3
votes
2answers
137 views

Reference for Insecure password by email

I have come across a site that on going through the password reset sends my old password to me via email. Now we know this is insecure I see here this question and here and no doubt others. However ...
1
vote
0answers
144 views

State transition Analysis Technique

As far as I have read and understood STAT is a concept used to design a platform independent IDS. My doubt is whether there exists any compiler/interpreter for STAT Language as I am planning to do a ...
2
votes
3answers
14k views

How to prevent man-in-the-middle attacks beside of SSL?

I would like to discuss this scenario: There is a HTTPS service which responds with signed keys to an authenticated client. These signed keys can be used for another service to return very sensible ...
1
vote
1answer
518 views

What mechanism to use for simple and secure HTTP API access?

I am currently working on a service which offers a HTTP API for mobile clients. I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be ...
1
vote
2answers
3k views

CGI generic sql injection

I was scanning a site with Nessus when the following vulnerability was reported: CGI Generic SQL Injection Nessus says that: "An attacker may exploit this flaw to bypass authentication, ...
1
vote
1answer
84 views

Hybrid Encryption System - Is this unnecessary in this case? [closed]

I have a column in my database that I need to encrypt. The column can contain any arbitrary data. What I am thinking is to generate a public and private key pair first. Store the public key in a ...
1
vote
1answer
862 views

Wireshark detecting suspicious messages through jabber protocol, It says it is from my website, no idea what it is

I was doing a network scan on my computer with Wireshark and came up with something very suspicious: I found a stream with the jabber protocol. I do not have a jabber server set up nor do I have any ...
1
vote
2answers
3k views

Getting a SQL injection past a given regex [duplicate]

I have been shown one regex which, per the one who wrote it, should protect against SQL injections on SQL server 2008. It doesn't really look like it, but I'm wondering exactly what code I can get ...
0
votes
2answers
7k views

Windows user: Is having many active TCP connections normal?

Is this normal? Can any ports be "dangerous"? I have 9 tcp's in a listening state, 4 in a close_wait state, and 4 in an established state. Some of them route to odd procceses using PID such as ...
0
votes
0answers
65 views

How to remove rootkits and malware? [duplicate]

I have downloaded and ran the programme Rootkit Hunter and the results are worrying. I don't know much about malware other than a malicious individual has persistently been installing it onto my ...
4
votes
1answer
968 views

What's a trustworthy S/MIME Certificate Provider that generates my private key in my browser?

I read this question on the process of generating a private S/Mime key. I looked at Comodo - which offer free e-mail certificates. I'm trying to find out whether Comodo generates the private ...
12
votes
2answers
5k views

How can a malicious URL affect a computer?

Many security experts advise not to click on malicious URLs. How can clicking a URL affect a computer's security? If a malicious file was downloaded and executed, then a computer's security may be ...
11
votes
1answer
178 views

Android Device Support Lifecycles

A key consideration for most computer platforms is the availability of security patches for vulnerabilities which inevitably arise with them. Are there any available resources which provide ...
4
votes
4answers
65k views

IP address of an iPhone

Recently I logged on to my bank account via the Chase app on my iPhone. I received a message that another device was currently logged on to my account and "would I like to end the session"? Of course, ...
3
votes
1answer
1k views

How to detect social engineering attack?

How can I understand if I am being targeted by a grey hat social engineer? And if I fail, what approaches exist to detect social engineering attacks being in progress within an organisation?
20
votes
5answers
3k views

419 Nigerian scam problem

I fell in a scamming trap. It took me a while to figure it out. Blinded like an idiot. But it is what it is. I can only do as much as I can now. Tell me if there is anything else I should do. After ...
7
votes
2answers
2k views

ECC based Client Certificate import in Chrome/Mozilla in windows

I have deployed a PKI server and successfully able to generate the ECC based user or client certificates. but non of the web browser support ECC as public key. I have tried different tools and also ...
12
votes
7answers
4k views

Strategies against jamming attacks?

We have some devices which are designed to use standard frequencies/protocols, such as GSM, CDMA, GPS, Wifi and Bluetooth, among others. While our focus is not thought to be used for high-profile ...
7
votes
2answers
628 views

How to attract hackers?

I'm contributing to an open source project and we setup a testbed for security testing. We want to start a challenge to find security flaws and my question is: how do we attract hackers to ...
0
votes
2answers
1k views

Bank Fraud Deposit

My daughter just discovered yesterday that a wire transfer of $12K had been made to her checking acct. at Chase. It said it came from a Wells Fargo in NY in the name of some name she didn't ...
5
votes
1answer
742 views

What iOS apps use data protection?

The iOS data protection API and its implementation are fairly well documented, but it is only really useful if apps actually use some level other than NSFileProtectionNone for their files. Is there ...
5
votes
2answers
3k views

url from another domain in my access log

Most of the time when I am looking for 404 errors in my access.log, I see attempts to access something like /phpMyAdmin/scripts/setup.php. This does not bother me so much, but few days ago I was ...
7
votes
4answers
4k views

Is 1Password more secure than an AES encrypted text file?

Are there extra measures taken by 1Password and KeePass, that make them more secure than an AES-256 encrypted text file? The database formats they use seem needlessly complex for my own purposes.
4
votes
2answers
645 views

SIEM log pre-filtering question

As everyone knows each company wants to save as much money as possible. I have been tasked with pre-filtering logs on less important status/health messages before they get to the SIEM. Does anyone ...
10
votes
3answers
2k views

Is Postgres password-based authentication secure?

According to Postgres's documentation, Postgres's password authentication method uses MD5 hashing to secure the password: The password-based authentication methods are md5 and password. These ...
14
votes
3answers
22k views

Is it possible to use wildcard certificates on multiple devices?

I have a server that I want to use a wildcard cert on. It runs multiple services. I purchase a wildcard cert so that I can protect mail.something.dom, www.something.dom, im.something.dom, ...
1
vote
3answers
687 views

What is the risk of cross site scripting if I embed javascript into a website

What is the risk of cross site scripting, if I embed javascript into a website? Quite simply, I am using a 'site builder', and they don't allow rotating images, but they allow you to embed code... So ...
0
votes
1answer
101 views

Java is running even after it is disabled [closed]

To prevent adds and pop-up that seduce users to install or download viruses I have disabled Java. But I have noticed that even with Java disables Firefox is still running it. The pop-ups are coming ...
-3
votes
1answer
132 views

How deeply is Adobe inside your Windows environment? [closed]

Well basically as an experienced user I am really afraid on the way that Adobe deeply resides into all my Windows based workstations. Basically in every machine that has some Adobe solution when we ...
1
vote
1answer
711 views

How to detect if a site is using a JavaScript exploit?

Is there a way for me (non-expert in JavaScript) to detect JavaScript attacks from a website. I have done a lot of searching around and have not come up with a definitive answer. NoScript is a pain in ...
6
votes
3answers
1k views

Why does a spam sms contain a link to an email address?

A colleague of mine just received a (spam) sms with this message: Congratulations! Your mobile have won $1,000,000,00 Pounds with Draw# 294 64/2013. For more info & claims, contact our ...
1
vote
1answer
2k views

Extremely big HTTP chunk size

I am working in a project which we must count HTTP response size. I am getting chunk size like: crlf = g_strstr_len(chunkeddata , responceSize - responceHeaderSize, "\r\n") And than I had a ...
0
votes
1answer
157 views

Is there any reason to allow Python fetches of my Web server's pages?

I keep seeing "python-requests/1.1.0 CPython/2.7.4 Linux/3.8.0-19-generic" requests e.g. from Amazon's servers of my website. It's kind of creepy. Who would set up an Amazon server to scan websites? ...
3
votes
3answers
556 views

Lua loadstring, whitelisting against injection

I need to take input from the user of a simple bit of math, they want to solve. Rather than parse there input myself, I want to just use the lua, loadstring function to load their input and evaluate ...
1
vote
1answer
449 views

Is double hashing bad? [duplicate]

I hear rumors that double hashing is bad... like hash("sha512", hash("whirlpool", "string")) Is it bad and less secure? if so why? Thanks for any help!
8
votes
1answer
684 views

Comparison between Firefox password manager and chrome password manager

As a follow up to Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?, I would like to know how firefox's password manager compares, if you have a master password and ...
5
votes
2answers
1k views

Designing a cryptographic file-sharing protocol

As a learning project, I am trying to implement a secure way to share files with a friend over dropbox. (I am not looking for existing software, I am doing this in order to learn how to do this ...
0
votes
2answers
2k views

Safe to email images with personal information? or use encryption for images?

It's common knowledge not to email credit card numbers or other personal information. How about emailing photographs that contain personal information, such as a photo of a deposit? Regarding plain ...
4
votes
1answer
949 views

HIPAA: How am I required to secure PHI database access creds on my web server?

Assuming I have a database of PHI that my web application needs to access, how am I required to secure the credentials on the webserver that the web application uses to access this database? Is ...
1
vote
1answer
102 views

Bootstrapping dual SMIME certificates for signing and encryption?

To maintain the non-repudiation property of signing while still having escrow for the encryption key, it's recommended to have a separate certificates (and pub-priv keys) for signing (say CertSign) ...
0
votes
1answer
95 views

Is there any anti-spam solution focused on preventing Replies from hitting spam?

If I were to reign in the problem scope of this other question, is there any proposed or current RFC focused on preventing replies of previous messages from hitting SPAM quarantine? The previous ...
0
votes
3answers
904 views

CSRF possible if params are not passed through query string?

I was reading up on OWASP's page on CSRF and in their example they use a request where the sensitive parameters are stored in the query string: ...
2
votes
2answers
205 views

It it a good idea to whitelist inbound email using a Hash on the address? (Similar to BATV, but with DKIM)

Problem Statement I'm looking at ways to ensure that business partners, or emails from trusted senders, never get quarantined; ....in other words prevent "ham being seen as spam". Ideally this ...
0
votes
3answers
9k views

How to sniff traffic on my wireless network?

For educational purposes, I want to see what packages are sent over my home wifi with VPN on and off. What program should I use for this?
2
votes
2answers
5k views

What causes “High Risk Website Blocked” on Chrome?

I have a website with no ads and no external content. Everything on the page comes from the webserver in question. Some users on Google Chrome have reported that they see the following warning when ...
2
votes
2answers
296 views

Slowing down repeated password attacks

I've been reading suggestions to use time-consuming formulas for checking passwords from login attempts, so that repeated attacks will be slowed down. Wouldn't it suffice to just sleep a bit in the ...
2
votes
1answer
723 views

Why is Access-Control-Allow-Origin required for uncredentialed cross-domain requests? [duplicate]

I understand CSRF and why cross-domain AJAX requests with cookies or other credentials can't be permitted without an Access-Control-Allow-Credentials header explicitly permitting them - otherwise I'd ...
0
votes
1answer
73 views

hijacking fedora or ubuntu or windows upgrades on the fly

is It theoretically possible to hijack (I mean substitute on the fly) the fedora or ubuntu or windows packages upgrades if a cracker has owned the company's firewall/proxy ?
6
votes
3answers
2k views

Telemedicine on Google+ Hangouts or Skype. Is it encrypted?

Would one be able to have a telemedicine conversation with a patient with google+ hangouts the way one can over a telephone? In other words does the security satisfy the HIPAA regulations that say ...
2
votes
6answers
6k views

How can I know that the CA certificates in my computer have not been spoofed?

As far as I know, the browser contains the certificates of several CA. When I access http://gmail.com, the site says it is Gmail, it exposes a certificate signed by one of the CA I have in my ...

15 30 50 per page