2
votes
0answers
13 views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
1
vote
0answers
13 views

VB.NET stored procedure implementation?

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet Result = DBInstance.ExecuteDataSet(Name, ...
-1
votes
2answers
20 views

How can I setup my local server and do a heartbleed attack on it?

I want to know how can i setup my server (apache) vulnerable to heartbleed attack and subsequently do an heartbleed attack on it?
-1
votes
0answers
21 views

possible to work in IT security without doing programming?

Prefer to concentrate on IPS/IDS system,IT forensic ,threat investigation , DRP etc hence staying competitive in the industry What kind of roles is suitable for me ?
1
vote
0answers
14 views

Is it possible to sign/verify a key-pair?

We currently have the need to authenticate and verify generated keypairs. Our system allows users to register for our service which generates them a key-pair for use on our network. We are in need of ...
0
votes
1answer
15 views

CNN Money Portfolio and Heartbleed

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
1
vote
0answers
8 views

How To Find Out What Software is Trying to 'Phone Home'?

I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and am wanting to find out which application is making the attempt. The server is ...
0
votes
0answers
6 views

What to do with .hash files when cracking WPA2

So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the ...
1
vote
0answers
10 views

IE11 on windows 8.1 and ssl fallback

I'm having problems with SSL certs and my SSL accelerator. I have a Sonicwall SSL-R and it only supports SSLv2, SSLv3, and TLS1.0. I have it configured to decode SSL with SSLv3 as the TLS1.0 ...
1
vote
0answers
10 views

Is a VirtualBox Host-only Adapter safe?

I have a VM in VirtualBox with two network adapters, a Host-only Adapter and a NAT adapter; I was wondering if the VM gets compromised, is my Host-only Adapter putting my host in danger? --- ...
4
votes
1answer
25 views

How can I verify if a website revoked its old SSL certificate keys?

Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed ...
4
votes
2answers
53 views

Why do some websites need time to log you in securely, while others can do it instantly?

I noted that on a lot of money-related websites (banks, paypal, etc), you are brought to a page that "logs you in securely". This is an example of one: Meanwhile, websites that also store very ...
1
vote
3answers
35 views

Can an attacker sniff physical network traffic through WiFi?

So, I am wondering - is it possible for an attacker to sniff traffic on an Ethernet connection if they are not physically plugged into the modem/router hardware but they are connected through wifi? In ...
0
votes
0answers
4 views

Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?

I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information. My question is simple: Does using of API ...
2
votes
3answers
29 views

Is there any point to connecting to a VPN server while on the local network?

I plan on installing a VPN server on one of my computers that is running Ubuntu for purposes of connecting to my local network while I am not at home. At home I also have a desktop computer (separate ...
2
votes
1answer
12 views

Is it possible to slow down the Blue Midnight Wish cryptographic hash function?

In the Blue Midnight Wish (BMW) cryptographic hash function, is there a variable I can use to increase memory/CPU resource consumption to slow down the password hashing process? Call me crazy, but I ...
4
votes
1answer
22 views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § ...
1
vote
0answers
57 views

I believe my Domain has been hijacked I am not receiving in sales in shopping cart

My IP address is 181.224.153.95 Domain: www.ashaybythebay.com FTP Hostname: m23.siteground.biz I added private domain servers to my domain name ashaybythebay.com and I see the two IP server ...
1
vote
0answers
60 views

Decrypt Passwords based on using a user's password

I am creating a database to store our client's information at work (a heritage center specializing in DNA based genealogy). Once the results of a test come back, we have people that use the ...
4
votes
1answer
20 views

Why does a web site operator need to trust an openid provider?

I am working on a web site and am considering using OpenID for authentication. The site will have some low cost ($3-$5) premium services, but will not be protecting particularly sensitive user data, ...
1
vote
1answer
13 views

what are the current best practices for key generation

What is the difference between these openssl commands: "openssl genrsa" "openssl genpkey" "openssl req -newkey rsa:bits [everything else]" Which one should I be using when preparing a new CSR?
1
vote
2answers
44 views

One computer with multiple OSs in different drives

I use my personal computer for both programming work and gaming at my free time(and sometimes penetration testing) all these in different operating systems each. The problem is that I dont really ...
0
votes
1answer
17 views

Issues of using HOTP w/ iteration window

I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
1
vote
1answer
39 views

TestSSLServer Results

I ran TestSSLServer.exe (from http://www.bolet.org/TestSSLServer/) against a web server in my organization. The results seemed self explanatory save for one section I'm not sure how to interpret. ...
2
votes
2answers
26 views

When using PGP/GPG, is it safe to use the same public/private key pair on multiple computers for the same person?

It seems somewhat unsafe to move the private portion of one's key around to multiple machines...but it also seems odd to have multiple identities floating around.
0
votes
0answers
26 views

Snort reading pcap

I have 2000 something .pcap files I need to read with snort. I want to: Save all the alerts, and only the alerts, in a .pcap Run a very small ruleset What I have so far is this: read files in ...
1
vote
1answer
68 views

Explain the Heartbleed Python code

first post here so be gentle please! I understand the Heartbleed vulnerability concept, and I have a general grasp of Python. I'm struggling to understand the PoC Python code though, so was after a ...
1
vote
1answer
28 views

BYOD - Looking for Secure means of Wiping Data Remotely

We are in the process of implementing a Bring Your Own Device policy to allow our many employees to use their personal laptops and desktops (Windows platform) to VPN into our company's network. These ...
-2
votes
0answers
95 views

Are gmail and twitter being affected by heartbleed bug [duplicate]

Are twitter and gmail servers are being affected by heartbleed bug and is it recommended to change gmail and twitter password after this bug? Thanks
0
votes
0answers
14 views

Using Proxy Server, can gateway know which URL i am trying to open

I am using a Proxy for example UltraSurf, if I try to open a URL in my web browser, obviously web browser is going to send this information to my Proxy, then Proxy is going to communicate my Gateway. ...
1
vote
2answers
40 views

Identify Known Malware By Hash (MD5) Across Network

I need to design a solution that will allow me to submit a series of MD5 hashes and then be alerted if these hashes are found on any machine (Windows) on the network. I'm open to existing solutions ...
0
votes
0answers
29 views

How do I renew an SSL certificate correctly? [on hold]

I have an SSL certificate which is about to expire under GoDaddy. So what I did after I renewed was Generate a Keystore and CSR in Tomcat Install SSL in Tomcat The above is based on the steps ...
1
vote
1answer
18 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
3
votes
1answer
40 views

How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design

I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...
0
votes
1answer
46 views

HTTP Status Codes - security considerations

I am designing an authorization framework and now I am thinking about the error codes which I should return when someone is trying to access a resource and he doesn't have the required permissions. ...
1
vote
1answer
25 views

Is it safe to sign in to Google with password from desktop app like BlueStacks? [on hold]

BlueStacks is an android simulator for desktop. After installation it will ask you to login with your Google account to download and install android app from play-store. My question is "Is it safe to ...
0
votes
2answers
44 views

SQL Injection and JavaScript Regex Bypass

me for learning SQLI. But I got stuck at this one regex which seems to be unbreakable : document.loginForm.username.value = document.loginForm.username.value.replace(/[^a-zA-Z0-9]/g, ""); If someone ...
1
vote
1answer
27 views

Multi-tenancy and Heartbleed

We use a well-known service provider/API management gateway that sits in front of our RESTful APIs providing key management functionality etc. etc. The service provider was running the dodgy OpenSSL ...
0
votes
0answers
31 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
2
votes
2answers
57 views

Chinese or “pinyin” wordlists for dictionary attacks

Background: I am currently trying to crack a salted md5 hash which I have recovered from an embedded device running busybox and manufactured in china. I have tried john the ripper using all of the ...
2
votes
1answer
23 views

How are CRLsets more secure?

Google Chrome doesn't do typical CRL/OSCP checks, instead it depends on CRLsets. In simple terms, Google scoops up the CRLs from most CAs, trims them down and delivers the CRLset to the browser via ...
2
votes
4answers
400 views

How to prevent users from downloading information from our search engine?

We have developed a search engine (simple search, no login required) where users can search details in the database (Apache Lucene) by entering their name (et. al.), then clicking the search button. ...
-1
votes
1answer
31 views

Minimize collision risk for any hash function?

What's some good advice on eliminating collisions when hashing things? I need a unique identifier for all my users, but I want them to be private. I'm thinking of using ODIN-1 ...
0
votes
0answers
21 views

Steganography for BMP [on hold]

I came across with steganography courses recently and was very new on this. I was given a BMP image which consist of hidden message in this BMP image. Just wanted to know how can I start to analyse ...
0
votes
0answers
18 views

Considerations when implementing a key based SSH-like auth scheme

I have a SMTP server where all the users (for an unrelated reason) will have public keys tied to their username and registered with the server. I want to add a non-standard extension that uses these ...
1
vote
3answers
91 views

Decrypting Engima messages

Not really computer related, but I hope someone has the answer. How do people decode messages from an Enigma machine? I understand that if you knew the rotors, rotor positions, and plugboard the ...
0
votes
0answers
11 views

Protect or Unlock [duplicate]

I am setting up a public WiFi router and recall reading that protecting the connection, but stating the password in the SSID, is better than simply leaving it unlocked. I don't know if I read or ...
0
votes
2answers
68 views

Can malware cause firefox to send GET requests?

Is it possible for a site to host malware such that if a certain page is accessed, Firefox is made to send additional GET requests? I'm seeing traffic for attacks coming from me that I haven't done. ...
0
votes
0answers
20 views

nginx - How to prevent processing requests with undefined server names with HTTPS

How do I avoid nginx processing a request with an undefined server name using the https protocol. The following configuration makes this work for http requests: server { listen 80; ...
1
vote
3answers
23 views

Secure Custom Registration Links

I'm working on a website that allows a current user to invite another individual to be friends by typing in the non-user's email address. The non-user would then receive a custom registration url by ...

15 30 50 per page