1
vote
1answer
47 views

Response on targeted attacks against an individual

I'm now an aim for a targeted attack. Someone tries to gather information about me and tries to get access to my accounts. Some time before he/they've managed to succeed (got all the info from my ...
0
votes
1answer
52 views

Objectively, how effective are malware removal tools at detecting infections?

I'm fully aware that concrete scientific data may not exist on this topic but I feel that the question at hand won't all boil down to opinion. Either way, with the rampant increase in sophistication ...
41
votes
5answers
8k views

Is it dangerous to call spam phone numbers, even if you know they're spammers?

I sometimes like to check spam just to see how the messages look like, and I found someone who actually put an American phone number (1-XXX-XXX-XXXX). Most of these spammers are either trying to get ...
-1
votes
0answers
9 views

How to set linux as default OS after reinstalling windows already dual booted envirnment? [migrated]

I have a system running windows and linux in dual boot envirnment. But due to of some problem i have reinstall my windows but now my boot menu only shows windows OS. I want to know that how i can ...
1
vote
1answer
54 views

Where to save Keepass' file? [on hold]

Using Keepass since a year ago, been told it's an excellent method to store one's passwords. But what is the best location to save Keepass' file (the file where all password are stored and that you ...
1
vote
0answers
30 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
-2
votes
2answers
53 views

Running SSH on a different port vs adding the port number to a password

So, a pretty typical piece of advice is to run SSH on a high port number, thus decreasing the chances of it being attacked. The thing I have always wondered about though is that it seems more secure ...
4
votes
1answer
35 views

Is OpenSSL generating Diffie-Hellman parameters that are safe for use in TLS or SSH servers?

I would like to generate Diffie-Hellman parameters on a Debian GNU/Linux "Jessie" 8 with OpenSSL. Lets assume the system CSPRNG was seeded with some real random data. On such a system, is the result ...
0
votes
0answers
13 views

Identify if pc is infected [duplicate]

I am operating a credit-card sized PC with debian on it. For some time (before taking care of it) it was reachable with SSH over port 22, simply using root as username, and no password. How can I ...
-2
votes
0answers
15 views

Router hangs when running Nessus [on hold]

I tried to run a Nessus scan for my own website through my home router (ZTE ZXV10 W300). However, the router always hangs when I run Nessus. Internet also doesn't work on that time. Once, I pause the ...
3
votes
3answers
178 views

Is web application connected to a database via an application server is more secure?

I have heard from my colleagues and some other people on web suggest that it is more secure to run this configuration: Web server -> Application server -> Database, than this: Web server -> ...
0
votes
1answer
24 views

Secure Electronic Transaction (SET Protocol)

I've looked into the SET protocol and some of the information are outdated. Therefore, I would like to ask if the SET protocol uses 3DES or AES or just the DES and the RSA?
6
votes
4answers
103 views

How to identify a company's public network address range?

Which tools or websites can I use to identify a company's public network address range(s)?
-1
votes
0answers
31 views

What could eventually be effectively done to mitigate the risks of errors and backdoors in IT-security software? [on hold]

Software errors of programmers in composing the originals and later in updating them understandably can't be perfectly prevented. On the other hand there exist backdoors in IT-security software, which ...
-4
votes
0answers
35 views

how to AES cipher? [on hold]

You were eavesdropping on a network and intercepted some diffie-hellman keypairs as following (1099511627791, 152351, 903291794923) and (1099511627791, 152351, 838683142382) After those packages you ...
0
votes
0answers
15 views

Is cryptsetup luksFormat -y --cipher aes-xts-plain --key-size 512 /dev/sdax a insecure setup for luks [duplicate]

Is cryptsetup luksFormat -y --cipher aes-xts-plain --key-size 512 /dev/sdax insecure. If so why and what setup would be good for keeping corporate information safe?
0
votes
0answers
17 views

Problem with Firefox browser about user privacy [migrated]

Every time I use my firefox browser to visit sites like this I end up with multi redirection popups on every single click. however, I solved the problem accidentally by visiting the previous site ...
-6
votes
0answers
49 views

how to decrypt it on RSA encrypted message? [on hold]

You must decrypt the following RSA encrypted message, the thing is you only got public key :/ which is as following ...
1
vote
1answer
20 views

Diffie Hellman prime attributes

If I generate a Diffie-Hellman prime openssl dhparam 512 -text (deliberately of small size to keep the paste size below small; I know minimum is 2048 and up), what are the different parts of the ...
0
votes
0answers
45 views

How does add-on for the Firefox with a custom proxy server prevents info from Google?

I would like to know how does add-on for the Firefox web browser with a custom proxy server prevent Google from collecting information about your browsing? Does it prevent also from your internet ...
-5
votes
1answer
78 views

The problem I have with wikipedia showing IP addresses to the world? [on hold]

I went on wikipedia, then went to the edit history of an articles I edited. To my surprise, my IP address, along with other people's IP addresses are on the articles edit history page. Why would ...
1
vote
2answers
52 views

Is it possible to digitally sign an email twice?

User A encrypts an email with the public key of user B and digitally signs it. User B receives this message and decrypts it. B wants to forward it to user C, encrypts it with C's public key and signs ...
1
vote
1answer
31 views

Password manager: should key file be stored on a different device than password db file (even if master pw used)?

Does it defeat the purpose of a key file to store it in the same location as the password database? What if a master password is needed also? For example I save my .kdbx to dropbox as a means to ...
0
votes
0answers
31 views

Passwords vs keys in cryptography? Which is stronger and safer? [duplicate]

Maybe it isn’t correct question, but how to compare passwords and keys in cryptography? Symmetric encryption, e.g. AES, usually encrypts data with passwords, and all public-key cryptography use open ...
-1
votes
2answers
62 views

History of connected devices to my internet router (WIFI) [on hold]

Note: same question here, however I was not able to comment because it was by an unregistered user account. Simply, how can I know who (devices) has connected to my network WiFi without using tools ...
-1
votes
0answers
25 views

History (logs) of connected devices to my internet router (WIFI) [duplicate]

Simply, how can i know who has connected to my network WIFI? without using tools that run on PCs to monitor the traffic. Is there is a way?
0
votes
0answers
24 views

What is the layers of abstraction (Digital Forensics)? [on hold]

Its my understanding that the layers of abstraction role is to translate abstraction layers into manageable data from 1's and 0's. But what exactly are the layers of abstraction?
0
votes
1answer
36 views

Timing side-channel attack example

I understand that timing side-channel attack is a measurement of time taken to execute cryptographic algorithms. I'd like to see a simple example that explains how timing attack takes a place on any ...
1
vote
2answers
77 views

Possible to send password in plain text with SHA-256?

I just registered on a site where I had to specify sensitive information, eg. my card number. I got a confirmation mail where my password, the one I specified as my login password, was in plain text. ...
1
vote
2answers
434 views

Signal listening

Is there a way to know if someone listens to signal I produce (air signal as well as signal on network)? Is there a way to know if the signal was listened along the way until the signal is reached to ...
0
votes
3answers
44 views

creating a testing environment

This question has been asked over and over again across the web, but many answers are either ridiculous or the same. I have tried using OWASPs VM which has a range of purposely built holes in web ...
-3
votes
0answers
5 views

What is use of validation.properties for ESAPI.encoder().encodeForSQL in ESAPI [migrated]

I am using ESPAI for SQLInjection prevention in Java. I am only using ESAPI.encoder().encodeForSQL(ORACLE_CODEC,queryparam)) method. If I do not include validation.properties in the esapi.properties ...
-3
votes
0answers
25 views

How to perform penetration testing on android app? [duplicate]

I have an Apk file. I need to perform penetration testing on that app. Which are the tools required and how to perform? Please help me out here. It's very critical to me. I have already performed pen ...
-3
votes
0answers
51 views

How to hack a smartphone by using the phonenumber [on hold]

EDIT: Is it possible to attack a mobilephone via telephone number? After a hacker attacked a friend's mobile phone he got blackmailed with very private things stored on that phone. My friend received ...
0
votes
1answer
24 views

What should I set the TTL for my DNS to?

I've heard before that one should set TTL for the domains of recovery emails to as high value as possible. The threat model here is that an attacker uses social engineering tactics to gain access to ...
3
votes
1answer
54 views

Can still ping from secure network?

I have a standard network and wanted to make a more secure one so I bought a second router and set it up as a separate network daisy chained so it can get internet. I managed to make the setup, with ...
0
votes
1answer
25 views

Why is HMAC truncated in IPsec?

I'm having a look at IPsec standard and I realized that integrity and data authentication check is based on 96-bit truncated version of HMAC algorithms. For example, in IPsec v3 we can use ...
0
votes
0answers
22 views

Log to file my own SSL traffic coming from websocket

I have to decode and capture my own traffic that come from a websocket WSS listening on port 7072, when I use browser to connect to my data provider. My idea is: to redirect traffic to ...
0
votes
1answer
10 views

Linux equivalent to Windows WriteProtect key in the registry for a software based write blocker?

I unfortunately don't have access to a physical write blocker and am looking for a software based write blocker in Linux. In Windows this can be achieved by modifying the registry and setting a DWORD ...
-1
votes
0answers
17 views

Is Yahalom protocol secure or not? [on hold]

Let's consider Yahalom protocol. ​The Wikipedia says that it is less secure than Needham-Schroeder. ​ I do not understand why.​ Why is it an insecure protocol?
-3
votes
0answers
24 views

PC infection suspected [migrated]

I have a feeling that my PC is infected with a RAT (remote administration tool). It all started when I logged on an mmorpg (online game). It's not popular and at this time I had a port open by me ...
-1
votes
0answers
6 views

OpenSSL 0.9.8zg [migrated]

A week ago, as part of the installation a PHP 5.4 cartridge from openshift.com on my Mac with OS X v10.10.5 in the Terminal I noticed a message about it is loading OpenSSL 0.9.8?? for compatibilty ...
0
votes
0answers
7 views

ECDH-ECDSA Combination [migrated]

I am doing research on cryptography primitives at a basic level and I faced a question on encryption methods. I understood that ECDH is an approach to for secure key exchange between two parties ...
-1
votes
0answers
14 views

How does OpenVAS work out severity? [on hold]

Nessus uses CVSS base scores, but i'm unable to find a reference as to if OpenVAS does or not.
7
votes
4answers
182 views

Must a system be insecure against physical access? If so, why?

Inspired by: Why don't OSes protect against untrusted USB keyboards? Related: What can a hacker do when he has physical access to a system? (I address the points of its main answers below.) There ...
1
vote
1answer
23 views

Stateless AEAD (AES-GCM) based tokens

I want to generate secure data tokens which can be shared with the client for uses like password reset, etc. which involves low storage overhead at server end. Ideally I am interested only in managing ...
-1
votes
0answers
15 views

Yahalome protocol is (not) secure. Why? [on hold]

Let's consider Yahalom protocol. The wikipedia says that it is less secure than Needham-Schroeder and I know how to attack on Needham-Scroeder with MitM attack. But I can't see how to attack (in any ...
3
votes
2answers
41 views

What is the best way to organize OpenPGP keys?

I've always used OpenPGP as a single private/public pair of keys for (S)igning and (E)ncryption. But learning about OpenPGP subkeys, it's recommended to use separate keys for (C)ertification, ...
-1
votes
0answers
17 views

How is the current situation of smartphone's factory reset protection?

I came across this news talking about a bypass on the nexus 6P factory reset protection, which made me wonder what is the current security status for the most known phones out there. For example, is ...
-3
votes
0answers
12 views

How to create a simple chrome extension with ax XSS vulnerability? [migrated]

Could anyone point me to any tutorials or just offer some tips on how to create a basic web extension with an XSS vulnerability? I was thinking of something really basic, like an extension that tells ...

15 30 50 per page