Hot answers tagged

7

No, it is not a practical security measure. I'm not going to speculate on the specific case you mentioned as I don't have all of the facts, but there are a couple of more generally relevant points. First: Attackers do not determine which attacks might work based on the desktop chrome. They're going to figure out what the OS actually is, by any number ...


4

If you don't plan on ever playing Solitaire on your machine, why allow it through the firewall? You can always reverse your decision later if you decide to become a Solitaire fanatic, but until then it's safer to just deny Solitaire access. I know it looks legit and it almost certainly is the application trying to connect with the Microsoft network to ...


4

There is so many variables to this question with that been said but I'll provide an few scenarios. Scenario 1: User machine has been infected by an "virus.exe" which is executing under the user context "TokinRing" which is not an administrator account. You've decided to run an application "cool.exe" as an administrator account. Default windows security for ...


4

Everyone has read access to system32, but only administrators have write access. If you want to write to system32 as a Windows user, you need to conduct what is called a privilege escalation which elevates a normal user to admin. This can usually be prevented by proper user management and configuration since there are many possibilities to elevate ...


3

Microsoft (among many others) uses somewhat confusing terminology at times. In this case, "drive" is used in the sense of "drive letter". This is distinct from a "disk", which is a physical storage device. A drive's data may be stored on a physical partition, but the storage location for a "drive" is most properly called a "volume". It might be one ...


3

What you describe can be called an information disclosure vulnerability. You could use this technique as a method of fingerprinting (looking for specific operating system files, common web framework folders and files, etc.) and could prove useful in identifying a version of something on the system that is susceptible to a separate vulnerability. As you've ...


3

I do not have enough rep to post this as a comment so here goes: Based on http://superuser.com/questions/363018/how-do-i-tell-what-version-and-edition-of-windows-is-on-the-filesystem you can find the Windows Version and Service pack in C:\Windows\System32\license.rtf for Windows 7. For Windows XP the information is in C:\Windows\System32\eula.txt. For ...


3

Standard protocol would be to wipe the hard drive(s) completely clean and install from known good read-only media. A malware also modifying the windows 7 copy on the recovery partition is conceivable. But whether or not the malware you have did that is something we can not tell you without looking at your machine.


3

The Honest Truth Answer: Unless you physically destroy the drive by putting it through a metal shredder, there is no way to completely prevent that information from having a chance to be recovered by a skillful individual. If government level actors factor into your threat model, then you need to physically destroy the drive. The Good Enough Answer: ...


3

There are so many incorrect tinfoil hat solutions here. Allow me to present a correct tinfoil hat solution that fits into your "without formatting" requirements. Even magnetic force microscopy isn't going to get the files back if they've been deleted properly. Burning the drive is an extreme tinfoil hat option that is completely unnecessary. Taking Your ...


3

C:\windows\system32\config\SAM (Registry: HKLM/SAM) System memory The SAM file is mounted in the registry as HKLM/SAM. Windows locks this file, and will not release the lock unless it's shut down (restart, BSOD, etc). However, if you look at the SAM entry in the aforementioned registry section, you will not find the hash. Therefore, it seems more than ...


2

It's best to create a bootable USB/CD for Tails and not run it through a VM. Tails forces your internet connection through Tor, so if there any vulnerabilities with Tor (exit nodes, etc...) then you will be compromised. For internet banking and things that require more security, it might be best to install Linux (Debian is a good distro) alongside Windows, ...


2

Yes, using any browser exploit. https://en.wikipedia.org/wiki/Browser_exploit http://krebsonsecurity.com/2010/01/a-peek-inside-the-eleonore-browser-exploit-kit/ What current browser exploits exist is anybodies guess however. No spam filter will be able to filter out all malicious URLs though. You will need to educate your users.


2

Microsoft has a knowledge base article about this for debugging which will effectively provide the desired result. How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2 Forensics Wiki maintains a great list. Note that some tools only work for x86 so be sure x64 is also supported (i.e. FTK Imager).


2

Since you are already running it with Sandboxie, no need to be concerned about "admin rights", that shouldn't be an issue. The program won't write any changes to your hard drive or the windows registry directly, so it is "sandboxed" regardless of having administrator access. If you'd like to be in greater control of what's going on when you run programs, I ...


2

I don't know about Zeus in particular, but generally speaking, it's easy to do this using debug APIs like VirtualProtectEx and WriteProcessMemory. Open a HANDLE to the target process, add some executable memory (with VirtualAllocEx), put some malicious code in there, re-map the virtual address of the executable code of the library that holds your target API ...


2

The short answer is Yes, it is safe. KeePass does not write any plain text passwords to disk, instead it keeps the database and passwords in memory.


2

I response to the comment that we are allowing the attacker to have physical access to the machine: There's a running joke in security called The 10 Laws of Security. Law #3 is If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. So yes, if the bad guy can walk up to the machine, reboot it off a USB stick ...


2

There is an additional location where they store cached domain credentials as MSCASH2 hashes: HKEY_LOCAL_MACHINE\Security\Cache So, if you are talking about a domain-joined machine, there are three places that you could find credentials stored. SAM file (need both C:\windows\system32\config\SAM, and C:\windows\system32\config\system) Registry ...


1

In theory, you could have caught a drive by download. However, it is much more likely that you have been redirected to an advertisement page and the respective owner now rejoices about the revenue of all the sheeps clicking on funny looking links ;-) You can delete your cookies to get rid of any tracking/advertisement ones and I generally recommend ...


1

That depends a lot on the process who is used to conduct the exploit. If the elevated privilege process is the one being used, then any shellcode injected into the logical address space will have administrator privileges. So if a normal user starts, for example, Firefox as administrator and catches a malware using drive-by-download, the exploit will have ...


1

According to this answer, there is no way the history is written down somewhere on the system natively. But I am sure that you will find a tool that can track when what process was started like one of these: http://geekflare.com/how-to-check-process-start-time-in-windows/ ...


1

The best starting point would be to investigate its logs and see if it gets you anywhere. By default, SmartScreen does not log events as per Microsoft's documentation: Logging: By default, SmartScreen Filter does not log events. However, if you use the Application Compatibility Toolkit to enable logging for application compatibility events, SmartScreen ...


1

To answer your question: I believe that the safest way would be to use psexec to get a remote cmd shell. This method should not result in a plaintext password stored. Or do you mean interactive, AND with a GUI? Unfortunately your best solution really is to avoid interactive login whenever possible. Luckily there are some safe ways to remotely manage ...


1

You could grab important files as suggested. For example, web.config files or other application configuration files may contain sensitive information such as passwords. You could also try grabbing the SAM and SYSTEM files - the only trouble is that these will almost certainly be locked. In that case you could grab the backups from the repair folder. See ...


1

All they have to do is view the page. Specifically, it is ran through iframe cross-scripting or Adobe Flash (< v15). There are also more obscure ASP .NET and PHP viruses that utilize drive-by-download tactics. These are less common, but it was how many banks were hacked in 2010. There have been historically viruses embedded within files. A programmer ...


1

From Comodo.com's newsletter: A 'drive-by-download' attack is a malware delivery technique that is triggered simply because the user visited a website. Traditionally, malware was only 'activated' as a result of the user proactively opening an infected file (for example, opening an email attachment or double clicking on an executable that had been ...


1

This is an issue for virtually every OS. To understand the core problem you should look at the "Immutable Laws of Security" [1]: https://technet.microsoft.com/en-us/magazine/2008.10.securitywatch.aspx. Mainly Law 3: "If a bad guy has unrestricted physical access to your computer, it's not your computer anymore." Even if they did not add an admin account ...


1

First of all, lock the workstations down with a BIOS/UEFI password. This is common practice for enterprise networks. If the device is yours, then do it yourself. This prevents systems other than Windows from booting. Also make sure you disable the XPE network OS loader. At this stage, you cannot be certain the computer is 'OK' from now on since it was easy ...


1

I have free Avira installed on Windows8.1, Avira uses Windows firewall. Till know I haven't encountered any trouble related to virus or malware. This doesn't mean my laptop is totally safe. Even if I have the strongest known AV and firewall, that doesn't mean my laptop will be totally safe, either. Using the native Windows firewall or an external firewall ...



Only top voted, non community-wiki answers of a minimum length are eligible