All Questions

1
vote
1answer
69 views

How does a browser choose which certificate to use if my web server has multiple certificates?

I'm using Apache 2.4, with two certificates, one RSA signed by CACert, and one ECC self-signed. Neither of these certificates provide a path to a broswer-trusted root certificate. My question is ...
0
votes
0answers
43 views

PCI-DSS: Recomendations for Mixed-Mode Virtual Environments

We are PCI-DSS 2.0 compliant. We have three internal networks: GENERAL (workstations, app file servers) workstations can RDP to the PCI servers in order to work on the cardholder data. MANAGEMENT ...
2
votes
3answers
85 views

Can password_verify() be used to identify password after database breach?

I am a newbie to PHP and password hashing. I am following the instructions provided here to hash my user password before storing. My questions are: PHP recommends password_hash() method as a ...
-3
votes
0answers
41 views

How to modify and resend WiFi packets [closed]

I need to know how to capture a packet from WiFi using aircrack-ng suite, modify it and resend.
-2
votes
0answers
32 views

What is a DNS poisoning attack and how does it work? [duplicate]

So first of all is it the same as DNS cache poisoning? It's mentioned in this article http://www.infosecurity-magazine.com/news/sites-damage-china-blocks-edgecast/ in the second paragraph and would ...
1
vote
1answer
94 views

How to suspend a silent oberserver from Facebook account?

A friend of mine told me about the following problem: She used to login on Facebook on a computer of her boyfriend. After they broke up she recognized that he was able to login to her account from his ...
1
vote
1answer
70 views

Authenticated Diffie Hellman Key Exchange

It appears that the textbook version of Diffie-Hellman is susceptible to man in the middle attack and the use of digital signatures could prevent this attack from occurring. Digital signatures could ...
-3
votes
0answers
31 views

Suggest a Security Certification [closed]

I have been into security field for more that 1.5 years now and involved most of the part in finding the security bugs with in the web application. Now, I am planning to have a security certification ...
0
votes
0answers
17 views

Enabling BIOS disabled features during OS runtime [migrated]

I am trying to play with some of the features of my machine using the BIOS menu. Some of them(webcam, microphone, etc) are disabled for security (paranoia) reasons. Making the assumption that ...
-3
votes
0answers
21 views

Scrambling Data and Keywords sent over the internet [closed]

is it possible to Scramble data which we send over the internet? or make keywords look like mouse clicks or a software like on-screen keyword to be put between physical keywords and data being sent? ...
0
votes
0answers
16 views

The meaning of apparmor logs

What is the meaning of the fields in apparmor logs? Is there any document about it? Eg: apparmor="ALLOWED" operation="open" parent=32142 profile="/bin/su//null-1e" name="/proc/32143/attr/current" ...
1
vote
2answers
55 views

Is there any security in locking down a router by MAC address for wired clients?

At our office we have a router on the table, and the powers that be want to lock it down by MAC address to stop people from plugging in cables for other computers i.e. intruders. Given that resetting ...
3
votes
2answers
138 views

Website Defacing without hacking (google issue or trick?)

When I search in google for: "Impedance spectroscopy of MSDI (molecular semiconductor-doped insulator) ammonia sensors" The two first results are: "(molecular Semiconductor-doped ...
2
votes
1answer
81 views

Best practice in securing a web server and an offsite worker

Suppose I'm hosting a web server and a separate box offsite that crunches data. The web server interacts with the worker using the worker's API over port 2888. What would be the design of a secure ...
1
vote
2answers
70 views

Storing AES password for verification

I was wondering if such practice would be safe: I have a table that stores encrypted notes Every note has a data field and a password field When a password is entered, i want to select all notes, ...
12
votes
2answers
2k views

Best practice in web application security authentication to avoid bruteforce attack

I want to cover the possible cases of attacking. My application already has captcha and two-factor authentication, but how can I avoid a tiny attack without annoying my users? The possible cases that ...
-1
votes
0answers
15 views

How to remove Version Information from Encrypted OpenPGP message in Windows? [migrated]

I am using Keybase.io with GnuPG on Windows 8.1 via Powershell. I am wondering how to remove the Version line from the encrypted and or signed message. Here is example if what I mean: -----BEGIN PGP ...
1
vote
1answer
33 views

Tracking sender of Email via email address ONLY

Is there a way to track the sender and the location via the email address only. The problem is somebody has created a similar sounding email id to send content to my official circle with a view to ...
2
votes
2answers
94 views

_ _ VIEWSTATE to Protect Against CSRF

I am not a .NET developer and I am trying to understand how exactly does __ViewState protect against CSRF/XSRF attacks. I came across the following : security Stack exchange discussion on similar ...
-1
votes
0answers
35 views

How to be secure on a unsecured wifi? [duplicate]

Firesheep can catch all packets transmitted to an open network. If someone puts a password "password" on the device, and tells everyone the password, will this stop Firesheep?
0
votes
0answers
35 views

How is PBEWITHSHA256AND256BITAES-CBC-BC used to derive a key that can in turn be used as a key to encrypt using AES in CBC mode? [on hold]

The user password is expected to have very low entropy. The salt that is to be given as one of the parameters to the PBE will be generated per user. I should use a different IV for each AES ...
1
vote
0answers
79 views

Password automatically typed into user box on facebook [closed]

Just want to ask some questions regarding on this strange experience while logging on my account on Facebook There are cases that I'm accidentally typing my password into the username box of the ...
2
votes
1answer
61 views

Why protect files with sensative information with .htacces?

I was taught that an important step to securing a website (primarily with PHP) was to store all sensitive information such as database connection info, salt generation, etc. in a separate ...
-3
votes
0answers
19 views

Telerik ratings under a different user [closed]

I am a member of a website forum, that uses Like and Dislike buttons allowing members to vote up or down any post from other members. I would like to know how I can hack these controls to force Likes ...
0
votes
2answers
50 views

What's the best way to authenticate an user using a websocket?

I'm creating a multiplayer game(based in websockets) which runs directly from the browser and which has multiplayer functionality. Each player needs to have his own account(Username and password). ...
2
votes
2answers
42 views

Are default ACL in Linux a security flaw?

I'm currently learning the Linux system and I have a question about the default Linux ACL. On my virtual machine, all files created are set with the default permissions as follows: -rw- rw- r-- ...
12
votes
0answers
2k views

Should I Use Base64 or Unicode for Storing Hashes & Salts? [migrated]

I have never worked on the security side of web apps, as I am just out of college. Now, I am looking for a job and working on some websites on the side, to keep my skills sharp and gain new ones. One ...
2
votes
1answer
40 views

User IDs containing URIs

When adding a User ID to your OpenPGP key, you are typically asked (for example by GnuPG) to provide a name, a comment, and an email address (where each part is optional). This format (Name (Comment) ...
1
vote
2answers
142 views

Stream/block cipher add a simple hash to guarantee integrity

The question is simple: Adding a hash to a message and then encrypt it using a stream cipher / block cipher. Why can't this guarantee integrity of the message upon decryption?
-1
votes
0answers
30 views

Is Chip and PIN still Broken [duplicate]

http://www.cl.cam.ac.uk/~sjm217/papers/oakland10chipbroken.pdf Has the industry changed yet the broken EMV standards?
0
votes
0answers
6 views

RSA Private Key: set Common Name [migrated]

I create an RSA private key openssl genrsa -out mykey.key 2048 Using a certificate and the generated key, I create a .p12 file openssl pkcs12 -export -inkey mykey.key -in certificate.pem -out ...
1
vote
1answer
29 views

Notifications (RSS or mailing list) of CVE with high scores for Windows and Red Hat? [closed]

I'm looking for a RSS feed or a mailing list that would allow me to be alerted of new CVEs impacting Windows or Red Hat that have a very high score, such as the recent ones for Shellshock and Winshock ...
4
votes
2answers
251 views

Placeholders for cshtml — ASP.NET

I'm learning Application Security, and tutorials such as www.asp.net discuss updating databases with placeholders, instead of directly using user input @{ var title = ""; var genre = ""; ...
0
votes
1answer
78 views

How many passwords should I have? [closed]

So I am upgrading my personal security. Most passwords that I use are generated by and stored in a password manager. There are a few places where I cannot use a password manager -- here, I plan to ...
0
votes
0answers
18 views

scanf of backspace (0x08) and EOT(0x04) [closed]

Can anybody say me which input I have to give on terminal to get 0x0804857d saved in the memory. The used function is scanf("%s", array) ic C language. The problem is that 08 equals to Backspace ...
1
vote
4answers
72 views

employing SSL even on non critical web server [duplicate]

I know that SSL should be used on web servers that need to gather credit card information etc..however, is it industry best practice to also turn on SSL even for non critical web servers? eg those ...
8
votes
3answers
2k views

Is it possible that authorities can't block a certain website

I was watching a very recent TV show, the FBI agent told the police that there is no way for anybody to block a live stream of a pedophile torturing a kid nor to trace it. Even when it's being ...
0
votes
1answer
46 views

What's the typical approach to caching invalid authentication attempts?

Clients (actually software pieces developed by some random dudes all over the Internet) are authenticating on a web server using "basic" authentication scheme and to do so they are passing the ...
0
votes
0answers
36 views

Question regarding SSL / TLS / Certificates in general [duplicate]

for the last two days I played around a bit with nginx's SSL configuration. A question came up: I created asymmetric key using $ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:4096 -keyout ...
1
vote
3answers
94 views

Potential risks when sending plain text E-Mails with encrypted attachments?

To ensure privacy in communication I encrypt and sign E-Mails using gpg4win. However, sometimes the communication does not work as expeceted (GPGTools and Outlook/gpg4win seem to be incompatible). In ...
2
votes
1answer
35 views

BTLE pairing: Where does the code come from?

When trying to pair 2 bluetooth LE devices (e.g. 2 iPhones), a popup shows up that requires to input a code displayed on the other device. I am aware of the concept of out-of-band authentication, and ...
0
votes
0answers
15 views

Is it a security risk to give read/write permissions to /Library/WebServer/Documents to my main account?

The default setting is that the apache2 root-directory Documents is owned by root and I have to enter a password each time I change it. This is why I want to give full permissions to my user account ...
2
votes
1answer
62 views

Why Shellshock works in useragent string?

I was wondering why Shellshock works when put in the useragent. Based on what I could find it is because a web server (e.g Apache) uses the useragent string in its internal working. Why would a ...
1
vote
2answers
49 views

Does using the Google Maps client-side Javascript API leak data?

I am currently working on a project where we are using Google Maps to display some data by using the client-side JS API to manually add the points on to the map once the user has clicked on a button. ...
0
votes
1answer
47 views

bitlocker and data retrieval

The data on my hard disk was deleted from an encrypted bitlocker hard disk. After deleting the data, a new partition including a new installation of windows was created on the same hard disk. The key ...
0
votes
1answer
48 views

iptables intercept received packet with proxy and then forward to destination

Lets say I receive internet through my eth1 port and share it via hotspot to other devices (wlan0 port) [internet]----(eth1)[my computer](wlan0 hotspot) | ...
0
votes
1answer
144 views

Does MS14-066 affect CE versions of Windows?

I'm aware of the impact of MS14-066 to Windows servers/workstations, and have managed the patching our of desktop networks. However, I am concerned that our Windows CE systems may also be affected, ...
0
votes
0answers
8 views

IOS Device ID query [migrated]

I am doing pen test of application on IOS device 7.1.2. Customer want me to find the IOS device ID in the keychain but I am not able to do it. If I am changing the device ID name then I am not able to ...
0
votes
0answers
35 views

Could someone compare basic anonymity vs basic computer hacker anonymity? [duplicate]

So, let's say one just doesn't want the government/corporations to know what they are doing online. Let's say, for example, that they just don't trust the NSA, FBI, Google, etc. So what are the steps ...
0
votes
2answers
46 views

Storing CardHolder Data using RC2 encryption

I would like to know if storing credit cardholder data using RC2 encryption requires to be compliant with PCI DSS. Currently the 16 digit PAN number and expiry date is stored in the database. The PAN ...

15 30 50 per page