New answers tagged

0

(IME) Java requires firewall exceptions for both TCP and UDP (and one firewall rule can't do both) so that's always two. In addition you can easily have/use more than one java programfile if you: use both java.exe for console mode and javaw.exe for GUI mode use both 32-bit and 64-bit java on 64-bit Windows use more than one major version (java 7 and java ...


2

As a client device, simply turn off the "Automatically detect proxy settings" feature in Internet Options. This prevents the browser from trying to look up a location for the wpad.dat or proxy PAC script. If you want to protect poorly configured devices on your network, set a DNS entry for WPAD and blackhole the traffic.


1

The green folders are encrypted, the locked folders are locked to the user only(possibly password protected, but not encrypted). A quick google search for folder with lock icons windows 10 shows that they can only be accessed by you, and not anyone else. Green on the other hand means actually encrypted. A simple test: Send the peglocked folder to someone ...


4

First off, you should go type "how bitlocker works" into google and read a few articles. You will probably learn the answer to your question (and a bunch more interesting things besides!). If you want a quick answer, I found an article by Microsoft that says: During the startup process, the TPM releases the key that unlocks the encrypted partition only ...


3

It depends on how EFS is set up, and what version of NTFS you're using. For the purposes of this question, I'm going to presume a modern version of NTFS (i.e. >=3.0) on a modern operating system like Windows 8.1 or 10. In a single-user environment outside of a domain, by default, files are encrypted in a 3-stage process. First, a random File Encryption Key ...


1

Yes, if an attacker can crack your local password hash they can log in as you and have the same access to your encrypted files. You could export your EFS cert and private key to a PFX file protected with a separate password that would be harder to crack, but this would mean deleting it from your local key store when not in use and then importing it again ...


0

Of course it's possible and already in development as @Danny pointed out and you can assume that some big vendors will follow. But in fact this is nothing more than another behavior driven anti virus solution. It's the same game as it is with any other protection solution: It's being developed and deployed, some attacks will be mitigated, the attackers ...


1

Already done - it's currently in beta. Have a look at: Malwarebytes Anti Ransomware Beta. Former times it was called CryptoMonitor developed by EasySync Solutions, owned by Nathan Scott. Nathan was recently hired to bring up the Anti Ransomware tool for Malwarebytes.


0

If you use the Share... button Windows will push the share rights on to the file permissions. Period! Use Advanced Sharing... button if you want to separate the share permissions from the file permissions.


1

Is it a good idea to remove & re-pair my devices on a set interval (thinking that this is changing the Bluetooth PIN) No, it might not be a good idea. There is an exchange of information during the pairing that can be exploited by someone eavesdropping the radio communication link. Please see the excellent presentation by Dominic Spill ...


4

You're really asking the wrong question here Really what you should be asking is: Should I be worried that I can use tools to look at passwords stored in my Chrome browser? And the answer to that is... Kind of. Really the best way to prevent that from happening is to keep your systems hardened. If someone gets access to that data, you've already lost ...


1

If you have saved your passwords in the browser's password store, then they can be read from the browser's password store, and there's no way around that. The reason that Nir's tools works is that the browser makers have not given proper consideration to secure storage, and you can't fix that yourself. Your alternative is to switch to a real password ...


2

The Windows Credential Manager is anything but secure. It's "secure" at the user account level, which means that any process that the user ever runs and the user themselves must necessarily be trusted in order to call this system "secure" with a straight face. The only semi secure way of using the Windows Credential Manager is to store values pre-hashed, ...


1

There are the usual risks associated with explicitly or implicitly trusting something which comes from outside and thus can be controlled by the attacker. And there is a risk of assuming that environment variables provide a restricted visibility which they don't do always. Some examples: Implicitly trusting environment variables like PATH, LD_LIBRARY_PATH, ...


1

Microsoft doesn't consider UAC a security barrier, and thus they often don't fix UAC bypasses. These bypasses are common and easy. See for yourself: https://www.google.com/#q=uac+bypass


1

The existing answers covering most of the important things. I just want to add that in case of ransomware the software doesn't need any elevated privileges. If the malware doesn't has privileges to persist somewhere this wouldn't even a problem. If the user has write access to (some of) their important files which is very likely, the ransomware just encrypts ...


0

The benefit would be that ALL rights would be run as a standard user, not as administrator. Installers that trigger the UAC are far from the scariest things that go bump in the night. What you are describing is what a standard user would see, not what goes on at the OS level. UAC on its own does not make you secure.


3

The DFIR Blog has a great summary of UAC -- https://dfir-blog.com/2015/10/24/protecting-windows-networks-uac/ In the article, the author recommends the Always Notify approach, especially for administrators and critical servers. Besides social-engineering attacks such as the exploits/windows/local/ask module in the metasploit-framework, there are also tens ...


8

Is Windows 10 Leaking my IP Address? Almost everything is leaking your IP address. I'm going to avoid telling you your IP address isn't secret. You seem to already know that. Instead, I'm going to tell you what you're looking for: Yes, Windows 10 leaks information about your IP address ten over a hundred times until Sunday, even if you're behind a proxy! ...


0

This is a question you should answer for yourself. The most accurate way to know what you're sending is to download and install Wireshark, and set it to capture from your WiFi network interface. Connect to the cafe's wireless hotspot, and observe the start menu for a minute or so. Terminate the capture. You'll see literally hundreds or thousands of IP ...


0

To be more simple, lets assume, you have set internet time sync on your windows. By default it contacts time.windows.com to fetch the time. When a client connects to a server, the IP is disclosed, because IP is the metadata of the established connection. Let that be any kind of connection on any OS irrespective of Windows 10, the answer is so so so simple. ...


0

Windows "leaks" your IP Address to Microsoft since there's Internet Support. The Network Connectivity Status requests a file from Microsofts servers to check if your connection works. This can not be connected with your computer, tho. If I'm at an internet café with my notebook and go online, does Windows 10 send out information that can be used to ...


0

Go to step 4 of this: http://windows.microsoft.com/en-us/windows7/store-passwords-certificates-and-other-credentials-for-automatic-logon Enter a DNS name (store.steampowered.com) along with the credentials and it should work. Please note (and in your question you even state this) that this won't work the same way that a password manager such as LastPass ...


0

The start menu only fires web requests if either Cortana or the search bar is enabled. If both are turned off, you're not leaking your IP to Microsoft.


0

This is something a LOT of people asked a LOT of times, and honestly the information is outlined pretty easily in your Terms of Service and how the internet works as a WHOLE. However more specifically in the start menu there is the smart panels, which have web based content, which will send your IP address out to the web servers(same with the search pane). ...


7

Since your IP address is essentially the internet equivalent of your postal address and since it is required for routing your request (and especially the response) over the internet, any website that you connect to will have access to it. Any email server you connect to will have access to it, etc. Every time you connect to another computer, that computer ...


1

In teamviewer 10 you can check the following files: C:\Program Files\TeamViewer\Connections_incoming.txt C:\Program Files\TeamViewer\TeamViewer10_Logfile.log First one provides details about the incoming connections. Second one provides details of the actions performed


-2

From technical perspective, it's probably OK. From social engineering perspective, however, such information could be useful to some extend.


2

This depends on how paranoid you want to be. The dxdiag.txt file generated by using the Direct X Diagnostic utility will contain a lot of information about your computer and depending on the type of user you are, one particular thing may directly identify you (if you're the kind of person to name your PC Zachiel-PC). For example: NETBIOS name of your ...


2

From the source code of the meterpreter persistence script, the delay parameter is passed to the VBS executable that is created. When you check the VBS creation code, you can see that it runs WScript.Sleep When you say that persistence does not run sleep(), I assume you mean that it isn't running that function in in the shell, and it isn't. But it is ...


12

TLDR: It's probably fine, and MS meant it not to leak anything important. It's worth stepping through this line by line, but it's too long. So let's leave out anything that's fairly innocent. Essentially though, an attacker must work out what your system is (and this has no obvious Personally Identifying Information), and somehow find a specific driver of ...



Top 50 recent answers are included