0
votes
3answers
92 views

Please critique my encryption scheme for a very small microcontroller [on hold]

I am new here and not an cryptography expert; but I have been using encryption library for a while. My company is working on a small hardware device. It is powered by a microcontroller so memory is an ...
3
votes
1answer
38 views

Mobile authentication with password as param in get request over ssl

I'm building out a new services layer for an existing mobile application. The mobile application authenticates with the existing services layer by providing the user name and password as url params in ...
0
votes
0answers
26 views

Shared control scheme [on hold]

For the shared control concept, each party has part of the key to avoid having 1 person having the entire key. I'm given the following rules, but whenever I try out numbers on the rules I do not get ...
1
vote
1answer
34 views

Is adding apt keys using wget secure?

Many (I would even say most) projects that have Debian repo give instructions like this (https://www.dotdeb.org/instructions/): 3. Fetch and install the GnuPG key wget ...
0
votes
2answers
49 views

Sniffer attack on mobile

I have Nokia lumia 625. And a guy hacked it using sniffer. That's how much I know about it. He has access to all my online texts(eg. Whatsapp, messenger etc) . and also to offline carrier text ...
2
votes
1answer
51 views

What's the mechanism used to extract my user name on a website? [on hold]

I was browsing this forum http://openelec.tv/forum/64-installation/40869-putting-openelec-onto-sd-card-using-usb-reader-from-a-mac-for-raspberry-pi ,and realised that they show my hostname and my ...
1
vote
1answer
63 views

How does Amazon Fire TV know my name/account? [on hold]

I bought a Fire TV stick and inserted it into the HDMI-port of my TV. I was presented with a dialog to select my wireless router so it can connect online. Just after I did that, it asked me if I am ...
0
votes
1answer
34 views

Is Cryptree suitable for cloud storage?

I'm evaluating a cloud storage product. The marketing literature states it uses Cryptree. I pulled the paper and performed a quick read, but I don't see where Cryptree lends itself to confidentiality ...
0
votes
1answer
37 views
2
votes
2answers
128 views

Website security checklist?

I'm building a web service (a control panel for clients) (PHP on linux apache) and trying from the design to make it the most secure as I can, Can anyone provide me with some kind of a check-list of ...
14
votes
5answers
1k views

How secure is binding to localhost in order to prevent remote connections?

Let's say we're running a service that's bound to localhost (127.0.0.1), and the goal is to only allow local clients (i.e. from the same machine only) What techniques might be used to break this ...
7
votes
2answers
40 views

How to handle decomissioned/donated/RMAed printers?

Printers, nowadays, almost always include some form of non-volatile storage that keep tracks of pretty much everything that went through the device. In the case of larger, "departmental" system that ...
18
votes
2answers
3k views

Is email from my WordPress site a hack or just a normal comment?

I received an email for my WordPress site, where the comment section is disabled. This was the email: "Author: google (IP: 210.56.50.40, 210.56.50.40) Email: guest@gmail.com URL: ...
-1
votes
0answers
12 views

Compromised Virtual machine image (dataset) [on hold]

Are there any compromised virtual machine image datasets available online? I require it for cloud forensic research.
-3
votes
1answer
58 views

Is there an exploit for python hash collision? [on hold]

Is there an exploit for this vulnerability? EDIT Python DoS via hash algorithm collision - oCERT advisory 2011-003. Affected numerous languages. No CVE for Python but CVEs for other languages.
4
votes
3answers
67 views

Same Origin Policy - XHR response

I know that Same Origin Policy (SOP) prevents a page/script from one origin to read response from another origin, but it does not prevents the page/script from making a XMLHttpRequest (XHR) request to ...
1
vote
1answer
33 views

OWASP + Atomic ModSecurity Rulesets - Too much?

Looking to implement some additional mod_sec rulesets on our server. OWASP and Atomic keep coming up as the best of the best. Would it be wise to implement both? Or, would one or the other be ...
0
votes
0answers
27 views

Opening outgoing ports on dedicated machine [migrated]

I have a website where I have been working with another person on a game server listing site. It queries the game servers and shows information etc. Anyway upon talking to the creator of the script he ...
0
votes
1answer
42 views

Sharing a common public and private SSH keys for a cluster of machines

I guess this is way to settle an internal debate I am having with myself. In my provisioning process, I am wanting to share a common public and private ssh keys for each machine in a clusters, ...
2
votes
1answer
47 views

SSL certificate connection is verified by proxy.abc.com, is this secure?

I am using chrome, and when I perform a google search I get the green icon in my browser. When I click on the icon to see the certificate information, in the 'Connection' tab is says: "The identity ...
2
votes
0answers
40 views

Detecting 2G/3G/4G Devices [on hold]

There are one or two answers that come close to answering this question but they either fall short or go in straight at the deeper end. Essentially, I am interested (for genuinely academic reasons!) ...
3
votes
1answer
45 views

Bing bar without admin rights

I know viruses uses exploits to gain admin rights to install software. My question is here at work, we have people end up with the Bing Bar installed from time to time on their machines. It is listed ...
12
votes
3answers
652 views

Custom socket server on the internet running as root

We are writing a custom socket server which runs on a high port. Until recently, it has been running behind a corporate firewall. Now, it has been decided that the server should be taken outside the ...
1
vote
0answers
65 views

What is the problem with my pen-testing lab? [migrated]

I have setup Kali Linux and Windows XP in Virtual Box. My first problem is, these two systems are not being able to ping each other. Second is, they are not being able to connect to the Internet ...
-5
votes
0answers
62 views

What is more preferred Kali Linux or Black Arch [on hold]

I am very good with Kali whilst other people keep asking me to use Black Arch or claiming Blackarch to be better. I know it has more tools but we cant be all be scriptkiddies, What do u have to say. ...
0
votes
0answers
50 views

Has human-generated entropy ever been a real problem? [migrated]

I know the topic of human brains generating random numbers has been discussed here and in Cognitive Sciences before, but I am interested in a particular part of it: In an introductory book to ...
0
votes
2answers
56 views

Understanding Certificate Pinning [duplicate]

I am attempting to implement certificate pinning across a suite of mobile apps. I have been reading a lot about the different strategies (pinning to the CA/intermediate, pinning to a leaf cert, ...
16
votes
3answers
2k views

Why do HTTPS requests include the host name in clear text?

I'm having a little bit of trouble understanding why the HTTPS protocol includes the host name in plain text. I have read that the host name and IP addresses of an HTTPS packet are not encrypted. Why ...
0
votes
2answers
20 views

Can I specific a public key name instead of recipient when encrypt with GPG

Can I do something like: gpg --public-key my.pub -e file.txt If I can, any reason that I should not do that? P/s: I think I don't need to know about the recipient because on my machine have only ...
1
vote
1answer
47 views

Buffer Overflow with Big Endian architecture

Could anyone help to solve the following practice problem related to buffer overflow? On this problem, I am confused about how the variables and addresses should be stored within the stack. Here ...
2
votes
2answers
75 views

How significant is the risk in having someone email/IM an htpasswd hash?

I need to set users up for subversion access, and we're currently stuck using htpasswd for our credential storage. If a user sends me an htpasswd record via email (or GChat / off the record?), what's ...
3
votes
0answers
37 views

Same version of Chrome, two different behavior regarding sha1 depracation [migrated]

i'm well aware of the changes made to Chrome 42 and sha1 signed certificates. Here a short reminder : https://blog.filippo.io/the-unofficial-chrome-sha1-faq/ Our client reported this problem and ...
0
votes
0answers
11 views

basic: adding a profile in Volatility [migrated]

Just starting out with the Volatility framework. I want to use a pre-built profile for OSX. I've downloaded the MacProfileAll.zip file and have copied the profile I want into the ...
2
votes
1answer
33 views

How to verify installed packages [on hold]

On Linux (Debian x64) I recently installed some software with: apt-get install the_package_name APT told me some packages couldn't be authenticated but I ignored the warning and installed anyway. ...
0
votes
0answers
24 views

OpenSSL: Display DH Parameters [migrated]

When using SSL Ciphers relying on a diffie hellman key exchange, the size of the private key employed is of crucial importance for the security of that key exchange. When I connect to a server using ...
-3
votes
0answers
35 views

security reason stops me from login into facebook [on hold]

The time limited was exceeded meaning it would not allow me to go forward.i had to pick a couple of friends pictures for security reason.
5
votes
1answer
105 views

Feedback for Study Plan (Kali Linux & Penetration Testing) [on hold]

I started to study pentesting for two months with the book named Penetration Testing - A Hands on Introduction to Hacking by Georgia Weidmann, and now I am really hungry to learn more :) . I think I ...
-2
votes
4answers
137 views

My wifi has been hacked [on hold]

The hacker has complete control of my computer; opening and shutting programs at will. Deleting files that display the remote user ip address. We have changed the password several times; but no ...
11
votes
4answers
2k views

Are short usernames a security concern?

I was somewhat suprised that the sysadmin approved a one-letter username like "m" and my username is also short ("nik"). I think that if usernames are brute force attacked then the username should ...
0
votes
0answers
34 views

Https request call capture in Wireshark [migrated]

I have installed Wireshark and Windows based application(to be analyzed) which uses https request authentication to validate user.When I use interfaces -- > capture all the request of my system is ...
-1
votes
0answers
29 views

Why does an exe's import Table have two refrences to kernel32.dll (or any other dll)? [on hold]

According to what I know, Import Descriptor table is made of an array of _IMAGE_IMPORT_DESCRIPTOR structures. There is one _IMAGE_IMPORT_DESCRIPTOR for every dll that is imported. I have an exe ...
0
votes
0answers
9 views

It is possible to make an IPSEC VPN Bonding? [migrated]

I wanted to know if It is possible to bound two IPSEC tunnels ? I've already done a VPN bonding of SSH tunnels, but It will be better if I use IPSEC.
-2
votes
0answers
20 views

Capturing screen app Using Phonegap [on hold]

I ma using the Phonegap deesktop app for the creating an app which will capture the screenshot of the current screen.Please help me
0
votes
1answer
47 views

How to pick an encryption algorithm (cipher) and mode for PHP's mcrypt, for encrypting passwords?

There are numerous algorithms listed in the PHP documentation: http://php.net/manual/en/mcrypt.ciphers.php How strong is each one and what criteria to use when picking one? Also the ...
4
votes
3answers
769 views

“Authorized” Man in the middle

I am implementing a TLS connection with a basic server and client. It’s a one way connection: the server has a certificate chained to the CA, and the client has a collection of trusted root ...
0
votes
1answer
18 views

Caching ARP to avoid L2 detection on switched network?

Using nmap on a very large (/16) switched network can lead to an excessive number of ARP requests which can be detected by simple ARP counters listening to broadcasted ARP requests. Is there a way ...
1
vote
1answer
124 views

Possible shellcode mailed to me

When I opened my email this morning I found a rather odd message in my mail box. It didn't seem like your every day spam email as it looked like a base64 encoded string and nothing else. Here is a ...
1
vote
1answer
22 views

How to handle disk encryption for remote connection?

I have at my workstation, an ubuntu 14.04 installation with full disk encryption. I now have to travel frequently for days and am planning to ssh into this machine from my chromebook to work remotely. ...
1
vote
3answers
47 views

External JS Security

I'm kinda new to security development. I've work mostly with backend processing stuff. I've been assign on how to secure external javascript that we import from facebook, twitter and google. One ...
-3
votes
0answers
16 views

how to ping on linux and a windows2000 on a virtual box [on hold]

i am just stating to learn the ethical hacking so i want to know how to ping Linux and windows2000 on a virtual box box to learn the simple hacking method

15 30 50 per page