0
votes
3answers
101 views

User Account Guessing [duplicate]

I'm doing some research on user account guessing, and wanted to ask a question about some "bad practices". My thought is generally this is a trade-off between great user functionality/UX and ...
0
votes
1answer
516 views

Use SSH config file with Putty [closed]

I'm using SourceTree (a Git GUI) which uses PuTTY as SSH client. I need to push some code into a repository for which I need to tunnel through SSH to do so. The trouble is, the repository and SSH ...
1
vote
2answers
164 views

How to make an efficient bruteforce attack on Windows? [closed]

I've been trying to figure out a way to efficiently bruteforce on Windows, but the method I currently have isn't very efficient. I did some profiling and found out that on average it can go through ...
1
vote
1answer
60 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
0
votes
3answers
161 views

Is a console application with NT Authority/System rights dangerous?

A developer managed to open a console application with NT Authority/System rights at the startup screen before logging in. From that command prompt it is possible to execute arbitrary programs like ...
1
vote
1answer
183 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
14
votes
2answers
1k views

How does Windows 8's Microsoft Account authentication work?

One of the new features to Windows 8 is the ability to log in to your PC using your credentials from a Microsoft Account. How is this implemented, and what steps are taken to prevent hijacking of ...
4
votes
2answers
596 views

Windows Authentication and Session Ids

After a penetration test made upon an intranet application I'm developing, in ASP.NET MVC, one of the concerns raised was that the application supports concurrent user sessions and it is recommended ...
3
votes
1answer
900 views

What are the risks posed by “pass-through authentication” and how are they mitigated?

Related: Local Admin has Domain Admin rights "Pass-through authentication" on Windows systems allows for the possibility for user accounts with the same name and password to impersonate one ...
1
vote
3answers
242 views

How safe is it to provide my administrator account password for a 3rd party software: EasyUS Todo Backup?

I've been recently searching for a backup solution for my Windows desktop. That's when I came across this free software called EasyUS Todo Backup. (I know it's a mouthful but English doesn't seem to ...
3
votes
1answer
791 views

Preventing LSASS from storing clear-text passwords in Kerberos environment

It is a well known security risk that LSASS stores clear-text passwords if a user has performed a keyboard-interactive logon on a machine - be it local login to his/her workstation or using RDP to a ...
3
votes
0answers
509 views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
154
votes
7answers
26k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
5
votes
1answer
898 views

How do I make or get computer certificates to use with IPSEC user authentication on Windows?

I am having trouble and need some direction using computer certificates with Windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
3
votes
1answer
7k views

Setting up Windows laptops to require a smartcard for unlocking

I am looking for details on how to secure a windows laptop using smart cards. The scenario is that we have laptops in vehicles, which remotely connect (via https) to an application server over the ...
1
vote
2answers
202 views

is RDP7.0 authentication process secure enough?

Latest version RDP used NLA, CredSSP and TLS to secure the authentication process. It sound like secure but in reality does it really secure enough. I knew that the previous version RDP is ...
2
votes
3answers
2k views

Dealing with untrusted administrators in a Windows domain

I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
4
votes
1answer
203 views

Does DPAPI works if a user hasn't a login password?

I was wondering if the DPAPI will still work properly if a user doesn't have a a login password (like most of the home users). I can't find this information on Google or in the official documentation ...
1
vote
1answer
488 views

Silent (no user interaction) utility to clear cached credentials on Windows [closed]

Is there any way to clear cached credentials on Windows, that doesn't require: user interaction (e.g. a confirmation window); administrator access; or making a persistent change to the ...
5
votes
2answers
160 views

Windows Vista user logon integrity

Is it possible to delete some or all user session logon datetime records from Windows Vista? Is there any mechanism to give me confidence that individual records aren't deleted even if there isn't a ...
22
votes
4answers
6k views

How secure is Windows 8's Picture Password login?

The final Windows 8 build has been released to manufacturing. One of the new features of Windows 8 is "Picture Password", where the end user logs on to Windows by clicking a specific pattern on the ...
6
votes
1answer
1k views

NVidia update service creates local account on system. Does anyone know the users password?

Nvidia update service has created a local user on several of my boxes. Does anyone know its password? I recon it could possible be leveraged as an entry way for an attacker. Details: wmic ...
1
vote
2answers
820 views

How does DCOM authentication compare to RPC based authentication/auth?

The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM A CA running Windows Server 2003, Enterprise Edition, ...
15
votes
1answer
83k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
35
votes
1answer
2k views

What's the risk if I accidently type my password into a username field (Windows logon)?

I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
5
votes
4answers
8k views

Secure use of psexec or better alternative to it

I want to remotely start VMWare virtual machines (I own VMWare Workstation) and to this end I need to execute on host something like "vmrun -T ws H:\VMWare\VM1\VM1.vmx nogui" with user desktop ...
3
votes
2answers
3k views

Is CIFS/SMB (Folder Sharing in Windows) secure?

I have to back up some data from windows 7 machines over the internet, and I rarely use windows so am distrustful of it in general. Specifically: Is there any sort of check that the server is the ...
2
votes
1answer
584 views

Token Based Authentication & Pass-the-hash Attacks

Do token-based authentication solutions (such as RSA SecurID) mitigate tools like incognito and/or pass-the-hash tools?
4
votes
4answers
4k views

How secure is Windows Auto-Logon?

Obviously, if auto-logon is enabled, anyone who can gain physical access to the PC can use the PC. That's not the question. The question is, when I enable auto-logon for my Windows 7 box, will there ...
3
votes
1answer
283 views

How do I use Windows 7 virtualization features to prevent transitive trust of admin credentials?

I am exploring using VMs to separate my administrative actions from standard user actions in Windows 7. The goal is to limit my risk and exposure when using "RunAs" to open an application or file ...
2
votes
1answer
1k views

“Extended Protection” primer and implementation guide to prevent MITM

Extended Protection (link) (link) is a feature in Windows 7 and Windows 2008 R2 that prevents certain MITM attacks. Does anyone have a primer (or explanation in plain English) what this feature is, ...
14
votes
4answers
3k views

Three-Factor Authentication for Windows

This HowToGeek article... http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/ ...got me thinking. Is there any software (or combination of software) that ...
14
votes
2answers
3k views

Hiding user account names from unauthenticated RDP sessions

This is for a Windows 7 Ultimate system, which is not a member of a domain. When I log into the system locally, I am required to either manually enter my user ID or authenticate with biometrics. The ...
18
votes
1answer
618 views

Is it secure to connect to a remote Windows Server using Remote Desktop only?

I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, ...