-1
votes
0answers
11 views

TrueCrypt not working on OS X 10.10.1

Can someone help explain why TrueCrypt isn't working on OS X 10.10.1 anymore? I can't get any version to work and it is frustrating. I know TrueCrypt has been discontinued with development but it was ...
2
votes
0answers
11 views

Which manufacturers who make BadUSB possible on their drives?

So as we all know by know BadUSB is possible on Phison 2251-03 chips. But are there any more reflashable devices in the wild that could be dangerous? And if there are is the firmware easily changed or ...
-4
votes
0answers
13 views

In what companies can I find internship/job in information security?

I am a computer science master's student from Europe, majoring in information security and looking for an internship. The problem is that I have no idea what jobs there are in what kinds of companies ...
0
votes
0answers
13 views

Is it safe to send this extra verification material when my credit card was flagged as high-risk? [on hold]

My credit card recently expired, so I got a new one. However, my web hosting company rejected this card because it was flagged as high-risk by a third-party risk estimator. To override this, I'm being ...
0
votes
0answers
7 views

How do interfaces work with in a VPN (en 0 & tun 0) [migrated]

VPN noobie here with a general VPN question. I have just installed a vpn on my mac. When i opened wireshark to check what was going on in the VPN i notice that two interfaces are at work. One ...
2
votes
1answer
20 views

How to securely install software on Ubuntu?

How to install a software like Sublime Text on Ubuntu 14.04 LTS and mitigate against a MITM attack? There is a PPA available, but the PPA must be added manually. I don't see any PGP keys or MD5 ...
-1
votes
0answers
11 views

Pair verification functions [on hold]

Is there a function (say f(x)) to find a string q for string p such that another function g(p, r) returns true or false depending on r matching the p's q without the involvement of data storage?
1
vote
2answers
70 views

Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?

It has become quite difficult to configure an HTTPS service that maintains "the ideal transport layer". How should an HTTPS service be configured to permit some reasonable level of compatibility while ...
0
votes
0answers
28 views

Can TLSv1.0 ciphers be used with SSLv3?

Can TLS cipher, such as TLS_RSA_WITH_AES_256_CBC_SHA, suites be used within an SSLv3 connection? For example, say the client and server both support TLS but the connection is downgraded to an SSLv3 ...
-1
votes
1answer
24 views

Have WhatsApp rolled out their end to end message encryption system using the protocol used by Textsecure? [on hold]

According to this link, Openwhisper systems have said that WhatsApp with their collaboration will be implementing end to end encryption for all of their messages. Has it been implemented yet?
3
votes
2answers
195 views

What is the need and purpose of packet injection within WiFi attacks

According to my research, the most common WPA/WPA2 WiFi attack requires a chipset capable of packet injection. However I am not sure what this is, and what purpose it serves once you have the ...
-1
votes
0answers
10 views

Is is possible to use a database backend for OpenSSL? [on hold]

Typically, PKI actions result in updates to a number of files, e.g., index.txt, serial, etc. where the OpenSSL library/binary runs. However, this could be problematic where the PKI infra is hosted ...
1
vote
1answer
96 views

Get WPA-Passphrase from HEX key and SSID?

Down to the business. Using this as an example for WPA key calculation link Network SSID: linksys54gh WPA passphrase: radiustest Hexadecimal key: ...
-1
votes
0answers
10 views

monitoring local admin remote login [migrated]

Using SIEM system, how can I monitor the event of someone remote login into a computer using a local adminstrator account ? By using RDP you can remote login using local adminstrator account into a ...
2
votes
1answer
37 views

Verify client-side created data

I have a Java applet, which records the whole screen of the user and uploads the images to the server. If one would be able to (and many people could, I know) falsify the screen recording they could ...
-3
votes
0answers
24 views

What is the condition i have to set to make the image upload secure php [on hold]

What are the conditions that I have to check while uploading an image to my website to avoid getting attacked or hacked? For example in w3school uploading image example here checked if the image : ...
0
votes
0answers
8 views

Why is multiple hashing not a good idea? [migrated]

There are plenty of questions on this site about hashing passwords. However, none of them quite cover this topic. One of those links covers using multiple different hash algorithms; one covers general ...
0
votes
0answers
13 views

RT2800 USB: monitor mode using Virtual Box [migrated]

Information I am using a WiFi USB Adapter and the latest version of Kali running under VirtualBox. Chipset: Ralink RT2870/3070 Driver: rt2800usb Manufacturer: TP-Link FCC ID: TE7WN727NV3 It is ...
4
votes
2answers
39 views

does using a long delimiter multiple times degenerate encryption security?

I need to condense multiple distinct pieces of data into a single encrypted string that can be decrypted and separated out later. Before encrypting, I need to separate the data with some kind of ...
1
vote
0answers
30 views

What is the security value of this on-the-fly user registration?

I am currently implementing SRP on a game I am developing. However, I will be distributing this game server and client, so I would like registration to be allowable on-the-fly, without requiring the ...
0
votes
1answer
88 views

Can a Windows or Linux password be brute-forced on a public network?

I am at a hotel that has a public network. I have a Windows machine with a wired connection to it. "Network and Sharing" has network discovery on. No folders are shared except "Users", which is shared ...
3
votes
1answer
33 views

Database Security

Would having the IP address and name of my database visible to the public be a security risk? I have hosting with godaddy, a shared hosting plan. When I connect to my DB, via MS-SQL-MS, I can see the ...
1
vote
2answers
38 views

Reasons to encrypt filenames on cloud backup

I use a cloud service for my off-site backup, and all my files are encrypted. But I am wondering whether to enable filename encryption or not. Are there any security advantages to be gained by ...
1
vote
0answers
19 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
-1
votes
2answers
55 views

Is JavaScript console vulnerable to XSS

Assume the content of the name variable below is controlled by an attacker. Is this line of code vulnerable to XSS? console.log(name) When I send an injection in name variable I see its value ...
-1
votes
0answers
32 views

Are there different types of watermarking, and do they require different types of security?

I can identify two types of watermarking. One is what I call "branding." That is, you put "watermarks" on your documents to identify them as yours, before sending them out over the "net." These ...
0
votes
0answers
103 views

HTTPS web browsing [on hold]

For an HTTPS web browsing, is it allowed to receive an out of order packets at the receiver. If so, is it possible to reorder the received unordered packets? Consider specific features in HTTPS that ...
3
votes
0answers
69 views

How are random numbers for RSA generated? [migrated]

The RSA public key encryption requires two very large prime numbers as part of its encryption process that serve as secrets. These are typically generated with cryptographically secure random number ...
0
votes
1answer
59 views

How to fake a browser fingerprint?

I'm developing a browser based on Google Chromium and keeping in mind that privacy is freedom; but I need to know how to protect my browser's users against fingerprinting. I was thinking about ...
0
votes
0answers
18 views

Email account password change via email-to-script

I host a mail server (postfix and dovecot) and I wish to set up a password change feature (especially useful when creating a new address provided with a temporary password). Does my scenario has ...
0
votes
0answers
19 views

tutorial on writing attack signature based on known vulnerbility

Can someone recommend any tutoial or books on how to write IPS ruLes that detects attacks exploiting known vulnerabilities. Basically given the details of a vulnerabilty, I need some guide/examples ...
0
votes
1answer
28 views

What exactly is a subkey?

I fairly understand the math behind RSA, Elgamal, AES, SHA but not how things are used in practise. How are subkeys different from master key? I understand its purpose from various websites but How is ...
3
votes
0answers
43 views

PKI Installation

I must install a PKI in my organization. I work in a windows environment. I already set an offline CA. I must now install a subordinate CA. I have the choice between installing the subordinate CA on a ...
1
vote
0answers
33 views

How to monitor my internet traffic split between a PC and laptop?

I'll try to describe my problem as specific as possible. So I have an internet connection and there are two PCs using it. Now let's call my laptop as A and the other PC as B. Laptop A - My laptop, ...
1
vote
1answer
27 views

TOOL-BARS: How do toolbars manage to insert new settings on to the users computer when legitimate programs can't/won't do it?

I accidentally installed Ask Toolbar, and it changed my Homepage,Search engine and added some extra stuff. It did all this without alerting Google Chrome! But when I try to install a legitimate ...
0
votes
0answers
31 views

How is Thread local storage used by malware/Virus?

I have been told that code in TLS is run before the entry point of an exe is reached ,so if one puts a breakpoint on this TLS address he/she could debug the behavior of the virus.Can Fiber local ...
2
votes
1answer
26 views

Arduino to Android secure bluetooth connection

I'm using an Arduino Uno and a nRF8001 board from Adafruit to connect to an Android phone over bluetooth. I will be using it to lock and unlock a lock and I need to make sure only verified devices are ...
-1
votes
1answer
52 views

SQL Injection - Don't follow redirect? [on hold]

There are certain sites that have a Redirect once they detect malicious behaviour. Once you try to find a hole (assuming the service is vulnerable), everytime you try to submit a link with malicious ...
1
vote
1answer
16 views

What account should be used to install SQL Server 2008 patches?

The company I work for is currently going undertaking a project to remediate (among other things) a pen-test finding that a privileged domain-level account (which they compromised) was being used for ...
4
votes
2answers
410 views

Identifying an ongoing exploit?

Recently I was contacted by a person saying that they had found a vulnerability in my site. They were able to prove it, by sending me a list of my own databases (some of which had been created but ...
0
votes
0answers
29 views

How to get a token for Facebook using only login and password? [on hold]

'm working on proxy XMPP that listen on port 5222 for Gtalk and I need token to change the request of users and sent it to the server that's why I use this url: String url = ...
-1
votes
1answer
33 views

How can I test my CAPTCHA's (or CAPTHA-alternative's) effectiveness?

Are there any tools out there to test the effectiveness of user turing tests, such as CAPTCHAs or honeypots, on a site without intentionally getting the site targeted by spambots? Or do I simply have ...
3
votes
2answers
68 views

How does infection through web surfing work?

Often I read about compromise due to visit a malicious site which download some exploit to your computer. I've never seen a detailed process, all books/tutorials I read just say sentences like "once ...
0
votes
1answer
29 views

is copy pasting sudo password from opened document a possible vulnerability?

During setup of my ubuntu systems after installing the system offline i open a textfile and change my sudo password by typing it into a textfile and paste it after so that i don't lock myself out by ...
-3
votes
1answer
46 views

Decryption of data [on hold]

Apparently, for privacy I have encrypted data on my mobile. A few pics (family ones). This I did through ES File manager, was using AppLock previously but encountered a few errors for storage so I ...
6
votes
1answer
113 views

Is ntpd running purely as a client vulnerable to the recent ntp vulnerabilities?

There's been 3 recent vulnerabilities in the NTP reference implementation. Namely: CVE-2014-9296 CVE-2014-9295 CVE-2014-9294 Is ntpd, or ntpdate, running as a client vulnerable to any of these ...
7
votes
1answer
265 views

How does SSH use both RSA and Diffie-Hellman?

SSH protocol 2 allows you to use DSA, ECDSA, ED25519 and RSA keys when establishing a secure connection to a server. (Keep in mind for this question that I'm only familiar with the procedure and ...
1
vote
1answer
28 views

MS03-026 RPC DCOM Exploit not working on metasploit [on hold]

I'm trying to exploit Windowx XP SP2 through MS03-026 Microsoft RPC DCOM Interface Overflow vulnerability on msfconsole. When execute "exploit" but it is not working. What could be reason? The one ...
0
votes
1answer
20 views

How I do get the correct the Tamper parameters from an internal web login [on hold]

I am doing pentesting for a web application, but I do not know if am using the Tamper Data add on on mozilla correctly. Could anyone explain how to get the following parameters, and where do I need ...
0
votes
1answer
35 views

Upgrade my Dell Inspiron laptop for PenTesting [on hold]

I have a Dell Inspiron N5110 & wanna upgrade it to start practising pentesing with virtual machines. What do u suggest from specs below to upgrade (I have Kali Linux, Tails OS, XP, Metasploitable ...

15 30 50 per page