Hello There, Guest!
View New Posts  |  View Today's Posts
Mega Computer Security Compilation

  • 0 Vote(s) - 0 Average


01-13-2013, 05:27 AM #1
0x69
Unregistered
 

Information  Mega Computer Security Compilation
0x69's Mega Computer Security Compilation

Anti-Keylogging
Software specifically created for detection of keyloggers.

KeyScrambler - Link

Download: Latest Version (Windows,Personal Edition) | Docs: Documentation
License: End User License Agreement
Price: Free ($0) / Varies (Multiple Products)

Getting Started:
1) Install KeyScrambler
2) Options->Display
2a) Tray Icon->OK.


I Hate Keyloggers - Link

Download: Latest Version (Windows,Evaluation) | Docs: Documentation
License: N/A
Price: Free ($0) / Bloat-free ($30)

Getting Started:
1) Install.
2) Run.
3) Profit.



Anti-Virus

Avira Free Antivirus - Link


Microsoft Security Essentials - Link

Download: Latest Version (Windows Vista/7, 64-bit, English) | Docs: Documentation
License: Microsoft Security Essentials License Agreement
Price: Free ($0)

Recommended Settings:
1) Settings->Scheduled Scan->Set-up scheduled scans
2) "Check for the latest virus & spyware definitions before running a scheduled scan"
3) Settings->Real-time Protection->Enable All
4) Settings->Advanced->Enable All



Browser Protection
What's the point of being able to utilize the internet if you can't do it safely?

Mozilla Firefox - Link

Download: Latest Version (Windows) | Source: Source Code | Docs: Documentation | Alternative(s): Comodo IceDragon ; IceCat
License: Mozilla Licensing Policies
Price: Free ($0)

Getting Started:
1) Tools->Options
1a) Options->General->Ask where to save files
1b) Options->Security->Warn me when sites try to install addons
1c) Options->Security->Block reported attack sites
1d) Options->Security->Block reported web forgeries
1e) Options->Security->Remember passwords for sites (disabled)
1f) Options->Security->Use a master password (disabled)
1g) Options-Advanced->General->Submit Crash Reports
1h) Options-Advanced->Update->Automatically check updates for all
1i) Options-Advanced->Update->Ask me what to do
1j) Options-Advanced->Encryption->Use SSL 3.0
1k) Options-Advanced->Encryption->Use TSL 1.0

2) Install NoScript
2a) Options->Embeddings->Forbid Java
2b) Options->Embeddings->Forbid Adobe Flash
2c) Options->Embeddings->Forbid Microsoft Silverlight
2d) Options->Embeddings->Forbid Other Plugins
2e) Options->Embeddings->Forbid <AUDIO>
2f) Options->Embeddings->Forbid Font

3) Addons->Plugins->Disable All (Optional)

4) Install:
4a)Better Privacy
4b) Ghostery
4c) HTTPS Finder
4d) HTTPS-Everywhere
4e) LastPass (Why?)
4f) WOT - Safe Surfing
4g) Tor Button

5) about:config
5a) network.http.sendRefererHeader = 0
5b) network.http.sendSecureXSiteReferrer = false
5c) network.protocol-handler.external = false (default & sub-settings)
5d) network.protocol-handler.warn-external = true (default & sub-settings)
5e) extensions.blocklist.enabled = false
5f) network.http.keep-alive.timeout = 600
5g) network.http.max-persistent-connections-per-proxy = 16
5h) network.http.pipelining = true
5i) network.http.pipelining.maxrequests = 8
5j) network.http.proxy.keep-alive = true
5k) network.http.proxy.pipelining = true
5l) network.prefetch-next = false
5m) New->Boolean->config.trim_on_minimize->true


Chromium - Link

Download: Latest Version (Windows) | Source: Source Code | Docs: Documentation | Alternative(s): Comodo Dragon ; RockMelt ; SRWare Iron
License: Chromium Licenses
Price: Free ($0)

Getting Started:
1) Open Advanced Settings
1a) Privacy->Enable Phishing and Malware Protection
1b) Privacy->Use a web service to help resolve navigation errors (disable)
1c) Privacy->Use a prediction service to help complete searches and URLs typed in the address bar (disable)
1d) Privacy->Predict network actions to improve page load performance (disable)
1e) Passwords->Autofill (Disable)
1f) Offer to Save Passwords (Disable)
1g) Content Settings->Cookies->Block third-party cookies
1h) Content Settings->Javascript->Do not allow
1i) Content Settings->Javascript->Manage Exceptions->[*.]com ; [*.]edu ; [*.]gov ; [*.]net ; [*.]org (Whitelist)
1j) Content Settings->Plugins->Block All

2) Install:
2a) Last Pass
2b) HTTPS-Everywhere
2c) Ghostery
2d) WOT - Web of Trust



Data Retention
Data retention can help with malware analysis and prevention.

Deep Freeze Standard - Link

Download: Latest Version (Windows, Evaluation) | Docs: Documentation
License: Commercial
Price: $35.00

Getting Started:
1) Install Deep Freeze.
2) Whenever you need to keep your data, hold down "shift" and double-click the Deep Freeze icon in the tray.
3) Input password.
4) Boot Thawed on Next {X} Restarts
5) Apply and reboot.

Note: Always use your computer while "frozen" (data actively retained) unless you specifically need to boot "thawed".
I find it useful to sync my documents in the cloud, and sync every day or so.


Sandboxie - Link

Download: Latest Version (Windows) | Docs: Documentation
License: Shareware (Nagware) / Commercial
Price: Free ($0)

Getting Started:
1) Install Sandboxie.
2) Open any suspicious files or websites in a new virtual sandbox.

Notes: Particularly helpful for malware analysis.


fsprotect - Link

Download: Latest Version (Debian) | Docs: Documentation
License: GPLv3
Price: Free ($0)

Getting Started:
fsprotect Installation



Firewall
Wouldn't it be nice to have your own VPN/firewall/AV?
Note: This will be a generic guide with multiple alternative programs to use at user's discretion.

Gufw Firewall - Link

Download: Latest Version (Ubuntu Package Manager) | Source: Source Code | Docs: Documentation | Alternative(s): Firestarter ; iptables ; ipcop ; Shorewalls ; UFW
License: GNU General Public License
Price: Free ($0)

Getting Started:
1) Create a new Linux VM. (We'll be using DSL.)
1a) Memory: 50MB
1b) Virtual Hard Disk->None
1c) Network->Adapter 2->Internal Network
2) Desktop->System->Deamons->SSH->Start
3) Desktop->Right-Click->XShells->Root Access->Transparent
3a) "passwd"
3b) Decide on a new password (see: "Complex Passwords")
4)
Code:
ifconfig eth1 10.0.3.1
4a) Ctrl + S (Save State)
4b) Ok.
5) Power off machine.
6) Restore Snapshot 1.
6a) Restore->Start

7) Create a new linux VM. (We'll be using Ubuntu 10.10.)
7a) Memory: 256MB min. ; 512MB rec.
7b) Virtual Hard Disk->Create New Hard Disk
7c) VDI: 8GB (fine) ; 10GB rec.

8) Start the Ubuntu VM.
8a) Install Updates (Recommended)
8b) After all updates have finished, restart the VM.
9) Devices->Install Guest Additions
9a) Let it do its things. This may take up to 30 mins.
10) Shut down the VM.
10a) System->Base Memory: 512MB min. ; 1GB+ rec.
10b) System->Video Memory: 128MB+ Rec.
10c) Enable 3D Acceleration: Ok

11) Start VM.
12) Configure your firewall. This is where you'll actually have to do research and practice.
13) Manual Proxy Configuration: (Ubuntu Box)
13a) HTTP Proxy: 127.0.0.1
13b) SSL Proxy: 127.0.0.1
13c) Socks5 Host: 127.0.0.1
13d) Socks5 Port: 9050
14) Applications->Accesories->Terminal
14a)
Code:
ifconfig eth0 10.0.3.2
15)
Code:
ssh -N -L 9050:10.0.2.2:9050 root@10.0.3.1
15a) Yes->Input Firewall (DSL) Password
16) Terminal->File->Open Tab
16a)
Code:
ssh -N -L 8118:10.0.2.2:8118 root@10.0.3.1

18) Daily Use:
18a) Start Snapshot 1 (DSL)
18b) Start Ubuntu, Log in
18c) Applications->Accesories->Terminal
18d)
Code:
sudo bash
18e) Input password.
18f)
Code:
ifconfig eth0 10.0.3.2
18g)
Code:
ssh -N -L 9050:10.0.2.2:9050 root@10.0.3.1
18h) Yes->Password
18i) Terminal->File->Open Tab
18j)
Code:
ssh -N -L 8118:10.0.2.2:8118 root@10.0.3.1




Hard Disk Encryption
Encrypting your hard disk can prevent thieves from stealing your important information.

TrueCrypt - [size=3]Link[/size]

Download: Latest Version (Windows) | Source: Source Code | Docs: Documentation
License: TrueCrypt License Version 3.0
Price: Free ($0)

Getting Started:
1) Download TrueCrypt.
2) Install the program on the local machine.
3) "Create New Volume"
4) Select "Normal".
5) Select how many operating systems you're running. (If single-booting, partition encryption is recommended over disk)
6) Select an encryption algorithm. I suggest looking at a benchmark and deciding based on security and performance. I personally use a triple-cipher AES-Twofish-Serpent algorithm with SHA-512 or Whirpool. However, the default configuration is adequate.
7) Create a complex password. [ How Secure Is My Password | Complex Passwords ]
8) Here's the hard-part: randomly move your mouse. For plausible-deniability ("I forgot my password") do not display pool content.
9) Create your rescue CD. Burn it to physical media and keep a backup on a pen drive.
10) Choose wipe mode. How secure would you like to be? More passes = more secure = longer process.
11) Follow through with pretest.
12) Encrypt and wait...
13) Done!


PGPdisk - Link

Download: Latest Version (Windows) | Source: Source Code | Docs: Documentation
License: Open-source / Commercial
Price: Free ($0) / Varies (Multiple Products)

Getting Started:
Note - For our purposes we will be using passphrase protection versus public key or token key.
1) Open PGP.
2) Select the disk you would like to add a user to.
3) User Access -> Create User
4) Passphrase User -> New Username
5) Double-confirm the passphrase.
6) Finish.


FreeOTFE - Link



Malware Removal
Well, we all slip up once-in-a-while.

Malwarebytes - Link

Download: Latest Version (Windows,Free) | Docs: Documentation
License: Proprietary / Commercial
Price: Free ($0) / $24.95

Getting Started:
1) Install.
2) Open.
3) Perform full scan->Scan
4) Fix All.


Spybot S&D - Link

Download: Latest Version (Windows,Personal) | Docs: Documentation
License: Freeware / Commercial Business
Price: Free ($0) / Varies (Multiple Products)

Getting Started:
1) Install.
2) Open.
3) System Scan->Start
4) Fix problems.


Combofix - Link

Download: Latest Version (Windows,Free) | Docs: Documentation
License: Freeware
Price: Free ($0)

Getting Started:
1) Run. (This was a joke. Haha.)


HijackThis - Link

Download: Latest Version (Windows) | Docs: Documentation
License: GNU General Public License 2.0
Price: Free ($0)

Getting Started:
HijackThis User's Guide



Operating Systems
Operating system specific tips. (Some Googleing may be required.)

Windows XP - Link

Getting Started:
1) Update to Service Pack 3.
2) Enable ICF logging
3) Test service load and only enable required services.
4) Use complex passwords for service accounts.
5) Never log-n to service accounts.
6) Disable network access to service accounts.
7) Use accounts with minimal privileges needed.
8) Use the Microsoft Baseline Security Analyzer
9) Format your partitions to NTFS
10) Rename accounts
11) Replace the Everyone group with the Authenticated Users group inside the access control lists (ACLs) of your shares.
12) Disable IR (Infrared) transfers.
13) Regularly back-up data.



Virtual Machines
Virtual machines can be used to test out miscellaneous programs and scripts for undesired affects.

Oracle VM VirtualBox - Link

Download: Latest Version (Windows) | Source: Source Code | Docs: Documentation
License: Open-source / Commercial
Price: Free ($0) / Not Stated

Getting Started:
1) Install VirtualBox.
2) Download or create a VDI (Virtual Disk Image).
3) Run the VM (virtual machine) like a normal computer and install everything accordingly.
4) After you finish installing, you can use your new VM at any time.


VMware Virtualization - Link



Note: This is a constant WIP
Computer security is always changing and therefor this thread is dynamic.
Because of this it can not be guaranteed that all information is up-to-date and secure.
You have been warned.

01-13-2013, 05:43 AM #2
AceInfinity
Developer
*******
Administrators
Posts: 9,733 Threads:1,026 Joined: Jun 2011 Reputation: 76

RE: Mega Computer Security Compilation
TrueCrypt is a good utility. I have Windows 8 Pro, which was reformatted from a 7 Ultimate machine, so I've been getting used to BitLocker, which is a pretty neat tool as well :) I've never looked into the kind of security that it provides, but it did work well. Surprisingly when I did projects, It would work on Windows 2000 machines even, and prompt for user input to access the FAT filesystem. (I had even forgotten that I'd used BitLocker on the USB key at the time too.)


Microsoft MVP .NET Programming - (2012 - Present)
®Crestron DMC-T Certified Automation Programmer

Development Site: aceinfinity.net

 ▲
 ▲ ▲

01-13-2013, 05:54 AM #3
0x69
Unregistered
 

RE: Mega Computer Security Compilation
(01-13-2013, 05:43 AM)AceInfinity Wrote:  TrueCrypt is a good utility. I have Windows 8 Pro, which was reformatted from a 7 Ultimate machine, so I've been getting used to BitLocker, which is a pretty neat tool as well :) I've never looked into the kind of security that it provides, but it did work well. Surprisingly when I did projects, It would work on Windows 2000 machines even, and prompt for user input to access the FAT filesystem. (I had even forgotten that I'd used BitLocker on the USB key at the time too.)

I personally wouldn't trust BitLocker. FBI/NSA/Gov. creates deals with companies to add backdoors to help incriminate people.
The main concern, however, is simply the existence of the purposeful backdoor.
Lots of curious hackers (as well as malicious ones) will find them and then you have to worry about patching and other nonsense.
That's why with security I always prefer to use open-source software.
Contributors help find bugs/security-holes, fixes are created quicker, and I know exactly whats on my computer.
Also FYI, doesn't W8 have a "kill switch" created by Microsoft to help stop anyone?
Before it was released, I heard they were adding one which is the main reason I don't use W8 (besides the default UI).

01-13-2013, 06:37 AM #4
AceInfinity
Developer
*******
Administrators
Posts: 9,733 Threads:1,026 Joined: Jun 2011 Reputation: 76

RE: Mega Computer Security Compilation
(01-13-2013, 05:54 AM)0x69 Wrote:  
(01-13-2013, 05:43 AM)AceInfinity Wrote:  TrueCrypt is a good utility. I have Windows 8 Pro, which was reformatted from a 7 Ultimate machine, so I've been getting used to BitLocker, which is a pretty neat tool as well :) I've never looked into the kind of security that it provides, but it did work well. Surprisingly when I did projects, It would work on Windows 2000 machines even, and prompt for user input to access the FAT filesystem. (I had even forgotten that I'd used BitLocker on the USB key at the time too.)

I personally wouldn't trust BitLocker. FBI/NSA/Gov. creates deals with companies to add backdoors to help incriminate people.
The main concern, however, is simply the existence of the purposeful backdoor.
Lots of curious hackers (as well as malicious ones) will find them and then you have to worry about patching and other nonsense.
That's why with security I always prefer to use open-source software.
Contributors help find bugs/security-holes, fixes are created quicker, and I know exactly whats on my computer.
Also FYI, doesn't W8 have a "kill switch" created by Microsoft to help stop anyone?
Before it was released, I heard they were adding one which is the main reason I don't use W8 (besides the default UI).

I'm not a huge targets by governments at this point in time though haha. I don't have anything super important on my PC. If I did, I wouldn't even hook it up to the internet. And I wouldn't allow my PC in the hands of people I didn't trust. :)

I don't know about any kill switch, but i'll have to see if and when I get the source code for Windows 8. I can't expose any direct information about the source though, but it would be interesting to see for myself, unless this feature is no harm to be known by the public.


Microsoft MVP .NET Programming - (2012 - Present)
®Crestron DMC-T Certified Automation Programmer

Development Site: aceinfinity.net

 ▲
 ▲ ▲

01-13-2013, 06:40 AM #5
RDCA
Senior Member
***
Posts: 278 Threads:10 Joined: Jun 2011 Reputation: 9

RE: Mega Computer Security Compilation
You're getting the source to Windows 8? How the hell did you manage to do that?

01-13-2013, 07:08 AM #6
0x69
Unregistered
 

RE: Mega Computer Security Compilation
(01-13-2013, 06:40 AM)RDCA Wrote:  You're getting the source to Windows 8? How the hell did you manage to do that?

More than likely because he's a Microsoft MVP. (Check his sig)

01-13-2013, 07:10 AM #7
AceInfinity
Developer
*******
Administrators
Posts: 9,733 Threads:1,026 Joined: Jun 2011 Reputation: 76

RE: Mega Computer Security Compilation
(01-13-2013, 06:40 AM)RDCA Wrote:  You're getting the source to Windows 8? How the hell did you manage to do that?

I have all the source code from Windows 2000, up to Windows 7 right now. Windows 8 will be added soon enough I'm thinking. I can't say when though, there's been no notification yet as of any dates. Not sure about Windows RT either. Navigating through it though was a nightmare at first though. I've gotten used to it.

The good thing is that there's some .NET stuff that i'm more familiar with including source code to the .NET framework directly, otherwise, obviously there's C in there. That's no secret. I can't expose stuff that is not known though about the code.

I can share that I have access to the code though. That was made clear to me, I just cannot share anything about it, I have an NDA with Microsoft that I had to sign.
This post was last modified: 01-13-2013, 07:13 AM by AceInfinity.


Microsoft MVP .NET Programming - (2012 - Present)
®Crestron DMC-T Certified Automation Programmer

Development Site: aceinfinity.net

 ▲
 ▲ ▲

01-13-2013, 07:46 AM #8
0x69
Unregistered
 

RE: Mega Computer Security Compilation
(01-13-2013, 07:10 AM)AceInfinity Wrote:  I have all the source code from Windows 2000, up to Windows 7 right now. Windows 8 will be added soon enough I'm thinking. I can't say when though, there's been no notification yet as of any dates. Not sure about Windows RT either. Navigating through it though was a nightmare at first though. I've gotten used to it.

The good thing is that there's some .NET stuff that i'm more familiar with including source code to the .NET framework directly, otherwise, obviously there's C in there. That's no secret. I can't expose stuff that is not known though about the code.

I can share that I have access to the code though. That was made clear to me, I just cannot share anything about it, I have an NDA with Microsoft that I had to sign.

I have the source to 2K. Am I cool? :c
Also, are you allowed to post unofficial patches?

01-13-2013, 08:04 AM #9
AceInfinity
Developer
*******
Administrators
Posts: 9,733 Threads:1,026 Joined: Jun 2011 Reputation: 76

RE: Mega Computer Security Compilation
(01-13-2013, 07:46 AM)0x69 Wrote:  
(01-13-2013, 07:10 AM)AceInfinity Wrote:  I have all the source code from Windows 2000, up to Windows 7 right now. Windows 8 will be added soon enough I'm thinking. I can't say when though, there's been no notification yet as of any dates. Not sure about Windows RT either. Navigating through it though was a nightmare at first though. I've gotten used to it.

The good thing is that there's some .NET stuff that i'm more familiar with including source code to the .NET framework directly, otherwise, obviously there's C in there. That's no secret. I can't expose stuff that is not known though about the code.

I can share that I have access to the code though. That was made clear to me, I just cannot share anything about it, I have an NDA with Microsoft that I had to sign.

I have the source to 2K. Am I cool? :c
Also, are you allowed to post unofficial patches?

Patches? source code's to them? If by unofficial you mean something from someone with knowledge of the source code came up with then I would assume so, under the following conditions:

- It doesn't expose any hints as to what the secure Windows source code looks like
- It isn't going to be used at a later date as an official Windows patch

But that's almost impossible to achieve, as a patch will almost indefinitely expose what is being patched, and how it works as a patch would also expose how the rest of the code works more likely than not.

It's better to not assume things though so I don't get into trouble by assuming something that they frown upon :) Unless I ask them specifically and they give me the "Ok", that's about the only time I can do something. Otherwise I can use it in whatever way I want as far as I know. I just can't disclose any information on it.

I signed my NDA Jan. 1st, 2012 (last year), and so it's been in effect for just barely over a year now. If you have access to anything secure by some company this is common though. All companies have some kind of NDA if they have some product or even an idea that they don't want you sharing with others...
This post was last modified: 01-13-2013, 08:08 AM by AceInfinity.


Microsoft MVP .NET Programming - (2012 - Present)
®Crestron DMC-T Certified Automation Programmer

Development Site: aceinfinity.net

 ▲
 ▲ ▲

01-13-2013, 08:13 AM #10
0x69
Unregistered
 

RE: Mega Computer Security Compilation
(01-13-2013, 08:04 AM)AceInfinity Wrote:  Patches? source code's to them? If by unofficial you mean something from someone with knowledge of the source code came up with then I would assume so, under the following conditions:

- It doesn't expose any hints as to what the secure Windows source code looks like
- It isn't going to be used at a later date as an official Windows patch

But that's almost impossible to achieve, as a patch will almost indefinitely expose what is being patched, and how it works as a patch would also expose how the rest of the code works more likely than not.

It's better to not assume things though so I don't get into trouble by assuming something that they frown upon :) Unless I ask them specifically and they give me the "Ok", that's about the only time I can do something. Otherwise I can use it in whatever way I want as far as I know. I just can't disclose any information on it.

I signed my NDA Jan. 1st, 2012 (last year), and so it's been in effect for just barely over a year now. If you have access to anything secure by some company this is common though. All companies have some kind of NDA if they have some product or even an idea that they don't want you sharing with others...

Well, people reverse engineer even official patches.
I was asking because it would be nice to have patches for all those pesky, undesirable features Windows come pre-loaded with.




Forum Jump:


Possibly Related Threads...
Thread Author Replies Views Last Post
  Computer keeps spamming file explorer tabs Cratorsealoe1001 7 2,760 11-11-2016, 06:38 PM
Last Post: AceInfinity
  Android security threats Adriana 3 2,119 02-09-2013, 09:04 PM
Last Post: Crystalii


Users browsing this thread: 1 Guest(s)