4
votes
1answer
210 views

firewall with cloud based malware analysis risks

Palo Alto, and probably others firewalls will offer it, has a feature to do malware analysis in a separate (cloud-based) process that does not impact stream processing. What I would like which risks ...
9
votes
2answers
574 views

PCI Audit: Using “test” cards

I know that the PCI standard does not allow you to use real credit card numbers on test systems. Visa, Mastercard and Amex supply a list of "test" cards to use. Makes perfect sense, and we have been ...
5
votes
2answers
776 views

Zero padding in HMAC

Section 2 of RFC 2104 defines the key used in HMAC should be padded with zero bytes up to the block length of the underlying hash algorithm. Isn't this a potential security vulnerability since any key ...
3
votes
4answers
550 views

Base64 conversion for byte array in encryption

I am using ECC algorithm for security. Now the concern is I am placing the data in web page after encryption of the data in hex format and transmit to server and then it decrypts the data, but when I ...
3
votes
1answer
472 views

Best security algorith for storing passwords [duplicate]

Possible Duplicate: Which password hashing method should I use? I want the best cryptography algorithm for storing passwords in database, which one should I use and how can I implement ...
7
votes
2answers
727 views

Enforce Code/Script Signing

I have both a couple of X.509 Code Signing certificates and a GPG keypair that I can use to sign against code I run on my VPS. Every now and again I write code for iOS, OS X and Windows and always ...
7
votes
2answers
228 views

Business-to-Business Security Disclosure and Agreement

Looking for a template covering the disclosure information security practices that are standard in Business-to-Business partnerships that share data. For example: Access management Password ...
2
votes
1answer
2k views

How should I configure a Citrix Netscaler to protect against HTTP, TCP, or UDP flood attacks?

I have a Citrix Netscaler and want to configure the appliance appropriately so that it can protect my hosts from a DDOS. Is this something I can do here, or must I take action on the host itself?
5
votes
2answers
2k views

openssl_digest vs hash vs hash_hmac? Difference between SALT & HMAC?

openssl_digest vs hash vs hash_hmac I want to use SHA512 for storing password. Which of the above methods are best to use? Why? What is the difference between SALT & HMAC? I just read ...
8
votes
1answer
421 views

Protecting emails in your database

It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database. Not just from hacking, but from disgruntled employees or engineers ...
8
votes
5answers
526 views

Utility company does not hash passwords in the database

I had to use my utility company's online account information application and forgot the password. Going through the steps of resetting the password I was emailed the password in the open. I found this ...
3
votes
1answer
3k views

What algorithm/encryption type does Gmail use for security?

In the wake of the recent database hacks, i.e. Sony, Gawker, etc.. where the hackers have access to the hashed usernames and passwords, i've been more keen in paying attention to the sites and ...
3
votes
2answers
3k views

HMAC key value and security

What effect would there be if you used the same value you were hashing as the Key in an HMAC? For instance given the following example: message: "my secret message" nonce: ...
23
votes
5answers
2k views

Do spaces in a passphrase really add any more security/entropy?

I often see passphrase suggestions written as a sentence, with spaces. In that format are they more susceptible to a dictionary attack because each word is on it's own as opposed to a large unbroken ...
4
votes
1answer
6k views

Fail2Ban does not ban failed root login attempt

I have a small server which only open ports are ssh, http and https. I have fail2ban installed and set up so that after 3 failed attempts someone gets blocked for 10 minutes (thats the dafault I ...
3
votes
1answer
295 views

Is there a way to use multiple firewalls / antivirus for penetration testing?

I don't really know how to do either, but I was wondering if it was possible to have multiple firewalls / virus scanners installed at once, and use a 3rd party program to specify which one is running ...
1
vote
1answer
584 views

types of intrusions on host [closed]

I am implementing an IDS and just want to know that what are the possibilities with which the intrusion can occur.I am just doing a literature survey over the atacks possible so I want to know that ...
4
votes
1answer
208 views

Can I safely post the output of lspci, lsusb, lshw?

I'm having trouble with my SD card, and have been asked to inspect the output of tail -f /var/log/syslog, sudo lspci -v -nn, sudo lsusb, and sudo lshw. tail shows nothing when I insert the card, so ...
2
votes
1answer
309 views

Will htmlspecialchars (php) be enough for making secure PDF files with user entered data?

My app creates an PDF file and uses an user entered info. How can I avoid all attacks with PDF vector? Will htmlspecialchars be enough? I don't want to enable JavaScript in PDF.
13
votes
1answer
695 views

SCADA / PLC exploit code was released in metasploit. Now what?

Wired reports that there are many security issues with Programmable Logic Controllers (PLCs) and now there is an easy to use tool to scan and detect vulnerabilities. They say it's so easy, the ...
2
votes
1answer
234 views

Is 90 day expiration for unique URL too long?

A web application I've been developing has a new use case that has me searching for something easier than username/password authentication. Current users don't sign up for the service themselves ...
2
votes
1answer
153 views

Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? [closed]

As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
6
votes
3answers
353 views

What is the most secure way to lock a Linux Distros Desktop?

So it's an everyday thing... people don't want to turn off their computer while their going out to the toilet..., etc. So they hit "ALT+CTRL+L", and the GNOME-screensaver locks their Desktop. After ...
1
vote
1answer
2k views

Are there any reviews or user experiences with Secretsync?

I haven't been able to find much in the way of professional reviews for Secretsync - http://getsecretsync.com/ss/ But i'm wondering how it compares to Boxcryptor and Truecrypt. How secure is ...
1
vote
2answers
10k views

Bypassing XSS filters [duplicate]

Possible Duplicate: New XSS cheatsheet? Can anyone give me list of ways to encode XSS payload , or to be precise what are the ways to encode XSS payload to bypass encoding of <> or (). I ...
2
votes
2answers
468 views

Restrict user login to a specific machine

How do you restrict user access to a corporate web site to a particular machine ? including the following conditions : Each user is meant to use his credentials ONLY from the assigned machine. The ...
5
votes
1answer
4k views

Is this jQuery ajax call vulnerable to XSS?

If somebody can edit $("#field").val(), can they change the url property here to point to another location? $.ajax({ url: "http://mywebsite/script?param=" + $("#field").val(), dataType: "jsonp", ...
2
votes
1answer
501 views

How secure are native iPhone - PUSH Services

The native app is sending the UDID to Provider Service for recieving PUSH Notification thru APNS. How is it possible to prevent tampered request(modified UDID) getting processed at Provider Service? ...
28
votes
5answers
5k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
3
votes
1answer
870 views

What are the practical differences between SELinux targeted mode and a capability based OS?

I recently asked a question about the differences between capabilities and mandatory access controls. Among the answers I got the point was made that systems like SE Linux in targeted mode are not a ...
1
vote
1answer
1k views

How to best authenticate a desktop client with a scaleable backend via SOAP / REST service?

I'm trying to find a solid architecture for authenticating users against a database. I have a game client, which I plan to serve up a request with. The transport doesn't really matter, but at this ...
2
votes
2answers
411 views

HTTP + HTTPS + One Time Pad/stream cipher

I'm designing a web application where users will exchange short messages with the server very frequently (for instance, a few characters every second). I want the whole communication to be ...
5
votes
3answers
383 views

What to consider in an SLA to ensure secure software when outsourcing software development?

To ensure secure development in the off shore team what are considerations to be taken into account in the SLA? I got this as a reference: ...
13
votes
3answers
2k views

VPS security best practice

I've just signed up for a linux VPS to host a website I've been creating and I need some advice on the best approach to secure it. I've previously been hosting it off a VM in the house, but I want to ...
2
votes
2answers
360 views

What does “if the Crypto Officer performs this operation” mean in this BitLocker security policy?

In the document Windows Server 2008 R2 BitLocker™ Drive Encryption Security Policy For FIPS 140-2 Validation, in the section 6.1.2 FIPS 140-2 Security Rules bullet point 2 it says: BitLocker™ will ...
7
votes
7answers
2k views

Verify the password of an encrypted file without waiting for complete decryption

I am currently working on an application that encrypts files with AES 256. The problem is that I want the user to see whether the password is wrong before the file is decrypted. For example if you ...
3
votes
4answers
1k views

SQL query sanitation (black list)

I have a following problem/challenge: Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports. These reports can be ...
13
votes
9answers
22k views

Tracking down a rogue access point

Over the course of about a month we have received multiple reports of a rogue access point attempting to intercept traffic. I suspect an attacker is using a wifi pineapple, or similar hardware ...
4
votes
4answers
650 views

Top Mobile Device Security Concerns? [closed]

What does everyone see as the top security concerns for mobile devices at the present time? I am working on a paper on the topic, but it seemed worth asking here to see if I might have missed ...
4
votes
2answers
2k views

Security Engineers - What Do They Do?

I'm starting my MS in Computer Science (I hold a BS currently) soon and I'm considering specializing in cyber security. I'll be taking courses such as cryptography, biometrics, network security, ...
8
votes
4answers
7k views

Regulations that specify password length?

I have read: PCI DSS 1.2 SOX 404 AR 25-2 ISO 27001 But only PCI DSS specifies a minimum password length. Are there any other regulations that dictate password lengths for any industry? NIST ...
2
votes
3answers
496 views

Security issues with email accounts

I am starting to become wary of giving out my email account to anyone, just by doing reconnaissance it is evident how easy it is to pull so much information from a person just by a email, There is a ...
7
votes
3answers
1k views

Who (which process) is calling curl?

On my mac (Lion), I know that curl is bing used by some unknown process to communicate with a server. Basically I installed little Snitch and find out that "somebody" is using curl periodically. ...
6
votes
2answers
1k views

Is BitLocker on a virtual machine still FIPS 140-2 compliant?

BitLocker can be used as a cryptographic module to fulfill FIPS 140-2 security level 1 compliance. In a common setup, USB thumb drives can be used to unlock drives encrypted by BitLocker on startup. ...
3
votes
1answer
297 views

Running Untrusted Software on Local Network

So I need to run a bit of software on my local network that I just have the .exe for. The caveat is: The software needs access to the internet to produce a bunch of files. I need to access those ...
3
votes
5answers
358 views

Exchanging private keys

I would like to understand something about security. Say two parties have a private piece of data (e.g. a password or license key) and the receiver needs to know that the sender has the same key and ...
9
votes
2answers
2k views

How does Google not care about “spaces” in Application-specific passwords?

I have recently setup "2-step verification" for my Google account. One of the features is the ability to create "Application-specific passwords " for devices that do not support the 2 step process. ...
7
votes
2answers
330 views

Is it a security risk to remind users of the password requirements at login?

I regularly find myself trying to login to websites where I don't remember the password I use. I make some guesses as to what I might have used but usually wind up having to reset it. One thing that ...
5
votes
4answers
1k views

Security concerns from publicly visible Hudson & Jenkins servers?

A friend's start-up has implemented a number of business critical services on a Hudson/Jenkins server run on a Tomcat container. This is not an open-source project, in fact many aspects of this ...
5
votes
2answers
161 views

What kind of cache-related attacks exists on the Web?

What kind of cache-related attacks exists in modern Web world? The only one I'm aware of is Cache Poisoning. Is there anything else I should be worrying about?

15 30 50 per page