1
vote
1answer
35 views

Cookie Tossing explained

Can someone explain to me what cookie tossing is? and how it can be used to hijack someone's session? and also how can we prevent it? I am a bit confused about this subject.
1
vote
1answer
39 views

Should reverse connections be used to bypass NATs?

I'm planning on doing a demonstration on how remote administrative tools work for my schools computer security club. I plan on writing a RAT in C++ and demonstrating/explaining how it works. I ran ...
0
votes
0answers
10 views

How many kbdclasses are normal?

I use a laptop and never had used any external keyboards. Is there a keylogger hiding? What to do?
2
votes
1answer
49 views

Why isn't recommended to use time-based blind for bruceforcing table/column names?

When not having priveleges on the session user you're using with sqlmap this warning appears when trying to retrieve table/column names, offering you to brute force names using a dictionary file, do ...
1
vote
2answers
51 views

is IPSEC Authentication between local domain hosts a part of normal behaviour in a Windows network?

I am seeing lot of IPSEC Authentication messages in eventlogs of Windows domain hosts. I was wondering if this - setting up IPSEC connections between domain workstations is a part of normal Windows ...
1
vote
1answer
101 views

Extremely suspicious UDP network traffic when idle [on hold]

My computer has been using about 7Mbps when idle, it does the same thing even I am playing games and such. This is the Wireshark capture ...
52
votes
10answers
11k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
0
votes
0answers
30 views

Where can I find a collection of tried and true Security Protocols?

Just as it's a good idea not to invent your own encryption standard (unless you are an expert), I'm assuming that it's also not a good idea to invent your own security protocol. Since I'm probably ...
-3
votes
1answer
84 views

Download Torrents on University network without detection [on hold]

I am wanting to download some things using Bittorrent, but I have heard that they can detect when someone is downloading torrents. How can they detect this? And are there any precautions I can do to ...
3
votes
1answer
43 views

Will PGP signed email be blocked in China?

I generally sign all of my outgoing email with PGP. I don't usually encrypt it because most people I send mail to don't have a public key. Anyway, if I send an unencrypted message with a PGP signature ...
1
vote
2answers
119 views

Getting Loads of Emails 'linking' my account to Gmail accounts I know nothing about

I have just come out of hospital and have in the region of 30 e-mails from gmail over the past few days 'linking' a gmail account to my (hotmail) email address. I have not done this once never mind ...
0
votes
1answer
64 views

which password was paired with my gmail address

Recently media have reported that a file of about 5 million gmail address and password pairs was published on a Russian Bitcoin forum. A media article on the leak Other media have reported that the ...
18
votes
3answers
4k views

Are popular porn sites more likely to be infected with malware?

I'm trying to help my friend understand this because he believes that since a site is very popular, that it's less likely to infect its viewers because of its security! Is a popular site less likely ...
2
votes
2answers
210 views

I believe my Domain has been hijacked I am not receiving in sales in shopping cart

My IP address is 181.224.153.95 Domain: www.ashaybythebay.com FTP Hostname: m23.siteground.biz I added private domain servers to my domain name ashaybythebay.com and I see the two IP server ...
3
votes
2answers
64 views

What role do hashes play in TLS/SSL certificate validation?

After coming across this question in the Hot Network Questions section and reading the related blog post by Google, I'm starting to become curious as to what role these hash functions play in TLS/SSL ...
0
votes
0answers
43 views

How are brute force attacks hitting my WP website after renaming wp-admin folder?

We maintain several wordpress websites which receive regular attempts at brute forcing the admin credentials. Part of our standard rollout package is installing the All in One WP Security and Firewall ...
3
votes
1answer
73 views

Secure REST API and Single Page App by using external OAuth 2 Authorization Code

I am trying to understand how to implement an OAuth 2 Authorization Code flow when having both a single page JS app and a REST API. The aim is to secure access to the REST API by offloading ...
1
vote
3answers
114 views

Are windows users passwords easier to crack than linux?

If i set the same password in both linux and Windows, is it easier for a hacker to break the windows password? If so why and how can i create a windows password in the same security level as Linux?
4
votes
4answers
195 views

Does Windows have a built-in password store?

What passwords are stored in Microsoft Windows? How can I know what password are saved in computer?
0
votes
1answer
55 views

How does credit cards authorization work

Few days ago I heard a professional scammer explaining how he exploits the banks, I cant find the right word to describe his actions, even the word scam does not fit as he is not breaking the law but ...
0
votes
1answer
50 views

User “ASP” logged in to windows server - hacking attempt?

I run a windows server 2008 which I connect to both via VNC and via remote desktop. Yesterday I noted when I connected to it via VNC that another user was logged in. See images. Notes: I have no ...
1
vote
1answer
271 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
0
votes
0answers
53 views

Suspected virus in my Windows 8.1 [migrated]

I suspect that I have a virus in my computer. There is a large amount of UDP traffic in my network card, I installed Wireshark and there was large amounts of UDP traffic, all of them are from the same ...
1
vote
1answer
29 views

How does authentication work without OAuth in mobile apps?

I have a (Drupal) website that needs a companion mobile app for some stuff (quite customized, not just creating/viewing nodes). I know I can use OAuth for this, but I was wondering about alternatives ...
0
votes
1answer
96 views

Can running a script while logged in compromise my facebook password?

In websites related to facebook malware analysis and information, we often see messages to the effect of if you have run this facebook app then your account has been compromised, or if you went to ...
0
votes
0answers
14 views

Which IPTables chains should I log from a security perspective

So far I've always been logging the INPUT and OUTPUT chains because I only used iptables as host firewall. Now I'm configuring network firewall which uses iptables, but I don't know whether I should ...
0
votes
0answers
14 views

Are USB hard disks less reliable for backups? [migrated]

A colleague told me that it is not recommended to use USB hard disks due to the lack of inherent integrity checking of copied files. I am looking for details on that. In what respect is copying to a ...
15
votes
6answers
4k views

My IP (with a NAS) is targeted by a hacker. What to do? Should I be worried?

I've noticed based on the logging of my NAS that my IP is targetted by a hacker. I already took action by automaticly ban the IP address permantly after 5 unsuccesfull login attemps. Unfortunatly the ...
0
votes
1answer
19 views

Verification code generation and expiration

I am trying to implement an application that includes registration, In order to register to the system the user shall enter his organization ID number let's say. To verify the user identity, a ...
32
votes
5answers
21k views

Does https prevent man in the middle attacks by proxy server?

There is a desktop client A connecting to website W in a https connection A --> W Somehow between A and W, there is a proxy G. A --> G --> W In this case, will G be able to get the ...
47
votes
4answers
12k views

Are all SSL Certificates equal?

After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against. Are all SSL ...
1
vote
1answer
92 views

How to perform penetration testing of Blackberry mobile applications?

I wish to start with blackberry mobile application penetration testing. I researched on net but no "in-depth" knowledge is available. Here is a good article but not much is covered. ...
3
votes
1answer
559 views

CakePHP Set-Cookie Response Header

I am familiar with the cakePHP cookie and session settings but I am unsure as to why (when analyzing through the Burp Proxy Suite I am finding 2 separate Set-Cookie responses: Set-Cookie: ...
-1
votes
2answers
55 views

Is my Password Hashing Secure or not?

I have recently created a code for hashing password. Can you please give your advice over the security of my code? The function takes a password, then converts it to a number. #include <string> ...
0
votes
0answers
19 views

What is the difference between session fixation and session recreation?

I have read that both of them are conventionally the same. But there must be a few differences which differentiates the two terms. Anyone please explain.
-1
votes
2answers
56 views

Simple Ciphers to Create Secure Passwords

A shift cipher shifts every letter of a word by "n" amount and creates new word. The number of possible keys in the shift cipher is equal the size of the alphabet set from which the word is derived. ...
0
votes
0answers
52 views

The old lady at my local city hall refuses my email because it does not contain my complete full name (with middle name) before the @. What can I do? [on hold]

I happen to be blessed with a middle name which I never use. For my gmail address which I have been using on a daily basis for the past years, I picked my first and last name, e.g. ...
0
votes
1answer
64 views

Smart Token Security Test [on hold]

I have a question. One of my colleague gave me a Smart Token which consists of public/private key inside and asked me if I can test its security. I said it should be tested in a equipped lab for ...
0
votes
1answer
36 views

Creating a secure home network - Which firm ware should I use and how should I configure my firewall?

I am starting to take on more and more enterprise clients while working remotely from my home office. I have a pretty secure network at the moment, but I have a lot hardware that I am not using and ...
0
votes
1answer
97 views

Tracking IP address to prevent abuse without logging user metadata

I am trying to balance good security practices against excessive logging of user metadata / Personally Identifiable Information. I am constructing a web app that tracks IP addresses to prevent abuse, ...
0
votes
0answers
11 views

Where are my passwords stored in browser? [migrated]

When i click the remember me radio while signing into a web application, I know that my password is saved into somewhere inside my browser. I want to know the exact location of that file in my OS ...
-1
votes
5answers
68 views

How difficult is it to protect your storage from data recovery

Many of my customers refuse to sell or recycle their old hard drives or mobile phones because everybody now-days talks about how popular data recovery program's are. Isn't it enough to use a software ...
-1
votes
0answers
29 views

Securing wp-admin folder - Purpose?

I am trying to understand how to secure a WordPress site. One security task I do not understand is...How important is it to protect the "wp-admin folder"? For example, I would consider limit login ...
1
vote
1answer
203 views

Requiring 2 keys to access a content

I need to use an external service that can only be accessed by password. I don't like the idea of storing the plaintext password on the server, but AFAIK there's not much I can do. Considering this ...
0
votes
0answers
45 views

How can I safely include the encryption key in the encrypted file?

I am encrypting text files using AES256 (no particular reason, that can easily be changed). Before granting access to a file, I need to verify if a party knows the correct key, but without necessarily ...
2
votes
1answer
219 views

how secure is javascript based oauth2.0

Javascript based oauth exposes the client id of the application and it trusts only on the domain requesting the access token. The domain name can be forged with a dns hijack(or a virus affecting ...
1
vote
4answers
310 views

Achieving End to End encryption with TLS

The scenario is that a client browser (eg: a user trying to log in to a bank website) needs to be able to view certain sensitive information that resides in a mainframe sitting in the Internal network ...
2
votes
1answer
35 views

When does it make sense to whitelist some subdomains but not others for a given domain?

Little Snitch has been useful to get a better handle on all the connections my computer tries to make. It's main dialog to allow or deny connections allows customizing (e.g. require specific port, or ...
0
votes
0answers
13 views

airodump-ng + Getting near by wlan + bluetooth MAC addresses [on hold]

This is a theoretical R+D where we are a company that wants to see if a particular meeting room/personal working space is free without the need of human interaction. The idea is to use a Raspberry Pi ...
6
votes
1answer
123 views

Skype called someone and connected to them with no action on my part. What do I do?

This happened to me today, September 12, at about 6pm. Any ideas about what happened, what's going on, and what I should do? I was at home alone with my 2 year old -- I was feeding her dinner. All of ...

15 30 50 per page