1
vote
2answers
1k views

Protecting an IIS web site hosted at home

My case is I just registered at dyndns.com to get a domain for a website I am staging on my home computer (I know it's not considered good to do so). But the website is not big, and I don't expect to ...
5
votes
2answers
724 views

Storing third-party auth info securely

Suppose there's a multi-user web application that requires access to user's mailbox (on third-party service, like gmail, etc.). This access needs to be persistent. Which means we'd have to store user ...
11
votes
2answers
681 views

logging requirements for PCI for web applications

Does PCI dictate how much should be logged at an application level or simply what shouldn't be logged? I'm struggling with too much logging right now and some people who think we should have it. From ...
7
votes
4answers
1k views

Escaping JavaScript constants

how can untrusted values be included in a html-page as javascript string constants? Although the case i am asking uses JSF and Rails, I think this is a general problem independent of the server side ...
8
votes
7answers
627 views

What type of captcha will you recommend?

What type of captcha will you recommend? I am looking mainly at usability, ease of use (development too), relatively secure Usability I find that those captcha with very curly words/numbers are ...
18
votes
5answers
1k views

Can you secure a web app from FireSheep without using SSL?

Assume that you want to give some web users privileged access to your website, but that you are unable (or unwilling) to offer SSL to all of them - at least past the initial login page. In this ...
10
votes
6answers
3k views

Security review: “HTTP header user-agent has been set to (something)”

We got a security review done of our PHP code and they team advised this in their report (amongst other things): /appdir/ Details The HTTP header user-agent has been set to \" . Request GET ...
7
votes
4answers
972 views

Verify Mac firmware is not hacked…how to do?

I have a late model Mac computer. I allowed someone to plug in a USB drive, and my network activity changed afterwards. Normally, Little Snitch will report every app that uses the internet. Every ...
7
votes
4answers
1k views

Copyright issues with encryption algorithms

I'm developing application for Android/Java. Application is a kind of password manager, so I'm storing encrypted passwords under the hood of master password. There are number of encryption algorithms ...
7
votes
4answers
242 views

Security papers or material focusing on the industrial control systems (SCADA)

Anyone know a good site or a list of resource to start to know issue related to the security of SCADA system ?
17
votes
7answers
1k views

How to exploit the “PHP_MAGIC_QUOTES ON” vulnerability in order to cause max damage?

I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
13
votes
9answers
611 views

What do you see as the emerging threats for 2011

As we move in to the new year, what do you see as the emerging threats for organisational security? I see more chat around; Advanced Persistent Threat (APT) from foreign states. More fines from the ...
6
votes
2answers
162 views

Video Conference Systems - Security Testing

Any one have any experience in testing ISDN based VC systems? What approach did you take, tools used? How did you approach fuzzing the protocol? What resources did you read up on prior to testing?
7
votes
4answers
646 views

What good, standard digital signature verification clients are widely or easily deployed?

I'm looking for a good way to publish data along with a digital signature (and ideally a timestamp) which is as easy as possible to verify. For example, imagine an election administrator who wants to ...
8
votes
2answers
308 views

What is secure enough for web applications?

we intend to build a network in a small health center with No Internet Access it is expected to have 30 terminal machines, all machines will use an electronic medical record web application we want ...
7
votes
6answers
1k views

Fortify360 - Sinks & Sources - Vulnerability count

In an application security environment, I use Fortify Software's Fortify360 on a daily basis. One of my biggest hurdles is explaining the numbers (sources vs sinks) Fortify flags each location in ...
4
votes
6answers
824 views

What are the weaknesses of this password-generation-method? How can it be improved?

I recently came up with the problem, that I have much more accounts, than I'm able to remember passwords. I don't want to use a password-safe, because I cannot access it on another computer, I lose ...
15
votes
7answers
2k views

SQL Injection Prevention

SQL Injection is always a hot topic particularly when it comes to web security. In this regard I am interested in what are the steps that should always be taken to prevent SQL Injection within any web ...
12
votes
4answers
5k views

Session Hijacking - regenerate session ID

Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing? I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
20
votes
7answers
1k views

Securing the security guy's home office: what should we do?

I read an article in the latest InfoSecurity magazine (an infosec trade rag by Elsevier) saying that us security professionals aren't necessarily taking the correct steps to protect our own home ...
9
votes
2answers
150 views

War dial research

Anyone know of any specific UK Law that would prevent the use of war dialling as part of a security research project?
10
votes
7answers
1k views

Whitelisting DOM elements to defeat XSS

As we know, developers are responsible for correctly escaping/validating data provided by the user before rendering or storing them. However, we must agree that it's relatively easy to forget a single ...
6
votes
2answers
2k views

Bell-LaPadula and Biba Together

Theoretically, could the Bell-Lapaluda security model be implemented with the Biba integrity model in an Operating System? Or do are they mutually exclusive? [Edit: Follow up from this question on ...
17
votes
7answers
553 views

which site do you use to view details of vulnerabilities? [closed]

Which site/sites do you guys use to view details of security vulnerabilities?
32
votes
9answers
2k views

Is there a method of generating site-specific passwords which can be executed in my own head?

I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
7
votes
3answers
879 views

What are the pros and cons of outsourcing an organization's PKI?

I am looking for the pros and cons of outsourcing an organization's Public Key Infrastructure (PKI). I understand that the answer to whether or not to actually outsource is going to depend on the ...
8
votes
3answers
229 views

Securing an E-commerce site

I'm building a custom e-commerce site, and the user will input their credit card details on the site instead of being directed to the payment gateway's site. I'm confused as to what the critical ...
7
votes
4answers
2k views

(SoHo) Multi-Factor Authentication for Remote Desktop Gateway

I am looking at implementing some sort of multi-factor authentication for a Remote Desktop Gateway at a small office (less than 20 users). Where would be a good place to start for a quality, ...
15
votes
3answers
439 views

Are there any decent web app security scanners that can integrate with a build server?

I've spent a lot of time in TeamCity recently and the nightly code quality metrics coming from the dupe finder, FxCop and NDepend have been great. What I'd really like to do is find a decent web app ...
7
votes
1answer
481 views

SSH Brute Force Dictionaries

Request for logs please. So, I had an interesting question posed to me around geographical trends in SSH brute force attempts. The question being "has anybody ever looked into the prevalent SSH ...
21
votes
7answers
4k views

Port Knocking is it a good idea?

Normally for a server I like to lock down SSH and other non-public service to only be accessible by certain IP addresses. However this is not always practical if the business doesn’t have static IP ...
12
votes
2answers
255 views

Establishing routines on what to do if a PC gets stolen

I need to establish routines for how to handle theft of PC equipment, specifically laptops and stationary machines. Also I need to figure out how to make the consequences of stolen equipment minimal. ...
8
votes
1answer
775 views

What were the specific security flaws with OAuth 1.0? How are they being addressed in 2.0?

I read an article documenting Twitter abruptly pulling its OAuth support back in April 2009. The article said it wouldn't specify the hole for security reasons, but mentioned "social engineering" is ...
11
votes
6answers
2k views

Is there a security risk running web apps in debug=“true”?

This is a copy of the original question on Stack Overflow which didn't get much love and is probably more relevant here: There are plenty of performance reasons why apps shouldn't be run in ...
9
votes
4answers
818 views

A firewall without any extra features [closed]

I have Kaspersky Internet Security (KIS) installed on my system. I always keep it disabled, yet using a few practices, I kept my system virus free for years: I disabled autorun using these tricks; I ...
0
votes
1answer
476 views

JUNIPER Junos Pulse - how to apply policy to device

we'd like setup and use Juniper Junos Pulse at iphone and ipad for access to Corporate mail. we have juniper SA, prepare policy, but Question: how to apply policy for device?
24
votes
5answers
10k views

Where to get an SSL certificate for personal website?

I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
13
votes
5answers
569 views

What is the potential impact of the alleged OpenBSD IPSEC attack?

Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have. For instance, does ...
16
votes
3answers
996 views

What techniques and tools do you use to relate security events?

You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck. Do you have any cool ...
5
votes
3answers
384 views

Are Windows security updates audited?

An IT guy said that in his company, the Windows updates (small security updates that are downloaded automatically by the Windows autoupdate) are checked by the auditor. ie: the auditor checks if every ...
8
votes
2answers
212 views

Retaining institutional knowledge of a complex infrastructure (checkpoint, juniper, etc)

In the next month my functions will be expanded to include IT security (firewalls, VPN, PKI) in a big complex infrastructure. Can I ask you for advice on how-to be well prepared for it? What sorts of ...
22
votes
2answers
4k views

MySQL Server Hardening

Following the hardening theme.... What are some best practices, recommendations, required reading for securing MySQL.
8
votes
2answers
253 views

Practical DRM for pdfs

An organization I am consulting for is trying to find a DRM solution for an ebook that they publish internally. It is in pdf format. Does anybody have experience with DRM for pdfs, and if so, any ...
4
votes
2answers
1k views

On iOS, what's the benefit of OpenSSL over using CFStream, CFNetwork etc. for secure sockets?

I asked this already on Stack Overflow, here. I was told I might find answers here.
15
votes
2answers
2k views

GnuPG/OpenPGP Key Practices

I'm looking for input on GnuPG (gpg) best practices. It's been discussed some on the gnupg-users mailing list, but I wanted to get as diverse a view as possible, so I thought to bring the topic to ...
8
votes
5answers
5k views

Can I block based on Mac Address?

Incase of dynamic IP's the hacker can work around by taking a new IP or use a Proxy, is it possible to make a ban based on Mac Address ? I want to block at the Webserver level so that unwanted users ...
19
votes
3answers
383 views

Isn't openid with http an issue?

Many openid enabled sites default to http identifiers, even if the openid provider supports https (such as myopenid.com). Does this pose a threat beside the identity being exposed? The second step of ...
6
votes
3answers
1k views

PHP mail() Header Injection Prevention

This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
27
votes
1answer
6k views

iOS Encryption Details

Following on from this question Does anyone have any details/resources on the technical specifics of how apple implement encryption on their iOS 4.x series devices? The Apple marketing material here, ...
9
votes
5answers
712 views

When brute-forcing DES, does knowing something about the plaintext help?

Data Encryption Standard (Wikipedia) I know that with brute force there are 2^56 possible keys to check (56 bits, each either a 1 or 0). But let's say I know the message itself is only made up of ...

15 30 50 per page