5
votes
2answers
2k views

Firewall Configuration Audits

I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the ...
5
votes
7answers
4k views

Can I reclaim ex employee gmail account?

This is the best place in SE I can find to post this. We have an ex employee who created a gmail account for work purposes that looks like staff_name.company_name@gmail.com He left the company and ...
13
votes
4answers
2k views

Question of importance of FIPS in security implementations

I am by far, no security expert but I experience on the subject working in Java (JCA,JCE and JSSE). Anyway, recently there was a discussion about FIPS compliance. I looked into this and SUN's ...
17
votes
1answer
597 views

Secure Development costs

I'm wondering if anyone has seen any case-studies or references from companies who have implemented a secure development process (eg, SDL or similar) around the cost/effort involved. Obviously each ...
3
votes
0answers
199 views

Checking whether a password is derived from previous passwords [duplicate]

Possible Duplicate: How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext? On a system I used several years ...
3
votes
0answers
173 views

Files for download and their hash numbers

I'm far from being an expert in the IT security and I have this maybe naive question. Many downloadable files are deployed on websites together with the corresponding hash numbers to ensure their ...
11
votes
2answers
365 views

Progress in market approaches to software vulnerability disclosure?

In A Comparison of Market Approaches to Software Vulnerability Disclosure (2006), Rainer Böhme describes the profound role of economic "market failure" in the industry dynamics that hinder software ...
9
votes
4answers
1k views

New credit card security standards regarding PA-DSS Compliance

The new credit card standards including PA-DSS can be quite confusing for software companies. My question is this: If your software company designs a POS software system (like we do) which utilizes ...
9
votes
4answers
4k views

How to disable Firewire in OpenBSD/Linux to prevent attacks through Firewire?

Since Firewire lacks security, allowing a plugged-in device to access host memory, it's a good thing to fully disable it. If we're not using the BIOS to disable the Firewire port then how could we do ...
7
votes
1answer
7k views

How to ensure that VirtualBox guests can't break out of the vm to get access to the host machine? [duplicate]

Possible Duplicate: How secure are virtual machines really? False sense of security? E.g. on Ubuntu/Fedora - if I have VirtualBox installed and I'm running guests in it, then how can I make ...
4
votes
2answers
616 views

Attack vectors in POSTing variables from one php script to the next?

I have an application which is structured in the following way for its signup page. After this signup, the user is directly granted access into the system - there is no email verification (as ...
23
votes
9answers
3k views

How can I ensure that I connect to the right wireless Access Point?

Under Windows/Linux, client side. How can I ensure that I'm not connecting to a rogue AP?
15
votes
3answers
1k views

Which companies facilitate payment in return for vulnerability disclosure?

If requesting payment from an affected party directly for the disclosure of vulnerabilities is considered extortion, how can independent security researchers earn a living or side income from ...
7
votes
3answers
4k views

Changing policy to allow USB drives. Why should I try to stop it?

We are currently in the process of allowing USB memory sticks, but with a stricter policy. Some key points in the policy is: Any confidential data stored on the USB drive has to be encrypted Always ...
7
votes
2answers
2k views

IIS IP Address Restriction - can I rely on it online?

I've been told that I might have more luck posting here than on Stack Exchange, so here goes: I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no ...
5
votes
2answers
2k views

What tools exist to help me monitor OCSP certificate validation failures?

The discussion at Why isn't OCSP required by default in browsers? notes that many browsers by default simply ignore failure to check web site TLS certificate revocation status via the Online ...
8
votes
2answers
225 views

How can one easily determine which IT Security related regulations apply?

Joe Tech gets a job managing Acme Startup's IT services. Acme Startup handles information of X, Y, and Z data types, and offers services A, B, and C. Joe Tech is aware that some of these data types ...
8
votes
1answer
2k views

How should I protect in-app Android payments when using a separate server?

I am currently implementing Android in-app payments, and am wondering what attack vectors I should look out for. I have a simple application to view server-generated content. I want to allow the user ...
4
votes
1answer
833 views

OCSP: What is “hackedirl.files.wordpress.com”?

After I ticked that my browser (Firefox) must require OCSP: http://i.stack.imgur.com/UeDXh.png I got a window popped up (several times! And it still pops up.. ~randomly ~about a few 10 minutes): ...
14
votes
1answer
721 views

Are there any security problems with Google false start for TLS?

Google recently announced false start in Chrome browsers which increased TLS performance by 30% http://news.softpedia.com/news/Google-Chrome-s-SSL-False-Start-201253.shtml I know TLS has been poked ...
11
votes
4answers
1k views

Why isn't OCSP required by default in browsers?

According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers. Can someone please explain why this isn't ...
7
votes
2answers
606 views

Firefox Add-ons not using HTTPS? Security bug. (?)

If I add a rule in Privoxy: echo '{ +redirect{s@http://@https://@} } .mozilla.org' >> /etc/privoxy/user.action then I can't install Firefox Add-ons. Why? I though the Firefox Add-ons ...
10
votes
3answers
15k views

SSL handshake failure modes

In SSL if the handshake is not succesful, does it always end with a handshake alert? Or are there other ways to finish the SSL connection (acceptable by standard). I am asking this, because in an ...
5
votes
1answer
356 views

How valid is the concern over narrow pipe hash function designs?

Narrow pipe hash function designs have recently come under fire, particularly in reference to some SHA-3 candidates. Is this criticism valid? Can it be explained more simply than this paper does? I'm ...
43
votes
9answers
4k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
47
votes
7answers
3k views

Do security questions subvert passwords?

Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
6
votes
3answers
814 views

wlan security - why is it not possible to protect against deauthentication flooding

Wireless security (Wikipedia) describes security issues due to the fact that wi-fi deauthentication packets are unencrypted: Weak PSK passphrases can be broken using off-line dictionary attacks by ...
-1
votes
2answers
245 views

How to store my contacts encrypted?

I use KeePass for storing my passwords. What should I use if I want to store my several hundred contacts (name, phone number, email, etc) encrypted?
15
votes
4answers
5k views

How to implement non-password authentication in a web site

In an answer to this question about pw reset, D.W. says: Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
17
votes
3answers
2k views

Status of Trusted Computing and Remote Attestation deployment

Hardware support for various client-side controls based on Trusted Computing (Wikipedia) has been evolving over the years, e.g. TCPM, TPM, TXT (LaGrande, DRTM). I've heard of one practical ...
9
votes
4answers
3k views

How to detect Meterpreter and similar malware?

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM? Most common anti-rootkit software like rkhunter and chkrootkit don't find it.
69
votes
8answers
166k views

How to determine what type of encoding/encryption has been used?

Is there a way to find what type of encryption/encoding is being used? For example, I am testing a web application which stores the password in the database in an encrypted format ...
5
votes
2answers
556 views

OSes that are mathematically proven to be 100% (or 99%) secure?

Are there any? What are their names? Are they publicly available/downloadable/installable?
4
votes
2answers
314 views

Keystrokes to text converter method? (from an audio file, from previously recorded sounds of keystrokes)

I have an e.g.: WAV file that contains the sounds of a man typing on his keyboard (English or any language) How can I convert this WAV file to a TXT file? I mean are there any scripts/programs that ...
2
votes
3answers
146 views

Could an Encrypted VG/Image compromised?

I mean if I encrypt my ""full system"" so that everything (besides the /boot) is in an encrypted VolumeGroup (Linux). So I store my /boot on a flash drive, thats always next to me. Q: can the ...
22
votes
4answers
3k views

Honeypot on home network to help me learn

I'm a pretty decent (IMO) web app penetration tester, but I'm eager to expand my knowledge of other areas of security. Given that I've just taken on something of an enhanced sysadmin role at my work, ...
15
votes
4answers
316 views

Are malicious relying parties able to abuse OpenID logins?

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me? Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
17
votes
8answers
3k views

How do I pick a VPN provider?

There's a lot of VPN providers out there. Some are free, some are for a fee, some report to the government, some inject ads int your HTTP, some are in other countries, you might not have any real ...
4
votes
3answers
152 views

OS Kernel Hashing

Has anyone had experience with or is aware of any products that hash the OS kernel? This would be used, ideally, for watching for system compromises, auditing, change management, etc. I am looking ...
5
votes
2answers
299 views

homomorphic encryption and DARPA

Why the government (and the DARPA in particular)is spending all these millions to improve the homomorphic encryption?which useful usage could it get?
91
votes
4answers
21k views

Recommended # of iterations when using PKBDF2-SHA256?

I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
8
votes
3answers
3k views

Risk of configuring MySQL for remote access with a dynamic IP address?

I'm looking to make a MySQL database on a VPS, accessible to my home PC through cPanel. cPanel wants the domain name or IP address of the remote machine. However, with standard DSL, I have a dynamic ...
5
votes
1answer
1k views

Does Fedora 15 still use suid bits?

I heard that Fedora 15 will not use suid bits. Is that true? Is the suid bit a security design bug?
14
votes
5answers
1k views

Methods of mitigating threats from keyloggers

I am concerned about keyloggers being installed on my system and transmitting sensitive data out of our network. Is there a common method that such malware uses to send its collection back to the ...
11
votes
6answers
760 views

What are effective ways to prevent targeted phishing?

Phishing is a very serious problem that we face. Popular banks are often the biggest targets. What methods can a bank website use to protect its self from phishing attacks? What security systems ...
10
votes
5answers
2k views

SQL Injection in a Non-Web Application

Does someone know of a good example of a SQL Injection vulnerability that isn't in a web application? What is the user input for this attack? I am looking for a real vulnerability, not speculation. ...
13
votes
4answers
632 views

How to protect off-the-shelf web applications?

As an exercise, please consider the following: If you are faced with having to deploy off-the-shelf web applications that you are unsure about the vendors security coding practices, which techniques ...
92
votes
3answers
16k views

Is a rand from /dev/urandom secure for a login key?

Lets say I want to create a cookie for a user. Would simply generating a 1024 bit string by using /dev/urandom, and checking if it already exists (looping until I get a unique one) suffice? Or should ...
25
votes
9answers
2k views

Why do some people really hate security via client-side?

For instance, lets look at a common login system for a website HTTPS connection is made User submits credentials via POST Server-side code hashes the password and looks if it matches the user name ...
5
votes
6answers
1k views

How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?

To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use include to include image files into PHP code. Sometimes though, the avoidance of ...

15 30 50 per page