Questions tagged [windows-10]

An operating system developed by Microsoft released July 2015 and designed to run across devices with multiple form factors - PC, tablet, smartphone, Xbox and HoloLens.

72 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
321 views

Windows Defender catches Trojan right after clean install

I recently upgraded some desktop PC components (GPU, SSD). I decided to perform a clean install of Windows 10 onto the SSD. I used a USB created using the Installation Media tool provided by Microsoft,...
4
votes
1answer
503 views

Having a code-signed binary, how can I tell if it's signed with an Extended Validation (EV) certificate?

I can't seem to find an answer to this seemingly simple question. Say, on Windows, if I have a binary file: How can I tell if it was signed with an extended validation (EV) code-signing certificate? ...
4
votes
0answers
905 views

Hyper-V Sockets in 2016 version and host/guest communication

In new version of Hyper-V released recently with MS Windows Server 2016 contains a new functionality Hyper-V Sockets which allows for host/guest communication. It uses WinSock API with new address ...
3
votes
0answers
140 views

Secure way to install windows 10 and winscp,notepad++,wamp on new laptop

I have a project with very critical information from business clients. I will buy a new laptop for this to manage/handle/analyze that information. All I need is: WAMP to run php script only on ...
3
votes
0answers
116 views

Is it possible to prevent rogue/unauthorised computers booting from your PXE server?

In the below scenario, is it possible to prevent a rogue/unauthorised laptop plugging into the network and installing our Windows image? What risks are we exposed to should a malicious 3rd party boot ...
3
votes
1answer
688 views

Why is home Windows 10 machine listening on port 8080 by default?

Ever since we upgraded one of our home windows machines to Windows 10, Kaspersky has been logging blocked network intrusion attempts over port 8080. The exploit is a strange one and tries to hit a ...
2
votes
0answers
47 views

Can a virus infect windows 10 bootable media?

I created a bootable windows 10 usb from my friend's computer. I used the official tool from microsoft. I was dumb enough to not check my friend's computer beforehand (turns out he had Utorrent Web ...
2
votes
1answer
2k views

Is Windows Sandbox a viable alternative to conventional VM solutions considering its design?

The idea of having a fast, disposable VM at the palm of my hand appeals to me very much. It makes adding an extra layer of security to any thing I want to do so easy - just launch the sandbox ...
2
votes
0answers
953 views

Can an Android Phone be used as a Windows Hello Security Key?

Microsoft Windows 10 does support physical security keys since some time. Google recently announced that Android phones can be used as security keys as well (primarily for their own services). Is ...
2
votes
0answers
435 views

How to detect file or file system tampering

I would like to know if the following is possible: Is it possible to detect a file that has been put into my file system using back dating? Are there any trace artifacts left behind which can help to ...
2
votes
0answers
254 views

Is Windows RPC (port 135) secure enough for domain-wide access

I have a network of approximately 150 computers that I'd like to regularly monitor. My proposed way of doing so involves running remote commands like reg query \\<ip> or systeminfo /S <ip>....
2
votes
0answers
167 views

Extracted LM Hashes doesnt match actual password

I'm new to LM Hashing and Windows authentication, and I'm having problems with LM hashes. I've created 2 accounts with the password "123", and both of them have different hashes, and none of the ...
2
votes
0answers
1k views

Does Chrome cache smartcard PIN?

When I have authenticated with a server suing TLS/SSL using HTTPS using a smartcard and PIN and I invalidate the TLS session by restarting the server, refreshing Chrome browser does not reprompt for a ...
2
votes
2answers
470 views

What are the security features of the Microsoft PasswordVault class?

There doesn't seem to be much information on the PasswordVault but it seems to provide for local encryption of credentials. There are references to it in this source code and this blog. The reason I'm ...
2
votes
1answer
262 views

How does Malwarebytes intercept web traffic?

I use Malwarebytes and the web filter functionality puzzles me. As far as my research has found, antivirus engines typically use a proxy to intercept web requests which typically there would be ...
2
votes
1answer
315 views

Securely launch local application from IE?

I am facilitating an management system project in intranet environment(but with internet access for many domain users) for printing barcode labels from a web interface. 1. The current method our ...
2
votes
1answer
1k views

Odd Proxy setting in Microsoft Edge

Today I encountered odd proxy settings on a user's Windows 10 installation. Microsoft Edge had the proxy set to: use proxyserver The address field was set to: ...os=127.0.0.1:51144 The "port" ...
1
vote
0answers
81 views

Does Windows 10 log network activity?

I've been thinking a lot about private browsing recently. Here's a scenario I've been thinking about: Let's say I have a browser installed on my Windows 10 PC called "ChromeFox" (made up, it'...
1
vote
1answer
358 views

How to run PrintSpoofer in memory from powershell?

PrintSpoofer uses named pipe impersonation to elevate on Windows 10 to SYSTEM from a user with SeImpersonatePrivilege (Local Service, Network Service, Administrator etc.). The compiled version is ...
1
vote
1answer
149 views

Windows 10 master key folder empty

I am currently trying to decrypt my files from my old laptop. I have a backup of the user folder of the old laptop and I am trying to find the old user master key to decrypt my files based on mimikatz ...
1
vote
0answers
79 views

Is the ability to export HKEY_LOCAL_MACHINE\SAM and HKEY_LOCAL_MACHINE\SYSTEM as .reg files a security concern?

I am concerned that if it is possible to copy these as .reg files (without privs) and then (on another machine) reverse the .hiv files from them... this would probably be bad, which makes me think it'...
1
vote
0answers
80 views

Third-party P3P extension for Internet Explorer or Edge

P3P has been removed from Internet Explorer and Edge in Windows 10. Is there a third-party browser extension that, as a cookie filter, reads compact privacy policies and allows or blocks cookies based ...
1
vote
0answers
72 views

New Win10 and Old YubiKey4; trying to configure GPG Sign for existing key

I have been using a YubiKey 4 to sign git commits for a few years on Ubuntu. I am setting up a new Windows10 machine and want to use the same signing key from Windows; however I cannot seem to point ...
1
vote
0answers
142 views

TPM & Windows BitLocker: how does it work and is it secure?

When starting a BitLocker-encrypted machine with a TPM and Windows 10 installed, you aren't prompted to enter a decryption key. The system relies on Windows lockscreen for authentication instead. My ...
1
vote
0answers
77 views

Which Windows 10 login protects secure data?

Windows can protect sensitive data using CryptProtectData, which according to the Windows docs, encrypts data for a given program using the user's login password. But Windows 10 has several forms of ...
1
vote
0answers
62 views

Implied network privileges on Windows 10 apps?

If an app in the Microsoft Store only has the "userNotificationListener" permission listed, will it be able to send data over the internet? On https://support.microsoft.com/en-us/help/10557/windows-...
1
vote
0answers
165 views

"Something you have" on a multi-user device - what is the opinion regarding the NIST AAL3 definition?

The NIST AAL3 specification requires In order to authenticate at AAL3, claimants SHALL prove possession and control of two distinct authentication factors through secure authentication ...
1
vote
0answers
96 views

Why did something on my Win10 machine try to fetch a Windows patch-looking EXE from localhost today? (UPDATED)

[Tue Feb 11 10:37:00 2020] 127.0.0.1:49951 [404]: (null) /c/msdownload/update/software/defu/2020/02/am_delta_patch_1.309.678.0_2ed0992bc429bfc321a0209f24dcd8912733a2a5.exe - No such file or directory ...
1
vote
0answers
154 views

How should I install Kali Linux on my Windows 10?

I'm using Windows 10. I found several ways to install Kali Linux on Win10: Install it on VMWare Install it on Docker Install it on Linux subsystem (WSL) I might need to access some files in my ...
1
vote
1answer
518 views

Show confirmation popup before running any downloaded program in Windows 10

I often download files either using my browser or by torrenting. Few times, I encountered an attack where the torrented file was called something like movie.mp4.lnk and the target was set to run a ...
1
vote
0answers
79 views

saving entire Windows event log for auditing & preserve digital evidence

As an admin one gets tasked with configuring [Microsoft Windows 10] computers so that auditing is enabled and captures all events as required by some list that's already defined and handed down. ...
1
vote
0answers
83 views

WMI Performance Adapter function for Chrome browser?

Does someone know why the WMI Performance Adapter (WmiApSrv.exe) always starts when launching Chrome browser? Whats the function of this service? I have heared this service can be maliciously used to ...
1
vote
0answers
144 views

Why is smartscreen.exe trying to create `Bob the Builder - Bob Builds a Park.exe` on my computer?

I just finished using the Sysinternals tool called procmon.exe to determine which files were being used during a program's installation. I used the procmon filters to show me only file events in a ...
1
vote
0answers
75 views

How do you lock down a users access to ODBC settings in Windows 10?

I was working with a users computer yesterday because they complained that an MS-Access Database they were using said that an ODBC datasource was not accessible. I went to change the settings on the ...
1
vote
0answers
84 views

Remote access to Windows Workstation with credentials, after Windows 10 - 1809

I am a newbie in terms of OS security and I started learning from Windows; in particular I downloaded Win10 virtual machine and I am simulating various attack / defense scenarios on it. I would like ...
1
vote
0answers
131 views

How do I examine a fresh Windows 10 installation

I suspect an unauthorized modification has been applied to a fresh new installation of Win 10 x64 and/or a PC running it by a person who knows me personally with the purpose of tracking my activity ...
1
vote
0answers
140 views

How to block all aplications from internet connection?

I would like to block all windows10 applications from internet access So I found a settings screen on the windows firewall (Windows Firewall\Allowed apps) I would like to uncheck everything from this ...
1
vote
0answers
179 views

Why is there no SEH handler found in Windows 10?

I use immunity debugger and mona.py to find SEH pointer in Windows 10. Command is !mona seh. But it says no pointer is found. I want to know what has changed in Windows 10 to protect against this ...
1
vote
0answers
481 views

Decrypt to memory for editing

I am looking for a secure way to edit sensitive text data, using Git and Vim in the process. An ideal solution would be: clone the encrypted git repository into memory; decrypt into memory; do the ...
1
vote
0answers
84 views

Resigned Windows app showing warning when downloaded

We have an Windows desktop application signed using a GoDaddy certificate. The certificate expired recently so, for the latest upgrade of the software, we went through the steps of renewing the ...
1
vote
0answers
589 views

Microsoft is spying me. What can I do?

I was getting into my Windows 10 configuration and I saw a lot of options which are sending data to Microsoft. Telemetries, tracking, statistics... even sharing Windows updates on my PC to other users!...
1
vote
0answers
319 views

LastPass Secure Notes Leak? - Is Spell Check and Typing Telemetry of LP Secure Notes a Significant Leak in Windows 10 Edge Extension

LastPass is the first and only password manager extension for Windows 10 Edge in the Microsoft Store (Fall 2016). The LP Secure Notes appears to use the standard Msft spelling engine and dictionaries. ...
1
vote
0answers
120 views

Why was I able to run Sharpkeys even though it isn't signed and Windows 10 Device Guard was enabled?

It didn't trigger SmartScreen but it was still unsigned. I enabled Device Guard right after setting up Windows, so I'm pretty sure it isn't hacked I was also able to install and run TPfancontrol EDIT: ...
1
vote
0answers
176 views

Why does Windows realtime protection block specific URLs?

I have observed this strange behaviour with Windows (7 to 10). When active realtime protection is enabled, it blocks my own website. The page has nothing special (PHP and JavaScript), just good old ...
1
vote
0answers
322 views

Avast Sandbox Waking Computer from Sleep in Windows 10. Avast 2016 premium version

I typed in powercfg /lastwake into cmd and it told me an avast sandbox .exe had woken the computer. I've disabled sandbox and it no longer constantly wakes from sleep - within 30 seconds. I scanned it ...
0
votes
0answers
27 views

No UAC appearing for newly installed applications

Recently I have noticed that my system doesn't show the UAC prompt whenever I install some application from another source, I have UAC on and everything is working fine, I also have an administrator ...
0
votes
0answers
48 views

TPM and Windows Credential Manager

I'm working on a project that needs to store some encrypted data along with their keys on a Windows 10 computer. The problem is obviously how to protect the keys. My original idea was to use DPAPI ...
0
votes
0answers
87 views

Windows 10 user autologin password lost

A while ago I have set up the autologin for my Windows 10 user. I do not know the password anymore. I can login to the system (as has autologin now). But I cannot change the password. Is it possible ...
0
votes
0answers
65 views

Unsigned Intel item in start-up?

Autoruns shows three Intel items in my Windows 10 19043 start-up Two of them are signed, one of them is not. Unsigned = C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe When I say ...
0
votes
0answers
300 views

Is there a more convenient, yet safe, way to run DOSBox-X than I'm currently doing it?

I recently learned about DOSBox-X. It's basically a somewhat less awful version of the basically-abandoned DOSBox. I currently have it installed inside a Windows 10 VM inside of my Windows 10 bare ...