A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.
58
votes
9answers
8k views
What would one need to do in order to hijack a satellite?
I realise this borders on sci-fi, but there's been some interesting demonstrations regarding security of various satellites.
What would be required to hack a satellite (in general terms, any hack ...
43
votes
3answers
16k views
What's the difference between SSL, TLS, and HTTPS?
I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
21
votes
3answers
2k views
How does Convergence (CA replacement) prevent its notaries from being MITM'd as well?
I have been looking into Convergence and how it works, but I cant figure out how it is effective against a MITM attack that happens near the target system. My understanding is that Convergence works ...
19
votes
2answers
348 views
Aviation security - Lessons to learn from PlaneSploit
A somewhat related question has already been asked (What would one need to do in order to hijack a satellite?), only at a more abstract level.
Now we have a presentation by Hugo Teso from n.runs AG ...
19
votes
3answers
720 views
Preventing artificial latency or “Lag Hacking” in multiplayer games
There is an attack that some people have dubbed "lag hacking", and its gaining popularity in multiplayer games. There are at-least two ways of creating artificial latency. One method of introducing ...
14
votes
3answers
3k views
Convergence - an SSL replacement?
Today, Moxie Marlinspike, a security researcher famous for his research on Android and SSL and related protocols (author of sslstrip/sslsniff), released "Convergence" which says is "an agile ...
11
votes
7answers
9k views
What is the difference in security between a VPN- and a SSL-connection?
I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
11
votes
1answer
4k views
The inner workings of iMessage security?
This is a very interesting article about the iMessage technology used in Apple's very popular communication devices. So far, there has not been much technical details released by Apple. Hopefully ...
11
votes
3answers
1k views
How are mobile telephony networks like LTE and HSPA encrypted?
How are mobile telephony networks like LTE (4G) and HSPA (3G) encrypted? between what parts is the communication encrypted? who has access to the keys? is symmetric or asymmetric encryption used? is ...
10
votes
1answer
564 views
Native rsync protocol security
Is the native rsync protocol (port 873) secure? Does it encrypt data or credentials?
I'm planning on using rsync to store encrypted files in the cloud, I'm wondering whatever the password is ...
10
votes
1answer
944 views
SSL TLS renegotiation vulnerability - current situation in clients
Reading about the SSL renegotiation problem CVE-2009-3555 one knows that servers supporting old type of renegotiation are vulnerable to data injection. We also have tools to test them (openssl ...
9
votes
6answers
2k views
How to implement multi factor authentication using a token generator?
I'd like to implement multi factor authentication on a few projects.
Now the first factor would be username and password, for the second factor I would like to use a token generator.
These tokens ...
9
votes
1answer
584 views
Is there a standard for printing a public key as a barcode?
Is there a standard for storing a public key printed on paper?
Say, I want to hand out business cards with my public key pre-printed on them
at a key signing party to help build the web of trust.
My ...
8
votes
3answers
1k views
What common products use Public-key cryptography?
I want know what common use products are there that use public key/private key cryptography?
8
votes
1answer
511 views
What were the specific security flaws with OAuth 1.0? How are they being addressed in 2.0?
I read an article documenting Twitter abruptly pulling its OAuth support back in April 2009. The article said it wouldn't specify the hole for security reasons, but mentioned "social engineering" is ...
7
votes
4answers
1k views
extract from pcap all protocols found
I have some pcap files, and i would like just to get a list of protocols that are present on that pcap file. I would like it in a batch mode, not using wireshark
I think tshark is able to do it, but ...
7
votes
2answers
3k views
What is ECDHE-RSA?
What is the difference between ECDHE-RSA and DHE-RSA?
I know that DHE-RSA is (in one sentence) Diffie Hellman signed using RSA keys. Where DH is used for forward secrecy and RSA guards against MITM, ...
7
votes
3answers
171 views
How do I test and secure ASN.1 Parsers?
As far as I can tell, .NET doesn't have an ASN.1 parser for reading or writing data built in the framework. This means that any code that creates or verifies ASN.1 data is using a 3rd party library ...
6
votes
2answers
4k views
The new CCMP attack against WPA/WPA2 PSK
The use of Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) for WPA/WPA2 PSK is being attacked. This is a trivial attack (offline brute force) against the initial ...
6
votes
3answers
427 views
Patent free symmetric-only key exchange protocols?
I am working with a networked embedded device with AES-128 and no public key cryptography (1KB RAM, 8KB flash). At install, the device is pre-loaded with a longterm AES-128 key known also to the ...
5
votes
5answers
108 views
How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
5
votes
4answers
3k views
How do the processes for digital certificates, signatures and ssl work?
I have been trying to understand how ssl works. Instead of Alice and Bob, lets consider client and server communication.
Server has a digital certificate acquired from a CA. It also has public and ...
5
votes
4answers
721 views
Is this type of ARP poisoning attack possible?
I am wondering if it is possible to paralyze a network by sending out a bunch of fake ARP response packets.
Some basis: I recently read a moderately detailed description of how ARP and ARP poisoning ...
5
votes
1answer
252 views
How do you analyze an unknown network protocol?
Of course Wireshark can be used to sniff traffic - you can inspect each packet or chain of packets.
But how would you do it smarter? Which tools do you use to identify behaviors or to automate the ...
5
votes
3answers
750 views
What makes the Blackberry device and network more secure?
One of Blackberry's strongest assets is the "network" that it uses. Can someone explain, or link to technical information that covers what this secure network is, and what it does better than the ...
5
votes
1answer
262 views
Why is NIST removing & not updating TLS guidance? What is the replacement?
The document NIST Special Publication 800-52 Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations was retired without superseding it with a newer document.
In ...
4
votes
4answers
222 views
Does TCP/IP expose critical infrastructure to added risk?
Background:
I just attended a talk on the security of critical infrastructure. The speaker spoke a bit on how adding the TCP/IP protocol to functions usually taken care of by dedicated protocols open ...
4
votes
2answers
167 views
What happens if a pro-censor ISP has Telex key(s)?
I've been watching more and more people jump on the idea of Telex as a way to prevent internet censorship (e.g. http://www.technologyreview.com/communications/38207/ -- not my comments at the bottom ...
4
votes
3answers
455 views
How do I identify an unknown port/protocol that my IDS picks up?
Googling a port and protocol leads to a terse description at best, and a linkfarm in the average case. Most protocols on assorted, unknown high ports contain little or no plaintext, and often if the ...
4
votes
2answers
1k views
How does Diaspora work?
I hear all this hype about Diaspora being decentralized, but the only information I can find on their official website and the Wikipedia article is that several people can run Diaspora servers. The ...
4
votes
2answers
213 views
IPsec - when to use AH only?
As far as I know, AH only covers integrity and authentication. So, suppose that an intermediate router receives the packet with AH and not ESP. Then, can't the router open its content (<- and ...
4
votes
1answer
95 views
Are the SSL Digital Security Certifiactes based on Kerberos Network Security Protocol
I just want to know if digital certificates use the kerberos session key algorithm.
4
votes
1answer
200 views
Two generals' agreement
I am trying to figure an agreement protocol on an unreliable channel. Basically two parties (A and B) have to agree to do something, so it's the two generals' problem.
Since there is no bullet-proof ...
4
votes
3answers
173 views
Are there a standard method(s) for me to give someone else read-only access to my data?
Are there a standard method(s) for me to give someone else read-only access to my data?
There are several situations where I may want to give a few people read-only access to some data, but I would ...
4
votes
3answers
297 views
Are there any serious problems with this technique for generating symmetric keys?
I'm using a technique borrowed out of a book by Bruce Schneier and Niels Ferguson called Practical Cryptography. Basically, it boils down to this:
Bob does this:
pubk_A = Alice's public key
...
4
votes
1answer
1k views
Is L2TP as secure as IPSEC for VPNs?
Is it as secure to use L2TP for VPN access, rather than IPSEC? Am I introducing any risks by using L2TP?
4
votes
1answer
297 views
What changed between TLS and DTLS
What did the DTLS (TLS over UDP) authors have to change so that it could run without TCP?
Bonus points:
Do any of the protocol difference affect the way it should be used, both in terms of interface ...
4
votes
2answers
455 views
How to see whether the pcap contains RTP traffic?
I am analyzing the traffic of a VOIP application. I started up wireshark, and made sure no other application was using internet, and then had a a voice call on the application. Wireshark captured some ...
3
votes
2answers
414 views
Can we prevent a man-in-the-middle attack with symmetric-key cryptography?
Suppose that Alice signs the message M = "I love security" and then encrypts it with
Bob's public key before sending it to Bob. As well known, Bob can decrypt this to
obtain the signed message and ...
3
votes
1answer
84 views
Creation and deployment of self-signed certificates for a two-machine scenario
Let us assume that I have two computers:
client
server
Now, in the server computer, I set up a legacy ASMX web service which will going to be used by the client. Before the client can connect to ...
3
votes
1answer
99 views
What project is a good SILC substitute?
As time has marched on, it would appear that the Secure Internet Live Conferencing (SILC) client/toolkit have lost a bit of steam, I can't find any current mailing lists, their website doesn't seem to ...
3
votes
1answer
161 views
Can wildcard certificates hide/obscure the hostname in a TLS connection?
I'm trying to increase security for my cloud-based / multi-tenant environment. I'm considering having clients access an obscure URL such as GUID.myCloud.com. I will then respond to that guid-based ...
3
votes
1answer
250 views
Loginless Client/Server Architecture (iOS)
I'm currently in the phase of planing a project involving loginless service.
Users would be identified by an unique device id created on the client (ios).
What are the security concerns?
sockets ...
2
votes
4answers
490 views
Best way to push data to a client without being blocked by firewall
I'm asking this question here since I think people on this forum
probably have the best knowledge of firewalls and routers.
Say I'm designing a multi-player game and I want to push data to the client ...
2
votes
2answers
134 views
Access via http to other protocols and ports!
Our firewall only allows HTTP port 80 but we have detected that a user accesses some other protocols and ports that we deny in our firewall.
We know that he has developed an application (Console ...
2
votes
3answers
147 views
I want to have the security of my crypto code checked, how should I go about doing so?
Specifically part of my system stores encrypted information in a database. I wrote the code that actually does the encrypting/decrypting using an existing cipher.
How should I go about making sure ...
2
votes
2answers
139 views
How do I correctly select and use a modern symmetric block cipher?
I have founds lots of DON'Ts with Google but so far, no simple resource that would explain to someone like me who knows that he is not smart enough get this right without help how to use correctly a ...
2
votes
2answers
308 views
Vulnerability of a computer behind a serial port?
Let’s consider these 4 computers :
East Coast location :
computer East1 is connected to the internet.
computer East2 is connected to East1 through a RS232 serial cable.
West Coast location :
...
2
votes
1answer
79 views
tshark - dump the data section
As the name suggests, im trying to dump the data section of the packet,
man would suggest that its something like tshark -r file.pcap -t fields but im not having any luck
2
votes
1answer
164 views
Loki How to crack the password hash OSPF?
I have created for myself a lab of routers in GNS3 . Routing protocol between routers is OSPF.
Now,by Loki penetration testing, I found that routers are the feature authentication.
Using wireshark, I ...
