New answers tagged

0

Windows 7 is not vulnerable to this vulnerability as mentioned here. This exploit only works on the targets mentioned in the code. Go through the exploit code,you can see only Windows 2003 and windows XP is mentioned. Take a look at the snippet of code which returns the error message which is shown on your terminal. You can see the code on github as well ...


1

Windows 7 SP1 should not be vulnerable to ms08_067. You can see which targets metasploit supports with the show targets command. This is the list I have on my kali box: Exploit targets: Id Name -- ---- 0 Automatic Targeting 1 Windows 2000 Universal 2 Windows XP SP0/SP1 Universal 3 Windows 2003 SP0 Universal 4 Windows XP SP2 ...


0

Well, actually, Ransom32 is not an .exe file, it's a .scr (which is basically the same thing) and he doesn't use WinRAR code but NSIS code in the latest version that I've found on the web. We can easily unpack the scr file to see interesting things : First, the NSIS script file will launch a .NET 4.0 installer if not found on the system Then it'll ...


3

Joanna Rutkowska, leader of the Qubes project, does a great job into documenting the concepts on which Qubes is relying. I therefore strongly suggest you to get the information at the source, and in particular to read the two following documents: Software compartmentalization vs. physical separation (Or why Qubes OS is more than just a random collection of ...


0

In theory, Qubes would be more secure as it's running fewer services by default. No network discovery, file sharing, etc, so less probability for any of those to get remotely exploited. It also benefits from being open source as well as being a niche OS, which means there's less malware targeting it. In reality though, unless you have reasons to believe you ...


0

I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? Yes. Some ISPs may have terms that prohibit certain activities which appear to be attacks. To thwart this issue, you could use your own equipment to attack. So, instead of having your firewall be plugged into your "modem" (e.g., cable modem, ...


1

It's perfectly legal to attack a machine or network as long as you have the explicit permission of the owner. Since it's your network, you can do whatever you would like.* There are other laws you may still bump into. For example, you can't change your WiFi access points to transmit on an unlicensed frequency. If you install a virus "for testing purposes"...


2

There is nothing hindering you from testing within your own network. To get a rudimentary understanding of what is involved with testing, I suggest you familiarize yourself with the Penetration Testing Execution Standard, OSSTMM, and other similar pentesting frameworks. Once you begin establishing the who, what, when, where and why, it will make things ...


2

All attributes can be seen here under "Permissions for files and folders" on Microsoft technet documentation: Permissions for files and folders The only attribute that is not there is the Full control which upon selecting will check all the rest of the attributes which is the detention of full control. Also, in the logs, event ID 4663 the Accesses ...


0

What type of payload are you using, powershell, Python, etc? and what type of connection is being made, reverse shell or bind shell? Often times I run into errors when I use a reverse shell payload from an NAT virtual machine. For what you are describing the powershell payload sounds best: Set payload Windows/meterpreter/bind_tcp If the correct ports are ...


1

If you scroll down the page of the provided msdn link under the See Also heading there's a link to Debugger Security which states: The ability to debug another process gives you extremely broad powers that you would not otherwise have, especially when debugging remotely. A malicious debugger could inflict widespread damage on the machine being debugged. ...


1

Whilst no single layer of security can provide complete protection from attack, adding a layer of containerization/virtualization to a solution adds a barrier which an attacker would have to overcome to attack the host system. In the case of Docker on Windows (so running linux programs on a windows host), it makes use of Hyper-V virtualization so an ...


0

Is there any way he could access my files/folders info? Yes, he could reboot from a live CD and then access your files directly, unless the drive is encrypted. He could also attempt privilege escalation by leveraging any vulnerability within Windows 10 (such as this), or via any insecure configuration on your machine (e.g. overwriting a .exe that he has ...


0

Yes, he can access those files but only if the guest account has permission to do so and some programs require administration rights to execute.


1

The question should be along the lines of Is my computer more vulnerable if I leave wireless on while shutting down/booting. I would say it's "possible," but most likely you are completely fine, if we assume you are up to date with patches and all that good stuff. I've seen AV Programs that have an option if you want to wait to disable the firewall ...


1

In some cases it could be risky to have wireless on even for a second, particularly for those instances when you are connected to a public network.Most guys prefer their laptops to connect to wireless connections automatically which they have ever used, due to which they are in great danger of security breach.Talking about security over wireless networks its ...


3

Your note that it's a "different user's process" is the key here. If the malicious process is limited to that user's context, then attaching a debugger (which usually requires deep permissions) gives the process access to more resources. While a debugger might be used to prevent malicious activity, there is no way for the debugger to know what exactly you ...


0

The most recent stable version of Chrome (Version 51.0.2704.84) now support extended protection and the SSO experience is similar to IE


2

Copying is just reading a file's contents and writing them somewhere else. If a user can read a file, they can copy its contents to somewhere where they have write access. On Windows, there are copy hooks that you could use to log or block the operation, but those only apply to the shell (i.e. Explorer). Using the command prompt would bypass such hooks. If ...


2

Nope, no software exploits, just classic exploitation of dumb users. The payload is distributed in a self-extracting RAR file. A self-extracting RAR file is really just an executable extractor with the .rar file appended to the file. Such a file is an executable file with the .exe extension, and has a feature to run arbitrary code after extraction. The ...


0

I can think of a few things to look out for in your situation. You can potentially get infected on your win 10 machine not just by running a malicious .exe file but also by opening any malicious file. MS Office or PDFs etc have the potential to be just as dangerous. (Of course this does require user action.) If the laptop is infected and remote access ...


0

From your comments: I just want to know how to proof if a system is infected or not. This is what is called a forensic analysis. You must be aware that a well done malware will take specific precautions in order to remain undetectable as much as possible and to hide its inner working. Therefore, it requires very specific competences to do such an ...


2

You do not need to be concerned by this. Windows 8 in particular introduced many new security features and technologies which take direct aim at early boot malware. You can read about these in some depth here: https://technet.microsoft.com/en-us/library/dn283963(v=ws.11).aspx One introduction for example is ELAM - Early Launch Anti-Malware, which gives ...


0

"I was wondering if at any point my computer is vulnerable, even if it's for a second or two" Step away from the questions/reasoning of wireless being turned off, or on. You're running Windows 8.1, what is your system (Windows 8.1), and the software running on your laptop vulnerable to. Are your patches up to date, this includes patches for non-MS software. ...


2

For best security, you can use a screen sharing program that does not give the auditor control over mouse and keyboard. You can talk with them over the phone/VoIP/video chat and have them instruct your staff on what to do. Make sure the staff is properly briefed to know what can be disclosed to the auditor and what requires further authorizations (e.g. data ...


2

If you don't trust Microsoft, don't use Windows. Using Bitlocker doesn't make you more vulnerable to backdoors that Microsoft may have introduced. Cryptographic software is actually not the best place to put a backdoor: it has a fairly narrow job, it would be impossible to reliably hide what it's doing from someone running a debugger, and it would be rather ...


5

Any time you install software from a vendor or project you are placing trust in that vendor or project not to have placed malicious code in there and also to have done a reasonable job of securing it. Some people may suggest that open source is the answer to this, but without repeatable builds and a full source code audit done by someone you trust, there's ...


5

First off, let's be careful about language, when you talk about a public CA like Entrust, or Verisign, or Digicert, yes there is some software involved for actually creating and managing the certificates, but you're really talking about the people. These companies are trusted CAs not because of the software they use, but because their network admins take ...


-1

To answer the last part. Yes they are all compliant with x.509. And they can all be used to set up a certificate authority (as described by previous answer). There are functional differences, more on the management, scalability or specific technical features, side that makes one or the other of them more suitable for your requirements than the other.


4

I think Software Restriction Policies are what you're looking for. It is basically the predecessor to Applocker, and it is still supported for application whitelisting or blacklisting. It isn't as powerful or comprehensive as Applocker, but on Professional versions without Applocker, it can get the job done. See Spiceworks Guide on Deployment and Microsoft ...


3

You could look at the sourcecode of the script behind that website and see that it is completely client-sided and doesn't communicate with a server. But just because the website delivered this script in that form to me does not mean that it will deliver the same script to you. Websites can easily deliver different content to different users. Also, there is ...


1

You need to use a RDP reverse proxy, not just a TCP proxy. There are plenty of software providing that functionality (in different forms), free and paid.


1

Use cmd: NET USE (to see what you're connected to) NET USE * /DELETE (to delete all connections) net use info is not the same info as listed in keymgr or credential mgr.


5

[The question "what could go wrong" is rather broad, so this is not a definitive answer. I am also not a Windows certified security professional, I'm just spitballing.] @CaffeineAddiction points out that when you leave a computer locked, all your user-level processes are still running. Imagine that an attacker is able to plant a backdoor, like running an ...


2

My answer would require writing some code. I'm only posting this answer because you mentioned a programming related solution in your question. Ever since Window Vista, the windows kernel raises an event for basically every single thing that happens on your computer. Microsoft provides a library called TraceEvent for .NET that makes it absolutely trivial to ...


1

You can detect it by monitoring free space (very easy) or file writes (not that easy). The screenshots must be stored somewhere so files will have to stack up to a not-so-obvious location. This is the method I used, and I managed to locate and eliminate a multi-logger just by using a simple file manager.


1

Is Bitlocker trustworthy? No, because it does not provide a source code, therefore you cannot successfully verify if there are default system/admin ways to access it. Auditing it cannot fully cover all aspects, so therefore the audit is only valid form a functionality point of view. There are alternatives that pre-date it and also offer the source code. ...


0

I would definitely recommend using a Sandbox. Taken from Wikipedia : In computer security, a sandbox is a security mechanism for separating running programs. It is often used to execute untested code, or untrusted programs from unverified third parties, suppliers, untrusted users and untrusted websites.1 A sandbox typically provides a tightly controlled ...


1

On Mac OS, you will probably find the relevant logs at /Library/Logs/TeamViewer/Connections_incoming.txt Log *Logfile.log is also in the same directory.


1

The most secure way to store a private key is to generate it on a smart card or in an HSM. Is that an option? The smart card or HSM can still be used to encrypt and decrypt by whoever has access, but it won't give up the key. You can put the public key wherever you want.


0

If your app running as the user can access a chunk of data, any process running as that user can access it too. As you saw in your investigation of option 2, determined programs will be able to find the data if it's stored without additional encryption. If you implement some encryption, as in option 1, somebody could reverse engineer your application to ...


0

I have done in in a big security product. With VAD walking in kernel mode but also with the help of a feature to detect remote thread. First you detect remote thread to get the memory location. The injected thread will mostly have a start address that is not in any modules loaded by the application. This is not suppose to happen, after that you can go ...



Top 50 recent answers are included