10
votes
3answers
6k views

Do my Android apps use TLS or other encryption when connected to public Wifi? How can I tell?

I have an Android phone. When it's connected only to my carrier's 3G network I imagine it's reasonably secure against eavesdropping (although not invulnerable). However, at times due to lack of ...
1
vote
2answers
443 views

Books, videos, and other resources for CEHv7 [closed]

What are recommenced books, videos and other resources for CEHv7. It seems as though not much is published on the new version of the cert just yet. Currently, I have read All In One CEH by Matt ...
6
votes
7answers
1k views

HTTP Proxy vs bump-in-wire

If I'm an administrator of a corporate network, I could use an HTTP proxy to examine outgoing connections to monitor what websites my employees are going to, and terminate connections based upon ...
7
votes
10answers
4k views

How can I share files with other individuals using the cloud in a secure way?

I would like to use a dropbox because it is easy and convenient. But I want to encrypt the files with the public key of the intended recipient, so he will be the only one who can access the data in ...
2
votes
2answers
741 views

Online virus scanning service with remote file submission?

I have some links that contain hacking tool and whatnot and I want to pass them to a virus scanning service. The thing is that I don't want to download them to my pc and upload them to their service, ...
12
votes
2answers
7k views

CSRF With JSON POST

I am playing around with a test application which accepts JSON requests and response is also JSON. I am trying to do a CSRF for a transaction which accepts only JSON data with POST method in request. ...
4
votes
5answers
2k views

what is the best keylogger for security uses? [closed]

Today we were robbed. A thief come to our home at night and stole some stuff including my brother's laptop. I think that the right thing to do is to download a keylogger on my PC, just in case... I ...
3
votes
2answers
341 views

Security while connecting to a mysql databse using pdo

I looked at this question: What is the right way of storing database connection strings from the security point of view? and I'm wondering specifically for connecting to a mysql databse with PDO, how ...
1
vote
1answer
129 views

Where to find a fake hierarchy for a honeypot for double-dot/path traversal attacks?

I would like to provide content when a hacker tries something like GET /../../../etc/passwd, but they may choose something else, other than passwd. I will install notification of when somebody does ...
5
votes
1answer
331 views

What are formal parameters for fingerprint scanner selection?

I would like to buy a USB fingerprint scanner. I intend to use it to log in into my Windows computer, to secure RoboForm password manager, and generally to replace password entry with a quick finger ...
5
votes
1answer
293 views

What is it called when you give hackers a way in?

Is there a name for a system that is designed to be hacked into? (Alternatively, there may be a different name for a system that is designed to look like it is hacked in to, but is actually just ...
6
votes
2answers
3k views

Perl script rootkit (exploit)

I received a spam abuse few days ago on my server. As a precaution, I blocked the SMTP port and started an investigation. I found a running Perl process. The script it was using was deleted but I ...
2
votes
1answer
232 views

Does this htaccess snippet provide sufficient security?

I've downloaded a part of .htaccess to prevent from using base64_encode or <script> or _REQUEST within URL. Is this secure enough to help me out for partial security, or is it just a waste of ...
25
votes
4answers
5k views

Reusing Private/Public Keys

I have accounts on several third party sites - Bitbucket, Bluehost, etc. From what I've gathered, it is common practice to use one key pair for all [id_rsa, id_rsa.pub], but only to give out the ...
18
votes
1answer
3k views

Why do you have to be an admin to create a symlink in Windows?

In linux every user can create symlinks, but in Windows I need an admin command line, or mklink fails. Why is that?
8
votes
3answers
145 views

Does marketing data trigger HIPAA Privacy?

If I was a marketing firm who provides an analysis on visitor statistics from anonymous members who then ties that in to a CRM to track conversions, what do I have to do to the data to ensure that ...
5
votes
1answer
2k views

Code Review on a Header Injection In Java : any help?

I'm auditing a piece of Java code that might be vulnerable to header injection : String headerValue =request.getParameter("headerVal"); //escaping CRLF headerValue = headerValue.replace("\n", ""); ...
2
votes
2answers
2k views

Can Tamper Data (the plugin) modify multipart requests?

I'm doing some testing on my web app with Tamper Data. I've had success with Tamper Data in the past for normal HTTP post requests, but in this particular case I want to modify a post request that ...
2
votes
2answers
159 views

Debug mode for an application but removed in production

A application use the debug as boolean to prefill login, password for authentication. The code is something like that : if (ContantsFile.CUSTOM_DEBUG_FLAG) //static final { //disable access control ...
5
votes
4answers
6k views

How secure is Windows Auto-Logon?

Obviously, if auto-logon is enabled, anyone who can gain physical access to the PC can use the PC. That's not the question. The question is, when I enable auto-logon for my Windows 7 box, will there ...
13
votes
3answers
17k views

Setting up a honeypot

I have a spare computer lying around at my house, so I decided to turn it into a honeypot. So far, I have installed Windows XP (no service pack) on it and have set up rules on my router to forward ...
4
votes
2answers
313 views

Site listed as hacked by a hacking group

I was Googling one of my domains (hosted on shared hosting) and found a webpage where it was list as Hacked Site, the list belonging to a certain national hacking group (the country they claim to ...
3
votes
2answers
760 views

How do companies track employee usage on corporate computers?

For companies that needs to monitor computer usage by employees, what systems are usually set up to do so (monitoring software, hardware, etc.)? What are the financial costs involved in setting up ...
4
votes
1answer
5k views

Is it possible to auto mount entire truecrypt drive

Truecrypt can easily automount if your drive is not entirely encrypted and your data is a standard file. However I have my entire removable storage encrypted and so to the OS, it is seen as an ...
3
votes
1answer
459 views

captive portal wikipedia article

Something on the wikipedia page regarding captive portals have confused me: http://en.wikipedia.org/wiki/Captive_portal When a client requests a website, DNS is queried by the browser. The ...
2
votes
3answers
603 views

What are the best security practices to install a C# Web App on client servers?

We would like to install a Web App written in C#/.NET4 on client servers, not ours. I would like to know what are the best security practices to implement for avoid the following: Authority ...
5
votes
2answers
3k views

Kerberos - what can an attacker achieve from a replay attack?

On the last step of Kerberos, the client sends the target server a ticket and an authenticator. One of the authenticator's parts is a timestamp. The timestamp is said to prevent replay attacks, as the ...
8
votes
2answers
2k views

OCSP and CRLs: Specified in CA or client certificate?

Here's an example PKI setup: * Root CA (offline) * Issuing CA * Client 1 * Client 2 I'd like to specify a CRL distribution point for CRLs generated by Root CA, and an OCSP URL for Issuing ...
1
vote
1answer
198 views

users avatar names based on Primary Key, is it safe?

We upload users avatar with their primary key name. avatars name are 1.jpg,2.jpg,3.jpg,... according to their primary key. We implemented this to omit avatar field from database, instead with use ...
9
votes
4answers
2k views

How would you analyze an image to find out if there are scripts embedded in it?

How would you analyze an image to find out if there are scripts or possible malware embedded in it? What tools / methods to use?
8
votes
1answer
824 views

How secure is the apt-get install command against man in the middle attacks

I think the title says everything, how secure is it to use apt-get in a network with an attacker who injects his own packets and blocks the original packets (man in the middle).
5
votes
4answers
2k views

Two SSIDs on same Access point- not good?

If I were to offer two networks (one for trusted users and one to visitors) on one physical access point, is this dangerous because a visitor could compromise the trusted network across via the ...
2
votes
1answer
114 views

Using MySQL in .NET and other easily-decompiled languages?

How would people use MySQL in C#, or really any other managed application? Couldn't someone simply decompile the application and find out the password/etc. for the database?
3
votes
4answers
73k views

Is Teredo in my router a back door?

I use the school computer, which I bought from school, administered by the IT-department. I opened a port to my computer when I stumbled upon this: It points to my computer IP. (I have a static IP ...
5
votes
2answers
4k views

Why don't we use MAC address instead of IP address?

I can use the system function in PHP to get the MAC address of site visitors (probably most of you know). Why do we use IP addresss to check whether someone is stealing a cookie or not? Does the ...
3
votes
1answer
2k views

static IV and random keys using aes-256-cbc

Are there any security risks in using a static IV if I generate a new random KEY for each set of data to encrypt? If I understand correctly what the purpose of the IV is in Cipher-block chaining mode ...
0
votes
1answer
177 views

Can web connections from a virtual machine guest using NAT attract attacks from the Web to the host?

The hosts OS might be Windows 7 and its firewall activated and the visualization is done by Virtual Box , but I think these details are less important. This question might be related in some way to ...
1
vote
2answers
163 views

hardware required for wifi security system

i am planning to implement one WIFI security system , in which one can lock or unlock door remotely. As i have serched over internet and i came across lockitron and schlage Now what i want to know ...
9
votes
3answers
914 views

Public wifi security protocols

I should apologise first- this post could seem a lot to ask for, but I am starting to go around in circles. I am interested in securing my laptop for when I use public wireless hotspots, as I am a ...
0
votes
3answers
6k views

How to exploit this SQL inection vulnerability?

I am learning SQL injection on a vulnerable Web App. I scanned it with w3af. It showed many vulnerabilities. One of them is : SQL injection in a Microsoft SQL database was found at: ...
1
vote
2answers
1k views

Why websense not allowing homepage url(youtube) but a video page?

My company uses Websense, when someone goes to youtube by directly hitting url from browser it says it's blocked due to category :Entertainment. When someone searches for a video in google and ...
4
votes
1answer
2k views

Rainbow tables, generation and lookup, preferably using GPU

1a) What software can I use to generate my own rainbow tables, preferably software that can utilize CUDA or ATI Stream? One of the reasons I want to make my own, is that I want to use a specific ...
2
votes
7answers
918 views

Chrome vs Explorer - how to explain in plain words that open-source is better?

Why open-source is better in plain words? Yesterday I had a talk at a DIY bicycle workshop. There is a PC (running XP) that main application is checking emails (nothing really serious). I found it ...
1
vote
3answers
424 views

What security protocols provide point-to-point confidentiality?

Am I right in thinking that VPN doesn't protect until you're out onto the external network (assuming you're connecting from within an internal network)? Or does VPN provide confidentiality from the ...
4
votes
4answers
1k views

Explaining security vs. performace to a non-tech superior

I was tasked to implement some sort of password-based encoding/decoding in an android app by my non-tech SO. He also showed me this list of android security providers. Naturally, He chose the one with ...
4
votes
3answers
553 views

Is changing image's extension prone to error for browsers?

In my uploading user's avatar scenario, I change users picture extension to jpg. Is this making the browsers to act differently? Is it prone to error for browsers when they read users avatar? ...
3
votes
1answer
431 views

Non English password dictionaries

What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
3
votes
1answer
181 views

Session Token Embedded in Form

I have a session token that's stored in a browser cookie client side. The cookie is already available for scripting and it's used to validate XHR through Javascript. For a particular page I'm using ...
9
votes
6answers
1k views

Is putting every username and password for our organization in a giant Google spreadsheet a spectacularly bad idea?

Our startup has something like 100 usernames and passwords to keep track of, and we can't keep track of all of them. Would putting all of them in a Google spreadsheet shared amongst ourselves be a ...
0
votes
2answers
1k views

Protecting yourself against DNS spoofing?

Are there any things which the user can do, on their own machine, to protect against DNS spoofing? I was just thinking when I was at the airport last and I wanted to check my email I used a hotspot ...

15 30 50 per page