1
vote
1answer
100 views

My boss knew I had put a file onto a memory stick? [closed]

The office I work for sent a email to me by accident; it contained an Excel spreadsheet that showed I was being treated illegally. I put it on a memory stick for my own future in case I needed to take ...
2
votes
1answer
39 views

Security of https website which resolves to local ISP (ex. twitter)

Recently I noticied that some of social networks (ex. twitter) domains points to an IP in my local ISP. (ping twitter.com resolved to local ip: 3.4.5.6-static.bad-government-isp.com). Note: now ...
1
vote
0answers
59 views

problem blocking TCP scans by setting up honeyd in virtual environment

I am creating a virtual environment where I have created three virtual machines, CentOS as an Apache Webserver CentOs as an Attacker machine FreeBSD with Honeyd to setup Honeypot I have ...
4
votes
1answer
114 views

When using VeraCrypt, can't someone just tell I have a hidden container by sheer file size?

I've just read that with VeraCrypt it is impossible to determine whether there are hidden files or not. Sure, the rest could be free disk space. But couldn't a nasty coercing person that is scornful ...
0
votes
1answer
126 views

Multiple hidden volumes (VeraCrypt)? [closed]

Why doesn't VeraCrypt support having more than one inner volume, each having its own password. It seems to me that someone could always use extortion to reveal the inner container password in addition ...
2
votes
2answers
158 views

number of ciphertext-plaintext pairs needed in double encryption

So I know in single encryption you would simply require at least 1 pair of plaintext-ciphertext, to carry out an exhaustive key search; you continue trying different keys until one is found that ...
1
vote
2answers
114 views

Why is finding a strong collision only half the work of a weak collision?

Regarding hash collisions, an attacker only has to do half of the work to find a collision when they can control both messages compared to when they are trying to find a weak collision. This can be ...
2
votes
1answer
95 views

Password cracking using a wordlist

I came across a test question that said "Given a random password, which type of mode typically produces fastest results?" and the two likely answers were "brute force" and "incremental". The ...
7
votes
3answers
955 views

How do virtual machines help security?

Can using a VM help to protect my passwords or other data? I'm asking this because I'm using a PC that others have access to, so there is possibly of some malware. I don't want to login to my web ...
-1
votes
1answer
86 views

Double encryption vs single encryption

So I understand that double encryption would do no more than possibly double the time taken to break a single encryption, as the key size of double encryption would be 2k-bits and the size of single ...
0
votes
1answer
61 views

Padding in CBC mode

Hi I have just started learning about ciphers and padding, and just wanted to know why is padding needed in CBC mode encryption, is it to get the blocks to all be of the same n-bit length? And why is ...
1
vote
1answer
431 views

Sent images on company WiFi network by accident [duplicate]

I know this was stupid, so I don't need to be told that...here goes: I was at work and thought I was on 4G network on my Android phone but after sending a number of nude pics via a social media app ...
0
votes
0answers
255 views

The pdf embedded exe generating error on the target machine when executed

These are the steps that I performed in order to generate a PDF embedded with exe. Attacker machine (Windows 7): msf > use windows/meterpreter/reverse_tcp msf payload(reverse_tcp) > set LHOST ...
2
votes
1answer
97 views

AuthentiCode Launcher runs everything

Imagine a vendor uses AuthentiCode only to get rid of the yellow UAC warnings. To avoid buying new certificates each year, the vendor could create a Launcher EXE which is signed, requests UAC ...
7
votes
2answers
311 views

Is it easier to crack a ZIP file than a 7z archived file given they have the same password?

I am interested in knowing if either of them is easier to crack than the other because of inherent flaws.
3
votes
1answer
287 views

Smartphone motherboard - Does it hold any data?

I recently went for a smartphone repair and got its motherboard replaced. However, it didn't occur to me to ask for the damaged motherboard back. I had confidential credentials and data stored. No ...
3
votes
1answer
716 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
1
vote
1answer
54 views

How to configure proxy settings of cellular internet for burp

I am pen testing an android app and using tethering to connect my phone to my laptop. I configured the access point settings as proxy = ipv4 address of my laptop and port = port on which burp is ...
2
votes
1answer
98 views

How do hackers get into servers? [closed]

I am a web developer. I've checked How does hacking work? and I know all of the things described in the most upvoted post. However, I can't understand how do hackers get into servers when the website ...
1
vote
0answers
159 views

Whole disk encryption on a tablet (that has no pre-boot keyboard) [closed]

I am researching methods to encrypt whole disk on tablet. I would like to encrypt my tablet that comes with Dual Boot OS, with pre-installed Windows 10 Home and Android 5.1. Let's start with what ...
8
votes
3answers
325 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of one-...
1
vote
2answers
224 views

How to find the ip address of a wifi router while I have it's MAC address?

I have a wifi scanner which shows me the MAC addresses of the wifi routers nearby. It displays SSIDs in one column and MAC addresses in another column. I want to know the ip address of the router. ...
1
vote
3answers
2k views

The difference between risk assessment and risk analysis [duplicate]

I am a little confused about the difference between the risk assessment and risk analysis. Many people argued to conduct risk assessment during the requirement phase and risk analysis during the ...
-1
votes
1answer
896 views

What is the difference between X-Received and Received in email-header? [closed]

Also how to calculate delay between sent and received?
3
votes
2answers
76 views

Would using a password already hashed+salted be secure?

Some basic principles of password security: Hash it and use a salt The people storing the password should never be able to see what the password is, just the hash This hash should be difficult to ...
1
vote
2answers
119 views

Protocol for secure communication over HTTP

Inspired by this hot question: Is there any reason to block HTTPS? Is there a way to setup an own server and encrypt all normal requests in the request body? So for an outside person it would look ...
1
vote
2answers
101 views

Dovecot TLS connection handshake ChangeCipherSpec

I added a virtual domain to our mail server today then did a check of the Dovecot TLS connection security. The test was done from a remote host using Thunderbird. I captured the connection with ...
-2
votes
1answer
800 views

how does AES encryption's algorithm actually work?

can anyone actually explain in simple and plain terms, how does AES encryption algorithm works? i can guess that the only significant distinction between AES-128 and AES-256 is their key size and NOT ...
21
votes
3answers
2k views

Is there any reason to block HTTPS?

Within our local education's I.T system, all websites served via HTTPS are blocked, except a select few websites which are 'authorized'. This results in some websites being unable to function ...
1
vote
0answers
206 views

Random script injected in wordpress project [duplicate]

Recently a website in wordpress that is on a server of my customer appears with the script below randomly. Someone knows this pattern of virus/malware/exploit or something like this? <?php $...
1
vote
1answer
318 views

is it true that AES-128 and AES-256 are Quantum resistant?

is it true that with the rise of quantum computers, which is pretty close these days, AES 128 and 256 are resistant? while PGP and RSA are not?
4
votes
2answers
476 views

Stopping webpage compromise by preventing frame-busting

My website offers rich content to users. I often subscribe to third party vendors whose content I embed in my pages. How can I safely embed external domain's content on my webpage in an iframe without ...
6
votes
1answer
164 views

Domain redirecting to my site without permission

I noticed that a domain that I don't own or know has been redirected to my site without my permission and has been affecting my SEO. I was able to block some of it by adding the following to the ....
1
vote
1answer
57 views

Encrypted config file in VCS

The problem: I have a project with a config file for development and production. I want the production config file to live in VCS to make it easy to checkout a tag and build a particular version of ...
1
vote
1answer
130 views

Some questions about port-scans

I have two questions and it seems like this website is the perfect place to ask them. I read a post earlier concerning port scans and one of the answers stated something along the lines of: "There ...
2
votes
1answer
128 views

Generating Own SSL certificate using DSC issued by a CA

Ok. So, here is what I know: SSL Certificate are used to verify domain for HTTPS protocol. These are issued by a root CA to ensure that it can be trusted by anyone using the website and trusting the ...
2
votes
1answer
42 views

What is the point of sending an email informing a possible break in to the same account?

There are several email services, including Gmail that for some time now sends an email informing that someone logged in from a different device. An attacker, logging into that account would also ...
22
votes
3answers
5k views

Let's Encrypt for intranet websites?

Many companies have intranet websites that are not reachable via the internet. Usually they just use a self-signed certificate, which causes a bad habit for the users since they get used to just ...
3
votes
1answer
130 views

Is it ok from the viewpoint of PCI DSS to send credit card info to my own server which then directly sends it to PayPal?

Currently I'm developing an iOS application which has an option to pay an order (clothes cleaning) via scanning credit card info using device camera. I can't use Apple In-App Purchases (IAP) for this, ...
2
votes
3answers
134 views

Gathering network device data for security detection purposes

I've finally gotten the networking team to start sharing data on the devices they manage (routers, firewalls, VPN, NAC, etc), so we can get better insight into our network and focus more on detection. ...
8
votes
1answer
403 views

Can ICMP Redirects still be used to redirect traffic in a LAN?

I tried just tried to migrate a MITM attack using hping3 with ICMP Redirects in my testlab. hping3 -I eth0 -C 5 -K 1 -a 192.168.2.1 --icmp-ipdst 192.168.2.15 --icmp-gw 192.168.2.100 --icmp-ipsrc 192....
0
votes
1answer
116 views

What is the difference between FTP Brute force with hydra and Metasploit? [closed]

What is the difference between FTP Brute force with hydra and and FTP brute force with Metasploit ?
6
votes
3answers
790 views

HSTS on sites available over HTTP and HTTPS

I'm wondering if it makes sense to enable HSTS on a site that is served over HTTPS as well as over HTTP. What I mean is to add HSTS-Header if the site is accessed over HTTPS. But there is no ...
5
votes
1answer
174 views

Connecting via SPNEGO/Kerberos out from domain

Is it possible to authenticate to SPNEGO/Kerberos server in domain A with an account from the same domain (obviously) when the client is connecting from computer in one of the following (quite similar)...
2
votes
2answers
210 views

Router reboots when using Nmap

I hope this question is OK to ask here. When I scan a external IP-address with Nmap my router always reboots itself, sometimes I even have to manually restart it by using the power switch. The ...
8
votes
1answer
205 views

How to check if iCloud password popup is legitimate?

I was away from the computer when this popup appeared and I've no idea what triggered it. How do I know if it's legitimate popup from App Store or a phishing attempt by some malware? Back in my ...
6
votes
1answer
128 views

Issues/Vulnerabilities that TPM 2.0 aims to enhance/solve comparing to TPM 1.2

I have read some documents that comparing TPM 1.2 and TPM 2.0 (e.g. more supported algorithms like SHA-2, reduced code size, or even symmetric keys seems added, etc.) I want to ask that what are the ...
2
votes
2answers
241 views

Strange requests to my server

I recently checked my logs and found some strange requests to my server. eg GET /path/Microsoft.XMLHTTP HTTP/1.0 GET /path2/Scripting.FileSystemObject HTTP/1.0 A further check seems to point to ...
1
vote
1answer
40 views

If You Use Secure Sites with Extended Validation Certificates How Much Do You Still Have To Worry About Phishing Sites Impersonating Them?

Was mulling over the issue of protecting users from password-stealing phishing sites when an interesting question that hadn't occurred to me before popped into my head: Let's say that I decide to ...
1
vote
2answers
104 views

What would typically be considered an acceptable string entropy for passwords?

I have gained interest in creating a way to check password strength (think password strength meters - yes - another one). I've found many ways to award a score on a policy driven approach (one capital,...

15 30 50 per page