Tag Info

Hot answers tagged

22

I'm a developer on GitHub for Windows - we're closely monitoring the msysgit mailing list for progress on this, but we believe at the moment that there isn't any way to exploit this in GitHub's shell, because there is no escalation of privilege (i.e. you can only hack yourself). We're definitely actively looking for scenarios where that is not the case, and ...


5

If you want to stay safe you can just ensure your Linux home and root partition are encrypted and use UEFI to ensure your Linux kernel isn't modified. Then it will be impossible for your Windows box to touch the rest of the OS. A less elegant (and insufficient from a legal standpoint if you need to guarantee the data is well protected) but maybe easier ...


3

Currently windows uses NTLMv2 to store the password, but for backward compatibility some system uses LM hashes. Now it is recommended by the Microsoft to not to use LM method to store the password because of its weakness towards brute force attacks. If you want to see currently which method is used then you have to navigate to ...


3

TL;TR This privilege can be used to create and run processes under another user (including SYSTEM) given proper access tokens for that user. SeTcbPrivilege Windows Services are programs that run in the background to perform necessary operations for the operating system to function. When you say, "when an account other than Local System is used to run ...


3

General strategies - Red Teaming Analysis Abuse identity and authentication -> Target: People and credentials -> RDP, SSH, more consoles, portals Exploit privilege and trust -> Target: Infrastructure -> NT Domain administrator, Unix root accounts Attack data structures and data handling -> Target: Services, Apps -> Client executables, Client-to-server ...


2

The article you linked to clearly stated that it was vulnerable. However, it's pretty hard to leverage "shell shock" in "BASH" on Windows for git. You're still restricted to the users permissions, and their git code repository on their file system. Additionally, there are far fewer attack vectors that exploit shell shock on Windows than on their *nix ...


2

If you don't log with a password, but instead with a fingerprint, then DPAPI plays an elaborate charade of encrypting keys with other keys, but the tower of encryptions must still end at some point. So what really happens in that case is that someone who steals your laptop will be able to extract all your secrets -- albeit with a substantial amount of ...


2

You are technically wrong when you say "signed the virus". the CA NEVER signs any code. What CA can do, is issue a code-signing certificate. Then the MAKER of the virus do sign the code. This means the CA never see the code and you can't really blame the CA for issuing a code-signing certificate. The Point of a code-signing certificate, is to bind the code ...


2

Hacking is a serious crime, and gets you in even a more of a problem. It seems you have some details, try to gather logs, screenshots etc. and get to the nearest police station and report the crime. Commiting a crime in awnser to a crime is NOT a solution.


2

Yes, it is ok to have CBC ciphersuites in the list as long as SSLv3.0 is disabled. The issue is not the CBC mode itself, but the SSLv3.0 specification for the padding format. The padding format in TLSv1.0 is more restrictive, so the malleability required to mount the POODLE attack no longer exists.


1

It isnt normal that your are experiencing DDOS attacks. Try using Wireshark or another network sniffing tool to look for Botnet traffic. IF you boot Wireshark and use the filter dns.flags.rcode == 3 If Wireshark is returning a lot of failures a good bet would be to set up a IDS such as Snort and create a rule to block the specific traffic. However ...


1

I don't think you understood what Windows did when it formatted the disk. When you plugged in the external drive, Windows couldn't read the filesystem (because it's encrypted) it therefore assumed the drive had no filesystem and offered to format the drive. You selected yes. Windows then deleted everything on the drive and overwrote it with a clean NTFS ...


1

Another option is to look at truecrypt's successors, like Veracrypt (https://veracrypt.codeplex.com/). They use Truecrypt as a base but claim to add some additional security improvements. Of course since they're new it still remains to be seen whether these projects will be able to support themselves in the long term and whether they'll remain secure, so ...


1

You can use dm-crypt drives, which have windows support as documented here: http://superuser.com/questions/584883/how-can-i-access-volumes-encrypted-with-luks-dm-crypt-from-windows


1

It can't hurt. ABP (and similar software) blocks known ad providers and patterns that look like ad providers. If one of them gets popped and starts serving up malware, ABP will save you. If the site you're on is the compromised one, ABP can't help (unless the compromise is to point at a compromised ad network that's already blocked... seems complicated). ...


1

If someone legitimately has superuser access to a system, you can't stop them from accessing any data on the system given time. You can certainly have data encryption to encrypt the data at rest, but what's to stop them from capturing the keystrokes that are performed when you unlock it? Or, if you're copying the data to the system from somewhere, getting a ...


1

Well, it might help. Better yet, make your computer not to obey autorun.inf on removable drives (but assuming you plug your usb into another -infected- system, it can help noticing it). There is a solution taking the next step, USB Vaccine, which creates a unwriteable, undeletable file with that name in your usb drive. It does so by marking it with some ...


1

I will assume that since it is a laptop, it will exposed to external threats as you will take it with you, but you are interested in security and hardening of the system to prevent unauthorized access. VMs are a great way to sandbox your activities without putting your entire machine at risk. You can take a snapshot of the VM's configuration at anytime you ...


1

KASLR has gotten under heavy critic on the day it was released for Linux, and it has also been defeated on that very day. Spender at grSecurity has written a post about it (along with LWN comments) which I'll only summarize in a simplistic way. I highly encourage reading the original source. Address Space Layout Randomisation was originally applied to ...


1

KASLR is simply ASLR... applied to kernel space. Without KASLR the address space of the kernel is static. Any exploits using a kernel vulnerability will find it trivial to overwrite and control return addresses and the like, just like any exploit against a userspace vulnerability will find those tasks trivial without ASLR enabled. LWN has a nice article ...


1

Pretty sure it is. Check with Is there a short command to test if my server is secure against the shellshock bash bug? Although on windows it is more difficult that an attacker is able to set an environment variable to a malicious value and that bash later gets executed with it.



Only top voted, non community-wiki answers of a minimum length are eligible