2
votes
1answer
59 views

How to keep important data secure in case of total compromise?

The question is simple, and really interesting at the same time. How would you keep your data secure in case of a total compromise of your infrastructure? This should NEVER happen, but as we all know,...
-2
votes
2answers
1k views

Can NSA generate all hashes for rainbow table to break md5?

I was wondering about md5 encryption. It is good, and I agree that it is unbreakable. But this is why we have rainbow tables. What if bunch of people gather together and start brute forcing and ...
3
votes
2answers
1k views

How to securely use Process.Start?

I am using Process.Start in a Windows Service I created to execute an exe that I have on my server that is used for audio conversion. I am passing some user input as a parameter to this exe. The ...
4
votes
2answers
5k views

Is it a good idea to store Email addresses as hash only?

I am currently building a web service at http://write-math.com similar to http://detexify.kirelabs.org/ that should help users to get LaTeX code from drawn formulae. It is part of my bachelors thesis ...
3
votes
1answer
340 views

Can I perform WEP cracking from several laptops against 1 AP

I have successfully being able to perform WEP key cracking attack using aircrack tool. I want to allow my students to test this in a lab environment. They will be working fro their own laptops against ...
1
vote
2answers
109 views

Symmetry meaning in cryptographic algorithms

When we refer to symmetry in cryptographic algorithms such as symmetric or assymetric does the symmetry refers only to the equality or not of the keys, or does it also refer to the symmetry of ...
0
votes
3answers
63 views

Restrict access to admin area by checking SSH connections

Assuming that the users have dynamic IPs (so I can't whitelist) and that setting up a VPN is not an option, is it a valid approach to restrict access to an administration area by only allowing IPs ...
4
votes
1answer
319 views

How fast can a MD5 collision be found

If I have a salt of 16bytes and 16bytes of data, how fast can one find another 16bytes of data so that MD5(salt + data) == MD5(salt + other data)? I don't expect an answer accurate to the nanosecond, ...
0
votes
2answers
195 views

How to handle data-dependent Claims?

This question is about Claims-Based Authorization and Windows Identity Foundation (unfortunately I lack the priviledge to create a tag for this). Consider the following simple use case: I have a ...
3
votes
1answer
6k views

Why do I need to install the startcom intermediate certificate?

I issued my server a Startcom class 1 cert. With no changes on the client, I can access this server via FF without issue. However, when try to validate the certificate via openssl s_client it chokes ...
1
vote
3answers
113 views

Is it ok to use the same password for many services with two-factor authentication?

Let's say that I've a relatively strong password, but I don't want to use many different passwords for each different service, and let's say that those services provide two-factor authentication using ...
3
votes
2answers
1k views

Is AES encryption vulnerable?

I was reading weaknesses in AES encryption. Unfortunately, I have a website that uses AES: Its database is almost entirely AES encrypted. Is there a real threat? Would it be worth to refactor the web ...
1
vote
3answers
204 views

Simple explanation of Port Knocking

I was just referring to this article: http://en.wikipedia.org/wiki/Port_knocking The term Port Knocking, as explained here, was slightly confusing and I was feeling difficulty in getting the hang of ...
2
votes
1answer
118 views

How does checking CRLs make sites less safe?

With the frantic certificate upheaval resulting from the Heartbleed fiasco [drink!], there has been lots of talk regarding certificate revocation, and in particular the policy of certificate ...
1
vote
2answers
3k views

Is cross site scripting possible with the img alt attribute?

My question is, if any characters are allowed in the alt attribute of an img tag (except for double quotes), is XSS possible? Valid image or not.
1
vote
1answer
527 views

Obfuscation and Mobile App

Recently, I stumbled with this topic in my mind for few days. I understand that obfuscation is not the best protection against reverse engineering. I wonder if there is another method that make it ...
0
votes
2answers
224 views

Asymmetric Data Storage+ No-Hash Password Storage?

Edit: removed a part of the original question; I'll break it down in a different post. I am following @Polynomial's answer to store information in a database. Here are my requirements: Only the ...
4
votes
3answers
444 views

Asymmetric vs symmetric encryption benchmarks

I have found these benchmarks in Crypto++'s site. http://www.cryptopp.com/benchmarks.html But I am, quite honestly, not entirely sure how to interpret them. I am really looking for a set of ...
3
votes
1answer
255 views

Windows - service account default certificate store

I am writing a web app that connects to external web services. The external web services serve an intermediate certificate signed by Thawte SGC CA - G2. When I setup IIS to run the web app using ...
3
votes
1answer
86 views

code optimization and security?

My background is in compilers/code optimization, and I'm wondering whether there might be any interesting applications of extremely aggressive runtime code specialization towards improving security ...
4
votes
2answers
151 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
0
votes
0answers
42 views

Windows tokens manipulation

I am creating a demo of the infamous windows tokens manipulation. the scenario I am using is as follows: A single PC connected to the domain controller. 2 users are signed in the DC through that ...
1
vote
0answers
285 views

SSH using pre-existing session (symmetric) keys

Is there at present a way to open a SSH connection using pre-existing symmetric session keys? In other words, if I create a list of symmetric keys can I send that list to the recipient on a CD or USB ...
0
votes
1answer
330 views

Virtualization / Cloud-Stack fingerprinting from running VM

How can the host environment (not just the OS) be identified from a running guest VM. To determine what the underlying host and virtualization stacks being used actually are. I.e. whether there's a ...
3
votes
1answer
2k views

Writing to drive with full drive encryption without decrypting

Consider the case where a computer has 2 drives: one for a Windows OS and one for a Linux OS. The user then uses full drive encryption, BitLocker, on the Windows drive. It can be assumed that Linux ...
10
votes
3answers
1k views

Logging “password with counter” use

When prompted to update their passwords after they've become stale (whether that's after 30, 60, 90 days — whatever is implemented by policy), many users simply increment the number that they may have ...
2
votes
1answer
1k views

OAuth and public keys

I get the basic OAuth and PKI flow and the different actors involved but I'm still unsure how public/private keys play a role. When a client identifies itself upon registration with a certified ...
3
votes
2answers
585 views

Storing the master key in the app server binary

Imagine you have a master key to encrypt/decrypt the data saved in your database of your app service. What is the risk of having this key embedded in your app service code to store this key in the app ...
1
vote
2answers
100 views

Ways to certify a SaaS for security [closed]

Is it common for small companies to get security certificates/compliance from audit agencies for their SaaS to present to customers for their assurance? If so what are the suggested certifications?
2
votes
0answers
53 views

Storing Tenants Cloud Keys In a Database

Imagine you are building a public service where you need to store the customer's cloud credentials(like their aws secret and access keys) in your database to regularly use by your backend services in ...
2
votes
2answers
324 views

Obstacle in Implementing a Time Limited/Number of Use Limited Software

How does one implement a trial period in a product properly, e.g. a trial period that lasts 30 days, or limits the number of product uses to 10? Storing the entries, even in an encrypted form, isn't ...
4
votes
2answers
281 views

What's the meaning of the term “ad-hoc MAC” (Message Authentication Code)?

In SSL literature, I've noticed the use of the term "ad-hoc MAC". I understand the meaning of MAC (Message Authentication Code) and how it works, but what does the term Ad-hoc MAC mean? Note: With ...
7
votes
3answers
514 views

Is it a bad idea to share the ssh host key in a diskless environment?

I am looking at this cluster of student work stations. They are diskless clients which boot from NFS. They also have sshd enabled. All of these machines share the same ssh host key (rsa,dsa,etc), ...
5
votes
3answers
275 views

Preventive security action in Android App

Currently, I'm developing a bank related android app. I would share my knowledge and also maybe you guys are more expert than me so you can add your ideas to the list. Bank is a very special client. ...
1
vote
2answers
241 views

A doubt in certificate chain validation and revocation checking

So when i do a tls handshake with the server, it responds with a cert chain which the browser verifies and which ends at a trusted root CA. In this the browser checks if the cert presented by the ...
2
votes
2answers
774 views

What was the security vulnerability behind Box and Dropbox and what's different now?

Earlier today I received a number of comments saying that my shared links were disabled. I looked around and saw a number of articles explaining what happened, and Dropbox posted an official statement ...
0
votes
2answers
195 views

Where can I practice MITM raw binary protocols?

I want to try practicing MITMing raw TCP binary protocols as well as MITMing HTTP protocol. What is the best way to do this? Are there any specific tools which help me do this? Like wireshark or ZAP ...
-2
votes
1answer
517 views

Backdoors and hard-coded usernames and passwords

I have been researching on computer worms that brought me to this topic of backdoors. According to my research, backdoors are malicious pieces of code that are inserted into either computers to get ...
-2
votes
2answers
78 views

What is this site? [closed]

I was reading an article which included an anecdote of someone who had nearly fallen for a phishing attack which: established a mock Halifax.co.uk website which replaced forward slashes in the ...
2
votes
1answer
2k views

Openssl ciphers SHA384 and AEAD

When running the command: openssl ciphers -v I get a long list of cipher combinations. I'm having issues interpreting some of them. An example is: DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA ...
1
vote
0answers
140 views

Ncat output problem

I am using ncat for creating reverse connections and through that i open a cmd. my problem is that for commands that there is a lot of out put such as dir in a folder with a large number of files, ...
4
votes
4answers
375 views

What risks are introduced by the browser passing the “referer” to the next site visited from a link to another domain?

As of today, I believe every major browser will by default reveal to a third-party site which site I came from, and more specifically, the exact URL I came from. What are the privacy implications of ...
2
votes
2answers
191 views

What's the point of EMV when only the card is needed to shop online? [duplicate]

In many countries, EMV is used to prevent credit and debit cards being cloned. But given that it's possible to perform online transactions using the details printed on the card, how does it add ...
-3
votes
3answers
107 views

what is remedy for the heartbleed bug? [duplicate]

I found lot of articles describing about the heard bleed bug but can someone please explain the remedy for the heart bleed bug ?
1
vote
1answer
2k views

MAC-address restricted port forwarding

I have an ASUS RT-AC68U router and would like to set up port forwarding, but I would like to restrict which MAC addresses can connect through that port. My use case is that I'll have a live camera, ...
8
votes
3answers
2k views

How does a root kit work inside a virtual machine?

In my class, we are discussing virtual machine based root kits. I've research root kits, but could not find any information specifically talking about how root kits work inside of virtual machines ...
4
votes
2answers
528 views

What are Implicit and Explicit Certificates in Public Key Cryptography?

A Public key is certified by a Trusted Certifying authority, to ensure the integrity of the key and authenticity of the entity who claims to have the corresponding private key. In this Public Key ...
0
votes
1answer
183 views

If I port scan a server on the outside of a firewall will this also tell me the ports the firewall is blocking?

Theoretically I was thinking a firewall inspects the TCP header and looks at the destination port and discards/forwards based on its firewall rules. So could I port scan an external server to the ...
0
votes
1answer
141 views

Corporate IT support for client-side cross domain requests

I have an API and a web application that exist in different domains. I can activate CORS on the API to allow for the web application to interface with the API cross-domain. However it has been ...
1
vote
1answer
1k views

Computer worms, propagation and exploiting vulnerabilities

I have been referred here to ask this question, so I am doing a research on computer worms, I have been through several sites and a few caught my attention, I have learnt that worms propagate through ...

15 30 50 per page