0
votes
2answers
132 views

Sniffing WhatsApp chat using Wireshark

Suppose two persons are using WhatsApp on Android. How can I see the communication between them if I have Wireshark running on a PC listening on network interface card? I know the communication ...
0
votes
0answers
18 views

Securing several Servers (Certificates)

I got a Question regarding Certificates. We got a situation, where only "Server 4" and its clients are given in the picture above. That Server4 (SLES11) and its Clients are using a self signed ...
1
vote
0answers
46 views

Which is the correct algorithm while checksumming a portion of code?

As part of my research, I came across a technique in a paper which applies checksumming on a portion of code. I want to implement it. Here is the research paper which talks about the checksumming ...
20
votes
4answers
4k views

Is VLC on Linux vulnerable to an attack from .wmv files designed to install viruses?

I was stupid and did not check a video file I downloaded from an untrustworthy source. It was .wmv file with no readable properties of the video. I know that .wmv videos can download viruses. What I ...
3
votes
1answer
153 views

Why does my SHA256 certificate get encrypted with 168 bit 3DES?

We use S/Mime certificates for internal emails within our company. The certificates signature algorithm are all SHA256RSA with a hash of SHA256. I have confirmed the public keys are RSA(2048bits). ...
1
vote
0answers
26 views

Snort false positive, yet suspicious

I have Snort installed and tuned nicely with ET Rules on my pfSense, both my pfSense and the modem are using Googles public DNS 8.8.8.8. Recently I was denied access to google.com, and by reviewing ...
1
vote
0answers
24 views

How to increase security for my OpenVPN clients?

The idea is simple, I want to increase security on the client-side. Beside the encryption, I'd like to keep them away from malicious websites/files. I had in my mind ClamAV and maybe HAVP, but at the ...
0
votes
0answers
8 views

Can 125Khz RFID reader communicate with Hitag chips [on hold]

I have a question which is quite simple, can a standard EM4100, EM4305, T5577 RFID reader (such as an arduino shield or a USB/serial) communicate with a Hitag key ? (assuming the reader has write ...
2
votes
1answer
50 views

Is there a security risk in using pointers instead of struct instances?

Recently during a code review, a senior developer asked me to replace a pointer with structure instance in a utility method. He asked me to do so for security purpose. One reason that I could think of ...
-2
votes
1answer
42 views

I am investigating the physical access control system weakness [on hold]

physical access control system -> Biometrics, RFID system, digital door lock I am investigating the weaknesses of physical access control systems. I need a newspaper article that a malicious person ...
0
votes
2answers
27 views

What are some metrics to be used to evaluate SaaS security?

Some examples: static code analysis (Fortify) code coverage (bugs being a potential source of vulnerabilities) others?
1
vote
2answers
23 views

How to rank the security strength of a cloud SaaS app

If my manager asked me to rank how secure/vulnerable our SaaS system is, what methods are available to do so? I know there are certifications available but I'm looking for something which can be ...
2
votes
0answers
52 views

How to securely delete full vm

We have a Windows 7 virtual machine on VMware Workstation 11. The VM is now encrypted (using Workstation) but wasn’t always. The VM has confidential information on it and as we no longer need it, we ...
1
vote
1answer
48 views

Virus/Trojan attached to GnuPG encrypted file

Is it possible to infect a file encrypted using GnuPG? For example, if I had an encrypted file on an unsecured public ftp server, would someone be able to copy that file and attach a virus/trojan ...
1
vote
2answers
113 views

Why won't Firefox accept my certificate?

I've been trying to get stunnel to work with my signed certificate (with a CA that I've trusted in Firefox). The error is: 127.0.0.1:5559 uses an invalid security certificate. The certificate is ...
-6
votes
2answers
55 views

Noob to tor/tails/darknet…forgot to disable Javascript. What to do now? [on hold]

I am a noob as stated in title. I didn't know how to disable Javascript before visiting some not-so-legit sites. So what can I do? I was using tor, I know this is not enough so I have tails ring a ...
-4
votes
2answers
88 views

TV and audio hacking [on hold]

I have been stalked now for over a year. I think they are doing it over the DirectTV because they can hear me and I can hear them. Is it possible they are recording me like a movie live through ...
0
votes
0answers
19 views

Extremely slow GnuPG 2.x Performance [migrated]

I have an curious problem with my script. The script runs very fast ,when i use GnuPG 1.x. With GnuPG 2.x it runs very slow at encryption/decryption, and i have no idea why. Versions: GnuPG 1.4.20-6 ...
2
votes
1answer
90 views

What is the difference between a digital signature and whole message encryption?

I am newbie in information security I am trying to understand the difference between a digital signature and encryption of a message. Lets consider simple example of email message. I understand how ...
-9
votes
0answers
29 views

c# code to reset password in ms word document [on hold]

am doing my final year project to develop a software that will enable to recover the password in ms office document in-case people forgot, die or quite a job in certain organization. ANYONE WITH IDEA ...
1
vote
1answer
22 views

Is there a secure method of distributing keys to network-booted diskless nodes?

I have a bit of an 'initial trust' issue. We are using CoreOS to run Kubernetes, and secure both the etcd API and the Kubernetes API servers using client certificates. We are using iPXE to boot ...
-2
votes
2answers
45 views

Can someone know that I'm using a VPN if they have my MAC address? [duplicate]

My university has a web filter, so I use a VPN to access blocked sites. They also have my MAC address. Can they identify that I'm using a VPN and what I'm doing on the internet?
5
votes
0answers
46 views

Prevent keyloggers on Linux?

Are there any mechanisms in the Linux desktop architecture to prevent malicious software keyloggers? What would be an ideal Linux setup to make it very difficult for an attacker to install a keylogger ...
1
vote
1answer
68 views

Doesn't this make 2FA irrelevant and possibly dangerous?

Article. One sentence summary: they use a smartphone as a listening device to compromise computer security. I know our bank doesn't allow us to take cell phones in at all, even if they're completely ...
0
votes
1answer
40 views

Is moving data between devices on an SD Card safer than a USB stick?

From the perspective of USB device-born malware/exploits, especially affecting firmware (e.g., can an infected computer reprogram an inserted USB memory stick to act like a keyboard and autotype ...
2
votes
1answer
45 views

How and why does case insensitive XSS work, given that JavaScript is case sensitive?

I found a lot of instances where XSS scripts like the following work: <iMg SrC=x OnErRoR=window.location=123> Given that JavaScript is a case sensitive language, how is the browser able to ...
2
votes
1answer
69 views

Is storing passwords encrypted with GnuPGP on an anonymous FTP server safe?

I would like some advice on a method of storing passwords to a database on my anonymous FTP server. Basically I have login details for a few trusted users to a database server stored in a text file ...
1
vote
1answer
18 views

Using external OAauth Authentication Service, how to manage the users's relations

I'm trying to create an API and a website client for it. Lately I've been reading a lot about OAuth2 as a security mechanism and companies that offers authentication as a service such as auth0.com or ...
1
vote
0answers
32 views

How to “stealthily” call a Java function to avoid text search?

Assume I am an attacker, I want to call an API function from an Android app, say Build.getRadioVersion(). But I want to keep this call stealthy, i.e., it cannot be searched through, e.g., grep ...
0
votes
0answers
3 views

Why ecryptfs still remain in mtab? [migrated]

I use ecryptfs for encrypted lxc container container start ok and stop ok But i see even after stop this line /var/container-lxc/face/rootfs.crypt on /var/container-lxc/face/rootfs type ecryptfs ...
0
votes
2answers
44 views

Can they tell which individual computer was torrenting on shared internet connection?

I live in a shared house where multiple people use the same wi-fi (actually, there’s two: the normal frequency and 5GHz one). The internet is included in the rent. The other day I received a complaint ...
0
votes
0answers
17 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
2
votes
2answers
36 views

Can a full SSD or HDD recover deleted data?

I've always been curious. It may be a stupid question but what if you deleted a file then filled up the SSD or HDD. Could your deleted data be recovered or is it physically impossible? I know Windows ...
0
votes
1answer
45 views

How to verify the signature value in a SSL certificate?

According to RFC 3280 a certificate's basic syntax is Sequence := { tbsCertificate signatureAlgorithm signatureValue } In tbsCertificate, SubjectPublicKey is the public key of the ...
0
votes
3answers
34 views

How secure is it to use passwords consisting of one common part and one site specific prefix? [duplicate]

One of the greatest problems with passwords is having to remember different passwords for different sites. Some people use password managers, others use the password reset link every time they want to ...
6
votes
1answer
78 views

Would a DMZ be safe to use with a software firewall for home networking?

If I set up a Windows 10 PC with a software firewall (TinyWall, which is a front end for Windows Firewall) and blocked all traffic except for a few applications and ports I would be using (Minecraft ...
0
votes
0answers
4 views

What are the advatages or disadvatages of using seperate chaining over linear or quadratic probing? [migrated]

I was looking through different hash methods the other day and was curious as to what the advantages or disadvantages of using separate chaining over linear or quadratic probing. I know that with ...
2
votes
2answers
29 views

Use Nessus or focus on manual testing?

Nessus scans for a a lot of vulnerabilities, so should I focus on learning vulnerabilities that are not covered by Nessus, like directory traversal attacks? Should I work on only the vulnerabilities ...
6
votes
2answers
149 views

Can free Wi-Fi hotspot providers snoop on HTTPS communications?

Every article (and post on this website) I find on public Wi-Fi safety is mostly concerned with other people connected to the same network snooping on our communications. As far as I understand it, ...
2
votes
1answer
31 views

Can data be restored from a hard drive after using magnets to wipe the data?

Can a 512GB SATA hard disk be successfully restored after using magnets to wipe off it's data? From the movie: "The Core", https://youtu.be/g3KPSyNxnL8, rat using magnets to wipe his drive and puts ...
0
votes
1answer
24 views

Does KDE System Tray Extra Items “Clipboard” have the same security threats as the system clipboard?

Does the clipboard under kUbuntu's KDE System Tray > Extra Items "Clipboard" have the same security threats as the system clipboard? The following articles point out the insecure nature of the ...
0
votes
1answer
60 views

Avast attempts to connect to the Internet when I try to download email [on hold]

The file AVAST (Software\Avast\AvastSvc.exe) tries to connect when I check my email. When I forbid access to the internet for AvastSvc.exe, I can't connect to POP3 & SMTP. I'm not sure where all ...
0
votes
0answers
6 views

How to manage logged-in state across multiple subdomains with a JWT?

So I am using JWTs to manage logged-in state for users. We also have translated sites on subdomains, eg: www.example.com // english es.example.com // spanish de.example.com // german And so on. ...
-9
votes
0answers
29 views

banking app testing information [on hold]

How to test banking android app for OWASP 10 SEQURITY RISK? PLEASE GIVE ME TOOL NAME ON WHICH EXAT RESULT WE CAN GET? AND GIVE ANDROID APP FOR DEEP TESTING? HOW TO PERFORM TESTING OF ANY BANKING ...
2
votes
1answer
34 views

How to identify and patch a hardware vulnerability?

Software and systems vulnerabilities are often patched with updates, or by avoiding the use of some OS or softwares that have multiple flaws. Regarding hardware vulnerabilities, I do not have a lot of ...
-1
votes
0answers
12 views

how to create DMZ on xDSL router [on hold]

Need to know that how xDSL router can be set to use DMZ in its firewall to reach a PC server on LAN. Should I use pubic WAN IP address for DMZ host ? The would it be accessible to public network.
13
votes
1answer
290 views

Bank complains about rooted Android. Is it really any worse than a Windows desktop?

When I use my bank's Android application, the app notices that my phone is rooted and puts up a message with a big red "danger" symbol and a message saying "vulnerable device." I totally understand ...
2
votes
1answer
29 views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
0
votes
1answer
39 views

How is UDP hijacking even possible?

My doubt is this: UDP has no sequence numbers, so what indeed is the concept behind UDP session hijacking?
8
votes
4answers
458 views

Can governments intercept end-to-end encrypted Whatsapp communication through lawful interception?

Since Whatapp started end-to-end encryption with an option for users to verify keys, many government security agencies, like the Indian one, red-flagged such use of encryption. Now, Yesterday the ...

15 30 50 per page