0
votes
0answers
8 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
-2
votes
1answer
19 views

IP hijacking during SSL

I was wondering, does SSL protect from IP hijacking (an active, authenticated connection between two hosts is disrupted and the attacker takes the place of one of the hosts) and how?
5
votes
3answers
420 views

Are routers vulnerable?

I apologize if this is an obvious question, I'm not very familiar with hardware. I am planning on hosting a few personal websites from my home, but I'm concerned about my security. I'm using a fairly ...
2
votes
1answer
24 views

Who can see the traffic of others in different kinds of LAN

I would like to consider three types of LAN: a) 2 computers are connected to a Hub, this Hub is connected to a router for e.g. internet access. b) 2 computers are connected to a Switch, this Switch ...
0
votes
1answer
23 views

Are wired and wireless networks on a router nessassarily one network, when they are not bridged?

I know, that if I bridge the wireless and the wired NIC of my router, that both networks are composed to one. In this case computers from the wireless and the wired LAN can reach each other (they are ...
-1
votes
0answers
20 views

Someone is using my website email to send spam

I have an email hosted by my website. Somehow someone is using this email to send spam. These emails are not being sent by me. Someone else has access to it and I don't know how to stop it. This has ...
-1
votes
0answers
15 views

Email alert for browsing a site

I want to be able to set an email alert for every site whenever my friends access the internet from my home Wi-fi modem or router. How can I achieve this in a very simple way with the website details ...
4
votes
1answer
80 views

What is the “Moose” worm and how can I protect myself from it?

I have heard from others that there is a new worm called "moose". This actively targets and exploits home routers. What are the effects of this exploit? How can I protect myself from this? Can I ...
0
votes
0answers
22 views

Tunneling SSH traffic through tor

I have encountered a somewhat bizarre issue while playing around with tor and SSH. After a connection to the server has been established the source address of the client(in this case the tor exit ...
2
votes
1answer
36 views

Is a newly installed server with no services running (but connected to the web) at risk?

A new server has just been installed but literally has nothing else running on it, no services setup to SSH in or anything yet (it's a Linux server). However, it is hooked up to the web so I can ...
0
votes
1answer
41 views

Server full disk encryption protection from malware

A group of LINUX servers is using dm-crypt to encrypt data. The servers do not store data long-term but are only temporary stopping points for data before it is sent to other systems. The time the ...
0
votes
0answers
12 views

Exchange Autodiscover XML question (Exploit related)

Recently we had an issue with the Exchange autodiscover.xml appending ".com" to our mail servers autodiscover address. It resulted in a certificate error due to the name not matching the certificate. ...
0
votes
1answer
32 views

How do I audit the effect of security policy on a computer

I have developed different templates for local security policy. I have been using the program Nexpose to test the effects of those security policy but so far i am not able to detect the visible ...
2
votes
0answers
32 views

chroot ssh users

I am using CentOS 7. I need to give shell access to ssh users but restrict them in a jail. I have used jailkit to set up the jail. I have copied all necessary libraries, binaries that are needed for ...
0
votes
4answers
99 views

What mail applications use crypto?

I just read that everyone in the world can ready my mails (if intercepted in traffic by eavesdropping?). Also, it reads that current versions (book's from 2004 so I assume that new versions adopt ...
1
vote
2answers
32 views

Certificate chaining:Intermediate Certificate Authorities

Wikipedia says: For example, if a certificate issued to "example.com" and issued by "Intermediate CA1", and the visiting web browser trusts "Root CA", trust may be established in the following manner: ...
1
vote
2answers
42 views

Encryption / Decryption algorithm generic across JRE (Sun/IBM)

Is there any encryption algorithm that is generic across all platforms? Is RSA generic across SUN/IBM JRE? Another question: will base64Encoder / base64Decoder sun.misc.BASE64Decode / ...
0
votes
0answers
26 views

Complicated HTTP-POST-FORM's with Hydra

So, long story short, I have been talking with a developer that is designing a website for us under a very high recommendation. They have had some break in's of late, and the developer has claimed it ...
0
votes
4answers
218 views

Is end to end email encryption possible without unique domain/subdomain for each user?

Lets say Alice@gmail.com wants to send message to Bob@secureMail.com Alice <--> gmail.com <--> secureMail.com <--> Bob We know gmail.com can read the unencrypted message. Is it possible for ...
0
votes
0answers
11 views

Can a TPM's EK's public key (hash) be used to fingerprint a device?

The question How to use TPM to perform platform authentication is basically asking if the TPM's EK can be used to "authenticate" a host/device. And one of the answers says The Endorsement Key ...
0
votes
0answers
39 views

How to get into penetration testing profession? [on hold]

I am 28 year old and holding master of information security. I don't have any practical experience of pen testing. I would like to study and sit for some relevant certifications such as CEH. But ...
3
votes
2answers
59 views

Can a RootCA be revoked?

I have created a New Trusted certification authority which issues certificate to the end entity and the end entity will use this certificate as trusted one for all their PKI operations. Some how the ...
1
vote
1answer
41 views

Linux Kernel module signing

If the linux kernel is compiled to check for kernel modules signing, it checks the validity of the public key (X.509) w.r.t the current system time. For the first time the system is booting up, it ...
0
votes
0answers
93 views

Design Principle violated by Certificate Revocation List (CRL)

I need help with my homework assignment, The question asked is: can you explain me which design principle between Least Privilege Fail-Safe Defaults Economy of Mechanism Complete ...
0
votes
2answers
49 views

SQL Injection Attack - Permissions Defenses

SQL injection attacks work by the attacker putting valid SQL into the text that goes back from the page to the server; something like "Delete * from tblAccounts where 1=1" What I cannot understand is ...
1
vote
0answers
59 views

Why is information obtained from public records considered a secure way of confirming your identity?

Various financial institutions, government agencies, etc., use public records information to confirm people's identities, as touched upon in UPS my choice -- How can I access my public records? The ...
5
votes
3answers
703 views

What if someone steals a Certificate authority's private key? [duplicate]

What if someone could steal a Certificate authority's private key? I know this will (probably) never happen, but what would happen to the certificates that were already signed with this private key? ...
1
vote
1answer
39 views

Does it make sense to scan localhost site?

I was playing around with wpscan a little while ago. I was wondering if it makes sense to scan a site on your localhost server. I think that it is since there are examples like DVWA, but I imagine it ...
1
vote
1answer
91 views

Why does Google.com still support SSL v3?

The POODLE vulnerability was discovered by Google in October 2014, and unlike heartbleed, it had a simple solution: just disable SSL v3. Now, most of the websites have disabled SSL v3 but ironically ...
0
votes
2answers
49 views

Hijack attacked SSL/TLS-connections?

I think we all heard the news that China used unencrypted HTTP-connections to drive DDoS attacks on targeted websites. Now within the last few months we've learned about three new attacks ...
4
votes
1answer
68 views

How can I delete a password and lock the account in one step?

I have a minimal server install on a remote machine with a root password set to a temporary, but chosen, value. I have added a separate administrator user. This user has an authorized key for SSH, no ...
4
votes
2answers
185 views

How to be safe from wifikill!

I recently found that my friend is using wifikill apk on his rooted android and I would like to get rid of that software as I always get kicked from my wifi. I have to give him the password of my wifi ...
2
votes
2answers
37 views

Is it secure to SMS your Credit card info (or other info) to someone else?

I am buying some products and have mostly communicated with the store via email. I am planning on paying by credit card, but the store doesn't have online billing. Normally, I would just phone the ...
1
vote
1answer
51 views

iOS Unicode Notification Bug

Evidently, someone has discovered a Unicode bug in iOS, where if an app receives a specific Unicode sequence (infinitely-repeating Unicode code point), the OS will kill the Springboard as it allocates ...
2
votes
2answers
140 views

How is it possible that a text message can reboot an Apple device?

I was reading through my infosec newsfeed and found this article: http://www.theguardian.com/technology/2015/may/27/iphone-crash-bug-text-imessage-ios It basically talks about a bug iOS has while ...
0
votes
0answers
38 views

How do you restore your hard drive after a crash if you use KeePass?

If you keep all passwords in KeePass, and the drive is destroyed/lost/corrupted, how do you restore? Currently my online backup is using a password that I memorize, but not as strong as KeePass would ...
2
votes
0answers
30 views

Simple method requiring no installation of special tools to share a file over the internet

I have searched for related topics, but found other existing answers to not be satisfactory, because they require installing special tools. This is a very common use case. For example, I want to ...
9
votes
5answers
1k views

Is this way of encoding cryptographic hashes safe?

I'm looking at the code of a particular web application that handle file uploads. For some reason, instead of using the cryptographic hash function (SHA-256 in this case), they derive an ID from it, ...
7
votes
1answer
74 views

How to fix a repeatedly hacked gmail account (where 2FA is enabled and passwords are changed)?

A friend of mine came to me for help with this issues. Her Gmail account has been hacked and keeps sending out spam emails to her contacts. This is happening to her on a monthly basis. Each time it ...
0
votes
0answers
20 views

Saving user data (IP, location…) on mobile app in USA [on hold]

I'm working on the implementation of a service that measures advertisement campaign efficiency on mobile devices; it'll be shipped as an SDK (Android and iOS) that other apps can implement. I retrieve ...
1
vote
2answers
77 views

Is it safe to publish some internal IP of my company?

Sometimes when asking networking questions on StackExchange I want to publish some output where several internal IP adresses from my company appear (output of traceroute command for example). Since I ...
2
votes
1answer
33 views

How much should I change my 64 character TrueCrypt password?

I got a TrueCrypt container which is using a 64 character password. This password contains all the different kind of characters available to me (upper case, lower case, digits, special). It's taken ...
0
votes
1answer
23 views

How ECDHE is signed by RSA in ECDHE_RSA cipher

About ciphers that use ECDHE as Key Exchange and RSA as Authentication: How exactly this two algorithms work together, is ECDHE process encrypted by RSA public key? What are the DH parameters? ...
26
votes
7answers
3k views

Can attackers get anything with DoS attacks except crashing the service?

A DoS (short for "denial of service") attack is a form of attack used on web services which aims to "crash" the service. Is there any motive of this form of attack besides crashing the service / ...
-4
votes
1answer
34 views

where to find a list of the most used security software used by businesses? [on hold]

I need a list of the most used commercial security software used by businesses to track and stop a set of malicious behaviour like: external attacks viruses network traffic malicious behaviour of ...
0
votes
1answer
10 views

openvas omp tool is not able to parse target option

I am trying out the OpenVAS and the omp tool (version 5.0). I can connect to the OpenVAS manager and get the targets and configs but when I try to create a task, I get an error. $ omp -u test -w ...
1
vote
3answers
84 views

Detecting RDP on non-standard ports

How can RDP connections on the network be identified if they are no longer using TCP 3389 and instead using a non-standard port? If the administrator of a system changed the port for remote ...
-4
votes
0answers
30 views

Web application security guidance for beginner [on hold]

I am new in the IT field. In need to learn about Web application security. how can i learn about it? is there any guidance about a good course i can take or an online class or a good book ? And as im ...
0
votes
1answer
83 views

What can I do if someone is using my IP address? [on hold]

Another device in my network is using my IP address, what can he do if he is using my IP address? Is this a crime? Can him be caught by police or sue by Malaysia government?
3
votes
2answers
94 views

RSA public key and private key lengths

I'm having a problem understanding the size of an RSA public key and its private key pair. I saw different key sizes for RSA algorithm (512, 1024,... for example), but is this the length of public ...

15 30 50 per page