Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

9
votes
1answer
309 views

Do the Windows shared source files compile into the same binaries as the retail version?

Microsoft makes the Windows source code available to certain third party organisations such as the US and foreign governments, universities etc. This is their Shared Source Initiative Is this a ...
9
votes
3answers
677 views

Is denying write access an effective way to stop ransomware?

I'm looking for ways to defend against ransomware. As part of this strategy I've come up with the idea to block myself from writing to as many locations (and files) as possible. It may be assumed ...
9
votes
5answers
2k views

Can a web server be secured with just a firewall?

I'm about to go online with my first web site, it is a small project hosted on a regular home PC running Windows 7. I want to keep the software footprint at minimum, so it only contains the operating ...
9
votes
2answers
2k views

How secure is PIN login to Windows?

I've just noticed that Windows 10 allow me to change my login method to PIN which is obviously much more convenient than entering my long and secure password after every startup / wake. I am just ...
9
votes
4answers
1k views

A firewall without any extra features [closed]

I have Kaspersky Internet Security (KIS) installed on my system. I always keep it disabled, yet using a few practices, I kept my system virus free for years: I disabled autorun using these tricks; I ...
9
votes
1answer
1k views

How to know the windows security dialog asking for username password is genuine?

I recently faced one issue. It appeared my outlook launched a dialog saying it needed password. It looked like this I noticed the "->" character in the domain name which usually it auto fills. Also ...
8
votes
5answers
1k views

Is disabling auto-run enough to protect against malicious code from removable media automatically infecting a machine?

If I block auto-run on a windows machine, is this enough to protect it from malicious code (assuming I don't run any files manually)? Or are there known vulnerabilities that may cause infection?
8
votes
7answers
5k views

Linux or Windows- the security issue [duplicate]

Possible Duplicate: Open Source vs Closed Source Systems Almost anyone who has grown up on Windows must have had the notion (that I had) of Linux being more secure than Windows- one of reasons ...
8
votes
3answers
2k views

Can I use the same keyboard on both my infected and non-infected computers?

I have a computer which is virus infected. Can I use the same keyboard on both it and a "safe/clean" computer without fear? Keyboards these days seem to come with built in software and thus must ...
8
votes
6answers
2k views

Using linux to combat windows flash drive malware?

I just put an old flash drive which i used with a windows machine into my linux. I noticed many files, mostly exes which were never visible in windows (my windows does not hide hidden files and ...
8
votes
4answers
7k views

How secure is Windows Auto-Logon?

Obviously, if auto-logon is enabled, anyone who can gain physical access to the PC can use the PC. That's not the question. The question is, when I enable auto-logon for my Windows 7 box, will there ...
8
votes
4answers
337 views

School's computers auto-login and can run .exe's

Before this semester, to use any computer across campus, you had to log into Windows with a username and password. This semester, when the computers start up they auto-login to an account (with let'...
8
votes
2answers
11k views

Can Keyloggers get passwords from Windows 7/8 Logon Screen?

If yes, do you know some examples of Keyloggers capable of perform this? EDIT: I mean when logon in the windows right after power on the PC and/or when locked with Win+L.
8
votes
4answers
3k views

Is Windows Firewall suitable for running in a production environment?

Is Windows Firewall suitable for running as the sole protection on a production web server? Is it hardened enough? Robust enough? and tested enough? I'm running a VPS with Rackspace on their cloud ...
8
votes
3answers
6k views

Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?

The firewall of my company has detected and blocked a repetitive (every 15 min) HTTP request from a PC, which tries to start a download of a file called ..._chrome_installer.exe(or so) from the host: ...
8
votes
1answer
204 views

Why would it be preferable for a system to shut down when the security log is full?

When running in a configuration that supports Common Criteria, Windows must be configured to shut down when the security event log is full. Why is this a preferable option?
8
votes
2answers
2k views

Possible to use a YubiKey in HSM mode to secure a Windows CA infrastructure?

I'm looking for a low-cost Hardware Security module, and discovered that YubiKey has a HSM mode. I'm not entirely clear if this HSM mode is what I'm thinking, but I'd like to use it as the offline ...
8
votes
2answers
26k views

Windows groups and permissions: Authenticated Users group meaning

What is the purpose of the "Authenticated Users" group in Windows? Under Linux it doesn't exist and I'm starting to think this is another idiosyncrasy or over-engineering of the Windows operating ...
8
votes
2answers
2k views

Can a webcam be turned on when disabled in Windows' device manager?

In addition to whether a webcam can be turned on without the indicator light, I was wondering if disabling the device in Windows' device manager is a good option. Of course when your system is ...
8
votes
1answer
185 views

Does Logging out of Windows make my computer much safer than only locking?

I recently saw the following security tip on my company's intranet: When you are done using a computer, always Log Off, Restart, or Shut Down. If you only lock your computer, your account ...
8
votes
3answers
460 views

Does setting a user password on Windows XP help protect against remote exploits compared to no password?

In a typical home user situation with a PC connected to the internet via a router, suppose we are not concerned with protecting the machine from people with physical access. Does setting a password on ...
8
votes
3answers
7k views

How to manage admin rights for helpdesk staff?

My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting. Helpdesk staff commonly require administrative rights to provide support for end users. I ...
8
votes
2answers
1k views

Local File Download vulnerability - What files can be downloaded to potentially compromise a windows system?

On Linux I have a good idea on what files I would like to get ahold of when you are sitting on a regular file download vulnerability. Any file on the entire OS system is accessible for download, which ...
8
votes
2answers
368 views

Can a malware infect just by right clicking?

Someone I know got infected. He sent me the file to analyze. I downloaded the zip and it contained a scr file. I unzipped it and right-clicked to open it in Notepad++. It immediately got quarantined ...
8
votes
5answers
14k views

How to trace a DDOS attack on a dedicated server and block it?

I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering. The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
8
votes
1answer
142 views

How can I protect myself against software installing insecure root certificates?

With the recent news that Dell installed a root certificate with a publicly accessible private key on their notebooks, I'm wondering how I can protect myself against this kind of incompetence. Of ...
8
votes
2answers
3k views

Preventing LSASS from storing clear-text passwords in Kerberos environment

It is a well known security risk that LSASS stores clear-text passwords if a user has performed a keyboard-interactive logon on a machine - be it local login to his/her workstation or using RDP to a ...
8
votes
1answer
796 views

Better way to import Win32 APIs from injected shellcode

I'm injecting native x86 code into a .NET application, via a TLS callback in the binary image. Unfortunately, .NET executables only import mscorlib.dll within the PE, and have kernel32.dll mapped ...
8
votes
2answers
750 views

CTF competitions/challenges that are Windows based?

I've been messing about in CTF's for a while and I also do pen-testing professionally, what i've noticed is a distinct lack of CTF competitions using windows environments. This is in stark contrast ...
8
votes
2answers
809 views

How can Network Disconnect be implemented for RDP on a Windows system (2003/XP or later)?

From NIST SP 800-53, Rev. 3: SC-10 NETWORK DISCONNECT Control: The information system terminates the network connection associated with a communications session at the end of the session or ...
7
votes
4answers
684 views

Security of different OS

At my work we are given a computer to set up at home so if we ever feel like working from home we can do so. The thing is that whenever it comes to developing for java I always prefer using windows or ...
7
votes
3answers
1k views

How effective is something like Deep Freeze against boot sector infections?

I work for an embedded system manufacturer and on our older generation systems, which are powered by Windows Embedded, a number of customers have been experiencing virus infections. Due to the real ...
7
votes
4answers
1k views

How to trace the actions performed by a virus?

Is that possible to trace the actions performed by a virus? Run Time , stolen data and the files consulted and get the relative impact on my pc.?
7
votes
7answers
800 views

Does Windows 10 leak information about your IP address?

There are various reports of Windows 10 automatically sending out data when the user opens the start menu. Can that information or other information that Windows 10 automatically sends out to the ...
7
votes
3answers
6k views

Any good free SSL proxy on windows? [closed]

I'm looking for SSL proxy capable of dumping requests. I want to test custom browser against SSL-MITM attacks. I'm able to re-route all traffic ongoing from browser to machine with proxy. ...
7
votes
2answers
522 views

What features do you look for in an Enterprise Log Management solution?

This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them. What are your requirements for such a Event Log ...
7
votes
4answers
2k views

Can the FBI or government agencies decrypt my hardrive and/or force me to give them the password?

I have seen other TrueCrypt questions as well "Windows encryption with BitLocker" and "Mac OSX encryption with FileVault". Does the FBI/NSA or other government agencies have access to my data or can ...
7
votes
5answers
1k views

How can I secure a network share from the insider threat?

We have a network share that contains thousands of files. I am concerned that anyone with access to the internet could copy that information to a CD. In addition to disabling all removable media, ...
7
votes
4answers
572 views

Finding date of last network access

I have a system that contains highly sensitive data that does not reside on the Internet. However, when I was going through the machine recently, I detected that it had cookies, and temporary internet ...
7
votes
3answers
4k views

HIDS detection system and registry changes

I use OSSEC HIDS to monitor XP and Windows 7 Operating Systems. When OSSEC flags changes in the Windows registry, I have no idea where to go for to look for information and identify if the changes ...
7
votes
2answers
3k views

Microsoft Office 2013 File Encryption

To what extent can the native file encryption provided by Microsoft Office 2013 (Word, Powerpoint, Excel, etc.) be relied upon to maintain the confidentiality of documents, especially within the ...
7
votes
1answer
6k views

Is CIFS/SMB (Folder Sharing in Windows) secure?

I have to back up some data from windows 7 machines over the internet, and I rarely use windows so am distrustful of it in general. Specifically: Is there any sort of check that the server is the ...
7
votes
3answers
11k views

Need a software that can monitor and log network traffic of installed applications [closed]

I need to monitor and log network activities of a specific software installed on my system. I know there are lots of network monitoring software out there, even system explorer has one built in. I ...
7
votes
2answers
2k views

When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?

When you take ownership of a TPM in Windows 7 you encounter a screen like this: Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
7
votes
3answers
6k views

UAC and Windows Services

A user has a PowerShell script that does some things that require administrative access on Windows Server 2012 with UAC enabled. When they run the script as a Local Administrator, it fails with ...
7
votes
3answers
39k views

Windows Firewall - how to block inbound for all .exe files in a folder

In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
7
votes
2answers
275 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
7
votes
3answers
1k views

How to hack a Win95 machine?

While playing with old operating systems, I came across that there are no remote code execution exploits available for Win95 machines, running just file share (no IIS or anything else). Win95 neither ...
7
votes
1answer
5k views

How to whitelist an Amazon ELB in a(ny) firewall?

We have a customer with a very locked-down network. Any outbound connections require whitelisting of the port and IP address. However, we are running our system behind an Amazon Elastic Load Balancer ...
7
votes
2answers
1k views

How can IA-5(1)(b) be enforced on Windows systems?

Note: I've also posted a question for this issue on non-Windows systems. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include ...