2
votes
2answers
341 views

Will using SSL to secure Wordpress admin area only still actually be secure?

The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas. There ...
1
vote
1answer
1k views

What is the “about:blank” context for browser security and privacy?

This blog is describing a way to hide the referer header in various situations. Specifically he is referring to things that run in the about:blank context. What is the about:blank context? How does ...
15
votes
5answers
12k views

SSH password vs. key authentication

I've usually been told that public key authentication is strongly preferred over password authentication for SSH. However our previous admin was against public keys and only issued passwords and took ...
41
votes
4answers
45k views

What's an easy way to perform a man-in-the-middle attack on SSL?

I'd like to perform a man-in-the-middle attack on SSL connections between clients and a server. Assuming the following: I've got a certificate that the client will accept, via poor cert validation ...
3
votes
2answers
2k views

PCI DSS 11.2.1/11.2.3 - Internal scans scope

I need help about SAQ #C - Are quarterly internal vulnerability scans performed? What is target (scope) for those internal scans? Our configuration: Router with modem (WAN1/LAN1), DMZ, some office ...
1
vote
1answer
982 views

Pre Installed OpenVAS , light way Linux [closed]

Is there any Pre installed light way OpenVAS Linux distributions Or any light way Linux witch Openvas Tested on it and work properly on that Linux distribution ? I have used Back Track (UBUNTU ...
1
vote
1answer
977 views

Browser cache, cookies, active logins and other data

This question is regarding common browsers, even though I may refer to Firefox settings. Not IE though, I wouldn't expect that to be in any way secure. I'm seeking to know how secure it is to let the ...
1
vote
2answers
2k views

Questions to hybrid encryption. RSA with AES

I want to use a hybrid encryption in my application, so after reading a lot of lines I ended with this implemantation, please critizie it ;) (I want to stick to .Net) byte[] aesKey = ...
2
votes
1answer
752 views

Detecting Virtualization from web browser

is that possible active adversaries who injecting malicious iframes (root kits), without Flash, Java or any other plugin detect that we using virtualization by javascript or timing differentials and ...
3
votes
3answers
2k views

Using /usr/bin/passwd as login shell

I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host. I have set up a separate user account (say 'tunnel') ...
0
votes
1answer
99 views

What is closed system esignature?

I need to find a solution for one of my clients who is asking me to implement a esignature solution. I was thinking of suggesting some solutions like DocuSign or EchoSign. But recently my client ...
7
votes
1answer
2k views

zero knowledge proof - where do we use it?

zero knowledge proof, Where do we use it online? I thought we mostly use the RSA algorithm.
0
votes
1answer
397 views

some questions about DOM based XSS [closed]

Is it possible to do a DOM based xss attack with window.location.protocol? How can we use dom based xss with document.title? How can we bypass the escape javascript function if it is used? thank ...
1
vote
2answers
208 views

How do browsers know which cookie to get?

I tried writing a script that would display the contents of a cookie set by another website but it didn't work. <?php echo 'Website cookie is '.$_COOKIE['locale']; ?> But I get an undefined ...
0
votes
1answer
907 views

Sanitizing JavaScript to prevent XSS

I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
10
votes
1answer
2k views

How does LSA authentication on Windows work?

I'm trying to understand the security protocols on Windows from a high level as part of legal research into cybercrime, and I'm having difficulty figuring out where to focus my research. I've already ...
0
votes
1answer
202 views

How does DOCTYPE selection affect security of my AJAX app?

I'm considering using modern techniques to protect my Javascript code and am studying how the DOCTYPE element selection may impact that. Specifically, the linked question used IFrames which are not ...
2
votes
1answer
2k views

Changing locks on server cabinet [closed]

I work in higher education, and we have a server room with various server cabinets, mostly APC and Belkin. The room is secured via card swipe access, however each server rack has the same lock, which ...
4
votes
1answer
190 views

Suggestions for secure fax SaaS

Does anyone have experience with any fax cloud services, which they can recommend from a security standpoint?
15
votes
7answers
2k views

Would it be possible to overload a large part of the internet, and if so then how?

Last week a news article went viral about a Dutch web hosting/data center company that was allegedly using a DNS amplification attack to DDoS an anti-spam company, because they blacklisting the ...
16
votes
4answers
2k views

What is the easiest way to search massive, leaked databases for persons and personal information?

This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be! A while ago a very MASSIVE database was leaked that contained ...
5
votes
4answers
581 views

What is zero day?

More specifically, if a website is using an application already known to have a flaw as part of the larger service it offers (so, say it's using a version of Apache known to have a flaw, and the ...
2
votes
2answers
2k views

Does “loose source and record route” drop the source address?

Is the source IPv4 address lost when a person uses "loose source and record route" and the destination address is put before the end of the list of addresses through which routing should occur? It ...
4
votes
1answer
2k views

Does Web Apps and Databases running on AWS EC2 need a IDS/IPS?

I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not. I will present my findings so far here, but it will be good if you guys can confirm ...
1
vote
1answer
120 views

Java applet authenticity problem

I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
2
votes
5answers
4k views

Website vulnerability scanner in Java && Open Source [closed]

I am working on a Web platform that must-need-should have a good level of security. Therefore, I am interested in a good quality tool to test my Web platform QA on security. My main programming ...
17
votes
2answers
759 views

Why on earth would anyone use the 'top secret' option of IPv4?

So, I was reading RFC 791, and got to the bit about options (here). Everything seemed to be decent and sensible, until I got to the 'levels of security' part. Now, I can understand how, internally, ...
1
vote
1answer
417 views

How to insert custom packets into SSL handshake?

I am trying to communicate with an SSL server whose protocol is non-standard. I want to insert custom packets into the handshake. I am using several SSL tools, so changing source code on every tool ...
2
votes
3answers
2k views

Task Manager and Keyloggers

I know that some of the best keyloggers can't be viewed from the Task Manager. Where can one see if such keyloggers are running on the system? Will they be in the Windows Services or are they hidden ...
2
votes
1answer
176 views

Secure Development Environment for University dealing with private data

We are a development team within a state public university. Much of our development deals with working with private student and employee data. Some applications push data from internal databases out ...
2
votes
1answer
2k views

Can exploit vulnerability if program started with gdb, but segfaults if started without gdb

i'm currently trying to exploit a simple program called basic_vuln.c #include <stdio.h> int main(int argc, char** argv) { char buf[64]; strcpy(buf, argv[1]); } I'm using xubuntu ...
-1
votes
2answers
567 views

Keyloggers and Email Accounts [duplicate]

This morning, I was experimenting with some keyloggers and noticed that they have a feature to send e-mails to the attacker. How can these e-mails be intercepted? Let us say that I have a packet ...
0
votes
1answer
2k views

What are the ports used by Online Email Accounts such as Yahoo Mail, Gmail, etc.?

Let us say that I send an email using Yahoo Mail or GMail. Can this email be intercepted using a packet sniffer? On which port does the email travel? HTTP, SMTP, POP3?
-2
votes
1answer
225 views

What mode of operation is secure for block ciphers?

as RC4 is not secure and AES-CBC is same thing the only solution is using EAX mode for AES. but why mozilla NSS don't support EAX mod ? is there any secure EAX implementation ? and why wikipedia says ...
-1
votes
1answer
10k views

Has the WPS brute-force cracking issue been fixed?

I have heard a rumor that the WPS brute force attack doesn't work on newer devices, and that you now have to try all 10^7 PINs to find the correct one. Is that true?
3
votes
2answers
690 views

Is it safe to suspend my computer if I'm using encrypted hard drive?

I'm using disk encryption to protect my data and sensitive information - but only one partition. I used to suspend my computer instead of shutting it down because of very fast resume and very low ...
1
vote
2answers
390 views

How do private photos get stolen?

I'm not referring to any of the below: A spiteful partner sharing private photos of the other after editing themselves out. Someone stealing photos from a professional photographer/artist without ...
10
votes
5answers
5k views

Email instead of username

I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
2
votes
1answer
669 views

Keyboards with built in SmartCard reader. PIN/Password to unlock not via Computer

I am looking for keyboards with a built in SmartCard reader, where the Smartcard can be unlocked directly without going via the computer. The keyboards I found so far connect the SmartCard reader via ...
1
vote
1answer
1k views

How does paypal store credit card numbers?

How does Paypal store credit card numbers? Have they published any information this? As for now I would say that they encrypt the card numbers and store the key in an HSM, but this is just a ...
1
vote
1answer
969 views

How to open a .txt.enc file?

I have a .txt.enc file. It is an output of openssl enc. I need to open it. When I try to open it in Emacs, the first some characters(also known characters) are : 'Salted__C' . how can I understand ...
2
votes
3answers
592 views

MySQL database access prevention

I am doing a PHP website for a client who deals with third party financial information, and he is concerned about the developmers (me) having access to all the information, which is obviously a valid ...
8
votes
1answer
13k views

DNS Spoofing vs DNS Cache Poisoning

What is the difference between DNS Spoofing and DNS Cache Poisoning ??? It seems like there are little differences between two attacks, with an exception that DNS server is actually might cache the ...
2
votes
1answer
2k views

Web service HMAC authentication/anti-replay

I am creating a web service, which handles various requests from web clients. The client and server share a big secret key S, and when one part wants to send data, it calculates the token as follows: ...
3
votes
2answers
7k views

How long it will take to crack a RAR password?

I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
0
votes
4answers
3k views

Brute forcing ssh keys

My problem is a common one: I deleted my SSH key, and forgot to set rm to point to a .trash file. I have the public key, and I need to get in this server. I am not doing this on anyone else's server. ...
4
votes
3answers
278 views

Resources for building a network security curriculum

I am currently helping my teacher create a curriculum around IT Security because it isn't currently implemented. Some previous question had decent responses but I was wondering if there was more. My ...
6
votes
1answer
1k views

ECDH and Forward Secrecy

I just read about ECDH and while getting a overview over the process, I noticed that this key exchange method does neither provide any forward secrecy, nor does it protect against replay-attacks, ...
5
votes
2answers
5k views

Symmetric or asymmetric encryption for JSON Web Token?

We're planning on using JSON Web Tokens (JWT) for our authentication server, and I am currently evaluating which encryption approach to take for the JWE token. There appear to be two options for ...
3
votes
1answer
394 views

Does the Windows Surface RT or Pro (Windows 8) support local encryption of Activesync data?

Our company policy is requires the local encryption of data for all email (in case the device is stolen) Does the Windows Surface (either version) support local encryption? Is the local device ...

15 30 50 per page