162

It's worth noting that your first link is in relation to the Windows Insider program. The Windows Insider program provides you with pre-release software that does call home with usage details and other information. This is something that you agree to by installing the Windows Insider preview - if you don't like it, you don't have to install it, it's ...


90

Nope. After Microsoft discontinue security updates for a version of Windows there is not a safe way to run that version of Windows. Some people will promote Virtual Patching where you have a external firewall scan all your traffic looking for patterns of traffic that look malicious. I would not trust that, and it requires a seperate non-vulnerable ...


66

Here is what they spy on, finally officially admitted after being proved again and again by different independent sources. That should make a pretty good idea on what actually is transmitted. To actually see what's being reported you can give yourself permissions for %ProgramData%\Microsoft\Diagnosis directory and look what's in there, but the file are ...


38

If the ransomware gains administrator access to your computer then it can damage any backups that the Windows machine may have created on that computer. If the ransomware only acquires non-administrator access (i.e. you use a non-admin account for web-browsing) then those backups will be safe. The best thing is to back up to a removable storage device. (...


38

Memory dumps often have document contents It's worth noting that if you're sending a memory dump of a crashed application at the moment of its crash (which is a reasonable way of analyzing crashes) then that memory dump is very likely to include the contents of whatever document(s) were opened in that app at the time. So if you're "just" sending app crash ...


34

No, anti-malware is not a replacement for security updates. Neil Matz summarized the Fortinet's Q2 Global Threat Landscape report for 2017, noticing: WannaCry and NotPetya targeted a vulnerability that had been patched by Microsoft a few months earlier. But it’s not just these high-profile attacks that target recent vulnerabilities that are the ...


23

The difference in modern version of Windows is that Autoplay is off by default, but it is still available and can be enabled. However, if you do not know the current Autoplay configuration of a Windows machine, you should check it before inserting a suspect stick.


22

With a Windows Profile you can see a portion of what's been collected. Expanding on Flyk's Last point. Microsoft Updates will be turned on by default with a peer to peer model for updating over your LAN or LAN and the Internet. Cortana seems to be the main intrusion with Windows 10. Optional extra's include linking to Office 365 linking to Power BI for data ...


17

It looks like you installed Cybereason RansomFree. This writes two folders with 'random' file names to each of your partitions, and one to the desktop labeled This folder protects against ransomware. Modifying it will reduce protection* (which you will only see if you have configured Windows to show hidden/system files). The program monitors these folders ...


14

The System Volume Information folder only contains files backed up by System Restore. That is, it won't protect your personal files should they get overwritten by malware, it will only protect Windows system files. Additionally, although you cannot by default get access to this folder, if you were to take ownership of the folder as administrator (or with ...


13

Graham Hill's answer is absolutely correct in my opinion! I just wanted to add, that there are different ways where usb sticks could harm/infect your computer. Have a look at Bad USB for example.


13

Although you ask specifically about Autoplay, I take your question more generally to be; Can I trust newer operating systems like Windows 8 or 10 to [protect me when I] insert a USB stick? To which I answer, NO, you can not trust any operating system to protect your computer from any USB of unknown origin. You should not plug in any untrusted USB into ...


11

It decompresses just fine for me... I converted the Base64 string into binary, then ran gunzip on it (I am using a Linux system here). This results in another piece of PowerShell that does things which can only be considered as definitely fishy. It contains a piece of 450 bytes, that it loads into (native) RAM, and runs as code. I am way too lazy to ...


11

I am aware of the following features: Windows Hello - A new authentication system, which will replace passwords with a combination of biometrics and public key crypto. This will eliminate "pass the hash" attacks. Private keys will be stored on the TPM. Biometric authentication to the local device can use fingerprint or facial scanning. The facial scanning ...


11

Is Windows 10 Leaking my IP Address? Almost everything is leaking your IP address. I'm going to avoid telling you your IP address isn't secret. You seem to already know that. Instead, I'm going to tell you what you're looking for: Yes, Windows 10 leaks information about your IP address ten over a hundred times until Sunday, even if you're behind a proxy! ...


11

There is no realistic substitute for software patches. There are additional security measures one can take, but all of them have their limitations. Antiviruses will not do a thing against attacks that do not write to disk. If an attacker hijacks a legitimate process in memory, it's open-season on your data. These kinds of attacks are becoming more and more ...


10

This is the whole passage (source: https://privacy.microsoft.com/en-us/privacystatement): Finally, we will access, disclose and preserve personal data, including your content (such as the content of your emails in Outlook.com, or files in private folders on OneDrive), when we have a good faith belief that doing so is necessary to: comply ...


9

Here is a suggestion for your case. You need an extra laptop with both cable connection and wifi connection. You, then bridge the two connection and enable the Internet Connection sharing function from the cable to the wifi. By that way, your laptop's wifi become an access point. Next, you install Wireshark on this computer and set it to monitor the wifi ...


9

A quick search turned up the link below. They created a new technology called CredentialGuard, which isolates secrets in virtualized secure environments rather than storing everything in LSA like they used to. Mimikatz can no longer just dump lsass.exe process memory and parse the contents. They're still in some memory, strictly speaking, but not memory ...


8

Windows 10 contains many new features and many existing features from previous versions of Windows that have been expanded on or improved such as Windows Defender, Windows Firewall and Bitlocker. Windows 10 also includes the following new features: Device Guard When enabled, Device Guard checks to ensure that every application is signed by Microsoft as a ...


8

This is a chrome notification. No local malware. You must have accidentally allowed notifications in chrome for aparat.com. Try following these steps to disable notifications. Alternatively, click on the cog wheel at the top right when this appears again. Generally, websites can use the notifications API to send notifications to your device. This website ...


8

One option would be to use Windows access controls to prevent changes to the firewall rules. If you first set the rule to Disabled (or simply deleted it), and then changed the ACLs on the firewall rule storage, it should be possible to avoid the rules re-appearing. While any administrator account could overwrite or bypass your modified ACL, it is highly ...


8

The existence of a watchdog timer (software or hardware) has no security implications. A watchdog is a timer that is used to detect hardware or software lockups. A watchdog timer counts down and, if it ever reaches zero, it will assume the system has frozen and will take corrective action (such as by rebooting the computer). In order to prevent this from ...


7

Since your IP address is essentially the internet equivalent of your postal address and since it is required for routing your request (and especially the response) over the internet, any website that you connect to will have access to it. Any email server you connect to will have access to it, etc. Every time you connect to another computer, that computer ...


7

"Authorized Applications" does not equal "Open Ports." These applications have authorization to communicate through the firewall...This does not mean that they're listening on ports open through the firewall. In the case of many (if not all) of the application you listed, that means that when you open them and try to use them, they can establish ...


7

There is a lot of hyperbole in tech journalism, just as there is in other journalism. While Windows 10 does indeed collect a lot of data about you, some of it being the result of key strokes, it does not come with a keylogger in any traditional sense of the word. The first article you linked to talks alot about the privacy policy of Windows 10 and what it ...


6

Posting this in an answer, because it's too big for a comment: I don't know what it does (though it does look sketchy) but here's the expansion. It's a PS script itself, of course: function t2Mj { Param ($hVrV8B2fWj, $zfOqpP8) $mJnysoxSPX = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_....


6

[The question "what could go wrong" is rather broad, so this is not a definitive answer. I am also not a Windows certified security professional, I'm just spitballing.] @CaffeineAddiction points out that when you leave a computer locked, all your user-level processes are still running. Imagine that an attacker is able to plant a backdoor, like running an ...


Only top voted, non community-wiki answers of a minimum length are eligible