Tag Info

Hot answers tagged

13

What is known about possible attack vectors for this exploit? Can it be exploited simply by visiting a website if you haven't applied the update? From [Dailydave] More info on SSLMAGEDON: Our friends at BeyondTrust have a page on the bug now: http://blog.beyondtrust.com/triggering-ms14-066 One thing I think people are missing is that this bug ...


3

Remember, the "U" in UAC stands for User. In the case of a kiosk, who is the user? Almost certainly it will not be you. What good outcome could you expect from UAC on a kiosk? Do you expect it to prevent the installation of malware if someone is surfing to evilsite.com? Do you expect the bored kid who surfed to evilsite.com to tap "no, I didn't mean to ...


3

It is possible when Windows logs the login event in the event viewer, it takes the login time from the system clock set. So a user could adjust the time and date then log back into the system which would log the event using the changed time/date, then then clock could be adjusted back to the correct time/date. this would show the last login as anything the ...


3

Wireshark should be able to do it. However, the process is not as straightforward as you would have to scan the memory for the master secret. Here is a tutorial on how to decrypt SSL without access to the master private key. http://www.cloudshield.com/blog/advanced-malware/how-to-decrypt-openssl-sessions-using-wireshark-and-ssl-session-identifiers/


3

The vulnerability (still undisclosed) is also described as "Microsoft Schannel Remote Code Execution Vulnerability", which indicates that it is an implementation weakness (namely, a probably boring buffer overflow), not a protocol weakness. Thus, there is no reason to believe that the vulnerability would be shared with any other independent implementation of ...


3

The SAM database is stored as a file on the local hard disk drive, and it is the authoritative credential store for local accounts on each Windows computer. This database contains all the credentials that are local to that specific computer, including the built-in local Administrator account and any other local accounts for that computer. The SAM ...


2

CVE Details allows you to create a customized RSS feed with certain CVSS scores. : http://www.cvedetails.com/vulnerability-feeds-form.php However, I'm not sure if there's a way to filter out only Windows & Red Hat OS vulns.. but perhaps someone has an idea?


2

I did some further investigation and realized that this constraint is taken into account at the time of resolving the certificate chain of trust, not at the time of creating a new link. From RFC 5280: The pathLenConstraint field [...]. In this case, it gives the maximum number of non-self-issued intermediate certificates that may follow this ...


2

Windows manages certificates and private keys separately. Each certificate may point to a private key; several certificates can point to the same key. Each such "pointer" is given as the name of the Cryptographic Service Provider (that morally contains the key), and the key name within that CSP. Windows does not keep track of how many certificates point to a ...


1

If you want to do that install Firefox. Firefox comes with its own trusted CA store and what you add there will only be available to Firefox.


1

If, by installing the anti-virus solution on the host system, you can achieve the same level of protection to the VMs as you would if they had anti-virus installed individually, then the end result is that all systems are protected from malicious software. This would satisfy compliance. There are very few products in the market that can be installed at the ...


1

In a trust relationship, the two domains are referred to as the trusting domain and the trusted domain. The trusted domain is the domain where the trust relationship is created. The trusting domain is the other domain specified in the trust, that is, the one wherein network resources can to be accessed. The trusting domain in this case recognizes the logon ...


1

You should use DPAPI to encrypt the data before storing it in Isolated Storage. While DPAPI is mostly targeted at per-user security, not per-app, it does have some provisions for your scenario: A small drawback to using the logon password is that all applications running under the same user can access any protected data that they know about. Of ...


1

The only realistic solution is to reimage any system that is known to be infected. You will want to take care to ensure the new image has every Windows patch on it. You will also need to examine your file sharing configuration on these systems as it looks like this worm will attempt to spread to those as well.



Only top voted, non community-wiki answers of a minimum length are eligible