0
votes
0answers
13 views

Why is my 3rd gen X1 Carbon not showing the “ThinkPad” logo when Secure Boot is disabled?

When I disabled Secure Boot, it still showed the "Lenovo" logo, not the "ThinkPad" one (the one it normally boots up in out of the box) Could BIOS malware have caused this?
4
votes
0answers
41 views

How does a website know my location? Checked with ipleaks and VPN seems to work correctly

Recently I have been using a VPN to watch a free web series available only in the US -- on a website called https://go90.com. Until a few days ago everything was running smoothly with just Hola VPN. ...
1
vote
0answers
24 views

Which clients support only TLSv1.1 but not TLSv1.2? [on hold]

I phrased the question originally as Is there any point in supporting TLSv1.1 on the server side? The recommended current setup if you don't have full control over your clients is to support TLSv1.0, ...
1
vote
1answer
11 views

Why doesn't the number of bytes required by GnuPG generating the key decrease?

I ran a gpg --gen-key on a remote machine connected with SSH and left it to do its job. It finished successfully, however during the execution time it asked to perform random actions to collect more ...
0
votes
3answers
112 views

How a professional hacker would penetrate a computer in a network?

Which kinds of vulnerabilities or security holes a hacker would use to penetrate and take over a computer in a network, like a normal PC in a default network (Wireless-LAN). I often hear that the ...
1
vote
1answer
37 views

How secure is it to use ODBC Driver with SSL

When Connecting from clients (such as Windows) to remote databases such as (MS-SQL Server), it is usually advised that this connection be via a service that runs on the database server. It is ...
38
votes
4answers
4k views

How can html5 geolocalisation bypass my vpn?

About two months ago I've decided to use a VPN all the time (it's launched at startup) for various reasons, privacy being the first one. But recently I realized that if you agree to share your ...
-3
votes
0answers
28 views

Suspicious addresses from netstat -b under chrome.exe [on hold]

[chrome.exe] TCP 192.168.0.2:54827 69.172.216.55:https TIME_WAIT TCP 192.168.0.2:54828 69.172.216.55:https TIME_WAIT TCP 192.168.0.2:54829 69.172.216.55:https ...
0
votes
1answer
76 views

Is a rootkit not an exploit?

I once referred to the bluepill rootkit from 2006 as an exploit. I was corrected and told that rootkits aren't exploits. Is this true? I thought an exploit included any software that was used to ...
0
votes
1answer
39 views

How To Stop A Mobile Verification Attack

I am thinking of using mobile phone number verification for the sign up step in my web application but how do I prevent a hacker or a malicious user from sending mobile verification requests to an ...
0
votes
1answer
58 views

Do I have the private keys to CAs installed on my browser?

Could someone please help explain the following comment from Why was the private key of the Superfish certificate so easily extractable? The main issue with private key extraction is the use of ...
3
votes
2answers
59 views

How to trust root CA

When I download a browser such as Mozilla, it comes bundled with several root Certificates. How do I trust that these certificates are legitimate? How do I know that my download does not contain ...
0
votes
2answers
20 views

Integrity of downloaded Oracle JDK (/software in general) [duplicate]

Found something related Why aren't application downloads routinely done over HTTPS? This is a question about general security from a noob. I couldn't find anything relevant about this topic via ...
0
votes
1answer
20 views

Does wireless card need to be on same channel as AP to sniff beacon frames?

OBJECTIVE Essentially, my goal is to emulate something like airodump-ng wlan0 Here is a link just in case ... airodump-ng Collects raw 802.11 frames Displays nearby access points and data ...
-7
votes
2answers
42 views

Can someone Hack my phone personal data using my IP address? [on hold]

There is "My wifi router" Installed in one of my office PC's. I once connected my nokia lumia 925 to it. That software "my wifi router" Shows our IP when we get connected. Is there any possibility ...
-3
votes
1answer
46 views

Are PDF zero-days still being widely used? [on hold]

Even after all those patches for PDF programs, would you estimate that there are still many zero-days out there? If so, would you estimate that these zero-days are being widely used for various ...
0
votes
0answers
44 views

What is the Linux Kernel attack surface? [on hold]

What is the full Linux Kernel attack surface ? meaning what are the vectors through which untrusted or unprivileged access interacts with the Kernel. For instance, system calls are an attack vector, /...
0
votes
0answers
28 views

rdp connection with netcat pivoting

I want to connection from local computer to another local computer. I have 3 machine. for example A: 192.168.1.50 -> in local windows machine B: 50.3.52.110 -> linux server C: 192.168.5.25 -&...
0
votes
1answer
35 views

Windows Firewall: Restricted RDP to 1 IP, but still see login attempts from other IPs

I restricted the Firewall rules for RDP incoming restricting the Scope to 1 Remote IP address (Local IP Address section is empty). This was done for both Public & Private/Domain Rules. I did not ...
0
votes
2answers
80 views

Hiding my activity from mobile service provider [duplicate]

Ok there is mobile service provider which also happens to be providing mobile internet. Now, I am interested to hide my activity from that provider. e.g. it can't see my browsing habbit. Basically ...
3
votes
3answers
33 views

How does the same origin policy apply to two different windows of a browser?

One particular scenario I am interested in: If I a open one chrome browser window with --disable-web-security option, then SOP is disabled. Will this window be able to access data on websites opened ...
1
vote
0answers
15 views

Are GeoTrust SHA-256 intermediate chain and cross-root legacy support, mutually exclusive?

I have purchased a GeoTrust TrueBusiness ID SHA-256 with EV SSL Certificate. According to GeoTrust website, I must also install the corresponding intermediate certificate, which is "GeoTrust EV SSL ...
-1
votes
1answer
33 views

In what order are digital certificates verified?

I understand how digital signatures work and how they are verified, but in what order does the CA verify each of the attributes of the digital certificate such as version, issuer, validity etc..? Any ...
-3
votes
0answers
54 views

Internet stopped working while a stranger was standing at my front door [closed]

I had a stranger ring my doorbell while I was in the shower (my kids were home and told me about it). While he was standing there, my music stopped playing on pandora (on my phone) and my phone made a ...
0
votes
0answers
18 views

SSL Certificate for Web API [duplicate]

I'm currently developping a web html/2 API for my mobile application, and I would need an SSL certificate for my application, Is it safe if i use a self-signed SSL certificate rather than a trusted ...
0
votes
0answers
17 views

Client secret verification vs redirect URL verification - is one more secure than the other is? [on hold]

Is client secret verification (code flow) considered more secure that redirection URI verification (implicit flow)? Why? It seems to me that they are equivalently secure. https://tools.ietf.org/...
0
votes
0answers
16 views

PHP: decrypting a file directly to a stream using the defuse/PHP_encryption library

I have for a while been using the excellent Defuse PHP Encryption library for storing encrypted data strings in a database. I have an extension of this need where I now have files that need to be ...
11
votes
3answers
2k views

Would a (password + combination of images) be stronger for user's login regarding keyloggers?

The scenario: We have a login system for a web application that requires a plaintext password and 3 images (from a collection of images that the users select during registration, the images are ...
0
votes
2answers
99 views

As a user, is using MD5-encrypted passwords on websites a good practice? [duplicate]

Disclaimer: This is from a user standpoint. We'll thus assume the target website (say, Paypal or Netflix) already uses a strong hashing algorithm with salts (bcrypt of pbkdf2, for example) and accepts ...
-1
votes
2answers
42 views

What is meaning of the term Whitelisting in antivirus?

How exactly does whitelisting work and what does it mean in terms of antivirus software?
3
votes
1answer
35 views

Difference Between Web and Chain of Trust

I have a basic understanding of the "Web of Trust" used in PGP. I would like to know how the "Web of Trust" differs from the "Chain of Trust" that's used for SSL certificates?
1
vote
1answer
32 views

wpa_passphrase command encrpyting psk

Does the wpa_passphrase command turn an ASCII string into hexadecimal and what is the benefit of doing so? Is the psk sent in the header of packets? Can it be easy to sniff if it's in a string format? ...
0
votes
1answer
42 views

How to sniff 802.11 packets without going into monitor mode?

Is it possible to sniff or capture 802.11 packets which sends my computer to the router (AP). I know that I can't sniff packets which have a other destination MAC address without going into monitor ...
1
vote
3answers
113 views

How to detect malicious JavaScript in a PDF file?

Is having any JavaScript in a PDF file by definition dangerous or is it only dangerous when specific functions (for example eval) are used inside a PDF, in which case, what JavaScript functions are ...
0
votes
1answer
26 views

How to encrypt a USB to be used with MAC & Win

I would like to find out if it is possible to encrypt a USB flash drive (or only password protection) which could work with dual OS ( Mac & Windows ). Is there a free software that i could use to ...
0
votes
1answer
31 views

Identity and Access Management (IAM/IdAM) deployment guide

I'm working on a set of applications that require authentication and authorization. Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
-1
votes
3answers
108 views

Jump Servers for security

In my network, I have the clients directly connected to the server; but in the new PCI policies, they required to use jump servers. What is the advantage of using jump servers for security reasons? ...
0
votes
1answer
63 views

Who is responsible for generating public key during secure communication?

This must be easy but I am getting a little confused. Say, facebook.com, it has a certificate which is signed by an intermediary CA. Who generated that public key that I can see in facebook ...
-3
votes
0answers
40 views

How can one track the origin of an image shared in Whatsapp? [closed]

How can one track the origin of an image shared in Whatsapp?
0
votes
0answers
16 views

gaining account access from whatsapp by swapping sim? [on hold]

I'd would like to know the possibility of gaining whatsapp account information by the government using sim swap. because the government can swap your sim while your phone is off then they can restore ...
-1
votes
0answers
56 views

Windows 8 hacking

Can a Windows 8 machine can be hacked, by only knowing the IP address of the victim, without having first penetrated the Wifi? Say I disable the Wifi altogether and start my computer fresh..is it ...
-4
votes
1answer
81 views

Can a dedicated server provider access my data without knowing root password?

Is it possible for a service provider to access my data without knowing the root password? Is there a way to change the root password without ejecting the disk somehow? Update: I'm wondering whether ...
1
vote
3answers
89 views

What is more secure practice? Hosting from CDN or Main website

There has been a long Debate on CSP modelling, I have a Web application and I use JQuery in it, For that i use JQuery main site http://code.jquery.com/jquery-x.yy.z.min.js to Host it on my Site to ...
-1
votes
1answer
38 views

Difference between an “Information Security Policy” and a “Cybersecurity Strategy”

What is the difference between an "Information Security Policy" and a "Cybersecurity Strategy" ? I had an argument about this with my management and whilst some think that its basically the same ...
0
votes
3answers
53 views

How can I protect my WiFi if I have two routers?

I have a main desktop computer in my basement. It is connected to a modem box that my ISP gave me, which is also wireless. They also recommended a stronger wireless router, from Linksys, that would ...
0
votes
0answers
31 views

How does quarantine feature work internally in antivirus? [duplicate]

I'm struggling to find out the internal encryption and details of quarantined file. if any body knows the information please share.
1
vote
0answers
58 views

Do search engines verify HTTPS certificates, and if so, against which CAs?

Just out of curiosity, I'm wondering whether search engines attempt to validate certificates and what is their trust store. Do they accept everything regardless of certificate's trust/validity or do ...
0
votes
1answer
27 views

Two Factor Authentication VPN

I have a VPN connections Site to Site VPN, for security reason, I want to add 2FA Can I set up 2FA on VPN ?
6
votes
0answers
141 views

Vulnerability in popular Javascript Framework (Angularjs)

I found a bug that allows you to escape the AngularJS template sandbox. Angular is a mustache based template language. It allows you to put expressions that are evaluated in your html. For example, {{...
1
vote
0answers
19 views

Is it safe to paste secure notes into Notepad if you clear your clipboard? [duplicate]

Password manager software such as LastPass and Keepass often offer some form of a secure note feature, which allows the user to encrypt data with their master password. However, their GUIs may not be ...

15 30 50 per page