10
votes
7answers
3k views

Secure memcpy for pure C

Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code... Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
17
votes
5answers
7k views

Do you detect/react to DNS tunnelling?

I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
14
votes
3answers
3k views

Computationally simple, lightweight replacement for SSL/TLS

Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
2
votes
1answer
578 views

Comprehensive book to study about wireless technology

I am searching for a comprehensive book on wireless technology that covers in detail almost everything about wireless technology, including the related protocols, security, hacks, etc. I know it is ...
7
votes
5answers
874 views

Code Review Strategies

As per my information, there is no hard and fast rule for doing a security code review but we all develop our own strategy for the same. I was wondering if we all can share the different strategies ...
7
votes
4answers
489 views

What kind of IT security applications do you guys run on your laptop/desktop?

I know a lot of people run different security applications on their laptops/desktops. I use Little Snitch on my Macbook Pro. I like to know where my applications are sending data and where I am ...
4
votes
3answers
386 views

Information gathering before deploying a Network IPS

I understand that most NIPS these days have either rules or signatures built in to them and perhaps gathering information prior to deployment may help in fine-tuning the rules / signature once the IPS ...
1
vote
1answer
714 views

Securing clients side scripts

Most browsers allow users to view the source of a web-page quite easily and modern even provided detailed analysis. Often this code includes critical client side scripts in the form of JS/jQuery, ...
4
votes
2answers
192 views

How can IA-5(1)(b) be enforced on non-Windows systems?

I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing ...
31
votes
6answers
3k views

How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?

In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
7
votes
2answers
652 views

How can IA-5(1)(b) be enforced on Windows systems?

Note: I've also posted a question for this issue on non-Windows systems. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include ...
29
votes
2answers
9k views

HMAC - Why not HMAC for password storage?

Nota bene: I'm aware that the good answer to secure password storage is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. Let's say ...
45
votes
17answers
3k views

Can we still provide confidentiality when cryptography is outlawed?

In certain jurisdictions, use of cryptography by the private sector is limited: e.g. there are reports that in the UAE and other countries not all of the encryption capabilities of the BlackBerry are ...
5
votes
2answers
300 views

Patching Mechanism and security holes

Let me clarify two methods of patching softwares and then I will go straight to the question: I am using both MAC OS X and Windows and different mechanisms of these two famous operating systems in ...
5
votes
2answers
929 views

Password History/Password policy

I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008). Where is password ...
4
votes
2answers
149 views

Question about the SessionLock paper

Some time ago there was a big fuzz over Firesheep: by listening to wifi traffic your login session can be stolen which is very bad because now somebody can e.g. send emails on your behalf. Some people ...
2
votes
3answers
817 views

Ranking of web security conferences

I have prepared a paper to publish in a web security conference. How can I know the ranking of available conferences to know which conference is better? For example, should I look at their sponsors?
18
votes
1answer
2k views

Collision rate for different hash algorithms

Is there any collision rate measure for popular hashing algorithms (md5, crc32, sha-*)? If that depends only from output size, it's quite trivial to measure, but I suppose that depends also of ...
6
votes
3answers
175 views

What indicators did OWASP use to end up with OWASP Top 10?

I was asked by a student how OWASP Top 10 are ranked, based on which indicators: is it severity? ease of exploit? ease of implementing their countermeasures? ... Knowing that each of these ...
10
votes
1answer
130 views

Is there an organization that reviews/approves crypto implementations?

As I understand it, NIST approves crypto algorithms but doesn't cover specific implementations. I think I've read about IEEE approving hardware implementations of, e.g. AES, but I can't think of any ...
18
votes
3answers
3k views

MySQL OLD_PASSWORD cryptanalysis?

The password hash used for MySQL passwords prior to version 4.1 (now called OLD_PASSWORD()) seems like a very simple ad-hoc hash, without salts or iteration counts. See e.g an implementation in ...
3
votes
2answers
275 views

Legal process for suing joejobber?

I'm currently being joejobbed, and want to sue the joejobber. Details: I have real damages: the joejob causes me to receive fake bounces, which: stop/delay my receipt of legitimate mail, since ...
8
votes
2answers
1k views

MIME sniffing protection

As it is known, older versions of MSIE (before 8) have a nasty habit of treating images as HTML if they "look like" HTML, which can lead to nasty vulnerabilities for sites that allow people to upload ...
9
votes
4answers
3k views

Is Schneier's “Applied Cryptography” current?

I've been recommended Bruce Schneier's 1994 book Applied Cryptography as an introduction to the use and the inner workings of cryptography. Is this book still current and a good introduction?
10
votes
5answers
6k views

Encrypting files in a windows environment

We have certain client data which must be encrypted at all times. The part we have been struggling with is encrypting files on network shares. Currently we have network folders encrypted using PGP ...
6
votes
4answers
365 views

What is the solution to Schneier's Law?

Schneier's law (which should probably be called Babbage's Law). States that: Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't ...
7
votes
5answers
2k views

Should one sign and encrypt using the same key? The Azure Training Labs are taking this approach

I'm taking the Azure lab LoadBalancing with WCF and recognise what I have been told is bad from a security perspective, but am not sure if it applies here. Can someone look at this code and tell me ...
10
votes
2answers
325 views

Anyone know of security tools utilizing google's prediction API?

http://code.google.com/apis/predict/ From google: What is the Google Prediction API? The Prediction API enables you to make your smart apps even smarter. The API accesses Google's machine ...
16
votes
9answers
3k views

List of good security podcast one should listen to

I'm a hard core dyslectic who wants to read up on all things security without the reading part. So I want to know what good high quality security podcasts are there? I'm interested in almost ...
1
vote
4answers
4k views

How To - Learn basic hacking skills? [closed]

I'm interested in learning some basic hacking; and I've read online that Linux is a good place to start. Although, I've been a Windows user for as long as I can remember. So I was hoping I could get a ...
5
votes
2answers
514 views

How to submit credit card info to a separate server/website (PCI)

My company has a website/service that stores/processes credit cards and is PCI compliant (Site A). We also have websites with storefronts that need to submit credit card data to that site for ...
7
votes
1answer
1k views

Security Operation Center (SOC)

I am looking for resources and details on establishing a security operation center (SoC) or network operation center (NoC) based on ITIL or any other applicable regulations. Where can I find good ...
7
votes
8answers
396 views

Topics for SecureCoding course in C

So I was asked to put together a syllabus for a series of courses on the basics of secure coding, for a programming team. Though the time constraints are a bit... constraining, I'm working around ...
2
votes
2answers
7k views

aircrack-ng under Win7 — possible?

What needs to be installed to get the full aircrack-ng suite (or the closest possible equivalent) working under Win7? Should you use VirtualPC, VirtualBox, or VMware Workstation for this? Should you ...
5
votes
1answer
805 views

Linux wireless hacking book

I am looking for recommendations on a good wireless hacking book. I would like something more focused towards the defensive, but a healthy knowledge of both would be great. I would also need it to go ...
5
votes
2answers
724 views

What is more secure: Many subdirectories, or many subdomains?

I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef: www.mydomain.net/enroll www.mydomain.net/admin www.mydomain.net/ ... or I can configure them as a ...
4
votes
4answers
866 views

Are there consumer-grade VPN services that support two-factor authentication, like SecurID?

I'd like to increase my VPN security, and Google hasn't turned up anything with regard to VPN services and SecurId. Does anyone know of services like this?
6
votes
6answers
677 views

How to protect data on a thumb drive

So I had a scare this past week (couldn't find my thumb drive) and figured I'd better put in some protection on my thumb drive. What is the best way to encrypt the data on the thumb drive? I am a ...
5
votes
1answer
418 views

Is storing a private key in a device as it was done in AirPort Express the right solution?

Here's a story about how one guy reverse engineered AirPort Express and obtained the private key that was used to prevent cloning the device ability to stream audio to approved devices only. So ...
2
votes
1answer
5k views

strongswan setup for ipsec environment

I have created two virtualbox ubuntu clones for the purpose of setting up a test strongswan ipsec network; I'm trying to follow this guide. The virtualbox machines are on a bridged adapter and i ...
69
votes
7answers
40k views

How secure are virtual machines really? False sense of security?

I was reading this CompTIA Security+ SYO-201 book, and the author David Prowse claims that: Whichever VM you select, the VM cannot cross the software boundaries set in place. For example, a ...
6
votes
3answers
673 views

Patent free symmetric-only key exchange protocols?

I am working with a networked embedded device with AES-128 and no public key cryptography (1KB RAM, 8KB flash). At install, the device is pre-loaded with a longterm AES-128 key known also to the ...
5
votes
2answers
319 views

How can I detect users that have requested AD Administrators to reuse an expired password?

There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it. ...
4
votes
1answer
626 views

Security Risk of Disabling forceguest in non-AD Environment

Our application group is looking to deploy a product which requires that we disable forceguest in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. We are running on a Novell network (I know, I ...
9
votes
2answers
2k views

Data Encryption and Key Management in C#

Which route to take, what are the pros and cons, which is more secure.. Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES ...
4
votes
1answer
486 views

How does the “Service Identity” feature of Azure ACS compare (and contrast) to a real IDP?

It appears that the ACS has IDP-style features within the "Service Identities" section. How does the ACS treat these in comparison to a real IDP? What is missing? Some examples I'm thinking of ...
4
votes
2answers
2k views

Command line Nessus/OpenVAS or NSE to find specific vulns?

Which methods do you use to quickly scan a network for certain vulnerabilities? I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
13
votes
4answers
1k views

Is Steganography considered encryption and subject to USA export restrictions?

I have written an application for Apple's iOS which embeds messages in JPEG files using steganography (see http://en.wikipedia.org/wiki/Steganography). For the purposes of this question lets assume ...
11
votes
7answers
3k views

Why can an encrypted private key be brute forced?

When using SSH keys to authenticate to a server for remote access, why is it possible to devise the true key and therefore the passphrase from an encrypted private key, without checking each guess of ...
12
votes
2answers
5k views

Encrypting with Mongo

How can I achieve the following goals? All compute and storage to be located in the cloud. Encryption in transit of all data between web nodes and db nodes running MongoDB. How to set up tunnels? ...

15 30 50 per page