1
vote
1answer
31 views

Does use of OpenID Connect for login imply Google can impersonate my users?

I am looking at integrating Google OpenID Connect (OAuth 2.0 for Login) as a login option for a web application. https://developers.google.com/accounts/docs/OpenIDConnect My question: Does use of ...
1
vote
1answer
41 views

UDP-Only Linux Dedicated Server?

I am running my own small UDP linux service on a dedicated server. my service responds to single-package requests with single-package responses. I don't want this server to do anything else. I ...
0
votes
0answers
24 views

Server security monitoring [closed]

I am looking to add a server monitoring solution to my servers for the purpose of security, e.g. things like log monitoring, file integrity monitoring, etc. I don't know what is typically included in ...
-3
votes
1answer
229 views

Malware encrypted my files with ecc [closed]

One of my office workers got malware on her computer that encrypted all her files with ecc. I say this because the new extension on the files is .ecc and that is what the ransomware states. I have ...
1
vote
1answer
44 views

Best practice for https Private Key Generation

I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it ...
0
votes
0answers
15 views

How to set size of RSA key in aspnet_regiis [migrated]

How do i set the key size of my rsa key. Creating the key: aspnet_regiis -pc "test" -exp -size 4096 Exporting the key: aspnet_regiis -px "test" "c:\myKey.xml" -pri this does not give me key size ...
-3
votes
0answers
57 views

MAC spoofing is considered legal - But why IMEI/MEID spoofing isn't? [closed]

I see many people spoofing MAC address for personal use. But when I search for spoofing IMEI/MEID of a device there are so many people screaming that I should not do it whatever the reason is. What ...
1
vote
2answers
46 views

Why do researcher need to control all C&C servers of a botnet?

Why do researcher need to control all C&C servers of a botnet? Wouldn't it be easier to spread a deinstall command to all reachable PCs to cripple the botnet? This could be done over and over ...
0
votes
1answer
42 views

php- is my code secured enough to protect from remote command execution when using shell_exec()?

I am using shell_exec function on the following variables to execute commands on the shell: fname (characters only) fpack(characters only) email (a valid email address) My code is: <?php ...
3
votes
1answer
27 views

Are there file-encryption tools that only allow access to whitelisted processes?

I am looking into VeraCrypt, a spiritual successor of TrueCrypt. This made a question pop up: As far as I understand, as long as the encrypted volume is mounted, every process can access the data. ...
-1
votes
0answers
21 views

AVAST VS GOOGLE INCOGNITO [duplicate]

Is Avast Safe Zone the same as Google Incognito? How are they different? I tried both, but do not really understand the differences. Please help.
2
votes
1answer
66 views

SSL communication between a C# Server and an Android Client App

I'm using a C# server and a C# tcp client example I extracted from the MSDN and I have created a self signed certificate using makecert.exe. I have got this to communicate with one another and it ...
-2
votes
0answers
26 views

Hash file of a .xls file from RSA securID attack 2011 [closed]

I am very new to information security , i am doing a presentation on RSA hack not a very technical one. I got hash file of excel sheet used in RSA attack in 2011 i got it from virus total but i don't ...
0
votes
0answers
28 views

Snoop-it crashes on iOS6 [on hold]

I'm trying to run Snoop-it on an iPhone 5 running iOS 6.1.4 but it crashes immediately after starting: Feb 25 14:18:56 iPhone Snoop-it Config[745]: MS:Notice: Injecting: com.nesolabs.Snoop-it-Config ...
1
vote
1answer
47 views

Diffie Hellman and exchange of public key for signature

Let's assume an insecure channel. Is it safe to exchange Alice & Bob public keys first then apply them to sign communications during the DH process? (then encrypt+sign all future communications)? ...
4
votes
2answers
317 views

When signing email with GPG, how does verification by the receiver work?

I use GPG to sign my outgoing emails. I understand how it works when I encrypt mail to send to someone else. Then I need his/her public key, encrypt it with that, and only he can decrypt it using ...
1
vote
2answers
60 views

multiple private keys for single public key

I am currently working in security in mobile ad-hoc networks I have several clusters, and I want from the cluster head to send some data encrypted with its public key ,to the cluster members. I assume ...
-3
votes
0answers
21 views

block cipher and stream cipher [closed]

what is differance betwwen stream cipher and block cipher?As in block cipher data are in chucks while in stream cipher bit by bit encrypting so how many data are as input in stream cipher?
-3
votes
0answers
26 views

Unrestricted file upload on a cloud based platform [closed]

Are all of the recommended best practices still applicable? https://www.owasp.org/index.php/Unrestricted_File_Upload I have heard it suggested that because files are not stored on disk they pose no ...
-1
votes
3answers
131 views

Can workplace wifi track ip address to an employee's computer? [duplicate]

At my work there is secure WiFi for all the employees. If someone has sent harrassment / sexual harrassment emails to me through the company WiFi, is there a way for my company to trace the IP address ...
-2
votes
0answers
33 views

Technical Pentest Name on Intrusion via Enumeration? [closed]

Okay, first off, it so happens that I was given a penetration test which were rejected by my lower vulnerability researchers (basically coming from the bug bounty family). As a part of my job role, I ...
3
votes
1answer
80 views

How cryptographic hardware accelerator is secure?

I am using cryptographic hardware accelerator of am335x. As per documentation it unloads the cryptographic operations from the main CPU and hence increases the performance. But from the security point ...
-3
votes
0answers
57 views

Sent anonymous emails, might get in trouble [duplicate]

Let us say that someone createda a fake gmail account. They then proceeded to send some emails to a school. (The school uses gmail for education). They want to track down the person who sent it ...
1
vote
0answers
30 views

Is it dangerous to allow users to edit the CSS styles? [duplicate]

I'm working on a blog site, and I plan to allow bloggers to completely edit the style sheet for their own blogs I assume this isn't dangerous, since CSS is client side, but I thought it'd be best to ...
3
votes
1answer
72 views

Linux/ssh - Forensic question

In a Linux terminal, I made a ssh connection from A to B and I used commands to read some files stored in B. Then I disconnected and I closed the terminal. Is it possible to find on A, informations ...
1
vote
3answers
52 views

What can manufactures of hardware do to prevent attacks on the firmware?

Given the revelations since The Equation Group was discovered. As well as that it is possible to not guarantee removal of a rootkit even with a nuke from high orbit. What properties of a harddrive ...
0
votes
2answers
71 views

Google DNS in Firewall logs

I was viewing my firewall logs and come across the IP 8.8.8.8. Further check reveals it most likely belong to Google DNS. And such traffic has been going out from some of our LAN segment PCs. From ...
1
vote
0answers
32 views

Using OpenSSL to generate encryption key for Outlook users [migrated]

A private web application needs to receive encrypted email from perhaps 20 known users. How can I use OpenSSL to generate a valid encryption certificate that Outlook users can import and use to ...
1
vote
2answers
25 views

How To Keep Data Private Where Software Requires An Online Check

When software forces a user to verify online(Phone Home) before use, it creates an opportunity for private data created with this software to be physically connected to the Internet. This may not be ...
1
vote
1answer
39 views

Same RSA key pair for all users

Let's say in my computer running Debian i have an RSA key pair generated by user foo and copied the public key to server_A for allowing key based authentication in ssh for foo. Now my question is can ...
3
votes
1answer
76 views

Clarification needed on CSR signing process

There doesn't seem to be a lot of in-depth information on the certificate signing process other than: Key Management Interoperability Protocol Usage Guide Version 1.2 (PDF) RFC 2986 - PKCS #10: ...
1
vote
0answers
17 views

How is an OpenID Authenticated user Identified?

On a system that I'm working on a user signs up by means of an OpenID/Social Media account (Twitter, Google, Facebook), and then subsequently signs in using that path. The System comprises of a ...
0
votes
0answers
6 views

What are the ssh-keygen -D and -U parameters for? How are they used with smartcards? [migrated]

The ssh-keygen manpage lists the following two parameters: -D reader = Download the RSA public key stored in the smartcard in reader. -U reader = Upload an existing RSA private key into the ...
1
vote
1answer
42 views

Can a compromised OpenSSHD server be used to upload a malicious payload to a client?

Since I'm fairly unfamiliar with the specific details of the SSH protocol, I was wondering if it was possible for a compromised SSHd server to upload a malicious payload (like a Trojan or some other ...
0
votes
0answers
47 views

Tools to create dictionary with word-combos? [closed]

I'm studying to take a job as a pentester, and specifically how to crack wpa/wpa2 security. I've been able to use aircrack/airodump to capture a handshake, and I know at this point it's just a matter ...
2
votes
1answer
77 views

Phishing email from Avast - Headers look totally legit?

Below is the email with headers. I never registered on the site, so it's clearly phishing, but the links in the email point to the real Avast site. The delivery path also looks legit since both IP ...
0
votes
0answers
9 views

Getting Certificate KeyContainerName to initialize CspParameters

How can I get the name of a Key Container that's in a smart card required for initialization of CspParameters? CspParameters^ cspa = gcnew CspParameters(ProviderType, ProviderName, keyContainerName, ...
2
votes
2answers
36 views

nmap says “variable 'keys' is not declared” when trying to run ssl-ccs-injection.nse

I'm running nmap 6.47 on Windows 7 and am trying to run the ssl-ccs-injection.nse script. After getting an error, I ran it with the -d (debug) option and the error in the subject is what showed up. I ...
0
votes
0answers
34 views

What can Android Antivirus apps really do? [duplicate]

I am studiying about android development and given the permission restriction between apps and isolation that the operating system itself imposes, I was wondering what can an antivirus app distributed ...
0
votes
0answers
5 views

lsarpc LSA_DELETE failed: What does this mean? [migrated]

I have been noticing the following error on our samba server: smbd[30271]: api_rpcTNP: \lsarpc: LSA_DELETE failed. I haven't had any luck figuring out what it is, and my experience with ...
-4
votes
0answers
24 views

Risk management hierarchy [closed]

Can someone please explain risk management process hierarchy like which process should start initial assets identification like ?
-4
votes
0answers
40 views

Legal requirements when collecting personal data (e.g. passport id) [closed]

I am developing form for a company dealing with visa, receiving such data as passport number or other personal info is crucial. Are there any laws, regarding the way how it should be collected? I know ...
-8
votes
0answers
97 views

XSS Filter Bypass [closed]

Please list out the XSS scripts that bypasses parsing. Parsing: Parses following characters: ",\,\',<,>,&,=,'. Escape character is used when sensitive character is found as part of input.
2
votes
2answers
135 views

Can changing a MAC address give an attacker more leverage in a network?

Security lessons force us to use limited users (Standard User) on Windows networks. I found that an administrator account can change his MAC address from Control Panel\Network and Internet\Network ...
2
votes
2answers
43 views

What are the real-world implications of duplicate SSH fingerprints across many devices?

There was a recent post on the Shodan blog showing that certain SSH fingerprints are common across thousands of devices. For example, this fingerprint is common across over 250,000 devices worldwide: ...
14
votes
7answers
3k views

How to perform safe authentication via HTTP?

I have to log in on an HTTP website. There is a login form which contains inputs for username and password and as hidden inputs the sessionId. I am creating an application in which I have to access ...
0
votes
0answers
15 views

HTTP DoS prevetion with UFW firewall [migrated]

I am trying to creator an HTTP DoS attack on my servers using UFW firewall using this Resource. I edited /etc/ufw/before.rules to get the following rules. # # rules.before # # Rules that should be ...
-9
votes
0answers
52 views

Server side encryption [closed]

In my research work i used only server side encryption of data and my external examiner asked that why I used RSA algorithm for encryption on only server-side and not client side so i am confused for ...
4
votes
1answer
548 views

Is it a good idea to use two salts? [duplicate]

Is it a good idea to use two salts? This is implying that one would be unique to the user, and one would be unique to the server, using Bcrypt of course. So for example, if you're using Golang as ...
2
votes
1answer
44 views

How do Client-specific keys and Certificates work?

I have clients that communicates with my server. Clients sends it unique id (guid) to server with its request over a secure https channel. Also to increase security I use my own private-public key ...

15 30 50 per page