BrokeBerry

Attack Computer Wiz

A Security & Technology Weblog

Configuring Remote Desktop with Network Level Authentication
 

, 0 comments

Windows 2008 server adds an extra layer of security when connecting via Remote Desktop. When enabled, legacy RDP Clients will not be able to connect to W2K8 Servers. If you are using Windows 2008 or Windows Vista as your client, everything is in place and you should be ok out of the box (just follow the first 4 steps and stop). But if you are running Windows XP you will need to make some minor registry tweaks to get this working.

First of all you need to turn on Network Level Authentication on your Windows 2008 Server. To do this simply follow the below steps:


1. Right click on the ‘My Computer’ icon and choose ‘Properties’.
2. Click on ‘Remote Settings” on the left side of your screen.
3. Now select the third radio button to set “Allow connections only from computers…”
4. Click Apply, OK, and exit your RDP session.

In order to configure your Windows XP client you must complete the below steps in to enable the Credential Security Service Provider (CredSSP):


1. Confirm you are running, Windows XP With Service Pack 3
2. Confirm you are running, RDP Client Version 6.0.6001 or better (Open RDP, right click the title bar, choose about)
3. Enable Network Level Authentication support:

1) Click Start, click Run, type regedit, and then press ENTER.
2) In the navigation pane, locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
3) In the details pane, right-click Security Packages, and then click Modify.
4) In the Value data box, type tspkg. Leave any other data and put the tspkg at the very bottom on its own line, and then click OK.
5) In the navigation pane, locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders
6) In the details pane, right-click SecurityProviders, and then click Modify.
7) In the Value data box, type credssp.dll. Leave any other data and put the credssp.dll at the end separated by a comma, and then click OK.
8) Exit Registry Editor.
9) Restart the computer.
10) Open Remote Desktop.
11) Right click in the title bar, choose about, and confirm the line near the bottom reads “ Network Level Authentication supported”
12) Click OK.

4. Finally you MUST connect to the W2K8 servers using the machine name, not the IP address.

That is all there is to it. You should now be able to connect your Windows XP Sp3 desktops to the NLA enabled Windows 2008 Server.

user Posted by Mike Wright

| More


Your Password is.......popcorn
 

, , , 0 comments

Sarah Palin had her email account broken into this week and it turns out that she used a week, easily guessable, password… “popcorn”. This is a very good example of how vulnerable password protected systems are and how important it is to protect the data that we access. Until we have an OpenID type solution (Old Post) your first defense in protecting yourself is a strong offence by creating passwords that are hard to guess yet easy to remember.


1. Passwords should be at least 15 characters in length.
2. Passwords should be complex and contain all of the below variations;
a. 1 lowercase letter (a, b, c, d)
b. 1 uppercase letter (A, B, C, D)
c. 1 number (1, 2, 3, 4)
d. 1 special character (!, @, #, $)
3. Never write your password down.
4. Do not use your name, birthdates, or other easily guessed words or phrases.
5. Do not share your password with anyone!
6. Never email your password.
7. Do not click on un-trusted links (bookmark your links and only use those bookmarks)
8. Create a different password for every single website you visit.
9. Do not mix work with personal.


Password suggestions:
Passwords can be hard to remember so some basic tips can help you create and remember a long complex password.


1. Think of a phrase that you like and use the first letters of the words in the phrase to create you password. example: The quick brown fox jumps over the lazy dog = Tqbfj0tlDog
2. Think of a phrase that you like and use the whole phrase as your password. example: The quick brown fox = Thequ1ckBrownF0x
3. Create a Password key word(s) that you can use throughout different systems. example: This is my password for = ThisismyPW4MySpace (then ThisismyPW4Yahoo, then ThisismyPW4Yahoo!, etc.)


Password managers:
Password managers can be a great way for you to save and remember your passwords. A password manager will save your usernames, passwords, and links in a secure way (i.e. encryption). The programs will allow you to create a master password that will allow you access to your password database. Using a password manager will allow you to create completely random passwords (i.e. “jkkjh$gf5!fJKJfHGD”) and save them. They also make it very easy to create a different completely random password for every single site you visit. There are some great, commercially available, password managers available. Do a Google search and find the one that meets your needs.

user Posted by Mike Wright

| More


Barack Obama's GMail Account Hacked!
 

, 0 comments

I love the Onion... Of course this is a joke but it's fun :)

Link to Pic

user Posted by Mike Wright

| More


Sarah Palin’s Yahoo Email Account Hacked?
 

, , 0 comments

I don’t even need to spend the effort writing about this because Martin McKeay hit the nail square on the head (link below). I do want to add though; Where are the fact checkers? Has this information been validated or is the media and the web users just letting it run like wildfire? And, is this just a fabricated story meant to cause damage to the McCain/Palin ticket?

My thoughts… and of course, I could be wrong… I think this will turn out to be a fraud and the screen shots that everyone is seeing and ranting so much about will be discovered to be fabricated and completely false. Can we say "Photoshop"?

Martin’s Blog

Updates:

9/18/2008: I still stand by my thought that this is going to turn out to be a fraud... Let’s assume, granted lets agree that YES in fact her email accounts were hacked, that part I am not disagreeing with. Let’s also agree that some (a single so far) emails are valid and verifiable. This much I believe to be fact. (Passwords suck) There is no way that anyone with half a brain cell would assume that using a personal (Yahoo) email account would believe that they could do so for government business and keep if off the radar. IF this was the case, her emails to "The Govenator" would have been sent to T-1000@yahoo.com.... NOT his state of California email account. It is basic Government employee training (right down to the guy who changes the mints in the bottom of the urinals) that you do not do anything on the systems that you don’t want to read about in tomorrow’s news paper. Non-repudiation Look it up. In addition to that: The email accounts have been deleted from Yahoo… If that is also fact it would be destruction of evidence, a serious crime, which I also doubt her or Yahoo would be willing to so publically commit. My thoughts are still, Photoshop between the lines. Here is another great link with credit to Martin McKeay

9/23/2008: Busted

user Posted by Mike Wright

| More


Dispose your personal data… at Costco?!
 

, 0 comments

For the first time in a while I went to Costco over the weekend. Near the pharmacy I located 3 medium sized trash receptacles with padlocks on them. Upon closer inspection these bins are being provided for customers to place their confidential materials for destruction.

Who in their right mind would take confidential document (used checks, bank statements, utility bills, credit card information, etc.) to Costco, dump them in a bin with a $4 lock on it, and walk away. Well, plenty of people it seems, all three bins were no less than two thirds full. Not a single observer asked any questions of me when I stuck my camera phone inside one of the bins and snapped a photo (3 photos actually). I wonder if they would have said anything if I grabbed a handful of paperwork? I would pass on this service, thanks, but no thanks!

http://www.recall.com/

user Posted by Mike Wright

| More


MonAppleY
 

0 comments

The once rumored kill switch for applications that Apple-co does not want is now confirmed. With the 2.0.2 firmware upgrade Apple now can remotely kill any application that you have installed on your iPhone or iTouch. The first casualty on my device would be the PhoneSaber application. It was nothing more than a Star Wars style light saber that made swishing noises as you moved your device around. But it is no more (it worked fine under 2.0.0).


And second: After being home from work for the forth week with a new family member (hence no posts for a while) I just moved my treadmill out to the garage, setup a TV in front of it, and went online to order a video cable for my iTouch. A cable is a cable, and there is no point in spending $50-$100 on some monster of a cable with platinum plated whatever! So as always, I started looking at the $6 cables. Every single one I found had comments that they do not work on newer firmwares. It seems that sometime around the first of the year Apple flipped a software switch that killed all cables and adapters that are not branded with the Apple logo and of course that comes with a steep price! Some speculate that there is a chip in the cable?


Thanks again Apple for ripping me off. Can you imagine if Microsoft put a device killing switch in their operating system that only allowed to you connect Microsoft keyboards, Microsoft mice, and Microsoft branded power cables. Who does Steve Jobs have naked pictures of at the FTC!

user Posted by Mike Wright

| More


Google looks to Outshine the Competition with Chrome
 

0 comments

Google's new web browser, Chrome, is now available for download as a beta. Go figure another Google beta. At first glance Chrome looks very clean and user friendly.

Google seems to like challenges and now they have a big one ahead if they are going to try and make a grab at a piece of the browser market share. With Microsoft IE and Mozilla Firefox taking the lions share of the browser market, well okay Microsoft taking most of that, we will see if Chrome can become a player. We have to realize that Chrome is far from finished, but it looks like a good start.

Try Chrome for yourself

user Posted by Jason

| More

Newer Posts Older Posts