0
votes
0answers
2 views

Understanding DUKPT KSN

I have a number of questions regarding KSN: KSNs are 8 - 10 bytes long. Older implementation are 8 bytes whereas newer ones are 10 bytes. Do I risk being incompatible with some old system if I ...
0
votes
0answers
4 views

Devices enabling remote access and bluetooth connections

Are there any major security risks associated with using a device for remote access to a workstation computer while at the same time enabling blue-tooth internet sharing on the device? Thanks ...
0
votes
0answers
5 views

Store and protect details for software licenses

Assuming that a license can be a key (XXXX-XXXX-XXXX-XXXX), a file (license.xml or whatever), or a login for a dashboard on the vendor website, how would be a standard way to store and secure those ...
0
votes
1answer
10 views

Why do phishing sites use images instead of just copying the HTML?

Why do phishing sites use pictures of the full site (e.g., they took screenshot and broke it up) instead of just copying the real HTML and modifying the target for form submission of ...
0
votes
0answers
3 views

For attackers looking to launch arp spoof on a target, does the attack have to happen in real time?

I was surfing the web at 3 in the morning and I got a warning which seems to indicate a MITM attack. Does this mean the attacker was able to passive sniff my activity in real-time in order to launch ...
-2
votes
0answers
13 views

Is it true that breaking into the https padlock settings on a web page is easy to do?

I found some articles online that explained that https settings are easy to crack. If this is true, is there no way for us to keep our browsing private? I use Tor and used to have JonDo before it ...
2
votes
3answers
23 views

Securely storing bank account details in database

I am developing a service that will involve the direct debit of customers' accounts on a routine (weekly, monthly, etc.) basis, and so I'll need to store their information (BSB/routing number and ...
0
votes
0answers
3 views

Mystery URL in iftop

So this may be more appropriate for serverfault, but it seems like it belongs here. I was watching iftop on a server I control that can send data to arbitrary sources but can theoretically only ...
0
votes
0answers
9 views

Decrypting SSL traffic for Security Onion at or before the interface

I have Security Onion installed and doing full packet capture on my home network. I also have a firewall (pfSense) which does my routing. I have Security Onion sitting just behind my firewall and ...
0
votes
0answers
6 views

Security Assessment v/s Security Engagement Breakdown

I had this couple of threads in here which talks about security assessment v/s risk assessments, but here the idea is completely different. Suppose, I had to breakdown qualitative tasks from the ...
0
votes
1answer
15 views

Is this a secure hash “Function” for integrity?

I was wondering what were the posible security (not efficieny) issues with this hash "function": Although not an actual function, this method turns a message of any length into a message of fixed ...
0
votes
0answers
13 views

How can I use the free version of Burp to identify input HTTP urls for my site

I want to create (and update ongoing) a list of input vectors for my site, including forms (GET and POST etc). I am new to pen tesing, and have been pointed at Burp (free). I have Spidered my site, ...
0
votes
0answers
5 views

Why has my GPG-key been duplicated on expiry change?

I've published my GPG-key publicly on the MIT keyserver. Later I realized I needed to set the expiry date to an earlier date than the one the (sub-)key was published with. I managed to do this ...
0
votes
2answers
15 views

Does splitting RNG into “private” and “public” entropy sources reduce risks of compromise?

I'm reading s2n's docs (https://github.com/awslabs/s2n) where it is claimed that: https://github.com/awslabs/s2n#compartmentalized-random-number-generation The security of TLS and its associated ...
0
votes
1answer
11 views

FIPS 201(-2): Central requirements for PIV?

I was recentely asked in the comments on some details on tamper-proofing of a smartcard in question. The term "FIPS-201" was used to specify what kind of details was needed. I understand that FIPS ...
3
votes
1answer
36 views

Why is logjam rated as “None” for confidentiality impact in CVSS?

The CVSS score for Logjam is (AV:N/AC:M/Au:N/C:N/I:P/A:N). As noted in that nice dynamic image interpretation, the Impact metric "Confidentiality" is described as "None" (C:N). But the ...
0
votes
0answers
15 views

Thinktecture IdentityServer security review

Has an independent security review been performed for Thinktecture IdentityServer, for design and code? Alternatively, does IdentityServer address the threats discussed in RFC 6819, OAuth 2.0 ...
1
vote
0answers
25 views

Why use oddly compiled ELF files for Linux malware?

I ran file on some Linux malware ELF files that I've acquired over the last couple of years. I noticed some oddities: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for ...
2
votes
2answers
18 views

Malware: extract private keys from smartcard?

We all appreciate smartcards because they secure private keys so they don't get exposed to the world. But in a production-environment it's often the case that smartcards are staying inserted for a ...
1
vote
1answer
70 views

Why do some programming language API's not support private key passwords?

Two questions: I've recently started building a basic Go web-server, and noticed that the API for starting a TLS web-server does not support a symmetrically encrypted private RSA key. The API is ...
1
vote
1answer
25 views

Secure connection between two clients with shared secret

I am creating a system where there are multiple clients, each of which has a secure connection to a central server which could pass out shared secrets to each of them. I could be wrong, but I am ...
2
votes
2answers
46 views

Is writing to /dev/null secure?

I am working on a web-service based crypto project in JAVA. The basic idea is for the client to send a SOAP request to a servlet to encrypt data. For data transmission I am using MIME/data-handlers ...
3
votes
2answers
422 views

What can hackers do with ability to read /etc/passwd

I see on the exploit websites security analysts and hackers targeting the /etc/passwd file when showing the proof of concept. My question is, if you have a Local File Inclusion or Path Traversal ...
0
votes
0answers
23 views

Neighbors Internet Kicks My PPEOE Off

Had this problem for almost a year now, and watched it closely, my internet vianet, runs just fine till a certain wifi shows up, always Bell023 when ever this wifi shows up my modem gets it's PPEOE ...
0
votes
2answers
30 views

Brute force time estimation - random sequence

I would like to ask if there are 2^1000 possibilities to choose from, how long would it take go through them all on average? (in terms of min, hours or years) Note: This is not necessary related to ...
0
votes
3answers
33 views

Why is shared less secure than open when it comes to WEP?

According to this post, Jeffrey Tippet (Microsoft employee) writes: WEP can run in two modes: shared and open. Despite the names, shared is actually less secure than open. Because of this, our ...
0
votes
1answer
16 views

Changing the signature on a cert or creating a key file from an existing cert

I would like to create a certificate with a specific public key. I have another certificate which contains the public key I need to use, and I wish to change the signature on that certificate to a ...
-1
votes
0answers
24 views

Can't encrypt email

My friend has a problem described here: https://gpgtools.tenderapp.com/discussions/problems/18790-cannot-encrypt-an-email But the solution provided by this link did not work. What else can he try? ...
0
votes
0answers
14 views

Is the SanDisk ULLtraDIMM secure after power-down?

I found an interesting product last night called the SanDisk ULLtradDimm SSD (product page), which essentially claims drastic performance gains by plugging an SSD into a standard DDR3 memory channel. ...
2
votes
1answer
73 views

How to avoid ransomware

Malware files execute themselves after downloading them. Let's look at it from the point of view of a piece of ransomware like CryptoLocker, from Wikipedia: Crypyowall 3.0, uses a payload ...
2
votes
1answer
37 views

Issue regarding installation of SHA256 scertificate

Can anyone help me with the installation of SHA256 certificate? I have generated the certificate perfectly but there seems to be an error below: Kindly let me know why am getting the exclamation ...
1
vote
1answer
24 views

Padding of 802.11 packet with 0's in libpcap

I am trying to send probe request to Access Points.But whenever I send a probe request packet it is padded with 0's i.e I see two packets on wireshark for every packet I send : a non-padded packet and ...
0
votes
2answers
79 views

Hiding (Obfuscating) Java script

So i heard that obfuscating java script is useless and waste of time because anyone with a little of skill can decode your code. So i want to test that. This code will display a alert box saying hey ...
15
votes
4answers
3k views

How secure is Snowden's MargaretThatcheris110%SEXY password?

In an extra from Edward Snowden's interview with John Oliver, Snowdon advises that a good password to use is one such as MargaretThatcheris110%SEXY.. Also, on the Errata Security blog, Robert Graham ...
2
votes
0answers
8 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
18
votes
5answers
2k views

Unsubscribe safely

I have heard that is better to never click to any link in an email. Is it a bad idea to click to a unsubscribe link? What is the best way to unsubscribe to undesired mails?
1
vote
1answer
26 views

How to prepare FATCA data transmission files with open source tools [on hold]

Here is the context: to transmit FATCA data to US IRS service the IDES protocol defines the following steps sign the XML Payload.xml file with enveloping signature, SHA-256 with RSA private key, as ...
1
vote
1answer
50 views

Can Windows 8 be PCI compliant?

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows ...
1
vote
3answers
96 views

Why not fix Android root exploit? [on hold]

I see many scripts for hacking Android device and getting root, critical access level. I see millions of people apply this to their devices and do not understand the risks. Why don't Android ...
1
vote
1answer
46 views

Cloud-based IM protocols / services saving messages encrypted on server which is decryptable only by user?

I am looking for a cloud-based (i.e. not end-to-end) secure IM protocol or service. The first one comes to my mind is telegram. Here is a quote from telegram's privacy policy: Cloud Chats ...
-3
votes
0answers
32 views

How do I decrypt a RSA-SHA1 code?

I am working on one project where I am having a RSA-SHA1 modulus code and Exponent value only. which is as follows: Modulus: ...
1
vote
0answers
58 views

Knowing the MAC adress of a stolen laptop [migrated]

Recently my HP 1000 laptop was stolen, is there any way to find its MAC address? I connected my laptop to a PTCL EVO (Pakistan) WiFi USB dongle, but in the device options there is nothing I could ...
4
votes
2answers
512 views

Confidentiality in Digital Signature

Recently I have been working on Digital Signature. Some common reasons for applying a Digital signature to communications are Authentication, Integrity and Non-repudiation. Does Digital Signature also ...
2
votes
2answers
191 views

Can malware provide hidden remote access to a user's desktop?

Is there a possibility that malware on a computer could be providing remote access to an external party without the computer user being aware? I.e., some kind of hidden active remote access tool? ...
1
vote
4answers
67 views

is it easier to eavesdrop on ethernet connection rather than wifi?

I heard someone say that ethernet connection is vulerable if someone can connect to your LAN, and that the traffic isn't encrypted in the way it might be if you're using WPA wifi encryption. Is this ...
1
vote
1answer
139 views

Why AJAX is not used to log in?

I'm wondering why AJAX is not used to log in nor register in most of the pages and it's used PHP reloading the whole page. Is it about security, or it's just that it's not practical at all?
2
votes
3answers
120 views

Email confirmation techniques in major sites

The way I understood traditionally for email confirmations to work is the user registers to the site with their email and then to login they must verify their email. If they have not verified ...
2
votes
1answer
32 views

Is FileVault 2 HIPAA compliant?

It looks to me like FileVault 2 uses AES 256 bit encryption for the desk. Does that mean that it meets the HIPAA "data at rest" standard? Is there something else I need to check about it?
1
vote
1answer
27 views

Can Hydra and Crunch be used in combination for HTTP-get-form? [on hold]

I'm trying to recover my router username and password without resetting the router for educational purposes. I read that Hydra can be used for "brute-forcing" http-get-form authentication that most ...
-1
votes
0answers
44 views

Do you know any tip to accomplish this xss? [on hold]

I have the following scenario: Test A: https://target/srv;?q=pwn%0Aalert(1);//&ref=B The result: <script type="text/javascript"> if ("pwn alert(1);//" != "") ...

15 30 50 per page