0
votes
4answers
187 views

Help understanding VPN

I've been reading about VPNs lately, and I'm struggling to understand what they do and how they're essential components to upholding anonymity online. The basic idea I have is that a VPN allows two ...
0
votes
1answer
49 views

is return-to-libc attacks possible Now?

I'v read that to make a successful return to lib-c attack, the attacker should store the address of the command (for example "bin/sh") in stack exactly after the return address to 'system' function ...
0
votes
1answer
42 views

Framework behind password reset mechanism

I have always seen those "Forgot password" links from web sites that requires some form of user login. Can I get a deeper understanding of how this works? What tools/framework do I need to use because ...
0
votes
2answers
31 views

The difference of Security Policy and Acceptable Use Policy ?

Acceptable Use Policy (AUP) is a set of constraints and practices that users must agree and sign off to access the corporate network, endpoints, applications, and the Internet. Information Security ...
0
votes
3answers
65 views

Is there any way to check the certificates in a client's root CA store?

When a client connected to a web server, is there any way the check to see what root CAs the client has? Edit: Could I use JavaScript to send a GET or POST request to the server, providing a ...
0
votes
2answers
79 views

Browser Updated, yet still vulnerable to POODLE

So here's a situation, some of my company's partners notified us that they will be entirely disable their server's SSLv3 support. This prompts my superior to take this chance to update our operation ...
0
votes
1answer
56 views

Security at application layer

Originally asked on http://crypto.stackexchange.com/questions/24430/security-at-application-layer but was suggested to ask here instead. I saw lots of questions asking about encryption over http, ...
0
votes
2answers
52 views

“Rebuild” firmware on router

Is it possible to rebuild/make firmware for a router with a backdoor for attackers? I mean If attackers get access to a home router and they're make a new firmware with backdoor in case If I will ...
0
votes
2answers
76 views

Is CAPTCHA necessary when I use token?

I wonder is it a good idea using captcha when using token on login page? I think it's impossible for robots to mess with login page because token changes on every request. Thanks.
0
votes
1answer
139 views

Why my files that Encrypted with EFS in Windows 8.1 shown in Linux ubuntu?

i Encrypted my files with EFS in windows 8.1 so i logged in ubuntu and without any warning , its shown my files actually not Exactly the file but shown the path of file and the name and i can ...
0
votes
1answer
101 views

Begin of Certificate/ End of Certificate dash “-----”

What significance does the dash "-" holds along with the line -----BEGIN CERTIFICATE----- or -----END CERTIFICATE-----. I checked multiple docs and linked RFC's as well but could not find the ...
0
votes
1answer
63 views

WPS and WPA2 connection methods

Do clients use WPS every time when they connect to a WPS-enabled AP? Or maybe they do it just the first time and then they switch to a normal WPA/WPA2 key exchange? If the latter, it's possible for ...
0
votes
1answer
90 views

Is cloud server without HTTPS secure

I am running a Seafile Open Source Cloud server (v 4.0.6) on my Raspberry Pi 2. Currently it is set up to simply run without HTTPS or even a domain name on [myIP]:8000. I am also running an Apache web ...
0
votes
1answer
139 views

What can hacker do, if he knows my SALTED password?

for example, in any website (WORDPRESS or etc..) they store passwords in database, using SALT mehtod (as i know)... for example: $P$dfwegfwegewgIT03.wewefefweg if hacker got this password and ...
0
votes
1answer
138 views

rainbow table for AES 256 CBC knowing IV, cipher text and plain text

I'm in a situation where I know that I have to decrypt a file encrypted using AES 256 CBC and I've the following details: I know the first 16 bytes block in plain text I know the IV (static 128 bit ...
0
votes
1answer
79 views

How to enforce TLS on Windows [duplicate]

In Windows 2008 R2 and 2012, how do you enforce TLS-only and how do you demonstrate that posture? I am in IP Compliance and have a strong background in practical system administration and support. I ...
0
votes
1answer
34 views

uploading photos to cloud from an infected device [closed]

My computer is infected with Malware and (shame on me) of course I didn't back up my photos or word docs. I also happen to know almost NOTHING about computers. Is it possible to upload photos to cloud ...
0
votes
2answers
61 views

How to prevent yourself from exploitable browser?

If we suppose that an attacker has a zero-day vulnerability for a major browser, and can exploit this vulnerability. How can a Linux/Ubuntu user secure themselves from downloading malware (like ...
0
votes
1answer
37 views

Need help to define existing web app vulnerability

I found vulnerability in a web app where I could manipulate URL parameters, i.e. take host/friends.php and then change it to host/friends.php?view=username and as a result see the users friends and ...
0
votes
1answer
26 views

dm-crypt over iSCSI

I recently bought a NAS that supports iSCSI. I'd like to create a new LUN, and then from my computer, create a new dm-crypt/LUKS device on it and back up to it. Is this secure? Could the data or ...
0
votes
1answer
81 views

What are the repercussions of a DDoS attack on a website? [closed]

First of all, I'd like to know what exactly a DDoS attack is- my understanding is that it's a collection of infected or "zombie" computers, all controlled by a central computer, with the intent of ...
0
votes
3answers
86 views

Do all non-CA certs have to be End Entity certs?

Still learning the differences between certs. Can someone explain? The internet has so far been surprising not lucid in describing certificates. *EDIT to clarify EE
0
votes
1answer
63 views

Infection through Virtual machine in NAT mode

I have a VM box configured using NAT to my host OS. It seems I can ping to the machines in my LAN. If my VM box got infected somehow my malware while surfing, would the malware be able to infect ...
0
votes
2answers
149 views

OSX Yosemite and Security/Privacy

I currently have a Macbook Pro running OSX Mavericks, being the skeptic that I am I always wait a bit before upgrading to 'new' OS versions when they are released to see how they fare both stability ...
0
votes
1answer
71 views

Why first kerberos message is not ciphered

When analysing Kerberos exchange (and other similars as Needham, Denning, etc.) I wonder why the first message where the identities of the client and remote are not encrypted. In case not encrypted I ...
0
votes
1answer
70 views

Is there any secure way to transfer data between mobile phones without Internet? [closed]

Assume that I don't have any Internet access in my country. The only thing that I have is a mobile phone with a 3G or 4G SIM card inside. The mobile operator didn't provide any Internet access also. ...
0
votes
2answers
66 views

Decrypting old data from PHP extension

I recently came across an old website of mine that I had used the PageProtectionPlus MediaWiki extension to encrypt parts of. I'm curious to see what I wrote, but the extension is no longer supported ...
0
votes
1answer
66 views

Is there a “how to” about Gmail fraud, updated at least once per week?

My Gmail account has just been cracked and many of my contacts are receiving fake emails, claiming that I'm in troubles and requesting money. Searching for advice, using Google, about what actions ...
0
votes
4answers
118 views

Is it safe to set up IP address to domain name redirection?

We recieved the following e-mail with from one of the UI developers When we browser site with IP: http://x.x.x.x/, it doesn’t redirect to http://www.our_website_name.com. This could cause ...
0
votes
2answers
75 views

Phishing email sent to me within a few hours after a related incident, what should I do?

A few hours ago I was helping a family member pay for something on a government website with one of his credit cards, but for whatever reason it didn't go through, so we used another card and it ...
0
votes
1answer
30 views

How to ensure security between devices from different manufacturers over multicast

I'm involved in the design of a protocol that allows different manufacturers to share data amongst their products. The protocol uses multicast over Ethernet so any device can join. Note that it's very ...
0
votes
1answer
121 views

penetration testing first step [closed]

I've started a course about Penetration testing and CEH on cybrary. The course begins with an introduction that quickly describes each step of pentesting. The first step is essentially to gather ...
0
votes
1answer
71 views

Client authentication [closed]

Assume a server which offers some information which must not be exposed publicly. A client of this which may be e.g. a windows service (or at least something executing headless) needs to access the ...
0
votes
1answer
44 views

Using a custom authentication mechanism with SSH

I have a hardware device that can compute ECDSA signatures and generate ECDSA keys without exporting the private key (only public key is exported). I'm looking for a way to tie this into SSH. Is ...
0
votes
2answers
119 views

Need To Learn About IP Address

I work on a U.S. government crisis/suicide hotline as a rescue coordinator. We receive phone calls, (mostly cell) text, and, chat from all over the world. Most times the caller/chatter will not ...
0
votes
1answer
31 views

When, during authentication, should I ask for an OTP token?

I was working on implementing an OTP strategy in our login process of a web application when I was asking myself: Should I ask for the OTP token before or after asking for the username/password? What ...
0
votes
1answer
267 views

Sign PKCS#7 and verify PKCS#7 signature with OpenSSL

If someone have to transfer X.509 certificates in a single bundle, usually, it is recommended to pack them into PKCS#7. And content of PKCS#7 can be signed. OpenSSL allows to pack certificates into ...
0
votes
1answer
70 views

What are the consequences of not upgrading to the latest version of java?

Suppose I need to convince someone to upgrade to the latest SDK version of Java? I have heard there are many security vulnerabilities with old versions of java but can't find anything that concretely ...
0
votes
2answers
71 views

To which entity merchants must report credit card breach?

In the incident that a Marchand like Target or Home Depot, detects credit cards are breached, who they need to notify? Visa recommends informing the merchant bank, and/or Visa Incident Response ...
0
votes
3answers
84 views

commercial CA for your client certificates?

I seem to have mis-understanding around client auth certs... If you have software that will use Client Auth certificates over SSL (such as those installed on a remote desktop via Windows Certificate ...
0
votes
1answer
311 views

How does LSARPC protocol work?

I'm trying to understand how does the LSARPC protocol work internally. In particular, I would like to know how secured is it. I couldn't find anything in the internet or in different books.
0
votes
2answers
58 views

HTTPS in request and HTTP in response [closed]

If I have an API that calls a backend webservice, is it possible to use HTTPS in the request and just HTTP in the response? I have such a question because I want to protect my OAuth token in my ...
0
votes
1answer
50 views

Extract a key from an AES black-box?

I'm trying to figure out how a given executable works. I know it's using AES-128 to encrypt and decrypt, but the specifics of the code are unknown. I can get the executable to encrypt and decrypt any ...
0
votes
2answers
350 views

Why would someone use my email address in his Gmail registration?

I got an email from Google no-reply@accounts.google.com saying the following about the gmail address of an acquaintance that is supposedly connected to a non-gmail account I use: > The password ...
0
votes
1answer
70 views

Have i been phished? [closed]

I recently opened a link from a "friend", while I was on my workplace. It was some really simple stupid game "Super Mario" type. I opened it, played for 10 seconds and closed the link. What felt ...
0
votes
1answer
54 views

Bogus HostName Causing Suspicion of Man In The Middle

I have servers on a LAN reporting my laptop with a bogus hostname. This is making me suspect a man in the middle attack. Here are some details: From an Ubuntu Linux 14.04 laptop, I logged into an ...
0
votes
1answer
63 views

Is biometric security viable in the long term?

Obviously biometric security is a hot-button topic. I happen to attend a university with a well known biometrics department. (Which I'm not a part of.) My problem is, biometrics has a large caveat: ...
0
votes
1answer
112 views

Why openssl shows www.google.com sha1WithRSAEncryption?

According to Chromium Blog, Google Chrome 39 with SHA-1 certificate will show a yellow icon, but my Google Chrome shows: Google Chrome (39.0.2171.99 (64-bit) on Ubuntu 12.04) I've confirmed it's ...
0
votes
2answers
150 views

What's the difference between HMAC-SHA256(key, data) and SHA256(key + data)

Is there anything different about how secure these two hashing algorithms are? Does HMAC "fuse" the data and the key in a special way that's more security-aware?
0
votes
1answer
75 views

What's the best, most unique (and uneditable) hardware id or key for each computer? [closed]

I'm a C# programmer and I'm looking for the best way to "know" what hardware is running my software. What is the best uneditable and unique "hardware id" in each computer?

15 30 50 per page