18
votes
7answers
2k views

Defence Against Keyboard Keylogger

I am wondering whether there is a way to defend against USB Keyboard Keylogger (obviously other than physically checking the keyboard every time after leaving my computer unattended). These days, ...
1
vote
3answers
144 views

Are there any security related rules in PCI-DSS that govern when I can capture a payment?

Is there a PCI-DSS rule that a merchant cannot capture the funds for an order until we have actually shipped it? I can't seem to find an official reference that describes this as a PCI DSS ...
6
votes
2answers
18k views

OpenSSL generate different types of self signed certificate

Does anyone know how to use OpenSSL to generate certificates for the following public key types: DSA - For DHE_DSS key exchange. Diffie-Hellman - For DH_DSS and DH_RSA key exchange. ECDH - For ...
8
votes
6answers
4k views

How can I detect that steganography has been used?

I have seen some of the algorithms which are used to detect if a file is a stego-file or not, but all those algorithms check for specific patterns and are not universal. Maybe there are universal ...
2
votes
2answers
286 views

xss Scripting on clean-urls

I am learning about XSS vulnerability. I need to know what sort of XSS attack can be done on clean URLs. Clean URL example : //my url.net/project/public/#questions/question/edit/id/122/answer/1
6
votes
2answers
792 views

How can you securely generate keys on AWS?

Our application needs to generate secure keys for long term storage on AWS using openssl. But I've seen some instance where entropy falls dangerously low on AWS machines and this doesn't appear to be ...
18
votes
2answers
18k views

What's the purpose? Strange login attemps “sshd[***] Received disconnect from **.**.**.**: 11: Bye Bye [preauth]”

I've seen something like: sshd[***]: Invalid user oracle from **.**.**.** // 1st line sshd[***]: input_userauth_request: invalid user oracle [preauth] // 2nd line ...
1
vote
3answers
348 views

How safe is it to provide my administrator account password for a 3rd party software: EasyUS Todo Backup?

I've been recently searching for a backup solution for my Windows desktop. That's when I came across this free software called EasyUS Todo Backup. (I know it's a mouthful but English doesn't seem to ...
6
votes
2answers
367 views

SQL injection across multiple tables

If a website has multiple web apps, each of them connected to different tables in a database and all of the apps are protected from SQL Injection except one; can that one web app be used to ...
6
votes
1answer
1k views

Crypter Anti-Virus Test

I have written a very simple/basic crypter in C++ and I would like to test it. How would I go about writing a simple MessageBox program that is "tainted" so that my Anti-virus will attempt to ...
13
votes
3answers
9k views

What is the purpose of OAuth 2.0 redirect_uri checking?

The OAuth 2.0 specification's authorization code mechanism includes redirect URI checking from the site you redirect to. See steps D and E in section 4.1 of the spec. Also, section 4.1.3 describes in ...
1
vote
1answer
162 views

Hardening Services, Ports on OSX

People boast about OSX Security, yet I find it very hard to find a comprehensive manual in regards to any equivalent Services and the ports they use. I am aware of lanchd and launchctl and Lingon is ...
4
votes
3answers
8k views

What are the main differences between the network-level and the application-level regarding information security?

I'm fresh new to the field of security, so I'm sorry if this question seems stupid to you. What are the main differences between the network-level and the application-level regarding information ...
23
votes
2answers
5k views

How would one know if they have a rootkit?

Are they impossible to detect? Seeing as the attacker has admin rights and could modify anti virus software that might otherwise be used to detect or circumvent a root kit. Are there certain red flags ...
1
vote
2answers
113 views

Antivirus / Wireless PCI v2 Controls Scope

Do the Antivirus / Wireless controls within PCI v2 apply for the entire organisation, or just for the PCI scope?
1
vote
4answers
495 views

How can these spam emails be accessing email accounts on respected domains?

Today I received a spam email from juliew@mchs.org.au requesting to contact Harry Black about a charity project. His email address is harryblack2013@rogers.com. After I had done so and fallen for the ...
0
votes
1answer
201 views

Anonymity on the Web 101 [duplicate]

nice to meet you all! I'm newbie on this stack. Sorry if I did anything idiot :) Well, I'm very curious about browsing on the web completly anonymous. I would like to hide the websites, e-mails, ...
1
vote
4answers
651 views

Protecting Backups from Viruses

Currently we are using ReadyNAS by NETGEAR to hold all our images from all our machines. My question is can viruses expand from the machines and infect the NAS drive and the backups? We are using ...
5
votes
2answers
4k views

What is the need of security token to prevent CSRF attack?

I have a REST API which is running in one domain and I have a client in another domain. To prevent CSRF I have configured REST API to accept request originated from client application only. I have ...
1
vote
4answers
2k views

Can Cross site scripting lead to database access?

I wanna know that weather a site having XSS vulnerability can lead the hacker to access database? I know that he can get the username and password from the cookie stored but can he completely access ...
0
votes
1answer
122 views

Where to perform authorisation in a web app?

Most web apps perform authorisation checks at the controller layer. This is basically ok, but complex apps tend to have repetitive checks. For example, there might be ten or so controller actions that ...
4
votes
1answer
3k views

Are there sha 512 rainbow tables available? [closed]

Are there sha 512 rainbow tables available for download or what kind of dimensions and processing power would be required to generate them?
2
votes
3answers
1k views

Asking for an SSL Certificate from the Client

I have created a web application for a client and I'm hosting it on my own server behind a domain I own. I have purchased an SSL certificate for this domain and the web application runs nicely over ...
5
votes
1answer
3k views

Is TLS 1.0 sufficiently secure for a bank?

I disabled SSL2 and SSL3 in my Firefox browser, version 24. I only enabled TLS 1.1 and 1.2. Unfortunately when I went to my bank's website, I found that it didn't work until I re-enabled TLS 1.0. ...
3
votes
3answers
824 views

What type of SSL certificate do I need for communications between an Android app and a web service?

I am developing a game for Android. The customers using the game will have to send their information to a REST web service that, behind the scenes, will be connected to a MySQL database. I would ...
1
vote
4answers
11k views

SQL injection with “INSERT” statement

I am currently studying the most basic SQL injections that are possible. Pure and solely for the purpose of teaching myself the basics before advancing to more advanced ones. I am recreating this ...
1
vote
1answer
666 views

Don't use encryption without message authentication

The text is taken from the famous answer: Lessons learned and misconceptions regarding encryption and cryptology: Don't use encryption without message authentication Alternatively, you can apply ...
1
vote
2answers
377 views

Preventing exploits like ROP and Return-to-libc in modern Operating systems

As I was reading about the advanced exploits such as Return Oriented Programming (ROP), Retun-to-libc, etc., I came across many defenses to these attacks including techniques like ASLR, kBouncer, ROP ...
3
votes
1answer
831 views

How is a Tor hidden service immune to exit node attacks?

Let me explain with a nifty diagram: IP/RP <-> bunch of Tor clients/node (Tor circuit) <-> Tor hidden service Wouldn't the last Tor client in the circuit knows that the message is for the Tor ...
0
votes
1answer
284 views

At what point is a cryptosystem “rolling your own”? [duplicate]

Everybody knows making your own cipher really sucks. Everybody also knows using existing cryptosystems, such as TLS, totally doesn't suck. But when is the line drawn? For example, would I be rolling ...
-1
votes
2answers
665 views

May I `store` the password, by making it the key in AES-256?

I would like to seek for another way to save the credentials, which is used to verify the user trying to login, into my database. I came up with this idea. Since I believe that even knowing a ...
0
votes
1answer
2k views

Stack Guard vs Stack Shield

I would like to know why nowadays Stack Guard is used everywhere (example: ProPolice in GCC, /GS in Visual Studio), instead of Stack Shield. Both the approaches (i.e. Stack Guard & Stack Shield) ...
0
votes
1answer
152 views

How to Choose and adopt information security model [closed]

I would like to ask about how can someone adopt certain security model in the organizations what are the criteria that controls how I can pick the best security model for my organization For example ...
0
votes
2answers
479 views

Can you trust the URL shown when 'hovering' on a link? [duplicate]

When using a modern web browser, if you hover on a link, the browser will show you the link in a little display on the bottom left corner of the browser screen. Can I trust this? Can this display be ...
4
votes
2answers
137 views

Could server honesty be audited by remote peers without said peers having sole (or any) control of the server?

Suppose for some reason, you and your peers absolutely positively have know that a server is acting honestly. Could the server behaviour be audited remotely through some mechanism of randomly ...
2
votes
4answers
394 views

Protecting personal documents in cloud

I want to keep my personal documents in cloud e.g. Dropbox. But I want some of my documents be encryted and password protected, such that: 1. even if my Dropbox gets hacked, those documents still have ...
3
votes
0answers
322 views

OpenSSL vs NSS from FIPS-140-2 and Suite B perspective?

Does anyone know of any work/papers/articles comparing the relative strengths and weaknesses of NSS and OpenSSL? EDIT: In case there aren't any existing documents/articles, I would certainly ...
0
votes
1answer
216 views

Understanding a Zenmap output

I'm running Zenmap on my Windows 7 laptop. I ran an intense scan with UDP targeting my router 192.168.1.1.I realize that I'm probing into the back end of the router from the inside and that any open ...
11
votes
7answers
2k views

Why are security-crucial software written in unsafe languages?

This may be a stupid question, but... Why are security-crucial software written in languages such as C and C++? I understand why, say, an embedded system might need a low-level language to make the ...
1
vote
1answer
186 views

google states connection is encrypted. Should I change that?

"The connection to www.google.com is encrypted using RC4_128 with SHA1 for message authentication and ECDHE_RSA as the key exchange mechanism". This is on my google search bar. Is that o.k.?
33
votes
8answers
4k views

Isn't all security “through obscurity”?

I know that one shouldn't rely on "obscurity" for their security. For example, choosing a non-standard port is not really security, but it also doesn't usually hurt to do so (and may help mitigate ...
0
votes
0answers
40 views

Securing your virtual machine [duplicate]

I am using my virtual machine and run there a few programs that may be malicious. Is there a risk of my host getting infected? Can a virus migrate to my host considering that I dont allow file sharing ...
9
votes
4answers
9k views

How does a key file increase the security of a password manager?

Password managers like KeePass often have an option to use a key file in addition to a master password. I don't understand how this increases security. (Note: KeePass also allows using a key file ...
1
vote
1answer
2k views

“Must have” and “Preferred Cipher” suites terminology

I have received the following advise to set cipher suites to suitably mitigate Beast attack on a newly setup Apache HTTPD server. Preferred ciphers: RC4-SHA, RC4-MD5 Must Have Ciphers: ...
7
votes
3answers
3k views

How does Dropbox keep files secure

I have read that Dropbox encrypts all the files that are uploaded with a single encryption key. Where is this key stored and why do they bother encrypting the stored items if they just store the key ...
3
votes
1answer
5k views

How is the HMAC key exchanged?

Just wondering about this. Does it need a PKI to work?
15
votes
3answers
19k views

with IPv6 do we need to use NAT any more ?

I'm wondering how to use NAT with IPv6 ...seems that you don't even need it any more. So what exactly is the concept behind firewall configurations in IPv6 environments?
1
vote
1answer
341 views

Possible DOS Attack? And solutions for it?

I don't know whether it's appropriate to post this question here but I desperately need help. I've been receiving ping requests from 18 different IP addresses so far. Some of them are local, some ...
4
votes
2answers
272 views

Would re-salting passwords regularly in-/decrease security?

What are the (dis)advantages of re-salting a user's password regularly, e.g. weekly (or at their next login once week since the last re-salting)? The basic idea would be that users who regularly log ...
1
vote
1answer
198 views

what info can web bugs track?

From EFF's Web Bug FAQ(point 6), What information is sent to a server when a Web Bug is viewed? The IP address of the computer that fetched the Web Bug The URL of the page that the Web ...

15 30 50 per page