2
votes
0answers
90 views

Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)

I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry). The developer documentation says that JDK 7 is needed, however there are ...
2
votes
0answers
272 views

ssh dns spoofing warning - possible investigation?

Recently the router my ISP provided started to work suspiciously. At times the wireless connection from my devices to the router breaks and the router stops responding while sometimes the connection ...
2
votes
1answer
460 views

RSA BSAFE Crypto-J JCE provider - “Server Hello” returns unassigned Named Curve

I'm using the RSA BSAFE Crypto-J 6.2 JCE provider in Java as SSL/TLS server (in FIPS 140 Compliant Mode for SunJSSE). when I use any elliptic curve based key exchange mechanism the handshake fails ...
2
votes
0answers
50 views

OWASP A9 - Maintain the latest security patch level for third party libraries and software [closed]

In wanting to produce secure code, a common requirement is to not use outdated libraries and frameworks in code bases (for example the OWASP A9 requirement). I understand the reason to do this, but ...
2
votes
0answers
1k views

How to disable injection JavaScript into browsers? [closed]

I am using Kaspersky Antivirus and recently I've updated it to Kaspersky Total Security 16.0.0.614. When I checked my browsers I realized Kaspersky injects remote JavaScript into all my pages even ...
2
votes
0answers
110 views

How to write a PoC of heap-based ROP? [closed]

I want to write a Proof-of-Concept to exploiting any heap-based vulnerability(e.g. heap overflow, use-after-free) where my ROP(return-to-programming, a kind of code-reuse attacks) payload is deployed ...
2
votes
1answer
292 views

Reasons why there are no web based unified email clients (with OAuth2)?

There are plenty of mobile applications that you sign into with different accounts to retrieve email, contacts, and calendar (such as CloudMagic), and a couple desktop clients (such as Inky). Yet I ...
2
votes
0answers
40 views

Let users sign in with eIDs - do I need government authorisation? (scope: all nation-states)

I've decided to launch a crypto-basic income system. Crypto UBIs are pretty popular now. For me, it seems like an open nation-state ID should exist by now (2015). However, Mike Hearn, Bitcoin core-...
2
votes
0answers
83 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
2
votes
0answers
40 views

How to safely decrypt user data in scheduled script

I have a web application with a lot of stored db data, some of which is encrypted. The data is encrypted with a surrogate key, which itself is encrypted with a hash of a user password. Upon request ...
2
votes
0answers
70 views

What is the cost of CALEA in the US? (Lawful intercept) [closed]

The Computer Assistance for Law Enforcement Act (CALEA) is a law in the US that provides for lawful intercept of communications by law enforcement (namely, the FBI). Specifically, as I understand it: ...
2
votes
0answers
62 views

Is stacking encryption a good idea for a file system?

Somewhat related to a previous question, is stacking encryption under and via file systems a good idea? For example, dm-crypt for the device, and then eCryptfs or veracrypt for the file system. If ...
2
votes
0answers
57 views

Can static analysis of JavaScript be done?

Is it possible to statistically analyze JavaScript to find obfuscated JavaScript? Any algorithms or equations with coefficients that can find obfuscated JavaScript?
2
votes
1answer
99 views

Generating shared secret key using existing receivers public key and senders private key

I have the public key of the receiver, and the private key of the sender. I want to generate a new key by using the receivers public key and senders private key (also known as the signing key) to ...
2
votes
0answers
94 views

A fledgling idea: Relational Encryption [closed]

I've been spending my spare time coming up with the basis for an encryption algorithm. I am completely unfamiliar with computer programming, but my time as a Network Technician left me incredibly ...
2
votes
2answers
226 views

How secure is loging into internet banking via an https library?

My bank does not have an API so I want my server to log in and check incoming payments to notify me if a client has paid or not. I would like the server to log in and scrape using Beautifulsoup and ...
2
votes
2answers
526 views

Practical steps for encrypting an encryption key for data stored in MySQL

So I'm working on my first project where user data is stored as encrypted using the user's password as (part of) the key. I have read many similar things about best practices, but the details seems to ...
2
votes
3answers
376 views

How does Facebook really identify requests?

Today I have discovered something very strange. It seems like Facebook is playing some kind of unfair game for identifying one's online identity. So, here is what I have done: I have a regular ...
2
votes
0answers
46 views

Risks associated with switching ISPs/Telco providers

What are the risks associated with switching Internet Service Providers and/or Telco providers (i.e. Telstra -> Optus), if any? This is in relation to a larger organisation with a wide area network.
2
votes
1answer
225 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
2
votes
0answers
75 views

Security implications of CA signed SSL cert for local development

Curious to know the security implications and potential risks involved with getting a CA signed cert for localdev.mydomain.com, and issuing it to all the developers who might need to spin up a local ...
2
votes
0answers
2k views

Just how intrusive IS Cortana? [closed]

According to Microsoft's privacy statement: To enable Cortana to provide personalized experiences and relevant suggestions, Microsoft collects and uses various types of data, such as your device ...
2
votes
0answers
408 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
2
votes
1answer
235 views

Use RSA Encryption With ASP.NET

My goal is to implement asymmetric encryption in an ASP.NET website to secure user-entered Social Security Numbers. I want to encrypt the SSNs with a public key, and only display a masked version, to ...
2
votes
0answers
90 views

Where to search for vulnerabilities in a WordPress theme? [closed]

I have been doing research on a custom WordPress theme. I'm not very familiar with this CMS and how it works on the inside: where should I start my security analysis? Should I look for SQL Injection (...
2
votes
0answers
63 views

Failure analysis to avoid locking permanently online accounts [closed]

(I reposted here a question I previously asked in SuperUser, I think this section is more appropriate) Back in the days defining a path leading to loss of data or loss of online accounts was easy: ...
2
votes
0answers
39 views

How should end users respond to Earthlink's “Allowed Sender” feature when blocked by policy?

Some of our users are requested to click on an Earthlink antispam URL below https://webmail.pas.earthlink.net/wam/addme?a=USERNAME@earthlink.net&id=<SOME GUID> However our firewall ...
2
votes
0answers
51 views

Patterns for asynchronous authentication (after message is sent)

I'm looking at a scheme where users/servers post messages to each other. One of the main challenges is to prove "ownership" of a URL - defined as the ability to receive messages. This can be done ...
2
votes
0answers
59 views

Can high network usage be detected and prevented in Tor? [closed]

I've already asked this question here but as of yet it has no views/answers. I was wondering if there is any way for Tor to detect high network usage in the context of transferring large files using ...
2
votes
0answers
388 views

Using .apk files to reverse_tcp and exploit on android? [closed]

I have been able to install and run the application that I plan on exploiting. Once the app is running I am able to exploit the application. In my testing environment I am able to do this just fine. ...
2
votes
1answer
483 views

Using RSA for Web Application Authentication

I have a network that is only accessible through bastion servers over ssh. In it, I am developing web applications that are exposed to end users via GUI's served up over websockets. All traffic into ...
2
votes
0answers
158 views

Is it possible to exploit an image field in which I can upload any file? [closed]

I'm pentesting this web application developed in ASP.NET. I've found that I can upload any file as profile photo. When I later visit the profile page the site tries to display it like this: <img ...
2
votes
0answers
49 views

Risks when connecting Public WLAN networks [closed]

I want to refer with my question directly to a question posted on the forum before. wifi topic I am running teamviewer on my android which is not rooted and i am not using a firewall on it. I guess ...
2
votes
0answers
149 views

Metasploit pattern not working for buffer overflow for SLMail 5.5 [closed]

I'm trying to do a buffer overflow on SLMail 5.5. I see where EIP is when I send 2606 A's to the program using my script. However, I cannot get the Metasploit pattern creator to work. I want to use ...
2
votes
0answers
35 views

Nation-state digital signatures - how is my public key linked to an identity? [duplicate]

A bitcoiner trying to understand the nation-states. When I use my eID (I'm swedish and I have 'BankID'), and I sign something with my private key that's in the 'eID-file' that I've got on my laptop, ...
2
votes
0answers
114 views

Is there an iframe attack surface to webcache.googleusercontent.com?

I've noticed that one of my web-sites shows up pretty much blank when viewed from Google Cache at webcache.googleusercontent.com, because Google apparently must be inserting the following extra header,...
2
votes
0answers
106 views

OAuth2 Authorization and Resource server certificates

I'm implementing a custom IAuthorizationServerHost using DotNetOpenAuth library. Example implementation uses two certificates for CreateAccessToken (see Listing 6): public AccessTokenResult ...
2
votes
1answer
100 views

How would a nation-state provide an API for its citizens to verify their legal identity online? [closed]

An official nation-state institution, like the Swedish Skatteverk, could easily let their citizens verify themselves online. O-auth tokens could be created by the nation-state institution, generated ...
2
votes
0answers
83 views

Personally identifiable information in query parameter for Tomcat REST service

I have a REST API running in a Tomcat container that has an endpoint that takes a customer email address as a query parameter. It's something like this: /customers?email=foo@bar.com Customer email ...
2
votes
0answers
197 views

Hydra - Possible to follow redirects

I'm trying to use Hydra on an ASP web application. Their login page uses the following method: site/Login: username/password If successful, I am redirect back to site/Login but with a newly set ...
2
votes
0answers
109 views

Ways to prevent traffic injection by ISP [closed]

I live in a big brother country (Egypt, but valid to many other countries), which apparently bought Hacking team and fin fisher software since couple of years. After reading about the very-easy ways ...
2
votes
0answers
194 views

DNS Server Recursive Query Cache Poisoning Weakness “Bounce DoS”

Tenable Nessus states that if there is a DNS Server Recursive Query Cache Poisoning Weakness the host allows recursive queries via UDP, then the host can be used to 'bounce' Denial of Service attacks ...
2
votes
1answer
117 views

How can I detect subnets? [closed]

Given a WAN, which is connected to the internet via a single exit point. Inside this WAN, I don't want to have any subnet structures. Every user gets his own access point, which he can expand via ...
2
votes
0answers
58 views

Where should I store encrypted data so as to have app-exclusive access?

I am using windows Data Protection API (DPAPI) to protect private key used in my application. I cannot hide entropy used in DPAPI call because my application needs to be open source. Where should I ...
2
votes
0answers
146 views

How to do side channel attack on smart cards? [closed]

Assume that I have a smart card and I want to do a differential power side channel attack on its mutual authentication mechanism. This is the mutual authentication mechanism that my card using(Let ...
2
votes
0answers
126 views

Should Mozilla SSL3/RC4 whitelisted sites be blacklisted by admins/users? [closed]

As of Firefox 39, Mozilla has dropped support for SSL3 and RC4... and whitelisted 519 (!) non-compliant sites: (https://mxr.mozilla.org/mozilla-release/source/security/manager/ssl/src/...
2
votes
3answers
141 views

Could a spoken (TTS) SMS-based 2FA be intercepted?

In mid-June, Lastpass made news again, and I've since been mowing around the idea of two-factor authentication. After familiarizing myself with SMS and Google Authenticator, I thought the SMS was a ...
2
votes
0answers
90 views

A simple HMAC question

Suppose I use a key (and IV) to encrypt a piece of binary data with AES-256-CBC to produce the corresponding encrypted data. Suppose I then throw this encrypted data into HMAC-SHA512 using the same ...
2
votes
0answers
186 views

Why use oddly compiled ELF files for Linux malware?

I ran file on some Linux malware ELF files that I've acquired over the last couple of years. I noticed some oddities: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for ...
2
votes
1answer
286 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...

15 30 50 per page