2
votes
1answer
158 views

Send credentials by sms [duplicate]

If a user forgets his login credentials for a web site, is it secure enough to send users credentials by sms?
4
votes
1answer
317 views

Confidentiality without Encryption - A way to circumvent Internet censorship

Nowadays we see that countries like China and Iran detect and block all encrypted connections as a way to prevent their citizens from communicating over the Internet freely. Although encryption ...
3
votes
5answers
524 views

Blocking network access to host(s) at the kernel level in Linux?

Getting it out of the way: Not iptables! What I'd like to do is block network access to certain IPs, subnets, and/or hostnames at the Linux kernel level, such that no user, including root, could ...
3
votes
2answers
891 views

Is IP Forwarding a risk by itself?

A coworker claims that merely enabling IP_forwarding on a single homed Linux machine poses a security risk as he says it could then be used as a proxy. I can't think of how this would work, except ...
3
votes
1answer
342 views

How do you evaluate and audit Central Authentication Service (CAS)?

This is in reference to Jasig's CAS software and I'm looking for a checklist to audit the state of security of a CAS implementation. While the Jasig site has a lot of documentation and their mailing ...
8
votes
5answers
60k views

Bruteforce on 10 characters length WPA2 password

I'm trying to hack my own WPA2 network for learning purposes. I have the *.cap file generated by aircrack-ng tools after a WPA handshake. I've tested by including my own password and a bunch of ...
4
votes
2answers
1k views

I'm being followed on the web. Explanations for mysterious behavior

Am I being stalked? I was recently doing some basic Python development scripting. Python has a nice feature where it can run a simple HTTP server that serves the contents of the local directory, on ...
6
votes
1answer
747 views

Database encryption or filesystem encryption?

Recently I've been working on some data which, although not directly governed by any infosec laws, is sensitive enough to warrant being encrypted. I'm interested in finding out about best practises ...
8
votes
3answers
582 views

Why would a website allow answers to security questions to be used interchangeably?

I needed to reset my password on a website that uses security questions for the purpose, and I noticed something strange. My hypothetical security questions are (not the ones I actually use) are: ...
18
votes
5answers
3k views

How can a DoS attack be used as part of the 'Gaining Access' phase of a hack?

I'm doing some revision for an exam and I've made a note to look at how DoS attacks can be used to gain access to a system. I can't find anything online but I found a reference to the fact here. I ...
5
votes
1answer
195 views

Could a password hash that's prone to more collisions provide better overall security?

Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
4
votes
1answer
132 views

Is access to the caller API in mobile phones a real security threat?

From time-to-time I receive "Unknown" caller on my mobile phone. I do not want to answer those calls as I do not trust the identity of a caller. I feel safer if I can see caller name or at least ...
4
votes
3answers
376 views

The safest way to circumventing Iran's Internet censorship

We usually buy services like VPN, SOCKS, Kerio [Kerio Connect?]... to circumvent Iran's Internet censorship policy. Recently, one of the shops started selling [one of] Kerio's products, for which I do ...
3
votes
2answers
1k views

Example of malware that spreads via USB? [closed]

I'm messing with Mandiant Redline on Windows Server 2012 in a VM and I wanted to download a sample virus that spreads via USB and modify it to attack Mandiant Redline - I've never written malware ...
10
votes
4answers
7k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
6
votes
6answers
40k views

Company computer use from home - how much can they see on the desktop?

I have a company supplied computer that I use from home. I log into VPN (cisco AnyConnect) when i need to access company email or internal company sites. In the past the company has been able to ...
3
votes
3answers
2k views

Self Tests for cPanel Server PCI Compliance

(Edited & added more information at the bottom of this question) I've been tasked with "testing" a client's Linux web servers, running cPanel (which they own and mostly manage, until they come to ...
7
votes
2answers
2k views

Do the new instruction sets found on Intel's Haswell Architecture make any difference in cryptographic operations?

Intel's Haswell architecture has support for several new Bit Manipulation Instructions. In Intel's own words, Bit manipulation instructions are useful for compressed database, hashing , large ...
-7
votes
1answer
413 views

Is there a way to get Tor “for free”? (free as in time, not money)

I'm wondering if there's a way to get the functionality for Tor in Firefox (or my general OS) for "free", meaning that I spend 10 minutes setting up part of the functionality to work and skip the ...
2
votes
1answer
143 views

US Department of Labor Watering Hole Attack

So I read this article about how the US Department of Labor's website was compromised and users were redirect to a site that installed malware: ...
0
votes
3answers
2k views

How to effectively save database password inside desktop application?

Suppose we are in the field of desktop applications which need to store their data in a database. How do I store the password for this database avoiding the most obvious mistakes, which are: 1) hard ...
5
votes
1answer
307 views

Is the execution time for bcrypt independent of the length of the input string?

Is the execution time for bcrypt independent of the length of the input string? i.e. Should the execution time of bcrypt.hashpw('input_string', bcrypt.gensalt(12)) and ...
15
votes
1answer
82k views

How to figure out if someone has been using TeamViewer 8 to access my computer when I was not here?

I came to my computer today and have not been here since monday afternoon. I am using windows 7. There were some error messages showing even on the log in screen about memory violations done by ...
-1
votes
2answers
258 views

Why is RSA using fixed point type numbers?

Why does RSA use fixed-point numbers instead of floating-point? Are there too many floating-point implementations to choose from? Does fixed-point arithmetic increase the difficulty of factorization? ...
1
vote
2answers
491 views

Relationship between penetration testing and false positive results

I had read through several research papers that discussed the trend of existing automation scanners to produce false positive results. I also read through some articles that showing the manual ...
4
votes
4answers
6k views

How to remote monitor a computer network traffic?

I would like to know if it is possible to remote monitor the incoming and outcoming network traffic of a specific IP from my network. I need to log the time, ip numbers and port that contact the ...
8
votes
2answers
14k views

Encrypting using AES 256, do I need IV? [duplicate]

I'm looking into encrypting with AES using a 256bit key, and I notice that a number of methods in various languages, for instance http://php.net/manual/en/function.openssl-encrypt.php, and I notice ...
20
votes
3answers
11k views

What access does UK Police currently have to ISP logs, and what information can said logs provide?

I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
1
vote
1answer
2k views

How secure is my private key in the Windows Digital Certificate store?

Many files we download don't have digital signatures. Files may get infected or someone may intentionally modify them on our hard disk. So I wrote a simple file hashing program in c# that creates a ...
24
votes
1answer
10k views

High-frequency noise deterrents

I've found that walking past certain boutique stores in my city that some places have installed very loud high-frequency noise generators. These cause a fair amount of discomfort for passers by that ...
8
votes
1answer
471 views

Getting strange texts to an iPhone #PWD123456#00X

My dad is getting strange SMS texts to his iPhone 4 Some examples: #PWD123456#WHL003=2308480298 #PWD123456#WHL004=2398480389 #PWD123456#WHL002 #PWD123456#WHL002 #PWD123456#STATUS? ...
7
votes
1answer
1k views

Reconstructing bittorrent data from PCAP

I am doing a CTF flag for my school project with a PCAP flag based on this CTF write-up: eindbazen.net - Plaid CTF 2012 - Torrent I setup a local torrent file containing an .mp3 (the audio is my ...
4
votes
1answer
131 views

Security / logging on a Xen-based VPS instance?

Our company has a Xen-based instance on a VPS provider and we have some sensitive data stored on it. Is there a way for me to tell if/when employees of the hosting company have accessed my VPS (by ...
2
votes
2answers
255 views

Are these two ways safe?

I have two scenarios and want to know if each is secure or which risk there are. Number One: If the User has the edit Link (edit/[md5hash]) he can edit a post. The editkey (the hash) is in an form ...
5
votes
3answers
868 views

Online Payment Gateway Requirements

I have been looking at an online payment gateway, authorize.net, and specifically their Direct Post Method. This method would allow me to create a form on my server, then submit the post parameters ...
-1
votes
2answers
1k views

Allow embedded videos while keeping youtube blocked [closed]

Our organization has launched a training program for employees. the hosting server(internal), has YouTube videos embedded. we have YouTube blocked, and employees access the internet via proxy. How can ...
4
votes
3answers
174 views

Do email clients reduce security?

I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc. Afterwards I was thinking about the way that passwords are stored for ...
0
votes
2answers
157 views

How to know what domains other clients visit if I have no access to the router?

As a client computer, I am behind a router to which I have no access. Is it possible for me to know the domains or IP addresses that other clients visit? I want to know which clients often download ...
4
votes
1answer
830 views

How to interpret specific NIST 800-57 cryptoperiod advice?

We are uncertain how to interpret a specific piece of NIST 800-57 - to wit, how long a symmetric key cryptoperiod should be when originator usage and recipient usage begin concurrently. The short ...
42
votes
4answers
8k views

Is publishing your public IP address a security threat?

I work for a large-ish company (thousands of employees across multiple locations). I recently needed to know what the possible public IP addresses are, so that a vendor could identify us (presumably ...
92
votes
3answers
32k views

How does Google Authenticator work?

Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent. It works without any connectivity; it even works on plane mode. This ...
3
votes
1answer
354 views

How is the TLS protected against length field of the header being modified?

I know this question looks very silly, but, it has been bothering me for a while and I am unable to come up with an answer by myself. So, here it goes.. Packets in the TLS protocol consist of a 5 ...
5
votes
3answers
493 views

Can Penetration Testing be considered as a part of a Vulnerability Management Program?

Can Penetration Testing be considered as a part of an exhaustive Vulnerability Management program? P.S: I realise the difference between penetration testing and vulnerability assessment. But I want to ...
10
votes
4answers
3k views

How do proxy servers sniff data?

I live in a country which most website on the internet is blocked by government so we mostly use wide variety of proxies such Web proxies, VPN, SOCKS and most of them are free. My question is: Is ...
1
vote
3answers
851 views

Why one time passwords using nested hash chain are not used?

I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
5
votes
2answers
522 views

Masking password when typing vs hiding input when typing

There is a command-line application that interactively prompts you for your password to a third-party service. Whereas e.g. sudo completely hides your input as you type your password, this ...
11
votes
5answers
8k views

A standard way to manually add a digital signature to a pdf file?

I've created a few certificates to use myself, but I find myself stumped when it comes to creating a certificate which contains a digital signature. First, how would I go about creating a standard ...
0
votes
2answers
189 views

How to allow only the public key owner to submit requests to my site? And what is this type of security called?

This was probably asked many times here, but I'm not finding any because I'm not sure what to look for. I'm developing a simple payment gateway, where partners (consumers) can submit requests so ...
2
votes
1answer
3k views

How does an offline CA revoke certificates?

If an RSA private key of a root CA is stored offline, how does it revoke certificates it signs? From looking at OpenSSL config the default_crl_days option seems to indicate that a CRL must be ...
3
votes
1answer
182 views

PHP - Serializing user inputs

My entropy gathering system works by serializing user inputs: $entropy=sha1(microtime().$pepper.$_SERVER['REMOTE_ADDR'].$_SERVER['REMOTE_PORT']. ...

15 30 50 per page