1
vote
1answer
27 views
What about AD2P vulnerability?
My goal is to create a simple one-way intercom using B Speech TX2 and B Speech RX2, an Audio2Bluetooth and Bluetooth2Audio converter.
My question is, how secure is the audio(in my case voice) being ...
2
votes
2answers
50 views
Is KeePass a good defense against keyloggers?
KeePass is a program in which you can store your password and copy and paste them into websites. Does anyone know if it is safe against key logging software? Does key logging software pick up what you ...
0
votes
2answers
21 views
Looking for safe, simple way to store passwords with PHP 5.2.17 [duplicate]
I've found many posts on StackOverflow and other sites using Google, but since security is always changing, and what was safe a few months ago not me anymore... I felt the need to ask on here.
...
-4
votes
0answers
21 views
MAC osx strange behaviour [closed]
I have a mac desktop that has worked well for years.
Max osx 10.8 lotsa tols and software installed.
Some how a new window has appeared ![enter image description here][1]What is this??
I do have a ...
0
votes
1answer
33 views
Indexed link is taking to google brazil
It's happening in FF and Safari - Chrome works fine.
That, if I search for courfleurie.com in one of the two browsers, and when I click on the link, there, I am taken to google.com.br
I can visit ...
-1
votes
0answers
24 views
How much can I recover memory data from memory dump created when BSOD occurred?
Let's say in Windows 7 every Windows setting is set to default. Computer suddenly goes onto BSOD, and creates memory dump automatically. In this case, how much would one be able to read into memory ...
1
vote
1answer
42 views
Can Windows 7 hibernation files be recovered?
As curiosity, according to my knowledge, hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data ...
5
votes
2answers
130 views
Using EnCase to recover InPrivate browsing history
I heard that it is possible to use EnCase to recover IE InPrivate browsing history. Is this really possible?
If so, suppose that a computer has been shut down right after usage of InPrivate browsing ...
5
votes
3answers
210 views
How to find live hosts on my network?
I am trying to find the live hosts on my network using nmap. I am scanning the network in Ubuntu using the command sudo nmap -sP 192.168.2.1/24. However, i am unable to find the live hosts. I just get ...
4
votes
1answer
65 views
How to secure application VM?
This question is derived from my previous question on Isolating Web application where two approaches were recommended.
Apache Chroot Jail
Isolation through Virtualization
My question is if one of ...
8
votes
2answers
371 views
“Friend” stole SD card. Tracing an SD card?
First off, let me say that I currently live in Mexico, a land filled with petty theft. I had a group of friends over last night, and they were looking at the photos on my camera. Today, I looked at my ...
-2
votes
0answers
24 views
Enable hardware virtualization in samsung netbook(Pheonix secureboot Setup BIOS)? [closed]
I have searched all the setting in my bios but coud not find a way to enable VT.
I have Pheonix Tech motherboard with an Intel Core i5. It supports VT according to the Intel Tool. When i run Apple ...
-4
votes
1answer
89 views
Am I part of a botnet or hack?
(FYI: my network has been hacked before...see other thread).
I have 2 routers daisy-chained. Router #1 hosts Windows PCs and a VOIP box on subnet 172. Its LAN4 goes to WAN of Router#2, which serves ...
-2
votes
0answers
65 views
History of RAT + Strange networking recently… was I hacked again?
(FYI, my PCs were infected and remote accessed in the past by a friend/stalker, & I’ve reinstalled the network few times already. Recently added Router#2 to double-NAT).
My network has 2 routers ...
3
votes
5answers
85 views
Is cookie-based XSS exploitable?
Today I've found interesting site that output your cookie value directly to the page, so if I modify the cookie value I can XSS myself.
e.g <span id=statistics>Last visit: ...
0
votes
1answer
46 views
What triggers a Firewall to block a TCP Socket?
I was wondering what would cause a Firewall to block a TCP Java Socket from connecting. What would trigger that? Thanks!
3
votes
1answer
105 views
Known plaintext; What cipher is being used here? [closed]
plaintext: CANDY VERY CRANBERRY
ciphertext: TXOtWjYhVk 8&O$4AmSA
plaintext: http
ciphertext: cZf.
plaintext: http
ciphertext: r5Hz
This is definitely somehow decodable from ...
-3
votes
0answers
33 views
VirtualBox Guest OS Backtrack 5 cant access Internet [closed]
My Host OS is windows 7 Home Basic (64 bit).
I am using Tata Photon Plus (India) Wireless device to connect Internet.
My Guest OS is Backtrack 5 64 bit.
I am not able to connect to Internet from ...
4
votes
1answer
37 views
'Trusted CA Certificates' and 'Trusted remote Certificates'
What is the difference between Trusted CA Certificates and Trusted remote Certificates?
3
votes
3answers
119 views
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted?
Given that it's possible to fake ID cards and fake social security numbers are created, I need to ensure that all users of my site are US or UK based citizens, and don't have more than one account.
A ...
-4
votes
2answers
57 views
Can a windows phone be traced without a SIM and battery [closed]
I lost my lumia 800 mobile two days back. If the sim and battery is removed can it be traced with the IMEI number by the cops if I lodge a complain? Or can the location be traced if a new sim is used ...
0
votes
1answer
85 views
Please recommend scanner that allows to find XSS and SQL injections vulnerabilities for Web Application [closed]
We develop Web Application:
Platform is Redhat 6.3/6.4
Presentation tier is JSF2
Persistence tier is Hibernate
Server is JBoss 4
Database is PostgreSQL 9.0.13.
We want to run scanner during our ...
0
votes
0answers
19 views
Why this k parameter is in unary in adversary PPT algorithm? [migrated]
While reading some text on cryptography, I found that algorithm A, that the adversary (called Eve by convention) runs to break the cipher message, needs two parameters, candidate message (y) and ...
3
votes
1answer
57 views
Do websocket-powered web apps (e.g. “comet” apps) have to worry about CSRF?
The standard advice for HTTP applications wanting to prevent Cross Site Request Forgery is to include a random token on each state-changing request (usually POST) which is verified by the server ...
-3
votes
0answers
44 views
User entered Javascript security implications [duplicate]
I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? ...
5
votes
2answers
82 views
User entered Javascript security implications
I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? ...
3
votes
2answers
125 views
Login with a hash. Is this secure enough?
I need to provide store's clients with a tool to check the status of their repair orders.
The clients doesn't have a user or password. They are only a record in the database. Yet I need to give them a ...
2
votes
2answers
57 views
Is it safer to store the XSRF value inside your JavaScript?
To protect yourself against XSRF, you need to have a separate token on a page.
See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood
As the posting suggests, its best to have those ...
3
votes
4answers
45 views
How to prevent restrict access to a web application to authorized devices only?
I have developed an MVC web app.
Right now, the client using this app in office area.
The client has requested that no one should use this app on any device except the office's PC/tablets.
Now ...
20
votes
4answers
405 views
Detecting skimmers and other ATM traps
This question has been bothering me ever since I first heard of ATM skimmers:
Instances of skimming have been reported where the perpetrator has put
a device over the card slot* of an ATM ...
3
votes
5answers
75 views
Why can we not block DNS Amplification attack by blocking UDP packets or DNS response packet?
I mean if the attacker tries to ask all the open DNS resolver respond to a web server. The web server can just block its UDP ports.
If the all the DNS response go to a Authoritative ...
3
votes
2answers
30 views
Change 'Key Usage' of a certificate
Is it possible to change the 'Key Usage' property of an existing ssl certificate of a web site? Our goal is to host a web service so that a third party can integrate with our solution, and their ...
4
votes
2answers
72 views
Do SSD's offer significant performance boost for Scrypt?
Being a memory intensive hash, I was wondering if SSD's offer any appreciable performance boost for brute force attacks.
5
votes
5answers
80 views
How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
-1
votes
0answers
35 views
Win7 Delete Files Record? [migrated]
I use TrueCrypt to encrypt sensitive data. And then SugarSync to sync them to the cloud. Today I noticed that
- my trucrypt file was gone from my computer
- The TrueCrypt option to show my history ...
6
votes
2answers
108 views
Isolating Web application hosted on same web server
I am working on a scenario if we have two or more web application hosted on a same server. Let says Web application X is vulnerable so how can i be sure that it will not effect the other web ...
3
votes
1answer
46 views
What is the difference between Key Escrow and a Recovery Agent?
From what I understand Key Escrow is where a copy of they key is stored in a safe place so they can be recovered later.
But in the context of PKI, a Recovery Agent can also recover private keys.
How ...
4
votes
2answers
65 views
Executing arbitrary commands through iptables-restore input
During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
6
votes
3answers
115 views
Trying to firewall ports 1863, 5190
I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need.
But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further?
...
1
vote
2answers
47 views
Force SSL/TLS client cert authentication even if server does not request it?
Usually the server specifies in the Server Hello message if a client certificate is needed/wanted.
Does anybody know if it is possible to perform an authentication via client cert if the server does ...
1
vote
0answers
33 views
SAM Card deployment best practice
As part of my current project we will be deploying smart card readers containing SAM cards for decryption purposes. The deployment process involves a third party software integrator who will control ...
1
vote
2answers
55 views
Application to monitor software activities
I am doing black box testing on a software which is installed in my local machine. I want to analyze and see the list of files and registry entries that software create/modify/delete. Basically ...
-4
votes
1answer
64 views
How can I crack ArrayOS password [closed]
I have some Array Load Balance device that the user password hash like:
user "array" "XXXXXXXXXVkjTX9a1kYtNo".
How can I crack the password or find out the algorithm of the hash?
-6
votes
2answers
57 views
Install Metasploit under Cygwin? [closed]
Is there a way to install Metasploit under Cygwin? Metasploit is meant to be run under a linux environment.
The Windows installation doesn't have many tools such as msfpayload available.
Please ...
14
votes
4answers
437 views
How to avoid scripts with hardcoded password?
I have some scripts on Ubuntu Linux machine that logs in to a database server to run some maintenance daily. To login to the database, I need a password and right now it is hardcoded in the script.
...
0
votes
3answers
106 views
Security concept [closed]
How do we know that the systems that we are using are secure? At what point do we have to audit the software that we use? How do unknown security threats affect software over time?
2
votes
1answer
40 views
What is inside a Kerberos TGT ticket?
I would like to know what makes up a TGT ticket?
The reason is that we've noticed the more Windows AD groups the account is in, the larger the size of the ticket. We've also noticed that when we clear ...
2
votes
0answers
33 views
What can be used to keep xp_CmdShell in SQL Server disabled?
It's a well known fact that anyone with "SA" privs can turn on xp_CmdShell and use it and that includes any would-be attackers that can gain access to SQL Server as a login that has "SA" privs. There ...
2
votes
1answer
33 views
Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA
I would like to ask if it is possible to use different CA for the client certificate and the web certificate?
For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
5
votes
1answer
72 views
Security differences between Passive and Active RFID tags
Most people are aware there are two types of RFID tags, active tags (ones that contain a power source of some kind) and passive tags (ones that are powered by the RF field).
I'd like to know if ...
