4
votes
1answer
7k views

Is using RC4-MD5/RC4-SHA as SSL ciphers enough for most purpose?

In the AWS ELB, I have uploaded a cert and only selected "RC4-MD5" + "RC4-SHA" as the ciphers and scored A in the ssltest [1] If I using the default ELB setting, I can only score a C Since I am not ...
0
votes
1answer
1k views

In-office Flask app on port 80 - is it safe? [closed]

The title says it all; I'm just serving data to coworkers as a courtesy via a series of single-page apps that I basically consolidated under Flask, serving Jinja templates. Presently, I have Apache ...
13
votes
4answers
2k views

Sending HTTP 403 as. 200 - “Silent Identification of Admin”

A researcher recently reported an issue in a site about using script on a 3rd party site to discover if a user is an admin. Here's the scenario: Main site is target.example Attacker site is evil....
12
votes
1answer
325 views

WAF Process Creation for Integration of IT and Business

A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready ...
5
votes
4answers
2k views

“Forgot my password page” best practice

On a "forgot my password" page, is appropriate when user doesn't have an account to display the message "this account doesn't exist"? Or in the interest of security, should I display a success message ...
1
vote
1answer
411 views

Generate Keytool Object from CSR

I have to develop an application which uses another application for generating a CSR. After generating the CSR I have to provide this CSR along with a SHA256 hash of the public key to a CA. The ...
2
votes
2answers
205 views

Eye-Tracking, Public Access Points and Password Protection [closed]

Could entering sensitive keyboard input in public places with camera systems equipped with a robust AI possibly leak keystrokes via eye-tracking technology -- assuming the typist is using the hunt/...
22
votes
3answers
5k views

How does the TPM perform integrity measurements on a system?

I am trying to find out how the TPM performs an integrity measurement on a system. It is well-documented in the TPM specification how it seals the data it has measured in the PCRs and how it is ...
6
votes
1answer
285 views

SFTP or FTPS for connecting to a VPS?

I'm going to be hosting one of my websites on a VPS soon and I want to make it as secure as possible. Only I will need access to the VPS, and I can't see that changing in the near future. Because it ...
24
votes
7answers
18k views

Should I use FileZilla?

Recently, an increasing number of people have started advising moving away from FileZilla. However, the only reason I can see for this is that FileZilla stores the connection information in a ...
3
votes
2answers
2k views

Encrypt web.config file using Data Protection API

I have encrypted part of my web.config file using the Data Protection API. Now, my question is, what does a hacker need in order to decrypt the web.config file? Does he require physical access to ...
4
votes
2answers
4k views

Checking SSL/TLS servers for NULL encryption support

I have a web server supporting SSL 3 and TLS protocols, the following are the supported cipher suites: TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA How can I ...
13
votes
3answers
8k views

SQL injection can bypass login but not drop table

I've setup a test environment for running some SQL Injection against my code and learning how to defend against it. I can bypass the login form using the following in the password field: ' OR ...
57
votes
2answers
40k views

How secure is Ubuntu's default full-disk encryption?

How secure is the encryption offered by ubuntu (using the disk utility)? What algorithm is used underneath it? If someone could at least provide a link to some documentation or article regarding that ...
3
votes
1answer
351 views

Should I trust and play every embedded video on Facebook?

Regarding to trusted sites like YouTube, should I trust other videos when embedded to Facebook, usually, when user shares a link a thumbnail image will be created and previewed, then, we need only to ...
-2
votes
1answer
232 views

Can Cain&Able Crack SSL? [closed]

I have been messing around with Cain and Able and used APR on another computer (also mine) to get a hashed version of my username and password for my yahoo e-mail account, but I seem to be lost as to ...
10
votes
1answer
435 views

Is this cross-site password model secure?

I'm looking for a way of securely having passwords for different pages. Say I generate this password: ild23rfsfdfg%*#fArg34t34657%537@asd7oak2094^*q2k2k@Kk3j4tn453Q5# Then, for each site, I change ...
-5
votes
1answer
512 views

How to prevent malware infection and file accessibility through a wireless router? [duplicate]

The answer suggested in the 'duplicate' is about a different issue. But since my original wording of the question seems to have not been clear - here's a second attempt: Is there any danger of any of ...
2
votes
1answer
414 views

Possible to detect and log CORS and preflight requests in IIS?

I'd like to track and understand if CORS/cross site requests are hitting my website, and if they are succeeding or failing. My goal is to understand if clients are following our documentation ...
3
votes
1answer
618 views

Is this a security threat?

So at my business our receipt printer randomly printed some questionable looking data. I looked into scanproxy.net and it's clearly not something legitimate. Can anyone give me a better idea of ...
0
votes
1answer
1k views

Ways to protect source code from theft [duplicate]

I just want to know better ways to protect source code from theft on Windows by Removable Devices like CD,Pendrive. Here is what I know: Windows Disk Encryption: Pretty nice to protect from offline ...
5
votes
1answer
278 views

SQL injection not returning expected results

I've created a test site in order to learn about SQLi and then protect against it. I may be misunderstanding how it is supposed to behave but at present I'm not getting the results I expect. The page:...
9
votes
2answers
1k views

How does one evaluate tamper-resistant envelopes/packaging?

In contrast to digital cryptographic algorithms and protocols where many qualified high-IQ individuals dig into the details and specifics, physical tamper resistance for low-tech packages is not ...
26
votes
2answers
9k views

stronger encryption for SSH keys

I configured my server to encrypt user passwords using 500,000 rounds of SHA-512. The question is, how does the standard AES-128-CBC encrypted SSH private key stack up to that, provided the same (or ...
3
votes
3answers
400 views

Should I trust URL based on file extension like this: http://example.com/image.jpg

I created a slideshow and mentioned that user must not trust URL based on file extension, however, I got some claims against that, because URL's like this should be safe: example.com/images/pic001....
12
votes
2answers
1k views

Correct way to get a number from 0-9 from a random byte?

If I have a good random number generator that gives me a byte of data at a time, and I want to extract a random decimal digit of 0 to 9 from that byte stream, what is the correct way to do that? At ...
2
votes
1answer
220 views

Why Google and smartphone manufacturers don't care about updates?

For Windows, Firefox/Chrome, Java, Flash critical updates are issued each couple weeks, and as far my understanding goes, it is REALLY bad not to install them ASAP. For my 3 year old Samsung ...
5
votes
2answers
173 views

Understanding PRGs: How can we expand randomness?

I am getting a bit confused with the PRGs employed in cryptography. Basically, a PRG is used to expand a random sequence (mostly a key) of length s to a length n>s, still looking random. Now while ...
2
votes
1answer
244 views

Session Cookie HttpOnly Set After Initial Server Response Showing as Vulnerable

Is a session cookie set without HttpOnly at first, but added before the client browser finishes rendering, still considered vulnerable? The scanner test I need to satisfy believes so, but is this a ...
1
vote
1answer
343 views

SSL Handshake takes much longer in LAN than in WAN [closed]

Here is the structure we have, 3 servers in location A (172.22.25.X) and 3 servers in location B (192.168.140.X). One of the 3 servers in each location creates an SSL connection to the other 4 servers,...
0
votes
1answer
114 views

Antivirus scanning [closed]

I use the avast free antivirus ... and i sort of noticed a very strange occurrence. Whenever I scan a document from avast, the application scans more data then there is on the document. For e.g., if ...
104
votes
5answers
9k views

How do I deal with a compromised server?

I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism: What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", ...
9
votes
3answers
409 views

Is it dangerous to place ~/ssh/config on GitHub?

I am used to version control most of my dot files and push them to a repository on GitHub. I would also like to add ~/.ssh/config to have an up-to-date configuration on all machines. Could an ...
3
votes
1answer
431 views

SNMPv2 and Community Security

When working with servers on the internet and doing monitoring is there any dangers using SNMPv2? I am working with observium and have the following: /etc/snmpd.conf com2sec readonly default ...
-7
votes
3answers
119 views

Download a data file, add it to the database only when certain it's clean [closed]

You need to download an essential data file but the act of downloading carries with it the risk of contamination from say, an embedded keylogger, or worse, that can ruin your day(s) if it takes up ...
0
votes
3answers
814 views

Is using a numbers station to transmit a one-time-pad as key actually insecure?

We all know the two most important problems related to a “one-time-pad”: The one-time-pad needs to be truly random (which I think is logic, as pseudo random generators are quick but predictable). ...
5
votes
4answers
8k views

Find out how my server is being used for DDOS attacks

I got an email from Amazon that my Amazon EC2 server is being used for DDoS attacks and they have closed all ports except SSH. This is tragical for me but I have not been able to find out how and ...
-1
votes
3answers
304 views

2 routers, a desktop and an Android

Router 1 is setup with WPA and a 32-character PSK. A Linux desktop is connected to it via Ethernet. Router 2 has an 8-character PSK and is connected to Router 1 by Ethernet cable. Router 2 is used ...
2
votes
1answer
391 views

What is the most “safest” architecture to run in QEMU? [closed]

Currently OpenBSD supports these architectures ( http://www.openbsd.org/plat.html ): alpha Digital Alpha-based systems amd64 AMD64-based systems armish ARM-based appliances (by Thecus, IO-DATA, ...
1
vote
2answers
1k views

Why is unshadowing needed?

john /etc/shadow look like working, because john will use many-many CPU for it. But why is unshadowing needed? Why isn't it enough to use "john /etc/shadow"? Because of the salting? Can someone ...
2
votes
4answers
207 views

Protecting IP on a remote server

Apologies in advance if this question is a bit vague. I just joined a stock trading group. A guy set up a server for me, and it's racked in their building. I ssh into it, and run my algo remotely ...
14
votes
3answers
30k views

How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?

There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP. How is the syn flag in TCP used to achieve ...
3
votes
3answers
164 views

Fake Websites: How to avoid?

So, I'm sure you've heard of gatt.org being the fake website for the WTO. What I'd like to know is, when I'm on the Net, how do I discern the authenticity of the website? I was thinking something like ...
-2
votes
5answers
995 views

Why do most cars use physical keys and no PIN?

Why do car makers rely on physical start keys, which can be stolen by home burglars and then used to start the vehicle? Why don't they use more secure methods such as a personal PIN, or a pin code to ...
5
votes
5answers
759 views

Encrypted disk at risk if laptop stolen while turned on but locked

If I have a laptop with full disk encryption it's turned on, the screen is locked and it gets stolen. How would an attacker get my data? It's not encrypted at the moment because it's turned on but the ...
4
votes
1answer
295 views

Unique SSL keys for load-balanced hosts

Given a setup with multiple SSL-terminating load-balancers in a failover configuration, is it a bad idea to have a unique TLS private key for each one of the hosts? They would all share the same FQDN.
2
votes
4answers
411 views

Securing JSON? Is it justifiable to return html code instead of json to prevent copy cat?

In one website I had to manually enter first hand data, which is a really tiresome job. I am concerned if I return such data in json, it would be too easy to parse and incorporate into other's ...
-3
votes
1answer
156 views

Am I covered with GPL If I want to share open source code of project developed in my company? [closed]

I do not know if it's the right place to ask this question. But I find that this site is the closest site in the exchange sites to ask a such question. I m working in a company and in my job contract ...
6
votes
1answer
198 views

Are the Trends of Type II Hypervisors and Newer Applications a Security Issue?

It seems that every time I have a new 'binge' at using the likes of VirtualBox or VMWare (the Type II version), they've introduced even more high-level features, often ones that remove layers between ...
0
votes
1answer
726 views

Elgamal algorithm PHP code [closed]

I was wondering if there is a PHP implementation for Elgamal algorithm for website data security ? I found that for EC, Diffie-Hellman but could not find any about elgamal. Thanks in advance.

15 30 50 per page