A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.
0
votes
2answers
264 views
Logging and Metrics for DEP, EMET, and Related Mitigations
Is it possible to collect metrics or generate alerts when one of EMET's suite of mitigations prevents code execution? Ideally I'd want to be able to collect and analyze data to support statements ...
-2
votes
2answers
193 views
Will winlock virus really delete information after 12 hours? [closed]
I've got virus which tells that all data will be deleted after 12 hours. I cleaned autorun and now scaning my computer with anti-virus, but still is this message just to scary people or is this virus ...
3
votes
3answers
647 views
How can winlock virus change Windows Registry without admin permission?
When you try to install program you'll always asked about administrator permission. Same thing when you try to user 'regedit' command.
So I'm interested in how does this virus works. How can it edit ...
4
votes
5answers
2k views
Preferred UAC configuration in Enterprises that use Login scripts to map drives
In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work:
Dim WshNetwork
Set WshNetwork = ...
1
vote
0answers
108 views
Hidden Registry Strings - possible rootkit? [closed]
Win server 2003 R2 SP2 - no noticeable issues on the machine. When I create new strings in regedit, I hit refresh and they are gone! I try to re-add and it complains the string already exists.
I am ...
4
votes
4answers
3k views
Secure use of psexec or better alternative to it
I want to remotely start VMWare virtual machines (I own VMWare Workstation) and to this end I need to execute on host something like "vmrun -T ws H:\VMWare\VM1\VM1.vmx nogui" with user desktop ...
0
votes
1answer
344 views
Should I use Windows' Cryptographic Service Provider to generate RSA keys?
If I want to generate strong high quality RSA keys, is there any reason not to use Microsoft's built-in cryptography system? Or should I use something open source like OpenSSL or Bouncy Castle?
I'm ...
3
votes
1answer
266 views
CDNs used by Windows Update
My question is about CDNs (Content Delivery Networks) and their simultaneous use for legal and questionnable stuff. One specific example is the following.
I'm noticing taffic from our network to the ...
1
vote
1answer
677 views
IIS password protected website
I have a website built upon windows IIS and to use password to protect the website and disable anonymous logon to that website, the ONLY way is to disable the anonymous logon in IIS and use a windows ...
3
votes
1answer
163 views
eBay account compromised/Credit Card used/Hosts files changed
To preface this, I'd just like to let you know that I'd consider myself an intermediate security guy(Definitely not a novice, not yet an expert) I do have a story to tell, and would like to know if ...
4
votes
2answers
309 views
How can I assess the strength of user passwords in my office environment?
I want to assure the compliance of password policy in my office.
Environment Intro
My environment is all windows based (server 2003/2008) user base is not more than 400 employees. Nearly 90% of all ...
2
votes
1answer
90 views
Network abnormally slow during night hours
My network recently the last week as become abnormally slow around 11 pm. Very slow buffering youtube videos during all hours. Ive recently purchased the new router about two months ago but not ...
1
vote
2answers
1k views
Why is system32/ntoskrnl.exe blocking port 80?
Today I've tried to start the Visual Studio Developer IIS as usual on Port 80, but this time it has quit with an error that port 80 is already in use. With netstat I've found out, that an application ...
1
vote
1answer
924 views
What are the risks of removing ISATAP from the default global block list?
The process of installing Microsofts pseudo VPN called Direct Access requires me to remove the ISATAP name from the default global block list by running this command:
dnscmd /config ...
2
votes
6answers
356 views
Is a self signed certificate sufficient to prove the integrity of my executable?
I have an EXE file on Windows that I have to distribute around. It's based on tclkit so an adversary could unpack it, change some tcl script inside and repack the exe.
I would like to know if this ...
8
votes
3answers
353 views
Reading keystrokes of other applications
Is it possible for other application running in the OS to read the keystrokes that my application uses?
What about mouse events and window handles?
Is there any security wall that the OS uses to ...
3
votes
2answers
107 views
Reading keystrokes of other applications
Is it possible for other application running in the OS to read the keystrokes that my application uses?
What about mouse events and window handles?
Is there any security wall that the OS uses to ...
6
votes
7answers
2k views
Physical computer security, how to disable USB ports when the computer is 'locked'?
Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
2
votes
6answers
183 views
What are possible approaches and arguments for securing corporate IT systems with most computers being portable?
I was employed as the only system administrator by a company where half of computers are portable ones being taken away for work at home, business trips, visits to clients, etc. having access to ...
4
votes
2answers
312 views
Added value of Windows Server 2008 over 2003 in terms of security
What is the added value of a Windows 2008 Server over Windows 2003 in terms of security?
Does Windows Server 2008 has enhanced/new security features compared to 2003?
1
vote
1answer
206 views
If password is changed on Active Directory, can I ensure that PC must be restarted before logon with new password
Basically, if I have a Windows computer connected to a domain, how can I ensure that if the password is changed on Active Directory that the computer must be restarted before the new password takes ...
4
votes
1answer
483 views
Why does Windows 7 require a password hint during setup?
Correct me if I am wrong, but I think Windows 7 is the only operating system out there that requires a hint for the first user created on the system (have not had a chance to check out Windows 8 ...
0
votes
3answers
1k views
Is diskcryptor really secure?
Diskcryptor is an open-source competitor to TrueCrypt for Windows. It has an edge over Truecrypt for system encryption, because it allows for more than one independently encrypted system partition, ...
5
votes
2answers
1k views
Is opening port 3389 on a router and forwarding this to a Windows SBS 2003 server secure?
I know of a company who has port 3389 open on their router and forwards this to a Windows SBS 2003 server. The server has the Windows firewall switched on, is patched and has an up to date antivirus ...
1
vote
2answers
735 views
Is CIFS/SMB (Folder Sharing in Windows) secure?
I have to back up some data from windows 7 machines over the internet, and I rarely use windows so am distrustful of it in general. Specifically:
Is there any sort of check that the server is the ...
0
votes
4answers
419 views
Locking down Windows 7 and only allowing outbound calls on 80/443
I need to harden a windows 7 PC running in a kiosk type device.
Basically the hardware on the PC only needs to make outbount HTTP requests and communicate with some peripherals over USB(COM ports).
...
2
votes
1answer
242 views
Active Directory: Should Workstations be separated from servers to protect from related domain hacks?
How should I protect domain joined hosts in the same AD domain from the Related Domain Cookie Attack?
Suppose there is an AD forest called example.com. This company has a variety of internal and ...
2
votes
3answers
408 views
Do you give local administrator account password to notebook users?
My notebook users need to travel a lot.
Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings.
Should I give them local administrator's ...
2
votes
4answers
767 views
Reboot to clean state daily, on Windows
I already know that this can be done on Linux, One can boot to a flash drive that is write protected. Live modify folders can be symlinked to to a swap partition, and this prevents viruses from being ...
2
votes
2answers
2k views
Automating PGP encryption? (Windows)
Let's say I have daily files that need to be encrypted using PGP (and then emailed) and I want to automate this task. I would be using Windows PowerShell to manipulate the files (examine date/times ...
11
votes
5answers
3k views
How is something as simple as a keylogger detected on a computer?
I found one online, which I wanted to try out at my house and see if it actually worked. It's written in C, and it is not very big at all considering half of it is just a bunch of cases for which key ...
4
votes
4answers
193 views
How to securely delete a table in MS-Access?
I have a Windows 7 computer which currently has a large working Microsoft Access 2007 database on it containing some tables with confidential data. I would like to securely delete/remove the tables ...
1
vote
1answer
995 views
Checklist for configuring WinRM Security settings on servers
WinRM has a very difficult to use command line interface and that leads me to believe some settings will be easily reconfigured, overlooked, and eventually exploited.
In other words, insecurity ...
2
votes
1answer
121 views
Are COMET installations immune to “Slow TCP Reading” DoS on Windows? (Such as SignalR or WebSync)
My understanding is that COMET implementations of WebSync and SignalR do not directly use IIS and are a few layers lower on the ISO model.
After reading Qualys's blog regarding slow TCP reading, I ...
6
votes
2answers
380 views
How can I restrict users' connection attempts to my FTP server?
Is there any way possible to restrict user to make a connection to the FTP server on my Windows XP computer?
I have an FTP server established in Windows XP and now I want to make access to that FTP ...
20
votes
8answers
20k views
Can I determine if my computer has a key logger installed?
A friend of mine just started a job at a security sensitive company. They've provided him with a laptop with Windows XP Professional installed. He's heard a rumor from other employees that the laptops ...
2
votes
1answer
377 views
Token Based Authentication & Pass-the-hash Attacks
Do token-based authentication solutions (such as RSA SecurID) mitigate tools like incognito and/or pass-the-hash tools?
1
vote
1answer
144 views
Can accounts still be logged onto if Password Caching is not enabled?
This is kind of an extension of my other question.. If you were not storing any of the passwords locally (caching disabled), would a user some how still be able to circumvent around this security ...
2
votes
1answer
139 views
Running Untrusted Software on Local Network
So I need to run a bit of software on my local network that I just have the .exe for. The caveat is:
The software needs access to the internet to produce a bunch of files.
I need to access those ...
2
votes
1answer
90 views
User Account Notification under Windows useful at all?
IMHO the 'screen dimming'-and-displaying-of-warning-window feature (?) in Windows is extremely annoying, since I routinely run software that does require the permission to modify a lot of things. I ...
0
votes
1answer
926 views
windows security alert windows firewall has blocked some features of this program message coming for every new build of my application
I made an application which uses ftp so windows shows windows security alert windows firewall has blocked some features of this program message for every new version of my application any idea how to ...
4
votes
2answers
477 views
Difference between vulnerabilities on windows/linux/mac for same program
If someone finds a vulnerability like buffer overflow in a program such as Google Chrome or Mozilla Firefox running on a linux machine, are there any chances that this vulnerability will persist on ...
2
votes
2answers
220 views
ltd.exe, “Vista Antivirus Security 2012”, any info?
I was taking a look at someone's computer who had a virus. It called itself "Visa Antivirus Security 2012". It turned out to be ltd.exe. It would seemingly randomly block programs, it turns out it had ...
3
votes
3answers
747 views
what is the best keylogger for security uses?
Today we were robbed. A thief come to our home at night and stole some stuff including my brother's laptop.
I think that the right thing to do is to download a keylogger on my PC, just in case...
I ...
8
votes
1answer
287 views
Why do you have to be an admin to create a symlink in Windows?
In linux every user can create symlinks, but in Windows I need an admin command line, or mklink fails. Why is that?
4
votes
4answers
2k views
How secure is Windows Auto-Logon?
Obviously, if auto-logon is enabled, anyone who can gain physical access to the PC can use the PC. That's not the question.
The question is, when I enable auto-logon for my Windows 7 box, will there ...
5
votes
5answers
273 views
Introduction/refresher course on Windows security
Can someone point me to a blog or recommend a book with an introduction (or refresher course) to Windows security.
I am not a newbie programmer, actually have more than 10 years of experience, with a ...
0
votes
1answer
260 views
Iframe hack / done through FTP?
On two websites which I host for a friend, I found that there is an iframe at the bottom of each site's index.htm file.
<iframe src="http://www.kunstsalen.dk" width=1 height=1
style="visibility: ...
3
votes
2answers
663 views
Time server security error
Today at work, we brought out some PCs that were not used for a long time (were not in use when I joined this company so I have no idea about their history). After booting one of them (Windows XP ...
5
votes
2answers
808 views
Breaking out of a strict linux sandbox running virtually under windows: do the linux-sandbox access control policies even matter?
I am developing an application which will run untrusted code. I have been designing it for linux, thinking that I can just run it in a virtual machine on windows when the need arises. The linux ...
