Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

20
votes
3answers
886 views

How Do Rootkits & Other Low-Level Malware Still Manage to Load on Systems Protected by Secure Boot (and TB/MB)?

Let me try asking my question this way... Let's say that I'm a offensive cyber Bad Guy working for a foreign state-sponsored Advanced Persistent Threat unit. My unit is charged with, say, stealing ...
-1
votes
1answer
176 views

Unable to open port on Windows 7 [closed]

The scenario is as follows: while a PC was connected to our company's network, a specific application was able to open another process on a predefined port. It worked as expected. But now, this PC ...
0
votes
0answers
53 views

Encrypt a file before being copied

I am working on a program that will prevent data theft. I want to encrypt every file that is being copied to an external drive before it is actually copied using a symmetric encryption. Is it ...
8
votes
4answers
332 views

School's computers auto-login and can run .exe's

Before this semester, to use any computer across campus, you had to log into Windows with a username and password. This semester, when the computers start up they auto-login to an account (with let'...
10
votes
3answers
3k views

Offline Bruteforce attack against a Bitlockered Windows PC

I am currently assessing the security of Bitlocker from the perspective of an offline attack against a stored password (used to secure the Full Disk Encryption key). My assumption is that the password ...
1
vote
1answer
269 views

Was I hacked remotely, how could I find out? Windows 7

I was cleaning out my old windows 7 HP desktop computer approximately 5 months ago. There was only the expired Norton 360 as far as antivirus and no firewall. Up until this point I disabled the wifi ...
5
votes
1answer
180 views

What are the differences between “simple” UAC and two user accounts on Windows?

I'm currently thinking about increasing security on my Windows machine. As part of this harderning I considered the least-privilege principle and want to apply this on Windows using two different ...
2
votes
0answers
71 views

userWorkstations attribute in AD preventing users from logging into WebApp

For some of our users in AD, we have set userWorkstations attribute to restrict access to other machines. But this is preventing those users from logging into WebApplications (around 50+) protected ...
0
votes
2answers
150 views

Analyze Windows executable

How can I see which files, ports, URLs, etc that are used by a suspicious Windows executable.
5
votes
0answers
141 views

Windows Certificate Services: Is it possible to enroll a SmartCard certificate AND have key archival?

I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option ...
76
votes
2answers
8k views

Windows language pack update with a gibberish name

This morning, I noticed that a new Windows update was offered to me. It looks very suspicious to me: Here are the update details: ...
0
votes
1answer
1k views

Is it that easy to crack a Windows SAM file?

My friend told me that he can easily crack a Windows SAM file using Ophcrack. Assuming that I have access to the whole config folder (the one which contains the SAM file) of a Windows machine, is it ...
34
votes
6answers
4k views

How do I purge Windows of my private data when formatting the drive is not an option?

I'm changing my employer, and I'm about to leave my office computer. Due to internal regulations and my supervisor's orders, I'm unable to format the disk drive. I was hoping I would be able to do ...
2
votes
1answer
252 views

Memory injection in games

I'm currently researching memory injection attacks on games in Windows 7/10. After reviewing several threads on this topic, there's a few questions which are still unclear. DLL injection can be ...
2
votes
0answers
62 views

Novicorp WinToFlash Lite, spyware etc

I used Novicorp WinToFlash Lite on Windows 7 to create a Windows 10 bootable USB memory stick. While creating the USB drive, I noticed that WinToFlash wrote something like adding blahblah files to ...
2
votes
2answers
120 views

Custom browser based on Internet Explorer - Uniqueness questions

I have developed a custom web browser for Windows using C# (based on Internet Explorer 11) and I'm trying to understand & solve the next issues: 1. I adjusted the User Agent string and the ...
4
votes
1answer
116 views

How does Trusteer Rapport make accessing websites more secure?

Trusteer claims that: Trusteer Rapport verifies that you are really connected to the genuine website as opposed to a fake website created by criminals. Surprisingly, it is not trivial to reach a ...
2
votes
1answer
96 views

When I connect my PC to a network, what (meta) information can the router/admin see that identifies my PC?

If I connect my Windows 7 PC to a third-party (wireless) network what information might the network admin be able to obtain about me? I know they can (sometimes) see traffic but that's not an issue ...
1
vote
3answers
341 views

Need help understanding Windows Authentication mechanism

Even if I enforce HTTPS and use anti-forgery tokens, it seems like Windows Authentication could be inherently insecure because it does not require that the user explicitly passes credentials from the ...
1
vote
1answer
54 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
4
votes
1answer
250 views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the quad-...
6
votes
1answer
117 views

How to check which certificate is being checked for revocation?

I have a .net desktop application without a certificate on a network not connected to the Internet When I start it, there is a call to crl.microsoft.com that times out and slows down the application. ...
1
vote
4answers
143 views

Redirection Malware Infection

I have AVG Antivirus installed on my PC. My PC is infected with some kind of bonjovi redirection malware. It randomly opens up a new tab in Chrome and loads porn sites. I have had this infection in ...
22
votes
3answers
2k views

Java SE 8, Update 51 Added “Native Sandbox” Protection for Windows PCs. Wait, what?

So I was doing a little research about differences (if any) between the sandboxing models for Windows 8/8.1 applications and windows 10 applications when I stumbled across something rather interesting:...
-4
votes
1answer
160 views

Security Setting up personal web server [closed]

I'm sure something like this has been asked many many times over the Internet. I'm asking again because I need situation-specific response. I've already set up a home web server. My setup is like this:...
0
votes
3answers
195 views

Chinese hieroglyphs appear on screen when signing out of windows [closed]

For some time now, when I try to sign out of windows or restart my computer, a message appears that a program forbids my computer from signing out and this program is a .exe file with Chinese ...
1
vote
2answers
8k views

How do we determine the SSL/TLS version of an HTTP request?

We are wanting to configure our Windows client to use only TLS 1.1 and greater. We've learned that we can do this by editing the registry. Now we want to make several HTTPS requests from different ...
0
votes
2answers
190 views

Many suspicious requests are going from my browser whenever open any site

Whenever I open any site there are so many suspicious request are shown in my network panel of browser. I scan my system with many antiviruses too, but still facing the same issue. And sometimes I ...
0
votes
1answer
126 views

Possible sources of repeated Adware infections

In the last couple of months I have had the same thing happen on separate occasions to two Android phones, a Mac laptop and a Windows desktop computer. In all cases, something infects Chrome making ...
0
votes
0answers
64 views

How to secure a service with Mutual SSL Authentication and Intermediary CA?

Given: A working SSL mutual authentication setup (a WCF service hosted in IIS) No Intermediary CA In the current setup any client in the world having a certificate signed be one of the well known ...
0
votes
1answer
131 views

WebDAV automatically attempting to connect remotely because of DFS namespace?

I recently bought and Installed a WAF (after much begging). I have a DFS namespace called \\mycompany.com\ which is based on my Active Directory domain name mycompany.com. My website domain is ...
2
votes
1answer
365 views

How can I hide a program from another program?

If program A scans RAM, running processes and whatever, can I hide program B from being detected by A? Basically, I don't want program A to detect program B, or at least, stop it from identifying ...
2
votes
1answer
169 views

Antivirus monitoring activity: why do they not have an internal firewall to prevent processes' access to user's documents?

A question that arises after an updated and licensed version of Norton Internet Security has detected a trojan installed in my new laptop (Windows 7 installed on 26 Aug'15 and fully updated). Trojan ...
22
votes
1answer
2k views

What are the privacy and security implications of Windows Telemetry

There have been quite a few news stories relating to the use of "Telemetry" in Windows 10 (and also now Windows 7/8) with suggestions that users would want to disable or remove these updates due to ...
2
votes
0answers
123 views

How to store a file securely on the windows file system?

Problem: I have a windows service running under local system account. I have a blob of data that I want to store securely and persistently between reboots. I have decided to store it as afile( as ...
0
votes
1answer
152 views

How to access SQL server inside a Powershell script

I'm coming from a Linux world so I'm a bit at a disadvantage here. Assuming a windows Task scheduler script that calls a stored procedure to return some rows, and transmit a file over email or SFTP -...
0
votes
1answer
127 views

BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”

Note: Below are some information from searching around the Internet. To skip to my main question, go to the last line of this post. I've been searching around on how to change the Volume Master Key (...
30
votes
6answers
5k views

What is the point of making a complicated PUBLIC password?

I have downloaded a couple of Virtual Machine images from http://modern.ie, in order to test different versions of Internet Explorer. When running these images, a complete Windows environment is ...
1
vote
0answers
146 views

Windows 10 privacy concerns for other accounts on same computer [closed]

What are the privacy concerns for a local account on a Windows 10 computer, which has all settings set to "private", if an additional "Microsoft" account is being used on the same computer with ...
5
votes
2answers
2k views

Can a piece of malware/virus inject itself into an ISO

Let's say that I have an infected PC. I download a copy of the Windows ISO(obviously clean) and burn it to an USB. Is it possible that the malware on my computer can inject itself in this process/ISO ...
9
votes
2answers
2k views

How secure is PIN login to Windows?

I've just noticed that Windows 10 allow me to change my login method to PIN which is obviously much more convenient than entering my long and secure password after every startup / wake. I am just ...
168
votes
4answers
41k views

How does Windows 10 allow Microsoft to spy on you?

Windows 10 is perhaps the most Internet-connected and cloud-centric operating system released by Microsoft to date. This, of course, has caused many users to be concerned about how the OS respects ...
7
votes
4answers
2k views

Can the FBI or government agencies decrypt my hardrive and/or force me to give them the password?

I have seen other TrueCrypt questions as well "Windows encryption with BitLocker" and "Mac OSX encryption with FileVault". Does the FBI/NSA or other government agencies have access to my data or can ...
0
votes
0answers
50 views

What artifacts to acquire when looking for IoC? [closed]

I want to hunt for the Indicators of Compromise (IoC) in a potentially infected Windows PC. I am writing a batch script that would record the information needed for analysis. It includes the ...
-3
votes
1answer
112 views

How to tell if my Windows 7 copy is not modified?

I lost my windows cd I downloaded a copy from the internet. The guy who shared it said it's original without any modifications. However I get weird actions like I can't use mouse clicks or I can't ...
7
votes
0answers
235 views

Windows 10 installaton USBs sold by Microsoft [closed]

With the recent release of Microsoft's Windows 10, I dropped by a local Microsoft store to purchase a windows 10 installation media. To my surprise (somewhat) the employees said that they do not ...
0
votes
2answers
106 views

If there is a malicious attack on one partition, is the other one safe?

I recently have used Bootcamp to set up a new partition and run Windows 7. About half of my HDD is designated to my OS X partition and the other half is allocated to the new Windows 7 partition. If ...
3
votes
3answers
648 views

Is it dangerous to have the built-in Administrator account enabled?

I've seen it said that when using the built-in Windows Administrator account, the best practice is to enable it (net user administrator /active:yes), use it, and then disable it. I do realize it's a ...
108
votes
8answers
15k views

Are there technical differences which make Linux less vulnerable to virus than Windows?

What makes Linux so different than Windows in terms of anti-virus needs? My question is not if I should get an anti-virus for my Linux. I perfectly understand why an AV is important. I would like ...
31
votes
5answers
6k views

Why can't Windows 98/IE5 connect to HTTPS sites in 2015?

Recently I found an old installation CD for Windows 98 Second Edition, and looking for a bit of a nostalgia kick, I installed it inside VirtualBox. Win98SE shipped with IE 5.0, and browsing the web ...