-2
votes
1answer
232 views

Can Cain&Able Crack SSL? [closed]

I have been messing around with Cain and Able and used APR on another computer (also mine) to get a hashed version of my username and password for my yahoo e-mail account, but I seem to be lost as to ...
10
votes
1answer
435 views

Is this cross-site password model secure?

I'm looking for a way of securely having passwords for different pages. Say I generate this password: ild23rfsfdfg%*#fArg34t34657%537@asd7oak2094^*q2k2k@Kk3j4tn453Q5# Then, for each site, I change ...
-5
votes
1answer
512 views

How to prevent malware infection and file accessibility through a wireless router? [duplicate]

The answer suggested in the 'duplicate' is about a different issue. But since my original wording of the question seems to have not been clear - here's a second attempt: Is there any danger of any of ...
2
votes
1answer
414 views

Possible to detect and log CORS and preflight requests in IIS?

I'd like to track and understand if CORS/cross site requests are hitting my website, and if they are succeeding or failing. My goal is to understand if clients are following our documentation ...
3
votes
1answer
618 views

Is this a security threat?

So at my business our receipt printer randomly printed some questionable looking data. I looked into scanproxy.net and it's clearly not something legitimate. Can anyone give me a better idea of ...
0
votes
1answer
1k views

Ways to protect source code from theft [duplicate]

I just want to know better ways to protect source code from theft on Windows by Removable Devices like CD,Pendrive. Here is what I know: Windows Disk Encryption: Pretty nice to protect from offline ...
5
votes
1answer
278 views

SQL injection not returning expected results

I've created a test site in order to learn about SQLi and then protect against it. I may be misunderstanding how it is supposed to behave but at present I'm not getting the results I expect. The page:...
9
votes
2answers
1k views

How does one evaluate tamper-resistant envelopes/packaging?

In contrast to digital cryptographic algorithms and protocols where many qualified high-IQ individuals dig into the details and specifics, physical tamper resistance for low-tech packages is not ...
26
votes
2answers
9k views

stronger encryption for SSH keys

I configured my server to encrypt user passwords using 500,000 rounds of SHA-512. The question is, how does the standard AES-128-CBC encrypted SSH private key stack up to that, provided the same (or ...
3
votes
3answers
400 views

Should I trust URL based on file extension like this: http://example.com/image.jpg

I created a slideshow and mentioned that user must not trust URL based on file extension, however, I got some claims against that, because URL's like this should be safe: example.com/images/pic001....
12
votes
2answers
1k views

Correct way to get a number from 0-9 from a random byte?

If I have a good random number generator that gives me a byte of data at a time, and I want to extract a random decimal digit of 0 to 9 from that byte stream, what is the correct way to do that? At ...
2
votes
1answer
220 views

Why Google and smartphone manufacturers don't care about updates?

For Windows, Firefox/Chrome, Java, Flash critical updates are issued each couple weeks, and as far my understanding goes, it is REALLY bad not to install them ASAP. For my 3 year old Samsung ...
5
votes
2answers
173 views

Understanding PRGs: How can we expand randomness?

I am getting a bit confused with the PRGs employed in cryptography. Basically, a PRG is used to expand a random sequence (mostly a key) of length s to a length n>s, still looking random. Now while ...
2
votes
1answer
244 views

Session Cookie HttpOnly Set After Initial Server Response Showing as Vulnerable

Is a session cookie set without HttpOnly at first, but added before the client browser finishes rendering, still considered vulnerable? The scanner test I need to satisfy believes so, but is this a ...
1
vote
1answer
344 views

SSL Handshake takes much longer in LAN than in WAN [closed]

Here is the structure we have, 3 servers in location A (172.22.25.X) and 3 servers in location B (192.168.140.X). One of the 3 servers in each location creates an SSL connection to the other 4 servers,...
0
votes
1answer
114 views

Antivirus scanning [closed]

I use the avast free antivirus ... and i sort of noticed a very strange occurrence. Whenever I scan a document from avast, the application scans more data then there is on the document. For e.g., if ...
104
votes
5answers
9k views

How do I deal with a compromised server?

I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism: What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", ...
9
votes
3answers
409 views

Is it dangerous to place ~/ssh/config on GitHub?

I am used to version control most of my dot files and push them to a repository on GitHub. I would also like to add ~/.ssh/config to have an up-to-date configuration on all machines. Could an ...
3
votes
1answer
431 views

SNMPv2 and Community Security

When working with servers on the internet and doing monitoring is there any dangers using SNMPv2? I am working with observium and have the following: /etc/snmpd.conf com2sec readonly default ...
-7
votes
3answers
119 views

Download a data file, add it to the database only when certain it's clean [closed]

You need to download an essential data file but the act of downloading carries with it the risk of contamination from say, an embedded keylogger, or worse, that can ruin your day(s) if it takes up ...
0
votes
3answers
815 views

Is using a numbers station to transmit a one-time-pad as key actually insecure?

We all know the two most important problems related to a “one-time-pad”: The one-time-pad needs to be truly random (which I think is logic, as pseudo random generators are quick but predictable). ...
5
votes
4answers
8k views

Find out how my server is being used for DDOS attacks

I got an email from Amazon that my Amazon EC2 server is being used for DDoS attacks and they have closed all ports except SSH. This is tragical for me but I have not been able to find out how and ...
-1
votes
3answers
304 views

2 routers, a desktop and an Android

Router 1 is setup with WPA and a 32-character PSK. A Linux desktop is connected to it via Ethernet. Router 2 has an 8-character PSK and is connected to Router 1 by Ethernet cable. Router 2 is used ...
2
votes
1answer
391 views

What is the most “safest” architecture to run in QEMU? [closed]

Currently OpenBSD supports these architectures ( http://www.openbsd.org/plat.html ): alpha Digital Alpha-based systems amd64 AMD64-based systems armish ARM-based appliances (by Thecus, IO-DATA, ...
1
vote
2answers
1k views

Why is unshadowing needed?

john /etc/shadow look like working, because john will use many-many CPU for it. But why is unshadowing needed? Why isn't it enough to use "john /etc/shadow"? Because of the salting? Can someone ...
2
votes
4answers
207 views

Protecting IP on a remote server

Apologies in advance if this question is a bit vague. I just joined a stock trading group. A guy set up a server for me, and it's racked in their building. I ssh into it, and run my algo remotely ...
14
votes
3answers
30k views

How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?

There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP. How is the syn flag in TCP used to achieve ...
3
votes
3answers
165 views

Fake Websites: How to avoid?

So, I'm sure you've heard of gatt.org being the fake website for the WTO. What I'd like to know is, when I'm on the Net, how do I discern the authenticity of the website? I was thinking something like ...
-2
votes
5answers
996 views

Why do most cars use physical keys and no PIN?

Why do car makers rely on physical start keys, which can be stolen by home burglars and then used to start the vehicle? Why don't they use more secure methods such as a personal PIN, or a pin code to ...
5
votes
5answers
760 views

Encrypted disk at risk if laptop stolen while turned on but locked

If I have a laptop with full disk encryption it's turned on, the screen is locked and it gets stolen. How would an attacker get my data? It's not encrypted at the moment because it's turned on but the ...
4
votes
1answer
295 views

Unique SSL keys for load-balanced hosts

Given a setup with multiple SSL-terminating load-balancers in a failover configuration, is it a bad idea to have a unique TLS private key for each one of the hosts? They would all share the same FQDN.
2
votes
4answers
413 views

Securing JSON? Is it justifiable to return html code instead of json to prevent copy cat?

In one website I had to manually enter first hand data, which is a really tiresome job. I am concerned if I return such data in json, it would be too easy to parse and incorporate into other's ...
-3
votes
1answer
156 views

Am I covered with GPL If I want to share open source code of project developed in my company? [closed]

I do not know if it's the right place to ask this question. But I find that this site is the closest site in the exchange sites to ask a such question. I m working in a company and in my job contract ...
6
votes
1answer
198 views

Are the Trends of Type II Hypervisors and Newer Applications a Security Issue?

It seems that every time I have a new 'binge' at using the likes of VirtualBox or VMWare (the Type II version), they've introduced even more high-level features, often ones that remove layers between ...
0
votes
1answer
727 views

Elgamal algorithm PHP code [closed]

I was wondering if there is a PHP implementation for Elgamal algorithm for website data security ? I found that for EC, Diffie-Hellman but could not find any about elgamal. Thanks in advance.
4
votes
3answers
365 views

How do open (no password) wireless networks deal with abuse?

Many places today such as restaurants, malls, and other public places have free and open WiFi that does not need a password or login information to access. That means that anyone, even people outside ...
7
votes
3answers
2k views

Are 500 responses or specific error codes more secure for REST services?

I am building a REST API to store security sensitive data for both my client and third-party partners. Each request is validated using an HMAC of certain data which is keyed on a temporary key ...
3
votes
2answers
214 views

Degree of Obfuscation

Let us assume that I have the following code: namespace MobileApp { public class Storage { public Storage() { } public bool Save() { bool ...
1
vote
2answers
662 views

OpenSSL dgst authentication failure

I've tried to replicate the workflow presented on this blog in OpenSSL: http://farid.hajji.name/blog/2009/07/27/public-key-cryptography-with-openssl/ However, authentication seems to fail despite ...
5
votes
2answers
5k views

I am always Hibernating my System, is there any risk for my Encrypted drive with BitLocker?

I am Always Hibernating my Laptop, for faster booting, I encrypted sensitive drive by BitLocker, what if my Laptop stolen and attacker knew that it was in hybernate mode, can he decrypt my hard?
7
votes
2answers
263 views

What security measures does Chrome have in place to sandbox different user accounts?

Google Chrome has a feature that allows different users to use Chrome on the same computer in a completely separate space. The support page is quite light on information. Is there information ...
5
votes
2answers
2k views

possible exploits through avahi daemon

It is always recommended to disable Avahi daemon, for security reasons, when not in use. So, by what ways it is possible to exploit a system which has avahi daemon service running? And how can we ...
126
votes
5answers
5k views

How can I protect myself from this kind of clipboard abuse?

Clipboard abuse from websites Many websites use JavaScript or CSS to stealthily insert or replace text in the user's clipboard whenever they copy information from the page. As far as I know this is ...
4
votes
1answer
117 views

Are there any public examples of an encrypted attribute in a Verisign-issued certificate?

This Credentica- UProve paper describes how Verisign issues (or did issue in the past) certs with encrypted attributes: "VeriSign issues certificates that contain encrypted attributes that can be ...
1
vote
1answer
884 views

Disabling built-in Wi-Fi adapter and protecting Wi-Fi's MAC address on a laptop

I have an XP laptop with Wi-Fi issues - it connects / disconnects intermittently. Anyway, I bought a USB Wi-Fi that works well. My security question are: Is there a way to completely disable the ...
2
votes
3answers
5k views

Is there an alternative to TCP/IP that encrypts end-to-end?

If there was a communication protocol that encrypts at the very low-level, this would solve the problem of wiretapping entirely and for all.
1
vote
1answer
381 views

NTRU java attack implementation

I'm researching NTRU cryptosystem and started research based on source code from sourceforge and bouncy castle(java language). Currently I'm reseacrhing attacks on NTRU, based on CVP and SVP. But I'd ...
110
votes
8answers
6k views

Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?

Today I experienced a situation where a person responsible for the security of a company required a pentesting company to withdraw a clause in the contract that says that: "during the pentest there ...
2
votes
2answers
3k views

Is this a valid Windows update page

In my chrome browser if I google for Windows Update the first hit is windowsupdate.microsoft.com/‎ When I click on it I am redirected to http://www.update.microsoft.com/windowsupdate/v6/thanks....
2
votes
2answers
371 views

Time based event, console application on Windows Server — security implications

I'm a software engineer, and I've written several discreet utilities that run at specific times on Windows Server 2008. Generally speaking, they are console applications, need to access SQL Server, ...

15 30 50 per page