0
votes
2answers
51 views

What is the likelihood of a government organization having a copy of the major .COM private keys? [closed]

This is a bit of a vague question, but it seems relevant these days with the information on all those "mass spying" programs getting leaked. I will describe the scenario and I just want to know if it ...
0
votes
2answers
277 views

Is there a “classic” information security textbook? [closed]

Much in the same way compilers has the dragon book, algorithms has the Cormen, and graphics has Foley & van Dam I am wondering what the book on computer security is. Not the "best" book, or the ...
0
votes
3answers
251 views

Can my GSM network operator figure out the name of the Wi-Fi access point I am connected to?

I recently saw a film where the police were able to locate where the criminal was because the GSM network operator knew the name of the Wi-Fi access point the phone of the criminal was connected to ...
0
votes
1answer
419 views

My cookies have been stolen. What to do?

About a month and a half ago I got infected by a virus called MSIL.Bladabindi. I noticed the virus quite soon because google notified me that someone from Turkey tried to access my account (I'm in ...
0
votes
2answers
123 views

Is a long salt usually sufficient for security purposes, even with MD5?

I always hear that MD5 is too fast for effective password crypto because you can crack up to 6 characters very quickly (or is this number higher now)? But what if the salt you use is really long and ...
0
votes
3answers
93 views

How secure is my method?

I want to select data from a MySql database on an iphone device. The method I seem is the easiest one is to connect to a php file with GET arguments and then return it as a string. Now I'm just ...
0
votes
2answers
3k views

Encrypted code file (.vbs) hide all my files and shows .lnk files

I am using Windows XP Professional and what happens is that when I try to connect any gadget like a pen drive or a mobile through USB, all my data got hidden and it shows a 1 kb file which is a .lnk ...
0
votes
2answers
312 views

Securing Public Web Services - What is the best practice? [closed]

There seems to be a number of ways to secure web services. OAuth, API Keys, Tokens, WIF, etc. Since security is not my area of expertise, I am asking what is the best ways to secure public web ...
0
votes
1answer
106 views

Why has Convergence stalled out? [closed]

Convergence is a well-thought out system to replace certificate authorities built by Marlin Moxiespike back in 2011. Since it's debut, it seems to have largely stalled out, with no additional major ...
0
votes
2answers
63 views

Posting links to executable files and security

If someone is able to post on the forum of my website links to executable files (malware) hosted on remote websites: can we say that my website suffers from a security hole ?
0
votes
2answers
236 views

How common and how easy is sniffing plaintext communication?

So the first reason we give to encrypt content is to prevent against a man in the middle sniffing all data. That is the reason ssh is used and not telnet for example. But in today's networks where ...
0
votes
3answers
360 views

What security issues will I face with outsourced VPS server?

Our small comapny wants to launch a paid service, hosted on the outsourced VPS server. The obvious risk is that the machine is physically not in our office and that possibly the database could be ...
0
votes
1answer
161 views

HTTPS encryption and internet proxy [closed]

I'm not sure if this is the right place to ask this question. Please tell me, and I'll delete it. I want to modify a Word document hosted on my OneDrive account. I see that it is using a SSL ...
0
votes
3answers
2k views

Is a prepaid SIM-card with 3G data anonymous?

Say I buy a prepaid sim-card with 3g data and put it in a used 3g modem (dongle) or a used smartphone and then create a Hotspot. How would it technically be traced back to me? The ISP should see a ...
0
votes
2answers
279 views

Ubuntu LVM LUKS Encryption

I've been reading about Ubuntu LVM Encryption, and I understand that it supports the use of Linux Unified Key Setup (LUKS) during installation, which is a block level encryption that encrypts the ...
0
votes
1answer
718 views

How to prove iOS app is vulnerable to MiTM

I'm updating an iOS app and I want to prove that it is vulnerable to MiTM attack. I have set up Charles Proxy on my mac and configured the Simulator so that it trusts Charles CA Certificate, per ...
0
votes
2answers
374 views

How dangerous javascripts really are? [closed]

I've watched this video, and what this guy says is that with javascript its easy to create a worm that steals your information also that javascript will continue to execute even tho you closed the tab ...
0
votes
1answer
256 views

BurpSuite: Anonymity

Are the attacks being performed using burpsuite detectable? If yes, how should we stay anonymous/secure while conducting web application reconnaissance?
0
votes
3answers
385 views

How source port field in firewall rule is used

Some firewalls (like the first figure in 13.1.4 in http://doc.m0n0.ch/handbook/examples.html) allow user to specify source port in a firewall rules. But in a TCP connection, the source port is ...
0
votes
1answer
154 views

Why can't we create a new SSL implementation?

SSL implementations have been discussed a lot lately, due to Chrome's potential of switching off NSS ...
0
votes
2answers
1k views

Could a router protect our network or need we use an hardware firewall?

I am at a small firm (12 PC on the internal network). We use this network architecture now: Internet(Modem) --> Router --> Firewall --> Switch -- > Internal Network (clients PCs) ...
0
votes
1answer
62 views

How does LM hash deal with passwords that are between 8 and 13 chars

If its 14 then it splits it to 7&7, but how about 13 characters? 7&6? How does it work?
0
votes
4answers
698 views

Are Truecrypt volumes safe from the government agencies? [closed]

I have some Truecrypt volumes stored on my USB drive and I would like to know if they are safe from being cracked by the FBI or any government agencies? Some people say Full Disk Encryption will ...
0
votes
2answers
268 views

How do I prove for my client that unused ports are closed and unused services are disabled?

I have seen advice that I need to close all unused ports, and disable any unused services in order to secure my servers. How can I prove, beyond any doubt, to my client that I have done this? I need ...
0
votes
1answer
73 views

Are there limits (or, what are the limits) to our understanding of AES's resistance to known plaintext attacks?

Let's assume the same message is encrypted many times, each time with a different IV but the same key. Do we reach a point where just knowing what that message is gives us a plausible attack by which ...
0
votes
3answers
463 views

Up to date books for OpenSSL coverage of TLS 1.1 and 1.2 [closed]

I currently have Implementing SSL / TLS Using Cryptography and PKI Joshua Davies. It is very recent and covers even newer TLS version 1.1 and 1.2 and ECC. It is based on many C sample that are ...
0
votes
2answers
119 views

Is this anti-forgery scheme secure?

To prevent cross-site request forgery attacks, I'm considering the following scheme: For each user, store a random key. If the user submits any "dangerous" information, include a security token and a ...
0
votes
4answers
91 views

Isolate dual system

Say I have a computer with 2 operating systems: one secure, one... not so much. Now say I want to use the insecure system to do some work I can't do on the secure one. What is the best way to isolate ...
0
votes
2answers
315 views

What kind of attack is this?

This past week, my traffic logs are showing many hits (usually with repeated tries) for a URL from perhaps 30+ different IP addresses all over the world. This is not a URL that should garner more than ...
0
votes
4answers
202 views

How to secure my website's FTP?

When I opened ftp command prompt and typed open mydomain.com, it gave me the following and I think that this is a security vulnerable. connected to mydomain.com. 220----- Welcome to Pure-FTPd ...
0
votes
1answer
352 views

Virtual private server security [closed]

I want to move from a shared hosting to VPS. I never used VPS or dedicated server, so I wanted to know if there are some security precautions that I should have in mind. Say, I create a ftp account ...
0
votes
1answer
324 views

Potential problem in public Maven repository

Problem This morning I found that, what I thought was one of our proprietary artifacts, had been published to a public repository: http://repo.grails.org/grails/simple/codehaus-cache/com/ If you ...
0
votes
1answer
118 views

is this code valid for securing passwords? [duplicate]

i was wondering if this is a secure method for a hashing password.if it is not secure please tell me what to do in order to make it secure $pass='test'//the password ...
0
votes
2answers
136 views

Is sending authorizing links through e-mail a vulnerability?

I am not sure if my wording is right, but if I attach a unique token inside email links which will authorize the user if clicked, would you consider this a vulnerability? Password-reset partly ...
0
votes
1answer
162 views

Is there a way of determining if tor is running on a remote machine?

In most of the companies, IT guys block some sites and by using TOR or other VPNs people walk around these blocks and gain access to blocked content. My question is, assuming TOR is running on ...
0
votes
1answer
162 views

Server Encryption - Best practice [closed]

Q: For servers running Windows 2008 and up, what would be the most reliable whole disk encryption? We want to protect our data from unauthorized access. Right now, we used BitLocker. However, the ...
0
votes
3answers
173 views

Restrict request to Android and Iphone App only?

I have a ASP.NET/IIS server. I want to restrict my server to only accept request from Android and Iphone(IOS) applications. I have heard about HMAC. Can HMAC help me?
0
votes
1answer
80 views

How to prevent malware to know when removable devices are plugged in

The question is clear, I'm a programmer and wrote a software to disinfect the USB devices when they got the malware which hides the files and creates a shortcut of the virus . Using this soft we can ...
0
votes
2answers
278 views

Any residual effects after SQLMAP has been run?

Some time ago, penetration testing was done on our website, and one of the tools used was SQLMap It was executed by a security consultancy, but unfortunately they did not notify us beforehand. So, ...
0
votes
3answers
1k views

Is it PCI compliant to send credit card details to the server without saving them there?

Considering I use SSL the whole process. I have an IOS client that I want to use to enter the user's credit card details. I want to do the whole charging and processing on the server side, so I send ...
0
votes
2answers
102 views

What influences the speed of rendered php page using encryption [closed]

I've built a web app which uses the openssl_private_decrypt() functions. The rendering of a page with 15 messages encrypted with these functions takes remarkely longer as the ones without. (3-4 ...
0
votes
4answers
359 views

Keeping TrueCrypt keyfiles in plain sight

If I create a TrueCrypt volume and secure it with a password and a keyfile, is there any way that someone who has access to my computer would be able to tell that the volume requires a keyfile to ...
0
votes
2answers
2k views

Attack on old OpenSSL/Debian vulnerability doesn't work on a vulnerable box

DISCLAIMER: The vulnerable box that we are testing on belongs to us, and all the actions are under surveilence, hence we are not doing anything illegal here. I'm testing a Ubuntu 8.04 box, it's known ...
0
votes
2answers
714 views

Modifying SSL Certificate once created, Multi domain

We're developing an application that has the ability to run across multiple top level domains, each with its own sub domain. (www.foo.com, www.bar.com, would each point to the same application on the ...
0
votes
1answer
88 views

A fake phone tech changed my start up password. [closed]

I was duped into believing a phone caller was a computer tech. I allowed him remote access and when I refused to pay a fee at the end of all his changes he hung up. My start up now has an unknown ...
0
votes
2answers
723 views

DNS Cache Poisoning as a Foil to SSL

I recently learned a bit more about DNS cache poisoning, and my understanding of the basic way it works is by editing the DNS cache so that when the victim types in, say, www.google.com they get the ...
0
votes
1answer
299 views

LDAP and anonymous bind for PCI compliance

We have to setup a central auth for PCI compliance and I'm wondering if it's ok to allow anonymous bind or should I create a user to do the bind for the services needing ldap?
0
votes
2answers
81 views

Company Laptop and iTunes/iPhone

With their permission, I am selling a company laptop that I used, but I had been using iTunes and syncing my iPhone on that PC. Is it possible for a forensic tech to retrieve any of the browsing ...
0
votes
1answer
182 views

How can brute force scripts tell once they're found the correct key?

If you have a random block of data and you encrypt it with a key, how can a brute force script tell when it has found the correct key? Is it possible without some sort of reference to the original ...
0
votes
1answer
700 views

Buffer Overflow on Raspberry PI

Is the ARM processor used on the Raspberry Pi vulnerable to standard buffer overflows? That is, if a program that has a BO vulnerability is run on a Pi, will it be vulnerable to exploit? How does ...

15 30 50 per page