full-disclosure - Re: Abusing Windows 7 Recovery Process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <500F812A-15E0-49FB-91E4-DA54F9F8BDDA@grsee.co.il>
Date: Sat, 13 Jul 2013 22:13:38 +0300
From: Moshe Israel <moshe.israel@...ee.co.il>
To: "Valdis.Kletnieks@...edu" <Valdis.Kletnieks@...edu>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Abusing Windows 7 Recovery Process

All secured/regulated systems as required by most certifications/standards/best practices.


On Jul 13, 2013, at 8:52 PM, Valdis.Kletnieks@...edu wrote:

> On Sat, 13 Jul 2013 13:23:18 +0200, Alex said:
>> This one is a classic, but it will fail integrity checks of 
>> tripwire/ossec/whatever you use.
> 
> What percent of systems actually do this?
> 
> On Sat, 13 Jul 2013 14:19:19 +0200, Alex said:
>> And trigger automated incident/alarm
> Trigger the automated alarm from the tripwire program you just axed?
> 
> Much more likely is some monitoring system like Big Brother or Zabbix
> alerting that the system has been rebooted.  And again, the vast majority
> of systems don't have this sort of monitoring.
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/