Tag Info

New answers tagged

0

You can easily inject characters as if typed either via USB tools or code. Depending on the latency of trying a code and assuming no lock-outs it may not take too long to iterate through every possibility. A better option may be to attach a debugger, enter any code and step through until you see the check of the input string. Change the logic of the result ...


0

You can bypass UAC manually on windows 8.1 it is my own technique here you bypass UAC Secure desktop and consent.exe etc in this bypass you belong to group of local administrators and you won't get any UAC prompt what you have to do is move to system32 directory and there are at least 10 ways to reach there,any way i will show you how to do it locally,press ...


0

secure desktop runs under local system account and no other process can interact with it except OSK,Narrator etc,it is started by winlogon.exe and you can disable it in registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System by changing the value of PromptOnSecureDesktop from 1 to 0 if you run cmd.exe under system account it ...


0

When you belong to a group of local administrators on windows server or windows 7 0r 8 by default you are not given full admin token,for instance even as administrator on the machine when you run cmd.exe and click run as administrator you have to pass UAC ( secure desktop) when you say yes to the UAC prompt you are given full admin token for the process.Even ...


2

Technically speaking there is very little risk in running an insecure VM on a secure machine IF that VM does not have network access (after all this is how you research malware). If it does have network access then you've essentially just circumvented all security safeguards. From a security perspective, assume that your VM will be insecure and thus full ...


1

Except for the few exceptions for viruses that can run on Wine and iyou have Wine installed, Linux generally won't be affected by Windows virus. Note though that Linux can be an asymptomatic carrier of Windows viruses. If you send other people a file infected Windows virus, their machine can catch the virus, even if the file looks fine on your Linux ...


0

Network discovery is a network setting that affects whether your computer can see (find) other computers and devices on the network and whether other computers on the network can see your computer. By default, Windows Firewall blocks network discovery, but you can enable it. Instead you turn off 'Network Discovery' in your system, I suggest you install a ...


0

The Windows Encrypting File System (EFS) would meet your usability requirements and probably the majority, if not all, of the PCI DSS requirements. However, I have not evaluated it against the DSS so I can't say for sure. You could turn on EFS for a directory structure and then point all your applications to write to subdirectories within that tree. ...


0

We cannot help you if you don't post more info about the file. First you will need the md5 signature of that file. You can use a tiny tool called winmd5 for that. Secondly either search that md5 sig online and try to find relevant information about the process/file or submit it to md5 malware databases such: https://isc.sans.edu/tools/hashsearch.html


1

So many ways! What is the most common type of software flaw that is exploitable? Buffer overflow. A buffer overflow is where a program requests a size of memory but then writes more data in that location (overflowing) to the memory next to it. For example: A program like OpenOffice Writer (Word Processor Like MS-WORD) (this is pure fiction by the way) ...


0

The short OP is asking why clicking on a .txt runs a virus. If a virus changes the associated program for an extension, then your computer can start mad_notepad_that_also_runs_a_virus.exe instead of notepad.exe when clicking on a .txt file. But clicking on i_love_you.txt.extension_like_that_will_obviously_make_this_computer_explode.exe, even if a very naive ...


4

One possibility not yet mentioned is unicode shenanigans. Unicode supports displaying many languages, including those written left to right, and those written right to left. One way it does this is using special characters including: [U+202E] Windows supports unicode, including in filenames. You see a file on your desktop: evilexe.txt It looks like a ...


1

Windows Credentials Yes, they are stored hashed within files in the c:\Windows\System32\Config\ directory. You will need the SAM and system files. However, a backup of these files may be stored in the Windows repair folder at c:\Windows\Repair\. If Windows is running and you need access to the locked files in the Config folder (for example you know the ...


4

Yes, Widnows saves users' passwords in 3 files: Windows\System32\Config\SAM file (without extension). Windows\System32\Config\SAM.sav: it is a copy of the first one Windows\System32\Config\SAM.log A transaction log of changes. To access these files, run Start/CMD and type %SystemRoot%then choose the subfolder system32\config. These files can not be ...


1

To access the windows passwords, you'll need both the SAM and SYSTEM file from C:/WINDOWS/SYSTEM32/config On a Linux Distro, like Kali-linux, you can then use the command "bkhive SYSTEM bootkey" to get the bootkey from the system file. Then, use the command "samdump2 SAM bootkey > samdump.txt" to get the hash dump from the SAM file. If you open the file, ...


0

All local user account passwords are stored inside windows. They are located inside C:\windows\system32\config\SAM If the computer is used to log into a domain then that username/password are also stored so it's possible to log into the computer when not connected to the domain. As for seeing which passwords are currently stored on a computer you can use a ...


11

Sometimes opening a .txt , .jpg or .docx files leads to running a virus. How come is this possible ? To add to the answer to a similar question (thanks for finding it, Tcholas!): You are correct in thinking that a virus in and on itself is harmless. A virus sitting in a file somewhere is no immediate threat to your computer. But when you open a file ...


0

Been a long time since I've done C structured exceptions (MS specific but emulated on Wine), but the syntax is close to this. Somebody using this could have a lot of fun even if Z is not mapped. bool isLinux = 0; __try { asm { mov AL, 172 int 80h } isLinux = 1; } __except {} if (isLinux) asm { /* Linux shellcode here */ ...


7

One possibility is by exploiting overflow vulnerabilities. When opening the image, the software failure will "throw" the virus into unauthorised memory sections that may be executed by the system. Here you have a description by Symantec of a vulnerability that exploited Internet Explorer in this sense. Also, this question was answered in Stack Overflow.


27

This is possible thanks to OLE (Object Linking and Embedding) technique. It is intended to share information between applications that run on Microsoft Windows operating system. Mainly, it allows to embed objects in documents. Official Microsoft Documentation explains the benifits of OLE. But as any other concept, it could be used for a neferaious ...


0

As said on the link you point to, this vulnerability concerns only pre-2003 versions of Microsoft LSASS. It also says that some worms are known to try and exploit this vulnerability to propagate. Essentially, they just try and send a request to your OS's Local Security Authority Directory Service (whatever that is, it's probably built-in many Windows ...


2

The page lists the affected systems and your windows 7 32bit is not included: Affected Avaya DefinityOne Media Servers Avaya IP600 Media Servers Avaya S3400 Message Application Server Avaya S8100 Media Servers Microsoft Windows 2000 Advanced Server SP1, SP2, SP3, SP4 Microsoft Windows 2000 Datacenter Server SP1, SP2, SP3, SP4 Microsoft Windows 2000 ...


0

This is not what Bitlocker is for. Full Disk Encryption (FDE) tools like Bitlocker are only meant to protect against off-line attacks. This is where the computer's operating system is not running. Examples might be if the disk is removed and mounted in another computer, or if the computer is booted from a LiveCD or similar. When the OS is running - ...


1

How do you validate the signature? If you can compromise the system files, chances are you can also compromise the root public keys being used to validate against and the files would still appear valid. Signed files only helps if the system is otherwise secure, if the system files themselves are corrupt, that is no longer a true statement and all pretense ...


1

Not just IP/pings, but if your computer is "discoverable", it means it will allow requests for other things such as public/shared files, remote control/access, any printer resources that may be shared, and DLNA/streaming, homegroup, etc. - any one of those may have a vulnerability that can now be exploited


0

I don't think that not being technically proficient is really a problem for installing him a Linux. Given that he has gotten so paranoid to not want go online anymore, it should be possible to convince him to try that. Linux is not hard when it is already installed and working properly (no programs missing, hardware errors…) there aren't special needs, ...


0

You can't. See my answer to the similar question How isolated are 2 operating systems on 1 harddisk? The nastiest of the malwares you installed in disk B could easily wipe the contents of disk A. You would want to use a virtualization solution (QEmu, VMware, VirtualBox, VirtualPC…). In this way, the guest operating system doesn't have full control over the ...


0

No, they won't be much isolated. Each install will be isolated from a normal usage. For instance, a Windows update installed on one Windows, won't be applied to the other. The main problem, as hinted by Rory Aslop, is that both will be able to see each other partition. So a virus which eg. infected each .exe files on the computer, will infect both ...


1

What is the challenge here? Why don't you accept it? Or will you lose your laptop when he succeeds? ;-) If you have a spare external disk, big enough, give it to him, completely erased and let him do his magic. The disk is yours, stays yours, and of course you want to see if this really works so you don't leave your laptop out of sight. All in all there is ...


1

Yes, it looks possible. I assume you are talking about a USB device. First, if you have autorun still enabled, the device can present itself as a drive configured for automatically executing the binary that will simply copy all files accessible to it, and maybe try to make a full disk copy. Then, if you happen to have Windows unpatched, there were some USB ...


1

If the owner (user) of the process of the software has the ability to do so, then the software also can delete/replace/modify DLLs.


4

The most common? Probably HKLM\Software\Microsoft\Windows\CurrentVersion\Run -- it's how programs arrange to be run at startup. Of course, a lot of perfectly harmless programs also use it, so watching it won't gain you much. The problem with simply watching registry keys for modification is that normal programs also change many of them. You can't, for ...


0

There is an open source file integrity monitor called Mugsy that ships with a list of important directories to monitor for Linux: - /boot - /lib - /lib64 - /sys - /bin - /sbin - /usr/bin - /usr/sbin - /usr/local/bin - /usr/local/etc - /usr/local/sbin - /etc I'm the developer of Mugsy, so shameless plug. I agree that all files should be monitored, but ...


0

For Linux, disable root if you don't need it. Use sudo with a properly configured sudoers file. This allows fine-grained control over what users have what superuser permissions (i.e. you can allow sudo only for Nessus). Alternatively, you can set permissions so the account running Nessus has permissions to access the resources it needs (this will be more ...


0

As has been mentioned by others do not do something like this on a PC that you intend to use as the device maybe attacked in other ways. I personally would also separate this machine from the rest of the network to help protect any other devices on the network. Last thing you want to do is to accidentally open the rest of your network to attack. Depending ...


0

If you want to use a folder in this way, put it on a disposable computer, not a computer that you want to protect. You have to assume that anyone can (will) break into it, so keep it segregated and replaceable.


1

Deliberately opening your computer for attack is not safe. You presume the attacker is interested in your shared folder, much more likely with a connection to the machine they will choose other attack avenue. A better solution is to install a honeypot on the pc.


2

Sorry but this view that Linux is by default more secure than Windows is wrong. Does GnuTLS mean anything to anyone? How about all of the issues in OpenSSL recently? Vulnerabilities affect Linux just as much as Windows. More so in some cases. In general, as long as you are keeping your OS and applications patched, you are doing the first few things right. ...


0

Also council move to Linux, I probably will describe a couple of programs that will definitely help improve of the home PC a little bit. Tripwire Secure Cheq - just download and run this app and it will show you some of weak places. Set up enterprise firewall (default sucks, but better than nothing) Enable UAC Install and configure EMET with "maximum" ...


0

RODCs really are all about physcial security, and not at all about network security. They're an upgrade of ye olde Backup Domain Controllers, that had a nasty tendency to get stolen (and the database along with it). RODCs come with a unique kbtgt account, so they can't intrude on Active Directory, or decipher kerberos tickets on behalf of WDCs, in case of a ...


1

As a follow up to David's answer I wanted to point out this article (I can't add a comment): http://digital-forensics.sans.org/blog/2012/02/29/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly It shows that even when clients are told not to store LM hashes in the SAM database, they will still be held in memory and can be dumped ...



Top 50 recent answers are included