3
votes
1answer
212 views

Remove CA from trusted CAs list while trusting it older certifications

Lets say that some certificate authority changed her security policy and we don't trust her new certifications. Is there any convenient way for an organization to remove this certificate authority ...
3
votes
1answer
5k views

What needs to be encrypted for FIPS 140-2 compliance?

We're developing a Client/Server C# .NET application that needs to be FIPS compliant.Im reading a lot about FIPS online, but am having a bit of difficulty determining the difference between the ...
0
votes
1answer
525 views

Preferred access list (WPA2 rogue AP)

For the following scenario in which victim has a WIFI access point at home (AP-HOME) through which he surfs the net and a client (CLI1) connected to "AP-HOME" via WPA2. The victim also has "FREE-AP" ...
0
votes
1answer
77 views

Level of Data Security in iOS [closed]

How secure is the data stored on iOS devices, specifically app data like notes, pictures, etc.? Are there any ways to make it more secure?
2
votes
4answers
198 views

New gTLDs are coming. How will browsers handle cookies, SOP and certificates?

Given that the security "zone" varies based on the TLD, how will the new TLS be handled? For example: A browser may permit cookies to be shared and SSL certificates, and wildcard certificates ...
0
votes
3answers
276 views

Need references about why public access to a password hash and salt is poor practice

What are some published industry standards about why revealing the password hash and salt are poor or bad practices from a security perspective? I am dealing with a vulnerability where anyone can ...
1
vote
2answers
150 views

Signed URL's as a security measure

Would implementing signed URL's be an effective security measure to prevent URL tampering and poisoning on public facing resources accessed via a GET request. e.g. ...
1
vote
1answer
244 views

Scan Source Code for Potential Viruses

If you are sent a program written by someone so that you have the complete source code, how would you go about scanning the source code for any potential viruses/malware? Note: While bugs and ...
0
votes
3answers
418 views

How can I protect my eCommerce site from stolen credit cards?

The case would be that someone with stolen credit card registers on my site, and uses the stolen credit card details to purchase services through my site. How can I protect my eCommerce site from ...
2
votes
3answers
173 views

Alternative to charging 2 small amounts for credit cards authentication?

Currently the client I'm working for charge 2 small amounts on adding credit card to authenticate credit card. After that they ask end-users to check the exact amounts on their monthly statements and ...
3
votes
1answer
131 views

How to reduce the size of a key established with Diffie-Hellman?

When I generate a key with the a Diffie Hellman method (DH), the established shared key will be of the same size as the prime which is used. As far as I have read this should be at least 2000 bits for ...
-1
votes
2answers
363 views

smartphone pentest framework [closed]

I have done some searching around Google to find out if there are any penetration testing frameworks like metasploit on Backtrack for computers and its applications Can any one help me to find such ...
11
votes
3answers
819 views

Is off-the-record style encryption possible with email?

The instant messaging world has off-the-record encryption - which means you get authentication, encryption, and forward deniability. Key material is published after a session ends such that an ...
5
votes
6answers
15k views

Is Windows BitLocker secure?

Naturally I feel that I have to ask this question, since it's a built-in feature in Windows. Let's say someone has physical access to my PC, is there an easy way for them to access a BitLocker ...
4
votes
1answer
2k views

Is it possible to execute a command on the local computer in meterpreter?

While running meterpreter handler, is it possible to execute a command on the local computer? That wasn't mentioned in the output of help command. I also tried !ls and to no avail. Is it possible ...
0
votes
1answer
231 views

Suspected of hacking Windows 7 SP1 [duplicate]

Hi.I have Microsoft Windows 7 SP1 on my PC. I have an Ubuntu OS near Windows OS. My internet connection has a proxy server from Iran that monitors our networking and filters some of our websites. ...
-1
votes
3answers
1k views

Is there a generic list of IT Risks that can be used as a reference to prepare an IT Risk Assessment report? [closed]

I am working on my first IT Risk Assessment assignment and even though I have the steps required and understanding of the system I am working on, I was wondering if there was a list of generic IT Risk ...
0
votes
1answer
456 views

My WIFI (with my own password) is connected to our office network. Is it secure? More details

Is there a possibility that they can see my browsing history, media transfers, Skype sessions and even FaceTime? Please tell me.
0
votes
2answers
201 views

Why do browsers leak their version info to the webserver?

The question surmises it all. If my firefox browser puts something like "..Gecko/xxyy Firefox/nn.mm.." in the USER_AGENT attribute, then from security point-of-view, isn't it an open invitation to the ...
0
votes
2answers
541 views

Is there a way to configure WPA2-PSK to provide Forward Secrecy?

Is there a way to secure an wireless connection against a decryption attack where the PSK is known (E.G. Airdecap-NG)? Is it possible to configure Forward Secrecy on 802.11 Wireless Connections?
0
votes
2answers
3k views

Tor via Python - can the real IP address leak?

I was thinking about how safe it really is to use Tor as a "local proxy" to grab information from webpages anonymously. Is it possible that the real IP address can be seen? On the official Tor ...
5
votes
7answers
1k views

Is PGP combined with a regular web-based email service secure?

With the disappearance of private email services like Lavabit and Tormail (http://www.dailydot.com/news/email-anonymous-hushmail-lavabit-nsa/) it seems that we will need to resort back to standard ...
0
votes
1answer
83 views

Why oauth use a secret with temporal credentials?

I am trying to understand oauth protocol. I am currently looking at temporal credentials section of the oauth 1.0 sepecification. I can't understand why the secret is needed along with the temporal ...
3
votes
8answers
2k views

Secure alternative to e-mail

After the announce that NSA conducts extensive metadata and traffic search on e-mail, it is clear that people looking for privacy and security would better abandon the system completely, since, by ...
1
vote
1answer
393 views

WAF testing frameworks

How to test the effectiveness of a Web Application Firewall (WAF), or any other security control that is put in place to protect the web application from being attacked? Currently, what are the ...
-4
votes
2answers
108 views

Analysing server (VPS) before hosting a government website [closed]

Hosting a government website would definitely increase reputation, but it would also bring higher chances of the hosting server getting attacked by DDoS attacks. It's a cPanel based VPS. What basic ...
2
votes
3answers
2k views

Javascript containing a long hexadecimal string and eval: is this suspicious?

At the bottom of the index.php file for a simple “contact us” form, I found the following (some whitespace and newlines added): try {if(window.document)--document.getElementById('12')} catch(qq) ...
1
vote
0answers
514 views

Decrypt “key” that is encrypted with LMK or TMK

New to HSM (Thales payshield 9000), I'm working on DUKPT algorithm. I manage to derive the IPEK(encrypted either under LMK or TMK), but I need to inject a plain text IPEK into an end point device. I ...
0
votes
2answers
660 views

How do i know if I have moved or copied a file from my SD card to PC? [closed]

is there any way to know if the file I have on my mini-SD card was moved or copied to my PC? i have sensitive files on my SD card which is stolen and i cant remember if I cut or copied the file from ...
10
votes
7answers
840 views

Cheating or service disruption by altering client-side code

A reasonably white-hatted hacker has demonstrated the ability to insert text of his own choosing into the communication between a java applet and a web based server. Not a simple MITM attack, but ...
1
vote
1answer
239 views

fail2ban and iptables

Should fail2ban be the master of iptables rules? For example, should I setup my firewall rules along side the fail2ban rules, or should I have all my services configured and managed by fail2ban? ...
2
votes
3answers
289 views

Is there any reason I shouldn't use SHA1 of salt + website name + master password for my password in websites?

I considered writing a program to do the above for websites I only intend to use for short-term use.
0
votes
2answers
137 views

General User Authorization Security

I am creating a website that needs user authorization. It is my first time creating a website to go live, and also my first time trying to do any form of authorization. The following is my plan, will ...
0
votes
2answers
193 views

A thought experiment about obfuscating the location of a smartphone when it is in use, is it possible? [closed]

I was thinking about how smartphones are very difficult to use in a way that does not transmit your location, with all the networks it has to connect to (and let's say a 'burner phone' is too ...
6
votes
3answers
11k views

Full Disk Encryption with GPT disk support

On my old computer I used Truecrypt full disk encryption. My old computer however was running Windows 7 with a standard MBR partition scheme. I recently got a new laptop with the fancy UEFI support. ...
2
votes
0answers
107 views

Shorewall stopped policies - routeback

Here goes a very specific question about the insides of Shorewall and Iptables in general. Shorewall supports configuration of "Stopped Policies" using the file routestopped, which defines the ...
15
votes
3answers
381 views

What expectation of privacy is there with US-based vendors with the LavaBit and SilentCircle shutdown?

Lavabit hosts a secure messaging service that was recently shut down. Likewise SilentCircle has preemptively done the same thing with their email-based service. It seems that the justification for ...
3
votes
3answers
329 views

Are local firewalls necessary

Is having local firewalls enabled on machines actually necessary if you run hardware based firewalls like pfsense or a netgear fvs338 and use that to control in/out bound connections? I personally do ...
4
votes
1answer
85 views

Is there any danger in the preview button in blogs?

In my Wordpress blog (though this may be true of other blogs too), there is a preview web page feature. So when I get a comment with a link, I can hover over the link, and it shows me a preview of ...
-2
votes
2answers
295 views

Parameterization strategy for hazardous character injection [closed]

I have a input text field for accepting Email ID. If Email ID is not entered by User, I have a client side validation using Java Script to display error message which reads like, "Please enter valid ...
2
votes
3answers
626 views

Top 10 dangerous mistakes in C programming? [closed]

What is the top dangerous mistakes in C programming? for example misusing a strcpy causes a stack-overflow and code injection. I'm looking for at least 10 bad programming pattern in C.
2
votes
2answers
1k views

Security behind the windows 8 eye

I use the Windows 8 operating system. Whenever I navigate to the login page of Internet Explorer 10, or even the login screen of the operating system, I see an eye symbol at the end of the password ...
1
vote
1answer
495 views

Openvpn in front of proxy? [closed]

I have been reading books on OpenVPN, and there is one thing I don't understand yet. What happens when a person connects to OpenVPN, and their web browser is set to a Socks5 or HTTP/HTTPS proxy and ...
3
votes
2answers
144 views

Deciding whether to sign someones key

How do i decide whether to sign someones PGP public key? I was looking at some contact pages and they have a request for people to sign their public key. How serious of a commitment is it to sign ...
-3
votes
3answers
4k views

Generating an unguesable token for confirmation e-mails

I'm generating a token to be used when clicking on the link in a verification e-mail. I plan on using uniqid() but the output will be predictable allowing an attacker to bypass the confirmation ...
2
votes
2answers
19k views

Access router if you don't know password

At home I have a wireless cisco router. Unfortunately I wasn't smart to change its ip or passwords. So anyone who is connected to it can access 192.168.0.1 and log in as admin using password admin and ...
1
vote
1answer
166 views

Incentives to Support Adoption of the Cybersecurity Framework

The US White House has just release the subject blog post link here which suggests adoption of this proposed new cyber insurance might be rewarded by liability limitations including "reduced tort ...
2
votes
2answers
1k views

How to secure an open wifi access point

I have seen tremendous amounts of guides on how to protect yourself when using a public wireless internet connection, but nothing about how to protect your public access point from malicious users. A ...
0
votes
1answer
618 views

Stack buffer overflow confusion

I am trying to dig deeper into the nuts and bolts a stack buffer overflow using the classical NOP-sled technique. Reading some articles and watching videos brought me to a confusion which can be ...
1
vote
3answers
228 views

Do obscure image URLs prevent image harvesting?

On a Web site which requires user login, and all content is viewable by any registered user, is there any point in making obscure image URLs like "1mh9cr2m78234bc23-32xy4723nxy12.jpg" to protect the ...

15 30 50 per page