0
votes
1answer
2k views

Why is /dev/random so slow on Linux? [duplicate]

If it's true you only need about 128 bits of entropy to fuel enough data forever, why is it that /dev/random is so slow? My system has uptime of 214 days! Is it really only gathering .000000001 bits ...
0
votes
2answers
600 views

Is it illegal to use Fake User-agents? [closed]

Is it illegal to impersonate user-agents when you are crawling a website? If so, what and how a legal action can be taken against the faking requester? Is this law applies only for crawlers or a user ...
0
votes
1answer
159 views

how secure is an iPhone 4S+ with iOS 6+ in 2013?

I was searching for the current status of iPhone security: there are many discussions on the subject but a lot of them are mostly hand-waving or related to old bugs/iOS weaknesses. How secure an ...
0
votes
3answers
950 views

Elaborate Hacking attempt detected - now what?

I am in the process of developing a php/mysql based web application. I took the complicated route and rather than to use a framework or anything I built the entire foundation of my app from scratch. ...
0
votes
1answer
462 views

Challenge, Authentication and session key

I programmed an application on Linux using C, I added an authentication and cryptography layer that's going like this : 1 -client sends connection request. -server send a random challenge to client. ...
0
votes
1answer
396 views

Does RSA encryption always pad small amounts of data to some larger size?

If I encrypt 160 bits (20 bytes) of data using an RSA 1024 private key, will the result always be 128 bytes? This seems to be the case in my experiements, but I want to be sure. For example, ...
0
votes
2answers
130 views

Are there any obvious flaws in this anonymous-receiver communication method using Twitter?

There might be flaws in the following method for anonymous signal reception that I'm not seeing: Alice doesn't know who Bob is. Bob wants to Alice to notify Bob of a particular outcome without ...
0
votes
1answer
165 views

Average user reaction to SSL certificate error pages [closed]

With the attack on Twitter's whois information today, I got into a bit of an argument about whether or not the SSL certificate error messages that web browsers have will actually do any good to ...
0
votes
2answers
4k views

Windows user: Is having many active TCP connections normal?

Is this normal? Can any ports be "dangerous"? I have 9 tcp's in a listening state, 4 in a close_wait state, and 4 in an established state. Some of them route to odd procceses using PID such as ...
0
votes
2answers
995 views

Bank Fraud Deposit

My daughter just discovered yesterday that a wire transfer of $12K had been made to her checking acct. at Chase. It said it came from a Wells Fargo in NY in the name of some name she didn't ...
0
votes
2answers
664 views

What are other channels Botnets can use for command and control except IRC

What command and control channels might a botnet use? Which would be most effective? I found good info on IRC, what are other possibilities? (Exam preparation - no harm intended :-) )
0
votes
1answer
395 views

Would adding root to a group open a security hole? [closed]

I have a server for which I have created a cron job "sendalerts" to users. Mind you this "sendalerts.php" should be runnable from two methods (via browser and also via a cron job) So cron's job is to ...
0
votes
3answers
2k views

Is there a generic list of IT Risks that can be used as a reference to prepare an IT Risk Assessment report? [closed]

I am working on my first IT Risk Assessment assignment and even though I have the steps required and understanding of the system I am working on, I was wondering if there was a list of generic IT Risk ...
0
votes
1answer
106 views

Is this HIPAA-protected health information?

We're developing an online events calendar for a senior assisted-living facility.They want to record, in the system, the names of facility residents who attend each event. There would be no other ...
0
votes
1answer
595 views

Splitting up symmetric key to be able to encrypt using 1024 bit RSA public key

The application which I am writing generates a 256 bit symmetric key everytime it wants to communicate with the server and encrypts the data and sends it to the server. This is to avoid storing the ...
0
votes
1answer
778 views

Ways to protect source code from theft [duplicate]

I just want to know better ways to protect source code from theft on Windows by Removable Devices like CD,Pendrive. Here is what I know: Windows Disk Encryption: Pretty nice to protect from offline ...
0
votes
2answers
4k views

What would a hacker do if he got your router password over the internet? [duplicate]

I was wondering!! I like configuring my router so that I can access it over the Internet even when am not home. What are the most critical risks if a hacker got my router password?
0
votes
1answer
1k views

Tracing nuisance or malicious cellphone calls

Is it possible for an ordinary citizen to trace source of nuisance calls to cell phone when caller ID has been blocked?
0
votes
3answers
1k views

SSL vs TLS, which is less vulnerable to DOS attacks?

When I learned TLS does not allow a connection to be created until it is has finished a secure handshake, i figured that would make it better for preventing DoS attacks. However, all I seem to find ...
0
votes
2answers
2k views

Why store the password salt instead of generating it? [duplicate]

So, reading through this article: http://crackstation.net/hashing-security.htm it says that storing the salt is fine in plain text because it renders the lookup/rainbow tables ineffective. I get that, ...
0
votes
1answer
1k views

What triggers a firewall to block a TCP socket?

I was wondering what would cause a firewall to block a TCP Java socket from connecting. What would trigger that?
0
votes
3answers
162 views

Security concept [closed]

How do we know that the systems that we are using are secure? At what point do we have to audit the software that we use? How do unknown security threats affect software over time?
0
votes
1answer
87 views

Security comparisons between two approaches: how to distinguish FUD from Substance? [closed]

Background: WorkerB and Tymac were discussing the pros-and-cons of using two different alternatives for extending a web content management system that is used in their company. Alternative one ...
0
votes
2answers
1k views

Why can't the police/government shut down black market websites? [duplicate]

I've been told that black market websites that have pretty much every drug, guns and all sorts of illegal things for sale don't actually exist on the internet, and I was then told some lengthy ...
0
votes
2answers
290 views

openssl EVP_aes_256_gcm - what's inside?

I have been reading about encrypting and authentication. Traveled the path from home made authentication to encrypt-then-mac approach and finally settled on GCM mode. I am curious what resided inside ...
0
votes
2answers
140 views

Why is S/MIME (instead of PGP) recommended for such an scenario?

A large MNC with approximately 50,000 employees, and with offices in Asia, Europe and North America. This MNC operates its own PKI environment, with a self-signed Certificate Authority based at its ...
0
votes
2answers
5k views

What is the meaning of .ini file in startup folder?

Now my windows 7 is too slow and crashing usually. I checked the start up folder. I get a file with extension .ini. The content of file is [.ShellClassInfo] ...
0
votes
1answer
873 views

Can I ensure that a public key derived from a private key is unique?

In asymmetric cryptography, is it possible to ensure that public key derived from a given private key is unique, no matter the algorithm?
0
votes
2answers
163 views

How can I encrypt something user provided without risk of the key being exposed?

So, let's say I have a theoretical service. User has some text they want to encrypt. They pass it to me, and I encrypt it. Then, only I should be able to decrypt it afterwards. Another kicker, it must ...
0
votes
4answers
612 views

Dynamic tools to detect vulnerabilities in software applications written in c?

I am doing a project on detecting vulnerabilities in Windows 7/8 for software applications. Some of which some have source code available and some do not. Please suggest some technique that can help ...
0
votes
3answers
190 views

What day-to-day activities can compromise a person's information security [closed]

Recently a car was stopped next to me at the traffic lights. The driver had his phone connected to the car's bluetooth and the conversation could be heard by me crystal clear in the next car - the ...
0
votes
2answers
304 views

Suscpicious registry entry

In HKEY_USERS\S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxx\Software\Microsof\TATrial and HKEY_LOCAL_MACHINE\SOFTWARE\Microsof\TATrial there are entries Default (no value set) InstallDate (733998) ...
0
votes
3answers
82 views

Is there a way to make changes to a virtual machine, test it out, and automatically make same changes to normal machine?

Is there a way to install programs and make changes to a virtual machine and if they work ok have them applied to the "actual" machine? For example in this question when fiasco_averted says "...only ...
0
votes
3answers
775 views

How can this xss challenge be solved? [closed]

I found this : http://research.insecurelabs.org/xssmas/ And so far my solutions were: 1.http://research.insecurelabs.org/xssmas/search.php?query=<script>alert(0)</script> 2. ...
0
votes
2answers
1k views

CSRF over post request without redirection?

Is there a way to forge post request without being redirected to the page where parameters are submitted.For example : <html> <head> <title> CRSF example </title> ...
0
votes
1answer
481 views

is it OK to grant permission for IUSR_ to cmd.exe?

One of my developers asked me to grant permission to IUSR_ user (the IIS user) to CMD.exe (console) now I'm wondering is it safe to do it? He is complaing, that his libraries had to use console for ...
0
votes
3answers
4k views

WHM server hacked, lost root access [closed]

I have a huge problem. In a nut shell, 2 days ago I noted a strange process going on with httpd, something I never saw before. That then led to me googling it, and OVH came up top with "Examples of a ...
0
votes
2answers
116 views

API - How can I make sure data sent by the user is only sent to my application?

I have an API and a web application where users can login through another system and then post text messages to my application, for example. How can I assure that when this data is only posted to my ...
0
votes
2answers
533 views

Any open source software firewall with country based ip blocking feature? [closed]

I am looking for an open source firewall with country based ip blocking feature for Linux OS.
0
votes
3answers
232 views

Using remote desktop

I was having trouble getting Outlook to work with my schools email account and called the help desk. They gave me a link to install a program called Bomgar. I installed it and clicked "allow viewing ...
0
votes
1answer
710 views

scanning my site for JavaScript/XSS vulnerabilities [closed]

It have had a report that my site may have a security issue and there is some JavaScript loading 10 times per second. www.ayrshireminis.com Is there anyway that I can "scan" my site to check if ...
0
votes
1answer
484 views

How securely use Firefox Add-on to prevent steal data?

Some videos on YouTube demonstrate how a Firefox extension can collect login information used to login to websites such as Facebook. After installing this tool/malware as Firefox Add-on, I observed ...
0
votes
1answer
487 views

Should I encrypt data on my server as an extra layer of protection?

I'm going to create a client-server application that stores a user's sensitive financial information on the server. I would like to encrypt this data so that even if a hacker gets access to the ...
0
votes
3answers
4k views

How to filter POST requests before they reach PHP on Apache?

I have done URL filtering with .htaccess (using learning and generator), however I am still concerned that any POST request can be submitted to the PHP even there is only one POST form on the website, ...
0
votes
2answers
77 views

Solution to site database [closed]

Our warehouse site desperately requires a database that runs efficiently, is secure and we can modify ourselves. Unfortunately the Company's policy does not allow any servers on site, only at ...
0
votes
1answer
762 views

Suspicious .exe set to run at startup: Determine if file exists still

When I open MSConfig and look at all the applications set to run on startup there is a suspicious file set to run at startup. I have disabled the .exe to not run at startup but I want to delete the ...
0
votes
2answers
1k views

Is there any good open source software for Security Risk Analysis?

Is there any good open source software for Security Risk Analysis? for example something like one explained on : http://www.security-risk-analysis.com/introduction.htm
0
votes
1answer
1k views

More information about CVE-2012-0883 vulnerability

I need to have more details about CVE-2012-0883 vulnerability published on : http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0883 Second, I need to know , what mean DSos mentioned on the ...
0
votes
1answer
142 views

Tracing The Source Of IDS/IPS Alerts

This may be more of a routing question than a security one but I am asking for the reason of security. I monitor an IPS on a remote network and there have been high alerts triggered recently that ...
0
votes
1answer
2k views

Ban MAC address from website? [duplicate]

Possible Duplicate: Can I block based on Mac Address? I have a situation where I need to ban a MAC address from accessing my webserver. (Windows Web Server 2008 R2). Is this possible? P.S. ...

15 30 50 per page