I'm voted OT simply because it seemed "black hat" which is discouraged. I didn't think MS-Cache v2 had a place in a white hat's vocabulary.
Namely I think SCOM puts credentials there, and anyone who gets SCOM credentials, (especially if they are configured in a special run as mode) is a very scary power.
I work mostly in advising higher ups on the pro/cons of various technologies and tie in Admin, Development, and Sec. (Jack of many trades, master of none)
I mean, it had questions about crypto hashing functions, *nix password stuff, web stuff...even stuff about their chromium exploit cash prize offering amounts
web-based app, needs to do digitial signatures on the client. Up till now, they've been using a crappy ActiveX to sign a file on the client - using the user's smartcard.
is there any other technology that would allow them to do that - without the ActiveX?
@TerryChia and, even if we were to find a halfway decent js crypto library (NOT rolling our own), it is unlikely it would be able to call into the smartcard.
I have a question which relates to use of forensics technology to gather evidence from mobile / portable workstation / devices?
I would try to better explain this scenario, by considering a work environment where us(as technical security team) gets call for investigation to the xyz location to ...
Well, the file transfer big isn't necessarily unique to forensics, but there are some additional concerned when doing it as part of a forensics process.
I might be wrong here, but isn't it enough to hash the disk before and after transferring the files then verify the integrity of the disk using said hashes?
Do note that for any evidence gathered, you have to ensure that it is done with a forensically-sound procedure. Else it won't be allowed as evidence in court.
@TerryChia I worked with a police unit here that would yank the drives out, and plug them in directly via a readonly interface, upload the image from a local drive.
@TerryChia and typically we would take 5 copies of every drive, so our device had one read only bay and 5 write only bays. That way we could ensure pristine masters/secondary masters as well as giving one to the client's legal team etc
@TerryChia true, a lot of these were simple oldschool desktops. I guess they used IDE too.... this was about a decade ago, so I am understandably fuzzy on the details.
@RoryAlsop you brought to another point that i was missing , the forensic grade copy of evidence for the legal team. That sure is must,
so the transfer speed doesn't really matter as long as you have the necessary bay architecture design for your forensic workstations. In that way connecting those devices to analyze evidence as if you are doing from your local hard-drive
There is some planned support for Javascript accessing local keys, but: 1. it is not widely deployed yet, 2. it is rather limited in its options, and 3. it is kinda scary when you think about it.
If client is Windows, then it should abstract smartcard access. Applications lookup a certificate in the "My" store, say that they want to "access the private key", and Windows links that to the smartcard automatically.
Now I do that all day long in an MS-only environment, and they are all about ActiveX here.
Even when following strict security protocols, and what the user typed is (in this hypothetical situation) completely impossible to derive, the key that the server needs to compare to is still there. And even if that weren't the case, the server admin or someone with that ability could just acces...
we did a survey - oh, I guess 5-6 years ago, when those were gettign really popular - and we were able to bypass, confuddle, or molest just about all of them.
So when two process access the card regularly, each will generate its own session PIN, erasing the session PIN for the other process, and the user has to type his own PIN a lot of times
@AviD I had trouble finding that out; it required a recent Windows and a recent smartcard (otherwise, MiniDriver v5 was used, and that one does not have session PIN, so all process which cache the PIN cache the user-visible PIN instead of distinct session PIN)
@AviD I know my solution works, but I need an email from someone with an address in '@microsoft.com' to confirm it so that management people here can stop making endless meetings and spending extra money on the problem.
Lately, I have investigated how "smartcard logon" works in an Active Directory environment: what machine validates what and how. Microsoft has apparently embraced the "documentation is blog posts" fashion, which means "you shall grope in the dark and then do our documentation work for us".
