1
vote
1answer
44 views

Certificate authority has changed for personal website - but I haven't changed anything?

I have the Certificate Patrol addon (website) installed in Firefox. While I mostly ignore the (far too many) warnings, today I saw that the certificate authority for my personal website has changed. ...
1
vote
1answer
86 views

What this type of attack called? (gaining peripheral information)

When the intruder looks at the transmitted data and finds information about the sender and the receiver of the data or other peripheral information that won't help him hack the system but know more ...
1
vote
2answers
461 views

How effective is antivirus software? [duplicate]

On one hand, most antivirus websites claim their products are highly effective, and I've seen antivirus "test" videos claiming 95%+ detection rates for new malware (as in less than a day old, not old ...
1
vote
2answers
147 views

Server compromised with magento vulnerability, possible rootkit

I am experiencing a security issue with one server that it happens that I manage. I will try to cite all relevant facts as briefly as possible. I am asking for any additional information and course of ...
1
vote
1answer
61 views

How to check randomness of a hash?

I have a REST api in which the server allots a unique token each time a user is logged in. Its a hash containing numbers,letters and a one or two special chars. I want to check the entropy of these ...
1
vote
3answers
123 views

How to identify hashes [closed]

How can I indentify a hash? Not with length only, I mean: as I know, specific hashes has specific charsets. Where can I find them? I need this information for making a hash indentification tool. (this ...
1
vote
2answers
75 views

Importance of Lastpass User Vaults Statement and Two-Factor Authentication

The Lastpass breach statement reassures folks who had two-factor authentication enabled and recommends it for all users. I also note that they explain that there is no evidence that the encrypted user ...
1
vote
2answers
49 views

IIS - RequestFiltering for #

I came across this link today that does run XSS on the site it was originally intended for: ...
1
vote
2answers
92 views

Why aren't there large-scale attacks on BIOS and UEFI

I was reading the new and I came across this article . I have not spent lots of time reading the paper the article referred to but I pretty much agree with the fact that people rarely update their ...
1
vote
3answers
86 views

How can hackers access WordPress usernames? [duplicate]

Recently I've had brute force attack attempts on some of my WordPress sites and the attackers are using actual usernames other than the default admin (which was removed). How is it possible for them ...
1
vote
1answer
134 views

How to extend x509 certificate validity

I have two x509certificate, and now they are expired. What I would do is to extend the validity date of these certificates (I don't want t creat new one). Can I do this with openssl or other tools ?
1
vote
2answers
248 views

How to look for steganography in a picture [closed]

I need to scan this picture for steganography as the meta-data suggest there is some concealment. I'm new to this process and don't know which free tool is the most comprehensive. EDIT: 1. as I ...
1
vote
2answers
154 views

Is there a online filter to check email attachments?

I've just received an email from an old employer. There is very little information in the message sent just: See attached file for your review. Kind regards, Mick with an attachment. I ...
1
vote
1answer
181 views

Can my identity be revealed through WiFi access?

Assuming I am using a WiFi connection on my Android phone, can somebody also on the network know the particular sites I visit? I believe they will get to know my MAC ID, but will they get to know ...
1
vote
1answer
70 views

Virtual Machine Integrity Hash Check

If I used virtualbox to create a snapshot template of a preconfigured linux machine and wanted to ensure that no one has tampered with my snapshot, could I simply keep a comparable hash of the VDI ...
1
vote
1answer
587 views

How ECDHE is signed by RSA in ECDHE_RSA cipher

About ciphers that use ECDHE as Key Exchange and RSA as Authentication: How exactly this two algorithms work together, is ECDHE process encrypted by RSA public key? What are the DH parameters? ...
1
vote
1answer
88 views

Someone updated my friend's twitter profile after an internet forum abuse [closed]

I'm doing a security investigation for a friend of mine, working a bit of a Sherlock Holmes here... Trying to figure out a possible hack scenario for the following: My friend receives a "screw you ...
1
vote
1answer
183 views

Password management: how an administrator should reset password for a user?

I implement simple user management. How an administrator should reset password for a user? Just provide a new password for a user (as in Active Directory)? Is it secure enough? Added Is it secure ...
1
vote
1answer
137 views

Is it worth it to implement both SHA2 and SHA3 at the same time?

I'm creating a password storage system for a web server I'm building for fun. Would it be more secure for me to use both SHA2 and SHA3 for hashing, and then store them in a database? If I use both ...
1
vote
1answer
182 views

Is there a backdoor in the hardware of our smartphones?

I don't know for you but I always felt like Android especially is not safe. Is somebody - the government or other - able to listen to my microphone, or access my hard drive remotely ? I'm wondering ...
1
vote
1answer
69 views

Prevent padding oracle attack on key exchange process

I found in my searches that the padding oracle attack can be used against the RSA with PKCS1PAdding or OAEP padding, and I used this algorithm for a symmetric key exchange. How can I prevent a padding ...
1
vote
2answers
79 views

Why Wordpress doesn't filter post_title?

Today, when I did some tests and found out that Wordpress doesn't filter the post_title. Respectively, I make posts with the titles: <?php while ( have_posts() ) : the_post(); echo 'Post Title'; ...
1
vote
3answers
2k views

How to hack into a remote mysql database?

(Moved from Stack Overflow as other users said it was a security question) I have a mysql database sitting on a remote server. Nothing else, ie no web site using it, no server side scripts etc, ...
1
vote
3answers
112 views

Which kind of Wifi is safe to use ?

I travel a lot, so I most of the time get Wifi from Hotel or Cafes. I payed attention to the fact that some Wifi does not have security password ! Here is a screenshot of the type of security I found ...
1
vote
1answer
160 views

Where to start with api security testing? [closed]

I have the backend api of an iOS application. I would like learn api testing on this. How to begin with api security testing?Please suggest some tutorials and tools available online.
1
vote
1answer
54 views

Using a minimal set of certificate authoraties

It been known for quite a while now that SSL is more of a security-illusion than a real one. As it's not completely useless, and there's no real alternative at moment (though convergence looks ...
1
vote
2answers
115 views

So I need to unzip and process user submitted zip files - how to do so securely?

I am writing a system that accepts zipfiles from end users. The title says it all - what precautions should I take to ensure my processing server does not get compromised when I need to unzip a ...
1
vote
3answers
298 views

What type of hashing method is used for the private key to encrypt for signing messages?

To use RSA for signing, Alice takes a hash of the message, encrypts the hash using her own private key, and appends the result (this is the signature) to the message. Eve can of course still ...
1
vote
3answers
335 views

SMTP Header Injection

I'm trying to understand SMTP header injection. I'm using Python's SMTPLIB library to proto-type this vulnerability. Here is my code: import smtplib # create variables server = 'smtp.zoho.com' port ...
1
vote
2answers
95 views

Assigning random IPv6 ranges to ISPs as a security measure

Pinging all the IPv4 address space takes about 5 hours (and can generate beautiful maps). Port-scanning doesn't take much longer and can reveal vulnerable services, such as remote administration of ...
1
vote
1answer
326 views

Does AES 256 encryption support a master key and generated (time-bombed) keys?

I have a scenario where semi-sensitive [1] data for a corporate web application is to be stored in the browser's localized storage (Indexed DB to be specific, via JavaScript). The intention is to ...
1
vote
3answers
155 views

Sensitive issue regarding windows 8 password [closed]

Although I know this sort of request probably isn't exactly what stackoverflow is for, I am desperately seeking help. One of my best friends recently passed away and his parents asked me if I knew a ...
1
vote
1answer
89 views

PKCS7 vs TLS 1.2 padding

Can anyone explain why there is a difference between padding claimed in PKCS7 https://tools.ietf.org/html/rfc2315 Page 22 - which is 01 02 02 03 03 03 ... and padding used in TLS 1.2 ...
1
vote
1answer
45 views

In What Ways Can X-Foward-For Header Information Be Used In An Attack

By enabling X-Foward-For on our proxy, we would essentially be advertising our internal IP addresses externally. However, we use a private range. Everything goes through NAT. So, the best anyone would ...
1
vote
2answers
217 views

How can I detect unencrypted self-executing code in JPEG images?

Assuming that I have an infected image containing a self-executing malicious code that targets my image viewer and executes when I open the file. Supposing also that my computer is completely clean ...
1
vote
3answers
259 views

Is browsing http sites insecure?

So for example this site, security.stackexchange.com, when I look in my browser it doesn't say that it uses https and it does say that my connection is not encrypted. The same goes for, say, ...
1
vote
3answers
496 views

Sharing a common public and private SSH keys for a cluster of machines

I guess this is way to settle an internal debate I am having with myself. In my provisioning process, I am wanting to share a common public and private ssh keys for each machine in a clusters, ...
1
vote
1answer
244 views

Minimize risk with Windows 2003 end of life

The company I’m at currently has over 500 Windows 2003 servers remaining globally in production and even though they have a refresh plan they are working through, they are not going to be done anytime ...
1
vote
1answer
54 views

Is it possible to convert a gpg key to a different encryption algorithm [duplicate]

Maybe the answer to this question is a simple and unequivocal "No", followed by "How can you possibly think that this is possible?". And if I think about it rationally this seems to be the only ...
1
vote
2answers
165 views

Is Ignoring SslPolicyErrors while doing SSL Pinning Secure?

I am implementing SSL pinning as a security requirement for a project and the HTTPS endpoint is giving me SslPolicyErrors. The following errors occur, RemoteCertificateChainErrors ...
1
vote
3answers
110 views

Is it possible that to sign a message with a PGP key in a way that leakes the key

Alice provides a software for signing messages. The software runs in a airgapped enviroment. The software is given the message that's to be signed and the private key. The software then produces a ...
1
vote
2answers
73 views

Disclosure and HTTP status codes

Disclaimer: yes, I have checked the Which HTTP status codes are interesting from a security point of view? which sounds relevant but not entirely. These days it's supposed to be a good practice to ...
1
vote
2answers
82 views

Are there any anti-virus programs that have a bot that clicks email links? [closed]

Just started a new job, and it looks like we have some bots that are clicking every link in some % of e-mails. The problem is, I can verify that at least a few of these people are real. The only ...
1
vote
2answers
101 views

Is the private key the only entropy in a X509 certificate?

Specifically, if I preserve the private key can I reproduce the exact same (self-signed) certificate at any time? The use case I have is a server-to-server protocol that allows (even encourages) ...
1
vote
4answers
251 views

What options exist for authenticated full-disk encryption?

Title says it all really. I'm toying with the idea of storing some disk images in "the cloud", but am concerned about the possibility of an attacker manipulating cipertext to do evil things once it's ...
1
vote
2answers
209 views

Which unicode (control) characters should a web app (not) accept?

THIS IS NOT ABOUT XSS Threat: Mallory enters control characters in a public web application text field that other users might use in a terminal program (via copy+paste or by running a script). ...
1
vote
2answers
222 views

Anonymity of prepaid SIM card in phone linked to real identity

I want to use a prepaid SIM card (text and calls only) anonymously. I bought the SIM card offline without providing any address or name. I am now thinking about using a dumbphone I bought from Amazon ...
1
vote
1answer
312 views

Can Snort be configured as HIDS?

I need to give a presentation regarding Snort and Security Auditing. I have recently learned to configure Snort as a NIDS. I want to know is there any way I can configure Snort as an HIDS? If I am ...
1
vote
2answers
78 views

Password strength in Wordpress Network

Very similar to this question at Wordpress Development, but intentionally asked here. A password, that contains: at least one capital letter, at least one small letter, at least one number and at ...
1
vote
1answer
109 views

How to use SSL approach at the application level

The SSL approach of using public/private key (asymmetric) mechanisms to establish a symmetric working key for data encryption seems like it would be a good approach for end-to-end secure data ...

15 30 50 per page