Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

4
votes
1answer
196 views

How secure is Sandboxie?

Sandboxie is a very popular and useful program for handling suspicious executables on Windows. Due to flawed security properties of Windows systems (eg. compared to Linuxes), it is hard to rely on the ...
6
votes
3answers
265 views

Does malware persist after wiping hard drive and reinstalling OS from manufacturer disc? [duplicate]

This question is related to a computer where users other than the owner have had access for periods of several hours at a time. The following steps have been taken to clean the computer: Used ...
-2
votes
1answer
90 views

anti cloning hard disk [closed]

I'm trying to create an "anti-cloning" system. I'd like to know if there's a way to check a unique label on the hard disk, during the boot phase, in order to avoid the machine to continue booting if ...
3
votes
0answers
71 views

How to extract windows event logs from a hard disk forensic image?

I have created an image of hard disk using FTK imager. I want to extract the windows event logs. The system was running windows 7. What should I do?
7
votes
4answers
998 views

How to trace the actions performed by a virus?

Is that possible to trace the actions performed by a virus? Run Time , stolen data and the files consulted and get the relative impact on my pc.?
3
votes
3answers
198 views

How to check if I have a rogue SSL/TLS certificate?

It's known, that if someone manages to install their certificate as a trusted certificate on your Windows computer, they can read all you SSl/TLS traffic with man-in-the-middle attack and you won't ...
2
votes
1answer
51 views

Will browsers trust an expired self sign certificate in the Trusted Root store

I recently discovered that if Windows AD LDS services are bound to a self signed certificate, that processes will continue to trust the cert even if it's expired. My guess is this is because the cert ...
1
vote
1answer
43 views

Windows command line does not check for revoked certificates: How bad is it?

I recently updated my D-link wifi dongle driver. However, I had to do this through the command line because Microsoft revoked the D-link certificates after a leak. The executable would simply not ...
1
vote
2answers
242 views

Track USB activity on Windows

I want to know what happens in my USB Devices (file creation, file renamed, etc) without use an external tool. I'm using Windows 7, can I enable some GPO to log these actions? Here use the event ...
3
votes
2answers
53 views

Is ignoring share permissions ok?

For my small home network I've found that it is easiest to setup network shares with share permissions set to Everyone: Full Control share permission and then configure the NTFS permissions according ...
-1
votes
1answer
58 views

External Hard Drive Operating System [closed]

If I put a OS onto a External hard drive, would it allow viruses to infect my internal hard drive?
-2
votes
1answer
100 views

How does Windows 7 login work? [closed]

Maybe the question can be considered ambiguous, so: how does Windows 7 work for its login authentication? What are the involved processes and what do they do?
1
vote
1answer
100 views

Privilige escalation with CreateNamedPipe and Impersonation for Windows Server 2012

While working with window based application came to know that local privilege escalation is possible when we use CreateNamedPipe method with Impersonation. This vulnerability was reported in Windows ...
0
votes
1answer
149 views

Is that possible for Linux and windows machines to be infected with KeRanger ransomware?

According to theguardian The Transmission site offers the open source software that was infected with the ransomware called KeRanger malware, it's programmed to encrypt files on an infected personal ...
0
votes
0answers
23 views

Windows : security of USBNET / RNDIS

I'm having trouble finding documentation about how to setup any security for RNDIS or if the system is already secure enough. For those who doesn't know RNDIS is a protocol that permits a USB ...
0
votes
1answer
110 views

Block OS fingerprinting without using iptables?

I have a Linux machine connected to a Windows 98 PC on port 104. Now I want to block the OS fingerprinting using nmap for the windows 98 PC. I tried using iptables (blocking that particular port) but ...
9
votes
3answers
521 views

Is denying write access an effective way to stop ransomware?

I'm looking for ways to defend against ransomware. As part of this strategy I've come up with the idea to block myself from writing to as many locations (and files) as possible. It may be assumed ...
0
votes
1answer
62 views

What is the difference between a certificate, a signature and a thumbprint in case of windows exe/binaries?

I am trying to understand the difference between signature , thumbprint and certificate in context of windows executable and binaries. I looked up on internet before posting this question but I did ...
0
votes
1answer
53 views

Security implications of “local admin on host OS” vs “local admin on virtual guest OS”

At work we have a discussion on computer security. The scenario: Our work PCs are Windows desktops that are part of a windows domain Users have domain accounts they use to log in to windows The ...
4
votes
1answer
151 views

Impersonating a computer in a Windows domain

I've been trying to wrap my head around how computers are identified and granted access to a Windows domain. More specifically, I've been asking myself if whatever mechanism is involved really ...
4
votes
1answer
701 views

(ctrl + alt + del) on Windows 8/8.1/10

After seeing this answer I wondered, how is this done in newer versions of windows, where [ctrl + alt + del] is no longer required for login? Was this feature just removed, or is it somehow ...
1
vote
1answer
42 views

Privilege seperation when using the same login credentials?

While thinking about preventing ransomware attacks on my machine I stumbled across the following question: Assume I'm on a Windows (10) PC. Assume further that I have two (local) accounts, one with ...
6
votes
1answer
106 views

Can windows domains be faked?

Without the equipment and software (and knowledge yet) readily available to test myself, I've been wondering about the relationship between computers and domains in a Windows environment. Some ...
1
vote
1answer
109 views

Unexpected attachment inside PDF

I have a PDF file that I downloaded in august last year. At that time, I opened it using Adobe Reader and didn't notice anything suspicious. Only today when I opened it in SumatraPDF did I notice that ...
0
votes
3answers
240 views

Are we anonymous when not connected to internet on windows?

When we don't use internet on windows, can windows or any Laptop vendor can access our Laptop (similar as connected to internet ). If yes, then How ?
1
vote
0answers
49 views

What personal information, if any, can be gleaned from a Microsoft APPCRASH problem signature?

I am trying to debug an "APPCRASH" problem event for a program running on Microsoft Windows 7. When this happens a problem signature is presented, like this example from SuperUser: Problem Event ...
16
votes
3answers
5k views

Running windows in virtual machine, should I bother with security?

I'm running Windows in a virtual machine on my mac (via Parallels). Should I bother installing antivirus, firewall and using other conventional wisdom practices (like don't open unknown .exe etc)? I ...
0
votes
2answers
86 views

How reliable is the method of overwriting deleted files with large files? [duplicate]

In addition to the question posted regarding purging data without formatting and the ability to recover data with forensic tools, how reliable is the method regarding overwriting with large file sets? ...
0
votes
0answers
32 views

Rootkit driver to change executed instructions

Say I have a process that has a bunch of functions I want to NOP out. From userland, I want anyone viewing the virtual memory to see the normal instructions. However physical memory, and in the end ...
1
vote
2answers
105 views

Limiting FTP privileges on Windows Server

I currently have a Windows 2012 Server which is acting as a webserver running IIS. I am using Filezilla to host an FTP server to allow some clients FTP access to their own websites. I have setup the ...
1
vote
1answer
135 views

What are the advantages and disadvantages of installing an operating system through network? [duplicate]

Netboot is a technology that allows a computer to boot through the network, instead of starting on a hard drive, USB stick or DVD, it connects to a remote server to retrieve a disk image to start. It ...
0
votes
0answers
44 views

How to prevent injection of Layered Service Provider (LSP) module in application with kernel-level?

LSP technology is often exploited by spyware and adware programs in order to intercept the communication across the Internet. For example, malware may insert itself as an LSP in the network ...
0
votes
1answer
84 views

How can I get someone to use PGP in emails [closed]

I do my part and ready to use PGP. There is a another user who is new to PGP.I have windows running, I did some installations to get PGP running.How can I get that user start using PGP ? what happens ...
2
votes
2answers
127 views

Block mobile tethering on android phones from Windows (DLP)

In our small organisation I have tried my best at implementing DLP by: Making sure users access all files from the server Local disks are denied access (forced to work only on network drives) ...
0
votes
2answers
84 views

Access to system32 [closed]

Is there a way anyone can access the system32 folder on Windows without being logged in? If so, how would he do that and how to prevent it.
4
votes
2answers
176 views

Location of Password Hashes on a Windows Local Machine?

"Where are the two locations that user's password hashes are stored on a local windows machine?" My place of business asked me this question. I know that the SAM stores password hashes, where would ...
3
votes
0answers
55 views

Lookaside List Injection

I've been reading a lot about Use-after-free and came across this document. It talks about a "Lookaside" injection exploit. The document says to empty the dynamic memory cache, called the Lookaside ...
0
votes
1answer
73 views

Why does Windows 7 remove Authenticated Users from file permissions when a folder is shared?

When I try to share a folder using the share tab in file properties, if I go back and remove sharing options from the Share tab, it also affects the Security tab, removing inheritance of permissions ...
3
votes
1answer
138 views

When using Dropbox to sync Keepass db, is it ok to open it in synced folder?

I'm going to be storing a Keepass 2 database file (.kdbx) in a local folder that's synced by Dropbox. Is it safe to use Keepass to open the database directly considering everything in the folder is ...
2
votes
0answers
79 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
0
votes
2answers
93 views

Are there any consequences of clicking on a URL to a facebook.com link?

So I stupidly clicked on a suspicious link on a Facebook post today. Guest account for shame. In my defense, it was a link to facebook.com itself, but it loaded a Facebook page, then seemed to ...
2
votes
0answers
183 views

Is possible to prevent input emulation with SetWindowsHookEx in specific application?

The one of technique of input emulation protection with automation toools like AutoIt or ACTools used most of simple game bot programs is SetWindowsHookEx usage WH_KEYBOARD_LL flags. This solution is ...
5
votes
2answers
149 views

Security of Windows Processes using “RunAs A Different User”

I've struggled to find much information on this topic. What I'm interested in is the following: Scenario A user is logged into a Windows (7, 8.1, etc) workstation as a standard non-administrative ...
1
vote
1answer
73 views

Track cmd executions history logs?

I bought a new notebook with Windows 10 Home edition installed on it. The notebook also had tons of other software pre-installed: all kinds of drivers, keyboard back-lighting managers and so on. I've ...
2
votes
1answer
197 views

How does Zeus (and other malware) inject code into other processes

Recently, I've been studying how malware works, most recently the infamously known Zeus bot, and I've noticed one thing that I don't seem to understand: The malware is said to be able to hook APIs in ...
2
votes
1answer
103 views

Is there any way to discover why Windows Smartscreen is flagging your download?

Since Windows Smartscreen is now marking downloaded files signed with SHA1 post 1/1/16 as potentially unsafe, we have had to get a new code-signing cert. With it being a new cert, it has no ...
3
votes
1answer
98 views

Is the Windows paging file safe in the encrypted partition?

I came across this setting called ClearPageFileAtShutdown. The setting is described here and says: If you are truly worried about security, boot Windows off a fully-encrypted drive. Then you ...
1
vote
1answer
72 views

How to protect Windows Registery from being changed or from programs trying to add keys

This question is with regards to Windows Personal PC. How to protect Windows Registry from being changed or from programs trying to add keys? I understand that the following general good practices ...
5
votes
2answers
108 views

Path Disclosure without ability to read files

So I am a pentester, and I have discovered "feature" on a server that allows me to, essentially, blindly traverse a web server's files (without executing or reading them). The problem is that I ...
2
votes
1answer
106 views

In Windows, what should I do to run a program with admin rights without concerns?

I'm currently using Windows 8.1 - 64 bits. In my computer, I have 2 accounts, 1 with admin power (used to install programs), and another without admin power (for everyday usage). There's a certain ...