How to Install SIFT Workstation and REMnux on the Same Forensics System

Having the right tools at your fingertips can save hours and even days when examining digital evidence or analyzing malicious artifacts. You can now install two popular Linux distros, SIFT Workstation and REMnux, on the same system to create a powerful toolkitfor digital forensics and incident response. This combo is reminiscent of "Transformers combining together to form a super robot."

You can start with SIFT and then add REMnux, or begin with REMnux and add SIFT to it. If you prefer the look and feel of SIFT Workstation, use SIFT as the starting point. If you like the look of REMnux, start with that one.

Option 1: Add REMnux to SIFT Workstation

If you wish to start with SIFT Workstation, make sure you have the latest version of SIFT running on Ubuntu 14.04 64-bit. Follow instructions to download SIFT as a pre-built virtual appliance or use the SIFT bootstrap script to install it.

After booting into SIFT Workstation and making sure that it has Internet access, run the following command to install REMnux on it:

wget --quiet -O - https://remnux.org/get-remnux.sh | sudo bash

You'll need to enter the SIFT user's password when promoted. By default, the password on the SIFT Workstation's virtual appliance is "forensics".

The REMnux installer will run for a while, depending on the speed of your Internet connection and the strength of your system. Once it completes, reboot the system. In this configuration, REMnux will not replace the SIFT skin, and your system will look like a standard SIFT Workstation with the exception of a few REMnux documentation shortcuts that the installer will add to the desktop.

Option 2: Add SIFT Workstation to REMnux

If you wish to start with a REMnux system, make sure you have REMnux installed according to its installation instructions to get a REMnux virtual appliance or use the REMnux installer script to bootstrap its installation.

Note that the REMnux virtual appliance is configured to use little RAM by default; ifplanning to install SIFT into the same virtual machine, increase the RAM to at least 4GB. Also, if using the REMnux installation machine to install REMnux on a compatible system of your own, be sure to allocate enough RAM and disk space to accommodate your SIFT plans.

After booting into REMnux and making sure that it has Internet access, run the following command to install SIFT on it:

wget --quiet -O - https://raw.github.com/sans-dfir/sift-bootstrap/master/bootstrap.sh | sudo bash -s -- -i -s -y

The SIFT installation script will run for a while, depending on the speed of your Internet connection and the strength of your system. Once it completes, reboot the system.

In this configuration, SIFTwill not replace the REMnux branding and your system will look like a standard REMnux system, with the exception of a few SIFTdocumentation shortcuts that the installer will add to the desktop.

Updating the SIFT+REMnux System

To keep your system up to date with the upgraded and newly-added software, periodically run the following update scripts for SIFT andREMnux, preferably in the order in which you've installed the two distros, such as:

update-sift
update-remnux

There you have it, two powerful forensics-focused distroscombined in one super-toolkit. Be sure to readREMnux and SIFT documentation sites for each distribution to learn how to use the powerful utilities now available at your fingertips.

Read More

Windows 10 Doesn't Stop Spying You, Even After Disabling It's Creepy Features

In our previous articles, we raised concern about Windows 10 privacy issues,

unfortunately, all those efforts got wasted because Microsoft still tracks you, even after you harden your Windows 10 privacy to an extreme level by disabling all privacy-infringing settings.


This time the culprits are – Cortana and Bing search.


Windows 10 features, including Cortana and Bing search, continue communicating with Microsoft's servers and sending it data, even after you turned the features off.

A Technical Analysis done by Ars showed that even when you tell Microsoft to not to make any Internet-related inquiries by changing various privacy settings, it appears that Windows 10 still communicate with the software giant's servers for different information.


Cortana is Cheating on You

With Cortana and searching the Web from the Start menu turned off, a request to www.bing.com is still made for a file called threshold.appcache that contains some Cortana information, whenever a user opens Start and start typing.
The operating system's voice assistant Cortana sends information containing user's identifying computer ID that persists across reboots. This allows Microsoft to distinguish between the Cortana requests from different computers.
The worrisome part is that Cortana sends this data even though she is disabled.


Windows 10 Sends your Data via Unencrypted Channel

Moreover, it also appears that Microsoft keeps on sending data to its servers via its Live Tiles in the Start menu. Even if users clear all the Tiles, Windows 10 re-install new tile info from Microsoft.

However, Windows 10 do so using unencrypted HTTP connections, potentially leaving users open to malicious actors who could intercept the traffic between users and the company, which is more troublesome.

In response to the latest report, Microsoft said that all communications between a Windows 10 machine and Microsoft are only to make the retrieval of updates easier.
"As part of delivering Windows 10 as a service, updates may be offered to provide ongoing new features to Bing searches, such as new visual layouts, styles and search code," Microsoft said.
Microsoft further added that "no query or search usage data" is sent to the company, in accordance with the user’s selected privacy settings, and the same applied to searching offline for apps, files and settings on the device.

Read More