A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.
8
votes
3answers
820 views
How can I mitigate the threat that DPAPick poses to my DPAPI protected data?
The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications).
DPAPick was presented at BlackHat ...
5
votes
2answers
562 views
Wine or sandboxie as sandboxes
I'm looking for a sandbox for Windows. I've looked at sandboxie but I don't know if it delivers what it promises. Is it actually safer to run programs inside sandboxie ?
I know a full-blown VM could ...
5
votes
4answers
116 views
can I find on which machine was a zipped archive created?
I have the following security issue. A zipped archive of emails was found on a machine (A) by using an undelete program. The claim made by the subject of the investigation is that they made the ...
3
votes
2answers
180 views
A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?
We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
3
votes
1answer
171 views
Best practice advice - folder security (windows environment)
An executive at the company I work for has asked me to set the permissions on a specific network folder so only they can access it. I don't usually do this, but in this case I need advice on the best ...
0
votes
3answers
195 views
Debugging and DLL-Injection
Hi I currently reading Gray Hat Python to learn about Debugging and various interesting techniques for binary analysis.
So far I have learned an amazing amount of stuff (just read about ...
0
votes
1answer
152 views
Due to which reason might a windows 7 password been reset to empty?
A user reports on monday he cannot access his windows 7 account anymore due to a "wrong password", which perfectly worked on friday. It turns out the password has been reset to empty for that account. ...
3
votes
2answers
108 views
DPAPI and malware
I'm considering using the Windows DPAPI to protect an ECDH key I use to encrypt some data in a local database in a Windows desktop application. I'm new to DPAPI, but its my understanding that DPAPI ...
1
vote
1answer
180 views
Padding oracle - Vulnerable Version of ASP.NET
I would like to install the vulnerable version of ASP.NET for testing purposes. I've thought about it and I guess the best way would be to delete/disable some security updates to make that possible. ...
-4
votes
1answer
87 views
Interaction Center User Applications with su10 [closed]
I noticed a piece of software on my laptop and I can't seem to be able to figure out what it does: Interaction Center User Applications with su10
Online search yielded pages of links to ...
0
votes
0answers
72 views
I need help configuring OpenSSH on Win2008 via CYGWIN [closed]
I need help configuring OpenSSH on Win2008 via CYGWIN!
THANKS in advance!
I am trying to configure an OpenSSH server on Windows Server 2008 Datacenter via CYGWIN. I have installed and configured ...
1
vote
2answers
115 views
is RDP7.0 authentication process secure enough?
Latest version RDP used NLA, CredSSP and TLS to secure the authentication process. It sound like secure but in reality does it really secure enough. I knew that the previous version RDP is ...
4
votes
5answers
2k views
Preferred UAC configuration in Enterprises that use Login scripts to map drives
In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work:
Dim WshNetwork
Set WshNetwork = ...
1
vote
1answer
233 views
Why is windows considered insecure? [duplicate]
Possible Duplicate:
Linux or Windows- the security issue
I often see people complaining that Windows is "highly insecure" while linux is MUCH more secure.
What exactly are the ...
1
vote
1answer
181 views
How does a developer interact with Microsoft Certificate *Web Services*
Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
3
votes
2answers
235 views
ASLR and how a program can actually call its functions
I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment.
As far as I know ASLR works by randomizing part of the imagebase address when ...
3
votes
3answers
5k views
Windows Firewall - how to block inbound for all .exe files in a folder
In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
2
votes
3answers
227 views
Dealing with untrusted administrators in a Windows domain
I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
0
votes
2answers
81 views
Suscpicious registry entry
In HKEY_USERS\S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxx\Software\Microsof\TATrial and HKEY_LOCAL_MACHINE\SOFTWARE\Microsof\TATrial there are entries Default (no value set) InstallDate (733998) ...
0
votes
1answer
213 views
Windows System event log warnings for smtpsvc
I get a lot of the following type messages:
Message delivery to the remote domain 'particular domain or IP address' failed for the following reason: The remote server did not respond to a connection ...
0
votes
1answer
135 views
How to analyze server crash dump after recent patch update? [closed]
I want to know, if there a way I can identify on windows systems an event / log generated due to patches incorrectly installed / or corrupted in the process. Is there a way I can process or look ...
1
vote
3answers
435 views
What is the most secure way to do OCSP signing without creating validation loops?
I'd like to enable the most secure OCSP validation that Windows 2008 SP1 and newer support.
Based on the following information, am I required to implement id-pkix-ocsp-nocheck on my OCSP ...
1
vote
3answers
4k views
Multiple running instances of rundll32.exe
I've noticed that in the Task Manager of Windows 7, I have multiple running instances (2) of rundll32.exe. Does this necessarily means that my machine is infected by a malware as noted here: ...
1
vote
1answer
221 views
IE on Windows 2012 doesn't show certificate or lock icon despite using HTTPS
Can anyone explain why IE on Windows 2012 doesn't show the lock icon despite using HTTPS when visiting the following site?
https://www.microsoft.com/en-us/default.aspx
I am able to see the lock ...
2
votes
3answers
273 views
Strange file named Aview.exe - WinClient
Today I've just discovered some strange files on my Win 7 PC.
I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe.
It is located in ...
8
votes
2answers
3k views
Checklist on building an Offline Root & Intermediate Certificate Authority (CA)
Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite.
Here is an image of the default cryptography settings ...
2
votes
2answers
4k views
aircrack-ng under Win7 — possible?
What needs to be installed to get the full aircrack-ng suite (or the closest possible equivalent) working under Win7?
Should you use VirtualPC, VirtualBox, or VMware Workstation for this?
Should you ...
2
votes
3answers
183 views
Boot or reboot to clean state on Windows each time?
I use virtual box to securely surf the web, but it's easy to get lazy and use the same image more than once. Currently, I have a golden Win 7 image that I built and loaded my required software. I ...
1
vote
5answers
716 views
how to import a private key in windows
Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys?
Is the only way I can do that by converting both ...
5
votes
6answers
393 views
How can a novice find proof of a system compromise?
I am almost certain a colleague has installed a keylogger on my system. I am totally new to IT security, but have substantial linux / windows / programming experience.
The system I believe is ...
2
votes
2answers
180 views
Command injection Windows platform
Let's say there's a site which is vulnerable to user's input.
For example users can ping a specified IP.
Since the site is vulnerable to Os command injection, a user as well as an IP address
...
1
vote
3answers
115 views
Is possible to know if increased marketshare means more viruses?
I'm having an argument with other developers about why more "viruses" exist (including all forms of external attacks, exploits, etc) in Android vs iOS. Like with Windows vs *nix, the main idea is that ...
2
votes
2answers
76 views
How to define different firewall rules for different users on the same machine running on Windows 7?
Provided that one machine running on Windows 7, connected to LAN, and connected to the Internet via a gateway in the LAN. There are two logon user accounts A and B on the machine. I want:
1, User A ...
2
votes
3answers
205 views
Identify a process that uploads data
I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about ...
2
votes
3answers
200 views
Making a Windows cert say it's purpose is “Ensures the identity of a remote computer”
Maybe this is a superuser.com question, I don't know.
Anyway, I want my cert to show up like this when I double click on it in Windows:
If I just double click on a random cert I get this:
The ...
2
votes
1answer
156 views
Fuzzing tool to find heap overflows in a Windows binary
Is there a fuzzing tool that can scan some arbitrary windows binary
and identify a set of heap overflow vulnerabilities?
For example, a tool that applies a set of heuristics or maybe a list of ...
2
votes
1answer
157 views
How should I audit and monitor shared TCP ports in Windows?
Windows has a feature called .NET TCP Port Sharing which allows different .NET applications to share the same TCP/IP port.
I would like to monitor the source and destination connections of each ...
1
vote
1answer
106 views
How to know what's the type of an attack and from whom is sent?
I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked.
How do I know what kind of attack it is and from whom is sent?
When he attacks, the RDP freezes and the ...
2
votes
1answer
121 views
Are COMET installations immune to “Slow TCP Reading” DoS on Windows? (Such as SignalR or WebSync)
My understanding is that COMET implementations of WebSync and SignalR do not directly use IIS and are a few layers lower on the ISO model.
After reading Qualys's blog regarding slow TCP reading, I ...
3
votes
1answer
128 views
Potential services.exe infected file?
I was asked by a coworker to help solve a problem with a remote client site through VNC. Immediately after connecting I've started noticing some strange behaviors that I am lead more and more to ...
1
vote
1answer
284 views
Windows 7 EFS - connot decrypt
I have some files on my laptop that were accidentally encrypted, I think by Visual Studio. I didn't even know that was possible. Anyway, the way I discovered they were encrypted was that I changed ...
0
votes
1answer
135 views
Windows Firewall accepts a three-second unicast response from any source
I have read this article but still has some doubts may be after that...
The Windows Firewall feature in Microsoft Windows XP Service Pack 2
(SP 2) accepts a three-second unicast response from ...
-1
votes
2answers
170 views
How to increase Windows PowerShell WebAccess security?
What are some recommended techniques to improve the security of powershell?
Google returns many articles about powershell security like these:
PowerShell’s Security Guiding Principles TechNet Edge ...
4
votes
1answer
79 views
Managing a large amount of MBSA Results?
I am responsible for scanning and fixing issues on ~50 servers with Microsoft Baseline Security Analyzer (MBSA) version 2.2. Unfortunately, there is no out of the box way to manage multiple MBSA ...
0
votes
2answers
83 views
Setting up a remote test environment correctly
My setup:
- Main Box (connected to network)
- VM1 : Linux
- VM2 : Windows 7
Both the VMs are running off VM Player and using Bridged: connected directly to the physical network and replicating ...
-1
votes
2answers
1k views
windows firewall disabled with Norton Internet security or Norton Smart Firewall? [closed]
My Company decide to Change antiviruses and anti-spywares and firewalls.
How to apply changes in all clients and servers safety?
Norton say: ( in this article):
When you are using Windows ...
1
vote
2answers
102 views
Auditing EXEs to ensure buffer overflow protections are in place? (such as SEHOP, ASLR, and DEP)
According to this answer, it's possible to compile a GCC-based application without certain buffer overflow techniques. Perhaps this is even possible with Visual Studio.
How can I audit a given EXE ...
1
vote
1answer
530 views
How to view which mac addresses are connected to some AP?
I set up an open AP. I know I can view mac addresses of connected users via AP's console (local console). this is not what I need.
I use tool like Netstumbler or inSSIDer on my Win 7 machine to see ...
0
votes
3answers
652 views
why Windows Firewall in XP cannot block outbound connections
wikipedia say: XP's Windows Firewall cannot block outbound connections; it is only capable of blocking inbound ones.
another article says: XP defends you with your traffic coming from the web but ...
4
votes
2answers
463 views
Discover what workstations a user us connected to in a Windows AD Environment?
I currently have a naughty user in my environment. We don't want to set any alarms of (even from speaking to the AD admins), and wish to discover the workstation the user is connected to in our AD ...
