Re: Boot floppy

["Curt Purdy" <purdy () tecman com>]

Absolutely Chris.  If they have Enterprise EnCase, they have complete
control, IF it is a company PC, and IF they have a written policy of no
expected privacy.  Barring the Navy case that had a questionable ruling, I
know of no other case that questioned the authority to do that with EnCase.
I have not worked with V6 yet, but V5 has about all the capability I could
ask for.

Curt Purdy CISSP, GSNA, GSEC, CNE, MCSE+I, CCDA 
Information Security Officer 
Information Systems Security
Columbia, MD
infosysec () gmail com
purdy () tecman com

-------------

If you spend more on coffee than on IT security, you will be hacked. 
What's more, you deserve to be hacked. 
-- former White House cybersecurity czar Richard Clarke 
 

> -----Original Message-----
> From: listbounce () securityfocus com 
> [mailto:listbounce () securityfocus com] On Behalf Of Chris Zevlas
> Sent: Wednesday, April 11, 2007 4:14 AM
> To: Shreyas Zare; Pen-Testing
> Subject: [lists] Re: Boot floppy
>
> How about you doing a remote image with Encase this way he 
> will never know 
> what you did.
>
> ----- Original Message ----- 
> From: "Shreyas Zare" <shreyas () technitium com>
> To: "Pen-Testing" <pen-test () securityfocus com>
> Sent: Tuesday, April 10, 2007 10:48 PM
> Subject: Re: Boot floppy
>
>
> > Hi,
> >
> > Try using social engineering. Tell him you are given a job to patch
> > all machines in the company for some security update then patch his
> > machine with a good rootkit. You may give him the update 
> (infected) in
> > any CD or USB media so that he would install it himself. Or use any
> > idea which will not look suspicious to the target.
> >
> > Regards,
> >
> > On 4/10/07, Mifa <mifa () stangercorp com> wrote:
> > > We have a user who takes a company  computer home with 
> them (no its not a 
> > > lap top).  We have a good reason to need to look at their files. 
> > > However, we want to do so without that employ knowing.  
> They seem to know 
> > > something about security becasue auto runs is disabled and the 
> > > workstation is always locked with a third party software.  
> INserting a U3 
> > > drive will not run a program either.  Are there any 
> programs that will 
> > > boot from a floppy then copy a program to the c drive then 
> wite an auto 
> > > start entry into the registry?  This was the only way I 
> can think of to 
> > > get the user to install a program..
> > >
> > > Any other ideas how we maight gain access?  It has to be 
> fast (bathroom 
> > > breaks ect).  I dont have time to load a live cd. Further, 
> robooting 
> > > would cause the user to loose work.
> --------------------------------------------------------------
> ----------
> > > This List Sponsored by: Cenzic
> > >
> > > Need to secure your web apps?
> > > Cenzic Hailstorm finds vulnerabilities fast.
> > > Click the link to buy it, try it or download Hailstorm for FREE.
> http://www.cenzic.com/products_services/download_hailstorm.php
> ?camp=701600000008bOW
> > >
> --------------------------------------------------------------
> ----------
> > >
> >
> >
> >
> > -- 
> > (This e-mail was composed and sent completely using 
> recycled electrons)
> > Shreyas Zare
> > Co-Founder, Technitium
> > eMail: shreyas () technitium com
> >
> > ..::< The Technitium Team >::..
> > Visit us at www.technitium.com
> > Contact us at theteam () technitium com
> >
> > Technitium Personal Computers
> > We belive in quality.
> > Visit http://pc.technitium.com for details.
> --------------------------------------------------------------
> ----------
> > This List Sponsored by: Cenzic
> >
> > Need to secure your web apps?
> > Cenzic Hailstorm finds vulnerabilities fast.
> > Click the link to buy it, try it or download Hailstorm for FREE.
> http://www.cenzic.com/products_services/download_hailstorm.php
> ?camp=701600000008bOW
> >
> --------------------------------------------------------------
> ----------
> >
>
>
>
> --------------------------------------------------------------
> ----------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
>
> http://www.cenzic.com/products_services/download_hailstorm.php
> ?camp=701600000008bOW
> --------------------------------------------------------------
> ----------


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------