Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.

learn more… | top users | synonyms

0
votes
1answer
17 views

How robust is a VeraCrypt Container against disk errors?

I am planning to encrypt backup data using VeraCrypt. How safe are the generated containers? My worries is not so much the encryption, but potential data loss due to degrading harddisk media over time....
-1
votes
0answers
55 views

Why would I need to check data integrity after sending file over ftp, sftp or ftps? [migrated]

I need to transfer some files from remote computer and I plan to do it via FTP (or SFTP or FTPS). Apparently, FTP is based on TCP protocol and if I remember well my lessons the difference between TCP ...
1
vote
2answers
88 views

Does this method of password confirmation risk encrypted file integrity?

I'm trying to make a basic encryption/decryption script for personal use, and it works perfectly fine. I'm posting this in the infosec section because my question revolves around how easy it is to ...
0
votes
1answer
61 views

Control flow integrity and data flow integrity

Most of todays exploits can be prevented by control flow integrity (CFI). However, there are also data only exploits (e.g. Heartbleed, read arbitrary data/keys). These exploits could be prevented by ...
1
vote
2answers
46 views

Difference between information flow control, data flow integrity, and tainting

The three techniques/concepts are frequently mentioned in recent academic security papers. But what are the similarity, difference and relation between them. Below is my very shallow understanding: ...
42
votes
4answers
9k views

Why aren't application downloads routinely done over HTTPS?

We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits: Encryption: The data can't be read by a middle-man while in transit. ...
0
votes
0answers
26 views

Kernel-based integrity measurement of an operating system startup in RAM

This idea is based on the Integrity Measurement Architecture and the usage of a trusted platform module to ensure the integrity of boot procedures. Let's say we have a kernel designed for an embedded ...
1
vote
2answers
190 views

Whitelist-based integrity scanner for Windows EXEs, DLLs, etc [closed]

I am looking for some kind of security software that scans your computer for all EXE and DLL files, calculates a cryptographic hash for them, and looks each one up in a database, logging all the ones ...
2
votes
1answer
41 views

Can the server detect when a client has disabled certificate pinning?

Many mobile applications enforce certificate pinning in order to make a man-in-the-middle attack difficult to accomplish. However, with a jailbroken/rooted device, it's possible to disable the ...
1
vote
0answers
52 views

Which is the correct algorithm while checksumming a portion of code?

As part of my research, I came across a technique in a paper which applies checksumming on a portion of code. I want to implement it. Here is the research paper which talks about the checksumming ...
4
votes
2answers
71 views

Signature that can only be verified by author and recipient - without pre-shared key

Desiderata: Alice wants to send a message to Bob for him to keep and to be able to refer to, such that Bob can be certain that the message came from Alice and was not tampered with. Alice also ...
2
votes
0answers
45 views

NIST SI-7 experience

On a recent project we have been asked to implement NIST SI-7 parts 1, 3 and 4. I have looked for a full software solution, but cannot find anything like that. Does anyone have any experience on this?...
3
votes
2answers
112 views

Does MDC integrity protection matter in symmetric encrypt/decrypt of local files?

I'm configuring scripts etc. to use GPG's symmetric mode to encrypt some files on my home desktop system. When I want to edit one of the encrypted files I decrypt it and pipe it into my editor and ...
1
vote
0answers
21 views

Are there any specific advantages of using a BLOCKCHAIN tech in the data tier of an organization from a information security perspective?

BLOCKCHAIN seems to be the most talked about tech topic in 2016. A cryptography powered distributed computing technology that has many potential applications. Are there any specific ways / ...
1
vote
1answer
84 views

Fast data integrity protection

I have a small device with a 16-bit (embedded) architecture, which transmits 1500 bytes every 3 milliseconds. This device has no built-in integrity protection, and it is possible to manipulate the ...
7
votes
2answers
186 views

Can BTRFS provide authentication on an encrypted disk?

One of the problems of disk encryption is providing authentication. An attacker with access to the ciphertext can modify the ciphertext at will without consequence. Given, this isn't a likely attack, ...
15
votes
1answer
2k views

Download an OS image via torrent [duplicate]

If you take the Ubuntu alternative download page for example, there, you have the possibility to download the OS also via torrent. Being a peer to peer where files are stored on anyone's machine got ...
16
votes
2answers
1k views

Is Torrent safe for sharing legitimate files (file verification)? Does it use SHA1 or SHA256?

Let's assume that a legitimate torrent file has been safely and successfully downloaded over HTTPS and perhaps even OpenPGP verification was used to verify the integrity of the torrent file. How good ...
0
votes
3answers
82 views

does validating MAC of individual packets validates the integrity of whole file?

When transferring a large file over network, its likely that the file is broken into packets and then transferred. The underlying network protocol, lets consider the case of TLS/SSL, it generates MACs ...
0
votes
1answer
98 views

FileVault 2 FDE and BoxCryptor are safe to use together or they have conficts?

Assuming that someone has a Mac and uses FileVault 2 FDE (256-bit AES key) and uses the BoxCryptor (256-bit AES key) for the clouds like Dropbox/GDrive/etc and or some other folders. FileVault 2 uses ...
1
vote
0answers
72 views

What are the appropriate steps to take after installing a questionable Android app?

Situation: User installed an Android app from the Google Play Store. User's device is rooted, but that app does not have root privileges. XPrivacy reveals that the app is trying to make IPC (inter-...
5
votes
2answers
103 views

Effective File Integrity Monitoring (FIM)

I have hundreds of windows servers in my environment that I need to monitor using FIM. I am afraid that after every patch (each patch might affect and change the hash of hundreds of sensitive files) ...
0
votes
0answers
11 views

What integrity does the TLS Record Protocol actually provide?

In TLS the "base" protocol is the "TLS Resource Protocol". This protocol is responsible for: securing application data and verifying its integrity and origin. It also uses a HMAC. However this ...
7
votes
1answer
76 views

Subresource Integrity versus signing

The draft spec for subresource integrity is straightforward: This document specifies such a validation scheme, extending two HTML elements with an integrity attribute that contains a ...
6
votes
2answers
967 views

Can a faked iPhone SMS log be detected

SMS messages received by an iPhone is stored unencrypted in an SQLite database, which may be extracted by backing up the phone. You can manipulate (tamper with, e.g: replace the text of a message ...
0
votes
0answers
15 views

message integrity under ssl connection [duplicate]

I read this article which is a great article to everyone wants to know how SSL works but still I have one other thing which I want to know about the communication using the SSL layer, my question is ...
6
votes
3answers
1k views

Verifying android application integrity from server side

I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
0
votes
1answer
70 views

Sample attack scenarios on file downloads over HTTP

The websites that serve files over https, can it be considered overkill? or is it a best practice everyone has to follow? The downside to serving files over HTTPS is that you will lose the caching as ...
0
votes
2answers
121 views

Does SSL/TLS (https) reveals your IP address? [duplicate]

Because the NSA monitors traffic going through the major nodes of the internet, they can know which IP address does what on your website, even if you are using HTTPS. Is this true or false?
3
votes
2answers
107 views

Use password to calculate checksum for API requests

I was wondering if it would be an effective way of securing an API by requiring all requests to be checksummed, salted with the users password (or a hashed version)? With securing I mean making it "...
17
votes
4answers
2k views

Why would a website serve different versions of a file over HTTP and HTTPS?

Here is a link given on curl's official website: (prefix omitted) bintray.com/artifact/download/vszakats/generic/curl-7.46.0-win64-mingw.7z When I downloaded it with prefixes http:// and https:// I ...
20
votes
2answers
4k views

Something is changing my hosts file without asking

First: I can't find any information on this phenomenon, not anywhere on the net. I don't know which application does it, but something in my Windows 7 Home Premium system (fully updated & legal) ...
4
votes
2answers
217 views

Can TLS provide integrity/authentication without confidentiality

It was a bit surprising that Wikipedia has switched to TLS because we all know it's public information available to anyone, but I suppose that the real purpose for that is to provide authentication/...
3
votes
0answers
71 views

How does a Sign tool work?

My basic understanding about sign tool is: 1.It loads the zipfile(may be exe,jar,ddl,apk..) which has to be signed to its memory(cache memory of the sign tool). 2.It will verify it, and unzip the ...
18
votes
1answer
1k views

Is there a way to verify a binary against the sources?

It seems like there is no practical way to verify the full integrity path of precompiled and packaged software? I can check the downloaded package itself by hashes, but I have no verification if the ...
1
vote
3answers
270 views

Why would a replay attack be considered a threat to integrity and not confidentiality?

I came across a test where the instructions were to circle all the correct answers. I'm looking for an explanation to the answer for this question: Question: a replay attack is a threat against ...
2
votes
3answers
89 views

Can a file get accidentally corrupted while downloading?

I read an answer here about websites providing downloadable files together with their hashsums. It contained a sentence I'm thinking about whenever I download something, but I never really understood ...
4
votes
3answers
194 views

integrity and consistency

This confuses me sometimes, I just need to know what is meant by integrity and consistency just in simple terms or in computer security. will it be wrong to say:- someone who gain an unauthorised ...
5
votes
2answers
93 views

Data Integrity in PKCs

This is a simple question but one which greatly confuses me. When you have a PKC, the public key can be accessed by anyone. Therefore, doesn't this mean that anyone can encrypt data? My question is ...
1
vote
0answers
53 views

Purpose of MAC when encrypting? [duplicate]

Really basic question, but what is the purpose of using a MAC/HMAC when you are encrypting using a symmetric key algorithm? It is my understanding that the purpose of a MAC is to authenticate the ...
4
votes
2answers
175 views

What is the difference between the “sig” files and the checksum files, such as on the PuTTY download page?

This is about the functional differences between sig files and checksum files and how they can be used by a user downloading some software. For example, on the PuTTY download page both sig files and ...
2
votes
1answer
83 views

Protecting a database against insiders

Consider a network for a web-application with 1 webserver and 1 MySQL database, both on physically different servers and both running Linux. The database stores mission critical data and this data is ...
3
votes
3answers
444 views

Message Authentication Codes (MACs)

What is the main difference between Message Authentication Codes (MACs) and hash function? Is there any difference regarding their usage domains?
1
vote
2answers
102 views

Confidentiality and integrity

Users permissions and privilege should be considered as a part of confidentiality (specifically access control) or integrity? And I'm also wondering if we can categorize Accountability, Authenticity ...
0
votes
2answers
192 views

What the most trustworthy way to demonstrate digital File Integrity?

I'm looking for ensure the integrity of uploaded files and demonstrate this integrity to a user. In my current scenario, a user sends multiple files in several different formats, these files are ...
7
votes
3answers
146 views

Automatic detection of a compromised web server

I'm trying to figure out if it is possible to automatically detect the the fact that the HTML or javascript files on a server have been tampered with or changed by an attacker. Our website, say www....
1
vote
1answer
77 views

Best way to ensure integrity of encrypted data which is kept in a public place

I need to keep sensitive data in a de fact public place (i.e. with a user, e.g. in a cookie) and only there (no copy or hash of that data should be kept on the server). The data was encrypted AES/CBC ...
1
vote
2answers
143 views

How to detect if file is being modified while my program reads it?

I'm writing an auto-updater tool that is run with admin permissions. It's job is to download and install files from a tat archive. The problem is solved to the point where I can verify identity of ...
-1
votes
1answer
95 views

Why do browsers have no built-in features to verify the integrity of downloads? [closed]

I just started a download of a large file. Checksums were placed prominently on the download page. But I just realized that I actually never made use of any of the checksums provided for download ...
4
votes
1answer
174 views

Does LUKS protect the filesystem integrity?

I have read in: http://css.csail.mit.edu/6.858/2013/readings/bitlocker.pdf that Bitlocker does not provide data integrity since it takes more space in the disk. The PDF says also that drive ...