1
vote
1answer
733 views

What encryption is possible for ReadyBoost?

ReadyBoost is a technology to assist getting Windows Vista or 7 to load faster on memory-constrained PC's. Since a USB stick can be easily removed, what security options are available for this ...
1
vote
1answer
4k views

Is it safe to use namebench?

As the title states is Google's namebench utility safe to run on my Mac and let it use Safari's web history?
23
votes
5answers
2k views

Should passwords be revealed in error message?

I am having pet-peeve with PHP's PDO class. As you can see on the Warning note: it reveals database password by default if an exception was not caught (when display errors is on which is a probable ...
6
votes
3answers
4k views

Advantages of separating Web server from Database

What are the security advantages of installing the database of a web application on a server other than the one containing the web server?
3
votes
2answers
407 views

Would our company system be more secure using a VPN?

I'm currently building a back-office system for our company [for internal use] that will manage our customers, accounts etc (not interested in don't reinvent the wheel comments today, thank you!). I'm ...
2
votes
0answers
767 views

Global Networks - Are there any other than the Internet? [closed]

Here is the definition of Global Networks: Currently does any Global Network exists (apart from Internet)? Can someone Quote some examples? Doesn't every other WAN network comes under the category ...
5
votes
1answer
268 views

Understanding a vulnerability

http://code.google.com/p/chromium/issues/detail?id=68439 I am having a little bit of trouble understanding this report. From what i have read, it appears as though removing certain dom nodes ...
2
votes
3answers
324 views

Verify if person belongs to the claimed university through his university email id

I need to allow users access to an application after verifying that they belong to the claimed institute through university email id. So that if a person claims that he belongs to Stanford University, ...
3
votes
2answers
895 views

failed login attempts analysis

Is there any open source project that logs all the failed login attempts over a period of time and gives me analysis of the same, the login failure is at windows or unix or mac user authentication ...
3
votes
2answers
182 views

Email & Domain ownership?

Most hosting companies, such as mine (hostgator) give the following notice when providing a contact email: Email address that you can be contacted at. This should be an email address that is not ...
5
votes
3answers
398 views

Is my sons' school portal in violation of any Password/UserID rules?

My sons' school sends both ID and PW for a portal through USPS at various times during the year, (e.g. class registration) whether I need it or not. If I change the password, it sends a confirmation ...
13
votes
7answers
978 views

Online Government Elections System - Is it possible?

I am from Bulgaria and currently some groups here are promoting the idea of referendum among the people, about the possibility for establishing a system for ONLINE GOVERNMENT ELECTIONS. The idea is ...
0
votes
3answers
745 views

Can people use AES VPN tunnels to hide their activities from authorities?

I have read an article about programmers who use AES VPN tunnels when working remotely with clients from other countries. The article writes that this way their countries are unable to track their ...
2
votes
1answer
881 views

Preventing License protection circumvention in Java software

A software (written in Java) by a vendor uses DSA signature to verify that the license information is correct. It achieves this by embedding the public key in the same Java software. Legit license ...
-2
votes
2answers
955 views

Is zeus trojan really harmless?

I am confused by this page http://www.wiki-security.com/wiki/Parasite/ZeusTrojan/ I was searching info on google as I read warning article about the fact it was very sophisticated bot that steals ...
7
votes
3answers
2k views

Getting started with SmartCards; what equipment do I need, what do I need to know?

I have an unused SmartCard slot on my laptop and I want to learn how companies take advantage of it. Are all SmartCard slots capable of reading and writing a blank card? Are there compatibility ...
4
votes
1answer
364 views

Has the wedge security flaw been fixed for credit cards?

According to this site http://www.lightbluetouchpaper.org/2009/08/25/defending-against-wedge-attacks/ there is a flaw in EMV. Since then has this flaw been fixed? Is it the same law as the one ...
2
votes
2answers
426 views

Trust and signing: full public key or thumbprint?

Imagine a B2B service where two parties need to set up a two-way trust relationship: Alice will only accept requests from Bob, and Bob wants to know his requests are only going to Alice. When ...
4
votes
2answers
2k views

Hashing Algorithms on GPU, 32 bit vs 64 bit

I read here in What algorithms are best be cracked by GPU? that, hashing algorithms such as SHA1, SHA224, SHA256 which do 32 bit integer arithmetic and logical operations are better implemented on GPU ...
0
votes
1answer
636 views

1and1 Dedicated Server got compromised (Windows Server 2003)

We had couple of dedicated servers rented on 1and1 hosting. In past we had situation where our server has got compromised and intruders were able to hack into the Windows 2003 standard edition and ...
5
votes
5answers
2k views

SYN Flooding issue

I recently purchased a server with "DDoS protection" and a 1gbps uplink. What I can't figure out, is that I'm suffering from SYN floods. Isn't the large amount of bandwidth available to me supposed ...
1
vote
1answer
2k views

Backtrack 5 R2 & Metasploitable

I have configured the OpenVAS server as per wiki instructions: http://www.backtrack-linux.org/wiki/index.php/OpenVas And i ran the following commands: msfconsole load openvas openvas_connect admin ...
7
votes
10answers
634 views

networking and security

I'm trying to pick up networking security within a reasonable amount of time. I'm not specifically looking to learn about all the little tools that are available (although I do want to know about ...
-4
votes
2answers
163 views

how to protect a personal computer? [closed]

I am Linux user with no knowledge on security , up to now i dont know that is my system was in attack or not . I havent felt anything wrong with my system . but every Computer user must have some ...
6
votes
3answers
1k views

Securing a multi-tenant architecture

I'm a computer science student looking to expand an already developed web application into using multi-tenant architecture. Considering I'm far from being a security expert, which precautions can I ...
1
vote
2answers
375 views

What is the best book on threat modeling that you've read? [closed]

I have been involved with developing threat models for several software products and features, and I'd like to formalize this process a little bit and create some documentation for my company's devs. ...
1
vote
1answer
239 views

SNMP trap by legitimate program?

Is there any way to tell if this SNMP trap is something created by a legitimate program? Update: Hex Dump 0000000: 30 82 00 ec 02 01 00 04 06 70 75 62 6c 69 63 a4 82 00 dd 06 82 00 09 2b 06 ...
8
votes
2answers
13k views

How to mitigate SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability?

Disclaimer: I'm not a sysadmin, please try to give your answers in developer friendly language ;) I'm test scanning a fresh VPS image with Nessus and I'm getting plugin 58751. I tried figuring out ...
3
votes
2answers
2k views

Keeping Whois domain registration details private

Most domain registers offer a service to keep your details private in the Whois database. Usually this works by replacing your email, telephone and snailmail addresses with proxies or P.O. Box ...
3
votes
2answers
1k views

How to run a Tor exit node securely on a vps

I want to run a TOR exit node on a vps, what security measures do I have to put in place on the vps? I know it will be a huge target for hackers and the three letter word agencies in the USA so I need ...
2
votes
1answer
841 views

Example of attack trees in the web application security analysis

Here I am again asking for some informations about attack trees usage in web application analysis. For my master thesis I decided to study the usage of this formalism in order to reppresent attacks ...
4
votes
6answers
2k views

Information Security Career tracks - Academically vs. IT certifications

I will try to be as straightforward as possible here. I am currently working as a security integrator at an integration company. I work with products of vendors like Check Point, Cisco, Juniper, HP, ...
2
votes
3answers
379 views

Why do credit cards not use digital certificates?

Asymmetric encryption and digital certificates are used all over in the IT world to verify authenticity and prevent forgeries. And it works great. Why do credit cards not use some form of ...
1
vote
2answers
241 views

Which MTA don't have antivirus check for outbound emails?

I need to test whether MTA has antivirus check for inbound emails. To check this I need to send email with e.g. EICAR testfile from another MTA to this one. However, Gmail, Yahoo and other well-known ...
1
vote
2answers
1k views

Is spam more likely to be sent to info@example.com? Would I be better off using a different address?

I think that when bots gather domain names or process a list of domain names, they create email addresses like info@example.com or support@example.com. Does selecting something different help to ...
7
votes
2answers
2k views

Could somebody explain how DNS poisoning might occur in this scenario?

I read the following statement in a security blog using the same source port over and over again for dns queries instead of randomizing them is a vulnerability for dns poisoning Could somebody ...
0
votes
1answer
632 views

Securing firewalls for XAMPP on Mac OS X

I've recently installed XAMPP on my Mac OS X 10.6.8, and this has caused me to reevaluate how I have my firewall setup. Right now I am using the two firewalls that came pre-installed on my computer: ...
2
votes
3answers
2k views

Do I have a virus on my hosted site?

A few weeks ago I hired an outsourcer from India to build for me a very simple PHP site. I bought PHP hosting and a domain name, and I gave him all the credentials together with the specification of ...
2
votes
1answer
7k views

How to use http-get-form in THC-Hydra?

I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App" brute force section but the problem is when I use http-get-form it said: Warning: child 1 seems to have died, ...
1
vote
0answers
350 views

making a start in finding exploits [closed]

I am a thorough newbie in computer security but the Google chrome exploit reward has gotten me interested in computer security and I would like to know what is an ideal starting point for one ...
2
votes
4answers
161 views

lock for asp.net developer using vs 2010 and win xp?

I am hiring few extra trainees who will use their personal laptop at my office to work on .net projects. I want to restrict the code/file access in their laptops with password. Like when they get in ...
2
votes
3answers
377 views

How should one manage authentication on custom line of business software

I am writing line of business software for a company, and we want to authenticate users, so we can manage workflow and do some auditing. Basically my employers don't want me to piggyback off of ...
3
votes
2answers
595 views

I have my website in wordpress and it got hacked how to secure it? [duplicate]

Possible Duplicate: Protecting WordPress installations i have control panel access to my wordpress website, but last week it got hacked and i found that the index.php was replced by the ...
1
vote
2answers
160 views

Is Google a feasible tool for an organization to check if their name is being used in phishing sites?

Is it feasible for an organization to use Google and the available Google search operators (e.g. allinurl, etc) to find out if their organization name is being spoofed or used in phishing sites and ...
3
votes
5answers
169 views

Are there any academic articles on how people handle their passwords?

Are there any academic articles on how people handle their passwords - how many they use in total, how often they change it, whether they commonly store it somewhere or just remember them and so ...
5
votes
5answers
4k views

How secure are “mobile authenticators” versus traditional key fobs?

Two-factor authentication, password + device, seems to be increasingly mainstream among consumers with products like Activision Blizzard's Battle.NET authenticators. However, I am curious what the ...
2
votes
2answers
843 views

External IP same as Internal IP security

Where I live my ISP does not give IP addresses out. My external IP address is the same as my external if I plug directly into the wall with no router. My ISP does give everybody a "router", that is ...
4
votes
3answers
1k views

In the Diffie-Hellman key exchange, how is the shared base key 'p' known and how are A and B, protected from Eve?

I'm trying to wrap my head around Hellman, Diffie, and Merkle's key exchange design, but after reading the Wiki article about it, I can't figure out how the commonly known factor ('p', I think) comes ...
2
votes
3answers
209 views

How to test for presense of antivirus?

I want to test that when user uploads file, then it goes through up-to-date and properly configured antivirus. I think that to test for it I need some malware that is likely to be detected (it doesn't ...
14
votes
2answers
5k views

Worst case scenario, what can a Chrome extension do with “Your data on all websites” and “Your tabs and browsing activity”?

Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to: Your data on all ...

15 30 50 per page