0
votes
1answer
4 views

Can Subject Alternative Name(SAN) Certificate install on different Web Server or OS?

Let say: application.house.com apache tomcat : physical server email.house.com apache tomcat : virtual finance.house.com Oracle Wallet Manager : physical server ...
0
votes
0answers
8 views

Is my authentication persistence system design secure?

This system is for a personal file upload and sharing web application made with PHP. When a user logs into the application, he/she has the option to "stay logged in" after closing and reopening their ...
2
votes
1answer
39 views

Does encrypting a setting in web.config actually provide security?

Does encrypting a value in the web.config file actually provide any real protection? It seems to me that any web app can read that setting. Yes that's more work than just reading the web.config file, ...
0
votes
0answers
19 views

SSL Certificate and IDS\IPS

I'm currently drafting an infrastructure design to provide web (internet) access to a number of users to an internal web server in our perimeter DMZ, we have no direct internet access but we do have a ...
0
votes
1answer
41 views

Worst-case scenario OPEN URL REDIRECTION and why google not covering it in bug bounty

OPEN URL REDIRECTION as per in my opinion can be proved very dangerous by crafting attacks such as phishing. But it seems like google thinks it as a very low level bug and does not provide any ...
0
votes
1answer
27 views

Does a smart card do encryption or does it just provide a private certificate?

I don't really understand how smart cards work. Do they sign or encrypt themselves (where the computer provides data to it to sign) or do they provide a computer with the private certificate when I ...
4
votes
2answers
461 views

Why can't I decrypt SSL traffic with the client's private key only?

I have found that I can decrypt SSL traffic in Wireshark with the server's private key. Why isn't the client's private key enough to decrypt SSL traffic?
2
votes
1answer
15 views

Question regarding browser windows when integrating with 3rd party payment software

I've been told that when integrating with a 3rd party payment gateway, the other website's window should not be opened in an iFrame or a separate window - that the current application window itself ...
1
vote
1answer
43 views

Is this a secure way to connect with Tor?

I was discussing the use of tor with a friend, and he happened to suggest a way to remain secure when using applications on the terminal (Lynx, Nmap etc.) His suggestion was this: ssh-keygen -b 4096 ...
0
votes
2answers
35 views

Can a system administrator see if someone is using a VPN?

A friend of mine wants to use a VPN on his school's Wi-Fi becuase they've blocked many applications such as Skype, etc. My question is, if he uses a VPN (with iOS 7) will the system administrators be ...
0
votes
0answers
16 views

Filter GET requests with regexp : Whitelist approach

I'm writing a new website with php, there is no backend but users will be able to input search terms through GET queries and I was wondering : is it safe to whitelist query parameters using regexp? ...
10
votes
1answer
61 views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
3
votes
1answer
45 views

Why use “App Secret” in mobile applications?

I see some SaaS require to import "App Secret" into your application also with "Application Key". I understand the "Applicaton Key", but can not understand the "App Secret". Here is why: I can ...
0
votes
2answers
91 views

What does 2^77.1 calls presented in a SHA1 attack mean?

Regarding the SHA 1 deprecation, I found this information here: http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2880823-recommendation-to-discontinue-use-of-sha-1.aspx I know ...
-2
votes
1answer
39 views

What is DOM based XSS? And How to prevent it?

I know very well about the classic XSS vulnerabilities such as reflected & stored XSS. I have read a lot about DOM and DOM based XSS vulnerabilities. I came to an inference that there is nothing ...
2
votes
1answer
66 views

Global user override - Uncomfortable

We have recently started a project with a service provider who is a little old fashioned in their ways. They provide a product but don't market it particularly well, so we (as users of the product) ...
0
votes
1answer
30 views

SSL cipher suite: what does “export” mean?

I saw a cipher suite EXP-EDH-RSA-DES-CBC-SHA, EXP stands for export, How do I explain the "export"? What is the different between "EXP-EDH-RSA-DES-CBC-SHA" and "EDH-RSA-DES-CBC-SHA"?
1
vote
1answer
19 views

Security implications of packets with an invalid state (iptables)

I have been seeing few rules with -m state --state NEW, ESTABLISHED, RELATED. First I thought that was pointless as it was contemplating the three possible states, so there was no need to define -m ...
2
votes
1answer
36 views

secure way to store application settings

What is a proper or, if possible to tell, the best way to store configuration in matters of security? So far I can tell that a database with very restricted access is a good way, but please lets ...
33
votes
5answers
4k views

Is it dangerous to post my MAC address publicly?

When posting questions, it is often quite useful to include debug output. However, it sometimes include the MAC address of my laptop, router, or both. What are the possible dangers of releasing these ...
1
vote
1answer
25 views

Securing iOS applications communication from client side

Many of you have heard about instagram flaw that facebook has not fixed yet, The flaw allows the attacker to hijack the session by sniffing the session cookie on Instagram iOS app since it does not ...
25
votes
2answers
1k views

Why do browsers enforce the same-origin security policy on iframes?

I did a small test on Chrome (V37) today. I created a small page and loaded it to the browser: <!DOCTYPE html> <html> <head> <title>Untitled Document</title> ...
0
votes
0answers
34 views

Is listening to an audio stream through Tor (using Tails) hazardous?

If someone were to listen to a SHOUTcast server through Tor using VLC (not just downloading the M3U playlist through the Tor browser, of course, but while running Tails), would it put their security ...
0
votes
0answers
19 views

How to relay broadcast traffic using ncat?

I have 2 servers, 192.168.1.1 and 192.168.2.1. I want to relay any broadcast traffic (192.168.2.255) through 192.168.2.1 to 192.168.1.1. Here's what I'm doing to relay port 137 traffic, and it seems ...
3
votes
1answer
41 views

Storing Credit Card Information on Mobile Phones

I've inherited the code-base for a legacy mobile app (both the native Android and native iOS version) and am running a security review on it, a few things stood out to me. The app allows a user to ...
-2
votes
0answers
48 views

I lost my android phone, but it keeps showing up on the logs [on hold]

I lost my android phone but noticed today some requests for on my DNS server logs. Does that mean it's in my house somewhere?
-2
votes
0answers
26 views

Replay attack on redhat [on hold]

in this case i have a redhat linux that is installed on a virtual machine,I want to change a text file on this machine before it leaves the machine and get to the destination,As i know this known as ...
-1
votes
1answer
70 views

How do I hash a password in C#? [duplicate]

I assume that the best way to handle passwords for a website is I create a hash of the password and save that hash in my database. Then when someone tries to login, I do a hash of the password they ...
0
votes
1answer
17 views

What is the difference between active reconnaissance and scanning/enumeration

I have just started studying for CEH exam v8 and I am trying to get the core of so called hacking phases. I could not totally understand the practical difference between the first two phases. In ...
1
vote
0answers
86 views

Task Manager shows higher total CPU usage than the sum of all running processes. Keylogger?

In Windows Task Manager and AVG Task Manager (included in TuneUp Utilities), I see that the sum of all the running processes is much lower than the total CPU usage shown in "performance" tab. Does ...
0
votes
1answer
28 views

Can an attacker detect if I have a TARPIT enabled?

Last thing we want to do is provoke an attacker and offer them challenges or puzzles indirectly to give them a flag to stay and continue to hack rather than move on to other hosts. If possible, I do ...
0
votes
1answer
33 views

HMAC based algorithm for publicly sharing authenticated messages

I am trying to design an algorithm for publicly sharing authenticated messages. Obviously, asymmetric public/private key schemes do this, but I want to avoid the requirement that users have to keep ...
2
votes
0answers
32 views

Removing malware which is creating temp file and modifying network traffic [duplicate]

I am on OSX 10.9.2, please note I have included several URLs in my post, this is not spam this is due to the nature of the malware. I have just discovered I have malware on my computer after noticing ...
1
vote
0answers
12 views

Secure Single Page Application (SPA) served from a CDN

Is it possible to secure a Single Page Application (SPA) served from a CDN that communicates with a REST API, assuming the following: The front end communicates with a backend REST API using a token ...
2
votes
1answer
57 views

What does verified file in windows mean? And does it guarantee related files?

Often when I run a .exe file in Windows, a small box pops up that shows that file is from a verified publisher (e.g Microsoft) or in other case, unknown publisher. I know public key encryption can ...
-1
votes
1answer
38 views

Running javascript when there is error on the script?

Recently i was figuring out a web application and found that the url is reflected among the source of the page which make it bit obvious for xss but the input from url which is reflected on source is ...
1
vote
0answers
30 views

Am I safe to see a thumbnail of a downloaded images on Ubuntu 14.04?

I have downloaded an image that someone has uploaded to my website with a public upload form. My intention was to copy the file in a virtual machine and see the image from there; unfortunately, on ...
4
votes
1answer
23 views

safely changing distribution, is there a strategy to get an distro iso image untampered?

I can check that an Ubuntu iso file is indeed untampered using the public keys already present and trusted in my Ubuntu system. Now I want to switch from Ubuntu to Arch and I wonder how I can start ...
1
vote
0answers
24 views

Signed an executable; appears as unsigned on VMs?

I signed my binary with a certificate issued by GoDaddy. It seems that myself and everyone I could get to test it for me confirms that it is indeed signed (much like signtool verify) However, when I ...
0
votes
1answer
27 views

Why does ssh `known_hosts` file need server name?

When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has ...
2
votes
1answer
37 views

Which PGP settings have been found to be vulnerable?

Digging through articles, one often finds recommendations such as "Use the default key type/size X", whereas an article written a few years later will write "Key type/size X has been found to be ...
13
votes
2answers
2k views

Linux password changed. Is this an attack or a hardware glitch?

My Linux (Ubuntu 12.04) password suddenly changed last night and I'm not sure if this is an attack or just a hardware/user error. This is on a personal/non-server box. Several strange events led up to ...
1
vote
1answer
31 views

Encrypt pdf by the server to prevent printing and copying

We are building a portal where users can upload few materials. we have been successful in using the command lines of linux to convert doc,ppts to pdf directly through the server but we are not able to ...
0
votes
0answers
10 views

How to evaluate authentication for a WAP portal?

I am trying to evaluate a security authentication for a WAP portal. The authentication works by asking the customer for his unique MSISDN and then a secret pin code is sms to client. In this is a ...
1
vote
0answers
30 views

Kerberos v4 replay attack vs. sliding time window

Just wondering about a replay attack against Kerberos v4. So v5 has a replay cache that takes note of tickets to prevent replay attacks. Kerberos v4 does not have a replay cache, though. Say, I ...
8
votes
4answers
683 views

Can anti-CSRF token prevent bruteforce attack?

I am not much experienced with brute force attacks but I was wondering Suppose, you have a website www.example.com and you want to do brute force attack on that login form but that login form is ...
0
votes
2answers
40 views

Firewall Security vs Anti-Virus

Overview of my question I want to create a secure Window's system without the use of an Anti-Virus program. Whilst I know there are many on-demand and live-scanning anti-virus programs readily ...
2
votes
2answers
71 views

entropy of two factor authentication

I have two independent authentication methods A and B with entropy a and b respectively. say compromise of A does not provide any information on B. Is entropy of two-factor authentication of A and B ...
0
votes
1answer
32 views

GnuPG / OpenPGP: How to eliminate redundancy in PGP private key?

I examined a few randomly generated private keys generated by Gnu PG, and found a lot of redundancy. It is enclosed by -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY BLOCK----- ...
1
vote
2answers
103 views

Search on hashed data

We have a request to encrypt customer personal data (e-mail, address etc.) We use MySQL which does not have any TDE like MS SQL or Oracle. So along with encrypting data we need to preserve ...

15 30 50 per page