Tag Info

New answers tagged

1

Windows Credentials Yes, they are stored hashed within files in the c:\Windows\System32\Config\ directory. You will need the SAM and system files. However, a backup of these files may be stored in the Windows repair folder at c:\Windows\Repair\. If Windows is running and you need access to the locked files in the Config folder (for example you know the ...


3

Yes, Widnows saves users' passwords in 3 files: Windows\System32\Config\SAM file (without extension). Windows\System32\Config\SAM.sav: it is a copy of the first one Windows\System32\Config\SAM.log A transaction log of changes. To access these files, run Start/CMD and type %SystemRoot%then choose the subfolder system32\config. These files can not be ...


1

To access the windows passwords, you'll need both the SAM and SYSTEM file from C:/WINDOWS/SYSTEM32/config On a Linux Distro, like Kali-linux, you can then use the command "bkhive SYSTEM bootkey" to get the bootkey from the system file. Then, use the command "samdump2 SAM bootkey > samdump.txt" to get the hash dump from the SAM file. If you open the file, ...


0

All local user account passwords are stored inside windows. They are located inside C:\windows\system32\config\SAM If the computer is used to log into a domain then that username/password are also stored so it's possible to log into the computer when not connected to the domain. As for seeing which passwords are currently stored on a computer you can use a ...


1

The important words in the articles you quote are "root access". The core of MacOS X is a Unix derivative, and "root" is Unix terminology for God. Or, at least, the super-privileged identity that can do anything. Well, it indeed can. If you think of your computer as a small country, and the attacker has some outsider intend on invading it, then a malware ...


0

It is not possible to prevent a root or administrator user from accessing a file under control of the OS. Your suggestion of obscuring the file might prevent someone from piecing it together in a meaningful way, but isn't really securing the file. Your thought to use an encrypted filesystem simply encrypts the files on disk such that only users with access ...


6

Ye cannot defeat root ! The root user can have complete control of the machine. The best that you can hope for is encryption: use GnuPG to encrypt the data with a sufficiently strong random password, that, of course, you won't reveal to the root user. However, as soon as you decrypt the file on the machine, wherever you put it, root will be able to see it. ...


1

This is more of a comment than an answer, but apparently I'm not allowed to comment yet. If you're concerned about the privacy of your cloud storage, you may want to consider Tresorit as an alternative to Google Drive. It offers client-side encrypted storage & syncing, so the Tresorit engineers aren't even supposed to be able to tell what files you're ...


5

What about hosting those files on other hosting services which have client side encryption like: Tarsnap, which has open source client and does client side encryption. Tahoe-LAFS SparkleShare, which has GUI clients for all operating systems. more on https://prism-break.org/


1

To answer one of your questions: any Google employee who has administrative access to the hosts (file servers) on which the drive data is stored will have read-access to your data: this includes the operations engineers, service engineers, system administrators: these type of employees are typically the ones with that type of access. The answer to your ...


2

Cryptography is a form of smart obfuscation, it does not make things "secure", just "secure enough, for now". If someone REALLY is out to get you, he would store your encrypted data until a later date when encryption can be broken - anything from stronger computers to software vulnerabilities like "heartbleed" will do the trick to decrypt your stuff in the ...


1

Apart from statements like NSA has your data when uploading it is based on the assumption that your data being on your disk is not somehow accessible. Like others stated, if your data is encrypted in a strong manner on your disk and uploaded in the same way I would regard the online version more safe in terms of redundancy (google is managing the replication ...


13

Not instantly. Although, that's what I want to believe. What you could do is the following. Download the Truecrypt version 7.1a and create an encrypted storage file (option 1 from the wizard) and choose 3 algorithm based encryption with a SHA-512 key. Put all your sensitive files in here and upload the encrypted file to Google Drive. When you want to work ...


7

Any data you upload to Google Drive (or Skydrive, or Dropbox for that matter) should be considered duplicated by the NSA. Apart from arbitrary queries from the aforementioned secret service, law enforcement agencies from any country may gain access to them through legal means (subpoenas and so on). And of course, Google engineers could in theory browse your ...


39

Google has access (obviously). The police will have access if they have a valid search warrant. A national security letter will give the FBI secret access. Various three-letter agencies may have access, depending on how they're doing at circumventing Google's encryption. (Google started encrypting its internal traffic after it was revealed that the NSA was ...


2

Technically, according to PCI SSC you can hold onto CVV and other sensitive authentication data until authorization has occurred. In other words the restriction on storing sensitive authentication data applies to post authentication/processing storage. Here is a document from the PCI SSC about data storage requirments. See the "Technical Guidelines for PCI ...


0

You need to speak to a QSA. You may not store the CVV. However, incidental storage may occur as part of an approved transactional flow, and that is acceptable if the QSA finds it so. Otherwise, it would be impossible to use CVV in batch transactions.


0

There are certainly (naturally) a lot of details missing here. I am in agreement with DKNUCKLES, and believe you have a process problem. Are you able to sanitize the rationale for the delay through authorization of your cardholder data? You definitely cannot store full track data or the CVV2 number at all.


1

You're not going to be able to do that - you'll need to find another way. If memory serves the PCI DSS framework also states that you can't store a credit card number (or other PAN) in plaintext in it's entirety. You'll need to obfuscate the middle numbers as is show on receipts, so you need to ensure your script will allow you to do that as well.



Top 50 recent answers are included