2
votes
0answers
7 views

Are antiviruses still useful?

Are anti-viruses useful nowadays ? Given the number of viruses that are developed and spread monthly, and given the fact anti-viruses are based on virus signatures, I wonder how much it is useful and ...
0
votes
0answers
3 views

need network level security alternatives to a VPN

We have a set of servers hosted at a tier-1 provider, and they are currently behind a VPN running on a gateway machine and not accessible to the open internet. Due to VPN instability issues we've ...
-1
votes
1answer
8 views

Browsec - VPN and anonymizer

According to Browsec's website this application can be used to Bypass firewalls. So in countries like Iran it seems a useful tool to bypass censorship and filtering. For start using this application ...
0
votes
0answers
3 views

How to stop auto-created files to happen?

I'm new to "Information Security" so I hope I'm in the right place. I'm experimenting a very disapointing problem on my hosting server: some files are automaticaly created and I don't know how. The ...
3
votes
1answer
21 views

Virtual Desktop & Virtual Machine

What is the difference between virtual machine and virtual desktop? KOMODO Internet Security, for example, offers virtual desktop, and there's a stealth program there. If software sends the same ...
3
votes
0answers
35 views

Drive-by download attacks: the exact how to

To trigger a drive-by download attack, this article states that a second method exists: The second takes advantage of the natural design of your web browser to display web page content. If that ...
4
votes
0answers
35 views

DNS spoofing of linux distribution repositories

Question(s) Is it possible to "redirect" linux-update-repos via DNS spoofing (e.g. DNS cache poisoning) to a malicious website, so that harmful software (updates) will be installed, when running the ...
6
votes
2answers
732 views

Break the popularity contest crypto

There is a very interesting code golf going on to Rearrange pixels in image so it can't be recognized and then get it back. I understand that this is not cryptography, but I wonder how effectively a ...
1
vote
0answers
26 views

How to trace AD Admin Login

How to trace an admin login to active directory server (2008 R2) from which host or which ip (In the situation where multiple admin are working) ?
0
votes
2answers
30 views

VPS Privacy: OpenVZ vs KVM vs Xen

Considering OpenVZ, KVM and Xen: Which VM technology is the most difficult for the host's administrators to access given an encrypted root partition? Can I have a reasonable expectation that rogue ...
0
votes
1answer
25 views

How can I generate some public and private keys on both sides with low overhead?

We have an Authority Center (CA) generating some public and private keys for each client (more than one pair for each client). One method for sending keys to client is sharing a secret key between CA ...
0
votes
1answer
60 views

XSS in HOST header

I'm able to inject JavaScript payload in HOST header, a request will look like: Host: <script>alert(document.cookie)</script> User-Agent: Mozilla/5.0 Gecko/20100101 Firefox/29.0 Cookie ...
3
votes
1answer
32 views

Principles of memory forensics tools

I am currently writing a thesis about digital forensics which includes a chapter about memory forensics. Besides the tools and the methods of acquiring various data with them, I am kind of desperate ...
0
votes
0answers
12 views

OAuth2 - Resource Owner Password Credentials grant

The OAuth2 spec describes the Resource Owner Password Credentials grant type and authorisation flow here. I understand that only 'trusted' client applications would be allowed to use this grant, for ...
-1
votes
0answers
17 views

privacy internet search engine (Google front ends)

What do you do to protect your privacy searching the internet? I know of Startpage and Disconnect Search. Startpage is very well integrated in Firefox, that what I use. What do you think about it? ...
0
votes
2answers
34 views

How exactly does this Flash malware function on Ubuntu?

In this video, an experienced Ubuntu user manages to infect his system with some sort of malware. This is the first example I've ever seen of truly successful malware in the wild aside from privilege ...
-1
votes
0answers
12 views

Gplusdata stores google plus information

This website stores the information of google plus accounts. I removed my google plus account, yet my information and photo are in this website. First of all, how did they manage to get their hands ...
2
votes
2answers
38 views

Related-password hash security

Say we are given a strong cryptographic hash function hash(), a strong completely random password of 15 characters pass15, two single-character salt values salta, saltb. We compute the hashes hasha, ...
0
votes
0answers
16 views

Secure access of web application on a newly created AWS instance using the associated keypair

I create an AWS instance using a private AMI (Linux) with an embedded web application (Jetty) which is activated on instance start. As soon as the instance is launched first time, I want the ...
-4
votes
0answers
30 views

All about executing Dlls and malicious dll

I was trying to execute kernel32.dll with rundll32.exe. I set the dll path to system32 but I couldn't do it. How can I do it. What is a malicious DLL. How do I create one How do I get linked with ...
0
votes
2answers
43 views

connecting a secure computer directly to the internet without a router

If you have a fairly secure computer how dangerous is it to connect to a modem directly without a router in between. Let's say the computer is running Debian as a host and Whonix in VirtualBox, a VPN ...
-3
votes
1answer
36 views

How to install Windows 7 on macbook [on hold]

How can I install Windows 7 on a Mac book ?! I want to install Windows 7 as a dual OS in Mac book.
0
votes
2answers
68 views

How to ensure that only my single page app can make requests to an API

I have a REST API that can potentially serve multiple web clients. I want to ensure that only my single page app on my-one-and-only-web-cleint.com can make requests to my API. How do I do this? ...
0
votes
1answer
18 views

Flash Objects SWF security (ExternalInterface.call)

I am performing a penetration test against a website that uses Flash . i found this piece of code url = ExternalInterface.call("window.document.location.href.toString") as String; how it can be ...
0
votes
3answers
70 views

Can a PDF file contain a virus?

Could a PDF file contain any type of malwares ?
0
votes
0answers
18 views

What Does Putting Each Subscriber of ISP in One Subnet of His Own Mean?

I've noticed that I used to be assigned an external IPv4 from my ISP and a 24 bit mask (255.255.255.0), then it changed to 255.255.255.255, today I was studying IPv4 subnetting and I understand that ...
2
votes
2answers
69 views

SHA and “Bits of Security”

I've researched several forms of encryption/hashing and have often come across the term "bits of security". For example, at least one source claimed SHA-256 = AES128 = ECC256 = 128 bits of security. ...
1
vote
5answers
56 views

Firewall rules by URL

is there a solution to create FW rules by URL instead of IP for inbound traffic? For example a.example.com and b.example.com are the same IP on the DNS, but they are different sites, is there a ...
0
votes
0answers
14 views

user defined counter increment function for blowfish CTR in java [migrated]

We did some research but couldn't find the answer. The javax crypto blowfish counter increment function seems to be fixed ( standard inc by 1? ). How to change the increment function, say by 4? Or ...
0
votes
2answers
91 views

Hacking machines using internet packets [on hold]

I have a friend (X) who hacked the whatsapp account of someone (Y) using iphone. He told me that he sent a packet to the iphone of Y that appears as a normal whatsapp message but now he can see all ...
0
votes
1answer
26 views

Only allow access to specific service running on computer in Demilitarized Zone over internet

If a computer (running different services such as ftp and ssh) is placed on a Demilitarized Zone, will all of its services automatically be accessed by anyone on the internet? If the answer is yes, ...
1
vote
0answers
25 views

Wardriving Code [migrated]

My next project consists of a Raspberry Pi discreetly connected to a car that will wardrive for the person who connected it and never has to be retrieved. This is proof of concept as I just want to ...
1
vote
2answers
67 views

Do multiplatform viruses exist? [on hold]

Is there any known virus that targets the main operating systems: Windows, Linux and Mac OS X?
-2
votes
2answers
30 views

Python/Perl SQLi scanner? [on hold]

I'm in need of a SQLi scanner. I'd prefer Perl/Python, but I could care less what language. I just need a simple one that can scan a large list of sites. Sorry for the skid question, I just could ...
-2
votes
2answers
44 views

The shortest list of effective security tips in layman terms [on hold]

When asked about "security" tips by non-techies I often limit myself to a handful of tips and avoid lengthy explanation unless questioned further. My aim is get the most effective messages across with ...
2
votes
1answer
30 views

Am I understanding correctly how to stop a certain OAuth2 session fixation attack?

Please find here described an OAuth2 session fixation attack. Is the attack possible? And am I understanding correctly how it can be stopped? The attack Mallory starts logging in at ...
2
votes
9answers
1k views

How to secure a public device against abuse? [on hold]

What I mean by public device? E.g. in Germany we have small stations to charge cars powered by electricity. This stations are small towers with a flap. Behind the flap are plugs to connect the tower ...
0
votes
1answer
20 views

nmap - “No exact OS matches for host (test conditions non-ideal)” even with 1 open, 1 closed port

I'm trying to do some Nmap OS detection and I'm running into some results I don't understand. The scan I'm running is the following: nmap -O -F -v -T2 -oA nmap-uphosts-OSdetect -iL < my_in_file ...
0
votes
1answer
19 views

client SSL authentication .pem file and .crt files

So I have minimal knowledge of security really but I'm a primary developer on an application which handles some sensitive data that we want to be secure. The application communicates with one other ...
1
vote
4answers
118 views

Are computers on same network as honeypot safe?

Wanted to if a computer is setup as a honeypot and is on the same LAN with other computers, could these other computers be attacked? My thought is that if an attacker infects a honeypot with a worm, ...
1
vote
0answers
23 views

Self signed certificate on application server behind web front end

I have a Tomcat application which is front ended by an Apache web server - end users connect to the Apache web server (never directly to Tomcat) and Apache has a valid, externally issued SSL etc The ...
1
vote
1answer
111 views

How can I trace a user on my network?

I want to trace a user based on IP Address (or MAC Address) on a Network with about 10 L2 or L3 Switches. Is it possible to know that on exactly which switch and on which port a user with a specific ...
0
votes
1answer
23 views

PCI compliant transparent data encryption at disk/folder level on windows?

Is there a way to achieve pci compliant data encryption at disk/folder level in windows in a way that is transparent to applications(they must be able to write/read to encrypted folders/disks as if ...
-2
votes
1answer
55 views

Is it safe to use public Wi-Fi networks that may be handled by non security experts? [duplicate]

I wonder if it is safe to use public WiFi in places where the WiFi router might not be managed by professionals and anybody is able to come and connect to the network with their own device. There are ...
0
votes
1answer
19 views

Monitoring Wirless modem without network

I have a wireless modem in home and home devices are not networked. Is it possible to find out how much Internet(Mb) is consumed by which device? (preferably based on MAC ID) If not please give me ...
0
votes
1answer
43 views

Encryption mechanism

I want to sent a data over the internet with secure for that I am using RSA public of receiver to encrypt the data. so that the receiver uses his RSA private to decrypt the data. In this case, any ...
0
votes
1answer
36 views

Downloading Text from Articles [on hold]

Is there any security measures that I should take when downloading article text from the web as far as file integrity? For example, I've written a bot that retrieves article text from a user's blog ...
1
vote
2answers
61 views

Database compromised and some passwords cracked

I run an MMORPG game and today while moving from one server to another, apache failed and listed some of the data on the server including a back-up of all the source code + database which a few people ...
0
votes
2answers
69 views

Track my girlfriend's stolen computer

My girlfriend just told me that her computer was stolen, the computer was hibernated and the second the thief turn the computer on a lots a things will open automatically. I'm hoping I can get the ...
1
vote
1answer
17 views

Importance of password strength with secure element?

Greetings SE security community. Background: I have a number of items like certificates, databases, and encrypted file systems that require private keys. In order to avoid having duplicates of these ...

15 30 50 per page