This article describes more advanced methods of customizing Mozilla applications, by editing the configuration files.

about:config entries

about:config is a feature of Mozilla applications which lists application settings (known as preferences) that are read from the profile files prefs.js and user.js, and from application defaults. Many of these preferences are not present in the Options or Preferences dialog. Using about:config is one of several methods of modifying preferences and adding other “hidden” ones.

Editing the user.js and prefs.js files are an alternative method of modifying preferences and recommended for very advanced users only. Unless you need a prefs.js and/or user.js file modified for a specific purpose, you should use about:config instead.

This article refers to the Firefox V. 9 edition of the browser. These entries may have adverse effects on Thunderbird and Mozilla Suite/SeaMonkey and older versions of Firefox. These settings will affect all profiles of the browser.

In Firefox, type about:config in the Location Bar (address bar) and press Enter to display the list of preferences. You may get a warning page next, just click OK and move on.

about:config > browser.display.use_document_fonts > change value to 0

0: Never use document’s fonts
1: Allow documents to specify fonts to use
2: Always use document’s fonts (deprecated)

Don’t let the site access to the fonts on your computer. That grants too much access that can be abused.

about:config > browser.sessionhistory.max_entries > change value to 2

The maximum number of pages in the browser’s session history, i.e. the maximum number of URLs you can traverse purely through the Back/Forward buttons. Default value is 50.  Set it to 2 so that the site you visit can’t see where you have been during your Investigative Internet Research (IIR) assignment.

about:config > dom.storage.enabled > double click to false

dom.storage.enabled is a mechanism allowing web pages to store information with a web browser (similar to cookies) called “client-side session and persistent storage.” Although use of session storage is subject to a user’s cookie preferences, this preference allows it to be disabled entirely.

about:config > geo.enabled > double click to false

True is location aware browsing enabled. Default is true. You want to disable this. See http://www.mozilla.com/en-US/firefox/geolocation/ for details of geolocation in Firefox.

The basic privacy settings in general settings, are found in the options bar in Firefox 9.0 (Firefox > Options > Options) or for iOS, Preferences.

1. Content: Enable block popup windows and disable Javascript when it isn’t needed.
2. Privacy: Enable the DNT (Do-Not-Track). For History, use custom settings. “Always use private browsing mode” should be enabled. “Remember my browsing history”, “Remember download history” and “Remember search and form history” should be turned off. “Accept cookies from sites”, but un-check “Accept third party cookies” as they aren’t needed often. Location bar: select “Suggest nothing”.
3. Security: Enable “Warn me when sites try to install add-ons”, “Block reported attack sites” and “Block reported web forgeries”. Under Passwords, disable “Remember passwords for sites” and use a master password.
4. Advanced – General – System Defaults: Disable “Submit crash reports and performance data”.
5. Advanced – Network – Offline Storage: Check “Override automatic cache management and limit cache to 0MB space”. Further—you can un-check “Tell me when a website asks to store data for offline storage use”.
6. Advanced – Encryption: Ensure both “Use SSL 3.0 and Use TLS 1.0″ are enabled. Then click validation > check “When an OCSP server connection fails, treat the certificate as invalid”.

Why does it cost so much just to look on the Internet?”

I get this question a lot, and too often from “professionals” who should know better. I will list a few of the reasons here.

To begin with, I never know how the research results will be used in the future. That means that the results must be properly documented so that it would be reproducible if someone else with similar skill did the searches at the same time as I did.

If at some future date what I find becomes important evidence, then how it was found, where it was found, when it was found, and what it actually looked like becomes very important. My report and the supporting material may be the only proof of the existence of the material being entered into evidence.

The computers must be free of malicious code (S. 31 Canada Evidence Act). We often set aside a computer for this purpose after doing some Spring-Cleaning.

The logic of the research process must be clear and easy to explain to anyone. This logic must be explained in the report. Search statements must be recorded. The project directory and file naming and structures must be logical and properly documented. The evidence must have a clear and documented chain of custody.

Providing this evidence requires skill, training, experience, software, computers, office space, support staff, and time.  Finally, did you know it takes at least twice as long to do the report as it does to do the research?

We still do neighbourhood inquiries, but over the last three decades this has produced less and less information of value, to the point that we now consider this an extraordinarily expensive investigative process.

Neighbours rarely share derogatory information or observations about the subject, and fewer still, even know the subject as most urban neighbourhoods are too transient and social contact is minimal.

Today’s neighbourhood isn’t tied to geography, but rather by Internet connectivity. The advent of virtual media has created virtual neighbourhoods that the Investigator must be adept at navigating and interrogating.

This new neighbourhood may reveal inappropriate pictures, drug and alcohol abuse, bad-mouthing of employers, co-workers, clients, and organisations. It may reveal poor communication skills and much worse – much of which is found exclusively online.

Unfortunately, inexpert interrogation and navigation of this neighbourhood has caused issues.

The ubiquity of Internet search engines and a lack of training and guidelines may put the Investigator in contravention of some laws if the resulting information creates a record of personally identifying information that is subsequently mishandled. Possession of Internet search results may impose either declared or implied responsibilities regarding the handling of the data in some jurisdictions.

A casual and undisciplined approach to Internet and social media searching raises questions regarding the competence, handling, fairness, storage, and analysis of the data. The role of the Investigator doing the searching should be clear from the outset. The sources and methods employed should also be clear throughout the search process and its reporting.

Virtual Identities

The subjects of an investigation do not line-up to tell the Investigator all his or her screen names and their related email addresses.

The Investigator must find the screen names and related email addresses from what he already knows at the beginning of the Investigation to build an online profile of the subject.

The Investigator must also recognise that screen names are often used by more than one person or a screen name may be used maliciously.

As the old New Yorker cartoon said, “On the Internet, nobody knows you are a dog”.

Navigation & Interrogation

The unstructured nature of data available on the Internet, and its density, creates problems for the searcher.

Google may say it found three million hits, but it will only show one thousand. The results will change depending on which version of Google searched and whence it is searched.

When searching for information about a person or company, the Investigator shouldn’t get bogged-down by search engine hits, but rather go straight to databases that have the right category of data for his purposes. This may mean searching sources not indexed by the search engines.

Google isn’t a substitute for knowledge and experience.

Mispronouncing foreign or unusual English words during a presentation or during court testimony immediately signals that you are not an expert in the subject you are discussing.  These sites will  help you pronounce both English  and foreign words better.

What They Don’t Teach at Detective School.

Flâneur (feminine, “flâneuse”) translates literally as  a loafer or a person who loiters,  but the poet Charles Baudelaire defined it as a passionate observer.

“There is no English equivalent for the French word flâneur. Cassell’s dictionary defines flâneur as a stroller, saunterer, drifter but none of these terms seems quite accurate. There is no English equivalent for the term, just as there is no Anglo-Saxon counterpart of that essentially Gallic individual, the deliberately aimless pedestrian, unencumbered by any obligation or sense of urgency, who, being French and therefore frugal, wastes nothing, including his time which he spends with the leisurely discrimination of a gourmet, savoring the multiple flavors of his city.” (Cornelia Otis Skinner, Elegant Wits and Grand Horizontals, 1962, Houghton Mifflin, New York)

The essential elements of the flâneur are also the essential elements of being a good investigator, reporter, researcher, and any other job that requires a well-developed ability to observe and report.

BYOD: How to Detect Deception, Part I

BYOD: How to Detect Deception, Part II

Autodidact (au·to·di·dact , ȯ-tō-ˈdī-ˌdakt, noun) is a person who has learned a subject without the benefit of a teacher or formal education; a self-taught person.A private investigator, is a person who can be hired by individuals or groups to undertake investigations.

The economic downturn has left a lot of Private Investigators moaning about a lack of work. That’s an economic hardship, if you haven’t planned for it, but it is also an opportunity. Now is the time to learn some new skills. Here are two great blog articles on how to go about it:

The Cheapskate’s Guide to Educating Yourself

How to Set Up Your Personal University

Why have Ethical Hacker Training companies got it so wrong?

We ask, just who are the people that you are sending on Ethical hacker training courses and why are you sending them?

So lets first look at the white hats.

Profile: Computer Science graduate working in corporate IT for about 5 years say, or network engineer or manager who has been treading the boards for about 7 years.
Ok, now lets look at the black hats.

Profile: Yuan Lopez, 33 from Paraiba, Brazil. (convicted 3 times for purgery, forgery and counterfeiting). Ex bank worker and trader. 2 ex wives, 10 kids and likes a little bit of the white snorty, snorty stuff every now and again.
Ok now, lets look at the Ethical Hacker trainer.

Profile: Ex Network Guru, Programmer, with an arm load of IT security certificates, from here to Amsterdam. Tony also worked in the military intelligence services where he is used to working in high security IT environments. His forte is social engineering, where he tells loads of cool stories about intrusion and deception attacks (as presumeably made up by Kevin Mitnick) and how they are common place and how through analogy you will learn many of the most frequent attack patterns.

Do you really think that Peter the IT engineer has a cat in hells chance of repelling an attack from a sophisticated, finance-savvy bandit like Mr Juan Lopez. Just how many angles are there to an attack anyway? Can you really cover them all?