0
votes
0answers
13 views

Questions on DDoS and IP Addresses [on hold]

I was learning PHP and one day, I suddenly get more into hacking. I'm just a beginner, I know some stuff on VPN, proxies, IP and MAC addresses, zip bombs, batch viruses, keyloggers and so on. And ...
2
votes
1answer
10 views

Are files deleted before encrypting then formatted able to be retrieved?

On a drive I have a folder of files, I then just soft delete these files (not wiping them or overwriting with any data). After I soft delete them I encrypt the drive and wipe it with a single quick ...
-1
votes
0answers
10 views

What is the darkest things you've verified happening to an individuals whose info and devices were compromised? [on hold]

This is in reference to attackers who avoid financial gains or attacking the person's business so that they stay under the radar? I am most interested in stories where attacker's use subtle signs ...
0
votes
0answers
9 views

Scheduled tasks that need domain admin privileges

I have a Windows 10 box that runs a whole bunch of Powershell scripts, some of those contain cmdlets that need to be run against a DC, or mail server, for eg. Get-ADComputer, and ...
-4
votes
1answer
25 views

ip address hack [on hold]

I believe someone knows my IP through accessing public WiFi and accounts such as BT sport. Now I know I'm being monitored but not sure how I believe this person is a hacker they know the latest ...
0
votes
0answers
27 views

How do password managers sync their data?

I assume that having a local password manager is more secure than hosting one online, but let's say you have multiple devices. How does a local password manager sync its data with your other devices? ...
-3
votes
1answer
23 views

How do I stop a snooper: phone and computer

Someone is snooping on me. They can see my location, text messages, and pictures (even if I don't send them to anyone), and also my download and web browsing history. Someone is reading my old juicy ...
0
votes
0answers
6 views

Trusted CA / smart card authentication on Ubuntu

For SSH connections, I want to validate a smart card certificate against a trusted CA and CRLs. I found tons of documentation on how to enable smart card authentication but most of them focus on ...
0
votes
1answer
8 views

What is the rationale for calling setgroups on a list of length one?

The Secure Programming Cookbook for C and C++ says that: "Ancillary groups are inherited by a process from its parent process, and they can only be altered by a process with superuser privileges. ...
0
votes
0answers
18 views

Block a website to Other Users, But the router can access it

I'm trying to block a domain from my router Tenda Router, I've successfully blocked it, now the thing is that the Router itself should have access to that domain for log in the broadband connection, ...
-2
votes
0answers
16 views

VSFTPD 2.3.4 exploits vulnerabilities? [on hold]

I am trying to pentest a friends server (he gave me permission) and after I ran an nmap scan it said it was running VSFTPD 2.3.4, after doing research I did find a vulnerability on CVE but that only ...
0
votes
1answer
30 views

Is using “SHA-256 with RSA-2048 Encryption” a secure certificate hashing algorithm?

Is using "SHA-256 with RSA-2048 Encryption" a secure certificate hashing algorithm? I don't think it is. Two examples: nsa.gov [careers site] give.wfp.org
2
votes
1answer
32 views

How bad it is to feed /dev/random with /dev/urandom?

I have seen many blog posts, or blog comments which recommends to feed /dev/random entropy using output from /dev/urandom. I'm not a crypto expert, but it looks like a good way to replace ...
0
votes
2answers
35 views

Replacing files with infected files on anonymous ftp server

I am creating a new question as i now have another question which was raised from a previous answered question post. What im trying to figure out is would this scenario be possible. I have an ...
0
votes
2answers
28 views

How to properly hash a key? big vs small digest

We have to roll (decommission) database access keys often, but it's important to know which key each system is using in order to avoid removing a key in use thus creating unavailability. We want each ...
0
votes
1answer
9 views

NTRUEncrypt in SSL and GPG encryption

Commonly used cryptosystems like RSA or ECC, on the other hand, will be broken if and when quantum computers become available. - https://tbuktu.github.io/ntru/ How can we introduce NTRU in GPG ...
2
votes
1answer
14 views

Always setgroups before setuid?

On GNU/Linux systems that are build using RPM packages, the rpmlint utility complains about programs that don't call setgroups before setuid. The idea is that before dropping privileges, a process ...
2
votes
1answer
16 views

Single Page Application with REST API backend based on XML, queried by dynamic XPath

A web application I'm developing will be a Single Page Application (SPA) that will interact with a REST API backend, through jQuery.ajax() calls. The SPA and API will both be served over an https/TLS ...
1
vote
1answer
29 views

Raspberry Pi IDS/FireWall - Should I?

I was excited to setup an IDS/FireWall with my new Raspberry Pi on a standard home network. Reading threats to SSH and Linux, now I am not so sure. Setup by an experienced amateur I'm now concerned ...
2
votes
2answers
56 views

My cellphone is infected, and it keeps coming back

Please bear with me as English is not my native language My Android smartphone downloads apps automatically without any interaction. Generally the apps are known but some are unknown apps. I can only ...
-2
votes
0answers
39 views

Why mobile app developers don't encrypt the user data?

I have been wondering why mobile applications don't actually encrypt the user data and only use SSL or certificate pinning? Otherwise MITM attack or tools that help bypass certificate pinning can be ...
2
votes
0answers
35 views

Why more Android applications (compared to iOS) use certificate pinning?

I used mitmproxy to test the same 50 apps on iOS and Android and noticed that more than 50% of the Android applications compared to 23% of iOS, used certificate pinning. Is there any explanation as ...
1
vote
1answer
16 views

Why mobile applications share device characteristics with third parties?

It is known that mobile applications can share with third parties many different types of data from information about the device to search terms used in the application. I understand that search ...
0
votes
1answer
38 views

Why does Sidekick say that my boyfriend who emails me from Malaysia is in the US? [on hold]

I am emailing my boyfriend. He is working in Malaysia right now. I use Sidekick for all my emails. He always opens them by his computer and that does not tell me his location. One time he opened ...
-2
votes
0answers
68 views

Do banks use anything besides AES encryption? [on hold]

I know that AES only comes in three sizes (128, 192, 256) but does that mean that banks only use these three for their symmetric and asymmetric encryption? Do any of the big banks use bigger key sizes ...
0
votes
0answers
5 views

Disable ssh logins with weak passwords [migrated]

Imagine an insane Debian server administrator, that added users with a weak password for a start and a hint, that they have to change it on the first login. Now that he uses secure passwords only, is ...
12
votes
4answers
1k views

What are the alternatives to door passcodes?

Passwords have been a problem since the dawn of computing. They tend to be either so complex that no one can remember them, or so obvious that anyone could guess them. ... Some users ...
-4
votes
0answers
79 views

Can someone help me dissect this virus? [on hold]

It's a well known virus found on USB sticks, where it will hide the data in the pendrive and creates a shortcut of the pendrive inside pendrive. Plug this into any other computer, and the virus ...
0
votes
1answer
38 views

Are Windows Superseding Patches not fully securing my systems?

I have completed a Nessus vulnerability scan of a Windows system. The scan is indicating that some windows patches are missing, but the patches are superseded patches and the most recent version of ...
1
vote
0answers
36 views

Is it possible to identify the source of message in whatsapp?

Is it possible to identify the real source of message in whatsapp? Scenario : Texting whatsapp message to a group,one of the group member forwards it to another and it goes on atlast one day it ...
2
votes
1answer
19 views

Sending non-expiring access token on each request vs using refresh tokens?

When securing REST APIs for mobile applications, what you often see is the use of refresh tokens. They exist because: Access Tokens have expiration date. We don't want the user to have to enter his ...
0
votes
2answers
50 views

Pros and cons of password policy filtering common weak passwords? [duplicate]

We all know the basics "password rules" when a user register on a website, such as: more than 8 characters, must contain an upper case letter, must contain numbers and so on Why don't websites ...
1
vote
1answer
59 views

Is it possible to use the Linux “echo” command maliciously?

While testing a web application today, I came across a function that passed arguments to dig in linux terminal. After some fiddling about I was able to pass the echo command using pipes and echo my ...
12
votes
2answers
2k views

Is it possible to transfer a virus through browser video?

I know that there is already a question related to viruses in videos, but the implication in the other question is that videos in question have been downloaded and played by media software on the ...
0
votes
2answers
120 views

Sniffing WhatsApp chat using Wireshark

Suppose two persons are using WhatsApp on Android. How can I see the communication between them if I have Wireshark running on a PC listening on network interface card? I know the communication ...
0
votes
0answers
17 views

Securing several Servers (Certificates)

I got a Question regarding Certificates. We got a situation, where only "Server 4" and its clients are given in the picture above. That Server4 (SLES11) and its Clients are using a self signed ...
1
vote
0answers
38 views

Which is the correct algorithm while checksumming a portion of code?

As part of my research, I came across a technique in a paper which applies checksumming on a portion of code. I want to implement it. Here is the research paper which talks about the checksumming ...
18
votes
4answers
3k views

Is VLC on Linux vulnerable to an attack from .wmv files designed to install viruses?

I was stupid and did not check a video file I downloaded from an untrustworthy source. It was .wmv file with no readable properties of the video. I know that .wmv videos can download viruses. What I ...
3
votes
1answer
144 views

Why does my SHA256 certificate get encrypted with 168 bit 3DES?

We use S/Mime certificates for internal emails within our company. The certificates signature algorithm are all SHA256RSA with a hash of SHA256. I have confirmed the public keys are RSA(2048bits). ...
1
vote
0answers
24 views

Snort false positive, yet suspicious

I have Snort installed and tuned nicely with ET Rules on my pfSense, both my pfSense and the modem are using Googles public DNS 8.8.8.8. Recently I was denied access to google.com, and by reviewing ...
1
vote
0answers
24 views

How to increase security for my OpenVPN clients?

The idea is simple, I want to increase security on the client-side. Beside the encryption, I'd like to keep them away from malicious websites/files. I had in my mind ClamAV and maybe HAVP, but at the ...
0
votes
0answers
8 views

Can 125Khz RFID reader communicate with Hitag chips [on hold]

I have a question which is quite simple, can a standard EM4100, EM4305, T5577 RFID reader (such as an arduino shield or a USB/serial) communicate with a Hitag key ? (assuming the reader has write ...
2
votes
1answer
46 views

Is there a security risk in using pointers instead of struct instances?

Recently during a code review, a senior developer asked me to replace a pointer with structure instance in a utility method. He asked me to do so for security purpose. One reason that I could think of ...
-2
votes
1answer
41 views

I am investigating the physical access control system weakness [on hold]

physical access control system -> Biometrics, RFID system, digital door lock I am investigating the weaknesses of physical access control systems. I need a newspaper article that a malicious person ...
0
votes
2answers
24 views

What are some metrics to be used to evaluate SaaS security?

Some examples: static code analysis (Fortify) code coverage (bugs being a potential source of vulnerabilities) others?
1
vote
2answers
21 views

How to rank the security strength of a cloud SaaS app

If my manager asked me to rank how secure/vulnerable our SaaS system is, what methods are available to do so? I know there are certifications available but I'm looking for something which can be ...
2
votes
0answers
51 views

How to securely delete full vm

We have a Windows 7 virtual machine on VMware Workstation 11. The VM is now encrypted (using Workstation) but wasn’t always. The VM has confidential information on it and as we no longer need it, we ...
1
vote
1answer
45 views

Virus/Trojan attached to GnuPG encrypted file

Is it possible to infect a file encrypted using GnuPG? For example, if I had an encrypted file on an unsecured public ftp server, would someone be able to copy that file and attach a virus/trojan ...
1
vote
2answers
110 views

Why won't Firefox accept my certificate?

I've been trying to get stunnel to work with my signed certificate (with a CA that I've trusted in Firefox). The error is: 127.0.0.1:5559 uses an invalid security certificate. The certificate is ...
-6
votes
2answers
52 views

Noob to tor/tails/darknet…forgot to disable Javascript. What to do now?

I am a noob as stated in title. I didn't know how to disable Javascript before visiting some not-so-legit sites. So what can I do? I was using tor, I know this is not enough so I have tails ring a ...

15 30 50 per page