4
votes
3answers
975 views

Can email be encrypted before it reaches the mail server? If not, is there something that would allow something like this that's being worked on?

I was thinking about hosting my own email (own email server) instead of using Gmail. But then I realized I could never host my email on a server where I'm also hosting Wordpress. That is because I ...
2
votes
3answers
275 views

Boot or reboot to clean state on Windows each time?

I use virtual box to securely surf the web, but it's easy to get lazy and use the same image more than once. Currently, I have a golden Win 7 image that I built and loaded my required software. I ...
2
votes
2answers
2k views

Strongest cryptographic algorithm available in PHP 5.3

Which options are available in the default installation and which ones by third-parties like extensions or frameworks? P.S. By Cryptography I mean algorithms which could be decrypted, not one-way ...
5
votes
2answers
630 views

Security of NoSQL databases

Hopefully this isn't too broad. I've got little experience with NoSQL databases, but I know that they are rising in popularity. As a developer that is extremely concerned with security, I'm ...
2
votes
3answers
480 views

How can I protect my browser from being compromised?

In enterprise environments, I have found great benefit to use binary white-listing, web security gateway and end-point AV to help protect the end-user/system. Unfortunately, I still see the browsers ...
2
votes
2answers
186 views

Why CAs instead of global fingerprint database?

Why do we use "too big to fail" CAs and the chain of trust instead of a global fingerprint database in a similar vein to how ssh works?
2
votes
1answer
481 views

Reverse shell attack and proxy interceptions.. . is there anything worng?

First I've got a few questions about Reverse shell. REVERSE SHELL I'm trying to understand the Reverse shell technique. My reasoning is as follows (I'd be glad if you could point out any mistake ...
2
votes
2answers
629 views

Best way to secure Wi-Fi Direct connection

I have setup WiFi Direct connection between two Android devices by using Wi-Fi Protected Setup (WPS) "push button" for authentication.I also want to secure the connection itself by securing the data ...
3
votes
3answers
406 views

Physical access: in-scope for penetration testing or not?

When pentesting a network, should a pentester consider physical access to devices (e.g. allow use of a USB stick)? Or is this out of scope?
0
votes
1answer
166 views

Anonymous access over SSL

I am using a paid VPN service and I just realized IP privacy does not exist at all when the connection is made over SSL. If I Google "what is my ip" using the HTTP version of Google, it will give me ...
12
votes
3answers
448 views

What does a HTML filter need to do, to protect against SVG attacks?

I recently learned that SVG (Scalable Vector Graphics) images introduce a number of opportunities for subtle attacks on the web. (See paper below.) While SVG images may look like an image, the file ...
4
votes
1answer
323 views

Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat)

I read the open source multifactor authentication techniques called HOTP RFC 4226 and TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this ...
3
votes
2answers
223 views

Backup server categorization in the Open PCI Scoping Toolkit

How are backup servers which host a copy of cardholder data supposed to be categorized according to the Open PCI Scoping Toolkit, given that the backup and storage guidelines from the PCI standards ...
3
votes
1answer
402 views

Burp proxy between non proxy aware device

I want to intercept traffic between a Ethernet connected device, which is not proxy aware and modify/inject javascript. Conventionally when testing webapps I would use burp. Can burp sit on my ...
11
votes
3answers
6k views

Is bcrypt better than scrypt [duplicate]

Possible Duplicate: Do any security experts recommend bcrypt for password storage? I'm no security expert and do not pretend to be that's why I'm asking here. I write many PHP based ...
4
votes
1answer
133 views

Share or not share public key for servers?

In order to encrypt communications from our (custom) client to our (custom) servers our current scheme is a bit like this: Client uses the bundled public key A to encrypt some random key material. ...
4
votes
1answer
381 views

ROP Exploitation on ARM

I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture. Are there any tools, such as mona.py ...
3
votes
2answers
794 views

OS Fingerprinting for Android

Are traditional OS-fingerprinting techniques effective in identifying Android smartphones (OS version) on a network. From my research I found most Android network mappers can be only run from Android ...
3
votes
2answers
117 views

Should the serial number of multi factor devices be removed?

I'm trying to understand the relationship between the serial number of a multi factor device and the cryptographic material behind it. I don't want to blindly assume that the serial number is just ...
3
votes
2answers
364 views

How was pentest performed in the era with no frameworks like Metasploit?

I have been interested in security lately, I have been reading mainly cookbooks on Metasploit framework, how social engineering has been employed exhaustively, I have started reading some IA-32 ...
5
votes
6answers
203 views

Is it useful to determine the name of the server software while doing a penetration test?

Getting the name of the server software through netcat or curl or any other method, is really useful? I mean, OS fingerprinting is useful in order to tailor an attack. For example with regard to OS ...
2
votes
5answers
478 views

OS fingerprinting: can I rely on the results?

Using nmap -O www.example.com I get: Running (JUST GUESSING): Microsoft Windows 7|2008 (90%) So I can say the target site is running Windows. Using xprobe2 -v www.example.com, I'm just astonished ...
3
votes
1answer
339 views

What are the best practices for RSA-based security?

I'm building a platform with a strong security. Security is based on encrypting data with AES-256 encryption. Yet the system needs to "share" these keys among the users and they need to be transferred ...
1
vote
1answer
127 views

Client vs Server security for business critical application (crossplatform)

We have the option to develop a software either based on Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
2
votes
2answers
2k views

should i use urandom or openssl_random_pseudo_bytes?

I am developing a site in php 5.4 and i was wondering which is better to use to gen a random salt for password security? $salt = sha1(openssl_random_pseudo_bytes(23)); or $seed = ''; $a = ...
8
votes
5answers
426 views

E-mail can be made to appear like it came from a big organization?

I know almost nothing about security. So, please bear with me if the questions sound silly. Is it possible for a malicious person to make an e-mail appear as if it came from a big company like ...
1
vote
2answers
317 views

Where does mutation engine resides in Metamorphic \polymorphic viruses?

I was reading about Metamorphic & polymorphic viruses .. to what i understood ; they both uses mutation engines to avoid detection by anti-viruses, as the polymorphic encrypts\decrypts its code ...
1
vote
3answers
1k views

Using Netcat to detect the webserver type

In order to know which server a site is running I can use netcat. Through the following command I can gather information about the type of server installed. netcat -vv www.example.com 80 But if ...
1
vote
1answer
134 views

Would it be possible to extract user agent strings from 3G/4G Data

At a location where 3G/4G Data is prohibited, would it be practically possible to extract user agent strings from 3G/4G Data and compared to a list of known mobile browsers, assuming that the correct ...
6
votes
3answers
408 views

Can I develop SSH-based tools within United States?

It is well known that development of open-source cryptographic tools is very problematic within the United States: all open-source ssh-based software was specifically developed outside of the US of A ...
2
votes
1answer
1k views

Is there any way to list the contents of the iPhone/OSX Keychain and their security level?

I have a few apps that I purchased from the app store that probably store information in my keychain on OSX and on the iPhone. Since it's possible for keychain items to be bound to a device (and ...
12
votes
2answers
16k views

Security comparsion of 3DES and AES

Which one is more secure and least possible to be broken through cryptanalysis AES or 3DES (no matter performance)? I need to use encryption for my projects to store and secure sensitive information ...
2
votes
2answers
355 views

Test Android Secure Encrypted Traffic

For testing android traffic encryption I have configured a VPN client in my phone. What simple test I can perform in my home wifi network to verify that the traffic is really encrypted and secure?
1
vote
2answers
494 views

How do I holistically protect a web service from network and MITM attacks?

I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...
1
vote
3answers
217 views

Any one know about UDP traffic on source port 26221?

On my captured network traffic i observe a flow having a source udp port of 26221 and have different destination udp ports. Some of these destination ports were standards IANA ports. The average ...
1
vote
1answer
301 views

Macbook pro, rootkithunter

I've never really tried to understand rootkit enough, I'm too much paranoid... I recently reinstalled mountain lion, but my EFI might be infected. I have a macbook pro, it was really slow at some ...
1
vote
6answers
326 views

Secure internet access while traveling

Given the risks of shared wi-fi as stated here, here and here, I would like to ask what are good practices for someone who is always traveling. While having your own wi-fi with a strong WPA2 password ...
0
votes
2answers
441 views

What are RealVNC 5.0 Authentication Protocol Security Limitations?

In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc ...
2
votes
1answer
2k views

Is it secure to install RSA SecurID Software Tokens on the same computer that will be used to access the VPN?

My office switched from using the old hardware RSA SecurID key tokens to the RSA SecurID Software Tokens and most users have them installed on the same machines they use to access the VPN. I asked ...
7
votes
7answers
237 views

Proving running code on a website is unchanged

Can it be proved to the user that the running code behind a website with security related code is the same as published? I'm currently looking at a few new project ideas and one involves secure ...
0
votes
1answer
114 views

Can IE be made to imitate the behavior of Chrome's KeyGen element?

Is there any way I can repurpose existing ActiveX controls or functionality to get IE to work with the KeyGen element? Assistance getting Safari to work with this optional HTML5 spec would be ...
2
votes
1answer
178 views

unix malicious scripts/ksh execution

I'm wondering whether my architecture poses a security risk. Details: The whole website is not ROOT owned but still, the APACHE user used instead has some pretty advanced permissions. I have a ...
1
vote
3answers
1k views

Do client certificates provide protection against MITM?

I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
1
vote
2answers
645 views

Self-signed certificates usage for code signing purposes

if a self-signed certificate is trusted by the client's certificate store, then it should be fine to be used, since the client trusts the issuer of the certificate as it does any other trusted CA ...
8
votes
2answers
784 views

Is Data Remanence a Myth? [duplicate]

Possible Duplicate: Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once? Multiple overwrites have often been discussed as a secure way of ...
1
vote
3answers
12k views

Multiple running instances of rundll32.exe

I've noticed that in the Task Manager of Windows 7, I have multiple running instances (2) of rundll32.exe. Does this necessarily means that my machine is infected by a malware as noted here: ...
-4
votes
1answer
647 views

Best free website vulnerability scanners [closed]

I need to check web security and vulnerability in my web application. Whatever free vulnerability scanners application or vulnerability scan online site's are available?
1
vote
1answer
405 views

How does the YubiKey Validation Server work from an encryption perspective?

Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at ...
4
votes
5answers
3k views

Track lost Android phone, if the thief is using it to access internet

I had a Samsung Galaxy S3, which got stolen recently but didn't have any built-in tracking software. But since the theft my friends often see 'me' on many online mobile chat applications. I conclude ...
3
votes
2answers
585 views

Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password

I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects. I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...

15 30 50 per page