Security & Area-H: September 2011

Wednesday, September 28

DECRYPT ENCRYPTED FILES - WINDOWS 7

FOLLOWING THE ENCRYPTION OF FILES IN WINDOWS 7, YOU NEED TO DECRYPT THE ENCRYPTED FILES. LINK FOR WINDOWS 7 FILE ENCRYPTION.

You may need to decrypt your files in the following circumstances :

Moving files to a new computer.

Re-formatting your current machine and using your encrypted files on the new installation of Windows

Exporting Your Current Encryption Key

When you learned how to encrypt your files, you created an encryption key. To export your key for use on another computer or on a new installation of Windows, do the following.

Press Winkey+R to open the run dialogue (Start > Run), and type mmc.

Click File > Add/Remove Snap in…

Select Certificates and click Add.

Click My user account and click Finish. Click Close. Click OK.

At the console root, expand Certificates – Current User > Personal > Certificates. Now right click on your user name and click All Tasks > Export…

Unless you want to change them, keep the defaults and give your exported file a name.

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Importing Your Backed Up Certificate

Press the Winkey+R to open the run dialogue, and type mmc.

At the console root, expand Certificates – Current User > Personal > Certificates. On a blank area in the right-hand pane right click and click All Tasks > Import…

Locate your backed up file and click Next.

Type in the key’s password (set when you created it), and check Mark key as exportable if you would like the option to transfer it, again, in the future. Check Include all extended properties and click Next.

Choose to store the certificate in your personal store and click Next.

You will be notified of the success of the import. You can now access your encrypted files again.

FILE ENCRYPTION ON HARD DRIVE - WINDOWS 7

THIS SECURTY FEATURE IS ONLY ENABLED FOR WINDOWS 7 ULTIMATE & ENTERPRISE EDITON.

IN THIS SECURITY LESSON, YOU WILL CAME TO KNOW ABOUT THE IN-BUILT ENCRYPTION TECHNIQUE IN WINDOWS 7. HOW YOU CAN ENCRYPT YOUR FOLDER OR WHOLE HARD DRIVE USING WINDOWS 7 OFFICIAL ENCRYPTION TOOL.

**************************************************************************************************************************************

ENCRYPT YOUR FILES

Right-click the file folder you wish to encrypt and click Properties.

In the Properties dialog, click Advanced.

Check Encrypt contents to secure data and click OK.

If you are encrypting a folder, you will be asked if you want to apply the encryption to sub-folders. This is useful if you want to protect the whole tree under the folder you are encrypting.

Your files will now be encrypted.

Notice the file or folder names are now green–this provides an easy way to show the data is encrypted.

DECRYPT YOUR FILES

If you want to decrypt your files or folders so they can be accessed on a different computer, simply follow the steps above and uncheck Encrypt contents to secure data.

Back Up Your Private Encryption Key

If you move your files to a new computer, operating system, or user account, you will need the private key to access your files. To backup the key after encrypting your files, do the following:

After encrypting your files for the first time, and icon should appear in the system tray. Double click on it.

Click Back up now (recommended).

On the Certificate Export Wizard, click Next.

Choose Personal Information Exchange and click Next.

Type a password and click Next.

Save your encryption key & CLICK FINISH.

You will be notified that the certificate export is successful.

Back up the certificate for later use. Your files and certificate are now protected.

----------------------------------------------------------------------------------------------------------------------------------------

Tuesday, September 27

PRIVATE BROWSING MODE EXPOSED

PRIVATE BROWSING AIMS TO HELP YOU MAKE SURE THAT YOUR WEB BROWSING ACTIVITIES DON'T LEAVE ANY TRACE ON YOUR OWN COMPUTER. IT IS VERY IMPORTANT TO NOTE THAT PRIVATE BROWSING IS NOT A TOOL TO KEEP YOU ANONYMOUS FROM WEBSITES OR YOUR ISP, OR FOR EXAMPLE PROTECT YOU FROM ALL KINDS OF SPYWARE APPLICATIONS WHICH USE SOPHISTICATED TECHNIQUES TO INTERCEPT YOUR ONLINE TRAFFIC. PRIVATE BROWSING IS ONLY ABOUT MAKING SURE THAT FIREFOX DOESN'T STORE ANY DATA WHICH CAN BE USED TO TRACE YOUR ONLINE ACTIVITIES, NO MORE, NO LESS.

HERE BELOW YOU WILL SEE, HOW YOUR DATA WAS STILL SAVED IN YOUR COMPUTER & ANY ONE CAN STILL TRACE YOU. PRIVATE BROWSING STILL NOT SAFE 100%.

**************************************************************************

USING THE COMMAND LINE

When you enter on a website, you first tell the browser the name of the site you want to visit. To contact that website, the computer needs to find the IP associated with the website name; to do this, it uses a DNS server.

As you can read the process is very straightforward. As it’s not necessary to get this IP address every time, Windows uses a program (a DNS client) to store this information.

To test everything first we are going to clear entries in the DNS client.

Press WinKey + R, type cmd and press Enter to open a command line.

In the command line type "ipconfig /flushdns" and press Enter.

You can see the DNS resolver cache using "ipconfig /displaydns".

Now we are going to open a Chrome window and go to any website using Incognito mode. This is the private mode of Google Chrome. To open a window in this mode press "Ctrl + Shift + N".

Can you imagine what happens if we close this window and check the DNS cache using "ipconfig /displaydns".

As we can see Chrome doesn’t remove this information from the DNS cache.

USING SCRIPT

You have to copy this to a notepad file :

@echo off

Powershell -noexit "ipconfig /displaydns | select-string 'Record Name' | foreach-object { $_.ToString().Split(' ')[-1] } | Sort | Out-Gridview"

As always go to File menu, click Save As…, and give the file a name i.e. “ShowDNSCache.bat”. (Include the quotes to save the file as a BAT file and not a TXT file.)

We can now easily find that someone has browsed Windows Guides (or any site.)

----------------------------------------------------------------------------------------------------------------------------------------

BIT LOCKER ENCRYPTION PORTABLE MEDIA IN WINDOWS 7

THIS DRIVE ENCRYPTION TECHNIQUE IS ONLY FOR ULTIMATE & ENTERPRISE EDITION FOR WINDOWS 7. BUT STILL YOUR SYSTEM REQUIRES TRUSTED PLATFORM MODULE (TPM) FOR ENCRYPTION.
IN THIS ENCRYPTION TECHNIQUE, YOU WILL LEARN HOW TO ENCRYPT YOUR PORTABLE MEDIA LIKE PEN DRIVE USING BIT LOCKER.

*****************************************************************************************************************

Plug your thumb drive into a USB port.

Click the Start button, type BitLocker, and click on BitLocker Drive Encryption.

Next to your thumb drive, click Turn on BitLocker.

If your thumb drive is compatible, BitLocker will prepare it.

Choose a password and click continue.

Either save your recovery key (used if you forget your password) or print a copy of it out.

If you save the file, ensure it’s stored somewhere safe.

Confirm your chosen settings and password and click Start Encrypting.

Your drive will now be encrypted, If you have a large thumb drive, this may take a long time.

------------------------------------------------------------------------------------------------------------------

Verifying Your Thumb Drive is Encrypted Properly

When protecting your data or anything you own, it is important to ensure the protection actually works. I took my thumb drive out of the Windows Seven machine and put it in a Vista machine. You should do the following too, to ensure your data is protected.

To verify your data is protected, do the following:

Put your thumb drive in another PC and try to open the files. You should see a BitLocker setup file, which shows BitLocker is not installed on the computer you’re testing on. If you have BitLocker installed on the machine, you will be prompted for a password (see the next step).

If you have BitLocker installed on the PC you are testing on, you will be prompted for your password.

Enter your password to get to your data.

--------------------------------------------------------------------------------------------------------------------

Removing Bit Locker Encryption

Plug your thumb drive into a USB port

Click the Start button, type BitLocker, and click on BitLocker Drive Encryption.

Next to your thumb drive, click Turn Off BitLocker, and click Decrypt.

Your drive is no longer encrypted.

BIT LOCKER DRIVE ENCRYPTION IN WINDOWS 7 - TPM BYPASSING

THIS DRIVE ENCRYPTION TECHNIQUE IS ONLY FOR ULTIMATE & ENTERPRISE EDITION FOR WINDOWS 7. BUT STILL YOUR SYSTEM REQUIRES TRUSTED PLATFORM MODULE (TPM) FOR ENCRYPTION.

A TPM IS A MICROCHIP DESIGNED TO PROVIDE BASIC SECURITY-RELATED FUNCTIONS, PRIMARILY INVOLVING ENCRYPTION KEYS. THE TPM IS USUALLY INSTALLED ON THE MOTHERBOARD OF A COMPUTER OR LAPTOP, AND COMMUNICATES WITH THE REST OF THE SYSTEM USING A HARDWARE BUS.

*************************************************************************************************************************************

To encrypt an entire drive, simply right-click on the drive and select Turn on BitLocker from the context menu.

A TPM ERROR, if you have a drive that doesn’t have a compatible TMP then you’ll need to use the following steps and have a flash drive.

Enter in gpedit.msc in the search box of the Start menu and hit Enter.

Under Local Computer Policy navigate to -->

Computer Configuration \ Administrative Templates \ Windows Components \ Bit Locker Drive Encryption \ Operating System Drives

and double click on Require additional authentication at startup.

Enable the feature and check the box next to Allow BitLocker without a compatible TPM, click Apply and Ok, and close out of Local Group Policy Editor.

Go back to the hard drive you want to encrypt and turn on BitLocker. A restart will be required to prepare the disk, and at this point make sure the flash drive is plugged in.

After the restart you’re prompted to use the startup key on the flash drive every time you start the computer.

Select the drive you want to use to store the key.

Again, simply right-click on the drive and select Turn on BitLocker from the context menu.

Next you’ll need to choose a secure password that will be used to access the drive.

You’re prompted to store the recovery key which is used in the event you lose your password or smartcard. If you store it as a file make sure that it’s not on the same drive that you’re encrypting.

Confirm you want the drive to be encrypted then wait until the process is complete. The amount of time it takes will vary based on the size and amount of data on the drive.

To access the encrypted drive you’ll need to enter in the password to unlock it.

The drive icon will change to show it’s encrypted with BitLocker, where the gold lock indicates it’s locked up and the gray lock is displayed after you have unlocked it.