1
vote
1answer
138 views

Slow Loris Incomplete GET Request

A slow loris attack is an attack of incomplete GET requests to most famously an Apache server because the server does not timeout the connection made after extremely long periods of time, from my ...
1
vote
1answer
137 views

Mitigating DDOS in P2P systems

In P2P systems where performance and response times are critical individual clients are susceptible to DDOS by publicly exposing their IPs. While there are various mitigation solutions available at ...
1
vote
0answers
116 views

Identify the attestation certificate (X.509) in Fido U2F registration response

I'm trying to identify the attestation certificate (X.509) in Fido U2F registration response as described in fido-u2f-raw-message-formats-v1.0-rd-20141008.pdf document: An attestation certificate ...
1
vote
1answer
107 views

How much of your web browsing behavior is VISIBLE to the administrators when you're behind HTTPS or VPN? [closed]

For example. If you're behind a VPN and want to get on on facebook and youtube. Will all outgoing traffic need to make a request to the firewall first? I don't really know extensively how well a ...
1
vote
0answers
58 views

Is there any merit to the RFC 3414 (SNMPv3 User Security Model) password-to-key method?

RFC 3414 (published 2002) specifies a method of generating keys based on password in its Appendix, which essentially takes any "passphrase", and keeps on repeating it until there is a 1MB string, at ...
1
vote
0answers
127 views

PKCS#7 signed data structure in signed PDF document

Is it mandatory to include PKCS#7 data (OID 1.2.840.113549.1.7.1) octet string into the sequence of PKCS#7 signed data? I mean if you want to sign PDF, you are basically adding PKCS#7 container ...
1
vote
1answer
104 views

Difference between Architecture review and a Design review

As the question says, I would like to know the difference(s) between an Architecture review and a Design review. If someone could explain the two using an example, such as an Architecture review of a ...
1
vote
0answers
27 views

How to Verify the Integrity of the BlackBerry Momentics IDE Download for Linux

I am currently setting up development environments for BB10 apps on Linux workstations. BlackBerry provides their Momentics IDE for free from (https://developer.blackberry.com/native/downloads/). The ...
1
vote
0answers
80 views

Hiding symmetric key inside encrypted data

My server generates an AES encrypted file which when downloaded acts as an input for an application. So, should I hardcode the symmetric key inside the application or should I randomly generate the ...
1
vote
0answers
43 views

Use cases for IPC security windows communication

There are two processes on windows machine. One is in user space and second is a service. User space process sends data to service. Because iam starting to think about securing somehow communication ...
1
vote
0answers
142 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
0answers
54 views

Are Secure Desktop and separate process enough for hiding sensitive information in RAM?

In my program, I have an encrypted database on the file system with a password. It is decrypted in RAM, and the sensitive data get spread out too much in RAM for mistake to be auditable easily enough. ...
1
vote
1answer
157 views

VeraCrypt secure in public?

I have made a Veracrypt Containment that uses AES to encrypt everything inside. But my question is: can I securely put the containment file in public (everybody can access it) without anybody able to ...
1
vote
0answers
55 views

OpenPGP (RFC4880) - do you agree with my SimpleS2K (string-to-key) implementation?

Background: I'm writing a GPL Python OpenPGP to JSON parser which I'm testing on files generated with GPG 1.4.16. If given a passphrase, the parser will generate keys using the string-to-key methods ...
1
vote
0answers
173 views

PowerShell / Windows - Security best practices for enabling Windows Remote Management

As the title indicates, I'm looking for industry best practices for enabling Windows Remote Management on a mix of Windows Servers (from 2000, 2003, 2008/R2 and 2012) to allow PowerShell to execute ...
1
vote
0answers
43 views

How do nested vpns through VM work?

Let's say I have 2 different VPN services (vpn1 and vpn2) both using OpenVPN and a Linux host running a guest VM. Now let's suppose I connect from the Linux host to vpn1. Then I connect from the ...
1
vote
0answers
43 views

Policy Privacy Italian / EU and anonymous blog [closed]

I would like to write a personal blog without making my real identity public. It's not a "war blog" or similar, I would like to write about several personal problems and give (if possible) some ...
1
vote
0answers
71 views

How to import key BLOB generated from Microsoft CryptExportKey from Linux

I have a private/public key pair saved as key BLOBs which were in fact exported with the Microsoft "CryptExportKey" API. Now I need to use the same key pair (specially the public key) under Linux ...
1
vote
1answer
137 views

Security of access to local network via VNC over SSH tunnel

I've just set up a Raspberry Pi 2 with the latest raspbian and installed some services. For remote access I've installed tightvnc server which I set up to only allow connections from localhost. I can ...
1
vote
0answers
21 views

Resources and Examples for Modeling Application Security Groups

I am searching for some resources and documentation on modeling security groups for a web application, but seem to be coming up rather dry. I am interested in creating a visio-like diagram that ...
1
vote
0answers
33 views

Website Link in Signature corrupted while transmission [closed]

We placed our website link in our email signature for last one week. This link apparently converted into something corrupt, so all our mails gets bounced. We scan our web server files using ClamAV ...
1
vote
1answer
82 views

Use appstore using trusted certificate [closed]

I connected my iPad to my laptop's localproxy. I also installed a trusted digital certificate in my iPad. I am now able to use all HTTPS networks through my iPad except appstore. If I disable proxy, I ...
1
vote
0answers
24 views

Security issues IIS 7.5 with PHP 5.3 [duplicate]

We are facing alot of weird php files all over our WordPress websites on our IIS 7.5 server. The file look like XSS script and maybe that php code that the hacker use to send spam emails or something ...
1
vote
0answers
89 views

ROP attack on x64, zero bytes trouble

I have found ROP tutorial on x86. Now i try to exploit simple buffer overflow case on x64: int main(int argc, char **argv) { char buf[10]; strcpy(buf, argv[1]); ... } I figured out, ...
1
vote
1answer
56 views

GPG: Detaching Public Subkeys - why can't I do it?

I understand the benefits of using subkeys. I also know that, in the case of private keys it is possible to detach the subkeys from the master key, since there are times when a user may prefer not to ...
1
vote
0answers
37 views

How to prevent location information from any dialing call [closed]

Assume you receive many unknown calls from unknown numbers regularly. You would like to prevent the callers to receive any pieces of information from you. How can you do this? Your number is ...
1
vote
0answers
41 views

Possible exploit while MPLS parsing with Bottom of Stack bit

My current task to parse MPLS label in a packet and store them in to a list. When I check packets with MPLS: One can understand it is the last MPLS header by checking Bottom of Stack bit. If ...
1
vote
0answers
26 views

Are there “standard” formats for storing GCM output?

The openssl enc -aes-256-gcm command is broken, because it can't decrypt its own output, otherwise I would look to that as a format. In order to decrypt a file, code needs to be able to separate the ...
1
vote
0answers
143 views

Migrate a x509 key using KSP (CNG) to CSP (CryptoAPI) in Windows

I have a code signing certificate issued to me by a commercial CA, and the key was generated on my local development machine using the new Cryptography Next Generation storage providers. ...
1
vote
0answers
192 views

How secure is Jitsi VoIP/IM Android app? [closed]

I was looking for a FOSS end-to-end encrypted alternatives to Skype and came over Jitsi. It looks all nice and seems to work really well (at least clients on Linux and Android). Even cross-messaging ...
1
vote
1answer
123 views

What's the value of data partition encryption for database files on a postgres database server?

We're in the process of rolling out a postgres based web app, and I'm trying to understand the value of encrypting the entire database. In postgres's case, the only way to do this is store the ...
1
vote
1answer
71 views

Which stream ciphers are supported in am335x cryptographic accelerator?

I want to use cryptographic accelerator in aes cfb mode [or any other stream cipher]. According to http://e2e.ti.com/support/arm/sitara_arm/f/791/p/156983/658334 link cfb is supported in am335x. I ...
1
vote
0answers
54 views

Can a victim of identity theft safely open a bank account? [closed]

A friend of mine had his identity stolen (at least including social security number and birthday), and apparently someone used the info to remove money from his current bank account with Citizens ...
1
vote
0answers
86 views

How can I launch DHCP starvation attack in WLAN?

In WLAN, due to MAC association on Access Point (AP), I can't send the DHCPDISCOVER messages using random MAC addresses. But if I keep my original MAC address as the source ethernet MAC a and random ...
1
vote
0answers
35 views

unable to execute shellcode,which is place on stack [duplicate]

I am trying to execute the shellcode to spawn an "sh" shell. I have taken shellcode as command line arguement,copied it to stack and tried to overwrite the return address of main function with the ...
1
vote
0answers
73 views

Request for links to worm source code [closed]

From where can you download worm source code? Need it for a project i am doing on honeypots. It does not matter whether it is a windows or linux worm.
1
vote
0answers
41 views

EIP getting changed in fgetc() Buffer Overflow Homework

Here is the gist of the code: main(){ char s1[64], s2[64]; int a = 0, b = 0; FILE *fp1, fp2*; char temp; scanf("%s", s1); scanf("%s", s2); ... //some checks happen, fp1 is opened to ...
1
vote
0answers
68 views

How secure is L2TP+IPSEC?

I understand PPTP is widely used still, but insecure. A convenient alternative is: L2TP+IPSEC. How secure is it? What steps in the server setup can I take to maintain a high degree of compatibility ...
1
vote
1answer
50 views

What bits of data is revoked in a CRL? Is it the hash(CSR) or hash(CSR + PKI signature)

My understanding is that a CSR contains the public key from the client, and the response is a signed version of that CSR, with certain attributes (EKU, expiration) and other attributes the CA decides ...
1
vote
0answers
180 views

VPN Server + Anonymity + Adblock for mobile Devices

In order to improve private security and anonymity while browsing the web on my mobile devices I wanted to tunnel all traffic to my own server via VPN and use a proxy software to filter unwanted ...
1
vote
1answer
137 views

Is End to End encryption possible for all servers across the whole infrastructure?

Running into a possible situation where a client I am working with is requesting that all data that leaves the servers should be encrypted and here, we are talking of hundreds of Linux servers ...
1
vote
0answers
137 views

Virtual Pentesting Lab on popular Enterprise level UTM and SIEM

I’m planning to add a new Penetration Testing Segment to my personal “Pen Lab”. It’ll be centered around Vulnerability Assessments /Penetration Testing on market leading Next-Gen Enterprise ...
1
vote
0answers
115 views

Android app downgrading TLS protocol to SSL 3.0

I performed vulnerability testing of some Android mobile applications I helped develop and I noticed some odd behavior. The applications used the default Android 5.0.2 cipher suite list that includes ...
1
vote
0answers
83 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. ...
1
vote
1answer
57 views

Advantage of group signing over single signing

As I know, signing is used to ensure integrity and authenticity of sender. What is the advantage of group digital signing over individual signing? Can anyone explain this using a scenario?
1
vote
0answers
89 views

Why would home routers accept incoming DNS traffic?

I stumbled upon an interesting paper (PDF Link) where researchers found out that more than 58% of the DNS open resolvers that are blamed in DDoS attacks are in fact home routers distributed by ISPs to ...
1
vote
0answers
158 views

Client Authentication with DH cert example using openssl command line

I want to perform client authentication with DH certificate from client side using openssl command line tool. when i am running server and client as below client is not taking certificate provided ...
1
vote
0answers
87 views

Is LTV in a pdf required if it has a trusted timestamp and the Verification Authority is guaranteed to remain active? [closed]

I have successfully managed to add valid "qualified digital signatures" using a USB token to the PDFs generated by our web application through TCPDF. I am now wondering if I should try to add a ...
1
vote
0answers
59 views

what security features a good Email Service Provider (for marketing) should have?

To choose the right Email Service Provider (ESP) for e-mail marketing processes, what are security requirements and checklists that we should pay attention to and ask for from vendors? In other ...
1
vote
2answers
445 views

Is SpiderOak truly “zero-knowledge”?

I've recently changed SpiderOak password on computer A. Because I have SpiderOak installed on computer B as well, I thought I will have to update the password on it so the application can connect to ...

15 30 50 per page