-1
votes
1answer
764 views

Solutions to TCP FIN Host Sweep (Signature 3032)

The Intrusion Prevention System is giving me an attack with signature 3032, TCP FIN Host Sweep on one of the ip addresses. I need a solution or recommendation on how to avoid the TCP FIN Host Sweep.
0
votes
0answers
24 views

Secure delete with urandom? [duplicate]

What recovery techniques (if any) exist that can recover data from a mechanical HDD if the user has filled the disk with a single run of dd if=/dev/urandom of=/dev/[disk]? Or in other words: is this ...
3
votes
3answers
5k views

Can files deleted from a true crypt volume be recovered?

I have a True Crypt volume that's set as a file. When I mount the volume and delete a file within the container, windows asks if I'd like to send the file to the recycle bin. While the volume is ...
1
vote
3answers
4k views

Retrieve auto saved Skype password from Ubuntu 12.04 LTS

The email address I used to create Skype profile has been disabled and I can't get it back. Unfortunately, I don't remember the Skype password now. As the password is auto saved in my local machine I ...
9
votes
6answers
659 views

Is there multi-factor authentication for machines?

Most of what I have seen on mutiifactor authentication (eg wikipedia or here on se) seems human centric. Ie it is a human interacting with a machine and the factors are associated with authenticating ...
3
votes
3answers
1k views

Looking for feedback on my REST-style API authentication design and two-factor authentication

Authentication The authentication is going to be signature-based. The signature will be generated using: HMAC_SHA256(SHA1(secret_key) + '#' + request_data + '#' + utc_timestamp) The utc_timestamp ...
4
votes
4answers
5k views

How can I detect backdoors?

I have a machine running Mac OS X and I suspect there may be a backdoor installed. I know that I could take it to a professional security firm for analysis, or nuke it from orbit, but I'm interested ...
2
votes
3answers
146 views

State before getting whitelisted?

There is a data flow of incoming files (from untrusted, external sources), that get whitelisted by a kind of application layer firewall. Is there a common name for the state of the files before they ...
1
vote
0answers
47 views

Can double encryption with different key increase the security? [duplicate]

Encrypting the file using same encryption algorithm using different Keys can increase the security or not?
2
votes
5answers
1k views

Does the padlock on my browser really indicate a reasonable assurance against eavesdropping?

I know that there have been broken or weak SSL implementations. Do browsers actually have decent standards for what they'll accept and display "the padlock"? Furthermore, are there any practical ...
3
votes
2answers
2k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
0
votes
2answers
400 views

Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]

I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
0
votes
1answer
516 views

DDoS prevention (LOIC doesn't do the job anymore) [closed]

We are about to launch a important webservice. We must test it for DDoS. From other questions/answers here I learned about LOIC. Downloaded, tried, but my apache refuses it. What other ready made ...
3
votes
3answers
477 views

Proper Linux user authentication through PAM aware applications

Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. ...
3
votes
2answers
3k views

HTML encoding to protect against XSS

While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
2
votes
0answers
191 views

Snort Parallelization Techniques and its effect on DDOS detection capability

I want to ask a query about snort parallelization. 1) Can snort detection rate remains same for all attacks after parallelisation? 2) As the parallelisation of netowrk traffic in each core is based ...
3
votes
1answer
1k views

Are any Java Card 3.0 smart cards available?

The Java Card 3.0 specification (draft?) came out in 2008. It is now 2013. Are there any existing smart cards that actually implement the specification? How about USB tokens? The best I've found is ...
-1
votes
1answer
668 views

Can File Sharing being Controlled by Mac Address? [closed]

I am currently setting up secure environment between 2 pc in isolated network. Just wondering can we do file sharing based on that pc mac address instead of username? The environment is OEM Windows ...
5
votes
1answer
461 views

Is it safe to use public USB charging stations? [duplicate]

I'm beginning to see more and more public device charging stations — okay, they're still mostly in airports — that include USB outlets, not just regular power outlets. Are these safe to ...
3
votes
3answers
2k views

How to detect & prevent fake emails?

I hope This not same as this one E-mail can be made to appear like it came from a big organization? I'm not asking how to protect a brands & and large organizations (Google , yahoo, etc ..), ...
2
votes
2answers
801 views

New Undetected Virus?

I am having difficulty with my laptop right now. All of a sudden some partitions would contain a link to the previous contents of that partition. For example: Before: Partition T:\ ...
2
votes
1answer
3k views

how does a sip flood attack work?

I understand that SIP is an application-level protocol that is used to setup/modify/end communication sessions for things like VOIP and instant messenger. I also understand that users can send request ...
2
votes
1answer
143 views

What attacks are most likely against SSL/TLS web service sessionid?

I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
0
votes
1answer
110 views

Implementing secure login for an API

I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
3
votes
4answers
621 views

Temporary passwords e-mailed out as plain text

Is this a security issue? Many big ecommerce platform companies use this feature. Where if you forgot your password, they e-mail you a temp password. Could someone potentially figure out the ...
3
votes
1answer
1k views

What is the best practice for storing a secret on the cloud?

This post on Securing Java Application Data for Cloud Computing offers a good introduction to using a Java KeyStore for securing encrypted data in the cloud. It neglects, however, to answer the ...
1
vote
3answers
333 views

Is the aggregate severity rating of “Important” for MS13-027 too low?

The Security Bulletin states that the "Maximum Security Impact" is "Elevation of Privilege"; however, the SRD blog post says code execution is possible. Additionally, SRD says "Other software that ...
0
votes
1answer
141 views

Is this a secure method for authenticating clients?

I am working with several other people in writing software which requires authentication before it accesses resources. In order to authenticate, we devised the following strategy. Client sends a ...
8
votes
3answers
1k views

What is the next step of this file upload attack?

Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
1
vote
1answer
810 views

CSRF with OAuth or Bearer Authorization headers

I am designing a RESTful API which is to be accessible from a web browser. The API is protected by Basic authentication. I understand the concept of CSRF, and the mitigations proposed (I found both ...
3
votes
2answers
193 views

Wireless Security: PEAP

I was wondering if there are any known attacks against PEAP used in wireless authentication/authorization? I'm specifically looking for attacks that would allow: bypassing the authentication ...
2
votes
1answer
162 views

SSL certificates published in Mandiant's APT1 report

You probably heard about excellent report "APT1: Exposing One of China's Cyber Espionage Units" published by the Mandiant company (you can download it here). Report is great and I recommend it to ...
1
vote
2answers
247 views

What threats are posed by SSL connections?

I'm working on implementing an Exchange 2010 solutions which includes Outlook Web Access, Exchange ActiveSync and Outlook Anywhere. These services use SSL and would be presented on the Internet so our ...
2
votes
2answers
517 views

Does it make any difference of the order Hashing and Encrypting in terms of security?

I am implementing a password vault program with java. I have programmed a triple DES for encryption and a SHA256 for hashing. My question is would it make any difference if I first hash the raw data ...
-1
votes
1answer
136 views

Windows “Send to compressed file” creates an image? [closed]

One of my friends windows laptops (which I don't have access to right now) has in the recent past had a virus (where .doc files were converted to .exe files) which we dealt with. Now when she ...
3
votes
3answers
801 views

How to evaluate a password manager?

How can we quantify the trade-off between password aggregation and convenience? Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce ...
0
votes
2answers
167 views

how to find injected code in SQL

Recently one of my sites is hacked. The hacker used SQL injection to compromise the security. After getting SQL access he injected code in many places in database. I cleaned up many of them. But I am ...
5
votes
2answers
485 views

RC4 bias protection with padding in TLS

On the answer to my previous question about RC4 vulnerabilities in TLS, Thomas Pornin gave a great answer, in which he said: One way to "fix" RC4, which has been suggested many times, is to drop ...
2
votes
2answers
527 views

CSRF Login: can Attacker Login using valid credentials?

Considering this picture: taken from here:page21 Is this possible? If so, How to prevent it?
1
vote
2answers
158 views

Guarding against XSS when setting Cookies based on URI?

I have a web-site written in nginx.conf — http://mdoc.su/ — which essentially accepts two parameters, an operating system and a manual page name, and does a redirect to a different site based on the ...
1
vote
2answers
219 views

Is there any risk in posting “local info” to the Internet?

Previously when I posted a screenshot online, someone told me to erase out my usernames, computer names, domain names, etc: Is there actually a need to do so? A quick Google search shows that many ...
-1
votes
1answer
106 views

Bringing in an intern

When bringing in an intern to help you in the IT world and with access to servers and client information, what kind of forms should be signed, especially when they work remotely?
5
votes
3answers
699 views

Setting a limit on password recovery attempts

in a setting where one has forgotten their password, I'd like to be able to limit the attempts of entering in email addresses to something like 10. My first thought was to use a cookie. $attempts = ...
1
vote
1answer
457 views

Pointers for john the ripper rulesets

I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
7
votes
6answers
751 views

Are smartphones at least as safe as “regular” computers for personal data?

Like a lot of people, I pretty much run my life on the Web these days. I use online bill pay, I shop at Internet retailers, I keep in touch with friends electronically, &c. I'm pretty comfortable ...
1
vote
2answers
266 views

Statistics of attacks on unhardened Web Server

Suppose my web server is on the public internet. It's not behind firewall hardware. It does use HTTPS, and it has its OS firewall software turned on - but this is the only security mechanism in place. ...
2
votes
4answers
487 views

What is nuke it from orbit? [duplicate]

I was reading this Windows 2003 Enterprise infected by Conficker; post-infection problems continue And they talk about nuking it from orbit (which apparently means wiping out the system and starting ...
9
votes
1answer
671 views

List of methods in iOS that have been deprecated for security reasons?

Is anybody on the nets keeping track of iOS methods that have been deprecated by Apple for security reasons? I have searched around but with no luck. Going through all the deprecated methods and ...
21
votes
1answer
4k views

TLS: RC4 or not RC4?

I was reading another interesting article by Matthew Green today, saying that if you're using RC4 as your primary ciphersuite in SSL/TLS, now would be a great time to stop As far as I'm aware ...
0
votes
2answers
192 views

Where are the private keys stored in Persona/Browser ID?

I'm trying to understand where the private keys are stored in the Persona system, and how they are protected. Can anyone elaborate on where the crypto material is created, stored, and what is ...

15 30 50 per page