2
votes
5answers
361 views

Can we predict the technology used from the URL?

As a person who is learning pentesting, I want to know if it is possible to predict the underlying technology used for the developement of the site from the URL? For example: This is the URL of the ...
3
votes
2answers
675 views

Digital signature with partial recovery

I'm having problems understanding what is meant by "digital signature with partial recovery". I found from Google that digital signature with recovery should mean that the message is recoverable from ...
0
votes
1answer
4k views

Is this possible to use fake AP to get wpa keys? [duplicate]

Possible Duplicate: Is it possible to speed up WPA/WPA2-PSK cracking using a rogue AP? Is it possible to get the WPA preshared key with a fake AP with the same SSID ?
1
vote
1answer
1k views

How do these Windows services affect the security of Windows Firewall?

Its common to disable unneeded services in Windows 2008 R2, but sometimes I come across installations that use Windows Firewall and related services. More info: see service dependencies for Windows ...
2
votes
1answer
924 views

Encrypting configuration on shared IIS7 hosting that uses load balancing

When hosting a site on a cluster (or cloud configuration) we need to specify a Machine Key in the web.config file. This is needed to keep the machines in sync (often the first encounter with this is ...
3
votes
2answers
330 views

Securing a script to prevent database from being exposed

We have an Ioncube encoded script running on an Apache web server which stores customer confidential information in a MySQL database. We have configured the script to run under its own account using ...
1
vote
1answer
682 views

What encryption is possible for ReadyBoost?

ReadyBoost is a technology to assist getting Windows Vista or 7 to load faster on memory-constrained PC's. Since a USB stick can be easily removed, what security options are available for this ...
1
vote
1answer
3k views

Is it safe to use namebench?

As the title states is Google's namebench utility safe to run on my Mac and let it use Safari's web history?
23
votes
5answers
2k views

Should passwords be revealed in error message?

I am having pet-peeve with PHP's PDO class. As you can see on the Warning note: it reveals database password by default if an exception was not caught (when display errors is on which is a probable ...
6
votes
3answers
3k views

Advantages of separating Web server from Database

What are the security advantages of installing the database of a web application on a server other than the one containing the web server?
4
votes
2answers
392 views

Would our company system be more secure using a VPN?

I'm currently building a back-office system for our company [for internal use] that will manage our customers, accounts etc (not interested in don't reinvent the wheel comments today, thank you!). I'm ...
2
votes
0answers
703 views

Global Networks - Are there any other than the Internet? [closed]

Here is the definition of Global Networks: Currently does any Global Network exists (apart from Internet)? Can someone Quote some examples? Doesn't every other WAN network comes under the category ...
5
votes
1answer
264 views

Understanding a vulnerability

http://code.google.com/p/chromium/issues/detail?id=68439 I am having a little bit of trouble understanding this report. From what i have read, it appears as though removing certain dom nodes ...
2
votes
3answers
296 views

Verify if person belongs to the claimed university through his university email id

I need to allow users access to an application after verifying that they belong to the claimed institute through university email id. So that if a person claims that he belongs to Stanford University, ...
3
votes
2answers
812 views

failed login attempts analysis

Is there any open source project that logs all the failed login attempts over a period of time and gives me analysis of the same, the login failure is at windows or unix or mac user authentication ...
3
votes
2answers
181 views

Email & Domain ownership?

Most hosting companies, such as mine (hostgator) give the following notice when providing a contact email: Email address that you can be contacted at. This should be an email address that is not ...
5
votes
3answers
392 views

Is my sons' school portal in violation of any Password/UserID rules?

My sons' school sends both ID and PW for a portal through USPS at various times during the year, (e.g. class registration) whether I need it or not. If I change the password, it sends a confirmation ...
13
votes
7answers
876 views

Online Government Elections System - Is it possible?

I am from Bulgaria and currently some groups here are promoting the idea of referendum among the people, about the possibility for establishing a system for ONLINE GOVERNMENT ELECTIONS. The idea is ...
0
votes
3answers
720 views

Can people use AES VPN tunnels to hide their activities from authorities?

I have read an article about programmers who use AES VPN tunnels when working remotely with clients from other countries. The article writes that this way their countries are unable to track their ...
2
votes
1answer
794 views

Preventing License protection circumvention in Java software

A software (written in Java) by a vendor uses DSA signature to verify that the license information is correct. It achieves this by embedding the public key in the same Java software. Legit license ...
-2
votes
2answers
911 views

Is zeus trojan really harmless?

I am confused by this page http://www.wiki-security.com/wiki/Parasite/ZeusTrojan/ I was searching info on google as I read warning article about the fact it was very sophisticated bot that steals ...
8
votes
3answers
1k views

Getting started with SmartCards; what equipment do I need, what do I need to know?

I have an unused SmartCard slot on my laptop and I want to learn how companies take advantage of it. Are all SmartCard slots capable of reading and writing a blank card? Are there compatibility ...
4
votes
1answer
342 views

Has the wedge security flaw been fixed for credit cards?

According to this site http://www.lightbluetouchpaper.org/2009/08/25/defending-against-wedge-attacks/ there is a flaw in EMV. Since then has this flaw been fixed? Is it the same law as the one ...
2
votes
2answers
401 views

Trust and signing: full public key or thumbprint?

Imagine a B2B service where two parties need to set up a two-way trust relationship: Alice will only accept requests from Bob, and Bob wants to know his requests are only going to Alice. When ...
4
votes
2answers
2k views

Hashing Algorithms on GPU, 32 bit vs 64 bit

I read here in What algorithms are best be cracked by GPU? that, hashing algorithms such as SHA1, SHA224, SHA256 which do 32 bit integer arithmetic and logical operations are better implemented on GPU ...
0
votes
1answer
603 views

1and1 Dedicated Server got compromised (Windows Server 2003)

We had couple of dedicated servers rented on 1and1 hosting. In past we had situation where our server has got compromised and intruders were able to hack into the Windows 2003 standard edition and ...
5
votes
5answers
2k views

SYN Flooding issue

I recently purchased a server with "DDoS protection" and a 1gbps uplink. What I can't figure out, is that I'm suffering from SYN floods. Isn't the large amount of bandwidth available to me supposed ...
1
vote
1answer
2k views

Backtrack 5 R2 & Metasploitable

I have configured the OpenVAS server as per wiki instructions: http://www.backtrack-linux.org/wiki/index.php/OpenVas And i ran the following commands: msfconsole load openvas openvas_connect admin ...
7
votes
10answers
615 views

networking and security

I'm trying to pick up networking security within a reasonable amount of time. I'm not specifically looking to learn about all the little tools that are available (although I do want to know about ...
-4
votes
2answers
160 views

how to protect a personal computer? [closed]

I am Linux user with no knowledge on security , up to now i dont know that is my system was in attack or not . I havent felt anything wrong with my system . but every Computer user must have some ...
6
votes
3answers
1k views

Securing a multi-tenant architecture

I'm a computer science student looking to expand an already developed web application into using multi-tenant architecture. Considering I'm far from being a security expert, which precautions can I ...
1
vote
2answers
350 views

What is the best book on threat modeling that you've read? [closed]

I have been involved with developing threat models for several software products and features, and I'd like to formalize this process a little bit and create some documentation for my company's devs. ...
1
vote
1answer
236 views

SNMP trap by legitimate program?

Is there any way to tell if this SNMP trap is something created by a legitimate program? Update: Hex Dump 0000000: 30 82 00 ec 02 01 00 04 06 70 75 62 6c 69 63 a4 82 00 dd 06 82 00 09 2b 06 ...
8
votes
2answers
13k views

How to mitigate SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability?

Disclaimer: I'm not a sysadmin, please try to give your answers in developer friendly language ;) I'm test scanning a fresh VPS image with Nessus and I'm getting plugin 58751. I tried figuring out ...
3
votes
2answers
1k views

Keeping Whois domain registration details private

Most domain registers offer a service to keep your details private in the Whois database. Usually this works by replacing your email, telephone and snailmail addresses with proxies or P.O. Box ...
3
votes
2answers
1k views

How to run a Tor exit node securely on a vps

I want to run a TOR exit node on a vps, what security measures do I have to put in place on the vps? I know it will be a huge target for hackers and the three letter word agencies in the USA so I need ...
2
votes
1answer
805 views

Example of attack trees in the web application security analysis

Here I am again asking for some informations about attack trees usage in web application analysis. For my master thesis I decided to study the usage of this formalism in order to reppresent attacks ...
4
votes
6answers
1k views

Information Security Career tracks - Academically vs. IT certifications

I will try to be as straightforward as possible here. I am currently working as a security integrator at an integration company. I work with products of vendors like Check Point, Cisco, Juniper, HP, ...
2
votes
3answers
363 views

Why do credit cards not use digital certificates?

Asymmetric encryption and digital certificates are used all over in the IT world to verify authenticity and prevent forgeries. And it works great. Why do credit cards not use some form of ...
1
vote
2answers
224 views

Which MTA don't have antivirus check for outbound emails?

I need to test whether MTA has antivirus check for inbound emails. To check this I need to send email with e.g. EICAR testfile from another MTA to this one. However, Gmail, Yahoo and other well-known ...
1
vote
2answers
870 views

Is spam more likely to be sent to info@example.com? Would I be better off using a different address?

I think that when bots gather domain names or process a list of domain names, they create email addresses like info@example.com or support@example.com. Does selecting something different help to ...
7
votes
2answers
2k views

Could somebody explain how DNS poisoning might occur in this scenario?

I read the following statement in a security blog using the same source port over and over again for dns queries instead of randomizing them is a vulnerability for dns poisoning Could somebody ...
0
votes
1answer
595 views

Securing firewalls for XAMPP on Mac OS X

I've recently installed XAMPP on my Mac OS X 10.6.8, and this has caused me to reevaluate how I have my firewall setup. Right now I am using the two firewalls that came pre-installed on my computer: ...
2
votes
3answers
2k views

Do I have a virus on my hosted site?

A few weeks ago I hired an outsourcer from India to build for me a very simple PHP site. I bought PHP hosting and a domain name, and I gave him all the credentials together with the specification of ...
2
votes
1answer
6k views

How to use http-get-form in THC-Hydra?

I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App" brute force section but the problem is when I use http-get-form it said: Warning: child 1 seems to have died, ...
1
vote
0answers
345 views

making a start in finding exploits [closed]

I am a thorough newbie in computer security but the Google chrome exploit reward has gotten me interested in computer security and I would like to know what is an ideal starting point for one ...
2
votes
4answers
159 views

lock for asp.net developer using vs 2010 and win xp?

I am hiring few extra trainees who will use their personal laptop at my office to work on .net projects. I want to restrict the code/file access in their laptops with password. Like when they get in ...
2
votes
3answers
344 views

How should one manage authentication on custom line of business software

I am writing line of business software for a company, and we want to authenticate users, so we can manage workflow and do some auditing. Basically my employers don't want me to piggyback off of ...
3
votes
2answers
578 views

I have my website in wordpress and it got hacked how to secure it? [duplicate]

Possible Duplicate: Protecting WordPress installations i have control panel access to my wordpress website, but last week it got hacked and i found that the index.php was replced by the ...
1
vote
2answers
119 views

Is Google a feasible tool for an organization to check if their name is being used in phishing sites?

Is it feasible for an organization to use Google and the available Google search operators (e.g. allinurl, etc) to find out if their organization name is being spoofed or used in phishing sites and ...

15 30 50 per page