21
votes
2answers
3k views

How do I remove my website from the malware database?

I have a website which is basically a service platform. As far as I know there is no malware in my website (at least not found according to these free scanners). However, Check Point malware database ...
0
votes
0answers
25 views

Secure Systems Design Principles Excercise

I've been asked to find which Principles are being violated in this situation: I have the program "su" that is similar to the UNIX one (It gives you access to another user if you are a SuperUser, ...
-3
votes
0answers
29 views

owasp security for android app pupose [on hold]

i have developed one android app for banking purpose it will go to server for fetching data and the user can see real ip used by android application as well ip address of server through man in middle ...
-5
votes
0answers
41 views

OWASP security for android app [on hold]

i have developed one android app for banking purpose it will go to server for fetching data and the user can see real ip used by android application as well ip address of server through man in middle ...
0
votes
0answers
22 views

Why /proc/self/environ no output through injection

What on a CentOS machine would stop a null byte injection from displaying the output of /proc/self/environ and /proc/$PID/environ or /proc/$PID/fd/12 ? According to this article, all folders under ...
0
votes
2answers
54 views

Is spoofing the origin IP in a TCP header an effective “anonymity” strategy?

I know just enough about TCP to know there's a header which, among other things, contains the origin IP and target IP of that packet, which the internet uses to guide it to its destination and then on ...
0
votes
1answer
33 views

How do connection relays strengthen anonymity?

We've all heard of the concept of some geek bouncing their internet connection over a number of servers to hide their trail when doing something secretive. I'm curious about why this is done. I know ...
4
votes
3answers
79 views

Could Google Chrome's lack of a download confirmation dialog be a security vulnerability?

Suppose the user is playing a game like flappy bird that requires constant tapping in the lower left area of the screen (where the downloaded file needs to be clicked). Then while the user is ...
3
votes
3answers
61 views

Does typical Ransomware only 'attack' certain folders/filetypes

I expect this is very much on a per malware and OS basis so could potentially be very broad hence the typical. A user's computer has been infected by a piece of malware which aims to encrypt all ...
0
votes
0answers
8 views

Security of encrypted data on Mac and multiple accounts on same computer

I'd like to use Boxcrypter to encrypt files shared via iCloud (OS X 10.11). The computer is connected to a network and my account is a network account. While the computer is primarily used by myself, ...
-3
votes
0answers
50 views

What is this program because I can't uninstall it [on hold]

So there is this program on my pc but it is in full chinese and I don't know what it's called and in Programs and Features there is no sign of that program. This is what it looks like: ...
2
votes
0answers
36 views

Something phishy going on with email [duplicate]

I own my own domain. For a month or so I've been getting emails from addresses I don't know with "see attached image" or "find the attached invoice", with a zip/rar file attached. Of course, I ...
0
votes
1answer
35 views

Threat Modelling Examples (Distributed Systems)

I have threat modelled applications in the past, but I'd like to threat model a distributed system. However for other people I'm with, who have never done it at all, I'd like to check out some ...
-1
votes
0answers
34 views

SQL injection using only Scala syntax?

Is there a way to perform an SQL injection using only Scala syntax (not importing any Java)? From what I've seen online all the examples were based on importing Java things and then using it for the ...
54
votes
4answers
4k views

Does FTPS (FTP+S) offer better security than SFTP on the server side?

I had an exchange with some third party sysadmin yesterday regarding the setup of a file transfer interface between our servers. I suggested using SFTP because our application has good support for ...
-3
votes
0answers
27 views

threema opensource client secure? [on hold]

i found a project that support the 'secure messaging client' "Threema" on linux (and even windows). (simple said, Threema is: like a secure Whatsapp Alternative from swizerland - further explanation: ...
-4
votes
0answers
105 views

What all websites are safe to try SQL injection in India? [on hold]

I am a beginner and I am learning SQL injection from various sites but before trying this method, I want to know on which all sites it would be safe to try this method in India? I am learning SQL ...
1
vote
0answers
67 views

Is this cascading encryption, and is my security weakened as a result?

I'm trying to understand what is, and what is not, considered cascading encryption. All of the posts and conversations I've read over the past few days discourage the practice, including this article. ...
1
vote
0answers
15 views

How did I get a signed cert back with a wildcard common name when I submitted a csr with a specific common name? [duplicate]

Apologies if this is obvious but I'm hoping for some clarification here. I generated a CSR on an appliance of mine. This CSR had a specific common name (let's call it foo.domain.com). I then sent ...
1
vote
1answer
39 views

SQLMap deleted database items

While doing test on my website, SQLMap deleted data in my database tables. Everything is corrupt. What is a safe way of using this tool without touching other items on a live server? How do you use ...
1
vote
1answer
50 views

Can firewalls decrypt SSL packets?

I was wondering if the firewall has the ability to decrypt the SSL traffic. If so, the network admin is able to read the data in clear text at transit.
0
votes
1answer
51 views

Multiple instances of programs allowed in Windows Firewall

I am new to Windows Firewall. While allowing a program through Windows Firewall, I found multiple entries present for Firefox and Java. Why is that?
0
votes
0answers
37 views

Does an account with a !! /etc/shadow entry have to still expire?

Currently where I work, our password policy is set at 84 days. This is set in our login.defs on all of our Linux machines. We have policies that are set around PCI DSS 3.1 and the like, this goes for ...
7
votes
1answer
63 views

How can meta data be used to identify users through chained VPNs?

Online privacy is a big issue for many people nowadays. Using VPNs is the usual suggestion as a means to stay anonymous. More often than not, somebody comes up with the point "just chain multiple VPNs ...
0
votes
0answers
9 views

Using application that uses MD5 with FIPS 140-2

I am using ecryptfs for disk encryption which uses MD5. However I also have requirement to be FIPS 140-2 enabled which blocks MD5. My question is, without modifying ecryptfs is there a way I can get ...
-1
votes
2answers
28 views

RBAC togehter with AAA?

I'm taking a network course and my teacher has not been answering my emails. I'm supposed to set up "Role based access using privileges with AAA" I thought RBAC and AAA stood in contrast to one and ...
1
vote
2answers
59 views

How to protect against request intercepting and parameter-tampering? [duplicate]

My problem is that I made an app and I am making PHP Requests. I just realized that you can sniff everything on Android with "Packet Capture". How can I make my app more secure? I thought about ...
-1
votes
0answers
12 views

How can you figure out which encryption was used just by looking at the data? [duplicate]

I have 1500 lines, which were encrypted (by a random encryption method) and then encoded using base64. Let's say I can easily write code to decode the base64 strings. After that I get the encrypted ...
25
votes
5answers
5k views

Advantages to killing sessions after 5 minutes?

I'm dealing with a server that isn't mine to configure. Something somewhere between me and this server kills any connection after 5 minutes if no traffic passes between the two machines. This includes ...
-1
votes
1answer
41 views

Same certificate but different private keys on different servers. Does this work?

We have a SAN cert that is used on multiple servers. Is it possible to have the cert re-keyed and only use the new private key on a particular server while keeping all of our other servers using the ...
0
votes
0answers
21 views

Can't see WEP networks with airodump-ng

I use airodump-ng on my RPi3 (armhf version). I've been able to properly set up the interface and turn it into monitor mode. Now, I can sniff the air traffic using airodump-ng, but I can't see my ...
0
votes
0answers
26 views

What are best ways to begin to write embedded system exploit code? [on hold]

Nowadays, unsecured embedded systems have became a route to infection of the network. I was reading the post of the person who hacked "Hacking Team", where he mentioned that he found embedded devices ...
3
votes
2answers
40 views

Is there any chance of PC getting infected when you analyse PCAP malware file?

Currently, there are lots of pcap files of malware analysis carried by other researchers available on Internet. Such files show the traffic pattern and communication of the malware with it's C&C ...
-7
votes
0answers
21 views

Hi is there a mobile version of this app? [on hold]

Is there a mobile version of this application ? I would like to be able to chit chat through this, but need mobile styles ?
0
votes
0answers
28 views

Can a virus execute without user interaction? [duplicate]

I have seen a lot of malware infection techniques where the user is infected by drive by downloads through browser vulnerabilities or social engineering. But is there a way that a virus could execute ...
3
votes
1answer
105 views

PayPal is asking for my Bank Details. How secure is this? [on hold]

I am from the UK but I'm living in Poland. I have two British bank accounts and a Polish account. The two British accounts are linked to a PayPal account registered from the UK and the Polish one is ...
-1
votes
3answers
40 views

Forensic analysis of file metadata

Suppose I have received a file (doesn't matter what it is - document, image, video, audio, etc). I know that the operating system and also programs that create the file like Office, and even hardware ...
0
votes
3answers
41 views

Denial of Service by SQL queries - are selective queries better than queries that return a lot?

Lets say I have a search form for a blog (or any other system that would use SQL to run queries) and I want to protect it from denial of service. An attacker wants to attack my site by flooding the ...
3
votes
1answer
52 views

How to protect from WPAD attacks?

If you are in a Windows network, and you basically connect to a website ; And there is an attacker on Linux who changes the hostname to WPAD and configures WPAD.dat in his system, all your PC's ...
30
votes
3answers
5k views

How does IP address spoofing on the Internet work? Who can do it?

Someone recently told me that the NSA could impersonate pretty much anyone they want by using IP address spoofing on the Internet. But how would that work and to what extend is it true anyway? Could ...
1
vote
0answers
13 views

Charles Proxy: Genymotion with certificate pinning

Is there anyway I can use charles proxy with an android app that is using certificate pinning? I read this thread: http://blog.attify.com/2015/08/24/intercepting-network-traffic-android/ and it says ...
-1
votes
1answer
45 views

Hardening switch vs router [on hold]

I'm currently working on a newtwork project and it is time to harden the network devices. I made some searches for googling switches and routers, but basically the same results keep popping up. Is ...
22
votes
3answers
3k views

To what extent does formatting a disk (securely) remove its data?

If the goal is to make data no longer retrievable, how secure is it to format the disk? I assumed formatting the disk overwrites free space (thus making it a safe bet no one's going to be able to ...
4
votes
1answer
64 views

Wiping magnetic stripe on card with magnet?

I asked a question a while back on using magnets (for example powerful Neodymium ones) to wipe a HDD, and got shown a good article proving it is not possible to wipe data. Pretend I am about to ...
0
votes
1answer
25 views

Threat modeling a network monitoring software

Assume a network fault monitoring tools is deployed to monitor a subset of routers. What an attacker can do by exploiting a network monitoring system like OpenNMS? Can they learn about the topology ...
2
votes
1answer
25 views

Can you tell OpenSSH to force a rekey according to a packet number limit?

OpenSSH has a parameter in the config files (ssh_config and sshd_config) for both client and server called RekeyLimit. The default values for it are: RekeyLimit 1G 1h Which will force a rekey ...
1
vote
2answers
72 views

Tracing origin of malicious PHP script

I'm looking at a Linux server running Apache + mod_php. A malicious PHP script was uploaded during the night. It's owned by the Apache user and I would think it almost certain that the script was ...
-1
votes
0answers
38 views

Oracle sql injection [on hold]

Im playing a tournament and have gotten pretty far already. Found a sql injection, blind, oracle 11g database on a windows 64 bit, asp .net based. The user is not dba. The finishing point is ...
2
votes
2answers
89 views

How does an encryption master key work

Apparently the 'secure' cloud-encryption service BoxCryptor supports master keys for encrypted files. Decrypt every file which is accessible by any member of your organisation. How would a ...
-3
votes
1answer
64 views

why ISO is 27001 & 9001, why there are no other numbers [on hold]

I am fond of asking question why example protocols eg 802.1 n for wireless 80 is 1980 & 2 is February since standardization of protocol is was done at Feb 1980 thats how it arrived at 802 now ...

15 30 50 per page