Tag Info

Hot answers tagged

5

If you're trying to eliminate malware, a simple format is sufficient. Zero-wiping the disk or repeated over-writing with fancy patterns is about preventing humans from using advanced data-recovery techniques to read the data. There's nothing magical about a pattern of bits that makes it malware, it's the structure surrounding it: the directory entries ...


4

Firstly as per @EricG most of the administration should be handled using a network administrator account, using group policies and the like. If you need access to a users logged-in session the best way to approach this is to have the user login to their machine and then hand you the keyboard. That way you never learn there password, and the user can observe ...


4

There are many ways to do this. The term you are looking for is "rootkit" - that should send you down a rich road of research. As for specifics, the attacker could replace a core Windows program with an infected one so it always gets loaded when Windows starts up normally. Or, the attacker could infect the BIOS. These two methods are impossible for a normal ...


2

Is it possible for a virus/worm to attack on your host to attack the guest OS? Yes. Is it likely? No. Malware can do anything you can do, including writing to the virtual disk. The easiest route would be to simply mount the virtual machine drive, and write new malware to it. This is unlikely because it would take specially crafted code to exploit this. ...


2

You can not generate your own EV certificates and especially you can not generate self-signed EV certificates. Only some CA's are able to generate these and these CA's are specifically marked in the SSL stacks of the browser or operating systems. If you want to create EV by yourself you would have to change the SSL stack used by the browser to accept the ...


2

Short answer: you can't, because they are two different and incompatible key+certificate systems. Longer answer: Windows Certificate Manager uses X.509 certificates, each of which must be signed by a Certification Authority whose root certificate is considered valid by Windows. Thunderbird will use the public key stored in your recipient's certificate to ...


2

If they keep coming back, it means that you have some software running checks on them. You should take some tool to analyze the running processes on your machine. Use Process Explorer to look at the current running processes (so that you can find out which one is recreating the reported keys and Autoruns to check the list of programs initiated ...


2

Another things are crypters. Crypters are a software just like obfuscators that take in a malware and encrypts its data so that it becomes undetectable by any anti-malware programs. This crypters uses special encryption algorithm and a method to inject the malware directly into a already running program like explorer.exe without even touching the hard ...


2

Depending on the version of Windows you are running, powershell should give you what you need. Something like this: netstat -ba |Select-String -pattern "EST" -context 1,0 Take a look at this technet article for some select-string info: https://technet.microsoft.com/en-us/library/ff730968.aspx


2

There are many ways that Nessus, and similar scanners or other utilities, may remotely control or alter systems without RDP enabled. In fact, you'll probably be hard-pressed to find any remote management utility or vulnerability scanner that requires RDP. Remote Desktop is mainly for the human user. Graphical interfaces help us to more easily interpret and ...


2

IIS is one of many applications that get HTTP requests passed to it from HTTP.sys, so HTTP.sys can be loaded without IIS running or even being installed. Windows implements an HTTP listener as part of the network subsystem via a kernel mode driver (HTTP.sys). HTTP.sys is what's actually listening for HTTP requests and passing it on to the application ...


1

This reddit give us some information based in the reported exploits. As you may see, it is a problem regarding validation in the "Range" HTTP Header. Some users reported getting immediate BSoD after issuing the mentioned requests to their web servers. Correction: So, as it seems, you do NOT have to be running IIS to be affected by this vulnerability. ...


1

Short version: You want Mandatory Access Control Real-world Industry Best Practices use of MAC is rare The use of bastions is the most common widely-accessible alternative Long version: The ability to apply fine-grained controls over not only the users but the processes able to access data is generally only found in Mandatory Access Control systems. ...


1

The best practice is exactly the same as for every privileged account (administrator, root, etc.): don't use it as a standard account. All you need to do is NOT grant access to the DUDE.NAME account to the sensitive data and use HIGHSEC.DUDE.NAME instead. You can effectively couple that with some form of isolation if necessary. For instance, you can ...


1

Nessus appears to use SMB and WMI when doing credentialed scans. Take a look at the following PDF from their site: http://static.tenable.com/documentation/nessus_credential_checks.pdf


1

Software such as PsExec allow remote command execution without software on the remote system: PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec's most powerful uses include launching ...


1

I realise this is an old thread, but still... This raises the following questions: How is the SRK derived from the password? How is the SRK stored? If the SRK is somehow compromised, how easily can the password be derived from the SRK? It isn't. The SRK is generated by the TPM using an onboard random number generator. The password is ...


1

Okay, I've done some investigation on this one. I still can't find any word from MS about it - presumably they feel it's such an obvious thing to do that it needs no such assertion. Examining the WindowsUpdate.log file suggests that signature checking is taking place, and examining the wuaueng.dll file with a debugger verifies this. Windows update will ...


1

My preferred method is SSHFS. Your NAS server runs a SSH server which you then connect to from your remote machine. Leveraging SSHFS it will mount a drive on your remote machine via SSH (secure, encrypted) from the server you specify. I've not used the windows client version so YMMV. ...


1

It sounds like what you are looking for is a solution where the encrypted text and the private key can be copied and pasted into in application that will perform the decryption. Ideally, you would like a solution that does not require anything to be installed on the users' systems. You might want to check out Travis Tidwell's javascript RSA ...


1

A reasonable approach here might be to see what existing HIDS products do in this regard. If we take OSSEC as an example, per the book on their site has a long list of both files and registry keys that are monitored for changes (P84 in the linked PDF) In general windows system files are mostly in c:\windows, so a lot of files to be monitored will be in ...


1

Depends on what you mean spoof and what you mean IP. If you want to be a specific IP4 or IP6 it may not be possible. Such as you pretending to come from Google's IP. But if you just want to test various IPs against a security firewall that's different. You can generally find VPN like hidemyass.com to use their IP. Some are anonymous, others not so much. ...


1

How can I spoof source ip address while making a ping request from windows command prompt? If you just want to change your local network address (e.g., change from 192.168.1.69 to 192.168.1.70) then you can set a different static IP address in the Windows "Network and Sharing Center". The exact steps depend on what version of Windows you are using, ...


1

You could send the mails in standard S/MIME format, which would allow recipients to use a plugin for their mail client of choice to read the encrypted parts without too much hassle. I know for a fact that there are Tunderbird plugins, and I'm pretty sure Outlook has native support for S/MIME. You can create these mails with the openssl command line tool: ...



Only top voted, non community-wiki answers of a minimum length are eligible