Virtualization On Windows

Operating System virtualization on the client side has many benefits including better security and more flexibility.  Depending on the resources available on your computer you can setup an entire virtual lab running numerous operating systems for testing.  Additionally, virtualization allows you to test software and perform other activities in a sandbox environment that will not affect your primary operating system.  You can infect your VM (virtual machine) but the rest of your computer will be safe.

There big players in the client virtualzation arena are VMWare Workstation, Microsoft Virtual PC and Sun VirtualBox. All have good products but only the Microsoft and Sun products are 100% free (and just a good as VMware IMO).

I have personally used both Virutal PC and VirtualBox for many years and recommend both for your virtual environment. Virtual PC always has great support for Windows operating system while VirtualBox does Windows well and is compatible with more Linux and Unix distributions.

Depending on what operating system you run on your physical computer will determine what client virtualization software you can run.

For Windows 7 Users:

Windows Virtual PC 32-Bit
Windows Virtual PC 64-Bit
VirtualBox

For Windows Vista Users:

Virtual PC 2007
VirtualBox

For XP Users:

Virtual PC 2007
VirtualBox

Using client virtualization software is very simple.  It is just like using a physical computer but your virtual monitor is just another window on your desktop.

You can boot up from a CD/DVD in your physical optical drive or use .ISO file and install the operating system in your virtual machine. Once you have your OS installed make sure you install the VM tools/additions/integration components on the virtualized machine for best performance.

Read More

Remove Personal Information From Office Documents

Microsoft Office and other Windows Applications store all sorts of personal information when you save a file. Your name, computer name, company, date and time last edited are all examples of data included in a simple Word document file.

If you are concerned about your privacy there is an easy way to strip this information from a file.

    1. Right click on the file and select Properties

    2. Click on the Details Tab

    3. Click Remove Properties and Personal Information on the bottom of the window

    4. Select Remove the following properties from this file option and check all the items you want to remove. I suggest using the Select All button.

    5. Hit OK and you are finished. All personal information is now removed.

Read More

Encrypt Removable USB Flash Drives With BitLocker

BitLocker was Microsofts first move into full disk encryption with support included in Windows Vista. Since then BitLocker has evolved and improved into a great software based full disk encryption solution. New for Windows 7 is support for removable disks. Using BitLocker on a removable USB flash drive provides a great way to protect your data in the event the drive was lost or stolen.

Not only will your data always be protected but it is possible to access your data on Windows XP and Vista through a read-only interface that is installed during the initial encryption. Now you are able to get your data anywhere, not just on your Windows 7 computer.

To get started you will need to plug in your USB flash drive and open Computer so you can view all your drives. Then, right click on your drive and select Turn on BitLocker.

Next, pick how you want to protect the drive. Set a password or use a smart card if your device has a smart card reader.

Click Next to continue.

It is a good idea to backup your recovery key so that you can always retrieve data in the event you forget your password.

Click Next to continue and then click Start Encrypting.

Encryption will now start. Depending on the size of your USB flash drive it can take a while. It took 14 minutes for my 2 GB drive.

When encryption is completed your drive is now protected.

Using BitLocker encrypted USB flash drive on another computer

When you plug your USB flash drive into a different computer it will still show up in Computer but the drive will have a different icon.

When you click on the drive it will ask you for the password.

Once authenticated, you will be see the special read-only interface where you can extract files off the encrypted USB flash drive.

Read More

Change Remote Desktop RDP Port

Port 3389 is the home of the remote desktop protocol that powers Remote Desktop Services on all modern versions of Windows.  If your system has Remote Desktop enabled, it is listening for connections on port 3389.  Since this port is both well known and can be used to attack accounts, it is low hanging fruit for script kiddies and bots looking for an easy target.

Theoretically on a system that does not have an account lockout policy in place which by the way is not a system default, the RDP protocol can be used to get the administrator password with brute force.  Brute force is a fancy way of saying trying all possible passwords.  If the system never locks out the account then time is the only barrier to eventually getting you password and logging in.

The first defense is to implement a good account lockout policy but that does not solve the entire problem.  Any administrator of a public facing Windows web server will notice that their server is continiously attacked by bots looking for an easy target.  The bots will often lock out your accounts which can be very annoying.

To protect your system from the bots and script kiddies I always reccomend changing the default RDP port.  This will not fool an intelligent attacker but it will weed out the noise.

There are two methods you can use to change the default RDP port.  The first is a simple registry hack:

Open up Registry Editor by running regedit.  Then navigate to HKEY_LOCAL_MACHINE, SYSTEM, CurrentControlSet, Control, Terminal Server, WinStations and RDP-Tcp.  Right click on the PortNumber dword and select Modify.  Change the base to Decimal and enter a new port between 1025 and 65535 that is not already in use. Finally click OK.



The second method uses a Microsoft Fix It wizard.  Click here to download the utility from Microsoft then click next to start the wizard.  On the PortNumber screen enter the new port you want to use, click next and that is it.



Make sure to reboot after either method to ensure the change is active.

Keep in mind that the next time you want to connect to your system with RDP you will need to provide the port number.  You can do that from the Remote Desktop client by appending a colon after the host name or ip address followed by the port number.  For example, if I have a computer with host name of tweak with RDP running on port 1234 I would use tweak:1234 in the remote desktop client hostname field.

Read More

Create An Account Lockout Policy

In my last article I showed you how you can protect your computer against anonymous user account attacks by turning on account logon auditing so you could see when someone attempts to remotely logon to your account.  Now I am going to help your increase your level of protection with the Account Lockout Policy.

Creating an Account Lockout Policy will protect your account by limiting the number of time a remote application or attacker can try to guess your password.  This works by automatically locking out your account after a designated number of incorrect passwords were entered.  Your account will remain locked out for a designated period of time before it is automatically unlocked and it can be logged into again.  This provides a valuable addition to your account security because it can render brute force password attacks useless.  If you have your lockout threshold set to 4 bad attempts and the lockout duration to 15 minutes, an attacker can try to guess your password a maximum of 16 times per hour.

Now that you know how valuable an Account Lockout Policy is, let’s get it setup on your computer:

    1. Click on the Start Button and key in Secpol.msc and hit Enter.
    2. Navigate through Account Policies and Account Lockout Policy.
    3. Right click on Account lockout threshold and select Properties.
    4. Enter in the value you want to use and hit OK to save. I like to use 4 here.
    5. Windows will set the default values for the lockout duration and Reset account lockout counter values.  If you want to change these values from the defaults (30 minutes), right click on them and select Properties. After making your changes hit OK to save and exit.

Read More

Turn On Auditing To Monitor Account Attacks

There is no doubt that all of the new security features in the modern versions of Windows will help keep your computer more secure.  However, these features become less valuable when they are not turned on by default.  One feature, known as user account auditing, is not turned on by default. With this feature is turned off, anyone with physical access or remote access to through a hole in your firewall (such an opening for Remote Desktop) can use a brute force attack against your user account for as long as they want without getting noticed at all.   How? The default audit security policy is configured to not log any account logon events, successful or failed.

This allows an attacker to try to hack your accounts for as long as it takes to break in.  There are a few ways to protect against this that I am going to go over in my next article about the Account Lockout policy.  But first, it is important to turn on this account auditing so that you can see who may be trying to break into your accounts.  After you have adjusted the auditing security policy, you will be able to see any account attacks including the account that they tried to logon with and where the request came from.

Let's get started and turn on audition for failed logon events:

    1. Click on the Start Button and key in secpol.msc in the box and hit Enter.
    2. Navigate through Local Policies and Audit Policy.
    3. Right click on Audit account logon events policy and select Properties.
    4. Check the Failure box and hit OK.
    5. Right click on Audit logon events policy and select Properties.
    6. Check the Failure box and hit OK. Your screen should now look like the figure below:



    7. Close Local Security Policy editor.

Your computer has now been configured to log all failed user account logon attempts.

Once you have turned on account auditing, you can view the logs in Event Viewer (run eventvwr.msc) under Windows Logs and Security.

Read More