4
votes
1answer
248 views

Jobs Regarding Network Security

I am new college graduate from India with no job experience. I have deep interest in Information Security and would like to a work for any good company related to the field. Since I don't have ...
-4
votes
2answers
206 views

Alternative for cryptography

Is there any alternative for cryptography? I heard a lot about quantum cryptography, but is this the only stuff which have a chance to exist in the future? Are there any other kinds of cryptography?
7
votes
2answers
10k views

How to get public key of a secure webpage?

How can I get the public key of a webpage like verisign , etc. using HTTPS protocol?
9
votes
2answers
19k views

How was my Yahoo email account used to send spams

My yahoo email account was sending spams at about 6:42pm EDT (the spams show 3:42pm PDT) yesterday. I realized it by receiving several "Failure Notice" emails for Yahoo was unable to deliver the spam ...
1
vote
1answer
68 views

Verifying physical address via a verification service provider. Are there any threats?

The idea is to send address information to a service provider to see if the address actuall exist or will kick back not valid. If done over an unencrypted connection across the internet, are there ...
4
votes
2answers
237 views

TLS server key: possible to sign another TLS server key?

If I have a valid (verifiable) certificate C_K_s that links the server key K_s to "www.example.com", is it possible to : use K_s to sign K_d, and let S_K_d be this signature use K_d as the TLS ...
4
votes
5answers
392 views

Tool to grab sensitive information from command lines [closed]

Of the information entered on the command line (command name and arguments) have to be considered public (everyone can access it using commands like ps). Is there a known tool to automate this kind ...
2
votes
1answer
53 views

What can I do to separate users best way if they are allowed to run their ruby (python) code

I have Ubuntu server 12.04 on VDS and I allow users to run their own Rails applications on behalf their own accounts. That means: They can use any shell they want They can upload what they want, ...
1
vote
1answer
151 views

Closed Internet Explorer inprivate trace

Suppose that a user uses inprivate mode in Internet Explorer and browsed something. Now, an administrator wants to search the user's activity in Internet Explorer using the user's PC without having ...
2
votes
1answer
750 views

Advice if safe from mail header injection PHP [duplicate]

Possible Duplicate: PHP mail() Header Injection Prevention Since I only started learning about header injection in the PHP mail() function, am uncertain if the form/code below is vulnerable ...
4
votes
1answer
744 views

Reasonable (BruteForce) Attempts/Second Estimate?

I've read various articles on password strength and passwords vs pass phrases (including the one from XKCD and its thread here), but most of those articles seem to be focused on online passwords, and ...
2
votes
2answers
560 views

Possible website hack?

I have been receiving some strange requests on my website from foreign countries. For example, 218.83.152.252/judge112233.php, /www.travelimgusa.com/ip.php, //59.53.91.9/httpproxy/proxyheader.php, ...
4
votes
1answer
278 views

php security courses

I got asked today by my boss if I wanted to do some php security courses, however I am not even sure other than the zend securing php applications course if any exist could any one provide any links ...
3
votes
2answers
185 views

Where a sysadmin deletes a company's data, why can't they just restore from backups

As an example, in the UBS Duronio case, Mr. Duronio executed code that deleted everything in its path, but isn't there a backup server? Why was UBS hit by the loss of data? If the backup is available, ...
8
votes
3answers
323 views

Does concealing server software versions have a notable effect on security?

Web servers can add Server, X-Powered-By and similar headers into HTTP responses. Looks like the consensus is such headers should be removed so that automatic vulnerability scanners don't immediately ...
0
votes
2answers
1k views

Is there any good open source software for Security Risk Analysis?

Is there any good open source software for Security Risk Analysis? for example something like one explained on : http://www.security-risk-analysis.com/introduction.htm
2
votes
1answer
894 views

Generate one CSR for two Windows servers

I have two Windows 2008 R2 servers which will be hosting a load balanced website. I will generate a private key and use it to generate a CSR using OpenSSL. How can I make this CSR (or the resulting ...
3
votes
2answers
170 views

In practice, does crypto software accept a *.com or or even a *. certificate?

Assuming this will be done with your own PKI, and not a public trusted CA. Considering that *.sub.domain.com is valid, and so is *.domain.com is valid, is it technically possible to issue *.com and ...
2
votes
3answers
962 views

SSL inspection detection

an interesting question was recently asked about SSL inspection, and that got me wondering if it is actually possible, from the end user (or even server side), to detect if the SSL link is being ...
5
votes
1answer
380 views

Securely Store Credentials for Web Application Services in Apache

We are running a web application in python using wsgi with apache2, and must submit to a penetration test. The testers will be exploring the potential for damage if the attackers gain shell access as ...
32
votes
5answers
17k views

What is preventing us from sniffing the mobile phone communication?

I'm learning wireless penetration testing. It really is amazing. But it made me wonder, what about mobile phones? They are also means of wireless communication. So, our entire voice must be in the air ...
-6
votes
2answers
3k views

Is AES slower to encrypt than MD5?

Is this the right interperation of this diagram: http://www.cryptopp.com/benchmarks.html AES/CCM MiB/Second:61 Cycles Per Byte:28.6 MD5 MiB/Second:255 Cycles Per Byte:6.8 And does that ...
3
votes
1answer
1k views

EMV Security? How is it possible that it's secure?

I recently read some articles on EMV and the various ways in which it has been improved over the years. I then read this which shows that it has been possible for some time to exploit EMV via a man ...
1
vote
0answers
1k views

SIEM-AlienVault; Risk Metrics, Assets, and basics [closed]

Been trying for a week now to get AlienVault (referred to as AV hereon) running with little success. I've gone through 2 installs so far. First time messing with SIEM, though have very limited ...
5
votes
4answers
2k views

Is encrypting a salt value with a password/plaintext a viable alternative to straight up hashing?

The basic problem, as far as I can tell, is that hashing's flaw is that the password is in the hash. Asymmetric encryption's flaw is that the password is encrypted and can be reversed. The posts ...
14
votes
5answers
5k views

SSL Inspection and privacy

I know my company is testing something called "SSL Inspection" based on Websense, which is our proxy. I can not provide more detail about this, but does this mean that in principle all my SSL traffic, ...
8
votes
2answers
3k views

Using RSA with 3DES instead of plain 3DES. Does it make sense?

I have a large legacy code. Currently it is using 3DES encryption for a network based application. It encrypts data packets with a main key. This key is used to encrypt and decrypt (symmetrical). And ...
5
votes
2answers
2k views

Raw hard disk data extraction possible?

Suppose that the administrator's account is hacked. Then, can a hacker extract hard disk raw data (by raw data, I mean every raw data, not just files that can be read by a file system.)?
5
votes
1answer
148 views

Does every security patch get back ported to every .NET framework? Are there exceptions to the rule?

I can imagine a scenario where Microsoft will create a security patch for some versions of .NET and not others. This might occur in occasions it's too expensive to regression test and back port all ...
3
votes
1answer
399 views

Implementation of Blizzard's Mobile Authenticator

How is the Blizzard Mobile Authenticator implemented? Does it happen to use OATH-TOTP or something similar?
4
votes
5answers
398 views

Why wasn't the flame malware flagged by firewalls?

Why didn't any firewalls catch the flame malware siphoning out all of that data? I thought there was firewall software that looks for "suspicious" activity?
2
votes
3answers
140 views

Are all vulnerabilities security related?

Are all vulnerabilities security related? When people talk about vulnerabilities and security vulnerabilities, are they the same concept? My understanding is that a vulnerability is the a weakness in ...
3
votes
3answers
5k views

Suspicious email with my information in it: what do i do?

I just received this email: Billed To: d**********@****.NET John ****** Order Number: M1V62***2711 Receipt Date: 07/12/12 Order Total: $699.99 Billed To: Credit card Item Number Description ...
0
votes
2answers
105 views

Should a host based firewall have an API accessible to other applications?

Some people are hesitant to use Windows Firewall because it allows software to alter its state via an API. The benefit of this is that the Firewall configuration can be centrally manged in GPO. On ...
2
votes
2answers
2k views

How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?

In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended. ...
0
votes
4answers
1k views

A faster method than Blind SQL Injection?

Blind SQL Injection is based on TRUE/FALSE tests. Here is an example: is first letter A? --> NO is first letter B? --> YES is second letter A? --> NO ... is last letter X? --> YES It's ...
4
votes
2answers
3k views

How to supply OpenSSL generated Private & Public Keys to iOS & Android apps?

The problem statement is: To supply clients on a network with individual Private & Public keys generated on a Server over the wire(over a HTTPS connection after they are registered). The clients ...
-1
votes
1answer
650 views

Top Ten Security Weaknesses of a Networked Computer [closed]

I'm looking for a list of what you would consider to be the Top Ten Security Weaknesses of a Networked Computer, can be Windows or Linux specific but ones that apply to both are better. I'm not as ...
3
votes
5answers
579 views

Does setting the cookie-path protect me from XSS from another context?

Lets say I am using a reverse proxy with URL rewriting that provides access to 2 different applications http://www.example.com/app1/ and http://www.example.com/app2/. I don't want those ...
7
votes
4answers
7k views

How do online accounts get hacked?

How does your typical users run-of-the-mill Facebook/twitter/gmail/AIM/etc account get hacked? Is it simply a matter of a weak password? Are they typically the victim of phishing or other social ...
4
votes
1answer
325 views

Can SIP registrars and VOIP providers eavesdrop?

An e-mail provider provides people with usernames for e-mail accounts. That normally means that they have access to your e-mail if it is unencrypted. Likewise, do sip registrars have access to ...
6
votes
2answers
8k views

Is there any disadvantage in using OpenNIC for DNS resolution?

What are the advantages/disadvantages of OpenNIC vs ISP for DNS resolution with regards to security and privacy?
29
votes
8answers
5k views

Why would salt not have prevented LinkedIn passwords from getting cracked?

In this interview posted on Krebs on Security, this question was asked and answered: BK: I’ve heard people say, you know this probably would not have happened if LinkedIn and others had salted ...
1
vote
1answer
1k views

syn flood size per second

Given the size of a TCP packet is 60 bytes, there is a SYN Flood attack on a computer made ​​by a 100 Mb bandwidth, the question is how many syn packets are sent in a second? Is there any formula for ...
6
votes
2answers
661 views

Is it a security risk to maintain an application developed for a version of .NET prior to 4.0?

I've had a request that we upgrade all our internally developed applications to .NET v4.0. Needless to say, this is a massive chunk of work. Is using applications based on the .NET framework prior to ...
0
votes
1answer
1k views

More information about CVE-2012-0883 vulnerability

I need to have more details about CVE-2012-0883 vulnerability published on : http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0883 Second, I need to know , what mean DSos mentioned on the ...
1
vote
1answer
411 views

Installing applications with different user accounts on linux

I have basic question about installing applications on Linux operating system, using the Oracle database as an example. When installing the Oracle database package, I created a user called ora112, a ...
4
votes
1answer
2k views

Which cross-platform password managers support encryption using a hardware token?

I am looking for a really secure password manager and I really like the fact that Password Safe supports encryption/decryption using a Yubikey programmed in challenge-response mode. Read more here: ...
1
vote
2answers
293 views

Elcomsoft Advanced EFS Data Recovery

The Elcomsoft "Advanced EFS Data Recovery" whitepaper says First the program tries to do this automatically, for example trying to extract the password from cache or system files, checking simple ...
0
votes
2answers
490 views

How to get started in information security with sales background?

I am currently a Masters student looking to change career from sales to IT, specifically Information Security. What are some good resources about finding jobs? What skills should I focus on to get a ...

15 30 50 per page