9
votes
1answer
697 views

Why do attackers bother (trivially) obfuscating their source code?

A friend of mine recently discovered and sent me a small collection of trojan php scripts that were uploaded to his machine. Here's an example: ...
3
votes
2answers
198 views

Protect sensitive data from sysadmin prying eyes

I'm thinking about this problem. What if I have to manage sensitive data (i.e. health data), and I use a managed server? I'd use encryption of course, but if they have root access they can see conf ...
2
votes
2answers
578 views

How to add safety to login page

I am making a website where users need to log in to use all the functions. The login form is placed on the landing page, but the actual login goes through a second page, login.php. If a user types ...
4
votes
3answers
330 views

Are there any regulations against financial companies storing passwords in plaintext?

A bank that I use stores my password in cleartext or perhaps using reverisible encryption, which is just as bad. I know this because when you click "Forgot your password?" (or similar) link, it ...
9
votes
2answers
2k views

With PBKDF2, what is an optimal Hash size in bytes? What about the size of the salt?

When creating a hash with PBKDF2, it allows the developer to choose the size of the hash. Is longer always better? Also, what about the size of the random salt? Should that be the same size as the ...
-3
votes
2answers
327 views

How is banking softwares used over the internet [closed]

I'm developing a banking software using php and that will be used over the internet. What are some of the security steps I should take in db design, programming, hosting...? thanks.
9
votes
4answers
903 views

How insecure are non-cryptographic random number generators?

I always hear that C rand() is not secure, but what how many calls would you need to know in order to predict the next value (or at least cut down the possibilities)? Would they have to be sequential? ...
1
vote
1answer
83 views

How to verify that a clientside-generated object is genuine?

I know that general best-practice states not to trust anything generated by the client. With that in mind, I want to write an HTML5 app that utilises the browser to generate various objects ...
50
votes
5answers
10k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
4
votes
2answers
345 views

How effective is changing the MAC address?

Since every vendor has a MAC address range, and Apple has network card models that only they use (Airport), I suppose that it is very easy to identify a network package as coming from an Apple device, ...
4
votes
2answers
4k views

Security Alert - Office File Validation - how to decide whether to proceed?

Recently, when opening a Microsoft Word document that came from a trusted source, I received the following warning message: The warning message is titled "Security Alert - Office File Validation". ...
1
vote
3answers
265 views

Logic for generating Strong Password?

I try to encrypt password using MD5 but there are decoders for MD5. So I'm worried about encryption of password for big website. Is there any logical suggestion or step function to generate strong ...
0
votes
1answer
200 views

Understanding CSRF vulnerability in Web Application?

I want to understand what is CSRF vulnerability. I use authorization system in my web application and found CSRF. What should we do to solve it? Actually I want to create simulation for this ...
0
votes
2answers
452 views

Issues with using a mail server that doesn't support authentication to send mail?

I have noticed the mail server we use at work (provided by our web-host) doesn't require any authentication to send mail through. I understand you easily spoof sender address' in emails, but I'm ...
4
votes
2answers
2k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
6
votes
2answers
175 views

HTTP daemon and Webroot permissions

We have a contracted web developer that uses deployment scripts to update and deploy web sites. In order for them to work they require write access to the whole webroot through the httpd user. I have ...
11
votes
3answers
2k views

Why are passwords limited to 16 characters?

What is the reason that most websites limit to 16 characters? I would have thought the longer the password the more difficult it makes it for someone to crack it? Is it something to do with hash ...
0
votes
1answer
401 views

Data Retention Laws for ISPs in North America

I was reading an article on TorrentFreak where Private Internet Access claims the United States "is one of the only countries without a mandatory data retention law." According to the linked article ...
8
votes
3answers
455 views

Is it safe to generate passwords online?

I usually generate strong passwords using various online tools. Some time ago I mentioned it to friend of mine and he looked at me as if my life was one big fail. Is it really so unsafe to generate ...
2
votes
1answer
521 views

Web application penetration testing resources? [duplicate]

Possible Duplicate: Best resources to learn web security attacks? I'm very interested in web application penetration testing. I went over every good Youtube video on that subject and most ...
10
votes
3answers
6k views

Possible to use both private key and password authentication for ssh login?

It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
2
votes
2answers
128 views

Any solution to passing a penetration test for an outdated php web application without upgrading the application?

A vulnerability list for my project's PHP version. The client would rather not upgrade the PHP version to the last version. Also, it's quite probable that some code will break after the switch from ...
0
votes
3answers
413 views

What is the most cost effective way to comply with PCI requirement 6.5, developer training?

We are a small company that is coming increasingly under pressure to be PCI complaint. Our main product is an API that move cardholder data between a customer and a supplier. I am in the process of ...
8
votes
2answers
3k views

What is a Yubi key and how does it work?

How do Yubi keys work? Are there any alternatives?
2
votes
3answers
243 views

Why would it be a good idea for someone to get or not to get a Yubi key [closed]

In what uses would it be smart to get a Yubi key?
0
votes
2answers
397 views

Anonymous proxy over SSL [closed]

Can you name any anonymous proxy software that don't use VPN connections? Basically, I'm analyzing different encrypted traffic and now I need to analyse a simple anonymity proxy traffic. I'm analyzing ...
5
votes
2answers
275 views

Can a HSM be used to make password hashing stronger?

Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
1
vote
1answer
687 views

on stack execution on windows 7 :: metasploit :: meterpreter :: executable crypter

I posted this on stackoverflow, was advised to move it to security section. I was writing an executable crypter as an exercise with goal of Antivirus evasion, now the problem is the final executable ...
4
votes
2answers
698 views

How to create an Apple Installer Package Signing Certificate

How can we create a certificate with the following Extended Key Usage extension using OpenSSL? Extended Key Usage extension, critical, with a purpose containing Developer ID Installer Package Code ...
1
vote
2answers
4k views

Encrypting string in javascript and decryption in java

I would like to know if someone know any library to do encryption in javascript and decryption in java. I have already tried many API, But getting not not getting same values in java. I want ...
2
votes
1answer
890 views

What are the methods to find hooked functions and APIs?

Many malware executables use hooking to be invisible. I am familiar with some hooking methods, I'm not sure what methods exist for detecting them. Is there a way to tell when a function call has been ...
6
votes
3answers
681 views

Computer decryption algorithms and knowing the solution

This is a general question about using computers to decrypt information. It has puzzled me for a while. The question is really two parts: How does a computer check if a "guessed" key is the correct ...
2
votes
0answers
76 views

Distinct databases with the same Kerberos Authentication server

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is ...
1
vote
2answers
133 views

Looking for a taxonomy of web attacks

I am working on semantic representation of firewall rules but could not find a good taxonomy of Web attacks in terms of HTTP protocol. I do find web attack classification i.e XSS attack, SQL attack.
1
vote
2answers
263 views

Custom font protection?

I have a custom characters that to most people it appears as chinese, arabic or just some random symbles, it is a simple way I make sure that my written notes are readable just by need. I have grown ...
7
votes
4answers
2k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
5
votes
2answers
460 views

Workarounds for :visited CSS History reconnaissance

Several years ago it was possible to use a:visited { background: url('/log.php'); } to figure out on what website user has been previously. But now it is restricted by browsers. Is there any ...
-1
votes
1answer
120 views

Would this be plausible for a metamorphic virus? Not repeatedly infecting same system

Would this be plausible for a metamorphic virus? When a new generation (for lack of better word) is created it would hard code a random file name, that would be checked to see if the system was ...
0
votes
3answers
294 views

Can a batch file download a file to infect a computer?

Is it possible to write a batch script that can download some code from the web and infect a computer? Can you explain it briefly?
3
votes
2answers
409 views

Signing data bigger than allowed RSA Block size?

I've enountered a small problem while implementing a modified version of the Station-to-Station protocol (STS). Say we have two principals A and B, where both of them knows the other's public key: ...
11
votes
8answers
11k views

Is it possible to Identify a VPN user by finding relations in traffic?

If I am using VPN service to protect my identity, can my traffic be used to identify all my traffic? For example, if I am accessing two services: Some service A, where I do not leave any ...
14
votes
2answers
530 views

Is there a real possibility of getting malware by “drive-by”?

I know malware can be gotten by downloading and running stuff, but is there a real possibility of just viewing a webpage or clicking a link and getting one? Assuming using only Firefox / Chrome and ...
2
votes
2answers
1k views

What are the most common infection vectors for personal computers?

We have OWASP to tell us about common security vulnerabilities in webapps and such, but what are the most common infection vectors for personal computers? A few example vectors: Social engineering ...
-2
votes
2answers
250 views

How to secure passwords when site is opensource [duplicate]

Possible Duplicate: How to securely hash passwords? How can I store passwords to have them secure? Right now the site use md5 md5, I was thinking about sha1+salt but if the source code for ...
1
vote
3answers
4k views

windows firewall turns OFF automatically

It seems pretty weird but for some reason, the Windows 7 firewall turns off. After I turn the firewall on in the control panel, it seems that it turns itself off when I go back to the control after I ...
4
votes
3answers
1k views

How can I report PCI-DSS violations?

A large supermarket chain in the UK, are storing their passwords in plaintext. Apparently, Mastercard's security department are already involved. I'd like to report them for violating PCI-DSS, since ...
2
votes
2answers
136 views

Are these email captchas legitimate?

The last week, I've been getting this kind of emails to addresses that I don't use: Dear Sir, Madam, For security reasons and as part of our ongoing fight against spam, it is our policy not ...
3
votes
4answers
466 views

Is there any explanation (other than storing plaintext) for case-insensitive passwords?

I've come across a few organisations stating that passwords are case-insensitive. Obviously this is ridiculous, and a gigantic red flag from a security point of view. Is there any explanation for why ...
71
votes
11answers
7k views

“Username and/or Password Invalid” - Why do websites show this kind of message instead of informing the user which one was wrong?

Lets say a user is logging into a typical site, entering their username and password, and they mistype one of their inputs. I have noticed that most, if not all, sites show the same message (something ...
4
votes
4answers
328 views

Is it secure to use similar password over different accounts?

I have a strong password which is a long, unfamiliar word phrase. I would like make other account use a password with similar level of complexity but I don't like to remember so many password over ...

15 30 50 per page