0
votes
2answers
75 views

Can you login to Facebook through a VPN or a proxy?

I've heard that there's a new type of security in Facebook. When logging in they automatically check if the IP Address is similar to that of the original IP during registration. That's in order to ...
1
vote
0answers
40 views

SS7 exploit on the wiretapping part

Wondering if there are info/source code/guide on the SS7 wiretapping part (SMS interception). I had a look on the track any mobile by a German researcher, and on PTsecurity about how the structure ...
-5
votes
1answer
69 views

What is AES 256 bit encryption? [on hold]

I was looking through some apps to store my passwords in on the App Store when I found one that boasted an "AES 256 bit encryption system". Now that sounds all very good and well, but that doesn't ...
7
votes
3answers
1k views

Why aren't ransomware deployers arrested? [on hold]

Why aren't people who use ransomware to extort money from people arrested? Using ransomware is illegal, presumably. The idea that Bitcoin is anonymous is a myth. Given this, it seems like they ...
4
votes
1answer
110 views

Can a SIM card propagate malware?

Is it possible that malware can infect a SIM card? What will happen when I insert the SIM card in another phone?
0
votes
1answer
93 views

website - infected by malware and if yes, how can I treat it? [on hold]

A friend told me that the website of our association, here , got blocked by the corporate network of the company he is working for, due to malware (see picture below) I've tried a few website like ...
-2
votes
1answer
62 views

Can government query company, such as Google, to get list of accounts associated with some information, such as IP address or phone number? [on hold]

UPD: My naive thought was that government requests should explicitly point account for which they requesting information. And that a broad requests like getting list of accounts logged during some ...
1
vote
1answer
27 views

Do IIS / ASP.NET / MVC version headers reveal patch presence?

Quick question: does anyone know whether the IIS / ASP.NET / MVC version headers, like this: Server: Microsoft-IIS/8.5 X-AspNetMvc-Version: 5.2 X-AspNet-Version: 4.0.30319 can be used to determine ...
2
votes
1answer
127 views

Enter the password outside the password field

If I press Tab twice after enter my username, I will type my password somewhere outside the password field. Are there any chances for somebody to catch my password when I enter it outside the ...
3
votes
2answers
69 views

Best practices to implement HTTPS in embedded devices

Embedded devices, such as routers, IP cameras, generally provide HTTPS access to the admin interface. These HTTPS implementations generally have a lot of problems (non-unique certificates, self-signed ...
1
vote
1answer
54 views

Can open source software be digitally signed?

I've read that installing Linux on UEFI PCs requires additional steps to disable the requirement for digitally signed bootloaders. But I thought that open source software can be digitally signed by ...
1
vote
1answer
78 views

Should VPN passwords be stored in plaintext?

I know nothing about setting up a VPN, but it happens that I use a VPN add-on for Firefox, and that the VPN provider stores the user password in plaintext. Last week I installed a VPN add-on for ...
0
votes
1answer
37 views

Free tools to run automated security audits for PHP code? [on hold]

I'm looking to scan my code for potential risks of SQL Injection, XSS, etc. Are there any free tools that can analyze code and give the complete reports. Thanks
1
vote
2answers
37 views

Strange apple dns answers

Could someone please explain to the results of a reverse DNS lookup I ran? dig -x 17.178.96.59 I was expecting apple.com but it also listed a whole load of PTR's. Many looked like phishing sites like ...
-1
votes
0answers
56 views

Is it more secure to always download app/update iOS via iTunes in PC/Mac instead of in iPhone directly?

Is it more secure to always download ipa and then sync iPhone/download update by iTunes instead of downloading them in iPhone directly? Because I think it allows me to never enter my apple account ...
3
votes
1answer
32 views

Turn RPi3 Wi-Fi adapter into monitor mode using airmon-ng

For some reason, I can't turn the built-in Wi-Fi adapter on the new Raspberry Pi 3 into monitor mode like I used to do on other platforms. First I kill the processes that interfere with sudo ...
5
votes
3answers
60 views

Asymmetric encryption and signature performed by hand

There are some methods of encryption so easy that you can do them be hand, but is there an easy(ish) method of private & public cryptography and signing that a human can perform it by hand? The ...
0
votes
1answer
47 views

How to verify the signature of DHE_RSA server parameters (TLS 1.2)?

By reading the TLS 1.2 specs I have been able to manually decrypt/encrypt pretty much all the steps of a TLS connection (DHE_RSA_AES_CBC_128_SHA cipher suite). One of things I am missing is how to ...
0
votes
0answers
9 views

OpenVPN in combination with SNORT

I'm working on one machine, where I'm planning to build VPN inside pfsense. But I'm not sure, if it's good idea to combine OpenVPN and SNORT together, if so, which rules should I enable/disable in ...
1
vote
0answers
23 views

OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out

I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
0
votes
3answers
54 views

Same wildcard cert from two different 3rd party CA's

We have a wildcard cert that's due to expire in three months. The CA won't let us renew it until one month prior to its expiration. We're thinking about using a different CA since we've since ...
5
votes
2answers
87 views

How to recommend a (more) secure router

A colleague asked me to recommend a router for her small business. I asked her for a specification list, and on her list, she specifies secure. Well, we all know that nothing is completely secure in ...
2
votes
0answers
39 views

Configuring Chrome to handle ETags like Safari

ETags can be used for tracking, but I happened to notice that Safari handles them differently from Chrome (and Firefox). I believe it's non-standard because it doesn't work across domains. If we ...
-1
votes
0answers
15 views

XPATH to Retrieve Local Files

We have a site using XPATH. Unfortunately I don't have access to the code but a colleague said he managed to read local files. I was wondering how this would be possible /api.php?q=Some%20Name This ...
1
vote
2answers
22 views

How does forward secrecy beat public-key encryption if the key is regularly updated?

Why is forward secrecy better (say for WhatsApp) than public-key encryption with a routinely revised key? The advertised issue is backwards safety: If at a point one key is compromised, someone ...
0
votes
0answers
26 views

100% load for Sophos UTM 9 [on hold]

We are using Sophos UTM 9.401-11. We are having about 10 - 15 spikes each day, each spike taking between 5 and 20 minutes. During the spikes, there is 100 % CPU high load on Sophos and Internet is not ...
0
votes
0answers
7 views

Link Layer, E2EE encryption [on hold]

Do you know how I can find out more about link layer and E2EE encryption also with related topics. I hove more network books in my library but I could not find any topics about OSI encryption, in ...
2
votes
2answers
41 views

Protect against virus and malware attacks from website ads with iptables

Lots of websites spread malware by publishing advertisements that distribute malware. Even YouTube's ad network has been compromised in the past. Browser ad blockers and related plugins have there own ...
2
votes
1answer
21 views

How to disable conntrack protocol parsing in the linux kernel?

Security researcher Jacob Appelbaum suggested to avoid certain code paths in the linux kernel that are related to conntrack that do protocol parsing (such as fdp, sip, etc.) right in the kernel for ...
8
votes
2answers
101 views

Are there any sequences other than ../ which will be intepreted as directory traversal in *nix or Windows?

A common vulnerability is for web applications to accept a filesystem path as a request parameter, and then perform some action on the specified path. For example, retrieving a file and returning it ...
0
votes
2answers
72 views

Is open source a good option for cryptography libraries? [on hold]

I am trying to find good cryptography library to use with my project. I found open source options like openSSL and many more and also proprietory options like Intel Integrated Performance Primitives ...
-1
votes
1answer
25 views

How does IP Geolocation get weather station information

I recently noticed that websites are using the weather station set in an app on my mobile phone to obtain my location. Various people offer localisation services using weather station choices, but I ...
-1
votes
1answer
137 views

Why is Linux considered more secure than Windows? [on hold]

Why is Linux considered more secure than Windows? Is there some sort of recent security report that proves it? I have come to believe that Linux has been safer so far, but now as we have Windows 10, ...
0
votes
0answers
26 views

Make a program execute only from verified drive [on hold]

I want to make simple exe file, which should check if it is executing from verified drive or not (for example, from verified flash drive). If not, to halt execution. Could you please tell how I can ...
2
votes
1answer
115 views

Can Windows BitLocker encryption be broken by Live Boot?

I have a Windows system and I protected the drive with BitLocker encryption. Can BitLocker encryption be bypassed by live-booting with Linux or any other OS?
2
votes
0answers
24 views

What are the risks of using an untrusted https connection? [duplicate]

Assuming the user realizes the connection is unsafe and doesn't send any secret data to the server, are there any risks of connecting to a website without a valid certificate using https? Does that ...
2
votes
1answer
83 views
+50

Authenticate tracking device with TCP server

I am building a tracking device and am looking for a secure authentication method to use when the device wants to establish a connection to the server. The server is a TCP server that we open a ...
0
votes
0answers
38 views

DDoS Solution for request floods [duplicate]

What are the mitigations to protect from ddos? Is using firewall like cloudflare would help or not? My use case is just want to make sure that no one is sending flood of requests i.e. thousands per ...
0
votes
1answer
32 views

Store password ciphers using Powershell ? DPAPI/AES

Hi and sorry if it is in wrong place I am making a script that requires to have a lot of server's IP and their passwords stored into a file. I wanted to use Windows DPAPI, but as we can easily ...
16
votes
3answers
2k views

Is exposing exception information in web service a security risk? [duplicate]

It is a known fact that exposing the exception information to the end user provides security risks since an adversary can user that to figure out how things work internally and attack it. But what ...
0
votes
0answers
20 views

What's the difference between 'TX' and 'tx' in modsecurity rule

This page describes definition of 'TX' as following: "This is the transient transaction collection, which is used to store pieces of data, create a transaction anomaly score, and so on. The variables ...
2
votes
1answer
28 views

Is EFS FINRA and SEC Acceptable

I'm trying to search in their manual but there is nothing explicit being mentioned as to what type and how encryption should be done. Can I assume that if I use EFS on the entire USER directory that ...
3
votes
1answer
45 views
+100

X509 CRL suspended certificates and openssl ca comand

In CRL X509 format we have "Hold Instruction code" for a list of suspended certificates. I know that "its use is strongly deprecated for the Internet PKI", but in my own private CA, I want to use it. ...
0
votes
0answers
13 views

why function “host” gives different results when using IP instead of domain name? [migrated]

I'm learning DNS, and when using the "host" bash function on Kali, i get different results according that i give the IP adress or its domain name equivalent: host -t ns axis.com => ...
0
votes
0answers
10 views

Digital Signature - PKCS#7 Response

I have a long xml-style string which looks like this: MIILhMIILhAY......H9WH9W Task given to me is to digitally sign a pdf document. Is there a tool (like jdk keytool or openssl etc) which I can use ...
1
vote
0answers
23 views

SSH Keybased authentication using NitroKey

So I'm fairly new to more secure forms of key management, I've been used to storing my keys inside key files on my computer. Recently I wanted to try and see if I could setup SSH authentication to my ...
25
votes
3answers
3k views

Does using a live CD make you more vulnerable to remote attacks?

Some people recommend the use of a Linux live CD for online banking, but doesn't that make you more vulnerable to network attacks since it's not updated? I tried installing updates and it required me ...
-3
votes
2answers
113 views

Why does privacy matter? [closed]

I've yet to find a comprehensive and compelling list of reasons for why people should care about their privacy, why bother defending it from the likes of Google, Microsoft, Facebook and the like. I ...
0
votes
1answer
79 views

Passwords processed on server side? [duplicate]

So while I was working on my personal project something struk me. When somebody creates an account on any web service/social media they provide their desired username and password,this is then ...
0
votes
3answers
79 views

Is HTTPS over wifi still safe if a hacker can set up a rogue DHCP server?

I always heard that entering passwords or any sensitive information while using a public wifi spot is safe only when visiting an HTTPS website, ensuring that the URI and certificate are valid. Many ...

15 30 50 per page