Questions relating criminal activity, performed (or aided) with the usage of a computer system.

learn more… | top users | synonyms

8
votes
2answers
249 views

Are social security numbers useless by themselves?

If 453.7 million social security numbers have been issued to date. And there are only 1 billion = 1000 million distinct 9 digit integer pairs. Then that means if I were to make up any 9 digits, that ...
1
vote
1answer
135 views

Why do so many cracking attempts originate from China?

I recently put a Linux server online and it didn't take long until I had the first attempts to brute-force the SSH login. It's not that I am worried about that - I trust the security of my server. But ...
1
vote
0answers
85 views

Are there any known cases were antivirus software have deliberately ignored malware?

Are there any known cases were antivirus companies for some reason have choosen to make their product allow/ignore malicious software? The reason could be government coercion or former trustworthy ...
-1
votes
1answer
481 views

Someone borrowed my phone and Im scared its hacked [closed]

I am from Australia and I use a iPhone 4. Today, a young guy asked to borrow my phone, since he was out of credit and since I was trying to be a good samaritan, let him borrow my phone (also we were ...
0
votes
0answers
67 views

Fixing compression oracle in GZIP library

What design change would you add to the GZIP algorithm so that it makes sure that compression oracle is not present anymore? This is assuming that both the INFLATE and DEFLATE endpoint designs can be ...
-2
votes
1answer
49 views

Privacy vs monitoring cyber crime [closed]

So , how does the police find/monitor criminals' actions (eavesdropping) that do cyber crime(pornography , drug trafficking etc..) without breaking their privacy, and succesfully catch em and provide ...
2
votes
1answer
1k views

Do the BEAST and CRIME attacks apply to an IMAP service?

While setting up the Dovecot IMAP service, I noticed that the default parameters are not optimal, it allows SSLv3 for example. Using Thomas Pournin's TestSSLServer.java program, I saw the following: ...
-8
votes
1answer
168 views

Viable way to ruin a milk corporation? [closed]

Hack into their system and change the "Sell by" date so that it is immediately bad. How long do you think until they notice, if you pull it off?
1
vote
2answers
786 views

Clients breaking after avoiding RC4-MD5

As per http://projects.webappsec.org/w/page/13246945/Insufficient%20Transport%20Layer%20Protection , we have been recommended to stop using RC4-MD5. The clients supported by our Application are IE ...
4
votes
1answer
971 views

Whats the best custom compression method to use when I have SSL?

Suppose I have an application which does encryption using SSL and provided you cannot control what cipher suite is being negotiated, and assuming that I have some custom compression over the data ...
3
votes
2answers
198 views

Is revealing your residence physical address when browsing the web a security risk?

I live in a large apartment building that provides a wireless service for residents. All of that traffic goes through a proxy server, and the domain name on that server contains the name of the ...
0
votes
1answer
127 views

Mobile Broadband, e-Fraud & Anonymity Against My Website [closed]

I was wanting to know if the blend in the title of this post provides e-criminals an open field to explore. What I mean is this: say a fraudster goes and buys a pay-as-go SIM card from a certain ...
3
votes
1answer
167 views

Is NTFS file compression vulnerable to a CRIME-like attack when using an encrypted volume?

I know that content compression can cause SSL to be vulnerable to the CRIME attack, via changes in the content length when injected plaintext matches existing content. Does this principle carry over ...
3
votes
5answers
6k views

How to Investigate Wi-Fi Intrusion and where to look for evidence?

I'm trying to figure out how to configure a network so that I can tell what an intruder did (in the past) while on the network after they are detected. eg. If someone with a wi-fi enabled laptop ...
3
votes
1answer
2k views

Detect a server supporting SPDY?

With my current interest in the CRIME attack, I am currently trying to check if there actually exits a way to "fingerprint" a server that supports SPDY? My research lead me to believe only that the ...
12
votes
1answer
11k views

Tools to test for BEAST/CRIME that AREN'T Internet-based?

We have increasing pressure to identify and remediate any HTTPS server configurations that are vulnerable to BEAST (CBC) and CRIME (compression). We need to fix servers that are accessible to the ...