Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
0
votes
0answers
13 views

Does the filesystem windows is installed on have an effect on the time zone settings of windows registry timestamps? [migrated]

As far as I know Windows Registry timestamps are stored as UTC timestamps when Windows is installed on an NTFS filesystem. Does this change when Windows is installed on a FAT Filesystem (e.g. FAT32)? ...
0
votes
2answers
99 views

Can I rely on Operating System (OS) Anti Virus (AV) scanning to scan files shares?

I have an EC2 instance with an Windows OS with anti virus installed. I have a requirement to attach a file share to the OS where the application is hosted. The file share is Amazon Fsx ( Amazon's ...
0
votes
0answers
32 views

How to design a script to remove WindowsFormsApplication5.exe malware? [closed]

I have a malware file with me that's been infecting my dad's laptops for over a year now. This malware is known popularly as WindowsFormsApplication5.exe malware and I think he has bad security ...
0
votes
1answer
84 views

How does Windows use the TPM for BitLocker encryption without an attacker being able to do the same?

How does Windows use the TPM for BitLocker encryption without an attacker being able to do the same? From this FAQ, I understand that BitLocker uses the following keys to encrypt the hard-drive: ...
1
vote
1answer
101 views

Do non-administrator Windows accounts need strong passwords?

I have always used long passphrases for my own Windows user accounts. But I know some people who use moderately common passwords (we'll say they're in the top 1,000 most used passwords, but not in the ...
2
votes
0answers
72 views

Computer that can't upgrade beyond Windows 1803 - safe to use until when?

I have an old computer that can't (at least according to Windows Update) upgrade beyond Windows 1803. (Probably due to the manufacturer not releasing updates to drivers.) Until when will it be safe to ...
0
votes
1answer
81 views

Is it safe to share msinfo32? [closed]

Is it safe to share your msinfo32 export with the Internet? Does it contain any sensitive data like PII?
1
vote
2answers
170 views

Can rootkits hide their internet usage from resource-manager and third party software in windows 10? If so, how?

Lets say I have the latest windows 10 version. I also have DU meter for checking my network usage I know that in windows there is a linked list of processes that many rootkits tend to remove ...
2
votes
1answer
73 views

Is it safe to view local pdf files in a browser?

When receiving a pdf file by e-mail, the question is how to open it. Browsers are normally quite secure, don't support all pdf features (an advantage in this case) and the viewer/conversion might ...
1
vote
1answer
77 views

Securing IPC between kernel and user-mode application

We are currently developing a security software for Windows. This application consists of a service running in user mode and a driver in kernel mode. These two need to communicate, so that the service ...
2
votes
1answer
78 views

How long are password hashes stored locally?

Suppose Alice logs into Windows machine M (which is part of an enterprise network managed through Active Directory). My understanding is that M will contact the domain controller to get Alice's ...
1
vote
2answers
64 views

IIS Application - service account permissions

My company is looking to install a 3rd party application on our infrastructure and this application will be installed on an IIS Server with a connection to a SQL server. They require an AD service ...
0
votes
1answer
85 views

Understand the “Windows Key Store”

I work in a enterprise environment and I often hear the use of the "Windows Key Store" to store various keys including symmetric. I do understand there is a "Windows Certificate Store" which as the ...
0
votes
1answer
145 views

Why isn't free software signed with self-signed certificates? [duplicate]

A majority of free software (in particular, Linux ports for Windows) are not signed. As I understand it, it is quite easy to create a self-signed CA, and sign the software. Distribution would be ...
0
votes
1answer
50 views

Local File Inclusion [ Post-Exploitation ] Question

Hello I am just curious what kind sensitive files I can read on a windows server which is vulnerable to LFI compared to Linux? I mean the first file or common files which a pentester or a ...
1
vote
0answers
71 views

Extracting .p12 cert and key without OpenSSL

I've asked a question on SO, but was directed here since it might align better with this SE. The problem I have is that I need to extract the certificate and key in unencrypted PEM format for use in ...
1
vote
1answer
200 views

Is disabling Remote Desktop Services sufficient to protect a Windows device from the BlueKeep vulnerability?

Microsoft (and the NSA) have been urging Windows users and administrators to install patches to protect systems from the BlueKeep (CVE-2019-0708) vulnerability. Is disabling Remote Desktop Services ...
0
votes
0answers
78 views

How to fingerprint Windows 10 reliably?

Recently, I have been practicing penetration testing and I have come to a standstill when trying to fingerprint the OS for a Windows 10 target with nmap. For the most part, I'm not able to identify ...
1
vote
0answers
35 views

Veracrypt Windows Script [duplicate]

I forgot part of my password to Veracrypt and I need a script for Windows that can go through a .txt file with the possible passwords. The script needs to only decrypt using the encryption algorithm ...
0
votes
0answers
34 views

Software build processes - Dependencies without admin privileges

we have the following problem and I would like to hear your opinions for this case: Currently several users are working with domain accounts which are in the local admin group (Yes, shame...) You ...
1
vote
1answer
60 views

Windows Kerberos Pre-Auth Failed (4771)

Is there an easy way to distinguish 4771 events from a real attack perspective vs. someone having a stale session with an old password? If you don't get logs from all endpoints and rely on Domain ...
30
votes
1answer
7k views

Is it possible to change original filename of an exe?

We are using an application control solution which denies access for some exes according to their original filename. Is it possible to change original filename with hex editor or another method?
43
votes
4answers
9k views

Should one buy new hardware after a system compromise?

If there are places on a laptop malicious programs can leave elements, hooks, backdoors etc, in locations such as BIOS, device controllers, firmware etc - what confidence can one have in wiping the ...
2
votes
1answer
120 views

Reliable signs a Windows laptop has been booted for first time [duplicate]

Are there any ways to reliably determine that a Windows laptop has been booted for the first time? I do no trust the system log, and so am hoping there may be certain files or other data (or an ...
1
vote
0answers
17 views

Can the Windows Event Log be edited by a malicious program? [duplicate]

Is it possible that a malware can edit the Windows Event Log to hide System Event Log entries (specifically 6005 and 6006, which indicate startup and shutdown respectively)? If it is not possible, ...
1
vote
1answer
60 views

Executing vs Extracting PE32/PE32+ executable

If you have a malicious upon execution ("running" it / double clicking on it) .exe , would extracting its contents with something like 7-Zip utility mitigate its effects? Or can it still do harm?
0
votes
1answer
42 views

Guidelines to make Windows Server 2008 Common Criteria Installation

I'm new to certification arguments. I have an issue with a requirement that is to make an application in a certified Windows 2008 environment. What are / where can I find a guide to WS2008 CC-...
0
votes
0answers
65 views

Windows Smart Screen pops up after EV Code Signing

I am code signing my application's installer using an EV Code Signing that we have bought recently at work. The code signing is performed when the installer is created using Inno Setup (version 5.6.1)....
0
votes
1answer
95 views

Accidentally “trusted” work PC when I connected my iPhone 6 - can my employers still see my pictures after I unplug it?

I just trusted my work PC (Windows 10). I didn't open my iPhone 6 files. I didn't view any pictures and I unplugged it pretty quick after I accidentally trusted it. I was wondering if my employers ...
1
vote
1answer
49 views

Windows certificate manager imports a SHA256 root CA certificate as SHA1

I generated the root CA test cert using: makecert -a sha256 -n "CN=RootCATest" -r -sv RootCATest.pvk RootCATest.cer I've imported this root CA certificate on another machine (Win Server 2019, ...
-1
votes
2answers
92 views

is it a standard best practice to *display* the last-logged-in user by default on an individual employee laptop?

My new workplace laptop is configured so that after I log off and log on, rather than the last-logged-in user being selected by default, I have to hit ctrl-alt-del and then enter my username and ...
0
votes
2answers
112 views

unauthorized devices appear in windows 10 network drive SMB [closed]

Few days ago I was trying to access a shared folder via SMB on Windows File Explorer and noticed 3 strange mobile phone devices appear listed in the network drive. I never owned any of the mobile ...
-4
votes
1answer
63 views

After have all the Patches, NotPetya can still run? [closed]

NotPetya runs inmediatly after infection or can be there and being executed even do i have all the security patches?
1
vote
1answer
115 views

How are malware able to start on boot on windows without administrator rights? [closed]

I know that a malware could create a new Run registry key to make itself start at boot, but an user could simply remove the registry key and reboot and that would stop the virus, but this is usually ...
0
votes
0answers
39 views

How to find out what program called an API in windows?

Okay, so I am developing a kernel module that does kernel mode hooking to hook APIs and modify some values. But is there anyway I could tell if what program called a specific API? Say a program from ...
0
votes
0answers
35 views

I think I might be infected with some sort of remote access malware/keylogger and victim to hacker attack [duplicate]

I've learned about computers over the years but it hasn't been until recently where I really sat down and tried to learn about malware in-depth (like the registry and embedding in files, etc.). I've ...
0
votes
2answers
63 views

Can 3rd party AVs have accessed to my Windows PC and Android phone even after uninstalling and removing them?

Before we start this, I have paranoia issues (doctor diagnosed, not self-diagnosed) so things might at some points seem like an extremely far reach, but please bear with me. I bought an AV yesterday ...
7
votes
2answers
162 views

What is the safest and most convenient way to transfer data from my computer to “unknown” USB devices?

I recently attended a friends wedding. As a gift to the couple I filmed lots of things and edited the clips into a montage of the big day. Thankfully they loved it and I have had requests from a ...
0
votes
2answers
104 views

Is it possible for specific event logs to have been deleted?

I'm analyzing several hacked machines on our network. On the original hacked machine, I've found event logs indicating a series of successful RDP connections to other machines, but when I go to those ...
0
votes
0answers
90 views

Privilege Escalation using a leaked thread handle without SeAssignPrimaryTokenPrivilege or SeImpersonatePrivilege

I have a leaked thread handle that grants me THREAD_ALL_ACCESS over a thread of a process running as SYSTEM. My process is running unprivileged and has no special privileges. This means I do not have ...
1
vote
0answers
55 views

Can an unprivileged user on Windows DNS poison itself?

Can an unprivileged user on a Windows machine spoof DNS responses the machine it is running on makes? For example, if a privileged command prompt ran nslookup example.com, can an unprivileged process ...
1
vote
0answers
160 views

Buffer overflow return address with null byte, workaround

I'm practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout ...
0
votes
0answers
48 views

Recover deleted Windows volumes

I have been given an HDD image. I believe the image was taken with dd. I have ingested the file using Autopsy and can see there are 4 volumes, like so Volume 1 - Unallocated. I believe NOT securely ...
23
votes
3answers
6k views

How to bypass password on Windows XP account? [closed]

I have an old ThinkPad R40 family laptop running Windows XP lying around and there's an account on it that has a password and it gave me a hint and I put everything I could possibly think in there and ...
-1
votes
1answer
170 views

Kleopatra importing private key

I'm using Kleopatra Version 3.1.4-gpg4win-3.1.5. I try to import private key (my private key is in a separate file, just a plain text) with GUI and I've got it imported without any problems. However, ...
0
votes
0answers
85 views

Named pipe impersonation affected windows versions

I want to know which windows versions are vulnerable to named pipe impersonation attack. And, are the techniques used in that attack for each version the same?
1
vote
0answers
52 views

CMSTP.exe used for Applocker Bypass

A lot of literature suggests that CMSTP can be used for AppLocker bypass by making use of a malicious INF file which can fetch and run a malicious sct file which can in turn run arbitrary code. (https:...
2
votes
0answers
67 views

Methods of exploiting a Windows executable protected by “Control Flow Guard” and “Return Flow Guard”?

I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc. However, I don't see how to exploit an executable ...
0
votes
0answers
63 views

How to spot malwares that hide their disk usage from Resource monitor?

So lets say a malware has hid itself from task manager, so it wont show up in there. lets also say that it also hides its disk usage from resource monitor as well. (based on previously asked ...
1
vote
0answers
65 views

The last logon time of the Administrator user in Windows 7 system is prior to the OS installation date, why?

What may be the reason behind the fact that in a digital forensics report (FSL report) of a computer's hard disk, the last logon time of the Administrator user in Windows 7 system is prior to the OS ...