1
vote
1answer
6 views

Is it possible to keep your harddrive data safe from being copied and recovered

One of my friend challenged me that if my laptop is turned on then he can attach a device to it, just like in movies which will copy all data of my computer to his hard drive without touching a single ...
0
votes
0answers
3 views

Firewall init script

On Debian, what is the best way to start an iptables firewall script : /etc/init.d/firewall_script.sh in /etc/network/interfaces, add post-up /etc/network/if-up.d/firewall_script.sh Do you check ...
0
votes
0answers
6 views

Long term HDD storage solution

I have some HDDs which are encrypted to what I think is a decent standard. I want to lock these away in a remote storage facility, but am a little worried about EMP/Magnetic stuff from wiping the ...
0
votes
0answers
3 views

What are the alternatives to ECDSA for an authentication protocol?

In an authentication protocol, S has a public/private key pair known to C, and S and C have established a secure channel (for example, using DH or ECDH, or any other key exchange protocol). C wishes ...
0
votes
1answer
35 views

How to generate an unpredictable but short string?

I want to built some short urls for uploaded files and links on my own server. Simple enough, I upload files and my script returns me a link. On access, the link is translated to the file and download ...
0
votes
0answers
7 views

Reg - Ipsec Tunnel Establishment

I am planning to setup the Ipsec tunnel between single server( Example: server1) and two security gateway( seg1 and seg2).The setup should be like this server1 -----ipsec tunnel1-------->seg1 ...
0
votes
1answer
16 views

Can benign software modify Widnows DLL files?

On Windows (XP, 7, 8, NT ...): can .dll files be modified (in any manner) by benign programs/software already installed/running on the computer ?
3
votes
1answer
31 views

How is YouTube able to identify anonymous users?

A few days ago I was searching YouTube and I noticed an "outlier" video poped up in the suggestions list. This video had nothing to do with the topic being searched, but instead it was based on a ...
-1
votes
1answer
19 views

What registry windows keys malware target often?

I wonder what are the main registry windows keys malware target often ? I would love to code a program that will check the state of those windows registry keys for eventual modifications by malware.
6
votes
2answers
532 views

Should I get an antivirus for my Mac?

There lots some people saying that people should use an antivirus software on Mac. And there are thousands of people claiming that Macs don't get viruses (under this term I mean spyware / malware as ...
14
votes
6answers
1k views

Is “the oft-cited XKCD scheme […] no longer good advice”?

I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead. Modern password crackers combine different words from their ...
0
votes
2answers
39 views

Does using unicode or (at) actually stop spambots?

I want to make my email address available on my website and I was wondering if there was any point in using the "(at) (dot)" convention these days. If I was writing a script to trawl for email ...
0
votes
0answers
31 views

Is it possible to be using a public WiFi hotspot and be hacked from somebody who is not within WiFi frequency range?

I frequent a library in a semi-rural town, specifically because I figure citizens of that particular library possess neither the knowledge nor the inclination to hack another person's pc. I've used ...
3
votes
0answers
25 views

Security Risks of BD+

I have recently been reading about the DRM measures on commercial bluray disks, in particular BD+. It seems that this technology involves Java software running in a virtual machine, with full access ...
1
vote
1answer
22 views

Security of linux shred utility

If I am trying to destroy a single file, what is the best method? shred -uvz -n500 file dd if=/dev/null of=file dd if=/dev/zero of=file I hexdumped a file that was in the middle of shredding, and it ...
0
votes
0answers
38 views

Stealing internet connection [on hold]

Is it possible to steal internet connection. I don't mean hacking WiFi password, rather that is it possible to configure router to use another IP address provided by another ISP. If I get all ...
1
vote
0answers
42 views

How common are mitm attacks behind an ISP?

Yes. Of course using https everywhere is best. But sometimes that's not an option. In those cases, I'd like to make an informed decision. Is there any information about their prevalence? Or would that ...
0
votes
1answer
29 views

What should you do when you notice weird traffic?

I'm not at this point yet, thankfully, but being prepared means knowing the answer before the issue arises, so here goes... You're looking through your firewall / website logs... And you notice a ...
12
votes
2answers
766 views

Should I disable http HEAD requests?

I have seen increased 'HEAD' requests in my webserver access.log. What are these requests for? Should I disable this method in my webserver configs?
2
votes
1answer
18 views

How do I customize /proc permissions?

So that: Only process owners, and root, can access information about their processes, Or, at the very least, cmdline permissions are only readable by root, and My system (CentOS 6.x) still runs ...
-1
votes
0answers
54 views

credit card number search software for Linux and Windows [on hold]

Can anyone recommend free software that will search all the systems files for credit card numbers? The software should produce a log output of the result. I need one to work on Linux and ideally also ...
0
votes
2answers
66 views

How much I can depend on TOR to protect my identity, especially from outlook.com

guys I am using Tor browser from some time, few weeks maybe and I am still trying to determine the level of anonymity that the browser gives. I am using the browser to advertise a service that I am ...
-1
votes
4answers
79 views

Software for web hacking? [on hold]

I want to learn sql injection, xss and other web attacks. I am new to all this, just a beginner. I want to know which software to use. Can I use Windows for these attacks ...
2
votes
1answer
73 views

Is it possible to use bitcoin miners to decrypt files/communication?

My understanding is that miners solve complex algorithms (sha256 i believe) and receive bitcoins. With the amount of hash power all these pools get from miners couldn't they use the resources to ...
3
votes
2answers
73 views

how to scan a web application that uses Captcha

I have a web application I am doing a security assessment on and it uses captcha for both the login and for certain operations inside the app. The interesting thing is that this particular app ...
2
votes
2answers
28 views

PGP/GPG verifying authenticity

My apologies in advance if this is the wrong section to post in or if this question has been asked before. I'll try to keep this as short as I can. My boss recently implemented a new security system ...
0
votes
1answer
34 views

Making it harder to scan on-screen QR-code from a distance

Say I have a QR-code on my laptop screen that I need to scan with my mobile device. Is there anything that can be done to make the on-screen code harder to scan from a distance? I am thinking for ...
0
votes
0answers
17 views

Encrypting a key with a KEK using Thales HSM [on hold]

I need to encrypt & decrypt a key with a defined KEK on Thales HSM. I have the Host Command document but I couldn't find the appropriate command. Which command should I use?
0
votes
1answer
48 views

What is the best way to protect an encryption key? [duplicate]

I am using few secret keys to encrypt sensible date. What is the best way/place to protect the keys ? In a file located on my server ? Within the SGBG databse itself ? Or ... ?
0
votes
1answer
24 views

Steps to create user authentication system between mobile and server

First time doing a secure login from a mobile app to a server (built in java). I want to understand if I got this right. Login in for the first time: 1. On the mobile device hardcode a security ...
0
votes
0answers
24 views

Unable to get rid of Fake.Adobe.zusy [on hold]

Spybot Search & Destroy recognized this trojan, but wasn't able to delete it, because as it said "files are being used". It proposed to fix it at system startup but eventually Spybot didn't show ...
0
votes
0answers
20 views

How to config Squid SSL bump to let Paloalto PA series firewall recognize App-ID

A Paloalto firewall(PA-2050,POS 4.1x) was capable of recognizing the websites which users are visiting(thru http/https) then flag them with a App-ID and apply application control on the traffic, for ...
0
votes
1answer
28 views

Windows and BlackBerry device for learning penetration testing [on hold]

I want to buy a Windows Phone 8 and a Blackberry (BB) device for practicing penetration testing of mobile applications (of course, Windows and BB apps). I am asking for appropriate devices. I don't ...
1
vote
2answers
67 views

Must login and logout action have CSRF protection?

I am making a web application in Django which generates and includes CSRF tokens for sessions (a Django session can be anonymous or a registered user). Should I keep CSRF protection to the controllers ...
0
votes
1answer
43 views

URL Rewriting vulnerability

We modified our Session handling from cookie based to URL Rewriting. By doing this the session id gets transmitted as part of the URL. Now there is a vulnerability issue, where whoever uses this URL ...
2
votes
1answer
60 views

How long does it take for Google to detect click fraud and suspend an AdSense account?

Click farms can be hired to boost ad revenue. http://www.security-faqs.com/what-is-a-click-farm.html The click farm is made up of armies of low paid workers who’s job is to click on links, surf ...
3
votes
1answer
58 views

Is it possible to find out what a remote user is trying to do connecting to a closed port?

From my iptables log, I can observe a particular remote IP address trying to connect to my server from port 80 to a private port number: Jul 09 01:24:41 example.com kernel: IPTABLES: IN=eth1 ...
0
votes
2answers
26 views

how to block ip from head or ping or get or post to webserver (using apache and windows)?

am using apache 2.4.9 latest with windows 7 i am using some modules like limitipconn_module security2_module but using wireshark i get unlimited request to busy my webserver (DOS) from some ip ...
0
votes
1answer
39 views

A few GPG questions

Since I am new to encryption and have recently been losing stuff, I decided to start a file that contains some passwords for online accounts and whatnot, encrypt it, back it up (and keep a single copy ...
2
votes
1answer
56 views

Why shouldn't I sign my email newsletter using an s/mime email certificate?

I currently offer email subscriptions on my blog, something I coded myself in PHP. People sign up on the blog using their email address. I send them an email with a link to verify their email address ...
0
votes
2answers
93 views

Store a file on a harddisk without root having access to it

Is there a way to store a file on a disk as a user so that even the root user has no access to it? I tried EncFS but that is no solution because the root user can switch to every user, so he/she can ...
1
vote
1answer
17 views

Export a folder from KeepassX [on hold]

Is it possible to unencrypted export a folder in KeepassX? I would like to share a part of my KeepassX database with a collegue but I have all of the needed passwords in separate entries in KeepassX
0
votes
1answer
25 views

How to encode a username in PKIX certificate?

I was reading through RFC 5280, PKIX Certificate and CRL Profile, Section 4.2.1.6, Subject Alternative Name: The subject alternative name extension allows identities to be bound to the subject ...
0
votes
1answer
74 views

Is a firewall an access control list?

I want to know if a firewall is considered an access control list (ACL). I know there are other types of ACLs, but am specifically interested in knowing if a firewall is an ACL. Edit: It appears ...
0
votes
1answer
25 views

Does ASP.NET guarantee the integrity of a page's controls on a post back?

Say you have an ASP.NET page that lists the prices for certain items in labels. I know it's cringe-worthy, but say you took the price of the item from the label on the page to determine what the user ...
-1
votes
1answer
43 views

How should privileged accounts be secured in both Linux and Windows?

I have recently started work in application security at a mid-sized firm, having transitioned away from 5+ years in security consulting (pentesting, etc). One of the biggest challenges I see here from ...
1
vote
1answer
79 views

Why do sandboxing environments not rely on antivirus programs?

Since years ago, miscreants use JavaScript to craft web malware attacks such as drive-by download attack that is used for example to install the famous CoolWebSearch virus. There are static methods ...
-1
votes
1answer
38 views

Bluetooth penetration testing

I need to do some testing on boxed devices, incidentally having Bluetooth interface. I am quite sure that there are problems in the implementation, at least there must be given how the architecture ...
1
vote
2answers
60 views

My certificate seems fine but my TLS fails (Cert not validated)

I set up my certificate for my mail server at https://mail.travelstreamer.com/ I exported my certificate as described in my mail servers documentation and pointed to it in the server settings. The ...
0
votes
0answers
20 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...

15 30 50 per page