Monday, August 1, 2011

PGP for Outlook Open Source with Source Code

Prerequisites for Outlook 2007 (see 2010, 2013 below)

First of all, get a working copy of GPG is required, so visit the GnuPG download page, scroll down and download the Windows installer version or windows version. 

Windows installer version is located here https://www.gpg4win.org/download.html, you can install PA (personal Assistant), but it never worked on my computer. But this is a GUI to your user keys.
If everything has gone correctly, you can now open a command prompt and type gpg --version and gpg --list-keys to see the version and your keys (which would be empty if you're using it for the first time).
Visit the Getting Started section of the GnuPG handbook to generate your own key if this is your first encounter for instructions. You need a private public key for latter in the install.
gpg --gen-key

























To install this quickly, 

choose 4) RSA and key size of 2048 default will do, or 4096 for better security, and continue, it's pretty logical.

OutlookGnuPG

There are two main areas in the plugin, functionality for sending a mail (sign/encrypt) and for retrieving a mail (verify/decrypt).
At the moment only plain text emails are supported. No HTML mail or attachments, that's for a future version :)

See Cumps Consulting blog for the remainder of the install article ...
https://cumps.be/en/blog/2009-04-15-gpg-in-outlook-2007-outlookgnupg/

GnuPG addin for Outlook 2007

Here is the Github project :

https://github.com/twalrant/OutlookGnuPG

NOTE: To get this to work in Vista/7 you have to run the installer as administrator. Find your command shell in the run menu, right click and select run as administrator. Then do msiexec -i "path\and\filename.msi". That should get you past the impersonation difficulties.


PGP for Outlook 2010, 2013
 

A simple OpenPGP encryption plugin for Outlook 2010 and 2013.
https://github.com/dejavusecurity/OutlookPrivacyPlugin



Saturday, June 4, 2011

Remote Access Trojans (RAT) removal

Remote Access Trojans (RATS) are malicious programs that run invisibly on host PCs and permit an intruder remote access and control.

On a basic level, many RATs mimic the functionality of legitimate remote control programs such as TeamViewer but are designed specifically for stealth installation and operation. Intruders usually hide these Trojan horses in games and other small programs that unsuspecting users then execute on their PCs. Typically, exploited users either download and execute the malicious programs or are tricked into clicking rogue email attachments.

Remote Access Trojan Defined
http://technet.microsoft.com/en-us/library/dd632947.aspx


























Recent RATS create the following null registry keys; 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F4046E19-9A33-3DA4-5EBC-CD6114454DBA} 

This key F4046E19-9A33-3DA4-5EBC-CD6114454DBA is not deletable using Registry Editor. You cannot search for it and delete it, Regedit will complain that it is not found!Use GMER tool (is an application that detects and removes rootkits and works with Win7) available at http://www.gmer.net/ to find suspect rootkits and bad registry keys.

To remove a null registry key, you can use the toolkit provided by Mark Russinovich's suite of tools available from Microsoft  named Sysinternals. 

RegDelNull v1.1 This command-line utility searches for and allows you to delete Registry keys that contain embedded-null characters and that are otherwise undeleteable using standard Registry-editing tools. Note: deleting Registry keys may cause the applications they are associated with to fail. Back-up your registry and be sure you know what you are doing.