A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.
114
votes
7answers
18k views
CTRL+ALT+DEL Login - Rationale behind it?
Maybe a rather noobish question: Why is CTRL+ALT+DEL required at login on Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a ...
25
votes
3answers
1k views
Stack Overflow is www.doioig.gov/? If not, then could I be infected
Great! I made a post recently where I mentioned that my system might be infected. Now something new came up. When I search for Stack Overflow on Google, I see that the URL is www.doioig.gov/. When I ...
24
votes
1answer
969 views
What's the risk if I accidently type my password into a username field (Windows logon)?
I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
20
votes
8answers
20k views
Can I determine if my computer has a key logger installed?
A friend of mine just started a job at a security sensitive company. They've provided him with a laptop with Windows XP Professional installed. He's heard a rumor from other employees that the laptops ...
17
votes
6answers
455 views
How to deal with a person who gets easily fooled by internet and mail scams?
alternative title: How to deal with a person who has gotten paranoid and doesn't want to go online anymore?
A person, who has over the years been scammed many times, by bad spam/fraud emails, and ...
17
votes
3answers
535 views
What can an attacker do with Bluetooth and how should it be mitigated?
What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? What can an attacker do once a malicious device is paired with mine?
...
16
votes
3answers
944 views
Create a unterminable process in Windows
I am a student, and am genuinely curious about unterminable processes in Windows.
For educational purposes, I would like to create an application (possibly in VB6?) which cannot be terminable by a ...
15
votes
3answers
914 views
Why aren't applications sandboxed in Windows?
Sandboxing seem to be a way to restrict what an application can do. Today, I don't have much control of what my applications do with my computer. It feels more secure to use JavaScript based web ...
15
votes
4answers
496 views
Firefox pre-downloading
I've found out that if you download a file with Firefox, a similar window as this one pops up (in dutch in my case):
("Bestand opslaan" = "Save file")
However, the file is already being ...
14
votes
3answers
529 views
Why do rootkits hide in drivers?
A lot of rootkits for Windows (maybe even Linux?) do hide in drivers. Why is that?
One reason I can think of is that using a driver they run in kernel mode and have full system access, but aren't ...
14
votes
2answers
7k views
How does the Windows “Secure Desktop” mode work?
Can anyone explain (or provide a link to a simple explanation) of what the Windows "Secure Desktop" mode is and how it works?
I just heard about it in the KeePass documentation (KeePass - Enter ...
13
votes
4answers
1k views
Windows hardening
Can anyone point me at some good resources on Windows hardening? From 2003 upwards.
13
votes
2answers
3k views
How secure is Windows 8's Picture Password login?
The final Windows 8 build has been released to manufacturing. One of the new features of Windows 8 is "Picture Password", where the end user logs on to Windows by clicking a specific pattern on the ...
13
votes
2answers
1k views
Hiding user account names from unauthenticated RDP sessions
This is for a Windows 7 Ultimate system, which is not a member of a domain.
When I log into the system locally, I am required to either manually enter my user ID or authenticate with biometrics. The ...
12
votes
4answers
331 views
How to safely synchronize time over Internet?
All modern OS now keep accurate time by regularly synchronizing time over an untrusted network - Internet. Could an attacker conducting a MITM attack, influence or change the time of a computer while ...
12
votes
2answers
667 views
Can Windows malware harm a Linux computer when it's executed with Wine?
I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables.
I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to ...
12
votes
1answer
852 views
Something is changing my hosts file without asking
First: I can't find any information on this phenomenon, not anywhere on the net.
I don't know which application does it, but something in my Windows 7 Home Premium system (fully updated & legal) ...
11
votes
3answers
3k views
Prevent acccess to the C drive on Windows systems
Is it possible to prevent regular users from accessing the C drive via Windows Explorer? they should be allowed to execute certain programs. This is to ensure that employees cannot steal or copy out ...
11
votes
5answers
3k views
How is something as simple as a keylogger detected on a computer?
I found one online, which I wanted to try out at my house and see if it actually worked. It's written in C, and it is not very big at all considering half of it is just a bunch of cases for which key ...
11
votes
5answers
684 views
Convenient cross-platform help on checking secure hashes like SHA-256
It is often helpful to be able to obtain a good cryptographic checksum of a file, e.g. the SHA-256 hash. This can be used to verify file integrity, so long as you have a reliable source for the hash.
...
11
votes
3answers
699 views
Starting with sandbox development
I am looking for some security related project in which I can contribute and also learn something. Since I am new with this stuff It will be better if that project is less complex and digestible for a ...
11
votes
3answers
2k views
Three-Factor Authentication for Windows
This HowToGeek article...
http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/
...got me thinking.
Is there any software (or combination of software) that ...
11
votes
1answer
318 views
Is it secure to connect to a remote Windows Server using Remote Desktop only?
I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, ...
10
votes
6answers
1k views
Can viruses actually inject their code in other processes?
Can a virus really inject its own code into a process so it stays on your computer permantly? The only way to actually remove it is to reinstall your OS. My question is how can it do that without ...
10
votes
3answers
2k views
How can I prevent someone from accessing a Windows XP system via boot disk?
Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one:
...
10
votes
3answers
673 views
Attacks against windows kiosk software
I am interested in potential/actual attacks against kiosk software.
I am not talking about physical access, or specifically designed kiosk operating systems or shells, bur rather software that runs ...
10
votes
3answers
7k views
How do you discover what permissions an AD group has, if you have no documentation?
You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
10
votes
3answers
324 views
What security requirements do you have for Domain Administrators?
With regard to managing a Windows network, what security polices and processes do you use? For example
Do you require/support Smart Card
Authentication?
Restrict logins
from a particular ...
10
votes
2answers
268 views
How insecure is PowerShell Web Access?
Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones.
This sounds cool and scary at the ...
10
votes
1answer
95 views
How does LSA authentication on Windows work?
I'm trying to understand the security protocols on Windows from a high level as part of legal research into cybercrime, and I'm having difficulty figuring out where to focus my research.
I've already ...
10
votes
1answer
387 views
What encryption prevents the tampering of Windows Identity Foundation (WIF) FedAuth cookies?
It occurred to me that the WIF FedAuth cookies contain identity information, that if tampered with, could permit someone to assume the identity of another user. Fortunately, WIF does ...
9
votes
3answers
503 views
How can TOCTTOU vulnerabilities within the Windows OS be mitigated?
What are some ways to mitigate the time-of-check-to-time-of-use issues that apply to Windows permissions?
Example:
End-user is added to the local Administrators group in order to install software, ...
9
votes
3answers
3k views
Security of passwords remembered by Windows
Does Windows XP or Windows 7 encrypt saved passwords?
I'm assuming that the user uses local password to logon.
The user then uses his own computer to connect to server in work and sets the "remember ...
9
votes
2answers
338 views
A firewall without any extra features
I have Kaspersky Internet Security (KIS) installed on my system. I always keep it disabled, yet using a few practices, I kept my system virus free for years:
I disabled autorun using these tricks;
I ...
8
votes
3answers
874 views
Am I protected from USB autorun malware on Windows 7?
As far as I know, the autorun.inf problem (the possibility of automatically executing code when a USB stick is plugged in) was solved through Windows Updates for XP, and on 7 it is no longer possible ...
8
votes
5answers
2k views
How can I decrypt data with Java, without hard-coding the key?
I hope this is not a chicken-egg problem or reinventing the wheel but here goes.
I have a Java application that needs to access a password protected file (actually during the application startup).
The ...
8
votes
5answers
5k views
How secure is NTFS encryption?
How secure is the data in a encrypted NTFS folder on Windows (XP, 7)?
(The encryption option under file|folder -> properties -> advanced -> encrypt.)
If the user uses a decent password, can this ...
8
votes
4answers
341 views
Unknown malware, how to report it and whom to report it to?
I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
8
votes
2answers
3k views
Checklist on building an Offline Root & Intermediate Certificate Authority (CA)
Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite.
Here is an image of the default cryptography settings ...
8
votes
3answers
354 views
Reading keystrokes of other applications
Is it possible for other application running in the OS to read the keystrokes that my application uses?
What about mouse events and window handles?
Is there any security wall that the OS uses to ...
8
votes
3answers
823 views
How can I mitigate the threat that DPAPick poses to my DPAPI protected data?
The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications).
DPAPick was presented at BlackHat ...
8
votes
4answers
503 views
How to track a laptop after theft?
Our company had a break-in this evening and a laptop was stolen. The data on the laptop was not super-sensitive (luckily); however, we would like to be able to track the laptop if at all possible.
...
8
votes
1answer
288 views
Why do you have to be an admin to create a symlink in Windows?
In linux every user can create symlinks, but in Windows I need an admin command line, or mklink fails. Why is that?
8
votes
1answer
1k views
Detecting reflective DLL injection
In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
7
votes
3answers
415 views
How effective is something like Deep Freeze against boot sector infections?
I work for an embedded system manufacturer and on our older generation systems, which are powered by Windows Embedded, a number of customers have been experiencing virus infections. Due to the real ...
7
votes
1answer
120 views
Why would it be preferable for a system to shut down when the security log is full?
When running in a configuration that supports Common Criteria, Windows must be configured to shut down when the security event log is full. Why is this a preferable option?
7
votes
2answers
291 views
How can I restrict what an application can do with my computer?
Often when I install applications on my computer, I realize that I need to trust the application because it can do what ever it want with my computer, e.g. accessing files, listen to my keyboard, ...
7
votes
2answers
218 views
Can a webcam be turned on when disabled in Windows' device manager?
In addition to whether a webcam can be turned on without the indicator light, I was wondering if disabling the device in Windows' device manager is a good option.
Of course when your system is ...
7
votes
3answers
1k views
How to manage admin rights for helpdesk staff?
My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting.
Helpdesk staff commonly require administrative rights to provide support for end users. I ...
7
votes
2answers
351 views
How can IA-5(1)(b) be enforced on Windows systems?
Note: I've also posted a question for this issue on non-Windows systems.
In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include ...
