Tag Info

New answers tagged

0

The best environment I've found so far for Windows exploitation would have to be the OSCP labs (and you get a qualification at the end if you pass!). It is a big network with a fair mix of Windows and other OS's although it is dominantly Windows. As far as I'm aware there are none that exist, people have them though do not make them available due to ...


1

This doesn't seem suspicious at all. As raz pointed out, Windows makes rapid estimates of space and then replaces that number with the real number after finishing calculations. Also, all disks need to reserve space, but again, as raz mentioned, 32Mb is not unreasonable.


1

If this is the case, doesn't this logic essentially adhere to the 'security through obscurity' mentality that is generally frowned upon? Security through obscurity is only frowned upon when used instead of a more fundamentally effective control. Typically it is best to apply multiple layers of security, and it is perfectly acceptable and beneficial to ...


1

Ubuntu (or any Linux distro) is less a target for malware because it's less common - if you had a limited amount of time to spend developing malware, would you make it for an OS that the majority uses or do it for the one a minority uses ? As for the security by obscurity part, Linux distros don't base their security on top of the fact that they're less ...


0

Well a quick and dirty answer is that Ubuntu runs off of the Debian core which has a huge development community. Thus if a vulnerability is found a patch is written very quickly where as in windows they have their cycled patch Tuesday that happens once a month. But there is truth to saying that more malicious code exists for windows that targets the home ...


3

I played around with Family Safety on Windows 8.1, and from what I can tell, it's seems to be smart enough to check the validity of the original certificate before it proceeds to replace it with a Microsoft certificate. From the screenshot below, you can tell that when I visited Google, Google's real certificate was replaced by the Microsoft Family Safety ...


-1

Windows was measuring the speed of the drive for ReadyBoost. You can disable this in the same drive properties.


1

Shellshock is a vulnerability in the bash interpreter which is mostly used on Unix-like systems but has been ported to Windows. However, Apache Tomcat, when running on windows, does not include bash by default and doesn't have CGI enabled by default either. So, generally speaking, no, Apache Tomcat running under windows is not vulnerable. To be sure, ...


0

Physical access is always a very risky thing. While I don't now of any security flaws right now that will give you immediate access there are a lot of other things that you can do, eg. using a USB keylogger to intercept the user's password when he uses the machine the next time. There have been attacks using PCI cards utilizing direct memory access ...


50

In essence, these certificates are necessary and required for backward compatibility with XP and Server 2003. If anything was signed with these certificates, even if they're expired now, your server needs the cert trusted in order to trust the thing that the cert signed. Source: http://support.microsoft.com/kb/293781 Some certificates that are listed in ...


2

From the Windows Blog: As well as being teased with a variety of PCs, Certified drives must: Be built for high random read/write speeds and support the thousands of random access I/O operations per second required for running normal Windows workloads smoothly. Have been tuned to ensure they boot and run on hardware certified for use with ...


2

In short, you will have to use a packet sniffer in order to detect traffic that is not destined for your computer. This requires that your network interface be set in 'monitor' mode in order to take advantage of the way networks route packets. Not all wireless cards can do this, you will have to see if yours is compatible. Two examples of network sniffers ...


2

Unsure of what you're asking so I will answer based on what I do understand: if theres a port scan on the same segment and it does not reach the firewall at all, it is not detectable by anything. This makes little sense. If there is a port scan on the same NETWORK and it does not reach the firewall, it is not detectable by anything? Consider the ...


3

... ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN) This error is due to a certificate provided by a peer not matching the expected certificate. This is probably due to SSL interception by some middlebox (firewall) or an attacker, which does a man-in-the-middle attack to intercept and decrypt the traffic to the server and re-encrypt it to the client. Since it ...


2

Public key pinning means the server has said Not only is this cert vouched for by a reputable Certifying Authority, but any time you see a certificate claiming to be me, it will always be vouched for by one of these Certifying Authorities. If you see a certificate claiming to be me issued by a Certifying Authority other than these, it is bogus. ...


0

If you have a VPN tunnel between A and B, that will allow those two servers to have a conversation private from others on the LAN. It does not prevent access to other resources on the LAN by A or B. For that you'd want to look into VLAN tagging or other router based access controls.


1

Some software vendors partner with BIOS makers (e.g. Absolute) so that even if an operating system is re-installed, on network connection, the BIOS may be able to send back relevant information. Many of these products are gimmicky, for example LoJack can be blocked at a firewall/network level that will disallow it from phoning home. These types of software ...


0

It's a honeypot. Who do you want to catch? If you want to catch random people scanning your network, put it on your DMZ with a publicly accessible host name. Something juicy like, financial01.yoursite.com. If you want to catch someone who has already penetrated your network and is poking around, put it behind a router with a bunch of other machines. ...


1

This can very well be a concern. Different browsers handle it different ways. Chrome passwords on Windows are not stored in some file in AppData; they're stored using Windows's DPAPI, which means that they're encrypted with a key derived from your Windows password, so they're secure if someone doesn't have access to your Windows account. However, while it's ...


3

To answer your question, Microsoft does not care because you followed their directions to disable UAC in order to 'bypass' their UAC. To disable UAC remote restrictions, follow these steps: 1.Click Start, click Run, type regedit, and then press ENTER. 2. Locate and then click the following registry subkey: ...


1

Just let it sit and update itself? Unless you are a very high value target or you have good reasons to suspect that you're being actively attacked, then just booting up and try to get the update finished before doing anything is quite a reasonable level of precaution. Two weeks of no update are not long enough to likely get infected and you can't ...


1

Hooking uses an operating system feature to monitor events sent to the process, like low level keyboard and mouse messages. Applications can utilize a targeted or global hook in order to keylog (malevolent) or listen for keystrokes in order to perform value adding functionality such as executing macros or other hotkey functionality. (benevolent) DLL ...


2

In reading some of these answers, I wonder if some read the question: "A computer hasn't been connected to the internet for 2 weeks" as most answers are spouting "static IPs" or "if your computer is connected to the Internet." I would steer clear of these answers as it demonstrates that answers are simply being typed without a thought process. On to the ...


13

With most file formats it is not difficult to identify the original filetype without knowing the original extension. A JPEG file, for example, always begins with the HEX sequence FFD8FF. Seeing that sequence at the beginning of a file tells you that it is very likely a renamed JPEG image. There are tools available which detect many common file formats ...


11

This is in no way shape form of fashion secure. It's akin to taking money from out of the mattress and placing it in the cookie jar. Let's illustrate what you said in five steps hades$ ls -ltha example.jpg -rw-r--r--@ 1 hades wheel 586K Dec 8 11:28 example.jpg hades$ md5 example.jpg MD5 (example.jpg) = a7ecc5e48db6cbfd609b9c6c6ca9b21f hades$ mv ...


4

A youtube video from Defcon 21: http://youtu.be/NG9Cg_vBKOg?t=6m19s The guy being investigated simply changed the extensions of the files (eg. from test.jpeg to test.txt). However when the crypto guys look at it their tool detects that the extensions don't match the files and these files are the first to be examined more closely by a human.


44

What you are doing is no kind of encryption, it is just obfuscation. It relies on security by obscurity. It may be enough to hide your files from an amateur/casual observer, but anyone analyzing the files in a hex editor is going to be able to rebuild and access them. Effectively your method is about equal in complexity to attempting file undeletion, for ...


2

DLL Hijacking is when you abuse the library search order to gain execution in a process. Being able to write to the directory an executable resides in allows a malicious actor the ability to drop a dll with the same name as one the executable will request via LoadLibrary. When the executable attempts to load the expected library, they will instead load the ...


1

These are commonly the artifact of installing the Visual C++ redistributable package, often installed with many applications and video games. It's worth noting that Steam installs this package with a large number of games. Some more info: http://support.microsoft.com/kb/927665


0

The National Collegiate Cyber Defense Competition (CCDC) is a blue team competition that includes a Microsoft server and client. Not exactly CTF, but an information security competition with Windows nonetheless. Must be involved with academia to compete however.


0

No. You should not click install the app. The process I go by is quite simple: So back to the simple process again: 1) What is the app doing? 2) What are the permissions? 3) Is that permission really needed? Now let's look at a simple example. What is the app doing? Eg: Simple text editor.(Read/Write stuff from/to files) What are the permissions? ...


0

No you should never click "install the app" if you don't know/trust the developer neither on mobile nor PC. If you used to install everything on PC that's your problem, but you shouldn't do that because anything you install has full access to your data (worse, many installers require administrative privileges which means they get full access to your system, ...


0

I think that's a calculated value by the Windows GUI. And not actually inside the cert. Have a look at the cert itself using OpenSSL. (openssl x509 -in MYFILENAME.CER -noout -text) Here's a blog that talks about this: http://morgansimonsen.wordpress.com/2013/04/16/understanding-x-509-digital-certificate-thumbprints/ the thumbprint is a computed field, ...


0

Windows stores these encrypted in the following locations: In Windows XP, wireless keys are stored in the Registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WZCSVC\Parameters\Interfaces\[Interface Guid]. The [Interface Guid] is a unique GUID value the represents your wireless network card. The keys are well-encrypted by Windows operating system, so you ...


0

Have you tried netcat for windows? You will still need to change the parameters, but at least you have a smaller syntax. It also allows you to RDP if port 3389 is locally open (therefore making your work easier) and to execute port scans. Combining with psexec might give you better options to further your control.


0

You will not find this elaborate data no matter where you search simply because there are a lot of unreported attacks against many operating systems. When dealing with XP, you are likely also dealing with the security issues with newer operating systems (Windows 7, Windows 8) not to mention software such as Adobe, Firefox, etc., that are no longer supporting ...


1

If the software is using a fixed port and an hostname rather than IP to connect you could redirect the traffic to your local computer and use, e.g. ncat to remove and readd ssl, then inspect the traffic in between. Comment if you need more details.


3

Wireshark should be able to do it. However, the process is not as straightforward as you would have to scan the memory for the master secret. Here is a tutorial on how to decrypt SSL without access to the master private key. http://www.cloudshield.com/blog/advanced-malware/how-to-decrypt-openssl-sessions-using-wireshark-and-ssl-session-identifiers/


1

If you want to do that install Firefox. Firefox comes with its own trusted CA store and what you add there will only be available to Firefox.



Top 50 recent answers are included