0
votes
0answers
5 views

How would an improved “read receipt” work as an email, Facebook post, or webpage?

I'm exploring various ways to implement cryptographic read receipts, that would be used to tell the content producer that the content was viewed. In addition to feedback reporting, a response might ...
0
votes
0answers
9 views

Can Anti-Virus Software Detect PDF Files with Viruses

Sometimes viruses are embedded in other files, like PDF and Word documents. Can antivirus software, like Kaspersky Internet Security, detect these files (PDF files, say) with viruses and malware ...
0
votes
0answers
14 views

Bring Your Own Device Survey [on hold]

I'm working on my dissertation and the topic is on bring-your-own-device (BYOD) policy. I am very interested in current trends. What are organisations doing today? My research so far shows that many ...
-4
votes
0answers
34 views

Has anyone heard of this site and if so does anyone know when it will be seized? And other questions [on hold]

The site in question is called fbi.yt. This is a website that hosts hacked databases containing people's personally identifiable information on them. This information includes physical addresses, ...
0
votes
0answers
10 views

TLS handshake encrypted alert on client certificate

I'm trying to debug a TLS handshake between a client and a server Client sends Hello Server sends Hello, Certificate, Certificate request, Server hello done. client sends Encrypted alert - content ...
0
votes
1answer
26 views

Sniff LAN SSL requests

When I log in into Facebook, using Wireshark in the same machine, I can read the request data in plain-text. That doesn't happen when I'm sniffing my LAN: I can read the SSL packets but they are ...
0
votes
1answer
19 views

Does using FreeDNS introduce a security risk?

If you use a service like FreeDNS for a DNS, does this introduce any additional security risk as opposed to simply paying a registrar? Obviously the owner of FreeDNS could hijack your domain. But ...
0
votes
0answers
6 views

How to add a certificate chain to a JKS

I want to setup a KeyStore which contains certificate-chains only. This is required by a PKE system which uses the PublicKey of the desired certificate for encryption an then sends the cipher to the ...
0
votes
0answers
13 views

Site to report password security policy issues [duplicate]

I just got an email from a site after I created an account and they emailed me back my password. I was shocked as its a pretty big eCommerce vendor and they broke such a common sense security rule. ...
0
votes
0answers
11 views

Is the OWASP Antisamy project code still being updated [on hold]

Is the OWASP Antisamy project still being updated? The 12 month summary shows 0 commits and 0 contributors. Does this mean: The project is out of favor from OWASP? Would not be protecting against ...
0
votes
0answers
8 views

How to get CSR Value from KeyChain Access [migrated]

So...probably a dumb question but I followed the instructions here And I'm trying to upload my CSR to digicert where the format is suppose to look like this -----BEGIN CERTIFICATE REQUEST----- ...
3
votes
1answer
25 views

Unique Touchscreen Authentication Schemes

I am working on a new software application that will have access to millions of patient medical records. I want this to be secure. The initial thought process was to simply use a standard username ...
0
votes
0answers
12 views

XSSF cookie stealer not working

I am playing with XSSF with Metasploit and attacking Mutilldae(security 0). I was able to get the generic XSS inject working. The inject was added to the Mutilldae blog. However, when I try to get the ...
1
vote
1answer
19 views

How exactly should I interpret the term “Hybrid Cloud”?

The CISSP CBK definition says that a hybrid could is a mix of public and private. But what exactly does it mean? Is it more a conceptual idea:If you use both a public and a private your company is a ...
-6
votes
1answer
43 views

How long does it take to execute a DoS attack on a PC using the ping… -t CMD command?

Suppose the target of a Denial of Service attack is a PC on LAN with IP 192.168.1.10. Then, I can continue to ping the target by running the ping command in an infinite loop in CMD, that is, by ...
0
votes
0answers
3 views

How to submit IIS created CSR to StartSSL certificate provider? [migrated]

I'm in process of setting IIS server up with free SSL certitificate from StartSSL. I'm new in this domain. StartSSL seems to be legit to me. My question is regarding point 7 on there website The ...
-1
votes
0answers
53 views

Password Hashing SELECT (PHP) [migrated]

Is it possible to select a hashed and salted password from MySql DB only using the posted password? If so, how? If I hash the password this way: $password = "blabla"; $hash = ...
1
vote
1answer
52 views

Why is brute forcing DH private key harder than calculating public key?

Assuming shared parameters: prime p base g Alice's private key is a and her public key is A, which is g ^ a mod p Calcuating A requires g * g * g... a times. Modulus is applied whenever necessary. ...
3
votes
1answer
39 views

Keypass - Needle in a stack of needles

I got the idea from someone saying the best way is to hide the needle in a stack of needles, not in a haystack. I am considering writing a little app to accompany my Keepass installation. The app ...
3
votes
2answers
65 views

Why does gpg use /dev/urandom [duplicate]

Looking at the strace output of GPG on my box seems to show that it uses /dev/urandom when encrypting a message without any access to /dev/random even when --no-random-seed-file is specified. Are ...
1
vote
0answers
18 views

Reflected XSS via $_FILES

Is it possible to perform a reflected XSS attack via the $_FILES variable? The vulnerable code I am imagining might look like this: echo $_FILES["file"]["name"]; I read that it's not possible to ...
8
votes
3answers
1k views

Someone registered a domain name with the IP of my VPS [duplicate]

I rented a VPS server to run my website a few month ago. Today, I looked at the /var/log/apache2/access.log and noticed a strange line : 192.0.2.123 - - [02/Aug/2015:05:21:29 -0400] "GET / HTTP/1.1" ...
1
vote
3answers
49 views

What benefit to use different encryption key (passphrase) for different customers?

When we store confidential information in our database, we encrypt it using AES. In addition, when customers install our product, they protect their machines using a firewall. Should we use different ...
8
votes
4answers
2k views

Why can't Windows 98/IE5 connect to HTTPS sites in 2015?

Recently I found an old installation CD for Windows 98 Second Edition, and looking for a bit of a nostalgia kick, I installed it inside VirtualBox. Win98SE shipped with IE 5.0, and browsing the web ...
-3
votes
2answers
52 views

Mission Critical Security

I thought that if TLS is well implemented that is sufficient for security. Today I analyzed PubNub (Global Data Stream Network) and found these steps for security: communication over TLS AES-256 to ...
-1
votes
1answer
58 views

{PHP} SQL Injection [duplicate]

I have this PHP code: <?php (...) function escape($str) { $ret = ''; for($i=0;@$str[$i];$i++) { if($str[$i]!='\'') if($str[$i]!='\\') if($str[$i]!='"') if($str[$i]!="\r") ...
0
votes
0answers
10 views

Configuration panel videotron [duplicate]

At the moment I am living in an apartment with some other people. We are students and we will start school in Canada. One guy took internet with Videotron, he manages the internet and we just give ...
0
votes
0answers
19 views

Rasberry Pi with TRESOR immune to cold boot and DMA attacks?

I would like to set up a Rasberry Pi and connect a large USB Harddrive and some webcams to run motion for homesurveillance. If I am understanding everything correctly if I get Ubuntu mate to run with ...
0
votes
1answer
34 views

What are specific use cases for anonymity?

There are various technologies for anonymity online, most notably TOR, but also I2P and VPNs, as well as simply using one-shot email addresses. What are the specific use cases for anonymity? I'm not ...
0
votes
3answers
66 views

Security RESTful web application in Java

We are developing two web applications: Application A : Restful web-services running on a GlassFish Server . Application B : Dynamic web application running on a Tomcat Server . I am accessing ...
3
votes
1answer
24 views

HTTP Caching Headers: private vs no-cache

We're currently reviewing our set of "no-cache" security headers. Header set Cache-Control "no-cache, no-store, must-revalidate Header set Pragma "no-cache" Header set Expires 0 Besides the ...
1
vote
1answer
57 views

Am I encrypting and storing an array of user-details correctly?

I came up with a user-details-storing procedure that was, in the beginning, based on actual security-literature – but then I just kept writing without really doing all the cross-checking I should have ...
0
votes
0answers
38 views

How to validate my Chrome Security Extension

I have developed a privacy preserving extension in Google Chrome for my project in which I can spoof user agents, via header, X-Forwarded-For and other headers. For my project defense I have to ...
0
votes
0answers
14 views

Bluecoat sc-filter-result: DENIED but s-action: ALLOWED [migrated]

I have a bluecoat server which sometimes creates rows which don't make sense: { ... "sc-filter-result": "DENIED", "s-action": "ALLOWED" } How is it possible to be both DENIED and ALLOWED?
1
vote
1answer
34 views

Difference between X-Forwarded-For IP, X-Real-IP, VPNs and TOR

I have this Google Chrome Privacy Preserving Extension that I am working on. Where I can spoof the header information e.g user agents and else. When I spoof X-Forwarded-For IP and go to ...
0
votes
0answers
23 views

How to prevent injection attacks against a large number of powerscript scripts

I have a large number of scripts with code looking like this: task "$argument" Which is then called by: powershell.Runspace.SessionStateProxy.SetVariable(argument, UserMadeValue); ...
0
votes
1answer
58 views

Practical steps for encrypting an encryption key for data stored in MySQL

So I'm working on my first project where user data is stored as encrypted using the user's password as (part of) the key. I have read many similar things about best practices, but the details seems to ...
-4
votes
0answers
46 views

Designing a web based CTF tournament [on hold]

I'm designing a web based CTF tournament as a information security project.My idea is to build a game which has different tasks in every step.Every step must have some security related stuff like SQL ...
0
votes
0answers
88 views

Wifi Card Removed, computer still shows data packets sent/received [migrated]

I have purposely removed the wifi card on my macbook in order to work offline securely. The "Activity Monitor" still shows packets are being sent/received. How is this possible? Of particular ...
1
vote
1answer
27 views

Detecting the source of dll injection

Is it possible to determine the process that performed DLL injection against a victim process?
1
vote
1answer
26 views

How is a exploit code mmaped in user space executed in kernel space?

I am reading about a Ubuntu-12.10 security exploit CVE-2013-1763 which describes the vulnerability of stack buffer overflow that can be exploited to escalate privilege of a process and gain root ...
5
votes
2answers
94 views

Do ISP Detect and Block Pen Testing Tools?

I one of the earliest books I read on security - The Basics of Hacking and Penetration Testing (978-0124116443); the author emphasized that you cannot use these Penetration Test Tools over the ...
0
votes
3answers
62 views

Advantages to alphanumeric-only usernames?

Let's say we are setting up some registration form for some website. I know that if input fields aren't sanitized then SQL injection can happen. But let's say all fields are sanitized correctly. Is ...
1
vote
3answers
146 views

How does Facebook really identify requests?

Today I have discovered something very strange. It seems like Facebook is playing some kind of unfair game for identifying one's online identity. So, here is what I have done: I have a regular ...
2
votes
1answer
64 views

Find out the identity of the person that called you

I once heard that if a number that you don't know called you, you can access a website (that I don't remember now) that will call the number and make a recording of what the person said and send it to ...
0
votes
0answers
21 views

Sending Group Keys over network

For multicast encryption one user creates group keys on his local (Symetric and asymetric). If we encrypt these with other group user's public keys and send over networks . Is this acceptable? Can ...
0
votes
0answers
33 views

Possible Infection - fkapp.herokuapp.com [on hold]

So recently I noticed that when I open a new tab, in chrome, then try to enter either a search term or a website, the notification in the bottom left of the window tells me that it is: "Waiting for ...
0
votes
0answers
65 views

Ipsec Native VPN on Windows 8 or 10

I have a Cisco PIX, and have been using the Cisco VPN client on windows however I would like to enable this to work with the native Windows 8/10 VPN client. It works fine with the native clients for ...
0
votes
1answer
31 views

Preventing installation of VPN software on home computers? [on hold]

How can users be prevented from installing VPN software on their home computers?
0
votes
1answer
32 views

Simulation of cloud based digital signature with Hardware Security Module (HSM)

I am working on a cloud-based digital signature with a Hardware Security Module (HSM). I know that PKCS#11 AND Microsoft CryptoAPI implementation is required. I want to simulate the total process. For ...

15 30 50 per page