Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

Is CVE-2024-20666 Bitlocker vulnerability mitigated by disabling Windows RE or removing the recovery parition?

Taking Microsoft's page on CVE-2024-20666 at face value, that Bitlocker vulnerability is darn serious in an "evil maid" attack: A successful attacker could bypass the BitLocker Device ...
fgrieu's user avatar
  • 1,211
0 votes
0 answers
34 views

How to prevent absolute path traversal in EasyPHP Webserver 14.1

In the EasyPHP Webserver 14.1 software, there is an Absolute Path Traversal vulnerability in the dashboard index.php page. https://www.exploit-db.com/exploits/51430 I reviewed the source code and ...
luminare's user avatar
  • 101
0 votes
0 answers
53 views

Very frequent calls to same Windows API function by malware

Here I have a malware sample that calls RegQueryValueEx quite frequently, without any time interruption. And as we can see, the result is quite often "BUFFER OVERFLOW". In another topic I ...
Questions123's user avatar
1 vote
1 answer
38 views

Can NTLM pass-through authentication be done without NetLogon?

In any "recent" documentation regarding NTLM (Microsoft) I see it stated that the mechanism of pass-through authentication is done over a NetLogon channel, which should be secure. This ...
superstav's user avatar
0 votes
1 answer
39 views

SACL for shadow copies

I'm researching the topic of detecting registry dump from disk shadow copies and realize that I don't see any specific events in the Windows and Sysmon logs. I tried a simple copy with the command: ...
ganbg's user avatar
  • 11
0 votes
0 answers
7 views

Trojan:Win32/Wacatac.B!ml found in C:\$Extend\$Deleted\0099000000001E1607EF0CDC [migrated]

I am really worried right now. I got the following message from Defender (Windows 11): What I tried so far: Actions to remove or even quarantine don't work. Defender offline scan and Malwarebytes ...
vonjd's user avatar
  • 101
0 votes
1 answer
53 views

Is the Bitlocker encryption key used on HD same for USB?

With Bitlocker, is there only one "master key" that is used to encrypt/decrypt for both HD and USB data? I saw this article today which talks about sniffing the encryption key to get access ...
nanonerd's user avatar
  • 197
0 votes
0 answers
8 views

Active Directory Account Operator Modifying Groups Which Inherit Privileged Groups [migrated]

In active directory, if an account I have access to has Account Operators group, by default, is possible to add myself to a group which is inherits Domain Admins group? For instance, I have a group ...
sunflower's user avatar
0 votes
0 answers
15 views

In Win10/Win11, how to block mobile phone cards with mobile data (SIM cards)? [migrated]

How do I block mobile phone cards or mobile data (SIM cards), on Windows? I know that I can take out the hardware that reads the SIM cards, the LTE card. Block the device, the LTE, in the Device ...
Diogo C's user avatar
0 votes
0 answers
44 views

What is Virtual Secure Mode trying to achieve?

I recently learned about the feature in Windows 10 called Windows Secure Mode (https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/vsm). I'm trying to understand what exactly it ...
user2334659's user avatar
0 votes
0 answers
43 views

How to embed a PE file to another PE files

So what I want to do basically is what BDFproxy does on the go, I want to modify a file (on the disk) to embed another PE in it and have both working, it does not matter if they work concurrently or ...
LuckyCoder3607's user avatar
0 votes
0 answers
64 views

Is using OpenSSH Authentication Agent on Windows 11 a secure practice?

I use a passphrase on my SSH key used for git. I wanted to be able to use the same git for a few scripts I run to clone/pull a bunch of my repos. I discovered that I don't have to repeatedly enter my ...
Scorb's user avatar
  • 111
0 votes
0 answers
35 views

domain (active directory) machines accessible via web

I recently stumbled across customer machines (windows server) that were part of the customers active directory domain and also had IIS applications accessible for the www. I only have the vague ...
rominator007's user avatar
0 votes
1 answer
88 views

ScyllaHide DLL Injection

When I try to perform a DLL injection with ScyllaHide in x32/x64 dbg, then it crashes for some reason, is this a bug? Both with stealthy injection as with normal injection, the program crashes when I ...
Moooz's user avatar
  • 35
0 votes
1 answer
99 views

How to protect a local app that acts as a webserver from exploits?

For me building interfaces through HTML / JS frameworks is by far easier then any other framework I have tried in the past. It's also not that strange, as by far the most UIs are based on the web ...
Dirk Boer's user avatar
  • 117
1 vote
0 answers
83 views

Suspicious new folders with chaotic jpg,sql,doc,txt and doc files

I found several new folders, each containing 10 small files with random content ( a chaotic picture, an rtf of random letters, a corrupted doc file etc...), all the files were created at the same time,...
OMGsh's user avatar
  • 111
0 votes
2 answers
86 views

Isolating encrypted and unecnrypted Windows installations and protecting the boot loader

I want to use my PC both for gaming and for stuff like keeping cryptocurrency wallets, online banking, etc. I need to install games as admin but of course I don't want them to be able to access my ...
Vlad's user avatar
  • 101
0 votes
1 answer
178 views

How to determine which Chrome extension is re-directing me to ad sites

Twice now, seemingly randomly, I've been redirected to an ad site. I believe it has occurred both times when I have a new tab open, type what I'm searching for (Google is my default search engine), ...
johnfernow's user avatar
0 votes
1 answer
230 views

Which Intel CPUs do not have Management Engine (ME) [duplicate]

The Intel Management Engine (ME) is a security risk which I would prefer not to take. I do not trust it, it seems to be a backdoor, and there are reported vulnerabilities on it. I do not trust the ...
user5623335's user avatar
1 vote
1 answer
105 views

Security vulnerabilites in Windows updates from local network

Windows has offered the ability to download updates from machines in the local network for some time. My gut feeling tells me this would be a great attack vector for Windows security vulnerabilites. ...
J Heschl's user avatar
  • 123
2 votes
0 answers
60 views

Secure API token handling in Windows app: the token is needed to authenticate the requests to a backend server

I'm currently working on a UWP app that involves validating redemption codes against a Cloudflare KV storage backend. That's all the backend server is for. I want the app to check the redemption code ...
Neox's user avatar
  • 21
1 vote
0 answers
36 views

SPNEGO-based Kerberos authentication: Should I create a new security context using `gss_init_sec_context` for every request?

I'm implementing SPNEGO-based Kerberos authentication for a Linux client application for authenticating requests to a Windows IIS server. I've read RFC4559, which describes how authentication should ...
Shuzheng's user avatar
  • 1,227
2 votes
0 answers
149 views

Bitlocker on Windows 11 local account

I've recently upgraded my computer security by encrypting all the drives on in with BitLocker (I'm using Windows 11 Pro). Unfortunately, I ran into a rather fastidious bug that prevents me from ...
Alicent's user avatar
  • 21
1 vote
0 answers
72 views

Local development credential manager and best practices

I've long since been storing credentials to databases and services in local configuration files during development. Sometimes these need to be to production systems, which makes this a security issue. ...
John's user avatar
  • 149
2 votes
1 answer
106 views

Do Windows Credential Manager encrypt information stored in it?

Apologize if this is a newbie question. Say the PC hard drive with Windows installed is un-encrypted (no BitLocker, etc); and someone gets physical access to the hard drive but does not know the (...
aaa acb's user avatar
  • 121
0 votes
0 answers
72 views

Can I setup and enforce additional WiFi connection (and password) requirements on managed laptops using Windows or MacOS?

Can I setup and enforce additional WiFi connection (and password) requirements on managed laptops using Windows or MacOS? Such as: blocking (or entirely hiding) the option to connect to open networks ...
Bob Ortiz's user avatar
  • 6,635
0 votes
0 answers
69 views

ZeroLogon possible false positive events 5827? (CVE-2020-1472)

ZeroLogon checklist: August 11, 2020 updates have been deployed on all domain controllers. February 9, 2021 updates have been deployed on all domain controllers. All devices are running Windows 10. ...
Amedee Van Gasse's user avatar
1 vote
1 answer
101 views

How to tell if BlackByte NT ransomware is on my computer?

The company I work at sadly fell victim to BlackByte NT ransomware this week. It ransomed many of the Windows machines on our factory floor. I have used my personal laptop (Windows 10 Home, version ...
Intrastellar Explorer's user avatar
0 votes
0 answers
115 views

I need help properly encrypting my computer SSD

My main laptop recently broke down and i've been forced to use an older laptop I had in storage. This machine was encrypted years ago with veracrypt and only has an SSD. It's around 250 GB of storage. ...
Elizabeth Vogue's user avatar
2 votes
1 answer
1k views

Security risks in using ‘no @thankyou.com’ to bypass Microsoft account login when installing Windows 11

One of the recommended methods for bypassing Microsoft account login during the Windows 11 OOBE is to attempt to log in using a locked account (no @thankyou.com being the most commonly recommended ...
Brybeck's user avatar
  • 121
0 votes
1 answer
99 views

How to mitigate spoofing, keylogging password, stealing public key with smart card with external/internal smart card reader?

Here is my thought process: I want to use smartcards without passwords for my setup. We don't want to use Iris or fingerprint or voice. I only want to put in the card whenever something needs to ...
user300431's user avatar
0 votes
0 answers
49 views

How do I check if my PowerShell is connected on SSH?

I know how to check but command line cmd or powershell can be altered to make it look clean with disguised hash codes (which they show like they are not tempered but actually commands are altered and ...
kurosakichigoo's user avatar
0 votes
0 answers
55 views

Can already opened event logs of PowerShell's event properties screens on Windows be hacked by hackers in milliseconds?

I am wondering some issues about event log safety of powershell. I think is it possible to alter the powershell itself. But theorically the event log should show us every attempt made in powershell ...
kurosakichigoo's user avatar
0 votes
0 answers
73 views

W-Firewall blocks Port 135 if using IPsec Kerberos V5 User Authentication

i am about to implement IPsec to achive a zero trust environment, in order to do so i am using the Windows Firewall with IPsec Rules (Allow the Connection if it is secure). Everything works fine, but ...
Proxolin's user avatar
1 vote
0 answers
75 views

Windows decrypting TC volume without passphrase?

I remember having read a blog post or a forum post, some years ago, about a TrueCrypt user whose Windows machine sometimes, at boot, did not ask for the TC passphrase and decrypted automatically the ...
dr_'s user avatar
  • 5,178
0 votes
1 answer
263 views

Methods to bypass Windows security policy: All Removable Storage Classes - Deny All Access

My partner recently got given work laptop and if you try and put in a USB mass storage device you get an error saying it is not allowed. Without having administrator access I assume this is via the ...
user2334659's user avatar
1 vote
0 answers
87 views

Is having no driver installed better than having old driver?

How safe are installed & genuine-vendor signed old drivers, specifically when attackers are spoofing Microsoft and other vendor certificates? On older PCs and laptops where some components are no ...
Shubham Deshmukh's user avatar
0 votes
2 answers
531 views

Implications of enabling Developer Mode in Windows 11

Windows 11 appears to have a Developer Mode. I was playing around with Flutter and got prompted to enable it. The setting looks like this: When I enable it, I get the following confirmation prompt: ...
Pieter's user avatar
  • 1,329
1 vote
2 answers
166 views

Does a database with pre-calculated SHA256 values exist for Windows EXEs?

Background: At my place of work, we're trying to block all unapproved browsers on all Windows machines and the IT Security guys did a search on our internal infrastructure and came up with a list of ...
Fabby's user avatar
  • 123
0 votes
1 answer
134 views

Windows 98 hacked just by visiting a website? [duplicate]

I am wondering how this was possible. I remember my cousin used to use the family computer and it was infected with viruses just by browsing the internet. I recall a bunch of our desktop icons turned ...
Zaku's user avatar
  • 101
0 votes
0 answers
95 views

Using rainbow tables to obtain the first 7 characters of a windows password(LM/NTLMv1)

I am trying to understand how an attacker is able to use the halflm challenge rainbow table to obtain the first 7 characters of a windows password that was used to authenticate a user using LM/NTLMv1. ...
Teererai Marange's user avatar
1 vote
1 answer
128 views

What information is contained in the local SAM in an Active Directory network

I'm curious in an enterprise network running Windows, what information is available in the SAM of a standard user's endpoint machine? I understand (and correct me if I'm wrong) that when logging in to ...
user2334659's user avatar
1 vote
1 answer
198 views

Is it worth it to force UAC to ask for a password?

I've tried to harden my Windows 10 by using an unprivileged account, which I know reduces the attack surface a lot. I'm running Ableton (a music program) which is running after UAC has given admin ...
JulianGR's user avatar
0 votes
0 answers
71 views

Is hashdeep deprecated?

The other day corporate or the vendor used their cloud deployment tool to replace some of our DLLs, and it got me wondering; does anyone still use hashdeep when they initially roll out a server or ...
leeand00's user avatar
  • 1,431
1 vote
0 answers
133 views

Cannot `qwinsta` during WinRM, but it works when run under `NewCredentials` logon type

When I try to WinRM into a Windows host (with a tool like evil-winrm) into the and when I do qwinsta, it says "No sessions exists for *", however, when I do RunasCs.exe x x "qwinsta&...
kizzx2's user avatar
  • 111
0 votes
1 answer
108 views

Port scanning but Windows firewall isn't logging the connection

We are seeing port scans coming from many of our company devices and scanning our internal network over the VPN. The events are not reproducible and are not regular. Scans always follow the same ...
H3GE's user avatar
  • 1
0 votes
1 answer
141 views

Which is more secure to access a VMware Windows VM : VMware Remote console or RDP+Remote Desktop Gateway

Without knowing more details, I can't suggest to our security guy that we should use RDP along with a Remote Desktop Gateway. One person says to that VMware Remote Console is more secure than using ...
SebMa's user avatar
  • 101
0 votes
1 answer
111 views

Is DPAPI usable when only being able to read the file directory?

DPAPI: Windows Data Protection API Say I would be able to read a Windows system file system, including all files. Say there would be a DPAPI encrypted value somewhere in this system that I want to ...
thepancakeplant's user avatar
1 vote
0 answers
79 views

How to detect/trace if a Windows Live/PE used on a system?

Is it possible to detect/trace if a Windows Live/PE is used on a system? Like with logs or dumps etc.
Pishtazan NowAndish Hadi's user avatar
0 votes
0 answers
120 views

What does an exported BitLocker key package contain?

I've learned that a key protector encrypts the VMK (volume master key), then the VMK encrypts the FVEK (full volume encryption key), and finally the FVEK encrypts the actual data blocks. I've also ...
Chris Chen's user avatar

1
2 3 4 5
45