7
votes
3answers
393 views
Which resources can help me learn how to use metasploit?
I tried google search but I can't find good resources to learn how to use the metasploit framework.
Where would you suggest a beginner go to learn about using metasploit?
0
votes
1answer
153 views
Where can I practice web-security or network-security? [duplicate]
Possible Duplicate:
Servers for penetration testing
I'm in a process of learning security of networks and websites.
I already practised code reviewing but I want to perform exercise.
Is ...
4
votes
4answers
1k views
Are there lists of most common words or ngrams used in passwords and passphrases?
I've been thinking about ways to focus brute forcing dictionary attacks on passwords and passphrases based on the assumption that certain words, combinations of letters, and combinations of words are ...
6
votes
3answers
199 views
Are there password/passphrase guessers/crackers which can utilize facts supplied about the target?
I was just reading a discussion about cracking passwords that said the person running the tool might know things about the target like the birthday of his first girlfriend's dog but the tool won't.
...
6
votes
4answers
3k views
Are the iPhone “connect the dots” passwords secure?
A popular way to login to iPhones and other phones is to use a "connect the dots" password. For those unfamiliar, it looks something like this:
Is this kind of passwords secure from brute force ...
15
votes
5answers
1k views
How can I protect my computer from my potentially malicious colleagues?
So, I work in this small company (10 people) where we do stuff in programming, for various platforms. I started recently working there (2 months) right after I graduated. My work is not exactly ...
24
votes
2answers
3k views
Amount of simple operations that is safely out of reach for all humanity?
Cryptographic primitives usually assert some security level given as number of operations to mount an attack. Hash functions, for example, give different security levels for collision attacks, ...
10
votes
6answers
598 views
Best method of retiring hard drives
What are some typical ways you guys retire hard drives? We have a hard drive that won't mount anymore (makes clicking sounds when it tries to mount). The data on it isn't necessarily sensitive (no ...
5
votes
5answers
1k views
What password cracking software is commonly used?
I am curious to know how secure my passwords are.
What password cracking software is commonly used?
Preferably open source.
EDIT: I am actually looking to crack my passwords used on services I ...
9
votes
1answer
2k views
Paypal Account created using my gmail account
Some time ago, probably about 6 months, somebody hacked my email account and used gmail settings to forward my emails to him/her.
I noticed that, removed the forward and changed the password. Now, I ...
-3
votes
2answers
380 views
Web service that converts HTTP GET to POST?
Is there some online forwarding service that I can give HTTP GET parameters to, and it would create a form with the parameters and submit it as POST?
For example, I'd like to give someone the URL:
...
2
votes
3answers
695 views
Use a Common Firewall for two Different Subnets
I want to implement a security scheme in a new network configuration. There are two buildings for the client:
Office Building 1 (OB1) with address 10.0.0.0 / 255.255.255.0,
Gateway 10.0.0.1 ( ...
17
votes
5answers
953 views
How can I choose a strong password that is easy use on a smartphone?
Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is ...
4
votes
1answer
935 views
How can I store downloaded video securely to device's sd card?
I want to save videos in my android mobile's SD card securely such no other application or user can use it, outside the application or on any other devices.
So for this what can I do? I think about ...
16
votes
5answers
463 views
What should I do when classified information stayed on a unauthorized laptop?
Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it?
How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
371
votes
20answers
57k views
XKCD #936: Short complex password, or long dictionary passphrase?
How accurate is this XKCD comic from August 10, 2011?
XKCD 936: Password Strength
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones ...
6
votes
1answer
213 views
White list or black list sanitation for international input?
There seem to be so many ways to create nefarious input that white-listing what input is good usually feels like the safer, simpler option.
For instance, one can fairly easily craft a white list ...
23
votes
2answers
965 views
What is the attack tree to intercept traffic on Wimax?
My current understanding is that sniffing traffic on 4G (lets use Wimax and LTE for the purposes of this question) and 3G is not a simple matter and either requires you setting up a fake base station ...
4
votes
3answers
152 views
Is there a common name for a software defect that leads to unexpected transfer of secret over the wire?
Suppose in a C++ program I use a memory region for temporarily storing an encryption key and don't overwrite that region afterwards. Then my program wants to send a data packet over the network.
Due ...
4
votes
2answers
454 views
How to see whether the pcap contains RTP traffic?
I am analyzing the traffic of a VOIP application. I started up wireshark, and made sure no other application was using internet, and then had a a voice call on the application. Wireshark captured some ...
6
votes
2answers
562 views
Do Flash memory (SSD) architecture impacts encryption techniques?
I'm working on encryption techniques on SSD's and my question is: does the erase before write architecture of SSD's has anything to do with the encryption technique?
What are the problems I might ...
9
votes
4answers
4k views
Is it possible to securely store passwords using reversible encryption?
Everyone says that you need to use a non-reversible hash when you store passwords so that even if your database is leaked, the passwords themselves are still safe. I'm wondering if there is anyway to ...
6
votes
3answers
170 views
Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?
I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
12
votes
7answers
3k views
Are jailbroken iPhones an enterprise security risk?
Background
My company is currently in the process of rolling out support for the iPhone. As a part of this rollout, they are requiring employees to install an application on their phones that allows ...
14
votes
2answers
1k views
Is “real salt” the same as “initialization vectors”?
In the question about real vs. fake salt, the answers describe how real salt 'perturbs the encryption algorithm.' I know roughly how initialization vectors work; is this the same concept, or something ...
33
votes
7answers
2k views
“Real” Salt and “Fake” Salt
During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" ...
5
votes
2answers
1k views
How large blocks does AES-cbc use with a 128 bit key and with a 192-bit key?
I read on wikipedia that the AES with cipher block chaining and a 128-bit key uses blocks of size 128 bit to encrypt the data.
However, it also said that with a 192-bit key, there were still 128-bit ...
8
votes
5answers
270 views
How to verify new accounts against a known persons database?
I need to (try to) solve the problem of new account creation for a patient portal for a medical records system (electronic health record). That is, a way to activate a patient online and match her ...
7
votes
3answers
405 views
Server to server encryption: Key rotation over the air. Can it improve security?
In my other question, I explored whether to write my own encryption or use an existing one. I was advised to use TLS or AES or something that is established.
This question is about key rotation. It ...
3
votes
2answers
339 views
Security logs on Linux, Solaris and Windows
As the company's security department, our system administrators ask us what they need to log for SIEM (Security Incident and Event Management). We don't have any prepared documents and are seeking ...
7
votes
5answers
925 views
Is finding vulnerabilities in the major browsers easy or not?
If young hackers can detect them, why can't security analysts get and patch them?
Also, I dream of finding a vulnerability in a major software, like IE or Chrome. Is it easy? Is it systematic or is ...
8
votes
4answers
1k views
How can an access point spoof me into connecting?
I was reading through the answers of the question "How can I ensure that I connect to the right wireless Access Point?" and was wondering how it is possible for an access point to imitate another wifi ...
6
votes
2answers
1k views
Dictionary Attack on Wifi
I know a few people with pretty weak passwords. What kind of systems exist to prevent dictionary attacks? Would it make sense to restrict the number of connection attempts in a certain timeframe?
...
12
votes
3answers
1k views
Bruteforce attack on my FTP server
I recently setup VSFTPD on my personal server for sharing files over FTP. In the vsftpd.log file, i see hundreds of failed attempts to login with usernames like "adminitrator" , "adminitrator1", ...
8
votes
2answers
2k views
Is doing credit card transaction via 3G secure?
3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is ...
6
votes
2answers
223 views
Geographic equivilent of RFC 3161 (X.509 PKI Time-stamp Protocol)
First time poster here, hope to be around more often.
I'm in need of a cryptographically secure 'stamping' system that allows not only time but also location to be attached to data, while still ...
6
votes
1answer
242 views
How many iterations of fuzzing is enough?
Fuzzing is a convenient, relatively low-cost way to detect some kinds of vulnerabilities, particularly in C/C++ code.
My question: How much fuzzing is enough? Are there are any standards or best ...
6
votes
2answers
392 views
Outsourcing security evaluation
Does anyone have any experience with outsourcing security code review via freelance sites (like Rent-a-coder, Elance, Guru, Getafreelancer, etc.)? Is this effective? What are the best practices? ...
11
votes
2answers
2k views
Smartphone / GSM Sniffer
This question would be in the category of SmartPhone Sniffers.
So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
8
votes
3answers
373 views
How do researchers “gain control of an attacking PC” and not themselves be considered attackers / criminals?
In reference to this Network Computing Report article titled "'Operation Shady Rat' Perpetrated Five Years Of Long-Term Attacks On Government, Enterprises"
The Cliff's Notes to the article is thus: ...
5
votes
3answers
464 views
Where do I securely store the key for a system where the source is visible?
I have a customer with an Access database (ugh!) in which credit cards are stored in plaintext (yikes!), so amongst other changes I'm doing in the app, I'm applying some encryption in there.
I've ...
3
votes
1answer
287 views
Is there a viable open source antivirus for OS/X?
I am interested in finding an antivirus program for the Mac, but not one from Symantec, because I don't trust them.
I wonder if perhaps there is an open source solution for antivirus for OS/X?
Or ...
10
votes
1answer
296 views
What did Blackberry do wrong?
The NIST defines a vulnerability in RIM Blackberry encryption discovered last October.
Apparently, Blackberry's flavour of PBKDF2 was weak. They say:
The offline backup mechanism in Research In ...
5
votes
2answers
457 views
Security Manager job description
I work in a growing, family owned business. The company has 300 employees and has landed some big clients who require major policy changes in order to give us their continued business. Among those ...
3
votes
1answer
156 views
How can I assess the trust worthiness of a browser add-on?
Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing.
...
3
votes
1answer
480 views
Which encryption algo should be best for an Android application [duplicate]
Possible Duplicate:
Which type of encryption algorithms android supports, and which would be better?
I am confused about to use of DES. Triple DES, RSA and AES algorithms, I think I ...
11
votes
2answers
322 views
Network policies under AppArmor/SELinux
I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor.
I see that both SELinux and AppArmor allow the selected granting of socket level access ...
14
votes
3answers
3k views
Convergence - an SSL replacement?
Today, Moxie Marlinspike, a security researcher famous for his research on Android and SSL and related protocols (author of sslstrip/sslsniff), released "Convergence" which says is "an agile ...
4
votes
3answers
656 views
Is it necessary to encrypt an ASP.NET view state hidden field when using SSL certificate?
If you have an SSL certificate for a web site, is it necessary to make the ViewState more difficult to decode. Without any extra development, it appears that ASP.NET encodes it as a base 64 string. ...
3
votes
2answers
1k views
Truecrypt hidden partition deleted original drive data
Help! I created a hidden partition within a harddrive encrypted using truecrypt, and instead of creating a second partition, it seems to have deleted all of my data instead. what did i do wrong? I ...
