0
votes
3answers
140 views

Network Concerns Over a MITM Attack

If my website is hosted on a network of hundreds, possibly thousands, of computers wouldn't an attacker have to gain control of just one of them in order to conduct a MITM attack on my website ...
3
votes
4answers
2k views

Can a session be hijacked if the user is redirected from HTTPS to HTTP after login?

I am developing a web app, which makes HTTP calls as long as the user is not logged in. Once the user clicks the login button, he is sent to a "login page" that is HTTPS. The login makes an Ajax call ...
3
votes
2answers
679 views

Can key files be brute-forced like passwords?

Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...
2
votes
3answers
198 views

Theft of data via live boot disk

I have been working with live boot disks recently and I know that it gives you access to the computer's processing power, internet, and various other tasks without the hassle of a username/password. ...
5
votes
4answers
6k views

Preferred UAC configuration in Enterprises that use Login scripts to map drives

In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work: Dim WshNetwork Set WshNetwork = ...
3
votes
1answer
461 views

What is chrome.googleechotest.com?

I use chrome (dev channel) on mac osx lion and every now and then it tries to access chrome.googleechotest.com on port 80 (EDIT: and other ports!). Anybody knows what is the deal with ...
5
votes
2answers
296 views

Are more passwords breached via dictionary/bf attacks or via packet-sniffers/key-loggers?

This question has always intrigued me whenever the subject of passwords is brought up. Does anyone have direct experience or a reputable source to answer what percentage of password breaches are ...
21
votes
4answers
17k views

Multi-boot with full hard drive encryption and pre-boot authentication

How would I set up a multiboot system which supports full hard drive encryption and pre-boot authentication. I have a system with Ubuntu, Windows 7, Windows XP, and I would like to install Red Hat. ...
-2
votes
2answers
2k views

What are the limitations of vulnerability scanners?

What are the limitations of vulnerability scanners? If it is related to how these scanners work, how these work?
2
votes
3answers
1k views

Reviewing IP(s) that has been blocked by firewall / router

Is there a best practice on how to review IP(s) that are blocked on firewall / router and determine if they are safe to be removed from banned list? Occasionally, the firewall guys see a high counts ...
10
votes
3answers
4k views

What are the risks of storing passwords in a GPG encrypted file?

I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like gpg -d passwords.gpg | grep ...
5
votes
1answer
2k views

Can the TrueCrypt hash be slowed down?

I have read that TrueCrypt uses ~2k SHA-1 hashes on the password. The iteration count is part of the TrueCrypt specification and is 2000 for SHA1, 2000 for RIPEMD-160 and 1000 for Whirlpool ...
3
votes
3answers
2k views

Cleaning a virus by mounting the infected hard disk on another machine?

I have a laptop that has been infected with a virus. I am thinking of taking the disk out of the laptop, putting it into an external disk enclosure, and connecting it to a second laptop so I can run ...
5
votes
1answer
1k views

Is this admin area secure enough? V2

This is a response to my previous question, Is this admin area secure enough?. There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here ...
-2
votes
3answers
152 views

Is cracking really important systems possible?

We always hear about "hacking" (or cracking) banks, websites or the like. Nothing really "important" like centrals, or even satellites (like TV channels). Those we only see in movies - but are they ...
6
votes
1answer
575 views

Haskell and Happstack security

I'm currently investigating Haskell as a platform for secure web development. I'm leaning toward happstack for the web framework part, but I'm also investigating yesod and snap. My gut feeling says ...
6
votes
4answers
2k views

Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)

I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with. I was wondering if the best approach was: CA with RSA keys capable of signing RSA and EC CSRs CA with ...
5
votes
4answers
1k views

Do password complexity requirements reduce security by limiting search space?

I've read that password complexity requirements make passwords easier to guess via brute force attack. The reason for this is that the complexity requirement actually reduce the search space for brute ...
1
vote
3answers
511 views

Monitoring and filtering of arbitrary outgoing data

I would like to be able to not just centrally monitor but also filter any organizational data moving out our edge routers, regardless of the sender application and regardless of the protocol/port used ...
7
votes
1answer
474 views

Sulley - optional element and command check

I'm currently using Sulley to fuzz my FTP server, but I'm having problems. I want to specify the STRU command, which has a syntax: STRU [<SP> F|R|P] <CRLF> I tried to specify the ...
7
votes
3answers
3k views

Secure sync of TrueCrypt containers

Need to sync arbitrary files within two TrueCrypt containers; one container is a backup, the other the one actively used by me, both are local during the transaction. Current concern security wise is ...
4
votes
3answers
449 views

Is this admin area secure enough?

EDIT: Please view the revised question instead The admin area has special access to the database (modifying orders, etc). To help explain, I drew a diagram, so here is my process: Notes: I ...
1
vote
3answers
241 views

will all instrusion dectection will become host-based? [closed]

Will all intrusion detection become host-based once all network packets have been encrypted?
2
votes
2answers
367 views

Why superuser or administrator account should never locked?

Why should administrator or superuser account never locked regardless how many incorrect login attempts are made? What should be done instead to alert the staff to the attempted instrusion?
-1
votes
1answer
382 views

What time do dictionary attack take on salted passwords?

I was reading that the designers of UNIX password algorithm used a 12 bit salt to modify the E-table of the unix hashing function (the DES). Supposing i have a system with 2^(24) users? Is that ever ...
3
votes
1answer
133 views

Suddenly scans for 'formvars.php'

Suddenly, starting from about yesterday-evening (gmt+2), I get lots of -what I suspect are- 'hits' from bots that are looking variations of this file: /somerealpath/includes/formvars.php I'm ...
6
votes
6answers
17k views

It is safe to store photos and documents on skydrive / google cloud services?

I have over 20GB of photos and documents stored on my hard disk without a backup. I'm thinking about saving all of them in a cloud service such as Microsoft Skydrive or google cloud, but I'm wondering ...
1
vote
2answers
836 views

Certified Ethical Hacking courses [closed]

I want to take a CEH exam, I'd like to know what tutorials and books are recomended for this kind of study. I also would like to know if there are certifications that are better-recognized, so that I ...
3
votes
3answers
180 views

A way to secure hyperlinks on websites

How do you think could we secure hyperlinks pasted by users on website's forums, comments, blogs against bad links/leading to malware etc.? I thought about google safe browsing, projecthoneypot. Did ...
4
votes
2answers
1k views

How to use attack trees and attack graphs

I am trying to understand how attack trees\graphs can be used in the security process. I read a lot of papers presenting the topic and how this reppresentation can be useful, but I really don't ...
1
vote
2answers
852 views

Firewall audit log management tools [closed]

is there any free or open source tools that is able to collect audit logs from firewall in syslog format for monitoring purposes? There is 2 firewall in my organization and I would like to track ...
0
votes
2answers
487 views

How to build a secure socks tunnel?

I was using a socks proxy to access websites blocked by my ISP, now it don't work any more in an strange way. Using the proxy is same as not using it! (i.e. I can access open sites but filtered sites ...
1
vote
1answer
465 views

Web Service Security

We are currently designing a Web Service that returns a JSON formatted messages. The following are the planned implementation for the service's security: An SSL Certification to the service for the ...
21
votes
3answers
67k views

How do I test for SQL injection vulnerabilities on a site with input fields?

What methods are available for testing SQL injection vulnerabilities?
3
votes
1answer
440 views

Cookie based session variables

I have a situation in which I cannot use a server-side session, but must allow users to log in, and for their logged in state to be persistent between queries. As with anything that involves crypto ...
3
votes
1answer
69 views

CVSS Temporal Data

The CVSS standard has a "temporal" component that models the changing risk associated with a vulnerability over time, such as the publication of a working exploit. But NIST's NVD doesn't provide that ...
0
votes
1answer
2k views

Ban MAC address from website? [duplicate]

Possible Duplicate: Can I block based on Mac Address? I have a situation where I need to ban a MAC address from accessing my webserver. (Windows Web Server 2008 R2). Is this possible? P.S. ...
1
vote
2answers
945 views

Open Source tool to block email attachments

Is there any way to stop users from sending attachments over Gmail or any web based email including private mail servers, if internet access is through a Linux box running Ip Tables/Squid etc. We are ...
6
votes
4answers
7k views

Bank account number and account holder in check exposed?

I'm not sure if this is standard practice in all banking institutions but almost all banks where I've received checks the account number of the issuer is exposed (some even the account name). Isn't ...
10
votes
4answers
897 views

Source code security

We have about 20 developers working in a heterogeneous environment, mostly using company laptops or desktops. We run Windows 7 on desktops/laptops and a mixture of Linux distros (Ubuntu/CentOS). ...
5
votes
3answers
1k views

TLS Renegotiation Indication Extension vulnerability

I am trying to understand the TLS Renegotiation Indication Extension from the RFC. I can understand that it is related to the fact that the renegotiation is sent under the encrypted stream, but I ...
4
votes
2answers
1k views

Do you require a special type of certificate for using Diffie Hellman as the key exchange protocol in SSL?

In Diffie Hellman key exchange technique both the parties aggree on a common parameter g then they generate their private parameters a and b . Then they exchange g^a and g^b. now they can calculate ...
4
votes
1answer
1k views

Encrypt Medicare card numer in C# in ASP.NET

I am giving a free consultation for a non profit organisation that wants a simple system to manage multiple groups with a schedule component, etc. and also manage the medical informations of the kids. ...
0
votes
3answers
227 views

Is HTTPS necessary for password change if user has already logged in with HTTPS?

I notice many websites implementing HTTPS for changes in account information even though the user has already logged in through HTTPS and tracked by SESSION. Is this really necessary?
5
votes
3answers
242 views

When form submission fails, password field gets blanked, why is that the case?

I've recently asked a question about blanking the password fields in UX for usability purposes, but It seems all the sites use this approach for security reasons. Why is it insecure to post back the ...
3
votes
2answers
272 views

How can I report an ecommerce site in violation of security practices?

I ordered a product from a website and found that their invoice display page is completely un-protected with the order id in the query string and merely incrementing the number exposes every order. ...
-5
votes
0answers
74 views

IP Adress Spofing via ncat,nc etc [duplicate]

Possible Duplicate: Netcat IP Spoofing I want to ask one question to you. My friend and i playing game together.He is using below command this computer. ncat -u -c /bin/bash --allow ...
29
votes
4answers
33k views

Why is passing the session id as url parameter insecure?

I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
11
votes
3answers
2k views

Is it bad to only sign some of a domain's emails with DKIM?

Is it OK if I sign a subset of domain emails, or is this an all-or-nothing game? We use Amazon's Simple-Email-Service for sending e-commerce emails. We would like to sign these with DKIM. This same ...
2
votes
3answers
884 views

Downside of allowing uncertified Certificates

I've seen Firefox poping up the message "Untrusted Connection" where self signed certificates are involved. However, I could not understand what the following means (in bold) : XXXX.XXXX.XXXX:8443 ...

15 30 50 per page