Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
5 votes
3 answers
970 views

Decrypt TLS 1.2 traffic between .NET Windows applications

I have attempted to decrypt traffic between two .NET applications (both on Windows platforms) using Wireshark but due to the Diffie Hellman with perfect forward secrecy, I cannot use my private key ...
user avatar
  • 161
3 votes
1 answer
280 views

There are many ports opened by system on a Windows 8 computer - are the system files modified?

There are many ports opened by system on one Windows 8 computer: PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows ...
user avatar
2 votes
0 answers
546 views

What legitimate services uses SAMR queries? And how to verify?

Recently I noticed that every few days, at (almost) the same time, one host is querying the Domain Controller for group members using SAMR calls. I am trying to understand why its happening ...
user avatar
  • 21
2 votes
0 answers
95 views

Is the RSA Private Key non-exportable option protected from key extraction?

I would like to know if the non-exportable private key option, virtualized based security, selected when importing an RSA certificate guaranteed although the user will never be able to see the RSA ...
user avatar
8 votes
1 answer
287 views

Is this Windows local code execution bug also a security vulnerability?

I stumbled on a Windows bug leading to code execution. I believe it should be categorized as a vulnerability but Microsoft does not recognize it as such. I would like to read other opinions. ...
user avatar
1 vote
0 answers
162 views

How can this "Jim Browning" YouTuber have access to all these scammers' PCs? [closed]

I've been watching these videos on YouTube about some British-sounding male (with millions of views) busting Indian scammers. It is never explained how exactly he is able to do this, with him ...
user avatar
2 votes
1 answer
106 views

How can I protect myself from intercepting messages sent to the server?

I want to collect certain data from my application using the driver and transfer it to the server to check its integrity. And I want to sign these packages using TPM to avoid forgery. However, a user ...
user avatar
1 vote
2 answers
163 views

Are there any risks involved with plugging smartphones into Windows 7-10 computer's USB ports?

When you plug a smartphone into a USB port on a Windows 7-10 computer, often a small message box pops up on the Windows device indicating that drivers are being installed. This happens automatically ...
user avatar
0 votes
1 answer
218 views

public MySQL via XAMPP - security - whitelisting IP's versus VPN

I'm working on app that uses MySQL database on XAMPP Control Panel on Windows. I am concerned about security part. I received advice about connecting to MySQL through VPN so it won't be accessible so ...
user avatar
0 votes
0 answers
96 views

Non-malicious root causes for multiple failed logon in windows domain

While monitoring SIEM alerts, I saw that there was more than 200 failed logon for a user to several hosts in the domain. Obviously, it was triggered as a brute-force attempt. Assuming it was not an ...
user avatar
  • 21
1 vote
0 answers
730 views

Purpose of SeDebugPrivilege for DLL injection

I have been recently working on a little DLL injection program in Go. While the program works and I am able to successfully inject into a remote process, Windows permissions system still seems to ...
user avatar
1 vote
1 answer
188 views

How does malware avoid AV's when using a simple DLL injection technique?

As far as I understand it, a simple approach for a malware DLL injection would require 2 DLLs. The first for the DLL side loading, while the malicious DLL remains encrypted. And then this 'loader' ...
user avatar
0 votes
0 answers
96 views

The incoming traffic was allowed on my home network for two days. How to assess the damage?

My router's firewall was set to accept incoming traffic for about 48 hours. Misconfiguration from a user, apparently. I have few devices on the network (two Windows PC, Freenas, printer, chromecast TV)...
user avatar
  • 1
0 votes
0 answers
53 views

Is it possible to verify that a USB adapter is not malicious? [duplicate]

I have some generic USB C-to-A and A-to-C adapters that were bought cheaply. I thought that if any of them had any advanced capabilities (other than being "dumb" adapters) such as mimicking ...
user avatar
  • 53
1 vote
1 answer
94 views

WebApp Windows Command Injection without "||"

I've found an application that allows arbitrary file upload (client side validation on file extensions), however those files are not stored in a folder which is accessible by the webserver, so a web ...
user avatar
  • 638
0 votes
1 answer
83 views

IPC Security on Server [duplicate]

An application is running in a customer's environment on a single server and consists of a collection of Windows Services that communicate with each other using (unencrypted) TCP messages. Although ...
user avatar
1 vote
0 answers
43 views

How am I supposed to trust binaries "submitted by anyone"? [duplicate]

I finally found a Chromium fork which appears to have made a serious effort to remove all the Google cancer. Sadly, I see this: https://ungoogled-software.github.io/ungoogled-chromium-binaries/ ...
user avatar
  • 11
2 votes
0 answers
130 views

Are there any wormable vulnerabilities for legacy Windows operating systems that are left unfixed?

I want to know the status of remote, code executing vulnerabilities of old Windows operating systems that are left unfixed, if they exist at all. Exploits like EternalBlue or BlueKeep wreaked havoc on ...
user avatar
0 votes
1 answer
397 views

Is flash less secure now that it is End of Life? [closed]

As of this month, the Flash player has been disabled from all mainstream browsers. However, several platforms are still offering ways to use Flash content, most notably the games hosted on said ...
user avatar
2 votes
1 answer
285 views

Can a driver(malware) hide it self from device manager?

For security reasons, I have this question in mind. I am not a security professional, so I want to ask: Let's suppose my computer's firmware is hacked. If I disable the wifi driver on windows, can a ...
user avatar
  • 35
1 vote
1 answer
175 views

How do I isolate/compartmentalize different use cases on one machine?

I have a decently powerful desktop running Windows that I use for 2 different use cases: playing games and storing/processing my personal data. As a security-aware person this makes me uncomfortable. ...
user avatar
1 vote
0 answers
101 views

Removing PATH from the Windows DLL Search Order

There exists a class of bugs on Windows where an unprivileged attacker can write a DLL to a location on disk, then add that location to the PATH variable. Then, when an elevated user process is trying ...
user avatar
2 votes
1 answer
298 views

Windows service with elevated privileges - Security concern

The company I work at uses a program on their Windows workstations that runs as the logged-in user but some tasks require elevated privileges. The user must be able to run these without having admin ...
user avatar
  • 45
0 votes
0 answers
39 views

Is it possible for someone to "peel back" an image layer? [duplicate]

I am on a Windows 10 machine using Chrome (latest updates). I took a screenshot of Instagram, because I was having problems logging in, and then using Paint 3D applied a black rectangle to hide my ...
user avatar
1 vote
1 answer
163 views

Why do administrators create passwords vulnerable to kerberoasting? [closed]

I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
user avatar
  • 13
2 votes
1 answer
260 views

How do I add 2FA to my personal computer?

I have a Windows 10 PC that I would like to protect a little better. I've looked for solutions online, but they're all business oriented. What I would like, in an ideal situation, is having to enter ...
user avatar
  • 155
5 votes
1 answer
471 views

Windows group policies to protect against Rubber Ducky attack

I have these group policies set on my personal computer and it seems to me they should protect against Rubber Ducky attack (however I've read other threads that say it's hard to protect against, hence ...
user avatar
  • 53
1 vote
0 answers
386 views

msfvenom: how to output assembly of windows payload for inline assembly in C?

My goal is to obfuscate metasploit windows payloads' assembly code (adding junk code to the payload itself), then adding the obfuscated shellcode to inline assembly in C. The issue is there is no ...
user avatar
1 vote
2 answers
259 views

Can someone know who created a cpp file?

I know that one can see the modification, access, and creation date of a file on Windows. And that the creation date, as well as other dates, can be modified at will. I just wonder if it is possible ...
user avatar
  • 179
0 votes
1 answer
123 views

Web scraping is safe for security?

I'm working on web scraping and data mining for Alexa top-ranked websites in the world. I was doing that with node.js, Axios (for HTTP request), on a Windows machine (especially on WSL bash). After I ...
user avatar
2 votes
0 answers
116 views

Why do Windows AV software detect strings with case-sensitivitely?

As Windows is case-insensitive, the string mimikatz can be evaluated the same as MIMIKATZ or MimIkaTZ. A naive method of AV evasion by switching cases of some characters in suspicious string has been ...
user avatar
0 votes
1 answer
417 views

Can I elicit responses from "any remote host" on "all protocols" if I want to?

An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”. After some research, this is something that can be exploited. It is explained here that: By default, WSDAPI will listen ...
user avatar
0 votes
1 answer
112 views

Windows Firewall allows the connection to more than one user who shares the same external IP address

I wrote a stand-alone anticheat. When the client anticheat connects to its server, the server creates a firewall rule allowing the game client to gain access to the server. The problem is the firewall ...
user avatar
28 votes
5 answers
7k views

Is a password-protected stolen laptop safe?

Let's assume I have a Windows 10 computer and my login password has an entropy of infinity. If I did not encrypt my entire hard-drive, does it matter how secure my password is? Is it possible for ...
user avatar
  • 809
0 votes
1 answer
160 views

USN Journal leaks information on exFAT-hosted files (in VeraCrypt containers)

I'm using a secondary drive to store encrypted files, in VeraCrypt file containers. Unfortunately, even if the external drive is formatted as exFAT, Windows leaks information on files inside mounted ...
user avatar
  • 103
0 votes
1 answer
209 views

Spoof publisher info on Windows applications

Let me start by acknowledging that I have absolutely no experience with Windows development and this is purely for academic purposes. I apologize for incorrect terminology and welcome corrections or ...
user avatar
  • 1
8 votes
2 answers
265 views

Do people even exist who actually vet all the updates to their open source software?

A year or so ago, I set up this system which, whenever Composer (that's PHP's packet/library update manager) fetched new updates to my few (but critically required) third-party libraries, created a ...
user avatar
  • 81
0 votes
0 answers
259 views

Avast Remote Access Shield is blocking unknown remote access attempts to my computer (Win10) coming from a MacBook device on my LAN. [Confused]

I need help understanding what is happening on my LAN and determine if a malicious attack is taking place. The "attacks" started to occur for the first time last night. This morning, I open ...
user avatar
  • 101
1 vote
1 answer
570 views

How to generate a config file from a .csr using OpenSSL (or other)?

I want to export the configuration details from an existing CSR or Certificate to a config file which I can use with OpenSSL to generate a new CSR. Background Our CA has changed. For the old one, I ...
user avatar
4 votes
1 answer
3k views

What are the privacy implications of the "Your Phone" app on Windows?

I'm trying to decide whether or not to use the Your Phone app on Windows, and not finding much information on it. It requires a Microsoft account, but I don't really see why that should be necessary ...
user avatar
  • 2,492
0 votes
1 answer
2k views

Is it safe to use an executable if only unknown antiviruses detected something?

Recently I downloaded Open Shell application and checked it via VirusTotal. Most famous antiviruses like Bitdefender, Nrothon, Kaspersky found nothing. But some of antiviruses thing there are some bad ...
user avatar
  • 225
6 votes
1 answer
292 views

CertGetCertificateChain doesn't recognise revoked certificate if the reason is "unspecified"

In my program I use CertGetCertificateChain to investigate the validity of certificates. If in my test PKI I revoke a certificate and specify the reason "unspecified", the error code in the ...
user avatar
  • 163
0 votes
0 answers
132 views

How to prevent my ISP from seeing what sites I visit without a VPN

I use opera browser, and while the built-in VPN has been working relatively well it's been preventing me from joining discord voice calls and using omegle. Is there a way to hide my activity from my ...
user avatar
0 votes
1 answer
109 views

Information disclosure via ktpass tool

The Microsoft ktpass tool can be used to generate a .keytab file that contains a secret key. I'd like to understand the output of the tool. An example output can be found here. I'm interested in the ...
user avatar
3 votes
2 answers
487 views

What are the security risks to have admin rights for a user account on Windows 10?

I am considering the security risks to have a standard user added to the Administrators group on an enterprise Windows 10 machine that is dedicated to that user. This is related to security only, so ...
user avatar
  • 8,925
0 votes
1 answer
197 views

How are games and software executables injected with custom code & without breaking offset?

Introduction – Context Everyone has seen so called "Injectors" or "Cracks" for certain programs & games at some point in their life. These applications inject their own code ...
user avatar
0 votes
2 answers
8k views

How to dump the memory of a given process with Volatility 3?

It seems that the options of volatility have changed. How can I extract the memory of a process with volatility 3? The "old way" does not seem to work: If desired, the plugin can be used to ...
user avatar
  • 111
0 votes
1 answer
175 views

Directory to place files on windows

on linux when we have a foothold and we want to transfer files to the victim we usually transfer it to /tmp beacuse it is writable and always there. what directory should we transfer our files if we ...
user avatar
  • 27
8 votes
2 answers
3k views

Can BadUSB be avoided by looking at the shapes and the controller model inside it?

I'm an average user. I don't take part or have any dangerous jobs. I know that there is no fixed solution for this type of attack. However, I think USB is still become common devices for average user. ...
user avatar
2 votes
1 answer
195 views

Is the MIT implementation of Kerberos protocol as vulnerable as the one used by Microsoft?

I am doing some research for school about the Kerberos protocol and its vulnerabilities, especially the Pass the Ticket attack. Related articles are always talking about Active Directory so I was ...
user avatar
  • 21

1 2 3
4
5
43