2
votes
1answer
2k views

What kind of wifi network does not have any protection and yet it's not an open network?

When I browse thru the list of wifi networks in my neighbour, I see a couple of unprotected networks (with no wpa/wpa2 or wep protection). When I try to connect, I cannot. These networks belong to ...
31
votes
3answers
69k views

Understanding 2048 bit SSL and 256 bit encryption

On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: http://www.digicert.com/256-bit-ssl-certificates.htm What exactly is the difference here and why are two encryption bits ...
5
votes
4answers
644 views

Is not checking the src url a vulnerability?

By using a system of special tags you can allow users to add custom images, for example, tags like [img]user_url[/img]. Then you replace the tags by their real HTML tags like <img src="user_url" ...
1
vote
1answer
424 views

Any safety with private IP addresses? [duplicate]

Possible Duplicate: How can someone hack my PC if I am connecting to the internet through NAT? Private IP addresses (172., 192. etc.) are not routable addresses, and not visible to the ...
15
votes
5answers
2k views

Neural networks & anomaly detection

Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
11
votes
2answers
1k views

Requiring regular password change but storing previous paswords?

My bank requires me to change my password regularly but then they can detect if my password was used before. They probably store the old password (possibly hashed) in order to detect it. I think this ...
3
votes
4answers
23k views

How can attackers bypass firewalls? [closed]

I have read the Wikipedia article on firewalls but don't understand firewall security and how an attacker from the outside can bypass the firewall to hack target system. We all know it happens but ...
3
votes
1answer
190 views

Malicious php scripts in word press theme folder?

I am running a server on Ubuntu 10.04 running a word press website, and recently a virus scan revealed that I have several malicious scripts sitting in the word press folder. In particular they are in ...
2
votes
1answer
690 views

Encryption key token

How to securely store an encryption key in USB drive? Here is my idea. I would like to write a program (let's say PC) and it will store data to a database encrypted at the record level or field level, ...
2
votes
2answers
915 views

How to make a simple file integrity checker

I've seen many PHP file checker on the net. Basically they computes the sha hash of a requested file. Your PC queries periodically the script and alerts you if the returned hash changes. The problem ...
36
votes
5answers
1k views

How do I respond to a published security vulnerability in my application?

In my spare time I write some PHP code the purpose of which is to block link spam and other various malicious activity. On May 11 someone who discovered an XSS vulnerability in the WordPress version ...
3
votes
1answer
601 views

Does setting a firmware password add security if FileVault 2 is enabled?

On an up-to-date OS X computer with FileVault 2 (whole-disk encryption, minus the recovery partition), is any security gained by setting a firmware password, as well?
3
votes
2answers
2k views

openssl equivalent to des command line

I have a simple des command line: des -D -k "whatever" file.enc file.dec des is version des(1) built with libdes v 4.01 - 13-Jan-1997 - eay I would like to use openssl (version OpenSSL 0.9.8a 11 ...
2
votes
2answers
13k views

How does Remote Access Trojan / Backdoor Software work?

How does the RAT works? I understand it as once we surf the infected website, browser might download the trojan to our PC automatically. Will it executed and auto install in our computer? I can't ...
30
votes
7answers
2k views

Dealing with excessive “Carding” attempts

We are currently setup using Magento on a LAMP stack for our e-commerce platform. As of a month or two ago we began noticing a lot of carding attempts against our website. All attempted transactions ...
5
votes
1answer
56 views

What security controls should be in place for online updates of user's correspondance address?

Addresses are one of the key pieces of security information for an account. They're used for authentication, determine where statements go, and changing an address on an account provide enough ...
3
votes
2answers
64 views

securing unpatched websites

I have a client with a lot (read several thousand) websites in several old cms solutions that are no longer maintained. Now moving all of them to a maintained solution isn't really an option at this ...
2
votes
2answers
386 views

Is it a weakness to be able to see server side scripting?

Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction. CLARIFICATION: ...
6
votes
2answers
1k views

Production ready bcrypt implementation for .NET

Which, if any, .NET / C# bcrypt implementations are considered suitable for production environments? I have seen CryptSharp and BCrypt.Net mentioned in answers to other questions but without any ...
4
votes
2answers
655 views

Can you encrypt a password using that password itself? [duplicate]

Possible Duplicate: How to securely hash passwords? https security - should password be hashed server-side or client-side? I need to make a request to a web server, the only information I ...
4
votes
3answers
321 views

Secure File Encryption/Decryption Capabilities

As a preface to my question, let me state that I'm a relative newbie in the field of security. I work for a back-office financial software provider that is responsible for processing, generating, ...
11
votes
5answers
840 views

what would be a good way for a doctor to send xrays encrypted to another doctor?

As a dentist, I often want to send medical information including digital xrays to another doctor. What would be a good/easy way to do this encrypted? Our organization currently requires that all ...
0
votes
1answer
117 views

What is a preferred method of security-conscious creation of login cookies [duplicate]

Possible Duplicate: Is it safe to store the password hash in a cookie and use it for “remember-me” login? I am working on a webapp that uses localStorage alone ...
1
vote
1answer
81 views

Two questions regarding Mixor worm

According to Symantec's write up "it also infects .exe and .scr files in folders containing [RANDOM CHARACTERS].t". What if one of the .exe/.src files is run on the same computer - then all the ...
4
votes
1answer
2k views

Server monitoring for security

We do a lot of web hosting management and have started to get into selling server management packages. However, we want to start monitoring servers for security related threats. Our clients may use ...
2
votes
3answers
1k views

Is SSL Tamper Detectable?

I know how SSL provides security against people reading your messages - by encryting the message with a SYMMETRIC KEY, which was exchanged during SSL Handshake with the help of ASYMMETRIC KEYS. But I ...
1
vote
5answers
2k views

making an iPhone/Android app which sends a user password to my server, how to secure?

I'm making an iPhone/Android app for my website, users already have an account on the website and the app will allow them to login. I don't have SSL on my website, but it's just a reviews website and ...
6
votes
4answers
7k views

What is the danger of Reflected Cross Site Scripting?

What is the danger of Reflected Cross Site Scripting? I understand the Reflected XSS is dangerous, because it's possible. But what practical attacks can be performed using Reflected XSS?
3
votes
2answers
1k views

Tools/methods helping to determine application/protocol serving specific port

I do blackbox testing of the server and figured out that there is a bunch of listening ports. I need to determine what services/protocols those ports are used for. What I've tried so far is to use ...
3
votes
1answer
121 views

Password hashing on a load balancing setup

I've been doing some research into password hashing implementations and would like to know if it's feasible to have two servers hash passwords to the same database? I've come across the Bcrypt.net ...
5
votes
1answer
7k views

Is windows 7 vulnerable to null session?

My lecturer told me that Windows 7 is not vulnerable to null session but did not explain why. What is the preventive measure that windows 7 did to protect against from it? The recommend fixes for ...
-1
votes
1answer
739 views

Please tell me two strings which have the same MD5 hash value

Yes, I know MD5 is weak and should not be used. To make a prove of concept I need two strings with the same MD5 value but all I can find is binary. Like this nice example. Works fine as binary but ...
0
votes
1answer
185 views

How far beyond using Shred should I go when deleting files? [duplicate]

Possible Duplicate: How can I reliably erase all information on a hard drive? I'm looking to securely erase my files. Is shred the best option besides ditching the hardware? To what lengths ...
1
vote
2answers
2k views

Avast says I don't need to use encrypted connections for my e-mail accounts

I am using Outlook 2010 and Avast anti-virus 7. Whenever I add an account to Outlook if I choose to use SSL for incoming or outgoing connections Avast alerts me I shouldn't use it because Avast can't ...
4
votes
2answers
185 views

Did I miss anything when checking for passwords?

I was provided with a "challenge" forensics image of 2MB in size (floppy); they provide the disk image and want you to uncover as many passwords as you can find. I downloaded the image and dd'd it to ...
4
votes
3answers
2k views

how to detect the origin of a hacker attempting to breach or who has sucesfully breached a network or system

In the case of detecting that a system is infected with a root-kit, what if any thing can be done to trace route the origins of the remote out going packets to attempt to find out where the attacker ...
-1
votes
2answers
297 views

Learning IT Security while being paid [closed]

Is there any program out there (from the government or the private sector) where you can learn IT Security (from senior workers) while getting paid (to do the basics as you are learning)? To make ...
6
votes
3answers
2k views

What can a hacker do when he has physical access to a system?

I mean, I'm a tech guy here in my region (not a hacker...). When I sit in the front of another person's PC, I notice a little fear about what I can do in the system. It's obvious that I will not ...
1
vote
3answers
508 views

Why can I read the response to this CSRF attack?

I have a website www.foo.com:8002 that I have resolve to 127.0.0.1:8002 in my hosts file. I have another (the main site) running at localhost:80 In www.foo.com:8002 the page looks like <form ...
5
votes
3answers
1k views

What does WEP access point show during aircrack-ng attack?

I bought an old, used WRT-54G () which strangely enough, was running DD-WRT v24-sp2. Weird what turns up at yard sales. I want to try the "aircrack-ng" WEP cracking procedure on it. The criteria ...
7
votes
3answers
2k views

Web Browsers and Cross Origin Resource Sharing

The CORS spec states that if a request method and headers are not simple (http://www.w3.org/TR/cors/#simple-cross-origin-request) then a preflight HTTP OPTIONS request is sent to see if the request is ...
6
votes
1answer
12k views

Is my router vulnerable if WPS is enabled but WPS pin code is disabled?

I was reading about Reaver and wi-fi protected setups (WPS). In my Netgear router I have the option to disable the WPS pin code, but still have the WPS push button enabled. Am I secured with such ...
0
votes
2answers
690 views

Keeping the password secret over regular http

I would like to at first be clear that this is for poor site owners who can't afford the SSL option but require logins to their site, potentially from a public kiosk, and need a secure method of ...
19
votes
6answers
2k views

Hash function change

I have user account passwords stored in a database using an unsafe (old) cryptographic hash function. What is the best/usual approach to changing password hash function? Only two ideas come to my ...
2
votes
2answers
341 views

Does GateKeeper on OS X 10.8 offer any reasonable protection from exploits?

OS X 10.8 comes with GateKeeper, which basically has three settings: Allow only apps from Mac App Store Allow only apps from Mac App Store or that are signed with a valid Apple Developer certificate ...
4
votes
3answers
3k views

Securing a Windows Guest Account

I know that a person with physical access to a computer can do almost anything to it. My main concern with my Windows 7 guest account is privacy and sandboxing. I don't want a guest user to have ...
5
votes
1answer
588 views

How secure is NFC on mobile devices?

Near field communication is becoming more commonly available in modern mobile devices, such as smartphones and tablets. This functionality can be used to communicate between such devices, or with ...
1
vote
2answers
336 views

Repost: Wappalyzer selling datasets - possible website security implications? [closed]

This question has originally been posted to Stackoverflow but then I found that this was the right place to ask. If you are a moderator, please delete this question at SO. Hello everyone, I am ...
7
votes
3answers
1k views

Encrypt WiFi connection per connected user

One of the questions that comes on quite often is about WiFi encryption. Now imagine that you have multiple users connecting to one AP. With a simple WPA2 protection setup they can still sniff each ...
7
votes
2answers
8k views

Can Keyloggers get passwords from Windows 7/8 Logon Screen?

If yes, do you know some examples of Keyloggers capable of perform this? EDIT: I mean when logon in the windows right after power on the PC and/or when locked with Win+L.

15 30 50 per page