100

Nope. After Microsoft discontinue security updates for a version of Windows there is not a safe way to run that version of Windows. Some people will promote Virtual Patching where you have a external firewall scan all your traffic looking for patterns of traffic that look malicious. I would not trust that, and it requires a seperate non-vulnerable ...


43

As far as storage is concerned, I think that any correctly encrypted file will have same level of security. The problem is that passwords are meant to be used, and then dedicated password vaults have more features: ability to simulate key presses to avoid storing the password in the clipboard - and additionaly allows to use them on poorly designed web site ...


37

No, anti-malware is not a replacement for security updates. Neil Matz summarized the Fortinet's Q2 Global Threat Landscape report for 2017, noticing: WannaCry and NotPetya targeted a vulnerability that had been patched by Microsoft a few months earlier. But it’s not just these high-profile attacks that target recent vulnerabilities that are the ...


17

A brief look out there says that it uses AES, which is robust and the exploit tools I see look like they are doing dictionary and brute force attacks, rather than attacking something systematically broken. However, KeePass/LastPass/similar tools are specifically designed to deal with the situation. They support multi-factor/2-factor authentication, which ...


12

Thankfully, you don't surrender remote admin capabilities to Microsoft. However, you do surrender them to the e-mail system's administrator or some other IT admin there. Generally this is kind of security done at a corporate level. Corporations are as a whole concerned about loss of their intellectual property or privileged information (such as customer ...


12

There is no realistic substitute for software patches. There are additional security measures one can take, but all of them have their limitations. Antiviruses will not do a thing against attacks that do not write to disk. If an attacker hijacks a legitimate process in memory, it's open-season on your data. These kinds of attacks are becoming more and more ...


9

At the time of MS-DOS, or in the graphical derivatives (up to and including Windows ME), there was no notion of "administrative rights". There are two distinct concepts here, that should be detailed. The first one is about what a process is allowed to do when it asks nicely. The second is what it can do if it is not nice at all. In MS-DOS, each process ...


9

Apart from the usability concerns mentioned by @Serge Ballesta in his answer, the following security problems arise: KeePass has a well documented security. They document the Key Derivation Function they use and the encryption technology used KeePass is Open Source software, which means that you can verify that there is no backdoor in the software A KeePass ...


7

In MySQL, the # symbol can be used as a comment marker. Quote marks in comments don't have to balance. Not all SQL instances run on Microsoft databases.


6

Any time you install software from a vendor or project you are placing trust in that vendor or project not to have placed malicious code in there and also to have done a reasonable job of securing it. Some people may suggest that open source is the answer to this, but without repeatable builds and a full source code audit done by someone you trust, there's ...


6

I have seen several universities doing it this way: You can access your mailbox either using the Exchange protocol or using IMAP + SMTP. If you try to use the Exchange protocol with Android devices, you will get the remote access silliness that you described. However, if you use IMAP + SMTP, you can avoid this issue. (Yes, this doesn't make much sense. Yes,...


6

Windows 7 was released 10 years ago. Wanting to use win 7 now is the same as wanting to use win xp in 2013 (the year windows 8.1 was released), or wanting to use windows 95 in 2004. There were such guys in that era too, and we made fun of them at the time1. Technology is changing, you should learn to adapt if you want to succeed in this field. If you want to ...


5

I suggest you contact some local security provider and consult with them about securing your network and desktops. You can use Windows Defender to protect computers from malware and Microsoft System Center to configure it globally. In my opinion, the solution from Kaspersky Lab (their security center and endpoints) will be much easier to deploy and manage ...


5

You asked 1) if consent.exe is a legitimate program, 2) if its use of the network is legit (why does it attempts to connect to an external server), and 3) if there is any reason to allow it. Your questions (and some commentary) follow. The short answer is that it is OK, and no, you don't want to block it: Legit? Kudos for checking the genuine M$ origins ...


5

The 30-day waiting period helps Microsoft stop unauthorized people from trying to completely take over an account that isn't theirs. For example, an unauthorized person obtaining an account password through phishing or shared passwords across third party platforms. This waiting period gives the real account owner enough time to be alerted of any major ...


4

Your IMEI is not bound to your IP stack An IMEI number is used to identify a phone and is bound to each individual device, much like a MAC address is unique to a network interface an IMEI is bound to a device. Unlike a MAC address it does not exist in your network stack. IMEI stands for International Mobile Station Equipment Identity. IMEI numbers are ...


4

If you don't trust Microsoft, don't use Windows. Using Bitlocker doesn't make you more vulnerable to backdoors that Microsoft may have introduced. Cryptographic software is actually not the best place to put a backdoor: it has a fairly narrow job, it would be impossible to reliably hide what it's doing from someone running a debugger, and it would be rather ...


4

It depends on how EFS is set up, and what version of NTFS you're using. For the purposes of this question, I'm going to presume a modern version of NTFS (i.e. >=3.0) on a modern operating system like Windows 8.1 or 10. In a single-user environment outside of a domain, by default, files are encrypted in a 3-stage process. First, a random File Encryption Key (...


4

If you don't plan on ever playing Solitaire on your machine, why allow it through the firewall? You can always reverse your decision later if you decide to become a Solitaire fanatic, but until then it's safer to just deny Solitaire access. I know it looks legit and it almost certainly is the application trying to connect with the Microsoft network to ...


4

The Telnet client does not present much of a security threat in itself though it could be leveraged by some malicious process (virus/malware) to do further damage. It is also disabled as very few users, particularly home users make use of it. Standard security practice says you should reduce your attack surface as much as possible and that includes ...


4

Stuxnet spread by leveraging vulnerabilities MS08-067 and MS10-061, which were patched in 2008 and 2010 respectively. https://www2.cs.arizona.edu/~collberg/Teaching/466-566/2012/Resources/presentations/2012/topic9-final/report.pdf WannaCrypt spreads via the MS17-010, which was patched in March 2017. Not the same vulnerability.


4

If I'm reading this correctly, you changed a windows service, UPNPHost, to use a different executable than it shipped with, right? If so, the process dies because it doesn't respond correctly to the task host, so it gets killed by the system. Ive tried adding another user as admin but do not know how to switch to that user. You can switch using Remote ...


4

A legitimate reason for consent.exe to connect to the Internet is to figure out whether a certificate was revoked (by updating the certificate revocation list, CRL). I was however unable to confirm this with Wireshark. Using the Wireshark filter http contains "crl" didn't give any results on my machine. This could be, because traffic encrypted. Each ...


4

You can not trust that a sender address is correct. They are trivially easy to fake. The SMTP (email) protocol allows the creator of an email to state any sender address they want. There is no validation that the sender actually controls that address. And even if the receiving mailserver does some form of sender validation, like checking if the IP address ...


4

As others have said, it is not recommended to try to use an antivirus as a replacement for system updates. An antivirus is just one component of your system security, which also includes a secure network (incl. updated router), updated firmware and applications (especially your browser), 'street smarts' of what not to click on, and of course, an updated ...


3

It appears to that there are two possible implementation working in Linux. One is made by grsecurity named: "Reuse attack Protector (RAP)". Another is in llvm implemented and calls control flow integrity (cfi). As I understood: CFG is the marketing name of Microsoft for control flow integrity. The Chrome Team seems to work with that very well. Most of ...


3

Both approaches have their own risks: If you have your mail remote then you fully depend on the security provided by the external provider. If you host it locally it is more under your control. Which is more better depends an what you and what the provider are able and willing to do regarding security but the provider is definitely the more lucrative target ...


3

It is indeed mandatory to verify the certificate of the person you are talking to. However, it makes no sense for the server to verify it's own certificate. It would be like you verifying your home key still opens your door or if you did changed the locks. In normal operations, you should already know this. Checking the certificate of the server server-...


3

I know you've already got an answer elsewhere. However, just in case someone else stumbles upon your question, I'll try to provide a short explanation: In Windows 10, the Anniversary Update (1607), as well as the other "Feature updates" (November Update [1511], Creators Update [1703], ...) are in fact major updates, in some ways similar to an upgrade from ...


3

By design, LibreOffice will not execute macros that are not signed or are signed by an untrusted party without prompting the user and giving a security warning. I am not aware of any exploits that override that, you may be alright. It is still good practice not to accept documents from strangers, however.


Only top voted, non community-wiki answers of a minimum length are eligible