0
votes
0answers
2 views

Defenses other than firewall and antivirus?

Besides firewalls and antivirus, what other steps can be taken to harden a home computer? My certified security expert of a coworker says that antivirus can be assumed to fail as a means of defense ...
-2
votes
0answers
7 views

Sample Security Plan- Microsoft Exchange

I have found several system security plan templates but I am looking for examples that are complete and filled out. I am ideally looking for one for Microsoft Exchange but I am okay with any.
1
vote
0answers
12 views

Which is more secure - a VPN, a proxy-server, Tor, etc.? And why so, exactly?

I want to know how to ensure the most complete anonymity when browsing the internet and connecting to remote servers: I want to be as anonymous and secret as possible. I don't know exactly how VPNs ...
0
votes
0answers
14 views

Understanding the order by clause used in SQL Injections

I am trying to enumerate a database, created specifically for the purpose of learning SQL injections. I am trying to discover the number of columns a particular select statement might be using. I do ...
2
votes
1answer
18 views

Can someone launch a DOS attack on my IP

Suppose, I have a static IP on my PC and is known to others. None of my softwares listen for remote connection. Is it still possible for someone to DOS attack me in such cases? If yes, how it is ...
0
votes
1answer
12 views

Could a network host and process programs while securing against piracy?

Consider an ideal service hosting network, which: Lets programmers: Publish a program in such a way that it can't be retrieved. Associate a program with a wallet. Specify a cost per request and ...
3
votes
2answers
27 views

Crypto software: overwrite sensitive buffer

Is it common to implement crypto software in such a way that sensitive buffers are overwritten before free'ing memory? For example when they contain a private key or the plaintext message.
0
votes
0answers
8 views

Assymetric encryption in php

Can one do asymmetric encryption in php using php_encrypt() and php_decrypt(), using the public and private keys respectively as the key? Would it work? I prefer this to openssl_public_encrypt() and ...
0
votes
1answer
12 views

Does Google 2-step verification protect user from session hijacking?

After signing in Google 2-Step verification scenario, user should enter verification code which sends to his mobile. Without it, he couldn't access to Gmail account. Consider an attacker does session ...
2
votes
2answers
48 views

Does my brokerage/bank use poor password security measures?

I'm no expert. Could someone please tell me if I'm overreacting? After the Heartbleed news broke, I changed a lot of passwords. Here's what I discovered when changing the password on my all-in-one ...
0
votes
1answer
52 views

“No hack no fee” pen-testing agreements [on hold]

A common theme in security engineering is that perfect security is impossible (or at least highly unlikely). Consider Johnston's Infinity Maxim: There are an unlimited number of security ...
0
votes
0answers
26 views

What makes iOS more secure than other phone OS

Let's start off with an example. Here in Canada, credit card companies cannot upgrade you credit card limit. You need to make a request, that will then get analyzed and then, depending on your status ...
0
votes
1answer
23 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
1
vote
3answers
56 views

Robots.txt and admin areas

I'm using some popular commercial forum software and to help secure the admin area more I have changed the name of the admin folder; however I was wondering, with regards to robots.txt if I go ahead ...
2
votes
1answer
23 views

SmartCard for private keys - personal usage

I've just found my notebook has a SmartCard reader. Would it be wise/possible/practical to buy a single SmartCard, transfer my private key on that (somehow), and use it as my primary private key ...
0
votes
1answer
32 views

Forensics in the cloud

I recently did a university module on digital forensics and learned a lot about the process, and techniques, of digital forensics investigations. We didn't actually cover the cloud although I ...
-1
votes
0answers
16 views

Merging two dmains ( active directory server)

I've a requirement of merging two domains. Our domain will be merged with a other domain.This work will be done by AD team.From security point of view what are the points I need to be bothered about ...
9
votes
5answers
335 views

How to get top management support for security projects?

I am facing an issue regarding security projects, for example: last year we bought an antivirus licence for 500 (end point security), and made a policy in order to force everyone to install it, ...
0
votes
0answers
26 views

Are Images/Videos sent through WhatsApp stoed on the server for too long? If yes, are they secure [on hold]

The WhatsApp privacy policy states that messages once delivered are deleted from the server forever. But in case of "files"(I'm assuming them to be attachments like images and videos) it says and I ...
1
vote
1answer
57 views

Is wiping memory at code/end good practise?

Sometimes passwords/hash/keys & other private information is stored in variables and hence in memory/RAM during code execution. while some situations (i.e. Linux Kernels see here Is there any ...
2
votes
1answer
22 views

IKEv2: Why is it important “that each side sign the other side's nonce”

I am currently diging deep into the IKEv2 protocol. In the description of the Authentication (RFC5996, p. 48), the following statement is given: "It is critical to the security of the exchange that ...
-1
votes
1answer
34 views

Spyware for feature phones

There are a lot of spywares for android and ios smartphones. Are there spywares for feature phones ? I am using this samsung phone, which is basic. I am wondering if somebody who has access to this ...
12
votes
5answers
863 views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole ? ...
1
vote
2answers
45 views

Does having a seperate e-mail account only for security, increase security?

In this article about increasing the security of lastpass the author suggests For additional security, you can have LastPass send security-related emails to a special security email address ...
0
votes
0answers
27 views

URL filtering , issues with URL

I am working on a URL filtering project . I have a database given to me which contain URLs need to be blocked (eg: a.b.com/d/e). I get uri and domain from http request. I compare what I get with my ...
0
votes
0answers
73 views

Security jobs that suit disabled workers [on hold]

I was in a bad accident which has left me with some severe limitations in how I can work. Due to my disabilities I will only be able to work from my home. I understand that this is a very unique ...
-1
votes
0answers
21 views

Filtering of incoming and outgoing packets in a firewall

In general, egress http packets should be allowed to pass through the firewalls. Ingress http packets, however, should go through firewall inspections. Suppose the Web server is placed in DMZ. If an ...
1
vote
0answers
24 views

Securely calculating encoding efficiency

I have a rather odd security requirement that I must keep the amount of potentially encoded information in a record under 250 bytes*. That's not a lot of data, so I was thinking of calculating the ...
3
votes
2answers
58 views

Letting users pick up where they left off…without logging in (is this bad form?)

I have a Grails app I'm working on that allows users to fill out a fairly lengthy application form. One of the requirements I've been given is to NOT require users to log in or create any sort of ...
1
vote
2answers
137 views

Google Accessed My MSN Account!

I just received a notification from Microsoft that my Microsoft account has been blocked because it's been accessed by an IP address that's never accessed it before. I received this notification as a ...
0
votes
0answers
60 views

What major vulnerabilities have there been to TLS libraries? [on hold]

I'm trying to compile a list of large security vulnerabilities in TLS (and SSL) libraries. Examples of things I'm looking for are: Heartbleed Goto fail The Firefox/NSS PKCS11 (IIRC) parsing bug
0
votes
0answers
15 views

DTLS CertificateVerify doubt

In DTLS 1.2 RFC 6347, section 4.2.6: CertificateVerify and Finished messages have the same format as in TLS. Hash calculations include entire handshake messages, including DTLS-specific fields: ...
1
vote
1answer
97 views

What should I do when I need to store passwords for usage in 3rd party softwrae?

I have a desktop WPF application which authenticates with Dynamics CRM 2011. I ask for the username and password of the user and use them to connect to Dynamics CRM 2011 using ...
1
vote
1answer
32 views

Can you export a report from OWASP Zap based off a individual website?

I have a list of 30 websites I have scanned. I need to pull out a report for each individual website. Is it possible to do? Right now I am just running a report and getting the results for all 30 and ...
2
votes
1answer
32 views

Is the following code seeding OpenSSL's PRNG necessary, superfluous, or harmful?

As I was going through Crypt::SSLeay, preparing it for the next release, I noticed the following code, written way before my time, ... int rand_bytes_read; static int bNotFirstTime; char buf[ 1024 ...
3
votes
2answers
45 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
1
vote
0answers
23 views

Ruby OpenSSL vs Linux openssl

I have a difficulty reconciling Ruby's OpenSSL library with the standard Linux command line openssl. What I'm trying to do here is encrypt the string mysecretstring with the password foobar but first ...
-4
votes
1answer
52 views

Most secure SSH server [on hold]

Which SSH server (compatible with Debian Wheezy) has the fewest (if any) exploitable security bugs?
2
votes
1answer
19 views

OpenVPN seamless migration from 1024-bit RSA to 2048-bit RSA keys

The company I work for has a few OpenVPN servers used by over 200 employees. The servers were deployed a few years ago using the default easyrsa settings and now we want to upgrade to stronger ...
0
votes
2answers
51 views

Check if i'm using a filtered network [on hold]

I would like to know if the connection in my office is filtered, because i cannot access Faceboook neither Youtube but i can access google with no problems, but Tor i can access all the websites. i ...
0
votes
1answer
28 views

Is it good idea to rely on Mifare UID for security/authorization reasons?

Some of you may know that nowadays I think you can purchase chinese cards, where you can write any UID you want, hence emulating the UID of a legitimate Mifare (e.g., Classic) card. My question is: ...
-1
votes
1answer
35 views

Use SSH config file with Putty [on hold]

I'm using SourceTree (a Git GUI) which uses PuTTY as SSH client. I need to push some code into a repository for which I need to tunnel through SSH to do so. The trouble is, the repository and SSH ...
0
votes
0answers
35 views

Reverse proxy and corporate PKI

Here at OU=PKI we've been requested to issue a certificate with CA capabilities to install it in our reverse proxy, so that it could issue trustable certificates for every single web. (SSL ending) ...
0
votes
1answer
44 views

Increase hydra brute force login attempts

I have recently came to know about hydra and i am playing with it using brute force. The number of login attempts are almost 10 attempts / second, I am trying with my password, so if my password ...
-1
votes
0answers
24 views

How can i access in host file whiles using a proxy server [migrated]

I using a proxy server (Freegate to be specific). I an unable to access the connections (dns mappings) that i have set in my host file. That is i want to access "127.0.0.1 YourInstanceName" whiles ...
1
vote
1answer
37 views

Understanding the details of SPI in IKE and IPsec

I'm currently learning IKE and IPsec for an exam. I have a lot of information on how Security Parameter Indexes (SPI) are used in both protocols, but I'm having some problems figuring out the ...
0
votes
0answers
30 views

How to install Metasploit on Mavericks + MacPorts?

I would like to install Metasploit on an hardened OS. For this purpose I chose Mavericks just because I'm able to harden this OS pretty far. I would like to install Metasploit with MacPorts because ...
0
votes
2answers
29 views

How to avoid session sharing inside the same network

I was thinking about a situation to avoid session sharing or hijacking, validating the IP the user logged in against the ip that is accessing any page after log in. It was working until I figured it's ...
-2
votes
1answer
42 views

Personal details and last 4 digits of credit card [on hold]

Recently, I was asked by a car rental agency in Los Angeles to provide the following personal details, to secure a car rental: Full name Date of birth Address Driver's license number Passport number ...
1
vote
2answers
55 views

Is hashing a DLL useful to protect from DLL hijacking?

I want to make sure that the dynamic link libraries used by my application can't be replaced with other libraries of the same name, in order to inject malicious code. Therefore, I thought about ...

15 30 50 per page