-1
votes
0answers
12 views

What is the Address Format of XMPP? [migrated]

If I type "netstat -an" on CMD how can I tell what connections are based off messaging services - particularly XMPP?
0
votes
1answer
28 views

Alternative to ICANN? [on hold]

What are major DNS services offered that aren't state-controlled. Better yet, why can't we take Bitcoin's model and create a truly decentralized system with P2P DNS? I see potential reasons behind ...
1
vote
0answers
57 views

Ability to decrypt intercepted encrypted SSL traffic when having private key [duplicate]

I was reading some blog posts about the Heartbleed vulnerability (who's not nowadays) and was thinking about the following. Situation A If I would use a regular SSL/TLS connection the handshake will ...
-4
votes
0answers
26 views

Where to go to get suggestions for answers to security question? [on hold]

I know this probably isn't the right place to ask, but it's the only place I can think of.... Where could I go to post a security question and get suggestions for answers? The security question is ...
2
votes
1answer
161 views

Heartbleed: hackers have already used the vulnerability? [duplicate]

Read about the vulnerability and decided to check out the site. Receiving a response from the php code was surprised. Look at the screenshot. Perl-script: http://pastebin.com/rL0XkewP Hackers ...
1
vote
4answers
178 views

I only use windows for games. Do I need anti virus protection?

I use Linux, and even though I'm not pretending my system is virus-free, it's generally accepted that even an aggressive firewall is not a requirement. I want to install Windows 7 on a machine which ...
-2
votes
0answers
29 views

Advice on Freelance Security Work Online/From Home/What Should I do? [on hold]

I would like to apologize ahead of time for such a long post but please bear with me (skimming is definitely okay with me). I hope this is in the right section this is related to doing ...
2
votes
0answers
10 views

Is DNSSEC immune to stripping signatures?

In my opinion, it should be possible to forge DNS reply so it doesn't include DS/RRSIG/... parts for any request, thus bypassing DNSSEC validation of resolved domain. Is DNSSEC system immune to this ...
0
votes
0answers
19 views

Equivalent of data:text/html,foo but starting with http:// [closed]

Is there a way to hardcode HTML data directly into a link starting by http:// ? Like using a special local ip on a weird port that would echo the URL or something ? The idea here is to store a HTML ...
1
vote
2answers
320 views

Is a C plugin safe if I read it through an echoing parser before?

I wanted to use sharable plugins for an application. However, the plugins were extremely time critical, so I wanted to distribute them as C libraries. Now, these are not guaranteed to be safe (the ...
51
votes
3answers
4k views

Heartbleed: Why does the client supply the length of the message at all?

"The fix for this bug is simple: check that the length of the message actually matches the length of the incoming request." Why do we even have the client report the length at all? If we can know ...
1
vote
1answer
47 views

Perplexities about TLS handshake

I analyzed the TLS (1.2) handshake and I didn't manage to understand the message after the Change Chipher Spec Here it is: It is called "Encrypted Handshake Message" by Wireshark and it is sent ...
0
votes
0answers
14 views

How to calculate FAR and FRR in pattern recognition?

I am working on a vein pattern recognition project based on SURF algorithm and euclidean distance. I have completed my program to find the maximum and minimum distance between vein features and find a ...
0
votes
0answers
25 views

Firewall best practice

I have to implement a firewall on a Mikrotik RouterBoard. What is a good way to do it? Here is my plan: Note: We are using an OpenVPN (bridge mode) server, a DHCP server, a PPPOE client, and an NTP ...
3
votes
2answers
130 views

Heartbleed and heap management - Why user data and passwords are kept in memory?

If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how ...
3
votes
1answer
95 views

Password Managers: encrypted database vs hashing strategy

I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
0
votes
3answers
83 views

When given a SSL-Private-Key, how would one generate a valid SSL-Cert from this? [duplicate]

in the hybris of leaked ssl-private-key everybody cries for new certs and new keys. my question: how would one generate a new and valid ssl-cert with the private key from my website? our certs are ...
0
votes
1answer
64 views

Will the recently found OpenSSL vulnerablity Heartbleed affect my public site for which I obtained an SSL certificate from a CA? [duplicate]

I had generated the CSR with OpenSSL. Do I need to regenerate a new CSR with no vulnerability due to OpenSSL in order to obtain a new certificate from a CA?
0
votes
0answers
17 views

Gladman's file encryption library = AES in counter mode with HMAC-SHA1 authentication?

I would like to use Gladman's algorithm to create AES encrypted data in JavaScript. I use the Crypto-JS library, but its performance is horrible. PBKDF2 is terribly slow, so I switched to another ...
2
votes
1answer
32 views

After restoring from a (valid) full disk backup can malware still persit?

In the comments to this question it is mentioned that even after a backup recovery malware still can persist. Do I understand that correctly? How is this possible? If Acronis True Image is used to ...
-1
votes
0answers
17 views

File Encrypted using Kleopetra, started showing error while decrypting? [migrated]

I encrypted one of my text files with Kleopatra, which I have been using for 4 months. It was working fine, but since two weeks I'm getting an error when decrypting the file: Can not connect to GnuPG ...
4
votes
1answer
159 views

How secure is OpenSSH on FreeBSD?

In a discussion about the recent OpenSSL information disclosure vulnerability, the subject of OpenSSH being vulnerable came up. Theo de Raadt had this to say: ... as long as you aren't using ...
0
votes
1answer
82 views

Can a VM be used as a home computer?

Our old computer is getting replaced, and I want to secure the new computer right from the get go. So I figured if I install something like VirtualBox first thing, I could then create one very ...
-4
votes
0answers
29 views

Can we all stop heart bleed duplicate posts [migrated]

I have noticed 9/10 posts appear to be about the heart bleed vuln and most of them seem to be duplicate questions.. Please search your question before you ask it leaving room for other topics
-1
votes
1answer
81 views

Heart Bleeding Bus [duplicate]

This may be a unwise question, but I'll ask anyhow. I have been analysis relatively a bit about the Heart Bleed vulnerability, and I'm curious as to whether it only affects web applications or could ...
0
votes
1answer
61 views

Cryptographic Hash function [on hold]

How can I implement a cryptographic hash function using the block cipher? I was wondering whether I can use AES in cipher block chaining mode to achieve this.
1
vote
1answer
184 views

I login to Stackoverflow (vulnerable) with Google (not vulnerable). Do I need to change my password? [duplicate]

According to this heartbleed mass test, Stack Overflow is vulnerable whereas google is not. I use my Google ID to logon to Stack Overflow (and some other sites). Do I need to change my password? In ...
0
votes
1answer
112 views

are there serious weaknesses in this free password management system?

I want to protect my passwords for free and store them on a machine that might get stolen but have the passwords very securely backed-up in the cloud, again for free, and minimize the total lifetime ...
3
votes
1answer
110 views

API to change passwords?

After I learned last week that the login data of some of my accounts was leaked, I had to change my passwords for more than 30 sites. That was tedious! As luck would have it, some days later we ...
1
vote
1answer
106 views

Ethicality of websites that test other sites for Heartbleed [closed]

I realize that this may be more of an opinion type question, but I see a lot of questions on ethics in this forum so I hope mine fits in. I was reading a BBC article about Heartbleed, and in the ...
-1
votes
0answers
23 views

Heartbleed & SSL Certificates - What do we do to protect ourselves as end users? [duplicate]

I seem to be hearing a lot of mixed opinions on this subject, so I figure I will turn to you guys for some advice. From my understanding, we should consider any SSL certificate (generated by openssl) ...
2
votes
1answer
41 views

Which information does a whois lookup reveal about the registrant of the domain?

A friend of mine recently got her Gmail account "hacked" because of a weak password (the same as her login..). While sanitizing her account, I removed the forwarding of her emails to one email ...
-3
votes
0answers
26 views

From where to learn Linux [closed]

Everybody says: "Before get into pen testing learn Linux and Windows". I'm using Linux, but I can't find any free material on Linux, only the documentation project. Should I learn from there or you ...
1
vote
0answers
18 views

Password security on lost or stolen smartphone

I have a number of apps on my smartphone that store the passwords - facebook, mail, etc. So say the phone is lost or stolen and the finder decides he wants my passwords - what can he do to get them, ...
-2
votes
3answers
50 views

Does HTTPS retrieval, among its other effects, sign a document? [duplicate]

Does HTTPS retrieval, among its other effects, sign a document? I'm asking in hopes of understanding in more specific details what TLS accomplishes. I will try to elaborate my question, as follows. ...
0
votes
1answer
17 views

problem upgrading openssl on ubuntu servers [closed]

I'm running Ubuntu x86_64, and want to upgrade to OpenSSL 1.0.1.f. wget <openssl latest> tar -xzvf openssl.tar.gz cd <openssl dir> ./configure --prefix=/usr make In the console output, ...
2
votes
0answers
65 views

Encrypt Android app data and send to web service

I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone. Let's ...
-2
votes
1answer
37 views

What causes an Operating System to become Corrupted? [closed]

What Causes an Operating Systems ISO image to become Corrupted? I found an ISO image of windows 7 off the internet and now when I use windows 7, its extremely slow. What causes this? I cannot boot up ...
1
vote
0answers
32 views

What part of the browser is typically attacked? [closed]

Pretty sure that browsers are compromised most often through their plugins, at least, that's what I keep reading. So, then, does that mean the browser itself has vulnerabilities, and the plugins are ...
0
votes
0answers
23 views

What causes an antivirus to not be able to remove threats? [closed]

One day, when I used My Windows 7, my antivirus (AVG Free) detected 257 threats. The option to remove them was not able to be chosen. The button to remove them was gray and I couldn't select the ...
0
votes
0answers
13 views

How do I enable EVP functions in openssl? [migrated]

I am trying to update my webserver to the latest openssl with the heartbleed patch ( 1.0.1g ). Grabbed the tarball from openssl.org. Said the usual ./configure; make; make install. Had to say ...
3
votes
1answer
54 views

Is there an actual use for OpenPGP authentication keys?

The OpenPGP specification (RFC 4880) describes, page 34, the different capabilities that an OpenPGP key may have; including: 0x20 - This key may be used for authentication. In GnuPG, one of the ...
24
votes
3answers
1k views

How can an attacker use a leaked private key?

I admit that while I'm a programmer, my crypto/security knowledge is fairly basic. I understand that the potential of leaking private SSL keys is cited as one of the most serious effects of the ...
7
votes
1answer
1k views

Check logs for Heartbleed exploit use?

According to articles such as the following, it's apparently possible to check logs for heartbeat requests matching the payloads described in the Heartbleed exploit. Is this something that any server ...
1
vote
1answer
301 views

How to verify OpenSSL's Heartbleed patch is the correct one?

In hearing about the Heartbleed vulnerability, I went to https://www.openssl.org/source/ to download the latest patch, but was quite surprised to find that the security certificate for that site has ...
-5
votes
1answer
86 views

Heartbleed “OpenSSL” extra clarification? [duplicate]

I Didn't get how this bug can be used against me ! the scenario need more explanation , User ------ Connected "OpenSSL" ------ Gmail So , if a user in my network exploiting this bug against me , ...
1
vote
0answers
45 views

Local lan drive by download

Basically, I'm testing a local network, on which I'm able to use ARP spoofing. I now want to try and infect one of the Windows boxes on the network with a backdoor. I could inject an iframe into their ...
-1
votes
0answers
17 views

User experience monitoring [closed]

Has anyone come across User experience monitoring software like Logfiller before? It appears to be a totally new category of security / log management, and wondered if there was actual value in it. ...
3
votes
0answers
59 views

Google ads and/or DoubleClick wants to access the keyboard API in Firefox? [closed]

I have started Firefox in an Ubuntu terminal, and now I see these messages during browsing: "No permission to use the keyboard API for http://googleads.g.doubleclick.net" I mean... WTF? Why does ...
0
votes
1answer
20 views

SmartCard Key Extraction / Alternatives

(1) As it is possible to extract the secret key from a SmartCard using laboratory equipment, I wonder if there is any (new) way to protect against this sort of security breach? Does it affect all ...

15 30 50 per page