1
vote
4answers
807 views

Configure Firefox against malicious 302 redirect from a embedded image resource?

Today my friend demonstrated such a attack. I am using RenRen, a social networking website in a way very like Facebook in China. And I saw an article he wrote. Actually there is only an "image" ...
1
vote
1answer
2k views

Repair Truecrypt NTFS-partition with undetectable filesystem [closed]

Long story short: Got 1 TB HDD. Created one fullsized (non-system-)partition on that. Encrypt via TC. One time, via boot, Win presumably formats that (and maybe writes some bytes on it). I manage to ...
1
vote
0answers
288 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
1
vote
1answer
1k views

WSO 2.5 Found on Apache

I have found on my web server the file wp-conf.php which when you call it from the browser with a url parameter like wp-conf.php?t7831n=any value shows an interface where you can control the entire ...
1
vote
0answers
734 views

Decrypt “key” that is encrypted with LMK or TMK

New to HSM (Thales payshield 9000), I'm working on DUKPT algorithm. I manage to derive the IPEK(encrypted either under LMK or TMK), but I need to inject a plain text IPEK into an end point device. I ...
1
vote
2answers
128 views

Malware for testing [duplicate]

IS there websites and places where you can download all types of malware that you can run and test the security setup of your system? I am currently playing around with UAC+EMET4+MSE and would like ...
1
vote
2answers
85 views

Seeking security help as a non-technical manager [closed]

A friend in the business sector recently asked me for advice on "IT security in a large charity". Being a developer not specialized in security, I could see his difficulty in finding someone qualified ...
1
vote
0answers
31 views

Should we protect web application source code from being stolen by web hosts through obfuscation? [duplicate]

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code & probably even steal your business. If, so how to deal with this or how to obfuscate ? ...
1
vote
0answers
136 views

Formatting before encrypting [closed]

Is formatting a device before encrypting more secure as opposed to encrypting the device without a formatting?
1
vote
1answer
311 views

Generate Keytool Object from CSR

I have to develop an application which uses another application for generating a CSR. After generating the CSR I have to provide this CSR along with a SHA256 hash of the public key to a CA. The ...
1
vote
0answers
39 views

How would you find a complete list of a software's vulnerabilities? [duplicate]

I'm interested in the number of vulnerabilities over time, not in specific information about the vulnerabilities. I also don't expect any list to be completely authoritative. But what list could I ...
1
vote
0answers
357 views

Security Features in Bond Paper (Certificate)? [closed]

We are printing certificates and diplomas in bond paper and we found some fraud copy of our certificates. The only feature we have for security is an embossed stamp in GPA, also we have printed 3 ...
1
vote
0answers
780 views

How to set up a smart card for web login? [closed]

I'm a web developer with a login system (in PHP) that I would like to extend to allow those with a smart card to sign into the system. But I have no idea where to begin and I don't have a massive ...
1
vote
0answers
85 views

Is this any recognizable encoding or cipher? [closed]

I've been watching the Marble Hornets videos on YouTube (basically, an independent film series about a group of kids chased by the "Slender Man"), and in this video I saw something interesting. ...
1
vote
0answers
51 views

How can I recover the password of a TrueCrypt vlume? [duplicate]

I am trying to recover the password of a trucrypt volume. It is composed by a combination of 4 words (one invented). I remember 3 of them but not their order. Do you know any tools that cold help me ...
1
vote
0answers
61 views

What are the security implications of (not) expiring login screen session? [duplicate]

I manage a single sign on solution (CAS) for a group of related web applications. The CAS specification states that Login Tickets are associated with every login attempt which can only be used once. ...
1
vote
1answer
6k views

Totally different IP addresses assigned when using the same router

For some time I have observed a strange behaviour when connecting to the internet through my WLAN. Depending on the computer I use on my network, the ISP assigns me totally different external IP ...
1
vote
2answers
514 views

CSRF protection with cookie and AJAX

I would like to note that I've read the other question with an embarrassingly similar title and it does not contain an answer to my question. I have not used CodeIgniter as a programmer, but I have ...
1
vote
4answers
275 views

Free space shredding

I'm an avid fan of file system forensics but I'm an amateur so far. I've been reading up on NTFS forensics and I've noticed you sometimes can know if a file was on a certain volume even if it was ...
1
vote
1answer
1k views

Do the Owncloud clients use encryption when transferring files to and from the server?

Do the Owncloud clients use encryption when transferring files to and from the server? I understand that files are stored un-encrypted on the server, but I’m wondering if they are secured during ...
1
vote
1answer
6k views

The request was aborted: Could not create SSL/TLS secure channel Exception

Let me explain my situation. I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC. I then created two certificates using the self-signed ...
1
vote
0answers
442 views

Is anything written in the book “Internet Denial of Service: Attack and Defense Mechanisms” c2004 still valid? [closed]

I was reading through some of this book on google: http://books.google.ca/books?id=qmdCs_Jf2AEC It is uploaded to a hungarian website here: http://denialofservice.uw.hu/index.html I was reading... ...
1
vote
0answers
1k views

Automatic router admin password change [closed]

I feel that this is definitely a hack of some sort and an interesting one. I am using a Beetel 450TC1 ADSL2+ modem router and here is what I face: * First, I disconnect the telephone line from the ...
1
vote
1answer
410 views

How can I allow local pop3 but enforce remote pop3s on my ubuntu/postfix/dovecot OS/MTA/MDA

I would like to allow local clients to access email via any of pop3, pop3s, imap, or imaps if they so choose but restrict remote clients to pop3s and imaps only, simililarly to how I already do for ...
1
vote
0answers
464 views

OTR and/or SecureIM library for C# .NET [closed]

I'm looking for implementations (or even wrappers) for OTR or SecureIM encrypted chat protocols usable from C#. Currently I found none, and considering porting Java OTR library and/or wrapping ...
1
vote
0answers
38 views

Using SSL on my sites for everything or just some things? [duplicate]

I have a server which provides a few services through the web, some of those services must be logged into to be able to use them. For these services I have implemented SSL using level 3 CACert ...
1
vote
1answer
1k views

Brute Forcing Domain Controller

I have a MS-Server2K3 domain controller that also serves as a Exchange server. Due to recent network speed loss and issues I began looking at event logs and noticed an exceptionally large number of ...
1
vote
0answers
305 views

Fuzz a client with sulley [closed]

I want sulley to bind to an interface, wait for a connection and fuzz the reply to the client. How can I act as a server with sulley to fuzz a client ?
1
vote
2answers
188 views

Guarding against XSS when setting Cookies based on URI?

I have a web-site written in nginx.conf — http://mdoc.su/ — which essentially accepts two parameters, an operating system and a manual page name, and does a redirect to a different site based on the ...
1
vote
1answer
183 views

Do WPA-Enterprise implementations have built-in anti-IP-spoofing?

i'd like to know if WPA-Enterprise implementations have built-in anti-IP-spoofing. here's what i mean: it seems to me like IP spoofing should be easily detectable and handled under WPA-Enterprise. ...
1
vote
0answers
179 views

Which are appropiate tests to perform during an internal/LAN security audit? [closed]

In the internal network we know that controls are less strict than externally but in the other hand we know that lots of attacks come from the internal segment (unhappy workers, etc.) Which are ...
1
vote
1answer
271 views

Getting hmac_sha to work between Erlang and PHP

I am trying to get an implementation based on the AWS signed http request API to work between Erlang and PHP. But I can't get it to work. The core approach is that you constructed a canonical version ...
1
vote
2answers
775 views

What security issues are there when reading cookie with .htaccess?

I have a (hobby) web site that runs only on SSL (i.e., site-wide HTTPS). The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to ...
1
vote
0answers
41 views

Database hash for password field [duplicate]

I'm using a mysql database and am looking for a cryptographic hash method for a password with salt added to it. What would be the best hash method for this problem?
1
vote
0answers
48 views

How can I explain Cross Site Scripting in a non-technical way? [duplicate]

Possible Duplicate: Can anybody explain XSS to an idiot? I can reasonably explain Cross Site Scripting (XSS) in technical terms to other technically minded people or people familiar with ...
1
vote
2answers
1k views

securely destroying data on an external hard drive [duplicate]

Possible Duplicate: How can I reliably erase all information on a hard drive? I purchased an external hard drive and have been saving various things including system backups to it. I got it ...
1
vote
2answers
1k views

Best practices for operating a Bitcoin-Qt client regarding netwok privacy?

As privacy is part of security, I know there is a Bitcoin SE here but they couldn't answer my question so I hope it's appropriate to ask it here. I don't ask about how to secure my wallet on my ...
1
vote
1answer
2k views

Windows System event log warnings for smtpsvc

I get a lot of the following type messages: Message delivery to the remote domain 'particular domain or IP address' failed for the following reason: The remote server did not respond to a connection ...
1
vote
1answer
409 views

spkac: what is the purpose of the challenge string?

The SPKAC ASN.1 description: PublicKeyAndChallenge ::= SEQUENCE { spki SubjectPublicKeyInfo, challenge IA5STRING } SignedPublicKeyAndChallenge ::= SEQUENCE { publicKeyAndChallenge ...
1
vote
1answer
695 views

Public web server and AD- based Kerberos authentication

I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses ...
1
vote
1answer
264 views

Secure Encrypted Chat Protocol [duplicate]

Possible Duplicate: Is there a way to negotiate a secret between 2 parties with no prior knowledge? Imagine two clients who want to establish a secure connection over a server. Both clients ...
1
vote
1answer
627 views

Are there any test cases to ensure the “web-attacks.rules” snort file works correctly?

I have set up an free evaluation Confluence Server on my local host and have configured "snort.conf" to point to my localhost as "HOME_NET" environment variable. I tried to test the ICMP rule by ...
1
vote
1answer
703 views

How to write Snort rules based on MAC address?

I would like to create Snort rules based on MAC addresses instead of IP addresses. Most devices on the network are DHCP assigned, and I would like to ignore certain traffic (ex: Dropbox) for some ...
1
vote
0answers
168 views

Finding pre-image of MD5 hash [closed]

I have the following requirement for hashing using MD5. H(A,B,C,X); Where values A,B & C are given. However X is not given. I would like to find out what value of X would give a hash beginning ...
1
vote
2answers
1k views

authorization vs federation vs entitlement

I am vague among the three following terms: authorization, federation, entitlement (as stated by the OpenAM product: OpenAM provides open source Authentication, Authorization, Entitlement and ...
1
vote
2answers
4k views

IS Maltego is the best forensic/intelligence solution out there? [closed]

i am looking for the best intelligence forensic software that will give me the best solution for gathering information around the web . please recommend me the best software out there ... and if you ...
1
vote
0answers
142 views

Why not buy cheap SSL certificates? [duplicate]

Possible Duplicate: Is there any technical security reason not to buy the cheapest SSL certificate you can find? The comparison in Godaddy's website, makes it clear: they're just cheaper ...
1
vote
0answers
164 views

What becomes of SIEM when a large database like teradata gets involved? [closed]

My topic sentence says it all. I want to know the effect on performance, storage and analysis capabilities when teradata database is added. I'm talking about 70TB of storage with internal ...
1
vote
0answers
262 views

Verifying Authenticode signed executables and DLLs using OpenSSL API [closed]

I have installed openssl and now the rsa_test.c is running fine. What I want to do is: Open any exe or dll digital certificate. Extract the Thumbprint and PublicKey. The public key contains the ...
1
vote
0answers
1k views

Why do complex viruses tend to be written in assembly? [closed]

For example Simile is extremely complex and is written in assembly. If something is going to be complicated isn't it best NOT to write it in assembly?

15 30 50 per page