3
votes
1answer
41 views

secure way to store application settings

What is a proper or, if possible to tell, the best way to store configuration in matters of security? So far I can tell that a database with very restricted access is a good way, but please lets ...
51
votes
5answers
6k views

Is it dangerous to post my MAC address publicly?

When posting questions, it is often quite useful to include debug output. However, it sometimes include the MAC address of my laptop, router, or both. What are the possible dangers of releasing these ...
1
vote
1answer
27 views

Securing iOS applications communication from client side

Many of you have heard about instagram flaw that facebook has not fixed yet, The flaw allows the attacker to hijack the session by sniffing the session cookie on Instagram iOS app since it does not ...
29
votes
2answers
2k views

Why do browsers enforce the same-origin security policy on iframes?

I did a small test on Chrome (V37) today. I created a small page and loaded it to the browser: <!DOCTYPE html> <html> <head> <title>Untitled Document</title> ...
0
votes
0answers
37 views

Is listening to an audio stream through Tor (using Tails) hazardous?

If someone were to listen to a SHOUTcast server through Tor using VLC (not just downloading the M3U playlist through the Tor browser, of course, but while running Tails), would it put their security ...
0
votes
0answers
25 views

How to relay broadcast traffic using ncat?

I have 2 servers, 192.168.1.1 and 192.168.2.1. I want to relay any broadcast traffic (192.168.2.255) through 192.168.2.1 to 192.168.1.1. Here's what I'm doing to relay port 137 traffic, and it seems ...
3
votes
1answer
48 views

Storing Credit Card Information on Mobile Phones

I've inherited the code-base for a legacy mobile app (both the native Android and native iOS version) and am running a security review on it, a few things stood out to me. The app allows a user to ...
-2
votes
0answers
54 views

I lost my android phone, but it keeps showing up on the logs [on hold]

I lost my android phone but noticed today some requests for on my DNS server logs. Does that mean it's in my house somewhere?
-2
votes
0answers
26 views

Replay attack on redhat [on hold]

in this case i have a redhat linux that is installed on a virtual machine,I want to change a text file on this machine before it leaves the machine and get to the destination,As i know this known as ...
-1
votes
1answer
78 views

How do I hash a password in C#? [duplicate]

I assume that the best way to handle passwords for a website is I create a hash of the password and save that hash in my database. Then when someone tries to login, I do a hash of the password they ...
0
votes
1answer
21 views

What is the difference between active reconnaissance and scanning/enumeration

I have just started studying for CEH exam v8 and I am trying to get the core of so called hacking phases. I could not totally understand the practical difference between the first two phases. In ...
1
vote
0answers
103 views

Task Manager shows higher total CPU usage than the sum of all running processes. Keylogger? [migrated]

In Windows Task Manager and AVG Task Manager (included in TuneUp Utilities), I see that the sum of all the running processes is much lower than the total CPU usage shown in "performance" tab. Does ...
0
votes
1answer
33 views

Can an attacker detect if I have a TARPIT enabled?

Last thing we want to do is provoke an attacker and offer them challenges or puzzles indirectly to give them a flag to stay and continue to hack rather than move on to other hosts. If possible, I do ...
0
votes
1answer
39 views

HMAC based algorithm for publicly sharing authenticated messages

I am trying to design an algorithm for publicly sharing authenticated messages. Obviously, asymmetric public/private key schemes do this, but I want to avoid the requirement that users have to keep ...
2
votes
0answers
33 views

Removing malware which is creating temp file and modifying network traffic [duplicate]

I am on OSX 10.9.2, please note I have included several URLs in my post, this is not spam this is due to the nature of the malware. I have just discovered I have malware on my computer after noticing ...
1
vote
0answers
15 views

Secure Single Page Application (SPA) served from a CDN

Is it possible to secure a Single Page Application (SPA) served from a CDN that communicates with a REST API, assuming the following: The front end communicates with a backend REST API using a token ...
2
votes
1answer
60 views

What does verified file in windows mean? And does it guarantee related files?

Often when I run a .exe file in Windows, a small box pops up that shows that file is from a verified publisher (e.g Microsoft) or in other case, unknown publisher. I know public key encryption can ...
-1
votes
1answer
44 views

Running javascript when there is error on the script?

Recently i was figuring out a web application and found that the url is reflected among the source of the page which make it bit obvious for xss but the input from url which is reflected on source is ...
1
vote
0answers
32 views

Am I safe to see a thumbnail of a downloaded images on Ubuntu 14.04?

I have downloaded an image that someone has uploaded to my website with a public upload form. My intention was to copy the file in a virtual machine and see the image from there; unfortunately, on ...
4
votes
1answer
23 views

safely changing distribution, is there a strategy to get an distro iso image untampered?

I can check that an Ubuntu iso file is indeed untampered using the public keys already present and trusted in my Ubuntu system. Now I want to switch from Ubuntu to Arch and I wonder how I can start ...
1
vote
0answers
26 views

Signed an executable; appears as unsigned on VMs?

I signed my binary with a certificate issued by GoDaddy. It seems that myself and everyone I could get to test it for me confirms that it is indeed signed (much like signtool verify) However, when I ...
0
votes
2answers
35 views

Why does ssh `known_hosts` file need server name?

When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has ...
2
votes
1answer
41 views

Which PGP settings have been found to be vulnerable?

Digging through articles, one often finds recommendations such as "Use the default key type/size X", whereas an article written a few years later will write "Key type/size X has been found to be ...
13
votes
2answers
2k views

Linux password changed. Is this an attack or a hardware glitch?

My Linux (Ubuntu 12.04) password suddenly changed last night and I'm not sure if this is an attack or just a hardware/user error. This is on a personal/non-server box. Several strange events led up to ...
1
vote
1answer
33 views

Encrypt pdf by the server to prevent printing and copying

We are building a portal where users can upload few materials. we have been successful in using the command lines of linux to convert doc,ppts to pdf directly through the server but we are not able to ...
0
votes
0answers
11 views

How to evaluate authentication for a WAP portal?

I am trying to evaluate a security authentication for a WAP portal. The authentication works by asking the customer for his unique MSISDN and then a secret pin code is sms to client. In this is a ...
1
vote
0answers
30 views

Kerberos v4 replay attack vs. sliding time window

Just wondering about a replay attack against Kerberos v4. So v5 has a replay cache that takes note of tickets to prevent replay attacks. Kerberos v4 does not have a replay cache, though. Say, I ...
8
votes
4answers
696 views

Can anti-CSRF token prevent bruteforce attack?

I am not much experienced with brute force attacks but I was wondering Suppose, you have a website www.example.com and you want to do brute force attack on that login form but that login form is ...
0
votes
2answers
45 views

Firewall Security vs Anti-Virus

Overview of my question I want to create a secure Window's system without the use of an Anti-Virus program. Whilst I know there are many on-demand and live-scanning anti-virus programs readily ...
2
votes
2answers
76 views

entropy of two factor authentication

I have two independent authentication methods A and B with entropy a and b respectively. say compromise of A does not provide any information on B. Is entropy of two-factor authentication of A and B ...
0
votes
1answer
33 views

GnuPG / OpenPGP: How to eliminate redundancy in PGP private key?

I examined a few randomly generated private keys generated by Gnu PG, and found a lot of redundancy. It is enclosed by -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY BLOCK----- ...
1
vote
2answers
106 views

Search on hashed data

We have a request to encrypt customer personal data (e-mail, address etc.) We use MySQL which does not have any TDE like MS SQL or Oracle. So along with encrypting data we need to preserve ...
1
vote
0answers
27 views

How to permanently change (spoof) the MAC address in Kali Linux (Debian) [migrated]

I use the program 'macchanger' to change MAC address. However, I have to put down an interface (wlan0) and then invoke Macchanger and then bring the interface up again. I would like to have a way I ...
1
vote
0answers
46 views

The simplest way to emulate TCP-IP protocol violation / anomaly attacks

Reading up upon security on web applications I did not found that much info on TCP-IP and in particular HTTP/UDP protocol violation / anomaly attacks. My question: What is the general mechanism of ...
0
votes
0answers
17 views

What certificate attributes can I check to verify if an issuer is correct?

Apologies if this is a duplicate question. I thought I saw this discussed earlier but couldn't find the thread when searching. What attribute can I check to verify if I have the correct ...
1
vote
0answers
23 views

E-voting: receipt-free, verifiable, and anonymous

Background In response to a system design concept, a question was posed: How do you achieve electronic voting, anonymity, and verifiability at the same time? I was informed that most experts in ...
0
votes
0answers
14 views

Proper way to shutdown OpenVAS [migrated]

I currently start OpenVAS by calling openvasmd, ad, and sd manually. What is the proper way to stop these services? Killing the processes works but I don't know what might not be cleaned up by the ...
-4
votes
0answers
33 views

My Android phone is dormant because I can't access my account [on hold]

I have an LG android phone. Two weeks ago, a warning sign appeared saying that i have put in the wrong password. i have tried the password i remember,to no avail. i can't access my market.i tried ...
2
votes
1answer
59 views

What is x-frame content?

I tried scanning websites for vulnerabilities and found most of them are with low risk x-frame content and "nosniff" what is it exactly?
2
votes
0answers
47 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
-1
votes
0answers
43 views

How many remote holes did Windows had?

http://www.openbsd.org/ states that from 1995, they had: Only two remote holes in the default install, in a heck of a long time! Our question: How many did Windows had?
0
votes
3answers
30 views

Adding a “comment” to PGP mail signature files?

I have started signing my mail with PGP, and it attaches the file signature.asc to my messages to verify that I sent them with content, as you'd expect, like this: -----BEGIN PGP SIGNATURE----- ...
0
votes
1answer
128 views

Password stolen on public wifi even though https was used [duplicate]

I saw this video where news reporter is in public place, and some security expert demonstrates to her that even though she logged in at page which was using https that guy got password in his ...
1
vote
0answers
16 views

What aspects of a Host OS can be detected from VirtualBox VM? [on hold]

What aspects of a Host OS can be detected from VirtualBox VM? Processor and display features are all I can think of. What exactly about them? Any other features of the Host that a user with ...
0
votes
1answer
43 views

Reflected XSS script passing through URL how to make it work and what are the preconditions for it to work?

Trying to learn about security I set up the most simple website on my localhost consisting of one html page that a apache server serves. I first started trying and appending the JS script that would ...
0
votes
0answers
16 views

What could be expected from an AI program for scanning network vulnerabilities? [on hold]

There are tools like OpenVAS and other such online scanners which help in discovering network or a system vulnerabilities. I need thoughts on the limitations you feel, which are faced while using a ...
-8
votes
0answers
70 views

What are the best and most popular authentication algorithms/protocols? [on hold]

Our cryptographic/security company is designing a new generic versatile library that implements all popular algorithms in all areas of cryptography. Now I'm studying a subject of Authentication. What ...
2
votes
3answers
247 views

How can hackers guess passwords (using dictionary attack or brute force) without being locked out?

Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords? I am just wondering because in case of multiple wrong ...
3
votes
2answers
66 views

Is there any danger in allowing users to host PDF/RTF/DOC files on my web server?

If I were to allow users to host arbitrary PDF/RTF/DOC files on my server all under the same name, but with different query strings would there be anything to worry about? I've heard of PDF/RTF ...
1
vote
1answer
32 views

Remote Auditing a Secure WiFi Network-Obtaining enough of the Secured-Network credentials to attack without being in range of WiFi

I was wondering if there are any methods I'm unaware of that will allow an attacker to attempt to obtain WiFi access outside the physical range of the WiFi signal. When using net-stumbler or any ...

15 30 50 per page