A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.
2
votes
3answers
277 views
Is the aggregate severity rating of “Important” for MS13-027 too low?
The Security Bulletin states that the "Maximum Security Impact" is "Elevation of Privilege"; however, the SRD blog post says code execution is possible. Additionally, SRD says "Other software that ...
2
votes
6answers
183 views
What are possible approaches and arguments for securing corporate IT systems with most computers being portable?
I was employed as the only system administrator by a company where half of computers are portable ones being taken away for work at home, business trips, visits to clients, etc. having access to ...
2
votes
4answers
771 views
Reboot to clean state daily, on Windows
I already know that this can be done on Linux, One can boot to a flash drive that is write protected. Live modify folders can be symlinked to to a swap partition, and this prevents viruses from being ...
2
votes
1answer
316 views
What are the methods to find hooked functions and APIs?
Many malware executables use hooking to be invisible. I am familiar with some hooking methods, I'm not sure what methods exist for detecting them. Is there a way to tell when a function call has been ...
2
votes
3answers
228 views
Dealing with untrusted administrators in a Windows domain
I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
2
votes
4answers
135 views
The email system is compromised - what can you do?
I have a friend at a 7 person company which has an issue with email confidentiality.
Each time they send out an email with quotes to customer, the competitor get the message in 30 minutes and send ...
2
votes
3answers
339 views
How do I ensure that my computer is 100% worm-free?
Ok say I have a brand new laptop that was is brand new.
Is it true to say that as long as I keep the bluetooth turned off, and I am not connected to the internet, and only copy files that are 100% ...
2
votes
3answers
408 views
Do you give local administrator account password to notebook users?
My notebook users need to travel a lot.
Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings.
Should I give them local administrator's ...
2
votes
2answers
2k views
Automating PGP encryption? (Windows)
Let's say I have daily files that need to be encrypted using PGP (and then emailed) and I want to automate this task. I would be using Windows PowerShell to manipulate the files (examine date/times ...
2
votes
2answers
221 views
ltd.exe, “Vista Antivirus Security 2012”, any info?
I was taking a look at someone's computer who had a virus. It called itself "Visa Antivirus Security 2012". It turned out to be ltd.exe. It would seemingly randomly block programs, it turns out it had ...
2
votes
1answer
129 views
Whitelisting applications in Windows7
Windows 7 and Server 2008 R2 come with a security tool called Applocker. This allows admins to restrict applications to a specific white list which can be as granular as the individual application ...
2
votes
5answers
209 views
How secure are iPhone/Android/Windows 8 “PIN”/Pattern Lock features?
Most modern (and tablet-oriented) operating systems now offer alternative ways of logging on other than a strong password. For example, iPhones offer a 4-digit PIN, Android devices offer this and a ...
2
votes
4answers
321 views
Virus won't be picked up by Antivirus tools
Today we found a virus / trojan on our network which has thus far:
Hidden all files and folders
Replaced the hidden files and folders with executables of itself, with matching icons, and renamed ...
2
votes
2answers
3k views
How does Remote Access Trojan / Backdoor Software work?
How does the RAT works? I understand it as once we surf the infected website, browser might download the trojan to our PC automatically. Will it executed and auto install in our computer?
I can't ...
2
votes
2answers
388 views
how to identify p2p on network
Im trying to work out if the traffic in the below image is P2P file sharing?
If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...
2
votes
6answers
357 views
Is a self signed certificate sufficient to prove the integrity of my executable?
I have an EXE file on Windows that I have to distribute around. It's based on tclkit so an adversary could unpack it, change some tcl script inside and repack the exe.
I would like to know if this ...
2
votes
2answers
181 views
Command injection Windows platform
Let's say there's a site which is vulnerable to user's input.
For example users can ping a specified IP.
Since the site is vulnerable to Os command injection, a user as well as an IP address
...
2
votes
3answers
201 views
Making a Windows cert say it's purpose is “Ensures the identity of a remote computer”
Maybe this is a superuser.com question, I don't know.
Anyway, I want my cert to show up like this when I double click on it in Windows:
If I just double click on a random cert I get this:
The ...
2
votes
4answers
1k views
Detecting or preventing process memory injections on Windows (anti-hack)
Standard hacking case. Hack injects into a started game process and writes over process memory using WriteProcessMemory call.
The situation is like this:
we are hosting a game server
clients join ...
2
votes
4answers
139 views
lock for asp.net developer using vs 2010 and win xp?
I am hiring few extra trainees who will use their personal laptop at my office to work on .net projects. I want to restrict the code/file access in their laptops with password. Like when they get in ...
2
votes
1answer
317 views
My MP3 file is blocked, but still playable?
My computer is telling me that my MP3 file is blocked:
I have no problems playing the song, so I was wondering what exactly does it mean for my MP3 file to be blocked?
2
votes
3answers
273 views
Strange file named Aview.exe - WinClient
Today I've just discovered some strange files on my Win 7 PC.
I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe.
It is located in ...
2
votes
3answers
207 views
Identify a process that uploads data
I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about ...
2
votes
1answer
761 views
Disable DES-CBC-SHA in schannel
I have several IIS servers in house. When I have my external PCI scans run I'm still receiving alerts for having the weak protocol DES-CBC-SHA enabled.
I have the following registry keys set to ...
2
votes
1answer
382 views
Generate one CSR for two Windows servers
I have two Windows 2008 R2 servers which will be hosting a load balanced website. I will generate a private key and use it to generate a CSR using OpenSSL.
How can I make this CSR (or the resulting ...
2
votes
1answer
139 views
Running Untrusted Software on Local Network
So I need to run a bit of software on my local network that I just have the .exe for. The caveat is:
The software needs access to the internet to produce a bunch of files.
I need to access those ...
2
votes
1answer
926 views
Are Windows password hashes salted with the user name?
I'll readily admit I'm pretty clueless when it comes to cryptography, so there may already be some false assumptions in the question title itself :-)
Still, I "heard" that it is more secure to store ...
2
votes
1answer
547 views
“Extended Protection” primer and implementation guide to prevent MITM
Extended Protection (link) (link) is a feature in Windows 7 and Windows 2008 R2 that prevents certain MITM attacks.
Does anyone have a primer (or explanation in plain English) what this feature is, ...
2
votes
2answers
158 views
UAC and Windows Services
A user has a PowerShell script that does some things that require administrative access on Windows Server 2012 with UAC enabled.
When they run the script as a Local Administrator, it fails with ...
2
votes
2answers
165 views
Suspect Exchange Server appears to be hacked. How to determine if it was a false positive?
Our security vendor detected that our client's CAS server was doing a nessus scan in the internal network.
It's not uncommon for this vendor to issue a false positive, but I'm looking for general ...
2
votes
1answer
156 views
Fuzzing tool to find heap overflows in a Windows binary
Is there a fuzzing tool that can scan some arbitrary windows binary
and identify a set of heap overflow vulnerabilities?
For example, a tool that applies a set of heuristics or maybe a list of ...
2
votes
1answer
189 views
Windows 8 in a VDI environment and the use of Secure Boot
I have a question, How would secure boot be implemented in a virtulized environment, say XEN hypervisor with multiple guest OS's including Windows 8 guest VM? does the guest VM need access to the ...
2
votes
2answers
100 views
Why would encrypting data result in a call to a Domain Controller
This KB article mentions an issue where signing or encrypting information may result in a network IO call to a Domain Controller.
Apparently the RSACryptoServiceProvider's SignData and VerifyData ...
2
votes
1answer
90 views
Network abnormally slow during night hours
My network recently the last week as become abnormally slow around 11 pm. Very slow buffering youtube videos during all hours. Ive recently purchased the new router about two months ago but not ...
2
votes
1answer
121 views
Are COMET installations immune to “Slow TCP Reading” DoS on Windows? (Such as SignalR or WebSync)
My understanding is that COMET implementations of WebSync and SignalR do not directly use IIS and are a few layers lower on the ISO model.
After reading Qualys's blog regarding slow TCP reading, I ...
2
votes
1answer
270 views
Minimum credential for WMI parameters Monitoring?
I'm developing a big project to monitor a remote machine's performance parameters like CPU, memory, disk space, and etc. through C# WMI. I want to use the minimum possible credentials to connect the ...
2
votes
2answers
4k views
aircrack-ng under Win7 — possible?
What needs to be installed to get the full aircrack-ng suite (or the closest possible equivalent) working under Win7?
Should you use VirtualPC, VirtualBox, or VMware Workstation for this?
Should you ...
2
votes
1answer
69 views
Can Windows 7 hibernation files be recovered?
As curiosity, according to my knowledge, hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data ...
2
votes
4answers
122 views
Does Disabling Right Click In Windows Explorer Do Anything?
I am at a student at a school which blocks the right click in Windows Explorer and the desktop, as well as on the taskbar. I don't exactly understand why they do this, since most of the commands on ...
2
votes
1answer
66 views
Offline registry analysis - Hardware info?
Is it possible to get information about the hardware from an offline version of HKLM/SOFTWARE hive? There is OEMInformation in there, which gives things like machine manufacturer, but does the machine ...
2
votes
1answer
193 views
Windows Update - Interception
I'm trying to monitor the HTTP requests/responses made when performing a Windows Update.
I have a Windows 8 machine configured with a proxy in IE. I've also imported via netsh for winhttp:
netsh ...
2
votes
1answer
140 views
Normalizing Windows Advanced Firewall rules
How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen ...
2
votes
3answers
184 views
Boot or reboot to clean state on Windows each time?
I use virtual box to securely surf the web, but it's easy to get lazy and use the same image more than once. Currently, I have a golden Win 7 image that I built and loaded my required software. I ...
2
votes
2answers
77 views
How to define different firewall rules for different users on the same machine running on Windows 7?
Provided that one machine running on Windows 7, connected to LAN, and connected to the Internet via a gateway in the LAN. There are two logon user accounts A and B on the machine. I want:
1, User A ...
2
votes
1answer
158 views
How should I audit and monitor shared TCP ports in Windows?
Windows has a feature called .NET TCP Port Sharing which allows different .NET applications to share the same TCP/IP port.
I would like to monitor the source and destination connections of each ...
2
votes
1answer
262 views
VMware Workstation 9 Security Best Practice Guides
Could someone please be able point me in the direction of where I could find some best practice security guides for VMware Workstation 9 please? I've searched the VMware site and to say it's badly ...
2
votes
1answer
81 views
Which .CER file format is more secure for purposes of an AIA record?
What file format is most appropriate or secure for the AIA record in a PKI certificate?
The options I'm aware of are:
DER encoded binary X.509 (.cer)
Base-64 encoded X.509 (.cer)
I also have the ...
2
votes
1answer
238 views
How does DCOM authentication compare to RPC based authentication/auth?
The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM
A CA running Windows Server 2003, Enterprise Edition, ...
2
votes
1answer
243 views
Active Directory: Should Workstations be separated from servers to protect from related domain hacks?
How should I protect domain joined hosts in the same AD domain from the Related Domain Cookie Attack?
Suppose there is an AD forest called example.com. This company has a variety of internal and ...
2
votes
1answer
379 views
Token Based Authentication & Pass-the-hash Attacks
Do token-based authentication solutions (such as RSA SecurID) mitigate tools like incognito and/or pass-the-hash tools?
