Questions tagged [microsoft]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
52 votes
10 answers
20k views

Replacing Windows 7 security updates with anti-virus?

Microsoft has announced Windows 7 will no longer be receiving updates after January 14, 2020: Here. I hate windows 10's forced updates and telemetry so I have always stuck with Windows 7, but it may ...
TritiumCat's user avatar
42 votes
4 answers
51k views

Microsoft email servers "require remote control of Android device security features"

Just tried to set up my student email address with the default email client on my Android device. The email servers used by the university are outlook.office365.com (incoming) and smtp.office365.com (...
voices's user avatar
  • 1,779
27 votes
2 answers
11k views

What's the point of Microsoft Account 2FA if it still lets me log in using password instead?

I have a Microsoft Account linked to a Microsoft Authenticator app for 2FA purposes. Every time I log in, it first sends me the Authenticator request, but I can always click "Other ways to sign ...
ᴍᴇʜᴏᴠ's user avatar
20 votes
5 answers
12k views

KeePass Vs OneNote

In my personal life, I use KeePassX to generate/store all my passwords. I have seen some people use a password protected OneNote section. Does the password protected OneNote section provide a ...
pat's user avatar
  • 211
8 votes
1 answer
345 views

Is this Windows local code execution bug also a security vulnerability?

I stumbled on a Windows bug leading to code execution. I believe it should be categorized as a vulnerability but Microsoft does not recognize it as such. I would like to read other opinions. ...
Enos D'Andrea's user avatar
7 votes
2 answers
8k views

After changing Microsoft password, one can still login to previously authenticated Windows devices with old password indefinitely. Why?

Has anyone else noticed that if you are using a Microsoft account for Windows, after changing your password, the old password can still be used indefinitely on previously authenticated devices? I have ...
dyasta's user avatar
  • 193
6 votes
2 answers
3k views

Windows Privilege Escalation system shell dies quickly

I have a user restricted shell and I used a host upnpn exploit which gives me root access to nc.exe. I am able to get a shell as SYSTEM but it dies after 30 seconds due to the service being ...
Anderson's user avatar
  • 495
6 votes
1 answer
922 views

Curious about Microsoft "Buffer Security Check" implementation

A very quick background to help you answering my questions : Learning IDA Interactive Disassembler, the old free edition (too expensive for a hobbyist) 15 year Linux Sysadmin & DBA experience ...
ker2x's user avatar
  • 163
6 votes
2 answers
2k views

Can Google Docs be used to “sanitize” a Word or Excel document?

Sometimes I have to download some Word or Excel documents from uncredible sites. I need not only to read but also to edit them. I heard that the Microsoft Office suite is a very popular attack vector. ...
user avatar
5 votes
3 answers
7k views

Restrict Microsoft Network Policy Server (NPS) to only trust client certificates from a given CA?

I'm working on an install of a Microsoft Network Policy Sever (NPS) / RADIUS server for controlling access to corporate Wi-Fi using 802.1x / WPA2-Enterprise - using client certificates for ...
ziesemer's user avatar
  • 191
5 votes
1 answer
49k views

Is this email from OneDrive a phishing attack?

Today I received an email claiming that my OneDrive account is going to be deleted as it has been unused for the past two years. This is probably true. The email urges me to visit OneDrive to ...
Kelly Bang's user avatar
5 votes
2 answers
3k views

Is there an equivalent of Control Flow Guard for Linux?

Introduced by Microsoft in recent versions of Windows and its compilers, Control Flow Guard is a useful defence in depth measure in the mitigation of return-oriented programming exploits. My question ...
James Jameson's user avatar
5 votes
2 answers
11k views

Is there a RCE PoC for the CVE-2012-0002/MS12-020?

I've recently looked a bit into the MS vulnerability CVE-2012-0002/MS12-020, released in 2012. In March 2012, Symantec posted a screenshot of a supposedly RCE PoC for the vulnerability, but today I ...
SaAtomic's user avatar
  • 1,019
5 votes
1 answer
2k views

I ran netstat and one thing that came up was MSN bingbot, does that mean my computer is being used as part of a Microsoft botnet?

I ran netstat on my computer, and one thing that came up was msnbot-65-52-108-216. I did some research and what came up was that it's from an IP originating in Redmond, Washington and that it's likely ...
Mr. Chameleon's user avatar
5 votes
0 answers
365 views

Where can I find a list of all government agencies with CAs in PKI root stores?

Is there a source that monitors popular root stores for CAs controlled by government agencies? There are several "root stores" that maintain a list of trusted root CAs. These root stores are ...
Michael Altfield's user avatar
4 votes
3 answers
5k views

Is Bitlocker trustworthy?

My question isn't about whether or not the encryption on Bitlocker works, but whether or not there has been any security audits about potential backdoors Microsoft may have installed. I don't have a ...
J Rozlyn's user avatar
4 votes
2 answers
8k views

Windows 7 consent.exe attempting to access the internet

Looking at Firewall logs, I see that consent.exe, which is responsible for the Windows 7 UAC UI, attempts to connect to the internet. I have verified the file is a genuine executable provided by ...
End Anti-Semitic Hate's user avatar
4 votes
2 answers
475 views

This is a working SQL-injection. What could the server side query string look like?

This question is about a small detail in a larger school assignment. I have been struggling with this little problem for too long. ABCTF arranged a Capture-the-Flag competition which was held earlier ...
Magnus's user avatar
  • 377
4 votes
2 answers
270k views

Is '[email protected]' a legitimate sender of security alerts?

I have been getting emails from "[email protected]" (as verified in metadata) about unusual activity. The internet has very conflicting information about if ...
WakeDemons3's user avatar
4 votes
1 answer
1k views

Anniversary Update with Bitlocker Reboot without Encryption Key

I have Windows 10 Professional installed and have avoided the Anniversary Update until yesterday. The computer installed the update despite my best efforts to stop it. But that is a different ...
krwendland's user avatar
4 votes
1 answer
160 views

Is it possible to see the previous contents in a word file?

I have a word document where I have turned off the tracking history so technically no one could track my previous changes. What if I send the word document via email? Could someone possibly use a ...
Lisa's user avatar
  • 41
4 votes
1 answer
534 views

Why did Microsoft publish the CPassword AES key ca. 2012?

As outlined in Security Bulletin MS14-025, Microsoft acknowledges the way credentials had been stored in the group policy field "CPassword" is insecure and is not to be trusted any more. ...
Al Longley's user avatar
4 votes
1 answer
45k views

Microsoft account comprimised and someone did automatic sync and wondering if emails downloaded?

I have a Microsoft account and today I got a Security alert saying "We think that someone else might have accessed your account" and had to change my password. When I checked my account activity it ...
skinhat's user avatar
  • 43
3 votes
2 answers
8k views

How difficult is it to brute-force Windows EFS encryption?

With EFS I have C:\$USER\ encrypted so all files owned and used by said user are encrypted. If this laptop is stolen, am I correct that they could pull the microsoft user password hashes, crack them,...
Jason's user avatar
  • 3,106
3 votes
1 answer
16k views

What is the point of Microsofts 30 day security update waiting period

If you want to update your security info (such as a password). You need to verify your ID with your phone or another email. If you don't have any connected to you account (or forgot them), you can add ...
SirDuckduck's user avatar
3 votes
1 answer
550 views

Does Kali installed through WSL respect my privacy?

When installing Kali from Microsoft Store, I wasn't prompted with a user agreement license. Is Microsoft able to monitor my applications? How safe is it to use WSL in that context? (From privacy ...
Mobutu Sese Seko Kuku Ngbendu's user avatar
3 votes
1 answer
489 views

SMBRelay Attack - Mount Share instead of Code Execution

Is it possible to execute an SMBRelay attack that mounts a share instead of execute code? The application I am testing uses a non-administrative user but has access to several SMB shares. Only NTLMv2 ...
m3ta's user avatar
  • 274
3 votes
1 answer
738 views

Has any exploit leveraged a Video Driver flaw in WebGL?

Microsoft delayed support for WebGL due to the fact Javascript could exploit driver weaknesses. In the years that have past, in WebGL's adoption, are there any exploits of WebGL that supports their ...
makerofthings7's user avatar
3 votes
3 answers
423 views

Does MS16-087 imply Windows 7 computer vulnerable from Internet?

I just read the MS16-087 security bulletin and the articles by Vectra (who apparently discovered the vulnerability). As I understand it, MS Point and Print offered a delivery of print drivers from a ...
Dalton Bentley's user avatar
3 votes
1 answer
1k views

Security risks in using ‘no @thankyou.com’ to bypass Microsoft account login when installing Windows 11

One of the recommended methods for bypassing Microsoft account login during the Windows 11 OOBE is to attempt to log in using a locked account (no @thankyou.com being the most commonly recommended ...
Brybeck's user avatar
  • 131
3 votes
0 answers
121 views

Good book detailing the security aspects of Microsoft Active Directory [closed]

I am attending training later this summer related to AD pentesting. As such, I wanted to ask for book recommendations which detail (in full or in part) the security aspects of Active Directory. The ...
JohnyD's user avatar
  • 169
3 votes
0 answers
152 views

What personal information, if any, can be gleaned from a Microsoft APPCRASH problem signature?

I am trying to debug an "APPCRASH" problem event for a program running on Microsoft Windows 7. When this happens a problem signature is presented, like this example from SuperUser: Problem Event ...
Lee's user avatar
  • 131
2 votes
2 answers
185 views

What are the security risks of using downloadable email vs. remote/online email?

The organization at which I work wants us to download our e-mails rather than use a remote/online service like gmail. I have argued that this is less secure because downloading the e-mails brings the ...
honeste_vivere's user avatar
2 votes
2 answers
6k views

Microsoft Defender flagged Surfshark.exe as "Misleading:Win32/Lodi"

Can this be safely ignored? VirusTotal shows that Microsoft is the only security vendor that flagged this file as malicious. I did not modify my Surfshark installation in any way, except for an update ...
Marco Bischoff's user avatar
2 votes
1 answer
30k views

Microsoft DS vulnerability?

I heard that Microsoft DS is a port that is commonly used by hackers to hack computers due to its ability to transfer files. How do they transfer files with Microsoft DS? Do they need an exploit to ...
mohamed elgamal's user avatar
2 votes
1 answer
820 views

Is It OK If a Server Does Not Verify a Certificate?

I am currently learning a LOT about Azure, Azure Active Directory, and Azure Key Vault (AKV). To start with, please see this article: In particular, I am interested in this statement: When ...
Mike-E's user avatar
  • 185
2 votes
2 answers
288 views

What is the point of the sign-in timeout of Microsoft services?

The sign-in process of Microsoft services has a timeout whereby if you wait too long to input a password, the sign-in dialog expires and you need to refresh the dialog. For example, this is what ...
Kal's user avatar
  • 287
2 votes
1 answer
931 views

Is there evidence to proof that Windows is spying us ? Are the anti-spy programs works and are they trustable?

Are there any evidences that Windows is spying the users ? Let's focus on Windows 10. I am almost sure it does. The things like telemetry and Cortana... However I never saw a proof like university ...
GuessMe's user avatar
  • 81
2 votes
1 answer
677 views

Importing a self-signed certificate into Windows via the Microsoft Management Console

First, I apologize if I mix my terminology up a bit in this post, I'm new to SSL. I've created a CA and used it to self-sign an SSL certificate for a server I connect to. Now I need to import the CA'...
Adam's user avatar
  • 123
2 votes
1 answer
263 views

Office 365 "ForeignRealmIndexLogonInitialAuthUsingADFSFederatedToken"

I've detected a number of illegitimate logins to Office 365 (based on Client IP). In the audit log, the operation is listed as "ForeignRealmIndexLogonInitialAuthUsingADFSFederatedToken." I'm not ...
Henry's user avatar
  • 21
2 votes
1 answer
462 views

How does microsoftonline.com know which device I am on, and whether it is a registered device?

Most of the webprogramming and IT security I know is from ten years ago. I'm far from being a pro, so please keep my ignorance in mind when answering. Back then, browsers sometimes sent details about ...
Mads Skjern's user avatar
2 votes
1 answer
221 views

How to contact Microsoft regarding security flaw? [closed]

Here I see: If you believe you have found a security vulnerability that meets Microsoft's definition of a security vulnerability, please submit the report to MSRC at https://msrc.microsoft.com/create-...
stevec's user avatar
  • 1,270
2 votes
1 answer
185 views

How to tell if Microsoft office has been patched for a vulnerability?

The NIST database holds records for Microsoft Office vulnerabilities, however it only lists the application (i.e. Word 2016) and the service pack. Microsoft release hotfixes outside of service packs, ...
Neil P's user avatar
  • 181
2 votes
1 answer
2k views

What does Microsoft mean by "Trusted Domain" in relation to Kerberos?

In the Microsoft documentation about using Kerberos, it is stated that: Both the server and the client computers must be members of the same Windows domain or members of trusted domains. If this ...
Meadowlark Bradsher's user avatar
2 votes
1 answer
866 views

Microsoft and SHA-1 deprecating on Windows 7

Microsoft states: Effective January 1, 2016, Windows (version 7 and higher) and Windows Server will no longer trust any code that is signed with a SHA-1 code signing certificate and that ...
bayo's user avatar
  • 687
2 votes
0 answers
204 views

Bitlocker on Windows 11 local account

I've recently upgraded my computer security by encrypting all the drives on in with BitLocker (I'm using Windows 11 Pro). Unfortunately, I ran into a rather fastidious bug that prevents me from ...
Alicent's user avatar
  • 21
2 votes
0 answers
118 views

What does a Microsoft Safelink contain?

Regarding the URL query arguments of a Safelink: Why do they contain my e-mail address (the recipient)? What are these two longish strings? Look like IDs of a database. Does Microsoft store Safelinks ...
rexkogitans's user avatar
2 votes
0 answers
460 views

Why does MS Teams establishing outbound connection towards malicious IP? [closed]

I'm wondering how come an internal "Teams.exe" can make outbound connections to a malicious IP, 132.147.119[.]217 (ISP: ViewQwest Pte Ltd) that was flagged as malicious and also was involved ...
joeBoy69's user avatar
2 votes
0 answers
302 views

Extracting public key created by an UWP app in KeyCredentialManager

I know of an app that is using https://docs.microsoft.com/en-us/uwp/api/windows.security.credentials.keycredentialmanager to generate a key pair (supposedly stored in a TPM), and sequentially uses the ...
Chris Berland's user avatar
2 votes
0 answers
2k views

MS Updates for MS17-010

Anybody know what the KB numbers are for Windows 10 1607 64 bit and 64 bit for 1511? I am assuming these are them, can someone please verify this for me? Also, for the Windows 1607 there is a ...
Bob's user avatar
  • 21