Hot answers tagged

12

TLDR: It's probably fine, and MS meant it not to leak anything important. It's worth stepping through this line by line, but it's too long. So let's leave out anything that's fairly innocent. Essentially though, an attacker must work out what your system is (and this has no obvious Personally Identifying Information), and somehow find a specific driver of ...


8

Is Windows 10 Leaking my IP Address? Almost everything is leaking your IP address. I'm going to avoid telling you your IP address isn't secret. You seem to already know that. Instead, I'm going to tell you what you're looking for: Yes, Windows 10 leaks information about your IP address ten over a hundred times until Sunday, even if you're behind a proxy! ...


7

Since your IP address is essentially the internet equivalent of your postal address and since it is required for routing your request (and especially the response) over the internet, any website that you connect to will have access to it. Any email server you connect to will have access to it, etc. Every time you connect to another computer, that computer ...


4

First off, you should go type "how bitlocker works" into google and read a few articles. You will probably learn the answer to your question (and a bunch more interesting things besides!). If you want a quick answer, I found an article by Microsoft that says: During the startup process, the TPM releases the key that unlocks the encrypted partition only ...


4

You're really asking the wrong question here Really what you should be asking is: Should I be worried that I can use tools to look at passwords stored in my Chrome browser? And the answer to that is... Kind of. Really the best way to prevent that from happening is to keep your systems hardened. If someone gets access to that data, you've already lost ...


3

The DFIR Blog has a great summary of UAC -- https://dfir-blog.com/2015/10/24/protecting-windows-networks-uac/ In the article, the author recommends the Always Notify approach, especially for administrators and critical servers. Besides social-engineering attacks such as the exploits/windows/local/ask module in the metasploit-framework, there are also tens ...


3

It depends on how EFS is set up, and what version of NTFS you're using. For the purposes of this question, I'm going to presume a modern version of NTFS (i.e. >=3.0) on a modern operating system like Windows 8.1 or 10. In a single-user environment outside of a domain, by default, files are encrypted in a 3-stage process. First, a random File Encryption Key ...


2

This depends on how paranoid you want to be. The dxdiag.txt file generated by using the Direct X Diagnostic utility will contain a lot of information about your computer and depending on the type of user you are, one particular thing may directly identify you (if you're the kind of person to name your PC Zachiel-PC). For example: NETBIOS name of your ...


2

From the source code of the meterpreter persistence script, the delay parameter is passed to the VBS executable that is created. When you check the VBS creation code, you can see that it runs WScript.Sleep When you say that persistence does not run sleep(), I assume you mean that it isn't running that function in in the shell, and it isn't. But it is ...


2

The Windows Credential Manager is anything but secure. It's "secure" at the user account level, which means that any process that the user ever runs and the user themselves must necessarily be trusted in order to call this system "secure" with a straight face. The only semi secure way of using the Windows Credential Manager is to store values pre-hashed, ...


2

As a client device, simply turn off the "Automatically detect proxy settings" feature in Internet Options. This prevents the browser from trying to look up a location for the wpad.dat or proxy PAC script. If you want to protect poorly configured devices on your network, set a DNS entry for WPAD and blackhole the traffic.


1

The green folders are encrypted, the locked folders are locked to the user only(possibly password protected, but not encrypted). A quick google search for folder with lock icons windows 10 shows that they can only be accessed by you, and not anyone else. Green on the other hand means actually encrypted. A simple test: Send the peglocked folder to someone ...


1

Yes, if an attacker can crack your local password hash they can log in as you and have the same access to your encrypted files. You could export your EFS cert and private key to a PFX file protected with a separate password that would be harder to crack, but this would mean deleting it from your local key store when not in use and then importing it again ...


1

Already done - it's currently in beta. Have a look at: Malwarebytes Anti Ransomware Beta. Former times it was called CryptoMonitor developed by EasySync Solutions, owned by Nathan Scott. Nathan was recently hired to bring up the Anti Ransomware tool for Malwarebytes.


1

Is it a good idea to remove & re-pair my devices on a set interval (thinking that this is changing the Bluetooth PIN) No, it might not be a good idea. There is an exchange of information during the pairing that can be exploited by someone eavesdropping the radio communication link. Please see the excellent presentation by Dominic Spill ...


1

If you have saved your passwords in the browser's password store, then they can be read from the browser's password store, and there's no way around that. The reason that Nir's tools works is that the browser makers have not given proper consideration to secure storage, and you can't fix that yourself. Your alternative is to switch to a real password ...


1

There are the usual risks associated with explicitly or implicitly trusting something which comes from outside and thus can be controlled by the attacker. And there is a risk of assuming that environment variables provide a restricted visibility which they don't do always. Some examples: Implicitly trusting environment variables like PATH, LD_LIBRARY_PATH, ...


1

Microsoft doesn't consider UAC a security barrier, and thus they often don't fix UAC bypasses. These bypasses are common and easy. See for yourself: https://www.google.com/#q=uac+bypass


1

The existing answers covering most of the important things. I just want to add that in case of ransomware the software doesn't need any elevated privileges. If the malware doesn't has privileges to persist somewhere this wouldn't even a problem. If the user has write access to (some of) their important files which is very likely, the ransomware just encrypts ...


1

In teamviewer 10 you can check the following files: C:\Program Files\TeamViewer\Connections_incoming.txt C:\Program Files\TeamViewer\TeamViewer10_Logfile.log First one provides details about the incoming connections. Second one provides details of the actions performed



Only top voted, non community-wiki answers of a minimum length are eligible