you should be ok. Programs like June Fabrics PDAnet allow one to tether on most platforms and, from what I hear from my telco buddies, the carrier can’t tell the difference between the traffic originating from the phone or your laptop. I haven’t heard any horror stories of penalties for using such application however I’d be curious to hear from our audience if such a thing has happened in the past.

Kuroha write “I want to use Spotify, the new music service, but I keep getting this error:
Unfortunately, due to licensing restrictions we are not yet available in your country. We understand that you are currently in United States. How do I spoof my IP so it looks like I’m in Finland?”

Kuroha, there is a misconception about IP Spoofing that’s simply summed up by saying this. The source address of your computer is part of the IP packet header. There are plenty of programs out there that will let you spoof this source port, including our favorite tool nmap. However, like a return address on postage, unless you’re in a position to listen to the replies to your spoofed packets (such as on a local network) you aren’t going to get anything useful back from the server.

What you’re more likely referrencing isn’t IP Spoofing as much as it is simply bouncing your traffic off a server in another country — typically done to anonymize Internet traffic or for secure tunneling on untrusted networks. The SSH tunneling with dynamic SOCKS proxies we’ve been talking about recently will do the trick. It’s just a matter of finding a cheap shell, VPS or other server that allows tunneling in the country of your choosing.

Don’t forget this month’s LAN Party is Left 4 Dead 2. We’ll be playing at game.hak5.org Saturday and Sunday, January 2nd and 3rd. Hope to see you there!

World of Goo Mods

Recently I’ve been playing a lot of World of Goo. It’s an amazingly simple and fun game. I’ve been playing on the Wii but soon after arriving in Toronto Jenn Cutter picked up the title for her tablet and has been dabbling with the mods.

If you’re interested in making your own levels, or downloading fan-created levels and other mods be sure to check out GooFans.com — they also have a great forum on modding.

This week’s trivia question is: “World of Goo developers shares the same open source physics engine as what 2007 first-person shooter?” Answer at hak5.org/trivia and be entered to win Pronobozo‘s album Zero=One=Everything.

Easy Linux drive encryption with Cryptsetup

When it comes to Linux, I love super user friendly and powerful utilities. This is one such tool. Since the 2.6.4 kernel drive encryption has been built in, and this tool cryptsetup makes setting it up a breeze. Follow along in this tutorial as I keep my secret thumb drive free from prying eyes.

I’ve gotta give props to Peter Savage for sending this my way. Check out his SciFi fantasy novel Emblem Divide — it’s wicked good.

Wallpaper Contest: Best 2010 “New Years” Hak5 Wallpaper! Get creative and submit your wallpaper to Hak5.org/forums under the Community Images board.

Ultralight Notebooks

Chris writes: “I was wandering if you could suggest a laptop that is lightweight, long battery life, 13.3 inch screen, with Win 7. Budget of $1000″

Chris, I recently did just this research. I was looking for a notebook to edit the show on the go — which isn’t easy considering the heaft and hunger of those AVCHD video files. If you’ve been watching the show for a while you also know I’m the netbook boy. First with the 7″ eeePC, then the 9″ Aspire One, and more recently the 10″ Nokia Booklet 3g. The next step up to get a “real CPU” is 13.3″ — a sweet spot of performance and portability.

What I found was that ultra-light, ultra-long battery life is in. These sweet new Consumer-Ultra-Low-Voltage (culv) chips from Intel and AMD are sexy. I thought I would need a 35 watt Core i7, or at least a 25 watt 2.2GHz or faster Core2Duo to edit on the go — but I lucked out with the 10 watt 1.3ghz SU7300 Core2Duo chip from Intel.

The video editing performance of the ASUS UL-series notebook I ended up with is aided by hardware accellerated video processing in the GMA 4500 M HD. AVC, VC1 and h.264 decoding are offloaded to the graphics chip. In Windows 7 Home Premium I’m able to playback 17mbps AVCHD in WMP using only 20% CPU. Not bad at all.

So if you’re willing to live without an optical drive an ultralight notebook may be the best choice for you. The performance seems enough and the battery life is steller. I’ve seen prices in the $650 – 900 range so take a look at the ASUS UL, Acer Timeline, Dell Inspiron Z, Samsing X and Lenovo U series notebooks. Just be sure to get a Core 2 Duo — I’m not reading great things about the Core 2 Solo part. SU7xxx and SU9xxx seem to be where it’s at. For now. We’ll likely see a lot more of these slim buggers at CES.

I want to give a special thanks to our crew for being so supportive while I was in hospital. Shannon did a wonderful job of taking care of the hakshop and mailing out all the orders while I was away. Thanks Revision3 for understanding about the late episode, Sentara for their open wifi and hot nurses, and a big thanks to our loyal fans. All of well wishes on twitter, facebook and youtube, the forums and IRC brightened my day every day. And DigiPirate, thanks for the awesome USB Dalek Webcam. Exterminate!! Exterminate!!

While on Vacation at the beach Darren and Shannon talk password security. Shannon covers her favorite free open source password safe, Keepass, and how it can take the nightmare out of remembering a different password for every site. Then, Darren goes over salting and what it does to protect your password’s hash on the back end.

Download HD Download MP4 Download XviD Download WMV

With the dozens–or in the case of many administrators hundreds–of passwords one must use and remember every day, how is one to ensure a secure and original password every time? Sure you could come up with some crazy algorythm that involves information in the WHOIS record of the domain you’re logging into, or you could live in normal land and get a password safe. Shannon goes over her favorite free open source offering KeePass.

Using industry standard encryption to keep your passwords safe, KeePass is the most full featured password safe we’ve tested. With versions for just about every OS under the sun, including many smart phones, there is no reason to ever reuse a password again.

If you’re a fan of KeePass and have a story or plugin you want to sare with us be sure to hit up feedback@hak5.org!

When it comes to storing passwords on the back end, whether they be in a database or flat file, it’s important to keep ‘em salted. In this episode Darren goes over what Hash salting is — what it means to users, administrators, and would-be password crackers.

Don’t forget about our first ever official Hak5 Meetup at Busch Gardens Williamsburg on August 15th. Find all the details at hak5meetup.squarespace.com or RSVP on Facebook.

Rob Fuler, aka Mubix, of Room362.com joins us to expand on last week’s discussion about the Cold Boot attacks. We cover retrieving memory from live systems, analysis with tools like volatility, and file recovery with foremost. Mubix calls it forensics for the gray hat.

Download HD Download MP4 Download XviD Download WMV

Rob Fuller, aka Mubix of Room362.com joins us to expand on last weeks discussion about the cold boot attack.

This time we’re imaging memory from live systems. Windows boxes specifically. I point out my favorite open source app win32dd, which allows retrieval of physical memory in a couple of methods. Mubix is a fan of ManTech’s MDD. Both of these tools are capable of capturing memory on Windows 2003 SP1 (Vista+) and later machines. More tools can be found at the Forensics Wiki.

Once we’ve captured our memory it’s time to run it through a few tools to extract the good bits. Last week we touched on AESKeyFinder and RSAKeyFinder as well as Strings. This week we’re using the epic memory artifact extraction utility Volatility.

This gem allows us to see deep into what a Windows box was doing at time of memory capture, including running processes, open network connections, DLLs loaded for each process, registry handles, and more. The tool can even extract executables from memory. It’s a nifty little cross platform tool that’s worth a spin. If you’re looking to get your feet wet you might want to try it against some example data, courtesy of the NIST.

Best of all, Volatility if a framework that supports third party scripts. One such target=”_blank”>plugin makes it pretty simple to extract the Windows SAM from a memory sample.

We also cover using foremsot, an excellent tool for recovering data from memory based on headers, footers and data structures. I can say from experience that using the

-t ALL

option on a dump of Mubix’s memory that A TON of files are recovered, all nice and neat in their own folders based on extension. Thanks for the mem dump Mubix . If you don’t have a capture of Mubix’s memory you can find samples to play with Foremost at the Digital Forensics Tool Testing Images site.

We’ll be back in studio next week with Matt. Of course be sure to send your feedback to feedback@hak5.org, post in the forums or respond in the comments.

And don’t forget about our first ever official Hak5 Meetup at Busch Gardens Williamsburg on August 15th. Find all the details at hak5meetup.squarespace.com or RSVP on Facebook.