0
votes
0answers
2 views

Linux password changed. Is this an attack or a hardware glitch?

My Linux (Ubuntu 12.04) password suddenly changed last night and I'm not sure if this is an attack or just a hardware/user error. This is on a personal/non-server box. Several strange events led up to ...
1
vote
1answer
8 views

Encrypt pdf by the server to prevent printing and copying

We are building a portal where users can upload few materials. we have been successful in using the command lines of linux to convert doc,ppts to pdf directly through the server but we are not able to ...
0
votes
0answers
6 views

How to evaluate authentication for a WAP portal?

I am trying to evaluate a security authentication for a WAP portal. The authentication works by asking the customer for his unique MSISDN and then a secret pin code is sms to client. In this is a ...
1
vote
0answers
6 views

Kerberos v4 replay attack vs. sliding time window

Just wondering about a replay attack against Kerberos v4. So v5 has a replay cache that takes note of tickets to prevent replay attacks. Kerberos v4 does not have a replay cache, though. Say, I ...
1
vote
3answers
86 views

Can anti-csrf token can prevent bruteforce attack?

I am not much experienced with brute force attacks but I was wondering Suppose, You have a website www.example.com and you want to do brute force attack on that login form but that login form is ...
0
votes
2answers
22 views

Firewall Security vs Anti-Virus

Overview of my question I want to create a secure Window's system without the use of an Anti-Virus program. Whilst I know there are many on-demand and live-scanning anti-virus programs readily ...
0
votes
0answers
13 views

entropy of two factor authentication

I have two independent authentication methods A and B with entropy a and b respectively. say compromise of A does not provide any information on B. Is entropy of two-factor authentication of A and B ...
0
votes
0answers
19 views

GnuPG / OpenPGP: How to eliminate redundancy in PGP private key?

I examined a few randomly generated private keys generated by Gnu PG, and found a lot of redundancy. It is enclosed by -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY BLOCK----- ...
1
vote
2answers
80 views

Search on hashed data

We have a request to encrypt customer personal data (e-mail, address etc.) We use MySQL which does not have any TDE like MS SQL or Oracle. So along with encrypting data we need to preserve ...
0
votes
1answer
17 views

How to permanently change (spoof) the MAC address in Kali Linux (Debian)

I use the program 'macchanger' to change MAC address. However, I have to put down an interface (wlan0) and then invoke Macchanger and then bring the interface up again. I would like to have a way I ...
1
vote
0answers
13 views

The simplest way to emulate TCP-IP protocol violation / anomaly attacks

Reading up upon security on web applications I did not found that much info on TCP-IP and in particular HTTP/UDP protocol violation / anomaly attacks. My questions: What is the general mechanism of ...
0
votes
0answers
11 views

What certificate attributes can I check to verify if an issuer is correct?

Apologies if this is a duplicate question. I thought I saw this discussed earlier but couldn't find the thread when searching. What attribute can I check to verify if I have the correct ...
0
votes
0answers
17 views

E-voting: receipt-free, verifiable, and anonymous

Background In response to a system design concept, a question was posed: How do you achieve electronic voting, anonymity, and verifiability at the same time? I was informed that most experts in ...
0
votes
1answer
6 views

Proper way to shutdown OpenVAS

I currently start OpenVAS by calling openvasmd, ad, and sd manually. What is the proper way to stop these services? Killing the processes works but I don't know what might not be cleaned up by the ...
-4
votes
0answers
25 views

My Android phone is dormant because I can't access my account [on hold]

I have an LG android phone. Two weeks ago, a warning sign appeared saying that i have put in the wrong password. i have tried the password i remember,to no avail. i can't access my market.i tried ...
2
votes
1answer
43 views

What is x-frame content?

I tried scanning websites for vulnerabilities and found most of them are with low risk x-frame content and "nosniff" what is it exactly?
2
votes
0answers
26 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
-2
votes
0answers
16 views

Do you need to register with the ICO if you sell via PayPal [on hold]

In the UK, any organisation that holds or processes personal information is required by law (Data Protection Act 1998) to register with the Information Commissioners Office. If my small business ...
-1
votes
0answers
31 views

How many remote holes did Windows had?

http://www.openbsd.org/ states that from 1995, they had: Only two remote holes in the default install, in a heck of a long time! Our question: How many did Windows had?
0
votes
3answers
27 views

Adding a “comment” to PGP mail signature files?

I have started signing my mail with PGP, and it attaches the file signature.asc to my messages to verify that I sent them with content, as you'd expect, like this: -----BEGIN PGP SIGNATURE----- ...
0
votes
0answers
70 views

Password stolen on public wifi even though https was used

I saw this video where news reporter is in public place, and some security expert demonstrates to her that even though she logged in at page which was using https that guy got password in his ...
1
vote
0answers
11 views

What aspects of a Host OS can be detected from VirtualBox VM?

What aspects of a Host OS can be detected from VirtualBox VM? Processor and display features are all I can think of. What exactly about them? Any other features of the Host that a user with ...
0
votes
1answer
34 views

Reflected XSS script passing through URL how to make it work and what are the preconditions for it to work?

Trying to learn about security I set up the most simple website on my localhost consisting of one html page that a apache server serves. I first started trying and appending the JS script that would ...
0
votes
0answers
13 views

What could be expected from an AI program for scanning network vulnerabilities? [on hold]

There are tools like OpenVAS and other such online scanners which help in discovering network or a system vulnerabilities. I need thoughts on the limitations you feel, which are faced while using a ...
-8
votes
0answers
56 views

What are the best and most popular authentication algorithms/protocols? [on hold]

Our cryptographic/security company is designing a new generic versatile library that implements all popular algorithms in all areas of cryptography. Now I'm studying a subject of Authentication. What ...
1
vote
2answers
122 views

How can hackers guess passwords (using dictionary attack or brute force) without being locked out?

Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords? I am just wondering because in case of multiple wrong ...
3
votes
1answer
48 views

Is there any danger in allowing users to host PDF/RTF/DOC files on my web server?

If I were to allow users to host arbitrary PDF/RTF/DOC files on my server all under the same name, but with different query strings would there be anything to worry about? I've heard of PDF/RTF ...
1
vote
1answer
24 views

Remote Auditing a Secure WiFi Network-Obtaining enough of the Secured-Network credentials to attack without being in range of WiFi

I was wondering if there are any methods I'm unaware of that will allow an attacker to attempt to obtain WiFi access outside the physical range of the WiFi signal. When using net-stumbler or any ...
-2
votes
1answer
60 views

A future heartbleed bug? [on hold]

Checking out IBM.com and Google.com: https://www.ssllabs.com/ssltest/analyze.html?d=ibm.com&s=172.230.109.66 Valid from Tue Sep 09 14:00:34 UTC 2014 ...
-1
votes
1answer
41 views

Is it possible to hack an Android App or an Android device without being root? [on hold]

Simple question, as the title said. I wondering if in an ideal world where rooting Android devices is not feasible mobile pen testing would be still possible or not. Most of the sensitive folders ...
-6
votes
0answers
24 views

iPhone & windows pc malware removal and reverse tracking of perpetrators location, ip, et al [on hold]

There are various examples of malware available for sale nowadays, spybubbble being one of the best. cheaper alternatives eventually leave traces (clicks, hissing noises, crossed lines etc.) a key ...
1
vote
2answers
31 views

Why the Websense blocks same site when used with http & not when used https? [on hold]

I have been working in a IT firm. I have access to some social sites. When I try to open site Links in mail (that are having http://), the websense prompts me that the access is blocked. However, when ...
2
votes
2answers
115 views

Does Android encryption really prevent law enforcement access?

Google recently announced that in Android L encryption would be turned on by default: For over three years Android has offered encryption, and keys are not stored off of the device, so they ...
1
vote
2answers
52 views

Will the cookies crumble when it comes to proxy servers?

One important use of proxy servers as I understand reading Wikipedia is to keep you anonymous from other servers by acting as a middle-man. If that is indeed the case, consider the following ...
0
votes
0answers
4 views

Location Parse Help Please [migrated]

I succeeded has to get back the position of the user and I also managed to get back the position of all the restaurants ( GeoPoint un data cloud Parse) my question is now to know how to compare the ...
1
vote
1answer
29 views

Connecting to Oracle Database from VBScript - Hiding Credentials

At work our first level support uses a ticket management system that allows us to add extra functionality via VBScripts that the application invokes. First level support also receives quite a few ...
1
vote
3answers
51 views

Phone location detection

If someone posts something on the internet using their phone's data connection, is it possible to track their location? For example, somehow link their IP address and figure out their location. Or ...
1
vote
2answers
245 views

How do hackers deploy keyloggers?

I know the use of keyloggers. What I wish to know is how a hacker can install the keylogger onto the victim's system? If it can be done by XSS then to where this keylogger is actually installed (I ...
0
votes
1answer
26 views

Tracking urls in network using python [on hold]

I have requirement to track all the urls passing through network inside my organization, is this possible to track using python ??
0
votes
2answers
36 views

Does Nmap requires a closed TCP port to do OS fingerprinting?

I was checking the security of a server by running Nmap. Last time it gives me the following results, indicating that OS could not be fingerprinted: PORT STATE SERVICE VERSION 21/tcp ...
0
votes
0answers
21 views

Security considerations for RESTlike HTTP API of an embedded system

I'm designing a HTTP service for an embedded device and wondering if the following security concept is good enough: SSL(Up to Version 3) is enabled by default, TLS is not by limitations of the ...
1
vote
1answer
22 views

What happens if my signing subkeys are compromised?

Let's say my subkeys are compromised, but my master keypair is safe and secure, so I revoke the old subkeys and issue new ones. With encryption keys, the results are pretty clear: I can still decrypt ...
2
votes
3answers
104 views

Is it ever safe to publish hashed data?

I'm having a friendly debate with someone who thinks that a website can safely make public sensitive data about it's users as long as that data is hashed (don't ask why, it's a long and hypothetical ...
0
votes
0answers
9 views

what is the default cache control mechanism of http? [on hold]

I have heard about the cache control header parameter in http. I know that it can be edited with the way we wanted like no-cache,public,etc. But if we don't specifically provide anything, then what is ...
0
votes
2answers
24 views

Protect against malicious client with key derivation function (PBKDF2)?

Consider a protocol that allows clients to retrieve XML "forms" from a server. Forms are identified by a unique, randomly generated form ID that is embedded in the form. Clients fill out the form and ...
0
votes
0answers
20 views

Privacy implications of big data for the average user [on hold]

First of all, it's not related to What are the implications of NSA surveillance on the average internet user? My Master's degree project is about intelligence gathering from big data analysis. As my ...
-4
votes
0answers
16 views

HMAC- SHA 256- algorithm? [on hold]

Can any one provide me a complete algorithm, how to do hash computation with a complete example.
-2
votes
0answers
21 views

ISP regulation concering cyber security in EU [on hold]

What are main legal acts concerning ISP operation (and its role in cyber security) in European Union that regulate cooperation, reporting of cyber security incidents, personal data protection, safety ...
-1
votes
0answers
13 views

How to use windows 2008 as router [migrated]

i have a windows 2008 server with 3 network cards and 2 internet lines. i want to separate apps traffic and usual traffic as below. i tried RRAS as bridge but can i use windows 2008 as router using ...
1
vote
3answers
97 views

What are the differences between dictionary attack and brute force attack?

Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?

15 30 50 per page