Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

19
votes
4answers
15k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
6
votes
4answers
171 views

Why does DISA STIG recommend “Deny access to this computer from the network” for Domain Admins?

For Windows systems, the U.S. DISA STIGs recommend enabling the Deny access to this computer from the network for the Domain Admins and Enterprise Admins groups: https://www.stigviewer.com/stig/...
0
votes
1answer
28 views

How can I determine the common cryptographic suites I need to enable on my browser for common websites?

How do I determine the common cryptographic suites I need to enable on my browsers (I use IE11, Firefox/Nightly 49, Chrome 51) running on Windows for common websites, for eg, www.google.com, www.w3....
-2
votes
1answer
53 views

Can I reset a password, install a few programs, and restore the old password in Windows 7? [on hold]

I have a computer I need to install some programs onto. It is a company computer, but I need to fix it with a couple programs and they will not share the password. Thanks in advance and sorry if I ...
0
votes
0answers
48 views

Browser Autopwn2 Unable to exploit Firefox 47.0.1

Virtual Appliance: VMWare Workstation 12 Player Local VM: Kali Linux 2 Remote (Victim) VM: Windows XP Browsers on Remote VM: Firefox 47.0.1, IE 6 This article explains Browser Autopwn2 exploit. I ...
0
votes
0answers
14 views

Bypassing SafeSEH in application without unprotected modules

I'm trying to write an exploit for a vulnerable Win32 application, which has DEP, SafeSEH and stack cookies enabled. I can write anything to the stack, as there is buffer overflow vulnerability in an ...
1
vote
1answer
47 views

Unable to PSEXEC into machine with admin hash

I'm doing a penetration test at the moment, and I am trying to PSEXEC into a machine for which I have the local administrator hash. I am attempting this with metasploit and metasploits psexec module. ...
0
votes
0answers
25 views

rdp connection with netcat pivoting

I want to connection from local computer to another local computer. I have 3 machine. for example A: 192.168.1.50 -> in local windows machine B: 50.3.52.110 -> linux server C: 192.168.5.25 -&...
0
votes
2answers
84 views

How to use standalone meterpreter exe with a USB key connected to an unlocked victim session

When I need to make a POC about why it is dangerous to let the session unlocked, I used to put a mimikatz on an USB key and get the logon credentials in clear text. But sometimes the client has no ...
-1
votes
0answers
55 views

Windows 8 hacking

Can a Windows 8 machine can be hacked, by only knowing the IP address of the victim, without having first penetrated the Wifi? Say I disable the Wifi altogether and start my computer fresh..is it ...
0
votes
4answers
160 views

How to block all porn websites from firewall?

I want to block all porn websites and similar contents in my Windows 7 PC using Windows firewall. Till now I can block it by inserting sites one by one. Is there any category defined for such sites or ...
1
vote
0answers
19 views

Is it safe to paste secure notes into Notepad if you clear your clipboard? [duplicate]

Password manager software such as LastPass and Keepass often offer some form of a secure note feature, which allows the user to encrypt data with their master password. However, their GUIs may not be ...
0
votes
3answers
126 views

How secure is Windows 10 account control?

I have a Microsoft account in my machine (Admin). I set a guest account (Standard) for a friend so he can play games. Is there any way he could access my files/folders info? I mean, get data, view ...
9
votes
3answers
685 views

Is denying write access an effective way to stop ransomware?

I'm looking for ways to defend against ransomware. As part of this strategy I've come up with the idea to block myself from writing to as many locations (and files) as possible. It may be assumed ...
2
votes
2answers
309 views

Track USB activity on Windows

I want to know what happens in my USB Devices (file creation, file renamed, etc) without using an external tool. I'm using Windows 7, can I enable some GPO to log these actions? Here the event 4663 ...
-1
votes
0answers
34 views

Alternatives to Windows Internals [closed]

The shiny new book on Windows 10 internals is coming on December 29. Until this date, what other (official) source(s) can I use/research to deepen my knowledge in Windows domain? Keep in mind that not ...
4
votes
1answer
146 views

Why is it a security issue to load Notepad++ plugins from %APPDATA% folder?

I have used the Notepad++ installer several times. However, it caught my eye that in one of the installer windows there is an option of: Allow plugins to be loaded from %APPDATA%." Below it there ...
1
vote
1answer
61 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
2
votes
2answers
134 views

Limiting FTP privileges on Windows Server

I currently have a Windows 2012 Server which is acting as a webserver running IIS. I am using Filezilla to host an FTP server to allow some clients FTP access to their own websites. I have setup the ...
2
votes
1answer
255 views

How did someone find my Windows username?

I recently (and stupidly) created a Windows SBS 2011 user whose password was the username. Multiple unauthorized people across the Internet used RDP to log in as that user. How did they find the ...
0
votes
0answers
54 views

Windows API call sequence monitoring

I need to monitor an API call sequence created by a process running on Microsoft Windows, to analyze malware behavior. I know we can do user mode or kernel mode monitoring. I have tried some tools ...
12
votes
1answer
1k views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
-6
votes
0answers
77 views

How can I identify a person accessing my computer? [closed]

Activity on my computer last night when I was not home: Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 7/16/2016 11:27:59 PM Event ID: 4672 Task ...
2
votes
1answer
97 views

AuthentiCode Launcher runs everything

Imagine a vendor uses AuthentiCode only to get rid of the yellow UAC warnings. To avoid buying new certificates each year, the vendor could create a Launcher EXE which is signed, requests UAC ...
0
votes
1answer
495 views

Corporation Best Practices for Encrypting Locally Stored Email Data

Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an ...
1
vote
1answer
51 views

Shared folders in Windows to/from unsecured PC on the same network

I have a Windows 10 desktop computer which is my main device. It's password-protected and I'm not concerned about it being physically accessed by bad actors. I have a Windows 7 laptop with a fresh OS ...
13
votes
3answers
674 views

Can Microsoft access all private data if a user installs Windows 10?

According to this Forbes article by Gordon Kelly, a condition of using Microsoft's Windows 10 operating system is to agree to the following: [Microsoft] will access, disclose and preserve personal ...
4
votes
2answers
4k views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
1
vote
1answer
88 views

Is there a way to prevent changing the MAC address on a Windows machine?

Is it possible to stop someone from changing the MAC address of a Windows machine using GPOs?
4
votes
1answer
262 views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the quad-...
3
votes
2answers
190 views

Does typing something in Notepad but not saving it leave any trace?

Sometimes, if I'm having trouble typing a long password, I'll open up Notepad, type it in their (so I can make sure what I'm typing is correct), and the copy+paste it into the form, and then close the ...
0
votes
1answer
102 views

Why does Windows 7 remove Authenticated Users from file permissions when a folder is shared?

When I try to share a folder using the share tab in file properties, if I go back and remove sharing options from the Share tab, it also affects the Security tab, removing inheritance of permissions ...
3
votes
0answers
37 views

Can I use my computer while BitLocker is encrypting the system drive? [migrated]

I am thinking of encrypting my Windows 10 laptop with BitLocker (although I am curious about the answer for other versions too). If I start the process I imagine it will take a while since I have lots ...
1
vote
4answers
335 views

What configuration will allow another computer in the internet to probe my computer's ports?

I've just tested my computer with Gibson's port scan test: The test results stated that my system is "uncommon". It also said that my computer deliberately chose not to return. But I did not do any ...
-1
votes
3answers
61 views

Why is netapi obsolete [closed]

Why is the ms08_067_netapi exploit obsolete? Are there alternatives to this exploit that can help me inject payloads to more recent version of windows?
0
votes
1answer
67 views

Can't remove suspicious bridge connection

I'm currently fixing the computer of a family member who just fell for the "I'm from Microsoft and let me take control of your computer please" phone scam. The computer is an old Core 2 Duo running on ...
3
votes
2answers
620 views

If I visit a https site from a Family Safety-enabled computer, and someone drops in on the connection, will I be notified?

While reading about Family Safety and HTTPS: Since HTTPS is designed to prevent snooping, Microsoft Family Safety would be unable to monitor the encrypted traffic unless it performs what is ...
5
votes
4answers
4k views

How To Recover EFS Cert From Backup?

I made a backup of the old Win 7 Pro then did a clean install. But I forgot to export my EFS encryption certificate, so when after I restored the encrypted files from backup I could no longer access ...
1
vote
1answer
116 views

How can I manually add login credentials through the Windows Credential Manager?

For example I'd like to add the Steam login credentials, since the browsers won't ask to save the password. Is there a way to do it manually? If I choose to add a new windows credentials and put in ...
2
votes
1answer
61 views

Use local admin or domain admin to raise privileges on a machine for administrative purposes?

By now I would hope that, unless there were extenuating circumstances, all users (including administrative users) use a low-level account for their daily activities and raise their permissions to ...
0
votes
0answers
6 views

Using Windows installers created in SCCM on a custom boot menu [migrated]

I'm wanting to place several Windows Installers on an external HD and have a custom boot menu on it so one of those builds can be selected. Each of these are Windows 7 builds which have been created ...
0
votes
1answer
452 views

Windows CTF/war games/reverse engineering/exploit challenges

War Games are fun but mainly deal with Linux reverse engineering. Example: http://blackbox.smashthestack.org:85/ Does anyone know of similar online games for Windows security?
0
votes
1answer
82 views

How does Antivirus sandbox work?

Supposing we have a malicious .EXE which deletes (using DEL command with cmd) a sensitive system file. First, common antivirus will analysis the file with signature detection. Secondly, it will be ...
0
votes
1answer
140 views

WebDAV automatically attempting to connect remotely because of DFS namespace?

I recently bought and Installed a WAF (after much begging). I have a DFS namespace called \\mycompany.com\ which is based on my Active Directory domain name mycompany.com. My website domain is ...
10
votes
6answers
4k views

Can viruses actually inject their code in other processes?

Can a virus really inject its own code into a process so it stays on your computer permantly? The only way to actually remove it is to reinstall your OS. My question is how can it do that without ...
36
votes
2answers
14k views

How secure is the Windows 8 included Anti Virus known as Windows Defender?

How secure is the new Windows 8 anti virus known as Windows Defender? Does it have a protection against malware which uses UAC bypass/process injection/rootkits/process persistence/running the binary ...
7
votes
0answers
198 views

Are shatter attacks still possible in the days of User Interface Privilege Isolation?

Before Windows introduced User Interface Privilege Isolation, any application could send all kinds of window messages to any window on the same desktop (a shatter attack), allowing elevation of ...
0
votes
1answer
186 views

Block OS fingerprinting without using iptables?

I have a Linux machine connected to a Windows 98 PC on port 104. Now I want to block the OS fingerprinting using nmap for the windows 98 PC. I tried using iptables (blocking that particular port) but ...
45
votes
5answers
49k views

What can an attacker do with Bluetooth and how should it be mitigated?

What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? What can an attacker do once a malicious device is paired with mine? ...
10
votes
3answers
4k views

Offline Bruteforce attack against a Bitlockered Windows PC

I am currently assessing the security of Bitlocker from the perspective of an offline attack against a stored password (used to secure the Full Disk Encryption key). My assumption is that the password ...