Tag Info

New answers tagged

2

If they keep coming back, it means that you have some software running checks on them. You should take some tool to analyze the running processes on your machine. Use Process Explorer to look at the current running processes (so that you can find out which one is recreating the reported keys and Autoruns to check the list of programs initiated ...


1

My preferred method is SSHFS. Your NAS server runs a SSH server which you then connect to from your remote machine. Leveraging SSHFS it will mount a drive on your remote machine via SSH (secure, encrypted) from the server you specify. I've not used the windows client version so YMMV. ...


2

Short answer: you can't, because they are two different and incompatible key+certificate systems. Longer answer: Windows Certificate Manager uses X.509 certificates, each of which must be signed by a Certification Authority whose root certificate is considered valid by Windows. Thunderbird will use the public key stored in your recipient's certificate to ...


1

It sounds like what you are looking for is a solution where the encrypted text and the private key can be copied and pasted into in application that will perform the decryption. Ideally, you would like a solution that does not require anything to be installed on the users' systems. You might want to check out Travis Tidwell's javascript RSA ...


2

Is it possible for a virus/worm to attack on your host to attack the guest OS? Yes. Is it likely? No. Malware can do anything you can do, including writing to the virtual disk. The easiest route would be to simply mount the virtual machine drive, and write new malware to it. This is unlikely because it would take specially crafted code to exploit this. ...


-1

Short Answer: Yes, both the host (in your case Windows) and the guest (in your case Linux) OS can be attacked by malware. Additional Details: In fact - with techniques like "Red Pill and Blue Pill" (like in the Matrix movie) it is possible for malware to bypass the barrier of virtualization and proliferate on the host or hypervisor. So please follow ...


0

I agree with the above answer. S/MIME is a protocol for secure email. I would like to add that it is well supported in Outlook as well if that is a concern. And even in Outlook Web Access. If you're in an Exchange environment you can set it up for OWA as follows: As an organization administrator for both Exchange 2013 and Exchange Online, you can set up ...


0

If by spoofing your address you mean "I have address A and want to pretend that my request comes from address B" then you must be aware that the reply from the system will go to address B (and be discarded). In other words, while there are some possibilities to spoof an address, this is always a one-way trip: you will not get an answer to your request.


1

Depends on what you mean spoof and what you mean IP. If you want to be a specific IP4 or IP6 it may not be possible. Such as you pretending to come from Google's IP. But if you just want to test various IPs against a security firewall that's different. You can generally find VPN like hidemyass.com to use their IP. Some are anonymous, others not so much. ...


1

How can I spoof source ip address while making a ping request from windows command prompt? If you just want to change your local network address (e.g., change from 192.168.1.69 to 192.168.1.70) then you can set a different static IP address in the Windows "Network and Sharing Center". The exact steps depend on what version of Windows you are using, ...


0

if someone tampered a factory recovery partition to target you, I would doubt if it is wise to buy a second-hand computer to work with. To answer your question, yes the recovery partitions are usually signed. but to check them is somewhat difficult as different resellers might package different version of pre-installed software in the recovery partition, so ...


1

You could send the mails in standard S/MIME format, which would allow recipients to use a plugin for their mail client of choice to read the encrypted parts without too much hassle. I know for a fact that there are Tunderbird plugins, and I'm pretty sure Outlook has native support for S/MIME. You can create these mails with the openssl command line tool: ...


0

You first want to set up a host OS (Windows or Kali, whichever you prefer to use when you're not hacking.) Inside that host OS, install a virtual machine platform (VMware, VirtualBox, whatever you choose.) Inside the virtual machine control panel, create a first VM and install Kali, (presuming you want to use Kali for your pentest environment.) I would ...


0

Running a kali VM provides some benefits: Restoration - It is easy to restore your machine when you mess it up. If you're playing around with security tools and/or malware, changes are good that, at some point, you will damage your operating system. Without a VM, you would have to reinstall everything from scratch; with a VM, you can save an image and ...


2

You can not generate your own EV certificates and especially you can not generate self-signed EV certificates. Only some CA's are able to generate these and these CA's are specifically marked in the SSL stacks of the browser or operating systems. If you want to create EV by yourself you would have to change the SSL stack used by the browser to accept the ...


0

The Metasploit Framework, arguably the most-important penetration testing tool the world over, has a few post-exploitation modules that support user-activity monitoring. The primary one related to keylogging is the keylog_recorder.rb post module, documented on the excellent and highly-regarded Metasploit Unleashed site from Offensive Security (the ...


0

This very much depends on where the application is running, as code running in different environments will have different levels of access to system information. Browser Analytics have access to a relatively standard set of the information provided by the browser. The easiest/best way to block these is to use browser privacy plugins like ghostery which ...


0

A reasonable approach here might be to see what existing HIDS products do in this regard. If we take OSSEC as an example, per the book on their site has a long list of both files and registry keys that are monitored for changes (P84 in the linked PDF) In general windows system files are mostly in c:\windows, so a lot of files to be monitored will be in ...


1

This is mainly an addition to armani's answer. As Win98 has not been maintained for years, you cannot expect the OS TCP/IP stack to be exempt of bugs. But you certainly can find a recent (decent) OS accepting to run on an old computer. NanoBSD for example declares that it can be customized to low requirements : it is possible to cut the system down, so it ...


1

In addition to Polynomial's answer it's worth noting that the network interfaces will still be up and active and any access through that route (shares, remote management services etc.) may permit access to stored data regardless of screen locking. Either remote network sessions, or someone plugging in a device to your network ports could provide a surprising ...


2

This is simply a bad idea unless you just want to try it for fun. Anyone who suggests it could be done is making too many assumptions. There isn't enough information to make a call. Probably the main issues include Win98 is old, is no longer patched and is likely vulnerable to many existing penetration techniques which were not even thought of back ...


3

No, it's not secure. You're vulnerable to: Cold boot attacks (freeze memory and extract the contents, get BitLocker encryption keys and all your other sensitive data) DMA attacks via FireWire, CardBus, ExpressCard, Thunderbolt, etc. Installation of a physical keylogger (many laptop keyboards can be easily removed) or backdoor hardware. In general, if an ...


2

Get rid of that old box! It's too much hassle. Buy a Raspberry Pi B+. It's fast for your needs, cheap to buy, and within five to ten months it will earn the investment back by saving electricity. That old box maybe uses up to $10 a month for electricity, the RPi maybe $1.


1

Considering that a modern computer (or even a smartphone) can compute circles around a 15 year old laptop one would need to ask "why?", esp. as the old hardware is expected to fail more-or-less anytime. If this is a "because I can" project, then have at it and good luck. If you simply want your own webserver, it is very easy to set one up on your current ...


13

Do you have experience with CLI (command line interface), like Windows command prompt? If so, why not get a Raspberry Pi? The Pi is going to be smaller, faster, and more efficient than your old laptop. You can get a Pi for ~$50. Then you download (or get pre-installed SD card with ) their NOOBS software and install Raspbian OS, which is a Debian fork, ...


8

I also am questioning how this machine can run Win98 (which wasn't exactly an efficient OS in its day), but it cannot run Linux. How about taking a Linux Live CD (bootable "frozen" OS), editing the ISO to include the web pages you want to serve, removing local storage (pull out the hard drive), then boot off of the Linux Live CD and reboot daily? Even if ...


1

How about KolibriOS and write your own web-server? Or Tinfoil Hat Linux and maintain it? (shouldn't take too long, just upgrade everything to the latest versions and hack around with dependencies until you get it to compile) Most importantly before I can provide other suggestions, what are you hardware specifications; and personal skill level?


2

In the end, it's not the OS that's the issue, but the application and the service running it. If your firewall is locked down tight, if the computer is physically secured, and the ONLY thing you are doing to serving a static page, then it comes down to the web server and what "else" the static page could do. It CAN be done, but the web server you choose to ...


32

Probably not. In order to respond to HTTP requests, the operating system must be able to run a TCP/IP stack, process packets, and complete a TCP handshake, all requiring the system to utilize or spawn threads in memory, call libraries, etc. Therefore, the system would still be susceptible to protocol attacks it may not be patched for (TCP sequence ...


1

"I can't find any documentation on how key derivation works. There are some mentions of PBKDF2, but that's about it. " DiskCryptor is very visibly derivated from Truecrypt and shares some of its old style constants. It uses SHA-512 with 1000 iterations as key derivation algorithm according to ...


2

It is perfectly possible to have the same public key in several distinct certificates. Mathematically, the public and private key are linked (in RSA parlance, they use the same modulus) and there is nothing that you can do for or against it. It just is. Technically, a given machine may store certificates and private keys in some dedicated structures, and a ...


2

For Windows operating systems, Microsoft has multiple KB Articles and other references to address SSL/TLS configuration. Microsoft KB Article 245030, How to restrict the use of certain cryptographic algorithms and protocols in Schannel.dll has practically everything you'll need to know. Currently, the KB Article covers operating systems ranging from NT 4 up ...


1

windows is a close source OS so, your work is hard. you need learn basically about windows Architecture and you need learn Assembly with c/c++ language for attack. specially Assembly. also about this sentence : i used book about nmap, Metasploit, exploit writing etc..., but they contained too much information about too many OS's this tools ...


0

Look for NetBIOS over TCP broadcasts, NBT https://technet.microsoft.com/en-us/library/cc940063.aspx Look for Group Names with 1C , as this indicates the Domain Controllers. I would expect this name to be broadcasted on the same subnet, and be queried on a per machine basis by using NBTSTAT -A IP.


2

This is possible to an extent, on Windows, using the Windows Data Protection API; more specifically the CryptProtectData function. This function allows you to encrypt data against a user profile or machine, so that only that entity may recover the data. Your setup would look something like this: A dedicated service user is configured for the application. ...


5

In simple terms: Your browser starts to connect to an HTTPS website, asking to use a strong cipher. The attacker intercepts this request and replaces it with one asking to use weak "export-grade" encryption. The server gets this modified request and responds to your browser with an export-grade encryption key. Your browser doesn't notice the key it got is ...


1

A 'mail scanner' is not necessary with most modern webmail providers. Most modern webmail providers will scan your email and remove any malware. In addition if the user has a standard Antivirus installed it should catch anything else (download links, etc) when the file is downloaded and created. You can test this by sending your user a EICAR test file: ...


1

I ran out of space on my previous answer, but think this is valid and useful information: Revocation The next few sections discuss CRL and certificates, but before you get too far I want to draw your attention to an issue that may affect production and PKI operations: If you think your PKI will revoke twice the same certificate with Microsoft's PKI ...



Top 50 recent answers are included