1
vote
1answer
34 views

Is Two-way SSL sufficient for Multiple web servers communicating to each other?

I have a fixed number of web servers. Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one ...
1
vote
2answers
69 views

Rationale behind hiding originating IP address in emails?

Gmail has been hiding originating IP addresses for quite some time now. Hotmail and Yahoo have started doing this too. Apart from obvious privacy implications of revealing the sender's IP address, is ...
0
votes
0answers
33 views

Host Protected Area forensics

I see vague notes on forensic HPA interest, but it's never specific. What kind of information can be extracted from a PC's HPA? From ...
0
votes
2answers
63 views

Is there any way to determine the location of a laptop based on the MAC address or laptop serial number? (Lenovo)

If I have the MAC address and S/N of a Lenovo 3000 Laptop, is there some way for me to find exact street location of this laptop ? This machine was stolen from me last year and was my back up machine ...
-1
votes
0answers
19 views

Analog Camera with Static IP [closed]

For office, I have couple of analog cameras and DVR system. Now, I want to watch the live video on my phone when I away. I got a fixed IP from my ISP, and have a router. But what settings to do for ...
1
vote
3answers
83 views

Should I use my trusted VPN for all my traffic? [on hold]

I use my trusted VPN primarily for the sake of anonymity (to avoid data being collected about my Internet browsing), although I am aware of its security benefit -- traffic encryption. My question, ...
-5
votes
0answers
38 views

How to scan a target behind a firewall using Firewalk? [closed]

I have used firewalk nmap script and the output of this script is: Host ip XX.XX.XX.XX Blocked ports 1,3-4,6-7,9,13,17,19-20 Traceroute: my router ip not important ip ip ... the host which in ...
5
votes
3answers
143 views

In a monitored network, can the admins tell if Tor is being used?

I'm not asking if Tor is secure, I'm asking if an observer can know you are using Tor? For example if a persons ISP or company network monitors traffic would they be able to determine with certainty ...
1
vote
1answer
67 views

Is HTML5 sessionStorage secure for temporarily storing a cryptographic key?

Assume I am building a local web application (e.g. browser extension) in HTML5 to encrypt a database locally. Access to the database is controlled by a password and a cryptographic master key is ...
0
votes
0answers
12 views

Where can I view IO device history in Windows (8/7)? [migrated]

Essentially I need to view the IO devices that have been connected/disconnected in the past, and when they'd been connected. If such logs don't exist, how can I record them? I was able to find ...
0
votes
0answers
43 views

How to begin learning about cyber security? [closed]

I've been trying to self-teach myself various parts of cybersecurity, and I've been having a lot of trouble finding good resources for beginners. Are there any good sites visits or other resources ...
0
votes
1answer
33 views

gstatic.com resolves to local isp

In the light of Snowden revelations I become very paranoid. Yesterday I did a netstat -t -p and from my browser there were several connections pointing to my isp. I had only 2 pages open. Trying to ...
2
votes
1answer
41 views

Is it safe to enable SSLv2 ClientHello support?

In the wake of the POODLE attack, many web sites have dropped support for SSLv3. But some clients still in relatively common use as of May 2015 still initiate the handshake with an SSLv2 ClientHello ...
2
votes
3answers
57 views

How can I avoid buffer overflows when programming an Android app? [on hold]

I'm just starting out in Android and I've gotten my head around general programming within Android, but I've recently started trying to research security within Android. What coding practices would ...
1
vote
0answers
25 views

Firewall in virtual machine

I'm putting my server to use as a file server and a firewall. I'm looking at KVM or Xen VM setup where file server and firewall get their own VMs and host is just supplying the hardware (so Xen way, I ...
3
votes
1answer
32 views

How does Memory Corruption apply to Android?

I have researched several DoS attacks within Android e.g.: CVE-2015-1474 CVE-2013-5933 CVE-2013-4710 CVE-2012-6301 etc. And although I found DoS attacks within Android difficult to understand at ...
2
votes
1answer
36 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
-6
votes
0answers
46 views

I have iPhone 6 plus - can my boyfriend hack into my accounts? [closed]

I have iPhone 6 plus - can my boyfriend hack into my accounts using apps or anything?
6
votes
2answers
299 views

How does getting a remote shell via exploiting a vulnerability really work?

I can understand what a buffer overflow is and that it allows you to write in places of the memory that you shouldn't be able to. I can also grasp the concept that there may be other software ...
2
votes
1answer
35 views

REST API - XSS prevention - When and how?

I am currently developing a REST API with Java EE and MySQL, it will feed Data to a Android App. The Data comes from an AngularJS Frontend. So my questions are, when: When do I escape the data? Before ...
1
vote
1answer
53 views

Is it worth it to implement both SHA2 and SHA3 at the same time?

I'm creating a password storage system for a web server I'm building for fun. Would it be more secure for me to use both SHA2 and SHA3 for hashing, and then store them in a database? If I use both ...
0
votes
0answers
21 views

How secure are Ubiquiti Networks UniFi AP's restricted subnets?

I have a UniFI AP and create a quest network with subnet restriction 192.168.0.0/16. My local network is in 192.168.178.0/24. The gateway is 192.168.178.1. My question is: Is there a way that quests ...
1
vote
1answer
50 views

How to filter secure (HTTPS) websites by URL with regular expression?

I need to block access to certain pages on a website using regular expression and/or wildcard. The site uses https and therefore cannot be blocked using regular parental control filters (this is ...
0
votes
3answers
66 views

What does this snippet of code do exactly? found it inside a number of files on my webserver [closed]

Okay so I found some PHP code as I was randomly editing a website I've had for a very long time and I have noticed this: <?php #2b8008# error_reporting(0); @ini_set('display_errors',0); ...
0
votes
0answers
25 views

Windows Firewall Connection Security with Certificate (2) [migrated]

I have a similar problem as the question with the same title from last October. On a Windows Server 2008 machine, using Windows Firewall's Connection Security rules, I need to establish an IPsec ...
0
votes
1answer
53 views

What makes an Android application vulnerable to Directory Traversal?

Definition of Directory Traversal Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root ...
1
vote
1answer
87 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
1
vote
2answers
75 views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution ...
4
votes
3answers
65 views

Why does Windows have a place to store intermediate SSL certificates?

As I understand the process of verifying a remote computer's SSL certificate, the remote system sends its 'leaf' certificate and any intermediate certificates, but not the root certificate. Executing ...
2
votes
0answers
25 views

General Entropy as opposed to Password Entropy [duplicate]

I know that the formula for the entropy of a message is: (I believe b can be set to 2) but when calculating the entropy of a password websites usually only compute log2(p-1), ignoring the first ...
5
votes
0answers
70 views

When do shared disks “leak” data to other VMs, and how is that mitigated?

Inspired by this answer, I would like to know what are some common threats and mitigation techniques used to prevent one VM from leaking data to another via the shared storage infrastructure. ...
4
votes
4answers
906 views

Does altering characters of a file url lead to another file?

I have a link to a file which is stored in cloud: https://docs.google.com/file/d/0B8Tf19cw9c8SNnFPamhRWGFwaTq (I have edited a character from the original for privacy) So if the garbage ...
-1
votes
5answers
85 views

Security software to shutdown PC unless specific approach? [on hold]

For future refence: In light of answers and critique, my question should have been: 1. How does one make sure a physical attacker with access to a powered, but locked FDE PC fails his/hers attempt to ...
3
votes
1answer
42 views

How to decrypt email with revoked key in enigmail?

Is it possible to decrypt a message which is encrypted with a revoked PGP key? I still have the private key, but Enigmail doesn't show me revoked keys neither does automatic decryption. Edit: I ...
1
vote
0answers
14 views

Logging login events on my Windows 7 desktop OS to a file [migrated]

I suspect someone is login into my computer when I check event viewer. Is it possible to have a script on windows 7 to record every login onto my windows 7 desktop pc?
3
votes
2answers
70 views

Found this textarea with PHP in it. Might it be malicious/exploitable?

I came across this textarea on the website of a Medical Center. Clients enter sensitive medical data here. What users see: HTML: <textarea name="message">&lt;?php echo ...
2
votes
1answer
62 views

How can someone sniff dial-up connection using phone line?

Let's assume we have a computer that sends packets to the internet using dial-up connection, and we have access to the analog data on the phone line(we have access to the phone line), how can we make ...
3
votes
1answer
45 views

Is it safer to store valuable information on a unsecure client or send the data through the internet?

Background: I'm creating a secure web app with the purpose to act as a no-knowledge storage for small data (we're talking a few bytes). Since all the encryption and decryption happens client-side, ...
0
votes
2answers
54 views

Is WPA(2)/AES or some derivative really perfectly secure?

It is said they are uncrackable for now, but my question is how much uncrackable are they? Of course, it requires a situation to answer this, so here comes an assumed situation(the worst possible ...
0
votes
0answers
51 views

Is there any Windows/Linux host officially available on the Internet for practicing penetration testing? [duplicate]

Is there any Windows/Linux host officially available on the Internet for practicing penetration testing? I am having continuous trouble with Virtual-Box. It is horribly slow to load and giving me ...
0
votes
2answers
51 views

Preventing SSL strip attack

Is it possible to detect a ssl strip attack by checking whether the page deliverd is https or http using javascript?I am assuming that the response page is https page instead of http?
0
votes
1answer
41 views

Can XOR be used in a Merkle Tree instead of concatenation?

I am trying to understand why, in a Merkle Tree, the concatanation between hashes is used - and not for example the XOR operation. Can they be considered the same for the purpose of a Merkle tree? I ...
16
votes
4answers
1k views

Server for School Coding Assignments

An introductory C++ course is offered every year in our university. In order for students to code in C++ and submit their assignments, we give them shell access to a Linux server. They use ssh to log ...
2
votes
1answer
28 views

How can the parallelization in CTR mode be attained?

I am using CTR mode to encrypt/decrypt files. Theoretically CTR mode is faster than CFB or CBC because of its individual operations on blocks. In my case CTR mode takes almost as long as CFB. How can ...
-1
votes
0answers
18 views

TLS 1.1 android 4 support [closed]

Before Android 4.1 we couldn't add TLS 1.1 or more precisely tls pinning. IS there anyway to make android use TLS 1.1 for version before android 4.1
1
vote
2answers
51 views

Can I use AES CTR mode to encrypt files with same key and nonce?

I want to encrypt the files stored in SD card and I am using the CTR mode of AES to encrypt it. The key and IV are fixed. So each time I encrypt/decrypt I use the same key and nonce. Most of the ...
5
votes
3answers
130 views

Does TLS_FALLBACK_SCSV provide blanket protection against downgrade attacks?

The TLS_FALLBACK_SCSV flag was touted as a way to prevent POODLE, which abused the potential to downgrade to SSLv3 from TLS. Does the implementation of this flag prevent similar downgrade attacks ...
2
votes
1answer
61 views

Prevent shell script inside image file

Recently, one of my website was hacked by someone who uploaded an image (shell.gif) to my server. I have put server side validation to check file extension + mime type of the image. However, they are ...
-4
votes
0answers
33 views

How to Download the data from Telecom Tower at a base station [closed]

Can any suggest me or direct me to reference. I want to know the mechanism how the telecom tower data is downloaded into the server of base station. If this question does not fit the section pls ...
1
vote
1answer
69 views

Is there a backdoor in the hardware of our smartphones?

I don't know for you but I always felt like Android especially is not safe. Is somebody - the government or other - able to listen to my microphone, or access my hard drive remotely ? I'm wondering ...

15 30 50 per page