Changing MAC Address in Windows 7 & Vista

The MAC Address of Network Devices in Windows 7 & Vista can be changed by making a simple change to the registry. A possible step-wise approach to accomplish this is presented below.

• Open Windows Registry Editor.
• Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class from the tree view on the left hand side.
• Open Command Prompt.
• Type getmac in Command Prompt and press enter to get the MAC Address of Network Interfaces on your computer. You will see the MAC Addresses of all Network Interfaces you have on your computer including virtual ones.
• Copy the GUID in Transport Name part of the device whose MAC Address you wish to change. The transport name is like \Device\Tcip_{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} where the GUID is the part highlighted in yellow.
  Note: The transport name will not be displayed for network devices which are disabled. So if you have a wireless network device and have it switched off you then will not be able to see the transport name of the wireless network device.
• Go back to the registry editor and press Ctrl+F to display the search window.
• Paste the GUID you found into the text box in the search window.
• Next untick both Keys and Values under LookAt and tick Data.
• Click Find Next to search the registry.
• The Registry Editor will automatically take you to a Key similar to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\XXXXXXXX-XXXX-XXXX-XXXXXXXX\00## and a String Value with the name NetCfgInstanceId would be highlighted on the right hand side. This String Value would contain your GUID.
  Note: You may have to search a couple of times before you are able to find this key.
• Right click on an empty space on the right hand pane in the Registry Editor windows and select New -> String Value. 
• Type NetworkAddress for the name of this new String Value.
• Double Click the new String Value you just created i.e. NetworkAddress and enter the new MAC Address you want for the interface. The MAC address should be in hexadecimal without any hyphens and should be exactly 12 characters long. Example: 00AA22BB44CC
• Close the Registry Editor and restart your network device for the change to take affect.
• To restart you network device you can either restart your computer or disable and re-enable your network device (using the Control Panel -> Network and Sharing Center).
• To check whether the MAC Address of the device has changed you can open Command Prompt and enter getmac.

Hacking or Phishing?

During the past few weeks, some Maldivian blogs got hacked according to the blog authors or those close to them. How did all these blogs get hacked? Is GMail security that low that any script kiddie could take over your blog? Or is there something else to it? Was the bloggers phished?

As far as I know GMail is pretty secure and there is no known way of hacking into someone's GMail account unless you know their password or secret question answers. Therefore, the only reasonable explanation for the recent "hacking" of several Maldivian blogs can only be attributed to phishing (this seems to be what is suggested by a recent article on the dhiislam website).

If you want to learn more about phishing and how to protect yourself from phishing attacks please read my previous post on phishing attacks. You can also read more about phishing on howstuffworks.com

Windows 7 & the freezing Windows Live Messenger

Symptoms:

• Windows Live Messenger freezes randomly from a few seconds to a few minutes on a Windows 7 system. The problem occurs while you chat and gets worse when you try to select an emoticon or wink from the menu.

Cause:

• Windows 7 has a service called WinHTTP Web Proxy Auto-Discovery Service  which gets called by Windows Live Messenger each time it wants an internet connection. This service fails to perform as expected under some circumstances.

Solution:

• Windows Live Messenger uses Internet Explorer settings to determine the type of internet connection the user has.
• Disabling Automatically detect settings under LAN Settings in Internet Explorer would prevent Windows Live Messenger from using the WinHTTP Web Proxy Auto-Discovery Service. To do this:
  
  • Open Internet Explorer.
  • Go to Tools => Internet Options.
  • Select Connections tab.
  • Click LAN Settings.
  • Uncheck Automatically detect settings.
  • Click OK.

Disable Automatic Virus Scanning in Firefox 3

By default, Firefox 3 runs anti-virus scans on downloaded files in Windows systems with anti-virus software installed. Depending on the type and size of the files downloaded Firefox can stop responding for a significant amount of time while the virus scan is being performed. Follow the steps below to disable automatic virus scanning in Firefox 3:

• Type about:config in the Firefox location bar
• Click the "I'll be careful, I promise!" button if the "This might void your warranty!" message is displayed.
• Type browser.download.manager.scanWhenDone as the Filter. Alternatively you can just navigate to the setting browser.download.manager.scanWhenDone in the about:config page.
• Change the value of browser.download.manager.scanWhenDone to false.

Note: Do not disable automatic virus scanning in Firefox if your anti-virus software does not support real-time protection.

Show close button on the last tab in Firefox 3.5+

In Firefox versions 3.5 and later the close button is not displayed on the last tab. If you try to close the last tab by pressing Ctrl+W then Firefox closes with the tab. Sometimes, this can be annoying, so here is a simple fix for the problem.

• Open a new tab in Firefox and enter about:config as the URL.
• Click "I'll be careful, I promise!" button to get to the config page.
• Make the following changes in the config page:
  
  
  • browser.tabs.closeButtons = 1
  • browser.tabs.closeWindowWithLastTab = false
• Close Firefox.
• Goto folder %APPDATA%\Mozilla\Firefox\Profiles\xxxxxxxx.default\chrome
  
  
  •  %APPDATA% == C:\Documents and Settings\\Application Data\ folder in Windows XP
  • %APPDATA% == C:\Users\\AppData\Roaming\ folder in Windows Vista and 7
  • More details on where the Firefox Profiles folder is located in different Operating Systems can be found at http://support.mozilla.com/en-us/kb/Profiles
• Open userChrome.css in a text editor such as Notepad++ or Windows Notepad.
• Add the following code to userChrome.css
  
  

  /* Add tab-close-button to last tab*/
  .tabbrowser-tabs[closebuttons="alltabs"] > 
   .tabbrowser-tab > .tab-close-button {
    display: -moz-box !important;
   }
  .tabbrowser-tabs:not([closebuttons="noclose"]):not([closebuttons="closeatend"]) > 
   .tabbrowser-tab[selected="true"] > .tab-close-button {
    display: -moz-box !important;
   }

• Save userChrome.css
• Open Firefox and you should have a close button displayed on the last tab.

Windows 7 & Vista Canonical Folder Names

In Windows Vista Microsoft introduced a feature which allowed file system folders to be used as junction points. By appending a GUID (Globally Unique IDentifier) as an extension to a folder name that folder can act as a junction point to another folder or control panel item.

For example, appending {645FF040-5081-101B-9F08-00AA002F954E} as an extension to the folder "trash" (trash.{645FF040-5081-101B-9F08-00AA002F954E}) will change the folder "trash" to a junction point for the Recycle Bin.

A list of available GUIDs is available on MSDN. However, this list does not contain all the possible GUIDs available in Windows 7 & Vista. Also, not all of these GUIDs will work in Windows 7 & Vista. Some GUIDs may work in both, some may be specific to Vista or 7 and some may work depending on the hardware and software installed on the system.

The following batch file will create a folder called "Canonical". In this folder, it will then create sub-folders using the GUIDs available from MSDN plus some others found from the internet. These include the infamous "All Tasks" folder, Computer, Recycle Bin etc.

Canonical
MD5: 1DFC67F49E50DE23B500C095C43E2AB0
SHA1: F535E660FD130369CEBE46DB5C97410C912A2964

Protecting yourself from Phishing attacks

What is Phishing?

Phishing (pronounced as fishing) refers to the act of trying to fool someone into disclosing sensitive personal information (such as username, password, credit card number) by posing as a legitimate entity known to the person.

How it works?

There are several ways in which phishing attacks are carried out. Here are some sample scenarios.

Scenario 1

• victim is sent an email claiming to be be from their email provider (gmail, hotmail, yahoo etc)
• the email header is sometimes spoofed so that it appears to be coming from the email provider
• victim is told that the email provider has had some technical difficulties (such as data loss)
• victim is asked to reply to the email with username, password or other sensitive information (such as secret answer)

Scenario 2:

• victim is sent an email claiming to be from their bank or financial institution
• victim is told to update their personal details (or do something similar which encourages the victim to click the link provided)
• victim is provided with a link to do the update (or whatever)
• the link usually takes the form "http://bankname.something.com" in order to fool the victim
• the link takes the victim to a page that is similar to the login page of their bank
• once victim enters their username and password they are stored and the victim is presented with an error page or redirected to the correct website (i.e. the victim's bank's website)

Scenario 3:

• victim receives an instant message on their messenger client or through facebook (or social network)
• the message contains a link
• the message is worded such that the victim is tempted to click the link
• when the victim clicks the link they are taken to a site which looks similar to the login page of their email provider (hotmail, gmail, yahoo etc.) or facebook (or social network)
• when the victim supplies their username and password they are given an error message or redirected to the site they thought they were visiting

How to protect yourself from Phishing attacks?

There are several tools targeted at protecting internet users from Phishing attacks. However, the best way to protect oneself would be to be aware of how phishing attacks are conducted instead of solely relying on security tools for protection. Here are some key things to remember:

• Your email provider, bank, financial institution or any other respectable entity will NEVER ask you for your username or password via email
• ALWAYS check the address of the website in your address bar before you type your username and password to login (http://facebook.com is not the same as http://facebook.evilsite.com)
  The important thing to note here is what appears before the dot com (or dot whatever). That is the domain name. If the domain name (in this case evilsite) is different from the site you think you were visiting (i.e. facebook) then you are being scammed (or phished in this case).