All Questions

17
votes
0answers
2k views

What can the school do with my MAC address? [duplicate]

At my school they are requesting my MAC address so that I can use the schools Wi-Fi. Now I understand that the school can see what sites I am going to while I'm at school. But can the school see what ...
2
votes
1answer
24 views

SSL Mixed Scripting Vulnerabilities and XOR Attacks

Given that RC4 is a stream cipher (I'm pretty sure the details of its inner workings don't matter for the sake of this argument) and the existence of Mixed Scripting / Mixed Display (web applications ...
4
votes
3answers
935 views

Unknown URL shows my website

I run a website at https://fastslots.co. I just discovered that I am getting requests from the URL https://canadaehtees.com/ that I have no affiliation with. When I load canadaehtees.com in my browser ...
1
vote
1answer
93 views

Is google.com/webhp malicious?

Lately, I've noticed the addition of "/webhp" in the url of Google searches along with some additional variables, "sourceid", "rlz", and a few others. Together, they make a URL in the form of ...
1
vote
5answers
78 views

Identity Theft: should I shred documents with only name and address details?

I routinely shred documents with any personal information on them to protect myself and others against identity theft. I have no doubts that shredding any documents with ID numbers, account details ...
-2
votes
1answer
52 views

Good log file review tools [closed]

I am wondering, what tools are good for log file review? I am interested in a tool that is cheap or free, easy to use, covers all relevant log files, is useful for forensics (e.g. what did a hacker ...
2
votes
1answer
23 views

Why browsers implement stricter policy for local files

I have a problem viewing HTML/JS/CSS files generated on disk. Specifically, several calls in javascript are blocked by Google Chrome. I googled and found an answer here: ...
3
votes
1answer
73 views

How to best to secure data over HTTPS

My aim is to have an (iOS) app in which the user would login, then on sucsessful login, gain access to additional information over an encrypted webservice (undecided). From research, I understanding ...
2
votes
3answers
670 views

Is it possible to force a browser to use http in an ssl enabled (https) website?

I was doing a security research on storing the session id in local storage instead of storing it in cookies. I understand that it is not possible to tag the values in local storage as HttpOnly and so ...
5
votes
2answers
118 views

How to evaluate the damage after being hacked [duplicate]

It's well known what measures one should take to prevent hackers from hacking their PC. But are there any steps that allows a user to evaluate the damage done by a hacker? Say that I know for sure ...
0
votes
2answers
75 views

How would you set up a ‘cold’ netbook for master-key signing, large Bitcoin transactions, etc? [closed]

I've just ordered a cheap-o netbook on Amazon, with the intention of installing a Linux distro, and turning it into a permanently-offline high-security machine for sensitive tasks. However, I'm no ...
0
votes
1answer
77 views

How to disable SSLv3 on a Windows 8 phone?

I have a Nokia Lumia phone that runs Windows 8. However, simple test on the browser tells me I'm vulnerable for POODLE attacks. I use the phone for internet and email access a lot and I need it to be ...
0
votes
1answer
68 views

sslv3 is still showing in openssl result even after disabling from sslprotocol [on hold]

We are trying to disable sslv3 for poodle vulnerability.so i disabled in ssl.conf SSLProtocol -ALL +TLSv1 -SSLv2 -SSLv3 and tried to connect using tlsv1 using openssl command. openssl s_client ...
0
votes
1answer
24 views

Do we require to eliminate share drive access to PCI users?

Do we really require to eliminate the share drive access to the PCI users. We have a file server outside PCI VLAN. But PCI users have access to it. We dont have any DLP solutions. Does the PCI ...
0
votes
1answer
34 views

What are the major threats involved in storing the session identifiers in local storage instead of cookies?

I want to know the major security threats involved in storing the session variables in client side local storage, instead of storing it in the cookies. Can somebody give me a brief description?
3
votes
1answer
65 views

Is it a good idea to do double AES encryption with 2 different keys, when one is held by the user and one stored on the server?

I'm building a web app. The app needs to keep certain data within the database very secure. Please assume for the moment that I don't have a HSM or Key-Management facility and can't afford to ...
1
vote
0answers
40 views

SSL Asymmetric encryption newbie [duplicate]

I am relatively new to the world of cryptography and was wanting to develop a webpage which allows credit card payments. Thus, I looked into the digicert ssl service, hoping that it could do what I ...
1
vote
0answers
44 views

Build only OpenSSL crypto?

I was wondering if it's at all possible to compile only the crypto functionality of OpenSSL that I want? In particular, is it possible to compile just SHA1, AES, and DH parts of OpenSSL? I followed ...
1
vote
2answers
107 views

1'or'1'='1 help

When I put Username:anything and Password : 1'or'1'='1 Then my database retrieves the first row in the mysql table. But I want to retrieve the row corresponding to Username:anything row. How should I ...
0
votes
1answer
84 views

How to ensure a second hand computer is safe to use [duplicate]

I'm planning to buy a second hand computer (2012 Mac mini, which is no longer available in stores). Because I'm not sure if there is any malware in the computer so I will perform hard format several ...
0
votes
5answers
76 views

SSH server: What's more secure, pub key auth or Google Authenticator time-based auth?

I'm curious which would be more secure, pub key authentication or 2-factor auth via Google Authenticator. Apparently I can't use both. If I have pub key authentication, the Google Auth PAM module ...
0
votes
0answers
35 views

Preventing “existing accounts” data leak during account creation [duplicate]

It is common practice for web apps to prevent mining of existing user accounts for logins (with "username and/or password does not exist" rather than "user does not exist"), and for password resets ...
-2
votes
0answers
35 views

Hydra Too many connection to target? [closed]

This is what i get when i type in cygwin... $ hydra -l rivaljet@gmail.com -p (not saying it) -s 465 say ip Hydra v8.0 (c) 2014 by van Hauser/THC & David Maciejak - Please do not use in military ...
1
vote
1answer
46 views

PHP would this be risky (using hackable data for includes)

mysql_select_db($db.'_'.$table); include("/home/site/includes/".$type."/functions.php"); Would this be a bad idea if $table and $type are values passed via ajax from a JS script? And this.. ...
1
vote
1answer
35 views

How to detect/mitigate UDP port scan using OpenBSD and pf

One of our OpenBSD firewalls experienced a flood of UDP traffic from a compromised host within our internal network. The traffic was exchanged between the compromised internal host and a single ...
11
votes
6answers
3k views

Does the US government protect its physical internet lines in the US?

It seems like there are lots of ways to prevent man in the middle attacks. I've read many on here and on the rest of the internet. According to wiki you need a secure channel as well to completely ...
-5
votes
0answers
38 views

Virus blocking outside connections from computer [closed]

I downloaded a program that ended up being malicious and compromised my computer. It installed a "Smartbar" Application and a few other applications that were probably keyloggers or something of the ...
1
vote
5answers
122 views

Is there a term for Authorizing before Authenticating? Is it even common?

In most scenarios a person identifies who they are (authentication/AuthN) via something like a username and password. Afterwards a system would likely evaluate what that validated identity can perform ...
-6
votes
0answers
51 views

What should be the approach for bypassing the payment for an ebook selling website? [closed]

Its developed on .net framework. Now the payment success link should have a token or something. I am an experienced web developer but a novice in these kind of things. Please suggest on how should I ...
0
votes
0answers
22 views

Client side ssl auth by signing with server key [duplicate]

So I followed this for setting up client ssl certs using openssl: http://drumcoder.co.uk/blog/2011/oct/19/client-side-certificates-web-apps/ It basically walks through creating a new CA key, and then ...
2
votes
0answers
137 views

Has a plaintext password ever been used in a court of law as evidence to a crime?

Regardless of how the password was obtained (decryption, bad hashing, confession): Are there any prior known cases where the contents of the password was used to prove motive or guilt? Or, looking ...
1
vote
5answers
613 views

How can I verify that SSLv3 protocol is disabled?

I'm trying to disable SSLv3 in ejabberd 2.1.10 on Ubuntu 12.04. There is no way to disable it in config file, so I have to patch the source and rebuild the package: ...
-6
votes
1answer
54 views

Post-Infection Analysis of Suspected Keylogger [closed]

Hi I'm a complete noob when it comes to computer security so please excuse me if I say anything stupid. With that being said, I have downloaded a program for a game (WoW) and even though I scanned it ...
3
votes
3answers
134 views

Why require new users to change password?

I have noticed that it is common practice when setting up a user account (Windows users accounts and Google Apps user accounts in my case) to require new users to create their own password immediately ...
0
votes
0answers
21 views

XSSER get and post

I am using xsser for XSS vulnerability testing and I have a doubt about the parameters when it's a POST method. I have tried against DVWA (which uses get) with success like this: xsser -u ...
2
votes
2answers
98 views

Does client side encryption really add security?

A lot of password managers seems to promote client-side encryption as a key feature of their service. For example : LastPass, Firefox Sync, PasswordBox, etc... They all say something like Even we ...
0
votes
1answer
28 views

Can an end-entity certificate with SHA-1 be issued by an intermediate CA that has SHA-256?

Just curious - if I'm using an end-entity (leaf) certificate that has a SHA-1 signature, does that mean that ALL certificates in the chain also must use SHA-1?
1
vote
2answers
116 views

Prevent logging in by pressing Enter - security by obscurity?

An online banking site which I use, has a "feature" which disallows a user from pressing Enter to submit a login form. For example, if you have typed your username in the Username field, pressing ...
0
votes
0answers
17 views

Infer encoding mechanism from n-grams distance

I have a series of obfuscated strings which across the set of strings have regions of high variance and regions of low variance (implying some encoding mechanism as opposed to an encryption procedure ...
0
votes
1answer
20 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
3
votes
0answers
30 views

Interpretation of the results of NIST (p)NRG suite [migrated]

I have problems interpreting the NIST (sts-2.1.2) suite results. After running the statistics with 100 samples (each sample of 1000000 byte length) a new prng i got this result: ...
0
votes
4answers
63 views

Does access to a BISmark router mean access my network?

Project BISmark aims to measure broadband service by recording and reporting on service using OpenWRT-based router firmware (software licensing unclear, no LICENSE or COPYING files in the repos) with ...
-1
votes
2answers
75 views

how to embed exe file to pdf? [closed]

Im trying to embed exe file to pdf for case study. I try using metasploit exploits for this but i can only embed shellcodes with this method. I know there is a way to embed exe file but i cant find ...
4
votes
1answer
82 views

Is Firefox Password Manager less secure than LastPass?

After installing the LastPass password manager, I am presented with a login dialog including the option to "Disable Insecure Firefox Password Manager". (This option appears as long as the Firefox ...
5
votes
1answer
190 views

Is java Client vulnerable by POODLE?

I have a Java based application (running on java 5 or higher) that establishes an SSL connection towards an Apache tomcat 7.0.47 on java 7. From what I understand, to exploit POODLE you need a client ...
3
votes
1answer
120 views

What happened with badBios [duplicate]

Maybe some of you remember that in November 2013 the respected researcher Dragos Ruiu claimed that he was infected by some super advanced virus that no one ever heard of before. Experts agreed that ...
0
votes
1answer
63 views

Shellshock used in CUPS

Some days ago I read about the Shellshock bug and I wanted to test a CUPS server for it and readed some example codes to build this code: () { test;};echo /"Content-type: text/plain\"; echo; echo; ...
2
votes
1answer
65 views

Hardening ciphersuites on Windows Server 2012 R2

I'm currently in the process of compiling a Ciphersuite policy to be used on all of our new WS 12 & IIS 8.5 web servers. In the past I've always manually applied the registry keys into SChannel ...
0
votes
0answers
283 views

nginx poodle fix configuration [migrated]

I have a dedicated CentOS web server (with Plesk 12) and I am trying to disable SSL 3. I have been everywhere trying to disable SSL 3 and tried to apply the fix as detailed within other posts, but ...
4
votes
0answers
78 views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...

15 30 50 per page