2
votes
1answer
463 views

How does signing work with Elliptic Curve Crypto?

So I have read up and have a decent understanding of how the crypto works with Elliptic Curve Cryptography. I also think I have an understanding of how signing works with things like Elliptic Curve ...
3
votes
3answers
228 views

Is blurring face secure?

I'm wondering how secure is to blur face in my photos? Is there any way to re-focus, or re-blur blurred object?
1
vote
2answers
126 views

Creating an application in which all user content is encrypted

Does any one have references or sources on how to approach developing a web application in which the content is encrypted and unreadable for the developers or company owners; I'm referring to content ...
-1
votes
1answer
77 views

Protocols equivalent to TLS? [closed]

Are there any protocols equivalent to TLS that are widely used, or the TLS is the most, worldwide used protocol to secure almost all the traffic available in the network?
0
votes
1answer
73 views

How do I make my drive fullly protected with bitlocker?

I am new to bitlocker but I want to start using it. I set it up my c drive and now I think that my drive is secure however, I came across these two pages, ...
2
votes
2answers
189 views

Is my PC safe? need help

About 6 days ago my parents who aren't great with PCs got phished on gmail, and the account started spreading spam. It had been hacked on an Argentinian IP, and then logged in from IMAP and SMTP from ...
0
votes
1answer
119 views

How can I set up a secure virus laboratory? [duplicate]

I've been playing around with virtual operating systems for some time and began wondering: would it be possible to set up a virus laboratory in a virtual machine? If not, are there other ways that do ...
2
votes
1answer
182 views

Is this a bot fishing for security vulnerabilities on my site?

I am running a webpage for my family with a feature to track users and guests. Since its all just family stuff no one ever visits this server, and I hardly see more than 2-3 of us logged on at the ...
2
votes
3answers
118 views

Can viruses be transfered across incompatible architectures?

I am needing to run scans from one computer/laptop/device to another computer in a protected system. I am worried that plugging in my scanning computer to the protected computer might cause some risk ...
1
vote
2answers
284 views

Hundreds of legitimate IPs are hitting my website like bots [closed]

I'm having a huge problem with my website due to a weird spike on hits. Today, i'm getting several hundred hits. Normally, i get a lot less, and they are from me country. Today's hits are from every ...
3
votes
3answers
3k views

What are some cards that are vulnerable to RFID theft?

I heard that some credit cards are vulnerable to RFID scanning and thus identity theft. I am concerned about my cards and I would like to learn which cards are vulnerable to such abuse? Are any of ...
0
votes
1answer
88 views

Is installing malicious add-ons via drive-by attacks the only way to add new toolbars to browsers?

Some attacks on web browsers consist in installing new toolbars on the browser of the user (which is just a small aspect of browser-hijacking. My question: is installing (malicious) add-ons (via ...
0
votes
0answers
80 views

Private data encryption in database in case there is no password

I am currently investigating the architecture of the secure, but user friendly service, which combines storing of sensitive private data together with simple authorization procedure. The approach ...
0
votes
1answer
170 views

How to turn of telnet and FTP on Thomson 789vn router? [closed]

I have run a port scan against a Thomson 789vn router and have noticed to my surprise that its HTTP as well as telnet and FTP ports are open. How can one turn off telnet (also FTP) using the router's ...
1
vote
2answers
312 views

Nmap stealth scan shows that port is filtered

The title is really bad, but I was able to find better. I have installed Debian on VMware, and set iptables to block any traffic except port 80 (inbound and outbound). When I run a nmap scan it shows ...
1
vote
1answer
92 views

TPM support with OpenSSL FIPS Object Module

How to use TPM chip along with OpenSSL FIPS Object Module without modifying OpenSSL FIPS Object Module (to avoid Private Label certification)? Should we add an engine interface in OpenSSL module as ...
0
votes
1answer
145 views

How can a browser hijacking attack change the browser's default homepage?

Some attacks on web browsers consist simply of advertising, so the default homepage of the browser is changed (which is just a small aspect of browser-hijacking). My question: is installing ...
1
vote
1answer
191 views

Advice on using encryption and hashing

I'm going to rephrase a question I asked earlier, as I don't think anyone understood what I meant. Bascially I'm writting a web based password locker, which can have multiple accounts; so that users ...
4
votes
1answer
167 views

DMZ Firewall settings

I am involved in project where I have to install a new server for a new application to a preexisting production network. The new server shall sit in the DMZ and two controllers will sit on the ...
3
votes
1answer
1k views

find passphrase on encrypted ssh private key

I have an openssh encrypted private key. I don't remember the pass-phrase. I may be able to suggest words or patterns that may be in the phrase. I am looking for software that will help me recover ...
0
votes
2answers
183 views

Securing a Windows PC

Currently I have an "Antivirus" and Anti Malware software installed. In addition I closed all remote assistance and unused port rules on my firewall. I'd really like to get a complete as possible ...
0
votes
1answer
207 views

Save to setup localhost.example.com to test wildcard SSL?

I have a domain with a wildcard SSL certificate (i.e. "*.example.com"). I also develop using WAMP setups, which I would like to be able to test HTTPS on. There are several tutorials on how to setup a ...
0
votes
1answer
38 views

How VIP card helps in verification? [duplicate]

How does the 6 digit randomly generated security code from (disconnected) Verisign Identity Protection card help in verification/validation of any user? Why one cannot enter any random 6 digit ...
1
vote
1answer
99 views

Using encryption and hashing

I'm writing a project to securely store and share passwords between users, I've been doing tons of research into encryption algorithms, CSPRNGs, hashing algorithms, key stretching etc... I just want ...
0
votes
2answers
101 views

trying to xss a site [closed]

http://XXX/?subscribe_message=%3Cscript%3Ealert(/zzz/);%3C/script%3E Why doesn't that popup with a /zzz/ alert? When I do javascript:alert(/zzz/); in the address bar it does so why not when I do it ...
2
votes
2answers
185 views

Securing a Shuffle Algorithm

After reading about writing a secure shuffle algorithm, I realized that my module that generates a password is only as strong as my PRNG, which in this case is Math.random(). I'm confused as to how to ...
3
votes
2answers
125 views

Isn't this the same as using a certification authority?

Taken from Wikipedia, here is the pretext to my question: A certificate authority (CA) is an organization that stores public keys and their owners and every party in a communication trusts this ...
0
votes
2answers
69 views

how does tor protect data packets? [duplicate]

When you're using tor can't the third parties copy all the data that's going back to your device and decrypt it later, let's say I downloaded some doc files, the data has to come back to your device ...
0
votes
1answer
91 views

Prevalence of offshoring in the Information Security Industry? [closed]

After having been a regular code monkey in the US for 6 years now with readily offshoreable skills, I feel like I am fighting an uphill battle against third world wages. While I am not prepared for a ...
0
votes
1answer
56 views

Is it possible to detect IDS name and version

the title said it. Is it possible to detect IDS name and version. If server use Snort as IDS, would I be able to detect it from external PC? And if it's possible how?
1
vote
4answers
146 views

Data anonymization/ encryption requirement

I did check out the previous postings and didnt find what I was looking for- apologies if this is a repetition. I am working on an analytics engagement for a customer and he needs to share access to ...
1
vote
1answer
138 views

Is code-signing with a non-ssl timestamp unsafe?

Assuming your code-signing tool is secure (e.g., does not suffer from buffer overflow exploits and the like), is there any reason to be concerned if a time-stamping service is not running over SSL? ...
0
votes
3answers
176 views

What is the technical rationale behind intermediary email servers?

EFF's Survelliance Self-Defense (SSD) project has an illustration of how email over SMTP goes through intermediate mail exchange servers: AFAIK each intermediate servers is expected to add its own ...
-1
votes
2answers
268 views

Can I be hacked through WiFi? [duplicate]

Can my computer be hacked through my WiFi connection? If so, how can I detect this? And what can they access or see? Emails, etc? Please respond in layman's terms, as I am not a computer pro.
1
vote
0answers
207 views

Mobile traffic sniffing using Cain

As far as I know - and please correct me if I'm wrong - Cain does not support WiFi cards. So if an attacker wants to perform ARP poisoning without being connected through Ethernet to the ...
1
vote
4answers
131 views

What to do with possibly infected files that need to be kept

I have retrieved some old pictures/videos (mp4, many types of avi) of some old events that I want to keep, the problem is that these files have been sitting in confirmed infected machine for a very ...
7
votes
1answer
487 views

Is it possible to implement a nonce without storage?

I am looking at implementing an authentication module using OAuth 2.0 Client and I am trying to avoid having any server state. I was going thorough a few other questions when to use nonce? Is it ...
0
votes
4answers
136 views

Temporarily suspending a Certificate Authority's Certiticate

The PKI RFC talks about revoking or suspending certificates. It also talks about revoking CA certs. However, I could not find anything about whether a CA or a Sub CA's certificates can be revoked or ...
-4
votes
1answer
74 views

Digitally sign all outbound data [closed]

I want to digitally sign all outbound data from my computer. Can someone suggest a way to do this programatically or using some tool? Instead of actually signing the data, I would simply append a ...
1
vote
2answers
266 views

Password database vs flat encrypted file [closed]

I am considering putting a forward a proposal to use a password database/manager instead of a flat (PGP) encrypted file for managed passwords for our team to access. I would like to hear some ...
3
votes
1answer
178 views

How to detect if a user is logged in to a specific website?

I just learn about tabnabbing. Tabnabbing is a computer exploit and phishing attack, which persuades users to submit their login details and passwords to popular websites by impersonating ...
1
vote
3answers
173 views

Perform XSS on a link where image path is passed in querystring

I have a page on my website like this : domain.com?img=test.jpeg And on the page, the javascript written is: var imgPath = getQuerystring('img'); $("#img").attr('src','/Images/' + imgPath); I was ...
0
votes
1answer
250 views

How can spoofing a certain MAC address enable sending probe requests that I was never connected to?

I was wondering how could my computer that uses a spoofed MAC address be sending probe requests for APs that I was never connected to? Note: The other computer with the original MAC address I was ...
5
votes
1answer
2k views

How can the OpenSSL CCS Injection vulnerability (CVE-2014-0224) be exploited?

Just curious how this one works in practice and if it's as much of a risk as has been made out? It says you actively require a MiTM scenario, which is understandable, but then what are the steps to ...
1
vote
4answers
150 views

What to do after a co-worker has been phished?

One of our co-workers followed a phishing link and entered their Google for Business account credentials. We have reset their password, is there anything else we need to do? (We also used this as a ...
3
votes
2answers
2k views

Hiding and faking my location?

I read this: Reveal the True IP of a User I am using Hola Unblocker to hide my IP address. This appears to work when I go to netflix as the site treats me as a US resident (which I am not). This ...
0
votes
2answers
329 views

Clarifying MITM attacks and Digital Certificate requirement

We are running a Portal application for our client with Payment Gateway integrated. Payment gateway uses SSL as it is suppose to be . The concern for me is that our Portal application does not use ...
0
votes
1answer
527 views

SElinux security context public_content_t for vsftpd

My understanding of SElinux context public_content_t is as public_content_t is required for files shared via a FTP server unless associated with a user home directory Here is my question Does user ...
0
votes
2answers
325 views

website hacked - phishing form

My Drupal 7.28 site has been hacked through the the tmp dir which was not protected by .htaccess file. The hacker managed to delete the main .htaccess file and upload some bogus google docs 2014 ...
0
votes
1answer
159 views

benefits of xinetd for a web server

What are the pros and cons of using xinetd for a web server running on a VPS. Assume the following measures have already been taken to secure the system: system hardening, latest updates, minimal ...

15 30 50 per page