4
votes
5answers
1k views

Could I be defrauded by a website who has my address, phone number, and credit card number?

Exactly what kind of information does a scammer need to scam someone money? For example, if there's a website which wants me to provide my details, Exactly what kind of information can I divulge and ...
1
vote
1answer
815 views

Windows Session Recording Software

I'm trying to monitor connections and actions made by administrators (or any user connecting) to a server through TSE (i'm simplifying). I've heard about a software which can record a video of any ...
3
votes
1answer
1k views

parsing the id-ce-keyUsage extension in X.509 certs

I'm trying to decode an X.509 certificate and have a question regarding the decoding of the extensions. In particular, the octet string corresponding to id-ce-keyUsage (OID 2.5.29.15) is as follows: ...
6
votes
2answers
803 views

Why would the downloaded certificate show a different end-date as compared to the same certificate when viewed online?

This is sort-of a follow-up to my previous question What fields in a suspicious certificate should I look at? Chrome just presented the warning icon against the certificate presented by ...
2
votes
1answer
505 views

Is there any FOSS passive vulnerability scanner ? Not a NIDS but a vulnerability assessment tool [closed]

I've see the PVS (passive vulnerability scanner) from Tenable Network Security. I'm really interested in this kind of approach. Anyone know if is there any FOSS solution to be used professionally ...
3
votes
2answers
6k views

Where can I download vulnerable Windows OS images to practice penetration testing?

My objective is to learn and practice all the vulnerabilities and their exploitation on vulnerable OS.
6
votes
4answers
930 views

How is a ddos simulation any different from a real attack?

I asked a question earlier today on serverfault, but found out that there was also a security stack exchange. I had conflicting answers from there. The following is the link: ...
4
votes
2answers
99 views

Methods of accessing CRLs

I'm creating custom certificates with CDP Definitions with the option of configuring several methods of accessing the CRL. My options are HTTP, LDAP, and FTP. What are best practices or should I say ...
-1
votes
1answer
100 views

Why are there soo many HTTP connections when using Convergence?

I installed Convergence on Firefox 9.0.1: http://convergence.io/ but... after I installed/enabled it when I visit a HTTPS only-site there are many-many HTTP traffic to the notary servers. Why? ...
18
votes
3answers
767 views

What is a rootkit?

As a followup to "Tripwire - Is It Security Theater", I'm looking to get a better idea of what a rootkit is. To be more clear: What is a kernel module? What at high-level is the flow for how it's ...
21
votes
6answers
8k views

Is AES encrypting a password with itself more secure than SHA1?

This isn't really a practical question, but more a question of curiosity. I heard a CS professor recommend stepping up from md5ing passwords not to SHA1, but to AES encrypting the password using ...
16
votes
7answers
3k views

Tripwire - Is it security Theater?

Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes. Let's say I have tripwire configured to run ...
28
votes
7answers
5k views

Methods for protecting computer systems from physical attacks

I am interested in cost effective and creative ideas for detecting physical attacks against computer systems. This includes, but is not limited to Tamper Evident security measures. Consider the ...
1
vote
3answers
898 views

Sniffing on VPN configuration

Our company wants to implement a service based on sniffing for security purposes, since we manage important information this requirement is imperative. The situation is as follows. Everyone in the ...
5
votes
3answers
1k views

Making passwd/shadow files more secure

The passwd/shadow files in a unix-like OS contain sensitive info such as a user's password. In addition those files aren't necessarily secured: with a live CD we can access those files on the hard ...
18
votes
1answer
5k views

Can a dictionary attack crack a Diceware passphrase?

Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words. Everyone seems to know that we're not supposed to use dictionary words for ...
3
votes
2answers
837 views

Difference between vulnerabilities on windows/linux/mac for same program

If someone finds a vulnerability like buffer overflow in a program such as Google Chrome or Mozilla Firefox running on a linux machine, are there any chances that this vulnerability will persist on ...
128
votes
11answers
13k views

What alternatives are there when SSH is being actively filtered?

Unfortunately our government filters the SSH protocol so now we can't connect to our Linux server. They do the filtering by checking the header of each packet in the network layer (and not by just ...
12
votes
3answers
2k views

What are the security benefits to a separate user database?

In the app I'm writing I separated the user and main databases a long time ago for "security reasons". However its getting harder and harder to justify the overhead and the difficulty of managing such ...
3
votes
2answers
2k views

How to protect from copying files?

Is possible to protect files from being copied if you are the administrator of a machine? I heard that this behaviour is possible: one software developer sells his software in such a way. He installs ...
8
votes
8answers
3k views

With which algorithm I can prevent a brute force on a login?

I want make my software more secure. I want prevent it from brute force attack. I know that a strong password is the best but I can not control it. The algorithm must scale from a very small system ...
7
votes
3answers
1k views

Are there any established mobile security frameworks or secure coding guidelines available?

I am looking for security frameworks and secure coding guidelines especially for mobile devices (Android and iOS). The languages I am interested in are Objective-C, JAVA and HTML5. If there are no ...
3
votes
2answers
250 views

ltd.exe, “Vista Antivirus Security 2012”, any info?

I was taking a look at someone's computer who had a virus. It called itself "Visa Antivirus Security 2012". It turned out to be ltd.exe. It would seemingly randomly block programs, it turns out it had ...
9
votes
2answers
608 views

How to implement secure device identification in a for-pay wifi router to prevent usage fraud?

After reading this question about how for-pay wifi routers identify specific devices it got me thinking about what a secure alternative might be. I know that certain research has focused on ...
4
votes
3answers
841 views

Secure one-time-use credit cards

I've been reading a lot about one-time-use online credit card numbers (e.g. https://www.discover.com/credit-cards/member-benefits/security/create-online-account-number.html#) but I have to admit that ...
5
votes
2answers
3k views

How is user authentication sent in a public wifi? Radius/802.1x/EAP etc

I visit the airport, I pull out my laptop and connect to a network (no password needed). I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I ...
1
vote
0answers
103 views

What are the major security concerns in cloud computing? [duplicate]

Possible Duplicate: What are security issues which are specific to cloud computing? What are the major security concerns in cloud computing? From the point of view of a user that is using ...
7
votes
3answers
250 views

Searching encrypted storage

I have been reading some very interesting academic papers regarding the ability to search encrypted data without needing to actually decrypt the data. Doesn't this defeat the purpose of encryption in ...
0
votes
2answers
281 views

Convergence HTTPS - what are the Notary servers?

https://www.youtube.com/watch?v=Z7Wl2FW2TcA What are the "Notary" servers regarding convergence? Who is maintaning the "Notary" servers? Can someone please explain?
3
votes
1answer
169 views

Does knowing encrypted information make it easier to find an unknown key?

I'm curious if knowing the exact content of an encrypted message or several messages makes it theoretically any easier to discover the encryption key. Does this speed up a brute force attack in any ...
10
votes
3answers
6k views

Do my Android apps use TLS or other encryption when connected to public Wifi? How can I tell?

I have an Android phone. When it's connected only to my carrier's 3G network I imagine it's reasonably secure against eavesdropping (although not invulnerable). However, at times due to lack of ...
1
vote
2answers
443 views

Books, videos, and other resources for CEHv7 [closed]

What are recommenced books, videos and other resources for CEHv7. It seems as though not much is published on the new version of the cert just yet. Currently, I have read All In One CEH by Matt ...
6
votes
7answers
1k views

HTTP Proxy vs bump-in-wire

If I'm an administrator of a corporate network, I could use an HTTP proxy to examine outgoing connections to monitor what websites my employees are going to, and terminate connections based upon ...
7
votes
10answers
4k views

How can I share files with other individuals using the cloud in a secure way?

I would like to use a dropbox because it is easy and convenient. But I want to encrypt the files with the public key of the intended recipient, so he will be the only one who can access the data in ...
2
votes
2answers
740 views

Online virus scanning service with remote file submission?

I have some links that contain hacking tool and whatnot and I want to pass them to a virus scanning service. The thing is that I don't want to download them to my pc and upload them to their service, ...
12
votes
2answers
7k views

CSRF With JSON POST

I am playing around with a test application which accepts JSON requests and response is also JSON. I am trying to do a CSRF for a transaction which accepts only JSON data with POST method in request. ...
4
votes
5answers
2k views

what is the best keylogger for security uses? [closed]

Today we were robbed. A thief come to our home at night and stole some stuff including my brother's laptop. I think that the right thing to do is to download a keylogger on my PC, just in case... I ...
3
votes
2answers
338 views

Security while connecting to a mysql databse using pdo

I looked at this question: What is the right way of storing database connection strings from the security point of view? and I'm wondering specifically for connecting to a mysql databse with PDO, how ...
1
vote
1answer
129 views

Where to find a fake hierarchy for a honeypot for double-dot/path traversal attacks?

I would like to provide content when a hacker tries something like GET /../../../etc/passwd, but they may choose something else, other than passwd. I will install notification of when somebody does ...
5
votes
1answer
331 views

What are formal parameters for fingerprint scanner selection?

I would like to buy a USB fingerprint scanner. I intend to use it to log in into my Windows computer, to secure RoboForm password manager, and generally to replace password entry with a quick finger ...
5
votes
1answer
293 views

What is it called when you give hackers a way in?

Is there a name for a system that is designed to be hacked into? (Alternatively, there may be a different name for a system that is designed to look like it is hacked in to, but is actually just ...
6
votes
2answers
3k views

Perl script rootkit (exploit)

I received a spam abuse few days ago on my server. As a precaution, I blocked the SMTP port and started an investigation. I found a running Perl process. The script it was using was deleted but I ...
2
votes
1answer
232 views

Does this htaccess snippet provide sufficient security?

I've downloaded a part of .htaccess to prevent from using base64_encode or <script> or _REQUEST within URL. Is this secure enough to help me out for partial security, or is it just a waste of ...
25
votes
4answers
5k views

Reusing Private/Public Keys

I have accounts on several third party sites - Bitbucket, Bluehost, etc. From what I've gathered, it is common practice to use one key pair for all [id_rsa, id_rsa.pub], but only to give out the ...
18
votes
1answer
3k views

Why do you have to be an admin to create a symlink in Windows?

In linux every user can create symlinks, but in Windows I need an admin command line, or mklink fails. Why is that?
8
votes
3answers
144 views

Does marketing data trigger HIPAA Privacy?

If I was a marketing firm who provides an analysis on visitor statistics from anonymous members who then ties that in to a CRM to track conversions, what do I have to do to the data to ensure that ...
5
votes
1answer
2k views

Code Review on a Header Injection In Java : any help?

I'm auditing a piece of Java code that might be vulnerable to header injection : String headerValue =request.getParameter("headerVal"); //escaping CRLF headerValue = headerValue.replace("\n", ""); ...
2
votes
2answers
2k views

Can Tamper Data (the plugin) modify multipart requests?

I'm doing some testing on my web app with Tamper Data. I've had success with Tamper Data in the past for normal HTTP post requests, but in this particular case I want to modify a post request that ...
2
votes
2answers
159 views

Debug mode for an application but removed in production

A application use the debug as boolean to prefill login, password for authentication. The code is something like that : if (ContantsFile.CUSTOM_DEBUG_FLAG) //static final { //disable access control ...
5
votes
4answers
6k views

How secure is Windows Auto-Logon?

Obviously, if auto-logon is enabled, anyone who can gain physical access to the PC can use the PC. That's not the question. The question is, when I enable auto-logon for my Windows 7 box, will there ...

15 30 50 per page