0
votes
0answers
8 views

How to detect malicious code “calling home” in linux

Suppose you have some malicious code on your (personal) linux system, for example a rootkit or trojan or something like that. Now restrict your attention to the case that the malicious code does ...
0
votes
0answers
3 views

Can the device seed be recovered from the iPhone/Android RSA SecurID app?

The Windows RSA SecurID app allows the device seed to be determined and cloned from one machine to another (see this blog post). Do either the iPhone or Android RSA SecurID apps suffer from the same ...
0
votes
0answers
7 views

Best way to generate the AES key using c#?

We going to use AES encryption to encrypt the CC data, I stuck with generating the data encrypted key(DEK) and store it in DB(encrypted form) using sql encryption concept . Can you please provide ...
0
votes
2answers
15 views

JS malware detection

Is there a way to detect a malicious JavaScript code within a webpage before the script runs on my computer ? I want to develop a Python script that prevents from 8 JS malwares that I can embed on my ...
1
vote
1answer
13 views

Python Scripting Question

I have a question about writing a small tool that would provide the headers for any website. I am new to python but wanted to know if there is anything else other than encoding that I would have to ...
0
votes
1answer
7 views

Disable Specific Cipher Suites Apache with WHM/cPanel

We are operating a few web servers that have WHM/cPanel installed so we can easily mange our sites and projects. To ensure our information and users information is secured, we have been running some ...
0
votes
0answers
2 views

Does Mac OS X 10.8+ support self-signed Package Installer

I'm not sure whether self-signed Package Installer are supported by Mac OS X 10.8+ Using informations in How to create an Apple Installer Package Signing Certificate I could create a Package ...
0
votes
1answer
24 views

What is the problem with multiple encryption and how do you know if you have decrypted a cipher?

I have 2 questions that are somewhat related: 1. When you try and guess the key in a program (in a brute force way), how does the program know if it got it right and it had deciphered the message (I'm ...
2
votes
1answer
31 views

How does Android filesystem encryption work?

I'm interested in encrypting my Android devices for security in the (hopefully will-never-happen) event of the phone being recovered by an unknown/unauthorized person. How does Android filesystem ...
2
votes
3answers
26 views

Does a PGP signature provide integrity verification?

Many websites including OpenSSL's website provide downloads along with MD5/SHA1 checksums sometimes in addition to PGP signatures for the files. Simply put, do PGP signatures provide file integrity ...
1
vote
0answers
14 views

Configuration settings for sessions in php

I recently found the following configuration settings: use-strict-mode hash-bits-per-character hash-function and I have some questions about them: Use-strict-mode says the following: ...
1
vote
1answer
49 views

Load balancer and two machines - how many SSL certificates do I need?

We have a load balancer facing the Internet. It's balancing load towards two systems behind it in the back-end running apache. How many SSL certificates do I need to buy? - One for the load-balancer ...
0
votes
1answer
19 views

Does methods such as Generalized Mersenne are safe way to find p and q?

There are many methods for finding very large primes fast. Most of them have complete lists. Is it possible an attacker try to guess that p or q was generated using a such kind of method? If yes, ...
1
vote
2answers
21 views

What is the security benefit of Per-File Encryption key architecture?

Are there any security benefits to having a different key(it is encrypted by a master key and that encrypted key is included in the metadata for the file) used to encrypt each file versus just one key ...
-1
votes
3answers
38 views

Defenses other than firewall and antivirus?

Besides firewalls and antivirus, what other steps can be taken to harden a home computer? Specifically(?), we are getting a new home computer, fresh and probably filled with bloatware. It would be ...
-5
votes
0answers
15 views

Sample Security Plan- Microsoft Exchange [on hold]

I have found several system security plan templates but I am looking for examples that are complete and filled out. I am ideally looking for one for Microsoft Exchange but I am okay with any.
2
votes
1answer
46 views

Which is more secure - a VPN, a proxy-server, Tor, etc.? And why so, exactly? [on hold]

I want to know how to ensure the most complete anonymity when browsing the internet and connecting to remote servers: I want to be as anonymous and secret as possible. I don't know exactly how VPNs ...
0
votes
1answer
39 views

Understanding the order by clause used in SQL Injections

I am trying to enumerate a database, created specifically for the purpose of learning SQL injections. I am trying to discover the number of columns a particular select statement might be using. I do ...
3
votes
1answer
47 views

Can someone launch a DOS attack on my IP

Suppose, I have a static IP on my PC and is known to others. None of my softwares listen for remote connection. Is it still possible for someone to DOS attack me in such cases? If yes, how it is ...
0
votes
1answer
17 views

Could a network host and process programs while securing against piracy?

Consider an ideal service hosting network, which: Lets programmers: Publish a program in such a way that it can't be retrieved. Associate a program with a wallet. Specify a cost per request and ...
3
votes
2answers
43 views

Crypto software: overwrite sensitive buffer

Is it common to implement crypto software in such a way that sensitive buffers are overwritten before free'ing memory? For example when they contain a private key or the plaintext message.
0
votes
0answers
11 views

Assymetric encryption in php

Can one do asymmetric encryption in php using php_encrypt() and php_decrypt(), using the public and private keys respectively as the key? Would it work? I prefer this to openssl_public_encrypt() and ...
1
vote
2answers
31 views

Does Google 2-step verification protect user from session hijacking?

After signing in Google 2-Step verification scenario, user should enter verification code which sends to his mobile. Without it, he couldn't access to Gmail account. Consider an attacker does session ...
2
votes
2answers
70 views

Does my brokerage/bank use poor password security measures?

I'm no expert. Could someone please tell me if I'm overreacting? After the Heartbleed news broke, I changed a lot of passwords. Here's what I discovered when changing the password on my all-in-one ...
0
votes
1answer
80 views

“No hack no fee” pen-testing agreements [on hold]

A common theme in security engineering is that perfect security is impossible (or at least highly unlikely). Consider Johnston's Infinity Maxim: There are an unlimited number of security ...
-3
votes
2answers
57 views

What makes iOS more secure than other phone OS

Let's start off with an example. Here in Canada, credit card companies cannot upgrade you credit card limit. You need to make a request, that will then get analyzed and then, depending on your status ...
0
votes
1answer
32 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
1
vote
3answers
78 views

Robots.txt and admin areas

I'm using some popular commercial forum software and to help secure the admin area more I have changed the name of the admin folder; however I was wondering, with regards to robots.txt if I go ahead ...
2
votes
1answer
32 views

SmartCard for private keys - personal usage

I've just found my notebook has a SmartCard reader. Would it be wise/possible/practical to buy a single SmartCard, transfer my private key on that (somehow), and use it as my primary private key ...
0
votes
1answer
40 views

Forensics in the cloud

I recently did a university module on digital forensics and learned a lot about the process, and techniques, of digital forensics investigations. We didn't actually cover the cloud although I ...
-1
votes
0answers
20 views

Merging two dmains ( active directory server)

I've a requirement of merging two domains. Our domain will be merged with a other domain.This work will be done by AD team.From security point of view what are the points I need to be bothered about ...
11
votes
7answers
575 views

How to get top management support for security projects?

I am facing an issue regarding security projects, for example: last year we bought an antivirus licence for 500 (end point security), and made a policy in order to force everyone to install it, ...
0
votes
0answers
29 views

Are Images/Videos sent through WhatsApp stoed on the server for too long? If yes, are they secure [on hold]

The WhatsApp privacy policy states that messages once delivered are deleted from the server forever. But in case of "files"(I'm assuming them to be attachments like images and videos) it says and I ...
1
vote
1answer
64 views

Is wiping memory at code/end good practise?

Sometimes passwords/hash/keys & other private information is stored in variables and hence in memory/RAM during code execution. while some situations (i.e. Linux Kernels see here Is there any ...
2
votes
1answer
28 views

IKEv2: Why is it important “that each side sign the other side's nonce”

I am currently diging deep into the IKEv2 protocol. In the description of the Authentication (RFC5996, p. 48), the following statement is given: "It is critical to the security of the exchange that ...
-1
votes
1answer
36 views

Spyware for feature phones

There are a lot of spywares for android and ios smartphones. Are there spywares for feature phones ? I am using this samsung phone, which is basic. I am wondering if somebody who has access to this ...
17
votes
5answers
1k views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole ? ...
1
vote
2answers
50 views

Does having a seperate e-mail account only for security, increase security?

In this article about increasing the security of lastpass the author suggests For additional security, you can have LastPass send security-related emails to a special security email address ...
-1
votes
1answer
37 views

URL filtering , issues with URL

I am working on a URL filtering project . I have a database given to me which contain URLs need to be blocked (eg: a.b.com/d/e). I get uri and domain from http request. I compare what I get with my ...
0
votes
0answers
75 views

Security jobs that suit disabled workers [on hold]

I was in a bad accident which has left me with some severe limitations in how I can work. Due to my disabilities I will only be able to work from my home. I understand that this is a very unique ...
-1
votes
0answers
22 views

Filtering of incoming and outgoing packets in a firewall

In general, egress http packets should be allowed to pass through the firewalls. Ingress http packets, however, should go through firewall inspections. Suppose the Web server is placed in DMZ. If an ...
1
vote
0answers
29 views

Securely calculating encoding efficiency

I have a rather odd security requirement that I must keep the amount of potentially encoded information in a record under 250 bytes*. That's not a lot of data, so I was thinking of calculating the ...
3
votes
2answers
59 views

Letting users pick up where they left off…without logging in (is this bad form?)

I have a Grails app I'm working on that allows users to fill out a fairly lengthy application form. One of the requirements I've been given is to NOT require users to log in or create any sort of ...
1
vote
2answers
144 views

Google Accessed My MSN Account!

I just received a notification from Microsoft that my Microsoft account has been blocked because it's been accessed by an IP address that's never accessed it before. I received this notification as a ...
0
votes
0answers
61 views

What major vulnerabilities have there been to TLS libraries? [on hold]

I'm trying to compile a list of large security vulnerabilities in TLS (and SSL) libraries. Examples of things I'm looking for are: Heartbleed Goto fail The Firefox/NSS PKCS11 (IIRC) parsing bug
0
votes
0answers
15 views

DTLS CertificateVerify doubt

In DTLS 1.2 RFC 6347, section 4.2.6: CertificateVerify and Finished messages have the same format as in TLS. Hash calculations include entire handshake messages, including DTLS-specific fields: ...
1
vote
1answer
103 views

What should I do when I need to store passwords for usage in 3rd party softwrae?

I have a desktop WPF application which authenticates with Dynamics CRM 2011. I ask for the username and password of the user and use them to connect to Dynamics CRM 2011 using ...
1
vote
2answers
39 views

Can you export a report from OWASP Zap based off a individual website?

I have a list of 30 websites I have scanned. I need to pull out a report for each individual website. Is it possible to do? Right now I am just running a report and getting the results for all 30 and ...
2
votes
1answer
32 views

Is the following code seeding OpenSSL's PRNG necessary, superfluous, or harmful?

As I was going through Crypt::SSLeay, preparing it for the next release, I noticed the following code, written way before my time, ... int rand_bytes_read; static int bNotFirstTime; char buf[ 1024 ...
3
votes
2answers
47 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...

15 30 50 per page