A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

0
votes
1answer
61 views

What are analytics APIs accessing when they run, and how do you block or spoof them?

What are analytics APIs accessing when they run, and how do you block or spoof them? Usually all apps from desktop or mobile app stores, MMO clients, Steam and many utilities, and many games and ...
1
vote
2answers
122 views

Hidden Malware on a windows OS able to startup [closed]

How do hackers hide there malware on windows, to startup and be impossible to find then delete. The results I found that a hacker can use to hide his malware: (found here) Windows: Setting hidden ...
9
votes
2answers
1k views

Does http.sys vulnerability affect Windows not running any webservers?

Windows kernel level HTTP driver http.sys is affected by remote code execution vulnerability (MS15-034). This security update resolves a vulnerability in Microsoft Windows. The vulnerability ...
4
votes
1answer
136 views

Accessing user accounts without asking for their password

I don't like asking my (windows network) users for their passwords, it doesn't seem like a good security practice. I also want to train my users to never give their password to anyone if they ask for ...
0
votes
1answer
91 views

Windows Server Update Services (WSUS) - can I pivot to a client machine?

I'm considering setting up WSUS on a Server 2008 machine to push updates to my Windows 7 clients. If I do, I'll be following the hardening guidelines issued by MS (such as enabling SSL). One thing I ...
0
votes
2answers
44 views

Windows / Sensitive Data / Prevent access by various process

It's my understanding if you're logged into your Windows PC as DOMAIN\DUDE.NAME and you have access to \DOMAINFILES\SECRET STUFF\SUPER SECRETS.xlsx any process you run can also access that file - ...
2
votes
3answers
136 views

Can a virus persist across Windows version upgrades?

It is possible for a trojan which allows a remote user to secretly control a computer, to re-install itself after upgrading to a newer version of Windows?
0
votes
2answers
2k views

Does Reinstalling windows ensures removal of all malwares/spywares/virus/rootkits etc? [duplicate]

If I re-install Windows, will it ensure that all types of malware/spywares/rootkits and any other malicious software are removed from my laptop?
0
votes
1answer
64 views

Organizing results from netstat using find on Windows [closed]

I am trying to figure out a way to natively do this within Windows without having to load any 3rd party applications. When I run: netstat -ba I want to find established connections without losing ...
1
vote
0answers
42 views

Domain Exploitation [closed]

I have set up a domain testing environment on a couple of old computers that i had lying around at home. I have done a lot of information gathering and attempts at exploiting the machines via ...
1
vote
0answers
149 views

Null Session Questions [closed]

Null Session means using unauthenticated SMB session to IPC$ share and accessing the resources anonymously using the RPC function calls in SMB Since The Processes running Under Local System Account ...
2
votes
0answers
72 views

Remote accessed? [closed]

I'm not an IT professional but I'm hoping someone will take the time to answer this. I'm not generally such an idiot but this happened: I was using Ancestry.com on Chrome and clicking links within ...
4
votes
1answer
91 views

Security risk: Digitally sign communications for SMB

I have a computer (Windows) on a network where an industrial process is controlled. There is an option in Local Security Policy >> Local Policies >> Security Options >> "Microsoft network client: ...
0
votes
3answers
137 views

How does Nessus send remote commands on Windows without RDP? [closed]

I would like to know how Nessus sends remote commands on Windows. I have a scan with credentials launched on a Windows machine without RDP enabled, and Nessus can launch commands (.audit with the item ...
7
votes
2answers
1k views

When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?

When you take ownership of a TPM in Windows 7 you encounter a screen like this: Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
0
votes
0answers
42 views

Why windows do not alarm when an application hook keyboard [duplicate]

In microsoft windows , we can simply develop an application that hook the keyboard and mouse or take an screenshot of display. Why windows do not alarm that a program uses hooking (for example ...
4
votes
5answers
2k views

what is the best keylogger for security uses? [closed]

Today we were robbed. A thief come to our home at night and stole some stuff including my brother's laptop. I think that the right thing to do is to download a keylogger on my PC, just in case... I ...
0
votes
2answers
303 views

Suscpicious registry entry

In HKEY_USERS\S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxx\Software\Microsof\TATrial and HKEY_LOCAL_MACHINE\SOFTWARE\Microsof\TATrial there are entries Default (no value set) InstallDate (733998) ...
5
votes
2answers
193 views

Which Windows Files Should be Monitored by HIDS?

I highlighted my question below. Here is some background. It's easy to find data showing the most commonly trojaned/modified Linux binaries and config files. ps, ls, find, kill, lsof, passwd, ...
28
votes
3answers
8k views

Create a unterminable process in Windows

I am a student, and am genuinely curious about unterminable processes in Windows. For educational purposes, I would like to create an application (possibly in VB6?) which cannot be terminable by a ...
1
vote
2answers
171 views

How to wipe potentially infected SSD?

I recently fell victim to some Adware (and possible malware). I was installing Firefox and clicked an ad link in Bing and downloaded a "packaged" Firefox install. I believe the ad is still at the ...
0
votes
1answer
120 views

I just found many facebook entries on my registry? [closed]

I don't have a Facebook account but I was messing with my registry deleting old stuff and I found a bunch of Facebook keys and folders. Facebook is notorious for being a tool for spy agencies and has ...
1
vote
1answer
90 views

Secure point to point remote access to NAS drive

This question is very similar but also distinctly different (How do I ensure data encryption on Samba transmission on *NIX systems?) I'm looking to set up remote access to a NAS unit locally sharing ...
1
vote
2answers
132 views

Vmware over unsecure os

I run VMWare with Linux through my Windows OS. I want to use the Linux VM for online transactions. Is it possible for a virus, spy or worm to attack my Linux VM from the Windows host? Is my Linux ...
0
votes
1answer
153 views

How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?

I have a GPG certificate from someone used for email -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) I would like to import that into Windows Certificate Manager So ...
1
vote
3answers
288 views

Looking for a (simple) utility to decrypt rsa-encrypted text in Windows?

Quick question: I'm looking for a simple utility program to be able to decrypt rsa-encrypted data (either base64-encoded or binary attachment) on a Windows workstation. Scenario: There is a group of ...
0
votes
3answers
389 views

How can I spoof source ip address while making a ping request from windows command prompt? [closed]

I am using ping command to test my website which is running on a local server at the moment.
1
vote
2answers
157 views

Setting up a security lab, looking for a little guidance [duplicate]

I'm new here. Over the past couple of years I've had a growing interest in the security aspects of IT/CS. Recently, I've started setting up a lab for myself based on a kali/win7 dualboot and I've ...
1
vote
0answers
25 views

Use cases for IPC security windows communication

There are two processes on windows machine. One is in user space and second is a service. User space process sends data to service. Because iam starting to think about securing somehow communication ...
1
vote
0answers
47 views

Are Secure Desktop and separate process enough for hiding sensitive information in RAM?

In my program, I have an encrypted database on the file system with a password. It is decrypted in RAM, and the sensitive data get spread out too much in RAM for mistake to be auditable easily enough. ...
1
vote
0answers
126 views

PowerShell / Windows - Security best practices for enabling Windows Remote Management

As the title indicates, I'm looking for industry best practices for enabling Windows Remote Management on a mix of Windows Servers (from 2000, 2003, 2008/R2 and 2012) to allow PowerShell to execute ...
3
votes
1answer
222 views

What useful security reports can be extracted from a Windows-based machine and its' related logs?

What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)? Assuming I can aggregate them into a report what ...
12
votes
9answers
4k views

Can an old operating system webserver be made secure?

I have an old laptop with far too little RAM to run Linux (including specialty distributions). It can however run Windows 98 just fine, and I'm looking into turning it into a tiny retro webserver. Is ...
2
votes
2answers
123 views

Is my data secure in locked screen if I use bitlocker

My SSD is currently encrypted by bitlocker right now. So let say if I leave my laptop on locked state (Win+L). Is it possible for someone to get access to my data? Few thing I noted are: If someone ...
3
votes
2answers
670 views

Can a physical attacker compromise a Windows machine with UEFI, secure boot and bitlocker?

Machines such as the MS Surface Pro 3 comes with bitlocker encryption and UEFI secure boot out of the box. However, the default boot order is network -> usb -> ssd. If an attacker gets physical ...
1
vote
0answers
117 views

Migrate a x509 key using KSP (CNG) to CSP (CryptoAPI) in Windows

I have a code signing certificate issued to me by a commercial CA, and the key was generated on my local development machine using the new Cryptography Next Generation storage providers. ...
18
votes
1answer
3k views

Why do you have to be an admin to create a symlink in Windows?

In linux every user can create symlinks, but in Windows I need an admin command line, or mklink fails. Why is that?
2
votes
1answer
489 views

IIS 7 World Wide Web Publishing Service service account

We have a security requirement for IIS 7 (Windows 2008R2) that reads as follows: The service account ID used to run the web site must have its password changed at least annually. ...
1
vote
1answer
43 views

Possible to change the CA that a keypair is using?

Pretend I take the same CSR and send it to two different CAs as described in the following scenario: I create a CSR on Windows I submit the CSR and edit my SAN names. Request is pending at the CA ...
0
votes
1answer
88 views

How to enforce TLS on Windows [duplicate]

In Windows 2008 R2 and 2012, how do you enforce TLS-only and how do you demonstrate that posture? I am in IP Compliance and have a strong background in practical system administration and support. I ...
2
votes
1answer
103 views

Resources to learn about Windows systems exploitation [closed]

I'm a beginner in penetration testing, and I'm struggling with finding decent material to learn. I used book about nmap, Metasploit, exploit writing etc..., but they contained too much information ...
0
votes
0answers
46 views

Does Miranda-IM/Miranda-NG encrypt all messages?

Since the demise of GTalk a few weeks ago, we've found that MIM seems to be the lightest instant messaging client out there. It connects to multiple chat services (MSN, Skype, Yahoo) Our main concern ...
0
votes
0answers
44 views

Translating BUILTIN\Users Privileges and Security Settings

I would like to rid my CustomUsers security group from it's dependency on the BUILTIN\Users security group. My goal is to achieve the following: Tightened security (the OS is also hardened) Easy ...
22
votes
4answers
7k views

How secure is Windows 8's Picture Password login?

The final Windows 8 build has been released to manufacturing. One of the new features of Windows 8 is "Picture Password", where the end user logs on to Windows by clicking a specific pattern on the ...
1
vote
1answer
68 views

Can I create an application that can decrypt data but the administrator of the application cannot?

I have a windows application with a configuration file that contains some database passwords. I'd like to encrypt this data in such a way that my application can decrypt the data, but that the ...
2
votes
1answer
385 views

Can someone explain, in simple terms, how the FREAK attack on browsers works?

Is there a reason it only affects browsers on Windows machines and not Mac's or UNIX/LINUX environments? A lot of the wording on this site is particularly complicated and I don't understand fully what ...
0
votes
0answers
97 views

Open source database of malware signatures

I'm looking for an open source database of malware signatures/hashes (if possible regularly updated and well documented) that I could use in one of my software for scanning a huge numbers of files ...
3
votes
1answer
67 views

Any reason for a user to use an email scanner if they don't use any offline mail clients?

I typically recommend that users enable a real-time email scanner (aka a mail shield) in order to detect a possible vector used by malware. Even if they don't use an email application, the rationale ...
18
votes
4answers
12k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
1
vote
0answers
91 views

What is the security of Powershell “TrustedHosts”? (is it just a name match)?

Powershell has a TrustedHost section that is configured like this: winrm s winrm/config/client '@{TrustedHosts="CorpServer56"}' What security is implied for CorpServer56? Is it just an ASCII name ...