Integrity is the property of preventing unauthorized modifications of an asset. In other words, integrity protects against the threat of tampering. It is one of the three key security properties of an asset, along with confidentiality and availability.

learn more… | top users | synonyms

23
votes
4answers
5k views

Why aren't application downloads routinely done over HTTPS?

We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits: Encryption: The data can't be read by a middle-man while in transit. ...
16
votes
1answer
537 views

Is there a way to verify a binary against the sources?

It seems like there is no practical way to verify the full integrity path of precompiled and packaged software? I can check the downloaded package itself by hashes, but I have no verification if the ...
15
votes
1answer
2k views

Something is changing my hosts file without asking

First: I can't find any information on this phenomenon, not anywhere on the net. I don't know which application does it, but something in my Windows 7 Home Premium system (fully updated & legal) ...
14
votes
6answers
6k views

Does SSL/TLS (https) hide the urls being accessed [duplicate]

Suppose I type this in my browser https://www.mysite.com/getsecret?username=alice&password=mysecret and an attacker is watching all traffic from me to my ISP. What information is protected by ...
14
votes
7answers
2k views

Tripwire - Is it security Theater?

Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes. Let's say I have tripwire configured to run ...
13
votes
1answer
737 views

Are there Linux rootkits circulating that directly modify the kernel (without modules)?

It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
9
votes
5answers
691 views

Protect application from being modified

I have a question about how to protect a program from modification if that program is able to communicate with a remote validation server. More specifically I'm asking for android APK file, but it can ...
7
votes
3answers
1k views

What does a court need to successfully prosecute a hacker? Please cite previous cases if possible

Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that: Integrity of the investigation is maintained The ...
6
votes
3answers
271 views

How safe are copies of Firefox that are on various Mozilla mirror sites?

If I end up downloading a .dmg or .exe (depending on OS) installer from some mirror site, how can I be sure that a virus or trojan or spyware has not been added? I don't see any mechanism for ...
6
votes
4answers
1k views

Safest way for multiple users post to a single social networking account

Suppose I have a team or organization managing a single twitter account and a single facebook page. Different users need to be able to post content to the same account. How can I minimize the risk of ...
5
votes
2answers
950 views

What security standards and regulations are in place for bank ATM?

Are there any international or US mandated standards and regulations that apply to communications between automatic teller machines and bank's central office? Are banks or ATM operators subjected to ...
5
votes
4answers
1k views

What are the most common files to check with File integrity monitoring software?

I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server. Is there a ...
5
votes
1answer
163 views

Is the SD card write protection hard-wired or optional?

According to Wikipedia, the SD card reader recognizes if the little tab on the left of the SD card is in the "lock" position or not. Thus, a SD card reader can still write on the SD card even if the ...
5
votes
1answer
151 views

What prevents the Intel TXT boot loader from being maliciously altered?

From my understanding of Intel TXT, the technology can be used to put the processor in a trusted state where measurements can be performed. My understanding looks something like this, where I believe ...
5
votes
1answer
125 views

Integrity check against package repository?

I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates. From time to time I want to boot from a clean boot ...
5
votes
1answer
113 views

Authentication by Signing or MAC?

I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send ...
5
votes
2answers
320 views

Oracle Internet Directory (OID) hardening

What are best practices, recommendations, required reading for securing/hardening an Oracle internet directory? note: OID is compatible with LDAP version 3.
4
votes
3answers
3k views

Bell-LaPadula imlementation example

I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example. I understand how the model works, but I have difficulties implementing it in a programming language ...
4
votes
3answers
1k views

Using MD5 for file integrity checks?

General Always check the MD5 hashes of the .NET Framework assemblies to prevent the possibility of rootkits in the framework. Altered assemblies are possible and simple to produce. Checking ...
4
votes
3answers
380 views

Preventing users from tampering with replay data [duplicate]

Possible Duplicate: Protect application from being modified This probably belongs here as much as it does belong in gamedev.stackexchange.com, but I suppose I might find better technical ...
4
votes
2answers
118 views

Data integrity of malicious content in the database

From a data integrity standpoint, if I persist the following code into my database: <script> alert('hi'); </script> should I sanitize it before persistence, for instance making ...
4
votes
4answers
201 views

Contact person by phone, when their phone might have malware

I have a problem setting where I want to contact a user by phone, and where I need to protect the integrity of the phone call as much as possible. I'm wondering about how to design the interaction in ...
4
votes
2answers
493 views

How to correctly implement AES in a backup application

I am writing a back-up application which should have the feature of encrypting the back-up. It must encrypt file data, paths and filenames. The application is being written in C# (.NET). Target is ...
4
votes
2answers
541 views

Detect changes in /boot when using full disk encryption

When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
4
votes
6answers
585 views

Is a self signed certificate sufficient to prove the integrity of my executable?

I have an EXE file on Windows that I have to distribute around. It's based on tclkit so an adversary could unpack it, change some tcl script inside and repack the exe. I would like to know if this ...
4
votes
1answer
305 views

In the Clark Wilson models, why can't the TPs be executed in parallel?

I am studying the Clark-Wilson model, I can't exactly understand why the TPs must be executed in serial, is there a way to execute them in parallel? What would happen if I did execute them in ...
4
votes
1answer
297 views

Does deliberately wrong information from a DNS server violate standards generally accepted good practices?

For certain host names my DNS gives me a wrong ip address (the ip address of a transparent proxy) for which inverse DNS look up does not give me back the host I originally looked up. This is related ...
3
votes
4answers
2k views

I had SSL certificate on my site but still it has been hacked…how to prevent this from happening?

I used SSL certificate on my site but still it has been hacked. How do I prevent this from happening? Do SSL certificate come with a waranty which would compensate me because my site was hacked?
3
votes
1answer
804 views

Who is the creator of the CIA triad?

The Information Security goals - Confidentiality, Integrity and Availability (CIA) - are often referenced to as the CIA triad. As I am writing on my master thesis, I am wondering to which resource I ...
3
votes
3answers
243 views

Why are handheld tape recorders used?

Pardon me for doing the following as I know it is cringed upon (the tv reference) but: Is there any good reason for the usage of 'tape' recorders? Ex. taping a conversation between criminals, this is ...
3
votes
1answer
377 views

Is Torrent safe for sharing legitimate files (file verification)? Does it use SHA1 or SHA256?

Let's assume that a legitimate torrent file has been safely and successfully downloaded over HTTPS and perhaps even OpenPGP verification was used to verify the integrity of the torrent file. How good ...
3
votes
3answers
266 views

How do I transfer the HMAC?

I have a file I'd like to encrypt with a symmetric key using AES-256 and then use an HMAC for integrity. So I don't "roll my own" scheme which I know is a big mistake, what are the standards for using ...
3
votes
2answers
218 views

Confidentiality and integrity for web session

When the client authenticates with our service, he is issued an opaque "token". This token includes the information, that identifies the client and some other information about the client ("payload"). ...
3
votes
2answers
215 views

What's the point of using multiple checksum algorithm with “aide”?

In aide the author offers more than one hash algorithm to do the check-sum, why is that? Aren't a single one, i.e sha512 enough for determining file changes? I believe these algorithms are all ...
2
votes
3answers
238 views

Remote Connection Tampering

My small high street laptop repair/service/maintenance shop has been up and running for about 3 years. It's doing quite well so I'm looking to expand into other areas of the PC market. One area I ...
2
votes
3answers
726 views

Is SSL Tamper Detectable?

I know how SSL provides security against people reading your messages - by encryting the message with a SYMMETRIC KEY, which was exchanged during SSL Handshake with the help of ASYMMETRIC KEYS. But I ...
2
votes
1answer
100 views

TLS WG Charter and Security Goals

I was looking at the TLS Working Group Charter. I noticed that confidentiality and integrity of messages for those who desire it are not goals for the group. Naively, I believe confidentiality and ...
2
votes
5answers
207 views

Is DRM considered Confidentiality, Integrity, Availability, or some combination of the three?

I was discussing software trial time limit enforcement with a colleague and the idea of CIA came up. Do stricter enforcement techniques increase confidentiality at the expense of availability? (for ...
2
votes
2answers
731 views

How to make a simple file integrity checker

I've seen many PHP file checker on the net. Basically they computes the sha hash of a requested file. Your PC queries periodically the script and alerts you if the returned hash changes. The problem ...
2
votes
1answer
318 views

What extra protection is added to an REST API over HTTPS by the use of some kind of HMAC?

I'm designing a RESTFUL API that will always be used over HTTPS, what security advantages over the use of HTTP Basic Auth could be brought to my system by using such kind of message authentication ...
2
votes
1answer
209 views

Password checking in the context of symmetric encryption

It is my understanding that block ciphers like AES don't have any built-in mechanisms to verify data integrity upon decryption, although some modes of operation might provide that. I played around ...
2
votes
3answers
231 views

Find changes and modifications made to system by application or virus,

I would like to use either Hyper-V or Vmware to take a Clean Base snapshot and a snapshot after an application or virus has made changes so I can then see what was changed between the two images. ...
2
votes
1answer
44 views

JavaScript code authenticity when loaded from 3rd party website

Background A discussion about not sourcing JavaScript files from other websites (http://www.reddit.com/r/netsec/comments/29hfhz/please_dont_use_externally_hosted_javascript/) got me thinking. ...
2
votes
2answers
110 views

Domain and IP scoring

What kind of things would you check in a domain and IP scoring system? Which things are the most important? If I have a web site or web service, I would like to figure out a score for my visitor. If ...
2
votes
0answers
27 views

How do I verify a GPG symmetrically encrypted file? [migrated]

I created an encrypted file with symmetric encryption. gpg -c 50GBfile Now I want to delete the original. Before I delete the original, I want to verify the integrity of the encrypted file. Does ...
1
vote
2answers
72 views

How to detect changes to client

I am developing a Java game and money is involved. As such, I want to prevent people from modifying the client if at all possible (I'm a game designer, not a security expert). I know that it is ...
1
vote
2answers
77 views

How to prove the integrity of a digital file if certificates are not an option

Certificates are a fantastic way to prove the integrity of a file - provided that they have been signed from the beginning. This methodology can prove the files authenticity, in addition proving it's ...
1
vote
2answers
781 views

How can I check the integrity of the downloaded files?

I know we use hash functions to check for the integrity of the files etc... but my question is how can we check for the integrity of the files being downloaded from some server?
1
vote
2answers
423 views

Prevent my site to be sniffed and changed by man-in-the-middle-attacks

I want to secure site which is locally used for Prepaid Services, the site has been hacked many times, for the first step, I implemented SSL and its now working fine, however, I want to be sure that ...
1
vote
2answers
220 views

Recommended authenticated stream cipher for minimum overhead?

I'm running my TCP/IP protocol secured by encrypting each packet with AES128/CBC, bundling a SHA256 HMAC over that packet. This causes quite a bit of space overhead for small packets, so at first I ...