General Security and Encryption Questions

Hello everyone, this is my first time on this forums and I have a list of some questions I would like to ask this community, because I cannot seem to find my answers online (Google).

** If possible... I would like most (if not all) of my questions below answered before the end of the 1st week of January 2012.

I'm trying to create a more secure environment for my PC and personal data to prevent any hackers from accessing my data.
Some things I am doing to better secure myself:
-- Desktop computer (not mobile... so no worries about Hard access)
-- Clean OS install
-- Using Norton Internet Security 2012 (w/ custom security settings)
-- Using Windows XP Pro (SP3)
-- Using a Limited User account at all times (prevent system access)
-- Disable (completely) Guest account through register/group permission tweaks
-- Disable all windows remote access services
-- Disable other windows services with known exploitations
-- Using TrueCrypt encryption to encrypt my entire OS partition so no temporary data written to HDD is left unencrypted.
-- Using TrueCrypt encryption (and Windows XP built-in encryption) to secure Swap/Page partition.
-- NO dual boot system (just how TrueCrypt prefers it for system encryption I guess...)

Now... here are the questions:
#1) I have also disabled the CMD (command-prompt) program from being accessed from my limited user account. Is it still possible for "remote" hackers to still load viruses onto my system (with SYSTEM level access) without access to the command line?

#2) I have also disabled the RUN command line (through admin group permissions) from the START menu for the limited user account... does this help prevent any "remote" hackers from gaining SYSTEM level access?

#3) I will be using a completely sandboxed browser (like Dell KACE Secure Browser) to better protect myself. Does anyone know if malicious programs/viruses can still get through this line of defense?

#4) Is a "remote" hacker still able to gain SYSTEM level access with all the precautions taken above?

#5) I know all data on raw RAM is left unencrypted (including the encryption key). If a hacker is able to gain SYSTEM level access and leave a Rootkit on my system... will he be able to read Memory Dump data WHILE the OS is still running?

#6) Are there any other precautions I should know about to better protect myself and PREVENT viruses from gaining access to my system in the first place?

Again, I would like most (if not all) of these questions answered before the end of the 1st week of January 2012.

Thanks in advance!

Arrrggggg!

All three of your posts suggest you wish to learn "Computer Security" in one quick post.

You mentioned:
Norton Security
tor
TrueCrypt
Secure Browser (from Dell - Really?)

Raw RAM - I think you must have read something on COFFEE. /me thinks you should read up on DECAFE

You asked about router security settings and settings on a AT&T U-Verse Router.

Most of all you requested tutorials, answers by the 1st week of January.

HAHAHAHAHAHAHHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHHHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHHAHAHAHAHA

You want it WHEN?

He wants it before his teacher says he needs to turn it in lol. Duh.

Seriously though; I saw this earlier, and I was contemplating replying to ask WTF he was on and where I could get it, but I decided not too considering how the thread I was talking about SGI in went. I didn't feel like defending one of those "Damn I'm tired and I can't sleep because my back hurts to much to lay down" days where you've been up for so long you're actually hallucinating and **** lol.

I don't quite get why anyone would make a huge post like this, and then start saying things like "Am I secure if I do this? How do I do this? And I need it by this time frame" it's like WTF are you kidding me??? If you want a Professor style answer, pay me tuition and I'll open gore's haxx0r school again. lol.

Quote:

---

Originally Posted by dredogol

Again, I would like most (if not all) of these questions answered before the end of the 1st week of January 2012.

---

Damn! Since when is there an SLA on forum postings?

yip, this post made me lulz.

That's why I left it ;)

While I respect the fact that you are willing to learn about these things....for the most part, none of them will help you.....you need a far greater understanding, and respect, of how attacks and exploits work from a....."Darker" perspective.....good luck on your quest young grasshoppa!

;-)

Let's keep it on topic folks. :spit:


Tis the season of giving, so let's give the poor kid all the "Correct" answers ;)

I mean we wouldn't want him to get in trouble would we.... :drink:

The "correct" answer is: "Yeah, boot BSD or Linux" :cool::D:lildevil:

Seriously though, "Windows XP SP3" ???????????? that is very outdated, so upgrading to Windows 7 would be a security improvement. Windows XP was released in 2001 and obviously its core development took place before then. The service packs are mostly comprised of security patches and bug fixes, although SP3 did make it more SATA aware.

Windows 7 is pretty good in that it doesn't actually let you run as administrator even though you log in to an admin group account. You have to do it proactively.

No mention of wired or wireless internet connection? wired is more secure IMO in that it eliminates one potential attack vector?

Run Secunia PSI and File Hippo update checker. These will tell you if there are security patches for your OS and applications (Secunia) and updates for other stuff such as security software.

CCleaner to eliminate data remnants and garbage heaps where cybercriminals like to hide their stuff.

Turn off your computer when not using it and/or disable internet connectivity when not needed. If you aren't there you cannot be seen or attacked, and, if your computer isn't always on, it presents less of a time window of opportunity.

Quote:

---

Originally Posted by nihil

The "correct" answer is: "Yeah, boot BSD or Linux" :cool::D:lildevil:

Seriously though, "Windows XP SP3" ???????????? that is very outdated, so upgrading to Windows 7 would be a security improvement. Windows XP was released in 2001 and obviously its core development took place before then. The service packs are mostly comprised of security patches and bug fixes, although SP3 did make it more SATA aware.

Windows 7 is pretty good in that it doesn't actually let you run as administrator even though you log in to an admin group account. You have to do it proactively.

No mention of wired or wireless internet connection? wired is more secure IMO in that it eliminates one potential attack vector?

Run Secunia PSI and File Hippo update checker. These will tell you if there are security patches for your OS and applications (Secunia) and updates for other stuff such as security software.

CCleaner to eliminate data remnants and garbage heaps where cybercriminals like to hide their stuff.

Turn off your computer when not using it and/or disable internet connectivity when not needed. If you aren't there you cannot be seen or attacked, and, if your computer isn't always on, it presents less of a time window of opportunity.

---

Thanks for the "positive" reply nihil.
I'm just using XP because it's "cheaper", and it's what I have ATM... I know I should upgrade to Win7.
I'm on a wired connection... I do use Secunia PSI... I do use CCleaner... I do keep my PC off when I don't use it.
I'm trying to see what are all the options out there to better protect my system without using a gateway computer (don't have a spare one to setup network).

One of my main concerns, is weather or not the CMD / Run does anything.
I've never written any programs which directly manipulates the kernel or cause escalated privileges without the CMD.

Quote:

---

One of my main concerns, is weather or not the CMD / Run does anything.

---

Probably not as much as you might at first think. What you have done is removed the immediate acess to a utility for a particular user or user group. The utility is still there, and they could probably (?) still run it using a different route.

I may well be wrong, but I would normally associate what you have done with limiting users at the physical access level................ at least with NT 4.0 and Windows 2000 Pro. I am not so sure about XP, and haven't even tried with Vista, W7 or W8.

A few more random thoughts:

1. Rename the administrator account.............. it's hard to find something you don't know the name of? ;)

2. Disable "autorun" .............. it's Microsoft's very own malware installation utility :D

3. Create a backup image and keep it up to date. It's a lot easier to wipe and re-image if the worst happens ;)

4. Possibly total overkill, but you might look at "Deep Freeze" or similar utility? I know there is a free one out there, but I cannot remember its name.

It holds an image of the "clean" system, and re-installs it on reboot. It is used a lot in schools, public libraries and the like, as it automatically kills keyloggers, sniffers and other malware. This works particularly well if you have stroked your hard drive.

Quote:

---

Originally Posted by nihil

2. Disable "autorun" .............. it's Microsoft's very own malware installation utility :D

3. Create a backup image and keep it up to date. It's a lot easier to wipe and re-image if the worst happens ;)

4. Possibly total overkill, but you might look at "Deep Freeze" or similar utility? I know there is a free one out there, but I cannot remember its name.

---

#2 I always do.

#3 I really can't do ATM, because I'm on a RAID-0 machine (not enough spare HDDs... nor is it a big issue to "redo" my installs, because my XP cd is already hot-fixed with the most recently updates. Don't have too many games/programs installed either.

#4 Is that basically the same thing as running a hidden OS and keeping the main running OS in a virtual protected environment?
If that's the case, isn't it still prone to very sophisticated rootkits?

Quote:

---

#4 Is that basically the same thing as running a hidden OS and keeping the main running OS in a virtual protected environment?

---

No, it is a different approach, which is why I suggested "overkill" :D

What happens here is that the user goes and starts the machine and the OS boots up.

They use the machine for whatever, then logoff.

The next user restarts and the application re-images the drive. This is very fast because it is imaging rather than installation.

Your response to #3 is somewhat related, as my imaging solution is one hell of a lot faster than a wipe and reinstall. ;)

I don't know if this is possible in Windows XP, but one thing you may find of interest, is from the FreeBSD world called "Jails" which is pretty easy to work with. PC-BSD has them too since PC-BSD really is just FreeBSD with a paint job, and some customized apps that make it really easy to use, and of course, you don't have to configure a thing from the shell, which people who don't know Unix of course like, and, also, it's got one click installs of software; You don't have to compile anything if you don't want to, and you also don't have to use a Shell to download and install apps at all.

Look into FreeBSD Jails, and Sandboxes... Those are two things I haven't seen mentioned, and I think no one mentioned either because, I don't even know if they exist on Windows XP. You could look though. I mean just because they weren't made for Windows doesn't mean you can't use them; The Source Code for all of it IS available after all. I just don't know if anyone has done this.

Do you have an upgrade path thought out at all yet? Nihil was incredibly right about how you really should try to upgrade to 7. Windows 7 doesn't have the same retarded Admin Account auto log in by default with no password, and it also finally stole the idea of running an application with admin rights as opposed to logging in as admin, and then running it directly from the account, which, Honestly, it's about damn time.

EDIT:

I just saw Nihil's Reply, and I just wanted to point out that, again, he's right, you don't have to worry about it taking forever, since it isn't doing a true Installation, which, really, that would be a total pain in the ass; You'd have to sit there while it installed, and once it did, you'd have one hell of a time trying to get all those updates installed which, all of them need a reboot lol, which is sort of funny because you'd create an infinite loop in a way; You'd reboot to install an update, and that in turn, would start a fresh install. So I guess that's one way of you knowing it isn't doing a fresh install ;)

For simple browsing where speed is not very important I use a virtual machine.
When I'm done I shut it down without saving any changes to the virtual disk.

Okay, I have two more final questions for this thread (might be slightly redundant)...

Is there any point in encrypting a desktop computer (home) when I know no one will have physical access to it?

If my HDD data is encrypted, will a hacker be able to view my data if my system becomes compromised?
(Assume he doesn't use memory dump command to get my key... I'm screwed no matter what if I'm compromised that badly.)

I know encryption is important for laptops in the event they become stolen (physical access)... but I'm not sure about remote access.

Quote:

---

Is there any point in encrypting a desktop computer (home) when I know no one will have physical access to it?

---

I would say not, as it is more of a precaution to protect data in transit. At most I would encrypt files that contain sensitive information.

Quote:

---

If my HDD data is encrypted, will a hacker be able to view my data if my system becomes compromised?

---

Yes. Particularly with encryption that just encrypts the whole drive, then decrypts it when you log on. Obviously, if your machine is stolen, you don't logon and the encryption is still in place.

Quote:

---

Assume he doesn't use memory dump command to get my key

---

I don't know about you, but if that happened on any of my XP boxes I would know about it :D

Anyway, If an attacker can do that you must have already decrypted the drive?

Thanks nihil.
Those answers basically determined how I will be redoing my computer here in a few days. :)

Oh... you're saying it would be better (in my case) to just encrypt a certain (non os partition/folder) of my HDD, and only mount it when in use, or use an external hdd/usb drive.
(though I don't thing Truecrypt supported thumb drives...)

Only problem is, any time I were to access my "secure" data with this method, I would have data leaks on my OS... unless I ran from a Live CD and never write anything to the OS partition or swap file partition.

Quote:

---

Oh... you're saying it would be better (in my case) to just encrypt a certain (non os partition/folder) of my HDD, and only mount it when in use, or use an external hdd/usb drive.
(though I don't thing Truecrypt supported thumb drives...)

---

Yes, that's it, far less overhead if you don't have much confidential data, and you can be selective on a file/folder basis.

I don't know about truecrypt, but I would have thought that it supported USB external drives?

Anyways, your thumb srive should come with security software pre-installed, if not there are loads of free ones available.

Obviously, as soon as you open stuff it becomes available, only less so if you are not connected to the internet.

There is a Registry setting to wipe the pagefile on shutdown. I believe it is only a single pass, but that should be adequate to deter remote attackers.

You might change your dump settings to only allow the minidumps. I don't think that they contain anything confidential?

Quote:

---

Originally Posted by nihil

There is a Registry setting to wipe the pagefile on shutdown. I believe it is only a single pass, but that should be adequate to deter remote attackers.

---

I do that now, and shutdown takes forever since I have 8GB of page...

Oh, did you know during the XP install process, it only does a quick LBA wipe + DiskCheck when you choose 'regular' format right before the OS installs... and not a 1-pass wipe, which is dumb. I think Vista & Win7 both do a proper 1-pass wipe.

Quote:

---

Originally Posted by nihil

You might change your dump settings to only allow the minidumps. I don't think that they contain anything confidential?

---

Oh... was there an option under XP GroupPolicies to restrict that! :confused:

Yep, there was an option in DOS to wipe the drive, then it disappeared until Vista was released. I use DBAN (Darrick's Boot And Nuke) on older systems.


Change dump file size:

<Start>
<Control Panel>
<System>
<Advanced><Startup and Recovery>
<Write Debugging Information>

The options are:

(none)
Small Memory Dump (64KB)
Kernel Memory Dump
Complete Memory Dump

Quote:

---

Originally Posted by dredogol

Oh, did you know during the XP install process, it only does a quick LBA wipe + DiskCheck when you choose 'regular' format right before the OS installs... and not a 1-pass wipe, which is dumb.

---

Correct. Not only during the install though. The format option when Windows XP is booted does the same thing, it does NOT wipe the drive.