2
votes
0answers
74 views

Is this symetric or asymetric encryption?

I’m at the beginning of my journey into the world of security. I am reading about the most fundamentals topics and I have encountered something unusual that has thrown me. The Conundrum: I have come ...
0
votes
0answers
16 views

Blackberry 10 supported SSL/TLS/DTLS versions?

I'd like to know the supported SSL, TLS and DTLS versions in Blackberry 10? From a developer's perspective that is, what native support does BB 10 offer me to secure my app's communication? I've been ...
1
vote
1answer
59 views

why are passphrases not the standard

I have seen many questions concerning passwords: how to measure password strength, why don't we pick passwords for the users and obviously the best one: passwords vs phrases and the one i would like ...
2
votes
1answer
129 views

This is 2015. Has SHA1 been exploited or cracked yet?

went to Qualys SSL lab and tested one web site. One of the findings says the site is signed with weak algorithm SHA1withRSA and I did some research all are saying we should change to SHA-2. may i know ...
0
votes
0answers
16 views

Dropbox with Google url encoding for file download [closed]

I have been working on a case trying to identify the vector for an infection that had occurred. I have found an e-mail msg that contained a link that did not trigger a blocking event. For obvious ...
1
vote
0answers
21 views

Why Armitage nmap results differs from msfconsole ones? [migrated]

More specific in msf console why when I 'nmap -v -A 192.168.1.8' I get all the results I expect (OS detection windows 8.1 etc), while when I do the same from armitage I get unknown? I have the same ...
39
votes
8answers
6k views

Why can't you work backwards with public key to decrypt a message?

As the title suggests, I am curious to know why you can't work backwards using a message, public key and encrypted message to work out how to decrypt the message! I don't understand how a message can ...
12
votes
7answers
2k views

Why don't we reward users who choose strong passwords? [closed]

Suppose there is a web property that has some sort of reward system or commodity that its users desire. It could be reputation on Stack Exchange-like sites, rank badges on message boards, or add-on ...
2
votes
2answers
66 views

Password strength with grouping of characters

For better readability and easier entry of long passwords I thought it was a good idea to group these using a fixed separator like so: f6hyF.75zaG.FhtYb.1a63h Assuming this structure of the ...
1
vote
0answers
81 views

Consequences of disabling SSL2 and SSL3 on our webserver [migrated]

Our system is quite old and as a result gets an F grade for SSL from Qualsys SSL because the server supports SSL2 and SSl3. We have now identified all the browsers people are using. The oldest is ...
0
votes
0answers
25 views

calculate time for preimage attack (hash creation time is known) [on hold]

Given the 59 leftmost bits of a hash (Cryptographic Generated Address without SEC parameter http://en.wikipedia.org/wiki/Cryptographically_Generated_Address) how fast (on average) will we find another ...
0
votes
1answer
33 views

What are the risks of file server access over wireless? [closed]

In our office, all computers connect to the network over wireless. The wireless is protected by a pass phrase and communication is AES encrypted. On the same network is a file server that is used ...
4
votes
1answer
23 views

Secure encrypted storage of values that allows DB lookups?

I'm developing a system that has to store Finnish national identification numbers as securely as possible while allowing "does this identification number exist in the system?"-type queries over a web ...
0
votes
0answers
17 views

John The Ripper error: No charset defined for mode: ASCII [closed]

I installed the current John the ripper (1.8.0-1) on my Ubuntu. It worked first with very simple passwords, but one I get to something with capital letters and/or digits - all it does is to print: ...
0
votes
0answers
36 views

Encryption and decryption of plain text using stream cipher algorithm [on hold]

As we know that in stream cipher data are encrypted bit by bit as in block cipher block by block. So in stream cipher key will generate as depend on plain text. So I have doubt that if in any stream ...
20
votes
5answers
3k views

Is it possible to “read” secure (using SSL or TLS) messages if you know the message?

If I am communicating over a secure line (secured using SSL or TLS) and I send the server a message. Could someone eavesdropping tell what that message was if they knew before hand a list of messages ...
3
votes
3answers
70 views

What previously-unknown Wifi access points will devices automatically connect to?

I was reading an article on an iOS8 SSL exploit on The Register when one quote caught my eye: “Anyone can take any router and create a Wi-Fi hotspot that forces you to connect to their network, ...
3
votes
3answers
64 views

Is CSP enough to prevent XSS attacks [duplicate]

Assuming that users are using modern browsers, is implementing a strict CSP policy enough to prevent all XSS attacks? I'm working on a Backbone app, and am wondering if I still need to be escape user ...
1
vote
1answer
37 views

Running webserver with SSL enabled but not used

We have a web server hosted by a third party running on port 80. They have also enabled SSL but we did not use it. We are just using port 80. Right now, when I do a vulnerability scan, some SSL ...
6
votes
1answer
73 views

Secure HTTP headers

In this article, the example shows ... HttpOnly;Secure However, a check on my server response show ... Secure;HttpOnly This may be a stupid question but, does the order matter? thanks
0
votes
0answers
60 views

Pricing of a password audit [closed]

Let's assume that a company want's a password audit. So they get all the pw hashes and a security company performs a pw audit. How much would that cost? For example: One Active Directory with 50 ...
1
vote
0answers
33 views

If I have the cell #. switch ID and name, can I locate an physical address? [on hold]

Only a PRO can help me! My husband had an affair, said it was over five years ago and I should not be concerned, ever again. Yet, the result was devastating, medically with cancer. I believe people ...
1
vote
1answer
16 views

Can a client certificate be revoked and reissued with the same name in OpenVpn? [on hold]

Can a client certificate be revoked and reissued with the same name in OpenVpn ?
18
votes
5answers
3k views

The Perfect Mousetrap - Can a sandbox system be designed such that it's identical to an actual computer? [duplicate]

In testing suspicious files for malware, the typical method is to search for known malicious code. This is why zero-day malware attacks can be so dangerous — their malicious code is previously unknown ...
-1
votes
0answers
22 views

How secure is our whatsapp wechat bbm? [closed]

How safe is our whatsapp,wechat,bbm etc ? Does the application server stores all datas we sending including pictures and videos? Can anyone retrieve or backup all deleted datas from these?
0
votes
1answer
56 views

Solution for Protocol Downgrade Attacks

I have a Protocol Downgrade Attacks on my website, i have seen the solution to be as TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks refer link :- ...
-1
votes
1answer
44 views

What would be a problem with using a block cipher to encrypt the traffic of an online game?

I have a question and can't really find the answer. Here are my 3 possibilities. I think it is the 2nd one but want a different opinion. a)The communications require a key exchange not supported by ...
0
votes
1answer
79 views

What are the main differences between a Metasploit vulnerability/exploit attack and a “R.A.T.” attack?

I explain myself: To attack with a vulnerability & exploit it with Metasploit, you have first to find a vulnerability listed. Then once you have it, you set up the whole thing and end up with a ...
1
vote
3answers
97 views

What type of attack is this?

Attacker purchasing something from e-store when attempting to tamper with requests and change the transaction amount value. What type of attack is this? How to prevent this kind of attack as the bank ...
0
votes
0answers
17 views

Is there mobile app for encryption a voice thru the common gsm call? [closed]

Is there a program that encrypts the voice of the first person then it will be decrypted on the other side of conversation and so on? Or maybe something like that. The main point is encryption on the ...
0
votes
2answers
91 views

How can I stop rails exposing its routes?

Today my site was probed maliciously. I have searched through the knowledge base for advice on how to block cg-bin requests but have not been able to find specific advice. A portion of the log of the ...
2
votes
1answer
69 views

How does this encrypted webmails works?

In the last days I was looking on Tutanota, ProtonMail, LavaBoom, and others webmails that promise to respect users privacy. For all those, the one I most liked was Tutanota. I did few tests with ...
0
votes
0answers
12 views

UTF8 and T61 strings, how do I see what my SSL cert uses? [migrated]

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
0
votes
0answers
16 views

Findout address of shellcode dynamically, placed on stack [migrated]

I am using shellcode to spawn a shell,I am curious to findout the starting address of shellcode dynamically,which is placed on stack and not hard code the address in the shellcode kindly share your ...
3
votes
1answer
24 views

PGP Owner Trust Field & Signature Trust Field Distinction

I'm reading Cryptography and Network Security Principles and Practices (5th ed, p584) and reading about PGP keyrings, I'm a little confused about the differences between the owner trust field and the ...
1
vote
1answer
60 views

Minimize risk with Windows 2003 end of life

The company I’m at currently has over 500 Windows 2003 servers remaining globally in production and even though they have a refresh plan they are working through, they are not going to be done anytime ...
0
votes
0answers
19 views

SAD storage prior to authorization [closed]

Does anyone know of any FAQ's or articles written by PCI SSC in regards to sensitive authorization data storage, namely track data, in RAM before processing? The use would be storage within the ...
3
votes
1answer
90 views

Secure Connection between two mobile (Android and/or iOS) devices

I've a Device A which will communicate with multiple devices on a network (BLE and/or NFC). All the devices will be handled a Token upon authentication which somehow needs to be transferred over to ...
1
vote
0answers
23 views

Having trouble reproducing PHP heap based buffer overflow in quoted_printable_encode [closed]

I am trying to follow the test script provided here. I've installed an apache web server with PHP version 5.3.25 and created a script with the following code: <?php // file: test.php $str = ...
1
vote
1answer
32 views

is OSSEC effective in protecting a Drupal installation?

I noticed that the 2.8.1 rules have wordpress and other products listed, but no Drupal rules. Is its safe to assume OSSEC, acting like an IPS in active mode, is just not going to block any Drupal ...
0
votes
1answer
44 views

Disk level encryption + compression performance?

What are pros and cons for using disk level encryption like VeraCrypt and then turning on compression on mounted (virtually decrypted) drive? It seams to me that this can even increase some ...
-1
votes
3answers
154 views

If TLS 1.2 is considered unbreakable, why do the NSA and other agencies invest in supercomputers? [closed]

If a 2048-bit RSA key and a 256-bit AES key are considered to be unbreakable within the foreseeable future by any kind of computer, why do the NSA and other intelligence agencies invest in ...
1
vote
0answers
58 views

how many sha1 hashes per time on current hardware [closed]

How many sha1 hashes per second can current hardware (say a 500$ gpu) compute, when the input is 256 byte long? (or any other length). The question behind is how long (or how costly) is it to mount a ...
6
votes
1answer
428 views

stack buffer overflow in the main function? [closed]

I am trying to exploit a stack based overflow vulnerability. All the examples I can find make use of a ret address though. The buffer overflow I found is inside the main function, and I cannot find ...
18
votes
5answers
3k views

How can I ensure my dll has not been modified?

I have an old project in VB which created an unique pc code from MAC address and disc id. This was used to identify a pc so credentials cannot be used between pcs. This project migrated to C#, and I ...
0
votes
2answers
48 views

Should I create one key pair per customer as Service Provider in SAML?

This is more or less the reverse of what's asked in this question. I recently added SSO with SAML to a SaaS Web application making said application the Service Provider (SP). This is done so ...
1
vote
1answer
56 views

How to send secure messages from a microcontroller circuit?

I have an Arduino with a GSM shield. This enables me to send short arbitrary messages to any server. What do I need to do to enable sending "secure" messages (that cannot be intercepted and have a ...
0
votes
1answer
48 views

Limiting a CA to only issue valid certificates to internal web sites and clients

What are the possible defense measures that can be applied to a simple PKI (no intermediate CAs, etc.) used to authenticate clients and servers over TLS on an internal network only? Certificates ...
1
vote
0answers
65 views

How the firewall is allowing Facebook requests to bypass itself? [migrated]

I've a McAfee Firewall configured at my workplace. It actively blocks all the requests for websites like https://www.Flipkart.com https://www.Amazon.com https://www.Facebook.com I's playing ...
0
votes
0answers
34 views

Is it possible to pre populate a password (stored as hashed form in the db)? [closed]

I think this is a bad practice, but ignore that for now. If I have a login form (username/password and a remember me checkbox). Is it possible to pre populate the username and pwd fields if a user is ...

15 30 50 per page