Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

-1
votes
3answers
44 views

Trouble with Metasploit framework (kali linux) [ms08_067_netapi]

I'm new to kali linux and just penetration testing in general. I'm having a bit of trouble with the metasploit framework in getting into my own pc. I've used this tutorial and I get an error that says ...
5
votes
3answers
2k views

Can a physical attacker compromise a Windows machine with UEFI, secure boot and bitlocker?

Machines such as the MS Surface Pro 3 comes with bitlocker encryption and UEFI secure boot out of the box. However, the default boot order is network -> usb -> ssd. If an attacker gets physical ...
0
votes
0answers
86 views

My ISP provider is spoofing DNS [on hold]

My ISP provider is DNS spoofing OpenDNS, Google DNS, Norton DNS, Yandex DNS and all other known DNS servers. So even if I use those, I still can't access some websites. So I need a DNS server which is ...
20
votes
3answers
889 views

How Do Rootkits & Other Low-Level Malware Still Manage to Load on Systems Protected by Secure Boot (and TB/MB)?

Let me try asking my question this way... Let's say that I'm a offensive cyber Bad Guy working for a foreign state-sponsored Advanced Persistent Threat unit. My unit is charged with, say, stealing ...
3
votes
2answers
147 views

Ransom32: How does it work?

Ransom32 seems to be a new ransomware written (partly) in JavaScript. As I understand it, it doesn't affect a user through a browser / by visiting a website, but by downloading some .rar file which ...
2
votes
2answers
80 views

Is Qubes OS more secure than running a set of activity related VMs?

I'd like to skip the argument about Linux being more secure than Windows, and purely focus on the security boundaries between Host OS and VMs. Is Qubes OS theoretically more secure than say - Windows ...
0
votes
1answer
22 views

How can I determine the common cryptographic suites I need to enable on my browser for common websites?

How do I determine the common cryptographic suites I need to enable on my browsers (I use IE11, Firefox/Nightly 49, Chrome 51) running on Windows for common websites, for eg, www.google.com, www.w3....
2
votes
1answer
2k views

Why is windows considered insecure? [duplicate]

Possible Duplicate: Linux or Windows- the security issue I often see people complaining that Windows is "highly insecure" while linux is MUCH more secure. What exactly are the reasons/flaws ...
5
votes
3answers
75 views

Can I test my own network?

I'm currently trying to enter the field of information security and I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? I only have a couple ...
6
votes
0answers
59 views

Can I use disk encryption and track my device at the same time, in case it's stolen or lost? [duplicate]

I would like to encrypt a single user profile but have been told EFS isn't the solution. I have a laptop that I leave in my bag and use for work and private purposes. I want to secure data in case my ...
0
votes
1answer
303 views

How to find Windows version from the file on a remote system

I need to find out what Windows and Service Pack system is currently running. All I have is ftp access, it means I cannot run any the software. Is there a way to determine what version of Windows, ...
15
votes
7answers
3k views

Can hackers detect my operating system?

I've seen people demonstrating the use of backtrack to attack VMs. In one of the components of backtrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, i ...
-1
votes
1answer
96 views

What anti-DDoS solutions for Windows are there?

I would love to know, If there is a way to mitigate DDos/Dos attacks on Windows. In Linux we can Mitigate using the almighty iptables, but I wonder if there an equivalent for Windows.
2
votes
1answer
51 views
+50

What is the definition for different access attributes in object access auditing?

Though there is documentation available about configuring Object Access auditing, there is no place where I have found any documents explaining the different attributes in Object Access Auditing. Can ...
1
vote
1answer
24 views

Unable to PSEXEC into machine with admin hash

I'm doing a penetration test at the moment, and I am trying to PSEXEC into a machine for which I have the local administrator hash. I am attempting this with metasploit and metasploits psexec module. ...
0
votes
2answers
71 views

Running an app in docker on Windows

If I run an app in a docker container using Kitematic, does that help protect my system from that app? I mean: does it prevent any problems if the app tries to damage the Operating System?
0
votes
0answers
84 views

Possible to detect Metasploit trojan installation on Windows 10?

I'm concerned my Win 10 installation may be infected with one of Metasploit's trojan variants. How could I go about confirming or disproving this suspicion? Are there ways to detect Metasploit hacks?
4
votes
2answers
82 views

How attaching to a process with a debugger can compromise system's security?

Visual Studio shows a warning, trying to attach to a different user's process: Searching for an explanation, I've found the MSDN article, claiming that: An untrusted process that contains ...
0
votes
2answers
90 views

How secure is Windows 10 account control?

I have a Microsoft account in my machine (Admin). I set a guest account (Standard) for a friend so he can play games. Is there any way he could access my files/folders info? I mean, get data, view ...
3
votes
4answers
310 views

Is a computer more vulnerable if wireless is left on when booting?

Normally I switch off wireless on my laptop before I shut it down but I forgot to do this last night. So this morning, after I booted up the laptop, I saw the wireless notification on the bottom right ...
1
vote
2answers
267 views

Track USB activity on Windows

I want to know what happens in my USB Devices (file creation, file renamed, etc) without use an external tool. I'm using Windows 7, can I enable some GPO to log these actions? Here use the event ...
4
votes
2answers
2k views

“Extended Protection” primer and implementation guide to prevent MITM

Extended Protection (link) (link) is a feature in Windows 7 and Windows 2008 R2 that prevents certain MITM attacks. Does anyone have a primer (or explanation in plain English) what this feature is, ...
3
votes
0answers
53 views

security of libgcrypt when cross-compiling for windows?

Looking at libgcrypt, specifically secmem.c it seems that it does not account for windows-specific memory handling (e.g. VirtualLock) and in fact there is a very troubling comment: #elif defined (...
0
votes
1answer
78 views

Can I detect when a file is copied on Windows?

Can I detect when a file is copied on Windows? Will it create an event in the Windows log? Or can I not? I know you can detect when a file is created due to the file pointers and stuff, but can you ...
3
votes
0answers
35 views

Host process for windows services network activity between other computer on same network

Wondering if this is normal? I have two PCs hooked up to a router and when the other one powers up and I check my firewall I see that there's some sporadic network activity going on (mainly upload/...
1
vote
1answer
54 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
2
votes
2answers
120 views

Limiting FTP privileges on Windows Server

I currently have a Windows 2012 Server which is acting as a webserver running IIS. I am using Filezilla to host an FTP server to allow some clients FTP access to their own websites. I have setup the ...
11
votes
6answers
4k views

Can viruses actually inject their code in other processes?

Can a virus really inject its own code into a process so it stays on your computer permantly? The only way to actually remove it is to reinstall your OS. My question is how can it do that without ...
12
votes
1answer
1k views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
1
vote
1answer
90 views

AuthentiCode Launcher runs everything

Imagine a vendor uses AuthentiCode only to get rid of the yellow UAC warnings. To avoid buying new certificates each year, the vendor could create a Launcher EXE which is signed, requests UAC ...
0
votes
1answer
430 views

Corporation Best Practices for Encrypting Locally Stored Email Data

Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an ...
0
votes
1answer
32 views

Shared folders in Windows to/from unsecured PC on the same network

I have a Windows 10 desktop computer which is my main device. It's password-protected and I'm not concerned about it being physically accessed by bad actors. I have a Windows 7 laptop with a fresh OS ...
-3
votes
1answer
84 views

checking if malware altered system files in windows

a friend called me today because he opened an attachment of an email. It was a double zipped exe file - and malware: I started to analyze the file: first with virustotal - then with radare2 and the ...
4
votes
2answers
4k views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
3
votes
2answers
105 views

Comparison and difference between CAs

While doing some Google searches, I learnt that there are a lot of different Certification Authorities like the Windows role named "Active Directory Certificate Services", the OpenSSL library or the ...
4
votes
1answer
250 views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the quad-...
7
votes
2answers
2k views

When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?

When you take ownership of a TPM in Windows 7 you encounter a screen like this: Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
0
votes
0answers
30 views

How to record the event that an attachment from Outlook has been clicked to run or downloaded to the disk? [migrated]

I am developing a solution to monitor security events on Windows. Two of the events to monitor are: an attachment from an email (Outlook) has been clicked to run or downloaded to the disk a link ...
0
votes
1answer
93 views

Why does Windows 7 remove Authenticated Users from file permissions when a folder is shared?

When I try to share a folder using the share tab in file properties, if I go back and remove sharing options from the Share tab, it also affects the Security tab, removing inheritance of permissions ...
3
votes
1answer
45 views

Possible security measures to put into place before allowing screen sharing

I have someone who is having their non profit small company receive a financial audit. They are prepared for it but the financial auditors have asked to also do part of it remotely and would like to ...
3
votes
3answers
205 views

Is Bitlocker trustworthy?

My question isn't about whether or not the encryption on Bitlocker works, but whether or not there has been any security audits about potential backdoors Microsoft may have installed. I don't have a ...
-3
votes
0answers
43 views

How to secure locally created web applications [duplicate]

I'm a web developer, My customers always asking me to make a local programs to them like using C# or MS Access desktop application. I don't want to switch my programming knowledge.. the problem is if ...
3
votes
1answer
45 views

Application Whitelisting Approaches/Options on non-Enterprise Windows PCs

For a while now I've been kicking around the idea of implementing application whitelisting on a few sets of machines (owned by 2-3 different consulting clients) I administer that seem suitable for it. ...
1
vote
0answers
24 views

Denying access to USB ports, but setting up an “escalation” for allowing access on-demand [migrated]

For Windows 7/10, is there a way to block access to USB ports, but make it so that it could be "authorized" UAC-style by an Administrator, on a case-by-case basis? I know that I can block the USB ...
0
votes
1answer
58 views

Is it safe to use this online tool to generate my Windows Answer File?

I found a Tool to generate an unattended Windows Answer File for Windows Installation but I'm not sure if it is safe to use. It asks for the default password to setup a local admin user and the ...
0
votes
1answer
39 views

How to connect to Windows RDP and delegate authentication to a (reverse) proxy?

Looking for the following setup: Client connects to Windows RDP server through proxy server. The client is in public network hence can't send username/password for logon. The proxy server in between ...
29
votes
4answers
200k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
8
votes
1answer
182 views

Does Logging out of Windows make my computer much safer than only locking?

I recently saw the following security tip on my company's intranet: When you are done using a computer, always Log Off, Restart, or Shut Down. If you only lock your computer, your account ...
3
votes
2answers
239 views

Detecting when a screenshot is taken by a software (spyware) in Windows [closed]

Most trojaning, spyware and keylogger tools have the ability to take screenshots. Is there a way to detect if an app or software is taking a screenshot in Windows? Maybe a Windows API call or dll? ...
-5
votes
0answers
43 views

node.exe using network from USA

I found this process in my network via resource monitor.. why would it be there? (it was there before opening Firefox) Are the other Firefox services legit? Two of them are linked to amazon (the ...