Tag Info

New answers tagged

0

If the server's identity cannot be trusted, it is possible that you are subject to a man-in-the-middle attack. If that happens, an attacker can potentially read and/or alter your RDP traffic in either or both directions. Having a MitM on RDP is just as bad as dealing with one on a web session, if not worse. Anything you send to the remote system - ...


1

I was curious (and perhaps board) so I just ran a quick test to see... I took an old flash drive (4gb was my smallest one), did a quick reformat (to NTFS) and tossed a simple text file on there. Using FTK Imager, I took a before and after image of my drive (just the raw data dump). I used disk wipe to wipe (using the defaults and basic wipe settings) my ...


3

The name of $TxfLog.blf is self-explanatory: The extension blf indicates a CLFS log file, and TxF stands for Transactional NTFS. You can see that TxF is just a temporary file that backs up transactions to help against sudden crashes, just like similar precautions in modern databases. There can exist some leakage from this file, but it only would consist of ...


2

I don't know exactly if Disk Wipe works by overwriting the partition data, or the disk data. If it only overwrites partition data, there can be files left on hidden partitions. If you are confortable with Linux, it's very easy to nuke out a disk. Assuming your disk is on /dev/sdb, you could do this: sudo dd if=/dev/zero of=/dev/sdb bs=65536 oflag=direct ...


0

The "DO NOT TRUST" is actually in the certificate itself as created by Fiddler. Fiddler is able to interpret HTTPS connections by acting as an HTTPS proxy. When you connect to a site via HTTPS, Fiddler produces a certificate that claims to be from that site and then accesses the real site. This way Fiddler can see the traffic, but your browser still acts ...


0

The way that I understand that Fiddler (And similar proxyies such as Burp or OWASP ZAP) work is that each installation generates a unique root certificate which it then uses to generate certificates on the fly when you have it assigned as a proxy, so you can intercept and modify traffic flowing over this connection (the purpose of the software). As the root ...


3

It's safe as long as you understand the implications. Fiddler acts as a proxy / man in the middle to intercept and decrypt traffic between you and the target. For SSL sites, it does this by dynamically generating an SSL certificate with the name of the target. The problem is that your browser will not trust certificates issued by Fiddler, hence the ...


2

The reliable way to check this, I think, is to put yourself into attacker's position, dump hashes, and see if LM hashes show in those dumps. You can do this with variety of pwdump-like tools. I haven't done this in a while, but if memory serves, output file contains user name and id, along with LM and NTLM hashes. If LM hash isn't present, it will be ...


1

Multiple copies of rundll32 running strangely named files does look like a classic malware infection to me, although as the article you linked to states there could be benign reasons, and gives steps to possibly determine what these files are. You could also use this link's suggestions to try and recover your system. Using a malware removal tool may tell ...


1

IMPORTANT: Everything following is only part of my assumptions about this incident. Without further details of it nobody can tell you exactly what happened. What browser are you using? I know that some browsers don't safe the file immediately but create a temp file while downloading. It may be that the change from this tempfile to the normal file was not ...


1

@ThatGuy Lets start by re-downloading the http and ftp links again now we can upload them to VirusTotal.com while you are uploading the files we should come up with the MD5 hashs of the files, after you have found the MD5s you should Google them to see if anything comes back with the same MD5 you need to Google them with quotes and without. If everything ...


1

Once someone has access to your server it's not your server anymore. Meaning that logs could be tampered with as well as binaries. There is a security log in Windows which allows you (if configured correctly) to: Account logon events Account management Directory service access Logon events Object access Policy change Privilege use Process tracking System ...


0

A very common way today is to attack the system while you surf the web. These drive-by-downloads gets loaded by the browser when you visit a hacked web site or through advertisement networks ("malvertising"). Probably the most common attack vectors for drive-by-downloads are Flash, Java and Acrobat Reader plugin, but there are others too (other plugins, bug ...


0

There are new hacks always happening. Here is one in particular that was rather famous. In the late 1990's there was the teardrop attack which was pre-packaged as 'win nuke' which would send a packet to an ip address. The name tear-drop comes from what it did: it created a bad packet, tore it into a pair of half-packets, sent them both to the target ip ...


1

In general, drivers can access hardware (that's their point), meaning that they have enough privileges to do whatever they want with the machine. Some operating systems try to somehow constrain some drivers to only a specific subset of the hardware, but it is hard (e.g. if the hardware can do DMA then it takes some effort and some hardware support to ensure ...


5

Fiddler is a proxy server that runs locally on your machine. For this to work it needs to use the loopback network interface (localhost). In Windows 8 has a new runtime that allows for the running of Immersive Apps. For all Immersive Apps, Win8+ runs them in an AppContainer. All AppContainers are forbidden to use send network traffic to the localhost. ...


-1

Absolutely no. It goes back to the "chicken and the egg" thing.. One of the things that Microsoft as well as other vendors warn against is installing/re-installing the OS when you have a virus/malware/or other rogue software. You ** MUST ** have the "bad software" removed and/or disinfected first. It is like the company who is re-paving your street, if ...


-1

If your laptop has only one hard-drive and you format it, you should be fine. It doesn't prevent you from getting infected by the same vector again though.


0

Even if it is band new straight from -oh wait- China, there are still supply chain vulnerabilities to consider. The point is, security exists on a spectrum, you can never be 100% sure a system is secure. You can only make it more difficult to breach. This is why so much money is spent on cyber defense by everyone. Unless you have utter trade-secrets, the ...


4

There are just too many ways in which malware can persist on a Windows machine without touching the registry. For example: Windows Startup Folder Although it is the most simple and obvious to be found, still I am describing it here just to show that this technique doesn't require touching the registry. In Windows family of operating systems every user has a ...


1

I'm going to say no, with a symbolic link its only linking to a file on the system like a shortcut and all its designed to do is act as a bookmark for easy access from whatever location you put its shortcut at. In this case the only thing that COULD happen to your symbolic link is that if you don't put permissions other people on the system could potentially ...


0

LSASS is a System level process, so any kind of access to it will require Admin level privileges. I would guess that your user had admin access and you didn't realize it. You can check your level of access through a batch script to confirm. If you still have access to the machine you RDP'ed in to. To the best of my knowledge LSASS has always been a ...



Top 50 recent answers are included