Computer software, or just software, is a collection of computer programs and related data that provides the instructions for telling a computer what to do and how to do it.

learn more… | top users | synonyms

38
votes
3answers
2k views

Mars Curiosity Rover Security

Does the software in the Mars Curiosity Rover have any security features built-in? I can't imagine how someone would hack into it, but if the rover does indeed have some protection against malicious ...
28
votes
8answers
1k views

Is it safer to use less heard of software than popular software?

Is it good policy to use non-mainstream applications, or does it depend? For example is it better to use a less popular browser, media player or operating system as it is less likely a target for ...
23
votes
7answers
2k views

Is having Steam installed a security risk?

Speaking to one of our security administrators at work, he insists that Steam is a well understood security risk and it shouldn't be installed on work machines. Saying it's not work related I ...
10
votes
1answer
1k views

Insecure versions of crypt hashes

I read at crackstation not to use these variants of bcrypt* ($1$, $2$, $2a$, $2x$, $3$),but I've used bcrypt ($2a$) in various sensitive implementations recently. Can any security expert clarify why ...
9
votes
6answers
5k views

Is MD5 considered insecure?

After all these articles circulating online about md5 exploits, I am considering switching to another hash algorithm. As far as I know it's always been the algorithm of choice among numerous DBAs. Is ...
7
votes
2answers
966 views

Software security V.S Hardware security

In theory, perfect software applications are possible but in real life, they don't exist. When attackers know the software, they can send payloads to exploit vulnerabilities and run any arbitrary code ...
6
votes
5answers
5k views

Why Adobe is recommending McAfee security scan during flash player installation?

Why is Adobe recommending a McAfee security scan during the installation of flash player?
6
votes
1answer
115 views

Considerations for security release notes

I need help with understanding how to manage security release notes for our product. We create major release of our product about each half years and security or maintenance releases each month. What ...
6
votes
1answer
2k views

Average number of exploitable bugs per thousand lines of code?

Over the years I've heard various estimates for the average number of exploitable bugs per thousand lines of code, a common figure being one exploitable bug per thousand lines of code. A Google search ...
5
votes
5answers
4k views

Affordable web application attack tools

I've been using Burp Intruder (part of Burp suite), but in the free edition of Burp Suite the Intruder functionality is Time-throttled. As a student pen tester however, I can't justify the cost of ...
5
votes
3answers
1k views

Is KeePass a good defense against keyloggers?

KeePass is a program in which you can store your password and copy and paste them into websites. Does anyone know if it is safe against key logging software? Does key logging software pick up what you ...
5
votes
4answers
160 views

How to avoid to lose data encrypted because it was encrypted by no longer supported software?

How can I avoid losing data that is encrypted using methods that may become obsolete? I have valuable family records I wish to secure, so I plan to encrypt them before putting them in long-term ...
5
votes
3answers
296 views

how can an attacker use a fake temp file to compromise a program?

I am taking a security class. The class notes say that an attacker can observe a pattern in temp file names and then make their own temp file to compromise a program. They say that if a temp file is ...
5
votes
5answers
22k views

Cracking CISCO ASA Passwords

I've got a copy of a Cisco ASA config and i want to crack the following example passwords I've got the following lines in the config ASA Version 8.4(2) ! hostname ciscoasa enable ...
5
votes
3answers
3k views

Need a software that can monitor and log network traffic of installed applications [closed]

I need to monitor and log network activities of a specific software installed on my system. I know there are lots of network monitoring software out there, even system explorer has one built in. I ...
4
votes
3answers
336 views

Application to monitor software activities

I am doing black box testing on a software which is installed in my local machine. I want to analyze and see the list of files and registry entries that software create/modify/delete. Basically ...
4
votes
2answers
893 views

Security test lab setup [closed]

I want to setup a testing lab in my basement for penetration/vulnerability testing & offensive/defensive security skills. I believe I have all the equipment that I need, and if I'll need something ...
4
votes
1answer
999 views

truecrypt second encryption of the master and XTS key with a back door password

this table was published by (Ubuntu Privacy Remix Team ), in an analysis document, anyway i was quite skeptical. On file based containers as well as on completely encrypted partitions or drives ...
4
votes
2answers
100 views

How to be sure content was generated on a specific software?

I am developing an open source software. This software generates content that is sent to a server for publishing. Anyone can get this software and generate content. The API for publishing at the ...
4
votes
1answer
447 views

ROP Exploitation on ARM

I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture. Are there any tools, such as mona.py ...
4
votes
1answer
144 views

API to change passwords?

After I learned last week that the login data of some of my accounts was leaked, I had to change my passwords for more than 30 sites. That was tedious! As luck would have it, some days later we ...
4
votes
1answer
179 views

High Interaction Honeypot design

I've been writing a high interaction honeypot which has required some interesting design decisions, for instance I want the honeypot to get attacked not the underlying infrastructure/ software. Fun ...
3
votes
2answers
119 views

Upgrading to latest software version for security reasons

I have some software that I want to upgrade to improve security. The current version I'm on is 2.6.2. Is it better to upgrade to the latest version of the entire product line which is 2.8 or should I ...
3
votes
1answer
717 views

How does time-limited trial software work? [closed]

I'm curious about how time-limited (e.g. 30-day trial) software works. I know how serial keys are generated and designed, but the time-limiting part is more complicated to understand, because it is ...
3
votes
2answers
540 views

Does there exist software that will scan a filesystem for possible files containing PHI?

I don't need a list of software (I know shopping questions are off topic), but my google-fu is failing me at this. Basically looking for software that will scan a filesystem looking for files that may ...
3
votes
2answers
85 views

Crypto software: overwrite sensitive buffer

Is it common to implement crypto software in such a way that sensitive buffers are overwritten before free'ing memory? For example when they contain a private key or the plaintext message.
2
votes
4answers
7k views

What is the difference between antivirus and firewalls

I need a brief explanation about the differences between antiviruses and firewalls
2
votes
3answers
500 views

Top 10 dangerous mistakes in C programming? [closed]

What is the top dangerous mistakes in C programming? for example misusing a strcpy causes a stack-overflow and code injection. I'm looking for at least 10 bad programming pattern in C.
2
votes
2answers
90 views

How should we announce vulnerabilities in our application?

I have asked about security release notes Considerations for security release notes I need additional clarification about security vulnerabilities announcement. We create major release of our product ...
2
votes
1answer
90 views

Obstacle in Implementing a Time Limited/Number of Use Limited Software

How does one implement a trial period in a product properly, e.g. a trial period that lasts 30 days, or limits the number of product uses to 10? Storing the entries, even in an encrypted form, isn't ...
1
vote
1answer
201 views

uninstall and reinstall after hacking [closed]

My computer has been hacked. If I uninstall and reinstall do I loose my files? The facebook tech tried to sell me a number of pkgs ranged $149-$299 and told me that my account was hacked as was my ...
1
vote
3answers
633 views

How can this web page access the USB? [closed]

A friend bought a "smart" headset (working with voice commands). I had to install a software on Windows to be able to configure this headset. After downloading the software from the page, this page ...
1
vote
3answers
3k views

How to store a private RSA key for an application?

I was wondering how an application that have a private key will keep it secure? If the private key is outside the binary, then anybody can access it, but store it in the binary doesn't make it more ...
1
vote
3answers
866 views

What reputable site should I download Putty from?

I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code. If you needed to download Putty for a high security Windows ...
1
vote
2answers
112 views

How does NASA get hacked? [closed]

I have come across several news websites which claim that NASA websites get hacked many times a year. A 15-year-old computer hacker caused a 21-day shutdown of NASA computers that support the ...
1
vote
1answer
104 views

Enforcing software expiration on virtual machines

It is possible for virtual machine guests to bypass the software expiration timers for paid software. This example shows one way to do this on VMWare. A simpler method is for the user to "revert to ...
1
vote
2answers
333 views

Can I use hardware token OTP to stop piracy?

Our firm sells an offline desktop (.exe) software, we are thinking of using OTP (from hardware token like in internet banking) to stop people from copying the software without permission. Basically, ...
1
vote
3answers
97 views

Which Secure Development Lifecycle model to choose? [closed]

We are going to secure our software development life cycle and have been researching for a good model to start with. I have found 3 major models (methodologies?) which are : Cigital SDLC (7 touch ...
1
vote
2answers
112 views

Which exploit types does software diversity have a benefit against?

This classical paper of Paul van Oorschot: Revisiting Software Protection, mentions in section 3.4 that by employing software diversity "an exploit crafted to succeed on one instance will not ...
1
vote
1answer
133 views

Software library for 1-2 oblivious transfer?

I'm looking for software libraries that support 1-2 oblivious transfer of a single bit between two parties. Googling seems to bring up lecture notes, explanations, and research papers but not ...
1
vote
1answer
86 views

Malware infected ATMs in China via specialized device

Hackers inserted a specialized device which was connected to the notebook into the card reader slot on the ATM and installed malicious software. 100 thousand US dollars were stolen from at least seven ...
1
vote
1answer
58 views

How to prepare a report on security weakness in our software [closed]

I am part of an in-house development team that provides the software that is used in our company's factories across the world for production as well as for order management, and which also enables the ...
1
vote
7answers
4k views

How should I select which antivirus software to install on my new laptop?

I'm in a bit of a dilemma here. I have bought a new laptop with no antivirus installed. I'm wondering how to choose an appropriate antivirus software to install.
1
vote
1answer
186 views

Where are located the DPAPI BLOBS and is there any tool to decypher them?

I'm doing some testing with DPAPI for a project where I'm involved. I would like to know where the users Masterkey are located and if there is any free utility to find and decipher them. I'm pretty ...
1
vote
0answers
136 views

security clearance for programmers

I am programmer by day and night, I work within security at the moment working on some security products. I have noticed a few non software engineering based roles which require security clearance. I ...
0
votes
4answers
326 views

Dynamic tools to detect vulnerabilities in software applications written in c?

I am doing a project on detecting vulnerabilities in Windows 7/8 for software applications. Some of which some have source code available and some do not. Please suggest some technique that can help ...
0
votes
2answers
43 views

Software validation process

Two days ago I asked that question: Are web browser able to use camera without permission? and I got an answer saying : "there have been multiple vulnerabilities in Flash, Chrome and even Facebook" ...
0
votes
1answer
55 views

Do software systems become more secure every year? [closed]

It seems to me that computer software is becoming more secure every year - there are fewer zero-day exploits to be found, many hacker-proof concepts are becoming widespread (such as virtualization and ...
0
votes
1answer
51 views

Examples of software web clients (web browsers, IM clients, etc) written in “secure” / managed languages

After reading this article ("Everything is broken" by Quinn Norton) I was about to ask a question similar to this one (Why are security-crucial software written in unsafe languages?)... but actually I ...
0
votes
1answer
57 views

Worthy security related certifications for a software engineer [closed]

I am a software engineer with an interest in expanding my knowledge in the security field. In addition to security.stackexchange and OWASP, I am currently reading the book "The web application ...