2
votes
3answers
89 views

Concerned with Tails vulnerabilities

Regarding this: http://www.forbes.com/sites/thomasbrewster/2014/07/21/exploit-dealer-snowdens-favourite-os-tails-has-zero-day-vulnerabilities-lurking-inside/ Apparently, even the version of Tails ...
-1
votes
0answers
10 views

Grep a destination IP in Netstat results in realtime - windows 7 [migrated]

Does anyone know how to get grep working so you can tail netstat results in windows 7 CMD?
-3
votes
0answers
23 views

Looking for a non commercial antimalware application [closed]

So basically, I'm not looking for a commercial anti-malware solution, as they are likely not to detect certain malicious programs. Probably being funded by someone not to detect it. I'm looking for ...
1
vote
1answer
31 views

Is it safe to expose MongoDB ObjectID to users (e.g. in URI)?

I'm developing a RESTful API using MongoDB as the backend. The easiest thing to do programmatically would be to simply use MongoDB's _id field in the URI, such as: ...
1
vote
2answers
47 views

Sign contents of entire computer?

If I travel abroad and am concerned that when I land in the foreign country they may try to install a digital keylogger, does this work as a potential solution: If I sign my entire computer's hard ...
0
votes
1answer
53 views

What Linux software can I use to explore entropy of a file?

I've heard of tools that could be used to graph entropy of a file. Is there a graphical Linux program that I could use for this job that would let me conveniently explore which blocks of a file have ...
0
votes
1answer
33 views

Identifying stream cipher algorithm based on encrypted content

Is it possible to identify the algorithm used for the stream cipher based upon analysis of an encrypted stream?
3
votes
0answers
37 views

What's stopping DANE? [closed]

As I understand it, DANE (RFC 6698) is a promising candidate for addressing issues with current TLS Trust Anchors (i.e. Trust Anchors). My attempt at explaining the issue: Currently, CAs are ...
1
vote
1answer
29 views

Preventing tracking in browsers by setting HOME directory

Following worked on Ubuntu 12.04 using chromium and firefox browsers. I ran following command on terminal for both firefox and chromium browser HOME=/tmp/tmpdir firefox Both browsers promptly ...
0
votes
2answers
81 views

Broadband security question

I have a fixed line broadband connection at home. This morning when I tried accessing Google or Facebook through my browser (Google Chrome) I got a webpage asking me to update my flash player. I found ...
1
vote
1answer
11 views

Etterfilter file-contents injection

On the etterfilter(8) man page, there is a section about the inject() function, which takes the contents of a file and injects it in a packet, or as its own packet when coupled with drop(): ...
0
votes
1answer
45 views

PDF Digital Signature [closed]

I got free certificate from Comodo and installed on my Windows. Now I'm trying to sign PDF document using this certificate, but get message: "signature validity is unknown": Why is this? How I can ...
2
votes
5answers
398 views

Does the SSL termination happen with the ISP or a mobile service provider? [duplicate]

Is it true that when I connect to a site over HTTPS , my mobile service provider or the ISP gets to snoop in the communication? Can they play MITM?
1
vote
3answers
177 views

How to tell if my laptop is being spied on

I've been trying to determine if there is malware on my OS X 10.9.3 Mac, that is could be doing keylogging or other forms of non-destructive intrusion. Given the (not technically based) suspicion I ...
0
votes
0answers
19 views

CLI API that requires plaintext user details

I've been tasked with writing a module for my company to interface with an external api. This api has a syntax similar to ssh where I have to incorporate the user details as well as the host address ...
1
vote
2answers
74 views

Identifying suspicious encrypted traffic [duplicate]

Firstly, I welcome a better title for this question. I admit I'm a security novice. I'm trying to determine whether I have malware and what that malware may be doing. Using Wireshark, I see several ...
1
vote
1answer
48 views

Web app with iframe and user - how to deal with session?

We have application which will be in iframe. Partner sites can use our application - put iframe in their sites. Partner site has users with money, who will use our application in iframe to buy items. ...
2
votes
1answer
20 views

Is there any difference for OS fingerprint technique used in Nmap inside -A and -O?

Is there any difference between the technique or algorithm used from Nmap to guess the OS between the option -A and -O? If not, why -O option requires root privileges but -A that it is doing at least ...
0
votes
0answers
23 views

Edit/Remove Timestamps for files and file system [closed]

I'd like to remove every timestamps (creation, access, write ...) for multiple flash drives (their files and their file system informations), and eventually forbid them from updating later. Do you ...
-3
votes
0answers
48 views

iptables raw table

I'm trying to collect iptables common shield rules, here is my current list: echo "-Check for All flags enabled&Drop." iptables -I INPUT -p tcp --tcp-flags ALL ALL -j DROP echo ...
0
votes
1answer
33 views

Designing and implementing a secure epayments system with RESTful API

I want to design and implement an epayments system (I will not be handling credit card payments). The system will have a RESTful API. I am already familiar with RESTful servies, and have built a few ...
0
votes
0answers
48 views

Google indexed pictures or content [migrated]

is it possible to remove content which is indexed in google? sorry if i am asking the question in wrong forum, let me know where to ask this otherwise. some pictures of mine and certain statuses are ...
0
votes
1answer
64 views

Windows - Revoked Binaries

I find it hard to believe that the majority of Windows system files aren't signed. I don't know whether my disbelief comes from naivety, or because Windows is used within secure environments worldwide ...
1
vote
2answers
62 views

Content sniffing XSS attack?

As a part of work, I've come across content sniffing, and i understand web apps can be vulnerable to xss because of it. There is another post, regarding content sniffing and xss, but didnt quite ...
2
votes
1answer
43 views

Browser - what gets saved to the disk

We run scraping jobs on behalf of users. We use webkit-gtk as browser to do the scraping. Each job is executed as a separate process So as not to mix user data we have isolated following data per ...
5
votes
2answers
118 views

Security sanity check

A company whose services I'm trying to integrate uses this protocol: An AES key is embedded in an Android library. To authenticate itself, the library sends a SHA1 hash of the key over plain HTTP. ...
1
vote
2answers
73 views

What Can I Do While I'm Waiting for “Chip and Pin” Credit Cards?

For the second time in 8 weeks, one of my American Express (AMEX) card numbers was stolen. I do use the card online, but only at reputable (and SSL/TLS enabled sites). I use it in the real world, ...
0
votes
0answers
14 views

How to configure Proxychains in backtrack? [migrated]

I am trying to configure proxychains.conf file but when i run any application from proxychains like firefox, it can't open the webpage and also terminal is showing "need more proxies !" ?? I have ...
2
votes
1answer
49 views

Would it be possible to add additional files to a password protected zip 2.0 file

So the scenario is this: I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing ...
0
votes
0answers
9 views

How to store hexencoded ciphertext in Java [migrated]

I am tasked with finding the secret message and I believe that I will have to XOR the different ciphertexts, but I don't understand how to store a ciphertext in a variable in Java. I could not find ...
0
votes
1answer
28 views

Is encrypting and subsequently sending a known clearext string after a Diffie-Hellman bad design?

I'm writing a small protocol that relies on a DH handshake, generation of a shared secret, and subsequent AES encryption/decryption using that generated secret. I want to add a built-in test message ...
2
votes
2answers
81 views

What problem does ECC seek to fix compared to RSA?

Elliptical Curve Cryptography (ECC) is one of the newest encryption schemes to challenge RSA cryptography. What problem does ECC seek to fix compared to RSA? Would you have any qualms with using ECC ...
0
votes
1answer
22 views

In TLS1.2 AES-GCM mode, what happened when input is not exactly the multiple of its block size?

I know that AES-GCM mode does not need padding, and its output are exactly the length of input data plus the tagging. But I am a little bit lost, as AES itself is block cipher, it could only operate ...
1
vote
1answer
42 views

Is there an example of a web server that does steganographic watermarking?

You could imagine a web app that serves subtly different versions of a page to each user. For example, it might encode the identity of the user in the images it serves. This would be a per-user ...
3
votes
1answer
90 views

PUT vs. POST for password update

I am writing a User Management system that has to include a change of password utility. We don't front end hash passwords (hopefully we will soon). As a result passwords are passed over https in the ...
1
vote
2answers
45 views

Using Free AV to meet PCI Requirement 5

I am looking for some opinions on using free AV for meet PCI requirement 5. The way I read this for version 2.0 is that it's entirely possible for a client to meet their AV needs with the modern free ...
2
votes
3answers
69 views

Is there any way to block LD_PRELOAD and LD_LIBRARY_PATH on Linux?

Preferably with a vanilla Linux kernel i.e. not using SELinux or GrSecurity? Lately there has been a case of in-the-wild UNIX server malware: ...
3
votes
1answer
71 views

Tools to make a security researchers life easier - tracking vulnerability research [closed]

I've been a developer for quite some time, and as part of my on-going learning process I've learnt how to spot and remedy broken (and insecure) code written by others. Recently, I've found myself ...
3
votes
0answers
40 views

How does malware hooks ASEPs?

What are the operations made by malware to hook the auto start extensibility points in order to be able to run at the startup of the computer that runs Windows operation system ?
0
votes
0answers
725 views

Can one tamper with flight recorder data? [closed]

I am assume all of you guys heard of the Flight MH17 catastrophe. It would be interesting to know if the Boeing use any Information Security related defense in their black boxes? I think they ...
2
votes
1answer
68 views

Do non-browser clients work around Gmail's 2-factor authentication?

If you use a client like mutt to access your mail, you probably know that it doesn't support 2-factor authentication. It still prompts only for a password - either your account password or, in the ...
1
vote
1answer
59 views

How to post comments on websites without being traced back

Just trying to get some general sense about the security on internet now-a-days. There are so many websites I go and comment on different things. If some comments are political and they don't like, I ...
0
votes
2answers
53 views

HTTPS - ssl error bad cert domain

When I try to visit some websites with HTTPS , I get the error that the SSL is self-signed and that the SSL is only valid for another domain, and that SSL is actually invalid. If the SSL is valid only ...
0
votes
0answers
35 views

Forensics in wireless networks, anomaly detection and beyond? [closed]

Next year I'm gonna be working on my final project in computer security, I have to build a wireless forensics tool that can analyse a data capture and scan it for attack possibilities or weird ...
-3
votes
0answers
47 views

How are hardware anti tamper mechanism usually defeated? [closed]

What are the commons attacks used to compromise/defeats/bypass hardware anti tampering mechanisms ? With anti-tampering mechanism I mean all the mechanism deployed in: box board chips used to ...
7
votes
4answers
1k views

Should the password of a password protected channel be hashed?

Let's take a chat system, where any user can create a channel with a password protection. Thus, other users may only join using the channel password. This password is therefore known to every person ...
2
votes
1answer
71 views

Proper way to ask for parameters renegotiation with SSL

Given a specific SSL/TLS connection, I would like to know what is the proper way to launch a parameter renegotiation, asked from client side. 1) Are they any requirements from the previous handshake ...
1
vote
2answers
80 views

How does Network Address Translation (NAT) increase firewall effectiveness

Truth or bald-faced lie: the cheap $50 router you can pick up at your local electronics store for your home broadband Internet connection is actually a pretty effective firewall. Why or why not? How ...
0
votes
0answers
35 views

Why allow access without an access token but deny access with an invalid access token?

I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions: anyone in the world can ...
0
votes
1answer
50 views

Pivoting without meterpreter [closed]

Is there any way other than Meterpreter to pivot into the network? If yes, then please guide. I already know about Meterpreter, just want to know manual methods other than this.

15 30 50 per page