Danger Sampei Nihira Security Config WinXP (POS Ready2009) 2020

[DDE_Server]

I would not use the Windows firewall I would use Sygate Personal Firewall is the best program I have tried in many years.

If you want good firewall there are two solutions which are knows (sophos and fortigate ).however they are expensive however if I could afford I will by UTM instead

Firewall combjned by other proactive features such as IDS and IPS and central. Management

 

[Sampei Nihira]

What is the point of using old OS with tons of security programs to patch all vulnerabilities when Windows 10 protect computer from vulnerabilities by default?

I also use Windows 10.
At this moment I am at home and I am answering your question from the PC with Windows 10.

You will be surprised to know that there are still users who use Windows 2000,XP, Vista, but also Windows 7 and later OS.
Example my colleague "Win32" on the MSFN forum:

Extreme Explorer 360 Chromium 78-86 General Discussion

Hello. I was looking for internet browsers that still support XP and something caught my eye, a chinese browser called Extreme Explorer 360 (Chrome 360). It was advertised as Chromium 78 based so I decided to give it a try and to my surprise it actually worked. At first I thought that there was a...

msfn.org

 

[oldschool]

You cannot walk far away, so there are greater chances to avoid bad people.

 

[oldschool]

You will be surprised to know that there are still users who use Windows 2000,XP, Vista, but also Windows 7 and later OS.
Example my colleague "Win32" on the MSFN forum:

Extreme Explorer 360 (Chromium 78) - General Discussion

A look over there is like going back in time. These people are serious about their dinosaurs!

 

[ForgottenSeer 72227]

If you want good firewall there are two solutions which are knows (sophos and fortigate ).however they are expensive however if I could afford I will by UTM instead

Firewall combjned by other proactive features such as IDS and IPS and central. Management

You could build your own for much cheaper. If you have an old desktop laying around that you aren't using, you could put something like Sophos XG home, pfsense, etc.. on it and you have yourself a sweet hardware firewall with all those features.

 

[Sampei Nihira]

A look over there is like going back in time. These people are serious about their dinosaurs!

Instead it is a great satisfaction.
For example, I was very happy to have set my I.E.8 as the image below:

How's My SSL?

Even if I never use it.
By the way, we want to discuss the "Session Ticket Support" parameter.
If you pass the test with your browsers it is not always a good thing

 

[Andy Ful]

I would not use the Windows firewall I would use Sygate Personal Firewall is the best program I have tried in many years.

There are some other good solutions. I used to use 3rd party firewalls a few years ago. But in the home environment, the Windows firewall is enough for me.

 

[eonline]

But in the home environment, the Windows firewall is enough for me.

Apart from the fact that that system is no longer supported the firewall of that operating system is really bad, so I suggested that you consider some other option.

 

[DDE_Server]

You could build your own for much cheaper. If you have an old desktop laying around that you aren't using, you could put something like Sophos XG home, pfsense, etc.. on it and you have yourself a sweet hardware firewall with all those features.

Thanks for suggestion

 

[Andy Ful]

Apart from the fact that that system is no longer supported the firewall of that operating system is really bad, so I suggested that you consider some other option.

Ha, ha. You probably confused me with the author of this thread. I use Windows 10.

 

[eonline]

Ha, ha. You probably confused me with the author of this thread

online translator errors.

 

[Prorootect]

Surely you've disabled NetBIOS over TCP/IP (all interfaces)? - and disabled ports 135, 137-139, 445 ... type netstat -an in a command prompt window to look eventually for your opened ports...
- so use "Seconfig XP" v1.1 - small but powerful software by Davis Mosenkovs; download link on Softpedia: Download Seconfig XP 1.1
Good read: How to disable Ports 135, 137-139, 445 (Windows XP): How to disable Ports 135, 137-139, 445 (Windows XP)

 

[ichito]

- so use "Seconfig XP" v1.1 - small but powerful software by Davis Mosenkovs; download link on Softpedia: Download Seconfig XP 1.1

Still on board on my XP as the support of Kerio FW Free 2.1.5...yess...I'm using firewall from 2004 so...could I feel like dinosaur? As already mentioned - there still to get a few firewalls from the past e.g. Kerio, Sygate, Sunbelt, NetVeda SN, Filseclab, Outpost, PCTools, Prvatefirewall or even the last free Online Armor from Tall Emu but nowadyas we have nice firewall that is Free also - SpyShelter Free v.12. It' s for sure worth of attention.

 

[Sampei Nihira]

Surely you've disabled NetBIOS over TCP/IP (all interfaces)? - and disabled ports 135, 137-139, 445 ... type netstat -an in a command prompt window to look eventually for your opened ports...
- so use "Seconfig XP" v1.1 - small but powerful software by Davis Mosenkovs; download link on Softpedia: Download Seconfig XP 1.1
Good read: How to disable Ports 135, 137-139, 445 (Windows XP): How to disable Ports 135, 137-139, 445 (Windows XP)

Look in my configuration.
System Utilities - WWDC
Windows Worms Doors Cleaner
If you search on the net do in part what you wrote

 

[ForgottenSeer 823865]

To be honest I don't see, in my case, what a 3rd party firewall afford more than Windows Firewall, pop-up alert when outbound connection is created? No need, I block all outbound connections at fitst then create manually my own rules.

 

[ForgottenSeer 823865]

How to find it then

You can't by normal means. Maybe via a corporate firewall that has IPS/IDS or by dll monitoring.
I remember a "colleague" , showing me in real time how to evade AVs using obfuscated Mimikatz. The initial detection was originally like 15+ engines detecting it, and just by changing mimikatz attributes, it gradually went to zero detection... If I remember ESET was the last one.
Now couple it with true fileless/in-memory delivery techniques or a kernel exploit and your traditional security softs whatever awesome default-deny or AV will fail.
Why do you think corporations invest in very expensive business solutions (which are often hardware based)? And even with them, they still get breached. So I laugh when some home users products claimed to stop all malwares when basic true exploits are just enough to beat them...Yes they may stop your ordinary malware, not the complex ones like I saw.

Of course you won't see such stuff around every corner, some will say, they will never cross them (which is probably true), but we aren't in a security forum for Average Joe threats, we are here to learn how about sophisticated ones and how to protect ourselves against them.

 

[Andy Ful]

In-memory Mimikatz can be delivered filelessly via PowerShell (Invoke-Mimikatz.ps1). It can be obfuscated to avoid AV detection. It can be dangerous for enterprises. In the home environment, any true fileless malware must be started by the exploit which makes it far less possible than in enterprises, except when someone uses vulnerable (not patched) system/software.

 

[Sampei Nihira]

I don't have the Powershell "problem".
And Mimikatz creates more problems for your OS after XP.
The attacker is hardly inclined to consider the 32-bit compromised PC.

 

[Andy Ful]

I don't have the Powershell "problem".
And Mimikatz creates more problems for your OS after XP.
The attacker is hardly inclined to consider the 32-bit compromised PC.

I know. You even do not have PowerShell installed.
Mimikatz works on Windows XP. The exploit kit does not consider anything - it will attack any vulnerable system if only the right module is available.
Anyway, my post was related to the @Umbra post. Both were not related to your config, but they had a rather general meaning.

 

[Sampei Nihira]

I know. You even do not have PowerShell installed.
Mimikatz works on Windows XP. The exploit kit does not consider anything - it will attack any vulnerable system if only the right module is available.
Anyway, my post was related to the @Umbra post. Both were not related to your config, but they had a rather general meaning.

Yes, but I would like to broaden the discussion since Umbra mentioned it.
I know Mimikatz works on Windows XP.
Even on a compromised Windows XP it could even silently install Powershell 2.

If there is someone who is interested in the discussion, he can refer to the 3D below:

Current state of malicious Powershell script blocking

The above posting leads into something I have been "pondering." How about Microsoft via Windows Defender Exploit Guard create mitigation policies in...

www.wilderssecurity.com

I speak from page 8 but the previous pages are also interesting.
Final conclusion.
In my PC, even in case of compromise of the OS (absurd hypothesis) Mimikatz could not act.