Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.

learn more… | top users | synonyms

22
votes
4answers
5k views

Why aren't application downloads routinely done over HTTPS?

We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits: Encryption: The data can't be read by a middle-man while in transit. ...
16
votes
1answer
466 views

Is there a way to verify a binary against the sources?

It seems like there is no practical way to verify the full integrity path of precompiled and packaged software? I can check the downloaded package itself by hashes, but I have no verification if the ...
14
votes
7answers
2k views

Tripwire - Is it security Theater?

Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes. Let's say I have tripwire configured to run ...
14
votes
1answer
1k views

Something is changing my hosts file without asking

First: I can't find any information on this phenomenon, not anywhere on the net. I don't know which application does it, but something in my Windows 7 Home Premium system (fully updated & legal) ...
13
votes
6answers
5k views

Does SSL/TLS (https) hide the urls being accessed [duplicate]

Suppose I type this in my browser https://www.mysite.com/getsecret?username=alice&password=mysecret and an attacker is watching all traffic from me to my ISP. What information is protected by ...
13
votes
1answer
706 views

Are there Linux rootkits circulating that directly modify the kernel (without modules)?

It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
9
votes
5answers
647 views

Protect application from being modified

I have a question about how to protect a program from modification if that program is able to communicate with a remote validation server. More specifically I'm asking for android APK file, but it can ...
7
votes
3answers
999 views

What does a court need to successfully prosecute a hacker? Please cite previous cases if possible

Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that: Integrity of the investigation is maintained The ...
6
votes
3answers
254 views

How safe are copies of Firefox that are on various Mozilla mirror sites?

If I end up downloading a .dmg or .exe (depending on OS) installer from some mirror site, how can I be sure that a virus or trojan or spyware has not been added? I don't see any mechanism for ...
6
votes
4answers
939 views

Safest way for multiple users post to a single social networking account

Suppose I have a team or organization managing a single twitter account and a single facebook page. Different users need to be able to post content to the same account. How can I minimize the risk of ...
5
votes
2answers
877 views

What security standards and regulations are in place for bank ATM?

Are there any international or US mandated standards and regulations that apply to communications between automatic teller machines and bank's central office? Are banks or ATM operators subjected to ...
5
votes
3answers
816 views

What are the most common files to check with File integrity monitoring software?

I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server. Is there a ...
5
votes
1answer
106 views

What prevents the Intel TXT boot loader from being maliciously altered?

From my understanding of Intel TXT, the technology can be used to put the processor in a trusted state where measurements can be performed. My understanding looks something like this, where I believe ...
5
votes
1answer
115 views

Integrity check against package repository?

I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates. From time to time I want to boot from a clean boot ...
5
votes
2answers
307 views

Oracle Internet Directory (OID) hardening

What are best practices, recommendations, required reading for securing/hardening an Oracle internet directory? note: OID is compatible with LDAP version 3.
5
votes
1answer
108 views

Authentication by Signing or MAC?

I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send ...
4
votes
3answers
2k views

Bell-LaPadula imlementation example

I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example. I understand how the model works, but I have difficulties implementing it in a programming language ...
4
votes
3answers
701 views

Using MD5 for file integrity checks?

General Always check the MD5 hashes of the .NET Framework assemblies to prevent the possibility of rootkits in the framework. Altered assemblies are possible and simple to produce. Checking ...
4
votes
3answers
362 views

Preventing users from tampering with replay data [duplicate]

Possible Duplicate: Protect application from being modified This probably belongs here as much as it does belong in gamedev.stackexchange.com, but I suppose I might find better technical ...
4
votes
2answers
106 views

Data integrity of malicious content in the database

From a data integrity standpoint, if I persist the following code into my database: <script> alert('hi'); </script> should I sanitize it before persistence, for instance making ...
4
votes
4answers
156 views

Contact person by phone, when their phone might have malware

I have a problem setting where I want to contact a user by phone, and where I need to protect the integrity of the phone call as much as possible. I'm wondering about how to design the interaction in ...
4
votes
2answers
405 views

How to correctly implement AES in a backup application

I am writing a back-up application which should have the feature of encrypting the back-up. It must encrypt file data, paths and filenames. The application is being written in C# (.NET). Target is ...
4
votes
2answers
476 views

Detect changes in /boot when using full disk encryption

When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
4
votes
1answer
291 views

In the Clark Wilson models, why can't the TPs be executed in parallel?

I am studying the Clark-Wilson model, I can't exactly understand why the TPs must be executed in serial, is there a way to execute them in parallel? What would happen if I did execute them in ...
4
votes
1answer
274 views

Does deliberately wrong information from a DNS server violate standards generally accepted good practices?

For certain host names my DNS gives me a wrong ip address (the ip address of a transparent proxy) for which inverse DNS look up does not give me back the host I originally looked up. This is related ...
3
votes
4answers
2k views

I had SSL certificate on my site but still it has been hacked…how to prevent this from happening?

I used SSL certificate on my site but still it has been hacked. How do I prevent this from happening? Do SSL certificate come with a waranty which would compensate me because my site was hacked?
3
votes
1answer
587 views

Who is the creator of the CIA triad?

The Information Security goals - Confidentiality, Integrity and Availability (CIA) - are often referenced to as the CIA triad. As I am writing on my master thesis, I am wondering to which resource I ...
3
votes
3answers
236 views

Why are handheld tape recorders used?

Pardon me for doing the following as I know it is cringed upon (the tv reference) but: Is there any good reason for the usage of 'tape' recorders? Ex. taping a conversation between criminals, this is ...
3
votes
1answer
316 views

Is Torrent safe for sharing legitimate files (file verification)? Does it use SHA1 or SHA256?

Let's assume that a legitimate torrent file has been safely and successfully downloaded over HTTPS and perhaps even OpenPGP verification was used to verify the integrity of the torrent file. How good ...
3
votes
3answers
210 views

How do I transfer the HMAC?

I have a file I'd like to encrypt with a symmetric key using AES-256 and then use an HMAC for integrity. So I don't "roll my own" scheme which I know is a big mistake, what are the standards for using ...
3
votes
2answers
199 views

Confidentiality and integrity for web session

When the client authenticates with our service, he is issued an opaque "token". This token includes the information, that identifies the client and some other information about the client ("payload"). ...
3
votes
2answers
186 views

What's the point of using multiple checksum algorithm with “aide”?

In aide the author offers more than one hash algorithm to do the check-sum, why is that? Aren't a single one, i.e sha512 enough for determining file changes? I believe these algorithms are all ...
3
votes
6answers
541 views

Is a self signed certificate sufficient to prove the integrity of my executable?

I have an EXE file on Windows that I have to distribute around. It's based on tclkit so an adversary could unpack it, change some tcl script inside and repack the exe. I would like to know if this ...
2
votes
3answers
216 views

Remote Connection Tampering

My small high street laptop repair/service/maintenance shop has been up and running for about 3 years. It's doing quite well so I'm looking to expand into other areas of the PC market. One area I ...
2
votes
3answers
592 views

Is SSL Tamper Detectable?

I know how SSL provides security against people reading your messages - by encryting the message with a SYMMETRIC KEY, which was exchanged during SSL Handshake with the help of ASYMMETRIC KEYS. But I ...
2
votes
5answers
201 views

Is DRM considered Confidentiality, Integrity, Availability, or some combination of the three?

I was discussing software trial time limit enforcement with a colleague and the idea of CIA came up. Do stricter enforcement techniques increase confidentiality at the expense of availability? (for ...
2
votes
2answers
671 views

How to make a simple file integrity checker

I've seen many PHP file checker on the net. Basically they computes the sha hash of a requested file. Your PC queries periodically the script and alerts you if the returned hash changes. The problem ...
2
votes
1answer
242 views

What extra protection is added to an REST API over HTTPS by the use of some kind of HMAC?

I'm designing a RESTFUL API that will always be used over HTTPS, what security advantages over the use of HTTP Basic Auth could be brought to my system by using such kind of message authentication ...
2
votes
1answer
195 views

Password checking in the context of symmetric encryption

It is my understanding that block ciphers like AES don't have any built-in mechanisms to verify data integrity upon decryption, although some modes of operation might provide that. I played around ...
2
votes
3answers
203 views

Find changes and modifications made to system by application or virus,

I would like to use either Hyper-V or Vmware to take a Clean Base snapshot and a snapshot after an application or virus has made changes so I can then see what was changed between the two images. ...
2
votes
2answers
105 views

Domain and IP scoring

What kind of things would you check in a domain and IP scoring system? Which things are the most important? If I have a web site or web service, I would like to figure out a score for my visitor. If ...
1
vote
2answers
71 views

How to detect changes to client

I am developing a Java game and money is involved. As such, I want to prevent people from modifying the client if at all possible (I'm a game designer, not a security expert). I know that it is ...
1
vote
2answers
509 views

How can I check the integrity of the downloaded files?

I know we use hash functions to check for the integrity of the files etc... but my question is how can we check for the integrity of the files being downloaded from some server?
1
vote
2answers
342 views

Prevent my site to be sniffed and changed by man-in-the-middle-attacks

I want to secure site which is locally used for Prepaid Services, the site has been hacked many times, for the first step, I implemented SSL and its now working fine, however, I want to be sure that ...
1
vote
2answers
194 views

Recommended authenticated stream cipher for minimum overhead?

I'm running my TCP/IP protocol secured by encrypting each packet with AES128/CBC, bundling a SHA256 HMAC over that packet. This causes quite a bit of space overhead for small packets, so at first I ...
1
vote
1answer
67 views

How to protect integrity of resource files in a white-box attack context?

In a white-box attack context (e.g. PC, tablet, smartphone), there is no trusted entity, which can be used to guarantee some reasonable security. TPM is not considered a solution because it is not ...
1
vote
2answers
553 views

Signed request vs HTTP digest auth for API authentication?

By signed request I mean something like this (simplified example): Client creates a sig in his request: $sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
1
vote
4answers
292 views

Integrity monitoring for a LAMP server

So I'm setting up a small e-commerce app, and am thinking what happens if the server is compromised. We are selling software so potentially an intruder could generate themselves some free serial ...
1
vote
1answer
91 views

Ciphertext for email vs Ciphertext for database

Let's say Bob wants to send a message to Alice. This communication requires to achieve confidentiality, integrity, proof of origin, non-repudiation. Therefore we can use this cipher-text: ciphertext ...
1
vote
0answers
45 views

Is the digital declaration just an obscure proposal?

One professor from my university proposed me and some colleagues to work on a paper about the digital declaration (which is supposed to be better than the digital signature) for passing the subject. ...