Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

1
vote
1answer
123 views

How can I send a file with DLL to Cuckoo Sandbox?

I want to submit an executable for analysis in Cuckoo Sandbox. The file must be in the same folder with a DLL I have. How can I request Cuckoo to test my exe and make it run properly? (i.e exe and ...
4
votes
7answers
585 views

How to completely remove all traces of a file in Windows 7?

I'm curious to know how to completely erase all possible traces of files in Windows 7. For example, let's say I have a subfolder containing five different files at work deemed sensitive (A document, ...
0
votes
2answers
136 views

How does malware install itself as a service without requiring user's credential?

I order to understand malware, I've tried to create a toy-example myself. However, I don't understand how the malware install itself on the computer as a service, without the credentials of the user. ...
1
vote
0answers
27 views

Problem using custom CryptoNG KSP on IE 11

We are currently developing a custom KSP (Key Storage Provider) for a Key Storage System. We successfully developed a CSP (CryptoAPI) and a KSP (CryptoNG) provider, and both work really fine for ...
0
votes
1answer
60 views

Is it a breach to have a ssh program into a tomcat server

I start to working in a project here and find something that at least seems odd to me. Since I'm not an specialist I came here to ask. It is a Java Web project that was made to run into a Tomcat ...
0
votes
0answers
38 views

Using Client's Non-exportable Private Key from Windows Cert Store in Mutual SSL Authentication

In SSL, for Client Certificate Authentication, we have to use Windows Certificate Store. So client's certificate and associated private key is stored in windows store by importing PFX file containing ...
4
votes
1answer
118 views

Create memory dump from the windows commandline

I was following this blog post to dump the memory of a windows host. Sadly this method does not work on Windows Server 2012 because the memory drivers that come with mdd aren't signed and this is ...
0
votes
1answer
34 views

In NTFS EFS how is the symmetric key (FEK) generated?

I have some old backups that are encrypted using windows EFS and I no longer have access to the certificate used to encrypt the FEK symmetric key included in the files but I do have the password, user ...
15
votes
2answers
427 views

How much of a problem is it that Windows “hides” some of the trusted root CA certs?

Based on information on this page, Windows actually trusts many more root CA certificates than what are displayed when a user launches certmgr.msc and navigates to Trusted Root Certification ...
-2
votes
1answer
114 views

Check which ports are left open (vulnerable) and accessible in Windows OS from the Internet

Since open ports are a security risk, I would like to know which ports are open to the Internet (outside my network). I wouldn't think of all open ports as security vulnerabilities just the ones ...
27
votes
3answers
1k views

Are .dll files normally found in system32 but now in a user’s AppData folder always suspicious?

I recently had to read over some malware reports and associated logs for a confirmed malware detection and subsequent infection of a Windows asset. The logs clearly show .dll files in a user’s AppData ...
4
votes
2answers
121 views

Why would some Windows executables not have a “Digital Signatures” tab?

Why would some executable on a Windows 7 system not have a "Digital Signatures" tab? (With this question I am referring to those executables that are not part of Windows OS and to which the ...
1
vote
0answers
450 views

wonderlandads.com popup virus [closed]

Problem As for this or this or even this, my computer has been infected to this sh-t and my browsers open an annoying pop-up on every single click to whatever web page I am visiting and this is ...
3
votes
0answers
118 views

Possible Windows 10 Malware [closed]

Data: There are a set of Windows 10 computers. Out of 8 of those computers, three were found to have had the Windows OS altered in an unexpected way. An advanced malware/spyware infection is ...
3
votes
0answers
77 views

Enable FIPS 140.2 in Windows 7 (cng.sys version does not match with versions from NIST Validated list

I am currently working on an application running in Windows 7 Ultimate, and it has to be FIPS 140-2 compliance. As far as I have researched in ...
6
votes
1answer
276 views

Using Two-Factor Authentication to Stop Pass-the-Hash

Am looking into mitigations to Pass+the-Hash and Pass-the-Ticket in Active Directory that also improve overall network security, too. Have sorting through some of the many two+factor authentication ...
8
votes
2answers
342 views

Can a malware infect just by right clicking?

Someone I know got infected. He sent me the file to analyze. I downloaded the zip and it contained a scr file. I unzipped it and right-clicked to open it in Notepad++. It immediately got quarantined ...
2
votes
0answers
57 views

Is a keytab sufficient for logon?

Is possession of a Kerberos .keytab file (as generated by e.g. ktpass) sufficient to 'pretend to be' that user on a windows machine? For example, create a process as, or access network resources (e.g. ...
3
votes
0answers
32 views

how to create TPM_AUTHDATA as input in tpm commands ?

I'm writing my first program which use tpm (version 1.2) services in Windows 7 using TBS, in this program I'm trying to execute the TPM_CreateWrapKey command. I noticed that many commands like the ...
0
votes
1answer
71 views

EFS encryption in Windows

I'm trying to combine EFS encryption with VeryCrypt, system encryption. With EFS I can choose specific files/folders instead doing a whole drive encryption, so that is the reason I use it. I haven't ...
0
votes
0answers
79 views

Script to emulate DNS for Windows machine in honeyd

I want to simulate virtual Windows hosts using honeyd. To do so I have installed honeyd. I have configured honeyd as Windows XP SP1, and now I want to emulate DNS services on it. I used UDPot as a DNS ...
4
votes
2answers
228 views

What is the correct way to remove bitlocker secrets from a TPM when returning a device for warranty?

Note: This is not a question about how to preserve data on a device that is returned for warranty. Rather, this is a question about how to ensure that the encrypted remnant data on the device is not ...
-1
votes
2answers
84 views

Need tool to detect malware in several pdfs in Windows environment [closed]

I am looking for a Windows product that could detect malware in several pdfs in Windows environment. I don't want to use Python and I don't want to use Stream Dumpler. I am looking for something ...
3
votes
4answers
194 views

Simple tools for searching process memory for MSSQL connection strings

I'm working with a piece of software that handles all permissions in a Windows client binary on the user's computer. The software connects to a backend database using the sa account. The sa password ...
2
votes
2answers
147 views

How can an attacker tell when someone in a private network connects to the Internet? [closed]

I heard that your PC can get infected just by connecting to the Internet (even without the web). Assuming I'm connected to a private home network, how can an attacker tell that I just connected to the ...
0
votes
0answers
910 views

BRCM-LVG in home network

Shortly after the local cable provider upgraded our cable modem an item named BRCM-LVG appeared in the list of devices (two computers) connected to our Windows 7 homegroup. It contains a folder named ...
2
votes
2answers
122 views

I am not connecting to internet, do I still need the windows firewall on?

Forgive my ignorance but I am truly uncertain. Here is my situation: I have dual booted a Linux distro and Windows 7 on my machine. Windows 7 sole purpose is for gaming, that's all. I'm not planning ...
45
votes
3answers
5k views

Can USB drive infect my PC with malware if I don't allow any autorun.inf to run?

Assuming that I'm using a trusted USB flash drive (meaning that it's not some device that looks like a USB drive and whose purpose is to damage my PC), is it possible for my PC to get infected from ...
8
votes
1answer
130 views

How can I protect myself against software installing insecure root certificates?

With the recent news that Dell installed a root certificate with a publicly accessible private key on their notebooks, I'm wondering how I can protect myself against this kind of incompetence. Of ...
5
votes
1answer
112 views

Resetting the Windows RNG

According to this research, Windows seems to produce the same sequence of random numbers indefinitely when a process is kicked off before a VM snapshot is taken. This is a huge issue obviously when ...
0
votes
1answer
116 views

SAM and SYSTEM file copying to another PC

Can I copy a SAM file and a SYSTEM file of a laptop and just change my SAM file and SYSTEM file on my own PC? Will my PC then have the password of the laptop? Or is there another way I can copy the ...
84
votes
2answers
14k views

Can a rogue .wmv file “hijack” Windows Media Player?

I've downloaded a .wmv file using P2P. Attempting to play it with Media Player Classic (K-Lite Codec Pack) only gave me a green square in the playback window: I noticed that the video came with a ...
1
vote
2answers
91 views

Is a Windows (fresh installation) 7 really this safe against NMAP or am I missing something?

I am playing with NMAP in my small private network performing port scanning. So far I went through scanning the following OSs (Unaltered new installations - Meaning no extra software installed!): ...
3
votes
1answer
126 views

Join a computer to the domain or not?

If we have a computer on the network that is only used by one person that logs on using a local account, no noe will log on using a domain account, what are the pros and cons of joining/not joining ...
1
vote
1answer
92 views

Can OnionDuke malware actually spread to new systems through an image?

I do realize that questions about malware in images has been asked before. It just does not look like they answer the questions in this particular situation. This is about the OnionDuke APT malware ...
1
vote
1answer
44 views

Find the Encryption Key (used for network encryption) assuming a Trust Chain is being used on Windows?

If I double click on a .crt file, in Windows, I'm presented with three tabs General, Details, and Certification Path. I'm aware that the Certification Path tells you the details of which root and ...
12
votes
4answers
1k views

When using multiple operating systems, can they affect each other?

Let's say I have two different OS on my PC, Windows 10 and Linux. It is well-known that Windows collects a significant amount of information and sends it to Microsoft's servers, but I wonder if it ...
1
vote
3answers
85 views

Root access and malware

Would it help to defend against malware if I use a less privileged Windows 7 account for my day-to-day work?
3
votes
1answer
74 views

How to recover/log attempted passwords from a failed login [closed]

I saw the following question before: Is it legal to log passwords from failed logins? I think it raises another question: How do I log failed attempted passwords? That seems very useful when I need ...
4
votes
1answer
191 views

Do applications installing into AppData folder make UAC useless?

When UAC was first introduced, most well-behaving applications were installed into Program Files folder, so any tampering with executable files without explicit user consent became impossible. So when ...
6
votes
1answer
569 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
1
vote
2answers
139 views

Security Benefits in Replacing Windows Desktop Programs with New Windows Store Apps for Higher-Risk Uses?

Question: I'll put this as concretely as I can: For a small business-owning user of a Windows 10 PC who's highest-security-risk activities involve opening plenty of email attachments of PDF and ...
1
vote
3answers
432 views

Windows 7 Exploits

I just found my old, Windows 7 Ultimate installer DVD, so I thought I would set it up in a pentest-lab type environment, see what's possible and have some fun with it. So are there any publicly ...
3
votes
1answer
45 views

Two-tier PKI without OCSP?

I am currently in the planning phase of a two tier Windows PKI using this deployment guide, and I am stuck concerning the use of OCSP and the online responder role of ADCS. The guide mandates that ...
5
votes
3answers
242 views

How do Windows services access folders encrypted with NTFS EFS

If I understood correctly, when I enable NTFS encryption (EFS) for a specific folder in Windows, it uses specific account's user name/password (salted) to create asymmetric keys for data encryption ...
2
votes
2answers
90 views

Admin privileges from Random regedit modification [closed]

So lets say you can edit/insert one random key inside regedit (can be in any position in the entire tree structure HKLM/HKCU) in order get admin privileges. Any ideas?
1
vote
1answer
62 views

Find out what process is trying to initiate a connection in Windows

I'm not trying to find established TCP connections. I have a Windows 2008 R2 server and my host-based L3 firewall is showing one TCP connection ATTEMPT to a remote address. The connection is not ...
6
votes
2answers
145 views

What is the purpose of Intermediate Certification Authorities store in Windows?

Suppose I have CA1 root certificate and two intermediate CA2 and CA3 certificates issued by CA1. Would it pose any security issue if all of the intermediate certificates were installed in the root ...
5
votes
2answers
305 views

Decrypting SSL using Wireshark on Linux vs Windows

I'm working on decrypting my own traffic that gets sent through Wireshark and I've been following this guide for reference. I have been using the SSLKEYLOGFILE environment variable and I can get the ...
1
vote
1answer
70 views

AuthentiCode Launcher runs everything

Imagine a vendor uses AuthentiCode only to get rid of the yellow UAC warnings. To avoid buying new certificates each year, the vendor could create a Launcher EXE which is signed, requests UAC ...