12,798 reputation
749112
bio website security.stackexchange.com
location Florida
age 32
visits member for 3 years, 11 months
seen Dec 22 at 16:26

I'm not the droid you're looking for.


Dec
16
comment Securing Laptop's Wireless
@Mark So, privacy issue only - no risk to the home networks or data resident on the client?
Dec
16
comment How to exfiltrate data over remote desktop
@paj28 Looks like your way in (and out) is through the centralized management systems, then. Exfiltration capabilities will be limited by what traffic is allowed out to those systems (and, ultimately, from those to your external systems) and your own patience and/or ability to work around the unavailability of certain ports/services without getting caught.
Dec
15
comment How to exfiltrate data over remote desktop
You mention the general environment can get out to the Internet. How is outbound traffic restricted from the database server, if at all?
Dec
15
comment How to exfiltrate data over remote desktop
FTR: By definition, if there is any remote networked access to a system (or network) it cannot be considered "air gapped". What about other common management tools like remote file system (e.g.: \\192.168.1.1\c$) or remote registry?
Dec
13
comment Securing Laptop's Wireless
As long as you're not joining open networks, I'm not convinced SSID broadcast by client devices is a risk. See my question on the topic, and its answers/comments, for more details.
Dec
11
comment Remote UAC bypass and Microsoft does not regard it as security Boundry
Inconsistency in the need for Registry alterations sounds like bad change management and testing procedures to me. Re-build a box fresh, jack UAC up to full power, and try again. Chances are, you'll figure out that you'd already disabled UAC on one of your earlier test systems and just forgotten about it.
Dec
11
comment Security risks of disabling SSID Broadcast
@AdnanG That's impossibly simple. For that to be the case, the network would be equally weak against attackers who aren't spoofing the AP.
Dec
10
comment Security risks of disabling SSID Broadcast
That's exactly what I'm trying to determine - if an attacker gets only the SSID information of a trusted network, and the network is otherwise secured with encryption and a PSK not known to the attacker, is the SSID alone enough for the attacker to trick client devices into connecting to his Rogue AP? I've seen many posts about SSID hiding that say it puts clients at higher risk of connecting to spoofed APs, but they don't address what happens with encryption protocol/PSK mismatches when the attacker only has the SSID to work with.
Dec
10
comment Security risks of disabling SSID Broadcast
Fair point, but other networks aren't part of the risk equation here. Assume the client devices are only configured to connect to my network. How is their security, or the security of my network, actually harmed by turning off SSID broadcast on the router?
Dec
10
comment Security risks of disabling SSID Broadcast
@AdnanG Perhaps nothing. But how is that substantially different from how they'd have to crack the same network otherwise?
Dec
10
comment Security risks of disabling SSID Broadcast
Ok. But I still don't understand how this is a significant risk, if the client will not connect to an improperly configured AP anyway. For that matter, if the new default is to include SSIDs in all probe broadcasts anyway, how is SSID hiding a bad thing? Certainly, there's no real advantage to it. But there's no impact to the security (perhaps some to usability, but that's not my question here) of the network or its client either.
Dec
10
comment Security risks of disabling SSID Broadcast
Also, while clients may technically be actively scanning the area, active scanning does not necessitate transmission of known SSIDs unless a network is particularly known not to include its SSID in the broadcast.
Dec
10
comment Security risks of disabling SSID Broadcast
This does not answer the question. How will the client trust a connection to a Rogue AP, if it does not match the known properties of the original network? Example: Trusted Network with SSID "MyNetwork" uses WPA2 encryption with a PSK passphrase of "MyPassword". Rogue AP broadcasts the SSID "MyNetwork" but with no encryption, or uses WEP, or uses WPA2 with a PSK passphrase of "EvilPassword". When the client picks up the Rogue AP, shouldn't it drop the connection attempt when it encounters a protocol mismatch or incorrect PSK?
Dec
10
comment Security risks of disabling SSID Broadcast
This does not answer the question. How will the client trust a connection to a Rogue AP, if it does not match the known properties of the original network? Example: Trusted Network with SSID "MyNetwork" uses WPA2 encryption with a PSK passphrase of "MyPassword". Rogue AP broadcasts the SSID "MyNetwork" but with no encryption, or uses WEP, or uses WPA2 with a PSK passphrase of "EvilPassword". When the client picks up the Rogue AP, shouldn't it drop the connection attempt when it encounters a protocol mismatch or incorrect PSK?
Dec
4
comment Soundness of GRC.com Haystack padding concept
@MarkBurnett Really, if your passwords are known to follow any repeating pattern at all. Knowing that the first or last characters of a password will be a repeating pattern of length n still dramatically reduces the search space even if you don't know the pattern or how many times it repeats. To be fair, injecting the pattern into the middle of the password could make things a bit more tricky.
Dec
4
comment Soundness of GRC.com Haystack padding concept
+1 for password managers, and for only using human-memorable passwords where necessary.
Dec
4
comment Soundness of GRC.com Haystack padding concept
@MarkBurnett I can see your argument, but I think the principle still applies. Consider that applying the principle properly effectively equates the "security of the system" to the "secrecy of the key". A key is most secure when it is entirely unknown. Once anything is known about the key, it becomes much easier to break - exponentially so, in fact, for any amount of characters or patterns of characters the attacker can rule out.
Dec
3
comment Soundness of GRC.com Haystack padding concept
@DaveKimble Perhaps you should read up on Kerckhoff's principle. While it was originally written with cryptography in mind, it pretty much applies equally to all matters of security. In short, to be properly effective a security mechanism should not be weakened based on how much the attacker knows about the system so long as the key itself is kept secret. This does not meet that principle because the system is easier to attack if the attacker knows how you generated the key material.
Dec
1
comment Are local firewalls necessary
Is this for a desktop/server platform, or something more mobile like a laptop? In the latter case, you should definitely prefer host-based technologies since your home router/firewall can't protect you on the go.
Nov
27
comment Is there a security difference between remote desktop or VPN?
Depends on which Remote Desktop applications you're using. Microsoft's RDP can be configured to require TLS and network-level authentication.