Mac OSX Yosemite Draft eMail Problems

I finally upgraded my day-2-day notebook to Yosemite 10.10.2 and quickly noticed a very annoying problem with Apple's Mail client.  Mail automatically saves drafts of emails as you compose them, which is okay and to be somewhat expected.  However, the problem was, it would not delete the draft(s) after I sent the actual message and I had already turned off the "Store draft emails on server" function, years ago.

The solution I found that worked for me was to turn off the new "Automatically detect and maintain account settings" feature located in Preferences, Accounts, Account Name, Advanced, as shown in the screenshot below.  After unchecking that check box for all of my accounts and their corresponding SMTP servers, I restarted Mail and everything now works as expected. 

Sublime Text 3 Auto Complete Theme / Color Changes

After recently switching from Eclipse to Sublime Text 3 for my development work, I found the need to change some of the theme and element coloring options. One of the elements I wanted to change, but could not find any documentation for was the auto complete pop-up window. 

In the following screenshot you can see a pop up window with a list of auto complete options.  Let me explain how you might change these.  First off, the file you will need to edit is this one: ~/Library/Application Support/Sublime Text 3/Packages/Theme - Default/Default.sublime-theme




To change the background for the pop up window you would edit this element:
{
  "class": "popup_control",
  "layer0.tint": [64, 64, 64, 255],
  "layer0.opacity": 1.0,
  "content_margin": [2, 2]
},
{
  "class": "auto_complete",
  "row_padding": [2, 1],

  // White background
  "layer0.tint": [255, 255, 255],
  "layer0.opacity": 1.0,
  "dark_content": false
},


To change the color of text item is the pop up  window you would edit this element:

{
  "class": "auto_complete_label",

  // color of options in pop up window
  "fg": [72, 72, 72, 255],

  // red, the text color that you have typed that matches
  "match_fg": [255, 0, 0, 255],
  "bg": [255, 26, 26],

  // color of the text in the row that is selected 
  "selected_fg": [72, 72, 72, 255],

  // black, color of the matched text in the row that is selected
  "selected_match_fg": [0, 0, 0, 255],   
  "selected_bg": [156, 185, 223, 255]
},


To change the row highlight color you would edit this element

{
  "class": "table_row",
  "layer0.texture": "Theme - Default/row_highlight_wide.png”,

  // Blue highlight for the selected option
  "layer0.tint": [33, 90, 184],
  "layer0.opacity": 0.0,
  "layer0.inner_margin": [1, 1]
},
{
  "class": "table_row",
  "attributes": ["selected"],
  "layer0.opacity": 1.0,
},

Tools for editing PCAP files

I wrote a new command line tool to rebase PCAP files and edit their layer2 and layer3 addresses. This tool is smart enough to edit corresponding ARP packets and understands 802.1Q tagged frames and Q-in-Q double tagged frames.  It should easily compile with Go v1.4 on MacOSX and Linux (it may also compile on Windows though I can not test that). You can get it on GitHub at: https://github.com/jordan2175/rewritecap

Results of the 2014 Holiday Spy Hunter Network Forensics Challenge

I hope everyone had a great holiday season and enjoyed working through the challenge. After reading through loads of really great submissions, the top 3 reports, being 90+% complete, were from:

1. Peter VanBuskirk
2. Matthew Edmondson
3. Rich Cassara 

A round of virtual congratulations is in order for these three and everyone else that submitted solutions. For those of you that have been asking, the next challenge should be ready by midyear.

Spy Hunter Holiday Challenge 2014

This holiday season I have created a network forensics challenge for the community to try and solve. This scenario, called “Spy Hunter – Operation Hermes” is the first in a new series I am going to create and publish here at My War With Entropy.

All solutions should be submitted to me at Jordan 2175 with no space at Google’s mail service no later than December 20th, 2014. Winners will be announced in January. Entries will be rated based on completeness and overall explanation of what happened and how.

Please NOTE I will NOT accept any documents in PDF or Word format.  Only plain text email and documents, something readable by pine, vim or emacs, will be accepted. By submitting a solution you grant me the right to list your name on this blog.

Good Luck.

PDF: https://drive.google.com/file/d/0By0KeB0IEqeTX0ZYWTJqRWpXdlU/view?usp=sharing&resourcekey=0-A60aXqHU_Bml20VruR2iIg
MD5 (SpyHunter-Operation_Hermes-ver1.pdf) = 6d2bb7d0ab0d83ba2da8a1142deca758

PCAP: https://drive.google.com/file/d/0By0KeB0IEqeTVl9DRUpSU1lYclk/view?usp=sharing&resourcekey=0-YR30-ma8qjCx_2gS91rJeA
MD5 (SpyHunter-Operation_Hermes-ver1.pcap.zip) = de20687a9287dcf66ddf40d699915994

Official solution information will be available to full-time faculty members teaching courses in digital forensics or cyber security at accredited academic institutions.

How to reset the ADMIN password on a Supermicro IPMI device under VMware ESX 5.5

Resetting a forgotten ADMIN password on your Supermicro IPMI device when you are running VMware ESX 5.x is super easy, just follow these simple steps:

1) Download the IPMI tools from Supermicro’s site at: ftp://ftp.supermicro.com/utility/IPMICFG/

2) Extract zip archive and scp the Linux 64bit files over to your ESX server, either in /tmp or make the directory /opt/supermicro and store them there. 

3) Change execute permissions on ipmicfg-linux.x86_64.static to RX

> chmod 750 ipmicfg-linux.x86_64.static

4) Run the following command:

> ./ipmicfg-linux.x86_64.static -user setpwd 2 somenewpassword