1
vote
1answer
221 views

Storing encrypted information in database vs partition encryption

Trying to search for answers like Database encryption or filesystem encryption? but did not found what I need. My database contains confidential information. What is better? To store encrypted ...
1
vote
1answer
311 views

Should I trust zxcvbn with my password?

I want to measure current and future password entropy with the zxcvbn formula. Is there any way to test and detect if the input on this website is truly confidential? EDIT: 1. I found an ...
1
vote
2answers
338 views

Encryption / Decryption algorithm generic across JRE (Sun/IBM)

Is there any encryption algorithm that is generic across all platforms? Is RSA generic across SUN/IBM JRE? Another question: will base64Encoder / base64Decoder sun.misc.BASE64Decode / ...
1
vote
2answers
300 views

Code Vulnerability in Shell script

I was given an assignment for my Computer Security class. We we were given a piece of code to analyze and determine the vulnerabilities that it might have. #!/bin/sh # shell script to create a copy ...
1
vote
2answers
520 views

Malicious self-executing code can only exist in EXIF data in JPEG images?

Let's say we got an infected JPEG image that just by viewing it can automatically execute the malicious code stored inside it. It can do this either by taking advantage of the image viewer's security ...
1
vote
3answers
127 views

Securing a secondary login page for inputting a multi-factor auth token

I would like to implement the following use case: User lands on the login page User submits login credentials Credentials are validated and they are redirected to another page for inputting the ...
1
vote
3answers
122 views

External JS Security

I'm kinda new to security development. I've work mostly with backend processing stuff. I've been assign on how to secure external javascript that we import from facebook, twitter and google. One ...
1
vote
2answers
385 views

Hidden Malware on a windows OS able to startup [closed]

How do hackers hide there malware on windows, to startup and be impossible to find then delete. The results I found that a hacker can use to hide his malware: (found here) Windows: Setting hidden ...
1
vote
2answers
383 views

How to wipe potentially infected SSD?

I recently fell victim to some Adware (and possible malware). I was installing Firefox and clicked an ad link in Bing and downloaded a "packaged" Firefox install. I believe the ad is still at the ...
1
vote
1answer
624 views

Can public certificates be password-protected?

I've only seen private key files (.pfx, .pkcs12) being password protected. Someone told me public cert files (.cer) can also be password-protected. Is that true? Is it also true to say any certificate ...
1
vote
1answer
191 views

How can I prevent keys loaded into ssh-agent from being sent to a particular (insecure) server?

A particular server I need to interact with has an ancient or crippled sshd installed, and only supports SHA1 algorithms for key exchange. From information in the Snowden documents, I am leery that ...
1
vote
2answers
59 views

Transferring passwords to outside counsel

As part of a new eDiscovery effort, we send large amounts of data on encrypted hardware to third parties (outside counsel) that are not very technically proficient (so no key exchange via PGP ...
1
vote
3answers
190 views

Encrypt data going through an encrypted connection

If data are passing through a SSL-encrypted connection, is it required to re-encrypt these data? In other words, is it mandatory/useful/worth it to AES/RSA (for example) encrypt data that will be ...
1
vote
2answers
281 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
1
vote
1answer
343 views

Phone got pick pocketed and I got a huge bill

I'm really sorry if this is posted in the wrong section. I did spend some time trying to get it right but I am not sure if this is... I have been exposed to thieves who have stolen my phone and then ...
1
vote
3answers
444 views

Can an attacker spoof an IP address to access my .htaccess protected file?

Let's say I lock down my site through .htaccess and say DENY FROM ALL ALLOW FROM myip how involved is it for a hacker to to simply spoof their IP address to match whatever mine is and gain access? ...
1
vote
1answer
226 views

Is dot character safe against sql injection?

I'm modifying the search module of prestashop in order to be able to search strings containing dots : . Prestashop uses its own sanitize functions against mysql injection vulnerability (yeah...) and ...
1
vote
3answers
214 views

Why do credit cards have chips, if I can purchase online without the chip being read?

Credit cards (and debit cards) are used in three different ways: In person + pin. The seller requires me to insert my card with the chip and input the PIN number to complete the transaction. In ...
1
vote
2answers
238 views

Encrypted retrievable password

I have a password conundrum. I need to store an encrypted password in a DB table but in such a manner that would allow me to retrieve the password as plain text afterwards. Please note that this is a ...
1
vote
2answers
138 views

Storing AES password for verification

I was wondering if such practice would be safe: I have a table that stores encrypted notes Every note has a data field and a password field When a password is entered, i want to select all notes, ...
1
vote
2answers
226 views

Stream/block cipher add a simple hash to guarantee integrity

The question is simple: Adding a hash to a message and then encrypt it using a stream cipher / block cipher. Why can't this guarantee integrity of the message upon decryption?
1
vote
2answers
427 views

Is it possible to restrict email accounts within one computer?

can emails(e.g gmail)can be configured to open-up only in my laptop ,my operating system is windows 8 and is it possible to restrict my gmail account to be opened up only in my computer?Usually we ...
1
vote
2answers
317 views

Send fake response(?packets) to a program [closed]

So my idea was.. There is a program that require login to be able to use(the program should work offline aswell not requiring any online data), so i want to make that program to be able to run offline ...
1
vote
1answer
72 views

Multi hash security [duplicate]

Is md5(sha1(pass)) more secure than md5(pass)? For example in case of sqli when attacker cant get our hashing schema, brute force or dictionary attack would be much less efficient. Am i right or is it ...
1
vote
1answer
616 views

portscan using nmap fails to return open dhcp-port

I've just stumbled upon something pretty weird, at least for me at this moment. When i've finished setting up my openBSD 5.5 server, along with the isc-dhcp43-server port. I tried to see if i could ...
1
vote
3answers
2k views

What is same site scripting and what are some exploit scenarios?

I know it is an issue with how DNS is configured , but is it really dangerous if the attacker couldn't access your network?
1
vote
2answers
284 views

When MBR pirates grin as an indication of absolute pleasure!

Someone, have no idea who, really worked my computer, and placed some rootkit, all-knowing, all-smashing malware something and I simply cannot keep Windows OS clean in a multiboot configuration with ...
1
vote
2answers
206 views

How would you set up a ‘cold’ netbook for master-key signing, large Bitcoin transactions, etc? [closed]

I've just ordered a cheap-o netbook on Amazon, with the intention of installing a Linux distro, and turning it into a permanently-offline high-security machine for sensitive tasks. However, I'm no ...
1
vote
1answer
118 views

How to execute an XSS attack against a site that uses client side protection?

Say I have a site that allows me to save my name to the database, and that name is then displayed to other users. I have determined that if I save the following as my name: Abe ...
1
vote
1answer
6k views

how can we find the CSRF vulnerability in a website?

I heard that there are no specific tools available to test and find out the CSRF vulnerability of a website. So from a security testers point of view, how to test for the CSRF vulnerability?
1
vote
1answer
219 views

What is stopping me from replaying an SSL certificate?

Say I have the SSL certificate for google.com. I intercept it, edit the certificate with my own domain name and public key and use it to intercept all traffic to google.com. What mechanisms exist in ...
1
vote
3answers
326 views

How can an email sender include his PGP key, so I can answer with an encrypted mail?

Let's say I were to post my e-mail address and public PGP key to my website. When a client contacts me, they would have to include their PGP public key in the e-mail so that I can respond to them in ...
1
vote
2answers
4k views

Brute force alphanumeric password using JohnTheRipper

I recently recovered a zip archive with some files I need access to, but I can't remember the password. All I can remember is that the password was short (around 3-4 characters), and contained only ...
1
vote
1answer
242 views

Why is the HTTP Server header not used by most servers, but the User agent used by most browsers? [closed]

I've read that the Server header would disclose information, and that its use would be bad. The arguments made in that question also apply for the User agent header. So why is it still used, and not a ...
1
vote
1answer
268 views

Help removing my domain from blacklists

I bought a domain few days before. but it came to my attention that my domain has been blacklisted by many antivirus programs and search engines as the domain for previously purchased by somebody and ...
1
vote
2answers
1k views

XSS with input in onclick attribute

If I have... <table onclick="texttexttexttextUSERINPUTHERE"></table> Would XSS be possible? I mean with > and " filtered out. I know if there wasn't text behind the user input, you could ...
1
vote
3answers
425 views

Router Question — Port Forwarding Rules Added Automatically

I have an Actiontec V1000H router/modem. I have been having virus issues recently so I done a factory reset on all but 1 of the computers on the network. I went to add in a Port Forwarding exception ...
1
vote
2answers
344 views

In what situations can a hacker try to break passwords millions of times? [duplicate]

I keep reading about situations where a hacker could "easily" brute force a password (most recent example) but I'm confused about when some has an opportunity to do this kind of thing. If it is a ...
1
vote
4answers
548 views

Hashing Email Address and Contacting User

I am thinking about a log-in web service that would store a users username, password, and (optional) email address. If they forget their username or password, they can have their username and a ...
1
vote
2answers
177 views

Does logging out also stops the hijacked session?

Suppose somebody hijacks my session , say using Firesheep. Then what happens if I logout, does the hijacked session also end ? Also, does using LAN wire instead of WiFi prevents session hijacking ?
1
vote
2answers
321 views

Do I need a hardware firewall even if I have Internet security software?

I have Kaspersky Internet Security 2010 installed on my Win7 computer. I assume it gives me enough protection for a software firewall(port security,tracking tcp,udp traffic etc.) Do I still need a ...
1
vote
2answers
642 views

Is it illegal to publish an exploit against a known vulnerability in US?

Is it illegal to publish an exploit against a known vulnerability in US? The exploit could be published in one's blog or places like exploit-DB. It seems that in countries like Germany and France such ...
1
vote
3answers
1k views

How secure is iOS Touch ID?

I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". ...
1
vote
1answer
667 views

Why is it difficult to break RSA?

Given that an attacker only knows the public key and cipher text, why is it difficult to decrpyt the message ? If the knows the N value will he be able to decrypt it ?
1
vote
2answers
1k views

“A third party is capable of monitoring your network activity” with [imported] certificates?

I installed the CAcert root certificates on my Android device (which is not rooted), so that I could visit websites with server CAcert certificates without getting the "certificate not trusted" ...
1
vote
4answers
251 views

How to detect credit cards harvested from memory?

Had a chat recently with PCI compliance specialist and got to realize there is a way to steal raw data from Apache / Nginx memory e.g. credit cards. It's called "harvesting" and becomes pretty common. ...
1
vote
1answer
486 views

Obfuscation and Mobile App

Recently, I stumbled with this topic in my mind for few days. I understand that obfuscation is not the best protection against reverse engineering. I wonder if there is another method that make it ...
1
vote
3answers
137 views

Is it safe to share my hostname

I am using GNU/Linux. Sometimes, I copy/paste code from the terminal (like user@hostname ..) to put it in a forum thread or a blog ..etc And I was always wondering that it is better to hide it . Is ...
1
vote
3answers
2k views

Protecting form post values when on https

I am dealing with a multi-step form, and I need to pass information from step 1 to step 2, then from step 2 to step 3, and so on. Step 1 contains a membership number and ID number entry, as well as ...
1
vote
3answers
635 views

What are the problems that Chip card technology solve? and what are the problems EMV solve? Are the separate things?

What are the problems that Chip card technology solve? and what are the problems EMV solve? I understand that EMV is a standard where as chip card is a technology, It's pretty hard to tell them ...

15 30 50 per page