Tag Info

New answers tagged

1

If it's a computer (or group of computers) managed by Active Directory you can do this with Group Policy. The settings is under Computer Configuration > Policies > Windows Settings > Security Settings > System Services. If it's just on one computer you can just disable the service (Start > Run > Services.mmc) and change the Startup Type to Disabled.


1

As @kjetil-limkjær points out, Powershell version 4 and up includes the Get-FileHash cmdlet. powershell get-filehash -algorithm sha1 <file_to_check> Use doskey to make a persistent alias that's easier to remember. doskey sha256sum=powershell get-filehash -algorithm sha256 "$1" doskey sha1sum=powershell get-filehash -algorithm sha1 "$1" doskey ...


3

I am aware of the following features: Windows Hello - A new authentication system, which will replace passwords with a combination of biometrics and public key crypto. This will eliminate "pass the hash" attacks. Private keys will be stored on the TPM. Biometric authentication to the local device can use fingerprint or facial scanning. The facial scanning ...


1

No, it isn't secure. Signing a application does only provide traceability and unmodifiability - the created application can be traced back to the person who signed it, and the application cannot be modified without invalidating the signature. Anyone who has the Money and possibility to go through the process of getting a code signing certificate will get ...


0

Keeping the system fully patched is as important as setting a good password. The strongest that you have suggested is Using a non-privileged account with a password and having an admin account with a different password. The attacker does not require a password to break in. If an attacker gets into the system because of some service that is not patched, he ...


2

You can not securely use encrypted virtual machines without full disk encryption on the host. While the virtual machine is running, the host stores memory chunks, log data, configurations, and loads of other files on disk, leaving permanent forensic trail of a live decrypted virtual machine. File and project names will almost certainly be recoverable. If ...


2

You have a few options, and it'd probably be best to do at least the first two: Encrypt your host operating system's drive using BitLocker or doxbox. When installing your guest operating system, do the same thing inside the guest. VirtualBox and other VM hosts provide the option to encrypt the virtual drive. All drive contents are encrypted before written ...


1

I am sorry if I am missing something simple in your question. Why not just store the image on an encrypted drive? You could store the image or the entire VirtualBox folder on the encrypted disk so that way you need the key to be able to access it.


1

Without a prior preparation (which I understand is the case described by you) the only viable option that comes to my mind is to check the last opened/recent files in all users programs that you can access. This may include menu entries, pop down lists, or even registry entries. Since you mentioned MS Office documents, this might come in handy: ...


1

Well, AFAIK there are two options that do not require activation, nor specialized tools: Open C:\Users\user name\AppData\Roaming\Microsoft\Windows\Recent Items, and see if the file is listed there. Open regedit.exe, and navigate to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs section. You will see values, structured ...


0

Following this video you can enable auditing for files. This video was for windows. I suppose there is similar solutions for other OS. Edit: I think that if this video are going to be deleted, other are going to replace it. By just google "enable audit for windows" you can get your answer and some pretty detailed videos/posts.


-3

Without a specifically setup environment to track file open events there is simply no way to do this. Most OS'es do not track who opened a file. just who (or to be specific what process) has it open (so no history there). adding a 'tracking cookie' (or another tracking technique like the image of @WhiteWinterWolf) is not reliable due to network ...


1

Any application can easily submit any DNS resolution request. There are numerous libraries available and programmers can choose to perform the resolutions whichever way they want. For example, in Python it's one line of code (maybe two) import dns.resolver answers = dns.resolver.query('dnspython.org', 'MX') To link an actual application to the UDP ...


0

Generally, a virus just sitting there isn't an issue, but it's a problem waiting to happen. I have viruses on a dedicated PC just for analysis and forensics. Here is the paranoid answer: STUXNET was (in part) created by a vulnerability in the icon creation process when generating the icon for a file, where a buffer overflow occurred. I can assume that ...


0

I'll go against previous answer and say no you can't execute a program inside a Zip file without extracting it first. Windows explorer can open zip files and show it's content but it must decompress the program before execution. The zip file itself could in theory contain intentionally malformed data that in combination with a software bug can leads to ...


0

You should set the Security settings of your PC starting with whatever Browser you are using. (In your case, Firefox.) You can also set your AV Software to automatically scan any new item that is loaded/downloaded into your "Downloads" folder. This is usually called "On-Access Scanning."


0

Yes it is a realistic threat. Here is a tutorial on how this is done. The SAM file can be retrieved and cracked. Alternatively, new credentials can be injected in the SAM file. Defences include physically securing the computer, or (you've said it yourself) - encrypt the hard drive so it requires a password on boot.


2

Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. (https://technet.microsoft.com/en-us/library/hh278941.aspx) This is definitely a realistic threat. The question is whether you need to worry about it. If you can't guarantee that someone will not have unfettered access to your PC then you should be ...


0

This guide explains it quite good. One can turn on Bitlocker without TPM but has to modify the registry in order to allow this, as this isn't was Microsoft originally planned as the drive won't be bound to the computer any longer. But for company's convenience this option was added but hidden. Concerning this guide you'll want to use Step 4 to prepare your ...


0

As far as I know, BitLocker supports five configurations: TPM only, TPM+PIN, TPM + Startup Key, TPM + PIN + Startup Key, Startup Key only. ( Startup Key method eeds a USB flash drive containing the startup key.) Also in this link is a question like your question: Windows 7 BitLocker using startup PIN and USB flash drive, but without a TPM...how? Someone ...


0

The use case you are describing is perfect for a White Listing application. In the past I have use Savant Protection and have had good success. Savant allows you to specify what applications are allowed to execute though either a configuration file or by "training" it. Savant will take all of the white listed applications, calculate their hash values and ...


0

First, I would reword your question from "What security implications does having UAC instead of two user accounts where one is not local admin and one is?" to "What is the difference between UAC when one domain user is a local admin and another user is not?" If a domain user logs into a workstation the following will happen: Domain User - UAC will prompt ...


0

Based on your comments: You have a domain "normal, unprivileged user" account You have a local administrator account (not even a user at the domain) UAC is enabled and unchanged With one account, local administrators would have domain access credentials on a path that is easy, short, and potentially harder to separate from domain traffic. Your ...


1

You can use a Simple Batch File. Open Notepad and copy/paste the script below into a blank document. Save the file as BLOCKALL.BAT. Now copy that file to the same directory as the EXEs you want to block and double click it. It will add outbound rules to advanced Windows Firewall settings blocking all EXEs in that folder and sub-folders as well. I tested ...


13

This is normal and expected behavior for windows system. The IP you mentioned resolves to sinwns2012412.wns.windows.com. The Windows Push Notification Services (WNS) enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and ...


1

Firstly I would like to explain differences between Viruses, Trojans and Malware. Malware - is the short form of Malicious Software. It is basically a software written to cause damage or infiltrate computer systems without the owner informed consent. It is general term used to represent various forms of intrusive, hostile and annoying code. Virus - is a ...


1

You shouldn't use the recovery partition even if it's signed. I would personally be more worried about the manufacturer than the person who's selling it to me (and if the seller is really malicious, he would've embedded some evil hardware keyloggers rather than relying on a partition I may never ever use). To strictly answer your question, I believe the ...


0

You would use the token to authenticate the user to the machine. RMS uses a client certificate granted by the windows authenticated user to access the RMS protected document.



Top 50 recent answers are included