<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/"
    xmlns:wfw="http://wellformedweb.org/CommentAPI/"
    xmlns:dc="http://purl.org/dc/elements/1.1/"
    xmlns:atom="http://www.w3.org/2005/Atom"
    xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
    xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
    >
<channel>
    <title>Comments for SANS Computer Forensic Investigations and Incident Response</title>
    <atom:link href="http://computer-forensics.sans.org/blog/comments/feed" rel="self" type="application/rss+xml" />
    <link>http://computer-forensics.sans.org/blog</link>
    <description>SANS Computer Forensic Investigations and Incident Response Blog</description>
    <lastBuildDate>Wed, 22 May 2013 5:39:39 +0000</lastBuildDate>
    <language>en</language><item><title>Comment on Protecting Privileged Domain Accounts:  LM Hashes -- The Good, the Bad, and the Ugly by Mike Pilkington</title><link>http://computer-forensics.sans.org/blog/2012/02/29/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/comment-page-1/#comment-15407</link><dc:creator>Mike Pilkington</dc:creator><pubDate>Fri, 17 May 2013 19:35:06 +0000</pubDate><description><![CDATA[Hi Curious,That is true, pass-the-hash is extremely effective and once an attacker is in the environment and has the hashes, then they can mostly get where they want to with them.  There are some tools though that need the actual password.  For example, from the outside, a password is often all that is necessary to login to client VPN gateways or webmail.  Since the LM hash is so simple to reverse to get the password, a stolen LM hash becomes an issue not only from the inside (via pass-the-hash), but also the outside since it can effectively be turned into the password.All that said, it's really become a moot point with the discovery of passwords in memory by Benjamin Delpy, implemented in his tool mimikatz.  We can now dump the password just as easily as the LM hashes.  So at this point, I'd consider this information about LM hashes mostly an FYI regarding yet another way our credentials are exposed with an interactive logon.Thanks,Mike]]></description><content:encoded><![CDATA[Hi Curious,That is true, pass-the-hash is extremely effective and once an attacker is in the environment and has the hashes, then they can mostly get where they want to with them.  There are some tools though that need the actual password.  For example, from the outside, a password is often all that is necessary to login to client VPN gateways or webmail.  Since the LM hash is so simple to reverse to get the password, a stolen LM hash becomes an issue not only from the inside (via pass-the-hash), but also the outside since it can effectively be turned into the password.All that said, it's really become a moot point with the discovery of passwords in memory by Benjamin Delpy, implemented in his tool mimikatz.  We can now dump the password just as easily as the LM hashes.  So at this point, I'd consider this information about LM hashes mostly an FYI regarding yet another way our credentials are exposed with an interactive logon.Thanks,Mike]]></content:encoded></item><item><title>Comment on Protecting Privileged Domain Accounts:  LM Hashes -- The Good, the Bad, and the Ugly by Mike Pilkington</title><link>http://computer-forensics.sans.org/blog/2012/02/29/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/comment-page-1/#comment-15407</link><dc:creator>Mike Pilkington</dc:creator><pubDate>Fri, 17 May 2013 19:35:06 +0000</pubDate><description><![CDATA[Hi Curious,That is true, pass-the-hash is extremely effective and once an attacker is in the environment and has the hashes, then they can mostly get where they want to with them.  There are some tools though that need the actual password.  For example, from the outside, a password is often all that is necessary to login to client VPN gateways or webmail.  Since the LM hash is so simple to reverse to get the password, a stolen LM hash becomes an issue not only from the inside (via pass-the-hash), but also the outside since it can effectively be turned into the password.All that said, it's really become a moot point with the discovery of passwords in memory by Benjamin Delpy, implemented in his tool mimikatz.  We can now dump the password just as easily as the LM hashes.  So at this point, I'd consider this information about LM hashes mostly an FYI regarding yet another way our credentials are exposed with an interactive logon.Thanks,Mike]]></description><content:encoded><![CDATA[Hi Curious,That is true, pass-the-hash is extremely effective and once an attacker is in the environment and has the hashes, then they can mostly get where they want to with them.  There are some tools though that need the actual password.  For example, from the outside, a password is often all that is necessary to login to client VPN gateways or webmail.  Since the LM hash is so simple to reverse to get the password, a stolen LM hash becomes an issue not only from the inside (via pass-the-hash), but also the outside since it can effectively be turned into the password.All that said, it's really become a moot point with the discovery of passwords in memory by Benjamin Delpy, implemented in his tool mimikatz.  We can now dump the password just as easily as the LM hashes.  So at this point, I'd consider this information about LM hashes mostly an FYI regarding yet another way our credentials are exposed with an interactive logon.Thanks,Mike]]></content:encoded></item><item><title>Comment on Protecting Privileged Domain Accounts:  LM Hashes -- The Good, the Bad, and the Ugly by Curious</title><link>http://computer-forensics.sans.org/blog/2012/02/29/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/comment-page-1/#comment-15392</link><dc:creator>Curious</dc:creator><pubDate>Wed, 15 May 2013 20:14:20 +0000</pubDate><description><![CDATA[Forgive my ignorance, but if the hash has been obtained, then couldn't the attacker just use a pass-the-hash attack to gain access?  Then it wouldn't matter if the hash was LM or NT, credentials have still been obtained.]]></description><content:encoded><![CDATA[Forgive my ignorance, but if the hash has been obtained, then couldn't the attacker just use a pass-the-hash attack to gain access?  Then it wouldn't matter if the hash was LM or NT, credentials have still been obtained.]]></content:encoded></item><item><title>Comment on Protecting Privileged Domain Accounts:  LM Hashes -- The Good, the Bad, and the Ugly by Curious</title><link>http://computer-forensics.sans.org/blog/2012/02/29/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/comment-page-1/#comment-15392</link><dc:creator>Curious</dc:creator><pubDate>Wed, 15 May 2013 20:14:20 +0000</pubDate><description><![CDATA[Forgive my ignorance, but if the hash has been obtained, then couldn't the attacker just use a pass-the-hash attack to gain access?  Then it wouldn't matter if the hash was LM or NT, credentials have still been obtained.]]></description><content:encoded><![CDATA[Forgive my ignorance, but if the hash has been obtained, then couldn't the attacker just use a pass-the-hash attack to gain access?  Then it wouldn't matter if the hash was LM or NT, credentials have still been obtained.]]></content:encoded></item><item><title>Comment on Tools for Examining XOR Obfuscation for Malware Analysis by Thomas</title><link>http://computer-forensics.sans.org/blog/2013/05/14/tools-for-examining-xor-obfuscation-for-malware-analysis/comment-page-1/#comment-15387</link><dc:creator>Thomas</dc:creator><pubDate>Tue, 14 May 2013 16:42:31 +0000</pubDate><description><![CDATA[You may also find this tool interesting: https://github.com/tomchop/unxor/It may be shameless advertising, but I might as well share a tool I made :-)]]></description><content:encoded><![CDATA[You may also find this tool interesting: https://github.com/tomchop/unxor/It may be shameless advertising, but I might as well share a tool I made :-)]]></content:encoded></item><item><title>Comment on Tools for Examining XOR Obfuscation for Malware Analysis by Thomas</title><link>http://computer-forensics.sans.org/blog/2013/05/14/tools-for-examining-xor-obfuscation-for-malware-analysis/comment-page-1/#comment-15387</link><dc:creator>Thomas</dc:creator><pubDate>Tue, 14 May 2013 16:42:31 +0000</pubDate><description><![CDATA[You may also find this tool interesting: https://github.com/tomchop/unxor/It may be shameless advertising, but I might as well share a tool I made :-)]]></description><content:encoded><![CDATA[You may also find this tool interesting: https://github.com/tomchop/unxor/It may be shameless advertising, but I might as well share a tool I made :-)]]></content:encoded></item><item><title>Comment on Tools for Examining XOR Obfuscation for Malware Analysis by Thomas</title><link>http://computer-forensics.sans.org/blog/2013/05/14/tools-for-examining-xor-obfuscation-for-malware-analysis/comment-page-1/#comment-15387</link><dc:creator>Thomas</dc:creator><pubDate>Tue, 14 May 2013 16:42:31 +0000</pubDate><description><![CDATA[You may also find this tool interesting: https://github.com/tomchop/unxor/It may be shameless advertising, but I might as well share a tool I made :-)]]></description><content:encoded><![CDATA[You may also find this tool interesting: https://github.com/tomchop/unxor/It may be shameless advertising, but I might as well share a tool I made :-)]]></content:encoded></item><item><title>Comment on Tools for Examining XOR Obfuscation for Malware Analysis by Thomas</title><link>http://computer-forensics.sans.org/blog/2013/05/14/tools-for-examining-xor-obfuscation-for-malware-analysis/comment-page-1/#comment-15387</link><dc:creator>Thomas</dc:creator><pubDate>Tue, 14 May 2013 16:42:31 +0000</pubDate><description><![CDATA[You may also find this tool interesting: https://github.com/tomchop/unxor/It may be shameless advertising, but I might as well share a tool I made :-)]]></description><content:encoded><![CDATA[You may also find this tool interesting: https://github.com/tomchop/unxor/It may be shameless advertising, but I might as well share a tool I made :-)]]></content:encoded></item><item><title>Comment on Case Leads:  Zero Day Trading, Decrypting iPhones, Calculating AppID's for Jumplists and more. by Tom Yarrish</title><link>http://computer-forensics.sans.org/blog/2013/05/13/case-leads-zero-day-trading-decrypting-iphones-calculating-appids-for-jumplists-and-more/comment-page-1/#comment-15382</link><dc:creator>Tom Yarrish</dc:creator><pubDate>Mon, 13 May 2013 02:09:14 +0000</pubDate><description><![CDATA[Um, it's Brian Baskin, not Basken...(you having Lee spell check for you again Mark? :)  )]]></description><content:encoded><![CDATA[Um, it's Brian Baskin, not Basken...(you having Lee spell check for you again Mark? :)  )]]></content:encoded></item><item><title>Comment on Digital Forensics Reporting: CaseNotes Walkthrough/Review by Tom G</title><link>http://computer-forensics.sans.org/blog/2010/08/19/digital-forensics-reporting-casenotes-walkthroughreview/comment-page-1/#comment-15377</link><dc:creator>Tom G</dc:creator><pubDate>Sat, 11 May 2013 20:22:08 +0000</pubDate><description><![CDATA[Maybe someone can help me. I tried this tool but for archiving purposes, I can't find the case files. If I open an existing case the Open-Dialog directs to the folder: C:\\Program Files\\QCC\\CaseNotesBut if I use the file explorer this folder doesn't contain any case files.Where are they?Thanks,   Tom]]></description><content:encoded><![CDATA[Maybe someone can help me. I tried this tool but for archiving purposes, I can't find the case files. If I open an existing case the Open-Dialog directs to the folder: C:\\Program Files\\QCC\\CaseNotesBut if I use the file explorer this folder doesn't contain any case files.Where are they?Thanks,   Tom]]></content:encoded></item></channel></rss>