December 16, 2017, 05:03:21 AM
Welcome, Guest. Please login or register.

Feds Seize KickassTorrents Domains, Arrest Alleged Owner -- https://goo.gl/FRHbEJ

Author Topic: Suggestions on how to secure Win7?  (Read 1347 times)

Offline r0tati0n

  • Top Hat Member
  • Experienced
  • ********
  • Posts: 223
  • Internets: +21/-4
Suggestions on how to secure Win7?
« on: August 15, 2014, 11:58:49 PM »
Hi yall.

Do you have any suggestions on how to secure a windows 7 so it is more safe in a public environment without deactivating (W)LAN?
Requesting all hints, but specifically network hints.
e.g.: disable ICMP Ping, script kiddie tools cannot find my laptop anymore.
I'd like to have Augmentations.

Offline R4v3N

  • Administrator
  • Super Elite
  • *****
  • Posts: 3693
  • Internets: +160/-1
  • The googles and the metasploits...
    • Top-Hat-Sec
Re: Suggestions on how to secure Win7?
« Reply #1 on: August 16, 2014, 06:04:46 AM »
Well this is a challenge, if you stick your device on a bad network then it doesn't really matter how secure your computer is. WIN7 by default should be blocking ICMP ping. What you cant block is an ARP ping. Your router has to send out ARP to communicate with the network so I don't see how your computer would be able to block that and still function. So discovering your windows 7 machine is still going to be possible.

Offline r0tati0n

  • Top Hat Member
  • Experienced
  • ********
  • Posts: 223
  • Internets: +21/-4
Re: Suggestions on how to secure Win7?
« Reply #2 on: August 16, 2014, 07:53:34 AM »
No, my machines are pingable by default.
Perhaps because of home network, but it is not changing to ICMP block in another network.
I'd like to have Augmentations.

Offline 0E 800

  • If something can corrupt you, you're corrupted already.
  • Top Hat Member
  • Elite
  • ********
  • Posts: 961
  • Internets: +154/-0
  • ??? ???????? ?s ?? ??c?c??-???
Re: Suggestions on how to secure Win7?
« Reply #3 on: August 16, 2014, 12:58:03 PM »
i would think that once someone has compromised your network then its your firewall and local browser plugins that will determine what the attacker is able to see going out and coming in from the web. If you use java or flash or download 'free' software then its really pointless to be worried about malware. be bold. if you just dont want anyone to be able to access your data then make sure all sensitive data is encrypted and compressed with encryption and renamed to a common system filename or keep it all stored on a usb drive surrounded by lead and buried deep. you give up your sencitive data willingly all the time and trust the doctors and banks and creditcard companies and gas stations to keep that data secure but its out now. i fail to see why anyone would be concerned with people stealing their data unless they keep child pornography or confidential information or just like to pretend they are james bond. anyone serious about security would not have or store any sensitive data on a device with wireless capabilities or connected to the web. above statement is my opinion and i am not a professional
"He who passes not his days in the realm of dreams is the slave of the days."

ch3rn0byl

  • Guest
Re: Suggestions on how to secure Win7?
« Reply #4 on: August 16, 2014, 07:58:47 PM »
Honestly man,,,there is really NO way of making your box secure. If someone wants you, they will get you, of course depending on his level of skill. But if he is over level 9000, then you are going to get the shaft. The only way to be 'secure' is to not be on a network really, unless they are in the nsa and is capable of retrieving your data through radio freq's ;) Anyhow, what you're asking is not really possible :o

Offline Persistence

  • Top Hat Member
  • Enthusiast
  • ********
  • Posts: 68
  • Internets: +9/-1
  • listen and learn then hack
Re: Suggestions on how to secure Win7?
« Reply #5 on: August 16, 2014, 08:25:39 PM »
He is right there is a built in flaw in arp (forget its name) here is an extract that sort of explains the issue but I'm sure others here will have better info, so you see at present on standard networks if somebody wants to eavesdrop and get passwords etc they can depending on skill level and knowledge.


A switched network does not lend itself to sniffing as easily as a  network. It does not broadcast most frames. But the development of switched networks was driven by the need for more bandwidth, not for the need of more secure networks. Still it is much more secure that  network and there is no reason those days to use anything but switched networks. Although sniffing is more difficult, it is not impossible and several methods are available to sniff switched networks:

ARP Spoofing. One of the basic operations of the Ethernet protocol revolves around ARP (Address Resolution Protocol) requests and replies. In general, when Node A wants to communicate with Node C on the network, it sends an ARP request. Node C will send an ARP reply which will include the MAC address. Even in a switched environment, this initial ARP request is sent in a broadcast manner. It is possible for Node B to craft and send an unsolicited, fake ARP reply to Node A. This fake ARP reply will specify that Node B has the MAC address of Node C. Node A will unwittingly send the traffic to Node B since it professes to have the intended MAC address. There are tools that care cable of doing this automatically sending fake ARP replies to classes of machines (i.e., NFS servers, HTTP servers, etc). One such tool is sniff5 and it works well to sniff for specific types of traffic. Other tools listen for the general ARP request and send the fake ARP reply at that time. The parasite4 program falls into this category and it serves well to sniff the entire network. For this type of attack to work, we need the ability to forward on the frames we receive to their intended host. This is most commonly achieved through some type of IP forwarding, either at the kernel or application level.
MAC Flooding. Since switches are responsible for setting up the virtual circuits from one node to another, they must keep a translation table that tracks which addresses (specifically, which MAC addresses) are on which physical port. The amount of memory for this translation table is limited. This fact sometimes allows the switch to be exploited by flooding the translation table. Primitive switches, not knowing how to handle the excess data, will 'fail open'. That is, it will revert to a hub and will broadcast all network frames to all ports. At this point generic network sniffers will work.
MAC Duplicating. It's not difficult to imagine that, since all frames on the network are routed based on their MAC address, that the ability to impersonate another host would work to our advantage. That's just what MAC duplicating does. You reconfigure Node B to have the same MAC address as the machine whose traffic you're trying to sniff. This differs from ARP Spoofing because, in ARP Spoofing, we are 'confusing' the host by poisoning it's ARP cache. In a MAC Duplicating attack, we actually confuse the switch itself into thinking two ports have the same MAC address. Since the data will be forwarded to both ports, no IP forwarding is necessary.

Custom Hayabusa's Rule
and so does Linux/Metasploit/THS

Offline IdkImw

  • Top Hat Member
  • Enthusiast
  • ********
  • Posts: 65
  • Internets: +5/-0
Re: Suggestions on how to secure Win7?
« Reply #6 on: August 28, 2014, 08:17:28 AM »
There is the CIS benchmark guide which lists some settings which you can configure.. There's one for Windows 7.

https://benchmarks.cisecurity.org/downloads/latest/