2
votes
2answers
36 views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
10
votes
1answer
84 views

How can mobile sign-on be secured from imposter authentication screens?

History seems to have come almost full circle where old issues are shown in new/emerging technologies. Background If you trust the operating system, Windows originally had the Control - Alt - Delete ...
1
vote
3answers
71 views

How secure is this token url for subcontractors with no accounts?

Imagine you are a cab company that subcontracts independent drivers to drive within certain cities and towns. You send the subcontractor a link to a page that has fields for the subcontractor to ...
3
votes
3answers
67 views

Wordpress infected with Trojan

So recently our (VPS CentOS6.5) server began hosting a WP site that was, or became, infected (via revslider plugin) with some kind of trojan (probably spam sender, as we ended up on Spamhaus list very ...
1
vote
3answers
67 views

Vulnerabilities despite FIDO U2F?

FIDO U2F seems much more secure than one-time-passwords (OTP), especially TOTP, because of the challenge-response architecture. In what ways is a U2F user still vulnerable? I presume if a user's ...
4
votes
2answers
51 views

Are the rules used to validate certificates in the major browsers documented anywhere?

I'm trying to get a certificate that's good for two subdomains. Essentially, the TLS equivalent of the human-level logical cert "*.*.example.com". I've tried: Name constraints: these work in the ...
0
votes
1answer
38 views

Authentication on remote, unmanned, unconnected machines/devices

What proven methods exist for authentication of a user on remote, unconnected machines/devices where establishing unique login credentials for the users isn't practical due to the number of ...
-4
votes
0answers
17 views

is the market for android antivirus app too saturated? [on hold]

i wanted to develop an antivirus for the android platform and wondered if it was a still a good idea? Is there anything i can offer from the world of information security that is not already available ...
0
votes
1answer
47 views

Definition of security incident [on hold]

What's a security incident in information security? Can an unsuccessful attack (blocked by an IPS for instance) or an attack without real impact (a port scan for instance) be considered a security ...
6
votes
3answers
4k views

CV to a Suspicious Professor [on hold]

Here's the situation: we have this professor this semester who is an excellent teacher and is very friendly, but he has some ego issues. He promised a few of us internships at Princeton, Stanford, ...
0
votes
1answer
38 views

What security problems are exposed by running untrusted macros in excel?

Here's a 2015 article arguing that Macro-based malware is making a comeback. Obviously running untrusted macros is bad news, but what are the specific problems? As far as I understand, VBA can do ...
8
votes
2answers
1k views

Are all SSL/TLS implementations vulnerable to the Heartbleed bug? [on hold]

I've learned the theory behind the SSL/TLS protocols and how effective they are to achieve a secure communication between clients and servers. Do all the implementations OpenSSL, PolarSSL, MatrixSSL, ...
10
votes
2answers
1k views

Why should I choose SHA (such as SHa-512), instead of bcrypt or PBKDF2, for FIPS-compliance?

Due to regulation, my company needs to be FIPS-compliant. I was looking at the current list of FIPS-approved cryptographical methods and I notice that neither bcrypt or PBKDF2 are in this list. ...
0
votes
1answer
67 views

what is the most secure hash for virus definition databases in 2015?

I have been told, if I wanted to create virus signatures from infected files to use for detection in the future, I should be careful as some of them are prone to collision attacks?
1
vote
1answer
70 views

How does LastPass know that Microsoft.com uses the password for Live.com?

When I visit Microsoft.com, the LastPass dropdown lists my username/password for login.live.com. It does something similar for Playstation.com and several other sites. How does it know? Are these ...
0
votes
0answers
8 views

Enabled FIPS on a luks encrypted CentOS system - boot password not longer recognized [migrated]

I have a CentOS VM instance which was software encrypted during install. The system booted fine (after entering the boot decryption password). My project requires enabling FIPS for OpenSSL, so I ...
1
vote
2answers
42 views

Difference between virus and trojan?

To my current understanding: a virus is a program that does not self replicate and relies on the host file being spread, it has malicious intent. A trojan is a program that is run be deceiving the ...
0
votes
0answers
31 views

Breaking EncFS given .encfs6.xml

I forgot the password of a EncFS folder (created, went to vacation, forgot). But I remember how the password was created (e.g. was a sequence of 4 dictionary words). So I decided to try to find the ...
4
votes
1answer
84 views

How to Man-in-the-middle a whole network?

When performing a MiTM attack, you generally need to specify the router's IP address and the "victim" IP address. I'm trying to demonstrate to a business owner why he needs to secure his network, but ...
1
vote
0answers
42 views

Docker: Central daemon model is flawed?

I've read this article about CoreOS's new container runtime, rkt, and I'm curious about this section: Why not just fork Docker? From a security and composability perspective, the Docker ...
4
votes
3answers
52 views

Input validation: how to do it if I must accept HTML as part of my input?

I'm writing a service which receives FHIR data and it stores it. FHIR is an HL7 healthcare information standard format which contains HTML by definition, embedded into a JSON or XML, (to ensure ...
-3
votes
0answers
34 views

Any One Who Can Bypass Web Sultan Webapplication Firewall [on hold]

Any One Here in this Panel Who Can bypass this WebSultan xss based firewall link: http://anonkhan.host56.com
0
votes
0answers
18 views

How to change MAC address on Windows Phone 8.1? [on hold]

I did't find any method to change MAC address for Windows Phone devices, unlike the Android devices, so I want to know if there is a way to change my Lumia 525 MAC address.
7
votes
2answers
1k views

Spoof IP adress after a TCP handshake

I know it is not possible to perform a successful TCP Handshake with a spoofed IP-Address. However I wonder: Is it possible to spoof the IP once a TCP handshake was performed successfully? For ...
9
votes
4answers
2k views

How to break MAC address filtering?

If a MAC filter prevents you from connecting to a network, how can you break it or include your device's MAC in that filter?
0
votes
1answer
50 views

How can you draw attention to your web application honeypot? [duplicate]

Unsatisfied with existing software, I'm currently toying around with writing a web application honeypot. My question is: how do you draw the attention of attackers and automated attacking software to ...
0
votes
2answers
74 views

Store password in Public Domain using files and md5sum

Whenever I check integrity of a file using md5sum, I get a string of alphanumeric characters to compare and verify if it was downloaded correctly. Couldn't the concatenation of several of those ...
0
votes
0answers
36 views

End to end encrypted calendar [on hold]

What end-to-end encryption options exist for calendars? I am looking for a way to efficiently encrypt and store calendar entries myself (so not relying on Google calendar etc). For email there is for ...
11
votes
1answer
646 views
+500

What are the privacy and security implications of Windows Telemetry

There have been quite a few news stories relating to the use of "Telemetry" in Windows 10 (and also now Windows 7/8) with suggestions that users would want to disable or remove these updates due to ...
0
votes
0answers
21 views

How many times - on a specified date - a DVD recorder was used? [migrated]

I'm looking for a way to get to know how many times - on a specified date - a DVD recorder was used (DVD(s) burning). I'm running Windows Vista. The program used to burn DVD(s) doesn't create any ...
0
votes
0answers
33 views

DSA, ECDSA and RSA

Conventional wisdom these days is that in the context of SSH keys, DSA is insecure and RSA is preferred (or that they are both fine, but RSA is more secure, depending on who you ask). As I understand ...
1
vote
0answers
60 views

HTTP Response Splitting in practice

Have you ever seen HTTP Response Splitting in laboratory environment? There are many examples for HTTP Response Splitting vulnerability. I used old PHP and managed to get 2 responses from server ...
-4
votes
0answers
10 views

Restrict direct access in Jomsocial [on hold]

When I copy http://mywebsite.com/index.php/909-a/profile this link it gives all information of 909-a user in JomSocial. How to restrict that.
2
votes
2answers
366 views

Why does Google Safe Browsing keep detecting malware on my website?

We provide a freemium service to upload large files and download them later on. Using ClamAV, we scan every file for viruses after it is uploaded and before it can be downloaded. The file is deleted ...
0
votes
1answer
52 views

A “hardware” random number generator for mobile phone

I have been trying to write a random number generator using the hardware of the phone. After reading other people's attempts and tried some. I came up with the following to generate the seed: Play ...
1
vote
1answer
52 views

A possible router XSS vulnerability

I have been trying to analyze my router modem and see how it works and check for possible vulnerabilities in the system . and i would like some help . Router Security Research : router access ip : ...
0
votes
3answers
46 views

Difference between brute-force and dictionary-based in the mitigation process of the IPSs

I am working with Bro IDS and CIF ( cyber threat intelligence) using the Intel framework I am testing. How can I mitigate brute-force and dictionary-based attacks? I found that the mitigation ...
0
votes
0answers
3 views

Can I find, open, view a MFT (master file table) in Windows XP? [migrated]

I understand NTFS maintains a "MFT zone" on the hard disk, where it stores the Master File Table. After a crash and quick reformat in Windows XP, it's still possible to recover plenty of files. ...
1
vote
0answers
9 views

Monitor Mode doesn't work in Kali 2.0 [migrated]

For the last year or so I have been using this exact setup with Kali 1.0. Everything worked fine with Wireshark. Now, when I am connected to a Wi-Fi access point my card REFUSES to stay in monitor ...
3
votes
1answer
85 views

Can you exploit an Internet IP adress just like a LAN IP address?

Is exploiting an Internet IP address as simple as exploiting a LAN IP address? i.e.: Scan that IP for vulnerabilities and open ports using tools like nmap or nikto Use a vulnerability and set the ...
0
votes
1answer
26 views

Tracking a specific computer from an online enquiry form

The optical fiber cable that supplies a business is used for clients and staff. The business has an online enquiry form for bookings on its web page. It also provides free WiFi access to clients and ...
3
votes
2answers
272 views

SSH cache secrets

Why does SSH use public key crypto each time you connect to the server? RSA/DSA are computationally expensive, so why can't they just be used the first time to share a secret, and then in the future ...
4
votes
2answers
64 views

Protection of eduroam credentials

Recently my educational institution officially switched over from the their own wireless network to eduroam. If I understand correctly from the FAQ, credential authentication is performed on the ...
-2
votes
0answers
39 views

Http splitting attack via webgoat [on hold]

I'm trying to do the webgoat http splitting attack, I'm using firefox and burp suite. Note that I have already read the question that is already posted (Why is this response splitting attack not ...
4
votes
1answer
84 views

Should Flash be disabled, or are sandboxes secure enough?

Flash is a hot bed of vulnerabilities. Chrome contains a built in version of Flash, running in sandboxed mode. Obviously, this method is safer than running Flash as a plugin in either Firefox or IE. ...
-3
votes
0answers
17 views

PCI Compliance for 2checkout Payment API [on hold]

I am using 2checkout Payment API for payments which requires PCI compliance, for which I registered with 2checkout's PCI partner Trustwave. Trustwave scanned my server and this scan passed. The next ...
1
vote
0answers
22 views

Chosen plain text and chose ciphertext definitions clarification [migrated]

I am trying to understand a concept of CPA and CCA attack and I cannot get one thing from the definition. If an attacker can execute a CPA attack for something like Send 100 dollars to attacker ...
2
votes
1answer
32 views

New certificate but what about the keys?

One of our SSL certificates has expired and along with that so has the keys. I have a re-newed certificate but no re-newed keys. The posting Should I change the private key when renewing a ...
-2
votes
2answers
51 views

Use of Nmap ssl/http md5 and SHA1 hashes

I have below stated result on of the system by map: 443/tcp open ssl/http Apache httpd 2.0.52 ((CentOS)) | http-methods: GET HEAD POST OPTIONS TRACE | Potentially risky methods: TRACE |_See ...
4
votes
2answers
87 views

What is a “roving” backdoor?

What is a "roving" backdoor? I understand the general concept of a backdoor. Emphasis on keyword qualifier: "roving"...

15 30 50 per page