All Questions

2
votes
2answers
26 views

What stops a developer from accessing credit card details and other secret data from a company

First of all, I'm sorry if this has been discussed many times. I read many posts about PCI compliance but there are some small things I'm not quite sure about. Suppose there is Mr. GoodGuy, an ...
2
votes
0answers
20 views

Best way to store/retrieve sensitive key files?

We have our web servers running in AWS EC2. We have about 30 API Keys/passwords/etc (sensitive data) which is set in the environment for our app to use. Whenever we deploy, we start a new server ...
0
votes
1answer
41 views

How do security agencies share their data with each other?

I am trying to develop an application for some hypothetical security agencies for sharing their data with each other for a college project.I have three questions, 1.How do security agencies share ...
0
votes
0answers
19 views

Running snort behind iptables

I run a Centos 6.5 server with a highly restrictive iptables ruleset allowing incoming traffic only on a small handful of tcp ports (8 in total) and blocks all incoming unsolicited UDP traffic. I ...
0
votes
0answers
14 views

Are there any ways to leverage NTLM V2 hashes during a penetration test?

I am on a penetration test at the moment, where LM/NTMLv1 hashes are disabled. I have captured a number of NTLMv2 hashes via NBNS spoofing, however was unable to crack them after running them through ...
0
votes
1answer
17 views

Disable Win FW - via WinRS?

Security practitioner working on MCSA, trying to see what I could do with WinRS from remote, namely disabling the firewall. winrs -r:1.1.1.6 netsh firewall offline sh mode Returns that the firewall ...
10
votes
2answers
291 views

Why use a Smartcard for (Two Factor) Auth instead of another medium?

I recently installed Bitlocker on my Windows 8.1 machine, using only a password. I was thinking of getting something other than just a password for my storage drive, something physical, like a USB, SD ...
0
votes
2answers
52 views

Are there any good tools to test the encryption quality of data?

I am trying to increase my understanding of data encryption, and I was wondering this. It would be really nice if there were any good tools to test how secure my encrypted data is, for example how ...
6
votes
3answers
541 views

Why are drives overwritten three times when being disposed of?

I am looking at the secure disposal of old flash drives, and one of the standards I have come across says that they should be overwritten three times. Why is one time not enough? I assume doing the ...
1
vote
1answer
48 views

Any ways to protect my user data on company computers?

I have a desktop computer at work running Windows 8.1 Pro. For logging in I use a domain account and I have logged in with my Microsoft account to get access to my Onedrive and syncing of email ...
1
vote
0answers
37 views

Sticky keys on RDP

A recent report on page 18 states that: [black hats] have even leveraged [systems administration tools] as a means of maintaining additional persistence via setting “sticky keys” for RDP sessions. ...
0
votes
1answer
40 views

Can I create a fake AP with my wireless card?

I type iw list and these are the supported modes: Supported interface modes: * IBSS * managed When I run hostapd hostapd.conf I get this: Failed to create ...
0
votes
2answers
62 views

How safe is it to use older/unknown Encryption methods for plaintext?

When mailing or chatting with people, it had crossed my mind, what if, for simple communication, someone would use an older encryption method (i.e., ENIGMA), to encrypt their message? Would because ...
7
votes
1answer
376 views

How well is the SSL/TLS handshake protected against modifications?

The SSL/TLS handshake is protected against downgrade attempts by the Finished message, a signed and authenticated hash of the master secret and all previous handshake messages. Consider a client that ...
0
votes
2answers
87 views

How much does a GET request over HTTPS reveal to an eavesdropper

Correct me if I am wrong, according to HTTP v1.1 a simple CONNECT request initiates a SSL tunnel between the server and a client. its only after the tunnel is created that the complete GET or POST ...
4
votes
2answers
179 views

Why Sniff Session Cookies when UN/PW should also be available?

I've recently been reading on session cookies and how they can be hijacked via man-in-middle attacks. It seems this is mainly possible on an unencrypted connection between a client and a webserver. ...
0
votes
1answer
38 views

Who will fix the vulnerabilities found in Firewall

As a security guy, i run vulnerability scan and found vulnerabilities in firewall Like as follows SSL Server Allows Anonymous Authentication Vulnerability Solution SOLUTION: Disable support for ...
0
votes
0answers
14 views

Do we need IDS if we use Citrix terminals WYSE

In our environment, We use Citrix terminals in one part of world and those are connected to Citrix farm (Includes, AD, Log management, FW etc) (PCI Compliant) located in US. My Concern is, we are ...
0
votes
0answers
11 views

Security in MPI implementations

I came across a research paper andproject discussing about the implementation of encryption/decryption in the channel layer of MPICH2 called the ES-MPICH2 library ...
2
votes
2answers
57 views

Code Signing Confusion

I usually make free windows applications, now I want to digitally sign them. So users can be sure that its from me. But instead of buying the code signing certificate, I thought I may create my own. ...
1
vote
2answers
18 views

Segregating Offline Server and Internet Connection in one pc

What I want to do: Setup a PC with two routers. One router is directly connected to the internet, the other is connected to an offline workspace server. My client will be connected to both via a ...
1
vote
2answers
27 views

making online transactions over proxy

So I went over quite a lot of topics here and on the internet.. but I still can't seem to completely understand this issue. How secure really are services like proxies, VPN or VPS? VPN is promoted ...
1
vote
4answers
72 views

Is there any defense against Brute-Force done on a local encrypted file?

Let me start off by saying I don't know very much about encryption, hashing, cracking, etc. I'm just a typical computer enthusiasts, programmer and researcher with many questions. So, I've discovered ...
-1
votes
0answers
30 views

What is the point of JSON Web Token?

I've been reading the JSON Web Token (JWT) spec, and don't really see the point of using it. JWT has to be over TLS, otherwise the token (generated by the server on initial user authentication) could ...
0
votes
2answers
58 views

Trust level of whole disk encryption software

For example, if we take this software into account: Symantec Endpoint Encryption Sophos Safeguard Encryption How can we trust suppliers of whole disk encryption software in the lights of the ...
1
vote
1answer
53 views

Perfectly Robust Hashing Scheme, or Completely Over-Engineered?

This is going to get long, so prepare. Basis of the question is, Do all these steps improve security, or am I completely overthinking the problem? Are my assumptions/thought process valid? We all ...
1
vote
0answers
18 views

How do I display the usage flags for my encryption keys in a less hackish way? [migrated]

I am trying to educate myself on the use of encryption keys and I've been experimenting with this old Linus Torvalds’ key that I found 956EB7BF449FA3AB. I am interested to display the usage flags but ...
0
votes
1answer
31 views

How to make a decent Certificate Signing Request (CSR)?

I'd like to know how to make a decent Certificate Signing Request (CSR) to secure my website and e-mail with a wildcard SSL certificate. With recent exploits as POODLE on SSLv3 and such, I'd like to ...
2
votes
2answers
87 views

Can anyone be hacked?

I have often heard that if you are the target of a directed hacking campaign by say, a team of government hackers (whether Chinese, NSA, etc.), there is no way to prevent being hacked if they highly ...
1
vote
0answers
11 views

Clear EFS Cache at Set Interval

My boss wants to set up encrypted file shares using EFS on Windows Server 2012 R2 Boxes accessed by Windows 8.1 clients. I've been able to set the default DRA, issue certificates in test cases and so ...
0
votes
2answers
41 views

What is the solution for handling exceptions in password hashing schemes?

There is a technique called password hashing that describes creating unique passwords based on a unique master key and a static and arbitrary hash value. Using this technique, the user only has to ...
0
votes
1answer
57 views

Is a Cloud-Connected Door Lock More Secure Than a Traditional Lock and Key?

Now that app based door lock replacements are getting more popular in the market, I'm wondering what the security risks are and why or why not this is more secure than an old fashioned lock with a ...
0
votes
2answers
22 views

Postfix master running as root

Does running /usr/lib/postfix/master as a root could cause a security threat ? A fresh installation, gives this : **root** 11622 0.0 0.0 4792 1432 ? Ss 19:11 0:00 ...
1
vote
4answers
218 views

How to deal with password schemes that can produce weak passwords?

Introduction Since the xkcd note on password strength, there has been a lot of attention for password entropy. However, this raised the question: what if you used a strong scheme, but happened to ...
-1
votes
0answers
46 views

Removing CBC ciphers specific to SSLv3 [migrated]

I need to disable SSLv3 specific CBC ciphers as a temporary solution to the POODLE vulnerability as there are legacy applications that need to use SSLv3. After consulting the OPENSSL docs, it seems ...
-1
votes
1answer
33 views

FireFox plugin to change headers, user agent, screen size etc [on hold]

I am looking for a FireFox Plugin that can change/disable the following settings: User Agent Browser Plugin Details Other HTTP headers Timezone Screen Size System Fonts Sorry, wrong site. Please ...
28
votes
4answers
2k views

Pattern to allow multiple persons to decrypt a document, without sharing the encryption key?

Current setup We have a service that allows users to upload documents through a website and stores the uploaded documents encrypted on disk. The documents on disk are encrypted with a per-user key, ...
35
votes
7answers
3k views

How to report vulnerabilities without being regarded as a hacker?

I just discovered that my university alumni's login page is just plain HTTP. Wireshark confirmed that the credentials are sent using an HTTP POST message. I did a bit of research and, as I thought, ...
0
votes
0answers
71 views

Example websites that have invalid certificates [on hold]

I am looking for websites that have invalid HTTPS certificates. I did a search but found few examples. I am wondering if anyone knows any HTTPS website with invalid or broken certificates, for ...
-3
votes
0answers
37 views

What encryption or hashing algorithm is likely to be used here? [on hold]

I want to use the USERS table of a proprietary 3-rd party tool for user authentication. The column PASSWORD is of type VARCHAR(35). It holds the following data: 64783641124722847161648230000000000 ...
-1
votes
1answer
17 views

getting an error in aireplay-ng in kali linux

When I was testing penetration testing on my router using kali linux, I followed all the steps from this link. In the step where you have to enter the router's bssid and client's bssid in aireplay-ng ...
-2
votes
1answer
93 views

What kind of encryption is this? [on hold]

I'm trying to discover what type of encryption was used to generate this strings: Qo94v0JpPaL59LS6U3xfEB4nVgc= +3ZaEliGZ7DWte+LaviHvOlcg9A= v44x/KnS/JyOVDtbmbkFkJEgkWs= y75nHoG/yXwutlixBX7/jRXsv+o= ...
0
votes
2answers
69 views

Will an ISP give out network/traffic info upon request?

Nothing big, just a fear of embarrassment. I use my mom's (she pays for it) internet service to connect online and stuff. The thing is, I am nervous that she may possibly ask the ISP for some traffic ...
3
votes
1answer
21 views

Clarification on the -h Flag for Makecert.exe

When using Microsoft's Makecert.exe to generate a certificate (and key), there is the option to allegedly "specify the maximum height of the tree below that certificate", using the -h flag (see MSDN). ...
-4
votes
1answer
48 views

How does https check md5, sha-1 and sha-2 fingerprints?

When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient? This question arose ...
2
votes
1answer
39 views

Masking traffic in another protocol

I remember reading a couple of years ago (I believe it was during the Egyptian Revolution) that hackers managed to bypass government filters by making their traffic appear as another protocol. If ...
4
votes
0answers
37 views

Cordova/Phonegap: RefreshToken in localstorage

I'm following a tutorial to develop a cordova app, based on angularJS. The author stores the refresh token in local storage, which was said to be very bad practice in one of the comments on that same ...
2
votes
0answers
27 views

Why should I persist OAuth 2 access tokens along with refresh token

That's something I've came across in a couple articles about OAuth 2: when it comes to persisting refresh tokens to database some authors prefer to store access token as well, or at least mention it ...
4
votes
2answers
255 views

Disable SSLv3 in Dovecot --> TLS handshaking failed: no shared cipher?

Ubuntu 12.04 OpenSSL 1.0.1-4ubuntu5.20 14 Mar 2012 Dovecot 2.0.19 The situation is I'm trying to disable SSLv3 in Dovecot by adding !SSLv3 to the ssl_cipher_list: ssl_cipher_list = ...
1
vote
1answer
27 views

What is the difference between Internal and External scan in PCI

Is each firewall interface IP is considered as external IP?. Do we need to scan each interface IP??. What is an internal scan? What are the elements for internal, how we do it?.

15 30 50 per page