Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

15
votes
3answers
1k views

Is it safe to post dxdiag on the internet?

Is there any information that might be useful to damage me on the dxdiag.txt file generated by windows 7? A technical support forum from a big company (I guess they know what they're doing) asks me ...
15
votes
5answers
10k views

Encrypting files in a windows environment

We have certain client data which must be encrypted at all times. The part we have been struggling with is encrypting files on network shares. Currently we have network folders encrypted using PGP ...
15
votes
2answers
6k views

How secure is the Windows event log, and how is it secured?

I'm curious as to just how secure the Windows event log is, and exactly what security measures it uses. Does it include any defenses against tampering - for example, does it use digital signatures or ...
15
votes
2answers
567 views

How much of a problem is it that Windows “hides” some of the trusted root CA certs?

Based on information on this page, Windows actually trusts many more root CA certificates than what are displayed when a user launches certmgr.msc and navigates to Trusted Root Certification ...
14
votes
5answers
9k views

How is something as simple as a keylogger detected on a computer?

I found one online, which I wanted to try out at my house and see if it actually worked. It's written in C, and it is not very big at all considering half of it is just a bunch of cases for which key ...
14
votes
4answers
966 views

Unknown malware, how to report it and whom to report it to?

I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
14
votes
1answer
2k views

Is my modem compromised?

My modem automatically changes its DNS server from Norton DNS server to AdClick server. How do I prevent this from happen again? Is it possible to have protection from these for modem? How do I check ...
14
votes
2answers
5k views

Hiding user account names from unauthenticated RDP sessions

This is for a Windows 7 Ultimate system, which is not a member of a domain. When I log into the system locally, I am required to either manually enter my user ID or authenticate with biometrics. The ...
14
votes
3answers
18k views

How do I ensure data encryption on Samba transmission on *NIX systems?

I have a heterogeneous system (both MS and *nix) that communicates with CIFS/SMB. How can I ensure proper data encryption at the application layer?
14
votes
2answers
3k views

How does Windows 8's Microsoft Account authentication work?

One of the new features to Windows 8 is the ability to log in to your PC using your credentials from a Microsoft Account. How is this implemented, and what steps are taken to prevent hijacking of ...
13
votes
2answers
3k views

How does Internet Explorer know what text files I have viewed?

I am using Windows 8.1 and Internet Explorer 11. Each time I use File Explorer to view a .txt file the history of Internet Explorer shows that I viewed that file in pages visited on this PC. ...
13
votes
5answers
7k views

How can I decrypt data with Java, without hard-coding the key?

I hope this is not a chicken-egg problem or reinventing the wheel but here goes. I have a Java application that needs to access a password protected file (actually during the application startup). The ...
13
votes
3answers
4k views

Can you extract memory contents from a hibernated Windows machine?

In a recent discussion about hardware hacks, attacks surrounding Windows hibernate popped up. I am not entirely convinced that it would be viable to get stuff out of the memory saved to disk. When ...
13
votes
3answers
55k views

How do you discover what permissions an AD group has, if you have no documentation?

You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
12
votes
9answers
4k views

Can an old operating system webserver be made secure?

I have an old laptop with far too little RAM to run Linux (including specialty distributions). It can however run Windows 98 just fine, and I'm looking into turning it into a tiny retro webserver. Is ...
12
votes
3answers
4k views

How can I prevent someone from accessing a Windows XP system via boot disk?

Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one: http://www.raymond.cc/blog/...
12
votes
3answers
9k views

Prevent acccess to the C drive on Windows systems

Is it possible to prevent regular users from accessing the C drive via Windows Explorer? they should be allowed to execute certain programs. This is to ensure that employees cannot steal or copy out ...
12
votes
3answers
3k views

Am I protected from USB autorun malware on Windows 7?

As far as I know, the autorun.inf problem (the possibility of automatically executing code when a USB stick is plugged in) was solved through Windows Updates for XP, and on 7 it is no longer possible ...
12
votes
4answers
570 views

How to safely synchronize time over Internet?

All modern OS now keep accurate time by regularly synchronizing time over an untrusted network - Internet. Could an attacker conducting a MITM attack, influence or change the time of a computer while ...
12
votes
4answers
1k views

When using multiple operating systems, can they affect each other?

Let's say I have two different OS on my PC, Windows 10 and Linux. It is well-known that Windows collects a significant amount of information and sends it to Microsoft's servers, but I wonder if it "...
12
votes
3answers
37k views

Monitoring file access on Windows

I need a way to monitor user file access on windows. What I need is: monitoring of user opening, modifying (don't need to know what the changes were, just that a file was modified), copying, pasting ...
12
votes
1answer
1k views

Git server security

I want to install a Git server for my company. I'm able to get a Windows virtual machine. Now I've been asked to assess its security aspects. I'm lost on how to achieve this goal. As it is a Windows ...
12
votes
4answers
6k views

Detecting reflective DLL injection

In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
12
votes
1answer
1k views

What encryption prevents the tampering of Windows Identity Foundation (WIF) FedAuth cookies?

It occurred to me that the WIF FedAuth cookies contain identity information, that if tampered with, could permit someone to assume the identity of another user. Fortunately, WIF does ...
12
votes
1answer
1k views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
11
votes
6answers
4k views

Can viruses actually inject their code in other processes?

Can a virus really inject its own code into a process so it stays on your computer permantly? The only way to actually remove it is to reinstall your OS. My question is how can it do that without ...
11
votes
3answers
2k views

Attacks against windows kiosk software

I am interested in potential/actual attacks against kiosk software. I am not talking about physical access, or specifically designed kiosk operating systems or shells, bur rather software that runs ...
11
votes
3answers
2k views

How can I mitigate the threat that DPAPick poses to my DPAPI protected data?

The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications). DPAPick was presented at BlackHat ...
11
votes
3answers
11k views

Security of passwords remembered by Windows

Does Windows XP or Windows 7 encrypt saved passwords? I'm assuming that the user uses local password to logon. The user then uses his own computer to connect to server in work and sets the "remember ...
11
votes
2answers
607 views

How can I restrict what an application can do with my computer?

Often when I install applications on my computer, I realize that I need to trust the application because it can do what ever it want with my computer, e.g. accessing files, listen to my keyboard, ...
11
votes
2answers
170 views

Does Centralisation Decrease the Probability but Increase the Damage of Exploits?

This question is, perhaps, a tad too abstract for a Q&A site. But it's been playing on my mind for a while, so I'm throwing it out there. Modern systems seem to be increasingly centralised. An ...
10
votes
4answers
4k views

Is Changing a File Type and Name an Effective Security Solution?

Is renaming folders & files and changing file types an effective solution for file security of a PC? I am an application programmer and have an extensive background in it. I have written a ...
10
votes
4answers
10k views

How can I enumerate all the saved RSA keys in the Microsoft CSP?

I have an application that is creating several keys and storing them in various stores (in this case the Machine store). How can I enumerate all the keys on a given Windows system? ...
10
votes
1answer
4k views

Why is Windows Explorer making external connections?

McAfee is seeing Windows Explorer (explorer.exe) establishing connections to external IPs: Also verified with cmd: C:\Windows\system32>tasklist|find "explorer.exe" explorer.exe ...
10
votes
3answers
793 views

Reading keystrokes of other applications

Is it possible for other application running in the OS to read the keystrokes that my application uses? What about mouse events and window handles? Is there any security wall that the OS uses to ...
10
votes
3answers
3k views

Offline Bruteforce attack against a Bitlockered Windows PC

I am currently assessing the security of Bitlocker from the perspective of an offline attack against a stored password (used to secure the Full Disk Encryption key). My assumption is that the password ...
10
votes
3answers
558 views

What security requirements do you have for Domain Administrators?

With regard to managing a Windows network, what security polices and processes do you use? For example Do you require/support Smart Card Authentication? Restrict logins from a particular workstation?...
10
votes
2answers
35k views

Is there an SSL / TLS Certificate state-cache on Windows, IE, and Outlook and how it it managed?

Today I changed the SSL certificate that 3,000+ Outlook clients are using. In doing this I changed the certificate to an "older" one that had the same subject name, expiration and everything else. ...
10
votes
2answers
915 views

How insecure is PowerShell Web Access?

Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones. This sounds cool and scary at the ...
10
votes
2answers
447 views

How is UAC a security improvement?

What does User Account Control on Windows offer in terms of security? It's just an extra click to potentially run a virus.
10
votes
1answer
2k views

How does LSA authentication on Windows work?

I'm trying to understand the security protocols on Windows from a high level as part of legal research into cybercrime, and I'm having difficulty figuring out where to focus my research. I've already ...
10
votes
1answer
547 views

Are keyboard hooks inherently malicious?

My software is using low-level keyboard and mouse Win32 hooks for legitimate reasons (if it's any relevant, it's for determining a change in the caret position of the active code pane in the VBA IDE). ...
10
votes
3answers
582 views

Is ECDH for SEC P-384 and P-521 broken in Windows 10 / Windows Server 2016 TP3?

UPDATE: Proof of concept code here, console output shown below and all involved certificates are here. Just noticed that ECDiffieHellmanCng.DeriveKeyMaterial(...) behaves differently on Windows 8.1 ...
10
votes
1answer
474 views

Where does a Hyper-V guest get its entropy when generating a certificate authority key pair?

According to findings by the EFF's SSL observatory, there are "tens of thousands of keys that offer effectively no security due to weak random number generation algorithm." My understanding of that ...
9
votes
2answers
825 views

Running Windows Update when abroad

Is it safer or more dangerous to run Windows Update when abroad and using a WPA2 connection to a random cafe's wi-fi? Obviously good news: you get the latest security tweaks. Possible bad news: just ...
9
votes
4answers
1k views

How to track a laptop after theft?

Our company had a break-in this evening and a laptop was stolen. The data on the laptop was not super-sensitive (luckily); however, we would like to be able to track the laptop if at all possible. ...
9
votes
3answers
1k views

How can TOCTTOU vulnerabilities within the Windows OS be mitigated?

What are some ways to mitigate the time-of-check-to-time-of-use issues that apply to Windows permissions? Example: End-user is added to the local Administrators group in order to install software, ...
9
votes
2answers
2k views

Does http.sys vulnerability affect Windows not running any webservers?

Windows kernel level HTTP driver http.sys is affected by remote code execution vulnerability (MS15-034). This security update resolves a vulnerability in Microsoft Windows. The vulnerability ...
9
votes
1answer
308 views

Do the Windows shared source files compile into the same binaries as the retail version?

Microsoft makes the Windows source code available to certain third party organisations such as the US and foreign governments, universities etc. This is their Shared Source Initiative Is this a ...
9
votes
3answers
589 views

Is denying write access an effective way to stop ransomware?

I'm looking for ways to defend against ransomware. As part of this strategy I've come up with the idea to block myself from writing to as many locations (and files) as possible. It may be assumed ...