Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now
46

Let us analyze each one of the techniques you want the AV to protect against: UAC Bypass: Any process in the Windows environment running with the trusted root certificate can turn off the UAC bit of its own process, as well as any process spawned by it. This means that if your malicious code can inject itself into a process running with the trusted cert, it ...


23

One of ISO 27001 requirements is management of access control to company's IT resources. If you just install Ubuntu on your laptop, all the access control will be managed by you directly, instead of your company. So when, for example, your manager will want to fire you, then your IT department won't be able to block your local laptop account in a convenient ...


23

The difference in modern version of Windows is that Autoplay is off by default, but it is still available and can be enabled. However, if you do not know the current Autoplay configuration of a Windows machine, you should check it before inserting a suspect stick.


18

Potential weakness: predictable passwords. I expect the primary weakness is likely to be that users choose a "picture password" that is guessable or predictable. If the user chooses a predictable set of locations/gestures, someone may be able to guess the "picture password". For Microsoft's evaluation of their own design, you should read this Microsoft ...


13

I should start this by saying that no modern A-V is bullet proof and all of them can be bypassed by a determined attacker. So the decision about whether to trust Windows 8's built-in A-V comes down to your priorities and the level of security that you're looking to achieve. There have been some comparative analyses of A-V solutions which reckon that ...


13

Graham Hill's answer is absolutely correct in my opinion! I just wanted to add, that there are different ways where usb sticks could harm/infect your computer. Have a look at Bad USB for example.


13

Although you ask specifically about Autoplay, I take your question more generally to be; Can I trust newer operating systems like Windows 8 or 10 to [protect me when I] insert a USB stick? To which I answer, NO, you can not trust any operating system to protect your computer from any USB of unknown origin. You should not plug in any untrusted USB into ...


11

HiASLR is a term that represents the improved ASLR in Windows 8. The "hi" part refers to the improvement in entropy generated by the increased number of random bits that the stack and heap can be offset by. Microsoft also included randomisation to various system heaps, system tables, etc. to make the possibility of using a NOP sled or information leak more ...


10

Using the stolen laptop scenario; if you don't use whole disc encryption then all your data belongs to the thief. All of it. So what account you use is of little significance. Keep in mind, however, that if you connect your OS credentials with your email credentials then you're exposing a wider attack surface by which a bad guy can get them. Remember ...


9

Windows Credentials Yes, they are stored hashed within files in the c:\Windows\System32\Config\ directory. You will need the SAM and system files. However, a backup of these files may be stored in the Windows repair folder at c:\Windows\Repair\. SAM contains the hashed passwords, however they are encrypted using the boot key within the system file. If ...


9

From the reviews I've seen of Windows 8 defender (which includes what was security essentials in Windows 7 and earlier), it's a pretty solid middle of the road A-V suite with some anti-spyware features. I don't think that it's as fully featured as the paid for security suites, but then it is free. From a personal perspective I use it as it seems fairly ...


9

No, the SAK is still Ctrl+Alt+Del, and it never went anywhere. (It never was a technical requirement for logging in, merely a policy decision.) On "consumer" versions of Windows, the SAK (Secure attention key) requirement was disabled for convenience, although can still be enabled via Group Policy, or even via control userpasswords2. Server editions still ...


8

The ISO 27001 is* about documenting what you do, how you do it, and what controls you have in place to audit that things are the way they are supposed to be. That means that the typical laptop installs is very, very standardized with known templates (how you do it). The PCs are likely to be installed in an Active Directory with GPO enforced and monitoring in ...


8

~4 sources that will make you think twice about the security of AV TLS decryption: Antivirus Software Weakens HTTPS Security: Researcher “It seems strange that it turned into something people consider a legitimate security technology. Filtering should happen on the endpoint or not at all. Browsers do a lot these days to make your HTTPS connections ...


7

Actually the article does not say that the SmartScreen client uses SSLv2; it just says that the server which SmartScreen contacts would be happy to accept incoming connections using the SSLv2 protocol. It would be surprising if SmartScreen indeed used SSLv2: most plausibly, Microsoft reused their own existing code for a SSL client, and that code does SSLv3+ ...


7

I think your question should be "Would they do this?", because every software vendor can monitor user data with or without their users notice. Windows has full access to all resources of a computer so it's very capable of monitoring its activity and data. Add an online account to that so it can easily identify you on any device you sign in. The point here ...


7

KASLR has gotten under heavy critic on the day it was released for Linux, and it has also been defeated on that very day. Spender at grSecurity has written a post about it (along with LWN comments) which I'll only summarize in a simplistic way. I highly encourage reading the original source. Address Space Layout Randomisation was originally applied to ...


7

Security is hard. While I applaud your attempts to use commonly available programs to increase your security, software that wasn't expressly designed for security often does the little things wrong (as you found out). In your case, your rar program makes a local cache of the contents, presumably so it'll run faster - something that most users would be happy ...


6

In fact it more works in the opposite direction. To sign in your own PC, you use a password that you instructed your PC to recognize. When you configure your PC to accept a "Microsoft account" you in fact instruct your PC to recognize your Microsoft account password as the "local password" -- and the same password will be used to access Microsoft's servers ...


6

Windows uses a Credential Provider and a SSPI to provide the functionality. The SSPI communicates via web service to the Microsoft endpoints. The endpoints are configured by storing them in a code-signed DLL that gets pushed down via Windows Update. The SSPI will load up the DLL, verify its code signed by Microsoft, and parse out the necessary endpoints. ...


6

While I'd recommend following ekaj's suggestion and trawling your logs to be sure, it sounds very suspicious to me. If you have allowed automated updates, it is possible that this was part of an update script...but usually updates present quite formalised user information. Safest bet is to assume the worst - and wipe it and rebuild. A Powershell running as ...


6

This is a common issue, and the one thing that you have to keep in mind is that InfoSec serves the company. Your management team runs the company, so their needs are the company's needs. Your job is to educate, educate, educate, not only with technical detail, but with financial impact and risk analysis. But, in the end, it's their call. If they still ...


6

This works as designed, because WinRAR must send a plaintext version of the encrypted file to be processed. It's not a flaw. Lets see why. You have a password protected rar file In this point, all the data are inside the rar, encrypted and protected. Nobody can read them. You open the rar file on WinRAR In this point, all data are still protected, and ...


5

First of all, in such cases stop using the network drive. Deleted files are not immediately lost but just marked as "this space can be reused". If no need of additional space presents itself, a file may be fully recoverable years later. On the other hand, if a new file needs to be created and requires space, the deleted file area might be overwritten after a ...


5

Windows 8 Defender is quite good. Tom's hardware has a good comparison of free antivirus. Microsoft Security Essentials only ranked second to the free version of Avast (on average). For defensive capability is was beaten by Comodo, Avira and Avast. Performance wise MSE scored the highest, which is what you might be looking for. Common sense and MSE will ...


5

@D.W. has posted a great analysis here, so I'll just follow up by expanding on a concern I noted in comments. (Post-intro edit: Looks like I went a bit further than I'd intended. In any case, I hope this is all useful to you. If you want the really short version, jump to the end.) For the most part a Windows 8 picture password is probably "no worse than ...


5

In addition to n00b's answer above, I'd like to point out that autoplay is only disabled by default for removable devices. If you can reprogram the controller (think BadUSB), then you can make a flash drive that tricks the host computer into thinking that the flash drive is really a USB CD drive. There are actually legitimate uses for doing this - for ...


5

Looks like a reported bug. Someone blogged about it.


4

It's because the connection is not actually secure: There is an HTTPS error on the page about mixed content. Some data is loaded over HTTP (and not HTTPS), which causes this error. You can see this if you open the page in another browser like Chrome. Edit: Some more information about mixed content errors, from my answer on this question. if one of the ...


Only top voted, non community-wiki answers of a minimum length are eligible