4
votes
2answers
750 views

Online banking proof of transaction for vertification in court

So, when i do an online payment transaction i "sign" my transaction with my digipass using some sort of a MAC (HMAC) with a shared key and some information that is unique for this transaction. But ...
23
votes
2answers
4k views

Will encrypting the same file with GnuPG and the same key produce the same ciphertext?

If I encrypt the same file twice with GnuPG, using the same key, will I get the same result? or is it using some random/psudeo-random segment to improve security like rsynccrypto?
6
votes
1answer
8k views

SQL Injection - UNION SELECT and returning a 'keyword' to find exploitable columns

I have a problem I'm hoping someone could help with regarding the use of UNION SELECT, in a scripted/automated way to find columns that are exploitable (having already found the number of columns ...
8
votes
3answers
1k views

Are secret URLs secure over HTTPS?

Imagine a service that makes sensitive information available under a secret URL via HTTPS only, without requiring any other authentication. In fact, these are already widespread. What level of ...
2
votes
2answers
686 views

Looking for general guidance on securing web API application for client applications and users

I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization. After a lot of googling ...
6
votes
2answers
1k views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
8
votes
1answer
6k views

Drawbacks of storing an authentication token on the client side?

I am working on an ASP.NET MVC web application, which fetches its data from an API in the back. So authentication is currently done via ASP.NET Forms Authentication, which means the client sends email ...
15
votes
4answers
3k views

What are the security threats of zip file uploads and what preventive actions should be taken?

We have a Drupal application developed for sharing files. We are allowing zip files to be uploaded by logged in departmental user. We are using Drupal private file system (outside webroot). We are ...
2
votes
1answer
514 views

XSS MySQL Database Accessible?

I'd like to know if there is any danger of someone being able to access the database via XSS vulnerabilities on this page. I have the following link. When you go to this link, the text I've enclosed ...
-1
votes
1answer
106 views

For a Broker/Dealer, what technology is appropriate to limit transaction to a given state? [closed]

The SEC allows for individuals to not register with them if they don't permit business with users outside of the state: A broker-dealer that conducts all of its business in one state does not ...
4
votes
1answer
314 views

3DES with fixed-encoded random key

I need an advice. I have a communication protocol using 3DES cipher. Each time the client connects (and it can be very often like 1-10 per second), the 24-byte key is generated randomly on server ...
2
votes
2answers
3k views

Prevent unauthorized workstations from joining a Windows Domain

Corporate policy only allows users to connect corporate-issued machines to the network managed by Active Directory. Is there some means to log or otherwise detect when the same user account joins the ...
2
votes
0answers
44 views

Is it the default in billing systems to send out the users password by email? [duplicate]

I recently made a complaint to a company about them sending out passwords in plain-text via email upon registration knowing that it is a potential security risk. One of their employees responded with ...
12
votes
2answers
311 views

Preventing Voter Fraud on a Social Media Contest

I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...
2
votes
1answer
1k views

Why a web server HTTPS certificate can't sign its subdomain HTTPS certificates?

Why having a valid certificate for "exampe.com" I can't make a "child" certificate for "subdomain.example.com"? What insecurities will arise if browsers start allowing domain's certificates to be ...
6
votes
5answers
2k views

I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help?

My client wants to look into hiring a third party to perform penetration tests on the website that we're developing for them. The website is just a simple 3-month contest site where people can upload ...
2
votes
1answer
191 views

What devices/types of devices typically have unique associated ID numbers?

Background (not necessary to read; just what makes me ask): Say someone's computer has either been hacked, or is running software run by $LARGE_EVIL_CORPORATION, and the hacker/$L wants to collect as ...
4
votes
3answers
16k views

What typically is the expiration date of a session cookie?

I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
8
votes
1answer
386 views

Is there a public database of mutex names that are associated with malware?

I remember seeing something like this a while back, and it'd be incredibly useful for a project I'm working on. Essentially there was a list of mutex names, with a list of malware identifiers (e.g. ...
8
votes
3answers
6k views

Strong encryption for base64 encoded public key in Android

I want to know how I can achieve strong encryption of a public key present in my Android application. It's Android's advice that To keep your public key safe from malicious users and hackers, do ...
4
votes
1answer
289 views

How do I build a secure signing mechanism on top of HMAC

Say we have a system with strong shared keys (not passphrases), and we're trying to sign messages sent by the server that will be visible to an attacker. E.g. storing session state in a signed cookie. ...
4
votes
2answers
138 views

Using SSL Certification in Multiple Locations

I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access. The ...
0
votes
1answer
156 views

opening up Active directory to cloud services?

We are testing SPAM/Virus cloud solutions and they can read active directory users and groups to help with users set-up and configuration. All they need from me is a user name, a password and the ...
1
vote
1answer
497 views

What is the origin of the three factors of authentication?

The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the ...
11
votes
2answers
2k views

What does this injected code do?

One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files. Does anyone understand what it is trying to do? I would welcome anything that may ...
1
vote
1answer
423 views

Following redirects from HTTPS to HTTP - Secure?

So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting) This means, in theory, if you ...
7
votes
3answers
10k views

Need a software that can monitor and log network traffic of installed applications [closed]

I need to monitor and log network activities of a specific software installed on my system. I know there are lots of network monitoring software out there, even system explorer has one built in. I ...
2
votes
1answer
449 views

isaac random number generator and the type of encryption it is used for (game packet encryption)?

I recently found isaac but I'm not sure what type of encryption is possible using it. Does the random number generator itself become the message somehow or does it get used as a seed for an encryption ...
9
votes
4answers
2k views

Man-in-the-middle scenario for TLS

Consider the following scenario: You want to securely communicate with a.com and you only trust the VeriSign root certificate. a.com presents a certificate signed by VeriSign with CN=a.com, so you ...
9
votes
2answers
267 views

How general should a vulnerability be to be eligible for a CVE?

Which vulnerabilities are common enough to become CVE? Is it related to "application"s only, or websites are accepted as well?Is a vulnerability in an unpopular website (or a local service) considered ...
4
votes
1answer
990 views

Is this fprintf statement potentially vulnerable?

Here's the statement: fprintf(stderr, "Some random string\n"). Is it okay not to have a format specifier, such as %s, even though the statement doesn't take any user input? Is it still potentially ...
2
votes
3answers
315 views

SQL Injection - MSSQL

I'm learning about SQL injection and have the following backend code, Set rs = server.CreateObject("ADODB.Recordset") SQL = "SELECT * FROM Registration WHERE name='"&name&"'" rs.Open ...
3
votes
2answers
128 views

Can a good SSO protocol be built around a server signing tickets rather than validating them on demand?

CAS and its alternatives all seem to require a flow like this when one service is acting as a proxy for a user when accessing a back-end service: Service A makes a request to Service B on behalf of a ...
5
votes
1answer
2k views

How secure is Integrated Windows Authentication for IIS SMTP?

I have a Windows SMTP server that is currently allowing the "AUTH LOGIN" method of authenticating. As I now know, this is simply a base-64 encoding of the username and password, which is basically as ...
14
votes
2answers
1k views

Password and Generated number - How does it work?

In my company, they don't allow accessing the company email or servers from outside the company network. To access the email from outside the network, you have to use: Username, password and a number ...
7
votes
1answer
5k views

How to whitelist an Amazon ELB in a(ny) firewall?

We have a customer with a very locked-down network. Any outbound connections require whitelisting of the port and IP address. However, we are running our system behind an Amazon Elastic Load Balancer ...
1
vote
2answers
200 views

Is this Scenario Exploitable?

Here is the scenario: You get to overwrite 4 (consecutive) Bytes of a Userland Remote Process in Linux without Exploit Mitigation and without the ability to inject any Shellcode and you know the ...
5
votes
2answers
1k views

Man in the middle attacks for Out of band Authentication

I was researching on methods to avoid man in the middle attacks. I thought of using out of band authentication but i read the wikipedia article on the same topic which goes as follows: "In ...
2
votes
1answer
304 views

How much are security tools audited?

Just an open question to the security community at large because... well... the phpMyAdmin thing has made me more paranoid than usual... Specifically, I'm thinking about Kali Linux (ex-BackTrack). ...
45
votes
7answers
2k views

Why is application crash considered insecure?

If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again. Crash is a bad behaviour in general and should be avoided, but why are ...
1
vote
2answers
601 views

How to stop a (malicious) endless loop

Few days ago someone tried to crack my site using a Remote File Inclusion attack. The attack was blocked by my Web Application Firewall, but I was curious about the file. So I downloaded it started to ...
2
votes
1answer
259 views

find hardware and OS specs on routers

How do you determine the model and IOS version of a Cisco router, if you have its IP address remotely, but have no physical access. For example, I run nmap -sP and can see the router's IP, but all ...
5
votes
2answers
2k views

Securing USB flash drive on linux

We have a industrial system(running on linux) with a USB port. We have the USB port only for copying certain data. Other than this we don't want the USB drive to contain any other executables or ...
1
vote
1answer
2k views

How Do I find Out the Username And Password Of Wifi Windows 7?

Basically i have a computer that is dual booted with Windows 7 and Ubuntu. On the windows 7 side I do not have admin control. However on the Ubuntu side I have full control. So I want to know how can ...
2
votes
1answer
88 views

VPN using SmartPhone Location

When you VPN using your smartphone as a hotspot, can the VPN tell your location like it can when you VPN over a wireless connection hotspot?
3
votes
1answer
464 views

Will using external OAuth providers for authentication protect users better than custom authentication?

On StackExchange we have the ability to choose to use our existing credentials with external OAuth providers such as Facebook or Google. This is convenient for users, but does it also have potential ...
2
votes
3answers
7k views

What do I need to do to secure log-in and registration for my website?

What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
10
votes
1answer
1k views

Is there a spam storm? [closed]

I realize this is a bit off-topic, but don't know where else to go to ask... I've gotten an enormous amount of spam in the past 24 hours (hundreds), even after some relatively good spam filters. ...
5
votes
2answers
1k views

Linux forensics questions (ssh config, user activity)

I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates. We're supposed to answer: ...
5
votes
1answer
152 views

Voice Call Safety

When i was dealing with an assistant of my bank through mobile call, she asked me to insert my bank login code after a beep. I was wondering if this procedure is secure against a malicious agent who ...

15 30 50 per page