New answers tagged

-1

That setting prevents the built in registry editor from running. A user will still be able to use a 3rd party editor that does not respect the policy setting. Additionally, malware will still be able to modify the registry if it has that capability. This setting is useful for attacks where the built in editor is called with malicious arguments, or when a ...


4

A quick search turned up the link below. They created a new technology called CredentialGuard, which isolates secrets in virtualized secure environments rather than storing everything in LSA like they used to. Mimikatz can no longer just dump lsass.exe process memory and parse the contents. They're still in some memory, strictly speaking, but not memory ...


0

This is partly true. First of all, if you wish to go this way you need to understand that it's not enough to deny all incoming connections at certain times, you should deny them always. This is so because any time you are connected to the Internet (even if only for few seconds or minutes), you are potentially exposed to malware of all kinds. In fact, if you ...


6

No, that's simply wrong. Just like with a jail. They're not only built in a manner to keep anyone from escaping, but as well to prevent anyone from breaking in. You always have to think through both ways. Just an example: windows had a vulnerability that allowed arbitrary code-execution injected in JPGs (I think the format was JPG, but I'm not sure. ...


0

First of all you have to keep in mind that Windows XP's built-in firewall doesn't have the capability to apply the rules you described. Plus, even if it did, packets would still get dropped by the same machine that's handling the actual FTP connections, so it would still be recommendable to put a separate firewall (or Linux box) in front of it, just for ...


1

The SIM Card is not able to fulfill the requests sent to it when trying to place a certificate on it. The required commands are not available. Most (nearly all) SIM-Cards are not able to be extended in functionality either.


0

As Matthew said, it is not possible. But You can use MFT reader, a 3rd party tool used for forensics purposes, for your requirement.


0

First of all, I would strongly recommend to block FTP and only allow FTPS/FTPES (FTP over implicit/explicit SSL/TLS). SFTP would be even better, more firewall friendly, inherent forward secrecy... but FileZilla Server does not support SFTP. This said, I would recommend using a server software that allows you to do two essential things: Prevent file ...


5

Is this a known feature? Yes. How IE can know my file browsing history? As mentioned in the answer by RoraZ, Internet Explorer is (or at least, was originally designed as) largely an extension of the system file browser (explorer.exe), and they share many components and operations. Specifically, what you're seeing is that Internet ...


25

Internet Explorer is tied directly to the Windows operating system. It is essentially an extension of normal File window. Many of the operations performed by Internet Explorer call directly into Windows services. For example, the SSL/TLS implementation for Internet Explorer is performed in the LSASS (Local Security Authority Subsystem Service). So any ...


2

"Obviously a person can copy over a virus and run it, but you would see this happening so I don't count this as a method." Actually this is the method used most often with a malicious intent. There is a scam, where you get a call from a "Microsoft"-technician. He tells you, that your computer is behaving strangely. In order to show the user, that he ...


0

It depends which malware - if you've got a good idea of the behaviour of the particular strain of malware that you're testing, then internet access shouldn't be a problem. Of course you have to have confidence that running it won't attack any internet hosts, for example, from other reputable reports on the malware analysis. There will always be VM breakouts ...


1

From Gray Hat Hacking The Ethical Hacker's Handbook, 4th Edition: Enumerating Named Pipes Named pipes are similar to shared sections in that developers used to think, incorrectly, that named pipes accept only trusted, well-formed data from users or programs running at the same privilege level as the program that has created the named pipe. ...


2

Your 1) Can I test malware in VirtualBox with access to the Internet within the VM without harming my host computer or any of the other computers on my network? You wouldn't want to. Suppose the malware you are analyzing is deisgned to immediately target say a bank or government machine. You could set yourself up for huge liabilities. On the one side of the ...


1

The problem you will actually have, when using a VM, is that most malware will refuse to open its payload so you won't get a lot of research done. Researchers using VMs to dissect malware are all too common, and most malware nowadays actively prevents it by looking for clues that it's running in a VM, and staying dormant if it finds them. Keep that in mind ...


3

1/3/4/7-Access to the Internet? Not a good idea as depending on what it does, your VM could release it "into the wild". Running it in a VM should be perfectly fine if it is not connected to the internet. This answer from The Bear will go into a lot more detail regarding the malware escaping a VM. Here 2-Formatting should be fine for 99% of malware. Some can ...


0

Some good answers here. But what might make this all simpler is to just say that the encryption is linked to the current account that you are logged into when you encrypted. Try creating a new account on that machine. (even an admin account) Log into the new account and now look at the file (in place, without moving it off the system). You can't read it now ...


0

I used this ftp vulnerability (@halfinformed gave it to me in the comments). So here is the steps to install and exploit with a simple reverse shell : Install the vulnerable service from the link given above. Generate a new payload that fits your need (depending on your IP address) with this command msfvenom -a x86 --platform windows -p ...


1

Even with an additional Security Layer like Virtualization/Containerization, you are running this code at your system. If there is faulty code in this implementation, Docker in this case, the application will break out of the container and execute code at your host os. Docker CVEs from the past: https://www.docker.com/docker-cve-database


4

None of the symptoms you posted is a sign of having malware on your computer. My internet connection slows to a crawl often Complain to your internet service provider or find a better one. my games keep crashing Viruses don't tend to do that. When you have problems running games, it's far more likely to be a problem with your graphic driver... or ...


0

There is no sure way to tell. You can find a virus on your computer, and then I guess you'll know that there is a virus. But it is not possible to be sure that there is a virus responsible for all of the suspicious activity on your computer. It is equally possible that someone is hacking into your computer and screwing around with it. But in terms of ...


1

This here will be human readable. And (thanks to the semicolon as the delimiter) it will also open nicely in Excel: dir cert: -Recurse | where {$_.subject -ne $null} | where {$_.subject -eq $_.issuer} | Export-Csv -NoTypeInformation -Encoding UTF8 -delimiter ';' -path selfsignedcerts.csv


2

I know that many giant companies has spent billions of dollars on how to prevent the privacy of their products but still they cant prevent it... So I am not expecting that I can get 100% solution on this, but still I want to protect it as much as I can. You've already got your answer, you just don't realize it. "As much as you can" is "not at all." ...


0

Windows Embedded with the UI disabled would be a first step. Then you could: Disable the network Epoxy all open ports Remove the floppy drive (do these still exist) As all have said already, 100% is impossible, but if you look at each possible entry point and close it you can get close. Instead of the epoxy method you can setup a USB whitelist to ...


2

The biggest clue came in a comment: I am getting same thing. Did you use innoSetup? And I did. The conversation here points to a problem involving Inno Setup seemingly generating what appears to be a matching signature for a trojan:Win32/Fathale.B!plock. Submit the installer to the Microsoft Malware Protection Center. If your installer is indeed ...


7

As mentioned, its impossible to prevent capture of the displayed video - even in the worst case, the user can record the video on a smartphone or using a fixed camera (as some pirate movies do when they are recorded at the cinema) What you can do then is to shift the protection from stopping copying, to prosecuting copiers. You can embed watermarks in the ...


13

Do not roll your own DRM scheme. The industry have tried and failed so many times that a homebrew solution will stand little chance. It would be better to "stand on the shoulders of giants" and use existing DRM solutions. Windows Media Rights Management and PlayReady are good solutions. The latter supports HDCP and are used by mainstream premium content ...


4

This is a problem of trying to protect what you want to provide. It's impossible to do, but you can make it difficult. Probably the best approach would be to encrypt the files. But at the end, you give all the data for a person to run on a computer they have full access to. Since it will play the video at some times, it means the keys will be available in ...


15

As you state in the question, doing this in a foolproof way is technically impossible. For the video to be displayed on the screen it must somehow reside somewhere in the RAM on the computer, be transfered to the monitor and then displayed there. From all these points the video could be extracted. Possible ways include: Copied from RAM. Recorded with ...


0

(IME) Java requires firewall exceptions for both TCP and UDP (and one firewall rule can't do both) so that's always two. In addition you can easily have/use more than one java programfile if you: use both java.exe for console mode and javaw.exe for GUI mode use both 32-bit and 64-bit java on 64-bit Windows use more than one major version (java 7 and java ...


2

As a client device, simply turn off the "Automatically detect proxy settings" feature in Internet Options. This prevents the browser from trying to look up a location for the wpad.dat or proxy PAC script. If you want to protect poorly configured devices on your network, set a DNS entry for WPAD and blackhole the traffic.


1

The green folders are encrypted, the locked folders are locked to the user only(possibly password protected, but not encrypted). A quick google search for folder with lock icons windows 10 shows that they can only be accessed by you, and not anyone else. Green on the other hand means actually encrypted. A simple test: Send the peglocked folder to someone ...


4

First off, you should go type "how bitlocker works" into google and read a few articles. You will probably learn the answer to your question (and a bunch more interesting things besides!). If you want a quick answer, I found an article by Microsoft that says: During the startup process, the TPM releases the key that unlocks the encrypted partition only ...



Top 50 recent answers are included