0
votes
1answer
38 views

Ubuntu 12.04 server attacked using Wordpress vulnerability (plugin?) [duplicate]

Env Rackspace cloud server Wordpress 3.9.1 Ubuntu 12.04 Linux web.mydomain.com 3.2.0-67-virtual #101-Ubuntu SMP Tue Jul 15 17:58:37 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux History These may ...
-1
votes
1answer
31 views

generating extensions request in a PKCS#10 request using C# and CertENrollLib

I have to add extensions to a certificate request ( CSR ) in such a way that I respect a given structure. Namely this one On the left is the structure I must respect for the chalenge password, on the ...
0
votes
1answer
27 views

Antivirus false positive

I'm adding new features to an old Borland C++ VCL application using Borland 2006 IDE. I'm finding that upon adding a single line of code, and building, the exe is being quarantined since Sophos is ...
0
votes
1answer
25 views

Does serving Tomcat via Apache Webserver improve security?

This question is an ongoing discussion at work. Assume a Tomcat serving some web application and has all JMX and remote management stuff disabled. If you consider three scenarios: Tomcat serves ...
0
votes
1answer
73 views

Single sign on - is this a secure way to log in?

I am fiddling about with a sort of single sign on procedure. Let's say there is site1 and site2 and both use an SSL certificate. Users are signed in on site1. I was wondering what the experts think ...
1
vote
1answer
34 views

How to safely renew user and CA certificates in a PKI

I am currently developing my own PKI where x.509-client-certificates are issued by a public server. At the moment, the CA-public key is distributed with the binary and there are no routines for ...
0
votes
2answers
64 views

How to generate a superkey to decrypt strings

I'm working on an application where users have a key or password generated by me that is used to encrypt a string. Each user has their personal key, and no user should be able to decrypt another ...
1
vote
1answer
108 views

How do you stop a hacker with no IP and a dot for their HOST

The entry below is from the visitors log in c-panel Host: . /specific legimate-wordpress-post/ Http Code: 503 Date: Jul 24 09:28:06 Http Version: HTTP/1.1 Size in Bytes: 1118 Referer: ...
-6
votes
0answers
46 views

I have litteraly no more options of how to crack this hash. PLZ HELP D: [closed]

I have found this old hash laying around and I have no idea how to crack it :P my hash: 7b62d4ef52a09bb505055296faa4ffcc I have tried everything and have come up with nadda :l I have tried brute ...
3
votes
1answer
36 views

Could running applets/videos trigger a drive-by download attack?

Let us visit a given webpage on which video files and/or java applets are embedded. Could clicking to start on these videos/applets lead to a drive-by download attack ?
13
votes
5answers
2k views

Can sites which check your password as you type pose a security risk?

Some sites that I use check my password as I type it into the login (not registration) form. So, for example, to begin with I might have: Username: sapi ✓ Password: passw × and by the time I've ...
-1
votes
1answer
53 views

Man-in-the-middle attack with public wifi

I'm using Charles to sniff out the traffic on my iPhone at Starbucks and for some reason it won't work with at&t wifi. Google Starbucks wifi does, however. I use my iPhone to connect to the same ...
6
votes
4answers
108 views

Does Windows have a built-in password store?

What passwords are stored in Microsoft Windows? How can I know what password are saved in computer?
2
votes
1answer
111 views

Is it legal to “use” security vulnerabilities [closed]

I understand that the answer to questions like this depend on country, but I'd like to get an idea what the usual approach to cases like this are. Heres the case: I found a security hole in one of ...
1
vote
1answer
81 views

How easy is it to crack this encryption algorithm? [closed]

When I was about 13 or 14 years old, I was a little interested in cryptography (which is, after all, an interesting field). I learnt quite a lot since that time (it has been about 8 years since then), ...
0
votes
2answers
62 views

Is it not safe to open MySQL's port to the internet?

The consensus on this Server Fault question seems to be that opening port 3306 for MySQL is more dangerous than using an SSH tunnel to access MySQL. I would think that with strong credentials you ...
0
votes
1answer
28 views

Can any ECC field element be safely serialized as “compressed” and then restored as uncompressed?

I have a library that stores all its ECC Field Elements in uncompressed form, in a bloated Base64 XML format, and storage has become a concern. (We want to support QR code as a form factor,etc) ...
0
votes
1answer
40 views

SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?

This is a Nessus finding, which is considered medium by default. Basically it may allow for some plaintext injection which may allow for some man in the middling. My question is, has these been ...
2
votes
2answers
66 views

Penetration testing's terms of agreement template

My company is going to start to provide penetration testing services pretty soon, in fact, we are just missing the legal aspects of it. I'm wondering if is there any template which states the most ...
0
votes
1answer
40 views

malicious website blocked - on a legit program?

I'm fairly okay with PCs but when it comes to networking i'm quite lost with the details. My brother started up Mount and blade war band napleonic wars - an official game and played multi player and ...
0
votes
2answers
79 views

Does cPanel store my login password as plaintext

On attempt to change my cPanel password I was warned that: Your password could not be changed because the new password failed with the following reason : (is too similar to the old one), please try ...
2
votes
1answer
39 views

Inconsistant browser warnings for SSL

I am doing a penetration test at the moment, where the client has deep packet inspection for SSL enabled (my guess), as every SSL connection seems to being MITMed. Now, some HTTPS sites, like Gmail, ...
1
vote
3answers
33 views

How do to keep programs updated

We all know we should keep our programs up to date, after all each of them could have an unlatched security hole that was fixed in the latest update. However the average computer easily contains 200+ ...
1
vote
0answers
50 views

Are there any known cases were antivirus software have deliberately ignored malware?

Are there any known cases were antivirus companies for some reason have choosen to make their product allow/ignore malicious software? The reason could be government coercion or former trustworthy ...
-1
votes
0answers
15 views

NOSQL Database Security - Prevent unauthorised accces / view of sensitive data [closed]

Apologies for the broad question but for NOSQL DB's that would contain information classified as PII is there a native ACL or RBAC configuration that would allow for selective administrative duties to ...
27
votes
6answers
3k views

How can normal files hide a virus?

How can normal files supported in Windows operating system hide a virus ? Sometimes opening a .txt , .jpg or .docx files leads to running a virus. How come is this possible ?
-6
votes
0answers
42 views

How to install dual system on PC? [closed]

I would to install linux OS alongside to my Windows 8.1 OS, i tried once but failed. Please help me how to do that. thanks in advanced.
-3
votes
0answers
22 views

IBM TAM and Webseal for securing web applications [closed]

I have to evaluate which are the best Products to secure numerous web applications that are running in an Organization. I also need to enable SSO for them. The two products that I am considering are ...
4
votes
2answers
117 views

Safety of using online proxy?

Lets say for example I have to use a public online proxy like https://www.zend2.com to load a php webpage controlled by me containing sensitive data over https. How would i make sure that the proxy ...
39
votes
7answers
6k views

Does a virus need to be clicked on to function?

Can a virus infect my Windows XP operating system by its mere presence? I mean, if I copy/paste a virus on my computer and I never click on it, will it infect my computer or will it remain dormant, ...
0
votes
1answer
37 views

GPG encryption and signing

Why don't the commands gpg2 --armor --sign file.txt and gpg2 --clearsign file.txt have the same output? Also when I use just --sign I get a bunch of binary gibberish surrounding the message in ...
1
vote
1answer
54 views

Running an Open Server (contents are visible)

I'm considering the possibility of running an Open Server, as I would call it, that is, a server where as much of its contents are publicly visible as possible. I would like to give read access to ...
-1
votes
0answers
22 views

Nessus spots fake updates [closed]

My company is currently using Nessus to spot the misconfiguration and i'm about to re-patch all those which were forgotten. But Nessus is currently spotting some Microsoft Office updates missing on a ...
-1
votes
1answer
36 views

Can I test/determine all decryption types on an unkown filetype. I do have the password [closed]

I have a file that's nearly 200Mb. It was reportedly packed/encrypted with Kruptos 2. But it has a .~enc extension. The header of the file is pure gibberish. Running file says it's data running ...
1
vote
2answers
143 views

Intrusion Detected - OS Attack

I have recently gotten a prompt from my anti virus stating that there was an intrusion with an OS attack as describe in the link below: ...
1
vote
2answers
60 views

How do credit cards with chip+pin securely allow recurring transactions?

In Europe most cards use a chip+pin system to secure the card information. You put the card in te machine and enter a PIN number to decrypt the card information which is stored on the chip. ...
-1
votes
1answer
30 views

Sqlmap How to use different user? [closed]

When i run this command: ./sqlmap.py -u "[vulnerable_website_link]" --users It founds about 8 different databases(meaning DB users) But it always retrieve data from only current user. How to use ...
1
vote
7answers
163 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
2
votes
3answers
71 views

“Web of trust” for self-signed SSL certificates?

SSL certificates, generally speaking, use a "chain of trust" model - a trusted certificate authority (CA) gets proof that a company such as Amazon owns amazon.com and issues an SSL certificate. ...
-1
votes
0answers
21 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
0
votes
1answer
69 views

what type of attack does LOIC do? [closed]

I have used LOIC (Low Orbit Ion Cannon) earlier . Today i was reading on wikipedia that there are many types of dos attacks , namely SYN attacks , HTTP flooding ,UDP flooding ,etc and two questions ...
-1
votes
0answers
20 views

Why isn't auditd logging file deletes? [migrated]

I have auditd installed on 64-bit Ubuntu 12.04 to track down some unexpected deletes (nice discussion of auditd). This is my rule (tagging deletes with the deletes keyword): -a exit,always -F ...
0
votes
3answers
94 views

Has personal computing security gotten better or worse in recent years? [closed]

I have a lot of experience with software as a developer, and am trying to move from newbie to more informed about present-day security. Everything I uncover makes me feel that personal computers have ...
3
votes
1answer
49 views

Access rights management in large companies

I'm wondering how large companies with tens / hundred of applications are handling access-rights for their users. From what I've seen, it's a nightmare that never ends, and it requires full-time ...
1
vote
2answers
79 views

Are Internet Explorers “Tracking Protection” able to prevent AddThis canvas fingerprinting?

A paper on web tracking mechanisms identifies the web-tracking company AddThis as a major user of canvas fingerprinting. Are IE:s Tracking Protection, provided Tracking Protection Lists including ...
-1
votes
3answers
126 views

Help me catch someone red handed on our server.

I first tried to log in this morning and our password was changed on our ubuntu server. I contacted our server support and they told me that I had just been fat fingering the password. I thought it ...
0
votes
0answers
11 views

Airmon-ng, airbase-ng and interface names [closed]

I recently found a tutorial on how to set up a rogue AP using airmon and airbase and have a couple questions regarding the interface naming conventions. We start off with my wireless interface which ...
-1
votes
1answer
18 views

Pre-given words as “ad recommendation” solution? [closed]

There are so many talks about browser tracking, or try to uniquely identify who is behind a webbrowser. These marketing people have no other choice, that's why they do tracking. Question: wouldn't ...
21
votes
3answers
2k views

How is Google Chrome managing authentication to sites?

In Chrome, every tab is its own process. Yet, logging in to a site, say, Facebook, persists across tabs. For that matter, in many cases, it persists across OS reboots. This seems inherently very very ...
0
votes
0answers
72 views

Can not open my yahoo email. The connection was interrupted [closed]

Since yesterday, I can not open my yahoo mail. I get connection interrupted message (see pic). Or, some times I get another similar message saying the connection was reset. I tried another PC, same ...

15 30 50 per page