Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

1
vote
1answer
42 views

Windows command line does not check for revoked certificates: How bad is it?

I recently updated my D-link wifi dongle driver. However, I had to do this through the command line because Microsoft revoked the D-link certificates after a leak. The executable would simply not ...
-1
votes
1answer
58 views

External Hard Drive Operating System [closed]

If I put a OS onto a External hard drive, would it allow viruses to infect my internal hard drive?
3
votes
2answers
53 views

Is ignoring share permissions ok?

For my small home network I've found that it is easiest to setup network shares with share permissions set to Everyone: Full Control share permission and then configure the NTFS permissions according ...
9
votes
3answers
514 views

Is denying write access an effective way to stop ransomware?

I'm looking for ways to defend against ransomware. As part of this strategy I've come up with the idea to block myself from writing to as many locations (and files) as possible. It may be assumed ...
217
votes
7answers
42k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
5
votes
3answers
4k views

How To Recover EFS Cert From Backup?

I made a backup of the old Win 7 Pro then did a clean install. But I forgot to export my EFS encryption certificate, so when after I restored the encrypted files from backup I could no longer access ...
2
votes
1answer
103 views

Can I trust my antivirus' assessment of my computer as clean, if it previously found threats?

Yesterday, I went to my Recycle Bin (for the first time in a while) to purge a bunch of files I had sent there. When I clicked on the folder, my antivirus warned me of a trojan out of the blue. Later, ...
-2
votes
1answer
100 views

How does Windows 7 login work? [closed]

Maybe the question can be considered ambiguous, so: how does Windows 7 work for its login authentication? What are the involved processes and what do they do?
0
votes
1answer
149 views

Is that possible for Linux and windows machines to be infected with KeRanger ransomware?

According to theguardian The Transmission site offers the open source software that was infected with the ransomware called KeRanger malware, it's programmed to encrypt files on an infected personal ...
1
vote
2answers
317 views

RAM memory data remanence and double boot, risky?

I wonder if my setup can be risky. To give a good starting point for answers I would briefly sketch the situation setup: double boot system GNU/Linux and Microsoft Windows GNU/Linux is on 2 ...
1
vote
1answer
42 views

Privilege seperation when using the same login credentials?

While thinking about preventing ransomware attacks on my machine I stumbled across the following question: Assume I'm on a Windows (10) PC. Assume further that I have two (local) accounts, one with ...
22
votes
1answer
2k views

What are the privacy and security implications of Windows Telemetry

There have been quite a few news stories relating to the use of "Telemetry" in Windows 10 (and also now Windows 7/8) with suggestions that users would want to disable or remove these updates due to ...
0
votes
0answers
23 views

Windows : security of USBNET / RNDIS

I'm having trouble finding documentation about how to setup any security for RNDIS or if the system is already secure enough. For those who doesn't know RNDIS is a protocol that permits a USB ...
0
votes
1answer
61 views

What is the difference between a certificate, a signature and a thumbprint in case of windows exe/binaries?

I am trying to understand the difference between signature , thumbprint and certificate in context of windows executable and binaries. I looked up on internet before posting this question but I did ...
0
votes
1answer
53 views

Security implications of “local admin on host OS” vs “local admin on virtual guest OS”

At work we have a discussion on computer security. The scenario: Our work PCs are Windows desktops that are part of a windows domain Users have domain accounts they use to log in to windows The ...
4
votes
1answer
150 views

Impersonating a computer in a Windows domain

I've been trying to wrap my head around how computers are identified and granted access to a Windows domain. More specifically, I've been asking myself if whatever mechanism is involved really ...
4
votes
1answer
701 views

(ctrl + alt + del) on Windows 8/8.1/10

After seeing this answer I wondered, how is this done in newer versions of windows, where [ctrl + alt + del] is no longer required for login? Was this feature just removed, or is it somehow ...
6
votes
1answer
106 views

Can windows domains be faked?

Without the equipment and software (and knowledge yet) readily available to test myself, I've been wondering about the relationship between computers and domains in a Windows environment. Some ...
4
votes
3answers
129k views

How to detect if files were saved or copied to a USB drive?

How can I find out if files from my computer were written/copied/moved to a USB storage device? I want to know if there is a solution that would work in a system that has not got any ...
0
votes
3answers
240 views

Are we anonymous when not connected to internet on windows?

When we don't use internet on windows, can windows or any Laptop vendor can access our Laptop (similar as connected to internet ). If yes, then How ?
1
vote
1answer
107 views

Unexpected attachment inside PDF

I have a PDF file that I downloaded in august last year. At that time, I opened it using Adobe Reader and didn't notice anything suspicious. Only today when I opened it in SumatraPDF did I notice that ...
1
vote
0answers
49 views

What personal information, if any, can be gleaned from a Microsoft APPCRASH problem signature?

I am trying to debug an "APPCRASH" problem event for a program running on Microsoft Windows 7. When this happens a problem signature is presented, like this example from SuperUser: Problem Event ...
16
votes
3answers
5k views

Running windows in virtual machine, should I bother with security?

I'm running Windows in a virtual machine on my mac (via Parallels). Should I bother installing antivirus, firewall and using other conventional wisdom practices (like don't open unknown .exe etc)? I ...
1
vote
0answers
463 views

wonderlandads.com popup virus [closed]

Problem As for this or this or even this, my computer has been infected to this sh-t and my browsers open an annoying pop-up on every single click to whatever web page I am visiting and this is ...
0
votes
2answers
85 views

How reliable is the method of overwriting deleted files with large files? [duplicate]

In addition to the question posted regarding purging data without formatting and the ability to recover data with forensic tools, how reliable is the method regarding overwriting with large file sets? ...
0
votes
0answers
32 views

Rootkit driver to change executed instructions

Say I have a process that has a bunch of functions I want to NOP out. From userland, I want anyone viewing the virtual memory to see the normal instructions. However physical memory, and in the end ...
1
vote
1answer
133 views

What are the advantages and disadvantages of installing an operating system through network? [duplicate]

Netboot is a technology that allows a computer to boot through the network, instead of starting on a hard drive, USB stick or DVD, it connects to a remote server to retrieve a disk image to start. It ...
2
votes
1answer
174 views

Scam caller claimed to have elderly friend's “Windows unique identifier”

An elderly friend received a telephone call similar to this Information Security SE post and this one. The caller claimed that my friend's computer had a problem that needed to be fixed. My friend ...
0
votes
0answers
43 views

How to prevent injection of Layered Service Provider (LSP) module in application with kernel-level?

LSP technology is often exploited by spyware and adware programs in order to intercept the communication across the Internet. For example, malware may insert itself as an LSP in the network ...
6
votes
1answer
626 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
0
votes
1answer
84 views

How can I get someone to use PGP in emails [closed]

I do my part and ready to use PGP. There is a another user who is new to PGP.I have windows running, I did some installations to get PGP running.How can I get that user start using PGP ? what happens ...
0
votes
1answer
189 views

Is there a risk that file shredders and free space wipers steal our confidential data?

I was wondering how secure are the file shredding software and free space wipers? Lets say we are using PC Windows, and software CCleaner (from piriform) or File Shredder (found here) to securely ...
5
votes
3answers
5k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
2
votes
2answers
260 views

Logging in as administrator in windows 7, is there a downside?

I have a very straightforward question. Is there any downside to logging in as an administrator all the time in windows 7? I mean, it asks you whenever a program asks for permission to do something ...
1
vote
2answers
4k views

Encrypted code file (.vbs) hides all my files and shows .lnk files

I am using Windows XP Professional and what happens is that when I try to connect any gadget like a pen drive or a mobile through USB, all my data gets hidden and it shows a 1 kb file which is a .lnk ...
4
votes
2answers
172 views

Location of Password Hashes on a Windows Local Machine?

"Where are the two locations that user's password hashes are stored on a local windows machine?" My place of business asked me this question. I know that the SAM stores password hashes, where would ...
0
votes
2answers
83 views

Access to system32 [closed]

Is there a way anyone can access the system32 folder on Windows without being logged in? If so, how would he do that and how to prevent it.
3
votes
0answers
55 views

Lookaside List Injection

I've been reading a lot about Use-after-free and came across this document. It talks about a "Lookaside" injection exploit. The document says to empty the dynamic memory cache, called the Lookaside ...
4
votes
2answers
288 views

What is the correct way to remove bitlocker secrets from a TPM when returning a device for warranty?

Note: This is not a question about how to preserve data on a device that is returned for warranty. Rather, this is a question about how to ensure that the encrypted remnant data on the device is not ...
2
votes
2answers
17k views

How does Remote Access Trojan / Backdoor Software work?

How does a RAT works? I understand it as once we visit the infected website, the browser might download the Trojan to our PC automatically. Will it be executed and auto-installed in our computer? I ...
0
votes
5answers
1k views

NMAP scan fails

I started to read a metasploit guide book so I set up 2 Machines in VirtualBox for pen testing (host - BT 5, the second - WinXP SP2). When Im trying to scan open ports with NMAP on the Windows ...
3
votes
1answer
137 views

When using Dropbox to sync Keepass db, is it ok to open it in synced folder?

I'm going to be storing a Keepass 2 database file (.kdbx) in a local folder that's synced by Dropbox. Is it safe to use Keepass to open the database directly considering everything in the folder is ...
2
votes
0answers
183 views

Is possible to prevent input emulation with SetWindowsHookEx in specific application?

The one of technique of input emulation protection with automation toools like AutoIt or ACTools used most of simple game bot programs is SetWindowsHookEx usage WH_KEYBOARD_LL flags. This solution is ...
2
votes
0answers
79 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
0
votes
2answers
93 views

Are there any consequences of clicking on a URL to a facebook.com link?

So I stupidly clicked on a suspicious link on a Facebook post today. Guest account for shame. In my defense, it was a link to facebook.com itself, but it loaded a Facebook page, then seemed to ...
27
votes
3answers
1k views

Are .dll files normally found in system32 but now in a user’s AppData folder always suspicious?

I recently had to read over some malware reports and associated logs for a confirmed malware detection and subsequent infection of a Windows asset. The logs clearly show .dll files in a user’s AppData ...
5
votes
2answers
149 views

Security of Windows Processes using “RunAs A Different User”

I've struggled to find much information on this topic. What I'm interested in is the following: Scenario A user is logged into a Windows (7, 8.1, etc) workstation as a standard non-administrative ...
1
vote
1answer
73 views

Track cmd executions history logs?

I bought a new notebook with Windows 10 Home edition installed on it. The notebook also had tons of other software pre-installed: all kinds of drivers, keyboard back-lighting managers and so on. I've ...
2
votes
1answer
197 views

How does Zeus (and other malware) inject code into other processes

Recently, I've been studying how malware works, most recently the infamously known Zeus bot, and I've noticed one thing that I don't seem to understand: The malware is said to be able to hook APIs in ...
2
votes
1answer
103 views

Is there any way to discover why Windows Smartscreen is flagging your download?

Since Windows Smartscreen is now marking downloaded files signed with SHA1 post 1/1/16 as potentially unsafe, we have had to get a new code-signing cert. With it being a new cert, it has no ...