Tag Info

New answers tagged

1

As a general rule of thumb, running other services on security-related devices such as firewalls should be kept to a minimum. In other words, a firewall should ideally only be a firewall, and nothing else. The more services you run, the more likely one of them will contain a vulnerability that can allow an attacker to take over the machine. If that machine ...


1

Realistically, the risk reduction options available will most likely not be cost effective. Especially considering those servers may be upgraded within the year. Two options that come to mind are network segmentation and application white listing. Symantec has a nice guide entitled, "Windows Server 2003 Migration: A Guide to Effectively Mitigate Risks". ...


5

IIS is one of many applications that get HTTP requests passed to it from HTTP.sys, so HTTP.sys can be loaded without IIS running or even being installed. Windows implements an HTTP listener as part of the network subsystem via a kernel mode driver (HTTP.sys). HTTP.sys is what's actually listening for HTTP requests and passing it on to the application ...


1

This reddit give us some information based in the reported exploits. As you may see, it is a problem regarding validation in the "Range" HTTP Header. Some users reported getting immediate BSoD after issuing the mentioned requests to their web servers. Correction: So, as it seems, you do NOT have to be running IIS to be affected by this vulnerability. ...


1

Short version: You want Mandatory Access Control Real-world Industry Best Practices use of MAC is rare The use of bastions is the most common widely-accessible alternative Long version: The ability to apply fine-grained controls over not only the users but the processes able to access data is generally only found in Mandatory Access Control systems. ...


1

The best practice is exactly the same as for every privileged account (administrator, root, etc.): don't use it as a standard account. All you need to do is NOT grant access to the DUDE.NAME account to the sensitive data and use HIGHSEC.DUDE.NAME instead. You can effectively couple that with some form of isolation if necessary. For instance, you can ...


4

Firstly as per @EricG most of the administration should be handled using a network administrator account, using group policies and the like. If you need access to a users logged-in session the best way to approach this is to have the user login to their machine and then hand you the keyboard. That way you never learn there password, and the user can observe ...


0

Indeed, Microsoft Technet lists MITM prevention as the sole use of this setting. And a digital signature does just that: to prove the authenticity of a digital message. If your network is trusted and MITM scenarios are really (!) not possible, it can be disabled. Apparently there's also a performance decrease involved when it's enabled. So, if you're ...


0

Depending on where the pentest is being launched, one should be able to determine the DC by querying the SRV records for LDAP, Kerberos, GC, etc. This Microsoft TechNet link has some examples.


2

There are many ways that Nessus, and similar scanners or other utilities, may remotely control or alter systems without RDP enabled. In fact, you'll probably be hard-pressed to find any remote management utility or vulnerability scanner that requires RDP. Remote Desktop is mainly for the human user. Graphical interfaces help us to more easily interpret and ...


1

Nessus appears to use SMB and WMI when doing credentialed scans. Take a look at the following PDF from their site: http://static.tenable.com/documentation/nessus_credential_checks.pdf


1

Software such as PsExec allow remote command execution without software on the remote system: PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec's most powerful uses include launching ...


0

Jumping on the NMAP bandwagon: also look for machines that have TCP port 389 (LDAP), 636 (LDAPS), 3268 (LDAP Global Catalog), or 3269 (LDAPS Global Catalog). The last two are particularly juicy, since only a DC can be a Global Catalog server.


0

From what I read in the comments and in chat I think this is related to timestamping. The driver has been signed at a time the certificate was valid. That signing time was confirmed by a certified timestamp server. In that case, the driver is considered as trustworthy, since everything was fine at the time of signing. To check for a timestamp, open the ...


2

Another things are crypters. Crypters are a software just like obfuscators that take in a malware and encrypts its data so that it becomes undetectable by any anti-malware programs. This crypters uses special encryption algorithm and a method to inject the malware directly into a already running program like explorer.exe without even touching the hard ...


4

There are many ways to do this. The term you are looking for is "rootkit" - that should send you down a rich road of research. As for specifics, the attacker could replace a core Windows program with an infected one so it always gets loaded when Windows starts up normally. Or, the attacker could infect the BIOS. These two methods are impossible for a normal ...


1

I realise this is an old thread, but still... This raises the following questions: How is the SRK derived from the password? How is the SRK stored? If the SRK is somehow compromised, how easily can the password be derived from the SRK? It isn't. The SRK is generated by the TPM using an onboard random number generator. The password is ...


0

This removal guide from Norton has a lot of good information on registry keys and files most commonly targeted. For sure anything in the start-up folder. https://us.norton.com/support/premium_services/malware_removal_guide.pdf See page 18-19, for instance.


0

I don't know if this is possible in your context, but I'd say that you want to use Container-based encryption. That way you create a container file (using VeraCrypt/TrueCrypt/BestCrypt/...) which you mount as a new drive afterwards. The mounted drive can be used transparently for data accesses. If you can't move the folder you want to encrypt, than you can ...


2

Depending on the version of Windows you are running, powershell should give you what you need. Something like this: netstat -ba |Select-String -pattern "EST" -context 1,0 Take a look at this technet article for some select-string info: https://technet.microsoft.com/en-us/library/ff730968.aspx


0

In addition to what @Mark said about formatting your hard drive, you should format the Master Boot Record as well. It's very unlikely that your adware was that insidious, but better safe than sorry. To format MBR in Windows Vista / Windows 7, use bootrec.exe in Windows Recovery Environment: bootrec.exe /FixMbr Here's more info on Bootrec.exe Similar ...


5

If you're trying to eliminate malware, a simple format is sufficient. Zero-wiping the disk or repeated over-writing with fancy patterns is about preventing humans from using advanced data-recovery techniques to read the data. There's nothing magical about a pattern of bits that makes it malware, it's the structure surrounding it: the directory entries ...


1

Okay, I've done some investigation on this one. I still can't find any word from MS about it - presumably they feel it's such an obvious thing to do that it needs no such assertion. Examining the WindowsUpdate.log file suggests that signature checking is taking place, and examining the wuaueng.dll file with a debugger verifies this. Windows update will ...


2

If they keep coming back, it means that you have some software running checks on them. You should take some tool to analyze the running processes on your machine. Use Process Explorer to look at the current running processes (so that you can find out which one is recreating the reported keys and Autoruns to check the list of programs initiated ...


1

My preferred method is SSHFS. Your NAS server runs a SSH server which you then connect to from your remote machine. Leveraging SSHFS it will mount a drive on your remote machine via SSH (secure, encrypted) from the server you specify. I've not used the windows client version so YMMV. ...


2

Short answer: you can't, because they are two different and incompatible key+certificate systems. Longer answer: Windows Certificate Manager uses X.509 certificates, each of which must be signed by a Certification Authority whose root certificate is considered valid by Windows. Thunderbird will use the public key stored in your recipient's certificate to ...


1

It sounds like what you are looking for is a solution where the encrypted text and the private key can be copied and pasted into in application that will perform the decryption. Ideally, you would like a solution that does not require anything to be installed on the users' systems. You might want to check out Travis Tidwell's javascript RSA ...


2

Is it possible for a virus/worm to attack on your host to attack the guest OS? Yes. Is it likely? No. Malware can do anything you can do, including writing to the virtual disk. The easiest route would be to simply mount the virtual machine drive, and write new malware to it. This is unlikely because it would take specially crafted code to exploit this. ...


-1

Short Answer: Yes, both the host (in your case Windows) and the guest (in your case Linux) OS can be attacked by malware. Additional Details: In fact - with techniques like "Red Pill and Blue Pill" (like in the Matrix movie) it is possible for malware to bypass the barrier of virtualization and proliferate on the host or hypervisor. So please follow ...


0

I agree with the above answer. S/MIME is a protocol for secure email. I would like to add that it is well supported in Outlook as well if that is a concern. And even in Outlook Web Access. If you're in an Exchange environment you can set it up for OWA as follows: As an organization administrator for both Exchange 2013 and Exchange Online, you can set up ...


0

If by spoofing your address you mean "I have address A and want to pretend that my request comes from address B" then you must be aware that the reply from the system will go to address B (and be discarded). In other words, while there are some possibilities to spoof an address, this is always a one-way trip: you will not get an answer to your request.


1

Depends on what you mean spoof and what you mean IP. If you want to be a specific IP4 or IP6 it may not be possible. Such as you pretending to come from Google's IP. But if you just want to test various IPs against a security firewall that's different. You can generally find VPN like hidemyass.com to use their IP. Some are anonymous, others not so much. ...


1

How can I spoof source ip address while making a ping request from windows command prompt? If you just want to change your local network address (e.g., change from 192.168.1.69 to 192.168.1.70) then you can set a different static IP address in the Windows "Network and Sharing Center". The exact steps depend on what version of Windows you are using, ...


0

if someone tampered a factory recovery partition to target you, I would doubt if it is wise to buy a second-hand computer to work with. To answer your question, yes the recovery partitions are usually signed. but to check them is somewhat difficult as different resellers might package different version of pre-installed software in the recovery partition, so ...


1

You could send the mails in standard S/MIME format, which would allow recipients to use a plugin for their mail client of choice to read the encrypted parts without too much hassle. I know for a fact that there are Tunderbird plugins, and I'm pretty sure Outlook has native support for S/MIME. You can create these mails with the openssl command line tool: ...



Top 50 recent answers are included