Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

7
votes
4answers
1k views

How to trace the actions performed by a virus?

Is that possible to trace the actions performed by a virus? Run Time , stolen data and the files consulted and get the relative impact on my pc.?
3
votes
3answers
208 views

How to check if I have a rogue SSL/TLS certificate?

It's known, that if someone manages to install their certificate as a trusted certificate on your Windows computer, they can read all you SSl/TLS traffic with man-in-the-middle attack and you won't ...
2
votes
1answer
56 views

Will browsers trust an expired self sign certificate in the Trusted Root store

I recently discovered that if Windows AD LDS services are bound to a self signed certificate, that processes will continue to trust the cert even if it's expired. My guess is this is because the cert ...
1
vote
1answer
70 views

Windows command line does not check for revoked certificates: How bad is it?

I recently updated my D-link wifi dongle driver. However, I had to do this through the command line because Microsoft revoked the D-link certificates after a leak. The executable would simply not ...
2
votes
2answers
307 views

Track USB activity on Windows

I want to know what happens in my USB Devices (file creation, file renamed, etc) without using an external tool. I'm using Windows 7, can I enable some GPO to log these actions? Here the event 4663 ...
3
votes
2answers
56 views

Is ignoring share permissions ok?

For my small home network I've found that it is easiest to setup network shares with share permissions set to Everyone: Full Control share permission and then configure the NTFS permissions according ...
0
votes
1answer
62 views

External Hard Drive Operating System [closed]

If I put a OS onto a External hard drive, would it allow viruses to infect my internal hard drive?
-2
votes
1answer
112 views

How does Windows 7 login work? [closed]

Maybe the question can be considered ambiguous, so: how does Windows 7 work for its login authentication? What are the involved processes and what do they do?
1
vote
1answer
127 views

Privilige escalation with CreateNamedPipe and Impersonation for Windows Server 2012

While working with window based application came to know that local privilege escalation is possible when we use CreateNamedPipe method with Impersonation. This vulnerability was reported in Windows ...
0
votes
1answer
155 views

Is that possible for Linux and windows machines to be infected with KeRanger ransomware?

According to theguardian The Transmission site offers the open source software that was infected with the ransomware called KeRanger malware, it's programmed to encrypt files on an infected personal ...
0
votes
0answers
27 views

Windows : security of USBNET / RNDIS

I'm having trouble finding documentation about how to setup any security for RNDIS or if the system is already secure enough. For those who doesn't know RNDIS is a protocol that permits a USB ...
0
votes
1answer
185 views

Block OS fingerprinting without using iptables?

I have a Linux machine connected to a Windows 98 PC on port 104. Now I want to block the OS fingerprinting using nmap for the windows 98 PC. I tried using iptables (blocking that particular port) but ...
9
votes
3answers
677 views

Is denying write access an effective way to stop ransomware?

I'm looking for ways to defend against ransomware. As part of this strategy I've come up with the idea to block myself from writing to as many locations (and files) as possible. It may be assumed ...
0
votes
1answer
96 views

What is the difference between a certificate, a signature and a thumbprint in case of windows exe/binaries?

I am trying to understand the difference between signature , thumbprint and certificate in context of windows executable and binaries. I looked up on internet before posting this question but I did ...
0
votes
1answer
59 views

Security implications of “local admin on host OS” vs “local admin on virtual guest OS”

At work we have a discussion on computer security. The scenario: Our work PCs are Windows desktops that are part of a windows domain Users have domain accounts they use to log in to windows The ...
4
votes
1answer
247 views

Impersonating a computer in a Windows domain

I've been trying to wrap my head around how computers are identified and granted access to a Windows domain. More specifically, I've been asking myself if whatever mechanism is involved really ...
4
votes
1answer
704 views

(ctrl + alt + del) on Windows 8/8.1/10

After seeing this answer I wondered, how is this done in newer versions of windows, where [ctrl + alt + del] is no longer required for login? Was this feature just removed, or is it somehow ...
1
vote
1answer
45 views

Privilege seperation when using the same login credentials?

While thinking about preventing ransomware attacks on my machine I stumbled across the following question: Assume I'm on a Windows (10) PC. Assume further that I have two (local) accounts, one with ...
6
votes
1answer
111 views

Can windows domains be faked?

Without the equipment and software (and knowledge yet) readily available to test myself, I've been wondering about the relationship between computers and domains in a Windows environment. Some ...
1
vote
1answer
117 views

Unexpected attachment inside PDF

I have a PDF file that I downloaded in august last year. At that time, I opened it using Adobe Reader and didn't notice anything suspicious. Only today when I opened it in SumatraPDF did I notice that ...
0
votes
3answers
242 views

Are we anonymous when not connected to internet on windows?

When we don't use internet on windows, can windows or any Laptop vendor can access our Laptop (similar as connected to internet ). If yes, then How ?
1
vote
0answers
53 views

What personal information, if any, can be gleaned from a Microsoft APPCRASH problem signature?

I am trying to debug an "APPCRASH" problem event for a program running on Microsoft Windows 7. When this happens a problem signature is presented, like this example from SuperUser: Problem Event ...
16
votes
3answers
5k views

Running windows in virtual machine, should I bother with security?

I'm running Windows in a virtual machine on my mac (via Parallels). Should I bother installing antivirus, firewall and using other conventional wisdom practices (like don't open unknown .exe etc)? I ...
0
votes
2answers
92 views

How reliable is the method of overwriting deleted files with large files? [duplicate]

In addition to the question posted regarding purging data without formatting and the ability to recover data with forensic tools, how reliable is the method regarding overwriting with large file sets? ...
0
votes
0answers
36 views

Rootkit driver to change executed instructions

Say I have a process that has a bunch of functions I want to NOP out. From userland, I want anyone viewing the virtual memory to see the normal instructions. However physical memory, and in the end ...
2
votes
2answers
134 views

Limiting FTP privileges on Windows Server

I currently have a Windows 2012 Server which is acting as a webserver running IIS. I am using Filezilla to host an FTP server to allow some clients FTP access to their own websites. I have setup the ...
1
vote
1answer
169 views

What are the advantages and disadvantages of installing an operating system through network? [duplicate]

Netboot is a technology that allows a computer to boot through the network, instead of starting on a hard drive, USB stick or DVD, it connects to a remote server to retrieve a disk image to start. It ...
0
votes
0answers
50 views

How to prevent injection of Layered Service Provider (LSP) module in application with kernel-level?

LSP technology is often exploited by spyware and adware programs in order to intercept the communication across the Internet. For example, malware may insert itself as an LSP in the network stack ...
0
votes
1answer
86 views

How can I get someone to use PGP in emails [closed]

I do my part and ready to use PGP. There is a another user who is new to PGP.I have windows running, I did some installations to get PGP running.How can I get that user start using PGP ? what happens ...
2
votes
2answers
182 views

Block mobile tethering on android phones from Windows (DLP)

In our small organisation I have tried my best at implementing DLP by: Making sure users access all files from the server Local disks are denied access (forced to work only on network drives) ...
0
votes
2answers
89 views

Access to system32 [closed]

Is there a way anyone can access the system32 folder on Windows without being logged in? If so, how would he do that and how to prevent it.
4
votes
2answers
208 views

Location of Password Hashes on a Windows Local Machine?

"Where are the two locations that user's password hashes are stored on a local windows machine?" My place of business asked me this question. I know that the SAM stores password hashes, where would ...
3
votes
0answers
58 views

Lookaside List Injection

I've been reading a lot about Use-after-free and came across this document. It talks about a "Lookaside" injection exploit. The document says to empty the dynamic memory cache, called the Lookaside ...
0
votes
1answer
102 views

Why does Windows 7 remove Authenticated Users from file permissions when a folder is shared?

When I try to share a folder using the share tab in file properties, if I go back and remove sharing options from the Share tab, it also affects the Security tab, removing inheritance of permissions ...
3
votes
1answer
162 views

When using Dropbox to sync Keepass db, is it ok to open it in synced folder?

I'm going to be storing a Keepass 2 database file (.kdbx) in a local folder that's synced by Dropbox. Is it safe to use Keepass to open the database directly considering everything in the folder is ...
2
votes
0answers
89 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
0
votes
2answers
99 views

Are there any consequences of clicking on a URL to a facebook.com link?

So I stupidly clicked on a suspicious link on a Facebook post today. Guest account for shame. In my defense, it was a link to facebook.com itself, but it loaded a Facebook page, then seemed to ...
2
votes
0answers
233 views

Is possible to prevent input emulation with SetWindowsHookEx in specific application?

The one of technique of input emulation protection with automation toools like AutoIt or ACTools used most of simple game bot programs is SetWindowsHookEx usage WH_KEYBOARD_LL flags. This solution is ...
5
votes
2answers
173 views

Security of Windows Processes using “RunAs A Different User”

I've struggled to find much information on this topic. What I'm interested in is the following: Scenario A user is logged into a Windows (7, 8.1, etc) workstation as a standard non-administrative ...
1
vote
1answer
76 views

Track cmd executions history logs?

I bought a new notebook with Windows 10 Home edition installed on it. The notebook also had tons of other software pre-installed: all kinds of drivers, keyboard back-lighting managers and so on. I've ...
2
votes
1answer
265 views

How does Zeus (and other malware) inject code into other processes

Recently, I've been studying how malware works, most recently the infamously known Zeus bot, and I've noticed one thing that I don't seem to understand: The malware is said to be able to hook APIs in ...
2
votes
1answer
149 views

Is there any way to discover why Windows Smartscreen is flagging your download?

Since Windows Smartscreen is now marking downloaded files signed with SHA1 post 1/1/16 as potentially unsafe, we have had to get a new code-signing cert. With it being a new cert, it has no '...
3
votes
1answer
126 views

Is the Windows paging file safe in the encrypted partition?

I came across this setting called ClearPageFileAtShutdown. The setting is described here and says: If you are truly worried about security, boot Windows off a fully-encrypted drive. Then you needn'...
1
vote
1answer
77 views

How to protect Windows Registery from being changed or from programs trying to add keys

This question is with regards to Windows Personal PC. How to protect Windows Registry from being changed or from programs trying to add keys? I understand that the following general good practices ...
5
votes
2answers
117 views

Path Disclosure without ability to read files

So I am a pentester, and I have discovered "feature" on a server that allows me to, essentially, blindly traverse a web server's files (without executing or reading them). The problem is that I ...
2
votes
1answer
127 views

In Windows, what should I do to run a program with admin rights without concerns?

I'm currently using Windows 8.1 - 64 bits. In my computer, I have 2 accounts, 1 with admin power (used to install programs), and another without admin power (for everyday usage). There's a certain ...
1
vote
3answers
118 views

Is it possible to gain control of a Windows computer with no browser notifications when a user clicks a URL?

If so, how? Currently working on a spam filter for a large company and trying to determine the level of risk involved with this. We run many different Windows versions. This CNN video seems to imply ...
0
votes
2answers
117 views

Any idea to prevent on this case of security breach on Windows 7

I'm using a Windows 7 64 PC in my company. Today I found a strange username on the login screen. I checked and found some users' folders inside my Windows directory. Only my account from company ...
0
votes
0answers
41 views

Meeting HIPAA standards in a server-to-domain-client application?

Similar, inconclusive question by someone else found here: HIPAA requirements for local server The requirements are that the application runs on a Windows server and can be expected to connect to up ...
0
votes
2answers
64 views

How to reinstall Win7 from a D-drive on an infected laptop

The laptop is infected with some sort of bad stuff (virus? Trojan? malware? etc). I am thinking of wiping it clean and reinstal Win7 "from scratch". I am running Win7 from an HP Probook, which has a ...