Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

1
vote
2answers
91 views

Is a Windows (fresh installation) 7 really this safe against NMAP or am I missing something?

I am playing with NMAP in my small private network performing port scanning. So far I went through scanning the following OSs (Unaltered new installations - Meaning no extra software installed!): ...
3
votes
1answer
150 views

Join a computer to the domain or not?

If we have a computer on the network that is only used by one person that logs on using a local account, no noe will log on using a domain account, what are the pros and cons of joining/not joining ...
1
vote
1answer
93 views

Can OnionDuke malware actually spread to new systems through an image?

I do realize that questions about malware in images has been asked before. It just does not look like they answer the questions in this particular situation. This is about the OnionDuke APT malware ...
1
vote
1answer
44 views

Find the Encryption Key (used for network encryption) assuming a Trust Chain is being used on Windows?

If I double click on a .crt file, in Windows, I'm presented with three tabs General, Details, and Certification Path. I'm aware that the Certification Path tells you the details of which root and ...
12
votes
4answers
1k views

When using multiple operating systems, can they affect each other?

Let's say I have two different OS on my PC, Windows 10 and Linux. It is well-known that Windows collects a significant amount of information and sends it to Microsoft's servers, but I wonder if it ...
1
vote
3answers
85 views

Root access and malware

Would it help to defend against malware if I use a less privileged Windows 7 account for my day-to-day work?
3
votes
1answer
77 views

How to recover/log attempted passwords from a failed login [closed]

I saw the following question before: Is it legal to log passwords from failed logins? I think it raises another question: How do I log failed attempted passwords? That seems very useful when I need ...
4
votes
1answer
225 views

Do applications installing into AppData folder make UAC useless?

When UAC was first introduced, most well-behaving applications were installed into Program Files folder, so any tampering with executable files without explicit user consent became impossible. So when ...
6
votes
1answer
626 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
1
vote
2answers
142 views

Security Benefits in Replacing Windows Desktop Programs with New Windows Store Apps for Higher-Risk Uses?

Question: I'll put this as concretely as I can: For a small business-owning user of a Windows 10 PC who's highest-security-risk activities involve opening plenty of email attachments of PDF and ...
1
vote
3answers
480 views

Windows 7 Exploits

I just found my old, Windows 7 Ultimate installer DVD, so I thought I would set it up in a pentest-lab type environment, see what's possible and have some fun with it. So are there any publicly ...
3
votes
1answer
48 views

Two-tier PKI without OCSP?

I am currently in the planning phase of a two tier Windows PKI using this deployment guide, and I am stuck concerning the use of OCSP and the online responder role of ADCS. The guide mandates that ...
5
votes
3answers
262 views

How do Windows services access folders encrypted with NTFS EFS

If I understood correctly, when I enable NTFS encryption (EFS) for a specific folder in Windows, it uses specific account's user name/password (salted) to create asymmetric keys for data encryption ...
2
votes
2answers
93 views

Admin privileges from Random regedit modification [closed]

So lets say you can edit/insert one random key inside regedit (can be in any position in the entire tree structure HKLM/HKCU) in order get admin privileges. Any ideas?
1
vote
1answer
66 views

Find out what process is trying to initiate a connection in Windows

I'm not trying to find established TCP connections. I have a Windows 2008 R2 server and my host-based L3 firewall is showing one TCP connection ATTEMPT to a remote address. The connection is not ...
6
votes
2answers
151 views

What is the purpose of Intermediate Certification Authorities store in Windows?

Suppose I have CA1 root certificate and two intermediate CA2 and CA3 certificates issued by CA1. Would it pose any security issue if all of the intermediate certificates were installed in the root ...
5
votes
2answers
336 views

Decrypting SSL using Wireshark on Linux vs Windows

I'm working on decrypting my own traffic that gets sent through Wireshark and I've been following this guide for reference. I have been using the SSLKEYLOGFILE environment variable and I can get the ...
1
vote
1answer
77 views

AuthentiCode Launcher runs everything

Imagine a vendor uses AuthentiCode only to get rid of the yellow UAC warnings. To avoid buying new certificates each year, the vendor could create a Launcher EXE which is signed, requests UAC ...
4
votes
1answer
355 views

What is the best way to encrypt my Windows user folder?

I'm trying to encrypt my user folder on a Windows 10 shared machine. I don't have Windows Pro, so EFS or BitLocker are no option. I can't encrypt or change the whole system since I'm not the only ...
2
votes
1answer
104 views

Secure sharing between Windows computers

I'm working on a project to setup a secure system to share files between 5 Windows computers. The computers are part of a domain so could have multiple different users logging in (based on an AD ...
4
votes
2answers
153 views

What is the difference between the “sig” files and the checksum files, such as on the PuTTY download page?

This is about the functional differences between sig files and checksum files and how they can be used by a user downloading some software. For example, on the PuTTY download page both sig files and ...
4
votes
1answer
210 views

Why is Windows password security designed this way? [duplicate]

Let's start with the LM hash. The LanMan hash had MONUMENTAL security flaws, like the password being case insensitive (converted to upper), which reduced the keyspace for a brute force attack. On top ...
3
votes
3answers
220 views

How can one execute code upon entry of folder in Windows?

Theoretical question, I'm just interested in how could this be done. I remember I had a virus on Windows7/8 (can't quite remember which one tho) which made Windows BSOD upon entry of a folder which ...
18
votes
3answers
789 views

How Do Rootkits & Other Low-Level Malware Still Manage to Load on Systems Protected by Secure Boot (and TB/MB)?

Let me try asking my question this way... Let's say that I'm a offensive cyber Bad Guy working for a foreign state-sponsored Advanced Persistent Threat unit. My unit is charged with, say, stealing ...
-1
votes
1answer
152 views

Unable to open port on Windows 7 [closed]

The scenario is as follows: while a PC was connected to our company's network, a specific application was able to open another process on a predefined port. It worked as expected. But now, this PC ...
0
votes
0answers
53 views

Encrypt a file before being copied

I am working on a program that will prevent data theft. I want to encrypt every file that is being copied to an external drive before it is actually copied using a symmetric encryption. Is it ...
8
votes
4answers
319 views

School's computers auto-login and can run .exe's

Before this semester, to use any computer across campus, you had to log into Windows with a username and password. This semester, when the computers start up they auto-login to an account (with ...
10
votes
3answers
3k views

Offline Bruteforce attack against a Bitlockered Windows PC

I am currently assessing the security of Bitlocker from the perspective of an offline attack against a stored password (used to secure the Full Disk Encryption key). My assumption is that the password ...
0
votes
1answer
256 views

Was I hacked remotely, how could I find out? Windows 7

I was cleaning out my old windows 7 HP desktop computer approximately 5 months ago. There was only the expired Norton 360 as far as antivirus and no firewall. Up until this point I disabled the wifi ...
5
votes
1answer
175 views

What are the differences between “simple” UAC and two user accounts on Windows?

I'm currently thinking about increasing security on my Windows machine. As part of this harderning I considered the least-privilege principle and want to apply this on Windows using two different ...
2
votes
0answers
64 views

userWorkstations attribute in AD preventing users from logging into WebApp

For some of our users in AD, we have set userWorkstations attribute to restrict access to other machines. But this is preventing those users from logging into WebApplications (around 50+) protected ...
0
votes
2answers
136 views

Analyze Windows executable

How can I see which files, ports, URLs, etc that are used by a suspicious Windows executable.
4
votes
0answers
134 views

Windows Certificate Services: Is it possible to enroll a SmartCard certificate AND have key archival?

I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option ...
76
votes
2answers
8k views

Windows language pack update with a gibberish name

This morning, I noticed that a new Windows update was offered to me. It looks very suspicious to me: Here are the update details: ...
0
votes
1answer
868 views

Is it that easy to crack a Windows SAM file?

My friend told me that he can easily crack a Windows SAM file using Ophcrack. Assuming that I have access to the whole config folder (the one which contains the SAM file) of a Windows machine, is it ...
34
votes
6answers
4k views

How do I purge Windows of my private data when formatting the drive is not an option?

I'm changing my employer, and I'm about to leave my office computer. Due to internal regulations and my supervisor's orders, I'm unable to format the disk drive. I was hoping I would be able to do ...
2
votes
1answer
229 views

Memory injection in games

I'm currently researching memory injection attacks on games in Windows 7/10. After reviewing several threads on this topic, there's a few questions which are still unclear. DLL injection can be ...
2
votes
0answers
59 views

Novicorp WinToFlash Lite, spyware etc

I used Novicorp WinToFlash Lite on Windows 7 to create a Windows 10 bootable USB memory stick. While creating the USB drive, I noticed that WinToFlash wrote something like adding blahblah files to ...
2
votes
2answers
116 views

Custom browser based on Internet Explorer - Uniqueness questions

I have developed a custom web browser for Windows using C# (based on Internet Explorer 11) and I'm trying to understand & solve the next issues: 1. I adjusted the User Agent string and the ...
4
votes
1answer
110 views

How does Trusteer Rapport make accessing websites more secure?

Trusteer claims that: Trusteer Rapport verifies that you are really connected to the genuine website as opposed to a fake website created by criminals. Surprisingly, it is not trivial to reach a ...
2
votes
1answer
91 views

When I connect my PC to a network, what (meta) information can the router/admin see that identifies my PC?

If I connect my Windows 7 PC to a third-party (wireless) network what information might the network admin be able to obtain about me? I know they can (sometimes) see traffic but that's not an issue ...
1
vote
3answers
294 views

Need help understanding Windows Authentication mechanism

Even if I enforce HTTPS and use anti-forgery tokens, it seems like Windows Authentication could be inherently insecure because it does not require that the user explicitly passes credentials from the ...
0
votes
1answer
47 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
3
votes
1answer
216 views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the ...
6
votes
1answer
102 views

How to check which certificate is being checked for revocation?

I have a .net desktop application without a certificate on a network not connected to the Internet When I start it, there is a call to crl.microsoft.com that times out and slows down the application. ...
1
vote
4answers
142 views

Redirection Malware Infection

I have AVG Antivirus installed on my PC. My PC is infected with some kind of bonjovi redirection malware. It randomly opens up a new tab in Chrome and loads porn sites. I have had this infection in ...
22
votes
3answers
2k views

Java SE 8, Update 51 Added “Native Sandbox” Protection for Windows PCs. Wait, what?

So I was doing a little research about differences (if any) between the sandboxing models for Windows 8/8.1 applications and windows 10 applications when I stumbled across something rather ...
-4
votes
1answer
149 views

Security Setting up personal web server [closed]

I'm sure something like this has been asked many many times over the Internet. I'm asking again because I need situation-specific response. I've already set up a home web server. My setup is like ...
0
votes
3answers
182 views

Chinese hieroglyphs appear on screen when signing out of windows [closed]

For some time now, when I try to sign out of windows or restart my computer, a message appears that a program forbids my computer from signing out and this program is a .exe file with Chinese ...
1
vote
2answers
5k views

How do we determine the SSL/TLS version of an HTTP request?

We are wanting to configure our Windows client to use only TLS 1.1 and greater. We've learned that we can do this by editing the registry. Now we want to make several HTTPS requests from different ...