A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.
5
votes
6answers
393 views
How can a novice find proof of a system compromise?
I am almost certain a colleague has installed a keylogger on my system. I am totally new to IT security, but have substantial linux / windows / programming experience.
The system I believe is ...
2
votes
2answers
77 views
How to define different firewall rules for different users on the same machine running on Windows 7?
Provided that one machine running on Windows 7, connected to LAN, and connected to the Internet via a gateway in the LAN. There are two logon user accounts A and B on the machine. I want:
1, User A ...
2
votes
3answers
200 views
Making a Windows cert say it's purpose is “Ensures the identity of a remote computer”
Maybe this is a superuser.com question, I don't know.
Anyway, I want my cert to show up like this when I double click on it in Windows:
If I just double click on a random cert I get this:
The ...
1
vote
5answers
725 views
how to import a private key in windows
Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys?
Is the only way I can do that by converting both ...
2
votes
3answers
273 views
Strange file named Aview.exe - WinClient
Today I've just discovered some strange files on my Win 7 PC.
I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe.
It is located in ...
2
votes
3answers
205 views
Identify a process that uploads data
I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about ...
2
votes
1answer
156 views
Fuzzing tool to find heap overflows in a Windows binary
Is there a fuzzing tool that can scan some arbitrary windows binary
and identify a set of heap overflow vulnerabilities?
For example, a tool that applies a set of heuristics or maybe a list of ...
1
vote
1answer
106 views
How to know what's the type of an attack and from whom is sent?
I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked.
How do I know what kind of attack it is and from whom is sent?
When he attacks, the RDP freezes and the ...
2
votes
1answer
158 views
How should I audit and monitor shared TCP ports in Windows?
Windows has a feature called .NET TCP Port Sharing which allows different .NET applications to share the same TCP/IP port.
I would like to monitor the source and destination connections of each ...
3
votes
1answer
129 views
Potential services.exe infected file?
I was asked by a coworker to help solve a problem with a remote client site through VNC. Immediately after connecting I've started noticing some strange behaviors that I am lead more and more to ...
1
vote
1answer
286 views
Windows 7 EFS - connot decrypt
I have some files on my laptop that were accidentally encrypted, I think by Visual Studio. I didn't even know that was possible. Anyway, the way I discovered they were encrypted was that I changed ...
-1
votes
2answers
170 views
How to increase Windows PowerShell WebAccess security?
What are some recommended techniques to improve the security of powershell?
Google returns many articles about powershell security like these:
PowerShell’s Security Guiding Principles TechNet Edge ...
0
votes
1answer
135 views
Windows Firewall accepts a three-second unicast response from any source
I have read this article but still has some doubts may be after that...
The Windows Firewall feature in Microsoft Windows XP Service Pack 2
(SP 2) accepts a three-second unicast response from ...
0
votes
2answers
83 views
Setting up a remote test environment correctly
My setup:
- Main Box (connected to network)
- VM1 : Linux
- VM2 : Windows 7
Both the VMs are running off VM Player and using Bridged: connected directly to the physical network and replicating ...
4
votes
1answer
79 views
Managing a large amount of MBSA Results?
I am responsible for scanning and fixing issues on ~50 servers with Microsoft Baseline Security Analyzer (MBSA) version 2.2. Unfortunately, there is no out of the box way to manage multiple MBSA ...
1
vote
2answers
102 views
Auditing EXEs to ensure buffer overflow protections are in place? (such as SEHOP, ASLR, and DEP)
According to this answer, it's possible to compile a GCC-based application without certain buffer overflow techniques. Perhaps this is even possible with Visual Studio.
How can I audit a given EXE ...
-1
votes
2answers
1k views
windows firewall disabled with Norton Internet security or Norton Smart Firewall? [closed]
My Company decide to Change antiviruses and anti-spywares and firewalls.
How to apply changes in all clients and servers safety?
Norton say: ( in this article):
When you are using Windows ...
0
votes
3answers
652 views
why Windows Firewall in XP cannot block outbound connections
wikipedia say: XP's Windows Firewall cannot block outbound connections; it is only capable of blocking inbound ones.
another article says: XP defends you with your traffic coming from the web but ...
4
votes
2answers
464 views
Discover what workstations a user us connected to in a Windows AD Environment?
I currently have a naughty user in my environment. We don't want to set any alarms of (even from speaking to the AD admins), and wish to discover the workstation the user is connected to in our AD ...
3
votes
1answer
155 views
How do I configure Terminal Server (and clients) for use over untrusted Wifi networks?
Suppose a client wants to directly connect to Terminal Server exposed to the Internet, without a VPN, ... what software & settings is needed to properly protect against WiFi based attacks? ...
12
votes
4answers
331 views
How to safely synchronize time over Internet?
All modern OS now keep accurate time by regularly synchronizing time over an untrusted network - Internet. Could an attacker conducting a MITM attack, influence or change the time of a computer while ...
7
votes
1answer
303 views
Better way to import Win32 APIs from injected shellcode
I'm injecting native x86 code into a .NET application, via a TLS callback in the binary image. Unfortunately, .NET executables only import mscorlib.dll within the PE, and have kernel32.dll mapped ...
3
votes
3answers
5k views
Windows Firewall - how to block inbound for all .exe files in a folder
In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
0
votes
1answer
156 views
Deny domain admins from steal User files on PCs [duplicate]
Possible Duplicate:
Dealing with untrusted administrators in a Windows domain
I'm trying to block Domain Admins from accessing classified files on PCs that joined the domain. But it looks ...
2
votes
3answers
228 views
Dealing with untrusted administrators in a Windows domain
I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
0
votes
0answers
125 views
TrueCrypt Windows FDE Multi-Boot [closed]
I tried to achieve Matt's setup in my VM with Ubuntu and Debian (both having their separate /boot partition). Everything worked smoothly, but enabling TrueCrypt-FDE on Windows, I could still access ...
2
votes
4answers
321 views
Virus won't be picked up by Antivirus tools
Today we found a virus / trojan on our network which has thus far:
Hidden all files and folders
Replaced the hidden files and folders with executables of itself, with matching icons, and renamed ...
1
vote
1answer
86 views
Best way to secure file removals in Windows remotely
I have Windows 2008 R2 box on colocation. I want to remove certain files with a high degree guarantee it cannot be recovered from physical HDD access.
Could someone please explain what levels of ...
3
votes
1answer
137 views
Is it possible to prevent user from dumping hashes?
I run a Windows server, is it possible to prevent user from enumerating user password hashes?
Also can someone explain how the hash dumping tools works? As I didn't find it with google
0
votes
1answer
71 views
How does duqu implement its dll files in PNF file format?
As you know files with PNF extension are associated with bitmap file type, from technically point of view how did authors of duqu implement this? as I concluded it is possible to make dlls in any ...
4
votes
1answer
481 views
AIA/CRL locations for Offline Root
I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building
It's an ...
1
vote
1answer
123 views
Worst-case scenario for ShellExecute(0,“open”,arbitrary_string)
I found an application that uses ShellExecute to open hyperlinks. However, it doesn't check if the string is actually a hyperlink - it is passed directly to ShellExecute.
Aside from opening arbitrary ...
5
votes
3answers
434 views
Can you extract memory contents from a hibernated Windows machine?
In a recent discussion about hardware hacks, attacks surrounding Windows hibernate popped up. I am not entirely convinced that it would be viable to get stuff out of the memory saved to disk.
When ...
1
vote
4answers
109 views
Potential consequences of using “Everyone” to manage permissions?
If a web application is set to run using a specific account, could a malicious user do something they shouldn't if I use the "Everyone" account to manage permissions on a folder on the server? The ...
2
votes
1answer
262 views
VMware Workstation 9 Security Best Practice Guides
Could someone please be able point me in the direction of where I could find some best practice security guides for VMware Workstation 9 please? I've searched the VMware site and to say it's badly ...
-2
votes
1answer
157 views
How do I remove a root kit from Windows XP? [closed]
I was looking for root kits following these instructions
http://computersight.com/software/how-to-manually-remove-rootkit/
and saw this in my boot log:
Loaded driver ...
4
votes
2answers
521 views
How does syskey in Windows increase the security in a domain?
I use syskey in windows XP and Windows 7. I've read Microsoft's article but I have questions.
How does this solution increase security?
What are differences between using Syskey in a client that ...
1
vote
1answer
185 views
SafeSEH and x64
I read here that
/SAFESEH is only valid when linking for x86 targets. /SAFESEH is not
supported for platforms that already have the exception handlers
noted. For example, on x64 and Itanium, ...
0
votes
3answers
7k views
How to detect if files were saved or copied to a USB drive?
How can I find out if files from my computer were written/copied/moved to a USB storage device? I want to know if there is a solution that would work in a system that has not got any ...
3
votes
1answer
52 views
auditing mod security rule sets
Is there a audit system that can help me try my strings? Such as user agents, post/get data, a simple way to test general sql injections to see how my rule sets hold?
I know with fire fox I can ...
0
votes
3answers
1k views
How to list missing security updates for Windows servers?
I have a list of applied security patches and updates, exported from Windows server 2003.
The exported list is in CSV format, but converting it is not a problem for me.
Is there any tool/site/script ...
0
votes
2answers
411 views
Running Apache as system service on Windows 2003 R2 64-bit
Trying to make my point, that running Apache with PHP5 module as Windows service is not secure.
All I got to prove it - FTP access to some internal website.
So what I did - I uploaded file test.php ...
10
votes
2answers
267 views
How insecure is PowerShell Web Access?
Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones.
This sounds cool and scary at the ...
0
votes
1answer
178 views
is it OK to grant permission for IUSR_ to cmd.exe?
One of my developers asked me to grant permission to IUSR_ user (the IIS user) to CMD.exe (console) now I'm wondering is it safe to do it? He is complaing, that his libraries had to use console for ...
1
vote
2answers
102 views
Where are located the DPAPI BLOBS and is there any tool to decypher them?
I'm doing some testing with DPAPI for a project where I'm involved. I would like to know where the users Masterkey are located and if there is any free utility to find and decipher them.
I'm pretty ...
4
votes
1answer
89 views
Does DPAPI works if a user hasn't a login password?
I was wondering if the DPAPI will still work properly if a user doesn't have a a login password (like most of the home users). I can't find this information on Google or in the official documentation ...
4
votes
2answers
409 views
How would I go about rebuilding the IAT of a packed executable?
When executables are packed with a tool such as UPX, the real code and data sections are encrypted or obfuscated, then loaded into memory using an injected decrypter stub. This makes static analysis ...
2
votes
1answer
80 views
Which .CER file format is more secure for purposes of an AIA record?
What file format is most appropriate or secure for the AIA record in a PKI certificate?
The options I'm aware of are:
DER encoded binary X.509 (.cer)
Base-64 encoded X.509 (.cer)
I also have the ...
1
vote
1answer
186 views
Silent (no user interaction) utility to clear cached credentials on Windows [closed]
Is there any way to clear cached credentials on Windows, that doesn't require:
user interaction (e.g. a confirmation window);
administrator access; or
making a persistent change to the ...
3
votes
2answers
190 views
How does duqu delete itself?
I'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?
