New answers tagged

2

There is an additional location where they store cached domain credentials as MSCASH2 hashes: HKEY_LOCAL_MACHINE\Security\Cache So, if you are talking about a domain-joined machine, there are three places that you could find credentials stored. SAM file (need both C:\windows\system32\config\SAM, and C:\windows\system32\config\system) Registry ...


2

I response to the comment that we are allowing the attacker to have physical access to the machine: There's a running joke in security called The 10 Laws of Security. Law #3 is If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. So yes, if the bad guy can walk up to the machine, reboot it off a USB stick ...


4

Everyone has read access to system32, but only administrators have write access. If you want to write to system32 as a Windows user, you need to conduct what is called a privilege escalation which elevates a normal user to admin. This can usually be prevented by proper user management and configuration since there are many possibilities to elevate ...


3

C:\windows\system32\config\SAM (Registry: HKLM/SAM) System memory The SAM file is mounted in the registry as HKLM/SAM. Windows locks this file, and will not release the lock unless it's shut down (restart, BSOD, etc). However, if you look at the SAM entry in the aforementioned registry section, you will not find the hash. Therefore, it seems more than ...


0

NMAP scans on WIN machines must have (-sT -Pn)... nmap -sT -Pn 10.0.0.x "You cannot generally scan your own machine from itself (using a loopback IP such as 127.0.0.1 or any of its registered IP addresses). This is a Windows limitation that we haven't yet worked around. If you really want to do this, use a TCP connect scan without pinging (-sT -Pn) as that ...


2

The short answer is Yes, it is safe. KeePass does not write any plain text passwords to disk, instead it keeps the database and passwords in memory.


0

There are many reasons for this exploit to fail, in short: The target is patched. 'Not supported language' error from the target. The payload can't execute correctly. Networking errors 'reverse connection through NAT'. From experience with the same issue, I recommend to do the following: Try not to use VMs. Try another payloads, away from reverse ...


0

I would suggest you use share me not and Adblocker plugins The link might be just an AD or also can be clickjacking page or phishing page. Visiting that link might trigger a download of malicious file( some people put default action as download). Better not to click such links


1

In theory, you could have caught a drive by download. However, it is much more likely that you have been redirected to an advertisement page and the respective owner now rejoices about the revenue of all the sheeps clicking on funny looking links ;-) You can delete your cookies to get rid of any tracking/advertisement ones and I generally recommend ...


0

I'd call it bad programming if you actually overwrite Windows' default DLLs. Putting them in another location than System32 is a way to: Use an exact DLL version without depending on the system. (Example: Direct 9's DLLs aren't included by default on Windows 10, and any game that depends on that crashes) Update executables without admin rights (Firefox ...


0

If UAC is enabled, all the programs run with the same permissions as a normal user. A process only runs as admin when: You approved UAC. Changing Windows settings with the UAC shield next to them (it doesn't ask for confirmation on an admin account, depending on your UAC settings). You invoke the runas command and typed your password. You ...


4

There is so many variables to this question with that been said but I'll provide an few scenarios. Scenario 1: User machine has been infected by an "virus.exe" which is executing under the user context "TokinRing" which is not an administrator account. You've decided to run an application "cool.exe" as an administrator account. Default windows security for ...


1

That depends a lot on the process who is used to conduct the exploit. If the elevated privilege process is the one being used, then any shellcode injected into the logical address space will have administrator privileges. So if a normal user starts, for example, Firefox as administrator and catches a malware using drive-by-download, the exploit will have ...


1

According to this answer, there is no way the history is written down somewhere on the system natively. But I am sure that you will find a tool that can track when what process was started like one of these: http://geekflare.com/how-to-check-process-start-time-in-windows/ ...


2

I don't know about Zeus in particular, but generally speaking, it's easy to do this using debug APIs like VirtualProtectEx and WriteProcessMemory. Open a HANDLE to the target process, add some executable memory (with VirtualAllocEx), put some malicious code in there, re-map the virtual address of the executable code of the library that holds your target API ...


1

The best starting point would be to investigate its logs and see if it gets you anywhere. By default, SmartScreen does not log events as per Microsoft's documentation: Logging: By default, SmartScreen Filter does not log events. However, if you use the Application Compatibility Toolkit to enable logging for application compatibility events, SmartScreen ...


3

Microsoft (among many others) uses somewhat confusing terminology at times. In this case, "drive" is used in the sense of "drive letter". This is distinct from a "disk", which is a physical storage device. A drive's data may be stored on a physical partition, but the storage location for a "drive" is most properly called a "volume". It might be one ...


1

You might want to install a Host-based Intrusion Prevention System (HIPS), create a correlation that matches your desire and block the action and also provide an alert/notification about the activity. But this might be an administrative burden as you have to always monitor for false positives.


1

To answer your question: I believe that the safest way would be to use psexec to get a remote cmd shell. This method should not result in a plaintext password stored. Or do you mean interactive, AND with a GUI? Unfortunately your best solution really is to avoid interactive login whenever possible. Luckily there are some safe ways to remotely manage ...


1

You could grab important files as suggested. For example, web.config files or other application configuration files may contain sensitive information such as passwords. You could also try grabbing the SAM and SYSTEM files - the only trouble is that these will almost certainly be locked. In that case you could grab the backups from the repair folder. See ...


3

What you describe can be called an information disclosure vulnerability. You could use this technique as a method of fingerprinting (looking for specific operating system files, common web framework folders and files, etc.) and could prove useful in identifying a version of something on the system that is susceptible to a separate vulnerability. As you've ...


1

All they have to do is view the page. Specifically, it is ran through iframe cross-scripting or Adobe Flash (< v15). There are also more obscure ASP .NET and PHP viruses that utilize drive-by-download tactics. These are less common, but it was how many banks were hacked in 2010. There have been historically viruses embedded within files. A programmer ...


3

I do not have enough rep to post this as a comment so here goes: Based on http://superuser.com/questions/363018/how-do-i-tell-what-version-and-edition-of-windows-is-on-the-filesystem you can find the Windows Version and Service pack in C:\Windows\System32\license.rtf for Windows 7. For Windows XP the information is in C:\Windows\System32\eula.txt. For ...


2

Since you are already running it with Sandboxie, no need to be concerned about "admin rights", that shouldn't be an issue. The program won't write any changes to your hard drive or the windows registry directly, so it is "sandboxed" regardless of having administrator access. If you'd like to be in greater control of what's going on when you run programs, I ...


1

From Comodo.com's newsletter: A 'drive-by-download' attack is a malware delivery technique that is triggered simply because the user visited a website. Traditionally, malware was only 'activated' as a result of the user proactively opening an infected file (for example, opening an email attachment or double clicking on an executable that had been ...


2

Yes, using any browser exploit. https://en.wikipedia.org/wiki/Browser_exploit http://krebsonsecurity.com/2010/01/a-peek-inside-the-eleonore-browser-exploit-kit/ What current browser exploits exist is anybodies guess however. No spam filter will be able to filter out all malicious URLs though. You will need to educate your users.


2

Microsoft has a knowledge base article about this for debugging which will effectively provide the desired result. How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2 Forensics Wiki maintains a great list. Note that some tools only work for x86 so be sure x64 is also supported (i.e. FTK Imager).


0

The problem may be windows 8 (and windows 10) using 'Smart Multi-Homed Name Resolution'. This basically sends queries to multiple DNS servers and returns the fastest result, so your network adapter's DNS may not have been used. You can try using gpedit to disable this, avast have some instructions here If this setting does not appear in gpedit (I have seen ...


1

This is an issue for virtually every OS. To understand the core problem you should look at the "Immutable Laws of Security" [1]: https://technet.microsoft.com/en-us/magazine/2008.10.securitywatch.aspx. Mainly Law 3: "If a bad guy has unrestricted physical access to your computer, it's not your computer anymore." Even if they did not add an admin account ...


1

First of all, lock the workstations down with a BIOS/UEFI password. This is common practice for enterprise networks. If the device is yours, then do it yourself. This prevents systems other than Windows from booting. Also make sure you disable the XPE network OS loader. At this stage, you cannot be certain the computer is 'OK' from now on since it was easy ...


0

Windows indeed does not show any security warnings when an elevated process (i.e. one that passed the UAC dialog) launches another process or loads a DLL. This is not a problem with Authenticode, because Authenticode just applies a signature. This could be considered a problem with the trust model in Windows. Basically, when the user clicks Yes on the UAC ...


0

Re-installing your hard drive is most likely your best option. The D partition will only be usable if you have the OS-specific recovery media. If you feel the problem is worth trying to track down, you might learn something. Here is a list of some tools that could come in handy: CCleaner - clean unnecessary files, sorts registry problems, change startup, ...


3

Standard protocol would be to wipe the hard drive(s) completely clean and install from known good read-only media. A malware also modifying the windows 7 copy on the recovery partition is conceivable. But whether or not the malware you have did that is something we can not tell you without looking at your machine.


1

I have free Avira installed on Windows8.1, Avira uses Windows firewall. Till know I haven't encountered any trouble related to virus or malware. This doesn't mean my laptop is totally safe. Even if I have the strongest known AV and firewall, that doesn't mean my laptop will be totally safe, either. Using the native Windows firewall or an external firewall ...


0

You can of course never be sure that there are no back doors in software you get from random places on the internet. So you have to a similar "due diligence" that is always warranted in security: to consider the value of what you are trying to shred up against how much you can trust the vendor. So go with the high-reputation vendors or write your own ...


1

TL;TR: it is not safe and if local or hardware firewalls can help depends on how deep they can inspect. It depends on your exact environment but the currently the major attacks against PC's are delivered via web and mail. This includes drive-by downloads, malvertising, malware inside phishing mails (like alleged invoices or delivery notices) and other ...


1

There is also a command-line utility: C:\> cmdkey /? Creates, displays, and deletes stored user names and passwords. The syntax of this command is: CMDKEY [{/add | /generic}:targetname {/smartcard | /user:username {/pass{:password}}} | /delete{:targetname | /ras} | /list{:targetname}] Examples: To list available credentials: cmdkey /list ...


4

If you don't plan on ever playing Solitaire on your machine, why allow it through the firewall? You can always reverse your decision later if you decide to become a Solitaire fanatic, but until then it's safer to just deny Solitaire access. I know it looks legit and it almost certainly is the application trying to connect with the Microsoft network to ...


0

I know that a keylogger called Micro keylogger records passwords from Windows 7/8 Logon Screen. However, it doesn't work when logon in the windows right after power on the PC. It works when logon in the windows from sleep mode/log off.


2

It's best to create a bootable USB/CD for Tails and not run it through a VM. Tails forces your internet connection through Tor, so if there any vulnerabilities with Tor (exit nodes, etc...) then you will be compromised. For internet banking and things that require more security, it might be best to install Linux (Debian is a good distro) alongside Windows, ...


0

How it works NTFS, like other file system, goal is to maintain a logical map of file to the disk. The disk act as a large array. The file system allocate space using an efficient algorithm (Btree+ for NTFS). The logical representation : [file1, empty, file2, empty, file3, file4,...] actual disk : [file1, empty, file2, empty, file3, file4,...] ...


3

There are so many incorrect tinfoil hat solutions here. Allow me to present a correct tinfoil hat solution that fits into your "without formatting" requirements. Even magnetic force microscopy isn't going to get the files back if they've been deleted properly. Burning the drive is an extreme tinfoil hat option that is completely unnecessary. Taking Your ...


1

to add to the other answers, I also admit that the only true way of completely removing all treaces for even the most sphiscated attackers is to physcally burn/shred/etc. (destroy) the drive many people also go around the "standard" file shredding, working with the MFT etc. but this doesnt remove all traces that this thing even existed. for starters, dont ...


0

There are many methods and tools: Low Level Formatting Darik’s Boot And Nuke CCleaner SDelete Eraser Eraser is a freeware and open source security tool to completely remove data from your hard drive. It can overwrite data several times using randomized patterns of binary code. It essentially is a file shredder. Eraser is more convenient than ...


7

No, it is not a practical security measure. I'm not going to speculate on the specific case you mentioned as I don't have all of the facts, but there are a couple of more generally relevant points. First: Attackers do not determine which attacks might work based on the desktop chrome. They're going to figure out what the OS actually is, by any number ...


1

I'm just spitting in the wind; but to be certain I would use two hard drives. First, run command prompt as administrator. Then, type: cipher /w:drive letter and run. This will over write all free space on the drive, and all files marked for deletion. I believe it makes three passes. Use a utility to clone the data over to another hard drive verbatim ...


1

Adobe Reader is old code that was not written with security in mind, and opinions differ as to how much improved it is. Both the MS Reader and the Chrome browser built-in PDF reader were written to improve security, and so you'll likely see fewer exploits against either than against Reader. So that move is highly worthwhile. Office 2013 includes a sandbox ...


3

The Honest Truth Answer: Unless you physically destroy the drive by putting it through a metal shredder, there is no way to completely prevent that information from having a chance to be recovered by a skillful individual. If government level actors factor into your threat model, then you need to physically destroy the drive. The Good Enough Answer: ...



Top 50 recent answers are included