-5
votes
0answers
28 views
Noobee help [closed]
So I've purchased an unlocked Android (S6500) GSM, quad freq and am planning to take it to Italy to use on their TIM network..
There are no SIM's inside, rather 2 empty slots. I put in the SIM from my ...
0
votes
2answers
23 views
Virus Removal Boot Disks — a few questions
I'm new to working with and using a backdoor/virus with a boot disk.
Can they be mounted to a USB drive?
What options are out there and what should I look for in one?
Are they practical?
3
votes
2answers
46 views
How to fuzz proprietary protocol over SSL?
I'm doing vulnerability research on a client/server architecture that uses a custom proprietary protocol sent over SSL (port 443). I need to be able to intercept the traffic, and be able to view it in ...
1
vote
2answers
27 views
RSA key length vs. Shor's algorithm
I have just read a passage in Zeilinger's book about quantum world.
My question is:
Suppose there exist quantum computers. Given that a quantum computer can use Shor's algorithm,
what key length ...
-3
votes
1answer
28 views
Spam mail from my yahoo mail [closed]
Couple of days back spam mail(screenshot link) was sent to all my contacts from my yahoo account, and in my account activity page there is a yahoo partner logged in, from Peru (screenshot link) during ...
1
vote
1answer
73 views
Is revealing your residence physical address when browsing the web a security risk?
I live in a large apartment building that provides a wireless service for residents. All of that traffic goes through a proxy server, and the domain name on that server contains the name of the ...
0
votes
1answer
40 views
HTTP Basic Auth is enough?
I have WebSVN, Gitlab and phpMyAdmin hosted on my dev server. Now, all of it, I password protect the pages (not their individual login) using HTTP Basic Auth, is this the best practice that I can do?
0
votes
4answers
68 views
Why is data privacy important? [closed]
I am finding it difficult to motivate the importance of data privacy when speaking to both more or less technically inclined people. Since selling the idea of security is a fundamental precondition to ...
0
votes
0answers
38 views
Which programs do you use for analyzing unknown Binaries / malware? [closed]
I would like to know which are the best tools for analyzing unknown Binaries / malware ?
I used in the past
Wireshark
PE Explorer
HxD Hexeditor
File Analyzer
So i want to blog about some malware ...
0
votes
1answer
32 views
Allow read-only access to server-side pages for security review?
This answer:
http://security.stackexchange.com/a/37319/10574
Mentions the issue of host-based security. To the end user, the web server is an untrustable black box.
Would it provide to needed ...
0
votes
1answer
101 views
is it possible to sniff email content inside network?
I am working in a IT company. I am using LAN for all internet activities. I send some email from my personal gmail account. My network administrator sniffed all email I send from LAN and he shows the ...
-4
votes
0answers
24 views
Mass POST XSS Checker [closed]
I'm looking for mass POST XSS checker for my website. Most apps that I've tried either uses get parameter or does not do mass checking.
p.s: By Mass-checking, I mean a checker which does website ...
-2
votes
0answers
32 views
SSL certificate installation in browser [closed]
I have an web application of which we have SSL certificate on browser.
I have installed it in few computers its working perfectly fine.
However I have 2 computers in which I have installed ...
0
votes
1answer
43 views
How can I encrypt my router admin page login session? [closed]
I login to my router using the web connection but the session is not encrypted, is there a third party way to encrypt the web session so no one on my network can sniff the password?
0
votes
0answers
8 views
Should signature based NIDS detect malicious documents or executable malwares? [duplicate]
Two kinds of client side attacks are explained here, offensive-security.com: (1) just binary payloads and (2) exploit+payloads. Is it the responsibility of NIDS to detect them? It is the payload or ...
3
votes
1answer
32 views
NFC used in place of contact based smart card two-factor authentication
My organization is trying to move away from contact based smartcards (because our hardware vendor is no longer integrating them into their current systems) to some other form of two-factor ...
6
votes
4answers
156 views
How to use public WiFi safely?
The Dangers of Open Wi-Fi
How does one go about sending valuable information (for example inputting email username and password) over a free password-less public WiFi network?
The only option that I ...
1
vote
0answers
47 views
Any obvious flaws in this protocol?
Are there any particular flaws in this protocol?
(Yes I know about SSL)
Three participants:
Login Server LS
Game Server GS
Client C
Asymmetric key-pair Kpriv Kpub
Shared 128bit secret key Ksec
...
18
votes
3answers
704 views
How secure is the Windows 8 included Anti Virus known as Windows Defender?
How secure is the new Windows 8 anti virus known as windows defender?
Does it have a protection against malware which uses UAC bypass/process injection/rootkits/process persistence/running the binary ...
1
vote
0answers
26 views
Pursue career in Network Security [duplicate]
My qualification is Masters in Computer Science and i am currently working as a Technical Support Associate (Network Support) with a MNC. I am good with JAVA programing and have worked on some small ...
-1
votes
0answers
35 views
None of the cipher suites supported by the client application are supported by the server [closed]
I am getting this error in my server's windows event log:
An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client ...
7
votes
4answers
236 views
Why does PGP use symmetric encryption and RSA?
Looking into the details of Pretty Good Privacy, I'm confused as to the reasoning behind encrypting the message with a session key and the key with the recipient's public key via RSA. I fail to see ...
-2
votes
0answers
52 views
What are the implications of NSA's quantum computer ambitions? [closed]
The NSA Is Building the Country’s Biggest Spy Center
http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/all/1
“a lot of foreign government stuff we’ve never been able to break is 128 or less. ...
6
votes
2answers
143 views
Backdoors after SQL injection?
I just found an injection vulnerability on a live site of a client. It looks like this:
$sql = "SELECT * FROM users_dl WHERE Username = '" . $Uname . "' AND Password = '" . $Pword . "'";
I ...
3
votes
2answers
73 views
Securing a REST api at the message level
I'd like some feedback on the following authentication idea, does it makes sense, and is there a standard
way of doing this (or similar) so I can rely on a well tested implementation.
I've seen many ...
0
votes
1answer
38 views
Loading of fake Library attack
Let's supose i have an executable file a.exe and it uses stdlib for some operations.
Let's suppose an attacker changes the system stdlib to a "malicious" stdlib. The implications of this might be ...
2
votes
0answers
46 views
How does Perfect forward secrecy work in https? [duplicate]
How does Perfect forward secrecy work in https?
How to check whether it is enabled or not?
Which big site actually use this? Paypal? Facebook? Amazon?
I have read this Wikipedia article, but I don't ...
2
votes
1answer
78 views
SSL: MITM possible if private key is known? [closed]
If a Man-in-the-middle has the private RSA key of the SSL encryption.
It should be possible for the Man-in-the-middle to decode the entire HTTPS datastream right?
So, then the encryption is ...
-5
votes
1answer
70 views
Free collection of virus test samples [closed]
You want to check functionality of your antivirus. virussign.com can do that for money. Is there a free virus base?
0
votes
0answers
18 views
Openssl Encrypting, Decrypting doesn't work with DES [migrated]
I'm developing a simple application where there are a Client (C) and a Server (S).
Client gets text from std input, encrypts it, and sends it to the Server.
Since, I don't know if the text from user ...
-2
votes
0answers
82 views
Where to move from Gmail? [closed]
I am going to abandon my Gmail account for various reasons (I don't want Google to use my emails for ads, I don't like being spied while I am logged into Gmail and browsing other sites, etc).
So my ...
0
votes
1answer
41 views
Preventive Measure for detecting Session Fixation attacks
From my understanding if i am not wrong in session fixation attacks. The attacker login into the server as a legitimate user and creates a valid session. He then the tricks the compromised user to use ...
-1
votes
0answers
25 views
How to make sure my NIDS can detect recent exploits/vulnerabilities?
Is there any way other than installing the vulnerable OS and application, then running the exploit (published in exploit-db.com) to check whether my configured IDS could detect it or not? I mean, ...
1
vote
1answer
54 views
Licensing/selling digital certificate to another company
I recently stopped distributing my software, so I no longer use the digital certificate (AKA digital signature) I created for it.
A couple of days ago, a large software company offered to buy the ...
4
votes
2answers
86 views
using two passwords for normal and security critical functions
a user (can be admin) for example in a website has:
a password that is used for normal and everyday access (not security critical actions).
another password that is used for performing security ...
5
votes
3answers
125 views
Storing Credit Cards
Okay, so storing digitized credit card information/records is a well documented process when it comes to best practices. I recently got asked how a company can store, retrieve and process physical ...
-1
votes
1answer
68 views
Are there low-tech ways to reliably generate passwords? [duplicate]
Between the online services I use, and the number of machines and networks I need login credentials for, and how often some passwords need to be changed, I am faced with the choice of forgetting most ...
2
votes
1answer
45 views
How to implement canaries to prevent buffer overflows?
This is probably a very basic question. I've read about canaries, and how they work in theory. You have a global variable that you set to a random number in the prolog of a function, do your function, ...
-4
votes
1answer
43 views
Online POS terminal? [closed]
I need something like physical POS terminal but online, for offline credit card processing without needing CVV code on my site.
Does something like this exists?
-3
votes
2answers
143 views
Can the U.S. goverment crack encryption? [closed]
Does USA government have the sufficient processing power to crack keys in matter of seconds? Let say 2048-bit RSA, for example.
Since the RSA algorithm was developed by USA government (NSA?), I ...
-2
votes
0answers
45 views
Safe application hosting using LAMP [closed]
I have a Ubuntu Server with PHP, MySql/Postgres configured on it. I have a Symfony2 application, which looks something like this:
Symfony/
app/ (php app files)
src/ (php app files)
vendor/ ...
2
votes
1answer
85 views
Are very short messages secure using Public Key Encryption? [duplicate]
Say Alice publishes her public key and then disappears from public view.
Bob then needs to send a message to her that's either "OK" or ":(" so he takes her public key, encrypts his message and then ...
6
votes
2answers
845 views
Is there any way to get Chrome 27 to trust a self-signed cert? [closed]
I'm running latest gen Chrome (27) and preparing a demo that requires using a self-signed cert to support HTTPS on a local IIS website. The cert has been created with the correct common name for the ...
4
votes
2answers
83 views
Dual control / key encrypting key required?
I'm trying to get my head around 3.6.3 and 3.6.2 in the PCI-DSS standard, secure cryptographic key storage and distribution.
Would having two 256 bit key halves stored in separate, isolated ...
2
votes
3answers
84 views
Are there any customizable vulnerability notification services?
Are there any services (free or otherwise) that provide information on new vulnerabilities for a given piece of technology?
For example, say I want to be updated of all new Wordpress vulnerabilities ...
1
vote
1answer
75 views
Risks of Microsoft Remote Desktop access behind a secure VPN
This is mostly for my own education, but a scenario has came up at work that has me skeptical. I'd like for the security experts to tell me if this policy is overbearing or not.
I remote into a VPN ...
1
vote
1answer
91 views
How can I encrypt a textfile with gnupg? [closed]
It is easy to decrypt an encrypted textfile with:
gpg --decrypt /tmp/message
But how can I encrypt my own textfile?
3
votes
3answers
118 views
When changing a PGP passphrase, does it only affect the private key?
I am beginning to use GPG for email encryption. If I use
gpg --edit-key [keyID] to change the passphrase, what files will this affect? Will it only affect my private key, and thus I only need to ...
-12
votes
0answers
190 views
Someone from FB has been monitoring and manipulating my posts. [closed]
I feel that someone (an employee maybe) from FB has been monitoring and manipulating my posts. Some are my personal opinions about our gov't and certain gov't agencies. I am no threat to anyone ...
1
vote
2answers
62 views
Does CSRF work when the target site is not open on a tab?
This is an example attack scenario of OWASP for CSRF
The application allows a user to submit a state changing request that
does not include anything secret. For example:
...
