1
vote
1answer
5 views

Is the following code seeding OpenSSL's PRNG necessary, superfluous, or harmful?

As I was going through Crypt::SSLeay, preparing it for the next release, I noticed the following code, written way before my time, ... int rand_bytes_read; static int bNotFirstTime; char buf[ 1024 ...
1
vote
0answers
6 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
-3
votes
1answer
19 views

Most secure SSH server

Which SSH server (compatible with Debian Wheezy) has the fewest (if any) exploitable security bugs?
1
vote
1answer
6 views

OpenVPN seamless migration from 1024-bit RSA to 2048-bit RSA keys

The company I work for has a few OpenVPN servers used by over 200 employees. The servers were deployed a few years ago using the default easyrsa settings and now we want to upgrade to stronger ...
0
votes
1answer
16 views

Check if i'm using a filtered network

I would like to know if the connection in my office is filtered, because i cannot access Faceboook neither Youtube but i can access google with no problems, but Tor i can access all the websites. i ...
0
votes
1answer
16 views

Is it good idea to rely on Mifare UID for security/authorization reasons?

Some of you may know that nowadays I think you can purchase chinese cards, where you can write any UID you want, hence emulating the UID of a legitimate Mifare (e.g., Classic) card. My question is: ...
-1
votes
1answer
16 views

Use SSH config file with Putty

I'm using SourceTree (a Git GUI) which uses Putty as SSH client. I need to push some code into a repository for which I need to tunnel through SSH to do so. The trouble is, the repository and SSH ...
0
votes
0answers
23 views

Reverse proxy and corporate PKI

Here at OU=PKI we've been requested to issue a certificate with CA capabilities to install it in our reverse proxy, so that it could issue trustable certificates for every single web. (SSL ending) ...
0
votes
1answer
25 views

Increase hydra brute force login attempts

I have recently came to know about hydra and i am playing with it using brute force. The number of login attempts are almost 10 attempts / second, I am trying with my password, so if my password ...
-1
votes
1answer
15 views

How can i access in host file whiles using a proxy server

I using a proxy server (Freegate to be specific). I an unable to access the connections (dns mappings) that i have set in my host file. That is i want to access "127.0.0.1 YourInstanceName" whiles ...
1
vote
0answers
18 views

Understanding the details of SPI in IKE and IPsec

I'm currently learning IKE and IPsec for an exam. I have a lot of information on how Security Parameter Indexes (SPI) are used in both protocols, but I'm having some problems figuring out the ...
0
votes
0answers
18 views

How to install Metasploit on Mavericks + MacPorts?

I would like to install Metasploit on an hardened OS. For this purpose I chose Mavericks just because I'm able to harden this OS pretty far. I would like to install Metasploit with MacPorts because ...
0
votes
1answer
16 views

How to avoid session sharing inside the same network

I was thinking about a situation to avoid session sharing or hijacking, validating the IP the user logged in against the ip that is accessing any page after log in. It was working until I figured it's ...
-2
votes
1answer
34 views

Personal details and last 4 digits of credit card

Recently, I was asked by a car rental agency in Los Angeles to provide the following personal details, to secure a car rental: Full name Date of birth Address Driver's license number Passport number ...
1
vote
2answers
47 views

Is hashing a DLL useful to protect from DLL hijacking?

I want to make sure that the dynamic link libraries used by my application can't be replaced with other libraries of the same name, in order to inject malicious code. Therefore, I thought about ...
-1
votes
3answers
41 views

How do big companies ensure that other people don't register a new top level domain with their name?

For example today there are ".codes", ".farm" and ".vaijes" newly available. How do big companies like google, facebook, twitter, .. keep sure that they are the first who register their name on the ...
-1
votes
1answer
26 views

OpenSource considered harmfull?

What would you think about military strategist who is publishing full plans for all of important infrastructure? I think that person will be stupid. Can be this analogy case with OpenSource? Here is ...
0
votes
1answer
19 views

Is there a general name for this sort of cryptographic protocol?

Is there a general name for this sort of cryptographic protocol? If so what sort of assymetric/symmetric encryption functions tend to be used for this protocol?
0
votes
1answer
13 views

What is the point to the IPEK in DUKPT?

I'm trying to understand the DUKPT (Derived Unique Key Per Transaction) system used for PIN devices, but I'm getting hung up on the IPEK. This blog post has an image where the sequence is: BDK ...
4
votes
3answers
348 views

NTP DDoS Attack on Home Servers

After some half-good script kiddies found out about this exploit or DDoS method, they have been doing it like crazy to websites, game servers, and now my home servers which allows me to work on some ...
0
votes
1answer
9 views

Challenge Response Login Authentication with Password Salt

I want to implement a challenge-response login authentication for my web application. My understanding is that the server has to send back the password salt for the user so that the user can ...
0
votes
1answer
36 views

Understanding Hearthbleed attacks [duplicate]

In order for a Heartbleed attack to happen and for someone to grab the SSL private key and even spy they have to be on the local network with a router, switch or server, correct? Or can this be done ...
0
votes
0answers
7 views

What can I change in Lane to [migrated]

What can I change in Lane to increase memory (and compute) consumption. My first idea would be to change n, but with Lane hash function is there a way I can up the n to a level higher than 512. If I ...
0
votes
1answer
20 views

Detect possible router attack attemp

I have huge problem with my router: Sagem F@st 3202. Here are some Security log events: Inbound Traffic | Blocked - Default policy | TCP XX.XX.XX.XXX:80->XX.X.XX.XX:51707 on ppp0 ...
2
votes
1answer
21 views

Retrieving CSRF token cross-domain using JSONP, risky?

Looking at this previous question, the answer suggests that using a GET request to retrieve a CSRF token in order to make a POST is a legitimate method of preventing CSRF attacks. I have two ...
0
votes
2answers
64 views

Which hashing algorithm is ideal for use on the web?

I am new here, and have poked around the site looking for an overview of which hash algorithm to use on the web and why. It seems to be the consensus that SHA-256 or other SHA-2 family algorithms are ...
0
votes
1answer
48 views

Are there maximum allowed key size in USA?

I've heard using encryption outside military use had been illegal during a long time in USA. However I've also heard that when the regulation was updated, limits were puts on encryption strength such ...
0
votes
1answer
39 views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate?

Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
1
vote
3answers
68 views

How can I add a layer of security to cleartext passwords and SSL?

I'm creating a web API in .Net for a web application. I'm wondering what the industry standard for login authentication is. I know that most people believe that sending cleartext username/passwords ...
1
vote
1answer
25 views

App permissions to access hardware “at any time without your confirmation”

On Android applications now some applications say that they want access to things such as speaker or camera "at any time without your confirmation". I wasn't sure if this meant that it does not ...
0
votes
0answers
20 views

what to use as a proxy for desktop applications [on hold]

I'm familiar with Burp Proxy, Paros, Web Scarab, etc. for use as a proxy between my browser and the internet. I've got a need for similar tool that can interrupt and change traffic between other ...
2
votes
1answer
47 views

Random token and email confirmation key of 10 chars sufficient?

I have a function that returns random unguessable keys with the following characters: a-z A-Z 0-9. I have set the key length to 10 and I am using that for my form tokens to prevent CRSF and I will be ...
0
votes
1answer
32 views

Worthy security related certifications for a software engineer [on hold]

I am a software engineer with an interest in expanding my knowledge in the security field. In addition to security.stackexchange and OWASP, I am currently reading the book "The web application ...
5
votes
1answer
63 views

Server Infection: post-cleanup best practices

I've read through How do I deal with a compromised server? and have followed the steps to cleaning-up/mitigating any future damage. I'm just wondering if there are any post-clean up steps that are ...
16
votes
3answers
4k views

How can I create a password that says “SALT ME!” when hashed?

How can I create a password, which when directly hashed (without any salt) with md5 will return a string containing the 8 characters "SALT ME!". The hope is that a naive developer browsing through his ...
0
votes
1answer
62 views

Do I need an SSL Certificate for a HTTP only site?

The cert for our public facing site is about to expire soon. Our site is entirely http. The site runs on SharePoint, and with SharePoint working with NTLM, the credentials that are passed over the ...
1
vote
1answer
34 views

Do Javascript malware signatures exist?

Are there signatures for malicious JavaScript codes as they exist for other viruses/worms/trojans developed in other programming languages ? If so, are these javascript malware signatures defined ...
0
votes
1answer
32 views

Can a Tor exit node be reliably identified?

So with my knowledge of Tor, I know that exit nodes are where packets escape the Tor network and enter the "traceable" internet; ie. you can link an attack to an exit node but not the source of the ...
3
votes
1answer
47 views

How easy is it to make a malicious bank/identity card?

I recently got a magnetic card reader that plugs into my computer because I was bored. I decided to scan my ID and bank card through it and I was surprised to see my ID number/bank card number show up ...
19
votes
6answers
1k views

Should I obscure database primary keys (IDs) in application front end?

I'm working on an application which allows a moderator to edit information of user. So, at the moment, I have URL's like http://www.example.com/user/1/edit http://www.example.com/user/2/edit I'm a ...
1
vote
2answers
67 views

How to avoid DDOS against Kerberos Authentication Server

I have a school project where i am supposed to implement a Kerberos based infrastructure (AS, TGS and resource server). It is already done and working, but i started thinking about how to protect the ...
-1
votes
3answers
99 views

Wifi hack and computer hack?

Yesterday, I woke my computer up from sleep mode (it had been on all day while I was at work). And my browser was open to an email account that was not mine. Is it possible for someone to hack your ...
2
votes
1answer
54 views

How do I securely deal with SSL certificate validation failure when the client date is incorrect?

I have an application that runs in mobile devices and connects to my server via HTTPS. At times the connection fail because the device has a date set in the past (before the 'valid from' date on my ...
-3
votes
1answer
59 views

Is there a way to attack the SHA-3, GOST, and WHIRLPOOL hash functions? [on hold]

Is there a way to attack SHA-3, GOST, and WHIRLPOOL hash functions?
2
votes
2answers
60 views

Identifying SSL traffic?

How does DPI basically identify SSL data traffic? Just by the number “443” in port section or the SSL traffic has some other particular properties other than “443”? Thanks in advance,
-2
votes
1answer
29 views

Whether heartbleed is attaked while we are using heartbeat with apache(httpd)? [on hold]

We are using heartbeat for high availability of httpd. In httpd we are using openssl of version 0.9.8 but about heartbeat i dont much about that but while search in google some sites are sayong that ...
-2
votes
0answers
62 views

Is a PHP malicious code running behinde this page? [on hold]

Let us visit a website. Is there a way to detect that a given PHP page on it hides is running a malicious code ? I ask this from a programming point of view because I want to develop a PHP script ...
-1
votes
1answer
40 views

Determine if Tor works

I have installed Tor on my Mint computer, but how do I determine if Tor is working? When I visit http://whatismyip.com, my old IP is shown. Should it not be a different IP when I'm using Tor? Here is ...
0
votes
2answers
112 views

How different should passwords be?

It seems to be generally accepted the same password should not be used for different sites or devices. How different should passwords be? For example +_^gum<JW1 and +_^gum<JW2 are very similar. ...
0
votes
1answer
37 views

Repercussions of hacked router?

I am staying in Thailand right now on a "long holiday" to do some work on my laptop. A few weeks I noticed that at the condo where I am staying, sometimes I am redirected to ad sites. I researched it ...

15 30 50 per page