1
vote
0answers
7 views

Understanding Digital Certification as as a whole starting from a normal http request

I am very new to security and i do not come from an IT background. Please pardon me if i ask some very simple and questions that don't make sense. I am trying to understand the difference between ...
0
votes
0answers
12 views

Is 3DES is a weak cipher? [duplicate]

Our application runs on JBoss 6 + jdk 1.7. We use the jdk provided SSL provider. The server.xml file contains SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA in the cipher lists. Is it a weak cipher? Should we ...
0
votes
1answer
14 views

Does WhatsApp disclose the sender's IP address?

Does WhatsApp disclose the sender's IP address? Is it possible to get it by running netstat -a or via Wireshark?
-1
votes
0answers
17 views

how does malware gets into the system without my knowledge [on hold]

Today! i just installed windows 8 and using IE i went to official chrome site and installed google chrome while it is installing many adwares were installed on my computer? I don't know How does it ...
2
votes
1answer
18 views

How can demonstrate that 3 independent root CAs validated my domain?

I am concerned about the hacking of a root CA and want to buy 3 SSL certs from completely different providers who will independently validate my identity. Then at presentation time, I will send all 3 ...
0
votes
2answers
34 views

Why is Facebook planning to drop support for SHA-1 encrypted sites, when they themselves use a SHA-1 certificate?

I noticed this problem when I implemented the Facebook Like Button plugin on my website, and got this error in my browser console: Hmm, I'm assuming that Firefox is talking about the last request, ...
0
votes
1answer
19 views

Security of stock iPod vs. hardened Android [on hold]

http://www.wired.com/2015/08/secure-way-communicate-IPOs-touch/ https://www.lawfareblog.com/iphones-fbi-and-going-dark I'm looking for some advice on how to affordably secure my electronic ...
3
votes
2answers
32 views

Can a website have multiple valid TLS certs looping back to multiple root CAs in case one of them is compromised?

Sometimes, CAs get compromised, like Diginotar or Comodo. In such an incident, anything can happen from individual certs being revoked to the entire tree being scrubbed from the cert store. A company ...
1
vote
2answers
41 views

My IP address switched suddenly and then switched back

Sometimes I look at the login history of my blog account (a Tumblr blog) to make sure no one else is logging in (because I have private posts that I want to keep private). Even though today I ...
1
vote
0answers
20 views

At what point is information encrypted when communicating from a C# program over HTTPS? [on hold]

So I was running a communication log on an application I support I noticed that within the log there was a request string that displayed my password in cipher-text, but the next request string down, ...
1
vote
1answer
17 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
3
votes
1answer
33 views

How wifi sense actually connects to any network?

I read that using Wi-Fi sense, we can share our Wi-Fi networks with others and it stores pre-shared keys on Microsoft servers. Please help me understand the below scenario: I am sharing my network ...
0
votes
0answers
10 views

Executing ELF binaries in OSX [migrated]

I have a CTF related question and I was wondering if someone can point me to the right direction. I work on OSX Yosemite and I was going through some wargames and older CTF challenges. My goal is to ...
1
vote
0answers
26 views

Reflected XSS quote not encoded

I am attempting to exploit URL with a reflected XSS as follows: http://domain.com/vuln_parm= The contents of vuln_parm gets returned to the user as follows: <div attrib1="" attrib2="" ...
0
votes
2answers
17 views

Device visibility on a network

At my college dorm's Wi-Fi network, one device can play to any other network-connected, YouTube-enabled device on that network. Apple devices can also AirPlay to the one Apple TV connected here. How ...
1
vote
1answer
35 views

Site hack with email phishing scam

We have a small business website that has been compromised. They are somehow getting customers order details and contacting them requesting their credit card details. We have had our web team and a ...
0
votes
0answers
16 views

Is there any equivalent to the apache xml security library for JSON? [on hold]

I'm talking about org.apache.xml.security(santurio) Is there any equivalent library that works with JSON and provides the same set of features? (mostly AES-128 with KEK support)
5
votes
2answers
123 views

Why is Tor over HTTPs insecure?

I don't get how a HTTPs connection over Tor can be insecure. Where's the difference between a normal HTTPs connection and a TOR -> HTTP connection? Many sites recommend to use the Onion-URL instead of ...
1
vote
1answer
67 views

securely storing passwords that can be retrieved

I'm trying to build a web application that can store passwords of other services like Facebook, Gmail ...etc. These passwords can be later retrieved and shown to the user. This has to be a web ...
1
vote
0answers
15 views

SSH-Keygen Fingerprint providing Letters and Numbers Result [on hold]

I've been using SSH and public key crypto for a few months. I've run into a new problem with my install of the newest public beta of OS X, and can't find an answer online. When I run SSH-Keygen -lf ...
0
votes
0answers
12 views

Proving an encrypted message contains (but does not 100% consist of) a plain-text message? [migrated]

I have keypair (u,r), and two pieces of data, X and Y. I reveal X publicly but keep Y secret. Y has high entropy. I then combine X and Y, into c(X,Y) = Z. I encrypt Z, into "encrypt(Z,u) = Q". r ...
10
votes
4answers
767 views

What is the difference between http and https with a self-signed SSL certificate?

A colleague of mine has told me he doesn't see why there is a warning when visiting a HTTPS website with a self-signed certificate saying that the security may be compromised, but there is no warning ...
1
vote
0answers
20 views

Configure CLAMAV for XML inspection

How would I configure clamav to look for XML exploits. I am not even sure if it supports it but from reading the conf file I am not really seeing any mention of XML. to test this I have literally ...
0
votes
0answers
52 views

Virtual phone number

I want to set up an account for a certain service while remaining anonymous. This service requires phone activation and where I live it not possible to activate a sim card without submitting id to the ...
-2
votes
1answer
70 views

How to secure server when the root password is changed [on hold]

I have a server and I develop a web application for my customer. I have the server credentials but I wonder what if my customer changes the server credentials after I have completed the application, ...
3
votes
1answer
85 views

OS login password: How does it work?

I am making an application to create a password for a user. I am a bit baffled over how it all works though. Namely I want to be sure that my application will store the correct hash so the user can ...
23
votes
3answers
3k views

How does a hacker know how many times a password was hashed?

I've been reading a lot of questions about security and hash functions on this site and others. I am not an expert, just a curious mind and in my understanding the more iterations used to hash a ...
1
vote
1answer
50 views

Network setup for malware analysis lab in a corporate view

I am planning to setup a malware analysis lab in the Incident Response team of the company I work for. As I am basically a malware analyst I some how managed to get up with the malware analysis lab ...
1
vote
3answers
62 views

Where to place PHP files for security?

A simple question, where do you place PHP files on a server? I can't seem to find any good information on this. Obviously public files should be in the document root somewhere/somehow, since they ...
23
votes
2answers
3k views

Is Ghostery safe to use?

I've heard about Ghostery, a browser extension/plugin that blocks web trackers. But according to this link it sells our data. Are add-ons and plugins open source in Firefox? Is there another ...
2
votes
2answers
49 views

Is a precompiled Java program affected by Java vulnerabilities?

We know that Oracle publishes Java updates due to vulnerabilities / security issues and therefore we should make sure that we have installed the latest version of Java. Now there exist programs like ...
1
vote
1answer
52 views

How to access SQL server inside a Powershell script

I'm coming from a Linux world so I'm a bit at a disadvantage here. Assuming a windows Task scheduler script that calls a stored procedure to return some rows, and transmit a file over email or SFTP ...
0
votes
0answers
31 views

browser overlay with no “close” button

I observed what I will describe as an "overlay" on my Firefox browser tabs. It contained the logo of the local (copper wire) phone company and both the horizontal and vertical scroll bars. It ...
-3
votes
1answer
57 views

Is Telegram hacking possible? [on hold]

I have found this group on Telegram, which claims they can get all kind of information about a victim that you tell them about for you, if you pay them somewhat huge amount of money, the information ...
17
votes
3answers
3k views

How does DRM stop copying?

I've been doing some research into some DRM solutions, specifically "self-protecting containers". One example of this is DigiBox. Normally, the protected data is encrypted in some kind of container. ...
2
votes
2answers
38 views

DMZ for outbound connections

From a design perspective, is it a good idea to put servers that need to perform outbound connections to internet in a separate DMZ? These servers would be servers like web filters, WSUS servers, ...
1
vote
1answer
54 views

Is it safe to use the SHA1 checksum of a password as a key for SHA-1?

I have an authentication system, where the passwords are stored with bcrypt hash (node passport module). My server generates a random key (128bytes) at startup. Whenever a user logs in, the server ...
-1
votes
0answers
38 views

Is it possible to create multiple hidden volumes within an encrypted volume? [migrated]

You can create an encrypted hidden volume from an outer encrypted volume within Truecrypt or it's fork, Veracrypt... but is it possible to create more than one hidden volume within an outer encrypted ...
-1
votes
0answers
28 views

WPA explained for the non-technical?

Can anybody give me a simple explanation of the WPA mechanism used in our WiFi routers? How does my device know that it's connecting with the router I want to connect to (i.e. no man in the middle ...
3
votes
1answer
43 views

What are the potential security problems running untrusted code in a Docker container as a non-root user?

I've seen plenty of ink spilled by now about how Docker is not sufficiently isolated to allow arbitrary containers to be run in a multi-tenant environment, and that makes sense. "If it's root in ...
1
vote
0answers
29 views

How should I tunnel arbitrary protocol traffic over HTTPS?

I'm posting this question from a moving train! (Ok, maybe that's not so impressive.) This train has an annoying WiFi - it's low-throughput, high-latency, tends to lose packets, and blocks most kinds ...
0
votes
1answer
35 views

Are there any pen testing tools/methods for wpa2 networks that don't require using an adapter that supports monitor mode? [on hold]

I really enjoy reading and researching about networking and pentesting. Recently I heard from a friend that there are ways that can be used to get into wireless networks without needing an adapter ...
4
votes
4answers
79 views

Does an editable file owned by root pose any risk?

On a Linux machine, if we allowed the user bob with home directory /home/bob to put any content (malicious or not) into the file /home/bob/dangerfile.txt -rw-r--r-- 1 root root 61K Aug 24 13:59 ...
1
vote
1answer
23 views

Managing SSH key access to AWS servers behind bastion

enter link description hereI currently have an AWS setup with 3 VPCs, one for the bastion, then a Dev and a Prod VPC, those last two only being SSH accessible via the bastion of course (layout from ...
0
votes
0answers
4 views

How to configure a log aggregator to authenticate data? [migrated]

Background: Remote log aggregation is regarded as a way to improve security. Generally, this addresses the risk that an attacker who compromises a system can edit or delete logs to frustrate forensic ...
0
votes
0answers
15 views

2 IP cameras with same configuration but different behaviour [migrated]

I have a Vodafone Station router, and 2 IP cameras connected to it through an Ethernet cable. Both have the same configuration. Both DHCP enabled, one has IP 192.168.1.10 with port 81 and the other ...
1
vote
2answers
69 views

What the most trustworthy way to demonstrate digital File Integrity?

I'm looking for ensure the integrity of uploaded files and demonstrate this integrity to a user. In my current scenario, a user sends multiple files in several different formats, these files are ...
0
votes
0answers
34 views

Bypass Network using Facebook [on hold]

All ip addresses have been blocked at my work place apart from Facebook. Can I use Facebook as a proxy to access other blocked sites? Thanks.
3
votes
2answers
71 views

Conducting a succesful phishing test

How do you usually conduct a safe phishing exercise to test the staff's security awareness? How do you ensure that staff are not offended by such an exercise? Would you in some circumstances also ...
1
vote
0answers
28 views

John the Ripper performance

I have two questions regarding performance of John the Ripper. Within the format files, there is a variable named MIN_KEYS_PER_CRYPT and MAX_KEYS_PER_CRYPT. How much do they influence the ...

15 30 50 per page