Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

2
votes
3answers
904 views

Strange file named Aview.exe - WinClient

Today I've just discovered some strange files on my Win 7 PC. I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe. It is located in C:\Users\...
2
votes
3answers
3k views

Identify a process that uploads data

I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about 200–...
2
votes
1answer
2k views

Fuzzing tool to find heap overflows in a Windows binary [closed]

Is there a fuzzing tool that can scan some arbitrary windows binary and identify a set of heap overflow vulnerabilities? For example, a tool that applies a set of heuristics or maybe a list of ...
1
vote
1answer
127 views

How to know what's the type of an attack and from whom is sent?

I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked. How do I know what kind of attack it is and from whom is sent? When he attacks, the RDP freezes and the ...
2
votes
1answer
503 views

How should I audit and monitor shared TCP ports in Windows?

Windows has a feature called .NET TCP Port Sharing which allows different .NET applications to share the same TCP/IP port. I would like to monitor the source and destination connections of each ...
3
votes
1answer
405 views

Potential services.exe infected file?

I was asked by a coworker to help solve a problem with a remote client site through VNC. Immediately after connecting I've started noticing some strange behaviors that I am lead more and more to ...
1
vote
1answer
746 views

Windows 7 EFS - connot decrypt

I have some files on my laptop that were accidentally encrypted, I think by Visual Studio. I didn't even know that was possible. Anyway, the way I discovered they were encrypted was that I changed ...
-1
votes
3answers
692 views

How to increase Windows PowerShell WebAccess security?

What are some recommended techniques to improve the security of powershell? Google returns many articles about powershell security like these: PowerShell’s Security Guiding Principles TechNet Edge ...
0
votes
1answer
230 views

Windows Firewall accepts a three-second unicast response from any source

I have read this article but still has some doubts may be after that... The Windows Firewall feature in Microsoft Windows XP Service Pack 2 (SP 2) accepts a three-second unicast response from ...
0
votes
2answers
251 views

Setting up a remote test environment correctly

My setup: - Main Box (connected to network) - VM1 : Linux - VM2 : Windows 7 Both the VMs are running off VM Player and using Bridged: connected directly to the physical network and replicating ...
4
votes
1answer
455 views

Managing a large amount of MBSA Results?

I am responsible for scanning and fixing issues on ~50 servers with Microsoft Baseline Security Analyzer (MBSA) version 2.2. Unfortunately, there is no out of the box way to manage multiple MBSA ...
1
vote
2answers
175 views

Auditing EXEs to ensure buffer overflow protections are in place? (such as SEHOP, ASLR, and DEP)

According to this answer, it's possible to compile a GCC-based application without certain buffer overflow techniques. Perhaps this is even possible with Visual Studio. How can I audit a given EXE ...
-3
votes
1answer
11k views

windows firewall disabled with Norton Internet security or Norton Smart Firewall? [closed]

My Company decide to Change antiviruses and anti-spywares and firewalls. How to apply changes in all clients and servers safety? Norton say: ( in this article): When you are using Windows 7,...
-1
votes
4answers
5k views

why Windows Firewall in XP cannot block outbound connections [closed]

wikipedia say: XP's Windows Firewall cannot block outbound connections; it is only capable of blocking inbound ones. another article says: XP defends you with your traffic coming from the web but ...
4
votes
2answers
18k views

Discover what workstations a user us connected to in a Windows AD Environment?

I currently have a naughty user in my environment. We don't want to set any alarms of (even from speaking to the AD admins), and wish to discover the workstation the user is connected to in our AD ...
3
votes
1answer
697 views

How do I configure Terminal Server (and clients) for use over untrusted Wifi networks?

Suppose a client wants to directly connect to Terminal Server exposed to the Internet, without a VPN, ... what software & settings is needed to properly protect against WiFi based attacks? (...
12
votes
4answers
576 views

How to safely synchronize time over Internet?

All modern OS now keep accurate time by regularly synchronizing time over an untrusted network - Internet. Could an attacker conducting a MITM attack, influence or change the time of a computer while ...
8
votes
1answer
798 views

Better way to import Win32 APIs from injected shellcode

I'm injecting native x86 code into a .NET application, via a TLS callback in the binary image. Unfortunately, .NET executables only import mscorlib.dll within the PE, and have kernel32.dll mapped ...
8
votes
3answers
39k views

Windows Firewall - how to block inbound for all .exe files in a folder

In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
0
votes
1answer
677 views

Deny domain admins from steal User files on PCs [duplicate]

Possible Duplicate: Dealing with untrusted administrators in a Windows domain I'm trying to block Domain Admins from accessing classified files on PCs that joined the domain. But it looks like ...
2
votes
3answers
4k views

Dealing with untrusted administrators in a Windows domain

I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
2
votes
4answers
972 views

Virus won't be picked up by Antivirus tools

Today we found a virus / trojan on our network which has thus far: Hidden all files and folders Replaced the hidden files and folders with executables of itself, with matching icons, and renamed ...
1
vote
1answer
117 views

Best way to secure file removals in Windows remotely

I have Windows 2008 R2 box on colocation. I want to remove certain files with a high degree guarantee it cannot be recovered from physical HDD access. Could someone please explain what levels of ...
3
votes
1answer
309 views

Is it possible to prevent user from dumping hashes?

I run a Windows server, is it possible to prevent user from enumerating user password hashes? Also can someone explain how the hash dumping tools works? As I didn't find it with google
0
votes
1answer
141 views

How does duqu implement its dll files in PNF file format?

As you know files with PNF extension are associated with bitmap file type, from technically point of view how did authors of duqu implement this? as I concluded it is possible to make dlls in any ...
5
votes
1answer
5k views

AIA/CRL locations for Offline Root

I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building It's an ...
1
vote
1answer
301 views

Worst-case scenario for ShellExecute(0,“open”,arbitrary_string)

I found an application that uses ShellExecute to open hyperlinks. However, it doesn't check if the string is actually a hyperlink - it is passed directly to ShellExecute. Aside from opening arbitrary ...
13
votes
3answers
4k views

Can you extract memory contents from a hibernated Windows machine?

In a recent discussion about hardware hacks, attacks surrounding Windows hibernate popped up. I am not entirely convinced that it would be viable to get stuff out of the memory saved to disk. When ...
2
votes
3answers
3k views

Potential consequences of using “Everyone” to manage permissions?

If a web application is set to run using a specific account, could a malicious user do something they shouldn't if I use the "Everyone" account to manage permissions on a folder on the server? The ...
2
votes
1answer
771 views

VMware Workstation 9 Security Best Practice Guides

Could someone please be able point me in the direction of where I could find some best practice security guides for VMware Workstation 9 please? I've searched the VMware site and to say it's badly ...
4
votes
2answers
2k views

How does syskey in Windows increase the security in a domain?

I use syskey in windows XP and Windows 7. I've read Microsoft's article but I have questions. How does this solution increase security? What are differences between using Syskey in a client that ...
3
votes
1answer
1k views

SafeSEH and x64

I read here that /SAFESEH is only valid when linking for x86 targets. /SAFESEH is not supported for platforms that already have the exception handlers noted. For example, on x64 and Itanium, ...
4
votes
3answers
138k views

How to detect if files were saved or copied to a USB drive?

How can I find out if files from my computer were written/copied/moved to a USB storage device? I want to know if there is a solution that would work in a system that has not got any monitoring/...
3
votes
1answer
91 views

auditing mod security rule sets

Is there a audit system that can help me try my strings? Such as user agents, post/get data, a simple way to test general sql injections to see how my rule sets hold? I know with fire fox I can ...
0
votes
5answers
11k views

How to list missing security updates for Windows servers?

I have a list of applied security patches and updates, exported from Windows server 2003. The exported list is in CSV format, but converting it is not a problem for me. Is there any tool/site/script ...
1
vote
2answers
1k views

Running Apache as system service on Windows 2003 R2 64-bit

Trying to make my point, that running Apache with PHP5 module as Windows service is not secure. All I got to prove it - FTP access to some internal website. So what I did - I uploaded file test.php ...
10
votes
2answers
927 views

How insecure is PowerShell Web Access?

Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones. This sounds cool and scary at the ...
0
votes
1answer
647 views

is it OK to grant permission for IUSR_ to cmd.exe?

One of my developers asked me to grant permission to IUSR_ user (the IIS user) to CMD.exe (console) now I'm wondering is it safe to do it? He is complaing, that his libraries had to use console for ...
1
vote
1answer
387 views

Where are located the DPAPI BLOBS and is there any tool to decypher them?

I'm doing some testing with DPAPI for a project where I'm involved. I would like to know where the users Masterkey are located and if there is any free utility to find and decipher them. I'm pretty ...
5
votes
1answer
438 views

Does DPAPI works if a user hasn't a login password?

I was wondering if the DPAPI will still work properly if a user doesn't have a a login password (like most of the home users). I can't find this information on Google or in the official documentation ...
6
votes
2answers
4k views

How would I go about rebuilding the IAT of a packed executable?

When executables are packed with a tool such as UPX, the real code and data sections are encrypted or obfuscated, then loaded into memory using an injected decrypter stub. This makes static analysis ...
2
votes
1answer
144 views

Which .CER file format is more secure for purposes of an AIA record?

What file format is most appropriate or secure for the AIA record in a PKI certificate? The options I'm aware of are: DER encoded binary X.509 (.cer) Base-64 encoded X.509 (.cer) I also have the ...
2
votes
1answer
743 views

Silent (no user interaction) utility to clear cached credentials on Windows [closed]

Is there any way to clear cached credentials on Windows, that doesn't require: user interaction (e.g. a confirmation window); administrator access; or making a persistent change to the configuration,...
2
votes
2answers
329 views

How does duqu delete itself?

I'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?
4
votes
1answer
411 views

Need help on understanding obfuscated code in CVE-2012-4969 exploit

As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code. Is it necessary to use obfuscation ...
4
votes
1answer
499 views

How did my homepage get changed in IE?

I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
8
votes
2answers
2k views

Can a webcam be turned on when disabled in Windows' device manager?

In addition to whether a webcam can be turned on without the indicator light, I was wondering if disabling the device in Windows' device manager is a good option. Of course when your system is ...
12
votes
4answers
6k views

Detecting reflective DLL injection

In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
1
vote
2answers
594 views

Changing IP ID generation of a server

I've seen plenty about Idle Scans and incremental IP IDs on the net, but I have trouble finding a "solution" to the problem. Is there a way to "set" IP IDs for example to all zeros or is it coded into ...
0
votes
1answer
316 views

Good reading about windows architecture/reversing [closed]

I have a feeling that I need to get more knowledge about system programming and winapi/windows architecture in particular to be able to understand how lots of exploits work (like those exploiting ...