1
vote
1answer
476 views

How do I find out if I'm connecting to a spoofed server after getting “The authenticity of host [hostname] can't be estabilished”?

I've been SSHing into my VPS for months with no problems and this morning it returned this familiar message: The authenticity of host '[hostname]' can't be established. ECDSA key fingerprint is 05:39:...
2
votes
1answer
485 views

Supplying a password to PBKDF2 in raw binary vs. base64?

Background: I'm working with Node's crypto library. I'm using PBKDF2 to convert a variable-length binary "passphrase" into constant-length keys for an AES cipher later on. The underlying source of ...
2
votes
2answers
559 views

Is it possible to sign a certificate such that the issuer is different than in the CA's certificate?

Lets say I have a self-signed root certificate called root-ca.pem created by openssl. It allows me to sign certificates. Is it possible sign new.csr certificate with root-ca.pem such that the issuer ...
1
vote
3answers
423 views

Is data exposed in a CSRF attack?

I am wondering wether a CSRF attack, will disclose the information being sent back in a GET request. I need to send a social security number out, to the client a few times, and it is NOT anyone else ...
2
votes
1answer
962 views

Windows privileges to escalate? [closed]

What are the windows privileges that deserve to pay attention to prevent a user (non-admin) to escalate his privileges to the local admin group ? I know SeDebugPrivilege, but what else ? Thanks. ...
3
votes
3answers
4k views

How to send GET/POST requests without header and agent information

I want to test our DOS prevention system against http requests that are not have header and agent information. Is there any tool I can do that. I tried siege with this command siege -c 3 -b -H "Host:...
1
vote
2answers
374 views

Difference between key generation and key agreement

Please excuse my ignorance as I am new to information security. Could someone please explain in simple terms what the difference is between key generation and key agreement. In which situation would ...
1
vote
3answers
4k views

Why P2P need portforwarding when behind NAT? [closed]

Correct me if I'm wrong, but for a node to participate in peer-to-peer, if it's behind a NAT, it most port forward to be able to connect. Why is the port forwarding necessary? I know there's ...
5
votes
5answers
903 views

Penetration testing reported ZERO vulnerabilities. Does this mean my web app is secure?

I've spent many hours on whitebox testing to make sure my code was safe. From a theoretical standpoint, the code SHOULD be safe. I then used several widely known testing tools (including one that ...
-2
votes
2answers
341 views

I want to implement UART module in Xilinx with Encryption functionality so which algorithm i shuld choose RSA or AES [closed]

i designed code for uart module now i want to include Encryption code before sending the data which algorithm is better for me RSA or AES
2
votes
1answer
604 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
3
votes
2answers
642 views

Skype Audio / Video Session over VPN?

Basically I'm wondering if a Skype video session along with audio could be logged (or recorded) over a virtual private network? I know whoever hosts the VPN server can log which websites you visit (or ...
19
votes
3answers
1k views

Someone faxed me a bunch of black paper

I work for this telemarketing company, and when I went to work this morning all my fax machines' outputs were jammed with black paper with the faded words "fuck you" transcribed on each of them. I ...
1
vote
2answers
4k views

Null byte injection on php?

I look for answer, is it possible to perform null byte injection on PHP code, and how vulnerable code should look like. Give me some example, as I noticed that: <?php echo $_GET['get']; will ...
10
votes
7answers
8k views

Does a chain of proxies (e.g. one connecting to another and another and so on) make tracing the original IP harder/impossible?

I see nobody here has asked this question. What if one, instead of just using a single proxy, connected a proxy-to-proxy in a very long chain and downloaded something (illegal) using secure packets (...
5
votes
1answer
6k views

Hiding process from Task Manager [closed]

What technique is used to hide a process from Task Manager? I'm currently researching ways I can do this in C++. Is this process called hooking? http://www.codeproject.com/Articles/3978/Trap-...
1
vote
3answers
7k views

For security reasons, can I block ping response on my router without disabling my network?

I seem to have a serious problem of being attacked and after looking up the attack source, 99% come from China, then Korea, Hong Kong etc. Here is a fraction of the report from my Router, which is a ...
1
vote
3answers
214 views

Privacy-preserving authentication with unique user identification for Web applications

Is it feasible to authenticate users such that they should be prevented from creating multiple accounts, and that their privacy is not impaired (i.e., no personal information should be revealed to the ...
8
votes
5answers
5k views

If I use a good Master Password in Firefox, is security improved when I Remember Passwords instead of re-type? [duplicate]

In the old days I would emphasize that people should not select the remember passwords option because (besides the fact you tend to forget what the browser remembers) a bad guy could could display the ...
4
votes
2answers
1k views

How a provider can tap an internet line even for SSL encrypted connection [duplicate]

I heard once from someone I trust, that the French governement is about to buy and certify a software to put on tap an internet line even for HTTPS connection. I don't really care about the legal ...
3
votes
4answers
33k views

How to check if computer is controlled remotely

My laptop has windows 7 installed. One Saturday night I couldn't fall asleep and was just lying in bed. Then suddenly at around 2 in the morning I heard the fan of the laptop start up and lights on ...
4
votes
1answer
1k views

Sharing login session from one website to another?

Given two companies managing two separate websites, the client wants the user to be able to log in to one website, and then click a link to navigate to a certain part of the second website. The client ...
1
vote
2answers
1k views

Security of several files all using same password/key (7zip, AES256)

I'm working on a simple secure mirror for potentially untrusted services like Dropbox, Owncloud and so on. (Current code may be seen here: http://www.codeduce.com/extra/secure_mercurial) Currently I'...
0
votes
1answer
237 views

Can a sql query with both user input and parameter be prone to sql injection?

I've stumbled over some code in an application where (certain) users are allowed to input where conditions. In addition to this there is a part of the where condition that is set as a parameterized ...
0
votes
1answer
936 views

Can signature-based Antivirus detect encrypted malware? [duplicate]

How effective signature-based Antivirus is, in detecting encrypted malware?
1
vote
2answers
126 views

How do phone location services get their information?

Location services - such as https://www.lociloci.com - allow you to track any phone as long as the person replies to a text to allow the tracking to be performed. How do these services receive the ...
0
votes
1answer
395 views

Cellular Mobile Network Vulnerabilities - Is VPN the solution?

Do current mobile cellular networks like 3G offer enough security? The article from Info-Security states that 3G encryption cracked in less than two hours. Could a eavesdropper or man-in-the-...
-3
votes
1answer
67 views

Algorithms to store and send data

I would like to store data, and send it by mail. What is the best way to encrypt it, and being able to decrypt it? My guess would be RSA, but is there a better way? (Considering that the other person ...
-1
votes
2answers
208 views

Hotmail security

Recently I've been receiving in my SPAM folder, SPAM mails sent "by me". With "By me" I mean, that I am not sure if those are really sent from me. It has been happening since December, at around one ...
4
votes
1answer
3k views

OpenPGP keyserver URLs: what are typical or meaningful use-cases?

i'm getting re-acquainted with OpenPGP and noticed that GnuPG allows me to store a "preferred keyserver" URL in my keys: reuben@localhost:~$ gpg2 --edit-key 'Reuben NP Garrett <my-special-email@...
6
votes
5answers
3k views

What are good resources to do hands-on practice on network penetration testing?

Can anyone provide a good list of resources to learn network penetration testing? I am specifically looking for those having hands on exercises (kind of virtual labs/ISOs) which are free. I know web-...
1
vote
1answer
2k views

Help to understand secure connections and encryption using both private/public key in RSA?

I just started teaching myself cryptography, I am reading this http://www.garykessler.net/library/crypto.html to understand the basics. I am confused by Sections 3.4 and 5.3. Section 3.4 details how ...
3
votes
2answers
1k views

How can I ensure that an android app was installed on a physical device and not an emulator?

I want to avoid people installing the app on virtual devices. Is there any way to tell this? What is best you could do? Ideally what i want to prevent as a whole is one person or entity creating ...
1
vote
1answer
53 views

What security mechanisms enable a user to change their password under a Kerberos environment?

During client authentication, neither the secret key nor the password is sent to the KDC. If a user changes their password on the client, how is the password updated in the password database in the ...
1
vote
0answers
65 views

Needed: Reference data on the rate of adoption of secure email protocols [closed]

I am working on a security presentation in which I need to show that the incidence of unencrypted email protocols (e.g. POP, IMAP without STARTTLS) over the past 10 years has decreased and the amount ...
3
votes
2answers
1k views

XXE and its impact

I am trying to understand the concept behind XXE (XML External Entity injection). I went through OWASP Guidelines on XXE And since I am new to XML and DTD, I went through the W3Cschools tutorials as ...
0
votes
1answer
137 views

Intrusion Detection and Prevention technologies [closed]

I'm supposed to do a research paper on a recent technology and I thought of doing it on a technology in information security. I found interest on Intrusion detection and prevention systems (IDPS) but ...
6
votes
2answers
6k views

What approach would you choose to defend againt DDoS attacks from Nginx level?

I use Nginx compiled with the Naxsi module to protect against some vulnerabilities (SQL injection and cross-site scripting). Now I need to apply a layer of poor man's DDoS protection at this level. I ...
3
votes
2answers
3k views

IP cameras or webcams and wifi/network security

If I have a: router with stateful packet inspection turned on, plus WPA2 security on the wifi network an IP camera or webcam connected to this Wifi network Is there any way to ensure that: ...
8
votes
4answers
339 views

Best practice for informing a website they've been compromised?

I've received a spam email that claims to be invoicing me for some service in New Jersey, USA with whom I've not had any dealings. The email includes a link to a zip file that is hosted on a greek ...
-1
votes
1answer
8k views

Is my information secure when using Private Tunnel? [duplicate]

I am using Private Tunnel to do some tasks involving sensitive data like logging in to PayPal and online banking. Is my data safe or can it be retrieved by other users of the Private Tunnel service?
1
vote
6answers
2k views

DDOS slow-http attack prevention

I am often getting DDOS attack from multiple IPs with simple HEAD requests. There are around 30 unique IPs creating such attacks. 201.230.167.68 - [05/Jan/2014:00:19:19 +0530] "HEAD / HTTP/1.1" 301 5....
1
vote
1answer
176 views

Can I trust the details given in Resource Monitor?

I'm looking at Resource Monitor in Windows 7 and wondered whether a process could be hiding in plain sight by mimicking another process. For example I've renamed an executable file as chrome.exe and ...
0
votes
1answer
152 views

Using multiple hash-functions along the line [duplicate]

I was wondering what the effect on strength/security is If I would use an aggregate of multiple hash-functions. For instance, I don't want to sent passwords in plain text (although it's over an SSL-...
1
vote
3answers
479 views

Tell and sell a (web app) vulnerability legally

If someone discover an unknown vulnerability for a given online service or website, is there a decent way to sell it directly to the concerned entity.
1
vote
4answers
14k views

Is there any solution for block the HTTPS traffic using URL filtering?

The URL filtering can block the HTTP traffic but not the HTTPS traffic in Internet Explorer. For example, the website http://www.facebook.com is blocked by the URL filtering while the https://www....
-6
votes
1answer
2k views

Can kali linux be hacked [duplicate]

I'm just curious if new version of backtrack Kali be hacked like back-doored or crack user password like the windows or mac
1
vote
2answers
1k views

Is exploit researching different from penetration testing

I'm confused by some terminology - reverse engineering seems to me to be pretty similar to exploit researching. I mean if you can reverse one program probably you will be able to find a vulnerability, ...
2
votes
3answers
1k views

iptables: plaintext password protection

I'd like to find a way to block or restrict my access to the web-pages where my password is sent as a plaintext on the internet. Let's assume if I have the same password for all web-pages, is it ...
3
votes
3answers
196 views

opening random extensions with notepad

I get files with random extensions sometimes in order to bypass corporate firewalls. Usually I would just ask the other party what it is that I just received. Other times I get curious and open the ...

15 30 50 per page