2
votes
1answer
224 views

Does Internet Explorer handle Extended Validation properly

I'm reading about Extended Validation (EV) certificates and have a few questions. From what I understand, EV allows domain owners to pay extra for a especially trusted certificate (that the browser ...
4
votes
1answer
540 views

Safe way of accepting customer-supplied private keys?

We run a software as a service application that is used by medium to large companies. One part of our application is a messaging service that integrates into the customers own infrastructure. At the ...
0
votes
2answers
219 views

Can Tor browser bundle be attacked like this?

When using the Tor browser bundle, you load the check.torproject.org on start. It tells you when there is a security update to downloads, and let's you click a link to get it. The way for users to ...
4
votes
1answer
614 views

ISP and ssh tunneling

I have a question about ssh tunneling. Is it possible for the ISP to realize the destination server which I want to connect it via ssh tunneling? I mean the destination website which I want to visit ...
0
votes
2answers
357 views

How secure are hashed passwords that are salted too?

SAP Netweaver has its passwords hashed and also salted. But I read that a tool such as John the Ripper can bruteforce them. So how does security varies when passwords are hashed, in particular in the ...
2
votes
2answers
259 views

Security concerns with a “fiddle” site?

I recently came across a cool site for testing .NET code (http://dotnetfiddle.net/). In the FAQs they mention that they have two restrictions for security purposes: No access to File System IO No ...
1
vote
3answers
282 views

S/MIME doesn't protect against a stolen password, right?

We're setting up S/MIME so that we can send encrypted emails. However, I have a bit of a stupid (and maybe obvious) question... If someone steals a password for either the sender or the receiver, ...
-2
votes
2answers
3k views

Port list according to vulnerability [closed]

I'm looking for a list of ports sorted according to the number of vulnerability you can find for that specific port (considering of course, the service installed in the default port). Example: ...
1
vote
1answer
1k views

Is there a foolproof method to remove spyware from Android smartphone?

I am owning an Android smartphone. I learnt that factory reset may not remove spyware as it might have corrupted the image being installed by factory reset. Is there a foolproof method which ensures ...
1
vote
1answer
85 views

Storing opened mail attachments unencrypted in /tmp is a normal thing?

So there is an E-mail client. I can encrypt its database with a few clicks in its menu. But it's storing the opened attachments unencrypted in /tmp/foo/bla.xls. The bla.xls has 644 UNIX permission (...
2
votes
3answers
189 views

Website Authenticity/Verification without SSL

Are there any other ways of verifying the web server you're visiting is actually the correct one? For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing ...
0
votes
1answer
106 views

how does IE or chrome verifies certificate? [duplicate]

If the HTTPS webserver uses self signed certificate, the web browser warns the user as follow. http://www.sslshopper.com/assets/images/iis7/iis7-self-signed-certificate-8-certificate-not-trusted.png ...
0
votes
1answer
104 views

Verifying one specific attack vector of Cross Site Scripting

Burp suggests that there is a reflection.. It changes a value of a cookie named as x as x=<script src=abc.js> and in response this value gets injected to a javascript function.. <script type=...
22
votes
2answers
3k views

If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?

Looking at all the people who question the viability of DNSSEC, it's no wonder that the adoption rates are so poor. However, what about DNSCurve? It supposedly fixes all the DNS security and privacy ...
5
votes
2answers
329 views

Sensitive data and phone calls

How safe is it to give sensitive information to someone over a phone line? Does it matter if the data was verbally spoken or if it was typed in? Example: Opening an account with an internet provider ...
11
votes
2answers
210 views

Does any OpenID identity provider allow site-unique arbitrary email addresses?

Since OpenID officially furnishes email address to sites (with the user's permission) as a convenience rather than an attestation, is there any OpenID identity provider who'll allow you to ...
-2
votes
1answer
516 views

Removing Persistent MBR Malware [closed]

I do have a problem, how do I remove a persistent MBR malware? probably the malware hides itself in HDD sector that an OS couldn't even access. Already tried to format it and remove clean all ...
1
vote
0answers
27 views

Get Service_key in the course of kerberos authentication [closed]

Built environment 1) Exchange server: The operator system of Exchange server is Windows Server2008R2, We configured it as Active Directory (primary domain controller) used for client authentication (...
3
votes
1answer
1k views

Why does MySQLi using question marks (?) instead of the sprintf formatting?

As the title states, why does MySQLi use question marks instead of sprintf() formatting? For example, why is it $stmt = $mysqli->prepare("SELECT * FROM table WHERE column1 = ?"); $stmt->...
1
vote
3answers
227 views

Where to publish security research?

I'm considering doing some research in to an attack vector which I think doesn't get enough attention. It's not an earth-shaking vector but I think I can demonstrate an attack where none have been in ...
5
votes
3answers
2k views

How to Man in the Middle Internal AD Traffic

A coworker asked me why I thought encrypting internal AD Bind communication was important. I said because I follow a standard security practice, but couldn't actually articulate how an attacker would ...
3
votes
4answers
1k views

Storing credit cards to use for purchases on customer's behalf

My client physically makes online purchases (through various websites) on his customer's behalf using their credit cards. His clients have basically said "here's my credit card, buy what you need to." ...
4
votes
2answers
1k views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
0
votes
2answers
912 views

How can I stop this attack on my router?

After enabling system log on my Asus DSL-N10E router, I've got this message: DoS: Tcp SYN With Data Attack source=217.74.166.73 What does it mean? Is it a real danger on my network security? And ...
0
votes
3answers
2k views

Prevention against Cryptolocker virus by requesting password for all installing apps in Windows 7

Is it possible to protect Windows like Linux? I mean, I have Ubuntu installed on my laptop and when some program wants to install something etc. the pop up shows up and I need to type the password. ...
2
votes
1answer
386 views

Fundamental differences between digital ID and SSL security certificates

I was reading http://www.symantec.com/verisign/digital-id and http://technet.microsoft.com/en-us/library/dd351044(v=exchg.150).aspx. The articles are treating ssl cert and 'digital id' as if they are ...
1
vote
3answers
313 views

hardware firewall placement

In a home office environment with cable internet, can a hardware firewall be placed in front of/upstream from a cable modem to also protect the modem from tampering by the isp or a hacker?
0
votes
1answer
84 views

Network and Security Associates v.s. CISCO Security Associates [closed]

My college is expanding the Information Technology department to include Networking and Security as well as the CISCO Security. In my research online I have found different information for each ...
1
vote
1answer
169 views

Using secp256k1 and ECDSA with IKE

I just tried using an IKE daemon and EC certificates. I used the secp256k1 curve for key generation. The daemon claims signature scheme ECDSA-256 not supported by private key Now I am wondering ...
0
votes
1answer
504 views

Can query string command line exploits in older CGI implementations of PHP be protected against without updating PHP versions?

We recently received this from a security audit: PHP is a general purpose scripting language that can be embedded into HTML. A vulnerability exists in PHP versions prior to 5.3.12 and 5.4.2 due to ...
1
vote
0answers
2k views

When EAPOL packets are exchanged?

I have put wireshark to capture interface in monitor mode. I have also enable decryption and set keys in Wireshark preferences, but protocol for all packets is 802.11 which I think it means that ...
0
votes
1answer
1k views

Is it possible that the same VISA debit card numbers could be issued to different people by different banks? [closed]

I'm wondering if is it possible that the same VISA debit card numbers could ever be issued to different people by different banks or companies?
24
votes
4answers
7k views

How secure is NOPASSWD in passwordless sudo mode?

On all our boxes we have ssh access via keys. All keys are password protected. At this moment the sudo mode is not passwordless. Because the number of VMs are growing in our setup, we investigate the ...
2
votes
2answers
400 views

Choosing the right X.509 certificate infrastructure for securing LAN communications between a PC and a device

Edit: seems like I was quite hasty when typing in my question at first, so here is an updated version of it. I am developing an application that runs on PCs which are on the same LAN as other devices....
1
vote
2answers
1k views

When paying online with a credit card, what is “3D authentication” and is it reliable?

I tried making a purchase from http://www.laptop-batteries.ca/ but on the very last step the page reloaded with an error. A representative contacted me asking why I didn't complete the order and I ...
2
votes
1answer
1k views

Using Selenium tool for xss scripts

Ok, so i need to know can Selenium webdriver tool be used for testing xss vulnerabilities and exploits. If its possible, then pleasee provide me with some example or tutorial. Apologizes, if am wrong ...
0
votes
4answers
2k views

How can I test that I have correctly disabled unnecessary HTTP methods?

I am making a web-based application and I disabled some of the HTTP methods which are not necessary for the website (specifically, OPTIONS, HEAD and TRACE). I put this in the httpd.conf of my xampp ...
0
votes
2answers
4k views

How to prevent other hosts on the same LAN from seeing my IP and host name?

I want to hide my computer IP dan hostname when I am online on the same LAN on which other computers running netcut and other network tools. I have installed netcut defender but it seems not to hide ...
4
votes
2answers
1k views

What does Django's ALLOWED_HOSTS variable actually do?

I'm supposed to set ALLOWED_HOSTS in my Django project's configuration to the hostnames that belong to me to ... prevent an attacker from poisoning caches and password reset emails with links to ...
1
vote
1answer
154 views

What types of hacking attacks happen alongside a DOS or DDOS attack? [closed]

I'm trying to find some good material on this topic for a paper I'm trying to write for class. Any and all help is very much appreciated.
6
votes
2answers
886 views

What SSD maker has implemented Secure Erase to spec?

I have a Kingston hyperx drive circa 2012. I kicked off a secure erase on it. I then remounted the drive and was horrified (well, not really more like bemused) to see my whole parts of my old file ...
0
votes
2answers
510 views

OpenSSL create both keys at once

Is there any way to create private and public keys with one command? The classic way is two commands $openssl genrsa -out privkey.pem 2048 and after that $openssl rsa -in privkey.pem –pubout –out ...
3
votes
0answers
161 views

Main difference between Yahalom and Needham-Schroeder key exchange protocols

I am just wondering what is the main difference between the Yahalom and Needham-Schroeder key exchange protocols? Which protocol uses less computational power?
0
votes
1answer
138 views

Strange Virus Infecting My Server

I am currently working on a Web App on my dedicated server (LAMP) and it seems like it might be infected with some strange malware/virus of some kind. When I access some domains on that server (every ...
0
votes
1answer
115 views

How to investigate this anomaly?

According to the IT managers, this problem is neither at the server nor at the client but is suspected to be somewhere inbetween e.g. some DNS server that has been infected. Do you recognize this ...
1
vote
2answers
231 views

How to properly configure OSSEC for Web Application Security ?

I would like to implement OSSEC as HIDS on my server, but by default OSSIC monitors a number of folders. I am going to deploy a web application on my server. So what should be my default OSSEC ...
3
votes
3answers
2k views

Why block network ports?

There was another good question here on why you should block outgoing traffic: Why block outgoing network traffic with a firewall? But I was hoping to get an answer on why it is a good idea to block ...
-4
votes
1answer
200 views

Is there any virus that deletes Personal Folder? [closed]

I noticed that some special folders of my ex-HDD have been deleted. 'Personal' is one of them. Is there any virus that does that?
1
vote
1answer
154 views

The need for created timestamp in tokens

In different token, for example SAML, I have encountered I have seen that it includes the timestamp for when it was created. I understand the reason for a expiration timestamp, but before the token is ...
0
votes
3answers
2k views

Is it possible to install spyware in password protected android phone?

I own samsung galaxy y, an android. I suspect my roommate has installed spyware in my phone. Is it possible to install spyware in password protected android phone ?

15 30 50 per page