levi
Still fresh, damnit!
Shouldn't dll certificate checking be part of the os or the toolchain?
Pyra + CIA
- Thread starter netcat
- Start date
Cyber Security Assessment Netherlands 2016
Professional criminals are an ever greater danger to digital security in the Netherlands.
(at the bottom of the page there is a PDF that can be downloaded)
[doublepost=1489432451,1489432161][/doublepost]
[doublepost=1489432798][/doublepost]http://virusradar.com/ (click on a country to see your threats)
And a slashdot of sorts for security: www.welivesecurity.com
Adding your own Cryptolocker detection
Add some files in your home folder and on the root directories. If you detect a modification (size, content), then the file has been encrypted. The first things you need to do:
1. Stop it from spreading.
Disconnect your shares (for example: by shutting down your wifi and tcp connection), make files and shares read-only to avoid other files being infected, shutdown the machine (you can start it up later with a bootable USBdisk) or display a popup (easy with autoit3 or powershell)
2. Detect what version it was (there are some decryptors out there... but most of the time you are out of luck).
3. restore a backup... hah! real programmers do not backup! (they let others pull their git)
anyway, not that useful, sinds you already got infected, but nice to know as early as possible of course.
Professional criminals are an ever greater danger to digital security in the Netherlands.
(at the bottom of the page there is a PDF that can be downloaded)
[doublepost=1489432451,1489432161][/doublepost]
Well, the DLL's that are put in the windows directory are checked and versions are kept for SxS (side by side execution, where different programs can request different versions of the DLL). In the case of many software, they just put the DLL's next to the binaries, in the programs directory, so all you get is a "are you sure you want to replace file?" popup. So you would not notice that what you type gets send to an IP address, for example.
[doublepost=1489432798][/doublepost]http://virusradar.com/ (click on a country to see your threats)
And a slashdot of sorts for security: www.welivesecurity.com
Adding your own Cryptolocker detection
Add some files in your home folder and on the root directories. If you detect a modification (size, content), then the file has been encrypted. The first things you need to do:
1. Stop it from spreading.
Disconnect your shares (for example: by shutting down your wifi and tcp connection), make files and shares read-only to avoid other files being infected, shutdown the machine (you can start it up later with a bootable USBdisk) or display a popup (easy with autoit3 or powershell)
2. Detect what version it was (there are some decryptors out there... but most of the time you are out of luck).
3. restore a backup... hah! real programmers do not backup! (they let others pull their git)
anyway, not that useful, sinds you already got infected, but nice to know as early as possible of course.
Last edited:
elvissteinjr
Very Active Member
And a prompt to grant admin permissions on a sane configuration (and if they have that they don't need to plant DLLs). However, applications run from arbitrary locations are a different matter of course.
In the end the application only has normal user rights under normal circumstances. They can't take your system... but they can take all your personal data.
