A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

0
votes
0answers
5 views

monitoring local admin remote login

Using SIEM system, how can I monitor the event of someone remote login into a computer using a local adminstrator account ? By using RDP you can remote login using local adminstrator account into a ...
3
votes
0answers
41 views

PKI Installation

I must install a PKI in my organization. I work in a windows environment. I already set an offline CA. I must now install a subordinate CA. I have the choice between installing the subordinate CA on a ...
0
votes
0answers
31 views

How is Thread local storage used by malware/Virus?

I have been told that code in TLS is run before the entry point of an exe is reached ,so if one puts a breakpoint on this TLS address he/she could debug the behavior of the virus.Can Fiber local ...
0
votes
1answer
31 views

Upgrade my Dell Inspiron laptop for PenTesting [on hold]

I have a Dell Inspiron N5110 & wanna upgrade it to start practising pentesing with virtual machines. What do u suggest from specs below to upgrade (I have Kali Linux, Tails OS, XP, Metasploitable ...
-1
votes
1answer
46 views

Corporation Best Practices for Encrypting Locally Stored Email Data

Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an ...
46
votes
1answer
3k views

Why does Windows Ship with Expired SSL Certificates?

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete. Why does a fresh install of Windows Server 2012 R2 ...
3
votes
2answers
74 views

Corporate Domain-Joined PC Used in China [on hold]

What would be the disadvantages of allowing a user to travel to China (business trip) using a domain-joined corporate Windows PC as opposed to a non-domain-joined PC?
1
vote
1answer
67 views

secure use of psexec?

As of March 7, 2014 PsExec now "encrypts all communication between local and remote systems, including the transmission of command information such as the user name and password under which the remote ...
1
vote
2answers
56 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
2
votes
0answers
24 views

What are analytics APIs accessing when they run, and how do you block or spoof them?

What are analytics APIs accessing when they run, and how do you block or spoof them? Usually all apps from desktop or mobile app stores, MMO clients, Steam and many utilities, and many games and ...
0
votes
0answers
78 views

How to ensure all traffic goes through VPN?

I want to make sure all traffic goes through the VPN. The VPN manager has an option to enable a "kill-switch" which cuts off the internet if the VPN is not being used, however this feature buggy and ...
2
votes
1answer
193 views

Are COMET installations immune to “Slow TCP Reading” DoS on Windows? (Such as SignalR or WebSync)

My understanding is that COMET implementations of WebSync and SignalR do not directly use IIS and are a few layers lower on the ISO model. After reading Qualys's blog regarding slow TCP reading, I ...
5
votes
2answers
143 views

CTF competitions/challenges that are Windows based?

I've been messing about in CTF's for a while and I also do pen-testing professionally, what i've noticed is a distinct lack of CTF competitions using windows environments. This is in stark contrast ...
1
vote
2answers
90 views

Quick question regarding suspicious disk space use: [closed]

Quite some time ago I used a friend's computer. I can't remember exactly what I was doing; but as part of whatever it was, I needed to use a USB flash drive. At a point in time soon after connecting ...
1
vote
3answers
89 views

Security in Windows 7 vs Ubuntu

I have two semi-related questions about the security-related reasons I hear for switching to Ubuntu over Windows 7 (or from other Windows OSs to other Linux distributions). Someone people say that ...
3
votes
1answer
66 views

If I visit a https site from a Family Safety-enabled computer, and someone drops in on the connection, will I be notified?

While reading about Family Safety and HTTPS: Since HTTPS is designed to prevent snooping, Microsoft Family Safety would be unable to monitor the encrypted traffic unless it performs what is ...
1
vote
0answers
43 views

Obtaining login scripts for a domain?

I have read that a useful technique in penetration testing is to obtain the login scripts for a domain, as they may often have passwords obfuscated in there or other useful information. However, in ...
0
votes
1answer
43 views

csh http shellshock on a windows 2008 server

My company's McAfee system detected many "http CSH bash ShellShock code injection attacks" attempts on a Windows 2008 server running Apache Tomcat Coyote. Does this config present a potential attack ...
12
votes
6answers
13k views

How secure is NTFS encryption?

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? (The encryption option under file|folder -> properties -> advanced -> encrypt.) If the user uses a decent password, can this ...
2
votes
1answer
148 views

Can a physical attacker compromise a Windows machine with UEFI, secure boot and bitlocker?

Machines such as the MS Surface Pro 3 comes with bitlocker encryption and UEFI secure boot out of the box. However, the default boot order is network -> usb -> ssd. If an attacker gets physical ...
7
votes
5answers
10k views

How to trace a DDOS attack on a dedicated server and block it?

I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering. The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
1
vote
1answer
27 views

What is the difference between certified and non-certified drives for Windows To Go?

Microsoft suggests "certified drives" for http://www.microsoft.com/en-us/windows/enterprise/products-and-technologies/devices/windowstogo.aspx, but it appears that other than confirming that these ...
4
votes
2answers
40 views

monitor port scan on the same segment

if theres a port scan on the same segment and it does not reach the firewall at all, it is not detectable by anything. is there any solution to that ? maybe using the windows fw on ach workstation to ...
2
votes
2answers
151 views

Chrome is denying me access to the youtube website and it says incorrect certificate for host

I've been trying to access the website of youtube but it keeps denying permission. It says Incorrect certificate for host. The server presented a certificate that doesn't match built-in ...
6
votes
0answers
585 views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
0
votes
1answer
87 views

How can Stolen Laptop tracking softwares survive OS reinstall?

Some softwares such as Computertrace claim that it can survive on a laptop even if the thief successfully reinstalls the operating system, reformats the hard drive, or (in some laptop models) swaps ...
0
votes
1answer
33 views

How to configure routing infrastructure so that the appropriate network traffic gets passed to the honeypot machine (windows xp)

I would like to configure local honeypot on windows xp which is installed on vmware, to do so I follow instruction on this link, but as I am new I don't know how can I configure routing infrastructure ...
1
vote
0answers
112 views

Is the process Wslxrqjet.exe, tagged 'Google Chrome', malicious?

Multiple instances (between 3 and 15) of this of this process Wslxrqjet.exe are running on my Windows 8 system at all times. Windows Task Manager 'Description' field for all instances is "Google ...
1
vote
1answer
94 views

Does anything stop applications from reading your saved passwords and cookies from your browser's AppData folder?

Obviously the first answer is "a malicious application can do much worse than that." However, it seems like a really easy thing for an application to read your cookies, saved passwords, etc. from your ...
0
votes
0answers
57 views

Which antivirus scanners detect malicious files like image files / text files that seem harmless? until double clicked?

I'm on win7 64bit, and I just found out that you can embed scripting data into images and plain text files where it would run the cmd.exe file to execute other scripts. What type of antivirus scanners ...
2
votes
0answers
41 views

Remote Registry allows bypass of 2FA enforcement with 1FA

Some organizations will configure their Windows systems to require Smart Cards for all account logins, as part of a two-factor authentication implementation. However, this can easily be bypassed ...
5
votes
1answer
3k views

What's the risk of changing permissions of the Security Eventlog registry key to IT operations?

Background Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code: ...
0
votes
0answers
11 views

Is TrID a reliable alternative to the file command for windows?

I am doing malware analysis on Windows and am looking for a simple solution for file identification for an initial pass. TrID looks like a good candidate that prevents the overhead of installing ...
-3
votes
1answer
111 views

Remote UAC bypass and Microsoft does not regard it as security Boundry [closed]

Microsoft has tremendously increased the security of Windows 8.1 but i found a technique to bypass UAC remotely I know that if User belongs to local group Administrators he is not given full Admin ...
9
votes
4answers
4k views

Is Changing a File Type and Name an Effective Security Solution?

Is renaming folders & files and changing file types an effective solution for file security of a PC? I am an application programmer and have an extensive background in it. I have written a ...
2
votes
5answers
524 views

Computer hasn't been connected to internet for 2 weeks

A computer hasn't been connected to the internet for 2 weeks but has still been used. It's running Windows 8 and various notices are complaining about virus definitions and updates not being current. ...
2
votes
1answer
117 views

what is the difference between dll hooking and dll injection [duplicate]

I am confused and would like to know the difference between DLL injection and DLL hooking? I am familiar with its use in malware and I know that key-loggers use it. I also know that SetWindowsHooKEX ...
1
vote
1answer
90 views

what is the difference between dll hijacking and dll injection

I am confused. I would like to know if dll hijacking and dll injection are the same or are they different. I know that some malware use it to do malicious things. thank you in advance
0
votes
1answer
47 views

What process would add gdiplus.dll and msdia80.dll at the root of a hard disk

I added a new 4TB hard disk drive to my desktop computer, and noticed a couple of days later two .dll files at the root of the drive. The environment in question is a 64-bit Windows 7 Professional ...
0
votes
2answers
45 views

Mobile App Security vs. Traditional PC Desktop Security In The New Era

I have been using a Windows PC for many years now. Since Android has come to market, I have been very wary of installing apps that require unrelated permissions. Obvoiusly, these extra permissions ...
0
votes
1answer
42 views

Should the thumbprint be SHA2 in addition to the Signature Hash Algorithm?

I'm looking at a Windows PKI and see that the Thumbprint is SHA1, while the Signature is SHA2 (SHA256). Is this an acceptable configuration? Should I recommend that the client update to SHA2 for a ...
1
vote
2answers
308 views

How to securely use Process.Start?

I am using Process.Start in a Windows Service I created to execute an exe that I have on my server that is used for audio conversion. I am passing some user input as a parameter to this exe. The ...
0
votes
1answer
326 views

How to get a Network's WIFI Password through CMD?

I found that Wifi's Password can be retrived using the network and sharing wizard in Windows, And Technicaly theres no way to store Passwords/collection of bytes in the memory after switching/shutting ...
0
votes
1answer
54 views

Windows netsh pivoting

I am pentesting a windows box to which I have gained system privileges. This box has two network interfaces. I have been able to reach machines on the second interface via the below netsh command. ...
2
votes
1answer
693 views

My MP3 file is blocked, but still playable?

My computer is telling me that my MP3 file is blocked: I have no problems playing the song, so I was wondering what exactly does it mean for my MP3 file to be blocked?
0
votes
0answers
45 views

Detection of pass the hash

I have researched about PTH Attacks but yet found any solid way detecting it in a network.is there a way to detect a pass the hash ? analysing the windows message from the dcs or something ?
2
votes
2answers
82 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
0
votes
0answers
74 views

Windows CTF/war games/reverse engineering/exploit challenges

War Games are fun but mainly deal with Linux reverse engineering. Example: http://blackbox.smashthestack.org:85/ Does anyone know of similar online games for Windows security?
22
votes
3answers
6k views

Create a unterminable process in Windows

I am a student, and am genuinely curious about unterminable processes in Windows. For educational purposes, I would like to create an application (possibly in VB6?) which cannot be terminable by a ...
1
vote
2answers
1k views

Any network related security benefits using RODC (Read Only DC) in DMZ?

Windows servers in the DMZ need to communicate with the Active Directory. I do not like that the servers will have direct communication with my Active Directory, so I consider installing a Read-Only ...