Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

2
votes
2answers
17k views

How does Remote Access Trojan / Backdoor Software work?

How does a RAT works? I understand it as once we visit the infected website, the browser might download the Trojan to our PC automatically. Will it be executed and auto-installed in our computer? I ...
4
votes
1answer
3k views

Server monitoring for security

We do a lot of web hosting management and have started to get into selling server management packages. However, we want to start monitoring servers for security related threats. Our clients may use ...
5
votes
1answer
8k views

Is windows 7 vulnerable to null session?

My lecturer told me that Windows 7 is not vulnerable to null session but did not explain why. What is the preventive measure that windows 7 did to protect against from it? The recommend fixes for ...
4
votes
3answers
3k views

Securing a Windows Guest Account

I know that a person with physical access to a computer can do almost anything to it. My main concern with my Windows 7 guest account is privacy and sandboxing. I don't want a guest user to have ...
8
votes
2answers
11k views

Can Keyloggers get passwords from Windows 7/8 Logon Screen?

If yes, do you know some examples of Keyloggers capable of perform this? EDIT: I mean when logon in the windows right after power on the PC and/or when locked with Win+L.
4
votes
3answers
606 views

Further potential problems with Windows 8 SmartScreen

Some research was recently published that showed that Windows 8's SmartScreen feature sends certain details about every single application that you install to Microsoft. Ignoring the obvious privacy ...
4
votes
1answer
3k views

Disable DES-CBC-SHA in schannel

I have several IIS servers in house This includes IIS 6 and 7.x. When I have my external PCI scans run I'm still receiving alerts for having the weak protocol DES-CBC-SHA enabled. I have the ...
0
votes
3answers
12k views

Web browsing on Windows 2008 R2 terminal server (RDS): IE9 or Firefox? Flash or not?

I'm setting up a Windows 2008 R2 terminal server which users will connect to from thin clients. Since the thin clients don't have a web browser I need to allow users to surf from their terminal ...
4
votes
2answers
8k views

How to make / dump contents of memory for forensics analysis?

I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows ...
-5
votes
1answer
965 views

How to exploit a windows server when you have read-only filesystem access [closed]

I found a vulnerability in a site that can allow the download of any file of the server. I tested it by succesfully downloading boot.ini and autoexec.bat. I have no access to source code or file ...
5
votes
1answer
247 views

Use token for Windows Server 2008 AD RMS [closed]

I have a Windows Server 2008 configured for AD RMS (Active Directory Rights Management Service), another Windows Server 2008 machine that is the domain controller, and a third machine that is a member ...
0
votes
1answer
204 views

How can I prevent my son accessing my PC? [duplicate]

Possible Duplicate: How can I prevent my kids from bypassing my computer restrictions based on Windows Vista? My 14 year-old son is using a Ctrl+Alt+Del procedure to get into my computer even ...
1
vote
2answers
437 views

Windows process and socket capture

I am seeing some suspicious activity on windows 2008 web server. There are some connection attempts being made from the server going out to foreign IP addresses without any legit reason. The ...
4
votes
2answers
227 views

Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach?

I currently work in a manufacturing company with round about 5000 computers and 6000 employees. We use a lot of web based line of business applications (all internal, non over the Internet) in order ...
5
votes
3answers
852 views

When do Ps Tools send cleartext passwords, and how can I demonstrate this?

The Ps Tools from Mark Russinovich are very handy remote administration utilities. However, they all come with one big caveat. Note that the password is transmitted in clear text to the remote ...
1
vote
1answer
343 views

A BFE registry key's ACL is flagged by Microsoft Attack Surface Analyzer - what do I do?

Can anyone help me to understand which kind of action I should make to mitigate this issue, which emerged from Microsoft Surface Attack Analyzer? How I can tighten the ACL? Is there a standard ...
1
vote
1answer
60 views

Dangers of a vulnerability in a local installer?

I sent a message to my dev manager about a buffer overflow in our (widely distributed) installer, and received a response that it didn't matter as it wasn't server code. Other than the fact that if ...
2
votes
4answers
164 views

The email system is compromised - what can you do?

I have a friend at a 7 person company which has an issue with email confidentiality. Each time they send out an email with quotes to customer, the competitor get the message in 30 minutes and send ...
-1
votes
1answer
2k views

How to bypass firewall protection to hack windows server 2003? [closed]

I am trying to hack windows server 2003 sp2, i can see a lot of services running on target, there is also a lot of backdoors listing on ports like netbus, remote-everything .... But Firewall (as i ...
4
votes
1answer
3k views

What are the methods to find hooked functions and APIs?

Many malware executables use hooking to be invisible. I am familiar with some hooking methods, I'm not sure what methods exist for detecting them. Is there a way to tell when a function call has been ...
2
votes
3answers
6k views

windows firewall turns OFF automatically

It seems pretty weird but for some reason, the Windows 7 firewall turns off. After I turn the firewall on in the control panel, it seems that it turns itself off when I go back to the control after I ...
0
votes
1answer
283 views

Windows security policy analysis tool [closed]

I have several security policy files (INF exported from different Windows machines) which I need to audit. Is there any automatic tool you know of, that can analyse those files according to best ...
7
votes
4answers
565 views

Finding date of last network access

I have a system that contains highly sensitive data that does not reside on the Internet. However, when I was going through the machine recently, I detected that it had cookies, and temporary internet ...
6
votes
3answers
27k views

Windows 7 Password Hash Security

I recently came across a number of sources that suggest that cracking Windows user account passwords is easy by examining their password hashes. I understand that these hashes are stored in the SAM ...
-1
votes
1answer
203 views

What was Microsoft trying to do when they had Windows Updates over their website? [closed]

What was Microsoft trying to do when they had Windows Updates over their website? Now it's completely integrated into the operating system and it seems much smoother. The Linux and Mac I've used got ...
-1
votes
3answers
270 views

How to find & remove twitter spambot?

Sometimes i can see that i've "retweeted" some tweets , that i actually didn't. And all of them spam to some gaming & pharma websites. I've got windows 7 64bit, norton internet security , using ...
6
votes
3answers
932 views

How to effectively (and reasonably) secure Windows in corporate environment.

A member on my staff recently had their work computer compromised while on their home network. The following is the information regarding their computer Windows XP SP3 - fully patched at the time of ...
5
votes
4answers
3k views

What are the most common files to check with File integrity monitoring software?

I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server. Is there a ...
2
votes
2answers
5k views

how to identify p2p on network

Im trying to work out if the traffic in the below image is P2P file sharing? If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...
3
votes
0answers
203 views

How secure is HTTP basic authentication over SSL? [duplicate]

Possible Duplicate: Is BASIC-Auth secure if done over HTTPS? I want to set up a web server on a computer at home which will basically do no more than send the browser a file which contains ...
1
vote
2answers
815 views

Closing handles of a process as a regular user

Here's the situation: As an adminstrator, I am able to stall the application by closing 2 handles held by the process. (Using ProcExplorer) . Is there any way/hack I can use to close file handles ...
1
vote
1answer
885 views

How to fix the audit failure in our web server

We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network. Can anybody help me how to isolate and prevent this from happening? An ...
4
votes
3answers
12k views

How do you properly setup Tor on Windows 7?

How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?
6
votes
4answers
626 views

Would running VMs inside of VMs be a more secure way to study viruses, etc?

I was reading this post on SuperUser, and it made me wonder about security. I've read somewhere else that some viruses/malware/whatever CAN break outside of a VM... and then infect the host OS. BUT, ...
0
votes
1answer
975 views

Suspicious .exe set to run at startup: Determine if file exists still

When I open MSConfig and look at all the applications set to run on startup there is a suspicious file set to run at startup. I have disabled the .exe to not run at startup but I want to delete the ....
2
votes
1answer
327 views

Windows 8 in a VDI environment and the use of Secure Boot

I have a question, How would secure boot be implemented in a virtulized environment, say XEN hypervisor with multiple guest OS's including Windows 8 guest VM? does the guest VM need access to the ...
7
votes
1answer
3k views

NVidia update service creates local account on system. Does anyone know the users password?

Nvidia update service has created a local user on several of my boxes. Does anyone know its password? I recon it could possible be leveraged as an entry way for an attacker. Details: wmic ...
0
votes
1answer
565 views

Can the FiddlerCore library be used for Malware (e.g. MitM attacks)?

I've used the excellent Fiddler web debugging software before and have recently come across the Fiddler Core headless .NET library which gives you all the abilities of Fiddler in library form. It's ...
8
votes
7answers
5k views

Linux or Windows- the security issue [duplicate]

Possible Duplicate: Open Source vs Closed Source Systems Almost anyone who has grown up on Windows must have had the notion (that I had) of Linux being more secure than Windows- one of reasons ...
2
votes
2answers
182 views

Why would encrypting data result in a call to a Domain Controller

This KB article mentions an issue where signing or encrypting information may result in a network IO call to a Domain Controller. Apparently the RSACryptoServiceProvider's SignData and VerifyData ...
4
votes
1answer
525 views

A simple example for showing the use of Data Execution Prevention (DEP) security feature

I am finding it really hard to figure out why we need a DEP! Microsoft states this about DEP: The primary benefit of DEP is to help prevent code execution from data pages. Typically, code ...
4
votes
4answers
8k views

Detecting or preventing process memory injections on Windows (anti-hack)

Standard hacking case. Hack injects into a started game process and writes over process memory using WriteProcessMemory call. The situation is like this: we are hosting a game server clients join ...
2
votes
1answer
840 views

Smart card compatible with Schlumberger (Gemalto) Cryptoflex 16K and USB reader

Another question related to previous ones A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? and About performance of Smard card for performing 3DES in a MD5 hash We need ...
2
votes
1answer
488 views

About performance of Smart card for performing 3DES in a MD5 hash

Another question related to previous, unanswered A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? Another alternative is to store the keys in a Smart card permanently ...
5
votes
2answers
600 views

A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?

We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
2
votes
1answer
227 views

What does a IT Security Pro need to know about .NET Code Access Security (CAS)?

Background In .NET 1.0 through 3.5 administrators could administer the runtime security policy through mscorcfg. Aparrently many of these security features have been removed in .NET 4.0,. ...
2
votes
1answer
1k views

Generate one CSR for two Windows servers

I have two Windows 2008 R2 servers which will be hosting a load balanced website. I will generate a private key and use it to generate a CSR using OpenSSL. How can I make this CSR (or the resulting ...
0
votes
2answers
109 views

Should a host based firewall have an API accessible to other applications?

Some people are hesitant to use Windows Firewall because it allows software to alter its state via an API. The benefit of this is that the Firewall configuration can be centrally manged in GPO. On ...
1
vote
2answers
326 views

Elcomsoft Advanced EFS Data Recovery

The Elcomsoft "Advanced EFS Data Recovery" whitepaper says First the program tries to do this automatically, for example trying to extract the password from cache or system files, checking simple ...
5
votes
1answer
5k views

What's the risk of changing permissions of the Security Eventlog registry key to IT operations?

Background Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code: ...