A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.
4
votes
1answer
1k views
What's the risk of changing permissions of the Security Eventlog registry key to IT operations?
Background
Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code:
...
4
votes
1answer
2k views
What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?
What root certificates are/are not updated when the following checkbox is checked?
Additional questions
If I manually remove a root certificate, will this service replace that very certificate?
...
4
votes
2answers
769 views
Securing Windows 7 using Bluetooth
I'm thinking of using my iPhone as a device combined with a low power bluetooth usb key. So when the phone is gone the workstation locks. (I don't want it to unlock the workstation though, I'd prefer ...
4
votes
1answer
353 views
Security Risk of Disabling forceguest in non-AD Environment
Our application group is looking to deploy a product which requires that we disable forceguest in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. We are running on a Novell network (I know, I ...
3
votes
3answers
649 views
How can winlock virus change Windows Registry without admin permission?
When you try to install program you'll always asked about administrator permission. Same thing when you try to user 'regedit' command.
So I'm interested in how does this virus works. How can it edit ...
3
votes
4answers
726 views
Is Windows Firewall suitable for running in a production environment?
Is Windows Firewall suitable for running as the sole protection on a production web server? Is it hardened enough? Robust enough? and tested enough?
I'm running a VPS with Rackspace on their cloud ...
3
votes
3answers
750 views
what is the best keylogger for security uses?
Today we were robbed. A thief come to our home at night and stole some stuff including my brother's laptop.
I think that the right thing to do is to download a keylogger on my PC, just in case...
I ...
3
votes
2answers
663 views
Time server security error
Today at work, we brought out some PCs that were not used for a long time (were not in use when I joined this company so I have no idea about their history). After booting one of them (Windows XP ...
3
votes
2answers
268 views
Security Risks Involved in Deploying Win Server 2008 on a Linux host
The Question:
Are there any major security risks I should be concerned about, caused by installing Windows Server 2008 R2 onto a Linux Host in VirtualBox?
I run an Ubuntu box, with a fully-secured ...
3
votes
3answers
286 views
Is there is a way to lock my USB port over the device physically?
Is there is a way to lock my USB port over the device physically ?
For example I am connecting the USB mouse and keyboard on an public computer but I do not want anyone to remove them physically. I ...
3
votes
2answers
137 views
Potentially unsafe files on second hard drive, how to get my files back?
I have my files on a second hard drive (disconnected for now). This drive was connected to a system infected with Virus:W32/Virut. I have formatted my main hard drive and reinstalled Windows XP. Now I ...
3
votes
3answers
404 views
why blocking incoming traffic does not block chatting or VOIP
I just recently blocked all incoming traffic(all local ports and all external ips) in my windows 7 firewall and I understand that will not stop me from accessing websites as browsing needs outbound ...
3
votes
2answers
108 views
DPAPI and malware
I'm considering using the Windows DPAPI to protect an ECDH key I use to encrypt some data in a local database in a Windows desktop application. I'm new to DPAPI, but its my understanding that DPAPI ...
3
votes
2answers
235 views
ASLR and how a program can actually call its functions
I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment.
As far as I know ASLR works by randomizing part of the imagebase address when ...
3
votes
3answers
182 views
What ways are there to elevate from a non-priv account to system on windows?
I have a few computers at home on which i hack for fun. Until now google has been able to answer my questions. But now I need your help. What ways are there to elevate from a non-admin user to NT ...
3
votes
3answers
774 views
Need to secure (and add SSL?) RPC port 443 on Win2003 server
So I received an email from my system administrator who wants me to secure a server I own that seems to have a vulnerability in port 443 (which is Windows RPC over HTTPS). Disabling it I know causes ...
3
votes
2answers
523 views
SIEM and Windows Event Logs
When considering what Windows event logs to incorporate into a SIEM solution, should I be looking at just the Security event logs, or all categories of event log? How useful are the other categories ...
3
votes
1answer
83 views
Windows Phone and Hardcoding Values
Let us say that I have a Windows Phone application. If I hardcode a private key in the Windows Phone application, can people extract it once the application is released to the public on the Windows ...
3
votes
2answers
81 views
How can I identify / discover files hidden with ADS?
ADS, or alternate data streams, were added in to Windows in 1993 (First Windows NT version) as a feature of the new NTFS file system to help support some features of the Mac OS at the time. I like to ...
3
votes
1answer
137 views
Is it possible to prevent user from dumping hashes?
I run a Windows server, is it possible to prevent user from enumerating user password hashes?
Also can someone explain how the hash dumping tools works? As I didn't find it with google
3
votes
3answers
252 views
How to effectively (and reasonably) secure Windows in corporate environment.
A member on my staff recently had their work computer compromised while on their home network. The following is the information regarding their computer
Windows XP SP3 - fully patched at the time of ...
3
votes
1answer
171 views
Best practice advice - folder security (windows environment)
An executive at the company I work for has asked me to set the permissions on a specific network folder so only they can access it. I don't usually do this, but in this case I need advice on the best ...
3
votes
1answer
129 views
Potential services.exe infected file?
I was asked by a coworker to help solve a problem with a remote client site through VNC. Immediately after connecting I've started noticing some strange behaviors that I am lead more and more to ...
3
votes
2answers
190 views
How does duqu delete itself?
I'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?
3
votes
2answers
180 views
A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?
We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
3
votes
2answers
254 views
Mitigations for Windows clients that don't support OCSP Nonces
Windows 7 clients (and older) don't support NONCES, a key feature used in securing the revocation check. Without a NONCE a MITM could replay a previously signed response and alter the validation of ...
3
votes
2answers
132 views
Website file being altered
I have recently had random spam links inserted into 3 ASP.NET websites. The links are inserted into the physical file so it is not SQL injection attack.
The websites have very little in common other ...
3
votes
1answer
223 views
How do I use Windows 7 virtualization features to prevent transitive trust of admin credentials?
I am exploring using VMs to separate my administrative actions from standard user actions in Windows 7. The goal is to limit my risk and exposure when using "RunAs" to open an application or file ...
3
votes
2answers
290 views
Setup and record outbound traffic from a botnet in a sandbox/secure environment
How do I record the outbound 'attack' traffic from a botnet on a Windows XP machine? The captured traffic will be in the Windows XP firewall log.
I need to setup some kind of an experiment where I ...
3
votes
2answers
283 views
What criteria do you use for evaluating Client-Side / Endpoint security products?
What features are important to you in client-side AV and Firewall products?
Who benefits from these features? Managment, the end user, helpdesk.
Are there features that are being 'sold' by the ...
3
votes
3answers
204 views
Designing a Sandbox for Windows
I am thinking about the design for a sandbox, which is able to execute arbitrary unmodified, untrusted binaries. The goal is to implement an application
Unlike something like e.g. Google Chrome's ...
3
votes
1answer
56 views
Is access to the caller API in mobile phones a real security threat?
From time-to-time I receive "Unknown" caller on my mobile phone. I do not want to answer those calls as I do not trust the identity of a caller. I feel safer if I can see caller name or at least ...
3
votes
1answer
155 views
How do I configure Terminal Server (and clients) for use over untrusted Wifi networks?
Suppose a client wants to directly connect to Terminal Server exposed to the Internet, without a VPN, ... what software & settings is needed to properly protect against WiFi based attacks? ...
3
votes
1answer
52 views
auditing mod security rule sets
Is there a audit system that can help me try my strings? Such as user agents, post/get data, a simple way to test general sql injections to see how my rule sets hold?
I know with fire fox I can ...
3
votes
1answer
144 views
DPAPI offline attack by cracking windows password?
I'm thinking of using DPAPI to protect configuration file information in my program. After doing some reading on it, it looks like it uses the user's Windows password as part of the encryption ...
3
votes
2answers
363 views
How to counter or fix banner grabbing vulnerability
During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
3
votes
1answer
479 views
Which Domain Administrator created file X on a Windows 2008 R2-based server?
Someone created a file (web.config) in a location that basically caused IIS to not work. Is there any way I can determine who created this file?
The creator/owner says "Domain Administrators".
...
3
votes
1answer
112 views
Security track record of SSHD on Windows machines?
How do the various SSH daemons that run on Windows compare in terms of security? Vulnerabilities found, reviews by respected reviewers, source code availability, etc.
I only need access to a cmd ...
3
votes
2answers
100 views
Security Scanning for Desktop Applications
Our company develops Windows desktop applications. We offer off the shelf solutions - not custom development. A potential new customer wants to add a section to our standard contract that requires ...
3
votes
2answers
242 views
Hide web.xml file from public view
I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config.
I don't how to restrict. I tried with ...
3
votes
3answers
1k views
Securing a Windows Guest Account
I know that a person with physical access to a computer can do almost anything to it. My main concern with my Windows 7 guest account is privacy and sandboxing. I don't want a guest user to have ...
3
votes
1answer
266 views
CDNs used by Windows Update
My question is about CDNs (Content Delivery Networks) and their simultaneous use for legal and questionnable stuff. One specific example is the following.
I'm noticing taffic from our network to the ...
3
votes
1answer
165 views
eBay account compromised/Credit Card used/Hosts files changed
To preface this, I'd just like to let you know that I'd consider myself an intermediate security guy(Definitely not a novice, not yet an expert) I do have a story to tell, and would like to know if ...
3
votes
1answer
530 views
Should I only disable, but never delete an account from ActiveDirectory?
In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails.
Is this a ...
3
votes
1answer
133 views
What useful security reports can be extracted from a Windows-based machine and its' related logs?
What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)?
Assuming I can aggregate them into a report what ...
3
votes
1answer
57 views
What about AD2P vulnerability?
My goal is to create a simple one-way intercom using B Speech TX2 and B Speech RX2, an Audio2Bluetooth and Bluetooth2Audio converter.
My question is, how secure is the audio(in my case voice) being ...
3
votes
3answers
5k views
Windows Firewall - how to block inbound for all .exe files in a folder
In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
3
votes
0answers
121 views
MPPE-Send and Receive key derivation from MS-CHAPv2
I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
3
votes
0answers
145 views
How secure is HTTP basic authentication over SSL? [duplicate]
Possible Duplicate:
Is BASIC-Auth secure if done over HTTPS?
I want to set up a web server on a computer at home which will basically do no more than send the browser a file which contains ...
3
votes
2answers
107 views
Reading keystrokes of other applications
Is it possible for other application running in the OS to read the keystrokes that my application uses?
What about mouse events and window handles?
Is there any security wall that the OS uses to ...
