Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

1
vote
1answer
212 views

Is the javascript browser tool at printfriendly.com secure for my browser

I use Win Xp Home with SP3 and am pretty aware of security problems. I use Palemoon 12.1, a version of Firefox optimized for windows. I usually use printfriendly bookmarklet to create printable pages ...
3
votes
2answers
545 views

Mitigations for Windows clients that don't support OCSP Nonces

Windows 7 clients (and older) don't support NONCES, a key feature used in securing the revocation check. Without a NONCE a MITM could replay a previously signed response and alter the validation of ...
5
votes
1answer
19k views

What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?

What root certificates are/are not updated when the following checkbox is checked? Additional questions If I manually remove a root certificate, will this service replace that very certificate? ...
1
vote
3answers
2k views

How does DCOM authentication compare to RPC based authentication/auth?

The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM A CA running Windows Server 2003, Enterprise Edition, ...
29
votes
4answers
200k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
2
votes
1answer
5k views

Clearing IE temp files don't erase CRL history. How can this be purged?

Even after I purge all my Internet temporary files, I still see information when I type certutil -urlcache How do I purge this information?
2
votes
3answers
2k views

What is the most secure way to do OCSP signing without creating validation loops?

I'd like to enable the most secure OCSP validation that Windows 2008 SP1 and newer support. Based on the following information, am I required to implement id-pkix-ocsp-nocheck on my OCSP ...
3
votes
1answer
2k views

What are attribute certificates? Why would someone partition a certificate by reason codes?

In "How Certificate Revocation Works" a brief mention of Attribute Certificate and Reason Code partition is made: If validated by a client that supports partitioned and indirect CRLs, the IDP ...
6
votes
1answer
3k views

Can a certificate have multiple chains and multiple self-signed roots?

The following MSFT document has this paragraph: All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed ...
1
vote
1answer
8k views

What are the OIDs (KU and EKU) necessary for Smart Card Authentication in Windows?

MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed. Based on this and this KB article the EKU section of the certificate should contain "Client ...
19
votes
4answers
15k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
1
vote
1answer
123 views

Does the “Special Groups” feature in Vista, 2008, R2, and Windows 7 apply to File System access?

The Windows 2008R2 "Special Groups" feature allows for detailed tracking of domain administrators when they log into the machine. This is accomplished by editing a registry key or the LSA. Is there a ...
1
vote
1answer
2k views

How do these Windows services affect the security of Windows Firewall?

Its common to disable unneeded services in Windows 2008 R2, but sometimes I come across installations that use Windows Firewall and related services. More info: see service dependencies for Windows ...
1
vote
1answer
832 views

What encryption is possible for ReadyBoost?

ReadyBoost is a technology to assist getting Windows Vista or 7 to load faster on memory-constrained PC's. Since a USB stick can be easily removed, what security options are available for this ...
0
votes
1answer
700 views

1and1 Dedicated Server got compromised (Windows Server 2003)

We had couple of dedicated servers rented on 1and1 hosting. In past we had situation where our server has got compromised and intruders were able to hack into the Windows 2003 standard edition and ...
2
votes
4answers
163 views

lock for asp.net developer using vs 2010 and win xp?

I am hiring few extra trainees who will use their personal laptop at my office to work on .net projects. I want to restrict the code/file access in their laptops with password. Like when they get in ...
8
votes
5answers
14k views

How to trace a DDOS attack on a dedicated server and block it?

I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering. The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
1
vote
1answer
369 views

Shellcode for higher file privileges

I'm learning exploits from the book Hacking: The Art of Exploitation. The shellcode below was written to enable higher privilege access to files. \x31\xc0\x31\xdb\x31\xc9\x99\xb0\xa4\xcd\x80 \x6a\x0b\...
51
votes
1answer
3k views

What's the risk if I accidently type my password into a username field (Windows logon)?

I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
7
votes
3answers
4k views

HIDS detection system and registry changes

I use OSSEC HIDS to monitor XP and Windows 7 Operating Systems. When OSSEC flags changes in the Windows registry, I have no idea where to go for to look for information and identify if the changes ...
1
vote
3answers
220 views

Maintain User Privileges After Shutdown in Windows XP?

Is it possible, in Windows XP, to maintain user privileges of a command shell after a reboot? For example, I'm running as a non-privileged account LocalMachine\Pete, but have a shell running as ...
2
votes
2answers
2k views

Logging and Metrics for DEP, EMET, and Related Mitigations

Is it possible to collect metrics or generate alerts when one of EMET's suite of mitigations prevents code execution? Ideally I'd want to be able to collect and analyze data to support statements like,...
-3
votes
2answers
292 views

Will winlock virus really delete information after 12 hours? [closed]

I've got virus which tells that all data will be deleted after 12 hours. I cleaned autorun and now scaning my computer with anti-virus, but still is this message just to scary people or is this virus ...
2
votes
3answers
2k views

How can winlock virus change Windows Registry without admin permission?

When you try to install program you'll always asked about administrator permission. Same thing when you try to user 'regedit' command. So I'm interested in how does this virus works. How can it edit ...
7
votes
4answers
8k views

Preferred UAC configuration in Enterprises that use Login scripts to map drives?

In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work: Dim WshNetwork Set WshNetwork = WScript.CreateObject("...
6
votes
4answers
14k views

Secure use of psexec or better alternative to it

I want to remotely start VMWare virtual machines (I own VMWare Workstation) and to this end I need to execute on host something like "vmrun -T ws H:\VMWare\VM1\VM1.vmx nogui" with user desktop context,...
1
vote
1answer
1k views

Should I use Windows' Cryptographic Service Provider to generate RSA keys?

If I want to generate strong high quality RSA keys, is there any reason not to use Microsoft's built-in cryptography system? Or should I use something open source like OpenSSL or Bouncy Castle? I'm ...
5
votes
1answer
936 views

CDNs used by Windows Update

My question is about CDNs (Content Delivery Networks) and their simultaneous use for legal and questionnable stuff. One specific example is the following. I'm noticing taffic from our network to the ...
1
vote
1answer
1k views

IIS password protected website

I have a website built upon windows IIS and to use password to protect the website and disable anonymous logon to that website, the ONLY way is to disable the anonymous logon in IIS and use a windows ...
3
votes
1answer
252 views

eBay account compromised/Credit Card used/Hosts files changed

To preface this, I'd just like to let you know that I'd consider myself an intermediate security guy(Definitely not a novice, not yet an expert) I do have a story to tell, and would like to know if ...
3
votes
2answers
749 views

How can I assess the strength of user passwords in my office environment?

I want to assure the compliance of password policy in my office. Environment Intro My environment is all windows based (server 2003/2008) user base is not more than 400 employees. Nearly 90% of all ...
2
votes
1answer
154 views

Network abnormally slow during night hours

My network recently the last week as become abnormally slow around 11 pm. Very slow buffering youtube videos during all hours. Ive recently purchased the new router about two months ago but not ...
1
vote
3answers
8k views

Why is system32/ntoskrnl.exe blocking port 80? [closed]

Today I've tried to start the Visual Studio Developer IIS as usual on Port 80, but this time it has quit with an error that port 80 is already in use. With netstat I've found out, that an application ...
1
vote
1answer
5k views

What are the risks of removing ISATAP from the default global block list?

The process of installing Microsofts pseudo VPN called Direct Access requires me to remove the ISATAP name from the default global block list by running this command: dnscmd /config /...
4
votes
6answers
866 views

Is a self signed certificate sufficient to prove the integrity of my executable?

I have an EXE file on Windows that I have to distribute around. It's based on tclkit so an adversary could unpack it, change some tcl script inside and repack the exe. I would like to know if this ...
10
votes
3answers
793 views

Reading keystrokes of other applications

Is it possible for other application running in the OS to read the keystrokes that my application uses? What about mouse events and window handles? Is there any security wall that the OS uses to ...
3
votes
2answers
231 views

Reading keystrokes of other applications

Is it possible for other application running in the OS to read the keystrokes that my application uses? What about mouse events and window handles? Is there any security wall that the OS uses to ...
6
votes
7answers
8k views

Physical computer security, how to disable USB ports when the computer is 'locked'?

Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
2
votes
6answers
307 views

What are possible approaches and arguments for securing corporate IT systems with most computers being portable?

I was employed as the only system administrator by a company where half of computers are portable ones being taken away for work at home, business trips, visits to clients, etc. having access to ...
4
votes
2answers
720 views

Added value of Windows Server 2008 over 2003 in terms of security

What is the added value of a Windows 2008 Server over Windows 2003 in terms of security? Does Windows Server 2008 has enhanced/new security features compared to 2003?
1
vote
1answer
549 views

If password is changed on Active Directory, can I ensure that PC must be restarted before logon with new password

Basically, if I have a Windows computer connected to a domain, how can I ensure that if the password is changed on Active Directory that the computer must be restarted before the new password takes ...
4
votes
1answer
1k views

Why does Windows 7 require a password hint during setup?

Correct me if I am wrong, but I think Windows 7 is the only operating system out there that requires a hint for the first user created on the system (have not had a chance to check out Windows 8 Beta)....
4
votes
4answers
11k views

Is diskcryptor really secure?

Diskcryptor is an open-source competitor to TrueCrypt for Windows. It has an edge over Truecrypt for system encryption, because it allows for more than one independently encrypted system partition, ...
6
votes
2answers
6k views

Is opening port 3389 on a router and forwarding this to a Windows SBS 2003 server secure?

I know of a company who has port 3389 open on their router and forwards this to a Windows SBS 2003 server. The server has the Windows firewall switched on, is patched and has an up to date antivirus ...
7
votes
1answer
6k views

Is CIFS/SMB (Folder Sharing in Windows) secure?

I have to back up some data from windows 7 machines over the internet, and I rarely use windows so am distrustful of it in general. Specifically: Is there any sort of check that the server is the ...
2
votes
4answers
2k views

Locking down Windows 7 and only allowing outbound calls on 80/443

I need to harden a windows 7 PC running in a kiosk type device. Basically the hardware on the PC only needs to make outbount HTTP requests and communicate with some peripherals over USB(COM ports). ...
2
votes
1answer
577 views

Active Directory: Should Workstations be separated from servers to protect from related domain hacks?

How should I protect domain joined hosts in the same AD domain from the Related Domain Cookie Attack? Suppose there is an AD forest called example.com. This company has a variety of internal and ...
3
votes
3answers
747 views

Do you give local administrator account password to notebook users?

My notebook users need to travel a lot. Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings. Should I give them local administrator's ...
3
votes
4answers
4k views

Reboot to clean state daily, on Windows

I already know that this can be done on Linux, One can boot to a flash drive that is write protected. Live modify folders can be symlinked to to a swap partition, and this prevents viruses from being ...
5
votes
2answers
10k views

Automating PGP encryption? (Windows)

Let's say I have daily files that need to be encrypted using PGP (and then emailed) and I want to automate this task. I would be using Windows PowerShell to manipulate the files (examine date/times ...