Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

0
votes
1answer
316 views

Good reading about windows architecture/reversing [closed]

I have a feeling that I need to get more knowledge about system programming and winapi/windows architecture in particular to be able to understand how lots of exploits work (like those exploiting ...
0
votes
1answer
98 views

What expertise is required to create an Windows intrusion report?

I need an expert on a subject I know very little. I had a breach on one of my Windows systems. I know how someone got in but for legal purposes I need to prove that some former employee, whom I ...
8
votes
1answer
205 views

Why would it be preferable for a system to shut down when the security log is full?

When running in a configuration that supports Common Criteria, Windows must be configured to shut down when the security event log is full. Why is this a preferable option?
3
votes
2answers
3k views

Using Window Servers 2003 after security updates are discontinued

Let's say that Microsoft has stopped supporting Windows Server 2003 now so there is no any security updates and I use that system for Domain Controller (Windows XP/7 Professional Clients) and File ...
5
votes
2answers
2k views

What is the purpose of the entropy parameter for DPAPI.Protect?

So in Windows, when you make a call to the Data Protection API, you can specify some bytes as "entropy". To me, this sounds like salt. In PBKDF2, the salt is can, and in fact needs to be stored as ...
3
votes
1answer
479 views

DPAPI offline attack by cracking windows password?

I'm thinking of using DPAPI to protect configuration file information in my program. After doing some reading on it, it looks like it uses the user's Windows password as part of the encryption process....
5
votes
2answers
174 views

Windows Vista user logon integrity

Is it possible to delete some or all user session logon datetime records from Windows Vista? Is there any mechanism to give me confidence that individual records aren't deleted even if there isn't a ...
22
votes
4answers
8k views

How secure is Windows 8's Picture Password login?

The final Windows 8 build has been released to manufacturing. One of the new features of Windows 8 is "Picture Password", where the end user logs on to Windows by clicking a specific pattern on the ...
4
votes
1answer
563 views

Is Window's system restoration useful for getting rid of malware?

If your computer has been infected with some kind of malware, could a restoration of the system, using the tool provided by windows, help you getting rid of that malware? We should suppose that it ...
1
vote
1answer
210 views

tools automating logins/hashes grabbing

Lets assume I have access to the windows machine. I want to grab raw info about logins/hashes from both system and installed apps, dump and analyze it later. I could manually dump things like SAM ...
5
votes
1answer
3k views

How does a client authenticate the domain controller

On an active directory based network how do hosts authenticate the Domain Controller? Is it possible for an attacker to impersonate the Domain Controller? PS: I'm having a problem getting info on how ...
2
votes
1answer
2k views

How to view which mac addresses are connected to some AP?

I set up an open AP. I know I can view mac addresses of connected users via AP's console (local console). this is not what I need. I use tool like Netstumbler or inSSIDer on my Win 7 machine to see ...
3
votes
2answers
2k views

How to counter or fix banner grabbing vulnerability

During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
3
votes
2answers
1k views

Hide web.xml file from public view

I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config. I don't how to restrict. I tried with ...
5
votes
1answer
1k views

IPSec Domain Isolation with Windows Server

I'm looking for a good way to secure my servers, I have a set of dedicated servers that are not in my office but hosted by an external provider. ALL the servers have only one public (WAN) IP. I don't ...
8
votes
3answers
7k views

How to manage admin rights for helpdesk staff?

My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting. Helpdesk staff commonly require administrative rights to provide support for end users. I ...
2
votes
2answers
17k views

How does Remote Access Trojan / Backdoor Software work?

How does a RAT works? I understand it as once we visit the infected website, the browser might download the Trojan to our PC automatically. Will it be executed and auto-installed in our computer? I ...
4
votes
1answer
3k views

Server monitoring for security

We do a lot of web hosting management and have started to get into selling server management packages. However, we want to start monitoring servers for security related threats. Our clients may use ...
5
votes
1answer
8k views

Is windows 7 vulnerable to null session?

My lecturer told me that Windows 7 is not vulnerable to null session but did not explain why. What is the preventive measure that windows 7 did to protect against from it? The recommend fixes for ...
4
votes
3answers
3k views

Securing a Windows Guest Account

I know that a person with physical access to a computer can do almost anything to it. My main concern with my Windows 7 guest account is privacy and sandboxing. I don't want a guest user to have ...
8
votes
2answers
11k views

Can Keyloggers get passwords from Windows 7/8 Logon Screen?

If yes, do you know some examples of Keyloggers capable of perform this? EDIT: I mean when logon in the windows right after power on the PC and/or when locked with Win+L.
4
votes
3answers
609 views

Further potential problems with Windows 8 SmartScreen

Some research was recently published that showed that Windows 8's SmartScreen feature sends certain details about every single application that you install to Microsoft. Ignoring the obvious privacy ...
4
votes
1answer
3k views

Disable DES-CBC-SHA in schannel

I have several IIS servers in house This includes IIS 6 and 7.x. When I have my external PCI scans run I'm still receiving alerts for having the weak protocol DES-CBC-SHA enabled. I have the ...
0
votes
3answers
12k views

Web browsing on Windows 2008 R2 terminal server (RDS): IE9 or Firefox? Flash or not?

I'm setting up a Windows 2008 R2 terminal server which users will connect to from thin clients. Since the thin clients don't have a web browser I need to allow users to surf from their terminal ...
4
votes
2answers
8k views

How to make / dump contents of memory for forensics analysis?

I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows ...
-5
votes
1answer
981 views

How to exploit a windows server when you have read-only filesystem access [closed]

I found a vulnerability in a site that can allow the download of any file of the server. I tested it by succesfully downloading boot.ini and autoexec.bat. I have no access to source code or file ...
5
votes
1answer
248 views

Use token for Windows Server 2008 AD RMS [closed]

I have a Windows Server 2008 configured for AD RMS (Active Directory Rights Management Service), another Windows Server 2008 machine that is the domain controller, and a third machine that is a member ...
0
votes
1answer
206 views

How can I prevent my son accessing my PC? [duplicate]

Possible Duplicate: How can I prevent my kids from bypassing my computer restrictions based on Windows Vista? My 14 year-old son is using a Ctrl+Alt+Del procedure to get into my computer even ...
1
vote
2answers
443 views

Windows process and socket capture

I am seeing some suspicious activity on windows 2008 web server. There are some connection attempts being made from the server going out to foreign IP addresses without any legit reason. The ...
4
votes
2answers
228 views

Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach?

I currently work in a manufacturing company with round about 5000 computers and 6000 employees. We use a lot of web based line of business applications (all internal, non over the Internet) in order ...
5
votes
3answers
864 views

When do Ps Tools send cleartext passwords, and how can I demonstrate this?

The Ps Tools from Mark Russinovich are very handy remote administration utilities. However, they all come with one big caveat. Note that the password is transmitted in clear text to the remote ...
1
vote
1answer
350 views

A BFE registry key's ACL is flagged by Microsoft Attack Surface Analyzer - what do I do?

Can anyone help me to understand which kind of action I should make to mitigate this issue, which emerged from Microsoft Surface Attack Analyzer? How I can tighten the ACL? Is there a standard ...
1
vote
1answer
60 views

Dangers of a vulnerability in a local installer?

I sent a message to my dev manager about a buffer overflow in our (widely distributed) installer, and received a response that it didn't matter as it wasn't server code. Other than the fact that if ...
2
votes
4answers
164 views

The email system is compromised - what can you do?

I have a friend at a 7 person company which has an issue with email confidentiality. Each time they send out an email with quotes to customer, the competitor get the message in 30 minutes and send ...
-1
votes
1answer
2k views

How to bypass firewall protection to hack windows server 2003? [closed]

I am trying to hack windows server 2003 sp2, i can see a lot of services running on target, there is also a lot of backdoors listing on ports like netbus, remote-everything .... But Firewall (as i ...
4
votes
1answer
3k views

What are the methods to find hooked functions and APIs?

Many malware executables use hooking to be invisible. I am familiar with some hooking methods, I'm not sure what methods exist for detecting them. Is there a way to tell when a function call has been ...
2
votes
3answers
6k views

windows firewall turns OFF automatically

It seems pretty weird but for some reason, the Windows 7 firewall turns off. After I turn the firewall on in the control panel, it seems that it turns itself off when I go back to the control after I ...
0
votes
1answer
288 views

Windows security policy analysis tool [closed]

I have several security policy files (INF exported from different Windows machines) which I need to audit. Is there any automatic tool you know of, that can analyse those files according to best ...
7
votes
4answers
574 views

Finding date of last network access

I have a system that contains highly sensitive data that does not reside on the Internet. However, when I was going through the machine recently, I detected that it had cookies, and temporary internet ...
6
votes
3answers
28k views

Windows 7 Password Hash Security

I recently came across a number of sources that suggest that cracking Windows user account passwords is easy by examining their password hashes. I understand that these hashes are stored in the SAM ...
-1
votes
1answer
203 views

What was Microsoft trying to do when they had Windows Updates over their website? [closed]

What was Microsoft trying to do when they had Windows Updates over their website? Now it's completely integrated into the operating system and it seems much smoother. The Linux and Mac I've used got ...
-1
votes
3answers
270 views

How to find & remove twitter spambot?

Sometimes i can see that i've "retweeted" some tweets , that i actually didn't. And all of them spam to some gaming & pharma websites. I've got windows 7 64bit, norton internet security , using ...
6
votes
3answers
939 views

How to effectively (and reasonably) secure Windows in corporate environment.

A member on my staff recently had their work computer compromised while on their home network. The following is the information regarding their computer Windows XP SP3 - fully patched at the time of ...
5
votes
4answers
3k views

What are the most common files to check with File integrity monitoring software?

I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server. Is there a ...
2
votes
2answers
5k views

how to identify p2p on network

Im trying to work out if the traffic in the below image is P2P file sharing? If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...
3
votes
0answers
208 views

How secure is HTTP basic authentication over SSL? [duplicate]

Possible Duplicate: Is BASIC-Auth secure if done over HTTPS? I want to set up a web server on a computer at home which will basically do no more than send the browser a file which contains ...
1
vote
2answers
828 views

Closing handles of a process as a regular user

Here's the situation: As an adminstrator, I am able to stall the application by closing 2 handles held by the process. (Using ProcExplorer) . Is there any way/hack I can use to close file handles ...
1
vote
1answer
896 views

How to fix the audit failure in our web server

We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network. Can anybody help me how to isolate and prevent this from happening? An ...
4
votes
3answers
12k views

How do you properly setup Tor on Windows 7?

How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?
6
votes
4answers
634 views

Would running VMs inside of VMs be a more secure way to study viruses, etc?

I was reading this post on SuperUser, and it made me wonder about security. I've read somewhere else that some viruses/malware/whatever CAN break outside of a VM... and then infect the host OS. BUT, ...