0
votes
0answers
3 views

Firefox:Secure connection failed(Error code:ssl_error_weak_server_ephemeral_dh_key)

A screenshot of the problem: Browser: Firefox 39.0 Is this a problem with my browser? How can I solve this?
2
votes
0answers
11 views

What countries have strong data protection laws?

Many answers on this site and other security-related websites state that one should host sensitive data in a country with strong data protection laws. What countries are these, and how is this ...
2
votes
1answer
38 views

Does a VPN Provider Know My MAC Address?

I know MAC is a layer 2 address, so it's only sent to the next router in the chain. Does a VPN provider get that information when I'm connected to their service? Is their router considered the next ...
0
votes
0answers
18 views

Strange Security Key of F.C.E. 365 - What this protect?

Is someone able to tell me what crypto algorithm F.C.E 365 is using? I caught the following key from a faulty old version of F.C.E. 365 Carmen. I can't understand a bit of it. What is this key meant ...
1
vote
0answers
15 views

Is there any way track a Andriod phone using IMEI Number

I have lost my phone and I have a IMEI number of it. However, the guy removed my SIM card. Is there any way to track who is using my phone?
1
vote
0answers
11 views

VOIP: Tampering RTP data

Is it possible to take an encrypted RTP stream, one that has no integrity, and somehow edit the conversation to produce another conversation, i.e. make the person say something they didn't mean to? I ...
1
vote
0answers
15 views

Metasploit payload problem

Recently I tested a shell vector payload. A text file converted to .bat, which is both theoretically and practically 100% undetectable by antivirus. First I tested it on my host computer for Kali ...
2
votes
1answer
22 views

What are the security benefits to block all http referer header requests for web browser?

I would like to know also if you lose site functionality. Is this a security benefit that is beneficial than compromising functionality (if compromising at all)? What I mean by this is one a ...
4
votes
0answers
28 views

When did development on various TLS versions begin?

What I'm looking for I'm looking for an approximation of the date that the development on each TLS or SSL version started (so the development start date). So I do not want to know the date when the ...
-4
votes
1answer
27 views

How do you detect a virus in an image [on hold]

I have no idea. [padding for minimum requirements]
2
votes
0answers
17 views

attack on Unix procmail analysis

2 days ago I received the following E-mail (this is its original format not the one of any mailer, but where sensitive information is replaced by ••field_name••): From qqqqqq@freemail.net Thu Jul ...
1
vote
1answer
42 views

LastPass authentication grid hacked on June 15?

I wonder how safe LastPass's grid authentication is. I take it that they have a copy of the authentication grid on their server. You are supposed to print the grid and carry it with you to any device ...
1
vote
0answers
16 views

Web services API key

I have a PHP server with some .php files. Swift iOS application send POST request to server and get some response in JSON. PHP files on server do some work with MSQL. The question is: How to provide ...
1
vote
1answer
29 views

Traffic shaping during a MITM attack

In my local network there are about 10 computers. I setup ettercap to do arp poisoning between a particular host and the gateway and now I can see that host's traffic. What I wanted to do next is to ...
6
votes
1answer
14 views

GnuPG passphrase entry and X11 sniffing

Each time when I’m entering my passphrase in pinentry-gtk-2, every other X11 app may sniff it, as seen in $ xinput test-xi2 running in the background. What can be done about it? Or do I have to ...
1
vote
0answers
37 views

Metasploit new exploits failed

Why can't I use new exploits like exploit/multi/browser/adobe_flash_nellymoser_bof ? I tried to access it, but I can't even find it in MSF search Adobe or Flash or anything like this. What should I ...
2
votes
1answer
33 views

Defense in depth vs single security architecture

Traditionally, we have been that defense in depth is the best practice approach if we want to secure our premises from security breach. However, I recently read about DoD's Joint information ...
1
vote
2answers
44 views

Gmail X.509 certificate chain

I have asked about this on several forums but never got a straight answer. If the root certificate on a certificate chain has a different fingerprint to the root certificate available for download on ...
1
vote
1answer
18 views

Supply chain risks

I wish to know more about supply chain risks. Does it only apply to companies which have products to sell and has suppliers and customers? Or do agencies such as a government agencies (e.g. department ...
-1
votes
1answer
26 views

A cctv system for a small shop

I am not sure if I should ask here but I really can't find any information anywhere else. A family member of mine (let's say X) runs a small fashion shop in Hong Kong, China. The problem is that ...
1
vote
0answers
21 views

Reformatting drive from a GUID partition to an MBR partition [migrated]

I understand that Truecrypt is not compatible with an GUID partition but that is the limit of my knowledge. I am currently using a system that has a GUID partition but doesn't have bitlocker ...
1
vote
1answer
20 views

Could a spoken (TTS) SMS-based 2FA be intercepted?

In mid-June, Lastpass made news again, and I've since been mowing around the idea of two-factor authentication. After familiarizing myself with SMS and Google Authenticator, I thought the SMS was a ...
1
vote
1answer
29 views

Can Client Certificates be tied to a Specific Server Certificate?

I have a Root Certificate Authority and and Intermediate Certificate Authority. I have created a certificate for the server. SSL on Apache is working fine. Browser recognizes my Chain of Trust with ...
-4
votes
0answers
29 views

a pdf that is really a zip with a pdf inside? [on hold]

I have a pdf file but really is a zip file with another pdf file inside ( so the file wx000.pdf when renamed to wx000.zip ) when trying to open the zip you will see the pdf inside but ask you for a ...
-1
votes
0answers
24 views

What are some or all the security compliances? [on hold]

What are some of the security related compliances such as HIPAA, NIST or PCI-DSS? is there a comprehensive list of all of them or some real major ones?
2
votes
1answer
61 views

Why am I getting the message that Security Stack Exchange is only partially encrypted?

I realize that this is an information website but it does concern me a bit that I'm getting the message that this website does not supply ownership information. Does this mean that my posts can be ...
-3
votes
2answers
39 views

HTML Sanitization

Is just removing < and > from any user input before it is displayed sufficient to prevent a website from being hacked? If not, how else could a website be attacked? I really have no idea what I am ...
1
vote
3answers
53 views

Best method for securing text based messages

If I wanted to use a device for the sole purpose of sending and receiving text based messages, could it be done so that the messages from A to B are as secure as possible, the information is easily ...
1
vote
1answer
36 views

Receiving random numbers in GET request query string. Exploit?

I recently spun up a web server and have been receiving hits where the client appends a random number, for example "12345" as a query string to the root (/) endpoint. Here's an example log entry: ...
0
votes
1answer
46 views

How to track who created a fake Gmail account using my name

I was forwarded an e-mail from my boss that was sent from a fake Gmail account that was created with my first and last name in the username, and included in the message were extremely derogatory and ...
-2
votes
1answer
44 views

Is a ZIP file password easy to break?

I thought that ZIP file passwords were a fairly decent protection. I came across this video, that seems to indicate otherwise. https://www.youtube.com/watch?v=SqRSNuJSm4o [12 minutes view time] ...
4
votes
3answers
331 views

SFTP on Windows - is it likely to be disabled?

I'm a software engineer and I'm maintaining a product that allows a user to run commands and scripts on Linux servers via an SSH connection. We now need to extend this functionality onto Windows. We ...
0
votes
1answer
19 views

Affordable FIM, log monitoring, policy enforcement/checking, IDS? [on hold]

I've been working with OSSEC for awhile, and it's just been head ache. What are some linux Intrusion Detection Systems that do File Integrity Monitoring, Log Monitoring, and policy enforcement (same ...
3
votes
1answer
82 views

How was my email intercepted?

I've recently sent an email to a non-Protonmail user, using a code phrase. Someone on the recipient's home network was able to intercept the email and responded to me in detail as to the content of my ...
2
votes
2answers
29 views

Multiple Versions of Intermediate SSL Signing Certificate

I was checking out the SSL chain on onlineaccess.ncsecu.org because a network glitch made me paranoid. Both Firefox and IE on my computer have this chain: onlineaccess.ncsecu.org Serial number ...
1
vote
0answers
27 views

Basic scrypt question

Suppose we throw a regular password into scrypt to generate some data. Scrypt allows us to specify how large the output data should be. My question is, to take an extreme case, if we ask for a 1 GB ...
2
votes
0answers
25 views

A simple HMAC question

Suppose I use a key (and IV) to encrypt a piece of binary data with AES-256-CBC to produce the corresponding encrypted data. Suppose I then throw this encrypted data into HMAC-SHA512 using the same ...
4
votes
2answers
132 views

Is storing encrypted data in a database futile?

The way I see it: there are two ways to encrypt data for a web app. 1) Store a single encryption key on the server, and use it to encrypt / decrypt data at runtime. The obvious issue here is that if ...
24
votes
1answer
2k views

What is this? Virus or scanner?

I found a new file in my WP root folder and contains this text: <?php ...
-3
votes
0answers
67 views

How does a person fully secure his home IT infrastructure [on hold]

I'd like to know how to set my router to only let ten specific IP-MAC addresses through? Also if the Windows 7 OS & 8 OS can be set so that malware/spyware cannot operate to give permissions to ...
0
votes
1answer
26 views

Certificate validation Local DNS hosts file

I've a question regarding a certificate validation error I'm getting. I'm performing an https request from one machine to another (windows machines). On the destination machine I've configured a ...
1
vote
0answers
22 views

Is it okay to add CSRF synchronized token by modifying HTML from a valve/filter?

Is it okay to modify the html and add a hidden field containing the CSRF token to all the forms inside a page using a valve or a filter before going to the browser? I'm thinking on this line since I ...
-4
votes
1answer
52 views

MPR I suppose somehow I found a way to make a super hacker angry with me [on hold]

I suppose somehow I found a way to make a super hacker angry with me. I've lost three cellphones. It might have all started with the iPhone 4 getting locked then both androids to simlock. And I'm at ...
1
vote
1answer
42 views

Different types of DDoS attacks [on hold]

What is behavior of UDP flood, TCP SYN flood, Ping of Death and Smurf attack?
13
votes
3answers
634 views

ISO27001 and Linux/Ubuntu

My company has ISO 27001 certification. They provided me a new laptop with Windows 8 OS in it. I asked if I can have a Linux/Ubuntu OS installed, they said that it is not possible due to the ISO 27001 ...
0
votes
1answer
32 views

Setting the HTTPOnly flag for PHPSESSID cookie [on hold]

I am getting this message from my security audit: Cookie name: "PHPSESSID" Cookie domain: "xxx.xxx.xx.xxx" If possible, you should set the HTTPOnly flag for this cookie. How can I set ...
-1
votes
0answers
36 views

I can't copy files from a HDD, do I need permission from my own account? [migrated]

My friend wanted me to backup all the photos and music and text documents on his hard drive so I'm trying to do that. He gave me the whole computer. It's an OEM machine from 2005 running Windows XP. ...
0
votes
1answer
37 views

Staying logged in as a user for remote access (such as Team Viewer) Pros & Cons

This company we newly help have no remote access policy for say, but they allow the users to use Team Viewer. I have noticed some user leave their PC logged in all night and weekends and just shut ...
1
vote
1answer
64 views

Secure Flag and HSTS in HTTPS Only site

If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
-2
votes
2answers
38 views

What is the weakness of aircracking wifi attacks?

I did not come to anything after searching Google for some time. What's preventing someone from just doing an aircrack wifi atack and do any kind of attack once logged on the victims network?

15 30 50 per page