0
votes
3answers
508 views

How to rewrite config files using SNMP?

I scanned a router and found that the community string is public. The write access is also enabled. Now I want to change the configuration of the router. Can anybody tell me about tools and tutorials ...
4
votes
4answers
16k views

Is there a way to sniff packets of a remote IP address?

I would like to know if sniffing packets of a remote IP address is possibole at all, if yes i would like to know : what is the success rate, i mean by that how much percent of the packets you would ...
3
votes
3answers
529 views

Encrypting an email server's local drives or filesystems

Planning to deploy a remote hosted mailer (Zimbra based) I need to make sure the local data on the machine is encrypted. Currently, the plan is to use the built in LUKS to encrypt /opt/zimbra and ...
6
votes
3answers
4k views

How can I convert my encypted PGP secret key for use performing SSH authentication?

I wish to covert my PGP key (RSA) to be used performing SSH authentication. After some searching, I found openpgp2ssh, which appears to be an appropriate tool. Everything works swimmingly for my ...
3
votes
2answers
821 views

Secure Mobile Payments using HTTPS Web App

I'm hoping an expert with PCI compliance knowledge can help answer this question. We're looking at integrating mobile payments with our application which is HTML5-based for cross-platform reasons. ...
11
votes
3answers
189 views

How serious are security concerns of wireless healthcare devices?

Back in 2008 a wireless defibrillator was shown to be hackable. At this year's Black Hat conference a presenter showed exactly how to hack into a wireless insulin pump. Both of these demonstrated ...
2
votes
1answer
425 views

Safe harbor in USA, EU, and Russia

I am doing research on Google's Blogger service and its privacy protection features. They say that Google complies with the U.S.-EU Safe Harbor Framework and the U.S.-Swiss Safe Harbor Framework. I've ...
10
votes
1answer
3k views

Preventing man in the middle attack

I recently did a man in the middle attack on my college LAN (for purely educational purposes:)). I simply wrote a raw socket application that pumped ARP reply packets advertising my MAC address with ...
4
votes
6answers
212 views

Archive encrypted traffic, for later decryption attempts?

I am concerned about sending long-term sensitive information over SSL. Someone who does not have the private key could record SSL traffic (with WireShark, Fiddler or some such) and store it for ...
6
votes
1answer
762 views

How has TLS renegotiation been fixed?

I've read RFC 5746 on the TLS secure renegotiation extension. However, I don't understand how it fixes the problem. Client and server are required to include the verify_data from the previous ...
1
vote
1answer
288 views

Safe to store access details in a session?

Background I am about to create a website which will have a registration/login area. After the user has logged in he/she will have the ability to buy one or many modules which consist of static ...
12
votes
10answers
18k views

Techniques for Writing Encryption Algorithms (Exclusively For Personal Use)

I'd like to preface this question by stating that I fully understand the dangers of writing your own encryption algorithms, and I would never, ever, use homemade encryption to secure the data of ...
3
votes
3answers
575 views

Can too much web searching be a danger to a security professional?

As a junior security professional, I spend a lot of time goggling for things such as 'wpa dictionaries', 'vulnerabilities...' , 'how to crack ...','and so on. I sometimes feel like I am calling for ...
1
vote
1answer
258 views

Security testing on network

A group of student have been asked to do a bit of network security testing at college. Basically the college have just invested in some android tablets, more macs and more net books. The IT admins ...
5
votes
1answer
21k views

How to use OpenSSL generated keys in Java?

I have my pair of Public and Private keys and my certificate. Those where created in OpenSSL (why? because I was asked to do it in OpenSSL). Now I want to use those things to make a Java app that ...
4
votes
3answers
7k views

What data should I validate when validating X.509 certificates using Java?

Well I began with PKI a year ago with RFID system at school. Now I'm asked to implement this in my job. I understand most part of the idea. The doubt is about the certificate validation. I know it ...
5
votes
1answer
594 views

Trying to prevent Cisco toll fraud

A little back story on the setup first; We have a Cisco VoIP setup at our remote office(where I'm at) and the main CCM/CCX/Unity setup is at the parent company across the US in Connecticut. We have ...
4
votes
1answer
472 views

How can I validate data on RFID chip that has RSA signatures and SHA1 hash values?

I have a RFID chip that has a digital signature using RSA and has data hashed using SHA1. I would like to compare data from the chip and user input in a program but I believe in order to do that I ...
5
votes
6answers
10k views

Mysql - two-way encryption of sensitive data (email addresses) outside of Apache, PHP and MySQL

We store user email addresses in our database, like many other websites. While we do take pride in the security measures in place, sometimes "just enough" is just not enough. We've begun looking into ...
14
votes
1answer
1k views

Wireless mouse security

How secure are wireless mice? Is it possible to control a wireless mouse from a different computer? Is it possible to know the mouse movements from a different computer?
4
votes
3answers
4k views

Groupon SG is Storing Customers' Credit Card Information

Today I was purchasing a gift from Singapore Groupon website. And then I realized that what I have to do is simply login and hit the "submit order" button, because they store my credit card ...
8
votes
2answers
7k views

Can the numbers on RSA SecurID tokens be predicted?

My workplace uses these SecurID tokens which provide you with a temporary password, the code will expire after a short time. I have always been fascinated by the things, because it seems as though ...
6
votes
5answers
23k views

Modern high quality password dictionary

Has anyone come across any good password dictionary lately? Some of the lists I found dated back to 90's! Some are simply too big that I doubt their quality. There appears to be some work by someone ...
6
votes
4answers
2k views

Is this type of ARP poisoning attack possible?

I am wondering if it is possible to paralyze a network by sending out a bunch of fake ARP response packets. Some basis: I recently read a moderately detailed description of how ARP and ARP poisoning ...
2
votes
2answers
796 views

Chrome reports on other browsers running

I was playing around with Chrome and typed the following in the address bar: chrome://memory-redirect And saw the note: "If other browsers (e.g. IE, Firefox, Safari) are running, I'll show you ...
5
votes
3answers
615 views

How dangerous is it that there are DNS entries for our domain that we did not register?

I was performing an DNS brute-force on our company's domain and found entries like "html" "ww" and "wwww" resolving to IPs outside of our registered block. This sparked a debate about just how ...
3
votes
1answer
3k views

Spoofing email From address

Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...
3
votes
5answers
238 views

What's the Security equivalent to SICP? [closed]

For those of you who don't know any developers and/or didn't go to MIT, The Structure and Interpretation of Computer Programs is the Canonical reference on it's title subject. It is often used as the ...
4
votes
2answers
2k views

Securing Windows 7 using Bluetooth

I'm thinking of using my iPhone as a device combined with a low power bluetooth usb key. So when the phone is gone the workstation locks. (I don't want it to unlock the workstation though, I'd prefer ...
-1
votes
2answers
129 views

What risks is one exposed to by browsing the Internet? [closed]

I which forms can visiting certain sites compromise one's system security, taking into account that browsers keep a sandbox for each opened page? Nowadays, can a malicious -or attacked- site really, ...
10
votes
12answers
910 views

How to guarantee that password is hashed on server-side?

I'm worried when I send a password to a server, even with SSL or TLS, that the server stores the password in cleartext. Is this the case? If yes and the server gets hacked, all passwords are available ...
6
votes
3answers
1k views

Is a Master's in infosec required to break into the security field?

So I'm going to be graduating college in January 2013, with a double major in Compsci and Cell Biology (don't ask...). I'm really looking to break into the information security field as a consultant. ...
5
votes
1answer
195 views

Security evaluation: what is there apart from common criteria?

ACME makes a product that is used in some security-sensitive applications. There are no particular security regulations or industry standards in the domain of this product. ACME's business arm would ...
1
vote
0answers
65 views

References on encryption in enterprise settings [duplicate]

Possible Duplicate: Enterprise Encryption Considerations I'm making a document on enterprise security. I'm looking for references and inspiration on the following topics: Enterprise ...
9
votes
6answers
8k views

how to protect my USB stick from Viruses

I repair a lot of computers with viruses, malware, and what not, and I have one problem that I am struggling to find a solution for. Whenever I connect my USB stick that has the tools I need for the ...
20
votes
7answers
2k views

How can I keep my identity anonymous as a website owner/administrator?

My question looks touchy, but I'll do my best to explain. You see, I live in country where democratic rules are quite, well, delusive. In theory, there is freedom of speech, democratic elections and ...
3
votes
1answer
200 views

HITECH : New United States Federal Act on Data Security

Has anyone heard of the new HITECH Federal Act? I understand that it is an underscore of the HIPAA Federal Act but am unclear of the requirements that they are requesting. It targets companies that ...
4
votes
2answers
736 views

Is there any research on which SSL certificate authority has the best browser compatibility

We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of ...
6
votes
3answers
365 views

On-line cryptographically signed date/time?

I’m looking for a source of on-line cryptographically signed date/time. I do not need a full timestamp service, as I am happy with the information « date/time was that », without a link to a ...
101
votes
9answers
12k views

How can PayPal spoof emails so easily to say it comes from someone else?

When I receive a payment in PayPal, it sends me an email about it (pictured below). The problem is that the email is shown to be coming from the money sender's email address and not from PayPal ...
3
votes
1answer
299 views

What lawful interception standards are used outside Europe?

In Europe European Telecommunications Standards Institute (ETSI) define the standard requirements to handle a lawful interception. It's define all from the terminology and definition to the ...
8
votes
4answers
1k views

Automated encryption detection

Is there any program that, given a cipher text, it would tell me what the encryption algorithm is? What if I have the plain text? Is there something that can be done in that case?
16
votes
4answers
2k views

sniffed packets , is there a way to put together the file?

I would like to know, in case an attacker manged to capture some packets from my network traffic, can he build from them a file or any easy to understand thing? I know that the TCP/IP protocol is ...
3
votes
2answers
6k views

Listing of DNS vulnerabilities

I am currently studying how to setup DNS servers and all aspects of the DNS system. I would also like to study the security aspect. I want to use current DNS server attack on my test servers. Is there ...
5
votes
2answers
3k views

What asymmetric encryption algorithms are in common use beside RSA?

I am looking for an asymmetric encryption algorithm other than RSA?
4
votes
1answer
904 views

Is a public known password protected Wifi more secure than one without a password?

When connecting to a public Wifi from a café for example, some don't use a password and some do. If they do use a password it is often publicly known to everybody around. Does having a password on ...
8
votes
3answers
6k views

Proxy vs. Firewall

I understand that very simply put a proxy is a sort of 'man in the middle' allowing/denying access to certain services/resources. Strictly in terms of security (I mean here privacy, parental control ...
8
votes
1answer
10k views

Are open ports dangerous?

I have forwarded port 80 to WAMPServer and 25565 to the MineCraft-server running Bukkit. (http://www.bukkit.org/) Am I vulnerable to attacks. Can hackers attack me if WAMP-server is running or if it ...
1
vote
3answers
448 views

Install my own proxy

My school network has blocked a lot of webpages, including TeamViewer, which I need. The IT department told me to find a proxy, because it was their ISP who had blocked the sites. To connect to the ...
10
votes
2answers
5k views

Is it safe to store the password hash in a cookie and use it for “remember-me” login?

I want to store an encrypted string of the password hash in a cookie and use the hash to lookup the user and log them in (if they want to be remembered). Is this safe? The password is one-way hashed ...

15 30 50 per page