Questions tagged [windows-10]
An operating system developed by Microsoft released July 2015 and designed to run across devices with multiple form factors - PC, tablet, smartphone, Xbox and HoloLens.
297
questions
0
votes
1answer
50 views
Windows Certificates - where is private key located?
In Windows 10:
When I load a certficate into the "Current User" store, it puts a private key file here:
C:\Users\[userID-A]\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-xxx\...
-3
votes
1answer
92 views
How am I supposed to check Defender's capability when it trusts me blindly after I mark a test malware file as “allowed”?
With enormous amounts of fighting with Windows/Microsoft Defender, I finally managed to download the "test virus" file from https://www.ikarussecurity.com/en/private-customers/download-test-...
0
votes
1answer
110 views
Why did my DoS attack fail against Windows 10?
I have multiple devices - a Samsung and a Lenovo tab, an Amazon Alexa, an HP laptop running Windows 7, and another running Windows 10. Bored, I tried to DoS my Windows 10 laptop using my Windows 7 ...
-1
votes
0answers
33 views
Recycle Bin delete logging
Can someone please explain why $I (Index) files are getting deleted when recycle bin is emptied.
When I delete files they go into recycle bin and depending on the drive say C:, the location of the ...
0
votes
1answer
64 views
What is “Your Phone” in Windows 10 Advanced Firewall?
I have an Outbound Rule in my firewall called "Your Phone".
Settings:
All programs.
In Customize Application Package Settings, it has "Apply to app package..." set with a long ...
1
vote
0answers
44 views
Setup guide for Privileged Access Workstation on Windows 10
I am setting up a Privileged Access Workstation (PAW) to access a whitelist of websites. Currently I have been following this guide on Github by unassassinable and applying the latest Windows 10 ...
1
vote
3answers
235 views
IT department says our windows 10 server is 100% going to be hacked because of port-forwarding my software
We have a local virtual windows 10 server hosting some custom software. This VM is only hosting this service and nothing else. This software is made of:
An ASP.Net core web app, public API, only ...
1
vote
1answer
38 views
How do you verify the key given by remmina (libfreerdp2)
This morning I took an update to remmina and started getting a "fingerprint changed" warning. When using xfreerdp (from freerdp-x11) I get they old key. The old key being 20 bytes and the new key ...
1
vote
1answer
95 views
Is Windows Sandbox a viable alternative to conventional VM solutions considering its design?
The idea of having a fast, disposable VM at the palm of my hand appeals to me very much. It makes adding an extra layer of security to any thing I want to do so easy - just launch the sandbox ...
1
vote
1answer
101 views
Should I worry about a cmd opening and typing “echo off”?
I some days see a cmd.exe opening and typing "echo off", then disappear.
My computer is slow, but I'm not sure if a program running with first line "echo off" would be so slow as to let me see it ...
0
votes
0answers
30 views
what is an example of out of bounds read in order to leak sensitive information?
I Am trying to understand a little bit better behind the scenes on bypassing aslr by reading the bytes in the memory of a process, but how can I make an example of an info leak in WIN32? my code does ...
2
votes
3answers
140 views
Folder level encryption on a Windows 10 Pro laptop
Most of the stuff on my laptop is benign; and the hassle of full disk encryption is not worth it. On the other hand, one or two folders I would love to encrypt and password protect.
What's the best ...
1
vote
0answers
43 views
TPM & Windows BitLocker: how does it work and is it secure?
When starting a BitLocker-encrypted machine with a TPM and Windows 10 installed, you aren't prompted to enter a decryption key. The system relies on Windows lockscreen for authentication instead. My ...
0
votes
0answers
29 views
FIDO2 Windows vs Linux
I am using a Yubikey 5C as a MFA & smartcard for various application.
On my Windows 10 desktop I have set up a FIDO2 PIN - so if I would like to use it within Firefox for example, I have to enter ...
0
votes
1answer
53 views
How I can encrypt Windows if I use a SSD and HDD?
I need to encrypt my Windows Disks with full disk encryption. Windows is already installed and all drives have data.
My Drives/Disks:
1 SSD - C: drive
1 HDD - D: drive and I have a drive where Linux ...
0
votes
1answer
69 views
Why do people warn of putting unknown USBs in your device [duplicate]
People keep saying never put a random USB in your device because it could ruin it with a virus. Hackers are able to program USBs to automatically run a virus when it is put in a device. So I decided ...
0
votes
0answers
18 views
Windows 10 encryption virus: Extension .lktja99122 [duplicate]
My Windows 10 Surface Laptop 1 i7 has been affected by a ransomware that says it has encrypted my hard drive. Here is what the README says:
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your ...
1
vote
0answers
30 views
Which Windows 10 login protects secure data?
Windows can protect sensitive data using CryptProtectData, which according to the Windows docs, encrypts data for a given program using the user's login password.
But Windows 10 has several forms of ...
0
votes
1answer
59 views
Finding mechanism of unauthorized data access on OneDrive/Windows 10
An ex-girlfriend has demonstrated an ongoing ability to access files stored only on my Windows 10 x64 PCs and Microsoft OneDrive. How can I find or trace the mechanism by which she is doing this? ...
0
votes
0answers
142 views
System Process PID 4 Attempt to connect to Public IP using port 445
I was cross checking my environment and i found that System process PID 4 establishing Outbound connection to public IP using Port 445 is that a normal behavior?
OS: Windows 10 1909
System PID 4
...
1
vote
0answers
30 views
Implied network privileges on Windows 10 apps?
If an app in the Microsoft Store only has the "userNotificationListener" permission listed, will it be able to send data over the internet?
On https://support.microsoft.com/en-us/help/10557/windows-...
0
votes
1answer
30 views
Can programs see your windows account name given admin rights?
The windows account name can be seen as one the folders in C:\Users. Assuming you changed your windows account name to something different to the folder, can programs see your new windows account name ...
0
votes
1answer
58 views
Does a Windows 10 endpoint check software installations for malware if they are installed through GPO / SCCM / Software Center?
I'm trying to get a view on what extra security checks our packaging team could do when they download a potentially infected installer from the web before they package an MSI or EXE (assuming that the ...
0
votes
0answers
359 views
Can my employer see my browsing history with work account on my personal device
I was using Edge on my personal device at home browsing stuff and realised I was logged in on Bing.com with my Microsoft work account. I cleared my browser's browsing history and also Bing's browsing ...
0
votes
0answers
66 views
Are all PAGE_EXECUTE_READWRITE are security risks?
I've used a dump program to get a snapshot of my memory on newly installed Win10x64 and then I've pip it into Volatility(Memory forensics Software) by running this command :
python vol.py -f ...
0
votes
1answer
88 views
How many actions do you need to take to disable DEP
I am attempting to disable DEP on a program that will be used in a demonstration of how a basic buffer overflow works.
The application is a C++ app written in visual studio and I am running into ...
0
votes
1answer
57 views
Risk of specific changes to the “Trusted” security zone
Our EDI VAN provides software to transmit sensitive customer and business data between our ERP and their website. This software requires that I add several URLs (including one plain HTTP) to the "...
1
vote
1answer
600 views
What ports should be closed in windows 10?
How can I close ports in windows 10 and what ports are unnecessary to be open? How do I find these open ports to close?
Also if I close a specific port on windows 10 do I have to close the outbound ...
2
votes
1answer
159 views
How exactly does Windows Defender in Windows 10 determine when to upload your local files to Microsoft?
Every time I install Windows 10, I painstakingly go through every setting that can be found in any GUI setting for the OS, disabling everything that sounds creepy.
One of the most disturbing things I'...
0
votes
0answers
54 views
“Something you have” on a multi-user device - what is the opinion regarding the NIST AAL3 definition?
The NIST AAL3 specification requires
In order to authenticate at AAL3, claimants SHALL prove possession and
control of two distinct authentication factors through secure
authentication ...
1
vote
0answers
51 views
Why did something on my Win10 machine try to fetch a Windows patch-looking EXE from localhost today? (UPDATED)
[Tue Feb 11 10:37:00 2020] 127.0.0.1:49951 [404]: (null) /c/msdownload/update/software/defu/2020/02/am_delta_patch_1.309.678.0_2ed0992bc429bfc321a0209f24dcd8912733a2a5.exe - No such file or directory
...
1
vote
0answers
92 views
How should I install Kali Linux on my Windows 10?
I'm using Windows 10. I found several ways to install Kali Linux on Win10:
Install it on VMWare
Install it on Docker
Install it on Linux subsystem (WSL)
I might need to access some files in my ...
0
votes
0answers
91 views
Mimikatz Windows 10 password recovery
I'm trying to log into my Windows 10 laptop that was using a Microsoft login. I used to mimikatz to retrieve the SAMkey, LSA secret, dpapi, System masterkeys, and the password hash but it's the ...
1
vote
1answer
126 views
Secure Windows 10 Home admin's data behind a password, even when user apps are running
Windows 10 Home's default account lock system for the admin account is not completely secure because there are multiple free password recovery tools & ways available that can be used by a non-...
2
votes
2answers
138 views
USB device security in Windows
Am I really understanding things correctly if I claim that:
If a USB stick/device is inserted into a PC running Windows, currently in "lock screen" mode (that is, somebody has pressed WinKey + L), it ...
0
votes
0answers
97 views
Is it safe to use cmdkey to store credentials?
In this question I saw that you can use command key to store credentials and then just run a command like mstsc /v:servername to connect to it without typing anything.
Additionally, you can delete it ...
2
votes
2answers
1k views
Does a lack of verified signatures for Windows Defender indicate malware?
I ran "autoruns" from Windows Sysinternals on a Windows 10 machine, and noticed that the Windows Defender services were marked in red colour, and did not have verified signatures. I checked these ...
0
votes
1answer
65 views
Dealing with File Permissions from a Virtual Machine - Forensic Logical Acquisition
I am currently in the middle of operating an analysis on Autopsy of a virtual machine (VMware) that has been hacked. I have mounted the VM and I am acquiring the evidence from VMware to my physical ...
1
vote
0answers
469 views
Why does Volatility fail on windows 10 dumps and what other tools can I use? [closed]
So I am trying to extract data from a full memory dump (Made with either dumpit or a BSOD). WinDBG manages to extract some information from it, but Volatility is silent:
PS F:\> C:\Python27\python....
0
votes
1answer
114 views
CVE-2020-0601 (CRYPT32.DLL exploit) standalone patch? [duplicate]
Is there any standalone patch for CVE-2020-0601 (CRYPT32.DLL exploit) besides installing Windows 10 latest cumulative update?
Or is there other ways to mitigate this exploit, when immediate ...
10
votes
1answer
274 views
How does CVE-2020-0601 (ChainOfFools/CurveBall) work to undermine ECC?
What is the recently patched and disclosed Windows 10 OS family Crypt.dll vulnerability CVE-2020-0601, nicknamed ChainOfFools and/or Curveball? I've read up on it and while I understand the basics (...
0
votes
1answer
202 views
Show confirmation popup before running any downloaded program in Windows 10
I often download files either using my browser or by torrenting. Few times, I encountered an attack where the torrented file was called something like movie.mp4.lnk and the target was set to run a ...
2
votes
1answer
252 views
How to ensure Windows 10 is safe from critical security hole reported by NSA on 2020-01-14?
All over the news today (2020-01-14) is the story that the NSA and Microsoft have reported a critical security vulnerability in Windows 10.
But I haven't been able to find clear instructions about ...
0
votes
1answer
70 views
security concerns when configuring Windows 10 to automatically log into a Microsoft account-linked user account
I have just configured my Windows 10 desktop PC at home to automatically log into my Windows 10 user account that my Microsoft account is linked to on startup. My desktop is in my bedroom upstairs and ...
0
votes
1answer
39 views
How to protect Server running on Windows 10 with Node Ngrok against attackers?
I'm running https://ngrok.com/ on Windows 10 pro with a custom app made on Node server running locally (can't be Linux) for a test suite that uses both web and desktop integrated. So I'm basically ...
1
vote
2answers
3k views
How to securely erase the free space on an SSD in windows 10?
I would like to wipe ALL free space on my SSD which Windows 10 is installed on, so that no previously deleted file can be recovered. How can I achieve this?
0
votes
0answers
86 views
Could this be considered lateral movement or is this normal activity?
Has anyone encountered this type of logon (4624 Type 3). The accounts are logging on then off within a few seconds. We are noticing this activity in the morning, which would be when they start working....
0
votes
2answers
244 views
Is it risky to download but not use a zip file?
Is there any possibility of malware infection in Windows 10 for the following three situations:
When you download a zipped file, but do not use it (you do not open it)?
When you only open a zipped ...
1
vote
2answers
131 views
why encryption result using 3 des is different between website and openssl commander?
I am working with OpenSSL using Windows 10 CMD.
I am trying to encrypt something using triple des with key coded in base64 that stored in text file (assume that plain text is:"hi all I am someone", ...
1
vote
0answers
41 views
saving entire Windows event log for auditing & preserve digital evidence
As an admin one gets tasked with configuring [Microsoft Windows 10] computers so that auditing is enabled and captures all events as required by some list that's already defined and handed down.
...
