3
votes
2answers
2k views

Truecrypt hidden partition deleted original drive data

Help! I created a hidden partition within a harddrive encrypted using truecrypt, and instead of creating a second partition, it seems to have deleted all of my data instead. what did i do wrong? I ...
5
votes
1answer
3k views

What are the security implications of enabling WINRM on all domain members?

As Powershell becomes more and more popular, it appears that using WINRM may end up being a better option than using PSEXEC from SysInternals for remote management. Given that WINRM is disabled by ...
5
votes
2answers
2k views

Frameworks or any Solutions for authentications/security/ login management in Java Web Applications

I am looking for a framework/solution for authentication/ user-login management/ security in java web application that can make the naive developer's job easier/faster and make the application ...
7
votes
7answers
1k views

Facebook account keeps getting hacked, can't seem to figure out why or how?

One of my mate, she has a lot of friends on Facebook, uses it for marketing. Her account keeps getting broken into. Her password gets reset and/or gets locked for changing resetting password too many ...
7
votes
4answers
2k views

Web browser password management security [duplicate]

Possible Duplicate: How are browser saved passwords vulnerable? How secure are the password managers that are built into modern web browsers? Currently I use lastpass plugin as I believed ...
2
votes
1answer
822 views

Zone elevation protection in Google Chrome

Internet Explorer has a security feature called "Zone Elevation Protection", in which sites outside a list of trusted sites (which can be configured) are not allowed to navigate to the ones on the ...
4
votes
1answer
676 views

Slow client key exchange in TLS?

I've been benchmarking my TLS performance, and I noticed that during the "write client key exchange" phase, there's significant overhead compared to all other actions. I'm wondering if there's ...
1
vote
4answers
230 views

Learning the role of intruder legally [duplicate]

Possible Duplicate: How can you become a competent web application security expert without breaking the law? I was reading this article earlier U.S. government hankers for hackers , and ...
65
votes
15answers
5k views

How to write an email regarding IT Security that will be read, and not ignored by the end user?

I've observed that several of our users are ignoring messages sent from IT Security managers, and also the system generated "You just sent a virus" notifications. The problem seems to be among people ...
11
votes
2answers
1k views

Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?

Going deeper into the previous question on Firefox plugins and add-ons malware risks: Could a Firefox add-on potentially decode and capture the encrypted websites' passwords saved in the browser?
1
vote
1answer
217 views

OSSEC New Install: Scan and analyse full log?

When OSSEC is installed and started, it starts analyzing configured logs starting the date it was installed. Is there a way to have it scan and analyze the full logs?
7
votes
5answers
2k views

Browsing on a USB OS (Linux) safe from malware?

Let's say I have a computer. It's a personal computer - the one you'd typically find in homes. In this scenario, it's running Windows XP SP3, although it could run 7, Vista, etc. I have a USB drive ...
1
vote
1answer
135 views

WebServices Security [closed]

Do we have any good resources on WebServices Security? Any book, pdfs, articles and even the detail answers regarding the securing web services would be appreciated.
17
votes
6answers
2k views

What are the security implications of people downloading addons, wrongly thinking that they are safe?

I recently learned about a plugin for Firefox called Fire Sheep, which was featured on the Security Now podcast. I downloaded F.S. and began examining it. To my surprise it includes C++ code that must ...
4
votes
2answers
181 views

What happens if a pro-censor ISP has Telex key(s)?

I've been watching more and more people jump on the idea of Telex as a way to prevent internet censorship (e.g. http://www.technologyreview.com/communications/38207/ -- not my comments at the bottom ...
7
votes
4answers
6k views

Testing clean urls with sqlmap

Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean? I know how to test my sites that have ...
18
votes
5answers
898 views

Is there any legal reason to save a cleartext password?

I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen. I asked her about this and she defended the ...
1
vote
5answers
314 views

Is there something similar to DNSBL's for protecting against forceful browsing?

I want to protect a couple of Apache webservers against forceful browsing. Lately there have been multiple scans querying for non-existent applications on them like phpMyAdmin, notably known for their ...
7
votes
8answers
872 views

Is the following authentication scheme secure?

I was trying to design an authentication system that would make it much harder to guess a password via brute force, and reduce the risk to a user if the hashed password was stolen through a snooping ...
0
votes
1answer
326 views

Wordpress online pharmacy hack? [duplicate]

Possible Duplicate: Protecting WordPress installations anybody knows how to protect your WordPress website from online pharmacy spam, even after deleting all spam files and deleting spam ...
5
votes
3answers
390 views

DHE exchange and client authentication

If a server has a known public key and a Diffie-Helman exchange is performed and signed by that key, is there any benefit to authenticating the client before establishing a secure channel instead of ...
11
votes
1answer
1k views

Native rsync protocol security

Is the native rsync protocol (port 873) secure? Does it encrypt data or credentials? I'm planning on using rsync to store encrypted files in the cloud, I'm wondering whatever the password is ...
11
votes
4answers
6k views

Looking for botnet IP address feeds to protect against DDoS

I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ...
2
votes
3answers
446 views

Security Implications of setting passwd as suid

When the passwd command is executed, it runs as the root user. Can't this be exploited? If not, why?
7
votes
2answers
328 views

Are there any independent organizations doing (publicly available) IT security research?

When looking up security risks on the net I find that all research being cited (if any is cited) always seems to come from the Anti-Malware companies. (just e.g., this article cites F-secure, AVG and ...
5
votes
2answers
337 views

Is cascading cryptographic algorithm better than using a single one?

Am I wrong to think that scrypt(bcrypt(password)) would be better than using sole (s|b)crypt? Especially when considering two different key for the two algorithms. I am also interested in some ...
7
votes
3answers
698 views

Remote return into libc attack

It is often shown that non-executable data segemnts are possible to bypass through return-to-libc attacks. It's evident on /bin/sh but is it also possible to invoke a remote shell?
17
votes
5answers
3k views

How to detect “forged” SSL certificates from the webserver end

The company I work for sometimes intercepts employees ssl connections to https websites by making the ssl connection on their behalf from a proxy, and then using the own generated certificate to send ...
35
votes
3answers
2k views

Am I wrong to believe that passwords should never be recoverable (one way hash)?

I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
0
votes
0answers
79 views

Pages restricted to certain IPs, safe? [duplicate]

Possible Duplicate: In what scenarios is relying on source IP address as a security control acceptable/unacceptable? If a website has a page which only renders for certain IPs, is there ...
14
votes
6answers
4k views

Are some uncommon TCP ports scanned less than others?

Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the ...
5
votes
2answers
1k views

How do you exploit Directory Traversal to traverse from one drive/share to another?

I'm trying to figure out if it is possible to traverse across drives or shares. If I have a path that is concatenated in a web application, where the prefix is a drive, such as this: var path = ...
7
votes
6answers
1k views

Secure Internet Polling

In the United States, there has been a lot of talk about creating a secure polling system that would operate over the internet. I have also heard that Securing a poll over the Internet is impossible. ...
-2
votes
11answers
4k views

Do we really need an antivirus? if yes, what for? And how do they activate and enter in a PC?

I've been reading on various sites how PC get infected by viruses and I got: Email attachments (but of course, only if I get an exe and open or execute something, right?) Don't update windows ...
11
votes
2answers
270 views

security implications of NULL dereference

Suppose we have code like this: struct somedata { int a; int b; }; struct somedata *data; /* ... */ data = malloc(sizeof(struct somedata)); data->a = something; Now, as you can see, NULL ...
2
votes
2answers
2k views

DUKPT - Sample data other then in X9.24

I wrote some code that does PIN encryption/decryption according to rules in X9.24. It works great with examples provided in ANSI doc, but doesn't work with actual device from the client. Where can I ...
22
votes
1answer
2k views

Has anyone achieved PCI compliance on AWS?

All the FAQs, documents and statements published by AWS aside, did any Level 1 merchant or service provider actually achieve PCI compliance on AWS yet? We're evaluating moving some of our services to ...
44
votes
8answers
11k views

How can I reliably erase all information on a hard drive?

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also. Methods for flash drives ...
6
votes
2answers
2k views

Is Access Control Through MAC ADDRESS a practical/secure solution

I run a small local gaming website with a custom admin panel I coded to let trusted members do administrative tasks through the software's API. Since their IP Address is dynamic, can I authenticate ...
13
votes
8answers
4k views

Is Steganography a safe method to store secret data?

I want to put some parts of my secret data into specific file with Steganography method. Is this method as safe as other encryption methods like RSA or SHA?
3
votes
2answers
313 views

Building a security framework

I know there are many security frameworks and "building" a security framework is a bad idea. In the recent project I have worked on, I used spring security to secure the web application. In the ...
8
votes
7answers
345 views

Aren't permanantly logged in accounts inherently insecure?

The basic premise behind a "keep me logged in until I log out" feature is a cookie is stored with some identifier that is used to log the user in again when returning to the site. While these ...
2
votes
2answers
437 views

Security Risks Involved in Deploying Win Server 2008 on a Linux host

The Question: Are there any major security risks I should be concerned about, caused by installing Windows Server 2008 R2 onto a Linux Host in VirtualBox? I run an Ubuntu box, with a fully-secured ...
5
votes
1answer
238 views

Using AD authentication in a publicly accessible webapp

I am sys admin working with a development team who is extending a publically accessible .net web app that currently uses forms authentication with usernames/passwords (hashed) stored in a sql ...
13
votes
4answers
2k views

Recommendations for Changing the Default Shell For Service Accounts

It seems as if most Linux systems use either /sbin/nologin or /bin/false as the default shell for service accounts. Many hardening guides, such as CIS benchmarks, recommend changing the default shell ...
4
votes
1answer
287 views

Distance Education Programs in Digital Forensics

I am looking for a distance education program with the end product being a Masters of Science in Digital Forensics. I looked through the site and did not find any results, and was hoping since most ...
1
vote
0answers
310 views

Best way to get “into the security industry”? [duplicate]

Possible Duplicate: What are the career paths in the computer security field? I've been called a "jack of all trades" guy, who has been working in health care and finance for about seven ...
4
votes
3answers
391 views

Locking down web-based admin areas with personal SSL certificates

I've been tasked to setup a secure platform, where I've been asked to assign personal SSL certificates to administrators, and have the server only allow persons into the administration areas that have ...
44
votes
9answers
7k views

I just discovered major security flaws in my web store?

A little background info here: I'm a self-taught web developer with very little experience outside of html/css, and the company I work for has hired a third party web development team to design us an ...
7
votes
2answers
4k views

Why limit passwords to ascii printable characters? [duplicate]

Possible Duplicate: Do non-keyboard characters make my password less susceptible to brute forcing? Every article on password security that I read tells people to make the password more ...

15 30 50 per page