0
votes
1answer
63 views

Two factor authentication for web application under PCI DSS

PCI DSS 8.2 is stated as follows 8.2 In addition to assigning a unique ID, ensure proper user-authentication management for non-consumer users and administrators on all system components by ...
0
votes
1answer
61 views

Perfect Forward secrecy in TLS session

I am looking at packet captures of perfect forward secrecy for cipher "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256". Per definition of PFS, after initial client and server hellos exchanged, both sides ...
0
votes
2answers
72 views

How to block spammers from using my public email api

I am working on a web application which allows users to share stuff on a web-page by clicking on an 'email to friend' link; similar to what extole is doing here ...
0
votes
1answer
43 views

Segregating network systems and functions [closed]

I want to segregate network systems and functions so that if an attacker hacks in one area, he can't necessarily reach others. What should be the recommendation when information from one network is a ...
0
votes
1answer
50 views

WEP man in the middle

my workplace is currently using a wireless router that is secured using WEP. If I connect a laptop to the wireless router with a cable, would someone that has cracked the password still be able to ...
0
votes
4answers
44 views

Will my existing VoIP phone work if I install TOR?

I currently don't use TOR and I have VoIP - a physical phone using a provider's VoIP service over my Internet connection. If I install TOR, will I still be able to make and receive phone calls with my ...
0
votes
1answer
24 views

How to make sure that only files I generated pass?

I have the following situation: I have an app on a User device, and my main server. The app can send the main server pdf-files and jpg-files. Now my problems are: -> What is the best way for the ...
0
votes
3answers
65 views

How to integrate AAA and otp

We have AAA services enabled in our organization (about 1000 clients). We want also to add otp (one time password) service. What are the main security concerns about integrating them. Is there any ...
0
votes
1answer
87 views

Can I get rid of storing user secrets by using OpenID, and what do I need to store?

What information do you have to keep about a user to be an OpenID consumer? I want to use OpenID to let users register and authenticate on my system. So while I'm at it I want to not duplicate ...
0
votes
1answer
239 views

Can I determine actual orgin of spoofed text message?

Can I determine the actual sender of a spoofed text message? I received a text message yesterday that appeared to come from one of my contacts, but he did not send it. I contacted my carrier (Verizon) ...
0
votes
1answer
36 views

Can we share a folder across regions for PCI Users

We need to be PCI compliant for a small setup. We need to share a folder which should be accessible by other regions as well. We have Private MPLS Connection. PCI users will be having only READ ...
0
votes
2answers
136 views

Is it safe to store encrypted volumes on cloud syncing services?

A recent discussion on another website prompted a proclamation that storing (TrueCrypt, LUKS, DMG, etc) on cloud sync services like Dropbox is unsafe, since a version history is kept of each file, and ...
0
votes
1answer
66 views

Why do private networks use both X.509 and User/Password authentication

For example, the school network I am on requires both a name & password to log in along with having its X.509 certificate installed in my browser. Why does it need both? Shouldn't name and ...
0
votes
2answers
36 views

Using bcrypt in chrome extension [closed]

I am developing a chrome extension for this non profit. Im also working on the server side component as well. Im not a full time developer so most of my knowledge has simply come from years of ...
0
votes
1answer
58 views

Looking for a way to encrypt/decrypt data using a generated key that works in Windows and Linux

I am looking for a way to encrypt/decrypt data on windows and linux platforms. The data gets encrypted in windows and the same data needs to be decrypted on linux/windows and vice versa. I understand ...
0
votes
1answer
44 views

PKCS11 PIN security

Hardware security modules are tamper-resistant and PKCS11 PIN is required to use keys. if a software application wants to perform some cryptographic functions, it should know the PIN. but the ...
0
votes
1answer
42 views

Working of Burp [closed]

I want to know How does burp decides whether the attack has been successful or not. When I send a request through burp the server give http response code as 500, what does this mean Session lost ...
0
votes
1answer
106 views

Revoke and regeneration in FIDO U2F / FIDO UAF

One of the benefits of using Software based Strong Authentication apps (e.g. RSA SecurID Software Tokens) is that if the device that is running the Token generation app is compromised or lost, the ID ...
0
votes
1answer
27 views

Does a constantly dynamic cluster of short-lived instances reduce attack surface?

The 4am Idea The general idea is that every instance that gets launched on my cluster is preloaded with a 'suicide script' that after a preset Time To Live (say, 27 minutes) launches a replacement ...
0
votes
1answer
88 views

Compromised submarine cables and the consequences to internet?

I recently read an article that Google wants to build a submarine cable connecting to my country supposedly to increase overall speed and while I hope my government will never allow this kind of thing ...
0
votes
1answer
29 views

What to choose ipsec or tlsv1 for rdp

I found a link but it didn't answered on my questions. (http://www.k2esec.com/secure-communications/network-security-protocols-ipsec-vs-tlsssl-vs-ssh-part-ii). I want to create secure connection for ...
0
votes
1answer
58 views

How to change font so simillar characters can be distinguished in Keepass 2? [closed]

I've had problems at work and at home where password managers display similar letters virtually identically. For example it's impossible to distinguish between an 1, l and I. Is there a recommended ...
0
votes
3answers
86 views

Theoretical game server DDoS prevention question

I may not understand how DDoS attacks work at this point, but Im just wondering if this would work for a game server? IF each time a new connection is attempted and the packet or connection type is ...
0
votes
1answer
21 views

Any Point To Paper Submission Of Forms Versus Electronic Submission

I know we're not going to like this question because it has some obvious answers, but I am looking for a thorough breakdown, and I could not find another mention of this topic on this site. Paper ...
0
votes
2answers
158 views

Scan all possible files on server (Brute force Filenames)

I'm not sure if I'm right here, but I just wanted to know if there is a tool that scans all possible filename combinations on a server and tells you what filenames the server responded to. So it would ...
0
votes
2answers
61 views

Web/App vulnerability responsibility [closed]

While auditing a few web apps and websites I uncovered a few serious vulnerabilities which I've since flagged (responsibly, of course). One of the things I noticed was that several development ...
0
votes
1answer
88 views

Is it possible to brute force a card reader lock?

Recently they've added a new lock to my building which looks like this: Now we were given the code to access the building, but not the cards/tags. I swiped my tag used for a different lock and it ...
0
votes
1answer
68 views

using temporary tokens for secure communication with IFRAME

I have questions about our application's security architecture: A critical piece that cannot save state but collects and displays sensitive information is served up in an IFRAME inside a more modern ...
0
votes
1answer
70 views

VPN - Unique client certificates? [duplicate]

Currently installing the OpenVPN service on my Linux box and stumbled across this in a guide: All of our clients will also need certificates to be able to authenticate. These keys and ...
0
votes
1answer
65 views

understanding tracert to determine MITM attack?

I made a test to understand tracert against same ISP (TE DATA) from two different location. I got the following result: To google Network A Tracing route to google.com [213.158.189.20] over a ...
0
votes
1answer
22 views

apache rewriterule htaccess security

If I configure an .htaccess like this : RewriteEngine On RewriteRule ^([^/]*)$ /view.php?key=$1 [L] Which transforms original URL http://www.test.com/view.php?key=123 rewritten URL ...
0
votes
1answer
89 views

How to use multiple charsets in hashcat

I wanted to use a brute force attack on hashcat but WPA/WPA2 networks are 8-64 characters long and they have multiple possibilities of a password. I was wondering if there was a way to use multiple ...
0
votes
1answer
62 views

Kippo graph Human Activity. What is it?

So I was running a Kippo honeypot. In Kippo graph there is a diagram tilted "Human activity" (see attached photo). What does it mean? Does it mean that, for example, on 21-11-2014 90 real attackers ...
0
votes
1answer
68 views

How do shared IP addresses work and do they give privacy?

I assume "shared IP addresses" work by NAT, because obviously two devices with the same IP address need someway to distinguish them. I've seen some privacy advocates boast they have "shared IP ...
0
votes
1answer
13 views

Web of Trust: What is “signatory trust”?

I am learning about the Web of Trust and how to use it. However, I have some issues to fully grasp the concept of Signatory Trust. What is an easily understandable definition of signatory trust? An ...
0
votes
1answer
38 views

sniff mobile application to find whether packages sent to the third person [closed]

I suspect that my messages via Viber are being sent to another person - because to my mobile have access a lot of people and it could be possible that somebody installed there some software or ...
0
votes
1answer
87 views

Will Let's Encrypt require SNI from the operators?

I'm curious if anyone knows whether the upcoming Let's Encrypt initiative would effectively require SNI. What I mean is, with the proliferation of the cloud, almost every web-site owner, even with ...
0
votes
3answers
93 views

Attack vector: Internet Service Provider [closed]

I'm suspicious. I wanted to forward a port (80) on my router and noticed that port forwarding didn't work properly, it didn't work at all. So I replaced the router and again, port forwarding was not ...
0
votes
1answer
39 views

When using LUKS, which parts of the hard disk are not encrypted?

Due to stories like the following: https://hackerone.com/news/pink-panther (forced at airport customs to decrypt laptop) being more and more frequent, I thought of the following. What if you simply ...
0
votes
1answer
33 views

Workflow for changes to source code

How do you make sure that in your environment, you have proper controls of your source code. For example, before deployment of any application, there must be approval from the boss and other parties. ...
0
votes
2answers
1k views

SSL handshake exception: unable to find valid certification path to requested target

We are using a third party payment service for our web users to be able to pay for courses. Once payment is completed however, payu attempts to connect to our site and run an IPN. However, they get ...
0
votes
1answer
36 views

Is it possible to hide behind a hostname to purposefully effect SEO?

Reference forum questions and a couple answers posted on 10 December 2014 What are these unknown visits to my private, unlisted webpage? One of the answers contained this phrase: "Given the fact ...
0
votes
1answer
218 views

Firewall Benchmark, Checklist, Guideline?

I'm doing some research on checklist, benchmark, hardening guidelines. And I couldn't find specific documents for security checklist for firewall. CIS had this document, but it was only for Cisco ...
0
votes
1answer
79 views

Does Windows Embedded OS supports Microsoft Bitlocker?

Does Windows Embedded OS supports Microsoft Bitlocker? If yes what are the list of versions and does the windows embedded OS comes with bitlocker?
0
votes
1answer
61 views

Choosing encoder for payloads in metasploit

I noticed that every payload (for example bind_tcp) in metasploit comes with defaut encoder.( shikata_ga_nai for bind_tcp). Is there a way in metasploit to manualy choose encoding for payloads or way ...
0
votes
1answer
54 views

How to secure sensitive data in application with message queue

Currently we are creating one small service, where we are using some sensitive data from users(not worth zillions but to me it is like password). The idea is that application itself only inserts this ...
0
votes
2answers
74 views

Type of SSL connection used when visiting google services

I have 2 computers running chrome: a) Win 8 , latest chrome b) Win 7 , latest chrome ~ 1.5 yr old high spec laptop Both display the Certificate Authority as: Google Internet Authority G2 computer ...
0
votes
2answers
116 views

Can Amazon's AWS Identity and Access Management (IAM) be used to manage server access?

Requirement 8.1.1 of PCI DSS states: Assign all users a unique ID before allowing them to access system components or cardholder data. Using Amazon IAM I can set up individual accounts for users ...
0
votes
1answer
34 views

Viewing PCI data via 3rd party sites securely

I'm working on a project that requires PCI protected data (card PIN numbers) to be made visible to customers, via a Third Party (a non PCI compliant) company site. The hierarchy is as follows: Us ...
0
votes
3answers
123 views

My site was hacked and the attacker got data from the config file [closed]

A few days ago my website was hacked. I found out that the 'hacker' ran queries directly into the database, so he somehow got access to my database credentials. I'm using laravel 4 and the config ...

15 30 50 per page