2
votes
3answers
2k views

How can I get my SSL certificate signed by an CA for web application that runs on localhost

I have a web application that runs on localhost. I have a self-signed certificate for tomcat configured but when loading the website on firefox, I get a security exception. Can I get a CA to sign my ...
0
votes
1answer
149 views

What companies drive around recording license plates? What do they do this for and on what grounds are they able to do so, legally speaking?

A friend shared a "security service" he just read about. Apparently the product is in beta and can thus be tried by anyone right now. I found it very interesting and surprising. I'm curious to know ...
0
votes
1answer
221 views

Algorithm to Transaction Data Signing

Transaction Data Signing I need an idea to develop a very secure algorithm to authenticate online operations using PHP in the server and an Android app in the user's device. What is the idea? The ...
3
votes
2answers
1k views

Web security - use of cookie in https

I am taking a web security class and was told by the instructor that most of the websites today use https for authentication and then use a cookie (authentication token) in plain text to keep track of ...
4
votes
1answer
265 views

Why are countermeasures against control-flow hijacking attacks mostly implemented in software?

I wonder why countermeasures against code-injection and control-flow hijacking attacks (e.g. stack-based buffer overflows and heap-based buffer overflows) are mostly implemented in software. Examples ...
3
votes
1answer
125 views

Email, Certificates and DANE [closed]

Does DANE offer the ability to provide certificates for services? Or is it just hosts? How does one specify a mail server with DANE? If my email is jd@foo.com but mail.bar.com is the email server, ...
1
vote
1answer
165 views

Storing encryption passphrases in memory in Dalvik?

Given KeePassDroid, I'm considering some of the security implications of accessing KeePass databases on an Android device. In the native applications for Windows, OSX, and Linux, whenever the ...
1
vote
2answers
184 views

Is it safe to rely on text messages as a means on authentication?

Many websites, including banks, use text messages as their primary or secondary means of authentication. In theory, it sounds like a perfect method unless the user loses their phone or has it infected ...
1
vote
1answer
91 views

Why are certain languages chosen for security application development over others?

Specifically, why are the most popular attack proxies written in java? Is there any particular security posture to the design of the java language that makes writing tools like these simpler? Easier ...
2
votes
1answer
431 views

Is there more risk in changing administrator password locally vs from a centralized location?

I'm working on a mechanism to better handle group policy passwords in response to MS14-025. We formerly used this mechanism for setting the local admin account passwords on our workstations (primarily ...
0
votes
1answer
200 views

Understanding cryptography practically [closed]

So I am interested in computer security, cryptography and security protocols. Thing is, everything I read is about theoretical usage of protocols, but how do those things work in real world? Is there ...
0
votes
2answers
110 views

Encryption in Linux: covenience and security [closed]

I was using TrueCrypt until recently, until one of two options has happened: either it was discontinued or its web-site truecrypt.org was hacked. Any option implies that I don't trust it anymore. So ...
1
vote
2answers
96 views

Security of Shared Corporate Credit Cards

We are a medium sized company. Recently, one of the representatives of the finance department raised a question about the use of credit cards to shop on-line among different departments in our company....
49
votes
5answers
12k views

Are there any reasonable TrueCrypt forks?

Unfortunately, TrueCrypt may have been discontinued yesterday. I use LUKS on Linux, but I liked the fact that with TrueCrypt I had a portable solution across Windows, Mac, & Linux. TrueCrypt ...
1
vote
1answer
1k views

Encrypted LVM as an alternative to TrueCrypt

In a weird announcement on the TrueCrypt page it says that the software is unsafe so we should migrate to BitLocker. If it is a prank it's sure not funny especially when it comes to data. Since I ...
1
vote
0answers
79 views

Is it safe to store password in a session context? ADFS

I'm playing with adfs, and I'd like to store credentials in a session context during my questioning of the user. So, my question is, is it safe to store sensitive data in a session context? Thanks
13
votes
3answers
910 views

What are the security implications of 'open-source' vs. 'source-available'?

In light of the current fiasco surrounding TrueCrypt, I have received considerable criticism from current clients and peers in the IT industry for my continued support of the open-source model. Such ...
1
vote
2answers
10k views

How to determine what type of encryption has been used? [duplicate]

i play an android game which seems to send the player's high score in an encrypted format . some thing like (f11cca35236eebbdc26a0ce45876d117) a 32 character code tried MD5 but no result found. i ...
1
vote
3answers
675 views

OpenSSL encrypting small packets bandwidth overhead

I have an c/c++ program used for encrypting data for communicating between two ends. Encryption is done using OpenSSL (0.9.8d-fips, Sep 2006). Think it'll be worthy to mention that I'm not much ...
8
votes
4answers
497 views

Establishing a Reputable Pseudonym with PGP Key

This has become a bit of a thought experiment for me. Suppose someone would like to establish a pseudonym along with a corresponding PGP Key, how could other people verify the correspondence between ...
4
votes
1answer
190 views

Reverse Proxy SSL

I am having trouble finding out if a potential server configuration is secure. I have a server running a nginx reverse proxy that is accessible from a public ip address on the ports 80 and 443. I then ...
0
votes
2answers
1k views

Way to make “DNS unblockers” safe?

Many people who live outside the US use "DNS unblockers" such as Unblock-Us to access region restricted services such as Netflix and Hulu. My understanding of these services is that for DNS requests ...
1
vote
1answer
73 views

Are there other ways for a CA to have their certificates included in a browser?

From what I understand, the certificate authorities (CAs) have to get their root certificate included in the browser. What if the root certificate of a particular CA is not included in the web ...
0
votes
1answer
39 views

Safely converting untrusted files with Microsoft Word in a web service

I'm made a small web service that gets urls, download them, and convert them for another format. Most of those urls are documents (doc, docs,...). Basically, I'm open them with MS-Word and convert ...
2
votes
2answers
3k views

Securing JSON data

I am planning to use JSON as the data transport mechanism between my iOS app and my server (the server is a WCF service). While learning about JSON, I realized that all the data is passed around ...
9
votes
1answer
1k views

Are there other ways to encrypt files other then TrueCrypt and BitLocker [closed]

I don't trust BitLocker. Probably backdoored and relies on TPM which can be hacked according to DEFON. It also does not allow for hidden partitions or other advantages like TrueCrypt. With TrueCrypt ...
4
votes
2answers
270 views

Reliable random seed for RNG

I want to create my computer passwords with a RNG, but I am thinking about one thing: I would use python to write that script and the RNG is controlled by one seed, most likely the time. If I would ...
6
votes
1answer
540 views

Information disclosure attack, using a heap overflow

A typical strategy for defeating ASLR is to find both a buffer overflow bug and an information disclosure bug. But when attacking servers that are automatically restarted whenever they crash/die, is ...
0
votes
1answer
514 views

Service traffic hijacking, how does cloud make it worse?

I read an article from CSA that they rank service traffic hijacking as the #3 threat to cloud-services. Why is it worse for the user if an attacker hijacks its service traffic on cloud? What new ...
2
votes
2answers
745 views

Where to store a key for system wide encryption/decryption?

I have a web application where (among other things) customers can upload files and administrators can then download those files. The uploaded files are stored on ServerA and the web application used ...
81
votes
3answers
27k views

Is TrueCrypt not secure now and should I stop using it? [closed]

The official TrueCrypt webpage now states: WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues This page exists only to help migrate existing data encrypted by ...
0
votes
1answer
380 views

What is the mechanism for this user impersonation?

I'm trying to understand how this user impersonation might have taken place. Here's the scenario: Our controller got a call from our bank this morning about a suspicious wire transfer request. After ...
0
votes
1answer
133 views

Repairing Bluetooth devices in public places

The wonderful answer to the question "What can an attacker do with Bluetooth and how should it be mitigated?" suggests that frequently repairing Bluetooth devices is a "good idea™." Are there any ...
0
votes
3answers
302 views

Where do my keys come from for requests over SSL? [duplicate]

From what I understand, when you send information to a website over SSL, you encrypt the information you send with their public key. However, if you want to be able to decrypt the information they ...
0
votes
0answers
25 views

Determining the efficiency of a biometric system [duplicate]

How can find the efficiency of any biometric system is there an equation to find it? How is the efficiency of a biometric security system?
3
votes
1answer
61 views

Does RADIUS allow for eventual, gradual adoption of 2 Factor auth in an AD Environment?

We have several applications that leverage AD SAML (via Ping Federate) LDAP authentication from 3rd party applications Windows workstation / Exchange auth (Kerberos) IIS and web components (su4user,...
7
votes
2answers
15k views

Can running a browser in Windows Compatibility Mode be a security issue?

I have several clients that are having trouble logging into vendor's web service. When talking to the vendor about the issue, they told me to set them up with Chrome running in Windows XP ...
1
vote
1answer
296 views

Does PCI DSS 1.4 include tablets and smartphones?

1.4 install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet (for example, laptops used by employees), which are used to access the ...
2
votes
2answers
26k views

Trace source and destination of an SMS message [closed]

Is it possible to trace the source or destination (location, even coordinates) of an SMS message ? If it is, is it possible to do it even if the phone is roaming in a different country ?
0
votes
1answer
104 views

Secure end-to-end when part of conversation must be over HTTP

We have a situation where a user's identity can be verified as follows: the network provider knows the identity of the user and injects secure headers into the HTTP request, which our servers can use ...
0
votes
2answers
79 views

Which mechanism did Flame use to avoid being identified?

I got a question that says "What is the major difference in the USB propagation system used by Flame with regard to Stuxnet to prevent being identified?". After Googling for a while, I haven't found ...
-2
votes
1answer
253 views

Buffer Overflow Exploit Shellcode for Windows

Using a buffer overflow, I have been able to override return addresses. But the problem is that Windows addresses contain zeros at the beginning (e.g. 0x00401020). As a result, the objdump of any C ...
0
votes
2answers
135 views

Can a 'fingerprint' file be used to track a stolen device?

A recent laptop theft, as well as concern that the data upon it might be deliberately accessed (on a drive with encryption or not), head lead me to think about how one might retroactively seek to ...
1
vote
2answers
449 views

MITM is impossibile when the gateway's arp entry is set to static?

As stated in the title. In my lab I am trying to arpspoof a so called "victim pc" that is using Windows 7. I do arp spoofing with arpspoof, but once run arp -a on the victim I see that the gateway ...
1
vote
3answers
1k views

Java AES encryption output length

I am trying to encrypt few database columns (string values) using Java AES algorithm. This is to protect certain sensitive data. For some users these data should decrypted. In Java AES encryption, if ...
21
votes
7answers
9k views

If a Windows laptop with an encrypted hard disk is stolen, can the contents be accessed by a professional hacker? [closed]

In other words, how easy is it to break into Windows without having the passwords for any of the users configured in the computer?
3
votes
2answers
323 views

Using HTTPS, can the target domain be seen?

If I go to https://google.com/q=test_query with from my browser, what traffic can be seen on the router? Can the domain name (google.com) be seen? If so, can I block all of the traffic to a web page ...
-1
votes
1answer
130 views

Prevent someone to login to my website from teamviewer

I have my own suspicions that there are blocked users of my website that use Teamviewer to login to my site from their friends' pc. Is there any way to identify if the one who visit a website is using ...
1
vote
1answer
631 views

Metasploit generating strange shellcode

So I just used metasploit to generate the payload/linux/x86/shell_bind_tcp payload without null bytes (generate -t raw -b '\x00' -f shellcode). Here's the shellcode: $ xxd -p shellcode ...
5
votes
3answers
1k views

3G Femtocell at home: can anybody connect, and is all traffic encrypted?

At our office we have bad reception for 3G. We bought a Femtocell device that provides a 3G connection for one specific mobile provider. This device is connected to our network via ethernet. I cannot ...

15 30 50 per page