Tag Info

New answers tagged

0

If the USB sticks are second-hand, it is possible that you obtained a wiped one that used to have encryption software. They would frequently have two partitions, an unencrypted one to handle the authentication, and once you were authenticated, the software would mount the encrypted partition for use. USB Devices are also serial-bus, so you can have multiple ...


0

If you want a "safe" solution, one where Windows does not offer to format the disk when you try to mount it, you need to use a format that is recognized by Windows. You could install Ext4 drivers on Windows, but this will only work for those machines with these drivers installed. You could use FAT32 or NTFS for the disk, and use Encfs or Truecrypt or ...


1

I don't think you understood what Windows did when it formatted the disk. When you plugged in the external drive, Windows couldn't read the filesystem (because it's encrypted) it therefore assumed the drive had no filesystem and offered to format the drive. You selected yes. Windows then deleted everything on the drive and overwrote it with a clean NTFS ...


1

Another option is to look at truecrypt's successors, like Veracrypt (https://veracrypt.codeplex.com/). They use Truecrypt as a base but claim to add some additional security improvements. Of course since they're new it still remains to be seen whether these projects will be able to support themselves in the long term and whether they'll remain secure, so ...


1

You can use dm-crypt drives, which have windows support as documented here: http://superuser.com/questions/584883/how-can-i-access-volumes-encrypted-with-luks-dm-crypt-from-windows


0

I'll say yes, if Cryptoware 2.0 use a server listed in the list you use. https://easylist.adblockplus.org But it's not the primary job of AdBlock. If you want something to block adware, malware and spyware you should look something like disconnect.me or ghostery. You could also secure your lan by using Secure DNS like using those dns Comodo DNS DNS #1 : ...


0

Roles are a convenient, easy-to-remember way of doing Mandatory Access Control. Unless you can edit or volunteer your way into a role, RBAC don't behave like DAC. Use MAC/RBAC to allow things someone should or should not be able to do. Use DAC for giving the power to assign "need to know" or "need to do" to everyone who has the permission. A good ...


1

It can't hurt. ABP (and similar software) blocks known ad providers and patterns that look like ad providers. If one of them gets popped and starts serving up malware, ABP will save you. If the site you're on is the compromised one, ABP can't help (unless the compromise is to point at a compromised ad network that's already blocked... seems complicated). ...


2

You are technically wrong when you say "signed the virus". the CA NEVER signs any code. What CA can do, is issue a code-signing certificate. Then the MAKER of the virus do sign the code. This means the CA never see the code and you can't really blame the CA for issuing a code-signing certificate. The Point of a code-signing certificate, is to bind the code ...


0

It was signed by a certificate of the famous and trusted Comodo company. One of the interesting aspects is that the variant of the malware discovered by security researchers is apparently signed a few hours before the campaign was launched, with a valid digital certificate from Comodo, which makes it more difficult to detect on the affected ...


2

Hacking is a serious crime, and gets you in even a more of a problem. It seems you have some details, try to gather logs, screenshots etc. and get to the nearest police station and report the crime. Commiting a crime in awnser to a crime is NOT a solution.


1

If someone legitimately has superuser access to a system, you can't stop them from accessing any data on the system given time. You can certainly have data encryption to encrypt the data at rest, but what's to stop them from capturing the keystrokes that are performed when you unlock it? Or, if you're copying the data to the system from somewhere, getting a ...


2

If you don't log with a password, but instead with a fingerprint, then DPAPI plays an elaborate charade of encrypting keys with other keys, but the tower of encryptions must still end at some point. So what really happens in that case is that someone who steals your laptop will be able to extract all your secrets -- albeit with a substantial amount of ...


1

I will assume that since it is a laptop, it will exposed to external threats as you will take it with you, but you are interested in security and hardening of the system to prevent unauthorized access. VMs are a great way to sandbox your activities without putting your entire machine at risk. You can take a snapshot of the VM's configuration at anytime you ...


1

KASLR has gotten under heavy critic on the day it was released for Linux, and it has also been defeated on that very day. Spender at grSecurity has written a post about it (along with LWN comments) which I'll only summarize in a simplistic way. I highly encourage reading the original source. Address Space Layout Randomisation was originally applied to ...


1

KASLR is simply ASLR... applied to kernel space. Without KASLR the address space of the kernel is static. Any exploits using a kernel vulnerability will find it trivial to overwrite and control return addresses and the like, just like any exploit against a userspace vulnerability will find those tasks trivial without ASLR enabled. LWN has a nice article ...


3

Currently windows uses NTLMv2 to store the password, but for backward compatibility some system uses LM hashes. Now it is recommended by the Microsoft to not to use LM method to store the password because of its weakness towards brute force attacks. If you want to see currently which method is used then you have to navigate to ...


1

Well, it might help. Better yet, make your computer not to obey autorun.inf on removable drives (but assuming you plug your usb into another -infected- system, it can help noticing it). There is a solution taking the next step, USB Vaccine, which creates a unwriteable, undeletable file with that name in your usb drive. It does so by marking it with some ...


5

If you want to stay safe you can just ensure your Linux home and root partition are encrypted and use UEFI to ensure your Linux kernel isn't modified. Then it will be impossible for your Windows box to touch the rest of the OS. A less elegant (and insufficient from a legal standpoint if you need to guarantee the data is well protected) but maybe easier ...


3

TL;TR This privilege can be used to create and run processes under another user (including SYSTEM) given proper access tokens for that user. SeTcbPrivilege Windows Services are programs that run in the background to perform necessary operations for the operating system to function. When you say, "when an account other than Local System is used to run ...


3

General strategies - Red Teaming Analysis Abuse identity and authentication -> Target: People and credentials -> RDP, SSH, more consoles, portals Exploit privilege and trust -> Target: Infrastructure -> NT Domain administrator, Unix root accounts Attack data structures and data handling -> Target: Services, Apps -> Client executables, Client-to-server ...


2

The article you linked to clearly stated that it was vulnerable. However, it's pretty hard to leverage "shell shock" in "BASH" on Windows for git. You're still restricted to the users permissions, and their git code repository on their file system. Additionally, there are far fewer attack vectors that exploit shell shock on Windows than on their *nix ...


1

Pretty sure it is. Check with Is there a short command to test if my server is secure against the shellshock bash bug? Although on windows it is more difficult that an attacker is able to set an environment variable to a malicious value and that bash later gets executed with it.


22

I'm a developer on GitHub for Windows - we're closely monitoring the msysgit mailing list for progress on this, but we believe at the moment that there isn't any way to exploit this in GitHub's shell, because there is no escalation of privilege (i.e. you can only hack yourself). We're definitely actively looking for scenarios where that is not the case, and ...



Top 50 recent answers are included