0
votes
0answers
38 views

How can I determine the encryption used by knowing input and result? [duplicate]

Is it possible to determine the encryption or hash used if I know the original input and final output? There is a similar post here: Determine encoding/hashing methods used based on knowing the input ...
10
votes
3answers
591 views

What simple security considerations can I / should I make for a read-only API?

Right now I'm setting up an API, to be consumed on the client-side to set up a directory site. I'm wondering what extra steps I need to take just to prevent people from gaining write access to the ...
-6
votes
2answers
511 views

the Informix password crack

I get some hash like: username sowainformix salt 7307821250330563328 hashed_password HaHvvzanjp_lPZgHLu0KHquN.Q4t98EF48csXk1QTJs hash_type SHA-256 updated flags ...
3
votes
1answer
295 views

What is the security purpose behind the “enable editing” of MS Word?

Whenever I open MS Word documents from my email, they open in "Protected View" with edit options disabled by default. As per my understanding, the hyperlinks used in the main document would be linked ...
2
votes
1answer
5k views

What is the best place to put my IDS network sensor? [duplicate]

I can only place a single network sensor somewhere within my network. Would it be best placed between the border router and firewall, or between the firewall internal LAN?
-1
votes
2answers
254 views

Interpreted VS Compiled web frameworks and trust

OK here is a big question. Interpreted languages have many advantages over the compiled languages when it comes to web application. But what is the ftp server is hacked or the web hosting company ...
8
votes
1answer
1k views

Why is it hard to prevent scalpers from using bots to buy up lots of concert tickets?

The New York Times recently has an article that talks about how scalpers are using bots to programmatically buy up lots of concert tickets, making it harder for ordinary fans to buy up tickets. For ...
-1
votes
1answer
1k views

Is AES more secure than Rijndael? [closed]

Which algorithm is generally considered to be more secure, and is AES-192/AES-256 still considered to be secure? After reading this it's lead me to belive that the Rijndael algorithm would be a more ...
5
votes
3answers
2k views

Why do we allow SSL certificates to be replaced before their expiry date, without revokation of others?

Imagine a situation where a rogue CA creates a certificate for your site. Since the user's browser trusts the CA, it will accept the certificate without any fuss. However, the site's real certificate ...
8
votes
3answers
6k views

Is it safe to have a DNS record pointing to 127.0.0.1?

My development server is on my local machine (127.0.0.1). I have created an A record in my DNS settings that points dev.mydomain.com to 127.0.0.1 so that I can use this domain name for accessing my ...
-1
votes
1answer
259 views

Malware persistence past a drive wipe? [duplicate]

Are there any known instances of malware persisting past a drive wipe and reinstall, through modified bios, or firmware on one of the machine components?
7
votes
2answers
2k views

Does the md5 (or any hash for that matter) of a string include the null terminator?

Does the md5 (or any hash for that matter) of a string include the null terminator in its calculations? That is does the hash of a string equal the hash of the sequence of bytes that represents the ...
1
vote
1answer
287 views

Enforcing software expiration on virtual machines

It is possible for virtual machine guests to bypass the software expiration timers for paid software. This example shows one way to do this on VMWare. A simpler method is for the user to "revert to ...
-1
votes
1answer
4k views

Virus affecting MS Office files

(I'm not sure if here is correct place for asking this question) I've come across a strange virus that changed contents of all MS Word, Excel, PowerPoint and image formats. It places this ASCII ...
4
votes
3answers
482 views

Understanding JVM zero day in relationship with other runtimes

I am a .net and php developer and since java has been in the news recently thanks to the string of zero days, I decided to brush up on security. In regards to the java zero days, this question has ...
9
votes
2answers
3k views

“Official statement” on php.net : CRYPT_BLOWFISH is strongest hash algorithm. Why?

First: I asked this question on stackoverflow and was kindly asked to post this here again. See the original question here. According to the [early] doc pages of the new PHP 5.5 password hashing/...
14
votes
2answers
9k views

CSRF protection and Single Page Apps

I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token. Should I send a CSRF ...
-1
votes
2answers
11k views

How can using a VPN increase network speed? [closed]

There are lots of guides online which suggest that using a VPN or proxy will gain better speed or 'free internet' however this seems unlikely. If my ISP is performing packet shaping on my connection. ...
8
votes
1answer
1k views

How does ASCII-Armoring help to prevent buffer-overflow attacks?

I was reading about return-to-libc attacks at Wikipedia. According to what I read and understood from the article, ASCII armoring means that binary data is converted into ASCII values by grouping ...
2
votes
1answer
81 views

Remote network security option

I'm a bit confused with some different network security techniques. Say we want a secure communication with a particular mail server in a remote company network. Reading and sending mails should be ...
2
votes
1answer
3k views

CentOS - Local privilege escalation - CVE-2012-0056

I have a server with these properties : cat /etc/lsb-release LSB_VERSION=base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:...
17
votes
2answers
11k views

How long does it take after a card is skimmed (unknowingly) at an ATM for the thief to be able to steal cash from the account?

My 21-year-old college sophomore daughter's SECU checking account debit card was skimmed 2 weeks ago at an ATM. She realized it the next day when she tried to use her debit card for a gas purchase. ...
5
votes
2answers
10k views

Estimated cost to make a brute-force WPA2 attack feasible

It's been shown that a brute-force attack on WPA2-Personal is possible in a reasonable amount of time. These successful attacks appear to be limited, however, to researchers who have the budget to ...
3
votes
1answer
827 views

Is TextKey SMS 2 factor authentication secure against cell phone cloning?

I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods. In typical SMS authentication, the provider sends you an access code ...
33
votes
5answers
6k views

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, ...
7
votes
2answers
6k views

How can I view the NTFS $MFT using correct field names?

I am trying to view an NTFS master file table. Each tool I have used so far extracts all of the entries, but puts non standard headers such as STANDARD_INFORMATION_ON instead of say $...
3
votes
5answers
445 views

Enforcing personal firewall for OS X

We're currently doing PCI compliance, and one of the requirements is that mobile devices that have access to systems involved in processing card data have personal firewall software installed which ...
0
votes
2answers
106 views

How do I obtain user info from SET?

I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
-1
votes
0answers
261 views

Email sender and account hacked [closed]

One customer got their email account "frozen" because it sent 9000 emails and some bounced back. I suspect something got hacked, but I have no idea what to do. I cannot figure out what was hacked. ...
5
votes
1answer
3k views

Pen Testing ASP.NET application with Backtrack

We have developed an ASP.NET Based Enterprise Application which is is soon to be released. Now, we are concerned about the security aspects of the application. I've been looking into Backtrack 5 and ...
32
votes
3answers
28k views

How can a website find my real IP address while I'm behind a proxy?

I just wonder how some website like WhatIsMyIP find out what your real IP address is, even if you use proxy server. It said : Proxy Detected and then they give your real IP address. Is it ...
6
votes
3answers
829 views

Security implications of an exploited router

So I completely understand that routers and local networks need to be kept locked down, etc. What real security threats can come about from an attacker who has remotely accessed (telnet or web gui) ...
1
vote
2answers
1k views

Reseting my computer to uninstall LogKext

My friend downloaded LogKext on my computer, so I'm guessing he can see every keystroke, but I've reset my computer so that it's in a condition when I first opened from the box. Can my friend still ...
4
votes
1answer
435 views

WPA2 audit tool

For the purposes of my own research, I have a very modest budget to set up a modest WPA2 brute-forcer supported by GPU(s). I've done some homework: Brute-Force GPU Password Crackers How to setup ...
2
votes
1answer
806 views

AES in CTR mode with same random IV to create same ciphertext

I am currently working on a little project. I am trying to generate an AES key with that I would like to encrypt a private RSA key. I have to do it this way. However, I do not want to save the AES ...
11
votes
3answers
1k views

Reason for writing Self-Decrypting Virus

What is the rationale behind writing a self-decrypting virus? By this I mean a virus that has it's payload encrypted, decrypts at runtime and runs it. How does this protect the virus from antivirus ...
-3
votes
2answers
2k views

What is the better way to share files between a server in DMZ and a server in the internal network? [closed]

I have to implement a solution to share some xml files between a frontend server in a DMZ and his backend in an internal network. Both servers are Solaris 10 boxes. What is the better way regarding ...
-6
votes
2answers
9k views

Is it possible to encrypt a virtual machine using virtualbox? [closed]

Is it possible to encrypt a virtual machine using virtualbox, and not leave accessible to the users of the machine where it hosted, and not allow any file to be extracted it with some program ? The ...
3
votes
1answer
268 views

What are the tradeoffs in cost, effort, and value in moving a database server to a virtualized DMZ environment?

I am quite new to the DMZ concept and working on a project as part of my master thesis where Remote access is required for the Development environment. However, there is a functional requirement for ...
0
votes
1answer
494 views

Definitions of computer forensics and information security [closed]

I'm about to do my master and I need to make a decision on what course I should take now I have two options either computer forensics or information security What I want to know is: What is the ...
4
votes
1answer
429 views

PKI integration in MAC OS

I have setup an ejbca pki and integrated certificates in MAC OS for S/MIME signing and encrypting. I have also set up a CRL distribution point and put the CRL online available on an HTTP server. ...
3
votes
2answers
319 views

PDF files on webserver file system

We create PDF files as relevant to a customer's e-mail communication. These PDF's contain some personal information, specific to the client. The client is emailed a link to the PDF. The link to the ...
14
votes
2answers
1k views

Does it make sense to hash a session id before passing it to an advertisement partner?

My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
2
votes
1answer
2k views

Brute-Force GPU Password Crackers

Brute-force password cracker programs which claim GPU support include John the Ripper, ighashgpu, oclHashcat, and others. oclHashcat appears one of the more popular, but I am not sure which AMD/ATI ...
5
votes
3answers
5k views

Can attackers steal SSL certificate from server and use it for MITM attacks?

I'm writing an iOS app for private use to act as a client for a PHP server. To secure the connection I'm using a self-signed SSL certificate. Since the server is self-hosted, on the first connection ...
6
votes
6answers
2k views

Best source(s) for security related news? [closed]

What is the best place to go for security news? I am looking for everything from news updates to editorials to guides and research. Anywhere considered more reliable or particularly hard-hitting? ...
-5
votes
1answer
946 views

Protect java WEB application inside the server(against reverse engineering) [closed]

I have a web application running on Glassfish 3.1.2 servlet container and I need a way to protect the compiled java classes. I have tried to obfuscate the source code but it didn't work. The project ...
7
votes
2answers
16k views

Decrypt from cipher text encrypted using RSA

I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is Public Key: ...
7
votes
2answers
362 views

Why standards organizations give so short protection times for 128 bit encryption?

According to this and this, seems even 128 bit encryption should remain secure for a much longer time than what security organizations say. I saw the standards with this: http://www.keylength.com/en/...
4
votes
2answers
391 views

Does providing OAuth for mobile apps pose a security threat?

Let's take a look at the basic OAuth workflow: The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...

15 30 50 per page