Danger Sampei Nihira Security Config WinXP (POS Ready2009) 2020

[Sampei Nihira]

Interestimg approach, anyway rundll32.exe as abused process is old news.

Off topic: are you French (coz I am)? Because most of your links are French stuff.

I'm Italian.

 

[Sampei Nihira]

I would like to bring this 3D to your attention:

Mimikatz in the Wild: Bypassing Signature-Based Detections Using the “AK47 of Cyber”

Mimikatz in the Wild: Bypassing Signature-Based Detections Using the “AK47 of Cyber” April 4, 2019...

www.wilderssecurity.com

 

[ForgottenSeer 823865]

I would like to bring this 3D to your attention:

Mimikatz in the Wild: Bypassing Signature-Based Detections Using the “AK47 of Cyber”

Mimikatz in the Wild: Bypassing Signature-Based Detections Using the “AK47 of Cyber” April 4, 2019...

www.wilderssecurity.com

Any malware can bypass signature if properly obfuscated and encrypted, make them fileless, signed and it is guaranteed to bypass.

About Mimikatz and lsass.exe, if you use a true anti-exploit or a soft protecting lsass.exe memory space like Appguard or the Excubit tool (forgot its name), you should be ok. However this is out if reach of most anti-exe (ERP, OSA, etc...) since they don't have any in-memory process protection (preventing lsass.exe or other processes to be read or modified).

This kind of attacks is the perfect example of anti-exe limitations, they are excellent at blocking malicious parent-child processes but it stop there. You can't just rely solely on them if you want them as main security tool (you need an anti-exploit alongside, i told this since ages).

 

[Andy Ful]

Sampei Nihira,
Did you make a comparison of PaleMoon safety to other possible web browsers like K-Meleon, Maxthon 5, or Opera (ver. 36)? All are still patched for security on Windows XP.

 

[Sampei Nihira]

Sampei Nihira,
Did you make a comparison of PaleMoon safety to other possible web browsers like K-Meleon, Maxthon 5, or Opera (ver. 36)? All are still patched for security on Windows XP.

Stay away from Maxthon especially for privacy reasons.
Roytam1 develops an XP version of K-Meleon but has inferior functionality to New Moon as you well know.
I don't know anyone who still uses Opera36 with XP.
He gave me several problems, a few years ago.

 

[Sampei Nihira]

Any malware can bypass signature if properly obfuscated and encrypted, make them fileless, signed and it is guaranteed to bypass.

About Mimikatz and lsass.exe, if you use a true anti-exploit or a soft protecting lsass.exe memory space like Appguard or the Excubit tool (forgot its name), you should be ok. However this is out if reach of most anti-exe (ERP, OSA, etc...) since they don't have any in-memory process protection (preventing lsass.exe or other processes to be read or modified).

This kind of attacks is the perfect example of anti-exe limitations, they are excellent at blocking malicious parent-child processes but it stop there. You can't just rely solely on them if you want them as main security tool (you need an anti-exploit alongside, i told this since ages).

The purpose of 3D on Wilders,from post 6 onwards, is prevention, as usual.
The attacker's aim is to appropriate our Lsass.dmp.
Our aim is to block the creation of this file in our pc.
Those who have read 3D have understood that there are various ways and systems to do this.

I with my Windows XP have prevented all possible methods for creating the file minus one, Process Explorer.

The method with P.E. was highlighted by me.

I do not think it is appropriate to waste time with P.E. in my OS.
If you want I can explain the reason.

Although an OS W.10 protects upstream from this type of attack, I believe that it is beneficial for Wilders and MT members to carry out some tests.

Which unfortunately only me and itman did.

 

[ForgottenSeer 823865]

I will tell you honestly, 90% of the discussions in security forums (especially on Wilders, where it involve just a handful of people) are more theoretical than practical.
It is like debating about the result of a meteor impact on Earth.

Those who have read 3D have understood that there are various ways and systems to do this.

Which after i quickly read, seems to involve the abuse of lsass.exe, which can be easily prevented by in-memory protection kind of software (unless i overlooked something while quickly reading)

 

[Sampei Nihira]

@ to All

The abuse of lsass.exe in creating the dump file with an OS W.10 is mitigated by the OS itself.
I believe in most cases, for what I recommend you check.

In an OS W.XP such abuse must be blocked in the sequence of events that can lead to the success of the attacker.
In my OS I just did this, I ran several tests.

 

[Andy Ful]

Stay away from Maxthon especially for privacy reasons.
...

Yes, there were some issues in the year 2016, for example:

Chinese browser Maxthon grants admin rights to malware: researchers · TechNode

The company positioned its browser as being secure and private following the 2013 Edward Snowden scandal.

technode.com

Honestly, I read far worse things about Google Chrome, Avast, etc. Furthermore, I could not find anything suspicious about it after the year 2016 (the company is in the US). It looks like the safest browser for Windows XP and Vista (except maybe the PaleMoon).

Best Most Secure And Safest Browser in 2020 – PrivacySniffs

privacysniffs.com

The cons are the extensions made by unknown people. So, I would rather use the Adguard DNS, or another safe DNS.

 

[Sampei Nihira]

Yes, there were some issues in the year 2016, for example:

Chinese browser Maxthon grants admin rights to malware: researchers · TechNode

The company positioned its browser as being secure and private following the 2013 Edward Snowden scandal.

technode.com

Honestly, I read far worse things about Google Chrome, Avast, etc. Furthermore, I could not find anything suspicious about it after the year 2016 (the company is in the US). It looks like the safest browser for Windows XP and Vista (except maybe the PaleMoon).

Best Most Secure And Safest Browser in 2020 – PrivacySniffs

privacysniffs.com

The cons are the extensions made by unknown people. So, I would rather use the Adguard DNS, or another safe DNS.

Look at this old 3D:

Spoofing Firefox 53 (and newer versions) on Windows 2000 and XP

msfn.org

see my post.
Using a browser also means having functionality.

P.S. Pale Moon ranks better than Maxthon in you article.

 

[Sampei Nihira]

The Mimikatz discussion on the Wilders forum has ended.
The result for my security configuration, with one exception (P.E.), ended positively.

I hope the

@MT Security Staff

will reevaluate their assessment.
A kind of exception that confirms your rules.

With best regards.


P.S. This my pleading is very little, compared to Humphrey Bogart's final pleading in the movie:

Knock on Any Door - Wikipedia

en.wikipedia.org

 

[ForgottenSeer 823865]

@MT Security Staff

will reevaluate their assessment.
A kind of exception that confirms your rules.

With best regards.

Don't hope too much, the actual rules are less strict than the ones I enforced when I was in charge of the security config section.
So I don't see any exceptions being made for you. The tags aren't only made to rate your config, but also to inform other members about replicating it.
Those tags aren't considering the user skills or workarounds but only the items used.
XP is vulnerable, so risky is your config.

 

[Sampei Nihira]

Don't hope too much, the actual rules are less strict than the ones I enforced when I was in charge of the security config section.
So I don't see any exceptions being made for you. The tags aren't only made to rate your config, but also to inform other members about replicating it.
Those tags aren't considering the user skills or workarounds but only the items used.
XP is vulnerable, so risky is your config.

I don't hope.
The ending of the film, which I have seen, and I have brought to attention is clear.
If you ask yourself "then why?"

I will answer you, if you can find that film, see it and you will know it.

 

[Andy Ful]

I think that it would be much easier to protect a Vista computer.

1. Stronger design.
2. The security patches are still available (manually via Server 2008).
3. This is a rarely used Windows version.
4. You can use Comodo Firewall or any AV + H_C to lock/unlock the computer in a few minutes.

1. Windows XP (for advanced swimmers only) :

2. Windows Vista (rarely used):

3. Windows 7:

 

[Outpost]

@MT Security Staff
will reevaluate their assessment.

But what are you interested in their assessment? The thing that should matter most to you is only one: you have been using your configuration for years, over time you have improved and mastered it. In all this time no virus or anything has ever gone through it. So for you (which you know how to use very well) it is more than good. That's all that matters.

 

[bribon77]

the actual rules are less strict than the ones I enforced when I was in charge of the security config section.

I remember it, and the Umbra seal of approved.

 

[Sampei Nihira]

I think that it would be much easier to protect a Vista computer.

1. Stronger design.
2. The security patches are still available (manually via Server 2008).
3. This is a rarely used Windows version.
4. You can use Comodo Firewall or any AV + H_C to lock/unlock the computer in a few minutes.

1. Windows XP (for advanced swimmers only) :
View attachment 232414


2. Windows Vista (rarely used):
View attachment 232415


3. Windows 7:
View attachment 232416

Kon Tiki in the year 1947 crossed the Pacific to arrive Polynesia:

Kon-Tiki expedition - Wikipedia

en.wikipedia.org

 

[Sampei Nihira]

But what are you interested in their assessment? The thing that should matter most to you is only one: you have been using your configuration for years, over time you have improved and mastered it. In all this time no virus or anything has ever gone through it. So for you (which you know how to use very well) it is more than good. That's all that matters.

I think it's a matter of justice.
But if I have to be honest I don't know it well.
It is as if something is not in the right place.

I have read of Security Configurations that use W.10 which may be more at risk than mine.

 

[Outpost]

Kon Tiki in the year 1947 crossed the Pacific to arrive Polynesia:

"Amateurs built the Ark and it was the professionals that built the Titanic"

I think it's a matter of justice...

...I have read of Security Configurations that use W.10 which may be more at risk than mine.

I see. I feel the same way.

 

[Sampei Nihira]

I solved the Mimikatz dump lsass.exe problem with Process Explorer.

You won't believe it but the idea came to me before I fell asleep.

I entered a general blocking rule for Process Explorer.
At the same time, an exception to my Process Explorer path was added.

The mitigations in this case are so varied that any attack would be impossible.

- P.E. works only in my path.

- The latest versions of P.E. although they start in W.XP they malfunction, an attacker will hardly be able to know because the "systeminfo" command does not work in W.XP.
And even if it works in OSA there is a specific rule.