Today we’re going over your top 5 tips, questions and software picks including performance boosters, 3d desktops and disk space analyzers for Windows.

Download HD Download MP4 Download WMV

Gabriel writes:

Hey folks. I am loving these hak tips. They are far more digestible and make me feel like less of a noob than actual hak5. I do love hak 5 too, but these tips make it awesome to do in my spare time. Anyway, I was a little confused as to how Shannon got virtual box to boot from a USB. I’ve run Virtual box on both mac and windows 7 and can’t get either to boot from a usb drive even with the guest additions. Am I missing something dumb? Plz don’t judge me!!!! Keep up the awesome work!

Booting from USB in VirtualBox is kind of a hack. Direct booting from a USB device isn’t ordinarily possible as VirtualBoxs doesn’t support USB in the BIOS. That said using the VBoxManage command you can convert a physical disk on your machine — say a USB drive — into a VMDK which VirtualBox can boot off as a hard drive. That’s all there is to it. As far as the VM is concerned it’s a Hard Drive.

The command for Windows is “”VboxManage InternalCommands CreateRawVMDK -filename filename.vmdk -RawDisk (which you can find under disk management).
VBoxManage internalcommands createrawvmdk -filename usb.vmdk -rawdisk \\.\PhysicalDrive1 where 1 is the drive number of your USB

In theory you could use this to boot a mirror image of your hard drive, but I haven’t gotten that crazy with it. Yet. Thanks for writing in.

Brit writes:

Just wanted to say how much I love the show. I was wondering if you have any ideas about running a virtual honeypot on a virtual machine? Is there any reason that it would work different then running it on it’s own machine? What about security risks since it is running through your machine?

We haven’t covered honeypots on Hak5 yet, but we totally should. I know Darren has been meaning to. He’s a fan of the tool HoneyD, which comes preinstalled in BackTack 5 under Exploitation Tools > Social Engineering Tools > HoneyPots.

Using it on a Virtual Machine for the most part wouldn’t be different than running in on its own machine. The only thing you have to watch out for is a hypervisor exploit, which is to say an exploit that lets malicious code break out of the virtual machine and attack the host. These are pretty rare but scary when they happen. If you’re really paranoid you might want to put your honeypot on a DMZ outside your normal LAN, or on another network completely. When we have crack the code challenges on Hak5 we use a dedicated cable modem line for this exact reason. Not that we don’t trust you on our office LAN. Just sayin’! Thanks Brit for writing in!

Rounding out our emails we’ve got a few software recommendations.

First Nick writes:

Love the show, just watched your system booster episode, just wanted to recommend Soluto to speed up start up time, its a brilliant program.

Next Josh wrote in to recommend DeskSpace 3D

In my opinion it’s better than Dexpot (which I tried for a while) It gives you 6 virtual desktops much like you get on a Linux OS and also has an awesomely fast and surprisingly not at all buggy 3d cube effect, very similar to what Compiz desktop effects for linux has to offer.

And finally Dids writes:

I recently came across an AWESOME harddrive free disk space reporting software, which in addition to being super sexy, is even easier to use than the other free alternatives out there. This one is called Space Sniffer.

Thanks Nick, Josh and Dids!
”

What programs or commands are rocking your world? What technologies are tickling your technolust? Hit us up — tips@hak5.org

And be sure to check out our sister show, Hak5 for more great stuff just like this.

Most guys hate shopping for clothes, but luckily now there’s JackThreads – a members-only online shopping club. Everyday JackThreads serves up the hottest brands at up to 80% off. And while JackThreads is a private club, we’ve got the hookup. Join free at JackThreads.com/hak5 and start saving instantly.

Checking out an alternative to Virtual Box called VM Ware Player.

Download HD Download MP4 Download WMV

In episode 10 of HakTip we went over Virtual Machines- what they are, why you would use them, and what they are good for.But you don’t necessarily have to use VirtualBox to try out a VM. There are plenty of virtual machine programs on the market, but not all of them are free or easy to use. VMware Player is both of these with a whole bunch of awesome built in as well. This program, available at vmware.com, lets you run several operating systems virtually, as well as give you the comfort and safety of trying out new software in a VM. Because sometimes, software you might download is just downright janky crapware. Over 200 different operating systems are supported including various versions of Windows, Linux, and even Chrome OS.

When you first download VMware Player, you’ll need to register for a new VMware account. They ask for your name, a password, and some geographical data, but that’s about it. The installation wizard is your normal process of yes and next. Upon opening, the general layout is about the same as VirtualBox. On the right you can choose to create a new VM, open one, upgrade to the paid VMware account, or choose help.
Click on Create a new Virtual Machine and choose installer disc image file (iso). From here browse to your .iso for the operating system you want to try out. I’m going to create a Puppy Linux VM so I’ll choose my Puppy Linux iso and click next. Choose Linux and in the drop down menu choose Other Linux 2.6 kernel. If you chose a different Linux distro, find it in the list and click on it. You can then choose how much space is allotted for the VM, so I went with 8 GB.
Once done, you can boot up your VM and test it out.

Before I reveal which one was my favorite between VirtualBox and VMware Player, I’d like to take a moment and mention some extras.
VMware Player comes with some handy tools, such as this one called the VMware Browser Appliance. You download this zip file from the website and extract it, then in VMware Player, choose open a Virtual Machine and browse to the folder. The Browser Appliance allows you to securely browse the Internet using Firefox to protect against adware and spyware, and safeguard personal information- as it can be configured to reset itself each time it’s booted up, so no info is stored.

Also available is this wide array of Virtual Appliances found on VMware.com. These applications can help you with information in the cloud- storage, IT administration, networking, and much more.
So now that I’ve checked out both VirtualBox and VMware Player, I have to say I think I like VirtualBox more. While both are free to use and work with all sorts of VM’s, VirtualBox seems to be a little bit faster in the guest OS as well as the host OS. Also, VMware Player only lets you use on Virtual Machine at a time, while VirtualBox will let you open many at a time.

That’s it — Virtual Machines are actually pretty easy? Ok, so I want to hear your feedback. What program or command have you found? Hit me up — tips@hak5.org

And be sure to check out our sister show, Hak5 for more great stuff just like this. I’ll be there, reminding you to trust your technolust.

This time on the show I’m creating a virtual machine inside VirtualBox.

Download HD Download MP4 Download WMV

Now, way back on episode 4 of HakTip, I introduced a program called YUMI (aka Your Universal Multiboot Installer), and I demoed it inside a program called VirtualBox. I got tons of questions about VirtualBox, so I decided to dive in and show you guys how to use it. I’ve been a Windows fangirl ever since I was a kid and my dad was building computers in our living room, but I’ve toyed around with Ophcrack and Puppy Linux a few times. Being somewhat new to the Linux operating system, you may not be ready to dual boot your PC or switch over completely to a new OS, so you might want to just test it out in a Virtual Machine that runs inside your Windows machine.

Today we’ll be setting up our very own VirtualBox Machine, but first it’s time for a few terms.

A virtual machine (VM) is a software implementation of a machine (i.e. a computer) that executes programs like a physical machine. It can be used as an operating system that you can open and boot into on your normal computer. So, for example, I am currently running Windows 7 on my laptop, but I am also running this Linux Virtual Machine inside VirtualBox, a program installed in Windows 7. Using a Virtual Machine means I don’t need any hardware. I don’t have to build a second computer just for Linux, and I don’t have to reboot my laptop every time I want to dual boot into my Linux Operating System. All I have to do is open VirtualBox, choose my Linux VM, and start the OS.

VirtualBox is a handy open source program that you can install on your host computer (the one that is going to be running the VM’s), whether it be Windows, MAC, Linux, or Solaris. Inside VirtualBox, you can boot into a second operating system, whether that means you boot into Linux while still being logged into Windows, or you boot into a MAC while still being logged in on a Linux machine, etc; and it will run as if it’s just another application on your regular operating system. You can run as many virtual operating systems inside VirtualBox as you want, the only limit is your computers disk space and memory. All of these operating systems that you can boot into are called the Virtual Machines.

VirtualBox will interpret any operating system you install as a VMDK, which is a Virtual Disk Image. This image file is considered a hard drive by VirtualBox, which is why it can boot into the operating systems.

So lets get started in the program. When you first boot up, you won’t see any VM’s listed, because you haven’t created any yet. Click on the New button at the top. From here, you will go through a setup wizard. First you’ll need to choose a name for your first Virtual Machine. I’ll call this one Ubuntu 32 bit. Then choose your OS Type that you will install in a few minutes. This will be Linux Ubuntu for myself. Next you will choose how much memory you want to allocate. I would suggest anything higher than 512 MB. I chose 1 GB for mine.

Next you will need to create a new hard disk. Since I’ve never run Ubuntu on my machine in a VM, I’ll need to create a new hard disk, enabling VirtualBox to see and use the operating system I’ve downloaded as a .iso file. Next you need to choose whether you want to store data dynamically or fixed size. I recommend dynamic data storage because it takes up less space and will only use up more space as needed.

Click next and choose the location you want to store data. I’ve created a new folder called Ubuntu and chose 8 GB allotted space.

After this, you’ll see a summary of your choices; click finish.

Now you’re ready to start up your new VM for the first time! Click on your new VM and choose Start. First you’ll need to select your installation media. This is where the Ubuntu .iso we downloaded earlier takes place. Click on the folder icon and find your .iso, then click next and finish. If all goes well, you’ll see a little first-time popup about how your mouse will be captured inside the VM and you’ll have to press a host key to use it in your Host PC again, and the new Virtual Machine operating system should start. After waiting a few minutes it looks like mine worked! Now, you can see I’m running Ubuntu inside my Windows 7 laptop. It’s automatically connected to the internet, and I can tinker to my heart’s desire.

In addition to being able to use VirtualBox like I did previously, you can also choose to add Guest Additions. These are addons that enable you to use the mouse without the need for a host key to uncapture it, share folders and files between the host PC and the guest VM, give you better video support, and plenty of other features.

What program or command is giving you warm fuzzies? Hit me up — tips@hak5.org

And be sure to check out our sister show, Hak5 for more great stuff just like this.

This time on an exciting brand-new-studio edition of Hak5 we’re getting hands on with the latest version of BackTrack-Linux, configuring virtual machines and wireless. Shannon’s flashing the firmware on a Dingoo Digital A320 and installing a custom distro of Linux and so much more.

Download HD Download MP4 Download WMV

Hacker Headlines

Oh Skype… They have another security problem. Skype on Mac OS X has a bit of a flaw. You can send a Skype message to another user and potentially get remote access to that other computer. Gordon Maddern, a security researcher, found the flaw and told Skype about it more than a month ago, but there was no fix until after the news started spreading that there was an issue. Skype has released a small term patch, but no full fix has been released, nor has users been notified to update.

Just days before Google I/O begins, French security firm Vupen demonstrates a zero-day vulnerability in Google Chrome allowing remote execution. The exploit, which hasn’t been released to the public, bypasses Chrome’s praised Sandbox as well as Address Space Layout Randomization and Data Execution Prevention. Google, busy introducing the Chromebook, has not verified VUPEN’s claims and says that if necessary an update will be pushed to users automatically.

The death of Osama Bin Laden has spurred several scams throughout the interwebz. Malware has shown up on certain websites, a Facebook scam popped up, and even the blog of the guy who accidentially live twittered the event has been compromised. Scammers are smart and they know what you’re looking for. People want to see the ‘Osama death video’, which doesn’t exist. So for anyone out there who was considering clicking that video on Facebook and sharing it with your friends, DON’T, and while you’re at it, delete it from your profile if someone else posted it.

Symantic security researchers are reporting that a flaw in the way application authentication works on Facebook, nearly 100,000 apps may have complete access to your account. Facebook now uses OAUTH 2.0 for authentication, however older authentication schemes are still in use. The firm advises users to change their passwords immediately — which essentually thwarts the access token bug.

Hot off the heals of Ubuntu’s 11.04 “Natty Narwhal” release — which has been getting mixed reviews due to the new Unity window manager, Backtrack Linux releases the much awaited version 5. In addition to native 64-bit and ARM processor support the security distribution now comes in both KDE and Gnome flavors. Are you excited? Have you checked it out? It’s available via torrents, has a stealth mode, comes with Metasploit, and sounds just plain awesome!

Kerby’s oldschool app of the week
Oregon Trail

Hacking the Dingoo Digital A320

This week I’m introducing this fun little device called the Dingoo Digital.

The Dingoo Digital A320 is a gaming handheld for open game development. It has modest hardware specs: 400MHz CPU, 32MB of RAM, 4GB internal storage, a miniSD reader, a 2.8″” LCD screen with a 320×240 resolution, and your normal jacks. The cool part is the software. You can playback several video and audio file types, there is a built in FM tuner for radio, you can record voice, and the SDK is available for free. My favorite part is it’s customization features and ability to play ROMs. Because who doesn’t like video games?

The device comes preinstalled with several arcade games like Centipede, Mine Sweeper, and has built in Emulators for your convenience as well. But if you want more with your new toy, what is better than installing Linux on it?

Enter Dingux, the Linux Distro for the Dingoo. You can get Dingux on the dingoo-scene website as well as really easy steps to follow if you want to check it out.

First off, you’ll need to download a couple of files. Booboo’s dual boot installer zip file for Windows, and the local-10 or local zip file. Charge your Dingoo so it doesn’t die during the reflashing process. We don’t want a bricked Dingoo!

Once your files are downloaded, unzip the Dual Boot file into a new folder wherever you want on your PC.

Turn on the Dingoo and go to the ‘System Setup’ menu, ‘About’, and press A. Press up-right-down-up-right-down and an easter egg diagnostics screen pops up. On the screen it should say ILI9331 or ILI9325 at the end of one of the lines. Mine says 9331. This is an LCD model and pertains to the flashing procedure.

Now, reset the Dingoo by holding B and pressing in the power button. The screen will stay dark so don’t panic!

Plug the Dingoo Digital into your PC. Choose cancel if any ‘new hardware found’ screens pop up. When your PC asks for a driver location choose your newly created Dual Boot folder. The driver should successfully install and you’re ready to flash your Dingoo!

Unplug the Dingoo, press the reset button, and let it boot into the normal firmware. You won’t need to hit the on button during this reset.

Hold the B button down and press POWER AGAIN. Plug the Dingoo back into your PC.

Open cmd, and go to the Dual Boot File directory. cd shannon\downloads\Dingoo Dual Boot and execute the usbtool-win file. We’re going to upload a file to a specified address, so we’ll type usbtool-win 1 hwinit.bin 0×80000000. This should start the flashing. Then type usbtool-win 1 zImage_dual_boot_installer_ILI9331 0×80600000 and press enter. A screen will appear on the Dingoo saying Dual Boot Flasher and press start to coninue.

Follow the on screen instructions. If done correctly, it’ll say Success at the end. You should see a Dingux startup screen when your Dingoo restarts. There is another step to getting Dingux to startup, so right now it’ll just boot to the original firmware.

Reset your Dingoo and plug it into the PC. Your PC should find it in a few seconds.

Next, plug in your mini SD card and format it to FAT32. Unzip everything from the second file you downloaded, local-10.zip, to the root of your mini SD card.

After unzipped, go to the mini SD card and rename your LCD screen file to zImage. So, mine is ‘zImage-20090707-ILI9331′, and I’ll change the name to ‘zImage’. Delete the other LCD image file if you want to.

Then, you’re done! Unplug and reset the Dingoo while holding down the Select key. It should boot into Dingux and launch the Dmenu. You should see a new menu on your screen.

Now that you have Dingux installed, go online and find some handy ROMs!

There is a ton of stuff you can do with this gaming device. The growing online community has tons of homebrew video games to try out, theme packs, and ROM’s available. I’ve linked a bunch of the websites in our shownotes. I’m thinking next week I’m going to try to stick Doom on here, because, why not? It’s DOOM!

Email me at feedback@hak5.org with questions and comments.

HakTip: BackTrack 5 first-boot

Darren is excited to be playing with the new BackTrack 5 linux. BackTrack is a fantastic distribution for security auditing. Version 5 is available in 32 and 64 bit flavors as well as ARM processor support and now comes in either Gnome or KDE.

Darren demonstrates how to setup either a USB drive to boot directly off, or a Virtualbox VM. Darren goes on to show off ethernet configuration and setting up a wireless adapter over USB.

Emails

Nick writes in:

http://hackertyper.net/
set type speed to 1 for a more realistic look.

Keep up with the latest on Hak5 by follow us on Twitter or Facebook. Subscribe and get your weekly technolust delivered automatically. Or show your support and grab some swag from the HakShop – including the new airport friendly WiFi Pineapple and hoodie. Finally if you’d like to suggest a topic
for ask a question feel free to hit up feedback@hak5.org.

Season 9 Premieres with the return of Shannon “Snubs” Morse and Paul “the camera guy” Tobias. We kick around the hacker headlines, get the low-down on Nexpose from Rapid7 at RSA, automate file mangement in windows, multiplex some screen sessions, capture packets from the command line and a lot more.

Download HD Download MP4 Download WMV

Hacker Headlines

Kinect hackers rejoice! Microsoft confirms that a Kinect SDK is coming for PC and Mac this spring, allowing developers to deal with the motion and voice sensor at a higher level than the informal Kinect hacks. The SDK will be free for personal use with a commercial version expected to follow.

Sony is threatening to permanently disconnect jail broken PlayStation 3 consoles from the PlayStation Network. Jeff Rubenstein, Sony’s Social-Media Manager wrote in his blog “To avoid this, customers must immediately cease use and remove all circumvention devices and delete all unauthorized or pirated software from their PlayStation 3 systems”

Donations have closed for the legal defense fund of George Hotz, notable iPhone jailbreaker and PS3 hacker. Sony has tied the hacker up in San Francisco federal since January court facing unspecified damages on DMCA violations. Hotz writes on his blog “I have enough to cover my legal fees for the time being.” and “For now, the best you can do is spread the word”

The latest VirtualBox 4.0.4 update adds support for Ubuntu 11.04 alpha guests. The Ubuntu Alpha, code named Natty Narwhal, introduces Unity as the default desktop session. Gnome can still be accessed as a “Ubuntu Classic Session”

Urban SQL Injection — full of win.

Crack the Code Challenge

Do you have what it takes to compete in the Crack The Code Challenge? Test your skills in our private lab network and bid for the title supreme leet hax0r. Winners will be featured on future episodes of Hak5!

Our next event will be this Sunday, February 27th at 3pm Pacific. Visit Hak5.org/challenge for all of the details. We’ll be live streaming at hak5.org/live throughout the day. We’d like to thank Citrix and GoToAssist Express for sponsoring the Crack the Code Challenge.

Rapid7′s Nexpose at RSA 2011

Darren meets with Chris Kirsch of Rapid7 to find out what’s new in Nexpose

Trivia!

Our last question was “In the Millennium Trilogy, what is the name of the hacker community?” and the answer is: “Hacker Republic”

Our new question is: “From March 5, 1975 to December 1986, this club of computer hoppyists would meet in the Silicon Valley Area.”

Participate at hak5.org/trivia

Hak5 finally goes HTTPS

Thanks to Domain.com our very own Hak5.org is finally sporting a shiny new SSL certificate. Darren recaps some of the nifty things you can do with one and recommends thawte SSL 123. Thanks Domain.com for hosting Hak5.org and sponsoring for over a year!

Automating Windows File Managment

Belvedere

What it does:
Automating file management and scripting on Windows: Belvedere.

Belvedere lets you organize any folders on your harddrive. You can create rules to move, copy, delete, rename, or open files based on name, extension, size, creation, date, and even more. So basically it’s a self-cleaner tool for Windows Only. There’s also a Mac cleaner called Hazel that you might want to check out if you are an Apple user.

It was created by Adam Pash back in ’08, and you can check out the source of this tool over at GitHub.

It’s a .exe so just install it from the download link. You can make Belvedere startup when Windows starts, but you’ll have to add it manually.

How you use it:
Belvedere is really easy to use, it’s just simple point and clicks. You create a folder, then name your rule from one of the choices, and build conditions with the drop down menus.

Belvedere gives me the ability to multitask and not worry so much about how clean my PC is.

Do you have another tool that works like Belve? Let me know at feedback@hak5.org.

HakTip: Multiplexing Screen Sessions

What’s more wicked than a screen session? Two screen sessions! As we’ve talked about recently the unix command Screen is a great way to maintain bash sessions from multiple SSH clients without losing your work. My favorite shortcut after invoking the “screen” command is CTRL+a followed by “S”, which splits the screen horizontally in two. Use CTRL+a then Tab to switch between the views. Debian users get the added sexyness of vertical split by hitting CTRL+a then Pipe.

What little gems are rocking your world? Hit us up, we’ll share ‘em with the world. tips@hak5.org

Email: Command Line Packet Sniffers

Hey, I’m in dire need of a command line linux packet sniffer. My servers are 3 hours away, and none have X11 installed. I used to use sniffit a long time ago, but it looks like they’ve added a GUI to it. Just wondering if you had any ideas off the top of your head.

Darren recommends TCPDUMP and NGREP

Have others to share? feedback@hak5.org

Sketching with the Harmony Project

Sparkleface writes in to share the Harmony Project — a nifty sketching program in HTML5. Check out the source code and more info

Keep up with the latest on Hak5 by following us on Twitter or Facebook. Subscribe and get your weekly technolust delivered automatically. Or show your support and grab some swag from the HakShop – including the new airport friendly WiFi Pineapple and hoodie. Finally if you’d like to suggest a topic
for ask a question feel free to hit up feedback@hak5.org.

This time on Hak5 we’re asking the question, can a three node Virtualization Cluster be built for under $1000? With the help of Proxmox, an open source virtualization environment, some cardboard boxes and a knife — we find out!

Download HD Download MP4 Download WMV

Hacker Challenge Recap
Darren reviews the recent Hacker Challenge and details improvements to this ongoing project.

Clustering with Proxmox
Darren demonstrates building virtualization clusters with proxmox. He also learns a very important lesson about the “any key” and pimps his cardboard case mod.

Virtio drivers and paravirtualization explained
Darren demos a live Proxmox cluster while building a Windows machine using the Virtio drivers.