Gatchaman 2009 Trailer Leaked

Here is the trailer that has been reveal at the Anime Expo in July 2009.

CTUpdate is now WSUS Offline

With the move into V6.1, CTUpdate has been renamed WSUSOffline and has been retaken over by the original author. Basically WSUSOffline allows you to download OS / Offices updates from Microsoft (of different version whether you have them installed or not). There are options to burn to CD/DVD or keep in a portable HDD which you can carry around and patch other system. In short, download once, patch many systems. Not to mention its pretty effective if you go to low bandwidth areas.

Check it out at:
http://download.wsusoffline.net/

Using Gamebooster to perform vulnerability scanning

How often have you tried doing your VA or pentest with a limited system which is slow and extremely lack of resources? Well I have. Especially when I am located in some secured area where I cannot bring in my own laptop and are provided with one from the client. Most client will hardly even be able to offer you something working.

So, with the admin account, usually you will be able to install your scanning tools such as Appscan, Retina or Core Impact. But what happen is that these laptop provided often are in range of <1GB RAM etc. Well, I do not have a solution here. But what I have is a good (and free) tool which can help you regain some of the system resources while you perform the scan.

Introducing IOBit Gamebooster.
http://www.iobit.com/gamebooster.html

Yes, I know it say GAME all over it. But think deeper. How is a game application different from the scanning application? Both of them needs lots of resources. Both of them does not need lots of services and background processes running. So its simple as that. Shutting down the unnecessary services such as BITS, Printer Spooling etc during the scan will save you some resources.

Well, give it a try and see if GameBooster does indeed help you manage you scanning better.

The moment of Zen 2

I recalled I once wrote about a particular moment when I was back in the fields, look at the sun, lying on dirt and soil. And there I was again, same place, same time of the day. The sun was still hot, the wind was less cooling and then nothing...

This time I feel nothing at all. Other than the insect sounds and rotten smell, nothing. I guess the moment to feel completed empty was gone, probably forever. Although I spend a few days there, its simply too hot and too humid to consider anything. Actually, I do not even recall sleeping much there.

I guess, this mean something has changed. Its either me, or the place or simple the moment of time is just no there anymore. Although I wish to find that feeling again, I seriously doubt I would want to visit the place again.

Windows Mobile 5 or 6 Activesync Internet Pass Through

If you had problem connecting to the internet via activesync on Windows Mobile 5 or 6 or simply get a 0x80072f78 from Pocket IE, I found a solution here:

1. 1. Open Registry Editor on your desktop (Start/Run and type "regedit") and locate the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows CE Services.
2. 2. Right-click on the value list and choose New/DWORD value. Type the name "AllowLSP" and leave the value zero.
3. 3. Disconnect and connect your device and Pocket Internet Explorer (and all other applications) will start working.
   

My blog is worth USD$1061

Well, I don't know how true things can be, but according to this website:
http://www.websiteaccountant.com/www.nemesisv.blogspot.com



My blog is kinda worth USD$1061. Well, what do you think?

ATI Catalyst 9.8 is out!

Though these drivers are not yet available on the official download page, Over at Quakecon Ian “Cabrtosr” McNaughton released Catalyst 9.8 drivers.
According to the latest info, with this driver, you should see significant performance increases on AMD platforms.
These improvements are more platform related – you will see gains of up to 50% in some titles (like Far Cry 2) when using a CrossFire solution with 4870 X2 or other 4xxx series in resolutions 16x10 and higher – you’ll see these gains mostly in CPU-bound situations. You will also see significant improvements in titles like HAWX, Crysis, Company of Heroes and World in Conflict.

• ATI Catalyst 9.8 Windows 7 and Vista (64-bit)
• ATI Catalyst 9.8 Windows 7 and Vista (32-bit)
• ATI Catalyst 9.8 Windows XP (32-bit)
• ATI Catalyst 9.8 Windows XP (64-bit)

Windows 7 RTM (RTL) is available on Technet and MSDN

As mentioned at:
http://msdn.microsoft.com/en-us/subscriptions/default.aspx

Microsoft has released Windows 7 RTM (Release to Manufacturer) To MSDN users. Under their download, they will see the RTL (Retail) version of Windows 7 as a downloadable link.

Depending on the subscription, MSDN or Technet may have access to these starting from 6th August:

Windows 7 Enterprise (x64) - DVD (English)
Windows 7 Enterprise (x86) - DVD (English)
Windows 7 Professional (x64) - DVD (English)
Windows 7 Professional (x86) - DVD (English)
Windows 7 Ultimate (x64) - DVD (English)
Windows 7 Ultimate (x86) - DVD (English)
Windows 7 Home Basic (x86) - DVD (English)
Windows 7 Home Premium (x64) - DVD (English)
Windows 7 Home Premium (x86) - DVD (English)
Windows 7 Starter (x86) - DVD (English)
Windows 7 and Windows Server 2008 R2 Debugging Symbols Checked Build (x64) - (English)
Windows 7 and Windows Server 2008 R2 Debugging Symbols (x64) - (English)
Windows 7 Debugging Symbols Checked Build (x86) - (English)
Windows 7 Debugging Symbols (x86) - (English)
Windows Driver Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (English)
Windows Software Development Kit for Windows 7 and Windows Server 2008 R2 (x86) - DVD (English)
Windows Software Development Kit for Windows 7 and Windows Server 2008 R2 (ia64) - DVD (English)
Windows Software Development Kit for Windows 7 and Windows Server 2008 R2 (x64) - DVD (English)
Windows 7 Language Pack (x86) - DVD (Multiple Languages)
Windows 7 Language Pack (x86) - DVD (Chinese-Traditional)
Windows 7 Language Pack (x64) - DVD (Multiple Languages)
Windows 7 Language Pack (x64) - DVD (Chinese-Traditional)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (English)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Spanish)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Japanese)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (German)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (French)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Italian)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Russian)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Chinese-Simplified)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Portuguese-Brazil)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Dutch)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Polish)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Turkish)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Korean)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Chinese-Traditional)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Czech)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Portuguese-Portugal)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Hungarian)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Swedish)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Danish)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Norwegian)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Finnish)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Arabic)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Hebrew)
Windows Automated Installation Kit for Windows 7 and Windows Server 2008 R2 (x86, x64, ia64) - DVD (Greek)

红蝴蝶 (TVB 巾幗枭雄主題曲) ~ 吳卓羲

Windows Home Server PP3 Beta Supports Windows 7

Windows 7 is already well on the way, 7.7600.386 is rumored as the voted RTM. And we are looking at Oct 22 as the first day release. WHS is not taking this any slower as PP3 gears up and prepare for the support for Windows 7.

Here is the current breakdown of the beta which already support Windwos 7 RC:

•Windows 7 Compatibility Enhancements
◦Windows 7 Libraries integration: When you install the Windows Home Server Connector and log on a Windows 7 computer, you can access the Windows Home Server shares from Windows 7 libraries.
◦Windows 7 Action Center backup warning suppression: After you install the Windows Home Server Connector and enable the home server backup on your Windows 7 computer, you will not receive the warning from the Action Center which reminds that Windows Backup has not been set up.
◦Windows 7 power settings: You can configure your Windows 7 client computer to wake up at scheduled backup time and be put back to sleep after backup finishes.
◦Windows Search: Windows Search 4 has been included to improve query search times, indexing times and reliability. Extended remote discovery increases the efficiency of searching across all your libraries running Windows Search 4. Files encrypted with Encrypting File System (EFS) are now supported.
•Home Computer Backup & Restore Enhancements
◦File and computer restoration: Helps prevent the issue experienced when restoring files and folders from a Home Computer Backup that stops at 81 or 97 percent complete.
◦Reliability: Improved handling of temporary files helps to ensure necessary system files are backed up more reliably. Improvements to the backup repair process.
•Home Server Console Enhancements
◦Support for low resolution displays: This update enables the Windows Home Server Console to support low-resolution displays. The lowest resolution that is supported after you apply this update is 1024 x 600.
◦This update enables Windows 7 to be properly displayed as the operating system shown in the Computers & Backup tab.
•Windows Media Center Enhancements
◦TV Archive: Enables automatic archiving of recorded TV by moving your recordings from a Windows Media Center computer to your home server in the format of your choice. This enables playback in the correct format for your home computers and/or portable devices.
◦Console View: Allows you to see information about your home server’s storage space, drives, backup status, etc. from Windows Media Center.

Full articles with pictures:
http://blogs.technet.com/homeserver/archive/2009/07/17/windows-home-server-power-pack-3-beta-includes-enhancements-for-windows-7-based-computers.aspx

Download:
https://connect.microsoft.com/WindowsHomeServer

I Don't Wanna Talk About It ~ Rod Stewart & Amy Belle

Alone Again, Naturally

You heard it in Mansion Ikoku, in Ice Age 3... Now this is the original...

精武英雄 ~ 甄子丹 - 我话俾你地知!我地中国人唔系东亚病夫!!!

以无法为有法, 以无限为有限

无可挡原是我精武英雄
英雄无不冲动
谁阻挡凌辱我怎去遵从
坚持人的尊重
谁瑟缩中偷生我愤怒
我定我的命途
谁哑忍声音不会泄露
我心一生刺着刀

无妥协世局摇荡
甚么东亚病汉
无妥协眼在前望
历史因我被震荡
宁于猛火中灭亡

无担忧无害怕走上惊涛
英雄源于风暴
狂魔者来负我怎需分途
坚持人的骄傲
谁瑟缩中偷生我愤怒
我定我的命途
谁哑忍声音不会泄露
内心一生刺着刀

无妥协世局摇荡
甚么东亚病汉
无妥协眼在前望
历史因我被震荡
宁于猛火中灭亡

我话俾你地知!我地中国人唔系东亚病夫!

身在天边的远方
看沙穿过万里
令心感真理不死

无妥协世局摇荡
甚么东亚病汉
无妥协眼在前望
历史因我被震荡
宁于猛火中...宁于猛火中灭亡

Firefox 3.5 Privacy Mode AKA Porn Browser Mode

This is (In my opinion) the most significant change in Firefox 3.5. Not that its something new. I did remember it was attempted back in the days of Netscape. But now, someone finally give it some serious thoughts (in Firefox anyway).

To turn it on, simply go to Tools>Start Privacy Browsing (or CTRL-SHIFT-P for lazy bumps like me). But first, make sure you are on Firefox 3.5 final. You will notice that it will ask you to confirm. What they failed to tell you (or warn you) is that it will close all your current tabs, cancel all your downloads in the background etc. Anyway, ensure you are all ready to switch off all those, click yes and then you are in.

In the privacy mode (or AKA Porn Browser Mode for good reasons), all your surfing is not tracked. No history, no saving of password etc. Therefore, you can safely visit sites and download stuff that you do not want to leave traces on the machines. However, you need to take note that this can be a false sense of security. Whatever you do can still be tracked on the proxies, firewall or whatever was installed outside your machine. It can still be TRACABLE. So do not let the privacy mode fool you. You do NOT was an email from your boss asking why are you visiting playboy.com daily in the morning. :)

In addition, you will notice that there is a Clear Recent History option right under Tools below the Privacy mode. This does what it says and can be access lazily by CTRL-SHIFT-DEL. But its more than just clearing all history. It allows you to choose what history you wish to destroy. This is based on time though. If you wish to clear history about certain sites (such as porn4free.com etc), you can do so easily by using the History Library from History>Show All History (or lazily CTRL-SHIFT-H). Under the site you wish to purge, right click and select Forget About This Site. If you are in Privacy mode already, you will notice nothing comes up in the History Library obviously.

If you are really very very concern about privacy and press CTRL-SHIFT-P can really hurt you, do not worry. There is even a way to switch off all history completely whether you are in or out of privacy mode. To do that, select Tools>Option. Click on the Privacy tab and you can change it to Never Remeber History. You can also clear your cookies here by clicking on the link "remove individual cookies". Of course, you can also tailor the history behavior by selecting "Use Custom Settings for History" and change whatever options you desire.

Supposely you want to do something about the Location Bar search as well. You can change that in the same place under Tools>Option, Privacy tab. You can change it such that it search from history, bookmarks, both or none. That way you won't accidentally display search results from places you do not want to show your child when doing some homework together.

Normal users still have another option. Its call Firefox portable. I believe 3.5 is out as well. check it out at:
http://portableapps.com/apps/internet/firefox_portable

For U3 and other portable options, check the respective sites. The good thing about portable version is that it does not even cache into the actual system's harddisk, but instead in the portable devices only. The bad point is that portable version are usually not as often updated.

Ok, for normal users. You should stop here. What I am going to say is really advance stuff which can break or damage your Firefox installation. Firefox has a developer mode which has something known as Profile Manager. To access this, you will need to execute :

firefox.exe -ProfileManager

This will allow you to create, delete and manager different profile for use in Firefox. This should be the clean and ideal way to manage bookmarks and history. However, since this is a function that Firefox wish to hide from the users, let's just presumed this is not stable and usable for some reasons. In any case, the documentation for the Profile Manager is here:
http://support.mozilla.com/en-US/kb/Managing+Profiles

Firefox 3.5

Despite the title bar and many references which says FireFox 3.5 RC, check the About box. Its 3.5 Final. The Transformer look alike start page is cool though.

Firefox 3.5 Final is out

Grab it from softpedia:
http://www.softpedia.com/progDownload/Mozilla-Firefox-Final-Download-5787.html

Some of the enhancements:
New JavaScript engine called TraceMonkey
Porn mode privacy browsing
Location-aware (tracking?) browsing
Support for HTML5 Audio and Video tagging
Enhance scripting which shifts Javascript to background (AJAX?)

Personally, I am very concern about point 2 and 3 for obvious reasons. Oh, btw, this works with Windows 7 (finally).

IObit Security 360

At the same time that Microsoft released Security Essentials, IObits has also release their anti-mlaware solution. Actually, its much earlier, but I had not covered it since its still in beta. Well, its call Security 360. I wonder if Xbox or Symantec is going to kick a big fuss about "360", but of course we all know that nobody can copyright a number.

In any case, IObits solution is a beta and it is free as well. So, do pop by and try it at:
http://www.iobit.com/beta.html

Microsoft Morro is now Microsoft Security Essentials

Microsoft Morro is a highly anticipated Microsoft solution for anti malware. It is officially Microsoft Security Essentials. Just pop by here to download the beta now:
http://www.microsoft.com/security_essentials/support.aspx

The installation is pretty straight forward.

The picture with the castle is quite suitable for a security product.
However, its should be very expected that it can ONLY be installed on a genuine Windows product as you can see from the WGA below:


The install should take only a while.

After which, if you are installing this offline, I strongly suggest you download the updates in advence.

Manually download the definitions:
http://support.microsoft.com/kb/971606

In then end, I can only conclude that this is not going to be able to replace OneCare in anyway... This is simiply a glorified and updated version of Windows Defender with real time monitoring.

IBTRM v3 Problem

Ok, this is related to my previous post:

http://nemesisv.blogspot.com/2009/06/ibtrm-v3.html

If you had not read that, you should and think about it before reading on.

OK, there is 2 things wrong with the statement. And I do not mean the part in english, whether its 6 characters consisting ONLY of alphabets or ONLY digits. Let's just blame that on bad english and bad interpretation.

The first thing that is wrong is 6 characters. We all know that 8 characters are being recommended even on average security. Its the BANK we are talking about here. 6 is definitely too low. In fact, 8 is too low, by today's standard. For example, common rainbow tables for 8 characters are available and within 10GB. Easily downloaded and executed. That will take 5 seconds to break if the hash is available. Super computer is another way to look at it. With chips like Intel i7 (8 virtual cores), bruteforcing on the maths is not so much a big deal than it used to be. I think 8 is not really enough.

The second thing that is wrong is the restriction on repeated characters. This is the MOST critical mistake. While this seems to be a good idea to avoid combination like "111111" or "abcabc", it is a BAD idea when we come to the cryptoanalysis. Without restriction, we are talking about 10x10x10x10x10x10=1000000 combinations of digits. With the restriction, its 10x9x8x7x6x5=151200 combinations. Thats almost 85% of the space lost. Reducing the combinations space reduces the strength of the PINs / Password. Having this restriction for digits is almost reducing it to only 5 digits instead of 6. In a lame mans term, I probably only need at most 5 tries to get your password if I saw 5 of your digits, instead of 10 I normally need to.

Lets see how much worse / better it is for alphabets. Without restriction, its 26^6=308915776, with restriction its 26x25x24x23x22x21=165765600. Its not so bad, about 50% of the space lost.

For alphanumeric, it will be 36^6=2176782336 for non-restriction. If restricted, it will only be 36x35x34x33x32x31=1402410240, its slightly better, but still about 50% of the space lost.

Therefore you can see, giving such a restriction does not improve anything. In fact, it makes the PINs easier to be cracked in terms of computation.

I strongly urges MAS to rethink the way this restriction should be imposed.

IBTRM v3

Here is an extract from the IBTRM (Internet Banking and Technology Risk Management Guidelines) June 2008 published by MAS (Monetary Authority of Singapore) :

11.0.3
"PIN should be at least 6 digits or 6 alphanumeric characters, without repeating any digit or character more than once."

Can you see what is wrong with the above recommendation? Well, if you do not get it, I will explain in the next post.

The full guideline is available via:
http://www.mas.gov.sg/legislation_guidelines/banks/guidelines/Internet_Banking_Technology_Risk_Management_Guidelines.html