A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

2
votes
1answer
231 views

Normalizing Windows Advanced Firewall rules

How can I best normalize our Windows Advanced Firewall rules while implementing network segmentation? I want them to be as clear and concise as possible for audit purposes. What few examples I've seen ...
0
votes
2answers
1k views

Regedit shows strange chinese characters in my system - should I be worried?

I suspect that my system has been hacked into. I see huge drops in free hard disk space for a while and then the space returns to near old values. A few days ago, when i clicked 'my computer', i saw ...
2
votes
2answers
2k views

UAC and Windows Services

A user has a PowerShell script that does some things that require administrative access on Windows Server 2012 with UAC enabled. When they run the script as a Local Administrator, it fails with ...
1
vote
1answer
368 views

Win server 2003 sp2 'local' Privilege escalation via thin client

Just asking if there is any known exploit that allows a client connected a win server 2003 sp2 x64 via SunRay thin-client to infiltrate (or preform a local privilege escalation on) the server. The ...
0
votes
1answer
246 views

How to enforce NTFS permission compliance?

I have to enforce NTFS permissions based on business roles. Each role (group in ADS) can be granted the permission to read or write a file server directory. I do not care about share permissions. I ...
0
votes
1answer
240 views

Windows 7 File Patching, Custom Visual Styles

In order to apply custom "visual styles" or themes in Windows 7, you must patch a few system files including Explorer. I can see from the start how this could be a potential security problem, but how ...
2
votes
2answers
300 views

Suspect Exchange Server appears to be hacked. How to determine if it was a false positive?

Our security vendor detected that our client's CAS server was doing a nessus scan in the internal network. It's not uncommon for this vendor to issue a false positive, but I'm looking for general ...
19
votes
3answers
5k views

Create a unterminable process in Windows

I am a student, and am genuinely curious about unterminable processes in Windows. For educational purposes, I would like to create an application (possibly in VB6?) which cannot be terminable by a ...
0
votes
3answers
149 views

Implement server serial key for server software

Me and my friend want to sell game server-side software, but we want some sort of control, over use of that software. For example, we want some sort of serial key system, so only verified/paid ...
1
vote
3answers
214 views

How isolated are 2 operating systems on 1 harddisk?

Lets say I have 2 windows dual booting on the same harddrive (windws 7), How isolated are they? I am thinking that there should be up to date antiviruses software on both Windows, and they should be ...
-1
votes
1answer
234 views

A simple but dangerous vulnerability in windows7?

I discovered that if you change the extension of any file to .lnk, that is make it like a shortcut file, then you can't change the extension again, even if you have set 'show the file extension names' ...
3
votes
3answers
1k views

Is there is a way to lock my USB port over the device physically?

Is there is a way to lock my USB port over the device physically ? For example I am connecting the USB mouse and keyboard on an public computer but I do not want anyone to remove them physically. I ...
17
votes
7answers
739 views

How to deal with a person who gets easily fooled by internet and mail scams?

alternative title: How to deal with a person who has gotten paranoid and doesn't want to go online anymore? A person, who has over the years been scammed many times, by bad spam/fraud emails, and ...
1
vote
1answer
220 views

Wildcard SSL Cert and Client Authentication

I have a wildcard SSL certificate (from GoDaddy.com) deployed to several Windows 2003 servers. I used IIS management console to import the certificate. The problem is that only one of these servers ...
15
votes
4answers
680 views

Firefox pre-downloading

I've found out that if you download a file with Firefox, a similar window as this one pops up (in dutch in my case): ("Bestand opslaan" = "Save file") However, the file is already being ...
3
votes
3answers
1k views

why blocking incoming traffic does not block chatting or VOIP

I just recently blocked all incoming traffic(all local ports and all external ips) in my windows 7 firewall and I understand that will not stop me from accessing websites as browsing needs outbound ...
0
votes
3answers
2k views

Are file permissions set in Unix/Linux effective in Windows or Any other OS?

Consider some files and folder in Unix/Linux OS which are configured for only read access by root, if the hard drive stolen, and used in Windows Environment, are these permissions are still effective? ...
5
votes
3answers
3k views

Wine or sandboxie as sandboxes

I'm looking for a sandbox for Windows. I've looked at sandboxie but I don't know if it delivers what it promises. Is it actually safer to run programs inside sandboxie ? I know a full-blown VM could ...
4
votes
3answers
167 views

can I find on which machine was a zipped archive created?

I have the following security issue. A zipped archive of emails was found on a machine (A) by using an undelete program. The claim made by the subject of the investigation is that they made the ...
3
votes
1answer
817 views

Best practice advice - folder security (windows environment)

An executive at the company I work for has asked me to set the permissions on a specific network folder so only they can access it. I don't usually do this, but in this case I need advice on the best ...
1
vote
3answers
471 views

Debugging and DLL-Injection

Hi, I am currently reading Gray Hat Python to learn about Debugging and various interesting techniques for binary analysis. So far I have learned an amazing amount of stuff (just read about ...
0
votes
1answer
1k views

Due to which reason might a windows 7 password been reset to empty?

A user reports on monday he cannot access his windows 7 account anymore due to a "wrong password", which perfectly worked on friday. It turns out the password has been reset to empty for that account. ...
1
vote
1answer
266 views

Padding oracle - Vulnerable Version of ASP.NET

I would like to install the vulnerable version of ASP.NET for testing purposes. I've thought about it and I guess the best way would be to delete/disable some security updates to make that possible. ...
4
votes
2answers
153 views

DPAPI and malware

I'm considering using the Windows DPAPI to protect an ECDH key I use to encrypt some data in a local database in a Windows desktop application. I'm new to DPAPI, but its my understanding that DPAPI ...
1
vote
2answers
196 views

is RDP7.0 authentication process secure enough?

Latest version RDP used NLA, CredSSP and TLS to secure the authentication process. It sound like secure but in reality does it really secure enough. I knew that the previous version RDP is ...
2
votes
1answer
750 views

Why is windows considered insecure? [duplicate]

Possible Duplicate: Linux or Windows- the security issue I often see people complaining that Windows is "highly insecure" while linux is MUCH more secure. What exactly are the ...
1
vote
1answer
721 views

How does a developer interact with Microsoft Certificate *Web Services*

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
4
votes
2answers
625 views

ASLR and how a program can actually call its functions

I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment. As far as I know ASLR works by randomizing part of the imagebase address when ...
0
votes
2answers
181 views

Suscpicious registry entry

In HKEY_USERS\S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxx\Software\Microsof\TATrial and HKEY_LOCAL_MACHINE\SOFTWARE\Microsof\TATrial there are entries Default (no value set) InstallDate (733998) ...
1
vote
1answer
988 views

Windows System event log warnings for smtpsvc

I get a lot of the following type messages: Message delivery to the remote domain 'particular domain or IP address' failed for the following reason: The remote server did not respond to a connection ...
0
votes
1answer
214 views

How to analyze server crash dump after recent patch update? [closed]

I want to know, if there a way I can identify on windows systems an event / log generated due to patches incorrectly installed / or corrupted in the process. Is there a way I can process or look ...
1
vote
1answer
2k views

IE on Windows 2012 doesn't show certificate or lock icon despite using HTTPS

Can anyone explain why IE on Windows 2012 doesn't show the lock icon despite using HTTPS when visiting the following site? https://www.microsoft.com/en-us/default.aspx I am able to see the lock ...
20
votes
4answers
7k views

What can an attacker do with Bluetooth and how should it be mitigated?

What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? What can an attacker do once a malicious device is paired with mine? ...
2
votes
3answers
288 views

Boot or reboot to clean state on Windows each time?

I use virtual box to securely surf the web, but it's easy to get lazy and use the same image more than once. Currently, I have a golden Win 7 image that I built and loaded my required software. I ...
1
vote
3answers
14k views

Multiple running instances of rundll32.exe

I've noticed that in the Task Manager of Windows 7, I have multiple running instances (2) of rundll32.exe. Does this necessarily means that my machine is infected by a malware as noted here: ...
2
votes
3answers
139 views

Is possible to know if increased marketshare means more viruses?

I'm having an argument with other developers about why more "viruses" exist (including all forms of external attacks, exploits, etc) in Android vs iOS. Like with Windows vs *nix, the main idea is that ...
2
votes
2answers
470 views

Command injection Windows platform

Let's say there's a site which is vulnerable to user's input. For example users can ping a specified IP. Since the site is vulnerable to Os command injection, a user as well as an IP address ...
5
votes
6answers
599 views

How can a novice find proof of a system compromise?

I am almost certain a colleague has installed a keylogger on my system. I am totally new to IT security, but have substantial linux / windows / programming experience. The system I believe is ...
2
votes
2answers
285 views

How to define different firewall rules for different users on the same machine running on Windows 7?

Provided that one machine running on Windows 7, connected to LAN, and connected to the Internet via a gateway in the LAN. There are two logon user accounts A and B on the machine. I want: 1, User A ...
2
votes
3answers
2k views

Making a Windows cert say it's purpose is “Ensures the identity of a remote computer”

Maybe this is a superuser.com question, I don't know. Anyway, I want my cert to show up like this when I double click on it in Windows: If I just double click on a random cert I get this: The ...
3
votes
4answers
9k views

how to import a private key in windows

Say I have an X.509 cert and a private key that corresponds to it. I can import X.509 certs easily enough into Windows but what about private keys? Is the only way I can do that by converting both ...
2
votes
3answers
574 views

Strange file named Aview.exe - WinClient

Today I've just discovered some strange files on my Win 7 PC. I was browsing through the Windows Firewall Inbound Rules and saw two ACCEPT rules for a program, Aview.exe. It is located in ...
2
votes
3answers
1k views

Identify a process that uploads data

I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about ...
2
votes
1answer
491 views

Fuzzing tool to find heap overflows in a Windows binary

Is there a fuzzing tool that can scan some arbitrary windows binary and identify a set of heap overflow vulnerabilities? For example, a tool that applies a set of heuristics or maybe a list of ...
1
vote
1answer
116 views

How to know what's the type of an attack and from whom is sent?

I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked. How do I know what kind of attack it is and from whom is sent? When he attacks, the RDP freezes and the ...
2
votes
1answer
298 views

How should I audit and monitor shared TCP ports in Windows?

Windows has a feature called .NET TCP Port Sharing which allows different .NET applications to share the same TCP/IP port. I would like to monitor the source and destination connections of each ...
3
votes
1answer
202 views

Potential services.exe infected file?

I was asked by a coworker to help solve a problem with a remote client site through VNC. Immediately after connecting I've started noticing some strange behaviors that I am lead more and more to ...
1
vote
1answer
470 views

Windows 7 EFS - connot decrypt

I have some files on my laptop that were accidentally encrypted, I think by Visual Studio. I didn't even know that was possible. Anyway, the way I discovered they were encrypted was that I changed ...
-1
votes
3answers
437 views

How to increase Windows PowerShell WebAccess security?

What are some recommended techniques to improve the security of powershell? Google returns many articles about powershell security like these: PowerShell’s Security Guiding Principles TechNet Edge ...
0
votes
1answer
167 views

Windows Firewall accepts a three-second unicast response from any source

I have read this article but still has some doubts may be after that... The Windows Firewall feature in Microsoft Windows XP Service Pack 2 (SP 2) accepts a three-second unicast response from ...