-3
votes
0answers
17 views

Which software can log All the files transafered to external storage (DVD & Flash Disk) [on hold]

I need a software that I can use it to log all the files that are being transferred from my computer to any external storage like DVD or Flash disk
-1
votes
0answers
30 views

Yahoo email origin syntaxes

I have several e-mails from a friend with the first (bottom-most) receive line in the general form of: Received: by 66.196.81.106; Tue, 10 Nov 2015 17:41:33 +0000 Date: Tue, 10 Nov 2015 17:41:30 +...
1
vote
1answer
18 views

Is it possible to lock down the http / https proxy settings on a Windows Phone?

Is there any way to lock down the proxy settings on a Windows Phone so that they can't be changed by anyone but the person with the password?
-2
votes
4answers
59 views

How is the private key kept secret in digital signatures?

A digital signature is verified using an algorithm that takes three inputs: the message, the digital signature (message encrypted with private key)* and the public key. If the public key is used to ...
1
vote
3answers
38 views

Can nmap take a list of ports to scan from a file?

Nmap can take a file containing a list of hosts to scan using the -iL flag. Is there similar functionality for a file containing a list of port numbers? I've scoured the man page, online docs at nmap....
0
votes
1answer
52 views

Is HTTP POST insecure?

Is it possible to perform a MITM attack or even bruteforce a HTTP POST? If so how does one perform an attack and how can a developer protect his/her site from such an attack?
1
vote
1answer
25 views

Should pypi subdirectories be accessible from web browser?

I am a security researcher and when I was fingerprinting one web application I found out that all the subdirectories of domain.com/pypi were accessible from the web browser. The main directory pypi ...
2
votes
0answers
32 views

Help converting string to NTLM

I'm trying to covert a string into a NTLM hash. From what I understand you just have to covert the characters in the string to unicode, format it to little endian and then hash it with the MD4 ...
2
votes
1answer
57 views

How can I tell if a zip file uses the 7-Zip exploit?

Let's say I have a zip file from a potentially suspicious source, and that at least one person has attempted to extract it. Conventional wisdom used to be that bad stuff™ didn't happen from ...
1
vote
1answer
32 views

How does the recent discovered PowerPoint exploit work?

One of the recent blogs in Project Zero described a bug in the Symantec virus scanner in relation with PowerPoint files. But I do not understand how the rounding up to the length of the cache can ...
0
votes
2answers
30 views

What can be done to limit corporate Identity theft?

Modern fraudsters commit identity theft by impersonation in social media, since a lot of personal information such as our names, location, contact info and other personal details are available for ...
1
vote
1answer
20 views

Is it possible to lock down the http / https proxy settings on an Android phone?

Is there any way to lock down the proxy settings on an Android Phone so that they can't be changed by anyone but the person with the password?
4
votes
2answers
100 views

Is it safe to submit personal information over a website with a gray (not green) https?

I am required to submit personal information as part of a form. I looked under developer tools and found this:[![screenshot of item displayed in developer tools][1]][1] Mixed Content: The page at ...
1
vote
0answers
14 views

url-encoded original URL in error page via og:url meta tag - Risk assessment?

I'm asked to advise on a scenario where meta tags in a 404 error page include the Open Graph og:url, which is (I'm told) being populated by React libraries. The full url as presented to the server ...
0
votes
0answers
62 views

Is SaySocket secure?

A friend of mine installed SaySocket onto his personal macbook pro (he intended to prank people, but wanted to try it first). He quickly realized that he had just installed an unknown piece of ...
0
votes
0answers
17 views

Enigmail: Issue about sending to old key

So I have set up a new GPG key for myself. I previously had one under the same email, but it has since been revoked. I installed enigmail on my new system with this new key and It seems that it is ...
0
votes
0answers
13 views

Is this an effective obfuscation technique? [migrated]

Long ago I created a simple program which obfuscated a file by taking the first byte, then X-ORing it with the second, etc, down the line. The file size was unchanged, and I could invoke the same ...
2
votes
1answer
61 views

How safe is this “Multidimensional-Encryption method” (includes xAES, familiar from Unseen.is)?

I would like to ask about this encryption method that I found: USPTO patent and it is related to this question here: A service that claims beyond army level encryption Didn't see any updates on this ...
-3
votes
0answers
34 views

What this netstat -t output mean? [migrated]

I ran netstat -t on my Ubuntu 14.04LTS and found following output: At that time, only Firefox was running with following add-ons: And I found following output showing way more servers. Is this ...
0
votes
0answers
7 views

How to enable information logging for all traffic - Cisco ASA [migrated]

How do I enable information logging for all traffic in the Cisco ASA. I do not want to manually go to each rule and set the logging to informational (right now on default)? Also if I do this will ...
1
vote
0answers
7 views

Why do I need to redirect in order to send the external OAuth2 authentication token to the client?

In an OAuth2 scenario: user confirmed his identity, allows the app to access his details server got the external access token I intend to respond directly with a local access token as opposed to ...
14
votes
6answers
3k views

What extra security does a 2-step website login process with a PIN provide?

I am currently working on a web application with a significant security risk attached to its function. We're using Microsoft Identity Framework to handle user logins, with the system forcing strong ...
-1
votes
1answer
62 views

Do I need to detect user's device for “remember me” system?

I'm following solution #1 of this answer. After a while, there will be some redundant rows in the table. Suppose this table: // cookies +---------+-------------------------+------------------+--------...
1
vote
1answer
58 views

Can an iPhone be hacked during a phone call?

If I called someone can they hack into my iPhone just by being on the phone with me and knowing my phone number? I was also transferred to another person during the phone call, if that would make a ...
0
votes
0answers
26 views

Is my mail web service secure? [duplicate]

I am using the mail.com web service and I cannot understand if it is secure enough. When I log in by entering my username and password, it redirects me to another page which is https and my browser ...
2
votes
1answer
17 views

Does the auth server have to be separate from the resource server when using OAuth 2.0?

I'm trying to implement OAuth 2.0 and I noticed in the spec they mention two servers - an auth server to pass access tokens back to and a resource server to use the access tokens on. My question is, ...
0
votes
0answers
18 views

PTK Security without Anonce and Snonce

Is the creation of the PTK still secure if it omits the Anonce and Snonce? My guess is, no, it is not secure anymore, it would be vulnerable for "replay" attacks maybe anyone can explain in a few ...
4
votes
2answers
75 views

What are the privacy and security risks associated with Intel's Management Engine and AMD's Platform Security Processor?

And also as an everyday user who mostly just surfs the web, are these risks a huge concern for me? Edit: Also on the similar note, are there any substantial evidences of Intel or AMD purposely ...
2
votes
2answers
77 views

Does “Certificate Authority” refer to the organization or the software?

Does the term "certificate authority" refer to the organization issuing certificates (symantec, comodo, let's encrypt, ...) or to the device and software that issues certificates from CSRs or both?
-3
votes
1answer
48 views

As a virus can use my system or browser to send spam? [on hold]

I wanted to know and what is the method that a malicious person who created the possible virus uses to email people without them knowing? Do they steal credentials or use some kind of language system ...
0
votes
0answers
12 views

How to use single Tor node as proxy? [duplicate]

I would just like to bypass a geo check (don't care about privacy) on some website. Is it possible to use a single Tor (exit) node as a proxy? (I am hoping to set up a 1 hop Tor connection to have a ...
1
vote
0answers
17 views

If a HSM RNG is FIPS 140-2 compliant, does that imply FIPS 186-2 compliance also?

If the RNG of an HSM is said to be compliant to FIPS 140-2 (approved DRBG - SP 800-90 CTR mode) does also imply that it is compliant to FIPS 186-2?
1
vote
0answers
33 views

USB flash drive is write protected [migrated]

I have this flash drive that I grabbed from work that has a few files on it I would like to delete. It is a 32GB flash drive and when trying to delete the data I get this error message: "This ...
2
votes
0answers
24 views

Is a Kerberos ticket valid with only one-way external trust between domains?

The situation is that I have two domains (Domain A and Domain B) that live on separate networks. I need to allow users in B to be authenticated with integrated windows authentication (IWA) when they ...
4
votes
2answers
320 views

My friend was fired from her job. Overnight, on her personal phone all her work contacts mysteriously disappeared

As the title stated. My friend personal email is connected to her personal phone. She works on the iPad and her work iPad is connected to her work email. She never checked her personal email on her ...
0
votes
0answers
51 views

Securing data with three USB drives problem

Here is a problem. There is a single piece of sensitive data, which is subject to update and invalidate previous non-updated copies (think of password-protected Bitcoin Core wallet.dat). There are ...
0
votes
1answer
45 views

Acquire new permission after installing an Android application

I would like to know if there is an attack that allows an installed Android application to acquire further permission that is not assigned initially during installation. I did some research and found ...
73
votes
9answers
11k views

Hosting company advised us to avoid PHP for security reasons. Are they right?

I'm doing a redesign for a client who's understandably concerned about security after having been hacked in the past. I had initially suggested using a simple PHP include for header and footer ...
-3
votes
1answer
100 views

How to get secure hashing software? [on hold]

I am searching for an open source hash calculator that I can download to verify my Tails .iso image, but I also want to be able to to calculate some password hashes with a sha512 hash (which is why I ...
1
vote
1answer
39 views

Is it possible to lock down the http / https proxy settings on an iPhone?

Is there any way to lock down the proxy settings on an iPhone so that they can't be changed by anyone but the person with the password?
-2
votes
1answer
44 views

Brute force symmetric knowing asymmetric

Lets say message A is encrypted with symmetric encryption. BUT before encrypting the message, it is asymmetrically encrypted (let's say to implement VPN ...). Now if a man in the middle captures the ...
8
votes
4answers
2k views

How to store data that the computer can read but not the user?

In the TV series The Office, Dwight says he uses a diary to keep secrets from his computer. I'm wondering if the opposite is possible: can my computer create a file that it can read but I can't? I ...
1
vote
1answer
58 views

Is it a security risk, lack of knowledge for reactive action, when abuse mail is rejected?

When inspecting the DNS configuration for example with dnsinspect.com, the following shows up sometimes (note I used example.com): Accepts Abuse Address WARNING: Found mail servers which are not ...
1
vote
1answer
59 views

Is it realistic for a script kiddie to remotely hack into a jailbroken iPhone?

If my iPhone was jailbroken and I plugged it into a computer controlled by the hacker, unlocked the phone, and clicked "trust this computer" to share photos with it, would it be realistic for a ...
2
votes
2answers
49 views

What would it take to scan a PDF for questionable content in addition to malware?

My company is trying to implement a new feature on our site to let customers load documents accompanying an order. We know that we will need to perform some kind of malware scan by calling out to a ...
-1
votes
0answers
27 views

Topic for research and project [on hold]

I have just started my 3rd year of engineering and a professor from my department has said me to start looking for a topic for my research paper and project. I was wondering to publish a research ...
1
vote
1answer
30 views

Is it possible to filter internet access on a mobile phone with a 3/4G connection with a proxy server?

If you were to put a pfSense Squid Proxy Server with Squid Guardian on a DMZ and then point a cellphone with a 3/4G connection at it for SSL and HTTP with a self-signed CA certificate installed on it; ...
2
votes
2answers
54 views

Using a hash in place of user data

I'm storing client data and they are sensitive about privacy and security of the data. In some cases, I don't need the actual data, but could work with a hash of the data. For example, in the case of ...
3
votes
0answers
67 views

Is dereferencing a null pointer in C a security risk if the program isn’t a daemon, but a small script lauched as a separate process for each request?

The following code is part of a program that is spawned at every request by the nginx’s ruby on rails script : static void time_t_to_dos_time(time_t user_supplied_time_t, int *dos_date, int *dos_time)...
0
votes
2answers
49 views

Remember me vs. persistent session for web applications

This question is intended to gather information about what the specific security advantages/disadvantages are to using a "remember me" function for an online web site relying on sessions compared with ...

15 30 50 per page