Tag Info

New answers tagged

0

The most secure generally available storage option that you're going to have on Windows is is the Windows Data Protection API (widely known by the acronym DPAPI.) This is one of the options for managing the encrypted web.config file sections that you mentioned as an example. DPAPI gives you user and machine specific encrypted storage for sensitive ...


0

There's a couple of options depending on your version of Windows. UAC will prevent you from controlling the firewall with netsh if you're not using an elevated session. netsh firewall is deprecated in recent versions of Windows and you should be using netsh advfirewall firewall instead.


2

I did some further investigation and realized that this constraint is taken into account at the time of resolving the certificate chain of trust, not at the time of creating a new link. From RFC 5280: The pathLenConstraint field [...]. In this case, it gives the maximum number of non-self-issued intermediate certificates that may follow this ...


2

You are wrong. It still shows up in the event logs and the computer knows if it is an RDP session. You can see that there is an active RDP connection if you have the right tools up as well. What you are talking about isn't an "invisible user", it's a service user, and it is an intentionally designed feature of Windows, not a security hole. You just ...


2

I don't think so. There are sources that indicate that in addition to collecting the SSID, Google is also collecting the BSSID. The idea was to take the SSIDs and BSSIDs from the collected packets of data, and to store them in a database together with the information about the location where the SSIDs and BSSIDs were seen. Source and Google and ...


0

If you want to capture traffic by using a second machine, then run a packet sniffer (Wireshark, for example) on that second machine while it is connected via a hub (or spanned/mirrored port) with the Win10 machine. It will capture all packets it sees being sent by the Win10 machine. You could do a packet forwarding scenario on the second machine, but that ...


1

One thing you can do to view traffic is connect it to a router that supports packet forwarding and run wire shark or security onion on a sperate computer. I know using firewall rules on the router (installing dd-wrt will allow it) will accomplish this.


0

Paranoia aside, I would suggest looking into cheap network taps. You can plug the system's interface into it and then plug the monitoring port into another system's spare interface. This other system should be running tcpdump or wireshark on the spare interface.


0

It does indeed look like something associated with conduit. Tips: To remove Google Webhp conduit hijacker, you need to also remove its bundle PUPs and repair all browser settings changed, otherwise the Google webhp may come back even if you repair it in your web browser. If you also notice below PUP/Toolbars which are all associated with Conduit search ...


-1

So far, I am aware of the following, but am not familiar with how good they are: Splunk Plaso log2timeline (deprecated, better to use Plaso) http://security.stackexchange.com/a/3491/47692 points out the following tools: arcsight loglogic alienvult/ossim logrhythm I look forward to further input.


0

I perused the Microsoft TechNet article here: http://technet.microsoft.com/en-us/library/deploy_ipsec(v=ws.10).aspx (googled "windows firewall certificate authentication") and a little bit lower it says that it doesn't cover: Guidance for setting up certification authorities (CAs) to create certificates for certificate-based authentication. For this ...


2

Yes, it is ok to have CBC ciphersuites in the list as long as SSLv3.0 is disabled. The issue is not the CBC mode itself, but the SSLv3.0 specification for the padding format. The padding format in TLSv1.0 is more restrictive, so the malleability required to mount the POODLE attack no longer exists.


1

It isnt normal that your are experiencing DDOS attacks. Try using Wireshark or another network sniffing tool to look for Botnet traffic. IF you boot Wireshark and use the filter dns.flags.rcode == 3 If Wireshark is returning a lot of failures a good bet would be to set up a IDS such as Snort and create a rule to block the specific traffic. However ...


0

If the USB sticks are second-hand, it is possible that you obtained a wiped one that used to have encryption software. They would frequently have two partitions, an unencrypted one to handle the authentication, and once you were authenticated, the software would mount the encrypted partition for use. USB Devices are also serial-bus, so you can have multiple ...


0

If you want a "safe" solution, one where Windows does not offer to format the disk when you try to mount it, you need to use a format that is recognized by Windows. You could install Ext4 drivers on Windows, but this will only work for those machines with these drivers installed. You could use FAT32 or NTFS for the disk, and use Encfs or Truecrypt or ...


1

I don't think you understood what Windows did when it formatted the disk. When you plugged in the external drive, Windows couldn't read the filesystem (because it's encrypted) it therefore assumed the drive had no filesystem and offered to format the drive. You selected yes. Windows then deleted everything on the drive and overwrote it with a clean NTFS ...


1

Another option is to look at truecrypt's successors, like Veracrypt (https://veracrypt.codeplex.com/). They use Truecrypt as a base but claim to add some additional security improvements. Of course since they're new it still remains to be seen whether these projects will be able to support themselves in the long term and whether they'll remain secure, so ...


1

You can use dm-crypt drives, which have windows support as documented here: http://superuser.com/questions/584883/how-can-i-access-volumes-encrypted-with-luks-dm-crypt-from-windows


0

I'll say yes, if Cryptoware 2.0 use a server listed in the list you use. https://easylist.adblockplus.org But it's not the primary job of AdBlock. If you want something to block adware, malware and spyware you should look something like disconnect.me or ghostery. You could also secure your lan by using Secure DNS like using those dns Comodo DNS DNS #1 : ...


1

It can't hurt. ABP (and similar software) blocks known ad providers and patterns that look like ad providers. If one of them gets popped and starts serving up malware, ABP will save you. If the site you're on is the compromised one, ABP can't help (unless the compromise is to point at a compromised ad network that's already blocked... seems complicated). ...


2

You are technically wrong when you say "signed the virus". the CA NEVER signs any code. What CA can do, is issue a code-signing certificate. Then the MAKER of the virus do sign the code. This means the CA never see the code and you can't really blame the CA for issuing a code-signing certificate. The Point of a code-signing certificate, is to bind the code ...


0

It was signed by a certificate of the famous and trusted Comodo company. One of the interesting aspects is that the variant of the malware discovered by security researchers is apparently signed a few hours before the campaign was launched, with a valid digital certificate from Comodo, which makes it more difficult to detect on the affected ...


2

Hacking is a serious crime, and gets you in even a more of a problem. It seems you have some details, try to gather logs, screenshots etc. and get to the nearest police station and report the crime. Commiting a crime in awnser to a crime is NOT a solution.


1

If someone legitimately has superuser access to a system, you can't stop them from accessing any data on the system given time. You can certainly have data encryption to encrypt the data at rest, but what's to stop them from capturing the keystrokes that are performed when you unlock it? Or, if you're copying the data to the system from somewhere, getting a ...


2

If you don't log with a password, but instead with a fingerprint, then DPAPI plays an elaborate charade of encrypting keys with other keys, but the tower of encryptions must still end at some point. So what really happens in that case is that someone who steals your laptop will be able to extract all your secrets -- albeit with a substantial amount of ...


1

I will assume that since it is a laptop, it will exposed to external threats as you will take it with you, but you are interested in security and hardening of the system to prevent unauthorized access. VMs are a great way to sandbox your activities without putting your entire machine at risk. You can take a snapshot of the VM's configuration at anytime you ...


1

KASLR has gotten under heavy critic on the day it was released for Linux, and it has also been defeated on that very day. Spender at grSecurity has written a post about it (along with LWN comments) which I'll only summarize in a simplistic way. I highly encourage reading the original source. Address Space Layout Randomisation was originally applied to ...


1

KASLR is simply ASLR... applied to kernel space. Without KASLR the address space of the kernel is static. Any exploits using a kernel vulnerability will find it trivial to overwrite and control return addresses and the like, just like any exploit against a userspace vulnerability will find those tasks trivial without ASLR enabled. LWN has a nice article ...


3

Currently windows uses NTLMv2 to store the password, but for backward compatibility some system uses LM hashes. Now it is recommended by the Microsoft to not to use LM method to store the password because of its weakness towards brute force attacks. If you want to see currently which method is used then you have to navigate to ...


1

Well, it might help. Better yet, make your computer not to obey autorun.inf on removable drives (but assuming you plug your usb into another -infected- system, it can help noticing it). There is a solution taking the next step, USB Vaccine, which creates a unwriteable, undeletable file with that name in your usb drive. It does so by marking it with some ...



Top 50 recent answers are included