Tag Info

Hot answers tagged

50

In essence, these certificates are necessary and required for backward compatibility with XP and Server 2003. If anything was signed with these certificates, even if they're expired now, your server needs the cert trusted in order to trust the thing that the cert signed. Source: http://support.microsoft.com/kb/293781 Some certificates that are listed in ...


44

What you are doing is no kind of encryption, it is just obfuscation. It relies on security by obscurity. It may be enough to hide your files from an amateur/casual observer, but anyone analyzing the files in a hex editor is going to be able to rebuild and access them. Effectively your method is about equal in complexity to attempting file undeletion, for ...


13

With most file formats it is not difficult to identify the original filetype without knowing the original extension. A JPEG file, for example, always begins with the HEX sequence FFD8FF. Seeing that sequence at the beginning of a file tells you that it is very likely a renamed JPEG image. There are tools available which detect many common file formats ...


11

This is in no way shape form of fashion secure. It's akin to taking money from out of the mattress and placing it in the cookie jar. Let's illustrate what you said in five steps hades$ ls -ltha example.jpg -rw-r--r--@ 1 hades wheel 586K Dec 8 11:28 example.jpg hades$ md5 example.jpg MD5 (example.jpg) = a7ecc5e48db6cbfd609b9c6c6ca9b21f hades$ mv ...


4

A youtube video from Defcon 21: http://youtu.be/NG9Cg_vBKOg?t=6m19s The guy being investigated simply changed the extensions of the files (eg. from test.jpeg to test.txt). However when the crypto guys look at it their tool detects that the extensions don't match the files and these files are the first to be examined more closely by a human.


3

I played around with Family Safety on Windows 8.1, and from what I can tell, it's seems to be smart enough to check the validity of the original certificate before it proceeds to replace it with a Microsoft certificate. From the screenshot below, you can tell that when I visited Google, Google's real certificate was replaced by the Microsoft Family Safety ...


3

... ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN) This error is due to a certificate provided by a peer not matching the expected certificate. This is probably due to SSL interception by some middlebox (firewall) or an attacker, which does a man-in-the-middle attack to intercept and decrypt the traffic to the server and re-encrypt it to the client. Since it ...


3

To answer your question, Microsoft does not care because you followed their directions to disable UAC in order to 'bypass' their UAC. To disable UAC remote restrictions, follow these steps: 1.Click Start, click Run, type regedit, and then press ENTER. 2. Locate and then click the following registry subkey: ...


3

It is possible when Windows logs the login event in the event viewer, it takes the login time from the system clock set. So a user could adjust the time and date then log back into the system which would log the event using the changed time/date, then then clock could be adjusted back to the correct time/date. this would show the last login as anything the ...


3

Wireshark should be able to do it. However, the process is not as straightforward as you would have to scan the memory for the master secret. Here is a tutorial on how to decrypt SSL without access to the master private key. http://www.cloudshield.com/blog/advanced-malware/how-to-decrypt-openssl-sessions-using-wireshark-and-ssl-session-identifiers/


2

DLL Hijacking is when you abuse the library search order to gain execution in a process. Being able to write to the directory an executable resides in allows a malicious actor the ability to drop a dll with the same name as one the executable will request via LoadLibrary. When the executable attempts to load the expected library, they will instead load the ...


2

In reading some of these answers, I wonder if some read the question: "A computer hasn't been connected to the internet for 2 weeks" as most answers are spouting "static IPs" or "if your computer is connected to the Internet." I would steer clear of these answers as it demonstrates that answers are simply being typed without a thought process. On to the ...


2

Public key pinning means the server has said Not only is this cert vouched for by a reputable Certifying Authority, but any time you see a certificate claiming to be me, it will always be vouched for by one of these Certifying Authorities. If you see a certificate claiming to be me issued by a Certifying Authority other than these, it is bogus. ...


2

From the Windows Blog: As well as being teased with a variety of PCs, Certified drives must: Be built for high random read/write speeds and support the thousands of random access I/O operations per second required for running normal Windows workloads smoothly. Have been tuned to ensure they boot and run on hardware certified for use with ...


2

In short, you will have to use a packet sniffer in order to detect traffic that is not destined for your computer. This requires that your network interface be set in 'monitor' mode in order to take advantage of the way networks route packets. Not all wireless cards can do this, you will have to see if yours is compatible. Two examples of network sniffers ...


2

Unsure of what you're asking so I will answer based on what I do understand: if theres a port scan on the same segment and it does not reach the firewall at all, it is not detectable by anything. This makes little sense. If there is a port scan on the same NETWORK and it does not reach the firewall, it is not detectable by anything? Consider the ...


1

This doesn't seem suspicious at all. As raz pointed out, Windows makes rapid estimates of space and then replaces that number with the real number after finishing calculations. Also, all disks need to reserve space, but again, as raz mentioned, 32Mb is not unreasonable.


1

If this is the case, doesn't this logic essentially adhere to the 'security through obscurity' mentality that is generally frowned upon? Security through obscurity is only frowned upon when used instead of a more fundamentally effective control. Typically it is best to apply multiple layers of security, and it is perfectly acceptable and beneficial to ...


1

Ubuntu (or any Linux distro) is less a target for malware because it's less common - if you had a limited amount of time to spend developing malware, would you make it for an OS that the majority uses or do it for the one a minority uses ? As for the security by obscurity part, Linux distros don't base their security on top of the fact that they're less ...


1

Shellshock is a vulnerability in the bash interpreter which is mostly used on Unix-like systems but has been ported to Windows. However, Apache Tomcat, when running on windows, does not include bash by default and doesn't have CGI enabled by default either. So, generally speaking, no, Apache Tomcat running under windows is not vulnerable. To be sure, ...


1

Some software vendors partner with BIOS makers (e.g. Absolute) so that even if an operating system is re-installed, on network connection, the BIOS may be able to send back relevant information. Many of these products are gimmicky, for example LoJack can be blocked at a firewall/network level that will disallow it from phoning home. These types of software ...


1

This can very well be a concern. Different browsers handle it different ways. Chrome passwords on Windows are not stored in some file in AppData; they're stored using Windows's DPAPI, which means that they're encrypted with a key derived from your Windows password, so they're secure if someone doesn't have access to your Windows account. However, while it's ...


1

Just let it sit and update itself? Unless you are a very high value target or you have good reasons to suspect that you're being actively attacked, then just booting up and try to get the update finished before doing anything is quite a reasonable level of precaution. Two weeks of no update are not long enough to likely get infected and you can't ...


1

Hooking uses an operating system feature to monitor events sent to the process, like low level keyboard and mouse messages. Applications can utilize a targeted or global hook in order to keylog (malevolent) or listen for keystrokes in order to perform value adding functionality such as executing macros or other hotkey functionality. (benevolent) DLL ...


1

If you want to do that install Firefox. Firefox comes with its own trusted CA store and what you add there will only be available to Firefox.


1

These are commonly the artifact of installing the Visual C++ redistributable package, often installed with many applications and video games. It's worth noting that Steam installs this package with a large number of games. Some more info: http://support.microsoft.com/kb/927665


1

If the software is using a fixed port and an hostname rather than IP to connect you could redirect the traffic to your local computer and use, e.g. ncat to remove and readd ssl, then inspect the traffic in between. Comment if you need more details.



Only top voted, non community-wiki answers of a minimum length are eligible