+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Keyloggers (https://hackforums.net/forumdisplay.php?fid=113)
+---- Thread: Have you guys ever used deep-freeze before? (/showthread.php?tid=4515191)
Have you guys ever used deep-freeze before? - Sennheiser - Oct 30, 2014
There is a program on the Internet made by Faronics called deep-freeze. This program is actually very interesting since there are no known bypasses to it, what it does is it every time you start your computer from the moment you activate it, everything resets back to that day or time you activated deep-freeze. What is the benefit of a program like this? A software like this would be very important since it would completely bulletproof your PC from any viruses or malware, though it is recommended that you clear all your browsing history, cookies, pasturage, or any kind of logins that have been stored before activating deep-freeze. Just wanted to point this out because it is a very cool program if you want to test out other people's rats, or viruses without actually messing up your computer since when it restarts, every single virus or malware or even legitimate files that have been downloaded and installed will have been removed since your PC is technically reinstalled back to that state deep-freeze was activated at that moment.
* - Yoshikage Kira - Oct 30, 2014
The computers at my old library used to use it, pretty damn effective.
* - Kouichi - Oct 30, 2014
This sounds pretty fucking cool. Official site link please.
* - Sennheiser - Oct 30, 2014
(Oct 30, 2014 05:29 PM)Kouichi Wrote: This sounds pretty fucking cool. Official site link please.
http://www.faronics.com/products/deep-freeze/enterprise/
* - Lucifer Morningstar - Oct 31, 2014
The only bot that bypassed deep-freeze was Carberp. It installed a bootkit component which started before any other kernel mode driver(deep freeze was one of them).
You can bypass it if you know how to make your ring0 driver load before ELAM.
But yeah that's the only negative thing that this tool has. I have it setup on my vmbox for testing purposes.
* - Mr. WAVES - Oct 31, 2014
(Oct 31, 2014 03:51 AM)Tx707 Wrote: The only bot that bypassed deep-freeze was Carberp. It installed a bootkit component which started before any other kernel mode driver(deep freeze was one of them).Thank you for this idea!
You can bypass it if you know how to make your ring0 driver load before ELAM.
But yeah that's the only negative thing that this tool has. I have it setup on my vmbox for testing purposes.
I'll use it on my VM, so I'll have a clean on every time I start it!
🤝
* - a323109 - Nov 1, 2014
Quote:Have you guys ever used deep-freeze before?
Not exactly the same but i used to log here a read only filesystem, everything loaded in RAM and everything deleted after reboot. Now i use a read/write filesystem.
* - Sennheiser - Nov 1, 2014
(Nov 1, 2014 08:19 AM)a323109 Wrote: Not exactly the same but i used to log here a read only filesystem, everything loaded in RAM and everything deleted after reboot. Now i use a read/write filesystem.
wat?
idk files could easily rewrite those permissions couldn't they?
* - Jagster™ - Nov 1, 2014
erm I would bet many rootkits can by-pass this
* - Sennheiser - Nov 1, 2014
(Nov 1, 2014 03:15 PM)Jagster™ Wrote: erm I would bet many rootkits can by-pass this
how?
running df is like running a vm
how can a root kit get outside of that vm
knowing there is no shared drives to host computer or any way to infect it as you can't connect to its main ip
* - a323109 - Nov 2, 2014
(Nov 1, 2014 11:38 AM)Sennheiser Wrote: wat?
idk files could easily rewrite those permissions couldn't they?
And so what?
Everything is RAM, they change permissions, i reboot -> problem end
#Edit
I gave a look to .idk files http://pcsupport.about.com/od/fileextensions/f/idk-file.htm , as i suppose thye are executable for windows http://file-help.net/m/filehelper.php?C=FSUS2&file=IDK&mt=E
I dont have any hidden file ".PDK" in my /root/filesystem
![[Image: XI2Znx1.png]](https://i.imgur.com/XI2Znx1.png)
* - ℬasic - Nov 3, 2014
Had some old computer who lived a random day as that! feel you
* - Aura - Nov 4, 2014
The way you explain it, you could simply use a VM with a snapshot to do malware testing. Create your VM, install all the programs you need, configure all the settings, etc.then take a snapshot and everytime you close/open it, you restore that snapshot. This is what I do and its basically the same thing. Of course, this program can be useful in same corporate environment or even on an old computer you have for malware testing, since some of them will try bypass your VM environment, so using a physical computer is better.
* - Sennheiser - Nov 4, 2014
(Nov 4, 2014 06:37 AM)Aurа Wrote: The way you explain it, you could simply use a VM with a snapshot to do malware testing. Create your VM, install all the programs you need, configure all the settings, etc.then take a snapshot and everytime you close/open it, you restore that snapshot. This is what I do and its basically the same thing. Of course, this program can be useful in same corporate environment or even on an old computer you have for malware testing, since some of them will try bypass your VM environment, so using a physical computer is better.
True
But the benefits of deepfreeze
Is you can run viruses which have anti vm
I had many viruses not running on the vm because it detected it was a vm
* - Aura - Nov 4, 2014
(Nov 4, 2014 08:43 AM)Sennheiser Wrote: True
But the benefits of deepfreeze
Is you can run viruses which have anti vm
I had many viruses not running on the vm because it detected it was a vm
I stated that exact benefit in my last post 😝
Quote:The way you explain it, you could simply use a VM with a snapshot to do malware testing. Create your VM, install all the programs you need, configure all the settings, etc.then take a snapshot and everytime you close/open it, you restore that snapshot. This is what I do and its basically the same thing. Of course, this program can be useful in same corporate environment or even on an old computer you have for malware testing, since some of them will try bypass your VM environment, so using a physical computer is better.