Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

0
votes
0answers
20 views

rdp connection with netcat pivoting

I want to connection from local computer to another local computer. I have 3 machine. for example A: 192.168.1.50 -> in local windows machine B: 50.3.52.110 -> linux server C: 192.168.5.25 -&...
0
votes
2answers
81 views

How to use standalone meterpreter exe with a USB key connected to an unlocked victim session

When I need to make a POC about why it is dangerous to let the session unlocked, I used to put a mimikatz on an USB key and get the logon credentials in clear text. But sometimes the client has no ...
-1
votes
0answers
47 views

Windows 8 hacking

Can a Windows 8 machine can be hacked, by only knowing the IP address of the victim, without having first penetrated the Wifi? Say I disable the Wifi altogether and start my computer fresh..is it ...
0
votes
4answers
153 views

How to block all porn websites from firewall?

I want to block all porn websites and similar contents in my Windows 7 PC using Windows firewall. Till now I can block it by inserting sites one by one. Is there any category defined for such sites or ...
1
vote
0answers
18 views

Is it safe to paste secure notes into Notepad if you clear your clipboard? [duplicate]

Password manager software such as LastPass and Keepass often offer some form of a secure note feature, which allows the user to encrypt data with their master password. However, their GUIs may not be ...
0
votes
3answers
126 views

How secure is Windows 10 account control?

I have a Microsoft account in my machine (Admin). I set a guest account (Standard) for a friend so he can play games. Is there any way he could access my files/folders info? I mean, get data, view ...
9
votes
3answers
677 views

Is denying write access an effective way to stop ransomware?

I'm looking for ways to defend against ransomware. As part of this strategy I've come up with the idea to block myself from writing to as many locations (and files) as possible. It may be assumed ...
2
votes
2answers
307 views

Track USB activity on Windows

I want to know what happens in my USB Devices (file creation, file renamed, etc) without using an external tool. I'm using Windows 7, can I enable some GPO to log these actions? Here the event 4663 ...
-1
votes
0answers
34 views

Alternatives to Windows Internals [on hold]

The shiny new book on Windows 10 internals is coming on December 29. Until this date, what other (official) source(s) can I use/research to deepen my knowledge in Windows domain? Keep in mind that not ...
4
votes
1answer
142 views

Why is it a security issue to load Notepad++ plugins from %APPDATA% folder?

I have used the Notepad++ installer several times. However, it caught my eye that in one of the installer windows there is an option of: Allow plugins to be loaded from %APPDATA%." Below it there ...
1
vote
1answer
61 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
2
votes
2answers
134 views

Limiting FTP privileges on Windows Server

I currently have a Windows 2012 Server which is acting as a webserver running IIS. I am using Filezilla to host an FTP server to allow some clients FTP access to their own websites. I have setup the ...
3
votes
2answers
124 views

Why does DISA STIG recommend “Deny access to this computer from the network” for Domain Admins?

For Windows systems, the U.S. DISA STIGs recommend enabling the Deny access to this computer from the network for the Domain Admins and Enterprise Admins groups: https://www.stigviewer.com/stig/...
2
votes
1answer
253 views

How did someone find my Windows username?

I recently (and stupidly) created a Windows SBS 2011 user whose password was the username. Multiple unauthorized people across the Internet used RDP to log in as that user. How did they find the ...
0
votes
0answers
52 views

Windows API call sequence monitoring

I need to monitor an API call sequence created by a process running on Microsoft Windows, to analyze malware behavior. I know we can do user mode or kernel mode monitoring. I have tried some tools ...
12
votes
1answer
1k views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
-6
votes
0answers
76 views

How can I identify a person accessing my computer? [closed]

Activity on my computer last night when I was not home: Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 7/16/2016 11:27:59 PM Event ID: 4672 Task ...
2
votes
1answer
97 views

AuthentiCode Launcher runs everything

Imagine a vendor uses AuthentiCode only to get rid of the yellow UAC warnings. To avoid buying new certificates each year, the vendor could create a Launcher EXE which is signed, requests UAC ...
0
votes
1answer
490 views

Corporation Best Practices for Encrypting Locally Stored Email Data

Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an ...
1
vote
1answer
49 views

Shared folders in Windows to/from unsecured PC on the same network

I have a Windows 10 desktop computer which is my main device. It's password-protected and I'm not concerned about it being physically accessed by bad actors. I have a Windows 7 laptop with a fresh OS ...
12
votes
3answers
656 views

Can Microsoft access all private data if a user installs Windows 10?

According to this Forbes article by Gordon Kelly, a condition of using Microsoft's Windows 10 operating system is to agree to the following: [Microsoft] will access, disclose and preserve personal ...
4
votes
2answers
4k views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
1
vote
1answer
88 views

Is there a way to prevent changing the MAC address on a Windows machine?

Is it possible to stop someone from changing the MAC address of a Windows machine using GPOs?
4
votes
1answer
261 views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the quad-...
3
votes
2answers
185 views

Does typing something in Notepad but not saving it leave any trace?

Sometimes, if I'm having trouble typing a long password, I'll open up Notepad, type it in their (so I can make sure what I'm typing is correct), and the copy+paste it into the form, and then close the ...
0
votes
1answer
102 views

Why does Windows 7 remove Authenticated Users from file permissions when a folder is shared?

When I try to share a folder using the share tab in file properties, if I go back and remove sharing options from the Share tab, it also affects the Security tab, removing inheritance of permissions ...
3
votes
0answers
37 views

Can I use my computer while BitLocker is encrypting the system drive? [migrated]

I am thinking of encrypting my Windows 10 laptop with BitLocker (although I am curious about the answer for other versions too). If I start the process I imagine it will take a while since I have lots ...
1
vote
4answers
334 views

What configuration will allow another computer in the internet to probe my computer's ports?

I've just tested my computer with Gibson's port scan test: The test results stated that my system is "uncommon". It also said that my computer deliberately chose not to return. But I did not do any ...
-1
votes
3answers
61 views

Why is netapi obsolete [closed]

Why is the ms08_067_netapi exploit obsolete? Are there alternatives to this exploit that can help me inject payloads to more recent version of windows?
0
votes
1answer
66 views

Can't remove suspicious bridge connection

I'm currently fixing the computer of a family member who just fell for the "I'm from Microsoft and let me take control of your computer please" phone scam. The computer is an old Core 2 Duo running on ...
3
votes
2answers
620 views

If I visit a https site from a Family Safety-enabled computer, and someone drops in on the connection, will I be notified?

While reading about Family Safety and HTTPS: Since HTTPS is designed to prevent snooping, Microsoft Family Safety would be unable to monitor the encrypted traffic unless it performs what is ...
5
votes
4answers
4k views

How To Recover EFS Cert From Backup?

I made a backup of the old Win 7 Pro then did a clean install. But I forgot to export my EFS encryption certificate, so when after I restored the encrypted files from backup I could no longer access ...
1
vote
1answer
114 views

How can I manually add login credentials through the Windows Credential Manager?

For example I'd like to add the Steam login credentials, since the browsers won't ask to save the password. Is there a way to do it manually? If I choose to add a new windows credentials and put in ...
2
votes
1answer
60 views

Use local admin or domain admin to raise privileges on a machine for administrative purposes?

By now I would hope that, unless there were extenuating circumstances, all users (including administrative users) use a low-level account for their daily activities and raise their permissions to ...
0
votes
0answers
6 views

Using Windows installers created in SCCM on a custom boot menu [migrated]

I'm wanting to place several Windows Installers on an external HD and have a custom boot menu on it so one of those builds can be selected. Each of these are Windows 7 builds which have been created ...
0
votes
1answer
451 views

Windows CTF/war games/reverse engineering/exploit challenges

War Games are fun but mainly deal with Linux reverse engineering. Example: http://blackbox.smashthestack.org:85/ Does anyone know of similar online games for Windows security?
0
votes
1answer
82 views

How does Antivirus sandbox work?

Supposing we have a malicious .EXE which deletes (using DEL command with cmd) a sensitive system file. First, common antivirus will analysis the file with signature detection. Secondly, it will be ...
0
votes
1answer
140 views

WebDAV automatically attempting to connect remotely because of DFS namespace?

I recently bought and Installed a WAF (after much begging). I have a DFS namespace called \\mycompany.com\ which is based on my Active Directory domain name mycompany.com. My website domain is ...
10
votes
6answers
4k views

Can viruses actually inject their code in other processes?

Can a virus really inject its own code into a process so it stays on your computer permantly? The only way to actually remove it is to reinstall your OS. My question is how can it do that without ...
36
votes
2answers
14k views

How secure is the Windows 8 included Anti Virus known as Windows Defender?

How secure is the new Windows 8 anti virus known as Windows Defender? Does it have a protection against malware which uses UAC bypass/process injection/rootkits/process persistence/running the binary ...
7
votes
0answers
198 views

Are shatter attacks still possible in the days of User Interface Privilege Isolation?

Before Windows introduced User Interface Privilege Isolation, any application could send all kinds of window messages to any window on the same desktop (a shatter attack), allowing elevation of ...
0
votes
1answer
185 views

Block OS fingerprinting without using iptables?

I have a Linux machine connected to a Windows 98 PC on port 104. Now I want to block the OS fingerprinting using nmap for the windows 98 PC. I tried using iptables (blocking that particular port) but ...
45
votes
5answers
49k views

What can an attacker do with Bluetooth and how should it be mitigated?

What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? What can an attacker do once a malicious device is paired with mine? ...
10
votes
3answers
4k views

Offline Bruteforce attack against a Bitlockered Windows PC

I am currently assessing the security of Bitlocker from the perspective of an offline attack against a stored password (used to secure the Full Disk Encryption key). My assumption is that the password ...
3
votes
1answer
1k views

How does Windows Server 2008 store local users' passwords?

It is not clear to me how Windows Server 2008 R8 stores local account passwords. Is there any salt added or just NT hash is computed and stored? The following article describes all the methods used ...
0
votes
1answer
166 views

What process would add gdiplus.dll and msdia80.dll at the root of a hard disk

I added a new 4TB hard disk drive to my desktop computer, and noticed a couple of days later two .dll files at the root of the drive. The environment in question is a 64-bit Windows 7 Professional (...
1
vote
4answers
711 views

Possible to find out the last person to open a file on Windows without specialist tools?

So I suppose this is specific to the OS you are using or the filetype or software used to open it, but my question stands open for all really but I am particularly interested in more common files such ...
3
votes
1answer
118 views

Secure sharing between Windows computers

I'm working on a project to setup a secure system to share files between 5 Windows computers. The computers are part of a domain so could have multiple different users logging in (based on an AD group)...
0
votes
1answer
99 views

Can I detect when a file is copied on Windows?

Can I detect when a file is copied on Windows? Will it create an event in the Windows log? Or can I not? I know you can detect when a file is created due to the file pointers and stuff, but can you ...
-1
votes
2answers
128 views

Trouble with Metasploit framework (kali linux) [ms08_067_netapi]

I'm new to kali linux and just penetration testing in general. I'm having a bit of trouble with the metasploit framework in getting into my own pc. I've used this tutorial and I get an error that says ...