Tekjournal

Why Windows 8 tablets will be a big deal…

tekjournal — Fri, 27 Jan 2012 18:47:07 +0000

True tablet interface with: Management.

Where are all the evil empire comments now?

tekjournal — Mon, 23 Jan 2012 18:10:23 +0000

As Apple takes over the title of the evil empire where are all the comments now? Come on Apple fanboys why so quiet? You fried Microsoft for their actions now you stand back and do what? Silence? Need proof, look at Apples new iBooks format that kills the ePub format and makes it so that the only eBook distribution company that can make money is Apple. Come on DOJ where is the anti-trust suit?

SLATE Conference and Scott McLeod

tekjournal — Sat, 21 Jan 2012 22:23:22 +0000

I attended the Wisconsin SLATE conference in Decemeber and had the unfortunate opportunity to attend the keynote which was given by Scott McLeod. I always love it when someone that knows a bit of technology talks to those that don’t and the hook line and sinker takes over! Everything that came out of this guys mouth is so two years ago. My advice to him: move on as your dog and pony show is old news! Do you think that schools throughout the state and country don’t know that we need to teach technology skills? Do you really think that Facebook and Twitter are going to save our educational system? Fact for you Scott: Collaboration between “C” level players gives you “C” level work. Steve Jobs had this figured out, read his bio. He didn’t put up with “B” or lower players. You were fired! That’s how a company like Apple is formed. Being an “A” player takes hard work and no bit of collaboration or technology is going to make you an “A” player. I think back to my fourth semester of Calculus, it was tough! There wasn’t anyone standing there next to me holding my hand and I couldn’t run home to mom and cry on her shoulder and make it all better. Study, study study, hard work!

Bottom line: The SLATE conference had better rethink their standards for keynotes as this was extremely sub par and I’m going to have to really think next time as to whether or not the time spent will be worth it. Want a great conference: Brainstorm!

Lets all buy tablets…

tekjournal — Sat, 21 Jan 2012 22:13:04 +0000

I have the solution to all of educations problems! Its easy! Just buy an iPad (or whatever flavor of tablet you like) for every child in the school!

If only it was that easy.

For those of you out there running down this road spending millions of taxpayer dollars on something you have ZERO (and yes you have ZERO) proof will change anything, where is the accountability? Are you putting your job on the line for this? When you get five years down the road and this has changed nothing who do you answer to? What happened to all the “research this” and “research that” stuff to prove that what you were going to spend millions on will actually work? Oh, I forgot that all that changes when it comes to cool new toys that are purchased to make a school look like they are at the top of the technology game!

If you haven’t faced the facts yet you need to come to a realization that tablets are a secondary device for many people and game playing devices for the most (it only takes a quick look to the top downloads on any app store to figure this one out)! I have multiple tablets (iOS and Android) and they have far from become my primary device. Percentage used on them: maybe 5%. My primary use is to take notes at meetings, surf the web and check email. Fact: tablets are consumption devices not content creation devices! Do I think I am going to do some software engineering on a tablet? No. How about create a spreadsheet? No. If tablets are going to replace laptops then why is the first thing tablet purchasers get as an accessory is a keyboard? Wow, I now have a laptop, oh that’s right we have had these for years. Yes, I know the touch interface is awesome and you will get no argument from me on this.

Now you may take my post as an all out attack on tablets in education but it isn’t. Tablets have a place in education just like graphing calculators did but as with everything balance and common sense are needed. In education there is always something out there that sales people want everyone to think will change the world and they are going to use every tactic (including making you feel inferior) to get you to purchase. Guess what folks, math is hard, calculus is hard, and an iPad and Facebook aren’t going to make them any easier! Dedication and hard work are the only solutions to these problems.

So all of that said where are tablets in education. First and foremost to truly revolutionize education these devices must be accompanied by software that allows everything to be tailored to the child. I want a textbook application that adapts to where the child is at and gears content based upon assessment scores. I want an assessment application that allows quick snapshots of where children are at on given skills. I want all of this wrapped up into a learning management system that allows every stakeholder in the educational process to be able to see the information they need to make decisions that are best for our children. Guess what folks, we are a very long way from this! Running Wheres My Water on an iPad gives you zero feedback as a teacher. Are you going to sit and watch each student work on the iPad? How do you assess what they have done with these applications? So everyone out there is running out buying systems that they have ZERO (and again you have ZERO) way to be able to test their effectiveness. Now that is accountability at its best.

Finally I would just like to mention how completely disappointed in Apple I am from this weeks BIG announcement regarding e-textbooks. Apple, can you make it any more obvious that all you care about is the bottom line? This big announcement had to do with one thing, iPad sales. Want to really help education Apple? Make open applications that can be used in any operating system on any device.

Google Apps and Los Angeles

tekjournal — Fri, 21 Oct 2011 11:45:21 +0000

Interesting article on the Google Apps implementation for the city of Los Angeles:

http://betanews.com/2011/10/20/los-angeles-wants-refund-for-google-apps/

Hopefully this will wake up the Google fan boys so that every organization out there doesn’t fall for the “Google Everywhere” concept. The fact is that this solution doesn’t fit every situation and you still need quality IT staff be it contracted if you are a small organization or in house for medium to large organizations. While we are at it lets just face the facts that contracted employees will seldom put as much heart and soul into your organization as it is all about the clock and billable hours to them.

Air Force Drones

tekjournal — Mon, 17 Oct 2011 11:36:03 +0000

Just read an article on how the Air Force is downplaying the malware that has made its way onto the drone system computers. Hey Air Force wake up! It isn’t that this malware is a “nuisance” it is the fact that something was able to makes its way onto your system! You just told the world that your door is wide open, come on in. I can only imagine what these systems are running! At a recent security training I attended one of the other attendees was from a penetration testing group for the military and their comment was that they had just installed Windows XP! Sad, very sad! What are these drones running under Windows 95?

Steve Jobs and Edison…

tekjournal — Sun, 16 Oct 2011 23:54:55 +0000

For those Apple fan boys out there that are comparing Steve Jobs to Thomas Edison: get a clue! Jobs was a marketer not an engineer. Apple stole just as many ideas (can anyone say Xerox Palo Alto) as any other company and Jobs was right there in the thick of it. I can only imagine how many ideas that came out of Apple came from engineers that got ZERO credit for their work! Advice: go find another idol to worship!

Facebook in education and other rants

tekjournal — Thu, 13 Oct 2011 14:31:13 +0000

WARNING: This is a rant! I have really had enough of hearing from people that things like Facebook are going to save education! Really? Are educators really that foolish that they think that social media is going to solve all of educations problems? Wake up! Hard work is all that will solve educations problems!

I always laugh when I hear parents say that their child is so busy that they can’t get their homework done, and then the next breath is that they need to reduce/remove homework. Good choice! Lets have them participate in a sport that there is near ZERO chance that they will participate in after their high school career and not focus on the things that they will need THROUGHOUT life! And for all of you that say that participation in these sports is a great team building experience, yes it is for those that perform well, for those that don’t it is a demoralizing experience! Sitting on the bench is really a team builder!

Back to hard work, I remember my 4th semester of Calculus in college, it wasn’t easy, it was tough and for those that experienced it as well you know that there was NO ONE that any amount of COLLABORATION with was going to make it easier. It took effort and brain power. If you don’t have what it takes to do something like this don’t tell everyone else that it is their fault, get off your tail and work harder because in the real world it is a team of ONE. Don’t get me wrong with this in that I am not against teams as we are always part of one team or another but a high quality team is made up of excellent INDIVIDUALS.

For those that think that Facebook will save the world show me proof! Take every student in your high school and tell me what percentage of texts or Facebook posts have anything to do with education! My estimate: less than 1%.

Yes President Obama you are right, we are SOFT!

Using Technet Psexec

tekjournal — Tue, 11 Oct 2011 15:52:48 +0000

If you are in need of performing a task on a remote computer and you don’t want to start up a RDP session to do so (say you want to run ipconfig /all) you can use the psexec tool from Technet to do this and anything else you can dream up. You can download Psexec from here: http://technet.microsoft.com/en-us/sysinternals/bb897553

Once you have it downloaded (please note that the file you download contains numerous tools and psexec is just one of them) and unzipped you are going to want to copy the executable into a folder that is in your executable path (say c:\windows).

To give you an example of how to use this tool start up a command prompt and type in “psexec \\remoteworkstationname -u “username” -p “userpassword” ipconfig /all” and see what you get. Some things to remember here is that if you are using a domain level account you need to include the domain name then “\” then the user name. It is also a good idea to enclose your user name and password in double quotes.

As you can see from the example the things that you can do are pretty much anything you can do from the command line of the computer as if you are sitting at it. So here are some other examples:

gpupdate /force
gpresult /r
cmd
regedit

And the list goes on and on. If you really want to get creative you can run installers. A recent article in Windows IT Pro gave an example of installing Security Essentials using this command: “psexec \\remoteworkstationname -S \\servername\softwaresharename mssefullinstall-XP-x86\setup.exe /S /runwgacheck /o”

Some additional features worth mentioning are the ability to run the command on all computers that are listed in a specific file or a really dangerous one \\* which will run on all computers in the domain.

SET (Social Engineering Toolkit) Part 1: SET Shell using web site cloner

tekjournal — Tue, 11 Oct 2011 14:49:02 +0000

If you haven’t played around with SET (Social Engineering Toolkit) you need to get your hands dirty and give it a try. I am going to walk you through the basics of SET in this post.

First of all you want to get the latest BackTrack distribution and make sure it is up to date. I have other posts on how to do this but here is the short of updating BackTrack and SET.

Open a terminal session
To update BackTrack run “apt-get update” and “apt-get upgrade”.
To update SET navigate to the SET folder: cd /pentest/exploits/set
Run ./set-update

The overall plan is that we are going to take an existing web site (in this case www.gmail.com) and clone it into Backtrack which will then fire up a web server local to Backtrack that will publish the site to any user we “trick” into visiting this site (when they think they are visiting the real one). Once we serve up the web site to the user SET will attempt to own the users computer by using a specific attack vector (in this case taking advantage of Java and users that will click yes to anything) and will then push its payload (in this case a customized command line). The end user will see the web site just as they would if they visited the “real” site but in the case of this attack a Java popup will appear asking them to to run the applet. If you are thinking that this last bit of user input creates a barrier just think about how a majority of users in your environment will react to that popup prompt. Yes they will click to run it!

To run SET navigate to the SET folder via “cd /pentest/exploits/set” then run SET via “./set”.

The interface is pretty straight forward with numbered options.

This post is going to show a web site attack so select option 2. The menu will change to this:

This post is going to target systems that are vulnerable to the Java Applet attack so select option 1. The menu will change to this:

This post is going to show how to clone a web site so selection option 2. The menu will change to this:

Enter the URL of the site you want to clone. In this case http://www.gmail.com and hit enter. SET will clone up the web site and then ask you what payload you want to push out upon a successful attack.

This post is going to show SET shell which is option 11.

SET will then ask you what port number (it will default to 443) you want the web server to listen on. Enter it if you want to change it from the default and hit enter and you are ready for a “victim”.

Once a “victim” visits the site and fires up the payload you will get this:

Enter the number of the session you want to take and hit enter.

Once you have a shell on the victims computer you can see all of the fun commands you can perform via the SET shell by entering ? in the command. Some examples include:

localadmin that will add an admin account on the system
keystroke_start and keystroke_dump
bypassuac (the uac here mean User Access Control and you can imagine what bypassing this allows you to do).

So there is the basics and I think you have a good idea as to the damage that can be done by this tool. My advice to you is to fire this up and take each of your operating systems you are running in your environment and point it at it and see how it reacts. In my environment with Windows 7 and Java fully updated it does absolutely zero which is what you want. The examples above came from Windows XP system with SP 3 and Java out of date. Please note also that this is a reason why 3rd party patching is a must!