-3
votes
0answers
17 views

PCI Compliance for 2checkout Payment API [on hold]

I am using 2checkout Payment API for payments which requires PCI compliance, for which I registered with 2checkout's PCI partner Trustwave. Trustwave scanned my server and this scan passed. The next ...
1
vote
0answers
22 views

Chosen plain text and chose ciphertext definitions clarification [migrated]

I am trying to understand a concept of CPA and CCA attack and I cannot get one thing from the definition. If an attacker can execute a CPA attack for something like Send 100 dollars to attacker ...
2
votes
1answer
34 views

New certificate but what about the keys?

One of our SSL certificates has expired and along with that so has the keys. I have a re-newed certificate but no re-newed keys. The posting Should I change the private key when renewing a ...
-2
votes
2answers
53 views

Use of Nmap ssl/http md5 and SHA1 hashes

I have below stated result on of the system by map: 443/tcp open ssl/http Apache httpd 2.0.52 ((CentOS)) | http-methods: GET HEAD POST OPTIONS TRACE | Potentially risky methods: TRACE |_See ...
4
votes
2answers
92 views

What is a “roving” backdoor?

What is a "roving" backdoor? I understand the general concept of a backdoor. Emphasis on keyword qualifier: "roving"...
4
votes
1answer
78 views

Is encrypted data a good random source?

Given that someone needs my encryption key to predict the output, can I encrypt arbitrary data (zeroes, system logs, personal photos) with AES and a secure passphrase, and use the result as a ...
0
votes
1answer
11 views

How to see absolute difference between DV and OV certificates? [duplicate]

I know that browsers show no difference to the user between OV and DV certificates, but what is a sure way to find out if a certificate IS or ISNT an OV certificate? Also, are there any technical ...
1
vote
0answers
14 views

Limited Buffer Size for shellcode on 64 bits machine

This question bother me for so long and I hope someone can give me an answer for that. I have a code snippet which have the classic strcpy vulnerability int main(int argc, char argv[][]){ char ...
5
votes
1answer
76 views

Locking Linux system to work on certain hardware only

Is there a way of locking a Linux system to work with a specific (pre-defined) hardware only? I am developing a commercial product and want to make it a bit harder for someone to clone the whole ...
0
votes
0answers
50 views

How to know our mobile number or phone has been hacked?

We have a Xiaomi Redmi 2 phone and a sim card in it. Yesterday we started receiving angry and swearing text messages. we called the numbers back and apparently a mass angry text messages have been ...
4
votes
1answer
41 views

How important is split-horizon DNS?

Split DNS returns different results depending on the source IP. It's commonly promoted as significant security measure for internal resources, for limiting enumeration and discovery. I've had many ...
-2
votes
2answers
49 views

XSS TRACE method [duplicate]

Could TRACE METHOD cause harm to my website? If this request is made: TRACE / <script>confirm("Java Script !")</script> HTTP/1.1 Host: xxxxxdomain.com X-Wing: ...
5
votes
3answers
82 views

Forgot password and revealing whether account exists

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
-3
votes
0answers
34 views

Restarting a wifi router with too many connections at the same time? [closed]

Will router restart itself if receives too many connections at the same time, i.e. 200 connections. Will a enough big number of simultaneous connections bring the router down? Will this work? I ...
2
votes
2answers
58 views

How much information a Flash program (Flash app) can gather about computer when running?

Does anyone know if a Flash web application has access to local hard drive? What about OS information or hardware information? If I allow webcam and microphone access, how much information can it get ...
2
votes
2answers
168 views

Is always using HTTPS a good idea? [duplicate]

OK, this question might seem a no-brainer for a professional but keep in mind I am not a professional web developer so my knowledge in this field is very limited. I have been pondering over time ...
-2
votes
0answers
29 views

IP address in my ISP's netblock resolves to google [migrated]

This appears to be the same as in the following question 'google.com' DNS resolved to addresses of ISP I have noticed that everytime I start a browser, I was getting a connection to one or ...
-6
votes
0answers
23 views

advantages of torrent clients, torrent P2P [closed]

With the passage of time, torrents have become popular. Speed, reliability, data distribution are some of the advantages of torrent clients. What are some torrent clients that users can use to their ...
1
vote
0answers
54 views

How to store a file securely on the windows file system?

Problem: I have a windows service running under local system account. I have a blob of data that I want to store securely and persistently between reboots. I have decided to store it as afile( as ...
1
vote
1answer
32 views

302 redirect and the body on the page (you are redirected to …)

I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this: ...
2
votes
2answers
72 views

SSL stripping in home network

I am trying to monitor the traffic of some "smart devices" in my home (TV, coffee machine, ...) but most of them communicate over SSL. What possibilities are there to look into SSL encrypted ...
4
votes
2answers
58 views

Understanding Digital Certification as as a whole starting from a normal http request

I am very new to security and i do not come from an IT background. Please pardon me if i ask some very simple and questions that don't make sense. I am trying to understand the difference between ...
-1
votes
0answers
17 views

Is 3DES is a weak cipher? [duplicate]

Our application runs on JBoss 6 + jdk 1.7. We use the jdk provided SSL provider. The server.xml file contains SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA in the cipher lists. Is it a weak cipher? Should we ...
1
vote
2answers
97 views

Does WhatsApp disclose the sender's IP address?

Does WhatsApp disclose the sender's IP address? Is it possible to get it by running netstat -a or via Wireshark?
4
votes
1answer
78 views

How can I demonstrate that 3 independent root CAs validated my domain?

I am concerned about the hacking of a root CA and want to buy 3 SSL certs from completely different providers who will independently validate my identity. Then at presentation time, I will send all 3 ...
6
votes
6answers
51 views

Forgot password and revealing whether account exists [duplicate]

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
0
votes
2answers
79 views

Why is Facebook planning to drop support for SHA-1 encrypted sites, when they themselves use a SHA-1 certificate?

I noticed this problem when I implemented the Facebook Like Button plugin on my website, and got this error in my browser console: Hmm, I'm assuming that Firefox is talking about the last request, ...
-2
votes
1answer
44 views

Security of stock iPod vs. hardened Android [closed]

http://www.wired.com/2015/08/secure-way-communicate-IPOs-touch/ https://www.lawfareblog.com/iphones-fbi-and-going-dark I'm looking for some advice on how to affordably secure my electronic ...
4
votes
2answers
52 views

Can a website have multiple valid TLS certs looping back to multiple root CAs in case one of them is compromised?

Sometimes, CAs get compromised, like Diginotar or Comodo. In such an incident, anything can happen from individual certs being revoked to the entire tree being scrubbed from the cert store. A company ...
3
votes
2answers
114 views

My IP address switched suddenly and then switched back

Sometimes I look at the login history of my blog account (a Tumblr blog) to make sure no one else is logging in (because I have private posts that I want to keep private). Even though today I ...
1
vote
0answers
24 views

At what point is information encrypted when communicating from a C# program over HTTPS? [closed]

So I was running a communication log on an application I support I noticed that within the log there was a request string that displayed my password in cipher-text, but the next request string down, ...
0
votes
1answer
40 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
3
votes
1answer
67 views

How wifi sense actually connects to any network?

I read that using Wi-Fi sense, we can share our Wi-Fi networks with others and it stores pre-shared keys on Microsoft servers. Please help me understand the below scenario: I am sharing my network ...
0
votes
0answers
10 views

Executing ELF binaries in OSX [migrated]

I have a CTF related question and I was wondering if someone can point me to the right direction. I work on OSX Yosemite and I was going through some wargames and older CTF challenges. My goal is to ...
1
vote
1answer
34 views

Reflected XSS quote not encoded

I am attempting to exploit URL with a reflected XSS as follows: http://domain.com/vuln_parm= The contents of vuln_parm gets returned to the user as follows: <div attrib1="" attrib2="" ...
1
vote
2answers
32 views

Device visibility on a network

At my college dorm's Wi-Fi network, one device can play to any other network-connected, YouTube-enabled device on that network. Apple devices can also AirPlay to the one Apple TV connected here. How ...
3
votes
3answers
62 views

Site hack with email phishing scam [on hold]

We have a small business website that has been compromised. They are somehow getting customers order details and contacting them requesting their credit card details. We have had our web team and a ...
8
votes
2answers
175 views

Why is Tor over HTTPs insecure?

I don't get how a HTTPs connection over Tor can be insecure. Where's the difference between a normal HTTPs connection and a TOR -> HTTP connection? Many sites recommend to use the Onion-URL instead of ...
1
vote
3answers
127 views

securely storing passwords that can be retrieved

I'm trying to build a web application that can store passwords of other services like Facebook, Gmail ...etc. These passwords can be later retrieved and shown to the user. This has to be a web ...
1
vote
0answers
16 views

SSH-Keygen Fingerprint providing Letters and Numbers Result [closed]

I've been using SSH and public key crypto for a few months. I've run into a new problem with my install of the newest public beta of OS X, and can't find an answer online. When I run SSH-Keygen -lf ...
0
votes
0answers
12 views

Proving an encrypted message contains (but does not 100% consist of) a plain-text message? [migrated]

I have keypair (u,r), and two pieces of data, X and Y. I reveal X publicly but keep Y secret. Y has high entropy. I then combine X and Y, into c(X,Y) = Z. I encrypt Z, into "encrypt(Z,u) = Q". r ...
14
votes
4answers
2k views

What is the difference between http and https with a self-signed SSL certificate?

A colleague of mine has told me he doesn't see why there is a warning when visiting a HTTPS website with a self-signed certificate saying that the security may be compromised, but there is no warning ...
1
vote
0answers
24 views

Configure CLAMAV for XML inspection

How would I configure clamav to look for XML exploits. I am not even sure if it supports it but from reading the conf file I am not really seeing any mention of XML. to test this I have literally ...
1
vote
0answers
66 views

Virtual phone number [closed]

I want to set up an account for a certain service while remaining anonymous. This service requires phone activation and where I live it not possible to activate a sim card without submitting id to the ...
3
votes
1answer
101 views

OS login password: How does it work?

I am making an application to create a password for a user. I am a bit baffled over how it all works though. Namely I want to be sure that my application will store the correct hash so the user can ...
31
votes
4answers
5k views

How does a hacker know how many times a password was hashed?

I've been reading a lot of questions about security and hash functions on this site and others. I am not an expert, just a curious mind and in my understanding the more iterations used to hash a ...
1
vote
1answer
66 views

Network setup for malware analysis lab in a corporate view

I am planning to setup a malware analysis lab in the Incident Response team of the company I work for. As I am basically a malware analyst I some how managed to get up with the malware analysis lab ...
1
vote
3answers
82 views

Where to place PHP files for security?

A simple question, where do you place PHP files on a server? I can't seem to find any good information on this. Obviously public files should be in the document root somewhere/somehow, since they ...
30
votes
3answers
4k views

Is Ghostery safe to use?

I've heard about Ghostery, a browser extension/plugin that blocks web trackers. But according to this link it sells our data. Are add-ons and plugins open source in Firefox? Is there another ...
2
votes
2answers
57 views

Is a precompiled Java program affected by Java vulnerabilities?

We know that Oracle publishes Java updates due to vulnerabilities / security issues and therefore we should make sure that we have installed the latest version of Java. Now there exist programs like ...

15 30 50 per page