Tagged Questions

A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

1
vote
0answers
12 views

How to sniff [possibly encrypted] TDS protocol data from the host the client application is installed on?

Let's say, there is an .NET application on a windows 7 host where I have administrator's access rights. The application works with remote MS-SQL server which I don't control, it also seems that the ...
0
votes
1answer
24 views

Disable Win FW - via WinRS?

Security practitioner working on MCSA, trying to see what I could do with WinRS from remote, namely disabling the firewall. winrs -r:1.1.1.6 netsh firewall offline sh mode Returns that the firewall ...
1
vote
0answers
12 views

Clear EFS Cache at Set Interval

My boss wants to set up encrypted file shares using EFS on Windows Server 2012 R2 Boxes accessed by Windows 8.1 clients. I've been able to set the default DRA, issue certificates in test cases and so ...
3
votes
1answer
23 views

Clarification on the -h Flag for Makecert.exe

When using Microsoft's Makecert.exe to generate a certificate (and key), there is the option to allegedly "specify the maximum height of the tree below that certificate", using the -h flag (see MSDN). ...
-1
votes
1answer
71 views

Forensic Question Invisible User [on hold]

I was able to create an invisible user in windows 7 and 8.1. The user is not visible at the login Screen, I added it to the SYSTEM account group and Remote desktop Users Group, The Administrator can ...
0
votes
1answer
68 views

SSID rotation prevent tracking or not?

The Program VirtualWifi Manager can rotate SSID's. Does rotating SSID's prevent the google tracking _nomap problem?
-3
votes
3answers
104 views

How to capture the traffic of a computer in my LAN?

I have a machine with the Windows 10 preview installed and I want to capture all the traffic it sends for a day and then block all the MS hosts it sent data to without my direct permission. I don't ...
0
votes
0answers
110 views

How can I use Windows 10 unattended, without getting keylogged and sending everything to Microsoft? [migrated]

I would really like to test the technical preview of Windows 10. I don't want to just install a few programs on it and see if they work, I also don't just want to quickly check out the new ...
1
vote
1answer
94 views

Is google.com/webhp malicious?

Lately, I've noticed the addition of "/webhp" in the url of Google searches along with some additional variables, "sourceid", "rlz", and a few others. Together, they make a URL in the form of ...
-2
votes
1answer
52 views

Good log file review tools [closed]

I am wondering, what tools are good for log file review? I am interested in a tool that is cheap or free, easy to use, covers all relevant log files, is useful for forensics (e.g. what did a hacker ...
0
votes
1answer
20 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
2
votes
1answer
68 views

Hardening ciphersuites on Windows Server 2012 R2

I'm currently in the process of compiling a Ciphersuite policy to be used on all of our new WS 12 & IIS 8.5 web servers. In the past I've always manually applied the registry keys into SChannel ...
-4
votes
0answers
55 views

Why is the USER = N/A and what does event 4689 means? [closed]

Why user = n/a? what is 4689? and why I only get the logoff event but not logon event? Log Name: Security Source: Microsoft-Windows-Security-Auditing Event ID: 4689 Task Category: ...
0
votes
1answer
44 views

Floppy disk partition showed up when USB Flash drive inserted

For one of my course's midterm lab portion, the professor provided us flash drives to put our project in. Everyone had their named labeled on one, so she gave me the last one left out, which had a ...
0
votes
0answers
134 views

TeamViewer: I'm worried the user who used my PC stole some data [migrated]

How can I be sure that the user yesterday connected to my PC with TeamViewer downloaded some data with the file transfer? Does the file transfer shows a notification to say that he is downloading ...
3
votes
4answers
116 views

How do I encrypt external drive with Password which is compatible with both Linux and Windows? [closed]

I wanted to encrypt my external drive with password, which is compatible in both Linux and Windows. Truecrypt is an option. But the development of it is stopped few months back. I came across ...
1
vote
2answers
153 views

Will Ad Block Plus block the ads that give someone Cryptowall 2.0?

Now I already know that making sure your browser plugins are either non-existent or up-to-date is one way of being on the safe side against ransomeware like Cryptowall 2.0; but since clicking ads are ...
1
vote
2answers
333 views

What agency digitally signed Cryptowall 2.0 so that it can run without being detected?

What agency issued a digital signature for the Cryptowall 2.0 ransomware virus? Is it too early to tell? As far as I know this is how Microsoft planned to prevent malware, by adding a digital ...
-5
votes
0answers
56 views

Log-on and log-off audit [closed]

I am sorry that my question is unclear, ok, to clarify the question. I have been receiving Logoff event instead of logon event and the logoff event in every minute are shown as below Log Name: ...
1
vote
0answers
208 views

Windows OLE Vulnerability CVE-2014-4114 “Sandworm”

Just heard about a new vulnerability and am using the same format as the POODLE guy for this one. What is the Sandworm vulnerability? I use [product/browser]. Am I affected? Is [product] ...
-8
votes
1answer
88 views

I need help on how to hack into a scammer computer via IP/DNS [closed]

I really need your help in this one. Today I got scammed by a "trader" for 100$, but I managed to get his IP, reverse DNS and Hostname but I am unskilled in hacking. I need help here, I just want to ...
0
votes
1answer
50 views

Can server administrator dump memory remotely thru Dell iDrac card?

I might at some point to invite another person into my software project. I don't mind sharing the code but the data I use is very sensitive. Once he gets hands on both pieces I wont see him again (if ...
-1
votes
0answers
26 views

Free alternatives to Windows nap? [migrated]

NAP was depreciated in 2012R2 and now Microsoft says it is not even present in Win 10 Server. I read this article which explains NAP is not as relevant today as there are better technologies to ...
4
votes
1answer
63 views

How secure is my DPAPI Master Key if I enable biometric login?

I understand that Windows DPAPI master keys are encrypted (directly or indirectly) with the user's login password - see e.g. Does DPAPI works if a user hasn't a login password? If I understand ...
0
votes
1answer
77 views

How would one go about setting up a system with security in mind? [closed]

I run a standard laptop at home (dual-boot Fedora 20 and Windows 7; the Windows side is almost never used). Soon my other computer will be working again; it will have Windows 8.1 and some flavor of ...
4
votes
2answers
68 views

Does KASLR really provide more security against exploits?

I know all about how ASLR works, and how it has been implemented on both Linux and Windows systems. It provides an extra layer of protection that malware has to take into account. But nowadays with ...
3
votes
1answer
126 views

Windows system password hashed - see which hash is used

How can I know / see if my windows is using NTML, LM, NTML2 for its user account passwords? What is the standard today, in windows systems?
1
vote
1answer
62 views

Is placing an `autorun.inf` folder in a drive's root a good safety precaution?

Is it possible for viruses to use Windows' autorun.inf mechanism to start their execution? If so, is placing an autorun.inf folder a good safety precaution? My reasoning is that it can help in one fo ...
3
votes
1answer
105 views

Dos Attack and other malwares!

I have been experiencing DoS attacks: ack scan and rst scan. Now I know these are supposed to be normal and the internet works that way but I experience severe internet disconnection when that ...
4
votes
1answer
173 views

Does dual boot hurt security?

On my laptop I have a well secured Linux installation that I would like to stay this way. It has in the past and could in the future contain confidential medical data I use for my study. I also have a ...
2
votes
1answer
77 views

About windows services and service control Manager

I was doing some study on Windows services, when I came to know that when an account other than Local System is used to run service, the SCM automatically grants the account certain security ...
2
votes
2answers
3k views

Git bash shellshock vulnerability [duplicate]

I have installed Git for Windows with bash shell support. Is it vulnerable to ShellShock? Refs: GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though? ...
0
votes
0answers
210 views

Ordinary Windows desktop bash bug [duplicate]

I'm still trying to make sense of the new bash vulnerability (shellshock). I can't tell from what I've read if having a bash script work in a Command Window makes my Windows box vulnerable or not. I ...
19
votes
1answer
5k views

GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though?

After the news of the Shellshock vulnerability broke out, I remembered I had GitHub's version of a bash shell for Windows installed. Just to see if it also had the vulnerability, I executed: env ...
0
votes
0answers
38 views

Tunneling Remote Desktop from DMZ Windows server to my Listening Linux Server. How to?

I have a situation in a penetration test where I got a meterpreter on an internal (DMZ) Windows box, and I want to connect via RDP to it, however the RDP port is blocked externally. The box I hacked ...
1
vote
0answers
33 views

Signed an executable; appears as unsigned on VMs?

I signed my binary with a certificate issued by GoDaddy. It seems that myself and everyone I could get to test it for me confirms that it is indeed signed (much like signtool verify) However, when I ...
9
votes
2answers
740 views

Running Windows Update when abroad

Is it safer or more dangerous to run Windows Update when abroad and using a WPA2 connection to a random cafe's wi-fi? Obviously good news: you get the latest security tweaks. Possible bad news: just ...
0
votes
1answer
66 views

User “ASP” logged in to windows server - hacking attempt?

I run a windows server 2008 which I connect to both via VNC and via remote desktop. Yesterday I noted when I connected to it via VNC that another user was logged in. See images. Notes: I have no ...
0
votes
3answers
204 views

Are windows users passwords easier to crack than linux?

If i set the same password in both linux and Windows, is it easier for a hacker to break the windows password? If so why and how can i create a windows password in the same security level as Linux?
0
votes
0answers
28 views

Read WMI stuff on offline system?

For forensic purposes, I want to work with WMI on an offline system (dd image disk). In particular I would like to read the WMI Event Subscriptions. How can I achieve this ? Are WMI stuff located ...
0
votes
1answer
176 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
-1
votes
3answers
168 views

What are the differences in Linux and Windows security that cause Windows to get so many more viruses? [closed]

I am trying to gain a more detailed understanding of specific features of the Windows and Linux security models that makes Windows so much more prone to infection by viruses than Linux. As an example ...
1
vote
1answer
150 views

How does Bitlocker only-PIN method work?

Microsoft explained USB-key and TPM based BitLocker decryption process on this article. USB-Key process: The steps in the illustrated sequence are as follows: 1- The operating system starts ...
0
votes
2answers
208 views

Computer hasn't been connected to internet for 2 weeks

A computer hasn't been connected to the internet for 2 weeks but has still been used. It's running Windows 8 and various notices are complaining about virus definitions and updates not being current. ...
19
votes
3answers
3k views

How can I tell if I have the citadel virus without downloading an antivirus?

I recently received an e-mail from Virgin Media indicating that I might have the Citadel virus. It obviously sounds like a fake e-mail, but I am almost certain it is genuine, as they had my name and ...
1
vote
1answer
94 views

What security risks do you face when connecting to a server via RDP? [duplicate]

What security risks do you face when connecting to an (possibly foreign) RDP server? Opening an unsigned RDP file triggers the following warning: RDP is a one way street, right?
3
votes
3answers
172 views

Could “system volume information” and $RmMetadata pose information leakage on a nuked HDD?

I recently nuked my HDD(s) via a Windows program (Disk Wipe to be precise: http://www.diskwipe.org/), now everything is fine when I try to retrieve the information on that disk by any program I can ...
1
vote
3answers
428 views

How trustable is third party root certificates?

i recently tried to use fiddler2 from third party vendor telerik,while decrypting the https traffic of my network it asked me to install its own root certifcate in my windows operating system : have ...
3
votes
1answer
91 views

How to check for presence of LM hashes in local SAM

To get rid of LM hashes in local SAM databases, one can rely on the famous NoLMHash domain GPO, which instructs clients not to store password hashes with the LM algorithm locally ("Do not store LAN ...
1
vote
1answer
59 views

Multiple “rundll32.exe mhunk.dme” instances. Is my PC Infected with Something?

So, I have this strange list of rundll32.exe There are quite a lot of rows of it (see attached image) when I open the process tab in my task manager I've already read the link here: Multiple running ...