3
votes
1answer
717 views

Sip call Developing in android with secure data transfer

I would like to make an application similar to RedPhone on android. I took a look at SipDemo from developer.android.com and at the android.net.sip package.My question is, when you make/receive a call, ...
5
votes
1answer
4k views

When will the webbrowsers have TLS 1.2 support? [closed]

https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.2_.28SSL_3.3.29 and http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/ when will the webbrowsers have TLS 1.2 support?? ...
11
votes
5answers
4k views

Does HTTPS Everywhere defend me against sslsniff-like attacks?

http://www.thoughtcrime.org/software/sslsniff/ If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
1
vote
0answers
160 views

Are there any instant messaging systems that offer resistance to traffic analysis? [closed]

I'm happily using off-the-record messaging now, but I'd enjoy exploring more traffic analysis resistant options? It appears the most visible ones like Tor chat are rather stagnant, or at least don't ...
7
votes
1answer
315 views

How are alternative operating systems even possible to load on a mobile device?

The whole idea of a signed boot image is to prevent replacing the boot image with something customized or malicious. However, the entire process seems to be reliant on a single point of failure: the ...
4
votes
1answer
566 views

Android for the Paranoid

In the case of a rooted phone, what are the various options to stay anonymous and keep your data secure? I've seen the guys at The Guardian Project work towards this: ...
6
votes
2answers
438 views

Videos and visual tutorials on Format String Vulnerabilities

Anyone know of good format string vulnerability tutorials/videos that demo how to test on a web app, such as modifying the URL. I've watched Vivek's videos from securitytube and another from ...
2
votes
3answers
998 views

Is running an OpenBSD in QEMU on an OpenBSD machine safe?

Is running an OpenBSD** using QEMU on an OpenBSD safer then running just natively an OpenBSD? ** = only used for apache + scp + ssh I'm thinking about running the OS/webserver in QEMU because then I ...
0
votes
2answers
279 views

Any Books/Sites/Writeups on IRC bot Security?

I've written a scriptable IRC Bot and I want to harden it against exploits. To that end I've already written it so that it ignores its own messages (so that, for example, even if it echoes back valid ...
5
votes
1answer
253 views

What compliance problem does “Common Criteria Certification” solve?

It has been said Common Criteria solves a "Compliance problem, and not a security problem". Can someone explain where CC certification is required or benefits an industry? Is it simply a marketing ...
6
votes
3answers
4k views

What makes the Blackberry device and network more secure?

One of Blackberry's strongest assets is the "network" that it uses. Can someone explain, or link to technical information that covers what this secure network is, and what it does better than the ...
1
vote
2answers
92 views

rsa certificate authorities

google.com's X.509 certificate issuer: http://www.flickr.com/photos/31717414@N06/6543437881/ The certificate authorities installed in my browser: http://www.flickr.com/photos/31717414@N06/6543437849/ ...
3
votes
1answer
2k views

Wireless MAC Address Filtering - Authentication/Association

Can somebody explain to me how a wireless AP denies access to the network if the client does not have the correct MAC Address. Does it not send a probe response when a client has not got a correct ...
4
votes
2answers
979 views

Network Vulnerability Scanner placement on network

We have implemented/are implementing a network vulnerability scanning process, and we have chosen to use Qualysguard. Qualys supply a scanner appliance for the internal network scanning, which ...
7
votes
1answer
1k views

Is Request.getHeader(“host”) vulnerable?

If the following is the code snippet, what would be your suggestions? <script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script> Is this a clear ...
4
votes
3answers
3k views

How can I check wifi activity?

I have a LAN network with three computers connecting to the Internet both through wired and encrypted wifi connections. Is there a way I can check who is connecting to the Internet via the wifi ...
8
votes
3answers
37 views

Active measures against lost or stolen PDAs in healthcare?

Many physicians, nurses, and technical staff like to carry PDAs to be kept abreast of patient conditions. Various companies want caretakers to view ECGs on their iPads. Due to the incredibly private ...
15
votes
2answers
6k views

Multibyte character exploits - PHP/MySQL

Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
5
votes
2answers
536 views

PCI DSS and Memcached

If I store cardholder details (PAN, Expiry etc.) in a Memcached data bucket, is that something to worry about in terms of PCI DSS compliance? Our database is in a data center and is encrypted. Our ...
2
votes
2answers
1k views

Can an unprivileged process in a hardware-virtualized system cause a `VMExit` without cooperation from the kernel?

For SVM or VT-x, the set of conditions which trigger a vmexit to the virtual machine monitor is pretty complex. Can an unprivileged process trigger any of these without assistance from the kernel? ...
3
votes
1answer
185 views

Should you have full account access when you forget your password?

Imagine the following scenario: I go to login to MyApp.com, but realized that I forgot my password. I request a new password sent to my email. The email arrives with a link to change the password ...
51
votes
7answers
7k views

Are passwordless SSH logins more secure?

I had a long discussion with my co-workers whether key-based SSH authentication (particularly for OpenSSH) is more secure than authentication using passwords. My co-workers always connect to servers ...
2
votes
2answers
748 views

Killing IP connections who “spam” with requests

How can I go about killing IP connections that seem to be sending a lot of requests to the same url? Let's say I have someone who requests the same url for more than 10 times in 5 seconds, I want to ...
0
votes
1answer
382 views

Iframe hack / done through FTP?

On two websites which I host for a friend, I found that there is an iframe at the bottom of each site's index.htm file. <iframe src="http://www.kunstsalen.dk" width=1 height=1 style="visibility: ...
14
votes
1answer
2k views

Best way to secure javascript front end/REST back end architecture web site?

I would like to build the following project: public REST API back end which can be accessed by any authenticated client. front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
6
votes
2answers
1k views

Keeping user data private in a cloud environment like Google App Engine

I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...
3
votes
2answers
237 views

Automatic harvesting of hacked hosts and reporting to domain/site admin

With so many internet attacks out there, I just think it would be convenient (and quicker and wise) if there is a way to automatically harvest the hacked hosts that are used to launch internet ...
3
votes
2answers
1k views

Time server security error

Today at work, we brought out some PCs that were not used for a long time (were not in use when I joined this company so I have no idea about their history). After booting one of them (Windows XP ...
9
votes
4answers
2k views

Is accessing bank account on the internet really secure?

Before I ask my question, I would like to make sure that I understand the settings correctly. So, the given: A client, using some web browser (firefox, for instance) - the Client The bank server - ...
22
votes
1answer
377 views

Are there security design weaknesses in the EFF Sovereign Keys proposal?

In response to SOPA and a number of high profile security breaches at certficate authourities in 2011, the EFF has released a soverign keys proposal: ...
0
votes
1answer
350 views

Enterprise Encryption Considerations

What are the different aspects to consider for Enterprise Encryption policy? So far the resources I have are: https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet ...
8
votes
2answers
3k views

Policy requirements of Sarbanes-Oxley (SOX)

I'm hoping this question will be appropriate for this site. The ServerFault people didn't think it applied to system administrators. Certainly I think it can be answered from a security perspective, ...
3
votes
1answer
465 views

Can format string exploit bypass the PaX protection?

I'm trying to find info regarding how format string exploit can bypass the PaX protection mechanism. As I understood PaX just features ASLR and NX protection. So I wonder if an attacker should use ...
8
votes
3answers
1k views

Secure PXE network OS installation

How can one make sure that when PXE is being used to boot a remote operating system, that the data being sent is encrypted (or at the very least that integrity is maintained)? Would it be possible to ...
5
votes
2answers
6k views

How to secure a dedicated linux server running a LAMP stack for commercial E-commerce use

To be more specific, I would like to get some help, either through a tutorial or through a book, on how to configure an apache server to run securely and minimize the risks for commercial use. ...
5
votes
3answers
1k views

Best user data encryption design patterns?

Let's say that I have a website that allows users to upload files (much like Dropbox), and I need to encrypt those files so that only the users that have access to them can view the file data. Users ...
11
votes
4answers
30k views

Encryption - should I be using RSA or AES?

My model is one where I have several clients which wish to speak with some (but not all) of the other clients. All messages will be sent through a server. Only the two clients communicating with ...
0
votes
1answer
146 views

Firefox Add-ons: “x” as Add-on name? [closed]

Is this normal? Why is the Add-on named "x"? - not just this one, any add-on that I want to install named "x".. Why? p.s.: from the https://addons.mozilla.org/en-US/firefox/ site
4
votes
2answers
229 views

What factors increase the probability of duplicating a GUID?

It's been argued that a GUID doesn't do a good job of being a one time security token , and it makes sense because GUIDs aren't random. In my scenario: suppose a given company is using GUIDs as a ...
6
votes
2answers
737 views

SSH Tunnelling: How can I stop users being able to access services bound to localhost via port forwarding?

I want to be able to offer ssh accounts on my linux server for people to be able to use for SSH tunnelling. All accounts will be locked down with no interactive shell, for tunnelling / port forwarding ...
2
votes
3answers
378 views

Sniffing the sniffer

A sniffs B while B is sniffing C. What's the traffic in A? Does A catches both B and C traffic or only B's?
4
votes
4answers
746 views

Store a password to avoid user interaction

I am creating a windows service that sends email to a user. It uses a Gmail account to send the email, so it needs a password to access the account. It also needs to do this automatically, without ...
4
votes
3answers
228 views

Should user input be validated for it's length?

Is it bad not to validate length of user input to text field at server side. May it lead to such vulnerabilities as buffer overflows and other? I think it depends on programming language of ...
8
votes
6answers
1k views

Cracking long Windows XP passwords

Completing an assignment for my Ethical Hacking unit at University at the moment and the first task I have is to crack some passwords. Decided to use backtrack to crack some passwords from a Windows ...
7
votes
3answers
2k views

Any additional security with large blacklisting hosts file?

I run Windows with a pretty hefty c:/windows/system32/drivers/etc/hosts file obtained from http://winhelp2002.mvps.org/hosts.htm. I update this file as regularly as I remember and layer it with ...
7
votes
2answers
306 views

Do I have to harden IE if I'm only using Firefox?

Assume a Windows 7 system (probably whatever home version comes with the machine), with the latest OS patches, latest IE and latest Firefox. Also assume that the user uses only Firefox for browsing, ...
7
votes
2answers
1k views

Breaking out of a strict linux sandbox running virtually under windows: do the linux-sandbox access control policies even matter?

I am developing an application which will run untrusted code. I have been designing it for linux, thinking that I can just run it in a virtual machine on windows when the need arises. The linux ...
5
votes
4answers
403 views

What fields in a suspicious certificate should I look at?

Looking at a certificate for a web-site (in Windows/Google Chrome) I see it lists the following fields Version Serial number Signature algorithm Issuer Valid from Valid to Subject Public Key Basic ...
0
votes
3answers
464 views

Best protection against a “chosen-ciphertext” attack?

What is the best protection against a "chosen-ciphertext" attack when transmitting (=streaming) secured (=crypted) data via networks using the TCP protocol?
9
votes
2answers
20k views

How safe is it to connect to Internet through VPN?

Sometimes I connect to internet using a VPN connection to be able to access the blocked websites. I've got a few questions regarding this: Are my important data (like my credentials) vulnerable to ...

15 30 50 per page