Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

1
vote
1answer
69 views

Multiple instances of programs allowed in Windows Firewall

I am new to Windows Firewall. While allowing a program through Windows Firewall, I found multiple entries present for Firefox and Java. Why is that?
-1
votes
0answers
53 views

What is this virus doing?

So I created a small Windows VM to make a template out of and opened it up to RDP. I created a really easy password when I made the VM so, lo and behold, within three days of it being online it was ...
0
votes
1answer
188 views

Lock Windows to a specific app

Is it possible, using some program or application, to lock Windows 7 so only a specific app can be used, for example Word, until a password is entered?
0
votes
0answers
24 views

InitializeSecurityContext takes 45 seconds to come out

For an expired certificate sent by a server, the InitializeSecurityContext function takes more than 45 seconds to come out with SEC_E_CERT_EXPIRED. Is there any configuration to avoid this much ...
0
votes
1answer
19 views

How can I determine the common cryptographic suites I need to enable on my browser for common websites?

How do I determine the common cryptographic suites I need to enable on my browsers (I use IE11, Firefox/Nightly 49, Chrome 51) running on Windows for common websites, for eg, www.google.com, ...
-4
votes
0answers
72 views

Why does this registry key keep getting recreated even if I delete it?

When I open my registry editor I see this: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ...
4
votes
4answers
1k views

Windows Honeypot user account for tracking laptop

I've been wanting to create a dummy "Honeypot" user account on my Windows 7 laptop in case of theft. My question is: Has anyone come across useful resources and tips for doing this? Is there a way ...
3
votes
2answers
76 views

How to protect from WPAD attacks?

If you are in a Windows network, and you basically connect to a website ; And there is an attacker on Linux who changes the hostname to WPAD and configures WPAD.dat in his system, all your PC's ...
2
votes
2answers
128 views

Block mobile tethering on android phones from Windows (DLP)

In our small organisation I have tried my best at implementing DLP by: Making sure users access all files from the server Local disks are denied access (forced to work only on network drives) ...
9
votes
4answers
1k views

How to track a laptop after theft?

Our company had a break-in this evening and a laptop was stolen. The data on the laptop was not super-sensitive (luckily); however, we would like to be able to track the laptop if at all possible. ...
1
vote
2answers
416 views

How can Stolen Laptop tracking softwares survive OS reinstall?

Some softwares such as Computertrace claim that it can survive on a laptop even if the thief successfully reinstalls the operating system, reformats the hard drive, or (in some laptop models) swaps ...
-4
votes
0answers
94 views

This guy claims no need to apply any Windows update or use Antivirus! Do you agree? [duplicate]

He said only need to block all incoming connections and use Chrome sandbox. You can read his claim and his other replies over here: ...
-2
votes
1answer
45 views

What are the risks of an open regedit.msc in Windows?

Curious as to what sort of damage can be done with an open registry. Is it worth it applying group policy that restricts registry edit access, or is this not necessary?
3
votes
2answers
230 views

Is it safe to not update Windows if you dont accept any incoming connections?

I see this guy shared his thought: How to be safe even without most updated Windows updates So he claims that as long as you do not accept any incoming connections and just use sandbox of Chrome, ...
2
votes
1answer
120 views

How can Windows 10 not have the password in memory?

I have read that Windows 10 does not hold the password in memory from the creator of mimikatz: Starting with 8.x and 10, by default, there is no password in memory. Exceptions: When ...
1
vote
1answer
169 views

What threats are associated with using Teamviewer?

I was under the impression that Teamviewer is a safe form of remote control as: all of its traffic is encrypted; searching for Teamviewer exploits does not turn up anything. But I recently heard ...
5
votes
3answers
804 views

How can I restrict users' connection attempts to my FTP server?

Is there any way possible to restrict user to make a connection to the FTP server on my Windows XP computer? I have an FTP server established in Windows XP and now I want to make access to that FTP ...
-1
votes
1answer
25 views

SIM card used with smart card user certificate

Is it possible to put a smart card user certificate (Windows) on a SIM card? (SIM card already has telecom info on it). I'm using Win 2012 and have tried, but I am getting this error "smart card ...
1
vote
2answers
242 views

Track USB activity on Windows

I want to know what happens in my USB Devices (file creation, file renamed, etc) without use an external tool. I'm using Windows 7, can I enable some GPO to log these actions? Here use the event ...
-1
votes
0answers
13 views

Beef installation problem in Windows 10 - 64 bit [migrated]

I am trying to install Beef in a WIndows 10 - 64 bit PC. I followed the instructions provided in the following link: https://github.com/beefproject/beef/blob/master/INSTALL.txt But I keep getting ...
0
votes
1answer
47 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
1
vote
2answers
105 views

Limiting FTP privileges on Windows Server

I currently have a Windows 2012 Server which is acting as a webserver running IIS. I am using Filezilla to host an FTP server to allow some clients FTP access to their own websites. I have setup the ...
0
votes
0answers
40 views

How to run a GUI program on windows as administrator on a user account? [migrated]

I am making a test program called ResourceManager(RMTest) that tries to access an image "resource.jpg" in the same directory. resource.jpg has access set to deny for all non administrator accounts on ...
1
vote
3answers
298 views

Need help understanding Windows Authentication mechanism

Even if I enforce HTTPS and use anti-forgery tokens, it seems like Windows Authentication could be inherently insecure because it does not require that the user explicitly passes credentials from the ...
12
votes
1answer
1k views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
0
votes
0answers
5 views

Contents of Users\Default folder in Windows [migrated]

Can you help me with two things: On a Windows machine, what does the folder named 'Default' (Found under Users\Default) contain? I have a slight idea that it serves as a template for different user ...
1
vote
1answer
77 views

AuthentiCode Launcher runs everything

Imagine a vendor uses AuthentiCode only to get rid of the yellow UAC warnings. To avoid buying new certificates each year, the vendor could create a Launcher EXE which is signed, requests UAC ...
13
votes
2answers
3k views

How does Internet Explorer know what text files I have viewed?

I am using Windows 8.1 and Internet Explorer 11. Each time I use File Explorer to view a .txt file the history of Internet Explorer shows that I viewed that file in pages visited on this PC. ...
1
vote
2answers
178 views

Whitelist-based integrity scanner for Windows EXEs, DLLs, etc [closed]

I am looking for some kind of security software that scans your computer for all EXE and DLL files, calculates a cryptographic hash for them, and looks each one up in a database, logging all the ones ...
2
votes
1answer
322 views

How can I hide a program from another program?

If program A scans RAM, running processes and whatever, can I hide program B from being detected by A? Basically, I don't want program A to detect program B, or at least, stop it from identifying ...
-1
votes
0answers
6 views

kill process by its own description [migrated]

I need help for killing putty.exe by searching process for it's description even if the user change the name and the class name ( win title ) for the putty.exe if process description on process list ...
1
vote
2answers
226 views

VMware VM run on insecure OS

I run VMware with Linux through my Windows OS. I want to use the Linux VM for online transactions. Is it possible for a virus, spy or worm to attack my Linux VM from the Windows host? Is my Linux ...
1
vote
1answer
342 views

Corporation Best Practices for Encrypting Locally Stored Email Data

Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an ...
0
votes
0answers
30 views

RDP Connection error Proxychains

I have a Remote Windows Server with RDP Enabled, Whenever i try to scan it's IP Using nmap <IP> It shows me Port 3389/tcp is Filtered (ms-wbt-server) , According to my Guess it must be Happening ...
5
votes
4answers
266 views

How can I safely test malware in a VM? [duplicate]

This question has probably been asked several times here, but I'll ask it a bit differently. I am trying to learn about malware and how it infects computers and how to disinfect a computer if one ...
1
vote
1answer
59 views

How can I protect named pipes in windows?

I have some misunderstanding regarding how to secure the communication of named pipes in windows For example, I have a windows service that talks with other processes via pipes, how can I make sure ...
4
votes
2answers
4k views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
3
votes
1answer
216 views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the ...
0
votes
1answer
73 views

Why does Windows 7 remove Authenticated Users from file permissions when a folder is shared?

When I try to share a folder using the share tab in file properties, if I go back and remove sharing options from the Share tab, it also affects the Security tab, removing inheritance of permissions ...
85
votes
2answers
16k views

Can a rogue .wmv file “hijack” Windows Media Player?

I've downloaded a .wmv file using P2P. Attempting to play it with Media Player Classic (K-Lite Codec Pack) only gave me a green square in the playback window: I noticed that the video came with a ...
6
votes
4answers
6k views

What does Windows's built-in encryption do, if I can seemingly always read my encrypted files?

I'm playing around with certificates and encryption on a Windows system, but either it isn't working or I don't know how it should works. When I encrypt a file its name changes to green. But then, I ...
4
votes
0answers
89 views

Are shatter attacks still possible in the days of User Interface Privilege Isolation?

Before Windows introduced User Interface Privilege Isolation, any application could send all kinds of window messages to any window on the same desktop (a shatter attack), allowing elevation of ...
1
vote
1answer
100 views

Privilige escalation with CreateNamedPipe and Impersonation for Windows Server 2012

While working with window based application came to know that local privilege escalation is possible when we use CreateNamedPipe method with Impersonation. This vulnerability was reported in Windows ...
1
vote
1answer
56 views

How can I manually add login credentials through the Windows Credential Manager?

For example I'd like to add the Steam login credentials, since the browsers won't ask to save the password. Is there a way to do it manually? If I choose to add a new windows credentials and put in ...
2
votes
3answers
230 views

Install a vulnerable service for Windows 7

I have some kind of a project or demonstration, where I have to exploit Windows 7 to get a remote shell. I did a vulnerability scan with nessus on my Windows 7 machine, but I didn't find any kind of ...
0
votes
2answers
157 views

How can you be sure that there is a virus on your computer?

Am I being paranoid? I'm seeing signs of a virus everywhere on my computers but I have no way of being sure. I've tried scanning with Windows Defender multiple times but haven't found anything. My ...
-1
votes
1answer
48 views

Running an app in docker on Windows

If I run an app in a docker container using Kitematic, does that help protect my system from that app? I mean: does it prevent any problems if the app tries to damage the Operating System?
7
votes
3answers
37k views

Windows Firewall - how to block inbound for all .exe files in a folder

In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
0
votes
1answer
122 views

WebDAV automatically attempting to connect remotely because of DFS namespace?

I recently bought and Installed a WAF (after much begging). I have a DFS namespace called \\mycompany.com\ which is based on my Active Directory domain name mycompany.com. My website domain is ...
1
vote
1answer
43 views

How can I list all self-signed certificates in my stores on a Windows client?

I'm on a mission to list the self-signed certificates ('issued by' and 'issued to' match) on my machine via an automated method. PowerShell is available for use. Preferably the results would be ...