Hot answers tagged windows
161
This combination is called a Secure attention key. The Windows kernel is "wired" to notify Winlogon and nobody else about this combination. In this way, when you press Ctrl+Alt+Del, you can be sure † that you're typing your password in the real login form and not some other fake process trying to steal your password. For example, an application which looks ...
61
Ctrl-Alt-Del is the Secure Attention Key on Windows. The operating system enforces a strong non-interception policy for this key combination.
You could make an application which goes full-screen, grabs the keyboard, and displays something which looks like the normal login screen, down to the last pixel. You then log on the machine, launch the application, ...
27
The answer to this can actually be found on our sister site, ServerFault. How does CTRL-ALT-DEL to log in make Windows more secure?
To quote the accepted answer by Oskar Duveborn,
The Windows (NT) kernel is designed to reserve the notification of this key combination to a single process: Winlogon. So, as long as the Windows installation itself is ...
10
Some additional questions have been raised regarding Windows 8 SAS support, and a later deleted by owner separate question was posted about it, too. Since I've already started writing my answer to that question, and Windows 8 has also been mentioned in this thread, I'm thus posting it here. If that deleted question reappears, I'll move my answer there. ...
6
What you are looking for is Windows Powershell. It is the windows equivalent to the unix terminal. Using the command line for administrative task is so much more efficient compared to using GUIs once you get past the learning curve.
In Powershell, the dir or ls command allows you to list files and directories together with the permissions. I am not that ...
6
So I looked this up how it works and found a nice article. An excerpt:
Now Microsoft is planning to release OEM 3.0 in Windows 8 which will enable more security against piracy. So what is OEM 3.0? OEM 3.0 will let Windows 8 to be installed on only one PC and the digital product key will be generated on that PC. The digital product key will only be valid for ...
5
This question is a bit off-topic, but I'll post my personal experience with a similar issue.
Create a VistaPE image.
Integrate PGP into the image (Follow this guide and download the PGP tools from here)
Burn the VistaPE image, then boot from it.
Use the following command to decrypt the disk:
pgpwde --decrypt --passphrase "YourPassword" --disk 0 ...
5
When teamviewer is installed it includes a daemon that runs under the system account. The client that is started under the users account only provides instructions to this daemon.
As this service already has elevated rights assigned at the time of installation (the creation of this daemon) it is possible to directly emulate key strokes as coming from the ...
5
With software, reverse engineering works (there is even a dedicated StackExchange site for reverse engineering questions). Extracting secrets from compiled binaries has been done and redone and done again since the days of the first "copy-protected" games for personal computers, back in the 1980s. The bottom-line is that you cannot really hide a secret value ...
4
The idea is that a trusted Windows process called Winlogon, and only Winlogon, can read the Ctrl+Alt+Del key sequence. This key sequence is called the secure attention sequence (SAS). By entering this key sequence, you are basically "proving" to yourself that it is Windows that is accepting your input. This guards against a malicious program intercepting ...
3
Running Teamviewer isn't very secure: read here
To determine who was logged in - look here:
C:\Program Files\TeamViewer\VersionX\Connections_incoming.txt
C:\Users\XXX\AppData\Roaming\TeamViewer\Connections.txt
3
Device security is limited to the type of device.
What are the security risks of Bluetooth and what technologies and
best practices should be used to protect my device?
Each device provides a level of services. The services provided create the restrictions or limitations to access and exploit. The best protection is to keep Bluetooth turned off (if ...
3
In general, OS vendors implement what network provider wish to see, and network providers are very wary about interfacing the bits which do the actual phoning, with user-provided code. They don't want customers refusing to pay their bills and defending themselves by saying that they did not pass the calls, but some virus on their phone did. Such a defence ...
2
Nope. It makes absolutely zero improvement in security and disables a normally useful feature.
As you're probably well aware, there's a number of shortcuts that work to do all the things you've mentioned like F2 to rename files, Ctrl+C for copy, Ctrl+v for paste.
It does absolutely nothing to prevent keyloggers, screen cappers, viruses/malware etc. To ...
2
If you can pull it off one of the best security things you can do with TeamViewer is under the Advanced options change the "connections to this computer" setting from full access to "confirm all". This will require that someone is sitting at the computer in order for TeamViewer to allow any inbound access.
Failing that if you only connect to your computer ...
2
Ctrl+Alt+Del was around way before Windows Logon, originally it simply did a soft reset on the system. The same combination is on other systems/OSs too (Atari ST springs to mind).
If the question is "why these three keys" then I would say because they are hard to push and a mistake is therefore hard (as people have said).
If the question is "why does ...
2
You are missing the point of the lockscreens of the various mobile operating systems.
They are not an effective deterrent for attackers who has stolen your phone and has an unlimited period of time to attack it. However, they are effective in deterring chance attackers who happens to walk by and only has a short period of access to your phone.
2
According to Symantec, it's possible to:
6.Decrypt the disk using another system - Remove the hard disk and slave the disk to another system with PGP Desktop installed to decrypt the disk.
So you should be able to mount this HD in another computer, and extract all the relevant files to make a backup.
I wouldn't bothering removing the virus: if the ...
2
Another option is to put the drive in another computer that has PGP installed and decrypt and scan the drive from there. Make sure that the other computer is either a burner or has auto-play turned off to make sure the virus doesn't get an opportunity to spread from the infected encrypted drive though.
The key is to load the drive in a clean environment ...
1
You may need to use a File Integrity Monitoring tool to look at the directories the software may affect. The FIM will monitor for creation, modification and deletion of folders/files in those locations and provide a report. However, it may tell you that changes have been made but not what are the specific changes.
You could run 2 separate systems; one ...
1
I agree with the answer that suggested the overall design of determining what is, and is not, a good system call may be difficult. Indeed, in isolation, a single system call might not be enough information.
In terms of the way Windows works, there are actually two levels of operation:
NT-level calls. These are the typical system calls you'd expect via ...
1
I just found Featherweight Virtual Machine, which is an open source sandbox implementation for windows:
http://static.usenix.org/events/vee06/full_papers/p24-yu.pdf
http://sourceforge.net/projects/fvm-rni/
Also interesting is Dune:
http://dune.scs.stanford.edu/
It implements a proof-of-concept sandbox like I described under linux using VT-x (which ...
1
Your plan is based on the flawed assumption that you can identify "bad" behavior by some kind of screening of system calls. You can't. Windows is replete with bugs, hidden features, and unexposed dependencies. As soon as you pass control to some other piece of code you didn't provide, you have absolutely no guarantee that it will do only things you ...
1
The security of a pattern lock is going to depend greatly on a) how it is implemented and b) how long and what path the user chooses. The interesting metric you are looking for to know how secure something is is a concept called entropy or randomness.
If entropy is maximized, then each choice should be unrelated to prior choices and the difficulty of ...
1
Kos demonstrated a P2P attack on Android at Derbycon last year that only takes seconds. PDF Warning: http://kyleosborn.com/android/AndroidPhySec.pdf Here is a video of the demonstration from Hak5 http://hak5.org/episodes/hak5-1205 (Kos starts at 6:55).
A lot of time with the pattern lock, there are ways you can just look at it and see what the pattern is ...
1
Some mobile devices provide on device encryption to protect them, tied to the passcode/password that the user enters. When tied to a device wipe after a certain (small) number of incorrect attempts, they can provide an effective mechanism to protect the data held on the device in a "lost/stolen device" scenario.
To take iOS devices as an example, you can't ...
1
The only sane protection against DDoS attacks is deploying a service like CloudFlare.
The very nature of a DDoS attack makes it difficult to detect and stop. How are you going to distinguish between malicious and normal traffic? Even if you have such a means, performing analysis on every single connect attempt on your server is probably going to overload ...
1
This clearly is being written to promote a reasonably tested application. I have three comments about this:
First and foremost, they should have their own internal scanning program (vulnerability assessment) that they would provide a test bed to run your program on as part of their acceptance testing. A software vendor may choose to have and develop their ...
1
Web application scanners are hardly be the be all end all of web application security and simply running an off the shelf tool will not solve the the problem of an insecure application. That being said, the security impact of a desktop application is highly dependent on what your application does. Is it a server? Does it communicate over a network? Does ...
1
If the customer is as security aware as the question imply's then they will understand that the only reliable way to perform the task would be to whitelist traffic to the IP address range for Amazon ELB service.
If the worry is that this would allow other websites using the same service external access then a proxy server or secondary firewall would be ...
Only top voted, non community-wiki answers of a minimum length are eligible
