3
votes
1answer
393 views

How can I use certificates to secure my webservices? What is available to javascript?

I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
6
votes
3answers
4k views

Capturing and decrypting my own SSL traffic

When I use browser or wget to access another site, some sites will only use HTTPS / SSL automatically. When a site doesn't provide content without encryption, how do I capture what my computer sends ...
2
votes
3answers
289 views

At what point is password complexity “safe enough”

Obviously the best passwords will be highly complex randomly generated passwords stored in a password vault. For the average user though, this might be a slight overkill. Assuming that the average ...
6
votes
1answer
976 views

Secure query string parameters

I have an application which use the Thick box jQuery component to open a popup page . And I pass my parameters in query string like this : <a id="btnShowPopup6" runat="server" class="thickbox" ...
-3
votes
1answer
1k views

Nessus does not detect sql injection with “Web App Tests” [closed]

In my website I have an sql injection vulnerability. But when I scan my website with Nessus under "Web app tests" there is no result on sql injection. Why is this? What should I do to make this ...
7
votes
1answer
2k views

Crack plain RSA given p, q and e

How would one find the secret key in a simple RSA encryption when given p, q and e?
1
vote
2answers
175 views

Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?

Question (a) Is there? and if so (b) what is a standard or accepted way for MAC systems to deal with complex software and in particular with Python, Bash and other interpreters? (in terms of ...
3
votes
1answer
374 views

Security of Openflow/SDN network

Openflow/SDN networks give a remote controller the ability to manage the behavior of network devices i.e. configurations. They can forward instruction sets to dynamically change network configuration. ...
19
votes
2answers
2k views

Which SSH security is stronger? 2 Factor or Public key

For SSH authentication, which is more secure? 2 Factor Authentication using a USB token/Google Authenticator(time based) OR Public/private key with password Or could they be both used at the same ...
0
votes
0answers
21 views

Steganalysis of outgoing traffic [duplicate]

Possible Duplicate: Detecting Steganography in images Is there any commercial traffic monitoring systems that implements steganalysis and could issue a warning upon suspicious file transfer ...
-1
votes
1answer
1k views

Changing user account passwords from PHP script - vulnerabilities? [closed]

I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I ...
7
votes
2answers
1k views

Sending data form registration forms

I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical. So how do I encrypt 'userside' and send the data to the server in encrypted form? Can ...
9
votes
1answer
762 views

Reversible, recoverable user data encryption scheme

From this earlier question, I have a general need to obfuscate a set of third-party credentials stored in a user account, which are then used in an internal Winforms software client. The scheme from ...
13
votes
4answers
2k views

PCI-DSS - one application per server?

How do I interpret the 2.2.1 point for PCI-DSS? Is "application server" 'one primary function' or does it need to be "program x server", "program y server" etc? I have a collection of applications ...
2
votes
1answer
218 views

Is this a reasonable approach to “generating” passwords? [duplicate]

Possible Duplicate: What is your way to create good passwords that can actually be remembered? I am using a self-developed "template" for my own passwords (like Facebook, Gmail etc.) I use ...
2
votes
2answers
214 views

Is it possible to boot into root's /bin/bash on a LUKS encrypted device?

I have to check the possibility of case mentioned in the title. An average Linux could be booted up into root's terminal directly without authentication by modifying kernel boot parameters. I'd like ...
299
votes
10answers
36k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
1
vote
4answers
2k views

Does a renewed certificate open old messages?

I have a digital certificate that I use to exchange messages with peers, my certificate expiration date is due next year, suppose I renew this certificate before it expires, will I be able to open the ...
2
votes
2answers
407 views

DNS cache poisoning

What are the things the attacker needs to know from the victim to perform DNS cache poisoning ? for example : IP , Port number and Transaction number what else ?
2
votes
2answers
200 views

Access via http to other protocols and ports!

Our firewall only allows HTTP port 80 but we have detected that a user accesses some other protocols and ports that we deny in our firewall. We know that he has developed an application (Console ...
2
votes
2answers
670 views

Is there any way to differentiate between a normal web request and a web service request?

I have a security layer for providing the security of the requests that come to my server. For all web request that come in a login page is shown if cookie is not present. I am now introducing web ...
6
votes
1answer
193 views

What responsibility do I have in continuing another developer's work?

My question is related to this one. I did not found anything googling around and that is why I am asking. This question I am the sole web developer for a firm, and I manage everything, from ...
2
votes
2answers
3k views

How valid is this statement “SSL sit between application layer and network layer”

taken from http://searchsecurity.techtarget.com/answer/How-does-SSL-sit-between-the-network-layer-and-application-layer The SSL protocol is quite unusual, as it doesn't just operate at one layer. ...
3
votes
3answers
1k views

length of ciphers versus length of key

ssh-keygen defaults to RSA (for SSH protocol 2) and a 2048 bit key. At this description of ssh The supported ciphers are: 3des-cbc, aes128-cbc, aes192-cbc, aes256-cbc, aes128-ctr, ...
4
votes
4answers
2k views

How to spoof an ATM transaction?

About 20 years ago, a man disappeared, but his ATM card was "supposedly" used the day after the disappearance. However, surveillance footage of the store shows no-one in the store physically used the ...
6
votes
3answers
904 views

How to subscribe to information about new vulnerabilities in selected products?

In order to be informed about critical vulnerabilities in selected products I'd want to subscribe to some list about them. I'd want to configure the list of products by myself. The question: Where ...
-1
votes
1answer
1k views

Designing DMZ(s) [closed]

I was wondering what would be the correct way to isolate servers in order to protect them and us from too much harm. Let's have two scenarios: 1) Access to Application Server from the world We have ...
10
votes
3answers
8k views

help understanding client certificate verification

I am creating an API that only certain computers should have access to. Communication will be via SSL between the server and the clients. In order to verify that a client has access, I would like to ...
5
votes
3answers
450 views

PCI compliance can prevent fines?

We're working really hard to achieve PCI compliance for a project and will likely be spending hundreds of dollars each month, but I was wondering what if, god forbid, something unlikely happens and ...
-6
votes
2answers
286 views

What technologies are recommended for E-banking? [closed]

If a Linux user need use his bank account from Internet, then what technologies and procedures should use? Is better to use the Guest Account (if exist) of the OS, or an Administrator Account? What ...
-1
votes
1answer
731 views

Prevent URL manipulations including /proc and /etc with fail2ban

I get many attacks on my debian apache server that include URL-manipulations like http://url_on_my_eserver/?username=/etc/passwd How can I block these attacks?
0
votes
1answer
280 views

Password protection of encryption and signature keys

I would like to store encrypted backup of text files on my computer. I'm developing a python script using Pycrypto to achieve that, based on this code to use the library. (current code) The basic ...
3
votes
1answer
413 views

Are man-in-the-middle attacks against p2p systems realistic?

I'm implementing a DHT based on Kademlia following this paper. The protocol described in this paper uses nonces to protect against man-in-the-middle attacks. The disadvantage is that latency gets ...
9
votes
3answers
2k views

Security tradeoffs of pathname-based MAC (e.g., TOMOYO, grsecurity, AppArmor, …)

I have been learning about MAC (Mandatory Access Control) systems in Linux. Often, but not always, these are tied to Linux Security Modules. Some systems I've looked at: SELinux, Tomoyo, AppArmor, ...
13
votes
2answers
612 views

How do I prevent my twin sister's “pulled from public record” information from being used when I try to answer security questions?

Several times in the past months, I have been asked security questions that are "pulled from public record" to verify my identity, either over the phone or on a website (Chase Bank, Walgreens ...
2
votes
1answer
324 views

what is the difference between virus, worm, trojan and other malware [closed]

Looking through the questions in IT security, I found out that there is no answer which cover this question in depth. I am aware of the answer and just hope to see something detailed about: main ...
4
votes
1answer
168 views

What physical, electronic, and software characteristics are important in a smart card?

I'm evaluating smart card readers to store a number of private keys, but don't know where to start. What criteria is important regarding smart cards and preventing the extraction or unauthorized used ...
2
votes
1answer
228 views

how does OpenSSL create X.509 certs from SPKACs?

The SPKAC ASN.1 description: PublicKeyAndChallenge ::= SEQUENCE { spki SubjectPublicKeyInfo, challenge IA5STRING } SignedPublicKeyAndChallenge ::= SEQUENCE { publicKeyAndChallenge ...
8
votes
3answers
997 views

How to authenticate a salted password?

If only the password hash is stored and the user inputs the original password, how does the program know that it is correct? I guess it could check all the possible salts but if there are 32bit salts ...
1
vote
1answer
417 views

spkac: what is the purpose of the challenge string?

The SPKAC ASN.1 description: PublicKeyAndChallenge ::= SEQUENCE { spki SubjectPublicKeyInfo, challenge IA5STRING } SignedPublicKeyAndChallenge ::= SEQUENCE { publicKeyAndChallenge ...
2
votes
3answers
3k views

KDC(Key Distribution Center) vs Asymmetric Key Exchange

Today I was reading notes about cryptography and I came across a problem that exists in Symmetric Key encryption, which is how to share the secret key across the network. 1st Method : Make use of ...
2
votes
4answers
1k views

Are malicious scripts in batch files detected by antiviruses?

we have many scripts in shared folders in our IT Department. Are malicious scripts in batch files detected by antiviruses?
0
votes
1answer
129 views

Manually monitoring your PC for Java (Oracle) exploits?

Sandboxing and AV's aside, if I wanted to manually look at/monitor my system for where they usually enter it, where could I look for possible malicious Java viruses/activity, e.g., would they first ...
0
votes
5answers
380 views

How to protect server uploads

I want to upload .jpg images to my Linux server so that clients can re-download the files when they want. Supposing unknowingly there is a trojan, worm or malware in my computer, will these be ...
6
votes
1answer
7k views

What is the fail2ban default setting for SSH login attempts?

I tried to block myself from my own server to test if fail2ban works correctly, so I tried ssh login and used a wrong password over and over. But I was blocked only after 13 failed logins instead of ...
13
votes
3answers
985 views

Do any DNS registrars support multi factor authentication?

I am looking for a DNS registrar that supports strong multi-factor authentication. Does any DNS registrar support multi-factor? Is this a legitimate need?
0
votes
0answers
77 views

Is it possible to attack system through torrent usage? [duplicate]

Possible Duplicate: What can do a hacker with ip address? I am using the Torrent for Downloading the Music and other files. I heard that using Torrent can give IPAddress information to ...
1
vote
3answers
286 views

How this kind of mechanism considered as vulnerability?

From following news, http://thehackernews.com/2012/12/etsy-for-iphone-loophole-allows.html Someone just setup a proxy to intercept traffic between browser and https protocol, then it called ...
4
votes
2answers
2k views

What did the certificate authority do with my CSR?

I needed to reach a web service which is not mine. The IT department of that web service has asked me to send them a CSR (certificate signing request). Then, he will send me back a signed certificate ...
4
votes
1answer
1k views

Where can a virus or other malware “hide” on common PC and Mac hardware?

I'm looking for a detailed list of locations that viruses can "hide" in modern hardware even after a reboot. Some things that come to mind include Boot BIOS/Firmware CPU Microcode Connected PCI ...

15 30 50 per page