1
vote
1answer
26 views

Issues of using HOTP w/ iteration window

I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
2
votes
1answer
44 views

TestSSLServer Results

I ran TestSSLServer.exe (from http://www.bolet.org/TestSSLServer/) against a web server in my organization. The results seemed self explanatory save for one section I'm not sure how to interpret. ...
2
votes
2answers
34 views

When using PGP/GPG, is it safe to use the same public/private key pair on multiple computers for the same person?

It seems somewhat unsafe to move the private portion of one's key around to multiple machines...but it also seems odd to have multiple identities floating around.
0
votes
0answers
31 views

Snort reading pcap

I have 2000 something .pcap files I need to read with snort. I want to: Save all the alerts, and only the alerts, in a .pcap Run a very small ruleset What I have so far is this: read files in ...
1
vote
1answer
179 views

Explain the Heartbleed Python code [on hold]

first post here so be gentle please! I understand the Heartbleed vulnerability concept, and I have a general grasp of Python. I'm struggling to understand the PoC Python code though, so was after a ...
1
vote
1answer
39 views

BYOD - Looking for Secure means of Wiping Data Remotely

We are in the process of implementing a Bring Your Own Device policy to allow our many employees to use their personal laptops and desktops (Windows platform) to VPN into our company's network. These ...
-2
votes
0answers
104 views

Are gmail and twitter being affected by heartbleed bug [duplicate]

Are twitter and gmail servers are being affected by heartbleed bug and is it recommended to change gmail and twitter password after this bug? Thanks
0
votes
0answers
25 views

Using Proxy Server, can gateway know which URL i am trying to open

I am using a Proxy for example UltraSurf, if I try to open a URL in my web browser, obviously web browser is going to send this information to my Proxy, then Proxy is going to communicate my Gateway. ...
1
vote
0answers
44 views

Identify Known Malware By Hash (MD5) Across Network [migrated]

I need to design a solution that will allow me to submit a series of MD5 hashes and then be alerted if these hashes are found on any machine (Windows) on the network. I'm open to existing solutions ...
0
votes
0answers
31 views

How do I renew an SSL certificate correctly? [on hold]

I have an SSL certificate which is about to expire under GoDaddy. So what I did after I renewed was Generate a Keystore and CSR in Tomcat Install SSL in Tomcat The above is based on the steps ...
1
vote
1answer
20 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
3
votes
1answer
49 views

How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design

I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...
0
votes
1answer
48 views

HTTP Status Codes - security considerations

I am designing an authorization framework and now I am thinking about the error codes which I should return when someone is trying to access a resource and he doesn't have the required permissions. ...
1
vote
1answer
33 views

Is it safe to sign in to Google with password from desktop app like BlueStacks? [on hold]

BlueStacks is an android simulator for desktop. After installation it will ask you to login with your Google account to download and install android app from play-store. My question is "Is it safe to ...
0
votes
2answers
56 views

SQL Injection and JavaScript Regex Bypass

me for learning SQLI. But I got stuck at this one regex which seems to be unbreakable : document.loginForm.username.value = document.loginForm.username.value.replace(/[^a-zA-Z0-9]/g, ""); If someone ...
1
vote
1answer
32 views

Multi-tenancy and Heartbleed

We use a well-known service provider/API management gateway that sits in front of our RESTful APIs providing key management functionality etc. etc. The service provider was running the dodgy OpenSSL ...
0
votes
0answers
42 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
2
votes
2answers
83 views

Chinese or “pinyin” wordlists for dictionary attacks

Background: I am currently trying to crack a salted md5 hash which I have recovered from an embedded device running busybox and manufactured in china. I have tried john the ripper using all of the ...
3
votes
2answers
49 views

How are CRLsets more secure?

Google Chrome doesn't do typical CRL/OSCP checks, instead it depends on CRLsets. In simple terms, Google scoops up the CRLs from most CAs, trims them down and delivers the CRLset to the browser via ...
2
votes
4answers
412 views

How to prevent users from downloading information from our search engine?

We have developed a search engine (simple search, no login required) where users can search details in the database (Apache Lucene) by entering their name (et. al.), then clicking the search button. ...
-1
votes
1answer
33 views

Minimize collision risk for any hash function?

What's some good advice on eliminating collisions when hashing things? I need a unique identifier for all my users, but I want them to be private. I'm thinking of using ODIN-1 ...
0
votes
0answers
25 views

Steganography for BMP [on hold]

I came across with steganography courses recently and was very new on this. I was given a BMP image which consist of hidden message in this BMP image. Just wanted to know how can I start to analyse ...
1
vote
0answers
22 views

Considerations when implementing a key based SSH-like auth scheme

I have a SMTP server where all the users (for an unrelated reason) will have public keys tied to their username and registered with the server. I want to add a non-standard extension that uses these ...
1
vote
3answers
95 views

Decrypting Engima messages

Not really computer related, but I hope someone has the answer. How do people decode messages from an Enigma machine? I understand that if you knew the rotors, rotor positions, and plugboard the ...
0
votes
0answers
11 views

Protect or Unlock [duplicate]

I am setting up a public WiFi router and recall reading that protecting the connection, but stating the password in the SSID, is better than simply leaving it unlocked. I don't know if I read or ...
0
votes
2answers
71 views

Can malware cause firefox to send GET requests?

Is it possible for a site to host malware such that if a certain page is accessed, Firefox is made to send additional GET requests? I'm seeing traffic for attacks coming from me that I haven't done. ...
0
votes
0answers
24 views

nginx - How to prevent processing requests with undefined server names with HTTPS

How do I avoid nginx processing a request with an undefined server name using the https protocol. The following configuration makes this work for http requests: server { listen 80; ...
1
vote
3answers
23 views

Secure Custom Registration Links

I'm working on a website that allows a current user to invite another individual to be friends by typing in the non-user's email address. The non-user would then receive a custom registration url by ...
0
votes
0answers
3 views

Barnyard2 Can't pull xref from unified2 format

I have snort configured to log unified2 in my snort.conf file and am using barnyard2 to parse the unified2 results. It works, except I can seem to figure out to pull the event reference (xref) out of ...
-1
votes
0answers
5 views

Visual Studio won't record updated text after clicking a button [migrated]

I am using Visual Studio 2013 for Web Performance Test and recording my steps. When I select an option from a dropdown list, the text on a div gets updated and when a second option is selected ...
2
votes
0answers
41 views
+200

Security in large-scale SOAs

Let's assume a service-oriented architecture (SOA) with hundreds of services. The services are completely isolated – what is behind their APIs is an implementation detail. Different services can have ...
4
votes
1answer
163 views

Certificate Revocation List

There are many fields on a certificate revocation list (CRL) like Algorithm, Parameters, Issuer Name, This update date, Next update date, user certificate serial #, etc. While I understand the purpose ...
1
vote
0answers
45 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
0
votes
2answers
104 views

If bruteforcing a password goes aaa, AAA, aab, AAB, etc, all the way to ZZZ, wouldn't ZZZZZZ be the most secure password?

I'm only taking about security against bruteforce attacks. I assume that most crackers start at a and go up to zzzzzzz for as long as instructed (so it could be zzzzzzzzzzz if told so in the ...
1
vote
2answers
118 views

Testing your site for the heartbleed vulnerability? [duplicate]

I've seen a number of articles on the heartbleed vulnerability that suggest testing your site to see if it was affecting using Filippo Valsorda's testing page which can be found here: ...
1
vote
0answers
44 views

What can I do to increase security of a small open source application

I've been developing a small CRUDish Ruby on Rails application on my free time for a non-profit organization. The app is already running in a small scale in Heroku. Lately I've been thinking about ...
0
votes
0answers
14 views

Location of passphrase digest in opengpg secring.gpg

I'm trying to understand the file format of the secring.gpg file. I couldn't really find any official documentation of the file format so I decided to create a new key-pair and use the S2K ...
2
votes
2answers
47 views

Should service accounts be set to never lock out

I have been in a discussion lately with our security team, and I want to get an answer from this group. Currently our security policy states that domain accounts will lock out after 5 failed ...
1
vote
1answer
47 views

Is it possible to use SSH agent for generic data encryption? [on hold]

Is it possible to use running SSH agent to decrypt some data (supplied as a string or read from file)?
-4
votes
0answers
63 views

Heartbleed and Client Certificates [on hold]

I would like to know if there is the possibility that a server that REQUIRES some client certificate is able to respond to any type of heartbeat request. Would it would be: Hello server ...
0
votes
1answer
82 views

Would encryption bypass some firewall rules?

Would an encrypted connection be able to bypass a firewall? A firewall is working on layer 1-4 of OSI model, the encryption and decryption is done in presentation layer (layer 7 of the OSI model). Can ...
0
votes
3answers
31 views

How source port field in firewall rule is used

Some firewalls (like the first figure in 13.1.4 in http://doc.m0n0.ch/handbook/examples.html) allow user to specify source port in a firewall rules. But in a TCP connection, the source port is ...
0
votes
0answers
28 views

Are there any security protocols that are redundant? [on hold]

Bugs are going to happen, no matter what and are going to introduce security exploits. But, heartbleed seems to be a major threat: Certificates have to be reauthorized The exploit allows not just a ...
1
vote
2answers
70 views

SSL cert minimize downtime key rotation strategy

As you already know, due to the heartbleed bug, we need to perform re-keying on our web servers (>10), before I do that, I want to check if my proposed strategy is a proper way or not a. Generate a ...
-1
votes
2answers
143 views

I have discovered a botnet during testing [on hold]

Whilst testing a server I discovered a botnet. I have the executable downloaded to the server and decompiled the file to get the strings from it. My question is what would the next logical step be ...
2
votes
4answers
503 views

Are custom protocols insecure?

So, I know rolling your own security is ill-advised, but for simplistic things like communicating with a home server, say, updating a grocery list, is a custom protocol fine? It won't be doing ...
39
votes
11answers
6k views

Are there “secure” languages? [on hold]

Are there any programming languages that were designed to be robust to hacking? For instance, Heartbleed would not have happened if the language used could guard against a Buffer Over-Read. Edit: A ...
1
vote
0answers
49 views

Imei and phone number given to unknown sources. What are the risks?

The facts: A friend put his phone number (and possibly the IMEI) for his android device into some kind of hacking PC software that promised to (and actually did) extend its Whatsapp account that was ...
1
vote
3answers
52 views

Is forwarding a port(s) a security risk to all computers on the network or just one?

I know forwarding ports can add some security risk, but if I forward a port to a computer, say running linux, would it add a security risk to all computers on my network or just the one?
1
vote
3answers
53 views

Can anyone DDOS my server with jmeter? Do they need a powerful server for that?

Is there a way to DDOS my web app through jMeter? Can anyone DDOS with a simple PC? I couldn't find any answer here. I would appreciate if anyone could help me out.

15 30 50 per page