0
votes
1answer
14 views

How real is the threat of MITM when you have your own network

I never understood why I have to worry about MITM when I am at home connected to my simple WiFiless modem using an Ethernet cable. I can tell how serious the threat is when you are in an Internet ...
-1
votes
0answers
9 views

Which encryption technique should be used for users name and passwords in my notebook

i writing all my passwords and users names on my notebook emails,amazons,facebook. and i have really Nosy little's brothers that will probably look at my notebook when i am not around, which ...
0
votes
0answers
13 views

Are SSH keys and PGP keys the same thing?

I have a 3072 bit RSA key that I generated for use with SSH. Can this key-pair be used with PGP/GPG, or do I need to generate a new pair of keys separately for use in email encryption? Are the two ...
2
votes
1answer
19 views

What security risks do you face when connecting to a server via RDP?

What security risks do you face when connecting to an (possibly foreign) RDP server? Opening an unsigned RDP file triggers the following warning: RDP is a one way street, right?
-1
votes
0answers
15 views

Risk in allowing arbitrary fields to enter my database and API?

What security concerns do I need to be aware of if I allow arbitrary fields to enter my database and API? Examplis gratias scenario: POST /api/create-endpoint -d '{"endpoint": "/profile", ...
-2
votes
0answers
19 views

What type of encoding/encryption is this?

Im new to encoding and this realm, and I know this is not Base64. Could anyone tell me what this is? ·H AGHü§“-GYÖÍ=cp:S´’u@Ô∂ıAº¨¿mÇ…VÙ®ù¯˘JÂK‚“][ÿ ∞4‹ ...
0
votes
0answers
20 views

Application Development: How many legislation acts are there to follow?

When creating a application which uses a number of technologies the legislation becomes harder to track. I have a application which uses machine-to-machine technologies. The application stores user ...
-1
votes
1answer
37 views

Anonymity with TOR in wifi connection (student house)

I just moved in a student flat where several students are using the same wifi connection. A few days ago the internet was very slow and a guy (son of the owner) came in to ask if I was downloading. He ...
1
vote
2answers
47 views

Which encryption technique should be used for cloud computing data transfer?

I want to setup my application for cloud computing for Software as a Service. There is going to be a lot of data transfer between my server and client, to and fro. The technique I have envisaged is: ...
1
vote
2answers
32 views

How secure are SSL client certificate authentications?

As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web ...
5
votes
1answer
41 views

What are the risks of accepting URL param for automatic redirection?

Can anybody name all the risks of the following scenario: User visits a page, but his session is expired, so he is auto-redirected to login page with his previous page and params added as a single ...
2
votes
0answers
27 views

Is there a way to identify the location of a person trying to intrude your wifi network? my wifi router is picking up his attempts

Aug 30 20:28:09 dropbear[6799]: Child connection from ::ffff:5.10.69.82:38463 Aug 30 20:28:11 dropbear[6799]: login attempt for nonexistent user from ::ffff:5.10.69.82:38463 Aug 30 20:28:12 ...
1
vote
2answers
34 views

What to do about ssh breakin attempts

Our system used to get bombarded by bots trying to login to the ssh client on the standard port. After switching to another port number the failed login attempts basically stopped completely. ...
2
votes
1answer
38 views

Why do so many cracking attempts originate from China?

I recently put a Linux server online and it didn't take long until I had the first attempts to brute-force the SSH login. It's not that I am worried about that - I trust the security of my server. But ...
0
votes
0answers
21 views

Virus/Malware: Force Java Download

I have two separate pieces of security software that run regularly - Webroot and Microsoft Security Essentials, and even though neither of these have detected anything is wrong with my computer, every ...
1
vote
2answers
50 views

Can attackers be traced if they used public WiFi

I always thought it's possible to track attackers unless they try to hide their identities using some form of "physical" disguise. No matter how many proxies you use even TOR seems to be traceable by ...
0
votes
2answers
39 views

Does Non Repudiation offer proof of receipt ?

I understand that non repudiation intends to provide a mechanism that reliably proves that the sender of a message cannot deny sending the message. But does it also provide similar mechanisms to ...
4
votes
3answers
82 views

How secure is this method to remember security questions?

So I found an interesting method of remembering those pesky security questions. Basically, the guy takes a hash of the question (IE what is your mother's maiden name?) and then appends his own ...
0
votes
1answer
34 views

Problem with OpenSSL rejecting CA possibly due to 12 digit Serial No

I work as a tester at a VoIP software company. We've been running into a problem with using TLS to communicate with certain phones. The phones are from different manufacturers but both exhibit the ...
1
vote
2answers
65 views

Does WPA2 Enterprise protect against evasdropping from within the network?

At home, I have a simple ISP supplied router where I have set up a WPA2-PSK wireless network for our laptops and other devices. While I played around with Wireshark, I noticed that I could use my ...
2
votes
3answers
82 views

Which one to ask first in multi-factor authentication?

Let's say I have a system which use something you know, like a password, and something you have, like a code sent to a cell phone, to authenticate. Is there a preferred order to ask for the password ...
1
vote
1answer
47 views

Getting null byte injection attacks to work with PHP 5.2.17

I'm trying to understand how null byte injection attacks in PHP code used to work before it was patched in PHP 5.3.4. I have this sample HTML page that is a somewhat modified version of what's shown ...
1
vote
2answers
30 views

How to Secure Exchange 2010 cookie?

We have received the below finding from an IT audit. Missing Secure Attribute in Encrypted Session(SSL) Cookie: It is best business practice that any cookies that sent over (Set-cookie) an ...
0
votes
0answers
37 views

How to use Truecrypt AES keys to decrypt a Truecrypt volume

I am performing a forensics experiment. I have access to a '.mem' memory dump and I am successful in extracting 2 AES keys from the dump. Now I wish to use these AES keys to decrypt a volume encrypted ...
1
vote
1answer
64 views

Shared Key vs Pre-Shared Key

Does Shared key and Pre-shared key mean different thing ? Currently reading Text , Security+ Guide to Network Security Fundamentals.
13
votes
5answers
2k views

Why should I sign data that's already encrypted?

My question is about the difference between signing and encrypting. Why would you still sign something if you are already going to PKI encrypt it? Doesn't the PKI encryption inherently provide ...
4
votes
1answer
107 views

How safe can connecting to VPN really be?

I would like to make this story as short as possible since my question is not that long, I have worked with journalists previously in war zone where we investigated the involvement of EU IT companies ...
2
votes
2answers
80 views

Does a VPN hide what URLs I visit?

It's clear that someone listening on a network could still find out what website I visit over HTTPS (as discussed here) but what about when surfing in a VPN? What exactly can the underlying network ...
-2
votes
0answers
26 views

Others solutions to enumerate vhost for an IP instead of bing [on hold]

I was using bing to enumerate every vhost entry for a given IP: ip:AA.BB.CC.DD But recent tests do not work, bing seems ti have switched off the funcionnality. What are the (reliable) ways to have ...
0
votes
0answers
18 views

Tool that can only find directory listing vulnerability

Is there are command line tool or online site that checks only the web server directory listing. In nikto there is no specific switch to find out this vulnerability. There are multiple online sites ...
-2
votes
0answers
14 views

.pfx certificate on iphone app on .cer form [on hold]

I am developing an iPhone app, i need to connect to a web service using a certificate, I have a .pfx certificate that I changed into a .cer because the ios system wont work with a pfx on the app ...
3
votes
3answers
177 views

Can firewalls get affected by the traffic they process

Does such attack exist? Forgive my wild imagination but is it possible for a hacker to pretend/try to communicate with a service on the server and when the firewall examines the traffic it get's ...
-1
votes
1answer
22 views

DOM XSS issue in code [on hold]

Is this DOM vulnerable to XSS attacks? var theForm = document.forms['aspnetForm']; if (!theForm) { theForm = document.aspnetForm; } function __doPostBack(eventTarget, eventArgument) { if ...
-3
votes
0answers
15 views

PKCS11 Module problem with hp [on hold]

I am having a weird problem. We have a Java PKCS11 signing application which is used by thousands of users without problem. But, for our HP users, after few signings it doesn't initialise and java ...
26
votes
4answers
2k views

What is the point in having arbitrary username requirements?

I've looked around on Security.SE, but couldn't find much related to the following problem: I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
0
votes
0answers
40 views

CA Flag in SSL certificate [migrated]

I have an web portal running as a POC purpose, and then i have a mobile apps to access this web portal. Since it's a POC, I just generate a self-signed SSL cert and load it inside the Web and my ...
1
vote
1answer
38 views

Early ChangeCipherSpec Attack

For the early ChangeCipherSpec attack, the attack would affect client with all version of OpenSSL and server with OpenSSL version 1.0.1 and above. My question: If two mail servers are communicating ...
3
votes
2answers
178 views

Why do the banks all use weaker TLS suites? [on hold]

I've been checking out various TLS certificates lately and noticed that most of the banks seem to have the following two issues: 1) They do not offer perfect forward secrecy 2) They are still using ...
17
votes
9answers
3k views

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...
2
votes
1answer
81 views

How can I protect my “try it with one click” service?

I have a service with "try it now" experience that currently offers a "one click" effort. This service has a pool of N resources (lets say 50). Each new resource takes about 1 hour to generate. ...
1
vote
1answer
44 views

How to convert SSL Certificate for mobile app?

I am in the current process of renewing my SSL cert for my website. I also have a mobile app for my site. I want to use the same cert from my website in my mobile app. How can I do this? Thanks - I ...
6
votes
1answer
449 views

What is “c/s” in context of hash cracking?

I was reading hashcat's About page, and the stats are listed in terms of c/s....is that "Cracks per seconds"....the 'c' part seems wrong, I'm just guessing. What is 'c'?
0
votes
1answer
59 views

Is running a TOR node from device in home network secure?

I want to run a TOR node using a small ARM device mini server. I already have a good firewall set but feel a bit uncomfortable when giving away my IP address to the open web by opening a port. If I ...
9
votes
4answers
877 views

Can ISP block HTTPS selectively? [duplicate]

Can ISP block HTTPS selectively i.e. certain websites cannot be accessed using HTTPS while others can be ?
0
votes
0answers
27 views

TOR security if ISP blocks TLS channel?

If ISP blocks TLS channel while a user is using TOR, can he read the TOR traffic, since TOR uses TLS encryption ?
1
vote
2answers
58 views

How to secure a web service for web applications using same database?

I have 2 or more web applications that need to be able to communicate together using a web service interface. Information All applications are using TLS/SSL (https) All applications have access to ...
-1
votes
1answer
133 views

Does microwaving a CD erase it?

I just read the question: Does microwaving a hard drive erase it? and now I am curious too... does microwaving a CD (or for that matter, DVD, or blu-ray) erase it? My initial thought is that some ...
1
vote
1answer
99 views

Does microwaving a hard drive erase it?

Kind of a silly question, but I'm genuinely curious: (in part because I recently saw several questions that refer to "nuking" a hard drive...) what would a microwave DO to an HDD? Would it erase data ...
0
votes
0answers
27 views

IDS/IPS for Ubuntu Server [on hold]

I have Ubuntu Server VPS. I tried CSF firewall but it couldn't block even a simple port scanning command (nmap myserver_IP). I tried psad and I got tons of email from Google DNS servers which it was ...
0
votes
1answer
53 views

Good way to make a secure token for logged out users

I work for a firm that has a marketplace on the web. We want to make a link with a token that stops an ad on the marketplace without the user being logged in. Someone suggested that we make a token ...

15 30 50 per page