Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

6
votes
0answers
57 views

Can I use disk encryption and track my device at the same time, in case it's stolen or lost?

I would like to encrypt a single user profile but have been told EFS isn't the solution. I have a laptop that I leave in my bag and use for work and private purposes. I want to secure data in case my ...
5
votes
0answers
98 views

Are shatter attacks still possible in the days of User Interface Privilege Isolation?

Before Windows introduced User Interface Privilege Isolation, any application could send all kinds of window messages to any window on the same desktop (a shatter attack), allowing elevation of ...
5
votes
0answers
141 views

Windows Certificate Services: Is it possible to enroll a SmartCard certificate AND have key archival?

I'm using ACOS5-64 Client Kit, I want to enroll for a certificate with key archival. I tried to do so by duplicating the SmartCard template and checked Archive subject's encryption private key option ...
3
votes
0answers
52 views

security of libgcrypt when cross-compiling for windows?

Looking at libgcrypt, specifically secmem.c it seems that it does not account for windows-specific memory handling (e.g. VirtualLock) and in fact there is a very troubling comment: #elif defined (...
3
votes
0answers
35 views

Host process for windows services network activity between other computer on same network

Wondering if this is normal? I have two PCs hooked up to a router and when the other one powers up and I check my firewall I see that there's some sporadic network activity going on (mainly upload/...
3
votes
0answers
61 views

Will WinVerifyTrust return true for a file signed by a revoked certificate, before it was revoked?

I've seen mentions online that drivers that were signed by certificates that were later revoked are still trusted by Windows' driver integrity. Apparently if the file was signed before the revocation ...
3
votes
0answers
81 views

How to extract windows event logs from a hard disk forensic image?

I have created an image of hard disk using FTK imager. I want to extract the windows event logs. The system was running windows 7. What should I do?
3
votes
0answers
55 views

Lookaside List Injection

I've been reading a lot about Use-after-free and came across this document. It talks about a "Lookaside" injection exploit. The document says to empty the dynamic memory cache, called the Lookaside ...
3
votes
0answers
81 views

Enable FIPS 140.2 in Windows 7 (cng.sys version does not match with versions from NIST Validated list

I am currently working on an application running in Windows 7 Ultimate, and it has to be FIPS 140-2 compliance. As far as I have researched in https://technet.microsoft.com/en-us/library/security/...
3
votes
0answers
39 views

how to create TPM_AUTHDATA as input in tpm commands ?

I'm writing my first program which use tpm (version 1.2) services in Windows 7 using TBS, in this program I'm trying to execute the TPM_CreateWrapKey command. I noticed that many commands like the ...
3
votes
0answers
116 views

Lowercase 'w' seen in C:\windows application paths from wmic services list

In reviewing several Windows 7 computers built from the same image (using wmic services command), I'm seeing most all the Window services paths displayed as C:\windows not C:\Windows. The 'w' is ...
3
votes
0answers
606 views

copying roaming profile credential file of another computer

I am trying to recover login information of another computer. I have managed to copy the local/roaming profile credential files located in C:\users\%username%\APPDATA\local\Microsoft\Credentials\ and ...
2
votes
0answers
84 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
2
votes
0answers
207 views

Is possible to prevent input emulation with SetWindowsHookEx in specific application?

The one of technique of input emulation protection with automation toools like AutoIt or ACTools used most of simple game bot programs is SetWindowsHookEx usage WH_KEYBOARD_LL flags. This solution is ...
2
votes
0answers
58 views

Is a keytab sufficient for logon?

Is possession of a Kerberos .keytab file (as generated by e.g. ktpass) sufficient to 'pretend to be' that user on a windows machine? For example, create a process as, or access network resources (e.g. ...
2
votes
0answers
71 views

userWorkstations attribute in AD preventing users from logging into WebApp

For some of our users in AD, we have set userWorkstations attribute to restrict access to other machines. But this is preventing those users from logging into WebApplications (around 50+) protected ...
2
votes
0answers
62 views

Novicorp WinToFlash Lite, spyware etc

I used Novicorp WinToFlash Lite on Windows 7 to create a Windows 10 bootable USB memory stick. While creating the USB drive, I noticed that WinToFlash wrote something like adding blahblah files to ...
2
votes
0answers
123 views

How to store a file securely on the windows file system?

Problem: I have a windows service running under local system account. I have a blob of data that I want to store securely and persistently between reboots. I have decided to store it as afile( as ...
2
votes
0answers
63 views

Are Secure Desktop and separate process enough for hiding sensitive information in RAM?

In my program, I have an encrypted database on the file system with a password. It is decrypted in RAM, and the sensitive data get spread out too much in RAM for mistake to be auditable easily enough. ...
2
votes
0answers
829 views

Using “Security Compliance Manager” to audit a Windows system

I found a few posts which suggest using Microsoft SCM (Security Compliance Manager) to audit the security of Microsoft software solutions: Windows security policy analysis tool How do I apply a ...
2
votes
0answers
152 views

Is the process Wslxrqjet.exe, tagged 'Google Chrome', malicious?

Multiple instances (between 3 and 15) of this of this process Wslxrqjet.exe are running on my Windows 8 system at all times. Windows Task Manager 'Description' field for all instances is "Google ...
2
votes
0answers
388 views

Remote Registry allows bypass of 2FA enforcement with 1FA

Some organizations will configure their Windows systems to require Smart Cards for all account logins, as part of a two-factor authentication implementation. However, this can easily be bypassed ...
2
votes
0answers
74 views

Storing Recoverable Passwords In An App

I'm working on a project where I need to store and recover a password. I can't use a salted hash for authentication because the password is used to secure an HTTP connection via HTTP Digest. I'm not ...
1
vote
0answers
57 views

Bypass UAC without meterpreter session?

I have a research project about "Malvertising". I try to show an attack by using metasploit and I am using a Flash Plugin to hack the victim (exploit/multi/browser/adobe_flash_hacking_team_uaf) This ...
1
vote
0answers
14 views

Does windows still use it's software based user keys when TPM-based EFS is enabled?

I have an infineon TPM installed, with ownership taken, and EFS enabled with the TPM taking control of EFS for me. I do know that regular EFS uses the windows user cryptography/login password to ...
1
vote
0answers
30 views

Change NTLM hash in memory on the lock screen?

Is there a way to change the ntlm hash in memory to bypass Windows login? For example, I have the NTLM hash of a Windows machine and I have physical access. Is possible to write the NTLM hash in ...
1
vote
0answers
52 views

What personal information, if any, can be gleaned from a Microsoft APPCRASH problem signature?

I am trying to debug an "APPCRASH" problem event for a program running on Microsoft Windows 7. When this happens a problem signature is presented, like this example from SuperUser: Problem Event ...
1
vote
0answers
34 views

Problem using custom CryptoNG KSP on IE 11

We are currently developing a custom KSP (Key Storage Provider) for a Key Storage System. We successfully developed a CSP (CryptoAPI) and a KSP (CryptoNG) provider, and both work really fine for ...
1
vote
0answers
153 views

Did DKOM trigger PatchGuard on x64 Windows?

DKOM can be used to hide processes and drivers. It works well on x86 system. However, there are PatchGuard on x64 system. Can PatchGuard detect DKOM?
1
vote
0answers
37 views

Protect Specific Services on Client PC

I am not sure if I am asking in the correct location for this, but will ask in the hopes you assist. I want to be able to lock certain services from being restarted/stopped/ended. I know most Anti-...
1
vote
0answers
79 views

Use cases for IPC security windows communication

There are two processes on windows machine. One is in user space and second is a service. User space process sends data to service. Because iam starting to think about securing somehow communication ...
1
vote
0answers
442 views

PowerShell / Windows - Security best practices for enabling Windows Remote Management

As the title indicates, I'm looking for industry best practices for enabling Windows Remote Management on a mix of Windows Servers (from 2000, 2003, 2008/R2 and 2012) to allow PowerShell to execute ...
1
vote
0answers
120 views

IIS | Block execution of files in directory

I am dealing with user uploads via a PHP application. I want to secure the server so no exploits are available to the user, such as uploading a php shell and executing it. I have set it so all ...
1
vote
0answers
97 views

Detecting reflective DLL injection any other ways?

any way to detect it? maybe using mcafee hips rules? Are there any known Techniques to detect it ? like walking the VAD tree or something?
1
vote
0answers
61 views

Obtaining login scripts for a domain?

I have read that a useful technique in penetration testing is to obtain the login scripts for a domain, as they may often have passwords obfuscated in there or other useful information. However, in ...
1
vote
0answers
331 views

Mcafee endpoint encryption doesn't see previously encrypted partition after Windows 7 reinstallation

My partitions C and D were encrypted and Windows 7 was installed on C. I copied all important files to D and then changed harddrive controller from IDE to AHCI, removed C and created it again and then ...
1
vote
0answers
78 views

About Windows Interactive services Security

I know most services run under non interactive windows station or desktop also called session 0 while as some services (interactive) running under local system account create a window on interactive ...
1
vote
0answers
125 views

Clear EFS Cache at Set Interval

My boss wants to set up encrypted file shares using EFS on Windows Server 2012 R2 Boxes accessed by Windows 8.1 clients. I've been able to set the default DRA, issue certificates in test cases and so ...
1
vote
0answers
310 views

Windows OLE Vulnerability CVE-2014-4114 “Sandworm”

Just heard about a new vulnerability and am using the same format as the POODLE guy for this one. What is the Sandworm vulnerability? I use [product/browser]. Am I affected? Is [product] ...
1
vote
0answers
32 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
1
vote
0answers
90 views

SSRS custom assembly security issues

I want to invoke a custom assembly that uses protected services (like DirectoryServices, etc...) with reporting Services. On the web, I see a recurring example of configuration (inspired by this ...
1
vote
0answers
143 views

What is the security of Powershell “TrustedHosts”? (is it just a name match)?

Powershell has a TrustedHost section that is configured like this: winrm s winrm/config/client '@{TrustedHosts="CorpServer56"}' What security is implied for CorpServer56? Is it just an ASCII name ...
1
vote
0answers
92 views

Does whosthere.exe of pth toolkit have to run with administrative rights?

To see the users that are connected to the machine and they're pass hashes with Whosthere.exe, do I have to run it as an administrator?
1
vote
0answers
818 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
1
vote
0answers
245 views

Problem with qgankgyefx..vbe virus

I am not sure if I am in right forum. But i am having problem with this virus. On affected computer, If we use a USB drive, all the file become hidden. I am using HFV.exe for retrieve all data in ...
1
vote
0answers
202 views

Windows EFS on Amazon - how secure?

We evaluate using Windows EFS on Amazon EBS. There is a report about Windows flaw that allows you to copy data from encrypted volume: http://slashdot.org/topic/bi/the-windows-flaw-that-cracks-amazon-...
0
votes
0answers
83 views

Possible to detect Metasploit trojan installation on Windows 10?

I'm concerned my Win 10 installation may be infected with one of Metasploit's trojan variants. How could I go about confirming or disproving this suspicion? Are there ways to detect Metasploit hacks?
0
votes
0answers
36 views

How to extract the hash from SMB

I have a running PC which I need to test against.It is running Windows with SMB enabled. When capturing using Wireshark while connecting with an incorrect password I see packets being sent to / from ...
0
votes
0answers
33 views

InitializeSecurityContext takes 45 seconds to come out

For an expired certificate sent by a server, the InitializeSecurityContext function takes more than 45 seconds to come out with SEC_E_CERT_EXPIRED. Is there any configuration to avoid this much ...
0
votes
0answers
41 views

RDP Connection error Proxychains

I have a Remote Windows Server with RDP Enabled, Whenever i try to scan it's IP Using nmap <IP> It shows me Port 3389/tcp is Filtered (ms-wbt-server) , According to my Guess it must be Happening ...