1
vote
0answers
7 views

safe system32 folder or not

I have been (still am actually) under really serious hacker attacks now about 2 weeks and I have been cheking constantly all system files, incomening and outgoing traffic, changing rules and etc in ...
1
vote
0answers
4 views

Using Volatility To Extract File

I'm using Volatility to try and extract a key3.db file from a memory dump, and if I do dump files I can see it: DataSectionObject 0x8228a870 2656 ...
0
votes
0answers
12 views

Trust based Security Implementations

What are the newer trust based security implementations. (like PGP)?
1
vote
0answers
17 views

how to separate arguments in sql query

I have this query : 'UNION ALL SELECT group_concat(username,password) from users-- and I want to seperate username and password because when i execute the code it prints in all in 1 long string. I ...
1
vote
0answers
9 views

How to calculate Exposure Factor?

How can I calculate a single loss expectancy without a given Exposure Factor? Can someone please explain me?
1
vote
0answers
8 views

improving iOS 8 and os x security

I was just going through the iOS security guide and it made me wonder how could one improve security features already present. the current system in general looks pretty secure and well thought out ...
1
vote
1answer
17 views

File Recovery No Signatures(Magic Numbers)

Is it possible to recover a file from a disk image (dd image) if File Header/Footer, Signature has been altered/modified or removed? I mean for example if signature of the bitmap image (0x42 0x4d) or ...
2
votes
4answers
67 views

Do search engines give searcher's IP address to sites that come up in search?

Ok so for example, I search "stackexchange" and a bunch of pages come up in the search result - of course most of them from this very site, and many other ones talking about stackexchange. Would this ...
2
votes
0answers
19 views

How to get directly to text versions of Google cached pages [on hold]

http://navigators.com/cached.html According to the bottom of that site, it seems the easiest way to view websites without giving them your IP is: "Edit the heck out" of google URLs like this: ...
2
votes
1answer
22 views

Click to play plugins vs. AdBlock?

Reading through articles like Faked Flash-based ads... I'm wondering what is a better way to keep yourself safe from malvertising. Many people suggest setting your browser's plugin settings to "Click ...
1
vote
1answer
39 views

Password-less authentication in web apps - How safe it is?

I read a long time ago this article about how could work a Password-less Authentication System, which sounded to me like a great idea. I even built it in a small fun little application for fun. To ...
2
votes
1answer
22 views

Are cars with keyless proximity-based entry protected against range extenders?

Some cars unlock whenever the key fob is within a certain distance. Do such systems generally guarantee the maximum distance in a secure fashion (namely, by requiring the fob to respond within a ...
1
vote
1answer
27 views

Does visiting cached pages disclose my IP address to site admin?

I know it discloses my IP to Google, but is my IP also disclosed to the owner of the site of which Google made cached pages that I'm looking at? And how about anything I do within the cached page - ...
-3
votes
0answers
30 views

Can BitTorrent be exploited? With the help of Immunity debugger or other methods? [on hold]

I need help in this question for my college project. Please help I just need the code for exploiting bittorrent.
1
vote
0answers
23 views

Implementations of the Slow Loris Attack

I have been trying to implement this attack for my Apache server with Python for my security issues. For each new connection I'd send GET / HTTP/1.1\r\nHost: MyServer\r\nUser-Agent: Mozilla/5.0 ...
0
votes
1answer
39 views

wordpress server visitor IP address contains script, what's the risk?

I see this in my WP statistics: Is it safe to click on the link? Under what conditions will the script be triggered?
1
vote
1answer
39 views

Why do Facebook and Microsoft make you enter a code when reseting a password?

Typically when you reset a website password you receive an email. A lot of sites send you a link with a code on the end of it to click on which will take you to an 'enter new password' form. ...
1
vote
2answers
56 views

Foolproof way to hide your IP when browsing

is there a fool proof-ish way to hide your IP from websites you visit? I heard even if you use VPN, there can be 'leaks'? And one step more secure is Anonymizer or Tor? Can they have 'leaks', too? ...
1
vote
0answers
11 views

Non-trad bus model: I pay suppliers directly with client CC info. Need to be able to securely collect and read info [on hold]

I'm a home-based travel agent. It is against my contract with my host agency (and I think the law actually) to directly accept payment from clients. Instead, we use customer CC information to pay ...
1
vote
0answers
25 views

How is Facebook Spam/Hacks Achieved?

Recently a handful of my Facebook friends flew off the handle screaming about how horribly they had been "hacked" and how scary it was and etc. It was my view that most of these "hacks" were simply ...
4
votes
0answers
15 views

Is is possible to avoid internal seeding of a RNG and seed the generator manually using OpenSSL's RAND_bytes()?

I'm trying to write a random number generator with the OpenSSL library. The provided RAND_bytes() function is self-seeding with the /dev/urandom. That's why I am only able to reseed with the ...
-1
votes
0answers
13 views

SIEM Vs IDS/IPS

Hello I'm new to Computer Security. THE SIEM is Security Management System. When the organization have Firewall,IDS/IPS,anti-virus..etc Why they need SIEM. What are the additional features in SIEM ...
5
votes
1answer
25 views

How does combining SHA256 with RIPE-MD160 compare to SHA256 + SHA-3?

Bitcoin stores its addresses as a combined SHA256 + RIPE-MD160 hash. Is it correct to assume this is done to prevent a failure in the algorithm? Since SHA3 was designed to be an alternative to ...
2
votes
1answer
24 views

What is the default cipher algorithm for GnuPG?

I know, that one can force GnuPG to use AES256 for encryption with gpg --cipher-algo AES256 or with a special setting in ~/.gnu/gpg.conf. But, what is the default cypher algorithm for GnuPG, if I ...
4
votes
0answers
18 views

Re-display password in registration form good or bad?

When a user tries to register and the data he submits are not right such as bad email, or weak password, we would display the registration page again to him with the data he just submitted along with ...
3
votes
1answer
26 views

RSnake's Slow Loris tool

I was looking at RSnakes implementation of his Slow Loris done on perl which can be seen here. I set up a little server to listen to his packets, and at first found this GET / HTTP/1.1\r\nHost: ...
1
vote
2answers
29 views

Encrypting user credentials using AES: how to hide the key

One of my software (an R package) has to save on disk users sensitive information. I encrypt such information using AES encryption using a random key that is generated at the moment of installation ...
2
votes
1answer
52 views

Plain text password emailed back during registration

I would like to ask if the passwords in the database are not encrypted if during registration I am receiving plain text password with username.
3
votes
1answer
30 views

Modify the return address of a C function with buffer overflow vulnerability

I am trying to modify the following C program so that the main function will skip the printf("x is 1") line and only print "x is 0". void func(char *str) { char buffer[24]; int ...
2
votes
0answers
50 views

How do I allow for anonymous encryption? [on hold]

I have a protocol I am designing that requires anonymity and privacy. My idea is to have a minimum number of hops in the network before the message can be sent to its intended destination. The ...
-1
votes
0answers
18 views

Url quote escape (whenever I place a quote in the url, it escape it with '/) [on hold]

Title says it all, if you have any idea how to bypass that, please answer me :)
2
votes
1answer
22 views

Using Google Authenticator for SSH sessions

So I have an SSH tunnel which I use with dynamic port forwarding to the alternate http port on the client. For initializing this connection, I'd like to implement an additional verification step, ...
2
votes
0answers
16 views

How does SHA3 (Keccak & SHAKE) compare to SHA2? Should I use non-SHAKE parameters?

Keccak is the winner of the SHA3 competition. Since Keccak is highly customizable (presumably for security/memory/time/speed tradeoffs) there does seem to be some controversy around how Keccak ...
3
votes
2answers
67 views

How do dissidents use Tor?

The most common justification for Tor is that people in countries like China that don't have full protections on free speech can use it to publish dissenting opinions or access foreign information. I ...
4
votes
0answers
23 views

Should other processes be running while an iPhone or Android is generating a cryptographically random number?

I need to generate a cryptographically secure random number on iOS and Android. I could use a software approach or leverage the built in OS API for this. In each case, is it better to generate a ...
1
vote
0answers
40 views

A local IP address (RFC 1918) on my network that is not … local .. [migrated]

I've noticed an IP address today on my network (192.168.15.1) which when visited actually goes to a page that has a router webconfig page (Not my router) The puzzling thing is that i tried traceroute ...
1
vote
0answers
25 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. ...
2
votes
0answers
30 views

Can you securely allow users to create VM's on their workstations

I've moved from a job where developers were encouraged to use technologies like docker and vagrant to create VM's on their workstations for testing and development. At my new job, the IT manager ...
3
votes
0answers
51 views

What is the alternative tool for Honeypots? [on hold]

Nowadays the tools of Honeypots are not reliable as before, because an attacker with some knowledge can detect it and override its power. So if I want something with the same characteristics as the ...
1
vote
1answer
44 views

Has anyone used this ICLOAK USB device? [on hold]

Does anyone know about this ICLOAK USB device? Opinions or how well they work? I'm looking for a security solution when I'm using PCs where I work. Occasionally we have to log into to web sites, ...
2
votes
1answer
20 views

How is ECIES available in FIPS Validated libraries?

ECIES is Elliptic Curve Integrated Encryption Scheme. Both Certicom's SecurityBuilder and RSA Data Security BSAFE provide ECIES. Both are FIPS 140 validated, and both clearly list ECIES in their data ...
1
vote
2answers
34 views

Is Ignoring SslPolicyErrors while doing SSL Pinning Secure?

I am implementing SSL pinning as a security requirement for a project and the HTTPS endpoint is giving me SslPolicyErrors. The following errors occur, RemoteCertificateChainErrors ...
1
vote
0answers
26 views

Extraneus message about security risk when I open a new Chrome tab [migrated]

Today I start getting in Chrome a message saying: "I SEE YOU ARE A XXXXX CUSTOMER are you concerned that your Linux computer may have a potential security risk.... Please call toll free for ...
0
votes
0answers
22 views

What is the difference between AH and ESP for internet packets authentication and integrity?

What are the basic pros and cons when you have to choose between AH and ESP for authentication and security of IP packets? Why AH exists since the same functionality is provided by ESP for origin ...
2
votes
1answer
38 views

How to view all SSH authorized_keys for a unix server

How would I view all the authorised SSH clients from a unix server? I know that cat ~/.ssh/authorized_keys shows authorised keys if logged in from root. Can other users set their own authorised keys ...
3
votes
0answers
45 views

How does Silverlight protect the AES keys it gets from PlayReady? [on hold]

I'm doing some research about how Silverlight protects AES keys. Here is the scenario: There is a smooth stream live encrypted channel service. When i log in to the service and tune the channel, ...
11
votes
3answers
2k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
0
votes
0answers
37 views

What setup should I use to learn PEN testing? [on hold]

I want to learn penetration testing. What type of setup should I have, especially since I need to keep the cost down. Would VM be better than a Cisco lab I intend to build? Any insight is welcomed. ...
0
votes
0answers
65 views

Your connection to website is encrypted with obsolete cryptography in Chrome [on hold]

I can see the warning in about the our SSL certificate. This is chrome browser alone. See the below screenshot. I have check this problem in some links, they mentioned there is problem in key ...
5
votes
2answers
56 views

Linux random number compliance

Not sure if this is the right forum, and I am pretty sure that his must have been answered before (I searched a lot but I haven't found a definitive answer). Do the Linux random number generators ...

15 30 50 per page