Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

0
votes
1answer
109 views

WebDAV automatically attempting to connect remotely because of DFS namespace?

I recently bought and Installed a WAF (after much begging). I have a DFS namespace called \\mycompany.com\ which is based on my Active Directory domain name mycompany.com. My website domain is ...
0
votes
2answers
66 views

How can you be sure that there is a virus on your computer?

Am I being paranoid? I'm seeing signs of a virus everywhere on my computers but I have no way of being sure. I've tried scanning with windows defender multiple times and haven't found anything. My ...
7
votes
4answers
36k views

Windows Firewall - how to block inbound for all .exe files in a folder

In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
-1
votes
0answers
26 views

Running an app in docker on Windows

If I run an app in a docker container using Kitematic, does that help protect my system from that app? I mean: does it prevent any problems if the app tries to damage the Operating System?
1
vote
1answer
30 views

How can I list all self-signed certificates in my stores on a Windows client?

I'm on a mission to list the self-signed certificates ('issued by' and 'issued to' match) on my machine via an automated method. PowerShell is available for use. Preferably the results would be ...
-1
votes
6answers
2k views

How to prevent illegal file transfer or copying of video files from a PC?

I have developed a windows desktop application using VB.NET. My applications main purpose is to play videos. I have some videos which has copyrights on them, that are not suppose to be distributed or ...
9
votes
1answer
230 views

Are keyboard hooks inherently malicious?

My software is using low-level keyboard and mouse Win32 hooks for legitimate reasons (if it's any relevant, it's for determining a change in the caret position of the active code pane in the VBA IDE). ...
3
votes
0answers
82 views

Work wants to create an admin account on my system that I don't have access to? [on hold]

This is on a Windows 10 system, and they want to create an administrator account that only my manager will have the password to. This is apparently to enforce some new "security policies" that haven't ...
1
vote
0answers
30 views

Change NTLM hash in memory on the lock screen?

Is there a way to change the ntlm hash in memory to bypass Windows login? For example, I have the NTLM hash of a Windows machine and I have physical access. Is possible to write the NTLM hash in ...
0
votes
0answers
15 views

Scheduled tasks that need domain admin privileges

I have a Windows 10 box that runs a whole bunch of Powershell scripts, some of those contain cmdlets that need to be run against a DC, or mail server, for eg. Get-ADComputer, and ...
0
votes
1answer
90 views

Block OS fingerprinting without using iptables?

I have a Linux machine connected to a Windows 98 PC on port 104. Now I want to block the OS fingerprinting using nmap for the windows 98 PC. I tried using iptables (blocking that particular port) but ...
5
votes
2answers
307 views

Decrypting SSL using Wireshark on Linux vs Windows

I'm working on decrypting my own traffic that gets sent through Wireshark and I've been following this guide for reference. I have been using the SSLKEYLOGFILE environment variable and I can get the ...
-4
votes
0answers
85 views

Can someone help me dissect this virus? [on hold]

It's a well known virus found on USB sticks, where it will hide the data in the pendrive and creates a shortcut of the pendrive inside pendrive. Plug this into any other computer, and the virus ...
2
votes
1answer
408 views

Are there any alternatives to EFS for transparently encrypting the contents of a folder in Windows?

EFS is not an option for me because I'm using Windows 7 Home Premium. I am looking for folder encryption, not drive encryption.
0
votes
0answers
17 views

How can I do a Windows registry check with OpenVAS with out a port scan?

OpenVAS has the function to check Windows registries, but when i try to check a registry it also does a port scan. I used the scan configuration out off the manual. ...
0
votes
1answer
51 views

Multiple instances of programs allowed in Windows Firewall

I am new to Windows Firewall. While allowing a program through Windows Firewall, I found multiple entries present for Firefox and Java. Why is that?
6
votes
2answers
1k views

Does enabling EnableLinkedConnections pose a security risk?

As shown Microsoft's TechNet, network shares that are mapped by logon scripts are shared with the standard user access token instead of with the full administrator access token. Here's the gist of it: ...
0
votes
0answers
30 views

Can a virus execute without user interaction? [duplicate]

I have seen a lot of malware infection techniques where the user is infected by drive by downloads through browser vulnerabilities or social engineering. But is there a way that a virus could execute ...
3
votes
1answer
137 views

How is encryption different for Windows yet they are identical?

I right clicked on C:\Users\USERNAME and did advanced -> enable encryption. On one laptop it turned green. The other it shows an icon on the files with a lock. What is the difference between these? ...
3
votes
1answer
54 views

How to protect from WPAD attacks?

If you are in a Windows network, and you basically connect to a website ; And there is an attacker on Linux who changes the hostname to WPAD and configures WPAD.dat in his system, all your PC's ...
-7
votes
0answers
66 views

How to stop someone from hacking me [closed]

I know who is at fault but I don't want for her to get in trouble unless it won't stop after this last attempt to remedy the situation. I have the ip address before she started using apps to disguise ...
1
vote
0answers
19 views

script to temporarily block remote users from logging into a windows server during downtime [migrated]

I'm looking for a solution to the following issue: we have a windows server with a bunch of people logging in remotely to work on stuff; when we need to upgrade the server, we issue warnings via ...
3
votes
3answers
193 views

How to check if I have a rogue SSL/TLS certificate?

It's known, that if someone manages to install their certificate as a trusted certificate on your Windows computer, they can read all you SSl/TLS traffic with man-in-the-middle attack and you won't ...
2
votes
1answer
118 views

Can Windows BitLocker encryption be broken by Live Boot?

I have a Windows system and I protected the drive with BitLocker encryption. Can BitLocker encryption be bypassed by live-booting with Linux or any other OS?
1
vote
0answers
25 views

Privilege Escalation using DLL Hijacking - error while compiling “template.c” [migrated]

I'm learning about DLL Hijacking, going step by step this video made by Vivek - Privilege Escalation using DLL Hijacking Everything is very well explained, but there is one passage that is getting me ...
-2
votes
0answers
14 views

Computer infected with Skeeyah.A!bit [migrated]

Today I did a virus lookup for my relative via Windows Defender, and it found an Skeeyah.A!bit trojan. Windows Defender has deleted it, and even after reboot he didn't find traces of that trojan. ...
3
votes
2answers
115 views

How difficult is it to brute-force Windows EFS encryption?

With EFS I have C:\$USER\ encrypted so all files owned and used by said user are encrypted. If this laptop is stolen, am I correct that they could pull the microsoft user password hashes, crack ...
-2
votes
0answers
8 views

Suspicious Teamviewer connection [duplicate]

Whilst using my computer, I saw the Teamviewer GUI appear which only appears when a connection has established. The cursor was also glitching as the other person was trying to move it. I quickly ended ...
0
votes
0answers
17 views

Windows Server 2012 disable MFA for a single user?

I'm having issues with this for whatever reason. I created a new user and MFA is supposedly disabled but it doesn't seem to be true. Is there maybe something I've missed or is there an easier (more ...
1
vote
1answer
191 views

Track USB activity on Windows

I want to know what happens in my USB Devices (file creation, file renamed, etc) without use an external tool. I'm using Windows 7, can I enable some GPO to log these actions? Here use the event ...
1
vote
2answers
171 views

Would a RansomWhere application be possible for Windows too?

This is related to RansomWhere? which is a OS X specific defense developed by a former NSA employee. The premise is that it will "generically" stop ransomware from encrypting files on the OS. ...
3
votes
0answers
33 views

Will WinVerifyTrust return true for a file signed by a revoked certificate, before it was revoked?

I've seen mentions online that drivers that were signed by certificates that were later revoked are still trusted by Windows' driver integrity. Apparently if the file was signed before the revocation ...
0
votes
0answers
10 views

How do I update a verisign SSL certificate for a website running on Apache for windows server? [migrated]

The site has an SSL cert signed by verisign which expires in four days. Webserver is a windows server 2008 running Apache 2.2. There's an Apache2.2/conf/ssl/verisign folder that has all the certs ...
0
votes
1answer
43 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
12
votes
1answer
1k views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
4
votes
2answers
173 views

How do I protect my passwords from WebBrowserPassView?

I just got shocked with what can be achieved with WebBrowserPassView. It basically shows every password I've saved in my browser (Chrome). I guess other users on my PC could get my passwords that ...
3
votes
2answers
75 views

Signing the Recovery Partition

Do any computer manufacturers sign (DSA, or just publishing a hash) their recovery partitions so that I can be sure that these bits are authentic? I'd like to buy a second-hand computer and reduce ...
1
vote
1answer
70 views

AuthentiCode Launcher runs everything

Imagine a vendor uses AuthentiCode only to get rid of the yellow UAC warnings. To avoid buying new certificates each year, the vendor could create a Launcher EXE which is signed, requests UAC ...
3
votes
1answer
600 views

Cracking a 6-character alphanumeric password Windows dialog box

To put this problem in context, I have a touch monitor screen whose firmware program is protected by a password. The firmware program is downloaded over RS232 via a Windows utility program provided ...
0
votes
1answer
58 views

Limiting FTP privileges on Windows Server

I currently have a Windows 2012 Server which is acting as a webserver running IIS. I am using Filezilla to host an FTP server to allow some clients FTP access to their own websites. I have setup the ...
0
votes
1answer
283 views

Corporation Best Practices for Encrypting Locally Stored Email Data

Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an ...
0
votes
0answers
12 views

Does windows still use it's software based user keys when TPM-based EFS is enabled?

I have an infineon TPM installed, with ownership taken, and EFS enabled with the TPM taking control of EFS for me. I do know that regular EFS uses the windows user cryptography/login password to ...
4
votes
2answers
4k views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
43
votes
8answers
11k views

Why am I allowed to access protected Windows files when I boot Ubuntu from USB?

How come I'm allowed to reboot a computer that I don't own, put in a USB, boot ubuntu from it and then access all files stored on the drives available (even critical files such as system files on C ...
3
votes
1answer
202 views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the ...
0
votes
0answers
31 views

Allowing a program through a Windows Firewall [migrated]

I am new to Windows Firewall. I have seen this dialog and unable to understand its meaning. The above dialog says that "Allow python to communicate on these networks:". It then gives two ...
0
votes
1answer
56 views

Why does Windows 7 remove Authenticated Users from file permissions when a folder is shared?

When I try to share a folder using the share tab in file properties, if I go back and remove sharing options from the Share tab, it also affects the Security tab, removing inheritance of permissions ...
34
votes
5answers
43k views

What can an attacker do with Bluetooth and how should it be mitigated?

What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? What can an attacker do once a malicious device is paired with mine? ...
8
votes
7answers
5k views

Linux or Windows- the security issue [duplicate]

Possible Duplicate: Open Source vs Closed Source Systems Almost anyone who has grown up on Windows must have had the notion (that I had) of Linux being more secure than Windows- one of ...
1
vote
1answer
70 views

Privilige escalation with CreateNamedPipe and Impersonation for Windows Server 2012

While working with window based application came to know that local privilege escalation is possible when we use CreateNamedPipe method with Impersonation. This vulnerability was reported in Windows ...