Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [microsoft]

The tag has no usage guidance.

24
votes
4answers
17k views

Microsoft email servers “require remote control of Android device security features”

Just tried to set up my student email address with the default email client on my Android device. The email servers used by the university are outlook.office365.com (incoming) and smtp.office365.com (...
0
votes
1answer
101 views

In a SQL server, passwords are hashed in chinese. What algorithm it might be using?

While performing the following query, passwords are displayed in Chinese. I'm wondering what hashing algorithm is being used here in order for me to carry out a brute-force attack.
46
votes
8answers
9k views

Replacing Windows 7 security updates with anti-virus?

Microsoft has announced Windows 7 will no longer be receiving updates after January 14, 2020: Here. I hate windows 10's forced updates and telemetry so I have always stuck with Windows 7, but it may ...
0
votes
0answers
21 views

When sharing confidential information, which is more secure share via Outlook vs store on Sharepoint then provide access?

I'm trying to figure out what is good practice and what is more secure for my small team. I wanted to set a standard or governance on how to share confidential information within our team. One person ...
0
votes
0answers
31 views

Block/spam an email that doesn't match a rule

Is there anything we can put in place such to verify that if the sender's name = "John Doe" and the domain is not company.org (or legitimate verified SPF sender), then the message is marked as spam or ...
1
vote
1answer
65 views

Does the file encryption of Microsoft Office guarantee integrity?

I stumbled upon Microsoft Office's feature of file encryption. For storing sensitive data in the cloud, e.g. DropBox, this sounds like a nice feature. Reading that the encryption is AES-128 in CBC ...
0
votes
1answer
27 views

Extensions and Modules and Packages, Oh My! [closed]

How do you know if extensions (e.g., Code, Chrome, Firefox), modules (e.g., PowerShell), or packages (e.g., Python, R) are not malicious? How can you control or monitor that in an environment? Stuff ...
0
votes
1answer
23 views

Restricting cipher suite on MSIE

I'm investigating significant performance problems with MSIE using TLS connections. I am trying to restrict the available algorithms to isolate the problem / see if there is valid workaround. To do ...
2
votes
1answer
144 views

Is there evidence to proof that Windows is spying us ? Are the anti-spy programs works and are they trustable?

Are there any evidences that Windows is spying the users ? Let's focus on Windows 10. I am almost sure it does. The things like telemetry and Cortana... However I never saw a proof like university ...
2
votes
2answers
33k views

Is 'account-security-noreply@accountprotection.microsoft.com' a legitimate sender of security alerts?

I have been getting emails from "account-security-noreply@accountprotection.microsoft.com" (as verified in metadata) about unusual activity. The internet has very conflicting information about if ...
0
votes
0answers
87 views

Mimikatz /rc4 argument for pass-the-ticket?

I'm studying how pass-the-ticket works using Mimikatz, i.e., forged Silver and Golden Kerberos tickets. The command usually takes the form (Golden tickets): kerberos::golden /sid:SID /domain:DOMAIN /...
3
votes
1answer
878 views

Is there an equivalent of Control Flow Guard for Linux?

Introduced by Microsoft in recent versions of Windows and its compilers, Control Flow Guard is a useful defence in depth measure in the mitigation of return-oriented programming exploits. My question ...
1
vote
2answers
1k views

How is my microsoft account compromised?

I have had my Microsoft account ever since Hotmail boomed, and I've had the same super weak six character password up until this year, but it was when one of my google accounts got compromised a few ...
6
votes
1answer
283 views

Curious about Microsoft “Buffer Security Check” implementation

A very quick background to help you answering my questions : Learning IDA Interactive Disassembler, the old free edition (too expensive for a hobbyist) 15 year Linux Sysadmin & DBA experience ...
2
votes
2answers
5k views

Is there a RCE PoC for the CVE-2012-0002/MS12-020?

I've recently looked a bit into the MS vulnerability CVE-2012-0002/MS12-020, released in 2012. In March 2012, Symantec posted a screenshot of a supposedly RCE PoC for the vulnerability, but today I ...
3
votes
1answer
36k views

Is this email from OneDrive a phishing attack?

Today I received an email claiming that my OneDrive account is going to be deleted as it has been unused for the past two years. This is probably true. The email urges me to visit OneDrive to ...
1
vote
1answer
2k views

What is the point of Microsofts 30 day security update waiting period

If you want to update your security info (such as a password). You need to verify your ID with your phone or another email. If you don't have any connected to you account (or forgot them), you can add ...
0
votes
0answers
51 views

Has Microsoft ever official recommended forms auth over Windows Auth

My team is debating using Windows Authentication for a public facing website. I’ve been scouring the forms and can see the numerous security vulnerabilities of replying on NTML, and I can see the ...
2
votes
1answer
258 views

SMBRelay Attack - Mount Share instead of Code Execution

Is it possible to execute an SMBRelay attack that mounts a share instead of execute code? The application I am testing uses a non-administrative user but has access to several SMB shares. Only NTLMv2 ...
1
vote
1answer
319 views

What is Badlock and how does it work?

A while back there was an announcement for the disclosure of a security vulnerability named "Badlock" - including this fancy name and a logo. The disclosure date was today and I was surprised (and ...
1
vote
0answers
81 views

Extracting public key created by an UWP app in KeyCredentialManager

I know of an app that is using https://docs.microsoft.com/en-us/uwp/api/windows.security.credentials.keycredentialmanager to generate a key pair (supposedly stored in a TPM), and sequentially uses the ...
2
votes
1answer
188 views

Office 365 “ForeignRealmIndexLogonInitialAuthUsingADFSFederatedToken”

I've detected a number of illegitimate logins to Office 365 (based on Client IP). In the audit log, the operation is listed as "ForeignRealmIndexLogonInitialAuthUsingADFSFederatedToken." I'm not ...
4
votes
2answers
4k views

Windows 7 consent.exe attempting to access the internet

Looking at Firewall logs, I see that consent.exe, which is responsible for the Windows 7 UAC UI, attempts to connect to the internet. I have verified the file is a genuine executable provided by ...
1
vote
1answer
309 views

Importing a self-signed certificate into Windows via the Microsoft Management Console

First, I apologize if I mix my terminology up a bit in this post, I'm new to SSL. I've created a CA and used it to self-sign an SSL certificate for a server I connect to. Now I need to import the CA'...
5
votes
1answer
875 views

I ran netstat and one thing that came up was MSN bingbot, does that mean my computer is being used as part of a Microsoft botnet?

I ran netstat on my computer, and one thing that came up was msnbot-65-52-108-216. I did some research and what came up was that it's from an IP originating in Redmond, Washington and that it's likely ...
0
votes
1answer
107 views

Did Skype give me a MBR virus? [closed]

So here's the deal, I could never login on my desktop to skype for business. Since I am an microsoft 365 admin, I issued a ticket and waited for someone to call me to help me login. He remotely logged ...
2
votes
1answer
352 views

Has any exploit leveraged a Video Driver flaw in WebGL?

Microsoft delayed support for WebGL due to the fact Javascript could exploit driver weaknesses. In the years that have past, in WebGL's adoption, are there any exploits of WebGL that supports their ...
20
votes
5answers
9k views

KeePass Vs OneNote

In my personal life, I use KeePassX to generate/store all my passwords. I have seen some people use a password protected OneNote section. Does the password protected OneNote section provide a ...
0
votes
2answers
90 views

How does “Microsoft domain authentication” prevent me from using passwort variants?

I have read Sequential password updates and I am aware of a number of techniques to prevent users from using password variants. My question is, which of these techniques are actually used in user ...
2
votes
2answers
910 views

Windows Privilege Escalation system shell dies quickly

I have a user restricted shell and I used a host upnpn exploit which gives me root access to nc.exe. I am able to get a shell as SYSTEM but it dies after 30 seconds due to the service being ...
4
votes
1answer
870 views

Anniversary Update with Bitlocker Reboot without Encryption Key

I have Windows 10 Professional installed and have avoided the Anniversary Update until yesterday. The computer installed the update despite my best efforts to stop it. But that is a different ...
1
vote
0answers
110 views

Is Windows certificate store FIPS 140-2 level 1 certified?

I'm not really aware of FIPS 140-2 requirements, but AFAIK some MS cryptographic libraries are FIPS 140-2 level 1 certified, so here it goes my question: If I do have the following requirement: ...
0
votes
3answers
312 views

Should we use Microsoft security or defender for securing our WAN network [closed]

I would like to understand much about Microsoft Security Essentials or another antivirus which build in or developed by Microsoft. I'm planning to set up the network for my company and use Microsoft ...
0
votes
1answer
231 views

(Why) does an encrypted MS Office 2010 Spreadsheet (need to) have the password hash “written down”?

To my naive mind, it seems like the encryption of a document with AES should go like this: HumanPassword ---|hash|--> key ---|AES|--> Ciphertext plaintext|--^ And the ...
1
vote
0answers
494 views

Microsoft CryptoAPI FIPS 140-2

My customer asks me to use FIPS 140-2 validated cryptographic libraries. Currently I have AES 256 encryption using Microsoft CryptoAPI in my application. First I get the provider (HCRYPTPROV) using ...
-10
votes
2answers
378 views

WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now? [closed]

WannaCrypt-like SMB spreading technique was widely used in Stuxnet, as docummented by Symantec and Kaspersky. Read this: W32.Stuxnet Dossier (2010,Symantec PDF) Now we have the name of the exploit: ...
2
votes
0answers
2k views

MS Updates for MS17-010

Anybody know what the KB numbers are for Windows 10 1607 64 bit and 64 bit for 1511? I am assuming these are them, can someone please verify this for me? Also, for the Windows 1607 there is a ...
0
votes
3answers
1k views

Is there any reason for disabling telnet client on windows?

Since Windows 7 release the telnet client is disabled by default on windows,any security reason for that? is enabling telnet client on windows will make it vulnerable for any type of threat?
4
votes
1answer
23k views

Microsoft account comprimised and someone did automatic sync and wondering if emails downloaded?

I have a Microsoft account and today I got a Security alert saying "We think that someone else might have accessed your account" and had to change my password. When I checked my account activity it ...
1
vote
2answers
2k views

Restrict Microsoft Network Policy Server (NPS) to only trust client certificates from a given CA?

I'm working on an install of a Microsoft Network Policy Sever (NPS) / RADIUS server for controlling access to corporate Wi-Fi using 802.1x / WPA2-Enterprise - using client certificates for ...
1
vote
2answers
643 views

“Unusual activity” on multiple Microsoft accounts

As MSDN subscribers all members of our development team need to have a Microsoft account. Since September 2016 these Microsoft accounts get disabled, temporarily or permanently, with no explanation ...
0
votes
1answer
253 views

Microsoft IP Blocked by my fail2ban

Yesterday at 3AM our Fail2ban blocked an IP, not tremendously uncommon, however it appears to relate back to a Microsoft address. This could perhaps be an Azure server being used for the abuse. My ...
1
vote
1answer
109 views

Is it safe to open word document sent in email in LibreOffice

It's not safe to open doc emails attachements in Microsoft Office, because of evil macros. Is it safe to open same file in Libre office or does it also execute macros?
0
votes
1answer
494 views

Is the MSWord password protection vulnerable?

When encrypting MSWord documents within the Word 2016 app (most recent file format .docx) what encryption algorithm is used? Have any vulnerabilities been found thus far? Has it been audited? Edit: ...
3
votes
3answers
332 views

Does MS16-087 imply Windows 7 computer vulnerable from Internet?

I just read the MS16-087 security bulletin and the articles by Vectra (who apparently discovered the vulnerability). As I understand it, MS Point and Print offered a delivery of print drivers from a ...
1
vote
0answers
495 views

Microsoft is spying me. What can I do?

I was getting into my Windows 10 configuration and I saw a lot of options which are sending data to Microsoft. Telemetries, tracking, statistics... even sharing Windows updates on my PC to other users!...
1
vote
0answers
624 views

Key usage not applied using Microsoft CA

I'm a bit of a newbie to Certificate signing, so please forgive any stupid questions I might have. I have a CSR, when I decode the CSR it cleary request the following key usages: Requested ...
2
votes
0answers
3k views

How to exploit a file upload to an IIS 5.1 [closed]

I found the following services in a testing environment: 21/tcp open ftp Microsoft ftpd 80/tcp open http Microsoft IIS httpd 5.1 The FTP server allows anonymous logins and ...
1
vote
0answers
343 views

Microsoft IIS 7.5 from Time Based SQLi DBA to shell

I am dealing with a time-based SQLi in a Microsoft IIS 7.5 Server and I want to upload a shell. My approach is to get the internal application path, and then, try to upload a file with sqlmap --file-...
4
votes
2answers
281 views

This is a working SQL-injection. What could the server side query string look like?

This question is about a small detail in a larger school assignment. I have been struggling with this little problem for too long. ABCTF arranged a Capture-the-Flag competition which was held earlier ...