Skip to main content

Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
4 votes
2 answers
190 views

How safe are my app's keys inside the TPM against other apps trying to impersonate mine?

This is a follow-up of these two questions about using the TPM to store application's keys. While both have great answers, there is a specific aspect I am missing: How safe are the keys inside the TPM ...
mist's user avatar
  • 111
6 votes
2 answers
144 views

Use of TPM to encrypt data of my application in practice

I am not very familiar with TPMs, but from what I can tell their main benefit for the user is to make the system as a whole more secure, if you take the appropriate measures, e.g. by checking the boot ...
mist's user avatar
  • 111
1 vote
0 answers
16 views

Windows 10 - Block File Transfer [migrated]

I would like to disable file transfer via Bluetooth while allowing other Bluetooth services to function normally such as mouse, keyboard, audio, etc. The devices are not on a domain and are not ...
Andam's user avatar
  • 111
1 vote
1 answer
81 views

How can Bitlocker do this?

Im about to upgrade my CPU that has TPM in it. Bitlocker is TPM+PIN+Keyfile. Now, naturally when upgrading CPU I will suspend Bitlocker, shutdown, change CPU and reboot. OK, I can understand that ...
mmja's user avatar
  • 93
0 votes
1 answer
111 views

Is Git Bash Safe to Use on Windows?

I've recently downloaded and installed Git Bash for Windows https://git-scm.com/downloads, my primary goal is to use it for pushing code to GitHub. I already connect Gitbash with Github in browser ...
SirGhazian's user avatar
1 vote
0 answers
26 views

A certificate chain processed but terminated in a root certificate which is not trusted by the trust provider [migrated]

I noticed that some binaries on my machine were showing up as "Invalid Signature", and looking closer at one of them in particular (Microsoft's "widgets.exe") I noticed something ...
Patrick's user avatar
  • 111
0 votes
0 answers
8 views

Windows YubiKey GPG works with putty but not terminal [migrated]

I created three gpg subkeys stored on my YubiKey as described here. I added enable-ssh-support and enable-putty-support to my gpg-agent.conf file. Everything works when accessing a server with the ssh-...
Marvin34565's user avatar
0 votes
0 answers
42 views

How to track thread termination if Invoke-Phant0m terminates a thread with no trace in Sysmon?

I recently learned about such a tool as Invoke-Phant0m, this tool has several implementations, one of which is a PowerShell script. The Invoke-Phant0m.ps1 script is a PowerShell script that uses WMI (...
0rdum's user avatar
  • 1
0 votes
0 answers
43 views

Multiple firewalls running on the same machine

On my machine, I have had the Bitdefender firewall and the default Windows firewall running for some time. In the past, I have set rules and exceptions such as to block ads on certain applications. ...
Leo's user avatar
  • 1
0 votes
0 answers
40 views

Why is running an exe created from ADS, failing in Win-11 with incompatibility of 64-bit OS?

I'm experimenting with ADS (Alternative Data Streams), and tried to create a text file with the calc.exe embedded in an ADS. I used the following steps to do this: "Hello" >t2.txt Get-...
not2qubit's user avatar
  • 275
26 votes
4 answers
8k views

How long does malware last "in the wild"?

I watched this YouTube video where the uploader connected a Windows 2000 virtual machine directly to the internet, no NAT or firewall. Within minutes, his VM is infected with malware, the overwhelming ...
ElectricHellKnight's user avatar
1 vote
0 answers
32 views

SmartCard rollout for Windows RDP clients

We want to deploy a thin client architecture, where the users can sign-in into their session from every client by inserting their SmartCard into an attached reader but we have a hard time finding ...
Marcel Körbler's user avatar
1 vote
0 answers
57 views

Why can't a user who is accessing the service on their own behalf find the "long term" keys to decrypt the service ticket and have to use U2U?

I started to study how the U2U mechanism works and got confused. The gist is as follows. When we use U2U the service ticket will be encrypted with the session key KDC of the user-"server". ...
Deoni Deon's user avatar
1 vote
0 answers
81 views

How does Windows 11 handle incrementing low-level syscalls compared to W10

I implemented my own version of SysWhisperer2 to parse ntdll and dynamically resolve syscall service numbers in Windows 11 under the assumption that the methodology would still be able to process ...
v0rtex's user avatar
  • 11
1 vote
0 answers
109 views

Pass-the-hash, why do I get a shell with high integrity?

I am testing the security of a Windows Server 2019 machine and have a question about remote access to the machine. The user on the machine has the permission "SeBackupPrivilege". I can ...
EEVV's user avatar
  • 11
1 vote
0 answers
64 views

WinAPI legit usecase for setting PPID

I am studying malware development right now (exclusively WinAPI) and reached the topic of PPID spoofing. I understand the concept and why it is useful, however I do not understand why is it possible ...
B4D4M's user avatar
  • 11
0 votes
1 answer
574 views

Is CVE-2024-20666 Bitlocker vulnerability mitigated by disabling Windows RE or removing the recovery parition?

Taking Microsoft's page on CVE-2024-20666 at face value, that Bitlocker vulnerability is darn serious in an "evil maid" attack: A successful attacker could bypass the BitLocker Device ...
fgrieu's user avatar
  • 1,253
0 votes
0 answers
112 views

Very frequent calls to same Windows API function by malware

Here I have a malware sample that calls RegQueryValueEx quite frequently, without any time interruption. And as we can see, the result is quite often "BUFFER OVERFLOW". In another topic I ...
Questions123's user avatar
1 vote
1 answer
119 views

Can NTLM pass-through authentication be done without NetLogon?

In any "recent" documentation regarding NTLM (Microsoft) I see it stated that the mechanism of pass-through authentication is done over a NetLogon channel, which should be secure. This ...
superstav's user avatar
0 votes
1 answer
81 views

SACL for shadow copies

I'm researching the topic of detecting registry dump from disk shadow copies and realize that I don't see any specific events in the Windows and Sysmon logs. I tried a simple copy with the command: ...
ganbg's user avatar
  • 11
0 votes
1 answer
271 views

Is the Bitlocker encryption key used on HD same for USB?

With Bitlocker, is there only one "master key" that is used to encrypt/decrypt for both HD and USB data? I saw this article today which talks about sniffing the encryption key to get access ...
nanonerd's user avatar
  • 197
0 votes
0 answers
118 views

What is Virtual Secure Mode trying to achieve?

I recently learned about the feature in Windows 10 called Windows Secure Mode (https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/vsm). I'm trying to understand what exactly it ...
user2334659's user avatar
0 votes
0 answers
115 views

How to embed a PE file to another PE files

So what I want to do basically is what BDFproxy does on the go, I want to modify a file (on the disk) to embed another PE in it and have both working, it does not matter if they work concurrently or ...
LuckyCoder3607's user avatar
0 votes
0 answers
133 views

Is using OpenSSH Authentication Agent on Windows 11 a secure practice?

I use a passphrase on my SSH key used for git. I wanted to be able to use the same git for a few scripts I run to clone/pull a bunch of my repos. I discovered that I don't have to repeatedly enter my ...
Scorb's user avatar
  • 111
0 votes
0 answers
64 views

domain (active directory) machines accessible via web

I recently stumbled across customer machines (windows server) that were part of the customers active directory domain and also had IIS applications accessible for the www. I only have the vague ...
rominator007's user avatar
0 votes
1 answer
214 views

ScyllaHide DLL Injection

When I try to perform a DLL injection with ScyllaHide in x32/x64 dbg, then it crashes for some reason, is this a bug? Both with stealthy injection as with normal injection, the program crashes when I ...
Moooz's user avatar
  • 45
0 votes
1 answer
141 views

How to protect a local app that acts as a webserver from exploits?

For me building interfaces through HTML / JS frameworks is by far easier then any other framework I have tried in the past. It's also not that strange, as by far the most UIs are based on the web ...
Dirk Boer's user avatar
  • 539
1 vote
0 answers
115 views

Suspicious new folders with chaotic jpg,sql,doc,txt and doc files

I found several new folders, each containing 10 small files with random content ( a chaotic picture, an rtf of random letters, a corrupted doc file etc...), all the files were created at the same time,...
OMGsh's user avatar
  • 111
1 vote
2 answers
129 views

Isolating encrypted and unecnrypted Windows installations and protecting the boot loader

I want to use my PC both for gaming and for stuff like keeping cryptocurrency wallets, online banking, etc. I need to install games as admin but of course I don't want them to be able to access my ...
Vlad's user avatar
  • 111
1 vote
2 answers
375 views

How to determine which Chrome extension is re-directing me to ad sites

Twice now, seemingly randomly, I've been redirected to an ad site. I believe it has occurred both times when I have a new tab open, type what I'm searching for (Google is my default search engine), ...
johnfernow's user avatar
0 votes
1 answer
1k views

Which Intel CPUs do not have Management Engine (ME) [duplicate]

The Intel Management Engine (ME) is a security risk which I would prefer not to take. I do not trust it, it seems to be a backdoor, and there are reported vulnerabilities on it. I do not trust the ...
user5623335's user avatar
1 vote
1 answer
140 views

Security vulnerabilites in Windows updates from local network

Windows has offered the ability to download updates from machines in the local network for some time. My gut feeling tells me this would be a great attack vector for Windows security vulnerabilites. ...
J Heschl's user avatar
  • 123
2 votes
0 answers
106 views

Secure API token handling in Windows app: the token is needed to authenticate the requests to a backend server

I'm currently working on a UWP app that involves validating redemption codes against a Cloudflare KV storage backend. That's all the backend server is for. I want the app to check the redemption code ...
Neox's user avatar
  • 21
1 vote
0 answers
69 views

SPNEGO-based Kerberos authentication: Should I create a new security context using `gss_init_sec_context` for every request?

I'm implementing SPNEGO-based Kerberos authentication for a Linux client application for authenticating requests to a Windows IIS server. I've read RFC4559, which describes how authentication should ...
Shuzheng's user avatar
  • 1,267
2 votes
0 answers
373 views

Bitlocker on Windows 11 local account

I've recently upgraded my computer security by encrypting all the drives on in with BitLocker (I'm using Windows 11 Pro). Unfortunately, I ran into a rather fastidious bug that prevents me from ...
Alicent's user avatar
  • 21
1 vote
0 answers
164 views

Local development credential manager and best practices

I've long since been storing credentials to databases and services in local configuration files during development. Sometimes these need to be to production systems, which makes this a security issue. ...
John's user avatar
  • 149
2 votes
1 answer
196 views

Do Windows Credential Manager encrypt information stored in it?

Apologize if this is a newbie question. Say the PC hard drive with Windows installed is un-encrypted (no BitLocker, etc); and someone gets physical access to the hard drive but does not know the (...
aaa acb's user avatar
  • 121
0 votes
0 answers
100 views

Can I setup and enforce additional WiFi connection (and password) requirements on managed laptops using Windows or MacOS?

Can I setup and enforce additional WiFi connection (and password) requirements on managed laptops using Windows or MacOS? Such as: blocking (or entirely hiding) the option to connect to open networks ...
Bob Ortiz's user avatar
  • 6,705
0 votes
0 answers
124 views

ZeroLogon possible false positive events 5827? (CVE-2020-1472)

ZeroLogon checklist: August 11, 2020 updates have been deployed on all domain controllers. February 9, 2021 updates have been deployed on all domain controllers. All devices are running Windows 10. ...
Amedee Van Gasse's user avatar
1 vote
1 answer
143 views

How to tell if BlackByte NT ransomware is on my computer?

The company I work at sadly fell victim to BlackByte NT ransomware this week. It ransomed many of the Windows machines on our factory floor. I have used my personal laptop (Windows 10 Home, version ...
Intrastellar Explorer's user avatar
0 votes
0 answers
157 views

I need help properly encrypting my computer SSD

My main laptop recently broke down and i've been forced to use an older laptop I had in storage. This machine was encrypted years ago with veracrypt and only has an SSD. It's around 250 GB of storage. ...
Elizabeth Vogue's user avatar
3 votes
1 answer
2k views

Security risks in using ‘no @thankyou.com’ to bypass Microsoft account login when installing Windows 11

One of the recommended methods for bypassing Microsoft account login during the Windows 11 OOBE is to attempt to log in using a locked account (no @thankyou.com being the most commonly recommended ...
Brybeck's user avatar
  • 131
0 votes
1 answer
152 views

How to mitigate spoofing, keylogging password, stealing public key with smart card with external/internal smart card reader?

Here is my thought process: I want to use smartcards without passwords for my setup. We don't want to use Iris or fingerprint or voice. I only want to put in the card whenever something needs to ...
user300431's user avatar
0 votes
0 answers
79 views

How do I check if my PowerShell is connected on SSH?

I know how to check but command line cmd or powershell can be altered to make it look clean with disguised hash codes (which they show like they are not tempered but actually commands are altered and ...
kurosakichigoo's user avatar
0 votes
0 answers
79 views

Can already opened event logs of PowerShell's event properties screens on Windows be hacked by hackers in milliseconds?

I am wondering some issues about event log safety of powershell. I think is it possible to alter the powershell itself. But theorically the event log should show us every attempt made in powershell ...
kurosakichigoo's user avatar
0 votes
0 answers
106 views

W-Firewall blocks Port 135 if using IPsec Kerberos V5 User Authentication

i am about to implement IPsec to achive a zero trust environment, in order to do so i am using the Windows Firewall with IPsec Rules (Allow the Connection if it is secure). Everything works fine, but ...
Proxolin's user avatar
1 vote
0 answers
107 views

Windows decrypting TC volume without passphrase?

I remember having read a blog post or a forum post, some years ago, about a TrueCrypt user whose Windows machine sometimes, at boot, did not ask for the TC passphrase and decrypted automatically the ...
dr_'s user avatar
  • 5,208
0 votes
2 answers
1k views

Methods to bypass Windows security policy: All Removable Storage Classes - Deny All Access

My partner recently got given work laptop and if you try and put in a USB mass storage device you get an error saying it is not allowed. Without having administrator access I assume this is via the ...
user2334659's user avatar
1 vote
0 answers
112 views

Is having no driver installed better than having old driver?

How safe are installed & genuine-vendor signed old drivers, specifically when attackers are spoofing Microsoft and other vendor certificates? On older PCs and laptops where some components are no ...
Shubham Deshmukh's user avatar
0 votes
2 answers
1k views

Implications of enabling Developer Mode in Windows 11

Windows 11 appears to have a Developer Mode. I was playing around with Flutter and got prompted to enable it. The setting looks like this: When I enable it, I get the following confirmation prompt: ...
Pieter's user avatar
  • 1,339

1
2 3 4 5
45