4
votes
6answers
2k views

Password sent via email upon registration

I was wondering what the pros and cons are about sending an email with the password to a user registering on a website (like wordpress.org does). They use pretty good passwords (12 characters long ...
1
vote
1answer
122 views

Viable way to authenticate certificate without a web of trust?

For SSL certificates we have a web-of-trust principle. If we are allowed to make alterations to the certificate format, are there viable ways to automatically or semi-automatically authenticate the ...
4
votes
3answers
2k views

Does DNS pinning protect against all DNS rebinding attack?

I found an example of a DNS rebinding attack scenario in the paper "Dynamic Pharming Attacks and Locked Same-origin Policies for Web Browsers". Figure 1: An example of a dynamic pharming attack ...
1
vote
2answers
571 views

If I migrate from dovecot/imaps to exchange will I be less secure?

I have a client using Terminal Server and it would make some sense to use Exchange for email as well, rather than the current situation with postfix/dovecot running on a linux VM alongside - ...
7
votes
2answers
3k views

PCI Compliant Key Management solutions that don't cost a fortune

We are relatively small software company who has a requirement to store PAN's for our customers. Hosted payment solutions just don't fit our product requirements. We literally have 3 lines of ...
0
votes
2answers
732 views

SSL/TLS Protocol Description

It may seem crazy to you, but I wasn't able to find any detailed description of these security protocols on the web (except wikipedia). Can you point me out some documentation of the protocols ...
0
votes
1answer
2k views

Deep packet inspection of VOIP packets

Some telecommunication companies in Europe and maybe in other parts of the world now want to charge their customers for the VOIP traffic (maybe some already are doing it), e.g. the use of Viber, Skype ...
6
votes
2answers
4k views

Full disk encryption and multi-factor authentication

All serious full disk encryption schemes I have looked into use a static password for authentication. For example, TrueCrypt supports two-factor authentication with keyfiles, but not for system ...
2
votes
1answer
754 views

Implementing 2-step verification via email for web apps?

I was thinking of applying 2-step verification to my web apps that will work similarly to Gmail's SMS/voice 2-step verification, except my web app will just email the verification code each time a ...
2
votes
3answers
895 views

Cheap door logging for home?

Does someone here knows a cheap DIY door logging system? What I have: - 2 doors that needs to be logged - 1 netbook (running OpenBSD with internet connection & root permissions), the two doors ...
3
votes
3answers
3k views

Hibernate SQL Injection - Fortify 360

I am using Fortify 360 to analyze my code's security. Fortify has identified a Hibernate based delete method to perform a delete based on an object that has been passed in. My understanding of ...
1
vote
2answers
102 views

NMAP SSMTP Service Detection

When I examined a NMAP -sV scan on a host running Exim on port 465, it uses the standard SYN scan to determine if the port is open, and then issues a Client Hello to which the server responds with a ...
3
votes
2answers
4k views

Using Cain and Abel to capture traffic of machine in the same network

I have installed Cain and Able in machine A, which is connected to another machine B via a LAN. Now I want to analyze all the traffic of machine B. Is this possible by installing Cain and Abel on ...
2
votes
3answers
808 views

why does the first certificate have a RSA public key in x.509?

Example from http://en.wikipedia.org/wiki/X.509#Extensions_informing_a_specific_usage_of_a_certificate 1st certficate - freesoft 2nd - CA thawte Don't we use the RSA public key from the 2nd ...
2
votes
2answers
4k views

NMAP DNS Service Detection

I was looking out how NMAP identifies DNS services. After determining that port 53 is open it issues a standard query TXT version.bind to find out if BIND is running on the domain port. Then, I saw ...
2
votes
2answers
404 views

How can I protect content distributed on a linux virtual machine?

What assets am I trying to protect? An unofficial pre-alpha software prototype provided as a reproducible example for evaluation during the scientific peer-review process. The software will be ...
1
vote
1answer
370 views

How can a SAML Relying Party redirect to one of two IDPs?

We need to support the following Authentication flows User 1 logs into Salesforce using Salesforce Credentials User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials User 2 logs into ...
2
votes
1answer
346 views

Malicious(?) PHP / BASH Script. What is it?

I'm not sure if this is against the rules of the site. If it is, please let me know and I'll delete the question. I've seen variations of this script floating around recently. What the heck is it, ...
3
votes
3answers
276 views

Is there an IDS based on process patterns?

After reading what Metasploit is able to do my grey hairs got even more. From my understanding current attack methods are being done without tampering with any file in a filesystem - thus rendering ...
2
votes
1answer
198 views

Browsers and export regs. Is SGC still valid?

I was reading a rather "dated" book on SSL/TLS, which mentions about International Step Up certificates and Microsoft's Server Gated Certificates which were the way arround the US export rules for ...
1
vote
1answer
484 views

How to use sslstrip with Internet Connection Sharing?

I'm trying to make sslstrip work with Internet Connection Sharing.ve shared internet connection to router and another pc connected to that router, all are Linux, so Internet <-> pc1 <-> ...
4
votes
8answers
2k views

how can you view an HTTP request in transit?

In Google Chrome, sometimes you will see the https: protocol in the URL bar with a red strike through it. Clicking on the info button says that not all elements on the page are encrypted, and may be ...
6
votes
4answers
10k views

Secure use of psexec or better alternative to it

I want to remotely start VMWare virtual machines (I own VMWare Workstation) and to this end I need to execute on host something like "vmrun -T ws H:\VMWare\VM1\VM1.vmx nogui" with user desktop ...
7
votes
1answer
17k views

PKCS7 encoding in Java without external libs like BouncyCastle etc

I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms). I have x509certificate from the keystore, rsa private key, ContentInfo. ContentType is "oidPkcs7Data". ...
0
votes
1answer
852 views

Should I use Windows' Cryptographic Service Provider to generate RSA keys?

If I want to generate strong high quality RSA keys, is there any reason not to use Microsoft's built-in cryptography system? Or should I use something open source like OpenSSL or Bouncy Castle? I'm ...
5
votes
5answers
31k views

If I use a VPN, who will resolve my DNS requests?

Will they be resolved by my VPN provider, or by my original ISP (if left on "automatic" settings)? Would I have to manually configure a dns server, to make sure my requests will not be resolved by my ...
2
votes
2answers
753 views

I fortuitously accessed the configuration of unknown router: how come and what now?

I've encountered a strange thing. I connected to an open Wi-Fi, then I was just fooling around. First, I visited 192.168.0.1 and it was a router configuration page but default password didn't work. ...
0
votes
1answer
333 views

NMAP Commands Used in Option -A

I've found that using the command nmap -A gives me the most reliable results and according to the reference guide the option -A includes service detection, traceroute, and OS detection. I want to do ...
1
vote
1answer
349 views

How to check for a key *and* store encrypted data?

I wish to create a system wherein I store encrypted data. Users can access this data if they have the key. If they give a wrong key, they don't get access at all. If they give the right key, they get ...
3
votes
2answers
7k views

Could Nmap scan switches/routers

Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.
-1
votes
4answers
796 views

How to protect myself from cyberbullying?

I want to learn how can I protect my PC from getting hacked in order to protect myself from cyberbullying. There is an intruder who has hacked my system over the last 4 years. He has hacked my all ...
9
votes
2answers
1k views

The Dangers of Open Wi-Fi

I know that the first response to a question titled like so is "seriously?". I know the answers exists, but I am just trying to put everything together. Using and/or having an open Wi-Fi network is ...
0
votes
1answer
58 views

File directory deletion [closed]

So I heard this guy talkin about how one time he deleted someone's windows directory remotely. He claimed to have gotten into the system and deleted it such that the files are all still there, but the ...
4
votes
5answers
874 views

Do any organizations use Smart Cards other than the military?

The military's Common Access Card (CAC) seems legit. Do other companies/organizations employ their use? If not, why? UPDATE What are the pros/cons of smart cards, compared to other methods?
2
votes
2answers
505 views

How to investigate possible illegal access by a staff member to emails?

At work we use Outlook 2010 (I think) and an exchange server. The situation is simple: Our IT Manager (Steve) was fixing a problem one of the guys out in the field (Dave) was having with email on ...
1
vote
1answer
182 views

How to secure upload from desktop client to web application?

Let's say we have a desktop application and a web application. The desktop application uploads files to the server using POST requests to the web application. What are the possibilities (except using ...
3
votes
2answers
2k views

How to check for null byte injection in Java webapp

Looks like Null Byte Injection is possible in Java apps. see: Is null-byte injection possible in Java filenames? So how does one protect against it? Inspect all the bytes of the filename for a 0 ...
1
vote
1answer
226 views

Device authentication mechanism

I am doing a project that needs device authentication with a gateway. What are some of the best ways of doing that ? Whether a certificate based mechanism is feasible in this case ?
5
votes
1answer
452 views

Protection against a fired IT employee [duplicate]

Possible Duplicate: When a sysadmin leaves what extra precautions need to be taken? We have some servers on two sites. We use Puppet to allow only SSH key (root denied) and authorize users ...
8
votes
2answers
2k views

ports blocked by firewall and not the server

I was asked this question at an interview and i wasn't sure about the answer. The question was "suppose you were checking the open ports on a particular webserver which was behind a firewall, how ...
3
votes
3answers
322 views

“Doxing” users on Social Media

I hope this question falls within the scope of the faq...I'm curious to see what kind of answers I get. Suppose the following A user is posting libel and slander on social media (lets say Twitter ...
3
votes
2answers
2k views

Is leaving the root user enabled in Mac OS X a security risk?

To those unfamiliar, the Mac OSX has the root account disabled by default. In order to enable the root user you have to go deep into System Preferences and authenticate yourself with an administrator ...
1
vote
1answer
401 views

Metasploit Closing Connections?

Whenever I attempt to use an exploit (that I know will work) from Metasploit in Windows on a machine on my LAN, I always get the error Exploit exception: An established connection was aborted by ...
4
votes
1answer
636 views

CDNs used by Windows Update

My question is about CDNs (Content Delivery Networks) and their simultaneous use for legal and questionnable stuff. One specific example is the following. I'm noticing taffic from our network to the ...
1
vote
2answers
3k views

Anonymous FTP Risks

If my IIS 6.0 web server is disabled and the only other service running is FTP, what are the security risks of allowing anonymous FTP read/write, considering that a random person couldn't use any sort ...
3
votes
3answers
2k views

XSS : Content-type: application/json

Background information - Application responds to request to a particular URL with content-type: application/json JSON response contains a parameter from the request Escapes the quote with a slash ...
-2
votes
1answer
1k views

How to retrive domain account hashes from windows 2008 server? [closed]

I want to do password length audit of domain password using offline brute force analysis. I cannot find any domain hashes from local machines , I want an approach where i can retrieve these hashes ...
2
votes
3answers
944 views

How to do a virus scan before post attachments in asp.net application

How to do a virus scan before post attachments in asp.net application,when they find a virus on to give up post attachments,otherwise proceed to upload. I wonder if there are any APIs out there where ...
4
votes
2answers
4k views

Can I determine the cipher used to encrypt a file with OpenSSL?

I have two files which were encrypted using OpenSSL. I know that that first one was encrypted using bf-cbc, and I also know the password to decrypt it. The second file is likely to use the same ...
2
votes
3answers
217 views

How important is user acceptance when deciding whether to deploy biometric authentication?

I've been browsing through several studies on user acceptance of biometrics, and I've been noticing that they all focus on attitudes and beliefs about biometrics. While it's important to know a ...

15 30 50 per page