Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
2 votes
1 answer
671 views

RDP logout necessary to prevent RDP session hijacking?

We recently got a strengthened security policy where people are required to log out of any RDP connections at the end of the day. So when I turn off my laptop, it is not enough to merely close the RDP ...
18 votes
2 answers
153k views

How do we determine the SSL/TLS version of an HTTP request?

We are wanting to configure our Windows client to use only TLS 1.1 and greater. We've learned that we can do this by editing the registry. Now we want to make several HTTPS requests from different ...
2 votes
3 answers
6k views

Potential consequences of using "Everyone" to manage permissions?

If a web application is set to run using a specific account, could a malicious user do something they shouldn't if I use the "Everyone" account to manage permissions on a folder on the server? The ...
0 votes
0 answers
160 views

What information does the Microsoft Intelligent Security Graph use for querying files?

I'm looking into WDAC and the option to use Microsoft's ISG for files that are not explicitly allowed or denied caught my interest. Unfortunately I haven't been able to find any information on what is ...
3 votes
2 answers
9k views

Is it possible to stay anonymous on Windows 10?

After reading some information on anonymity, I noticed that almost all sites stated that Windows 10 does not really allow you to stay hidden online, even when using services like Tor. I would like to ...
1 vote
2 answers
348 views

Can any program discover my precise geolocation?

While browsing the internet on my laptop, I've allowed an internet site to access my location data. What I had expected was that it will show the name of my city based on my IP. I was quite shocked ...
0 votes
1 answer
211 views

Do viruses survive in other drive and than re infect after resetting the PC?

Backstory: I got infected while installing some shady software and at that time I kept Windows Defender off, (I have very much faith on my shady website) by turning its features off. But when I ...
1 vote
2 answers
784 views

SIM card used with smart card user certificate

Is it possible to put a smart card user certificate (Windows) on a SIM card? (SIM card already has telecom info on it). I'm using Win 2012 and have tried, but I am getting this error "smart card ...
1 vote
1 answer
1k views

How to decrypt LockBit encrypted files

I've got an emergency on my PC. I remotely connected to it using Remote Desktop Connection a couple of days ago and I worked on my PC for a while and logged off. Later, when I went to log back on, I ...
3 votes
5 answers
14k views

How can I sandbox a Wine application on Linux?

I would like to run Microsoft Office programs such as Word but do not trust them, nor should anyone. Without running a virtual machine, is there a good way to sandbox a windows application to run on ...
1 vote
1 answer
2k views

Found KeyLogger in Windows 10 OS?

I was Running Yara, The pattern matching swiss knife for malware researchers on the Windows 10. I ran a scan using rules from Yara Rules from YARA Rules Github and MalwareConfig rules. I stumbled ...
3 votes
0 answers
204 views

Does Windows 10 read/run/care about USB devices plugged in "Lock Screen" mode?

Whenever I leave my computer for the bathroom or anything inside the living space, I press WinKey + L to enter the "Lock Screen" mode. (If I go outside, I turn it off completely.) Let's say ...
0 votes
1 answer
114 views

Using a program that likely has a trojan horse? [closed]

OP wants to back up his Blu-ray/4K collection to a HDD. OP suspects that a very popular program that makes MKVs is actually a trojan horse that infects host computer's USB drives, which can later be ...
2 votes
3 answers
486 views

I installed a windows app that stores cookies in a plain text un-encrypted database. Is this a problem?

I have recently installed an application that was developed with Electron that requires I authorize via Google to use the application. I did this at the same time as monitoring the application with ...
0 votes
0 answers
3k views

Windows hello pin removal/crack

Is there a workaround to the Windows 10 Hello PIN security login policy? The PIN is the only credential needed to log in, no password is set, checked with samdump2. I inherited this computer from a ...
1 vote
0 answers
414 views

API hooking with Microsoft Detours

I want to hook certain API calls, e.g. CreateFile (or NtCreateFile if I hook ntdll.dll), but there are some issues. I can use several methods to achieve this goal, e.g. DLL injection, Inline hooking ...
0 votes
1 answer
218 views

Can flash drive infect Android and then the Android infect Windows PC?

I found a flash drive outside my home. Thinking one of my neighbors might have dropped it and wanting to return to them (but still wanting to be cautious), I (stupidly) plugged it into an old Android ...
0 votes
2 answers
314 views

How can code signing posibly be secure on Windows when signed executables act on unsigned input?

As a security measure, my Windows-based work computer has been configured to deny any application that hasn't been signed with a valid certificate; my system will run a signed executable from DropBox'...
0 votes
0 answers
125 views

Downloaded malicious VSCode version

I just downloaded VSCode and after running the setup, which wouldn't give any response, I noticed that the setup.exe came from an obviously fake website. The website was the first to pop up upon ...
5 votes
3 answers
4k views

Is my data secure in locked screen if I use bitlocker

My SSD is currently encrypted by bitlocker right now. So let say if I leave my laptop on locked state (Win+L). Is it possible for someone to get access to my data? Few thing I noted are: If someone ...
2 votes
2 answers
2k views

Can product keys harm computer?

I downloaded Windows from Microsoft website. Then I type in (or paste) a product key that I bought from an unofficial seller to activate Windows. Can that lead to any security issues?
1 vote
1 answer
360 views

Using other programming languages for malware against EDR?

As an example, one of the most basic malware to inject into a process to get a C2 beacon goes like this: Get Handle of a process -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread ...
199 votes
10 answers
35k views

Search for military installed backdoors on laptop

My laptop was confiscated by the military institute of my country and they made me to give them all my passwords (I cannot tell you the name of my country). They did not give it back to me for one ...
1 vote
2 answers
480 views

Is Windows 10 Home more secure than Windows 10 Pro in some way?

I'm planning to do a fresh install of Windows 10 on my mother's computer. Despite it has Pro version right now, I wonder if I should use Home version instead, which is also called Single Language. ...
2 votes
2 answers
713 views

What's the point of Empire if all payloads get flagged?

I've been reading about how powerful frameworks such as Empire and Metasploit are but I'm confused about something. Say I gain access through a custom reverse-shell which I self-coded (so it bypasses ...
1 vote
0 answers
2k views

How do I convert any arbitrary .EXE to .DLL, in order to bypass program restrictions?

On a computer that blocks third-party programs, I figured that you could use use PowerShell and C#'s DllImport() function to import a native C program as a DLL and run it, and the program would simply ...
1 vote
1 answer
462 views

Is it still recommended to block Living Off The Land Binaries (LOLBins) in Firewall?

https://lolbas-project.github.io/ Realistically, do we still need to block cmd.exe or certutil.exe in Windows firewall, on latest version of Windows? Lolbins are for Linux too but my question is only ...
1 vote
0 answers
133 views

How would I communicate with my computer from a remote server when I'm using a VPN? [closed]

I have a computer at home. It's connected to the Internet. I use OpenVPN on Windows 10 to auto-connect to a VPN at startup. Now, I would like for a remote computer to make some sort of network ...
2 votes
0 answers
460 views

Why does MS Teams establishing outbound connection towards malicious IP? [closed]

I'm wondering how come an internal "Teams.exe" can make outbound connections to a malicious IP, 132.147.119[.]217 (ISP: ViewQwest Pte Ltd) that was flagged as malicious and also was involved ...
0 votes
0 answers
1k views

ERROR kuhl_sekurlsa_acquireLSA from customized mimikatz

Tried to call sekurlsa::logonpasswords function from mimikatz main source, but I get ERROR hl_aaaurlsa_acquireLSA ; Logon list The program is executed with Administrator cred and I'm sure there's no ...
11 votes
3 answers
4k views

Why create a CSR on my own server to have it signed by a 3rd party?

I am looking into our current website certificate-management process and am looking for steps that may be unnecessary and can be simplified. The current process was created by our sysadmin who now ...
4 votes
1 answer
358 views

Would secure boot block GPU if it has modified vbios?

I think that AMD GPUs can be flashed with any modded VBIOS because the GPU doesn't check for firmware signature. Shouldn't the secure boot be able to check signature of the AMD GPUs modded VBIOS and ...
2 votes
0 answers
1k views

Responder not collecting hashes in most cases

I've recently become curious on how AD works and how hashes are shared between Windows machines. It's very interesting how there are so many ways to get Windows programs to leak hashes, for example ...
0 votes
0 answers
754 views

Block all windows system outgoing internet connections but allow LAN on Private and VPN on Public

I have several windows PC connected to my mikrotik. I use basic features: file sharing, playing games with friends on home LAN and want to connect internet only through VPN (openVPN client). But I am ...
0 votes
0 answers
237 views

Responder still catching hashes with LLMNR and Netbios over TCP/IP disabled. Is this by design?

My responder is still catching hashes from Windows 10 box that has had Netbios over TCP/IP (DHCP scope option) and LLMNR disabled (GP). The workstation invokes the net view \\responderip and responder ...
1 vote
1 answer
401 views

How can I share web-platform credentials across multiple desktop apps on Windows?

I have two desktop apps, each authenticate against our server using OIDC in order to call our web api. Currently the users need to login independently in each application. I noticed when using ...
0 votes
0 answers
170 views

Requests to malicious IP being sent by background process on Windows

Whenever an internet connection is established on my pc, I am repeatedly getting warnings from QuickHeal like this: I am getting such warnings repeatedly with different IP addresses. In the above ...
0 votes
1 answer
647 views

How to safely run an untrusted program that needs to be run with admin privileges?

We use Hikvision cameras and with that comes LocalServiceControl.exe which needs to be running to see video streams from cameras in a web browser. This exe requires to be run as local admin which is ...
-3 votes
1 answer
122 views

Hiding a certificate [duplicate]

Is it possible to embed a TLS certificate into an application or hide it somehow so that it’s not so easy for a user to just export it from cert manager on Windows? Or does all certificates have to be ...
1 vote
0 answers
445 views

Enabling ECDH KeyExchangeAlgorithm in Windows Schannel while disabling CBC based ciphersuites

On our Windows Servers, we have disabled the following key exchange algorithms in registry SCHANNEL\KeyExchangeAlgorithms\ECDH SCHANNEL\KeyExchangeAlgorithms\PKCS This leaves us with only 2 ...
1 vote
0 answers
373 views

Cracking passwords following rules with John or hashcat

I would like to crack the forgotten password of a very old archive file (rar) with JTR or hashcat. I remember it was starting with a certain number from a set of numbers e.g. prefix number from the ...
-1 votes
2 answers
586 views

How to backdoor windows?

Studing pentest, I was astonished by how easy it was to backdoor a Linux machine after I got root. I just needed to compile a program like this: #define _GNU_SOURCE #include <stdlib.h> #include &...
1 vote
1 answer
199 views

Is there a way to enforce a user password challenge for a certificate every single time in Windows Security Policy?

In Local Security Policy configuration, I have set System cryptography: Force strong key protection for user keys stored on the computer to value User must enter a password each time they use a key. ...
3 votes
2 answers
17k views

Does Chrome OS Allow Executable Files?

My company has some real security issues and I am wondering if using Chrome OS can be some solution to my problem. Typical Windows computers seems all to vulnerable to attacks from malicious images ...
0 votes
3 answers
4k views

How exactly is a fingerprint stored in Windows Hello? Why is it claimed to be more secure than a password?

I can't quite imagine a scenario where fingerprints can be stored in a way that defeats the weaknesses of password storage (i.e. pass the hash attacks or password reuse). Moreover, I couldn't quite ...
2 votes
1 answer
2k views

Find out what process is trying to initiate a connection in Windows

I'm not trying to find established TCP connections. I have a Windows 2008 R2 server and my host-based L3 firewall is showing one TCP connection ATTEMPT to a remote address. The connection is not ...
0 votes
0 answers
576 views

Self-signed certificate chain verified by OpenSSL but Windows says leaf is invalid

Let's say I have rootCA.crt, intermediateCA.crt and leaf.crt. I used openssl to veriy leaf.crt: cat rootCA.crt intermediate.crt > chain.crt openssl verify -CAfile chain.crt leaf.crt and it said ...
0 votes
1 answer
1k views

Is there a way to get Windows login password hint from SAM hive with volatility?

We know that every user in Windows has a password hint. This password hint is stored in the SAM hive, more specifically in the SAM\Domains\Account\Users path. Is there a way to extract this password ...
3 votes
2 answers
326 views

What program can Decrypt specific a Folder/Files during Windows Boot/Loading? (Windows)

I've been looking into Encryption of my data for some time now; I've decided to move ahead with VeraCrypt for encryption all of my partitions (I have 2 disks in 1 laptop) except for the OS (C:) ...
2 votes
1 answer
78 views

Is the Windows Security Protection History shared with my employer if I'm logged in on a work laptop?

I have a laptop with an Office 365 company account. I work from home, but I obviously have some company policies running, since I get the 'Your administrator has blocked this action' messages in my ...

1 2 3
4
5
45