A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

5
votes
5answers
2k views

what is the best keylogger for security uses? [closed]

Today we were robbed. A thief come to our home at night and stole some stuff including my brother's laptop. I think that the right thing to do is to download a keylogger on my PC, just in case... I ...
5
votes
3answers
444 views

What are the security considerations for setting up a basic security testing environment?

I only have 2 spare machines and both are very old, but I really want to set up an environment so that I can start practicing security. One of these machines has a Pentium 4 processor and 512 MB RAM; ...
5
votes
3answers
1k views

Is it possible to catch a virus on my LAN without clicking on anything?

My unpatched PC running Windows is connected to a network which contains other "infected" computers, can I get infected by viruses without any interaction on my part?
5
votes
4answers
657 views

Is Encrpyting Home Sufficient?

I currently have a fully encrypted Windows System, and I'm looking at switching to Ubuntu. Is encrypting my home directory (with ecryptfs) sufficient? On windows this would be problematic due to ...
5
votes
2answers
299 views

Do any crypto libraries take advantage of Windows GPU API “Direct Compute”?

Are there any encryption (decryption?) libraries that take advantage of the Windows GPU API?
5
votes
3answers
470 views

Are Windows security updates audited?

An IT guy said that in his company, the Windows updates (small security updates that are downloaded automatically by the Windows autoupdate) are checked by the auditor. ie: the auditor checks if every ...
5
votes
2answers
2k views

How would I go about rebuilding the IAT of a packed executable?

When executables are packed with a tool such as UPX, the real code and data sections are encrypted or obfuscated, then loaded into memory using an injected decrypter stub. This makes static analysis ...
5
votes
3answers
3k views

Designing a Sandbox for Windows

I am thinking about the design for a sandbox, which is able to execute arbitrary unmodified, untrusted binaries. The goal is to implement an application Unlike something like e.g. Google Chrome's ...
5
votes
2answers
1k views

Are there any Windows permissions management applications?

I am currently dealing with permission issues with an IIS app pool. I am tired of clicking through window after window to set permissions on folders for domain and local users. Also, I would like ...
5
votes
4answers
2k views

What are the most common files to check with File integrity monitoring software?

I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server. Is there a ...
5
votes
1answer
992 views

I'm having a DDoS attack, my hosting company is stupid, and I need to know what is hapening

So ok, right now my windows 2003 dedicated server is under attack by some guy who's flooding UDP packets (~90.000 packets/sec) on my 100Mbps server for the last 8 hours. I'm on a shared port, so I'm ...
5
votes
4answers
2k views

How widely deployed is TLS with cipher ECDHE?

Microsoft deployed a patch for Windows 2012 R2 and Windows 8.1 that adds the following ciphers. Cipher suite Exchange Encryption Hash TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DH ...
5
votes
3answers
750 views

Can a web server be secured with just a firewall?

I'm about to go online with my first web site, it is a small project hosted on a regular home PC running Windows 7. I want to keep the software footprint at minimum, so it only contains the operating ...
5
votes
2answers
940 views

What is the purpose of the entropy parameter for DPAPI.Protect?

So in Windows, when you make a call to the Data Protection API, you can specify some bytes as "entropy". To me, this sounds like salt. In PBKDF2, the salt is can, and in fact needs to be stored as ...
5
votes
1answer
2k views

Can a certificate have multiple chains and multiple self-signed roots?

The following MSFT document has this paragraph: All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed ...
5
votes
2answers
192 views

Can a Windows 7 PC with folder sharing and remote desktop disabled, still be penetrated by a rogue computer on the same WiFi or LAN?

Assume the network is already penetrated, and the attacker already fully controls another PC. Other than setting up a proxy to intercept traffic from all other systems on the network and use that to ...
5
votes
3answers
882 views

Can a physical attacker compromise a Windows machine with UEFI, secure boot and bitlocker?

Machines such as the MS Surface Pro 3 comes with bitlocker encryption and UEFI secure boot out of the box. However, the default boot order is network -> usb -> ssd. If an attacker gets physical ...
5
votes
2answers
9k views

Utilman.exe command prompt hack prevention?

This trick to hack windows and reset passwords(or create new logins)has been around for ages and still works on windows 7 and windows 8. Is there any way to disable the key combination that brings up ...
5
votes
1answer
209 views

User Account Control and outside processes

I was using TeamViewer (a remote desktop client) to log in to a remote computer running Windows 7. While logged in, the Java updater prompted me for administrator access to run an update check. Out ...
5
votes
1answer
319 views

Secure access to a Microsoft Access Database

I have a server set up with medical files in a Access database. I am taking over this job from an existing guy who has vanished, so I don't know all the details of the system. I can find out specific ...
5
votes
2answers
189 views

How secure is PIN login to Windows?

I've just noticed that Windows 10 allow me to change my login method to PIN which is obviously much more convenient than entering my long and secure password after every startup / wake. I am just ...
5
votes
4answers
177 views

How can I determine the domain controller when it's not in DNS?

On a penetration test going in blind for an organization, meaning no knowledge of network topology of design, no idea what the domain(s) might be, and domain controller is not apparent in DNS...how ...
5
votes
3answers
4k views

Wine or sandboxie as sandboxes

I'm looking for a sandbox for Windows. I've looked at sandboxie but I don't know if it delivers what it promises. Is it actually safer to run programs inside sandboxie ? I know a full-blown VM could ...
5
votes
1answer
7k views

Is windows 7 vulnerable to null session?

My lecturer told me that Windows 7 is not vulnerable to null session but did not explain why. What is the preventive measure that windows 7 did to protect against from it? The recommend fixes for ...
5
votes
3answers
623 views

When do Ps Tools send cleartext passwords, and how can I demonstrate this?

The Ps Tools from Mark Russinovich are very handy remote administration utilities. However, they all come with one big caveat. Note that the password is transmitted in clear text to the remote ...
5
votes
4answers
405 views

Introduction/refresher course on Windows security [closed]

Can someone point me to a blog or recommend a book with an introduction (or refresher course) to Windows security. I am not a newbie programmer, actually have more than 10 years of experience, with a ...
5
votes
2answers
410 views

Advice for writing my first application security review

I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The ...
5
votes
2answers
1k views

Password History/Password policy

I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008). Where is password ...
5
votes
3answers
409 views

How can I detect users that have requested AD Administrators to reuse an expired password?

There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it. ...
5
votes
2answers
3k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
5
votes
1answer
4k views

AIA/CRL locations for Offline Root

I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building It's an ...
5
votes
2answers
173 views

Windows Vista user logon integrity

Is it possible to delete some or all user session logon datetime records from Windows Vista? Is there any mechanism to give me confidence that individual records aren't deleted even if there isn't a ...
5
votes
1answer
2k views

How does a client authenticate the domain controller

On an active directory based network how do hosts authenticate the Domain Controller? Is it possible for an attacker to impersonate the Domain Controller? PS: I'm having a problem getting info on how ...
5
votes
1answer
1k views

IPSec Domain Isolation with Windows Server

I'm looking for a good way to secure my servers, I have a set of dedicated servers that are not in my office but hosted by an external provider. ALL the servers have only one public (WAN) IP. I don't ...
5
votes
1answer
4k views

What's the risk of changing permissions of the Security Eventlog registry key to IT operations?

Background Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code: ...
5
votes
1answer
1k views

Should I only disable, but never delete an account from ActiveDirectory?

In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails. Is this a ...
5
votes
2answers
112 views

Limiting Concurrent Login For System Admins On Windows Domain

Quick background: we are a smaller sized team meaning that we perform multi-function roles. Thus a developer is typically a DBA as well and some developers do have domain admin access. As a rule our ...
5
votes
1answer
7k views

Recover Server 2008 R2 Domain Admin Password

So I did the ultimate silly thing: I lost my domain admin password for my Server 2008 R2 box. Sure, I could just re-install but that's going to be a huge pain. I tried rebooting with the Windows ...
5
votes
1answer
326 views

Does DPAPI works if a user hasn't a login password?

I was wondering if the DPAPI will still work properly if a user doesn't have a a login password (like most of the home users). I can't find this information on Google or in the official documentation ...
5
votes
4answers
7k views

Preferred UAC configuration in Enterprises that use Login scripts to map drives

In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work: Dim WshNetwork Set WshNetwork = ...
5
votes
2answers
813 views

What are the risks associated with relying on IPSec IP Filtering?

When using Windows IPSec for IP filtering whenever a filter is added you need to have a "mirror" rule (by checking the "Mirrored. Match packets..." tickbox). Because IPSec Filtering is not stateful, ...
5
votes
1answer
2k views

Windows mandatory access control: How to remove “mandatory level” label from the file?

1) How to remove "mandatory level" label from the file? I have two files, for first icalcs return Mandatory Label\Medium Mandatory Level:(NW) for second icalcs doesn't return anything (that means ...
5
votes
2answers
204 views

Which Windows Files Should be Monitored by HIDS?

I highlighted my question below. Here is some background. It's easy to find data showing the most commonly trojaned/modified Linux binaries and config files. ps, ls, find, kill, lsof, passwd, ...
5
votes
2answers
2k views

How do I make or get computer certificates to use with IPSEC user authentication on Windows?

I am having trouble and need some direction using computer certificates with Windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
5
votes
1answer
14k views

What is updated with “Update Root Certificates” enabled? What is the equivalent in Windows 2008R2?

What root certificates are/are not updated when the following checkbox is checked? Additional questions If I manually remove a root certificate, will this service replace that very certificate? ...
4
votes
7answers
732 views

Is it possible to protect my Windows XP users now that Microsoft is no longer releasing security updates?

My office has about 20 PCs running Windows XP. I got a message saying that Microsoft is no longer releasing any security patches for Windows XP. However, we find that XP is very convenient for our ...
4
votes
2answers
650 views

Unknown Asian/Chinese registry keys

On a Windows Server 2008 machine found registry key "潓瑦慷敲卜湹潣敶祲" under HKEY_CURRENT_USER of the administrator account. It contains a value "敓癲捩剥湵楮杮" of type REG_DWORD which is set to 0. I scanned the ...
4
votes
2answers
490 views

What is the background of the Reference Counter Overflow in Microsoft TCP/IP (MS11-083)?

How unique is this bug? Is there a more sophisticated and well-studied attempt behind? Is it accidence? The article below says "continouos stream to UDP". What stream? Just an hour stream of zeros? ...
4
votes
3answers
425 views

SFTP on Windows - is it likely to be disabled?

I'm a software engineer and I'm maintaining a product that allows a user to run commands and scripts on Linux servers via an SSH connection. We now need to extend this functionality onto Windows. We ...
4
votes
4answers
3k views

What is the easiest way for a newbie to RSA to create & use a key pair on Windows?

So I need to get a block of text sent to me over email from a friend, but before he sends it he wants a public RSA key from me. Am wondering what is the simplest way for me as a newbie to generate ...