Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
0
votes
1answer
46 views

Downloaded a file which turned out to be a shortcut that ran the following command, not sure what it did [on hold]

I downloaded a torrent which turned out to be a shortcut that did the following thing. %ComSpec% /c certutil -decode "Succession.S02E07.720p.WEB.x265-MiNX.mkv.lnk" "%APPDATA%\Microsoft\Windows\...
1
vote
1answer
48 views

Can file recovery tools recover deleted small files from SSD drive's NTFS Master File Table?

According to this page and site, small files are kept in Master File Table when filesystem is NTFS. Let's assume that computer is using Windows 10 and a SSD drive with TRIM support. If a user ...
2
votes
1answer
75 views

Best Security measures for non-IT pro to take when at risk of hackers?

I work at a WeWork and am surrounded by about 5 different IT / coding type of companies. They apparently hacked me somehow, I don't know how, whether it was bluetooth or using WeWork wifi, or maybe ...
0
votes
0answers
36 views

Does Windows CNG Keystore supports exporting a key or keypair in ciphertext?

As Windows CNG Keystorage offers API to export key(pair)s: SECURITY_STATUS NCryptExportKey( /* The handle of the key(pair) to export */ NCRYPT_KEY_HANDLE hKey, /* The handle of a key to encrypt ...
0
votes
0answers
30 views

Abusing SSH for maintaining control on windows [on hold]

I'm curious to how an attacker could install SSH on a windows server without a established RDP session. (Only cmd.exe shell) Does anyone know of techniques or references to this? Say an attacker ...
0
votes
0answers
31 views

ms08_067_netapi exploit & pivoting problem

I'm having troubles with ms08_067_netapi. I have a private network with a web server (10.10.2.10), windows 7 (10.10.2.8) and windows XP (10.10.2.9). I'm hacking from outside the private network with ...
1
vote
0answers
38 views

Abusing RDP/SSH post exploitation [on hold]

I'm curious to how an attacker would enable RDP/SSH and use it to gain further access to the compromised windows server after achieving remote command/code execution on the server. (Using cmd.exe)
0
votes
1answer
40 views

Is there any difference between hiberfile.sys file and RAM dump made with 3rd party software for Volatility.py?

I was wondering how could I give some advice to one of my friend when attempting to analyze live Windows machine which was infected with malware. As far as I know, hibernation saves RAM memory ...
3
votes
1answer
57 views

How to enable concurrent users, one RDP and one local, in post exploitation in windows without disk modification?

I want to do this by just using memory and not using disk modification or a tool, in post exploitation of a remote system, i already know how to enable RDP but the problem is when a user is logged in ...
0
votes
0answers
13 views

Block access from an IP that tries too many requests to Apache server XAMPP / Windows [duplicate]

I have a VPS server with Windows 2016 Server and use XAMPP as Apache Server. Yesterday I receied too many requests from 1-2 IPs. How can I detect how many requests I get per 10 seconds and block them?
1
vote
2answers
107 views

Securely editing encrypted text files

My method for editing encrypted text files is to decrypt them in a RAM drive, edit them, and then encrypt them. What I'm worried about is information from my text files being transferred to non-...
5
votes
1answer
98 views

How secure are Windows logins tied to physical human fingerprints?

Some business laptops have a fingerprint reader, and Windows has the ability to use your fingerprint to log into an account in lieu of a typed password. I understand that these open up lines of ...
4
votes
1answer
95 views

Is it possible to take over a Windows server through Oracle?

I have a Windows Server 2008 R2 with an Oracle database running on it. Someone who knows my Oracle username and password claims that he can create a Windows system account somehow. And then he can ...
0
votes
1answer
51 views

Blocking mimikatz on the OS level?

I want to know under which case would Mimikatz still run despite disabling WDigest? Whether wdigest is set to 1 or 0, mimikatz still worked. (tested on Windows 7, 8, 2012) Is there a better way to ...
0
votes
4answers
214 views

Does safe removable media exist?

I have a laptop operating a vehicle with attached camera. Video is exported using removable media. Ports available are USB and Ethernet (also video and audio I suppose). The laptop is not infected (...
0
votes
0answers
15 views

Securing DB connection string and other configuration files in RCE scenario

Environment: Microsoft Windows IIS Web server MSSQL DB Let's say an application gets compromised with an RCE, what's the best scenario of protecting the database connection string file or any ...
0
votes
2answers
125 views

Linux and Windows Password Security Settings

I'm asking a client why some password parameters are not defined in the Linux OS level and he's saying that, internally, Linux and Windows complexity and timeout settings are different. If they set ...
63
votes
3answers
14k views

Why does Windows store Wi-Fi passwords in a reversible format?

Running netsh wlan export profile key=clear in PowerShell will dump your current stored Wi-Fi settings, including the password, into xml files inside of whatever directory you are currently in. Why ...
1
vote
2answers
93 views

What causes Windows security logs saying an attempt was made to reset an account's password?

This falls under the category of eliminating what might be normal activity from my attention. I'm looking at Windows 7 security event logs. I don't have context to know if the following event is a ...
-2
votes
1answer
114 views

Windows Hello Biometric Data

I have two PCs, A and B. I set Facial Recognition (Windows Hello) on A and then I took out the SSD from A and inserted it into B. I tried to sign in using Facial Recognition on B and it was successful ...
1
vote
0answers
45 views

Inbound rules for a port is configured and disabled yet an NMap scan shows that the port is opened

I am new to Windows Defender but have read about it to understand the basics of Inbound/Outbound rules. As mentioned on the app, Inbound connections that do not match a rule are simply blocked. For ...
0
votes
0answers
48 views

Determining clients connecting to IIS using CBC ciphers. (preparing for Lucky13 remediation)

I am trying to determine the impact of re-mediating a lucky 13 vulnerability; which i understand requires disabling CBC cipher modes. So far i have added custom logging to my IIS instance to capture ...
1
vote
0answers
45 views

Securing a SOCKS5 to SSH Tunnel on Windows

In order to gain web access from the perspective of a remote device, it is very common to use the SOCKS5 to SSH Tunnel capability built into OpenSSH Client and Putty (detailed here). Both clients ...
0
votes
1answer
39 views

Configure Windows Firewall Inbound Rule for Program Not Installed on Server

How can I configure an inbound rule on a Windows Server 2016 firewall to allow access from a program which is not installed on the server? When searching for a program browse is only offered for ...
1
vote
0answers
108 views

Forensics methods for obtaining WhatsApp data from Windows Desktop PCs

WhatsApp has the option to download a Windows (or Mac) Desktop version. Installation requires pairing the software with a mobile phone. I have read a similar question about Android devices, and ...
1
vote
0answers
78 views

How should you configure PowerShell logs permissions?

I'm currently trying to figure out the best way to configure Windows PowerShell logging, so that it is secure (Attackers cannot gain sensitive data out of it) it helps in DFIR (digital forensic and ...
0
votes
0answers
43 views

Windows RDS vulnerability

Further to windows thuesday patches and the 4 criticals vulnerabilities related to RDS, i want to know if i'm exposed to the risk or not. I don't have port 3389 exposed to internet, and i read in in ...
2
votes
0answers
53 views

Secure AWS instance metadata against potential SSRF

I am running a Windows instance on AWS. The instance has an IIS service running on it. The IIS service has a user associated to it and it has no need to access the AWS instance metadata. I was ...
0
votes
1answer
27 views

What does “windows_view” attribute of registry object in OVAL?

I've seen somewhere that in 32-bit and 64-bit Windows registry structure is different so you need to use flag windows_view="32_bit" in registry object behaviors tag. But i forgot about it and tested ...
1
vote
1answer
37 views

Finding applications vulnerable to dll preloading on windows

An application is vulnerable to DLL preloading attack on Windows if it loads a DLL simply by it's name. Windows then goes on to search several folders and loads the first DLL with a matching name. ...
1
vote
1answer
52 views

Secure REST API that only works for users authenticated by App with SSO (OAuth?)

I somehow need to accomplish the following: User accesses a application written in JavaScript. Application uses SSO to identify the user who is logged into Windows. Application obtains the access ...
1
vote
0answers
73 views

How to decode kerberos tickets on wireshark? [closed]

It has been two days in a row that I spend hours trying to decrypt kerberos traffic using wireshark. For learning purposes, I want to be able to read the encrypted parts of tickets and authenticators ...
1
vote
1answer
102 views

How can I detect CVE-2018-0886 vulnerable hosts in my network?

I know that the vulnerability is a bit old,but still an important one. Today, by chance I found out that a PC with Windows 7 didn't have the update applied and I'm wondering if there are more. Most ...
1
vote
0answers
73 views

RDP/VNC/Xorg over Tails/Tor - From Tails to Windows

I asked a question that was semi related to security, so I want to make it up by bringing a more focused question. Remoting from a Tails machine to a Windows one. I have been working for a couple of ...
0
votes
1answer
91 views

Analyze Windows Malware on Linux

I'm just getting started with the book 'Practical Malware Analysis', some of the exercises are using PEview and Dependency Walker however I'm slightly allergic to using Windows. Is it possible to ...
2
votes
1answer
72 views

3DES supported in application although disabled in Windows

Can users actually use the 3DES cipher to connect to a Tomcat web server, if the 3DES cipher has been disabled via registry keys in Windows: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\...
0
votes
0answers
52 views

What is the purpose of the Volume Master Key in BitLocker?

From this FAQ, I understand that BitLocker uses the following keys to encrypt the hard-drive: Full Volume Encryption Key (FVEK) (used to encrypt raw data; encrypted by the volume master key and ...
0
votes
5answers
339 views

How do keyloggers tell it's a password? (And how to fool them.)

This question also applies to clipboard monitoring. Imagine you are planning to deploy 100,000 copies of a Windows trojan with keylogger functionality. (For the record, I'm not talking about myself ...
3
votes
1answer
106 views

Is it unsafe to enter administrative Windows credentials when logged in as a regular user?

I was recently advised that when a user is logged in as a regular user and they need an administrator to do something (i.e. install an application) that entering the administrator credentials when the ...
-1
votes
1answer
74 views

Firewall logs with Local IP contacting local IP over the internet [closed]

I noticed some wierd behavior in our firewall logs: a computer in our subnet 192.168.1.0/24 sending UDP packets in port 161 to an IP in subnet 192.168.20.0 (we don't have a subnet like that), and the ...
1
vote
1answer
103 views

Are there totally isolated processes or services possible under Windows?

I want to program a little security watchdog for my Windows 10 machine. This watchdog should start directly after boot and should be active, no matter which user is currently logged in. None of the ...
0
votes
2answers
116 views

Can I rely on Operating System (OS) Anti Virus (AV) scanning to scan files shares?

I have an EC2 instance with an Windows OS with anti virus installed. I have a requirement to attach a file share to the OS where the application is hosted. The file share is Amazon Fsx ( Amazon's ...
0
votes
1answer
140 views

How does Windows use the TPM for BitLocker encryption without an attacker being able to do the same?

How does Windows use the TPM for BitLocker encryption without an attacker being able to do the same? From this FAQ, I understand that BitLocker uses the following keys to encrypt the hard-drive: ...
1
vote
1answer
144 views

Do non-administrator Windows accounts need strong passwords?

I have always used long passphrases for my own Windows user accounts. But I know some people who use moderately common passwords (we'll say they're in the top 1,000 most used passwords, but not in the ...
2
votes
0answers
76 views

Computer that can't upgrade beyond Windows 1803 - safe to use until when? [closed]

I have an old computer that can't (at least according to Windows Update) upgrade beyond Windows 1803. (Probably due to the manufacturer not releasing updates to drivers.) Until when will it be safe to ...
0
votes
1answer
157 views

Is it safe to share msinfo32? [closed]

Is it safe to share your msinfo32 export with the Internet? Does it contain any sensitive data like PII?
1
vote
2answers
181 views

Can rootkits hide their internet usage from resource-manager and third party software in windows 10? If so, how?

Lets say I have the latest windows 10 version. I also have DU meter for checking my network usage I know that in windows there is a linked list of processes that many rootkits tend to remove ...
2
votes
1answer
82 views

Is it safe to view local pdf files in a browser?

When receiving a pdf file by e-mail, the question is how to open it. Browsers are normally quite secure, don't support all pdf features (an advantage in this case) and the viewer/conversion might ...
1
vote
1answer
97 views

Securing IPC between kernel and user-mode application

We are currently developing a security software for Windows. This application consists of a service running in user mode and a driver in kernel mode. These two need to communicate, so that the service ...
2
votes
1answer
103 views

How long are password hashes stored locally?

Suppose Alice logs into Windows machine M (which is part of an enterprise network managed through Active Directory). My understanding is that M will contact the domain controller to get Alice's ...