16
votes
2answers
5k views

How should an application store its credentials

When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
1
vote
1answer
261 views

How to make sure that the public key has not been tampered with during transit?

I understand how public key infrastructure works. There is a private and public key, and someone may use the public key to encrypt data that can only be decrypted with the private key. However ...
0
votes
0answers
15 views

Securing FTP Creds in a Java Open Source API

I've written a basic Java API and source code must be released to a small community for the application to function correctly. The Java API helps developers track data for their running scripts and ...
-2
votes
0answers
21 views

How to completely restrict a device to a proxy?

Company-owned windows laptops, also chromebooks, also win & android & ios phones and tablets. Used anywhere & everywhere: office, home, trains, planes, automobiles. Is it possible to set ...
1
vote
1answer
23 views

What are common methods to verify symmetric encryption keys?

How can I be certain the same key that was used for encryption? I have an encrypted payload. I use a key and the decryption algorithm to decipher it. I understand data will be returned whether the ...
-4
votes
0answers
41 views

How was azure apps website defaced?

Recently we had 2 different html place holder websites that are hosted on azure apps had their index.html file replaced with some script kiddies hacker page and the old index file was renamed to ...
5
votes
2answers
104 views

What security features should a smart TV have?

With the proliferation of smart TVs, we can now browse the web, download movies and stream videos on a TV. A smart TV is essentially a computer. However, unlike a computer, a smart TV comes with an OS ...
0
votes
1answer
41 views

Checking if my username X is the same guy as username Y

I'm creating a new alias online for creative works that I don't want anyone I know in real life to see, but I'd like it to be possible for online people to check that things copyrighted and licensed ...
0
votes
0answers
35 views

Whatsapp and Viber information security

Is it possible for my ISP or government to MITM communication that I have made via one of these 2 services(I live in not so developed country) ? I think I am reasonably safe from attacks at transport ...
4
votes
2answers
46 views

Is this codes usage of document.location.toString() a DOM based XSS vulnerability?

I have come across the following JS code in multiple web applications. I think the reason for the popularity of this code snippet is this accepted answer on SO. Developers seem to be using this code a ...
4
votes
2answers
118 views

Is there a reason why /proc/interrupts is world-readable?

Reading this recent research paper on how to use information from /proc/interrupts to attack a system, I was wondering whether there is a particular reason why /proc/interrupts is world-readable. ...
1
vote
3answers
68 views

Could these special characters be used in a password?

To use a good password, I was thinking about adding special characters. I remember that some login services don't allow all characters. Perhaps it depends also on the keyboard layout. Could these ...
-8
votes
0answers
26 views

Make Website more secure [on hold]

how I make my website more secure and protect it from hack. To my knowledge https is just to Encrypts data only to a hacker can't see data Any help, any solution.
0
votes
0answers
10 views

Attacker's Potential Scope of Dmg if He/She can SSH into Android Phone

I've recently started researching the ability to SSH into an Android device. From what I've seen, this is a figured out challenge, which makes me wonder how much damage an attacker could do. Let's ...
1
vote
2answers
58 views

What's the difference between Radius and Kerberos?

Is Radius just a better version of Kerberos? I can't find anything about this. If you set up a Radius server in a modern network do you need Kerberos at all?
3
votes
2answers
327 views

Google Chrome on Android constantly being redirected

I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to ...
1
vote
1answer
27 views

Decypt des-sunos5.7 ecncrypted file by using OpenSSL in Linux

One of the shell scripts in our old Solaris 10 server uses below command to decrypt a file. des-sunos5.7 -d -u -k password enc_filename.tar.gz dec_filename.tar.gz Now we are migrating to RHEL 6 and ...
0
votes
1answer
68 views

Securing Internal Mobile REST API

I am planning to create an internal API for mobile devices for a company. They are planning to use this internal mobile app to get data from custom ERP, uploading contract, etc. Thus, it will be ...
5
votes
0answers
59 views

Is rowhammer comparable to faults caused by radiation?

As far as I know, both rowhammer and radiation based fault injection, can cause arbitrary bit flips in the memory. Are there any differences in matters of possible outcomes of both "attacks" on ...
-4
votes
0answers
94 views

This guy claims no need to apply any Windows update or use Antivirus! Do you agree? [duplicate]

He said only need to block all incoming connections and use Chrome sandbox. You can read his claim and his other replies over here: ...
1
vote
1answer
63 views

Could Diffie-Hellman be used to stop people who knows the PSK from snooping on your WiFi?

One known problem with WPA2 is that anybody who knows the preshared key can snoop on the handshake and decrypt all subsequent traffic between any parties on the network. In the typical coffee shop ...
0
votes
0answers
22 views

Use MDC to provide origin authentication for public key encryption?

Why can't we use an manipultation detection code (MDC) to provide origin authentication when using public-key encryption?
2
votes
1answer
51 views

Can a DNS “route” change cause an SSL certificate error?

What I mean by "route change": As a working example, mysite.example.net is set up as: mysite.example.net. 3600 IN CNAME some-other-site.elsewhere.com. ...
75
votes
2answers
12k views

How did someone log-in to my Gmail account from Kenya?

While on holiday in France in May I received an email from Google "New sign-in". Your Google Account was just used to sign in: Nairobi, Kenya. Tuesday, 26 May 2015 22:10 (East Africa Time). ...
1
vote
2answers
90 views

Certificate handling on a small network VPN

Background - I need to set up secure remote access for a small home office. I'm a bit of a noob and haven't needed to handle certificates before. I understand most of the setup but I want to ...
-2
votes
0answers
38 views

Cost estimation tools InfoSec [on hold]

Any suggestions for resources for software licensing costs and resources allocation for info-sec tools. I recall coming across such resources in the past but I did not bookmark at the time I was ...
0
votes
0answers
58 views

Need help in understanding packet analysis! [on hold]

The snapshot capture below contains a single HTTP request to a web server, in which the client web browser requests some files from server, and the server returns an HTTP/1.1 200 (OK) response which ...
2
votes
1answer
1k views

HTTPS green bar loads then goes away

I have properly configured SSL, and it loads pages when you put HTTPS. My problem is that when the page is loading. The bar will turn green, once the page is fully loaded. The green bar goes away. The ...
0
votes
0answers
65 views

How do I securely encrypt and store database encryption keys? [duplicate]

I have a database with encrypted information, and want to encrypt each entry with a different key. Then I want to store the encrypted keys in another database. I know I have to encrypt the keys before ...
0
votes
1answer
225 views

How long will it take to break a salted password?

Let's say that I have a system where all passwords must be 8 characters long and each character can be any 32 different values. All my passwords are hashed with a salt. I can test 64 passwords per ...
9
votes
1answer
490 views

Do randomized PID bring more security?

What is the concrete advantage of using random PIDs instead of traditional sequential ones? Some times ago, I've read an article in the french magazine MISC (no. 74 - July/August, 2014) publishing a ...
0
votes
1answer
45 views

Use John the Ripper to permutate cases in one password?

I'm currently testing standard pentest stuff on a Windows XP SP3 VM. I managed to compromise it and saved the SAM file with the password hashes. I used ophcrack with the "fast and free" and "small and ...
-2
votes
1answer
18 views

Key hierarchy structure

If I am going to use a master key to generate a session key, the master key must be "stronger" than the session key. For instance, I should not be distributing a 128-bit AES keys with a 56-bit DES ...
3
votes
3answers
167 views

Sending sensitive infromation via self destructing link in an email

I need to come up with a simple way for people within the company to send out arbitrary sensitive information to arbitrary recipients. There is an equal chance that the sender and recipient will be ...
3
votes
1answer
59 views

Are there problems with reusing strong passwords for private gpg keys

I am currently maintaining a few different identities each associated with different gpg keys (for personal, academic, professional correspondence etc., whether or not this is a good idea is probably ...
1
vote
2answers
78 views

Login attempt password logging and obfuscation

I have a third party app that records the password from every login attempt (regardless of success or failure). Is this a standard operation and does it really serve any meaningful security purpose? ...
0
votes
2answers
200 views

What can I do about being heavily port scanned?

I have two devices connected wirelessly to my Linksys router while running Symantec Endpoint Protection on my computer. A few days ago I started using the internet by connecting the cable directly to ...
1
vote
2answers
146 views

Strange 'agetty' process running on my VPS.

Recently, I had to reinstall one of my VPS servers (again), due to malware. I took what I considered to be pretty good security precautions. I also locked the root account and am using sudo as well. ...
3
votes
2answers
1k views

What OS's will “brick” a stolen phone; preventing their use or resale by a potential thief?

You can look at this question in two ways: Prior to purchasing a used phone, I want to ensure that the IMEI is not locked and I'm able to use it fully. Or you can be a purchaser who wants to devalue ...
1
vote
1answer
47 views

What to do with an APK file containing Swf.Exploit.CVE_2015_0323-1 and ELF File?

I received an APK file from a source. Prior to installation, I ran a virus scan on it. The result had following main features: The file contained Swf.Exploit.CVE_2015_0323-1 It required ...
-1
votes
0answers
31 views

Technique to put highest privileges backdoor on compromised Linux machine and how to remove it? [on hold]

What are the techniques attackers use after they compromised a Linux server to put a highest privileges backdoor to get access back in future? How can I track this type of backdoor and remove it?
13
votes
3answers
2k views

How are SPAMmers using LinkedIn “http://linkedin.com/slink?code=…” URLs?

I was sent this kind of link from presumably compromised Skype account, via a skype message: (do NOT click unless you have a sandbox or something to protect you) ...
12
votes
6answers
2k views

Why do coffee shops not use WPA/WPA2? Would it solve many problems if they did?

So I'm looking into public WiFi security in places such as hotels, coffee shops etc. It seems the current standard is just to use open wi fi connections in many of these locations. I would assume this ...
0
votes
0answers
21 views

Avoid undeleting corrupted/partially overwritten files [migrated]

Recently I dealt with some computers infected by ransomware, with encrypted user files. My job was to either decrypt these files (if possible), or recover as much usable files as possible. That ...
1
vote
0answers
36 views

“Rollback process” for different penetration testing in case of something goes wrong?

In some extent, different kind of vulnerability assessment and penetration testing may impact on target system. I am looking for the solution/rollback process if something goes wrong during test. ...
2
votes
1answer
68 views

Incident isolation and containment approach

In incident response, there are commonly two approaches to isolation and containment after a genuine incident is reported. Compromised systems are disabled or disconnected but operations carries on ...
1
vote
2answers
69 views

Comprimising or affecting card readers, billing systems, or POS terminals using a malicious card

Our company got a new card printer for employee IDs. It was a bit expensive and we had to undergo a background as it allowed us to print both mag strips and EMV chips. I don't understand enough about ...
1
vote
0answers
94 views

Is control theory of any use in the Infosec disciplines? [closed]

I'm currently studying Engineering in a European university (not CEng, though), and I've always been fascinated by the network security/information security field. As far as I know, crypto is the ...
0
votes
0answers
66 views

What does this injected query achieve?

On this very good link you can see some SQL injection expressions for MySQL. Quick Detection Error Based SQLi For integer inputs: (select 1 and row(1,1)>(select ...
0
votes
0answers
20 views

Providing identity verification via confirmed contact info to unconfirmed address w/o leaking information?

I emailed a known e-mail address for my local telecommunications/internet company about a complaint with their service. It appears the person I emailed forwarded this to somebody else in their office ...

15 30 50 per page