2
votes
1answer
53 views

what is worth a digital signature based on email address only? [closed]

I have noticed that most digital signature providers do not try to certify anything but an e-mail address, while it is quite easy to create an email address without disclosing any personal information....
2
votes
0answers
54 views

Determining time it would take to exhaust IVs on 802.11b/g/n

I'm trying to learn about WEP attacks at the moment. I know that attacks against WEP require collisions of the initialization vectors. Is there a way to determine how long it would take for the ...
2
votes
0answers
211 views

Securely storing users PIN on Android with fingerprint authentication

I am have an Android app where the user can enter a pin specific to a particular phone to save them entering the full password. I'm now looking at the new fingerprint reader API on Android M where I ...
2
votes
1answer
169 views

Is use of HttpServletRequest.getQueryString() for a response header vulnerable to response splitting?

I've been told that using HttpServletRequest.getQueryString() in a response header makes my application susceptible to HTTP response splitting attacks, but I just don't see how. It's clear in the ...
2
votes
0answers
120 views

Hardening a Chromebook

I have a Chromebook I routinely use for things like e-banking and other things where a security breach would be catastrophic. I've read it is a very secure OS by nature due to its small surface area ...
2
votes
1answer
105 views

Any issue with allowing CORS on an oauth2 endpoint

I am tempted to let my OpenID Connect/Oauth2 OP to accept CORS request on an oauth2 endpoint after checking that client id and its allowed origin match. This way a RP would be able to get a response ...
2
votes
0answers
52 views

Windows IIS Event/Security Log ID of Private Key deletion of corresponding TLS certificate?

I'm in the middle of writing an MS Active Directory Certificate Services Key Management Lifecycle document for my organization. The primary purpose certificates will serve for this organization is to ...
2
votes
0answers
59 views

cracking krb5 passwords (des3-hmac-sha1 and des-cbc-crc )

I'm trying to audit kerberos passwords. The available formats are des3-hmac-sha1 and des-cbc-crc but I cannot find a possibility/a tool to crack them. For other hash-types I used John the Ripper, but ...
2
votes
1answer
57 views

Is it necessary to have security documentations, policies, DRP & BCP's at place in order to execute secure network architectural review?

One of my client has ISO 27001 audits at their disposal and they have been going through audits. Meanwhile, they are taking custom security services from our company where-in one of the deliverables ...
2
votes
1answer
78 views

CISSP Cert: can an IT sales pro pursue CISSP? [closed]

I am a sales and product professional who has a total of 9 years experience in IT; related to selling products indirectly or directly. I started my career working as a product manager for hardware ...
2
votes
0answers
200 views

How do i find the number of relationships between user and permission in DAC and RBAC

This is a part of a homework. I don't want an answer, just a hint. Assume a system with N job positions. For job position i, the number of individual users in that position Ui, and the number of ...
2
votes
1answer
56 views

Server side Client VPN management?

Is this possible, and how? Here's the scenario: Public Web Server hosts basic content for general public. Private server inside a VPN hosts special subscriber content and services. The two servers ...
2
votes
0answers
84 views

Google.com serving *.portal.azure.com SSL certificate?

Just ran across this in my own browser (Chrome, Mac OS) where going to google.com would serve a *.portal.azure.com certificate. It seemed to be signed all the way to the root too. This disappeared ...
2
votes
0answers
29 views

What are the security implications when dealing with cloud on boarding services like Migrationwiz or Skykick?

There is a large push these days to move Email and communication to the cloud. Such as Google Apps, Office 365 or Hosted Exchange. Many company's hire partners to assist with these moves. Most ...
2
votes
1answer
99 views

Handling Authentication without a unique username or password

Working on a project and I have to authenticate a user that does not have a username ( '' ) or a password ( '' ). There are users and guest_users, but a guest_user won't have to explicitly log-in, ...
2
votes
2answers
28 views

DNS IP address auto reset

I have a unofficial Windows and i noticed that my internet connection gets reset. By taking a closer look at it, i found that the DNS server address is set to an IP in China. Any reason why this ...
2
votes
0answers
81 views

Is Microsoft trying to brush the Diagnostics Tracking Service under the rug?

I was working my way through disabling all of the spyware Microsoft has put into Windows 7 when I came across this Google result: "Sep 11, 2015 - Describes an update that enables the Diagnostics ...
2
votes
3answers
124 views

Linux File Security when connected to internet [closed]

Let me first admit that I am a nobody in computer security - I just know the various threats generally known to public. I have a Linux Cent OS 7 installed on my computer which is connected to the ...
2
votes
1answer
250 views

Properly generating RSA+AES keys

For learning purposes, I'm creating a chat application where the connections are done via SSL/TLS, and the messages are encrypted using AES-CBC-256 and the AES keys are encrypted with RSA-2048. The ...
2
votes
1answer
184 views

How to scan large .bin files for malware?

I know about websites like VirusTotal, and programs like herdprotect. I'm using Avira and Superantispyware, but once the large bin files are scanned, usually nothing is found. But after running an ...
2
votes
0answers
113 views

Installing a cocoapod and 'github' asks for login credentials?

I just added a cocoapod and got this >ls Podfile superApp Podfile.lock superApp.xcodeproj Pods superApp.xcworkspace >pod install Updating local specs ...
2
votes
0answers
44 views

Cloned site with tricky HTTP_HOST

Another site has cloned mine. The site in question is netdna-cdn.com, and if you do a search on Google ("site:netdna-cdn.com") you will see it has cloned 100's if not 1000's of sites. So in times ...
2
votes
0answers
42 views

How does Adobe Pass Auto-Authentication work?

At time marker 2:05 of this video, he describes that Adobe Pass can automatically identify you based on your broadband provider, and sign you in/authorize you for media content. Can anyone describe ...
2
votes
0answers
403 views

Any worthy open source Java Source Code Analysis tool from finding Security Vulnerabilities perspective? [closed]

I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links ...
2
votes
0answers
151 views

nmap OS scan showing DD-WRT when I'm not running it?

This weekend, I set up pfSense on a spare box that I had sitting in the garage. It seems cool and powerful, but I haven't messed with it much yet. Was doing some basic nmap scanning from work against ...
2
votes
0answers
119 views

Security token in android and embedded system

I have an embedded board with a very limited processing and memory resource. I would like to control the board using an android app. The users are categorized into 3 groups: owner of the board. ...
2
votes
0answers
39 views

Is it a good idea to use password safes such as KeePass? [duplicate]

I'm starting to use KeePass as a password manager but I was wondering if such password safes are a good way to store passwords. Could a malware dump my RAM when the safe is open and retrieve all the ...
2
votes
1answer
2k views

msfvenom payload problem

This is for educational purposes only! I'm trying to generate android payload using msfconsole payload standalone generator: msfvenom with the command msfvenom -p android/shell/reverse_tcp LHOST=192....
2
votes
1answer
118 views

signature and padding

I use JcaContentSignerBuilder to sign a self-signed certificate but I don't know what the default padding is. My requirement is that I must NOT use PKCS#1.5 padding. The code I use is below - can ...
2
votes
0answers
42 views

Priming an IDS/IPS for an impending attack

Is there a system which can put an IDS/IPS in "high alert" mode if there information about a suspected impending attack in the near future (obtained from an external system)? I would like to know if ...
2
votes
0answers
53 views

What is the security value of chattr +s?

Most modern Linux file systems support extended attributes. +s is secure deletion which ensures (at least intends) that the data in a file is overwritten with zeros when the file is deleted. Some ...
2
votes
0answers
24 views

Why has the “Origin” HTTP header not been universally adopted? [duplicate]

After running tests on a few browsers on browserscope.org, I noted that neither Firefox or IE have adopted the "Origin" HTTP header. This header is a useful and valid way of helping prevent CSRF ...
2
votes
0answers
102 views

Client authentication using the pfx not working

I have a requirement to generate the client certificates(pfx) files from another server certificate which are provided by a CA. Firstly I tested the following based on http://www.jayway.com/2014/09/...
2
votes
0answers
91 views

Why did Google sign every auxiliary app inside “Google Chrome.app” (OS X version) except for one?

$ codesign -dvv /Applications/Google\ Chrome.app/Contents/Versions\ /46.0.2490.80/Google\ Chrome\ Framework.framework/Resources/app_mode_loader.app/ /Applications/Google Chrome.app/Contents/Versions\ ...
2
votes
0answers
52 views

Wayland Partial Encryption for Mouse / Keyboard? (Also X and RDP)

Question What are the best practices for implementing Partial Encryption, to encrypt just the input devices (mouse/keyboard, etc), not the actual video display, during remote desktop sessions using X,...
2
votes
1answer
51 views

What does “8.11 Encrypt or sign files into an archive” do?

I am going through the GnuPG manual and I want to encrypt a folder which, if my laptop was taken by anyone else, noone would be able to get access to for any of my information. This man page gives me ...
2
votes
0answers
60 views

Do inter-bank transactions guarantee that the amount of money is preserved? How?

I recently transfered money between two of my bank accounts in the same bank, using the e-banking interface, and, once I approved the transfer the website announced having "successfully transfered 0$"....
2
votes
2answers
128 views

DoS Reflection attack using CharGen protocol

I'm researching DoS Reflection attacks w/ amplification, and Wikipedia says that one of the "worst" amplification services is the Character Generator Protocol. Frankly, I have never heard of this ...
2
votes
2answers
153 views

number of ciphertext-plaintext pairs needed in double encryption

So I know in single encryption you would simply require at least 1 pair of plaintext-ciphertext, to carry out an exhaustive key search; you continue trying different keys until one is found that ...
2
votes
1answer
73 views

Yovo screenshot blocker vulnerability [closed]

I was studying Yovo's screenshot blocker and I noticed that when watching their demo, I was easily able to pause the video when the screenshot blocker was taking effect and get a fairly clear view of ...
2
votes
0answers
32 views

Is it a bad idea to provide a “testing” OAuth ID and secret?

I'm working on a web app, and I may eventually want to bring others onto the project. I have two sets of GitHub credentials: one called Foo that calls back to foo.com/endpoint, and one called Foo -- ...
2
votes
0answers
51 views

Getting an image from an IP camera [closed]

I'm looking at this camera in order to take static pictures. This site showed me that it its probably possible, but the documentation for the camera doesn't seem to mention this ability. I'm planning ...
2
votes
0answers
76 views

Password cracking based on properties of target

Many people base their passwords on some characteristics or properties of their persona, which might not even be included in wordlists used for a dictionary attack. If one would put research into ...
2
votes
1answer
179 views

Use salt as identifier for crypted session id in database based authentication system for webapp

I have written a database-based authentication framework for webapps I am planning to program in the future. The framework is implemented by using the plpgsql-language of a PostgreSQL-Database and ...
2
votes
0answers
51 views

What are the most common ways to Architect the verification process of the access tokens between resource and authentication server using OAUTH 2.0?

What are the most common ways to Architect the verification process of the access tokens between resource server and authentication server using OAUTH 2.0? I am trying to build a web application ...
2
votes
0answers
77 views

Open source firmware as mitigation against firmware persistent malware?

I am concerned about the threat of persistent malware entrenched in device firmware. I am not familiar with the intricacies of firmware security, so I am turning to SE for help. I recently learned of ...
2
votes
0answers
75 views

Google/Apple account for corporate issued mobile phones

We are working on implementing MDM (Airwatch) for all corporate mobile devices (no BYOD will be allowed). But I have a question as what is the best way to avoid users use their personal Gmail or ...
2
votes
0answers
70 views

How bad is it to configure a public webhook service to use the server’s farm private dns server?

For those who ignore it, webhooks is a service that you configure with a web interface for sending post http requests to a configured url. Those services are sometimes offered by public sites like ...
2
votes
1answer
31 views

Opening window from secure site domainA.com, to partner site domainB.com - with short TTL encrypted query string

I am looking into a proposal and need to find reasons as to why we might not perform the suggested solution. Here is the problem: www.domain-a.com is a secure website dealing with customer ...
2
votes
1answer
96 views

Problem with Snort rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"Get2 method"; flow: to_server, established; dsize: >20; sid:1000006; priority: 15) Snort does not generate any alert, whereas when I write the ...

15 30 50 per page