Absolutely Chris. If they have Enterprise EnCase, they have complete
control, IF it is a company PC, and IF they have a written policy of no
expected privacy. Barring the Navy case that had a questionable ruling, I
know of no other case that questioned the authority to do that with EnCase.
I have not worked with V6 yet, but V5 has about all the capability I could
ask for.
Curt Purdy CISSP, GSNA, GSEC, CNE, MCSE+I, CCDA
Information Security Officer
Information Systems Security
Columbia, MD
infosysec@gmail.com
purdy@tecman.com
-------------
If you spend more on coffee than on IT security, you will be hacked.
What's more, you deserve to be hacked.
-- former White House cybersecurity czar Richard Clarke
> -----Original Message-----
> From: listbounce@securityfocus.com
> [mailto:listbounce@securityfocus.com] On Behalf Of Chris Zevlas
> Sent: Wednesday, April 11, 2007 4:14 AM
> To: Shreyas Zare; Pen-Testing
> Subject: [lists] Re: Boot floppy
>
> How about you doing a remote image with Encase this way he
> will never know
> what you did.
>
> ----- Original Message -----
> From: "Shreyas Zare" <shreyas@technitium.com>
> To: "Pen-Testing" <pen-test@securityfocus.com>
> Sent: Tuesday, April 10, 2007 10:48 PM
> Subject: Re: Boot floppy
>
>
> > Hi,
> >
> > Try using social engineering. Tell him you are given a job to patch
> > all machines in the company for some security update then patch his
> > machine with a good rootkit. You may give him the update
> (infected) in
> > any CD or USB media so that he would install it himself. Or use any
> > idea which will not look suspicious to the target.
> >
> > Regards,
> >
> > On 4/10/07, Mifa <mifa@stangercorp.com> wrote:
> >> We have a user who takes a company computer home with
> them (no its not a
> >> lap top). We have a good reason to need to look at their files.
> >> However, we want to do so without that employ knowing.
> They seem to know
> >> something about security becasue auto runs is disabled and the
> >> workstation is always locked with a third party software.
> INserting a U3
> >> drive will not run a program either. Are there any
> programs that will
> >> boot from a floppy then copy a program to the c drive then
> wite an auto
> >> start entry into the registry? This was the only way I
> can think of to
> >> get the user to install a program..
> >>
> >> Any other ideas how we maight gain access? It has to be
> fast (bathroom
> >> breaks ect). I dont have time to load a live cd. Further,
> robooting
> >> would cause the user to loose work.
> >>
> >>
> >>
> >>
> --------------------------------------------------------------
> ----------
> >> This List Sponsored by: Cenzic
> >>
> >> Need to secure your web apps?
> >> Cenzic Hailstorm finds vulnerabilities fast.
> >> Click the link to buy it, try it or download Hailstorm for FREE.
> >>
> >>
> http://www.cenzic.com/products_services/download_hailstorm.php
> ?camp=701600000008bOW
> >>
> --------------------------------------------------------------
> ----------
> >>
> >>
> >
> >
> >
> > --
> > (This e-mail was composed and sent completely using
> recycled electrons)
> >
> > Shreyas Zare
> > Co-Founder, Technitium
> > eMail: shreyas@technitium.com
> >
> > ..::< The Technitium Team >::..
> > Visit us at www.technitium.com
> > Contact us at theteam@technitium.com
> >
> > Technitium Personal Computers
> > We belive in quality.
> > Visit http://pc.technitium.com for details.
> >
> >
> --------------------------------------------------------------
> ----------
> > This List Sponsored by: Cenzic
> >
> > Need to secure your web apps?
> > Cenzic Hailstorm finds vulnerabilities fast.
> > Click the link to buy it, try it or download Hailstorm for FREE.
> >
> >
> http://www.cenzic.com/products_services/download_hailstorm.php
> ?camp=701600000008bOW
> >
> --------------------------------------------------------------
> ----------
> >
> >
>
>
>
> --------------------------------------------------------------
> ----------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
>
> http://www.cenzic.com/products_services/download_hailstorm.php
> ?camp=701600000008bOW
> --------------------------------------------------------------
> ----------
>
>
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!
http://www.cenzic.com/c/2020
------------------------------------------------------------------------
|