So, I always thought the example of the XY problem on Meta.SE was a little over the top - that nobody could possibly be that ridiculously off-base from the real problem they're trying to fix. Then I handled this one today:
I'm looking for a secure way to allow SYSTEM to open a file/application as another user in an automated scenario.
Currently I'm doing it with PSExec, however this exposes the users credentials if anyone is watching the system with Process Monitor or even the command line column in Task Manager.
...
-Hello Agent. Are you on a secure line?
-Yes, secured.
-Good, in 30 seconds the launch codes will be in your e-mail's inbox.
You now have the go. Are you ready for the package?
-Yes.
-The key is: "revi3wJAVA-fim++". You should have the codes by now. Be
prepared to take ...
@RoryAlsop we started and it was kind of a pringles moment where once you start you can't stop and we ended up getting all the series over the MS streaming service
Beer as a reward is never a good idea as:
Not everybody drinks beer,
Shipping physical products have a completely new set of challenges that the SE team might not have the manpower to execute, especially with restrictions to import/export of alcohol to certain countries, etc., and
We already ha...
@RоryMcCune I meant that particular song, the first one in the playlist. It's I believe referred to as "alternative love songs". Probably covers everything from Joy Division (Love Will Tear Us Apart) to PIL (This Is Not A Love Song) LOL
Probably stops at Billy Idol, that's a whole new genre, salivation is more mainstream :)
@TerryChia A chain of Stack Exchange pubs, now that's a scary thought. Once you're in you'd never be able to leave because there's always someone that's wrong on the internet. And if you got a beer each time you corrected one ...
@Nick And your awareness makes you sad, edgy and grumpy. How can that be a good thing ?
I'm just telling that there are two paths out of this situation: 1. clean the computers, educate users and achieve security; 2. convince yourself that the problem does not exist.
Second path is much more likely to make you happy.
1. believe me I've tried.... the day right after I find all auto updates off, firewall off and antivirus uninstalled.. 2. but a problem *may* exist since 1 of those malware is a confirmed remote control trojan
... and when you're accessing production servers with a ton of CPU power ... well lets say who wouldn't want the key to that
So they say: > Adrian Crenshaw, otherwise known as irongeek (www.irongeek.com) will > be the main responsible for video recordings of talks at BSidesLV and > PasswordsCon. They will be made available online some time after the > con on YouTube. We will make a publicy available playlist of the talks.
@AlexL You do not have to salt and hash the key if is is not weak. (I.E., random) If you wish to derive the key from a non-random source (such as a password) you still would not typically want to salt and hash it as you have done, but use a purpose built key derivation function such as PBKDF2.
A single iteration of SHA256 is much too fast, and a key derived from a weak password will be easily brute-forced.
If you're absolutely certain the issue must be with malware and nothing else, despite every reputable malware detection tool saying otherwise, there's only two options remaining:
Remove the hard drive, and attach it to another system as a secondary drive. Then, use the other system to scan for ...
I'm looking for a secure way to allow SYSTEM to open a file/application as another user in an automated scenario.
Currently I'm doing it with PSExec, however this exposes the users credentials if anyone is watching the system with Process Monitor or even the command line column in Task Manager.
...
@Iszi Oh yes - I did see that one. Sometimes you have to wonder why they come up with the necessary way to do something, rather than just asking about the problem
In Canada, at least, we do distinguish between kayaks and canoes, and those are the words I'll use for the contrast here. To first make sure there's no confusion, have a look at the articles in wikipedia:
"A kayak is a small, relatively narrow, human-powered boat primarily designed to be manual...
> However, I happen to have about 40,000 bookmarks at home and syncing them is beyond all reason. No, I cannot purge them: they are there for a reason!
There seem to be a few options for syncing Firefox bookmarks, such as Firefox Sync and Xmarks. Are there any other services which might allow the user to sync only a single bookmark folder between computers? I would like this situation:
// Home computer bookmarks
+ Animals
How to pet a rat
...
Still, for the sake of argument let's say each bookmark is worth 1 kilonibble. (Probably far less, but I like round numbers.) That's a 20 MB upload, tops. Might take a minute on the home computer. Getting that 20 MB down isn't even worth breaking a sweat over unless you're on dial-up. So, even if you did choose to sync the entire database, it would be a one-time minor inconvenience - after that, any smart syncing software will just have to send/receive changes.
@Iszi So, for the sake of argument, I have far less than 40,000 bookmarks, but many thousands none the less thanks to an unfortunate situation in which two sync'ing tools were running simultaneously. I can no longer sync my bookmarks at all. The sync tools have washed their hands of me and my bookmarks and will not run.
@Xander I think overall I probably have that many bookmarks, but they live in files named things like bookmarks_1990-1994, or bookmarks_parallel_computing_resources. And these files almost never get looked at, much less synced
I've ended up using evernote to solve the bookmark problem. The issue I had was too many of the things I bookmarked vanishing from the 'net before I looked at them again
@Xander You know when you change jobs, you have a bunch of bookmarks which were incredibly useful at the time, and you don't want to delete in case they may be useful again, but in reality they just sit there taking up nearly kilobytes of space in an old folder deep down the filesystem
@RoryAlsop There's a web version that works on any OS, (I'd guess, anyway, I use it in Chrome on Linux) and I have native apps for Windows and Android.
Here's something I've wondered about. Not necessarily how to extend the expiration, but what's the right way to trust the certificate used for RDP when a proper PKI is absent?
My Windows 7 desktop computer uses a self-signed certificate to identify its RDP host. So to prevent a man-in-the-middle attack, I have to manually verify the thumbprint the first time my RDP client connects. This isn't so bad if you only have to do it once, but the certificate expires every 6 mo...
Well, if the signing key would stay the same it wouldn't be a problem. I mean, as long as you're trusting the system to self-identify in the first place, you may as well trust any key it signs for that purpose. It's not proper PKI, but does prevent the MitM that we're trying to avoid in this case.
The secure way is to ask the client to display the certificate, and check its thumbprint against a reference value (printed on a poster, on the wall). The thumbprint is a hash, so it cannot be cheated.
Most people will simply click on the "don't ask me again" button, and be vulnerable to MitM.
The RDP client does not maintain a memory of the exact certificate that a given server already used. It would be the SSH model and it would be fine, and would work.
@ThomasPornin "Right" in this case being something easily implemented by a "power user" (as a class of user, not a particular role) on their home computer such that the certificate is either indefinitely trustworthy or gets automatically re-issued from a static and trustworthy signing authority.
I seem to recall a question along the lines of "what do I do if I found a vulnerability in an app" but can't find it...would it likely be here or Workplace?
We're soon going to start split testing a new feature: adding a checkbox by the answer field that allows users to opt-in to receive unread inbox items via email.
To be clear:
This will roll out as a split test first, to see its impact on inbox email subscriptions as well as answer submi...
Ok. I'm honestly not trying to rep-whore here, but this lady needs some help being convinced that - whether she likes it or not - there's no way for her to decrypt her data without the key.
If you've lost your password and your recovery key, then there is no way for you to access the data protected by BitLocker. If you could, under these conditions, then that means that anyone could and therefore the whole point of encrypting your drive is defeated.
Encryption isn't some programmat...
eset is verry smart aganst meterpreter he now scans it every 10 secondes and sies if theare coms somthing in what isnt good not long a go thear came a update that blocks theam all maby jou need to try and sie it for jou self in a vm.
Even after reading it twice, I'm not 100% sure what he's getting at.
> ESET Smart Security is powerful against malware such as meterpreter because it analyzes the behavior of the application after it is executed. Using heuristics, it flags certain behavior or actions as suspicious. It then terminates the process and blacklists the application. That could be the reason why it was executed successfully the first time but not after. You can try for yourself in a VM to examine closer.
-Hello Agent. Are you on a secure line?
-Yes, secured.
-Good, in 30 seconds the launch codes will be in your e-mail's inbox.
You now have the go. Are you ready for the package?
-Yes.
-The key is: "revi3wJAVA-fim++". You should have the codes by now. Be
prepared to take ...
Beer as a reward is never a good idea as:
Not everybody drinks beer,
Shipping physical products have a completely new set of challenges that the SE team might not have the manpower to execute, especially with restrictions to import/export of alcohol to certain countries, etc., and
We already ha...
In Canada, at least, we do distinguish between kayaks and canoes, and those are the words I'll use for the contrast here. To first make sure there's no confusion, have a look at the articles in wikipedia:
"A kayak is a small, relatively narrow, human-powered boat primarily designed to be manual...
There seem to be a few options for syncing Firefox bookmarks, such as Firefox Sync and Xmarks. Are there any other services which might allow the user to sync only a single bookmark folder between computers? I would like this situation:
// Home computer bookmarks
+ Animals
How to pet a rat
...
We're soon going to start split testing a new feature: adding a checkbox by the answer field that allows users to opt-in to receive unread inbox items via email.
To be clear:
This will roll out as a split test first, to see its impact on inbox email subscriptions as well as answer submi...
i like trains i like trains and pingas toasty pingas
eset is verry smart aganst meterpreter he now scans it every 10 secondes and sies if theare coms somthing in what isnt good not long a go thear came a update that blocks theam all maby jou need to try and sie it for jou self in a vm.
