-1
votes
1answer
530 views

where to get the latest trends about penetration testing systems? [closed]

I am an undergraduate student, who want to do a project in penetration testing automation, and i want a conference or some official source to obtain some latest researches from inorder to see what to ...
6
votes
3answers
668 views

How dangerous is it to use CSS styles from an untrusted source?

I'm a moderator at a forum. We want to have a new style for the forum. We're thinking about announcing a competition to the users to come up with the best CSS design; we would adopt the best ...
2
votes
1answer
3k views

Is Google's Hangout using encrypted communication?

I am trying to use Google's Hangout as alternative to WebEx for sharing screen. But not sure if it is safe.
3
votes
3answers
2k views

How to block user from using GoToMyPC or Teamviewer

Recently, we found our users install GoToMyPC and Teamviewer on their workstations. What is the standard approach to block users' personal use of remote desktop control?
8
votes
4answers
827 views

Preventing insecure webapp on subdomain compromise security of main webapp

I want your help on getting more concrete information on a type of vulnerability that I remember vaguely. I vaguely remember hearing about a year ago that if you set up a webapp on a subdomain, and ...
0
votes
1answer
162 views

Comparison between Data Encryption Tools and Data Sanitization Tools [closed]

What are the famous Data Sanitization Tools for languages such as ASP/PHP/Html Web Sites? Which Data Sanitization tools have the best results? Difference between Data encryption and Data ...
0
votes
1answer
212 views

Why unsupervised anomaly-based intrustion detection training data should be normal or less noisy

I recently read a paper which stated that "Traditional anomaly detection algorithms require a set of purely normal data from which they train their model" [1]. But as in K-means, or other unsupervised ...
1
vote
1answer
483 views

Are there any test cases to ensure the “web-attacks.rules” snort file works correctly?

I have set up an free evaluation Confluence Server on my local host and have configured "snort.conf" to point to my localhost as "HOME_NET" environment variable. I tried to test the ICMP rule by ...
2
votes
1answer
3k views

Stopping Session Hijacking

If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
6
votes
2answers
671 views

How is the available entropy in /dev/random calculated (or estimated)?

It seems (to a non-expert) that /dev/random is acclaimed to be useable as a source of pure random data. However, I am curious as to the analysis of the file /dev/random. /dev/random is a collection ...
-3
votes
1answer
222 views

What Type Of Encoding Is This? [closed]

I need help, what type of encoding is this? It is a popular encoding, not an encryption. begin 666 Restricted.zip M4$L#!!0````(`%T[="_]<LYX`P(``'0#```.````4F5S=')I8W1E9"YT>'1M ...
1
vote
1answer
107 views

How are root CAs for SSL distributed?

For internet explorer or whatever, I get it... It's in essence a sneakernet, you get them on the physical media from which you install your system and browser. But what about for firefox and chrome? ...
4
votes
3answers
1k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
2
votes
2answers
332 views

How should you store a password that needs to be retrieved as plaintext? [duplicate]

Possible Duplicate: How should passwords be stored if they must be recoverable? I have created an API for a site that doesn't provide any form of API. For the API to do anything with the ...
0
votes
1answer
236 views

How does an IDS system use PCAP to process malicious signatures?

I have been wondering exactly how does an IDS system use packet captures (PCAP) to process and alert of malicious signatures?
4
votes
3answers
654 views

How do you verify a certificate belongs to a domain?

I'm using PHP and trying to verify a SSL certificate belongs to the SMTP domain/IP I'm connecting to. Currently I can verify the certificate is valid using the following code $resource = fsockopen( ...
4
votes
1answer
628 views

Creating a DDoS attack using DirectConnect

I have been trying to hack around with Apex DirectConnect. What I wish to do is to utilize the querying nature of P2P apps like DC to generate a DDoS attack (see links for reference here, here and ...
3
votes
1answer
302 views

HTTP over GPRS - is it secure?

I have project involving a M2M device. The device is not capable of HTTPS but may be required to send and receive information that we would rather not be leaked out. The device will communicate ...
5
votes
1answer
280 views

Most efficient key algorithm for a TLS server key?

Let's assume I want to setup a HTTPS service on a modern-but-no-so-speedy x86 server without any form of hardware cryptographic accelerator. Which key algorithm should I choose for the server key in ...
1
vote
2answers
871 views

Wipe free space with zeros, how secure? [duplicate]

Possible Duplicate: How can I reliably erase all information on a hard drive? If I wipe free space with zeros instead of random data to finish fast will that write old file to be ...
1
vote
1answer
292 views

Protect database resources from fake data inputs via web forms

Scenario: I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
2
votes
1answer
294 views

solaris equivalent of /proc/self/environ LFI

I need to exploit a Solaris vulnerability for class, but we never dealt with Solaris before and I never installed it. Does Solaris have an equivalent to Linux's /proc/self/environ, exposing a ...
5
votes
2answers
572 views

Encryption key storage

I recently inherited an in-house built key storage system. The company stores credit card data in two database servers which are AES encrypted. The keys reside in a separate system that is located in ...
0
votes
3answers
304 views

Petraeus scandal - what would have been a better way to communicate electronically [closed]

Not a security professional here but .... having read through how it happened, it's clear sending these emails from the shared account by Paula Broadwell was the problem (if I understand correctly). ...
7
votes
1answer
4k views

Which key usages are required by each key exchange method?

I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key ...
6
votes
1answer
282 views

Security announcement mailing list for Java

I didn't find a security announcement mailing list for Java (from Oracle). How to get notified about new Java patches? I am not interested in other Oracle products. For example Apple provides such a ...
5
votes
2answers
787 views

How to store OTP seed securely at the validating server

'Everyone' knows when storing passwords in a database this should be done securely for example by using salts and an appropriate hashing algorithm. Most OTP (One Time Password) solutions are based on ...
2
votes
1answer
102 views

What's the best way to enumerate log/sign in attempts?

For sign in via a website, what is the best way to count the number of attempts that is: least vulnerable to tampering reliable quick The system would: use HTTPS throughout the sign on phase (at ...
1
vote
1answer
389 views

When distributing a CRL over HTTP, what is the optimal refresh time? What logic affects this decision?

When distributing a CRL over HTTP, what is the optimal cache and max age settings (etc) for this distribution mechanism? Related information on a different answer Consider using HTTP instead ...
3
votes
4answers
1k views

What XSS attacks doesn't “Reflective XSS Protection” defeat?

Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability. So ...
3
votes
2answers
1k views

Is it legal to store/send user's device's IMEI/MEID? [closed]

I'm working on an Android application with a "ban-system". The customer suggested using devices' IMEI/MEID as identifier and asked me about legal issues about that. Is it legal to store/send user's ...
1
vote
2answers
241 views

Good Practices to secure a Gaming Web Server, Memcached Server & MySQL Server

We have developed Game for Facebook platform. We have several Gaming Web Server, Memcached Server & MySQL Server. Here we have to work with facebook Payment API. We need to secure enough our ...
4
votes
1answer
2k views

AIA/CRL locations for Offline Root

I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building It's an ...
2
votes
4answers
281 views

FOUO on hosted sharepoint

I and few of my fellow employees were asking if it was okay to put FOUO (NSA issued) documents on SharePoint. The main justification was that its password protected (which is correct). But its a ...
3
votes
3answers
302 views

Why is it necessary to validate data in a servlet obtained by calling HttpSession.getAttribute()?

I am new to WebApp programming and am trying to understand the security implications of not validating data obtained by calling the javax.servlet.http.HttpSession.getAttribute() interface method. I ...
18
votes
5answers
2k views

What are the supposed security benefits of a “dead-drop” email strategy?

This was in the news recently. Here's what they were said to have been doing: Petraeus and Broadwell apparently used a trick, known to terrorists and teenagers alike, to conceal their email ...
1
vote
3answers
637 views

Validate hmac with hashed stored key

What if an HMAC is correctly generated and sent with the data to the server, so far I know the server needs to know the original data with which the MAC was created in order to re-create the MAC and ...
5
votes
3answers
3k views

What is a Shrink Wrap code attack?

On my C|EH course I have heard about term "Shrink Wrap Code Attack", but we've only mentioned it. Now trying to do some research and refresh the topics, I can't seem to find serious description of ...
-3
votes
1answer
234 views

Can i apply the 270Mbps mode on my Netgear CBVG834G or increase frequency range? [closed]

I have a two floor apartment and my router is downstairs. My reception is lousy on the 1st floor and I am trying to find a solution without having to buy new equipment. I've tried to change the ...
1
vote
3answers
1k views

What reputable site should I download Putty from?

I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code. If you needed to download Putty for a high security Windows ...
7
votes
4answers
689 views

applications of linear algebra to “security”?

I am taking a course in linear algebra which was to be credited towards a program in applied math. My interests have moved towards matters of "security" (information, network, cryptographic, etc.). ...
2
votes
3answers
713 views

In depth security: splitting key in different places

I use AES encryption on a website. At the moment, the key is stored in the source of the PHP script that does the encryption/decryption process thanks to openssl. I know that it isn't secure, so I ...
1
vote
1answer
204 views

Worst-case scenario for ShellExecute(0,“open”,arbitrary_string)

I found an application that uses ShellExecute to open hyperlinks. However, it doesn't check if the string is actually a hyperlink - it is passed directly to ShellExecute. Aside from opening arbitrary ...
5
votes
4answers
3k views

Is a 3 or 4 digit CVV enough for online transactions?

Background: The CVV/CVV2 number ("Card Verification Value") on a credit card or debit card is a 3 or 4 digit number printed on the card. It is 3 digits on VISA, MasterCard and Discover branded credit ...
0
votes
3answers
488 views

Key stretching an hash

if I implement an function which hashes the first half of my password with MD5 and the second half with SHA2 and MD5. Is there a security issue when I put these two hashes together to a 64 character ...
2
votes
2answers
1k views

Use truecrypt to make data unrecoverable

If I format all my drivers c,d,e,f and then make a truecrypt volumes equal to drive size then delete it 'the voulme' will that make the old data unrecoverable ex. d:= 30g i use truecrypt to make 30g ...
3
votes
1answer
1k views

How to restrict SSH access outside of LAN? [closed]

We have several dedicated servers. We need to ensure "root" user can not be accessible through SSH outside of LAN. I have searched and found the followings # ...
22
votes
3answers
1k views

Webmail host knows my password

I forgot the password to a webmail account and they didn't have an automated password recovery process. So I had to chat with their support and they asked a few verification questions then proceeded ...
2
votes
1answer
190 views

Determining how my Wordpress website was compromised

I have got a blog running Wordpress. The last time I visited my blog I realized it was hacked. The website redirects to a phishing page of paypal meanwhile other links a opening fine. I want to know ...
1
vote
1answer
449 views

How to write Snort rules based on MAC address?

I would like to create Snort rules based on MAC addresses instead of IP addresses. Most devices on the network are DHCP assigned, and I would like to ignore certain traffic (ex: Dropbox) for some ...

15 30 50 per page