Updates from July, 2016 Toggle Comment Threads | Keyboard Shortcuts

  • Old Guy Student 5:57 pm on July 24, 2016 Permalink | Reply  

    Cyanogen Mod & Pure Android, Why? 

    So last summer, I purchased a ZTE Zmax when my phone was stolen as it had a great recommendation from a nerdy friend in my speech class.  My first six months of ownership were amazing and I was extremely happy with the device except I desired root access which wasn’t available.  Somewhere along the way, I installed an application that was a system optimizer and it ran and munged things up.  Then I found root and just waited for the time to wipe and reinstall.  This day arrived on Thursday and I started by rooting and installing a custom recovery partition.  Then I found an ADB command to turn off the write protection in the boot loader thus making the system partition writeable when booting a custom ROM.  Next I downloaded nandroid backups of the factory ROMs for this device and placed them all on the SD card.

    Meanwhile, I had already used the recovery program to factory reset the phone and had installed and added most of the APPs that I regularly use.  I made a nandroid backup before I wiped and then again once I had everything perfect.  I then proceeded to install the CM 31.1 nightly that I found on an Android Nerd Website, Android Authority, I think.  There is that moment when you flash a ROM and reboot when it’s finished and your heart seems to stop beating as the boot-up process begins.  I find myself holding my breath until I see the Android desktop.  Everything seemed to work fine and I immediately set about flashing the proper Gapps from Open Gapps.  There are multiple packages based on what you want to install and I screwed up multiple times which meant I had to re-flash the ROM to ensure it was all installed properly. 

    Somehow, the permissions did not get set properly and that seemed to be a habitual problem as a total re-flash didn’t fix the problem. So, with the help of Google and the million member Android Army, which is where I found all of the information to do everything I have described here, I slowly found out how to resolve each pop-up error about a Google service failing that prevented me from using the device or doing anything else but clicking on the OK button.  There was a video on YouTube of another user with the same problem on another device and his fix was to painstakingly fight to bring up the Android Settings and then Applications and then locate each offending application and give the proper permissions.  Needless to say, this took a while and when I was done, Android 6.0 is so much nicer then the 4.4.4-Kit-Kat that I had been using that it was rewarding to have successfully fixed the permission issue even though it was frustrating.

    Everything seemed to work but the LTE wireless data and the 3G and 2G data seemed spotty at best as did cellular calling.  Remember I did most of my setup over Starbucks Wi-Fi and my home Wi-Fi and not Carrier data.  Googling the issue indicated the problem stemmed from the Radio ROM I was using so, I downloaded the correct radio.  Further research indicated it was more then just the radio, so I downloaded a ROM that flashed all of the necessary changes to make the radios work properly with CyanogenMod and AOSP based ROMs.  On first reboot everything appeared to work as I wanted.

    Now, it may sound like all of this was trivial, it wasn’t and required a significant investment of time to read forum posts and get to the correct solutions.  Then add in my relative n00b status in Android hacking and the time compounds exponentially.  My Google contacts weren’t syncing and that took a bit of time and effort to get working properly.  Then add to that the problem didn’t go away until I rebooted my device and only then did everything seem to work properly.  Flashing the proper modem files was a nightmare as every copy failed the signature check and only through Google did I find that this was because they couldn’t be signed.  Turned off the signature check and crossed my fingers and flashed.  When it rebooted and appeared to resolve the problems, I took a deep breath.

    So, why did I do this?  I like the idea of a pure Android phone and my next device will be as close to pure Android as possible because that increases the likelihood of frequent updates and almost guaranteed compatibility with the next version of Android.  Nexus devices are pure Android with the addition of Google’s applications for accessing their services.  Motorola offers a purer version as well and ultimately even if the manufacturer doesn’t make an update available, as I have shown with the ZTE Z-Max, the community will step in and do it on it’s own.

    Updates are important and Apple has one of the next track records in this regard, with ensuring that older devices receive updates for a guaranteed period of time and security patches for even longer.  I bought a phone for my wife from Motorola back around the time of the first Galaxy Note, the N-7000 and it never got an updated that I could find even though it was a business class device with a fingerprint reader.  We just recently replaced it with a Blu device purchased from Best Buy because she had a gift card.  Her Motorola device was acting peculiar because of the heat and most of the developers had stopped supporting her version of Android including her browser.  So, she had to upgrade to continue to use the device for anything more then a dumb phone with an iPod built on.

    This is scary on multiple levels because it forces people to upgrade in order to continue using the device the same way they always have.  It is also scary because there have been major security flaws in Android that have been discovered that were never patched.  Imagine if a defect was found in a modern car and the manufacturer didn’t issue a recall or tell anyone who had purchased one from then new?  When it was discovered, there would be a Senate enquiry to find out the details of who, what, when, where, how and why.  This is becoming more of an issue as more and more personal data is contained on devices and users begin to use them for more and more purposes in their daily lives.

    Now that everything is working properly, I am going to slowly begin blogging about each application I install and use regularly along with why I use them.  I am doing this as a guide for some of my friends who are less technical, to help them be able to make the move from a proprietary version of Android like that produced by Samsung or HTC where their overlays often delay and or prevent the release of updates for devices.  One of my primary functions is to show how security can be implemented in a manner that adds to and enhances the existing security.

     
  • Old Guy Student 12:32 am on June 10, 2015 Permalink | Reply
    Tags: , , Best Prectices, , Information Technology, , , Wireless Networking   

    Summer 2015 Begins 

    When I started at American River in 2009, the first classes I took were the Cisco CCNA Training Classes.  The professor often made comments about the school’s IT Department, their policies and procedures.  Since that time, almost every professor has seemed to have the same level of confidence in the internal IT Department.  When I restarted in 2013, I put my Samsung Galaxy Note N7000 on the school’s wireless and it was a convoluted procedure because the school was using a self-signed certificate.  Once you got it working, it would work on most of the campus.

    Last semester, I noticed that there were quite a few classrooms and common areas around and in Davies Hall that you could connect to the wireless network but packets seemed to go nowhere and there was no DNS responses.  When they repaired my tablet last year, they reset it to factory settings so when I tried to connect it to the Network this semester in Davies Hall, I was unsuccessful.  I took it to the LRC or Learning Resource Center Help Desk and asked for help.  The Help Desk Employee asked me to unlock the tablet and I presented him the Windows Desktop.  I watched as he did everything that I did and suddenly it worked.  I asked about the certificate and the guy responded and I didn’t understand, I asked for clarification and still didn’t understand his answer.

    At this point, I became frustrated and explained that I have 20 years experience as a Corporate IT Consultant and I have worked with and for multiple high profile Fortune 500 companies on IT Projects, that I carry multivendor certifications so this should NOT have been this difficult for me.  I explained that this wouldn’t work in Davies Hall and he said it would now.  So I walked back to Davies Hall and walked around until I could find a spot where it worked.  Unfortunately there were far more locations where it wouldn’t work.  The sad part is that I know from last semester there are classrooms in Davies Hall like this as well.  It made it difficult to access D2L for the Honors History class while in the classroom.  How can an institution for higher learning that trains people to design, install and maintain infrastructure like this have such a horrible configuration?

     
  • Old Guy Student 6:31 pm on May 20, 2013 Permalink | Reply
    Tags: , 95841, , , ,   

    Campus Crime 

    image

    For the size of the campus and the number of police employed and deployed at any given time it sure seems like there is something wrong with this picture.

     
  • Old Guy Student 3:13 pm on October 15, 2012 Permalink | Reply  

    New Facebook Attack 

    So, I was looking at my stream on Facebook and came across a post by someone I trust that looked like this:

    image

    The subject matter and the title by my friend was a clue, so I clicked the link.  The page that appears is this:

    image

    If you look closely, the Submit button is drawn over the original Facebook button that allows you to use your Facebook credentials to login to a website.  By clicking submit, the same link above will be posted to your wall and the ‘Hacker’ will have access to your Facebook account.  Every one of your friends who clicks and does the same thing will perpetuate this scenario.  Pass this around so that we can stop this from spreading.

    If this happened to you, change your password and look in your Facebook security settings and remove any unknown apps and websites that have access to your account.

     
  • Old Guy Student 10:37 am on October 10, 2012 Permalink | Reply  

    FBI Virus 

    So, there is a new creative Malware circulating throughout the US and world.  It is called the FBI Virus and when it infects your computer it displays the following screen:

     

    IMAG0462a

     

    This screen prevents you from doing anything with your PC except entering payment information.  Since this is NOT a real message from the FBI or any law enforcement agency and there is a simple fix.  Download ComboFix, Install it.  Reboot the PC in to safe mode and run Combo Fix.  Allow it to scan and clean everything it finds.  Then update your antivirus and other malware software and allow them to perform a full system scan.  This is the easiest and most direct way of getting rid of this Nag Screen, which will not go away or allow you to do anything else until you do.  Also, there is no guarantee that paying the fee will get rid of the issue and that it wont just keep popping up randomly and demand money.

     
  • Old Guy Student 12:51 pm on June 19, 2012 Permalink | Reply  

    Securing Your Digital Life–Introduction 

    I decided to write this series to help a friend of mine better understand how to secure herself against creepy ex-boyfriends who knew everything about her.  Since I am a network security expert, she asked me my advice and I realized that I should probably write a blog about it and never did.  While none of this is female specific, it is something that single females should do to secure themselves and their lives in the modern age.  Ever since I got involved with computers, I have always been interested in security and this probably stemmed from running a BBS at 300 baud.  As computers progressed and I moved in to the corporate IT World the focus on Data availability, integrity and security all became a focal point.  Emphasis was put on ensuring that users stored all data and documents on the server so that it could be secured and backed up.  While I was focusing on security the consumer world was introduced to windows without any security at all.  Users relished the freedom and ridiculed the lack of security.

    Most people are of the misguided belief that there is nothing of value on their computer and that they have nothing to worry about on their computers.  I am telling you to not be so sure about that and you really do not have to give up any freedom to make things a little more secure.  I am going to explain why you should adopt these practices and then how to implement them and get used to using them.  The idea is to keep you safe online and safe if someone steals your computer or smart phone.  I will use real language and terms and try and explain them in everyday terms so that you can understand what the goal is and exactly how it is accomplished.

    Around 2004 I got to see the seedier side of computer based crime that dealt with identity theft and fake documents.  Someone who had been shown the basics by someone showed them to me.  Using Photoshop he showed me the template for the new California Drivers License that would take effect in January, this being December.  He then used the webcam on the notebook to take my picture and using Photoshop placed it in the correct places and onscreen it looked like it came from the DMV.  We used all of my real information and he showed me the process to make an ID. First he printed the main layer on white paper.  Then he printed another layer on clear transparency film and then another and finally the back layer.  Each layer was cut to the precise size and then a clear epoxy was used to glue the back to the back of the base layer.  Then each subsequent layer was glued on the top.  When everything was complete it looked just like the real ID minus the gold printing.  He then took this foil paper, placed it on the top and ironed it with an iron.  When he removed the foil even the gold printing was there.  The only thing that didn’t work was the magnetic strip.

    This was an entry level setup and the IDs it made would pass all rudimentary inspection if the maker paid attention to all of the details and took their time to ensure each step was perfect.  I can only imagine what an artist with even more tools could accomplish in the same time.  That being said, this made me realize how easy identity theft really is and  that is the first area I will focus on.  Ironically the same methodology used for this can also help ensure that an overly possessive boyfriend cannot snoop on you as easily either.  A girl has to have her secrets.  I have also been asked multiple times by clients over the years for assistance in personal matters that involved computer security and forensics.   A friend contacted me today and explained the situation his friend was in, she was evidently somehow involved with someone or friends with someone who first tech-raped her and is now holding her tech-hostage.  What I mean by this is he helped her setup her iPhone to sync with her ISP email and in doing so, he gained access to her passwords.  He allegedly has hijacked her Facebook page and made inappropriate posts.  So in the middle of the first draft of this blog, I began discussing this with him and offering advice.

    I set my cell phone as a cell phone and only point of contact with the people that I do business with.  I use a Patelco, a credit union, instead of a bank.  I keep the address on most of my financially related information at an address other then my home address.  This buffers and protects my identity because the only one with this other address are my creditors.  I try and opt for online billing as often as possible.  I download and save or print a PDF version of the bill and save it in a folder on my hard drive named yyyymmdd-accountname.pdf and then at the end of the year I zip all of the previous years up and leave the zip folder named yyyy–accountname.zip. I use this kind of archiving for everything.  I save my camera phone photos by year and separated by decade.  But I am lazy about backups, and continue to be so even though I have lost so much data to hardware failure.

    Let’s get some things on the table:  I do not trust the cloud for many reasons the most important of which is that it is for profit and that means they will change the terms and conditions at anytime and you have to agree to them and the second is most of them indemnify themselves from liability regardless of their culpability.  They also often have weird clauses about who actually owns the information being stored on their cloud.  But that is another story and blog.

    Most online services and websites require a password although now it seems like there are two major providers and two minor providers of cross site logins:  Twitter and Facebook followed by Microsoft and Google.  I have personal and professional accounts at AOL/AIM, ICQ, Microsoft, Google, Yahoo and have Facebook, My Space and Linked In.  All of these require passwords.  To add to that complexity, I have my main email address: sgoldfein@gmail.com as valid addresses for AIM, MSN, and Google.  Yahoo uses sgoldfein@yahoo.com and I also have an MSN for sgoldfein@hotmail.com.   These all require unique secure passwords and a way to remember them securely and that’s just the beginning.

    There is this myth that there is a need to constantly change your password for security and integrity reasons although I am not sure where this ideology came from but Microsoft did a massive study over a several year period of time and realized that forced password changes on a random basis provided absolutely no more security then using the same password for the entire period of time.  They also found that the help desk spent far more time resetting passwords soon after the change then at any other time and that there were little to no password resets necessary when the users were not required to change their passwords.  So in conclusion: requiring random password changes doesn’t increase security but it does reduce productivity and increase help desk costs.

    The one thing there is no myth about is choosing passwords and securing them after we choose them.  When I first started life online, I used one password or a derivative of it on every BBS I joined.  I quickly learned that this was a stupid move and an asshole sysop could find out your password and logon as you somewhere else.  About 10 years ago I found a program called Roboform and it revolutionized how I did passwords because it allowed me to carry my list of passwords with me on a Flash Drive or my Cell Phone encrypted from prying eyes.  Roboform has come a long way and there are versions available for Windows, Macintosh, Cloud Based, Android, and IPod/IPad.  Roboform integrates with most browsers, although right now it does not work with Maxthon like it is supposed to but that’s not a show stopper.

    Download the installer from the website above and save it to the Downloads folder on your computer and then navigate to that folder using My Computer or Windows Explorer.  Select and double click on the installer file and it will display the following screen:

    image

    Now before we proceed you need to be thinking about your ‘Master Password’ as this is the most important password on your system because it is the one that will be used to secure your other passwords and data.  I recommend taking your favorite verse from the bible, or a song or first paragraph of a book you know by heart or any passage of text you know by heart.  Recite it in your head memorizing the first letter of each word until you can just say the letters without thinking about it.  That is your private master password and you should never tell anyone what it is.  I usually add some random number for letter substitutions within as well.  Use this password in Roboform to secure your passwords.

    Notice I have checked the Show Advanced Options checkbox.  I will explain each of the options as we proceed with the installations so you will understand what effect they have on the overall program.  I am doing an upgrade and not a new install so there might be a slight variance in the process from what you see here.

    image

    The installed and active browsers will have the Roboform Toolbar connectors installed.  This allows Roboform to display a toolbar in the browser that let’s you click a button on it to fill in the username and password.  It doesn’t appear in screenshots of Chrome for some reason either, so I can’t post a screenshot.  If the browser is installed the option to install the add-on becomes active.

    I started using Chrome for one reason and one reason only, it was fast, stable and it was NOT IE or Firefox.  I would have used Opera but it did not have Roboform support.  As soon as Maxthon and Roboform work together, it will be my browser of choice.

    Notice there is also an option to Fill and save forms in Windows Applications and this is a hit or miss.  IBM / Lenovo used to have a password manager that they bundled in their security apps that hit this like no other.  It could fill the passwords in any windows app.  It is hit or miss with this and it does not work with games like Lord Of The Rings Online.  I select it anyway in the hopes hey slowly improve upon it like they have everything else. Smile

    image

    This is an annoyance because you really cannot utilize Roboform without purchasing it and as such I do not want it to hijack my start page.  Other’s might feel differently and I might change my mind in the future should I accidentally forget to uncheck it.

     

    image

    Since I have already installed and Roboform is running, I cannot change these options and there isn’t really a reason I can foresee to want to.

    image

    It wants me to close all my browser and windows explorer windows.

    image

    Do you have Android or an I pad or an IPhone?  If so then  you will want to make a temporary account this one time before you add any new passcards.

    image

    Fill in the information above and create your user account.  If it offers to make a passcard, do so.  Then follow instructions to finish the install and perform the first sync.

    Then load the Roboform options by right clicking the little green RoboForm icon in the tray next to the clock and selection options.

    image

    Select User Data and click the Settings Button.

    image 

    Choose Desktop and follow the prompts to finish.  Now just go and login to your favorite sites like Facebook and Yahoo.  I would use the toolbar option to generate random passwords to generate new random passwords and use a different one for each site. 

    image

    If this were the first time I visited Facebook it would wait for me to fill the username and password and then it would ask if I wanted to save it.  Make sure the Keep Me Logged In checkbox is checked and remains that way when saving the passcard.  Finally I would make sure you use a Windows Password that no one knows, you can change your password by pressing Control + Alt and the Delete key all at the same time.  Then select Change Password and follow the prompts.

    image

    Finally, change Windows to ask for a password on Resume.  This will make Windows ask for a password when the screensaver comes on.  This means if you walk away or get distracted that someone can’t get access to your computer.  By force of habit I lock my computer.  Another Tech pranked me and I decided to never let it happen again.  He basically took a screen shot of my desktop with all the applications minimized.  He then used the control panel to hide the desktop icons and hid the start menu.  This was back with Windows NT and random lockups before SP3.  Change your passwords and use Roboform.  I will cover the android and portable versions in the future.  In Windows Vista and 7 you can hit Control+Alt+Delete and select Lock Computer or just press the Windows Key and L at the same time to do it.  I usually forget and just let the screen saver take over.

     
    • somekindaodd 1:48 pm on June 19, 2012 Permalink | Reply

      dude write about your life .
      this is like 3X the amount of effort you have put into any single other topic.
      this is good and all, but what happened to your other plans?

      Like

    • Dennis London 'Chip' 2:52 pm on June 19, 2012 Permalink | Reply

      See…I knew you were a geek! And here I am posting my reply from an iPad at a sushi bar…LOL

      Like

    • Jessica 4:42 pm on June 19, 2012 Permalink | Reply

      I like your tech-nerd blog. But a personal blog would be good too. 🙂 Nonetheless, thanks for sharing!

      Like

    • sgoldfein 9:19 am on June 20, 2012 Permalink | Reply

      I have a personal blog too, that is at Blogger and is 'Musings Of A TechnoNerd.' This is the more technical side. 🙂

      Like

    • sgoldfein 9:20 am on June 20, 2012 Permalink | Reply

      LoL Did you have any doubt? I was online back when we were in High School. 🙂

      Like

    • sgoldfein 9:20 am on June 20, 2012 Permalink | Reply

      That's on Blogger and I have posted three or four things in the last few days there too. 🙂

      Like

    • somekindaodd 12:07 am on June 23, 2012 Permalink | Reply

      So you are having the boreing blog on the site i use oh, good plan, either cross post or nevermind..

      Like

    • gehen 12:35 pm on July 18, 2012 Permalink | Reply

      Thank you for sharing your thoughts. I truly appreciate
      your efforts and I will be waiting for your further
      post thanks once again.

      Like

    • Cybersquire 12:21 pm on August 2, 2012 Permalink | Reply

      I am currently working on a blog about converting from Sprint to a Post Paid GSM based provider and when I have finished that I will do another blog on securing your digital life because I had an unfortunate situation arise that created a great blog post.

      Like

c
Compose new post
j
Next post/Next comment
k
Previous post/Previous comment
r
Reply
e
Edit
o
Show/Hide comments
t
Go to top
l
Go to login
h
Show/Hide help
shift + esc
Cancel
%d bloggers like this: