1
vote
0answers
1k views

Why do complex viruses tend to be written in assembly? [closed]

For example Simile is extremely complex and is written in assembly. If something is going to be complicated isn't it best NOT to write it in assembly?
1
vote
0answers
352 views

MySQL Database Activity Monitoring Solutions [closed]

We are looking for a DAM solution for MySQL. There is of course GreenSQL but it seems to lack some of the features we desire like robust filtering of reports for export purposes, etc. It's very ...
1
vote
2answers
431 views

Oracle Transparent Data Encryption [closed]

Currently we are using Vormetric for Transparent Data Encryption (TDE) in the Oracle Standard product to satisfy PCI-DSS 2.0 requirements. Does anyone have experience with other third party solutions ...
1
vote
0answers
713 views

Comparison of Whitehat Security and Veracode [closed]

I'm a research student. My topic is Web Application Security Scanners. The companies under my study are WhiteHat Security, Cenzic, Veracode, Qualys, IBM Rational Appscan, HP WebInspect, Fortify. I'm ...
1
vote
1answer
236 views

Is it possibel to inject php code to roundcube errors log file via LFI vulnerability? [closed]

i tried to inject php code to roundcube errors log file, with no success. i think there is something filtering injected php code.
1
vote
0answers
312 views

Is there any more attacking points for this server? [closed]

Here is my situation: I already compromised the webserver. I want to attack the database server which has a IP of 192.168.100.2 which is a network that cannot be reach from outside. Through pivoting, ...
1
vote
0answers
191 views

Recomended hash algorithm [duplicate]

Possible Duplicate: How to securely hash passwords? Do any security experts recommend bcrypt for password storage? What would you choose between: PBKDF2 SHA256 (270,000 iterations) ...
1
vote
0answers
35 views

What is the smallest possible Windows shellcode? [duplicate]

Possible Duplicate: Are there any tools that focus on shellcode analysis? Any tools available that is for shellcode analysis? what methods are used in reverse engineering?
1
vote
0answers
106 views

Turn Binary Data into Airborne Packets? [closed]

Are there any software libraries and/or wireless drivers that make it possible to turn a sequence of binary data into a wireless packet in the air? For example, if someone used Airpcap/Wireshark to ...
1
vote
1answer
750 views

Apache mod_rewrite vulnerability

The public exploits of apache mod_rewrite asks for the rewrite path in order to work, and I am unsure what the rewrite path is referring to. What should I supply in rewrite path?
1
vote
0answers
179 views

What are potential use cases of script that identifies browser? [closed]

Let's say I've found a way to produce a unique string for each and every browser using pure Javascript (which makes it an alternative to UA strings). Now what I'd like to know is what are potential ...
1
vote
0answers
123 views

What's the deal with SMS archiving? [closed]

The other week I was texting a friend of mine, and something happened that I haven't experienced before. Instead of receiving the text I'd just sent, my friend received a text I sent several months ...
1
vote
1answer
954 views

on stack execution on windows 7 :: metasploit :: meterpreter :: executable crypter

I posted this on stackoverflow, was advised to move it to security section. I was writing an executable crypter as an exercise with goal of Antivirus evasion, now the problem is the final executable ...
1
vote
0answers
263 views

Honeypot for catching a spammer [closed]

I've been receiving more and more emails and now even TXT messages originating from google voice for inquiries of items that I've listed for sale on craigslist. What I would like to accomplish: I ...
1
vote
0answers
101 views

What category of security measures are required by popular regulations? [closed]

There's a few very popular regulations, HIPAA, SOX, PCI-DSS, PII, ITAR, GLBA. Can anyone explain what are their exact security implications? Exactly what type of implementations would my organization ...
1
vote
0answers
220 views

OpenPGP CFB mode examples [closed]

Does anyone know where to get worked out examples of OpenPGP's CFB mode encryption? I know RFC 4880 explains it very precisely, but I managed to mess it up somehow. I got one example from asking on ...
1
vote
0answers
325 views

what is this hash type? [closed]

Actually I have this hash but I don't know what cryptographic hash function generated it. 4753305A7A673D7A5A442156 I know password is 12345678 I extracted this pass from PLC device Mitsubishi
1
vote
0answers
234 views

AD authentication with high amount of ICMP traffic [closed]

We have an IPS in place and it's constantly triggering ICMP / Ping flood signatures between workstations and AD server; or AD to workstation. I understand that ICMP is used for AD authentication. ...
1
vote
0answers
32 views

What is Penetration Testing? [duplicate]

Possible Duplicate: What is the difference between a penetration test and a vulnerability assessment? What is Penetration Testing? When a security professional throws around these words, ...
1
vote
0answers
1k views

SIEM-AlienVault; Risk Metrics, Assets, and basics [closed]

Been trying for a week now to get AlienVault (referred to as AV hereon) running with little success. I've gone through 2 installs so far. First time messing with SIEM, though have very limited ...
1
vote
1answer
2k views

Backtrack 5 R2 & Metasploitable

I have configured the OpenVAS server as per wiki instructions: http://www.backtrack-linux.org/wiki/index.php/OpenVas And i ran the following commands: msfconsole load openvas openvas_connect admin ...
1
vote
0answers
349 views

making a start in finding exploits [closed]

I am a thorough newbie in computer security but the Google chrome exploit reward has gotten me interested in computer security and I would like to know what is an ideal starting point for one ...
1
vote
2answers
590 views

What are best practices for implementing Remote Desktop within a corporation?

After the recent critical vulnerability: 'MS12-020: Vulnerabilities in Remote Desktop could allow remote code execution' I have been looking for a hardening checklist or in the scenario that I am an ...
1
vote
0answers
57 views

How often should an SSH key pair be changed? [duplicate]

Possible Duplicate: How often should an SSH key pair be changed? I've been using a passphrase-protected 1024-bit RSA key for passwordless SSH via ssh-agent between my own systems for years. ...
1
vote
0answers
143 views

Recover Word file password [closed]

I have a Word (.doc) file that I created a long time ago I believe in a Windows XP. The problem is I don't remember the password anymore and need to access the file. What would you recommend I do? I ...
1
vote
1answer
837 views

Is using the same RSA key pair for both (signing and encryption) & (signing and encryption) a bad idea? [duplicate]

Possible Duplicate: Why should one not use the same asymmetric key for encryption as they do for signing? I'm new to IT Security. I still can't figure out why using the same RSA key pair ...
1
vote
2answers
903 views

What is the disadvantages of storing user role including admin in a session variable?

In my projects I always fetch roles from DB and store them in a session variable, then to check If a user has access to admin pages I just check the session. Let's consider I use a private hosting ...
1
vote
0answers
194 views

Hidden Registry Strings - possible rootkit? [closed]

Win server 2003 R2 SP2 - no noticeable issues on the machine. When I create new strings in regedit, I hit refresh and they are gone! I try to re-add and it complains the string already exists. I am ...
1
vote
1answer
432 views

How am I able to use Input Director when one machine is VPN'd into work?

So - I don't actually have a problem, but I'm really curious, because apparently VPN's don't work the way I thought they did. It was my impression that when I VPN into my office, my computer is ...
1
vote
0answers
196 views

Entry-level jobs for IT risk management? [Security guard v. data entry?] [closed]

E IT Security community, I was wondering if you could offer me recommendations on kick-starting my career in IT and information security. As it stands, I'm more interested in the non-technical side ...
1
vote
0answers
320 views

Any suggestion for a good readerless smart card (security token) solution? [closed]

I'm developing a small CRM application that will have to store some sensitive data and I would like to (optionally) supply my users with the possibility to use a readerless smart card (aka "security ...
1
vote
0answers
277 views

Unauthorised Perl Scripts [closed]

One of my servers just had the memory exhausted by a load of Perl scripts, we use plesk and they seem to have appeared under the /var/www/vhosts/domainexample.com/cgi-bin/ directory, I managed to stop ...
1
vote
0answers
659 views

A proposal for Data Transmission and Password Encryption [closed]

I need to implement a sensitive data protection scheme which can meet the requirements on secure data transmission, protection and storage, assuming mutually trusted third party is not available, that ...
1
vote
0answers
354 views

NetSec/InfoSec position salary expectation and negotiation [closed]

I'm about to receive an offer for a position of "Security developer / Pen-tester" that I have been interviewing for. The firm is moderately sized and as some very big clients, so in terms of cost vs. ...
1
vote
1answer
427 views

Incident database? [duplicate]

Possible Duplicate: Resources for data on security incidents Do you know any websites where they put Information about Security Incidents that happened to organizations/people (e.g. ...
1
vote
0answers
73 views

Is there a way to detect and extract steganographically hidden data from a picture? [duplicate]

Possible Duplicate: Detecting Steganography in images Is there a way to detect and extract hidden data from picture which altered by steganography? For example, If someone tried to spill ...
1
vote
0answers
178 views

How anonymous used UTF-16 ASCII to fool PHP escaping [duplicate]

Possible Duplicate: How anonymous used UTF-16 ASCII to fool PHP escaping (Reposted here as per request). A few months ago, anonymous took down a child pornography site using SQL-injection. ...
1
vote
0answers
246 views

What is the best way to manage temporary accounts on Active Directory [closed]

The organisation i work for has a high turnover of staff and we have a 5 day SLA to set up a new user. However this seems to be inefficient for ourselves and the business we serve. Is there anyway ...
1
vote
0answers
203 views

How Do I Secure Apache Web Server [duplicate]

Possible Duplicate: Apache Server Hardening I'm going to make a web server on Apache 2. What are the security issue I will be looking at? And how do I secure it? I have been reading news ...
1
vote
0answers
103 views

What are the major security concerns in cloud computing? [duplicate]

Possible Duplicate: What are security issues which are specific to cloud computing? What are the major security concerns in cloud computing? From the point of view of a user that is using ...
1
vote
0answers
164 views

Are there any instant messaging systems that offer resistance to traffic analysis? [closed]

I'm happily using off-the-record messaging now, but I'd enjoy exploring more traffic analysis resistant options? It appears the most visible ones like Tor chat are rather stagnant, or at least don't ...
1
vote
0answers
65 views

References on encryption in enterprise settings [duplicate]

Possible Duplicate: Enterprise Encryption Considerations I'm making a document on enterprise security. I'm looking for references and inspiration on the following topics: Enterprise ...
1
vote
2answers
739 views

Strange Event Log Entry - Windows Server 2008

Reviewing some logs recently, and came across a strange failure in our Windows 2008 DC. An account failed to log on. Subject: Security ID: NULL SID Account Name: ...
1
vote
1answer
240 views

Can we protect domain name by law? [closed]

Some company have domain names worth a million dollar. But sometime they are lost to hackers. So I wonder how can we protect domains by law instead of technology?
1
vote
0answers
383 views

PF NFS Firewall Issue [closed]

I have a question about NFS and PF (freebsd). I know that NFS uses both TCP and UDP to connect to the client along with a bunch of daemons that use random port numbers. Both the NFS server and ...
1
vote
1answer
235 views

Working of WAF/IDS/IPS payload normalization schemes?

I want to know how WAF/IDS/IPS deals with Payload Transformations. Such payload transformations may be base64Encode html EntityDecode url Encode Remove whitespaces I want to know how WAF/IDS/IPS ...
1
vote
0answers
312 views

Best way to get “into the security industry”? [duplicate]

Possible Duplicate: What are the career paths in the computer security field? I've been called a "jack of all trades" guy, who has been working in health care and finance for about seven ...
1
vote
1answer
44 views

Are there any ways to defraud a fundraising site?

I have developed a many e-commerce stores for clients over the years; almost all of them selling physical products. Recently, one client in particular was repeatedly getting hit with fraudulent ...
1
vote
2answers
79 views

Is It Good or Bad Practice to Fake User Agent

I'm using a browser on Mobile. I found a program that can fake my User Agent (UA), so I changed to something else. Is this good practice or bad practice in terms of preserving privacy? The way I ...
1
vote
5answers
68 views

Does services provided by different companies for DDoS protection work well?

Is it necessary to use any DDoS service provided by different web hosting provider and other people? We know, they are running their business to provide security to thousands of web property. They are ...

15 30 50 per page