Questions tagged [windows-10]
An operating system developed by Microsoft released July 2015 and designed to run across devices with multiple form factors - PC, tablet, smartphone, Xbox and HoloLens.
0
votes
1answer
41 views
I installed a windows app that stores cookies in a plain text un-encrypted database. Is this a problem?
I have recently installed an application that was developed with Electron that requires I authorize via Google to use the application.
I did this at the same time as monitoring the application with ...
5
votes
2answers
80 views
How to prevent Windows Update from suspending BitLocker encrytion?
I was quite shocked today to see that a Windows 10 Pro machine that I recently set up with BitLocker (startup PIN + TPM with full disk encryption) suddenly didn't have BitLocker enabled anymore:
And ...
0
votes
1answer
51 views
Does Windows 10 provide sufficient virus and threat protection? [closed]
I am configuring a new laptop with Windows 10 Home and trying to determine if it is necessary to buy one of the big antivirus packages such as Norton, McAfee, etc. Is the security software that comes ...
1
vote
1answer
93 views
WIN 10 hardening: Importance of “Allow system to be shut down without having to log on” policy
I am enforcing a hardening policy on my organization's work stations.
One of the policies I removed, under Shutdown, is called "Allow system to be shut own without having to log on".
Users started to ...
2
votes
1answer
71 views
How does Malwarebytes intercept web traffic?
I use Malwarebytes and the web filter functionality puzzles me. As far as my research has found, antivirus engines typically use a proxy to intercept web requests which typically there would be ...
2
votes
2answers
150 views
What can someone do with (non-admin) command prompt on a network?
Say that an organization has a closed network - only its own computers can access it. Each of these computers has Windows 10 Enterprise. For obvious reasons, users aren't given administrator ...
1
vote
1answer
43 views
FIDO2 on Windows: Why do I need a TPM?
I just installed the Windows 10 1809 update, which includes support for FIDO2 passwordless sign-in. I own a Yubikey 5, which supports this standard. However, I am not able to set up Windows Hello, a ...
-1
votes
0answers
26 views
I messed up and opened a couple .docx files, and allowed them to run. What should I do? [duplicate]
I had a couple of emails from someone in my office saying to open the .doc attachment that was an invoice. I opened them but it was just blue and it said 'enable content to see the invoice'. I very ...
0
votes
0answers
10 views
Windows 10: Kerberos settings not found [migrated]
In our company, we want to configure our Windows-based infrastructure compliant to the IASE SCAP specifications, e.g., the Microsoft Windows Server 2016 STIG Benchmark.
In this document, there is the ...
2
votes
1answer
58 views
prevent Ransomware on CIFS shares mounted on Windows 10
I am using Windows 10 with Defender. I follow all the ground rules when dealing with the internet and staying secure. I work in IS so I'm pretty familiar with the various threat-vectors and do a good ...
1
vote
2answers
136 views
How to copy files without copying Alternate Data Streams
I want to backup my infected Windows system's files before formatting it all and reinstalling the system. I would do it from a Linux Live USB. I've heard that one should be careful in copying only the ...
0
votes
1answer
55 views
SRUM (system resource usage monitor) forensics - Windows server?
Having read a couple of articles on the SRUM DB and its use in forensics, I started digging around in Server 2016. The path referenced in the articles is not found in Sever 2016 %systemroot%\System32\...
1
vote
2answers
86 views
What files can I keep to reinstall an infected system without getting infected again?
I'm quite sure my Windows PC is infected beyond salvation and I want to format it and reinstall everything. However, I have a 128 GB SSD where I keep only the OS and a 1 TB hard disk where I have ...
1
vote
2answers
45 views
Microsoft Windows CVEs?
I know sites like cvedetails and exploit-db feature Windows 10 specific CVEs. But doesnt microsoft.com have a list (or feed) of vulnerability advisories and recently disclosed CVEs? I checked their ...
0
votes
1answer
69 views
Can SMBv1 be secure if used for just SMB server discovery?
I noticed that my SMB shares from a Samba server no longer appeared in Windows 10 network browsing (network neighborhood) in Windows file explorer. The reason turned out to be that this functionality ...
0
votes
1answer
78 views
Both Ophcrack and ONTP&RE incorrectly show Windows 10 passwords as blank
I'm trying to crack a Windows 10 laptop that I myself set a password on a day or so ago. So far I've tried booting into Ophcrack 3.6 and ONTP&RE (Offline NT Password & Registry Editor) from ...
2
votes
1answer
100 views
Is RDRAND used in a safe way by Windows 10?
This question was already answered by Linus Torvalds for Linux, and is also cited in this Q/A on this stack:
We use rdrand as _one_ of many inputs into the random pool, and we use it as a way to ...
0
votes
0answers
130 views
Something is visiting every URL after I do. What is it?
For each time I visit a unique URL on my web server, a mostly random Amazon owned IP address visits that URL fairly soon after.
If I have a query string, and I use the same one that it's already ...
0
votes
0answers
19 views
Use local administrator and Domain Cached Credentials to obtain access to AD domain?
I have obtained local administrator privilege on a Windows machine connected to AD domain.
Using Mimikatz I see the Domain Cached Credentials of a few Domain Admins.
I know that, it is possible to ...
0
votes
0answers
15 views
Methods for obtaining a Windows domain account, when having no domain account already?
I know of sniffing NTLM authentication, using a tool like Responder, and then brute-force these packets to obtain AD credentials.
But what if the domain has disabled LLMNR and NetBIOS? Then Responder ...
0
votes
0answers
34 views
Which shims are used to patch memory?
Reading about Shims, I came across many suggestions that shims could be used to patch memory (for instance to inject a DLL). Unfortunately, I could not find the exact shims used to perform those ...
2
votes
1answer
110 views
Is there evidence to proof that Windows is spying us ? Are the anti-spy programs works and are they trustable?
Are there any evidences that Windows is spying the users ? Let's focus on Windows 10. I am almost sure it does. The things like telemetry and Cortana... However I never saw a proof like university ...
1
vote
1answer
93 views
Being connected to a trusted VPN, do I still need personal firewall, and if so, why?
Background
Hardware: Dell Inspiron 15 Gaming 7577-92774 with recent BIOS (16-Aug-2018)
Operating System: Windows 10 Pro, version 1803 (Build 17134.285)
Antivirus / Firewall: ESET Smart Security ...
2
votes
1answer
94 views
Obtain NetNTLM/NTLM hash or login
In one CTF, I encountered a task that is solved by getting NetNTLM \ NTLM or just getting username.
Tell me, please, is there any protocol that automatically sends NetNTLM / NTLM or username, when ...
3
votes
1answer
70 views
How does Windows knows a particular software is an AV?
First, I did some GoogleFu and came up with nothing.
My question is: How does Windows 10 know things like McAfee, Symantec, AVG, etc are antivirus solutions?
My assumption is that they set a ...
7
votes
2answers
231 views
Win10: Access other logged on users' memory
How easily can admin users access the data of other users' running processes on Windows 10?
Especially webpages loaded by Chrome.
Example
Context
Bob and Alice share a single Windows 10 ...
1
vote
1answer
63 views
How to determine if Windows 10 executable can connect to my network
I'm considering use of a scanner driver I see on a website. I don't know the site or the owner so I'll be paranoid and assume that this Windows 10 exe is malicious. I can run the code in a throwaway ...
0
votes
2answers
91 views
Should I change my built-in Administrator password?
I had never thought much about this until the only account on my home PC somehow lost admin
privileges (changing to guest - I suspect this is a Microsoft bug but will probably never know).
So, ...
-1
votes
1answer
95 views
Auto-Fill Windows Security Credentials
I am having a network issue that every time in a while it requires me to enter my windows credentials (it is company security thing)
If I don't do that I will have no internet connection on my laptop
...
0
votes
1answer
92 views
Does this evidence seem consistent with an intrusion via the VNC server?
I am new to this forum, so apologies in advance if this question does not seem to fall within its scope, or if it seems too long:
On two occasions over the past ~3 weeks, a hacker gained remote ...
1
vote
2answers
441 views
Combining a fingerprint scan and password for 2-factor-authentication [closed]
UPDATE:
I found the answer to the "How To?" part of my question on superuser:
Require Fingerprint AND Password/Pin for Windows Logon
Is it possible to require a TOTP on Windows Login using existing ...
2
votes
2answers
91 views
Is there a way to prove that a program was executed on my Windows PC?
Can I prove that someone used an executable that connected to the Internet (not necessary a harmful one) on my Windows 10 PC? Especially when the program was installed on a removable device such as a ...
0
votes
0answers
15 views
Hyper-V keep enhanced session while blocking redirected drives
I'm creating a nested vm user desktop inside Windows 10 Enterprise. I'm using the hyper-v console, not mstsc.exe. The user desktop vm needs to use a headset and microphone which requires Enhanced ...
0
votes
0answers
50 views
Why 6.7 version of image magick can be exploitable even it is Vulnerable version?
I have installed a vulnerable version of the image magick i.e. 6.7 and according to this CVE-2016–3714 it is a vulnerable version. Now why I downloaded it because to get a clear picture of this ...
0
votes
0answers
63 views
Wireshark showing all ports being probed from my tablet
The first two pictures: Wireshark shows a tablet device as the source and my computer as the destination and vice versa. This tablet has never been connected via USB, FTP, BT, nothing to the computer. ...
3
votes
1answer
103 views
VeraCrypt mounted container safety
If I mount encrypted container, it stays in encrypted state until file is opened. At this moment, file is fetched in memory and decrypted - VeraCrypt - Beginner's Guide.
Can malicious program open a ...
1
vote
0answers
87 views
How do I examine a fresh Windows 10 installation
I suspect an unauthorized modification has been applied to a fresh new installation of Win 10 x64 and/or a PC running it by a person who knows me personally with the purpose of tracking my activity ...
0
votes
2answers
221 views
Is it generally safe to disable Windows 10 Proxy Auto-Discovery Protocol (WPAD)?
Is it generally safe to disable Windows 10 Proxy Auto-Discovery Protocol (WPAD)?
This might be my only option to try before contacting my ISP which could be quite annoying to do.
0
votes
1answer
248 views
Can Microsoft collect data from inside a virtual machine?
If I spin up an OS in a VM, can Microsoft still collect and track data from the guest OS? I'm just wondering if Windows 10 collects that much data or not.
Just FYI: no, I'm not a nutter that's ...
1
vote
0answers
79 views
How to block all aplications from internet connection?
I would like to block all windows10 applications from internet access
So I found a settings screen on the windows firewall (Windows Firewall\Allowed apps) I would like to uncheck everything from this ...
1
vote
0answers
64 views
Why is there no SEH handler found in Windows 10?
I use immunity debugger and mona.py to find SEH pointer in Windows 10. Command is !mona seh.
But it says no pointer is found.
I want to know what has changed in Windows 10 to protect against this ...
1
vote
1answer
127 views
Would it be a security risk if I moved PsTools to the windows system32 folder?
Microsfot Sysinternals has a helper program called PsTools inside this PsTools suite are a bunch of .exe tools that I use regularly from a command line.
I was thinking about moving all these files to ...
3
votes
0answers
31 views
Is it possible to prevent rogue/unauthorised computers booting from your PXE server?
In the below scenario, is it possible to prevent a rogue/unauthorised laptop plugging into the network and installing our Windows image?
What risks are we exposed to should a malicious 3rd party boot ...
1
vote
1answer
87 views
Can a Windows program compromise the desktop hardware without giving administrator rights?
If I run a program on a Windows 10 machine, can the program install a virus on an attached USB drive, and can it install a virus into the firmware of the computer to be loaded before the OS/bootloader?...
1
vote
0answers
114 views
Decrypt to memory for editing
I am looking for a secure way to edit sensitive text data, using Git and Vim in the process.
An ideal solution would be:
clone the encrypted git repository into memory;
decrypt into memory;
do the ...
4
votes
2answers
105 views
What do the Disabled and NotBefore properties do for root certificates on Windows 10?
On this Microsoft page, they mention that a new feature in Windows 10 is that it can stop trusting root certificates using the Disabled and NotBefore properties. What is the exact meaning of these ...
0
votes
0answers
24 views
OS - Security Issues - Text Appearing - Performance Downgrade [duplicate]
First, I noticed PC performance downgrade, then random text started appearing in the different text fields (e.g. in Word when I was typing my text, half of page of some random text could appear or in ...
7
votes
1answer
603 views
Replacing cached domain credentials in SECURITY hive
Windows stores the (NTLM) hashes of local users' passwords in the SAM hive. By booting from a live system (for example), one can not only extract those hashes for offline cracking, but also simply ...
4
votes
1answer
2k views
BitLocker on Windows 10 Home
If I encrypt a flash drive using BitLocker on a Windows 10 Pro (With BitLocker supported and installed) device and put it in compatible mode, can I enter the key and read/write to and to/from it from ...
0
votes
0answers
76 views
Install dualboot Windows to avoid viruses
I need to work with some suspicious files or rather files without verified source. It is known that anti viruses(I use kaspersky and malwarebytes combined) fail to notice some hidden trojans. So I ...
