0
votes
0answers
4 views

Can user identifying information in Dropbox be derived from subscription data?

I've noticed that my Dropbox installation really loves sending unencrypted information over the net including a "user_id" and it's user-agent. What i want to know is if it's possible at all to ...
0
votes
0answers
11 views

MS-Word and Digital Signatures

We would like to digitally sign DOC (MS-Word) and PDF documents using PKI. Is this possible using an internally deployed CA? I've found lots of articles getting email digitally signed but almost no ...
0
votes
0answers
11 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
1
vote
1answer
20 views

Adding photos to Truecrypted, gapless laptop from camera safely

I have a Truecrypted, gapless (no internet connectivity at all) laptop that I use as a completely secure computer for sensitive files. I want to add images from my iPhone (I know), camera or other ...
0
votes
1answer
49 views

What can a hacker do with a card number without CVV? [duplicate]

From my experience a card can not be used for online payment without a valid CVV, then why is it still always emphasized that card number must be protected? What can a hacker do, assume that he has ...
0
votes
0answers
16 views

what is path for a software developer to gain some experience in Information Security [duplicate]

What is path for a software developer to gain some experience in Information Security or to switch a day job for being a full time web developer to Security analyst or Pen tester or Ethical hacker. ...
0
votes
0answers
27 views

My Ipv6 is under attack by the smurf6?

when i go to whatsmyip.org under my host name i get "Your.Ipv6.Is.Under.Attack.By.The.Smurf6.Info" what does this mean? I'm using private internet access as my vpn so i'm guessing PIA is under some ...
0
votes
2answers
48 views

How to combine a key and a password in practice

Alice wants to encrypt her data. She is not comfortable with using only a password. While she prefers to use a properly random crypto key, she isn't confident she can protect the key file from theft ...
0
votes
0answers
15 views

Could vpns like PIA be involved in Prism? [on hold]

private Internet access is a really trusted vpn because of its no log keeping but could it be possible all logs go directly to a 3rd party like the NSA like the Prism system so even though they don't ...
-1
votes
0answers
32 views

Which encoding/encryption is this [on hold]

What sort of encoding/encryption is this if 13661278 = saftXSI+xYxzpSvf+uAgZw== 13661266 = ANxBFoGBO9NzpSvf+uAgZw== 14455592 = pxm8KnpQ6LhzpSvf+uAgZw==
0
votes
1answer
24 views

What level of access do clients on a secured wireless network have as to the traffic of other clients with wireless isolation enabled?

Given a secure wireless network (lets say WPA2) with clients A and B, what level of traffic can A see from B? if the router has "wireless isolation" enabled? does it make a difference?
5
votes
1answer
69 views

TOR: I'm repeatedly being connected to a couple of Entry Nodes!

I'm using TOR (Orbot for Android), and when I look at the log of the connection establishment phase, I see that I'm repeatedly being connected to familiar nodes, especially the Entry Nodes which 3 out ...
0
votes
0answers
38 views

Can I use another port other than 443 for SSL communication? [migrated]

I have an application that communicates via SSL, however, Port 443 is already in use by an IIS instance on that same server. Can I use another port other than 443 for SSL communication?
0
votes
0answers
11 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...
-2
votes
1answer
30 views

Where can I find browsers error logs? [on hold]

If Internet Explorer, Google Chrome or Firefox browsers crash: where can I find their error logs, please ? Tell me. Thank you. I ask this question because if these browsers crash, I want to see the ...
0
votes
0answers
31 views

What else do I need to secure my data in an encrypted non-system drive?

I have to use an almost seven years old laptop running Windows 7 ultimate and want to encrypt my hard disk to protect my private data (e.g. documents, pictures, Dropbox, etc.). I encrypted a ...
0
votes
1answer
25 views

How does Matrix SSL perform certificate validation?

We use a custom app which uses Matrix SSL (client side) to perform certificate validation on MAC and Linux systems. My question is, does Matrix SSL keep a cert store cache of intermediate and trusted ...
-1
votes
0answers
16 views

Locking a partition/drive [migrated]

I am working in an environment where people share the same PC running Windows 7. I would like to put my private files in an encrypted partition so that I can lock it when I leave the PC, yet leave the ...
1
vote
2answers
50 views

How do proxy servers protect their SSL certificates?

Suppose that there is a http proxy server outside the firewall of an organization hosting a web server. All client connections to the web server happen through this proxy. The client negotiates SSL ...
-2
votes
3answers
63 views

How to identify if my site is vulnerable to DOS/DDOS attacks? [on hold]

I am hosting a site on a hosting server. How to identify whether my site is vulnerable to DOS/DDOS attacks?
0
votes
3answers
97 views

As a non-security professional how should I respond when told my site is insecure?

We have a website, and somebody wrote us an email claiming we are insecure! What should I do
2
votes
1answer
93 views

How difficult is the USB firmware attack? [on hold]

Not really new but it's all over the news right now. You can hack a USB firmware to run an attack by emulating a keyboard. I wonder how difficult it is create an USB thumb that emulates a keyboard. ...
0
votes
0answers
60 views

Should I be concerned about the following URLs that were tried to open on my webpage?

I don't know if this is some injection attempt or a weird bot or what ever. An IP opened several pages within my Drupal 7 website with the appendix ...
0
votes
2answers
45 views

What methods can be used to verify identity against a database?

I have a database with individual contact data for students... this data includes name, address, phone number, birthdate, etc. (no social... that would have made this too easy apparently, ha ha) I ...
0
votes
0answers
13 views

subuser, benefit or liability?

I'm trying various sandboxing solutions on linux. I'm used to running untrusted programs (for example, a web browser, a pdf document reader, etc) inside a selinux sandbox, which I'm quite satisfied ...
17
votes
5answers
2k views

Can malware be dangerous even when quarantined?

I am reading a book on network security and when talking about user confusion it writes: "It is not uncommon for a user to be asked security questions such as Is it safe to quarantine this ...
0
votes
0answers
24 views

Composing and Inverting Symmetric Encryption Keys

First Question: Using a symmetric encryption algorithm E on a message M, users usually send E(M) to the recipient and then the recipient will compute E^-1(E(M))=M to retrieve the message. If M is ...
0
votes
1answer
21 views

XSS attack remediation in older technologies

My application is vulnerable to XSS attack. Technology used in the application are Servlet 2.2, JSP 1.1, Jdk 1.3, WAS 4.0. I wanted to remediate XSS vulnerability with migration of technology or ...
0
votes
4answers
73 views

Using a Public-Key-Encryption browser side to avoid PCI compliance

We're developing a web application in which certain not logged users (clients) need to send their credit card details to other users (merchants) - which, we'll assume, are PCI compliant. We are ...
0
votes
1answer
34 views

Bios passwords “easy” to find

I have read that bios passwords are sometimes good--or bad, if there is a default. Places mention that these passwords are pretty much just available through google, but I can not find them. Where ...
3
votes
1answer
58 views

Can the USB standard be fixed to prevent the “firmware attack”?

Wired, and others are reporting on a research paper by Karsten Nohl and Jakob Lell. The paper apparently shows how any USB device (not just memory sticks) can be infected with malware at the firmware ...
1
vote
2answers
58 views

How to know if I'm under a MITM attack

If I am connected in a public WIFI , is there any way to know whether I am under attack or not while browsing sites using SSL. For example if I visit facebook.com , if the URL starts with "https://" ...
1
vote
2answers
62 views

How can one find keyloggers in javascript?

Assuming no XSS and a client-side only page, how can a keylogger be identified in javascript code? Should I simply look for the id of the targeted fields and possibly some sort of DOM traversal to ...
6
votes
2answers
500 views

How are browsers able to find and construct an alternate trusted chain path?

We had a web server that had the wrong SSL certs installed yet the browser was able to find another trusted path to a root and supply the page properly over HTTPS. We also have proprietary software ...
0
votes
2answers
75 views

Is a Windows AD credential combined with AD group membership 2 factor authentication?

We have a requirement for 2-factor authentication for our internal WiFi SSID's. Currently we use PEAP w/ MS-CHAPv2 to pass windows creds through the AP to a RADIUS server (A Domain Controller running ...
0
votes
1answer
31 views

Recommened books for learning operation system [on hold]

I see other similar question here. I want to become Malware analyst. I have learn to program in Python and C++(not on expert level but fairly good). Before I continue with Assembly language I want to ...
1
vote
1answer
34 views

Is the Java programming language used for penetration testing in practice ? If so, does the same apply to C#?

Is the Java programming language used for penetration testing in practice ? I've wondered whether Java is used or can be used for penetration testing in the field (people write pentesting suites ...
0
votes
1answer
49 views

Hacked Router Faking a Certificate Authority

Does a typical computer begin with any shared secret with a certificate authority when I buy it? If not, a compromised home router could fake everything and get my credit card info when I attempt to ...
4
votes
2answers
49 views

Mac OSX: What is the safest way to access an unknown USB storage?

Let's say a friend gives me a SD-card which I'm not sure is safe (i.e. it may contain malware), what is the safest way to access this card on a Mac OSX? E.g. Is it possible to create a sandbox in ...
0
votes
2answers
38 views

Minimum access required to access LSA Secrets

I would like to know what the minimum access is to be able to dump from the lsass process on a Windows machine (any version) to try and grab LSA Secrets. The reason I am asking is because I had ...
0
votes
2answers
108 views

PGP Encryption - Whats the need to encrypt using random one time key? [duplicate]

I just read about PGP encryption scheme here, and started wondering what is the need to encrypt the file with a one time random key? In other words, how is this scheme more secure than simply sending ...
0
votes
3answers
78 views

User Account Guessing [duplicate]

I'm doing some research on user account guessing, and wanted to ask a question about some "bad practices". My thought is generally this is a trade-off between great user functionality/UX and ...
1
vote
2answers
49 views

Is there a secret-sharing public-key-encryption-based service? [on hold]

I need to share some sensitive information with someone else who can only communicate via E-mail. I don't love the idea of sharing this information freely over email in plain text, so I was ...
1
vote
2answers
113 views

Will an IP packet to the own IP address ever leave the computer?

I am working on a system that consists of several applicaitons communicating with each other. Some of these applications will run on the same server and some will run on a different one. So there is ...
0
votes
1answer
17 views

Secure automatic authentication to samba share

I need to pull some data from network storage to a publicly available laptop that is running Linux. The network storage used to be provided via a server that could be connected to via ssh, but it has ...
-1
votes
0answers
19 views

Is it secure to use intermediate files for login and other files?

I am developing a web application. At some point, I am using intermediate files. For example, user loads login page. After submitting, it redirects to direct.asp or direct.php file. After that direct ...
2
votes
3answers
79 views

How can DH provide a known secret to two parties over an unencrypted connection without it being intercepted via MITM?

Without using Private and Public keypairs, i do not understand how Diffie-Hellman is able to generate a secret key between two parties on the internet without passing something between that could be ...
4
votes
5answers
2k views

Is it better to use a root password, or use 'sudo bash'?

When I am doing a lot of sudo operations, I like to spawn a bash shell from sudo to make the operations go quicker. I am against assigning a root password because I do not like the root account ...
0
votes
0answers
25 views

HTTP vs. HTTPS- detailed procedure to implement HTTPS [migrated]

I have a third party system deployed on Apache web server and Jbose application server, but no SSL implemented. Please tell me the detail procedure on how can I implement the HTTPS feature on my ...
1
vote
2answers
73 views

Buzzfeed just downloaded a binary file to my PC, unasked

The file is binary, named '96748', and it's 12.8kb in size. Ubuntu thinks it's an swf. Thank god I was in a Linux VM and not Windows. It doesn't seem to have done anything, and it's just sitting there ...

15 30 50 per page