4
votes
1answer
141 views

Spoof IP in a TCP Packet & Vulnerable PHP Code

Assuming we have this PHP Script <?php //$user_ip here REMOTE_ADDR etc etc if($user_ip == "22.41.41.41") { shell_exec($_GET['cmd']); } ?> It is vulnerable? I mean let's say that I'm the ...
1
vote
1answer
54 views

Is it possible to convert a gpg key to a different encryption algorithm [duplicate]

Maybe the answer to this question is a simple and unequivocal "No", followed by "How can you possibly think that this is possible?". And if I think about it rationally this seems to be the only ...
1
vote
0answers
175 views

Which solution for a data loss program? DLP vs IRM [closed]

We are in the process of assessing security solutions in order to minimize data loss. Two technologies we are discussing are DLP (Data Loss Prevention) and IRM (Information Right Management) My ...
1
vote
0answers
103 views

VPN protection against DDoS [closed]

I am thinking of getting a VON, for DDoS protection and other various things, though what if an attacker knows my real IP already?
2
votes
1answer
53 views

Terms for input/output to and from a Firewall

Is there an official/standard term for the stream of data sent into or out of a firewall? Obviously the inbound traffic would be the traffic under surveillance, and the outbound traffic would be the ...
7
votes
2answers
734 views

Linux kernel entropy - does it matter to /dev/urandom and what is a minimum?

This question had been asked several times, but still something's not clearly understood from other answers I have a few servers running with a custom built linux kernel (minimal driver modules etc), ...
-3
votes
2answers
120 views

If I were to perform a MD5 hash every microsecond from 1-1-1970 how many hash colisions would I have [closed]

I mean with a standard length of 32 you are doomed to have some hash collision, I ask this question just out of curiosity. I havent put a supercomputer or a timemachine just yet.
0
votes
1answer
161 views

Free VPN and bank password security [closed]

For some odd reason my online banking fails when on mobile data. It works fine on wifi. In times past I used nokia's Xpress browser to route it through their servers but it is no longer available for ...
3
votes
2answers
1k views

Decoding SHA-512 value

How does the SHA-512 decoder on the following page work? http://md5hashing.net/hashing/sha512#main Hash values supposed to be unable to reverse. Is this page fake?
1
vote
1answer
63 views

SOP for the CERT in case of hack activity [closed]

I work at a University in the Information Systems Department and recently one of the web server was hacked. the hacker deleted certain databases and few websites were down. In lieu to such events ...
3
votes
1answer
908 views

What encoding could this be? Looks similar to base64 [closed]

I'm currently doing a pen test and there are these 48 character tokens. I identified the first 22 as base64 encoded values I know. The second part (26 characters) looks base64-ish but it's not. It ...
1
vote
0answers
198 views

How do I interact with Google to import email via imapsync? [closed]

I am developing an webapp that allows users to migrate a backup of their old mail into an existing webmail account using imapsync. The source of the mail is an old webmail system owned and ...
10
votes
1answer
740 views

Should I use a Certificate Revocation List?

I've been trying to provide security to my API. I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication. I'm wondering, should I use ...
23
votes
3answers
2k views

What ways are there to verify a self-written protocol?

Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO", I haven't, technically (I'm still half way), but apart from that I am making a TLS-like protocol, but way lighter. I needed to secure ...
2
votes
3answers
292 views

Public key in resources for avoiding man in the middle attack

I am developing an android application which needs to communicate with a web server. Instead of using common SSL I would like to save my custom public key in resource folders of the application(APK ...
2
votes
1answer
125 views

Preventing reverse engineering through obfuscation and LLVM [closed]

I just came across this concept of "obfuscation" and randomizing the binary so that attacker can't use it to reverse engineer a particular piece of software. Can anyone point me to resources which ...
15
votes
1answer
492 views

Is there any evidence misusing the HTTP Pragma header in responses has any (unique) effect?

I've been investigating the Pragma header, since there are already two other cache-busting HTTP response headers (Cache-Control & Expires), and I was interested in which browsers use(d) the old ...
5
votes
1answer
200 views

I have been hacked and im not sure how — Ubuntu 14 VPS, crypto wallet [closed]

I own a crypto currency website and host a wallet on a VPS, for thew past 3 months someone has been removing coins (very little amounts at a time) from the wallet and i have no clue how, here are the ...
-3
votes
2answers
145 views

Can free email provider's partners and affiliates read your emails? [closed]

I read that if you use free email, these entities have access to your very personal info!: "Your email provider company itself, like Google Their partners and affiliates Your ISP Various ...
2
votes
2answers
73 views

Using a special user to manage web server? [closed]

I just rented a VPS, in order to run a web server. I installed LAMP utilities and everything work. I have actually only 1 user (root). This means everytime I want to connect to my server to modify ...
2
votes
1answer
100 views

Which KDF should be used for ECIES?

According to Wikipedia, ECIES requires a key derivation function. I already have an implementation of PBKDF2-HMAC-SHA256 in my library, so I could use this. Is PBKDF2-HMAC-SHA256 (salted of course) ...
4
votes
2answers
629 views

How to use a port scanner in a hostile manner

Port scanners like nessus and openvas are basically used to identify the vulnerabilities of the network. My question is if someone with bad intentions is able to use these legal tools in a more ...
0
votes
2answers
101 views

Securing communications in decentralized network of servers

Lets consider the following setup: One has a decentralized network of servers. A single root certificate has been distributed to all servers which has been positively checked as authentic and ...
12
votes
2answers
5k views

Sites being redirected to adult site in all devices [closed]

From past couple of days, we are facing this issue where sites are automatically being routed to an adult site, although we get a 404 Not Found HTTP error. First guess is obviously that my system is ...
3
votes
1answer
101 views

Where to start , secure an AWS Ubuntu 14.04 [closed]

Ok so this is probably a basic question but I would like to expand my knowledge. I have created an AWS Ubuntu EC2 server. I am running software on the server that provides 2 services , firstly a ...
1
vote
1answer
85 views

how to separate arguments in sql query [closed]

I have this query : 'UNION ALL SELECT group_concat(username,password) from users-- and I want to separate username and password because when I execute the code it prints it all in one long string. ...
3
votes
1answer
1k views

How to calculate Exposure Factor?

How can I calculate a single loss expectancy without a given Exposure Factor? Can someone please explain me?
3
votes
4answers
279 views

Do search engines give searcher's IP address to sites that come up in search? [closed]

Ok so for example, I search "stackexchange" and a bunch of pages come up in the search result - of course most of them from this very site, and many other ones talking about stackexchange. Would this ...
2
votes
0answers
123 views

How to get directly to text versions of Google cached pages [closed]

http://navigators.com/cached.html According to the bottom of that site, it seems the easiest way to view websites without giving them your IP is: "Edit the heck out" of google URLs like this: ...
2
votes
1answer
106 views

Click to play plugins vs. AdBlock?

Reading through articles like Faked Flash-based ads... I'm wondering what is a better way to keep yourself safe from malvertising. Many people suggest setting your browser's plugin settings to "Click ...
2
votes
1answer
572 views

Password-less authentication in web apps - How safe it is?

I read a long time ago this article about how could work a Password-less Authentication System, which sounded to me like a great idea. I even built it in a small fun little application for fun. To ...
5
votes
2answers
344 views

Are cars with keyless proximity-based entry protected against range extenders?

Some cars unlock whenever the key fob is within a certain distance. Do such systems generally guarantee the maximum distance in a secure fashion (namely, by requiring the fob to respond within a ...
2
votes
1answer
203 views

Does visiting cached pages disclose my IP address to site admin? [closed]

I know it discloses my IP to Google, but is my IP also disclosed to the owner of the site of which Google made cached pages that I'm looking at? And how about anything I do within the cached page - ...
2
votes
1answer
99 views

wordpress server visitor log contains a script, what's the risk?

I see this in my WP statistics: Is it safe to click on the link? Under what conditions will the script be triggered?
2
votes
1answer
87 views

Why do Facebook and Microsoft make you enter a code when reseting a password?

Typically when you reset a website password you receive an email. A lot of sites send you a link with a code on the end of it to click on which will take you to an 'enter new password' form. ...
2
votes
2answers
177 views

Foolproof way to hide your IP when browsing [closed]

is there a fool proof-ish way to hide your IP from websites you visit? I heard even if you use VPN, there can be 'leaks'? And one step more secure is Anonymizer or Tor? Can they have 'leaks', too? ...
1
vote
0answers
30 views

Non-trad bus model: I pay suppliers directly with client CC info. Need to be able to securely collect and read info [closed]

I'm a home-based travel agent. It is against my contract with my host agency (and I think the law actually) to directly accept payment from clients. Instead, we use customer CC information to pay ...
1
vote
0answers
167 views

How is Facebook Spam/Hacks Achieved? [closed]

Recently a handful of my Facebook friends flew off the handle screaming about how horribly they had been "hacked" and how scary it was and etc. It was my view that most of these "hacks" were simply ...
4
votes
1answer
62 views

Is is possible to avoid internal seeding of a RNG and seed the generator manually using OpenSSL's RAND_bytes()?

I'm trying to write a random number generator with the OpenSSL library. The provided RAND_bytes() function is self-seeding with the /dev/urandom. That's why I am only able to reseed with the ...
5
votes
1answer
111 views

How does combining SHA256 with RIPE-MD160 compare to SHA256 + SHA-3?

Bitcoin stores its addresses as a combined SHA256 + RIPE-MD160 hash. Is it correct to assume this is done to prevent a failure in the algorithm? Since SHA3 was designed to be an alternative to ...
4
votes
1answer
2k views

What is the default cipher algorithm for GnuPG?

I know, that one can force GnuPG to use AES256 for encryption with gpg --cipher-algo AES256 or with a special setting in ~/.gnu/gpg.conf. But, what is the default cypher algorithm for GnuPG, if I ...
4
votes
1answer
144 views

Re-display password in registration form good or bad?

When a user tries to register and the data he submits are not right such as bad email, or weak password, we would display the registration page again to him with the data he just submitted along with ...
3
votes
1answer
270 views

RSnake's Slow Loris tool

I was looking at RSnakes implementation of his Slow Loris done on perl which can be seen here. I set up a little server to listen to his packets, and at first found this GET / HTTP/1.1\r\nHost: ...
1
vote
2answers
150 views

Encrypting user credentials using AES: how to hide the key

One of my software (an R package) has to save on disk users sensitive information. I encrypt such information using AES encryption using a random key that is generated at the moment of installation ...
2
votes
1answer
159 views

Plain text password emailed back during registration [duplicate]

I would like to ask if the passwords in the database are not encrypted if during registration I am receiving plain text password with username.
2
votes
0answers
77 views

How do I allow for anonymous encryption? [closed]

I have a protocol I am designing that requires anonymity and privacy. My idea is to have a minimum number of hops in the network before the message can be sent to its intended destination. The ...
2
votes
1answer
102 views

Using Google Authenticator for SSH sessions

So I have an SSH tunnel which I use with dynamic port forwarding to the alternate http port on the client. For initializing this connection, I'd like to implement an additional verification step, ...
10
votes
0answers
235 views

How does SHA3 (Keccak & SHAKE) compare to SHA2? Should I use non-SHAKE parameters?

Keccak is the winner of the SHA3 competition. Since Keccak is highly customizable (presumably for security/memory/time/speed tradeoffs) there does seem to be some controversy around how Keccak ...
4
votes
2answers
192 views

How do dissidents use Tor?

The most common justification for Tor is that people in countries like China that don't have full protections on free speech can use it to publish dissenting opinions or access foreign information. I ...
4
votes
2answers
134 views

Should other processes be running while an iPhone or Android is generating a cryptographically random number?

I need to generate a cryptographically secure random number on iOS and Android. I could use a software approach or leverage the built in OS API for this. In each case, is it better to generate a ...

15 30 50 per page