0
votes
0answers
5 views
Man in the middle attack: how to sniff packets over 2 sided encrypted communication
I learned recently about the Man In The Middle attack and came up with this question.
Lets say we have two computers who try to communicate over the network.
Every computer have an encryptor and a ...
0
votes
1answer
15 views
RSA algorithm: How to enter the multiplicative inverse to wolframalpha?
I'm trying to enter step 5: Compute d, the modular multiplicative inverse of e (mod φ(n)).
How do I enter this in WolframAlpha?
http://en.wikipedia.org/wiki/RSA_%28algorithm%29#A_working_example
-1
votes
1answer
39 views
personal studies to become a security expert [closed]
I'm a little late, I'm 21 always been interested in IT and this past year I've looked here and there for computer security, but I don't have a diploma.
I never had any idea on what to do in my life ...
1
vote
2answers
30 views
If a user visited a malicious website a year ago, should we nuke from orbit to be safe?
A Microsoft Security Essentials virus scan just finished on one of our computers and it shows two potential threats in Internet Explorer's temporary internet files:
Web page with Black Hole Exploit ...
1
vote
4answers
52 views
How to physically destroy my desktop/laptop HDD using only software?
Is there some software "one click" solution app that will destroy my HDD (forever) when I e.g. run the app and enter a password?
I would prefer Windows application (could be piad, no problem with ...
1
vote
1answer
33 views
Auditing, accounting, logging, and accountability… What's the difference?
Let's first look at the book Microsoft Windows Security Essentials:
... the three As (AAA) of security: authentication, authorization, and accounting
... they combine to contribute to reliable ...
0
votes
1answer
38 views
How does does the “Sign out all other sessions” feature work in Gmail?
In Gmail, at the bottom of the screen if you click Details it will show you your recent account activity and there's a button to sign you out of all other sessions. How does this work? Are they ...
0
votes
0answers
47 views
Is it safe to connect mobile devices to rental cars? [duplicate]
Many modern cars feature Bluetooth connections and USB ports that allow passengers to connect them with mobile phones and digital music players (and smartphones, which serve as both). Is it safe to ...
12
votes
8answers
453 views
Is encryption in HTTPS done by the browser or by the system?
This may be a common sense question, but I am not able to find any documentation on this after searching on google for a long time
When browser makes a HTTPs request, does it encrypt the data then ...
3
votes
2answers
62 views
How to be sure content was generated on a specific software?
I am developing an open source software. This software generates content that is sent to a server for publishing. Anyone can get this software and generate content.
The API for publishing at the ...
4
votes
1answer
46 views
How to encourage responsible disclosure (and react appropriately otherwise)
As a conscious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that team ...
7
votes
2answers
261 views
Disabling CCTV/IP Cameras
@D3C4FF has asked a great question and I would like to follow up on that. Basically he had asked whether "[...] an attacker can identify if a CCTV camera is on/operational without direct physical ...
-4
votes
0answers
34 views
Method of the study of ctf [closed]
I am a university student of the computer science.I study c and java.I am interested in ctf and want to study it, but do not know what I should study.I want you to teach how you studied what you ...
-1
votes
0answers
16 views
App authenticating with Google
My iPad App uses an oAuth authenticator to get access to a user's analytics data on Google. After a welcome screen, users are shown the standard Google sign in page. The signup page is presented from ...
0
votes
1answer
52 views
Asynchronous vs. Synchronous authentication process
I'm currently developing a web application using Node.js (server-side JavaScript) and MongoDB (NoSQL database).
I'm at the stage where I have to design the authentication and I had a question about ...
0
votes
0answers
45 views
LophtCrack version 6.0.12 is not auditing my Administrator password
I am using LophtCrack on my Windows 8 OS. I was testing my password strength and the problem I am seeing it is not working it doesn't reveals me my Admin password, I've gave my half an hour.
I've ...
12
votes
2answers
439 views
Is there any way to tell if CCTV is on or not?
Is there any way that an attacker can identify if a CCTV camera is on/operational without direct physical access to the cable/camera?
If it is on, is there any way an attacker can tell if its being ...
2
votes
2answers
117 views
Allowing user to access password protected website without disclosing the password
A friend of mine has the following problem. She is an accountant and her clients frequently give her their login credentials so she could download their accounting data from various financial ...
6
votes
3answers
116 views
Vulnerabilities with DB backed session tokens
A user logs in and is given a session token. This token is also stored in a database on the server. The user includes this secret token with each request, and the server will pull it from the DB to ...
-1
votes
1answer
62 views
After salting my passwords, are they protected against dictionary attacks? [duplicate]
I use sha1() to hash my users passwords, but recently a friend told me that if someone get the hash then they could use dictionary attack and he recommended using salts.
I implemented a random salt ...
-1
votes
0answers
8 views
vpn connectivity issue with my Windows 8 pro? [migrated]
I have vpn connectivity issue. I want to established my connection, i am getting IP address etc but unable to connect with my Windows 8 pro but working fine with windows XP. I am using uk VPN
0
votes
0answers
28 views
Windows xp sp3 client fails decrypting application data after SSL Handshake done [migrated]
I am trying to make WPA2 authentication on windows client using PEAPv0 as inner authentication method. I am able to make the handshake and establish the tunnel. When I send the first application data, ...
0
votes
1answer
67 views
What method of secure erase is sufficient for MacBook Pro SSD Drives? [duplicate]
I would like to securely erase the hard drive of a SSD in a MacBook Pro. The Disk Utility does not give me the option to wipe this drive even when I boot into the System Partition. (it is greyed ...
-7
votes
2answers
86 views
Can a person be tracked when he spoofs both his ip as well as mac address? [closed]
just thought of that?Can a person be tracked when he spoofs both his ip as well as mac address using some tools and tries to hack or send a email?
6
votes
1answer
377 views
Working out how to decrypt encrypted string when knowing the plain text
I have access to a system which I have been asked to create a data export routine for. However, the address details are encrypted and the original sourcecode/password are lost.
However, I am able to ...
6
votes
1answer
107 views
Build a secure channel without SSL/TLS
I'm looking at possible options to build a secure channel between multiple embedded devices with limited cryptography capabilities and an HTTP server (It could be some sort of web service).
1. ...
-2
votes
1answer
37 views
Using Old version of mysql connector's security issue [closed]
I'm using asp.net 4.0 and MySQL. Last week my hosting firm changed security level of from full to medium. MySQL connector doesn't work correctly anymore. For this reason I'm using old version of ...
-2
votes
0answers
46 views
How to implement Korea's SEED algorithm in Java? [closed]
While reading about the SEED cipher in java documentations, I came to know about this Korean SEED algorithm. Can anyone help me to implement it in Java?
I have used AES for encryption and decryption ...
6
votes
1answer
57 views
public key distribution from a central server
I'm trying to code up a encrypted communication program. Originally I was thinking that I would use public key cryptography and then I would keep the public keys in a database where users could query ...
-9
votes
0answers
57 views
Noobee help [closed]
So I've purchased an unlocked Android (S6500) GSM, quad freq and am planning to take it to Italy to use on their TIM network..
There are no SIM's inside, rather 2 empty slots. I put in the SIM from my ...
2
votes
2answers
56 views
Virus Removal Boot Disks — a few questions
I'm new to working with and using a backdoor/virus with a boot disk.
Can they be mounted to a USB drive?
What options are out there and what should I look for in one?
Are they practical?
Do they ...
6
votes
3answers
93 views
How to fuzz proprietary protocol over SSL?
I'm doing vulnerability research on a client/server architecture that uses a custom proprietary protocol sent over SSL (port 443). I need to be able to intercept the traffic, and be able to view it in ...
4
votes
3answers
82 views
RSA key length vs. Shor's algorithm
I have just read a passage in Zeilinger's book about quantum world.
My question is:
Suppose there exist quantum computers. Given that a quantum computer can use Shor's algorithm,
what key length ...
-5
votes
1answer
45 views
Spam mail from my yahoo mail [closed]
Couple of days back spam mail(screenshot link) was sent to all my contacts from my yahoo account, and in my account activity page there is a yahoo partner logged in, from Peru (screenshot link) during ...
3
votes
2answers
129 views
Is revealing your residence physical address when browsing the web a security risk?
I live in a large apartment building that provides a wireless service for residents. All of that traffic goes through a proxy server, and the domain name on that server contains the name of the ...
2
votes
1answer
60 views
HTTP Basic Auth is enough?
I have WebSVN, Gitlab and phpMyAdmin hosted on my dev server. Now, all of it, I password protect the pages (not their individual login) using HTTP Basic Auth, is this the best practice that I can do?
-3
votes
4answers
89 views
Why is data privacy important? [closed]
I am finding it difficult to motivate the importance of data privacy when speaking to both more or less technically inclined people. Since selling the idea of security is a fundamental precondition to ...
-2
votes
0answers
55 views
Which programs do you use for analyzing unknown Binaries / malware? [closed]
I would like to know which are the best tools for analyzing unknown Binaries / malware ?
I used in the past
Wireshark
PE Explorer
HxD Hexeditor
File Analyzer
So i want to blog about some malware ...
0
votes
1answer
40 views
Allow read-only access to server-side pages for security review?
This answer:
http://security.stackexchange.com/a/37319/10574
Mentions the issue of host-based security. To the end user, the web server is an untrustable black box.
Would it provide to needed ...
3
votes
1answer
147 views
is it possible to sniff email content inside network?
I am working in a IT company. I am using LAN for all internet activities. I send some email from my personal gmail account. My network administrator sniffed all email I send from LAN and he shows the ...
-4
votes
0answers
31 views
Mass POST XSS Checker [closed]
I'm looking for mass POST XSS checker for my website. Most apps that I've tried either uses get parameter or does not do mass checking.
p.s: By Mass-checking, I mean a checker which does website ...
-2
votes
0answers
35 views
SSL certificate installation in browser [closed]
I have an web application of which we have SSL certificate on browser.
I have installed it in few computers its working perfectly fine.
However I have 2 computers in which I have installed ...
-1
votes
1answer
48 views
How can I encrypt my router admin page login session? [closed]
I login to my router using the web connection but the session is not encrypted, is there a third party way to encrypt the web session so no one on my network can sniff the password?
0
votes
0answers
12 views
Should signature based NIDS detect malicious documents or executable malwares? [duplicate]
Two kinds of client side attacks are explained here, offensive-security.com: (1) just binary payloads and (2) exploit+payloads. Is it the responsibility of NIDS to detect them? It is the payload or ...
4
votes
1answer
46 views
NFC used in place of contact based smart card two-factor authentication
My organization is trying to move away from contact based smartcards (because our hardware vendor is no longer integrating them into their current systems) to some other form of two-factor ...
8
votes
4answers
257 views
How to use public WiFi safely?
The Dangers of Open Wi-Fi
How does one go about sending valuable information (for example inputting email username and password) over a free password-less public WiFi network?
The only option that I ...
3
votes
1answer
100 views
Any obvious flaws in this protocol?
Are there any particular flaws in this protocol?
(Yes I know about SSL)
Three participants:
Login Server LS
Game Server GS
Client C
Asymmetric key-pair Kpriv Kpub
Shared 128bit secret key Ksec
...
20
votes
2answers
863 views
How secure is the Windows 8 included Anti Virus known as Windows Defender?
How secure is the new Windows 8 anti virus known as windows defender?
Does it have a protection against malware which uses UAC bypass/process injection/rootkits/process persistence/running the binary ...
1
vote
0answers
29 views
Pursue career in Network Security [duplicate]
My qualification is Masters in Computer Science and i am currently working as a Technical Support Associate (Network Support) with a MNC. I am good with JAVA programing and have worked on some small ...
-1
votes
0answers
36 views
None of the cipher suites supported by the client application are supported by the server [closed]
I am getting this error in my server's windows event log:
An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client ...
