Tag Info

New answers tagged

0

This question has been answered over at SuperUser, and is probably better suited there. To quote the accepted answer: This DLL is part of the Wise Installer as far as I know. Some programs aren't particularly good about removing the temporary files they create; it's really nothing to worry about. Note that the link in the accepted answer is broken. ...


3

There are a few possible scenarios, even after assuming Man in the Middle is not happening. Missing patches: If your system is missing a patch that allows RCE, that is an easy win. There are plenty of remote exploits that exist, and new ones every so often. Mitigation: Patch your system! Are you on a domain? You didn't mention Windows 7 Home or ...


2

When I hear this question, my first response is don't. If you are at all concerned about your personal network and your personal data, don't expose any part of it directly to the internet by hosting services. If you feel you must, here are some steps: Host the website on an entirely separate machine with nothing else on it Put that machine on a DMZ (most ...


1

Security is a process, where new software bugs are discovered from time to time. Sometimes by good people, and sometimes by bad people. Software bugs can be discovered in both user software, like Excel, but also in OS network stack. Windows 7 is based on rather well tested code, in which hundreds of remote vulnerabilities were found and patched during last ...


3

Microsoft is hoping to incorporate SSH: http://blogs.msdn.com/b/powershell/archive/2015/06/03/looking-forward-microsoft-support-for-secure-shell-ssh.aspx However, that has been attempted before and then fell by the wayside. As for your question, there is no standard or overriding reason why a user might enable SSH but disable SFTP, but there can always ...


0

SFTP and other SSH solutions are not standard on Windows mainly because they are not standardized and properly documented in RFCs. Microsoft provides the bare minimum if any facilities to enable SSH. That said I had no issues using it with ported Penix utilities compiled with Cygwin. Just don't expect it to make it's way into official development framework ...


8

Because SFTP runs over the same protocol as SSH, there is no valid technical reason to refuse to enable SFTP. That said, there may be company policies that prevent this. There is a big difference between an SSH connection to issue commands, and an SFTP to transfer files. A company might accept the risk of allowing an approved account to access another ...


2

This is how migrate works in meterpreter: Get the PID the user wants to migrate into. This is the target process. Check the architecture of the target process whether it is 32 bit or 64 bit. It is important for memory alignment. Check if the meterpreter process has the SeDebugPrivilege. This is used to get a handle to the target process. Further details ...


0

To answer your question, it's not necessarily. For example, if there are no clients, Open is less secure. In general, shared is less secure because you can deauthenticate a client, which forces it to associate again. You then capture the shared key authentication handshake. In open mode, this handshake doesn't happen.


0

Shared authentication uses a challenge/response protocol to connect, and this makes it very susceptible to a dictionary attack offline. Using WEP in shared mode, You just need to enter a secret shared key to connect, and this is where the attack can be easily perpetrated. Hope that helps!


1

Shared would send a plaintext query to authenticate clients which would be encrypted and returned. This left the key vulnerable to a known-plaintext attack. Open would allow anyone to authenticate, but wouldn't pass plaintext around, making the key harder to guess. Here and here are links to more details.


0

For the main part, configuration assessments of windows tablets are exactly the same as for standard windows builds and the approaches and resources would be the same (e.g. CIS security benchmarks). The only likely unique point for a tablet review would be the presence/absence of hardware features like TPM chips which can support full disk encryption. ...


1

There is no way to completely stop the hacker, you can only slow him down. No protection is 100% effective (yet).


1

If you have control over the environment in which the application runs — basically, if you have access to the account under which the application runs — then you can observe everything it does. Simply run the application under a debugger and put a breakpoint or a trace on calls to CryptGenRandom. If you don't have control over the execution of the program, ...


2

For the most part, smartcard integrations requiring pointing your email client at your smartcard reader & middleware, ensuring the proper crypto library is selected. There is mucho information on doing this with both OpenPGP smartcards and x509 smartcards Depending on the email client, the Windows trust store can be used, or not used. Your operating ...


0

A firewall only protects against direct scanning from outside. If you set up a web server and manage to get some user inside the firewall to visit your site you can use this to do limited scans from inside with the help of the browser and some Javascript. See https://defuse.ca/in-browser-port-scanning.htm for an example or search for more examples. Note ...


1

A port scanner, like nmap, connects to a port and analyzes the traffic being returned. A firewall's most basic function is to block access to a port. This means that there is no way to scan a port that is being blocked by a firewall. With some exceptions... Some firewalls will allow traffic to a port unless it determines that the traffic is malicious (like ...


0

You can try to use something as the -T2 option to slow down the scan since many firewall drop packets sent too fast. There's a list of option that can help you with IDS\firewall evasion: https://nmap.org/book/man-bypass-firewalls-ids.html


3

I worked at antivirus industry 12 years ago, so I'll try to explain, but it is possible that my knowledge is a bit outdated. Each serious antivirus vendor has antivirus lab, whose work is split to: detect new viruses and develop solutions for them: signatures, behavioral patterns for heuristic detection, specialized detection code, sometimes cleaning code ...


0

The antivirus product have different techniques to check if a given file is malicious or not. The most common technique is to check the file signature against the virus database. If there is a match then the file is considered malicious else not. Antivirus products examine a file and create a signature of it, depending upon the characteristics of the file. ...


1

According to CryptDeriveKey() documentation, upper WORD of dwFlags parameter specifies desired key size in bits. In your case it should generate 40-bit (0x28) keys, effectively discarding all but first five bytes of the MD5 output. To achieve similar behavior with CommonCrypto you can try this: CCCryptorCreate(kCCDecrypt, kCCAlgorithmRC4, 0, ...


0

If your threat model means your code has to run on a computer you can't trust, there is no way to protect your data: it simply isn't possible. No matter what you do, the decryption key MUST be present in the memory of the system performing the decryption in order to access the data. This means that the only possible way to protect the key is to move that ...


1

As it often happens IE does not fare well with certificates of other authorities. Basically your IE does not recognize "The Git Development Community" as a valid issuer of certificates. If you are still unsure, you could do a research on the community, or try to upload the screen shot the same way you did it earlier. Using an already proven and working ...


0

Some of these older Root Certificates have been used to generate 'Time Stamping' or 'Code Signing' certificates. This means a piece of executable code has been digitally signed way back. These Root Certs may still be needed, so your PC can validate that the code signing was valid AT THE TIME OF SIGNING. Which can be of course also way back. Deleting these ...


1

If you have Windows Authentication on IIS you are effectively allowing the following protocols: NTLM Kerberos Negotiate - which automatically chooses one of the above to use. If it is your internet users that are getting the prompt, it is most likely that they will not authenticate with Kerberos unless you have internet facing authentication and ticket ...


1

The answer is "no" it can't be done, at least not with a directory traversal attack by itself. There are several issues here. 1) Directory traversal attacks should be blocked by the Web server to begin with. Of course, since you set up a lab environment, you have control and may have defeated the protection against it. 2) Directory traversal attacks like ...



Top 50 recent answers are included