5
votes
2answers
186 views

What are the risk tradeoffs of all-in-one “smart” IDs vs. using a separate hardware authenticator?

In many organizations these days, employee IDs are very mutli-functional. They can serve as: Visual identitiy verification. (Including employee photo, name, ID number, and other details on the ...
4
votes
3answers
1k views

What sort of mathematical background is necessary to learn ethical hacking?

Do I need to be a "mathematical whiz" to be a hacker?
0
votes
2answers
1k views

What risks do I have to consider when encrypting server side as opposed to client-side?

I am looking at encrypting user data however performed on the server as opposed as on the client. What risks do I have to consider and if so how do I limit such risks? The reason we are looking at ...
6
votes
1answer
888 views

Cutting and sniffing fiberoptic cables - time before detection?

Suppose you'd cut a fiberoptic cable with two razor sharp mirrors, reflecting the traffic out into your sniffing device and then back into the wire again. How fast would you need to get the traffic up ...
12
votes
3answers
9k views

Can I trust the source IP of an HTTP request?

As far as I've understood, if you try to issue a HTTP request with a spoofed IP address, then the TCP handshake fails, so it's not possible to complete the HTTP request, because the SYN/ACK from the ...
1
vote
1answer
377 views

Checking if Mod_Rewrite is Enabled Remotely

When pentesting it is useful to know when apache mod_rewrite is enabled. But when one comes across a web server that does not utilize PHP it is difficult to tell if mod_rewrite is enabled considering ...
6
votes
5answers
3k views

What does key signing mean?

What exactly does the "key signing" mean? So for example I have a private/public GPG key so that people could send me encrypted e-mail, because they know my public key. But: what does key signing ...
0
votes
3answers
5k views

Set Cookie in XHR response : How different browsers handle this?

If I send a XHR request to example.com and response has Set-Cookie: dummyCookie=dummy in response. How different browsers handle this? Does any version of any browser set the cookie for ...
1
vote
2answers
556 views

AVG Website Scan, Chance of 'Potential Threat'?

In a recent question I asked about investigating websites for viruses. The answers were very helpful, I ended up using the AVG website scanner. First I used it on our website and found it was clean, ...
2
votes
3answers
231 views

Emerging Standards for file transfer and integrity check?

What are the emerging standards for file transfers (including online transactions)? How about for file integrity checks?
15
votes
3answers
637 views

If I have two identical linux virtual machine images, will they generate identical random numbers?

A really noob question, I know, but something I was wondering about this morning. If this were the case, would they encrypt things identically? Or maybe someone could direct me to a helpful research ...
2
votes
2answers
3k views

How to check if a website is sending out a virus?

I'm a webmaster at a company without much knowledge of IT Security. We are running 6 computers connected to a central server that also hosts our website. 3 out of 6 people in the office have gotten ...
3
votes
2answers
357 views

Are these standard OAuth2 flows? (what are their names?)

I'm developing a B2B platform, where other developers (our customers) will build shop-front style apps that leverage our platform. We expose a REST based API which our customers either call directly ...
2
votes
1answer
136 views

ISP security compared to enterprise

I've just started reading IT Security, and found some interesting reads on man-in-the-middle and different types of "attacks" that could be used by an enterprise to intercept communications on their ...
3
votes
5answers
232 views

Is DRM considered Confidentiality, Integrity, Availability, or some combination of the three?

I was discussing software trial time limit enforcement with a colleague and the idea of CIA came up. Do stricter enforcement techniques increase confidentiality at the expense of availability? (for ...
3
votes
2answers
806 views

Do fake-address generators work?

There are several pages on the Web that generate fake e-mail addresses so spammers can harvest them; the purpose is to fight spam. (Some examples of this concept under discussion and, in some cases, ...
7
votes
4answers
7k views

What do I need to configure, to make sure my software uses /dev/urandom?

When setting up a server, what configuration changes do I need to make sure that all of the software uses /dev/urandom instead of /dev/random? Some servers don't have much entropy in the entropy pool ...
1
vote
2answers
225 views

Can I connect our network to the internet but only allow connections to certain servers?

At work we have a network that is not connected to the internet however it is exposed to the outside work through USB drives and employees cell phones. I'd like to connect our system to the internet ...
1
vote
4answers
386 views

Integrity monitoring for a LAMP server

So I'm setting up a small e-commerce app, and am thinking what happens if the server is compromised. We are selling software so potentially an intruder could generate themselves some free serial ...
2
votes
1answer
1k views

openSSL Not Displaying all attributes

Here's a background of what I've done so far: I've been able to add a CRL to a self signed certificate using OpenSSL (see attached). But I'm not sure how to create an X.509 certificate issued by ...
0
votes
1answer
104 views

Implementation of a FREE web filter [closed]

I just want some advice for the implementation of a web filter for a school network. Just want to block some contents and url. A free tool should be fine I guess. Any recommendations? Thanks!
3
votes
3answers
1k views

Reading Wireshark Result and Security Learning Recommendation

I am (not so) currently learning about security and right now I am learning about using Wireshark. I bumped into this video: ...
7
votes
3answers
6k views

When is it appropriate to SSL Encrypt Database connections?

Let's say I have a web server I setup, and then a database server. However, they are communicating locally and are behind firewall. In my opinion, no SSL is needed here right? The only time to use ...
17
votes
1answer
13k views

What is the actual value of a certificate fingerprint?

In a x509 digital certificate there is a "certificate fingerprint" section. It contains md5, sha1 and sha256. How are these obtained, and during the SSL connection, how are these values checked for?
4
votes
2answers
361 views

Can a MitM attack occur on an ISP's local exchange or street wiring cabinet?

If an attacker were to dig up the 'outgoing feed' from my local exchange or the street cabinet, could they sniff my entire neighborhood's network traffic? Or is this infrastructure secured against ...
26
votes
3answers
32k views

How to fix SSL 2.0 and BEAST on IIS

As you can see on this post TeamMentor.net vulnerable to BEAST and SSL 2.0, now what? the app I'm currently development got flagged for SSL 2.0 and BEAST by SSL Labs. I'm using IIS 7.0 with the ...
0
votes
2answers
544 views

is it possible to test out remote host by using nmap?

I was trying to test out my friend's computer (with agreement) by using nmap remotely. But the result I got seems kinda awkward to me. It only showed 1900 as tcpwrapper and all other ports were no ...
4
votes
2answers
202 views

Is this a safe way to connect to a server

I am using a software to backup my website .sql data every 3 days and it connects simply to the server logs in and downloads the .sql file to my computer. While its downloading the connection is not ...
2
votes
1answer
212 views

Maximum protection on a computer network?

I would like to secure as much as possible a computer I am using to sync sensitive data files from work to my home pc. The syncronisation is being done by only 1 software is there a firewall to allow ...
6
votes
3answers
2k views

Disadvantages of metasploit Framework for windows

Are there any explicit disadvantages in comparison to running it on a UNIX machine these days?
17
votes
1answer
3k views

How safe is backtrack to use?

I've always used backtrack for security assessments, it's a great toolbox. The thing is since it's a toolbox to exploit things, have their been any reports of "bundled" spyware in standard backtrack ...
2
votes
2answers
896 views

Looking for a presentation about information security for corporate employees

I'd appreciate if you could recommend me a presentation the describes the dangers and possible solutions and guidelines, when using the Internet. Specifically, in corporate settings. I would need to ...
3
votes
1answer
1k views

Requirements for a secure session id?

I'm writing a web service which stores data which will be shared between two separate systems. /session/requestNewSession?args=<data> => returns session id ...
1
vote
1answer
192 views

Stripping / appending characters from user password before hashing to conceal it forever?

I had this idea to permanently conceal user password by requiring minimum length then stripping certain characters. For example if the user password is secret123, the system will strip it down to ...
0
votes
1answer
1k views

Backtrack 5 R2-64 bit cannot load database (postgres) help required?

I want some help regarding use of autpwm feature in backtrack 5 R2. I'm using bt5 (64 bit) on my dell inspiron N5110 laptop. I downloaded the copy fresh from the website and running it as dedicated ...
4
votes
3answers
989 views

Pseudo Random Generator is not initialized from the (entropy pool)?

The RHEL5 manuals state that /dev/urandom will use the entropy pool until it's exhausted, and then it will resort to a fall-back pseudo-random algorithm, so that it will never block. But when ...
7
votes
2answers
1k views

Would an unnecessarily long password degrade performance of a WPA2 wireless network?

My friend wants to keep his home network super-secure, due to some trouble that he's had with unwelcome Wi-Fi intruders. So, naturally, he devised an ultra-long WPA2 passphrase (on the order of 100+ ...
6
votes
1answer
858 views

Injecting ampersand to the url

Let's say there is a program sending some data to server via GET: http://server.com/gateway?value1=abc&value3=def Then the server sends these values further, adding value2: (python code) ...
3
votes
4answers
859 views

HTTPS Everywhere vs. NoScript

What does HTTPEverywhere gives compared to NoScript with Firefox (Options|Advanced|HTTPS|Behavior)? Why use HTTPEverywhere, when NoScript also can strict websites to use only HTTPS?
2
votes
4answers
12k views

How Team Viewer establish Remote Desktop Connection

I am wondering how is it possible for Team Viewer to establish the remote desktop connection over the internet even if the user has not enabled the 3389 port ? I am searching over the internet but ...
4
votes
2answers
4k views

Is your PGP passphrase used to decrypt an encrypted private key, or needed in conjunction with the private key to decrypt the message?

If the former, then if the private key can be used to digitally sign messages, why doesn't your client offer to encrypt this highly sensitive piece of data? If the latter, then if someone had access ...
1
vote
3answers
932 views

Wireless LAN router fingerprinting

Does anyone know of a database that lists the range of MAC addresses that are assigned to each particular brand of router? I would like to use this information for fingerprinting. I know I can find ...
9
votes
3answers
2k views

Hashcash, is this really used?

I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
3
votes
2answers
129 views

Does site need SSL to resend info to a site that does use SSL?

Let's say I have a website isellchicken.com, this site needs to be able to collect sensitive user information like credit card details. This site will not process the information, but will send it to ...
0
votes
1answer
472 views

Metasploit Exim4 String Format Overflow

The string format exploit affecting versions of Exim <= 4.69 cannot be used when Exim is running on port 465, considering authentication is required to relay messages through the mail server, ...
-2
votes
2answers
259 views

Will winlock virus really delete information after 12 hours? [closed]

I've got virus which tells that all data will be deleted after 12 hours. I cleaned autorun and now scaning my computer with anti-virus, but still is this message just to scary people or is this virus ...
2
votes
3answers
1k views

How can winlock virus change Windows Registry without admin permission?

When you try to install program you'll always asked about administrator permission. Same thing when you try to user 'regedit' command. So I'm interested in how does this virus works. How can it edit ...
0
votes
3answers
140 views

Network Concerns Over a MITM Attack

If my website is hosted on a network of hundreds, possibly thousands, of computers wouldn't an attacker have to gain control of just one of them in order to conduct a MITM attack on my website ...
3
votes
4answers
2k views

Can a session be hijacked if the user is redirected from HTTPS to HTTP after login?

I am developing a web app, which makes HTTP calls as long as the user is not logged in. Once the user clicks the login button, he is sent to a "login page" that is HTTPS. The login makes an Ajax call ...
3
votes
2answers
685 views

Can key files be brute-forced like passwords?

Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...

15 30 50 per page