Tag Info

New answers tagged

0

You will not find this elaborate data no matter where you search simply because there are a lot of unreported attacks against many operating systems. When dealing with XP, you are likely also dealing with the security issues with newer operating systems (Windows 7, Windows 8) not to mention software such as Adobe, Firefox, etc., that are no longer supporting ...


0

If the software is using a fixed port and an hostname rather than IP to connect you could redirect the traffic to your local computer and use, e.g. ncat to remove and readd ssl, then inspect the traffic in between. Comment if you need more details.


3

Wireshark should be able to do it. However, the process is not as straightforward as you would have to scan the memory for the master secret. Here is a tutorial on how to decrypt SSL without access to the master private key. http://www.cloudshield.com/blog/advanced-malware/how-to-decrypt-openssl-sessions-using-wireshark-and-ssl-session-identifiers/


1

If you want to do that install Firefox. Firefox comes with its own trusted CA store and what you add there will only be available to Firefox.


3

It is possible when Windows logs the login event in the event viewer, it takes the login time from the system clock set. So a user could adjust the time and date then log back into the system which would log the event using the changed time/date, then then clock could be adjusted back to the correct time/date. this would show the last login as anything the ...


0

Normally you simply have to remove the computer from the domain and rejoin again. You can do via Active Directory I believe or Powershell. But I've found that this is the most simplest and straightforward way...and can be done from the offending computer or remotely if necessary.


1

If, by installing the anti-virus solution on the host system, you can achieve the same level of protection to the VMs as you would if they had anti-virus installed individually, then the end result is that all systems are protected from malicious software. This would satisfy compliance. There are very few products in the market that can be installed at the ...


3

Remember, the "U" in UAC stands for User. In the case of a kiosk, who is the user? Almost certainly it will not be you. What good outcome could you expect from UAC on a kiosk? Do you expect it to prevent the installation of malware if someone is surfing to evilsite.com? Do you expect the bored kid who surfed to evilsite.com to tap "no, I didn't mean to ...


1

In a trust relationship, the two domains are referred to as the trusting domain and the trusted domain. The trusted domain is the domain where the trust relationship is created. The trusting domain is the other domain specified in the trust, that is, the one wherein network resources can to be accessed. The trusting domain in this case recognizes the logon ...


2

CVE Details allows you to create a customized RSS feed with certain CVSS scores. : http://www.cvedetails.com/vulnerability-feeds-form.php However, I'm not sure if there's a way to filter out only Windows & Red Hat OS vulns.. but perhaps someone has an idea?


-1

potentially, yes. However only if the device ran a vuln service which accepts SSL/TLS certificates would it be a problem, at least at this time. Schannel ships with all versions of CE, and the Schannel bug (there's actually several MS addressed in MS16-044) dates way back. For example, the same issue exists in Windows XP, but will remain unpatched. ...


-4

Apparently not if you are visiting that website using Chrome. I have an old XP laptop that I only use for light browning. On this (live) XP system, I just renamed all copies of "schannel.dll" or "schannel.dl_" on the boot drive, including any ones that kept cropping up in other locations (eg. windows\system32\dllcache or windows\$NTservicepackuninstall$). ...


3

The vulnerability (still undisclosed) is also described as "Microsoft Schannel Remote Code Execution Vulnerability", which indicates that it is an implementation weakness (namely, a probably boring buffer overflow), not a protocol weakness. Thus, there is no reason to believe that the vulnerability would be shared with any other independent implementation of ...


0

This vulnerability should be exploitable through any connection that relies on windows SSL libraries on an unpatched machine. A pre-auth remote exploit against rdp will be available to paying customers tomorrow according to this tweet.


0

The vulnerability derives from a flaw in SPVerifySignature. If the application being used relies on Schannel.dll, it is very likely that it is vulnerable to the WinShock exploit. Applications using their own SSL implementation are not affected by this. There is a lot of confusion going on between MS14-066 and MS14-064, the latter of which fixes a ...


0

Keep in mind the key to measuring security is not just entropy of the password, but the weakest link in the chain. In this case, physical security of the computer plays a part in addition to if the machine is on a windows domain. It is fairly trivial to reset any windows password using Trinity provided that you can mount a DVD in the drive and reboot the ...


3

The SAM database is stored as a file on the local hard disk drive, and it is the authoritative credential store for local accounts on each Windows computer. This database contains all the credentials that are local to that specific computer, including the built-in local Administrator account and any other local accounts for that computer. The SAM ...


13

What is known about possible attack vectors for this exploit? Can it be exploited simply by visiting a website if you haven't applied the update? From [Dailydave] More info on SSLMAGEDON: Our friends at BeyondTrust have a page on the bug now: http://blog.beyondtrust.com/triggering-ms14-066 One thing I think people are missing is that this bug ...


1

You should use DPAPI to encrypt the data before storing it in Isolated Storage. While DPAPI is mostly targeted at per-user security, not per-app, it does have some provisions for your scenario: A small drawback to using the logon password is that all applications running under the same user can access any protected data that they know about. Of ...


0

If it were me I would make sure that the Windows firewall is on and configured to block all inbound connections. While there is a risk that there could be a vulnerability in the Windows firewall, it is likely that such a vulnerability would be high profile and you would know about it from media reports, in this scenario one of the offline methods (described ...


2

Windows manages certificates and private keys separately. Each certificate may point to a private key; several certificates can point to the same key. Each such "pointer" is given as the name of the Cryptographic Service Provider (that morally contains the key), and the key name within that CSP. Windows does not keep track of how many certificates point to a ...


1

The only realistic solution is to reimage any system that is known to be infected. You will want to take care to ensure the new image has every Windows patch on it. You will also need to examine your file sharing configuration on these systems as it looks like this worm will attempt to spread to those as well.


0

If you can access the D drive after booting from your boot disc (which is different from booting into safe mode), then it will be reasonably isolated to scan everything using multiple virus, rootkit, and malware scanners. The only vulnerabilities you will be exposing your system to at that point, it has already experienced. You can just format the D drive ...


0

Some statistics from firefox telemetry. The link points to the usage statistics for the SSL_CIPHER_SUITE_FULL variable for firefox 32, showing which suite is actually used for connection between the release of firefox 32 (early september 2014) and today (early november 2014). Its values are defined in the firefox source code. Boiled down we have: 48% ...


0

The strange thing is, Microsoft offers GCM and ECDHE, but not both together with RSA certification. The only AES-GCM ciphers with ECDHE are tied to ECDSA. Otherwise GCM is only available with DHE_RSA. The list can be found in KB2929781 or the IISCrypto tool shows it. IE11 seems to have the same restrictions. I really wish they would implement ...


0

The most secure generally available storage option that you're going to have on Windows is is the Windows Data Protection API (widely known by the acronym DPAPI.) This is one of the options for managing the encrypted web.config file sections that you mentioned as an example. DPAPI gives you user and machine specific encrypted storage for sensitive ...


2

I did some further investigation and realized that this constraint is taken into account at the time of resolving the certificate chain of trust, not at the time of creating a new link. From RFC 5280: The pathLenConstraint field [...]. In this case, it gives the maximum number of non-self-issued intermediate certificates that may follow this ...



Top 50 recent answers are included