average admins

I’m a little late with this, but there’s a new version of PuTTY that’s finally been released. According to their changelog, there hasn’t been a PuTTY release since beta 0.58 was released in 2005-04-05.

You can download the file from here:
http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe

And here’s a copy of the changelog. The feature I’m really looking forward to is the serial support (I currently use a program called TuTTY and another one called TeraTermPro).

* PuTTY can now connect to local serial ports as well as making network connections.
* Windows PuTTY now supports “local proxying”, where a network connection is replaced by a local command. (Unix PuTTY has supported this since it was first released in 0.54.) Also, Plink has gained a “-nc” mode where the primary channel is replaced by an SSH tunnel, which makes it particularly useful as the local command to run.
* Improved speed of SSH on Windows (particularly SSH-2 key exchange and public-key authentication).
* Improved SFTP throughput.
* Various cryptographic improvements in SSH-2, including SDCTR cipher modes, a workaround for a weakness in CBC cipher modes, and Diffie-Hellman group exchange with SHA-256.
* Support for the Arcfour cipher in SSH-2.
* Support for sending terminal modes in SSH.
* When Pageant is running and an SSH key is specified in the configuration, PuTTY will now only try Pageant authentication with that key. This gets round a problem where some servers would only allow a limited number of keys to be offered before disconnecting.
* Support for SSH-2 password expiry mechanisms, and various other improvements and bugfixes in authentication.
* A change to the SSH-2 password camouflage mechanism in 0.58 upset some Cisco servers, so we have reverted to the old method.
* The Windows version now comes with documentation in HTML Help format. (Windows Vista does not support the older WinHelp format. However, we still provide documentation in that format, since Win95 does not support HTML Help.)
* On Windows, when pasting as RTF, attributes of the selection such as colours and formatting are also pasted.
* Ability to configure font quality on Windows (including antialiasing and ClearType).
* The terminal is now restored to a sensible state when reusing a window to restart a session.
* We now support an escape sequence invented by xterm which lets the server clear the scrollback (CSI 3 J). This is useful for applications such as terminal locking programs.
* Improvements to the Unix port:
o now compiles cleanly with GCC 4
o now has a configure script, and should be portable to more platforms
* Bug fix: 0.58 utterly failed to run on some installations of Windows XP.
* Bug fix: PSCP and PSFTP now support large files (greater than 4 gigabytes), provided the underlying operating system does too.
* Bug fix: PSFTP (and PSCP) sometimes ran slowly and consumed lots of CPU when started directly from Windows Explorer.
* Bug fix: font linking (the automatic use of other fonts on the system to provide Unicode characters not present in the selected one) should now work again on Windows, after being broken in 0.58. (However, it unfortunately still won’t work for Arabic and other right-to-left text.)
* Bug fix: if the remote server saturated PuTTY with data, PuTTY could become unresponsive.
* Bug fix: certain large clipboard operations could cause PuTTY to crash.
* Bug fix: SSH-1 connections tended to crash, particularly when using port forwarding.
* Bug fix: SSH Tectia Server would reject SSH-2 tunnels from PuTTY due to a malformed request.
* Bug fix: SSH-2 login banner messages were being dropped silently under some circumstances.
* Bug fix: the cursor could end up in the wrong place when a server-side application used the alternate screen.
* Bug fix: on Windows, PuTTY now tries harder to find a suitable place to store its random seed file PUTTY.RND (previously it was tending to end up in C:\ or C:\WINDOWS).
* Bug fix: IPv6 should now work on Windows Vista.
* Numerous other bugfixes, as usual.

THE Visual Guide To Penetration Testing

As posted on one of my favorite blogs, A Day in the Life of an Information Security Investigator

What’s that? You really want a visual guide to penetration testing? Something that covers:

- Enumeration tools (nmap, firewalk, amap, nbtscan, hping, scanrand, sinfp, etc.)

- General Vulnerability Scanning Tools (nessus, typon, NGS Squirrel, MatriXay, SARA)

- Exploit Engine Tools (metasploit, manual SQL injection, etherape, netwox, hijetta)

- Pre-inspection visit steps (EVERYTHING!)

- Password Cracking (JtR, L0pht, Rainbow, pwdump)

- Network Recon (whois, samspade, google, social engineering, dumpster diving, zone transfers)

- Enumeration results steps (what if a certain port IS open?)

- Command line examples of each tool

Something that could be printed out and be your all-in-one guide to penetration testing?

SHAZZAM!

Behold, your wish has been granted.

This is a must see!

Chief

We began looking at VoIP recently to try and eliminate the bulk of 800 charges we incur for telephone banking.  Using local numbers at each city where we have a branch and our soon to be installed network, VoIP would be ideal to connect to the IVR server that is going to reside in Hot Springs.  Once we got the infrasturcture in place for the IVR solution we knew we could start replacing the traditional pbx systems as needed. 

Several times I have been told to stick to Cisco for VoIP, so when I started pricing our solution that is where I began.  I even made a trip to Hot Springs to see the Cisco Mobile Lab for a demo of their equipement.  It all looked really nice until I saw the price……

The price was like chewing a piece of bad meat, it kept getting bigger and I just couldn’t swallow it!  With everything we are spending to bring our processing in house, I knew there was no way we could ever justify spending that much to only support the IVR and we have too much happening already for there to be a major phone system overhaul right away.  I was ready to scrap the idea, and then along came Shoretel.

One of our vendors, Datacomm sells/manages Shoretel and Cisco VoIP products and wanted to give us a demo of the Shoretel system.  I was thoroughly impressed!!  They use voice switches and a centralized server for management so we don’t have to put in higher grade routers as we would have to with Cisco.  We only need routers that support QOS.  The call manager software doesn’t cost a penny.  It is included by purchasing the hardware and extension licenses.  We can even tie it to our existing pbx systems for partial use of IP phones until we can get our dinosaurs used to them.  They are scared of anything not made in the 80’s or earlier!  The shoretel system ends up costing less than 1/3 than the same Cisco implementation not including our saving on routers.

It will be about 3 or 4 months before we get our system installed since we don’t have our network in yet, but I will share the experience as we get it implemented.  Hopefully this hasn’t sounded too much like a commercial or Cisco bashing because I am a Cisco fan, but this seems to be a pretty great alternative. 

I found this link while surfing around this weekend and thought it would make a great bookmark. It’s a list of available documentation for each version of the PIX software.

Very handy!