Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.

learn more… | top users | synonyms

6
votes
3answers
776 views

Verifying android application integrity from server side

I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
0
votes
1answer
47 views

Sample attack scenarios on file downloads over HTTP

The websites that serve files over https, can it be considered overkill? or is it a best practice everyone has to follow? The downside to serving files over HTTPS is that you will lose the caching as ...
0
votes
2answers
109 views

Does SSL/TLS (https) reveals your IP address? [duplicate]

Because the NSA monitors traffic going through the major nodes of the internet, they can know which IP address does what on your website, even if you are using HTTPS. Is this true or false?
3
votes
2answers
54 views

Use password to calculate checksum for API requests

I was wondering if it would be an effective way of securing an API by requiring all requests to be checksummed, salted with the users password (or a hashed version)? With securing I mean making it ...
17
votes
4answers
2k views

Why would a website serve different versions of a file over HTTP and HTTPS?

Here is a link given on curl's official website: (prefix omitted) bintray.com/artifact/download/vszakats/generic/curl-7.46.0-win64-mingw.7z When I downloaded it with prefixes http:// and https:// I ...
3
votes
0answers
54 views

How does a Sign tool work?

My basic understanding about sign tool is: 1.It loads the zipfile(may be exe,jar,ddl,apk..) which has to be signed to its memory(cache memory of the sign tool). 2.It will verify it, and unzip the ...
6
votes
1answer
53 views

Subresource Integrity versus signing

The draft spec for subresource integrity is straightforward: This document specifies such a validation scheme, extending two HTML elements with an integrity attribute that contains a ...
6
votes
0answers
63 views

Can a faked iPhone SMS log be detected

SMS messages received by an iPhone is stored unencrypted in an SQLite database, which may be extracted by backing up the phone. You can manipulate (tamper with, e.g: replace the text of a message ...
1
vote
3answers
140 views

Why would a replay attack be considered a threat to integrity and not confidentiality?

I came across a test where the instructions were to circle all the correct answers. I'm looking for an explanation to the answer for this question: Question: a replay attack is a threat against ...
2
votes
3answers
68 views

Can a file get accidentally corrupted while downloading?

I read an answer here about websites providing downloadable files together with their hashsums. It contained a sentence I'm thinking about whenever I download something, but I never really understood ...
4
votes
3answers
88 views

integrity and consistency

This confuses me sometimes, I just need to know what is meant by integrity and consistency just in simple terms or in computer security. will it be wrong to say:- someone who gain an unauthorised ...
1
vote
2answers
53 views

does validating MAC of individual packets validates the integrity of whole file?

When transferring a large file over network, its likely that the file is broken into packets and then transferred. The underlying network protocol, lets consider the case of TLS/SSL, it generates MACs ...
1
vote
0answers
51 views

Purpose of MAC when encrypting? [duplicate]

Really basic question, but what is the purpose of using a MAC/HMAC when you are encrypting using a symmetric key algorithm? It is my understanding that the purpose of a MAC is to authenticate the ...
5
votes
2answers
93 views

What is the difference between the “sig” files and the checksum files, such as on the PuTTY download page?

This is about the functional differences between sig files and checksum files and how they can be used by a user downloading some software. For example, on the PuTTY download page both sig files and ...
2
votes
1answer
68 views

Protecting a database against insiders

Consider a network for a web-application with 1 webserver and 1 MySQL database, both on physically different servers and both running Linux. The database stores mission critical data and this data is ...
5
votes
2answers
74 views

Data Integrity in PKCs

This is a simple question but one which greatly confuses me. When you have a PKC, the public key can be accessed by anyone. Therefore, doesn't this mean that anyone can encrypt data? My question is ...
3
votes
2answers
66 views

Does MDC integrity protection matter in symmetric encrypt/decrypt of local files?

I'm configuring scripts etc. to use GPG's symmetric mode to encrypt some files on my home desktop system. When I want to edit one of the encrypted files I decrypt it and pipe it into my editor and ...
1
vote
1answer
57 views

Denial of Service during scanning [closed]

As I know you can do Denial of Service when footprinting with scanners, like nmap or Maltego. But is it legal? As I know, scanning isn't illegal but doing DoS attacks is. EDIT I meant if you scan ...
4
votes
3answers
363 views

Message Authentication Codes (MACs)

What is the main difference between Message Authentication Codes (MACs) and hash function? Is there any difference regarding their usage domains?
2
votes
2answers
91 views

Confidentiality and integrity

Users permissions and privilege should be considered as a part of confidentiality (specifically access control) or integrity? And I'm also wondering if we can categorize Accountability, Authenticity ...
1
vote
2answers
140 views

What the most trustworthy way to demonstrate digital File Integrity?

I'm looking for ensure the integrity of uploaded files and demonstrate this integrity to a user. In my current scenario, a user sends multiple files in several different formats, these files are ...
7
votes
3answers
126 views

Automatic detection of a compromised web server

I'm trying to figure out if it is possible to automatically detect the the fact that the HTML or javascript files on a server have been tampered with or changed by an attacker. Our website, say ...
4
votes
2answers
167 views

Can TLS provide integrity/authentication without confidentiality

It was a bit surprising that Wikipedia has switched to TLS because we all know it's public information available to anyone, but I suppose that the real purpose for that is to provide ...
1
vote
1answer
74 views

Best way to ensure integrity of encrypted data which is kept in a public place

I need to keep sensitive data in a de fact public place (i.e. with a user, e.g. in a cookie) and only there (no copy or hash of that data should be kept on the server). The data was encrypted AES/CBC ...
-2
votes
1answer
85 views

Why do browsers have no built-in features to verify the integrity of downloads? [closed]

I just started a download of a large file. Checksums were placed prominently on the download page. But I just realized that I actually never made use of any of the checksums provided for download ...
0
votes
2answers
97 views

How to detect if file is being modified while my program reads it?

I'm writing an auto-updater tool that is run with admin permissions. It's job is to download and install files from a tat archive. The problem is solved to the point where I can verify identity of ...
2
votes
2answers
88 views

Authenticated encryption (Symmetric encryption) for .NET applications [closed]

Is there an implementation of Authenticated encryption for .NET applications? The AES API from .NET does not include mode such as GCM. In the documentation, I can only see insecure modes (ECB, CBC, ...
3
votes
2answers
36 views

Standard (or solution) for securing files in a point-to-point integration

I'm looking for a relatively light weight way to secure both integrity and confidentiality for files being uploaded in a point-to-point integration. The use case is uploading batch files for ...
1
vote
1answer
1k views

Difference between authentication, integrity and data origin authentication

I first thought all these terms were synonyms, but I sometimes see those terms used in the same document. For instance, on MSDN: data origin authentication, which enables the recipient to verify ...
1
vote
2answers
66 views

Methods to keep an autonomous log with high integrity

I'm writing a .NET desktop application that is used to send orders to a server via a REST API. To avoid leaking of our authentication token I have made it so that, when used for the first time, the ...
0
votes
1answer
63 views

Is this a secure hash “Function” for integrity?

I was wondering what were the posible security (not efficieny) issues with this hash "function": Although not an actual function, this method turns a message of any length into a message of fixed ...
2
votes
1answer
109 views

How easy is it to hide adding a file to a git repository

Here's the scenario... I have a git repository on a server that may have been compromised. My development team say that they can trust the files in the directory that houses the git repository ...
0
votes
0answers
41 views

How to properly store result of AEAD encryption

So for AEAD we have this scheme: encrypt(AD, Data) -> [key, cipher, tag] What if I want to provide some external identifier as an additional data (to be able to prove ext_id to get data back is ...
1
vote
1answer
70 views

Virtual Machine Integrity Hash Check

If I used virtualbox to create a snapshot template of a preconfigured linux machine and wanted to ensure that no one has tampered with my snapshot, could I simply keep a comparable hash of the VDI ...
4
votes
1answer
135 views

Can BTRFS provide authentication on an encrypted disk?

One of the problems of disk encryption is providing authentication. An attacker with access to the ciphertext can modify the ciphertext at will without consequence. Given, this isn't a likely attack, ...
2
votes
0answers
73 views

If someone hacks our server, how can we prevent them from decrypting data stored in Vault?

I have been tasked with evaluating Vault in our company and the first question asked by an architect was: If someone hacks our server, how can we prevent them from decrypting data stored in Vault? ...
0
votes
1answer
54 views

Would Poly1305-PBKDF2 be secure

I have a Poly1305-implementation (not Poly1305-AES) in my library. The difference: Poly1305-AES uses a key and a nonce and then uses AES to generate a one-time-key from key + nonce. This is ...
4
votes
1answer
129 views

Does LUKS protect the filesystem integrity?

I have read in: http://css.csail.mit.edu/6.858/2013/readings/bitlocker.pdf that Bitlocker does not provide data integrity since it takes more space in the disk. The PDF says also that drive ...
4
votes
1answer
2k views

JSON Web Tokens - How to securely store the key?

I was building a RESTful Web Service when I came across JSON Web Tokens as an alternative to traditional cookies for authentication. The concept core of this method is that the server is the only ...
18
votes
5answers
3k views

How can I ensure my dll has not been modified?

I have an old project in VB which created an unique pc code from MAC address and disc id. This was used to identify a pc so credentials cannot be used between pcs. This project migrated to C#, and I ...
2
votes
1answer
104 views

Does any DNS Recursive resolver accept a “DNSSEC-only” option under DNSCurve?

I want to use DNSCurve (for privacy) to a trusted DNSSec resolver (for integrity), and want to ensure that I can tell a recursive resolver (like 8.8.8.8, or OpenDNS) that I only want DNSSec queries. ...
2
votes
1answer
88 views

For intrusion detection, tripwire, using crypto hash integrity checking - what can be expected?

Intrusion detection using something like Tripwire that conducts integrity checks through crypto'ed hash functions of files requires a scan and to hash the file and save this for later comparison. ...
1
vote
0answers
40 views

How to Verify the Integrity of the BlackBerry Momentics IDE Download for Linux

I am currently setting up development environments for BB10 apps on Linux workstations. BlackBerry provides their Momentics IDE for free from (https://developer.blackberry.com/native/downloads/). The ...
4
votes
1answer
133 views

Securing client-side data from users

So my problem, in its general form, is encrypting test questions such that a client-side testing application can access the questions while students cannot. The naive approach, in my opinion, is to ...
2
votes
2answers
130 views

Whitelist-based integrity scanner for Windows EXEs, DLLs, etc [closed]

I am looking for some kind of security software that scans your computer for all EXE and DLL files, calculates a cryptographic hash for them, and looks each one up in a database, logging all the ones ...
5
votes
2answers
245 views

Which Windows Files Should be Monitored by HIDS?

I highlighted my question below. Here is some background. It's easy to find data showing the most commonly trojaned/modified Linux binaries and config files. ps, ls, find, kill, lsof, passwd, ...
1
vote
2answers
106 views

Does Google ensure that a packaged app is not tampered with?

I'm wondering if a chrome app I upload to the Chrome Webstore could potentially be manipulated (even by Google itself) without users downloading the app noticing it. I just downloaded a packaged app ...
1
vote
0answers
41 views

AES and message properties

An active attacker changes the ciphertext which was made using the AES cipher algorithm. Which message properties are preserved even though that change was made. Choose one of the below: 1) Integrity ...
0
votes
0answers
62 views

How can security models be relevant to the current environment?

I am trying to understand the Clark-Wilson and Brewer Nash Security Models. After deep research, I couldn't find any solution or idea to find out the relevance of these models in the current ...
1
vote
2answers
136 views

Should the whole web *really* be encrypted? Isn't plaintext sometimes faster/better? [duplicate]

It seems to be commonly accepted nowadays that all internet communication should be encrypted. (For example, this is evident in how the HTTP 2.0 standard outright requires HTTPS.) However, I have a ...