Mark's Latest Novel, Rogue Code: The third book in Mark’s Jeff Aiken technothriller series was published on May 20. In Rogue Code, Jeff is hired to penetration test the New York Stock Exchange. When he reaches the heart of the trading engine he discovers malware that’s manipulating trades to skim money while blending in with high-frequency trading (HFT) algorithms. He’s accused of hacking and goes on the run in a race against the clock to clear his name and prevent a multi-billion dollar heist that could cause the collapse of the US financial system. As with his previous novels, Mark doesn’t compromise technical accuracy while building a thrilling story. Rogue Code is available in Audible, ebook, and hard cover versions. Mark’s TechEd Presentations: Mark delivered five top-rated and top-attended presentations at TechEd North America this year. They included: his latest edition of the ever-popular “Case of the Unexplained” on Windows troubleshooting; a new “Malware Hunting with the Sysinternals Tools” that highlights the latest malware trends; a presentation with Nathan Ide on pass-the-hash mitigations introduced in Windows 8.1; a talk on Azure’s security architecture and its design for hostile multitenancy; and a wide-ranging conversation with IT Pro luminary Mark Minasi on cloud computing trends and considerations. If you missed being there in person, you can watch them now on demand at the TechEd webcast site.
Autoruns v12.0: This release of Autoruns, a Windows application and command-line utility for viewing autostart entries, now reports the presence of batch file and executable image entries in the WMI database, a vector used by some types of malware. Procdump v7.0: Procdump, a utility for capturing process dump files based on CPU, memory, and other triggers, has improved support for lightweight reflection dumps on Windows 7 and Windows 8, adds debug print statements as a new trigger type, has support for memory commit duration triggers, and now includes an option to unregister Procdump as the system last-chance exception debugger.
AccessChk v5.2: This release of AccessChk, a security command-line utility that reports the effective access and permissions of files, registry keys, processes, and more, adds support for file and printer shares. In addition, it adds filtering options for viewing accesses related to specified accounts and now includes the System Access Control List (SACL) when it dumps security descriptors. PsExec v2.11: This release to PsExec, a command-line remote execution utility, fixes a bug in the implementation of the -s (execute as local system) option on Windows Server 2003. Sigcheck v2.1: This update to Sigcheck, a command-line utility that shows file version and digital signature information, now reports a file’s entropy (average bits/byte required to encode its data), can dump information about catalog files including the hashes they store, and can list the certificates installed in the per-user and machine certificate store. VMMap v3.12: This release of VMMap, a tool for analyzing process virtual and physical memory usage, fixes a bug affecting queries of files stored on file shares, fixes a bug in copy-to-clipboard of 64-bit addresses, now reports an error when attempting to open stacks on loaded traces, and fixes a bug in the reserved memory working set calculation.
Process Explorer v16.02: This minor update adds a refresh button to the thread’s stack dialog and ensures that the Virus Total terms of agreement dialog box remains above the main Process Explorer window. Process Monitor v.3.1: This release adds registry create file disposition (create vs open) and a new switch, /saveapplyfilter, which has Process Monitor apply the current filter to the output file as it saves it. PSExec v2.1: This update to PsExec, a command-line utility that enables you to execute programs on remote systems without preinstalling an agent, encrypts all communication between local and remote systems, including the transmission of command information such as the user name and password under which the remote program executes. Sigcheck v2.03: This version corrects a bug that caused the output of the –u switch to include signed files, and fixes several other minor bugs.