News for hackers. Stuff that matters.

A comment on A Hidden Cost of Ransomware: Wholesale Password Theft. Parent comment

Re:A Hidden Cost of Ransomware: Wholesale Password Theft by mox1 on Thursday January 09, 2020 @10:16AM (#22001846)
The "mimikatz" problem (aka memory protections on the lsass.exe process) has basically been solved by Microsoft, they call it "Credential Guard". It works by doing some trusted boot stuff and using the hyper-v hypervisor to protect certain regions of memory from even the OS itself.

It's pretty complicated and requires server 2016 or windows 10. More info here - https://docs.microsoft.com/en-us/windows/security/identity-p...

[ Parent | on HN ]
Re:A Hidden Cost of Ransomware: Wholesale Password Theft by Stierlitz on Thursday January 09, 2020 @10:48AM (#22002132)
@mox1: ‘The "mimikatz" problem (aka memory protections on the lsass.exe process) has basically been solved by Microsoft, they call it "Credential Guard". It works by doing some trusted boot stuff and using the hyper-v hypervisor to protect certain regions of memory from even the OS itself.’

How about running the OS in a Virtual Machine, that evaporates on exit and you get a new clean image on each invocation.

“All the King's horses and all the King's men couldn't put Humpty together again”

[ Parent | on HN ]