A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

4
votes
1answer
2k views

Server monitoring for security

We do a lot of web hosting management and have started to get into selling server management packages. However, we want to start monitoring servers for security related threats. Our clients may use ...
4
votes
4answers
9k views

Is diskcryptor really secure?

Diskcryptor is an open-source competitor to TrueCrypt for Windows. It has an edge over Truecrypt for system encryption, because it allows for more than one independently encrypted system partition, ...
4
votes
2answers
100 views

Code-signing application from different locations

In our company, one of the software group is using a certificate from a trusted provider to sign their drivers manually on their local machine. My group wants to start to sign our installers and some ...
4
votes
1answer
13k views

Setting up Windows laptops to require a smartcard for unlocking

I am looking for details on how to secure a windows laptop using smart cards. The scenario is that we have laptops in vehicles, which remotely connect (via https) to an application server over the ...
4
votes
3answers
2k views

Is there is a way to lock my USB port over the device physically?

Is there is a way to lock my USB port over the device physically ? For example I am connecting the USB mouse and keyboard on an public computer but I do not want anyone to remove them physically. I ...
4
votes
2answers
999 views

ASLR and how a program can actually call its functions

I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment. As far as I know ASLR works by randomizing part of the imagebase address when ...
4
votes
1answer
1k views

Why does Windows 7 require a password hint during setup?

Correct me if I am wrong, but I think Windows 7 is the only operating system out there that requires a hint for the first user created on the system (have not had a chance to check out Windows 8 ...
4
votes
1answer
720 views

Open-source alternative for CryptGenRandom?

Let's say that for some reason I don't trust CryptGenRandom. Are there any open source software Windows entropy collectors to get cryptographically secure random numbers from for seeding purposes? ...
4
votes
2answers
206 views

DPAPI and malware

I'm considering using the Windows DPAPI to protect an ECDH key I use to encrypt some data in a local database in a Windows desktop application. I'm new to DPAPI, but its my understanding that DPAPI ...
4
votes
4answers
6k views

How to make / dump contents of memory for forensics analysis?

I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows ...
4
votes
2answers
630 views

Added value of Windows Server 2008 over 2003 in terms of security

What is the added value of a Windows 2008 Server over Windows 2003 in terms of security? Does Windows Server 2008 has enhanced/new security features compared to 2003?
4
votes
1answer
310 views

How to protect against viruses that takes files as hostages by encrypting them?

Today I was infected by CoinVault, a new malware similar to CryptoLocker I believe. Before today I was unaware of this entire type of malware. Fortunately I was protected by offline backups, but I ...
4
votes
1answer
226 views

What is the risk that Windows 8's loopback protection feature protects me from?

Windows 8 requires Fiddler to set up an exemption when sending traffic to localhost. Since this is a default setting (and affects many computers): What security benefit does this provide How can I ...
4
votes
2answers
1k views

Windows Authentication and Session Ids

After a penetration test made upon an intranet application I'm developing, in ASP.NET MVC, one of the concerns raised was that the application supports concurrent user sessions and it is recommended ...
4
votes
2answers
1k views

How does syskey in Windows increase the security in a domain?

I use syskey in windows XP and Windows 7. I've read Microsoft's article but I have questions. How does this solution increase security? What are differences between using Syskey in a client that ...
4
votes
1answer
464 views

How did my homepage get changed in IE?

I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
4
votes
2answers
211 views

Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach?

I currently work in a manufacturing company with round about 5000 computers and 6000 employees. We use a lot of web based line of business applications (all internal, non over the Internet) in order ...
4
votes
3answers
9k views

How do you properly setup Tor on Windows 7?

How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?
4
votes
4answers
5k views

Detecting or preventing process memory injections on Windows (anti-hack)

Standard hacking case. Hack injects into a started game process and writes over process memory using WriteProcessMemory call. The situation is like this: we are hosting a game server clients join ...
4
votes
6answers
718 views

Is a self signed certificate sufficient to prove the integrity of my executable?

I have an EXE file on Windows that I have to distribute around. It's based on tclkit so an adversary could unpack it, change some tcl script inside and repack the exe. I would like to know if this ...
4
votes
3answers
343 views

Strategy against browser exploits on Windows?

On a friend's computer is some kind of spam bot installed. It sends messages like Hello: I received my apple iPad 32GB ordered on an online shop (www.elevalley.com ) today. So exciting ...
4
votes
1answer
205 views

Does dual boot hurt security?

On my laptop I have a well secured Linux installation that I would like to stay this way. It has in the past and could in the future contain confidential medical data I use for my study. I also have a ...
4
votes
4answers
2k views

Does Windows have a built-in password store?

What passwords are stored in Microsoft Windows? How can I know what password are saved in computer?
4
votes
1answer
275 views

Hashed passwords for NTLM authentication

I understood that Windows users' password hashes can be exported very easily. Right? So my question is: If I can have the hashes of other user accounts (e.g. local users on my Windows machine), isn't ...
4
votes
2answers
273 views

Can viewing an email message in Outlook 2013 install malware on my computer?

I routinely get spam messages which state "Your account for [Insert game here] has been flagged. If you don't click this link/send us this info/go to this website in the next 72 hours, your account ...
4
votes
1answer
503 views

Is Window's system restoration useful for getting rid of malware?

If your computer has been infected with some kind of malware, could a restoration of the system, using the tool provided by windows, help you getting rid of that malware? We should suppose that it ...
4
votes
1answer
2k views

Disable DES-CBC-SHA in schannel

I have several IIS servers in house This includes IIS 6 and 7.x. When I have my external PCI scans run I'm still receiving alerts for having the weak protocol DES-CBC-SHA enabled. I have the ...
4
votes
2answers
4k views

Is CIFS/SMB (Folder Sharing in Windows) secure?

I have to back up some data from windows 7 machines over the internet, and I rarely use windows so am distrustful of it in general. Specifically: Is there any sort of check that the server is the ...
4
votes
3answers
218 views

Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?

The firewall of my company has detected and blocked a repetitive (every 15 min) HTTP request from a PC, which tries to start a download of a file called ..._chrome_installer.exe(or so) from the host: ...
4
votes
1answer
149 views

Accessing user accounts without asking for their password

I don't like asking my (windows network) users for their passwords, it doesn't seem like a good security practice. I also want to train my users to never give their password to anyone if they ask for ...
4
votes
2answers
52 views

monitor port scan on the same segment

if theres a port scan on the same segment and it does not reach the firewall at all, it is not detectable by anything. is there any solution to that ? maybe using the windows fw on ach workstation to ...
4
votes
1answer
3k views

Should the thumbprint be SHA2 in addition to the Signature Hash Algorithm?

I'm looking at a Windows PKI and see that the Thumbprint is SHA1, while the Signature is SHA2 (SHA256). Is this an acceptable configuration? Should I recommend that the client update to SHA2 for a ...
4
votes
1answer
258 views

How do I continue pentesting with access to local station?

I started learning hobbyist penetration testing a while ago, and as far as penetrating a computer I have physical access to, all is good. Mainly using Hiren bootCD, it is easy to gain access to an ...
4
votes
3answers
394 views

Security of a Windows XP system after April 8th when running the latest Firefox or Chrome

As we all know, Microsoft stops developing security patches for Windows XP very soon. If a bug in the kernel was to be found that would allow an attacker to take control by, say, sending a specially ...
4
votes
1answer
2k views

How can I misuse the information of DCE service enumeration?

Nessus reports almost on any Windows machine "DCE service enumaration". With the metasploit module tcp_dcerpc_auditor I get the following information: 192.168.1.23 - UUID ...
4
votes
2answers
522 views

Security Scanning for Desktop Applications

Our company develops Windows desktop applications. We offer off the shelf solutions - not custom development. A potential new customer wants to add a section to our standard contract that requires ...
4
votes
1answer
708 views

CDNs used by Windows Update

My question is about CDNs (Content Delivery Networks) and their simultaneous use for legal and questionnable stuff. One specific example is the following. I'm noticing taffic from our network to the ...
4
votes
2answers
4k views

Recover EFS encrypted folder after wiping system partition

We've recently ran into trouble while reinstalling one of client's desktop computer. Disk was split into two master partitions named C: and D:. We wiped out C: and reinstalled system (Win XP SP2 ...
4
votes
1answer
4k views

Windows task manager can see all processes as non administrator without permission

On Windows Server 2008 R2 operating as a standard user, when I open Task Manager I can see all the processes from different users on the system. I have the option to click "Show all processes" which ...
4
votes
1answer
579 views

Does sandboxie “grab” all the system calls?

Sandboxie: http://www.sandboxie.com Does sandboxie "grab" all the system calls, e.g.: filesystem calls? Or it "grabs" all the low level calls from a process?
4
votes
2answers
810 views

how unsafe is it for Windows webserver IIS to have domain privileges

Normally in the past, I've managed that the production server only serves http(s) to the internet, and is isolated from it's database by a firewall which only allows database queries to travel. ...
4
votes
2answers
341 views

What criteria do you use for evaluating Client-Side / Endpoint security products?

What features are important to you in client-side AV and Firewall products? Who benefits from these features? Managment, the end user, helpdesk. Are there features that are being 'sold' by the ...
4
votes
1answer
283 views

Remove a privilege from a Windows admin account : good or useless idea?

In order to protect a Windows administrator account from attacks such a Pass-the-Hash and other Token Passing tehcniques (e.g. via Incognito tool), can you tell me if it is a good idea to remove the ...
4
votes
1answer
126 views

Is access to the caller API in mobile phones a real security threat?

From time-to-time I receive "Unknown" caller on my mobile phone. I do not want to answer those calls as I do not trust the identity of a caller. I feel safer if I can see caller name or at least ...
4
votes
2answers
291 views

With full access to the disk of an IIS web server, could you access the database server?

Here is a theoretical setup: You have a web server running Windows Server with IIS You have a website running here which connects to a database This website can start automatically when the server ...
4
votes
3answers
3k views

Securing a Windows Guest Account

I know that a person with physical access to a computer can do almost anything to it. My main concern with my Windows 7 guest account is privacy and sandboxing. I don't want a guest user to have ...
4
votes
1answer
400 views

A simple example for showing the use of Data Execution Prevention (DEP) security feature

I am finding it really hard to figure out why we need a DEP! Microsoft states this about DEP: The primary benefit of DEP is to help prevent code execution from data pages. Typically, code ...
4
votes
4answers
567 views

How to securely delete a table in MS-Access?

I have a Windows 7 computer which currently has a large working Microsoft Access 2007 database on it containing some tables with confidential data. I would like to securely delete/remove the tables ...
4
votes
1answer
4k views

Checklist for configuring WinRM Security settings on servers

WinRM has a very difficult to use command line interface and that leads me to believe some settings will be easily reconfigured, overlooked, and eventually exploited. In other words, insecurity ...
4
votes
3answers
169 views

Using Tor browser on a Windows machine

Suppose a person is running a Windows 7/8 operating system. If she/he uses the TOR web-browser, can Microsoft see what they are browsing? Would that not defeat the point of using TOR in the first ...