21
votes
4answers
21k views

What is the use of stolen credit card details?

What can a person with stolen credit card details do? Buy porn? Buy tons of server resources to perform an attack? What else? I'm sure that if he buys books, shoes and bicycles or transfer funds ...
2
votes
1answer
3k views

Detected Port Scanning Attack in ESET Smart Security

I receive a number of notifications from ESET Smart Security about Port Scanning attack. But I'm behind a router. But as far as I know, computers behind a router is not accessible from others (Please ...
1
vote
2answers
733 views

How to react on a message about a pending account ban on Facebook? [closed]

Are you getting this message on chat? LAST WARNING : Your account is reported to have violated the policies that are considered annoying or insulting Facebook users. Until we system will disable ...
3
votes
1answer
2k views

Is opening both TCP/UDP less secured than just TCP or UDP when needed and why?

If application needs opened port X UDP, or X TCP combination. Is there any potential risk by opening both UDP/TCP as I usually am not sure which one the application uses?
9
votes
2answers
121 views

Encouraging security researchers to disclose vulnerabilities

What are approaches to forming solid relationships with security researchers? For example, is publishing a public PGP key on the "contact us" page of a company's website for high levels of risk ...
6
votes
2answers
451 views

International pentester certification

I've looked at the questions regarding certifications on this site and they are essentially asking what to go for. I hope that my question is distinct enough that is is not considered a dupe. I ...
21
votes
2answers
7k views

Can web sites detect whether you are using private browsing mode?

Most modern browsers support "private browsing mode" (also known in Chrome as "Incognito mode"), where the browser does not save any information to disk about your browsing while in this mode. In ...
4
votes
0answers
1k views

How can you remove your presence from the Internet? [duplicate]

How can you remove your presence from the Internet? For example from social networks, from email servers, from forums etc. Problem is how records of you are identified on the internet? We have well ...
8
votes
1answer
985 views

Closing an HTML element without using literal slashes?

I'm investigating a vulnerability in an application that echoes a user-supplied filename without sanitizing the filename. E.g. a file named test-<script>alert("evil");.txt will result in that ...
3
votes
2answers
121 views

When using a recovery disk, like AVGs boot-able CD, to scan for viruses, malware etc… what are the limitations?

What I like about about the boot-able CD concept, is it can connect to the Internet and get updates, however I'm not clear how effective they are at really finding things that are heuristic? How do ...
4
votes
3answers
882 views

Does Hash/Salted password really help when DB is compromised?

I came across this article and got a basic understanding hash, salt and brute force attack. My question is in the article, the author emphasises how hard it is to reverse the hash/salted password to ...
21
votes
4answers
8k views

Does a Virtual Machine stop malware from doing harm?

I would like to know if it is save for the host system of a virtual machine (VM - VirtualBox OSE in my case) to execute malware. Can a virus break out and read or write data from the host system? ...
3
votes
2answers
1k views

What is more secure: ISDN, Cable Modem, DSL, T1, etc…?

This discussion came after showing a friend this Security.SE post regarding DNS attacks, and after reading about a Cable Modem MITM attack. Given the current options available to consumers, what ...
3
votes
2answers
372 views

Secure Software Development

I'm researching models on building security into the SDLC and so far have come across: BSIMM Microsoft SDL Open SAMM Are there any other documents and resources to look into? Specific tools that ...
5
votes
2answers
285 views

Ethics and economy in security research

How can we design a market for information disclosure where individual security researchers may benefit economically in an ethical way? Assume a market where the participants are governments, ...
1
vote
2answers
585 views

Strange Event Log Entry - Windows Server 2008

Reviewing some logs recently, and came across a strange failure in our Windows 2008 DC. An account failed to log on. Subject: Security ID: NULL SID Account Name: ...
2
votes
3answers
535 views

Any place where I can find some template or base documents for IT/Infosec Compliance?

We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
6
votes
1answer
413 views

OpenPGP Encryption / Decryption Process Using GnuPG

I want to know if my method of encryption can ensure the security of my data if my database was hacked as well as the authenticity of the data I am decrypting. I am using GnuPG's implementation of the ...
6
votes
3answers
650 views

Global check of input/output of known hash functions

Is there a website, application, or script that will allow you to give an input/output for a hash function, run these against known functions, and return any matches? Here's one attempt to list the ...
5
votes
4answers
1k views

Server wide javascript injection

UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript. I'm troubleshooting a hacked website ...
2
votes
2answers
1k views

Secure SSL Session from losing itself into unsecure http

I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
2
votes
3answers
129 views

Identifying and preventing execution of “any” function via Late-Bound commands

The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
8
votes
3answers
1k views

How to recover securely deleted data

Since we all know files are recoverable with programs after being deleted from the recycling bin, everyone is told to do secure wipes by putting random data over the files you're deleting on the disk ...
27
votes
6answers
11k views

Trying to make a Django-based site use HTTPS-only, not sure if it's secure?

The EFF recommends using HTTPS everywhere on your site, and I'm sure this site would agree. When I asked a question about using Django to implement HTTPS on my login page, that was certainly the ...
5
votes
7answers
4k views

GPU powered Password cracking machine - buy metal or cloud?

As a IS consulting firm, we would like to have our very own password cracking machine. Great. Now, after some sketching and brain storming we concluded that GPU is the best way to go (contrary to CPU ...
4
votes
1answer
3k views

openssl verify signature

For S/MIME, I now know I can verify PKCS#7 detached signatures with: openssl smime -verify -in detachedsign.pem -content content.txt But what about non-MIME messages? So if I sign the message ...
1
vote
1answer
343 views

How to perform eavesdropping [closed]

How eavesdropping is performed? Can I perform eavesdropping by sitting on client side? Can eavesdropping be done in both wired and wireless transmission too?
5
votes
6answers
539 views

What is the use of password encryption?

Why do we encrypt passwords? Is it to protect the password from eavesdropping? to protect the password after saving it in database? both? or for some other reason?
3
votes
1answer
551 views

Mac sending hundreds of packets to gateway

I've got a user on my work network who brings her personal laptop (macbook) in for work. They've been having some horrendously slow network issues on everything past that hub, so I did some packet ...
8
votes
2answers
631 views

Are different hash algorithms ever used together?

I was wondering if different hashes (e.g. md5(sha1($data)) ) are ever used together for data security and if there was any reason for it (either positive or negative answer).
3
votes
2answers
282 views

Null content digitally signed message

IA technical specification I'm following requires me to send: The Digital Signature must be in the form of a null content Digitally Signed message (i.e. a PKCS#7 object containing the signature ...
10
votes
3answers
291 views

How to test if a browser add-on is safe

I came across this plug-in that started some alarm bells ringing. The add-on would help submit a website to web directories. The first 100 submissions are free, then you need to pay $20 via pay-pal ...
7
votes
3answers
6k views

How to listen to all ports (UDP and TCP) or make them all appear open (linux)

I got an external Debian server. The problem is that my university campus doesn't allow connections to go outside when the port is different than TCP port 22, 80, 443, or UDP port 123. I tested them ...
5
votes
9answers
3k views

What is the best way of securing a website logon without SSL or preshared keys?

Today I sniffed some unencrypted wlan traffic during class and I found quite a few passwords by a simple search for "pass" and "user" in wireshark. Turns out about half the sites we use for school ...
6
votes
3answers
618 views

How effective is something like Deep Freeze against boot sector infections?

I work for an embedded system manufacturer and on our older generation systems, which are powered by Windows Embedded, a number of customers have been experiencing virus infections. Due to the real ...
2
votes
2answers
210 views

Scan Novell NetWare backend with Windows servers and clients

Could anyone provide some insight on performing an internal vulnerability assessment regarding Novell NetWare as the backend with client workstations and servers running various versions of Windows? ...
9
votes
5answers
6k views

What does “key with length of x bits” mean?

I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
3
votes
3answers
10k views

How to force ALL programs to use my Proxy?

I have a local proxy on my PC. (localhost:8888) But unfortunately there are many programs which are not able to go through this proxy. So how can I force all my programs to go through my local proxy ...
2
votes
1answer
103 views

Privacy policy about links to other sites

In many of the privacy policies, I noticed there is one section as a disclaimer mainly talking about "our websites contain links to other websites, and it is your own risk/responsibility to familiar ...
12
votes
3answers
2k views

How are mobile telephony networks like LTE and HSPA encrypted?

How are mobile telephony networks like LTE (4G) and HSPA (3G) encrypted? between what parts is the communication encrypted? who has access to the keys? is symmetric or asymmetric encryption used? is ...
8
votes
3answers
955 views

How do I log all my internet-connections

How can I (maybe with a proxy, but I need names of programs!?) log all my interactions of programs with my Internet connection, so that I could see WHAT a program is sending and WHAT it is receiving. ...
6
votes
1answer
836 views

Select a TripleDES key so that it effectively behaves as regular DES

I'm working with a smartcard (DESFire) that supports both TripleDES and DES. In the specs it is stated that both modes of operation use 16 bytes keys. When the first 8 bytes in the key are identical ...
3
votes
1answer
549 views

challenge-responce and man-in-the-middle

Is man in the middle attack possible in a typical challenge-response based authentication? For a typical reference one can go through this paper. My question is that is it possible for an intruder to ...
3
votes
2answers
527 views

What additional difficulties are present in performing ARP poisoning on a secure wireless network (WEP, WPA) vs. an insecure one?

I just finished a project in which I coded a man in the middle attack on an unsecure network. I've tried to see how feasible it would be to extend this a secured network. Some internet searching has ...
8
votes
1answer
491 views

What role does cryptography play in anti-piracy?

As a follow-up to Cipher for Product Registration, are there secure yet usable cryptographic standards/protocols for protecting software and data used by software? I'm interested in hardware and ...
7
votes
4answers
852 views

Why is it a good idea that X.509 digital certificates have an expiry date?

What is the benefit of having certificates expire at some fixed date?
14
votes
4answers
588 views

How should I respond to poor password security?

My son's school uses a 3rd party to handle tuition and fee payments. I have recently come to the realization that they completely fail in the area of password security. Last month they sent a ...
6
votes
2answers
685 views

How do I log everything a certain program is doing?

i have a program which is pretty simple. Its just a simple login form. Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
9
votes
6answers
483 views

What are web attacks which users can run code on your servers?

I hear stories about insecure web servers and sites which people (or bots) break into and execute their own code on the server. My question is how is that possible? I heard of people putting their ...
3
votes
1answer
4k views

URLEncode vs HTMLEncode for XSS prevention

I have one project (in Java) that the programmer used URLEncode to output content as part of HTML instead of HTMLEncode. What is the risk that it is XSS vulnerable? (Let’s forget that it’s different ...

15 30 50 per page