0
votes
0answers
1 view

Is there a security risk in using pointers instead of struct instances?

Recently during a code review, a senior developer asked me to replace a pointer with structure instance in a utility method. He asked me to do so for security purpose. One reason that I could think of ...
0
votes
0answers
4 views

i am investigating the physical access control system weakness

physical access control system -> Biometrics, RFID system i am investigating the physical access control system weakness. i need a newspaper article that a malicious person enter the ...
0
votes
0answers
5 views

What are some metrics to be used to evaluate SaaS security?

Some examples: static code analysis (Fortify) code coverage (bugs being a potential source of vulnerabilities) others?
1
vote
0answers
5 views

How to rank the security strength of a cloud SaaS app

If my manager asked me to rank how secure/vulnerable our SaaS system is, what methods are available to do so? I know there are certifications available but I'm looking for something which can be ...
0
votes
0answers
12 views

How to securley delete full vm

We have a virtual machine on VMware Workstation 11, with guest OS Windows 7. The vm is now encrypted (using Workstation) but wasn’t always. The vm has confidential information on it and as we no ...
1
vote
1answer
30 views

Virus/Trojan attached to GnuPG encrypted file

Is it possible to infect a file encrypted using GnuPG? For example, if I had an encrypted file on an unsecured public ftp server, would someone be able to copy that file and attach a virus/trojan ...
0
votes
1answer
45 views

Why Firefox won't accept my certificate?

I've been trying to get stunnel with my signed certificate (with CA that I've trusted it in Firefox) The error is: 127.0.0.1:5559 uses an invalid security certificate. The certificate is only valid ...
-5
votes
2answers
33 views

Noob to tor/tails/darknet…forgot to disable Javascript. What to do now?

I am a noob as stated in title. I didn't know how to disable Javascript before visiting some not-so-legit sites. So what can I do? I was using tor, I know this is not enough so I have tails ring a ...
-3
votes
2answers
61 views

TV and audio hacking

I have been stalked now for over a year. I think they are doing it over the DirectTV because they can hear me and I can hear them. Is it possible they are recording me like a movie live through ...
0
votes
0answers
19 views

Extremely slow GnuPG 2.x Performance [migrated]

I have an curious problem with my script. The script runs very fast ,when i use GnuPG 1.x. With GnuPG 2.x it runs very slow at encryption/decryption, and i have no idea why. Versions: GnuPG 1.4.20-6 ...
0
votes
1answer
64 views

What is the difference between a digital signature and whole message encryption?

I am newbie in information security I am trying to understand the difference between a digital signature and encryption of a message. Lets consider simple example of email message. I understand how ...
-9
votes
0answers
16 views

c# code to reset password in ms word document [on hold]

am doing my final year project to develop a software that will enable to recover the password in ms office document in-case people forgot, die or quite a job in certain organization. ANYONE WITH IDEA ...
1
vote
1answer
17 views

Is there a secure method of distributing keys to network-booted diskless nodes?

I have a bit of an 'initial trust' issue. We are using CoreOS to run Kubernetes, and secure both the etcd API and the Kubernetes API servers using client certificates. We are using iPXE to boot ...
-1
votes
2answers
23 views

Can someone know that I'm using a VPN if they have my MAC address? [duplicate]

My university has a web filter, so I use a VPN to access blocked sites. They also have my MAC address. Can they identify that I'm using a VPN and what I'm doing on the internet?
4
votes
0answers
29 views

Prevent keyloggers on Linux?

Are there any mechanisms in the Linux desktop architecture to prevent malicious software keyloggers? What would be an ideal Linux setup to make it very difficult for an attacker to install a keylogger ...
0
votes
1answer
52 views

Doesn't this make 2FA irrelevant and possibly dangerous?

Article. One sentence summary: they use a smartphone as a listening device to compromise computer security. I know our bank doesn't allow us to take cell phones in at all, even if they're completely ...
0
votes
1answer
25 views

Is moving data between devices on an SD Card safer than a USB stick?

From the perspective of USB device-born malware/exploits, especially affecting firmware (e.g., can an infected computer reprogram an inserted USB memory stick to act like a keyboard and autotype ...
0
votes
1answer
20 views

How and why does case insensitive XSS work, given that javascript is case sensitive

I found out a lot of instances where XSS scripts like the following work. <iMg SrC=x OnErRoR=window.location=123> My question is: Given that javascript is a case sensitive language, how is ...
2
votes
1answer
45 views

Is storing passwords encrypted with GnuPGP on an anonymous FTP server safe?

I would like some advice on a method of storing passwords to a database on my anonymous FTP server. Basically I have login details for a few trusted users to a database server stored in a text file ...
1
vote
1answer
17 views

Using external OAauth Authentication Service, how to manage the users's relations

I'm trying to create an API and a website client for it. Lately I've been reading a lot about OAuth2 as a security mechanism and companies that offers authentication as a service such as auth0.com or ...
1
vote
0answers
22 views

How to “stealthily” call a Java function to avoid text search?

Assume I am an attacker, I want to call an API function from an Android app, say Build.getRadioVersion(). But I want to keep this call stealthy, i.e., it cannot be searched through, e.g., grep ...
0
votes
0answers
3 views

Why ecryptfs still remain in mtab? [migrated]

I use ecryptfs for encrypted lxc container container start ok and stop ok But i see even after stop this line /var/container-lxc/face/rootfs.crypt on /var/container-lxc/face/rootfs type ecryptfs ...
0
votes
2answers
24 views

Can they tell which individual computer was torrenting on shared internet connection?

I live in a shared house where multiple people use the same wi-fi (actually, there’s two: the normal frequency and 5GHz one). The internet is included in the rent. The other day I received a complaint ...
0
votes
0answers
10 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
2
votes
2answers
28 views

Can a full SSD or HDD recover deleted data?

I've always been curious. It may be a stupid question but what if you deleted a file then filled up the SSD or HDD. Could your deleted data be recovered or is it physically impossible? I know Windows ...
0
votes
1answer
39 views

How to verify the signature value in a SSL certificate?

According to RFC 3280 a certificate's basic syntax is Sequence := { tbsCertificate signatureAlgorithm signatureValue } In tbsCertificate, SubjectPublicKey is the public key of the ...
0
votes
3answers
30 views

How secure is it to use passwords consisting of one common part and one site specific prefix? [duplicate]

One of the greatest problems with passwords is having to remember different passwords for different sites. Some people use password managers, others use the password reset link every time they want to ...
3
votes
1answer
45 views

Would a DMZ be safe to use with a software firewall for home networking?

If I set up a Windows 10 PC with a software firewall (TinyWall, which is a front end for Windows Firewall) and blocked all traffic except for a few applications and ports I would be using (Minecraft ...
0
votes
0answers
4 views

What are the advatages or disadvatages of using seperate chaining over linear or quadratic probing? [migrated]

I was looking through different hash methods the other day and was curious as to what the advantages or disadvantages of using separate chaining over linear or quadratic probing. I know that with ...
2
votes
2answers
22 views

Use Nessus or focus on manual testing?

Nessus scans for a a lot of vulnerabilities, so should I focus on learning vulnerabilities that are not covered by Nessus, like directory traversal attacks? Should I work on only the vulnerabilities ...
5
votes
1answer
75 views

Can free Wi-Fi hotspot providers snoop on HTTPS communications?

Every article (and post on this website) I find on public Wi-Fi safety is mostly concerned with other people connected to the same network snooping on our communications. As far as I understand it, ...
2
votes
1answer
26 views

Can data be restored from a hard drive after using magnets to wipe the data?

Can a 512GB SATA hard disk be successfully restored after using magnets to wipe off it's data? From the movie: "The Core", https://youtu.be/g3KPSyNxnL8, rat using magnets to wipe his drive and puts ...
0
votes
1answer
21 views

Does KDE System Tray Extra Items “Clipboard” have the same security threats as the system clipboard?

Does the clipboard under kUbuntu's KDE System Tray > Extra Items "Clipboard" have the same security threats as the system clipboard? The following articles point out the insecure nature of the ...
0
votes
1answer
54 views

Avast attempts to connect to the Internet when I try to download email

The file AVAST (Software\Avast\AvastSvc.exe) tries to connect when I check my email. When I forbid access to the internet for AvastSvc.exe, I can't connect to POP3 & SMTP. I'm not sure where all ...
0
votes
0answers
4 views

How to manage logged-in state across multiple subdomains with a JWT?

So I am using JWTs to manage logged-in state for users. We also have translated sites on subdomains, eg: www.example.com // english es.example.com // spanish de.example.com // german And so on. ...
-9
votes
0answers
22 views

banking app testing information [on hold]

How to test banking android app for OWASP 10 SEQURITY RISK? PLEASE GIVE ME TOOL NAME ON WHICH EXAT RESULT WE CAN GET? AND GIVE ANDROID APP FOR DEEP TESTING? HOW TO PERFORM TESTING OF ANY BANKING ...
2
votes
1answer
28 views

How to identify and patch a hardware vulnerability?

Software and systems vulnerabilities are often patched with updates, or by avoiding the use of some OS or softwares that have multiple flaws. Regarding hardware vulnerabilities, I do not have a lot of ...
-1
votes
0answers
12 views

how to create DMZ on xDSL router [on hold]

Need to know that how xDSL router can be set to use DMZ in its firewall to reach a PC server on LAN. Should I use pubic WAN IP address for DMZ host ? The would it be accessible to public network.
10
votes
1answer
251 views

Bank complains about rooted Android. Is it really any worse than a Windows desktop?

When I use my bank's Android application, the app notices that my phone is rooted and puts up a message with a big red "danger" symbol and a message saying "vulnerable device." I totally understand ...
1
vote
1answer
15 views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
0
votes
1answer
35 views

How is UDP hijacking even possible?

My doubt is this: UDP has no sequence numbers, so what indeed is the concept behind UDP session hijacking?
6
votes
4answers
283 views

Can govt intercept End to End encrypted Whatsapp communication through the lawful interception?

Since after Whatapp started end to end encryption with an option for users to verify keys, many government security agencies like Indian one red-flagged such use of encryption. Now Yesterday the ...
0
votes
2answers
22 views

NMAP shows multiple outputs in OS detection

I am experimenting with NMAP in our network as an assignment, and I meant to do OS scan on one specific host 192.168.2.18, for which I chose the following command, nmap -O 192.168.2.18 and I was ...
0
votes
1answer
45 views

What is the best practice to secure an unattended Raspberry Pi?

I'm working on a project which involves mounting a Raspberry Pi on a self-moving vehicle. I'm looking for the best way to encrypt the Pi (entire file-system, swap, etc.), with the minimum possible ...
0
votes
1answer
22 views

How to find name of file to include in local file inclusion attack?

In a local file inclusion attack, besides guessing, is there method that allows an attacker to know the name of the right file? The name of the file to be included in a LFI attack is not always ...
1
vote
1answer
23 views

What can an attacker do with an exploited program?

If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do? Would it be able to only change data in Internet Explorer, could it modify anything on ...
2
votes
1answer
19 views

Server loaded with antivirus lets viral file go through

We have a .NET MVC website with a WCF Service as a service layer. One of the feature that the service offers is the ability to upload documents. When we asked our security consultant to test our ...
-1
votes
0answers
23 views

Explanation for these entries in the Suricata fast.log?

We have installed Suricata on our system. We have the following similar lines in our fast.log. Can anyone explain these lines? 03/17/2016-17:18:52.744707 [**] [1:2200075:1] SURICATA UDPv4 invalid ...
8
votes
0answers
59 views

Are keyboard hooks inherently malicious?

My software is using low-level keyboard and mouse Win32 hooks for legitimate reasons (if it's any relevant, it's for determining a change in the caret position of the active code pane in the VBA IDE). ...
0
votes
1answer
36 views

SRP, or hash hashes over HTTPS?

I'm designing a web API, which will use credentials from another system to authenticate. The API will require HTTPS, however I still want to avoid sending a basically plaintext password over the wire ...

15 30 50 per page