full-disclosure - Re: Abusing Windows 7 Recovery Process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 13 Jul 2013 13:52:23 -0400
From: Valdis.Kletnieks@...edu
To: Alex <fd@...oo.de>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Abusing Windows 7 Recovery Process

On Sat, 13 Jul 2013 13:23:18 +0200, Alex said:
> This one is a classic, but it will fail integrity checks of 
> tripwire/ossec/whatever you use.

What percent of systems actually do this?

On Sat, 13 Jul 2013 14:19:19 +0200, Alex said:
> And trigger automated incident/alarm
Trigger the automated alarm from the tripwire program you just axed?

Much more likely is some monitoring system like Big Brother or Zabbix
alerting that the system has been rebooted.  And again, the vast majority
of systems don't have this sort of monitoring.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/