A paper on Threat model

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - MBSA Script Error I'm a noob...I just installed Microsoft Baseline Security Analyzer 2.0.1, selected a group of servers to run against, and let it go. Once finished, everything looked well & good except for when I try to view the report on one server (of course, the one I care about the most). As soon as I click on the report, I get: Internet Explorer Script Error An error has occurred in the script on this page. Line: 70 Char: 5 Error: Object Required Code: 0 URL: file:///C:/Program&20Files/Microsoft%20Baseline%20Security%20Analyzer%= 202/r=ADeport.html Do you want to continue running scripts on this page? Whether I click Yes or No, I get a blank window. All other reports on all other servers (even ones which I believe are more or less identical) work fine. The server is 2003 Server SP1 (for now), I'm running MBSA from a Win XP SP2 machine fully updated running IE7. Ideas? Thanks. Tag: A paper on Threat model Tag: 97090
  - 2
    - how to block network packets using Java Hi everyone. I am a student studying computer engineering. My academic project is the development of a firewall for Windows XP using Java language. Now i'm done with deciding the firewall policy rules. The next step is to implement these rules. For this I will need to block the incoming packets. How to accomplish this? Please help. Tag: A paper on Threat model Tag: 97082
  - 3
    - restrict access to desk top only I apparently work with a group of unruly children, and I need to restrict access to the icons on the desktop only on a unit running xp pro. (I need to lock down start button?)-- Any help would be apprecitated. karen Tag: A paper on Threat model Tag: 97075
  - 4
    - Trojan Klone AO I tried a free scan program, and it came up with Klone AO. Does Windows Defender detect and remove this? If not, besides buying another program as a once off, is there another solution? I'm computer challenged. Tag: A paper on Threat model Tag: 97073
  - 5
    - What is the best way to restrict access to Domain Admins on certain Some of the folders in our file system contain sensitive financial data. The file server is managed by our IT department. How do I restrict the people in Domain Admins group (some of them are from IT Department) from accessing sensitive data? If I remove read permissions to Domain Admins, backup jobs may fail Tag: A paper on Threat model Tag: 97064
  - 6
    - AD CS in 2003 AD domain I am trying to build new PKI based on Windows Server 2008 AD CS. Is it possible to have AD CS on Windows Server 2008 servers in Windows Server 2003 Active Directory domain? Or do I need to upgrade Active Directory to 2008 first and then build PKI? Regards, Davor Tag: A paper on Threat model Tag: 97061
  - 7
    - Convert Enterprise Root CA to Standalone Root CA and create new Hi, my existing setup is/was simple. Had a single site active directory for 30 users and an exchange server. All computer workstation identification certs were pushed out via autoenrollment and as such they trust the root CA which was the one to issue the certificates. As i will now have a number of sites i think it would be prudent to have subordinate CAs at each remote location to issue certificates there. My question is, how would this affect the current computers having the existing CA where it is directly issued from the enterprise root, compared to other computers who were issued via the subordinate CA when i get them running? Im guessing not much, since all computers will trust the root anyway through thet certificate tree? Only down side is if the root got comprimised in this scenario since they would still trust it. To aid my understanding, do enterprise root CA issue certificates to workstations by default? Im guessing not, since i had to create a workstation identification template. How could i ensure in future that the root CA only issues certificates for other subordinate CA's and NOT workstations? Would this be through the certificate management mmc console? Is this controlled by active directory GPO or some other setting? What is the purpose of having a root enterprise CA and subordinate enterprise CA? I cant see much benefit and indeedd maybe this is less secure as the root is online... this is fine for small networks but i have found may no longer be ideal for me. Can active directory automatically publish the revocation list to http for it to check? Do i need to have IIS running on the server? I see the url for revocation checking but when i type it in in my browser i get a blank page again i presume because IIS is not running. Finally, given the site links are expanding, Is it possible to move my existing enterprise root CA to a standalone root CA, and then create multiple subordinate CAs to issue certs on the clients behalf? This would be the ideal setup as a managed upgrading process. Can i move the root enterprise CA to an offline root CA? Many thanks in advance, Chris Tag: A paper on Threat model Tag: 97057
  - 8
    - New Free software and games download (A to Z) New Free software and games download (A to Z) If we are to have real peace, we must begin with the children. Free software and new games download.... Everthing is available here..... Just click...... http://bajagu.guys.googlepages.com/www.newinfoproducts.c-o.in Tag: A paper on Threat model Tag: 97055
  - 9
    - Signed MSP still says Unknown Publisher Hi, We create monthly updates for our software released as MSP files. While we use Installshield 2008 to build the MSI installations, we use MSIMSP to build the patches. The patches install without issue, however, we have an issue signing it. Signtool says that the patch is signed successfully, but Vista insists that it is an Unknown publisher. How do we fix this? Also, while installing the MSI, it is happily acknowledging our signature, but uninstall is not. It insists Unknown Publisher. Thanks in advance Tag: A paper on Threat model Tag: 97048
  - 10
    - How did this Trojan appear? My system configuration: Win XP SP2 with all updates, firewall on, behind a router. AVG anti-virus. At the time of the incident I had several Opera browser windows open, and pointed to respectable financial sites like finance.yahoo. Outlook Express was loaded and may or may not have been downloading email. Microsoft Excel was the only other user application running. What happened was AVG suddenly reported an attempt by "Trojan horse downloader Zlob.ABQ" to load into one of my system restore subdirectories. How can this happen without me clicking on an attachment or popup, etc.? Tag: A paper on Threat model Tag: 97043
  - 11
    - man in the middle 4 firwalls/antivirus products in one month. I've come the the conclusion that there is no security on the internet beyond unplugging your machines permanently. I reformated 3 computors 5 times, reinstalled the windows xp sp2 and updated, and even went so far as to change the mac addresses on the network cards. Within days windows system security settings,and product firewalls would change and it would be downhill from there,not counting the money spent. In conclusion I've had to cancel my personal isp and email account,what was happening was that I would get these trial versions of security software both downloaded and cds, like them, buy them using https and then they would send me email confirmation and a link to download the full versions. Someone had cracked my email and was sending me to spoofed websites. It didn't matter how often I would reformat and reinstal the os after I found this out and NOT use the email. My question is how is this possible that this hacker could still track me? Tag: A paper on Threat model Tag: 97041
  - 12
    - logs og logon i have neccesity to search a history of login (from today to 10 days old) into computer from my domain users. what are the file or .log or event logs for find it ??? Tag: A paper on Threat model Tag: 97039
  - 13
    - Configuring Linksys Router with WPA2 and AES Hi, WinXP Pro SP2 on desktop & laptop. Linksys WRT54GX2 My question is simplified in the interest of brevity. If more information is required please let me know. Would like to increase the network security from WPA to WPA2 AES. I have a home network which consists of two computers. The desktop is wired to the router (provides firewall protection from the internet). The laptop is connected wirelessly. Can I configure the router security to WPA2 if the laptop's WLAN card supports it and the desktop's doesn't? My understanding is that if the desktop is wired directly to the router, WPA support isn't a concern for this machine. Is my understanding correct? Thank You. Cheryl (hope this isn't a dumb post...) Tag: A paper on Threat model Tag: 97033
  - 14
    - lost my CD I lost my printer CD. I try to download from their website but it doesn't work. It is hp 6310xi printer. Let me know if someone has better way. Kazam begin 666 p.gif M1TE&.#EA`0`!`/$``/___P```,# P ```"'Y! $```(`+ `````!``$```(" $5 $`.P`` ` end Tag: A paper on Threat model Tag: 97027
  - 15
    - What rights on a machine does an account have when logging on as a service? Gurus, System services usually run under the Local System account or Network Security account. When you make an account run as a domain user account, i.e a Domain Admin account, what additional rights does it give that box on the local machine? I know it gives it the right to logon as a service. Anything else? -- Spin Tag: A paper on Threat model Tag: 97025
  - 16
    - How does the windows patch scanner work Say I have a Windows 2003 server all patched. Then it crashes and we have do a repair on the server using original meda. Is the windows "patch manager" smart enough to analyize all the files to figure out what needs to be updated? Or does it just read some earlier created DB and assume all is well. Tag: A paper on Threat model Tag: 97024
  - 17
    - Why is a network printer a security hole? Gurus, Our network security guy scanned our network with a vulnerability scanner and stated that our HP Plotter has security vulnerabilities, namely, SNMP and anonymous FTP were enabled. Can someone give me a good reason why a network printer could be a security hole? I just can't wrap my head around that. -- Spin Tag: A paper on Threat model Tag: 97022
  - 18
    - Open File-Security Warning This message on opening a network EXE is driving me crazy. One workstation has XP with IE7. I have tried every regisitry edit, security edit, open edit etc. I could find available and still no luck. I have seen hundreds of posts about this. Anyone have something new to try? Thanks Tag: A paper on Threat model Tag: 97019
  - 19
    - Immediate Disable of Terminated Employee First off, apologies if this subject has been covered before, but I did a search and couldn't find anything. Our situation is this: an employee was terminated today and his/her user account was disabled and password reset. In spite of this, the terminated employee was able to send emails on the company Exchange email up to 30 minutes later. I've been asked to find a way to make disabling the user account have the immediate effect of keeping them from sending emails or doing anything else on the domain. I know that disabling the user account will prevent the user from being able to log on to the domain, but it appears that a disabled user who is already logged on maintains some or all abilities to access resources such as email. Is this expected behavior in Windows 2003 AD? If so, is there a way to change this behavior? For example, is there a way to force a disabled user account to be logged off of any computer he/she is logged onto on the domain? For those who will make the very logical suggestion that the terminated user be immediately escorted off the premises: I appreciate it, but that sensible solution has already been rejected by management! Thanks in advance for any tips. -- JL Tag: A paper on Threat model Tag: 97015
  - 20
    - Automated CA build Creating a hands off PKI install. And Enterprise Root CA. I need to set the DN to the following. O=Parent Company OU=Child Company C=US Somehow, i seem to only be able to set the CA's name. not the Distinguished name. If I build the CA by hand, of course i can type it in. But the automatic version of this seems to be tricky. Here is my unattend.inf file: [components] certsrv=on CertSrv_Server=on CertSrv_Client=on [Certsrv_Server] CAType=EnterpriseRoot CSPProvider="Microsoft Strong Cryptographic Provider" HashAlgorithm=SHA1 KeyLength=2048 Locality="US" Name="XYZ Corp Experimental CA R3" Organization="Parent Corporation" OrganizationUnit="Child Corp" SharedFolder=c:\cainstall UseSharedFolder=Yes ValidityPeriod=5 ValidityPeriodUnits=Years Here is my reference: http://technet2.microsoft.com/windowsserver/en/library/fec76c5f-bc6f-411d-96a7-6cd0587c1dd91033.mspx?mfr=true I am using the following command prompt to launch it. sysocmgr /i:sysoc.inf /u:c:\cainstall\unattend.inf Anyone ever set the CA's DN from an unattended install? if so, how? -Wayne wayne_a_harris@hotmail.com Tag: A paper on Threat model Tag: 97011
  - 21
    - Microsoft Security Bulletin Minor Revisions, 12 Mar-08 <QP> ******************************************************************** Title: Microsoft Security Bulletin Minor Revisions Issued: March 12, 2008 ******************************************************************** Summary ======= The following bulletins have undergone a minor revision increment. Please see the appropriate bulletin for more details. * MS08-017 - Critical * MS08-016 - Critical * MS08-015 - Critical * MS08-014 - Critical Bulletin Information: ===================== * MS08-017 - Critical - http://www.microsoft.com/technet/security/bulletin/ms08-017.mspx - Reason for Revision: V1.1 (March 12, 2008): Bulletin updated to reflect new download link for Microsoft Office Web Components 2000 for BizTalk Server 2000 and 2002. Also corrected the registry key for verifying the update for ISA Server. - Originally posted: March 11, 2008 - Updated: March 12, 2008 - Bulletin Severity Rating: Critical - Version: 1.1 * MS08-016 - Critical - http://www.microsoft.com/technet/security/bulletin/ms08-016.mspx - Reason for Revision: V1.1 (March 12, 2008): Bulletin updated. FAQ added to clarify the reason why a non-vulnerable version of Office will be offered this update. Also removed MS07-015 as a replaced bulletin for Microsoft Office XP Service Pack 3. - Originally posted: March 11, 2008 - Updated: March 12, 2008 - Bulletin Severity Rating: Critical - Version: 1.1 * MS08-015 - Critical - http://www.microsoft.com/technet/security/bulletin/ms08-015.mspx - Reason for Revision: V1.1 (March 12, 2008): Bulletin updated. FAQ added to clarify the reason why a non-vulnerable version of Office will be offered this update. Also updated the vulnerability FAQs and the file information tables for Outlook 2000 and Outlook 2003. - Originally posted: March 11, 2008 - Updated: March 12, 2008 - Bulletin Severity Rating: Critical - Version: 1.1 * MS08-014 - Critical - http://www.microsoft.com/technet/security/bulletin/ms08-014.mspx - Reason for Revision: V1.1 (March 12, 2008): Bulletin updated. FAQ added to clarify the reason why a non-vulnerable version of Office will be offered this update. - Originally posted: March 11, 2008 - Updated: March 12, 2008 - Bulletin Severity Rating: Critical - Version: 1.1 </QP> Source: MSRC -- ~Robear Dyer (PA Bear) MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/ Tag: A paper on Threat model Tag: 97003
  - 22
    - Unknown workgroup in Microsoft Windows Network Recently a new workgroup/domain appeared in our "Network Neighborhood > Microsoft Windows Network" We are running Windows 2003 Server with Windows XP Pro workstations in our network. Two questions: 1. I only found this by chance when I was looking in Network Neighborhood. Is there a way that I could be alerted if a new workgroup or domain appear? 2. How can we track this back to who or what IP address device attached to the network? Thanks, Bill Tag: A paper on Threat model Tag: 96993
  - 23
    - The directory datatype cannot be converted to/from native DS datat Hi, We are using a LDAP sync service. We are facing no problem when it was run on Windows XP. But we are getting the following error on Windows Server 2003 with Service Pack 2. More importantly this error is coming once in a couple of days but this will executes continously. Thanks in advance for the help. Ram Mohan Tag: A paper on Threat model Tag: 96990
  - 24
    - Microsoft Security Bulletin (MS08-017) Hi, This with regards to the recent (March) security bulletin published, on the link http://www.microsoft.com/technet/security/Bulletin/MS08-017.mspx it says that Office 2003 SP3 is not affected, however the below link says that Office 2003 SP3 is affected, could someone please clarify this? http://www.microsoft.com/technet/security/current.aspx Thanks & Regards, Rajiv Saha Tag: A paper on Threat model Tag: 96989
  - 25
    - Can't get past Windows login??? When I enter my login info at initial Windows login in screen, it's not recognizing the user/password as correct? I don't have the Windows XP CD as it was loaded when I received it. Can I connect it to my PC and overwrite with my PCs Windows XP? If so, how? Thanks! Tag: A paper on Threat model Tag: 96985
- Next
  - 1
    - Secuirty Collection Does anyone know of a tool that will allow me to collect user and group information from multiple servers to be posted in an Excel spreadsheet or a SQL database? 99% of our servers are stand alone and we are in the process of auditing them. -- Todd W. Gage Network Administrator Preferred Mutual Insurance Co. Tag: A paper on Threat model Tag: 96982
  - 2
    - SSL and Remote Desktop Hi, I am trying to install a SSL certificate for Remote Desktop. I installed the Microsoftâ??s Certificate Services and since the computer is not part of a domain, the only option I had to install the CA as is stand alone. So everything went fine that. However, when Iâ??m in the certificate mmc and I try to request new certificate, I do not have the choice â??request certificateâ??. The choice does not exist. I have set this up on my domain and have no problems, however on this stand alone computer, I am unable to request certificate and get the SSL installed for Remote Desktop. Thanks, Sam Tag: A paper on Threat model Tag: 96974
  - 3
    - Webmasterslookup launches Encrypted Messaging Service. You want to send your girlfriend a message from the office and you'd rather the IT guys weren't reading your e-mail. You're messaging a potential client about the special offer you want to make and want to keep it a secret to your competitors. These are just some examples when you might want to keep your messages for yourself. Why Encrypt your messages? Encrypting a message keeps the contents of the message private by converting it from readable text to scrambled text. An encrypted message can be read only by recipients who have the private key to decrypt it. Encryption does not make your data secure. Not using encryption, however, means that any data in transit is as easy to read as a newspaper on your doorstep. Encryption at least ensures that anyone who does read your messages has had a hard time hacking it. The Webmasterslookup Encrypted Messaging Service will help you with your encrypting messaging needs. Issues you have to consider (I). - The Encryted Messaging Service of Webmasterslookup is a Private Key encryption system. Both parties share an encryption key, and the encryption key is also the one used to decrypt the message. The difficulty is sharing the key before you start encrypting the message - how do you safely transmit that key? In this system however the key is not transmitted but present on the internet. You only have to know which key to use. - Cryptanalysis, or the process of attempting to read the encrypted message without the key, is very much easier with modern computers than it has ever been before. Modern computers are fast enough to allow for 'brute force' methods of cryptanalysis - or using every possible key in turn until the 'plain text' version of the message is found. In this particular system however the key can be a temporary key with only a short lifetime. This makes it very hard to decrypt. The longer the key, the longer it takes to use the 'brute force' method of cryptanalysis - but it also makes the process of encrypting and decrypting the message slower. Key length is very important to the security of the encryption method - but the 'safe' key length changes every time CPU manufacturers bring out a new processor. You can choose your own key length in the Encrypted Messaging Service of WebmastersLookup. Benefits. * Encryption is done by an unknown unusual method. * The message is encrypted and stored in our database. It is not sent by e-mail. * We don't store IP`s or Web Keys in our database. * Only a notification is sent by e-mail to the recipient if you want it. * The receiver's e-mail address is the identifier, both users don't need a special account or membership. * You don't have to install a certificate. * A handshake with your personal computer secures your identity. * This web based service means no download, no special software and no need for a special mail client. * There are no traces of the message on your computer. * It is Free!! Go to http://www.webmasterslookup.com/esend.php to start sending your secret messages without any password or payment. Kind Regards, Wim Hoogenraad Tag: A paper on Threat model Tag: 96965
  - 4
    - PKI Question -- Moving CA to New Hardware We're preparing to lease refresh our PKI servers, which will mean moving them to new hardware. I've found a good Microsoft KB article on this (298138), but wanted to post here to see if anyone else has direct experience with this sort of thing. Specifically: -- are the procedures outlined in this KB article the same for the root CA and the issuing servers? -- does it matter whether the root CA or the issuing servers are done first? -- any landmines to avoid that aren't covered in this article? Thanks in advance for any advice! I really don't want to blow up our PKI infrastructure. -- JL Tag: A paper on Threat model Tag: 96964
  - 5
    - vista problems with defender, onecare, disk defragmenter I am having problems with my computer. Installing new virus software like onecare doesn't help. The problem may actually be related to onecare not even being able to open. It says restart comp or contact support if problem persists. My disk defragmenter hasn't been working like it did when i first go my computer around a year ago. it says it is degragmenting but just keeps syaing that forever. This has been going on for about a month. Also my windows defender won't open at all so i can't manage start up programs and turn defender on off. It tells me i need to turn it on when i try to open it but it won't let me turn it on. I think my problem is a virus or somethign. But considering i installed onecare and it won't open i am stuck. I have been able to have a person connect with windows remote assistance. If someone is willing to do that that would help. Tag: A paper on Threat model Tag: 96949
  - 6
    - Auto downloads and installs -- ? Okay, we've established that I have XP Home ed. with only SP1 installed. Now the question is: my updates preferences are set to automatically download AND install at 3 am every night, but clearly SP2 and a host of little hotfixes and stuff have not installed themselves. Is that because my computer is usually off at 3 am, or what? [I had once upon a time installed SP2 and it interfered with my other programs, so I uninstalled it, but realize I'm a bit behind the times now and there are some other apps I am looking at that require at least SP1a, which means I need to probably bite the bullet and do SP2 and its hotfixes etc.] My fear here is that SP2 and its progeny will lock up my computer and I'd then unable to get online or do anything at all, so I've been better off without SP2. Why does SP2 cause conflicts, and will my computer and its programs be operable when SP2 is installed, and if not, why not, and then what? Thanks. Tag: A paper on Threat model Tag: 96939
  - 7
    - HELP ! My PC has been compromised !! Last nite my PC behaves normally, but this morning, it took over 1 hour to boot up the XP. Now, in the tasking tray, I see tons and tons of messages are being sent out ! I have not configure this PC to send out emails. I use webmails. But now my PC is sending out tons and tons of emails !! The symantec norton antivirus is doing the "Symantec Email Scan" on those emails and the emails are jamming up the system. What can I do ???? What software should I use to remove this security breach ???? Please help !!!! Thank you !! Tag: A paper on Threat model Tag: 96928
  - 8
    - HELP ! My PC has been compromised !! Last nite my PC behaves normally, but this morning, it took over 1 hour to boot up the XP. Now, in the tasking tray, I see tons and tons of messages are being sent out ! I have not configure this PC to send out emails. I use webmails. But now my PC is sending out tons and tons of emails !! The symantec norton antivirus is doing the "Symantec Email Scan" on those emails and the emails are jamming up the system. What can I do ???? What software should I use to remove this security breach ???? Please help !!!! Thank you !! Tag: A paper on Threat model Tag: 96927
  - 9
    - PKI CA CRL Extension: "Inlcude in all CRLs" "Include in all CRLs. Specifies where to publish in the Active Directory when publishing manually" This option in the Extension list of the CA properties is named a little bit incomprehensible for me. Even though the CRL publishing properties are described in detail at Mircosoft: http://technet2.microsoft.com/windowsserver/en/library/073732b5-80f0-4cf0-bc8e-d8e055ce26491033.mspx?mfr=true What exactly does this option? As far as I understand, it is used for offline CAs, to manually publish CRLs in the Active Directory but exactly why and how? Where is the difference between "Include in all CRLs" and "Include in the CDP extension of issued certificates".? As far as I understood, these options just control if the CRLs are to be published at the specified location and/or if they are to be included in the certificates. MS describes this option with "The Include in all CRLs flag specifies that the Active Directory publication location should be included in the CRL itself.". Does this mean in the CDP extension of the certificate - I don't believe that, as there's still another option for that. Much confusion here... Thanks in advance for throwing some light on it.. Reinhard Tag: A paper on Threat model Tag: 96922
  - 10
    - PKI CRL LDAP location exposes infos about internal DS structure to I want to set up a 2 tier PKI based on W2K3. The issuing CA is AD integrated. Certificates are also to be provided to external customers for secure web transactions. Unfortunately, the LDAP URL in the CRL extensions exposes details about the internal AD structure and NB-name of the CA. I read about LDAP translation but couldn't find any info on how to implement that. How can I obscure these details on the internal AD structure? How critical would you value keeping these details in the CRLs? Microsoft themselves advise in their design documents to obscure it but unfortunately don't tell how... You help is really appreciated. Reinhard Tag: A paper on Threat model Tag: 96920
  - 11
    - Microsoft Award Lottery Dear Sir or Madam, I received the following mail. From: Microsoft Award Lottery <angeliquemitchell@eircom.net> Date: Sat, Mar 8, 2008 at 5:28 AM Subject: AWARD WINNER (Ref:MSN-...........) YOUR EMAIL ID HAVE WON (Â£500,000) To: This is to inform you that you have won a prize money of FIVE HUNDRED THOUSAND POUNDS (Â£500,000) for the month of Feburary 2008 Lottery promotion which is organized by YAHOO LOTTERY INC & WINDOWS LIVE.YAHOO & MICROSOFT WINDOWS........................etc. It's also include Batch Number,Winning Number and Reference Number.... Please consider me that it is really sent by Microsoft or not. Tag: A paper on Threat model Tag: 96917
  - 12
    - Microsoft Award Lottery Dear Sir or Madam, I received the following mail. From: Microsoft Award Lottery <angeliquemitchell@eircom.net> Date: Sat, Mar 8, 2008 at 5:28 AM Subject: AWARD WINNER (Ref:MSN-...........) YOUR EMAIL ID HAVE WON (Â£500,000) To: This is to inform you that you have won a prize money of FIVE HUNDRED THOUSAND POUNDS (Â£500,000) for the month of Feburary 2008 Lottery promotion which is organized by YAHOO LOTTERY INC & WINDOWS LIVE.YAHOO & MICROSOFT WINDOWS........................etc. It's also include Batch Number,Winning Number and Reference Number.... Please consider me that it is really sent by Microsoft or not. Tag: A paper on Threat model Tag: 96916
  - 13
    - How do I know if XP SP2 is installed? I have auto updates enabled, and the list of updates downloaded from MS is long and has a green checkmark next to most (the updates that have a mark showing the download failed are then shown a few days later as having succeeded wiith a green checkmark). XP SP2 has a green checkmark, but the explanations, in their usual circular manner, don't indicate whether the download AND the installation happen automatically, or only the download. How can I tell if SP2 is installed? Thanks. Tag: A paper on Threat model Tag: 96912
  - 14
    - Unique -- Limiting User to Inside Folder I have a program which links to an enterprise server in real-time. My program uses a DLL provided by the company who owns the server. This DLL is currently registered in C:\Windows. ============================ My security objective is to keep the server operator from accessing my system through their DLL (my machine remote access is disabled) if such code is included within the DLL -- or -- possibly turn on my remote access remotely (which I understand can be done) even though it is disabled. If I move the DLL to a specific directory (folder) along with my program, how do I configure my system so that: 1) I can execute my program as system administrator, and 2) Keep the server provider within the program directory I created without getting into other directories (folders) or drives on my system. Thanks David Tag: A paper on Threat model Tag: 96911
  - 15
    - banning the entry of IP address searches from within Internet Expl I have a problem in my School where the pupils have discovered a way to bypass my filtering. I can't think of away to stop them from entering IP addresses into Internet Explorer and bypassing the filtering through our external DNS filtering service. Would I use an ISA rule or is there a setting in GPO? Thanks Tag: A paper on Threat model Tag: 96905
  - 16
    - Reason Please! Hi all, I have one internal employee which used the hacking tool to scan our network and change our administror account. He did not get any permision and thought it help us to do internal assessment. Can anyone give me the reason why he should not do it in the production network? Thank you. Tag: A paper on Threat model Tag: 96891
  - 17
    - WLAN Security WPA EAP/TLS. Authentication Failed error I am setting up WLAN to secure our wireless network. I plan to use 802.1x EAP/TLS with certificates for the client machine and user. My issuing certificate server is Windows 2003 Enterprise and I have the certificates set to Autoenroll the machines in the correct AD group. WHen I check the machines, they appear to have the correct certificates installed. The AP is set for 802.1x and is pointed to the radius server. The radius server has the AP as a client. However, when trying to connect to the AP, I get a "Windows was unable to log you into the network" error after the initial connection to the AP. Ipconfig shows an ip address of 0.0.0.0. I need some help troubleshooting this issue. I've included some of the radius server log below but I don't see any obvious problems. Radius Server Log. "RAD1","IAS",03/04/2008,00:00:01,1,"me@mydomain.net","mydomain.net/InformationTechnology/me","00-1c-f0-59-df-d1","00-13-02-1e-98-44",,,"DWL-3140_WLS_SW","0.0.0.0",0,0,"10.1.0.101","AP_1",,,19,,,,5,"Connections to other access servers",0,"311 1 10.1.0.28 02/29/2008 18:01:15 31478",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"Use Windows authentication for all users",1,,,, "RAD1","IAS",03/04/2008,00:00:01,3,,"mydomain.net/InformationTechnology/Me",,,,,,,,0,"10.1.0.101","AP_1",,,,,,,5,"Connections to other access servers",66,"311 1 10.1.0.28 02/29/2008 18:01:15 31478",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"Use Windows authentication for all users",1,,,, I am really scratching my head on how to tell where the process is failing so any help would be greatly appreciated. Steve Halvorson Preferred Credit, Inc Tag: A paper on Threat model Tag: 96889
  - 18
    - Code signing a "Flash" .EXE file issue / Code sign any .EXE? Dear Group, Hope you can advice me with this! If this is not the right forum, your advice is also appreciated. ] Background To avoid that our customers are confronted with the 'unknown publisher' warnings (there are other valid reason to code sign...), we are using Code Signing and the related certificate from Verisign. Recently, I noted that one of the signed .exe's did not function as when it was unsigned (I'm able to reproduce). In fact, it was a Macromedia Flash in an .exe file. Unsigned it runs the Flash content perfectly, signed, it does not run any more. Just the Flash Player windows opens, the content does not play. The signature verifies OK. I had a similar experience with some flash content converted to .exe using a tool called FLAjector. After successful signing, executing the .exe triggers an "X Flash player not installed" error. Unsigned the .exe runs OK. ] Question I thought that *any* .exe could be signed, but the above example shows that in this case - though the signature itself appears OK - the resulting signed .exe does not work as before. Any suggestions on how to address this? Is this specific to Flash? Thanks, Wytze Tag: A paper on Threat model Tag: 96884
  - 19
    - Vista is infected. Hello, I'm using Vista as OS and I think my laptop is infected. After vista load and after I input my username and passsword, the screen goes black and cannot do anything else. Is there any solution or advice that can help save my laptop or reinstalling is the only suggestion? Thank you in advance! Mingo Tag: A paper on Threat model Tag: 96880
  - 20
    - Windows Firewall Dropping Return UDP Packets I have a Windows 2003 Server Domain Controller with Windows Firewall enabled and set up correctly, and the domain controller works fine. But I occasionally see dropped packets for protocols in the pfirewall.log file that are absolutely authorized for travel through the firewall. For example, we have rules that allow any incoming packets on UDP ports 53, 88, and 389, yet I still see entries in Windows firewall such as these: 2008-03-05 18:47:00 DROP UDP 192.168.14.121 192.168.105.13 3825 389 246 - - - - - - - RECEIVE 2008-03-05 18:47:00 DROP UDP 192.168.14.121 192.168.105.13 3825 389 246 - - - - - - - RECEIVE 2008-03-05 18:47:00 DROP UDP 192.168.14.121 192.168.105.13 3825 389 246 - - - - - - - RECEIVE 2008-03-05 18:47:00 DROP UDP 192.168.14.121 192.168.105.13 3825 389 246 - - - - - - - RECEIVE 2008-03-05 18:47:01 DROP UDP 192.168.14.121 192.168.105.13 3826 53 105 - - - - - - - RECEIVE 2008-03-05 18:47:02 DROP UDP 192.168.14.121 192.168.105.13 3830 88 1403 - - - - - - - RECEIVE 192.168.105.13 is the host that is protected by the firewall in this case, and 192.168.14.121 is a member server communicating to the domain controller. I'm well aware of the many special requirements that domain controllers have when used with firewalls. I don't need to read Knowledgebase 555381 for example. My question is under what circumstances does it make sense for the firewall to be blocking the above UDP packets when the firewall rule explicitly allows them as exceptions? Maybe someone who understands details about the Windows Firewall's internals could explain why such packets might be dropped. -- Will Tag: A paper on Threat model Tag: 96878
  - 21
    - XCACLS.VBS and error In doing the following: cscript c:\windows\XCACLS.vbs \\mi-mke-mcfile02\users\05822 /G MI \05822:F /f /t /e I am getting an error -2147023174: occurred in connecting to server. (msg#3203) error description: the rpc server is unavailable. Not sure why this is happening, everything is fine network wise Tag: A paper on Threat model Tag: 96874
  - 22
    - urgent help! Hi all, We just found out that our administrtator password was changed last night. I am looking at security logs now. Can anyone help me how I find out who changed the password and through which computer? any specific ID? Thank you!!! Windows 2003 R2 environment Tag: A paper on Threat model Tag: 96873
  - 23
    - CAPICOM and CSR or PKCS#10 Does anyone know if CAPICOM can help me to create a Certificate Signing Request (or a PKCS#10)? Thanks Roberto Tag: A paper on Threat model Tag: 96867
  - 24
    - LinkedIn groups for SBS users and security enthusiasts To all, For those of you that are LinkedIn users and fans of SBS, I have created a networking group on the LinkedIn system for you. You can join it at http://www.linkedin.com/e/gis/64458/7D7008666D31. ALSO: Please feel free to join my security group on LinkedIn. It is for the National Information Security Group. Join at http://www.linkedin.com/e/gis/43269/7DC2303017E0 Yours, Brad Dinerman _______________________________________________ Bradley J. Dinerman, MVP - Enterprise Security President, National Information Security Group http://www.naisg.org Tag: A paper on Threat model Tag: 96866
  - 25
    - On security standards about home networks or digital home Can anyone give me some advices on how to find security standards about home networks or digital home? It can be world wide standards or just industry specific ones. Thanks. Tag: A paper on Threat model Tag: 96863

Hello,
I am looking for some information on Internet threat models for
example MITM, blind attacker etc.
Does anyone have pointers on the subject, maybe a paper that
summarizes the capabilities of various attackers.

Thank you,
Efi

Top

Re: A paper on Threat model by Malke

Malke
Thu Mar 20 07:15:27 CDT 2008

Efi Merdler wrote:

> Hello,
> I am looking for some information on Internet threat models for
> example MITM, blind attacker etc.
> Does anyone have pointers on the subject, maybe a paper that
> summarizes the capabilities of various attackers.

I'm sure someone does. Start with Google.

Malke
--
MS-MVP
Elephant Boy Computers
www.elephantboycomputers.com
Don't Panic!

Top