2
votes
1answer
2k views

Is HTTPS secure enough for important information? [duplicate]

Possible Duplicate: Does an established ssl connection mean a line is really secure For example, Amazon.com doesn't use HTTPS for the whole site, but only the login page. I know they are ...
2
votes
1answer
596 views

Best way to validate /etc/hosts from third party providers to avoid ads?

A lot of people use a huge /etc/hosts file to simply redirect ads and scam sites to 127.0.0.1. The interesting part about this approach is that you can have the same hosts on your tablet, your android ...
2
votes
1answer
177 views

How can I determine if a CA Cert can be used for DPI-SSL

I would like to know if a CA Cert I installed can be used to perform DPI-SSL decryption without my knowledge. Would there be any indication? Can you look at the cert properties to determine if it can ...
2
votes
1answer
968 views

Hosted Email Hacked, SQL injection maybe?

I have a hosted website using a free hosting service, I received an email this afternoon saying that I have been suspended because my account has been compromised. Basically, someone is using my ...
2
votes
1answer
546 views

Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?

There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there ...
2
votes
2answers
713 views

Code Signing: Change certificate attributes during renewal?

I'm quite new to code signing and could not find clear answers to the following general questions so far. It would be great if someone could clarify/explain the logic behind this and point me in the ...
2
votes
2answers
720 views

Does an equivalent for netconf exist in the Cisco ASA world?

I'm looking for a method to send instructions to a Cisco ASA without writing scripts to execute on the CLI over SSH. Cisco doesn't seem to support netconf or xml-pi on the physical ASAs (only their ...
2
votes
1answer
1k views

Is the mount manpage saying nosuid *is* secure, or is *not*?

I'm a bit confused about the description of nosuid in the mount manpage on this RedHat system I'm setting up: nosuid Do not allow set-user-identifier or set-group-identifier bits to take ...
2
votes
1answer
9k views

How to block all access to Akami deploy servers and Apple push servers?

I no longer blindly trust the numerous connections that occur at night and during the day that always go to "content" and "push" servers like: a23-33-37-54.deploy.akamaitechnologies.com st11p01st-...
2
votes
2answers
8k views

How to set up a user-friendly NAS encryption?

We recently installed one NAS drive (Buffalo LinkStation Pro Duo, LS-WVL, running the most recent Firmware version 1.6 to be precise) in our (small) company network. Currently, there is no encryption ...
2
votes
1answer
399 views

IDS/WAF scenario for 2 web servers

I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
2
votes
2answers
959 views

Low level attacks on WLAN/LAN connection while connected to VPN

Is it really secure to connect to a (well-secured) VPN server over an unencrypted WLAN connection (or maybe a hotel Ethernet)? I know, that there have been questions like this - but I'm not asking ...
2
votes
1answer
198 views

Is Creating a Restricted Database User in Microsoft SQL Server Decent Protocol

Forgive me for the heavy metaphor but it's a situation's complexity kind of goes over my head. Assume I'm Leonard Shelby (My short term memory only lasts 5 minutes). I'm a freelancer that reads ...
2
votes
1answer
4k views

Kik | WhatsApp - Encrypted? iOS / Android Message encryption tips [closed]

Kik says that their client is using ssl etc. But it's kind of hard to tell if the messages is actually encrypted between the devices. What i can understand is that they don't got device-to-device ...
2
votes
1answer
152 views

Curious about best start for autoresponding Certificate Authority (CA)

I am just getting started trying to implement some internal PKI ideas, where my app would need a cert to 'sign' messages. Since this is all completly internal, we have some degree of trust, and I ...
2
votes
3answers
410 views

What are some good references discussing the pros and cons of a company Wi-Fi network for personal use?

I am a software developer at a company that currently does not allow associates to use personal devices at work (ethernet and guest wi-fi alike). This makes it very hard to work on side projects (like ...
2
votes
1answer
825 views

Can /etc/passwd file be accessed on a cpanel shared hosting account?

Given standard server hardening was performed, can the /etc/passwd be accessed by a shared hosting account by using PHP or Perl scripts which is executed from the public_html of the shared account?
2
votes
1answer
3k views

Snort & Logging

I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me. I would like to use Snort to perform a trace, which, after it ends,...
2
votes
1answer
257 views

Chrome: Finding vulnerabilities using AddressSanitizer

I'm reading about AddressSanitizer, a tool that can be used to find memory bugs for Chrome (and other C/C++ software). I'm a little curious about what the process of using the tool involves: 1) Is it ...
2
votes
1answer
236 views

How does OpenID signature work without a shared key?

Following is my understanding - A third party app redirects to a an OP for authentication. Once the authentication is complete the OP redirects back to the third party app. It also sends back in ...
2
votes
1answer
87 views

Access Flags for Handles

The handles window in process Explorer has a column Access which supposedly determines the access rights of that particular handle. I am not able to get any documentation on how to read the flags and ...
2
votes
1answer
234 views

Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132?

NIST has released Special Publication 800-132: Recommendation for Password-Based Key Derivation which is meant for protection of stored data using encryption keys derived from user password. This ...
2
votes
1answer
164 views

Types of attacks outside of AppSec and Vendor-Specific Systems?

I'm reading up on the OWASP Top 10 for helping me defend my web app against common "app sec"-type attacks (SQL Injection, CSRF, etc.). And in a recent question I was prompted to not only use OWASP Top ...
2
votes
1answer
112 views

Ways to make it more difficult for data to be lifted from a website?

Assume for a moment that I run a public-facing website that hosts pictures and names of people in a "billboard" fashion (i.e. you do not have to register to view the information) and that my site ...
2
votes
2answers
155 views

Does the CVSS impact score correspond to probability?

From http://nvd.nist.gov/cvsseq2.htm, I noticed that the CVSS standard attributes the following impact values ​​for confidentiality, integrity and availability: 0 for none impact, 0.275 for ...
2
votes
1answer
848 views

Smart card compatible with Schlumberger (Gemalto) Cryptoflex 16K and USB reader

Another question related to previous ones A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? and About performance of Smard card for performing 3DES in a MD5 hash We need ...
2
votes
1answer
491 views

About performance of Smart card for performing 3DES in a MD5 hash

Another question related to previous, unanswered A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? Another alternative is to store the keys in a Smart card permanently ...
2
votes
1answer
722 views

Intepreting PE (Portable Executable) headers of suspicious malware files

I am starting up on malware analysis, and I am analyzing a file to see if it is packed or obfuscated. Using PEview I am examining the .text, .rdata and .data headers. I know that if there is a big ...
2
votes
1answer
491 views

CISSP Certification [duplicate]

Possible Duplicate: Good (preferably free) resource for CISSP practice questions I am currently reviewing and aiming for a CISSP certification on the fourth quarter of this year. I've been ...
2
votes
2answers
176 views

Security of asymmetrical decrypting proxy

I'm thinking about the safest possible way to store secure data (eg. Credit Card numbers) with a requirement of sending them in clear text to third party API (so hashing doesn't come into play). I've ...
2
votes
2answers
314 views

Domain and IP scoring

What kind of things would you check in a domain and IP scoring system? Which things are the most important? If I have a web site or web service, I would like to figure out a score for my visitor. If ...
2
votes
2answers
195 views

Using External Certificates on a network that doesn't permit outbound HTTP/S access

Some highly secure networks and DMZs prevent all communication to outside hosts. This can cause issues with validating externally signed data I can guess that issues with signature validation occur ...
2
votes
1answer
290 views

What's the benefit of using a specific implementation framework vs using the generic steps presented in most developed security frameworks?

Background Information: This post is for some research I’m working on for a course I’m taking at the University of Advancing Technology as a Network Security student. I’m researching some ...
2
votes
1answer
1k views

Classification of attacks in network specially in Snort IDS

What are the main classification of attacks in network and specially in Snort IDS?! Is it possible to power up the Snort by classifying the attack into for 5 main groups, for example; R2L, U2R etc. ...
2
votes
1answer
526 views

Authentication for a batch script

It seems amazing that there is no industry accepted best practice for this problem yet (or maybe just one I'm not aware of): What is the most secure way for a batch script, a program needing to ...
2
votes
2answers
2k views

Logging and Metrics for DEP, EMET, and Related Mitigations

Is it possible to collect metrics or generate alerts when one of EMET's suite of mitigations prevents code execution? Ideally I'd want to be able to collect and analyze data to support statements like,...
2
votes
1answer
489 views

Checking if Mod_Rewrite is Enabled Remotely

When pentesting it is useful to know when apache mod_rewrite is enabled. But when one comes across a web server that does not utilize PHP it is difficult to tell if mod_rewrite is enabled considering ...
2
votes
1answer
157 views

ISP security compared to enterprise

I've just started reading IT Security, and found some interesting reads on man-in-the-middle and different types of "attacks" that could be used by an enterprise to intercept communications on their ...
2
votes
1answer
379 views

Malicious(?) PHP / BASH Script. What is it?

I'm not sure if this is against the rules of the site. If it is, please let me know and I'll delete the question. I've seen variations of this script floating around recently. What the heck is it, ...
2
votes
2answers
652 views

How to investigate possible illegal access by a staff member to emails?

At work we use Outlook 2010 (I think) and an exchange server. The situation is simple: Our IT Manager (Steve) was fixing a problem one of the guys out in the field (Dave) was having with email on ...
2
votes
1answer
227 views

network improvements over ipsec

I have a specific environment in which TCP is not optimal due to its general assumptions, and thus needs to be improved. This small improvement has been done successfully. It operates at various ...
2
votes
1answer
280 views

How to estimate the number of entropy bits & search space of a signature system like passtouch?

Apologies if I'm using the wrong lexicon, I'm just reading up about password systems out of interest. After seeing the xkcd strip on passphrases and coming across the passtouch system (youtube demo) ...
2
votes
1answer
906 views

What attacks use enabled Apache's PATH_INFO?

In Tangled Web Michal Zalewski says: If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature. He gave only one example of this vulnerability. There ...
2
votes
1answer
584 views

Active Directory: Should Workstations be separated from servers to protect from related domain hacks?

How should I protect domain joined hosts in the same AD domain from the Related Domain Cookie Attack? Suppose there is an AD forest called example.com. This company has a variety of internal and ...
2
votes
1answer
1k views

Help in understanding a PHP exploit code found on a wordpress application

I've found this code in base 64 on all php files of one of my client's sites (wordpress) and I'm trying to understand what it does. I'm also trying to figure out if it was an application exploit or a ...
2
votes
1answer
406 views

Does iOS use built-in certificates to authenticate peers when using ipsec VPNs?

Suppose I am setting up an IPsec VPN for Apple iOS clients with the requirement that the iOS clients need to know that the server is legitimate and vice-versa. I create a root CA and issue a ...
2
votes
1answer
643 views

Large lan party : How to identify the users on the network?

I would like to know what are the good way to identify users on a large lan party when you manage network ? I had the idea to make the users register them self at a desk, they give us Firstname, ...
2
votes
1answer
211 views

Firewall Considerations with PGP Universal

The PGP Universal server is a fairly complex piece of work that provides several different services. When constructing firewall rules I am trying to determine what implications there are for opening ...
2
votes
2answers
447 views

Legal Risk to unpatched servers

Since one of the 10 domains on the CISSP is legal/governance, I figured this would be the best place to ask. I recently did a security assessment for a non-profit. I found that their systems needed ...
2
votes
1answer
3k views

Something causing Sonicwall to throw Smurf Amplification Attack Warning?

I set up a new laptop recently and, after installing various developer tools, it started causing our Sonicwall firewalls to issue an alert email whenever the laptop connected to the network. The ...

15 30 50 per page