3
votes
1answer
548 views

My home PC was hacked and accessed my bank! Advice on next steps? [duplicate]

I recently setup a new Win8.1 PC while still working on my main development PC so it did not have all of the security tools that I usually install, e.g. malwarebytes, adaware, etc. Since it takes me a ...
2
votes
4answers
7k views

Does a TLS interception proxy present the user's browser with the end server's certificate?

I know that TLS (commonly but mistakenly called SSL) interception works by establishing two encrypted tunnels between a client and server, with the interception device (proxy) terminating both tunnels ...
0
votes
1answer
127 views

Encryption and Deniability

I have the following problem: Alice wants to send Bob a message such that Bob knows it is from Alice but at the same time he cannot prove that Alice send him this message. The solution I came up with,...
1
vote
1answer
37 views

service providers and web activity

It is good to know that ISP have legal boundaries for retaining a client's internet activity. Is it possible that individuals can hack the ISP and then have access to someone's web history activity?
4
votes
1answer
2k views

CakePHP Set-Cookie Response Header

I am familiar with the cakePHP cookie and session settings but I am unsure as to why (when analyzing through the Burp Proxy Suite I am finding 2 separate Set-Cookie responses: Set-Cookie: DropZone=...
2
votes
1answer
514 views

In Same Origin Policy, why are different protocols considered a security violation?

I can understand why content from different domains is considered to be unstrusted for the same origin policy. But, how can be content from diferent protocols from the same site/domain be dangerous? ...
5
votes
1answer
2k views

Best practice for data security on a web application

I read a couple articles on privacy/security but still cannot get a clear picture of the best practice to ensure that an attacker will not be able to access users' private information. For storing ...
2
votes
1answer
6k views

Creating Client Certificates

Consider an application where client certificates are to be used for authentication. The application web server requires SSL and client certificates for all users. In this case, it's IIS 7. I've used ...
5
votes
1answer
906 views

Is it safe to use the official Facebook apps in a public Wifi?

I know, that my login credentials are sent in clear text for every body to read, when I log into facebook without using https from my mobile phone's browser in an public / non encrypted wifi. And I ...
2
votes
1answer
224 views

Should police departments recommend the securit.leadsonline.com website as a secure place to store information about our valuables?

This is kind of a social engineering question -- my local law enforcement agency sent out this email today: Help us by keeping identifying information about your valuables safe and accessible – ...
0
votes
1answer
189 views

How does a CA add www and raw domain names to my cert when my CSR doesn't have them?

I'm in the process of buying an SSL cert, and I'm confused by this part: Many CAs say they'll add www. to your domain, so that e.g. if you buy a single-domain cert app.example.com, they'll also add ...
1
vote
0answers
3k views

Brute force on Hydra with non-ASCII usernames and passwords

I use Hydra with the Web-Form (Http-Post-Form); and I'm trying to use a list of Usernames when some of the nicks contain a letter ñ. For example I have the following account in my list: Username: ...
0
votes
1answer
234 views

Security against IP Spoofing without consulting network administrator

I was wondering that if there is a Local Area Network and one public IP,through which various clients connect(which have been allocated private IP's).Suppose one of the clients spoofs his IP to try to ...
1
vote
3answers
410 views

What additional mitigations are necessary due to “Continue where I left off”?

I work with sensitive sites that handle financial information, my code protects more than four billion pounds of assets. All of our sites have a logout button and in addition use HttpOnly, Secure, ...
0
votes
2answers
136 views

What influences the speed of rendered php page using encryption [closed]

I've built a web app which uses the openssl_private_decrypt() functions. The rendering of a page with 15 messages encrypted with these functions takes remarkely longer as the ones without. (3-4 times)...
0
votes
1answer
3k views

Can a firewall blocking a guest virtual machine secure the host?

I have searched up whether a host is safe from its guest, and generally, it is said that, aside from vendor security flaws, a guest that is infected can infect the host over a shared network. So, ...
1
vote
2answers
224 views

How to avoid log4j output external modification

I had a request to find a solution for making a log file secure from editing from the user (not root user) running the JBoss instance of an application (Linux environment) First idea I had is to use ...
1
vote
1answer
365 views

PCI DSS compliance for storing PAN and PII in multi-tenant environment

I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the ...
4
votes
3answers
2k views

Should login pages be cacheable?

I'm considering the relative benefits/disadvantages of making a login page cacheable. Note that here I'm referring to the page containing the form into which the user enters their username and ...
2
votes
0answers
453 views

My Home Phone is being used to place calls to fax numbers [closed]

We are using Verizon's Home Phone Connect as a replacement for our AT&T landline. The problem is that somebody is using our phone to make dozens of calls each day to a series of toll free numbers....
0
votes
4answers
504 views

Keeping TrueCrypt keyfiles in plain sight

If I create a TrueCrypt volume and secure it with a password and a keyfile, is there any way that someone who has access to my computer would be able to tell that the volume requires a keyfile to ...
2
votes
2answers
764 views

Ways to authenticate client with a server

I have an app that sends an encrypted message to the server, with the sender and recipient username attached. The usernames are each linked to a unique device ID that allows messages to be sent to ...
2
votes
2answers
231 views

Keyed-hashing a password with a hash of the password + salt as the key, is it safe?

I was looking at our authentication system which hashes passwords differently than I was taught. The salt is a constant byte array and it uses the password + the salt as a key for the password hashing ...
1
vote
4answers
4k views

Can one use IP-spoofing to anonymize DDOS attacks?

Since it is possible to fake the source-ip of an ip-package, is it also possible to anonymize DDOS-attacks?
-2
votes
1answer
818 views

Injected Images

I want to learn all about that. How can we inject code into an image? Is the code must be php? Or is javascript or HTML works too? How I find documentation about this article? I'm a newbie about ...
3
votes
6answers
21k views

Hardware USB Key to Reset Any Windows Password

This tool requires physical access of course, and there are many things you can do once you have physical access, but this peaked my curiosity. The tool in question: https://www.kickstarter.com/...
1
vote
0answers
107 views

Suppressing broadcast traffic in honeyd logs?

I'm trying to set up a honeyd system. How can I suppress the broadcast traffic seen by the outside interface, preferably without needing to resort to syslog filters? User subnet 192.168.20.0/24, ...
2
votes
2answers
132 views

Are OpenPGP Robot key signers useful?

I've been thinking about building a web-based keysigning robot. Mostly I want to do this to dip my toes back into working with PGP after quite a few years of ignoring it. The robot I have in mind ...
-1
votes
1answer
670 views

Potential damage of someone getting your online banking password [closed]

Does anyone have thoughts on the potential damage of your online banking account being hacked? I'm not sure what a person could actually do since I think they could really only pay my bills (adding a ...
-1
votes
2answers
202 views

Are there any mail services that don't store encryption keys?

According to this article => http://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/ Gmail doesn't store the encryption key. But Gmail reads whole of users' email for ...
2
votes
3answers
283 views

Digital signatures and truly validating what was actually agreed to

I am developing an application and part of signing up requires a user to sign a contract agreement of using the service. I have been reading around the subject for a few days, and I am fairly happy ...
1
vote
2answers
152 views

understanding the point of VPNs

I can't really understand the concept of VPNs, since we already have various secure transmission protocols. Isn't the point of VPNs that people using its 'channels' can send encrypted data to each ...
4
votes
1answer
3k views

HTTP Reverse Proxy: Correct way to do SSL to backend

If I have a HTTP reverse proxy that communicates with it's backends in an untrusted datacenter, or across datacenters, I would want to use HTTPS in the backend, as talked about here: Reverse Proxy ...
9
votes
3answers
897 views

How did the spammers get this address?

A few months ago I configured a test mail server on Amazon AWS, all legit. I used a new address to my catchall-domain (something similar to, but not exactly, test-config-aws-neptune-2014-08@my-domain....
3
votes
2answers
277 views

Building a web application security focused team

I work as an application architect at larger company that builds web applications using both .Net and Java technologies. These are sold to and accessed by other businesses (not consumers). We have ...
15
votes
1answer
743 views

Does Gibson's fingerprinting service add much additional security?

I just read this post and it proposes a method of storing SSL fingerprints online so that you can double check that your certificates have not been tampered with. But is it really relevant or useful? ...
1
vote
1answer
86 views

Is it possible to use AH in transport mode on an IPSec channel with mediation?

I understand that it's not possible to have Autentication Header with a regular NAT, because it messes with the IP header protected by AH. How about proxies? Do they change anything in the packet? ...
3
votes
4answers
1k views

Is it ever safe to skip server-side validations?

I am working on a web app with a sign up form like below. The validations are all done client side using http://formvalidator.net/. I am well aware that client-side validations can be bypassed, but I ...
0
votes
1answer
1k views

Possible ways of exploiting PHP register_globals [closed]

I have a PHP script that executes a bunch of commands to verify that a user is logged. if (( isset ($password) && $password!="" && auth($password,$hidden_password)==1) || (is_array($...
1
vote
0answers
50 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
3
votes
1answer
1k views

How to run a tor hidden service from home securely?

Another theoretical question about Tor: Imagine I am running a dissident web site as a hidden service. How can I reduce the chances that I get caught? Assume I am running the server from home, over a ...
0
votes
2answers
83 views

Encrypting user details

This isn't really language specific, but I'm wondering if anyone has any suggestions for a security model securely storing some user details in a way that could be accessed in an automated fashion. i....
2
votes
2answers
3k views

How to prevent user from recovering my iPhone data?

If I'm about to sell my iPhone 5, is there a way to make sure that the buyer won't be able to recover anything from my data? Both data that has been recently deleted and data that has been deleted ...
1
vote
3answers
756 views

Can be WiFi credentials obtained by autoconnection feature + a mimicking hotspot?

Mobile devices like smartphones and tablets have the feature to autoconnect to wireless networks of known name. The same is with laptops and other hardware using WPA2. Is it possible to: a. Obtain ...
0
votes
1answer
160 views

Adding plugin to meterpreter

I'm trying to add a meterpreter plugin, a = client.railgun.kernel32.GetLogicalDrives()["return"] # Math magic to convert the binary to letters drives = [] letters = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" (...
1
vote
2answers
1k views

Can I get a malware on Windows without administrative rights?

I'm a Linux user and I installed Windows recently, I need it for some software. I don't want to use any anti-malware programs, I don't plan on giving administrative rights to applications I don't ...
1
vote
2answers
194 views

Which exploit types does software diversity have a benefit against?

This classical paper of Paul van Oorschot: Revisiting Software Protection, mentions in section 3.4 that by employing software diversity "an exploit crafted to succeed on one instance will not ...
7
votes
5answers
8k views

Is dd-wrt generally more secure than manufacturer's firmware?

I have been advised to use dd-wrt, for richness of features and heightened security. The argument about security is that major manufacturers don't care much about the firmware, release with a lot of ...
2
votes
1answer
267 views

What features boost security for a home edge router?

I want to hide my home network behind a router and not worry about firewalls on internet-facing devices. Furthermore, one PC is going to be hosting some services, so I guess I need port forwarding as ...
0
votes
1answer
364 views

Building an VM with Vagrant and connecting with ssh+2FA to protect a bitcoin wallet?

I would like to try to build a Virtualbox image to use with Vagrant. This is the features: Login with SSH + 2FA (Google Auth) No X No internet connection Copy unsigned transaction, sign it and ...

15 30 50 per page