Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

5
votes
3answers
2k views

Single File Encryption in a Windows Environment

Would it be correct to assume that encrypting a single file in a Windows environment, for example a simple text file containing login credentials for a variety of accounts, is inherently insecure? It ...
2
votes
1answer
655 views

How to run client's code on server securely

I'm working on a project basically a web application. It accepts code (java, c, c++) from client, compile and execute on server and return the results back to client. As I'm going to execute code on ...
3
votes
1answer
3k views

How can I monitor a named pipe?

I have installed an application that opens a named pipe that is accessible over the network. I would like to monitor/sniff what is sent to this named pipe, any idea how I can do that? Edit: Even ...
5
votes
3answers
989 views

Tools helps: First time cracking passwords

I am trying to crack passwords on two Windows member servers (2003 and 2008). There is no Active Directory. Each user seems to use the same password across servers, workstations, etc. I have access to ...
3
votes
2answers
2k views

Windows Update - Interception

I'm trying to monitor the HTTP requests/responses made when performing a Windows Update. I have a Windows 8 machine configured with a proxy in IE. I've also imported via netsh for winhttp: netsh ...
0
votes
2answers
289 views

No where to run, no where to hide - suggestions to improve personal security needed

I think that as a windows user, I have no where to run and no where to hide. In the windows world no matter how many precautions I take, I can get infected by - 1 - Drive by on legal and popular ...
26
votes
3answers
2k views

Stack Overflow is www.doioig.gov/? If not, then could I be infected

Great! I made a post recently where I mentioned that my system might be infected. Now something new came up. When I search for Stack Overflow on Google, I see that the URL is www.doioig.gov/. When I ...
0
votes
5answers
1k views

NMAP scan fails

I started to read a metasploit guide book so I set up 2 Machines in VirtualBox for pen testing (host - BT 5, the second - WinXP SP2). When Im trying to scan open ports with NMAP on the Windows machine,...
2
votes
1answer
335 views

Normalizing Windows Advanced Firewall rules

How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen ...
0
votes
2answers
4k views

Regedit shows strange chinese characters in my system - should I be worried?

I suspect that my system has been hacked into. I see huge drops in free hard disk space for a while and then the space returns to near old values. A few days ago, when i clicked 'my computer', i saw ...
7
votes
3answers
6k views

UAC and Windows Services

A user has a PowerShell script that does some things that require administrative access on Windows Server 2012 with UAC enabled. When they run the script as a Local Administrator, it fails with ...
1
vote
1answer
847 views

Win server 2003 sp2 'local' Privilege escalation via thin client

Just asking if there is any known exploit that allows a client connected a win server 2003 sp2 x64 via SunRay thin-client to infiltrate (or preform a local privilege escalation on) the server. The ...
0
votes
1answer
508 views

How to enforce NTFS permission compliance?

I have to enforce NTFS permissions based on business roles. Each role (group in ADS) can be granted the permission to read or write a file server directory. I do not care about share permissions. I ...
0
votes
1answer
297 views

Windows 7 File Patching, Custom Visual Styles

In order to apply custom "visual styles" or themes in Windows 7, you must patch a few system files including Explorer. I can see from the start how this could be a potential security problem, but how ...
2
votes
2answers
462 views

Suspect Exchange Server appears to be hacked. How to determine if it was a false positive?

Our security vendor detected that our client's CAS server was doing a nessus scan in the internal network. It's not uncommon for this vendor to issue a false positive, but I'm looking for general ...
29
votes
4answers
14k views

Create a unterminable process in Windows

I am a student, and am genuinely curious about unterminable processes in Windows. For educational purposes, I would like to create an application (possibly in VB6?) which cannot be terminable by a ...
0
votes
3answers
265 views

Implement server serial key for server software

Me and my friend want to sell game server-side software, but we want some sort of control, over use of that software. For example, we want some sort of serial key system, so only verified/paid ...
2
votes
3answers
422 views

How isolated are 2 operating systems on 1 harddisk?

Lets say I have 2 windows dual booting on the same harddrive (windws 7), How isolated are they? I am thinking that there should be up to date antiviruses software on both Windows, and they should be ...
-1
votes
1answer
240 views

A simple but dangerous vulnerability in windows7?

I discovered that if you change the extension of any file to .lnk, that is make it like a shortcut file, then you can't change the extension again, even if you have set 'show the file extension names' ...
4
votes
3answers
2k views

Is there is a way to lock my USB port over the device physically?

Is there is a way to lock my USB port over the device physically ? For example I am connecting the USB mouse and keyboard on an public computer but I do not want anyone to remove them physically. I ...
18
votes
7answers
1k views

How to deal with a person who gets easily fooled by internet and mail scams?

alternative title: How to deal with a person who has gotten paranoid and doesn't want to go online anymore? A person, who has over the years been scammed many times, by bad spam/fraud emails, and ...
1
vote
1answer
775 views

Wildcard SSL Cert and Client Authentication

I have a wildcard SSL certificate (from GoDaddy.com) deployed to several Windows 2003 servers. I used IIS management console to import the certificate. The problem is that only one of these servers ...
16
votes
4answers
1k views

Firefox pre-downloading

I've found out that if you download a file with Firefox, a similar window as this one pops up (in dutch in my case): ("Bestand opslaan" = "Save file") However, the file is already being ...
3
votes
3answers
3k views

why blocking incoming traffic does not block chatting or VOIP

I just recently blocked all incoming traffic(all local ports and all external ips) in my windows 7 firewall and I understand that will not stop me from accessing websites as browsing needs outbound ...
2
votes
3answers
4k views

Are file permissions set in Unix/Linux effective in Windows or Any other OS?

Consider some files and folder in Unix/Linux OS which are configured for only read access by root, if the hard drive stolen, and used in Windows Environment, are these permissions are still effective? ...
5
votes
3answers
5k views

Wine or sandboxie as sandboxes

I'm looking for a sandbox for Windows. I've looked at sandboxie but I don't know if it delivers what it promises. Is it actually safer to run programs inside sandboxie ? I know a full-blown VM could ...
4
votes
3answers
213 views

can I find on which machine was a zipped archive created?

I have the following security issue. A zipped archive of emails was found on a machine (A) by using an undelete program. The claim made by the subject of the investigation is that they made the ...
3
votes
1answer
2k views

Best practice advice - folder security (windows environment)

An executive at the company I work for has asked me to set the permissions on a specific network folder so only they can access it. I don't usually do this, but in this case I need advice on the best ...
1
vote
3answers
1k views

Debugging and DLL-Injection

Hi, I am currently reading Gray Hat Python to learn about Debugging and various interesting techniques for binary analysis. So far I have learned an amazing amount of stuff (just read about DLL-...
2
votes
1answer
2k views

Due to which reason might a windows 7 password been reset to empty?

A user reports on monday he cannot access his windows 7 account anymore due to a "wrong password", which perfectly worked on friday. It turns out the password has been reset to empty for that account. ...
1
vote
1answer
335 views

Padding oracle - Vulnerable Version of ASP.NET

I would like to install the vulnerable version of ASP.NET for testing purposes. I've thought about it and I guess the best way would be to delete/disable some security updates to make that possible. ...
4
votes
2answers
240 views

DPAPI and malware

I'm considering using the Windows DPAPI to protect an ECDH key I use to encrypt some data in a local database in a Windows desktop application. I'm new to DPAPI, but its my understanding that DPAPI ...
2
votes
2answers
270 views

is RDP7.0 authentication process secure enough?

Latest version RDP used NLA, CredSSP and TLS to secure the authentication process. It sound like secure but in reality does it really secure enough. I knew that the previous version RDP is ...
2
votes
1answer
2k views

Why is windows considered insecure? [duplicate]

Possible Duplicate: Linux or Windows- the security issue I often see people complaining that Windows is "highly insecure" while linux is MUCH more secure. What exactly are the reasons/flaws ...
2
votes
1answer
2k views

How does a developer interact with Microsoft Certificate *Web Services*

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
4
votes
2answers
1k views

ASLR and how a program can actually call its functions

I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment. As far as I know ASLR works by randomizing part of the imagebase address when ...
0
votes
2answers
392 views

Suscpicious registry entry

In HKEY_USERS\S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxx\Software\Microsof\TATrial and HKEY_LOCAL_MACHINE\SOFTWARE\Microsof\TATrial there are entries Default (no value set) InstallDate (733998) ...
1
vote
1answer
3k views

Windows System event log warnings for smtpsvc

I get a lot of the following type messages: Message delivery to the remote domain 'particular domain or IP address' failed for the following reason: The remote server did not respond to a connection ...
0
votes
1answer
300 views

How to analyze server crash dump after recent patch update? [closed]

I want to know, if there a way I can identify on windows systems an event / log generated due to patches incorrectly installed / or corrupted in the process. Is there a way I can process or look ...
2
votes
1answer
4k views

IE on Windows 2012 doesn't show certificate or lock icon despite using HTTPS

Can anyone explain why IE on Windows 2012 doesn't show the lock icon despite using HTTPS when visiting the following site? https://www.microsoft.com/en-us/default.aspx I am able to see the lock ...
45
votes
5answers
49k views

What can an attacker do with Bluetooth and how should it be mitigated?

What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? What can an attacker do once a malicious device is paired with mine? ...
2
votes
3answers
601 views

Boot or reboot to clean state on Windows each time?

I use virtual box to securely surf the web, but it's easy to get lazy and use the same image more than once. Currently, I have a golden Win 7 image that I built and loaded my required software. I ...
1
vote
3answers
27k views

Multiple running instances of rundll32.exe

I've noticed that in the Task Manager of Windows 7, I have multiple running instances (2) of rundll32.exe. Does this necessarily means that my machine is infected by a malware as noted here: http://...
2
votes
3answers
150 views

Is possible to know if increased marketshare means more viruses?

I'm having an argument with other developers about why more "viruses" exist (including all forms of external attacks, exploits, etc) in Android vs iOS. Like with Windows vs *nix, the main idea is that ...
2
votes
2answers
2k views

Command injection Windows platform

Let's say there's a site which is vulnerable to user's input. For example users can ping a specified IP. Since the site is vulnerable to Os command injection, a user as well as an IP address he/...
5
votes
6answers
949 views

How can a novice find proof of a system compromise?

I am almost certain a colleague has installed a keylogger on my system. I am totally new to IT security, but have substantial linux / windows / programming experience. The system I believe is ...
2
votes
2answers
667 views

How to define different firewall rules for different users on the same machine running on Windows 7?

Provided that one machine running on Windows 7, connected to LAN, and connected to the Internet via a gateway in the LAN. There are two logon user accounts A and B on the machine. I want: 1, User A ...
3
votes
3answers
6k views

Making a Windows cert say it's purpose is “Ensures the identity of a remote computer”

Maybe this is a superuser.com question, I don't know. Anyway, I want my cert to show up like this when I double click on it in Windows: If I just double click on a random cert I get this: The ...
17
votes
4answers
33k views

how to import a private key in windows

Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys? Is the only way I can do that by converting both ...
2
votes
3answers
904 views

Strange file named Aview.exe - WinClient

Today I've just discovered some strange files on my Win 7 PC. I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe. It is located in C:\Users\...