Monday, October 31, 2005

Microsoft's WSYP Project - Customer Feedback for the Digital Age

Microsoft's WSYP (We Share Your Pain) is a new project spearheaded by Mauro Meanti in Microsoft's UK Office.

Check the Microsoft TechNet video for all the details. Every Windows user should watch it, IMHO.

Key Features developed by the project include - Micro-Stun option, Micro-Impact option and the Micro-Jab option.

Friday, October 28, 2005

Wireless Network Detection 101

Wireless Detection Tools can be divided into two major groups - Active Scanning or Passive Scanning.

Active scanning detection tools are noisy and are much more likely to be detected by IDS. They send out probe requests on all available channels at the rate of about once a second. All wireless access points that are set to broadcast their SSID will respond. Most Windows-based WLAN tools are in this group, including NetStumbler.

NetStumbler can be called the de facto wireless detection tool for the Windows platform. It is very easy to setup and free (free as in beer). There are many wireless tools for Windows but most aren't cheap and do more than just detection. Airopeek NX is a perfect example.

If you want to use NetStumbler while staying connected to a wireless network, check out this nice hack by Israel Torres. By using a hex editor, he was able to reactivate the Wireless Zero Configuration service for Windows XP.

Passive scanning detection tools are well - passive. Most passive tools will change the run state of your wireless card to disable it from sending packets out. This is often called monitor or promiscuous mode. Most of the time this is only possible in Linux/BSD operating systems, therefore most passive tools are designed for these systems.

This gives them a huge advantage over active scanning systems for three reasons.

1) Less Likely to set off IDS or IPS systems.
2) Able to dectect non-broadcasting clocked wireless networks.
3) Some Passvie tools can detect the use of Active Scanning tools.

Kismet and by far my favorite and one of the best passive wireless detection tools in the world IMHO. It is the program that all other wireless dectection tools are measured against.

In terms of Linux software, the Kismet program itself isn't too hard to setup but getting your wireless card to work in Linux with the correct drivers is normally the hardest part. Drivers have to be patched to work with monitor mode sometimes. But once it is working, you will be able to detect almost any wireless network (using the correct wireless card, of course =).

This is a very simple view of the wireless detection world however. Throw in encryption and GPS and you could easily fill up a book or two.

Thursday, October 27, 2005

Unique Web-Based File Systems

What do you think of when you heard the term "Web-Based File Systems"? Do simple web services like Xdrive pop into my head? Xdrive is a secure web based file systems, but it isn't free.

There is where the world of hacking meets the world of need. You need to store your files online, but you don't own an internet connected server and you don't want everyone in the world to read them. So what do you do? Check out these unique options.

Gmail Drive for Windows - creates a virtual file system on top of your Google Gmail account and enables you to save and retrieve files stored on your Gmail account directly from inside Windows Explorer.

Gmail drive type programs based on the same idea exist for both Linux and Mac OS X as well.

Encrypting the data before it is stored online increases the security, of course. Why not use free open sources tools for the encryption step as well?

GPG has always been my program of choice on Linux. It is installed by default on most Linux distros, so getting it up and working is almost painless. In Windows, you will have to install GnuPG from binaries to get the same features, but it isn't too hard either. There appears to even be a Mac OS X release of GnuPG.

This Gmail trick isn't anything new however. For total uniqueness, check out TinyDisk.

TinyDisk stores AES encrypted data in TinyURL.com's database! It basically takes your file, encrypts it using 128-bit AES, cuts the file into parts and then submits those parts as URLs (base64 encoded) to TinyUrl. TinyDisk stores the returned hashes from TinyURL along with the AES encryption key in a metafile.

Pretty cool eh? Right now, TinyURL doesn't verify if the submitted data is a valid URL link and it doesn't limit the amount of data submitted. That could be a huge problem for TinyURL. Luckily, the creator of TinyDisk built in the protection for them.

Want to play with TinyDisk, but don't like the idea of filling TinyURL's database? Check out Nanourl.

I would guess that changes will be made to TinyURL in response to this program. Is it the best web-based file system? Nah. But it is the most unique I have seen. Two Cheers to the Ad-wizards that came up with this one.