0
votes
0answers
10 views

Negotiate n-bits key with Diffie-Hellman protocol (or other key exchange protocol)

I've got ASCII message. I convert it to binary - then I've got 8*(ASCII message length) bits - let us assume this value will be called n. I have to negotiate key, which length (after conversion to ...
2
votes
0answers
24 views

What are analytics APIs accessing when they run, and how do you block or spoof them?

What are analytics APIs accessing when they run, and how do you block or spoof them? Usually all apps from desktop or mobile app stores, MMO clients, Steam and many utilities, and many games and ...
0
votes
1answer
124 views

How can an online hack be traced back to the perpetrators?

What sort of evidence might be used in linking, say, the Sony hack to North Korea? While I am curious about what was used in this particular case, my question is meant to be a more general question ...
0
votes
2answers
45 views

Why do I have to use multiple Keys for each direction and purpose?

I'm currently writing an examen about 'Lessons Learned in the IT-Security'. I already found some thing, which shouldn't be done. But right now I'm in trouble finding the reasons why not to do so. ...
0
votes
1answer
47 views

Is a SSL CA signed certificate necessary when connecting with IP Address?

I'm currently creating a socket server, and would like to encrypt communications. The thing is, the client will connect directly to the ip without any DNS. (Every user will know the Server's IP ...
-1
votes
1answer
31 views

Emulating Client by sending encrypted hexdump to dB server and getting response back [closed]

So I used wireshark to retrieve a hexdump that has been encrypted with RSA. I need to figure out what the response to that would be when it comes back from the server. How I imagine it would work ...
0
votes
1answer
34 views

Two factor authentication using CVV and 3D secure code

While making online by Debit/Credit card, instead of using OTP (received on mobile), one can use a 3D secure code (verified by visa or mastercard) which is know to user. Should this qualify for two ...
1
vote
1answer
32 views

Are servers that do not implement time services vulnerable to clock skew attacks?

An article describes clock skew attack possibilities §§: These can be attacked by repeatedly connecting to the hidden service, causing its CPU load, hence temperature, to increase and so ...
2
votes
2answers
57 views

Tamper proof hardware - not resistant

Can you make a TPM (or any piece of hardware) Completely tamper-proof? The “regular” tamper resistant hardware has various physical attacks http://www.milinda-perera.com/pdf/EKKLP12a.pdf I have been ...
1
vote
0answers
75 views

Is hacking my own account illegal? [closed]

I have just learned email hacking and I want to test it. I am well aware that if I hack into any email account, there are chances that my email service provider will track me. So if I hack into my ...
3
votes
2answers
69 views

Where to store passwords of encrypted backup drives

I have all my backup hard drives encrypted with LUKS. Currently, the passphrase is some 25+ random password that I store in my password manager KeePassX. Since I have the backup drives for the case ...
24
votes
1answer
2k views

How does CVE-2014-9390 affect me?

On 18th December, a vulnerability in git and mecurial was announced.  What are the details of the vulnerability?  Does it affect me?  What should I do?
1
vote
0answers
22 views

Snort only detect local issues

I have installed two physical machines with KVM virtualization using Red Hat as OS ( h1 and h2). In h1 I have installed the virtual machines w1 and db1 In h2 the virtual machines w2 , db1 and ids. ...
2
votes
1answer
34 views

Would a VPN with changing configs do the same job as different VMs

I was reading this question. So my question: Would using a VPN and swapping out configuration files that change your IP address mask the same as using different VMs?
1
vote
6answers
78 views

When is an antivirus program needed/useful?

Let's say I buy a computer and use the internet for services but rarely download anything and when I do it is from legitimate sources with a minimal to non-existent chance of malware. What benefits ...
5
votes
1answer
135 views

Best Practices for Security Questions

When a website asks me to enter security questions in addition to a password what is best practice on my part? This often happens with banks and other institutions but I see it less with other ...
-1
votes
1answer
44 views

Decrypting packet data without private key [closed]

Firstly I am not doing anything illegal. How would I go about decryption a packet from the server back to the client and vice versa and get it in plain text WITHOUT using a private key. I have tried ...
-1
votes
0answers
12 views

Java Keystore best practice for large scale application [closed]

I'm new to JCE/cryptography in general but I'm working on demo where we are going to create a public/private key combination for each users of the site. All the examples I have seen so far stores ...
2
votes
1answer
77 views

Does encrypting a file make it larger?

I encrypted a Word document using Winrar by setting a password. Surprisingly the archive was larger than the original file (631 vs 614KB). I then tested to see what would happen if encryption wasn't ...
1
vote
1answer
38 views

decrypt a soap message using openssl

I've tried to do the same as found in How to you manually decrypt a SOAP message using openssl? Unfortunatly without success... Here is my situation : I'm trying to do the same stuff only my data ...
0
votes
2answers
37 views

Calling string functions safely

I wish to implement some user callable functions in my code. I use something like this: function funcTest(){ echo "This is test function"; } if (isset($_GET['cmd'])) { $func = ...
-6
votes
1answer
46 views

Why study Information Security? [closed]

This question might be considered as overly general, but it has occupied my mind lately. I have decided to study Information Security (to be more particular, 'Networked Systems Security') at ...
-4
votes
1answer
105 views

How The Sony Hack Was Traced, and So Quickly? [closed]

What are the steps that are required to locate a source that have routed their traffic through multiple zombie hosts, spanning multiple networks/carrier/nations?
0
votes
2answers
44 views

HMAC: How unique does a nonce need to be if the Date is also part of the signature?

In a HTTP scheme where the HMAC-SHA256 signature is sent as part of the Authorization header, and the message input contains: The request method URL Post data Nonce Date HTTP header How unique ...
0
votes
2answers
149 views

How did piratebay.se search engine get in Chrome as an “other search engine”

I have an IT client with a user who had piratebay.se/... listed within his Chrome's (v39, 64-bit, OS X, 10.10.1) "Other Search Engine" section. I know a user could manually add it and suspect the ...
0
votes
1answer
112 views

Where can I download the Sony hack malware (for analysis)? [closed]

I want to analyze the Sony hack Malware as there have been a lot of stories on who is responsible; from the US government implicating North Korea to news articles stating it's an inside job. The fact ...
3
votes
2answers
249 views

Is Double NAT a secure way to create a public wifi network?

I'm trying to create an open, public WiFi network in my house for guests to use, as I am hosting a (somewhat) large party later tonight. However, none of my routers have any built-in guest networking ...
0
votes
1answer
47 views

Windows 8.1 full disc encryption

I have a zenbook ux302 that I want to do a full disc encryption on. I had no problem using bitlocker on my stationary computer, but the zenbook doesn't seem to have that functionality? I have the ...
0
votes
1answer
28 views

Modern Browsers, Safe to Ignore CSRF?

For users using modern browsers, is it safe to assume they won't be able to be hijacked via CSRF and the likes? If not, how likely is it that an attack can take place?
1
vote
3answers
48 views

Doesn't seem to be able to capture the packets I need [ANSWERED]

I've been trying to capture Telegram messaging application's packets (for my class project) but I couldn't get anything out of the punch of captured packets I got. Telegram does AES-256 encryption ...
0
votes
1answer
111 views

Good password hashing algorithm compatible with PHP and Linux apps

I'm looking for a password hash method for a new server system. The hashes must be generated from PHP code and verified from PHP as well as by a number of applications on a Linux system. I know that ...
0
votes
2answers
86 views

Only HTTP(S) port is open. Why do I need to worry about unpatched software?

Unpatched software poses no risk by themselves. They're only problematic when someone exploits it. How could malware get into my system if I do have unpatched software in general and I'm connected to ...
0
votes
1answer
55 views

Why is browsing while logged onto a VPN from public wifi more secure than not?

I've been trying to wrap my brain around VPNs for a while now, but can't find a good source that answers the questions I have. In particular, I can't understand why browsing from a public access ...
0
votes
1answer
45 views

How encryption/decryption of RSA private key by passphrase works?

I would like to know how exactly the encryption of private key by passphrase works. I am a software developer with no background in cryptography and I know only some basics. When I open the private ...
1
vote
1answer
122 views

SHA256.DB30.com listing of email account

After searching a gmail account in Google I've found a result for the website SHA256.DB30.com. The page just shows the name of the gmail account and a list with major and minor hash. From my basic ...
1
vote
3answers
54 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
0
votes
2answers
32 views

Tails OS for Android and PC?

Can I use Tails OS on a USB-stick on both an Android tablet and a PC, or do I have to have two different versions? Would I have to go into the BIOS to make this work?
0
votes
1answer
30 views

CSRF Guard: Injects token in POST Request?

I have implemented CSRF Guard into my web application. It's working fine for GET requests (with AJAX and without AJAX) however for POST request token is not getting injected into the request that's ...
3
votes
4answers
79 views
+100

Safe storage service for private keys

Is it currently technically (as opposed to financially) possible to provide a fairly secure means of providing a storage facility for private keys, not excluding physical verification etc? As in, you ...
0
votes
1answer
38 views

How to prevent outgoing UDP attacks?

My server has been the target from hackers 3 times in the last month, and the attack seem to follow the same pattern. The attack another site from my server using UDP connection. The report from my ...
0
votes
1answer
27 views

Why is there a path to a .pdb file in an exe I am trying to reverse?

My query is ,if I'm seeing a .pdb path in a exe(VC++) what conclusion can I draw from it.Why does the exe have these paths and does it have significance in malware analysis? eg ...
4
votes
1answer
50 views

Suspecious js file sent as email attachment

I received a js file with following code in my spam folder but I decided to take a look into the file. Do anybody of you know what does this code might do? var evl='';function nr() { evl = '}; ' + ...
1
vote
3answers
90 views

Security in Windows 7 vs Ubuntu

I have two semi-related questions about the security-related reasons I hear for switching to Ubuntu over Windows 7 (or from other Windows OSs to other Linux distributions). Someone people say that ...
0
votes
1answer
30 views

Mobile Game Auth Token Stolen [closed]

Basically someone sniffed my packets and stole my auth token/cookie for a mobile game I have played on for a year and spent thousands on (crazy I know) and now they are controlling my account through ...
-1
votes
2answers
45 views

Is Firefox on Ubuntu less secured (does it not confine Flash)?

Ubuntu Linux makes it easy to install Flash as soon as you encounter it. Just like Firefox on Windows really! Installing it on Ubuntu even provides security updates through the standard OS method. ...
10
votes
3answers
467 views

How do RSA SecureID ® Keys Work?

I have been using RSA SecureID ® Keys for quite some time now (perhaps 10 years), for things such as securely my home banking account online or accessing my company's network of computers from home. ...
2
votes
2answers
81 views

How to ensure that a login is really going over http?

So I've been offered the chance to go to a day long security awareness event hosted by some organization. On their site, I noticed the login box in the corner, but the site was delivered on HTTP. ...
1
vote
0answers
20 views

Force TLS on mobile app

i'm developing a mobile application for iOS and Android. On this app i'm asking resources on a secure server through ajax. Server's developers asked me to force the call in order that we use TLS ...
2
votes
3answers
249 views

How secure is an Activation Email?

Is there any risk to an Activation Email? My ASP.NET Site is set up so that a user has to check their Email and click an activation link which is made of a GUID created as their user ID in the SQL ...
-6
votes
2answers
54 views

Large web application security challenges [closed]

What are the biggest challenges of security in web applications? I want to do a search in the area but I'm not sure what I want to look, I want something that people think it is impossible to serve ...

15 30 50 per page