1
vote
0answers
9 views

Can ISP use MITM attack to “break” encrypted traffic?

Use connection of A and B as an example. Their communications were encrypted by Public Key Encryption. Before they exchange their public key, ISP MITM attacked. A got "B"'s public key (ISP generated) ...
0
votes
0answers
8 views

How can a keylogger gather & transmit data from a client-only webapp run from file?

For a client-side only webapp run from file, how can a keylogger gather data and then transmit it? In this scenario, please limit the scope to the client code only, that an attacker somehow has ...
1
vote
0answers
12 views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
0
votes
1answer
25 views

Why is the HTTP Server header not used by most servers, but the User agent used by most browsers? [on hold]

I've read that the Server header would disclose information, and that its use would be bad. The arguments made in that question also apply for the User agent header. So why is it still used, and not a ...
0
votes
1answer
23 views

How secure is user-mode Linux, in terms of protecting the host system?

Two questions about User-Mode Linux: Suppose that a privilege escalation attack is used to gain root in a UML guest. Assuming modern (3.0 or later) host and guest kernels, is it trivial to escape ...
0
votes
0answers
17 views

What is known about recent zero day flaw with Tails and what level of confidence can we put on Tails to be able to keep us anonymous?

Following is a excerpt from COMPUTERWORLD Yesterday, in talking about the zero-day vulnerability in Tails, Exodus Intelligence wrote: "We publicized the fact that we’ve discovered these ...
0
votes
1answer
17 views

Is server-side access control sufficient or should I encrypt querystrings

I've got an ASP Classic system that passes around sequential ids corresponding to keys in the database. I had gotten an encryption module (chilkat, an activex control) that I was using to encrypt and ...
1
vote
0answers
15 views

Do cell-phones exist with open source baseband processors?

In a recent question (can't seem to find now), someone asked: Is it possible to track a phone which is off? and received a response of Who's to say that it's really off? Your phone has both ...
0
votes
0answers
21 views

How to further analyze suspicious traffic

I've been monitoring my network traffic with Little Snitch, and today, when launching Chrome, just the default Chrome tab (shows most frequent sites), it alerted me Chrome was trying to connect over ...
0
votes
1answer
18 views

Google safe browsing vs traditional anti-malware scanners

What is the difference between using Google Safe Browsing and using other traditional anti-webmalware tools ? Which one is more efficient to protect against malicious web content ?
1
vote
1answer
22 views

Server + Client certificate vs Server certificate + Client password

There are three different ways how TLS (1.2) can be used: server and client authenticate, only the server authenticates or neither authenticates. If neither server nor client authenticates using a ...
18
votes
4answers
1k views

Can you prove that an open source program is running the same code that it claims to be?

So if a group has made open source software, and the source code is available on github, and is bundled with an executable in their main download, can it be proven that the executable is compiled from ...
0
votes
0answers
14 views

Export non-extractable private key from Keychain on OS X

I have a PKI certificate in Keychain Access.app on OS X 10.9, together with the private key. The manual page for /usr/bin/security indicates that there is a -x option for security import to specify ...
2
votes
1answer
39 views

security reviews of third party code

I am not familiar with all the steps involved in a full-fledged information security review of an in-house developed application, so I am wondering whether or not the following scenario is ...
0
votes
1answer
53 views

Spoofing public IPv4 address

How can I spoof my public IPv4 address to another without using proxys? I don't need any response, the TCP handshake needn't be completed! I just want to send a SYN packet with spoofed (specific) ...
0
votes
1answer
122 views

How were hackers able to alter the text of my pages without a form or querystring?

I maintain a small site that runs old-fashioned classic ASP pages with an Access backend. Recently, the site got hacked. The attacker managed to add a large quantity of code to the index.asp page. ...
0
votes
1answer
43 views

How can LastPass enforce 2-factor authentication

I've recently started using LastPass and one of the things you can set as a policy for you password vault is Prevent offline access when using Google Authenticator. The local cache can be ...
-1
votes
0answers
25 views

Basic Security tool in Python

I am new to python and scripting in general. Are there any recommendations on any basic security tool project I can start which tests both security and programming skills? For e.g. If I want to find ...
0
votes
2answers
28 views

How can I mitigate attacks that rely on poisoned data as a developer?

A few years ago, there was a high-profile attack on a Wired editor, where the hackers added a credit card to the target's amazon account, then used that self-added credit card to gain access to the ...
1
vote
1answer
36 views

Auth / Login token schema

According to this answer, a valid login token schema would consist of the username (U) the time of issuance (T) and secret key K owned by the server only The suggestion then is to concatenate the ...
-2
votes
1answer
40 views

Problem in downloading and browsing [on hold]

My downloads stop completing and some page in the browser appearing blank or with text only without css or js and so on, some program after complete return me a message when trying to start ...
23
votes
1answer
1k views

How does a SIM card prevent cloning?

I have read a few articles about SIM cards, stating that the chip inside them uses some cryptographic magic to prevent people from cloning your number. This to me seems borderline impossible, given ...
0
votes
1answer
27 views

What are JS malware techniques attacks?

Malicious JavaScript (generated by malicious hosted PHP code for example ) can lead to attacks. What are the types of attack that malicious javascript could perform ?
0
votes
1answer
35 views

Is it possible to distinguish between a SHA256 hash and an ecc256 key?

If an attacker were just given 256 bits, and they were either a SHA256 hash or a 256 bit elliptic curve key, would they be able to tell which one it is? Just out of curiosity, would they be able to ...
-1
votes
0answers
18 views

Convert hex MAC address to floating point [on hold]

How do I convert a MAC address to a floating point? I have tried to convert it to a decimal, but it gives me a long number, and I'm trying to get to a 3-digit number.
11
votes
1answer
231 views

Questions about the 2013 php.net malware

On October 24th, 2013, the admins of the famous php.net website said that their website delivered malware to its visitors using a drive-by download attacK. I have several questions about this malware, ...
0
votes
2answers
494 views

How to get MAC address via IP [on hold]

I have an IP address of a computer which I am currently away from, and I need the MAC address. How do I get the MAC address if I ony have the IP?
2
votes
2answers
43 views

Preventing a Computational DoS Attack in Public Key Cryptosystems

I'm designing a server which accepts anonymous messages using ECIES: as in, anonymous users send the server an ephemeral EC public key, and the server uses ECDH to derive a shared secret, and some KDF ...
-3
votes
0answers
13 views

Secure server not working with mac mail and microsoft outlook [on hold]

Secure server Now days we are getting lot of Domain advertisements on Facebook .Seeing those I took two domains on line after one month of follow up I can not configure it on my Microsoft outlook as ...
0
votes
0answers
59 views

Cracking a 6-character alphanumeric password Windows dialog box

To put this problem in context, I have a touch monitor screen whose firmware program is protected by a password. The firmware program is downloaded over RS232 via a Windows utility program provided ...
0
votes
1answer
30 views

Web site blocked by Windows defender and is marked as unsafe in IE

I posted this originally on Drupal Stack Exchange, and it was recommended that I try here for an answer. Here is the original question: Visiting my Drupal 7 site just now with IE 11, I get this ...
0
votes
1answer
30 views

Better way to store user authentication on phone app

We are creating an app and registration of user happens in following way. User sends via app: email-id/phone and username. Server sends a pin to enter in app via phone/email. User enters the pin in ...
1
vote
2answers
35 views

PyCrypto Possible To Check If File Already AES Encrypted?

import os, random, struct from Crypto.Cipher import AES def encrypt_file(key, in_filename, out_filename=None, chunksize=64*1024): """ Encrypts a file using AES (CBC mode) with the given ...
-1
votes
2answers
41 views

How to prevent accessing secure cross-domain data store

I have a client that needs to be able to secure a data site from hackers. This is the methodology we currently are looking at: server.com (web server) —> HTTP JSON API request —> dataStore.net (data ...
0
votes
1answer
61 views

How do SSL/TLS certificates work?

I'm trying to understand how SSL/TLS certificates work, but I'm missing something. I have obtained my current understanding from this website: ...
3
votes
3answers
590 views

Websites Forcing Weak Password Standards (Updated) [duplicate]

Please Note: I am not going to name the websites which have these horrible standards for their clients and users. I have had to change my passwords for my routine update just recently in the last ...
5
votes
2answers
285 views

Is it possible to ping a LAN card through its MAC address? [duplicate]

As you can start a PC through its 'WAKE ON LAN' feature on private networks, can you trace someone's online status through their MAC address over the internet ?
-1
votes
0answers
32 views

Outbound Traffic Blocked? [on hold]

I'm kind of new to networking. I'm working at a business that has solar panels installed on the roof. Recently, the solar reader has been unable to send data out on the network. There's a router ...
0
votes
1answer
25 views

Where is the TOTP secret key stored on client applications?

I'm new to concept of TOTP, but as I understand, 16-character base32-encoded shared secret is stored in the client application(for example Authy, FreeOTP)? This means that if I remove the application, ...
11
votes
3answers
2k views

Known characters in passwords?

I generate passwords for everything that requires security using the following method: ksoviero@ksoviero-Latitude-E7440:~$ head -c 16 /dev/urandom | base64 gorv/cp+lSiwiEfKck2dVg== 256^16 ...
4
votes
1answer
76 views

Is a Linux environment PCI compliant if the swap file is not encrypted and PANs are loaded into RAM?

Is a Linux environment PCI compliant if the swap partition/file is not encrypted and PANs are loaded into RAM by an application?
1
vote
2answers
66 views

Will a DDOS attack prevent outbound traffic?

Imagine a scenario where there is a DDOS attack against a target - clients would be unable to connect to the target, but I would like to know if the target could initiate a connection to the outside, ...
0
votes
1answer
58 views

Spying cellphones [on hold]

Today I read an article on a French newspaper that our government listens to us when we use our cell phones. I wonder what type of programming methodoly or technology that allows this espionnage ?
0
votes
1answer
78 views

So how much anonymity is effective? [on hold]

Is anonymity a real or metaphysical concept ? I mean, hackers use all sorts of softwares and methodologies to remain anonymous on internet but they end up by getting caught. So how much anonymity is ...
4
votes
3answers
37 views

Clearing/changing session id on logout

While reading through the newes OWASP ASVS standard (still beta) I have found a requirement V2.6 saying Verify that the session id is changed or cleared on logout. I do not see a clear point ...
3
votes
3answers
584 views

Is JavaScript malware as dangerous as native viruses? [on hold]

Can JavaScript malware be as dangerous and damaging as more traditional viruses that are programmed mostly in native APIs?
0
votes
1answer
41 views

A folder lock/encryption program that can do this? [on hold]

I am looking for a program that can lock or encrypt folder, but in case if my laptop is stolen and C drive is reformatted and reinstalled, and i have locked folders on D drive, these folders to remain ...
2
votes
0answers
30 views

Security concept for Android app with PHP based REST API

I'm trying to build my own PHP based REST Api for my Android app and I'm a litte bit confused by all the different user authentication stuff one can find on the internet. So I want to present my ...
2
votes
4answers
128 views

Does it take longer to brute force a password starting with z than one starting with a?

I was wondering about the following: If someone tries to get my password with Brute Force, will a password starting with "a" guessed faster than one starting with "z" ? In this case assume the ...
-1
votes
0answers
45 views

system Idle process in windows [on hold]

I was looking at core system process in windows 7 through process explorer when i came by system idle process,this process captured my attention as it has no image so i thought i should research on ...

15 30 50 per page