0
votes
2answers
225 views

Cryptography protocol suitable for two-way radio communications

Specifically talking about walkie talkie radio networks. Suppose there is a group of up to 16 persons, each equipped with such a unit. Typically, one person will be talking with one another ...
0
votes
1answer
304 views

Tor, PGP and Tor Entrance Nodes

Imagine alice posts her public PGP key on her website and bob encrypts a widget with that public key then sends it to alice over Tor. If alice's key is widely and publically available and an attacker ...
0
votes
2answers
73 views

Is “user education” actually doable?

I was going to ask about how to educate users, but now that I think about it, I first want to know if it's actually possible to do effectively at all. Are there any amazing success (or horrible ...
0
votes
1answer
138 views

Save password on user-side for autologin

If a user wants to login to a system/server, it's recommended to have the hashed&salted password saved in a database, along with its salt. So the user wants to login, types in the password, ...
0
votes
1answer
106 views

learning SSL/TLS [closed]

I am looking forward to learn more on implementing SSL/TLS, can anyone of you suggest me a good source to learn about it? For now I only have basic knowledge about it such as what is SSL and how it ...
0
votes
1answer
67 views

MITM protection, key distribution

I want to make sure each of my apps users only get their own data, and that nobody tampers with it or sniffs it in a MITM fashion. Encryption of everything should be the solution, right? But how do I ...
0
votes
1answer
154 views

A no-login approach to authenticating a certain device, MAC-Address as password?

I have created a REST api, and now i'm thinking about authentication. I want the mobile application's flow for the user to be very simple: only having to enter a username and then this username ...
0
votes
1answer
316 views

Should remote access (RDP/SSH) only be allowed for VPN clients? Or should RDP and SSH be opened the public?

I am about to push hard against the powers that be and strongly recommend that we shift our many (20+) consultants from direct public access to RDP & SSH to VPN clients (connecting to a ...
0
votes
2answers
301 views

Steps to create user authentication system between mobile and server

First time doing a secure login from a mobile app to a server (built in java). I want to understand if I got this right. Login in for the first time: 1. On the mobile device hardcode a security ...
0
votes
1answer
287 views

URL Rewriting vulnerability

We modified our Session handling from cookie based to URL Rewriting. By doing this the session id gets transmitted as part of the URL. Now there is a vulnerability issue, where whoever uses this URL ...
0
votes
1answer
39 views

Utility of Output Chains in IPTABLES when there is no Network Firewall— Is it ok to permit all outgoing connections from a server?

I have a set of INPUT chain rules restricting traffic based on source ip and destination ports.The services are ftp and a job service.The server has a public ip address. The default policy of the ...
0
votes
1answer
127 views

How can a browser hijacking attack change the browser's default homepage?

Some attacks on web browsers consist simply of advertising, so the default homepage of the browser is changed (which is just a small aspect of browser-hijacking). My question: is installing ...
0
votes
2answers
166 views

Securing a Windows PC

Currently I have an "Antivirus" and Anti Malware software installed. In addition I closed all remote assistance and unused port rules on my firewall. I'd really like to get a complete as possible ...
0
votes
1answer
161 views

Save to setup localhost.example.com to test wildcard SSL?

I have a domain with a wildcard SSL certificate (i.e. "*.example.com"). I also develop using WAMP setups, which I would like to be able to test HTTPS on. There are several tutorials on how to setup a ...
0
votes
2answers
96 views

trying to xss a site [closed]

http://XXX/?subscribe_message=%3Cscript%3Ealert(/zzz/);%3C/script%3E Why doesn't that popup with a /zzz/ alert? When I do javascript:alert(/zzz/); in the address bar it does so why not when I do it ...
0
votes
2answers
67 views

how does tor protect data packets? [duplicate]

When you're using tor can't the third parties copy all the data that's going back to your device and decrypt it later, let's say I downloaded some doc files, the data has to come back to your device ...
0
votes
1answer
87 views

Prevalence of offshoring in the Information Security Industry? [closed]

After having been a regular code monkey in the US for 6 years now with readily offshoreable skills, I feel like I am fighting an uphill battle against third world wages. While I am not prepared for a ...
0
votes
1answer
47 views

Is it possible to detect IDS name and version

the title said it. Is it possible to detect IDS name and version. If server use Snort as IDS, would I be able to detect it from external PC? And if it's possible how?
0
votes
4answers
107 views

Temporarily suspending a Certificate Authority's Certiticate

The PKI RFC talks about revoking or suspending certificates. It also talks about revoking CA certs. However, I could not find anything about whether a CA or a Sub CA's certificates can be revoked or ...
0
votes
1answer
130 views

benefits of xinetd for a web server

What are the pros and cons of using xinetd for a web server running on a VPS. Assume the following measures have already been taken to secure the system: system hardening, latest updates, minimal ...
0
votes
3answers
57 views

Custom surveillance protection [closed]

I want to make a secure network because of government surveillance. Is there a way I can configure or build some type of custom hardware to be able to detect and to access the network, but only ...
0
votes
2answers
173 views

BIOS upgrade only with PGP-signature / encrypting the whole BIOS

To successfully defend the BIOS from malicious rootkit installation or other malware that writes itself inside BIOS I wonder if these ideas are possible or even done yet: Can you program the BIOS ...
0
votes
1answer
90 views

Tracing the attacker

I have seen from: http://www.scientificamerican.com/article/tracking-cyber-hackers/ "The source field can be changed [spoofed] by an attacker to make it seem like it's coming from someplace it's not" ...
0
votes
1answer
838 views

x509 serial number - hex or decimal

When I run the openssl command openssl x509 -noout -text -in certname on different certs, on some I get a serial number which looks like this. Serial Number: 256 (0x100) On others, I get one ...
0
votes
2answers
774 views

How could you find wildcard subdomains on websites?

Other than testing different URLs separately, is there anyway to find out if a website has a wildcard sub domain?
0
votes
2answers
56 views

What conditions allow an attacker to write a cookie?

Some CSRF protection mechanisms are vulnerable to attackers who can write cookies. Others are not but incur extra complexity or computational cost. Help me understand the cost/benefit. What ...
0
votes
1answer
123 views

Detect referer check on redirect

I have a section of my web site that I only want reachable from another portion of my web site. I know that referer spoofing is trivially easy. But, if all requests from an incorrect referrer are met ...
0
votes
2answers
118 views

What kind of information can be found from email?

When an average person sees an email, he can see only part of an information enclosed in the mail. To see full information one can look at the source of an email, which shows more. Example of an email ...
0
votes
2answers
103 views

securely storing password in a file

I am working on making a log file for a small application. If an error occurs in the application then I have to send a mail to a person. I've figured out the code to send a mail to a person, but I ...
0
votes
2answers
165 views

Mac laptop security on insecure wifi connections

I'm going every year at big IT conferences (3k->4k people). Everyone is connected to the internet with wifi on laptops. This wifi is open, everyone can read the traffic and analyse it... The risk is ...
0
votes
3answers
141 views

Is This A Website Attack/Vuln Test?

I have a specific IP that has been iterating through the directories on my site testing for something. Here is an example of what it keeps trying to hit: ...
0
votes
2answers
215 views

Can a SSH server or client to initiate a unencrypted connection?

Several clarifying questions: Is it possible to disable the SSH encryption using options at the OpenSSH server/client or some appropriate hack? Is it possible to do this at the time of the ...
0
votes
1answer
142 views

Why providing many protected zip files will increase the chance of retrieving the password

In fcrackzip man they say : the more files you provide, the better. I want to know why. What's the method it uses to retrieve the password?
0
votes
1answer
147 views

CSRF vulnerability in CGI/shell script web interface of hardware

I have a web interface to a hardware that is primarily used to reboot the hardware. Reboot can be done only by authenticated user.The web interface is written in CGI/shellscript. It does not use any ...
0
votes
1answer
184 views

Using hashed password as secret key for hmac to avoid exchange of secret between server and client

I'm currently trying to improve our API to be more restful, therfore avoid any state on the server. I want to accomplish this with a hmac token, appended on every request. The hmac will be made with ...
0
votes
3answers
64 views

How to secure Password and Salt on a deployed application

I have a question regarding one step of protection more than salt/hash. I work on an application that is distributed to many clients and then deployed on their networks. If I set a password on one ...
0
votes
1answer
199 views

Did somebody connect to my facebook account?

I have a problem. I'm not sure, but I think that somebody (in our home network) found out a password to my Facebook account and sometimes logs in. Is there a way to find out whether it is true? There ...
0
votes
1answer
49 views

How to sync with multiple authentication services?

I have a peculiar case to work on. We are using a proprietary product which supports LDAP integration. However, it can be configured to use only one LDAP service. (most of the products are shipped ...
0
votes
1answer
2k views

How to backup files stored in a possibly infected computer?

I am to reinstall an old Windows XP installation. Before I format the drive, I have to backup some data (~200GB) like .doc files, pdfs, photos to an external hard drive. My concern is that this ...
0
votes
1answer
71 views

unfamiliar IP when logging into ssh server

I just noticed something today, and Now I am curious... I was on my shell server, an i was wondering who was on, so I gave the command $w and saw this: j0h@server:~$ w 22:06:02 up 18 days, 7:02, ...
0
votes
2answers
103 views

Some questions about crypto

How to determine what type of encoding/encryption has been used? This link discusses in the first answer a "128 bit" value. How do you know that it is 128-bit and what is a 128bit value? If I md5sum ...
0
votes
2answers
125 views

Malicious capabilities of Social Botnets

A fairly new concept in Malware, especially in the case of botnets, is the emergence of social botnets. These botnets are comprised of accounts (either a newly created account or an existing hijacked ...
0
votes
1answer
105 views

Valuable languages for working malwares

I would like a recommendation for programming languages which will be valuable when dealing with malware. I learn to code on C not on expert level(thanks god I didn't). But C doesn't seems so popular ...
0
votes
2answers
170 views

OWA + AD Lockout Policy: Quite the Mixture

Many organizations have webmail exposed to the world. These sites are often hooked up to AD for user authentication. Are there any specific security controls OWA (Outlook web app) has that would ...
0
votes
2answers
762 views

How to know when a file was deleted in a NTFS filesystem?

Is it possible to know when a file in a NTFS filesystem was deleted? For example, if you have the file in the recycle bin you have the metadata file that stores when the file was sent to the recycle ...
0
votes
2answers
402 views

Encrypted offsite storage using sshfs and cryptsetup/dm-crypt/LUKS

I'm interested in an encrypted offsite storage scheme, but I don't want to depend on the vendor for encryption. I have an idea for doing so by combining sshfs with cryptsetup/dm-crypt/LUKS, but I'd ...
0
votes
1answer
59 views

Securing data at rest

For an API request to my application, I store the data in the request object temporarily in an xml file before it is pushed to the database. Although the xml files are stored on a secured server at a ...
0
votes
1answer
209 views

Firewall hole punching [closed]

I'm interested in doing my thesis on Firewall hole punching. Hole Punching: A way to exploit NAT to open a connection TCP or UDP between a Client and a Server. What I'm looking for is a reason this ...
0
votes
1answer
77 views

How secure is this way to use open VPN

I have installed openVPN using the following link http://www.vpnbook.com/howto/setup-openvpn-on-ubuntu I would like to ask is it really secure . the password is available for everyone and the ...
0
votes
2answers
144 views

What college majors are suitable for a career in security? [closed]

I was recently asked by a friend of mine (outside the computer science field) if he can be successful in web-application pen-testing I took this as an excuse to ask a more comprehensive question. I ...

15 30 50 per page