4
votes
2answers
614 views

Protecting data on a laptop with linux

I'd like to keep some private data (photos, notes, ...) and my browsing data hidden. The rest is not so important. Most of the time I just put the laptop to sleep and don't shut it down often, making ...
2
votes
2answers
908 views

C# Encrypting string in DES 3 CBC mode

Is it normal that when I use Double DES secret key to encrypt a string in DES3 CBC mode then I always get the same cipher text? For testing I'm using IVC=0.
8
votes
4answers
2k views

Is forcing users to change passwords useful?

In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively ...
6
votes
5answers
2k views

Penetration testing by ethical Hackers/Crackers should be trusted?

My question today come from my homework question from class ethics in IT. Our question states roughly that I'm IT guy in in big company and I am asked to hire few hackers to to find vulnerabilities ...
7
votes
3answers
231 views

Disclosing security vulnerabilities to paying customers first

Particular case An (unnamed) vendor of an open source product also sells commercial licenses and support. One of the advantages of the commercial deal is that you get notified of security ...
47
votes
8answers
5k views

Online backup : how could encryption and de-duplication be compatible?

A "soon to enter beta" online backup service, Bitcasa, claims to have both de-duplication (you don't backup something already in the cloud) and client side encryption. ...
2
votes
1answer
1k views

folder and file permission shared host advice

I have a website with a webhost company. I wrote a little php/mysql application - no file uploads, just administering data from the DB and creating pdf with TCPDF. There are folders like css and js ...
5
votes
3answers
3k views

How can I protect my saved passwords in Chrome?

I'm currently using WIN+L, and sometimes Kid-Key-Lock, to prevent anyone from checking my storaged passwords but if I forget doing it only once, all of them are vulnerable of theft. How can I protect ...
4
votes
3answers
225 views

There's a lot of spam, and hacked sites are often used to distribute it [duplicate]

Possible Duplicate: What are common/official methods of reporting spam/phishing/nasty-grams to organizations? My production application receives a lot of emails and I can easily detect spam ...
13
votes
1answer
852 views

Are there Linux rootkits circulating that directly modify the kernel (without modules)?

It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
50
votes
12answers
10k views

What to do about websites that store plain text passwords

I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
2
votes
1answer
377 views

Security reason why one should upgrade old web server to modern Java EE Web Application Server

Currently the company I work for uses Sun Java System Web Server 6.1 SP9 and Java 1.4.2. I know this version of Java reached its EOSL around 2008. The Sun Server still seems to be supported but it's ...
5
votes
3answers
1k views

What is the difference between encrypted data and data sent through an encrypted tunnel

I am looking at different VPN protocols. [1] L2TP does not provide encryption so require IPSec to encrypt the data [2] IPSec tunnel provide encryption to the tunnel What is the difference in terms ...
2
votes
1answer
2k views

Can the following .htaccess rules prevent this attack?

See these related questions from the same user about the same incident first: How to find and protect against the exploited vulnerability in an PHP application based on the logged URL? ...
1
vote
1answer
567 views

Android application level encryption cracking

We come across Android applications which use the custom encryption. When we proxy the Android phone or emulator, the proxy captures traffic which is unreadable. Is there a known technique to read ...
11
votes
3answers
1k views

Carrying out a professional IT audit procedure

I'm a new masters graduate and I need to find out how to carry out an IT audit professionally. What software tools are required and what are the specific topics I need to cover? Please point me in the ...
8
votes
6answers
1k views

when is it safe to click through an SSL warning message?

How does a user know if it's safe to click through scary browser warnings about SSL certificates? Ideally, a user should never need to click through these warning messages, but sometimes honest ...
7
votes
1answer
4k views

Do I really need all these Certificate Authorities in my browser or in my keychain?

There are lots of strange looking Certificate Authorities in my keychain as well as Firefox. I am sure they are legitimate CAs (as they are the same on my Mac and PC and other computers I checked). ...
4
votes
4answers
1k views

What security features should a PHP framework have?

What security features would you find useful or expect from a PHP framework? I have a PHP framework that I've developed that I'm going to be releasing as an open source project, but I want to make ...
7
votes
2answers
4k views

php.ini security setting after attack

My website have been attacked and I need a best practice for a php.ini I have done some reading but I am still not sure if I covered most of the options. here is my settings: file_uploads = Off ...
1
vote
1answer
300 views

Information on the phpMyAdmin probe?

Various IP addresses call various domains looking for various paths that might lead to PHP My Admin/scripts/setup.php One of those IP addresses is 74.63.212.48 which I just now found out I could ...
4
votes
2answers
2k views

How to find and protect against the exploited vulnerability in a PHP application based on the logged URL?

I have been attacked on a shared host server and they said I should configure my own php.ini file properly. I have a little PHP/MySQL program with a registering function, a little admin site. ...
2
votes
3answers
3k views

Authentication between multiple systems/platforms within the same web application context

Consider the following scenario: Web application is using two separate systems (they can share data/state through DB). First one is used for processing standard web stuff like http requests/responses, ...
6
votes
3answers
2k views

How can files be deleted in a HIPAA-compliant way?

Any material I've come up with for data destruction standards relate to completely wiping (ATA Secure Erase) and physically destroying hard drives, but I haven't been able to find much about standards ...
19
votes
4answers
997 views

Securing an area both physically and technically

I work for a commercial printing company, and we're beginning to get a couple jobs labeled "High Security". Essentially this means that if any pictures/information/files/etc. of the product were ...
3
votes
1answer
979 views

Securing sensitive data in a DB,is using H2 worth it?

I am designing a web application at the moment, and one of the requirements is to secure the user credentials as well as their roles. Now of course, besides the usual password hashing + salt +.... I ...
3
votes
2answers
2k views

/dev/random security holes

I'm doing some reading into the security issues surrounding /dev/random but it's proving to be hard to find good sources of information. Can anybody help? I've asked Google and got a bunch of articles ...
30
votes
2answers
9k views

I just send username and password over https. Is this ok?

When a user's logging in to my site, they send their username and password to me over https. Besides the ssl, there's no special obfuscation of the password - it lives in memory in the browser in the ...
2
votes
2answers
298 views

Company sending Master passwords in unencrypted emails

If a company has terrible security policies like letting people email password in cleartext emails, what to do if they reject all fair minded advice?
18
votes
2answers
3k views

Sending temp password when users first registered - is that good for anything?

One of our clients has sent us a list of security requirements. One of them was that registration does not including setting a password - once complete, a temp password is sent to the user, and the ...
8
votes
4answers
1k views

How to tunnel all network communication?

I'm looking for a way to tunnel all network communication from my laptop through another computer. I can control the software on both the laptop and the computer. The connection between them should be ...
17
votes
7answers
10k views

Getting rid of a large quantity of paper

Say you were in charge of getting rid of a large quantity of paper - up to 1,000 in a row. It can't be used as scratch paper because it contains confidential information. It also can't be outsourced ...
5
votes
3answers
1k views

Is it safe to use different derived keys but from the same passphrase for AES CBC encryption followed by HMAC SHA256 hashing?

I am working on a cross platform (JS/iOS/Android) list manager application that persists data through a REST API and I want to ensure that any textual data is properly encrypted on the client side so ...
12
votes
4answers
19k views

Recommendations for a Certificate Management tool for Linux [closed]

A client is looking to roll out OpenVPN to all its mobile employees and will use certificates on both the server and all clients. This creates a new challenge to manage all these certificates and ...
4
votes
2answers
1k views

Is it possible to test for Postgres BlindSQL injection using pg_sleep() in a WHERE clause?

In mysql, I am familiar with using the following payloads to test for blindsql when the WHERE clause is vulnerable (all payload examples from fuzzdb): 1 or sleep(TIME)# " or sleep(TIME)# ' or ...
3
votes
2answers
151 views

Need an overview of web service / web site security world, where do I start? [duplicate]

Possible Duplicate: Resources to learn about security I'd like to get a good understanding of modern issues in web security and get insight into what it takes to keep your sites and ...
5
votes
3answers
1k views

US export control on open source libraries

I want to ask, is the US export control applicable only to US citizens? E.g. I think Bouncy Castle are Australians. Do use of their library fall into export control regulations? I do not understand ...
13
votes
1answer
4k views

enable browser caching with HTTPS

I understand that sensitive data should not be cached (ie, you dont want to cache an HTML file with all of your bank account details in it), but there are some things that HTTPS protected sites should ...
25
votes
3answers
11k views

How should web app developers defend against JSON hijacking?

What is the best defense against JSON hijacking? Can anyone enumerate the standard defenses, and explain their strengths and weaknesses? Here are some defenses that I've seen suggested: If the ...
11
votes
3answers
923 views

Best way to triage crashes found via fuzzing, on Linux?

When doing fuzz testing, it is easy to end up with many bugs (many crashes). This makes it important to have a way to triage each bug that's detected, so we can prioritize them and focus our effort ...
5
votes
5answers
1k views

What are the likely threats to a public-facing DB instance?

Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash. We've been running an instance of MySQL internally for years and it's worked OK, but I ...
7
votes
3answers
531 views

How should I compile program for fuzz testing?

I'm doing some fuzz testing of a program for which I do have source code. Should I compile the program with any particular compiler options, to make fuzz testing more effective? If so, what's the ...
4
votes
3answers
368 views

How should I configure OS for fuzz testing?

Should I configure my OS in any particular way, if I'm going to be doing some fuzz testing? Should I turn off ASLR (address space randomization)? Does it matter?
9
votes
3answers
1k views

Length of CSRF Token

Is there any standard length of the token which should be used while generating the random tokens? Should we use the same standard which we use for generating Session IDs?
7
votes
7answers
6k views

Storing credit cards for automatic payments?

I have no experience with storing credit cards and I do not know anything about the legal end of this. The company I work for / develop for wants to store credit cards to process auto payments for ...
6
votes
2answers
846 views

How should I make diceware passphrases more memorable?

I find that truly random diceware passphrase, more often than not, either contain a word that is easily misspelled or has an order that is illogical. I think there are three ways to make a diceware ...
11
votes
3answers
4k views

Is it possible to get all the data I send through wifi?

Is it possible, that the network administrator (wpa2 wifi network) can log all the data the users send and then get password out of it? I know it is not possible to get the password if I'm surfing ...
6
votes
3answers
334 views

How safe are copies of Firefox that are on various Mozilla mirror sites?

If I end up downloading a .dmg or .exe (depending on OS) installer from some mirror site, how can I be sure that a virus or trojan or spyware has not been added? I don't see any mechanism for ...
5
votes
2answers
729 views

How to detect infected machines on my wifi?

I currently live in a building with around 40-50 other tenants (mostly students) and we all share one connection to the Internet using one of 3 wifi routers that are spread throughout the building. ...
2
votes
2answers
335 views

Literature about IT security from a hardware standpoint

Can you point me to any book, blog, paper, anything about IT security on the lowest possible level (hardware)? I'm primary interested in the motherboard, CPU & GPU, however, if you know any good ...

15 30 50 per page