1
vote
0answers
79 views

Use cases for IPC security windows communication

There are two processes on windows machine. One is in user space and second is a service. User space process sends data to service. Because iam starting to think about securing somehow communication ...
1
vote
0answers
245 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
0answers
440 views

PowerShell / Windows - Security best practices for enabling Windows Remote Management

As the title indicates, I'm looking for industry best practices for enabling Windows Remote Management on a mix of Windows Servers (from 2000, 2003, 2008/R2 and 2012) to allow PowerShell to execute ...
1
vote
0answers
43 views

Resources and Examples for Modeling Application Security Groups

I am searching for some resources and documentation on modeling security groups for a web application, but seem to be coming up rather dry. I am interested in creating a visio-like diagram that ...
1
vote
0answers
66 views

Website Link in Signature corrupted while transmission [closed]

We placed our website link in our email signature for last one week. This link apparently converted into something corrupt, so all our mails gets bounced. We scan our web server files using ClamAV ...
1
vote
1answer
172 views

Use appstore using trusted certificate [closed]

I connected my iPad to my laptop's localproxy. I also installed a trusted digital certificate in my iPad. I am now able to use all HTTPS networks through my iPad except appstore. If I disable proxy, I ...
1
vote
0answers
133 views

ROP attack on x64, zero bytes trouble

I have found ROP tutorial on x86. Now i try to exploit simple buffer overflow case on x64: int main(int argc, char **argv) { char buf[10]; strcpy(buf, argv[1]); ... } I figured out, ...
1
vote
0answers
54 views

How to prevent location information from any dialing call [closed]

Assume you receive many unknown calls from unknown numbers regularly. You would like to prevent the callers to receive any pieces of information from you. How can you do this? Your number is ...
1
vote
0answers
74 views

Possible exploit while MPLS parsing with Bottom of Stack bit

My current task to parse MPLS label in a packet and store them in to a list. When I check packets with MPLS: One can understand it is the last MPLS header by checking Bottom of Stack bit. If ...
1
vote
0answers
39 views

Are there “standard” formats for storing GCM output?

The openssl enc -aes-256-gcm command is broken, because it can't decrypt its own output, otherwise I would look to that as a format. In order to decrypt a file, code needs to be able to separate the ...
1
vote
0answers
77 views

sample/starter code to test for TRUSTe password requirements [closed]

Considering its a requirement for Truste certification I figure that the code to test for a password meeting Truste's password strength requirements has been written more than a few times. I was ...
1
vote
1answer
354 views

What's the value of data partition encryption for database files on a postgres database server?

We're in the process of rolling out a postgres based web app, and I'm trying to understand the value of encrypting the entire database. In postgres's case, the only way to do this is store the ...
1
vote
2answers
244 views

Is a long, random string in a URL considered adequate protection from unauthorised access? [duplicate]

I have recently had to submit a number of confidential PDF documents to a website. These documents contain more than enough information to use in identity theft, and I can conceive how others using ...
1
vote
0answers
155 views

How can I launch DHCP starvation attack in WLAN?

In WLAN, due to MAC association on Access Point (AP), I can't send the DHCPDISCOVER messages using random MAC addresses. But if I keep my original MAC address as the source ethernet MAC a and random ...
1
vote
0answers
37 views

unable to execute shellcode,which is place on stack [duplicate]

I am trying to execute the shellcode to spawn an "sh" shell. I have taken shellcode as command line arguement,copied it to stack and tried to overwrite the return address of main function with the ...
1
vote
1answer
63 views

What bits of data is revoked in a CRL? Is it the hash(CSR) or hash(CSR + PKI signature)

My understanding is that a CSR contains the public key from the client, and the response is a signed version of that CSR, with certain attributes (EKU, expiration) and other attributes the CA decides ...
1
vote
0answers
353 views

VPN Server + Anonymity + Adblock for mobile Devices

In order to improve private security and anonymity while browsing the web on my mobile devices I wanted to tunnel all traffic to my own server via VPN and use a proxy software to filter unwanted (...
1
vote
2answers
703 views

What is a current best practice example of basic encryption and decryption in PHP?

I have a good working knowledge of basic security best practices (password hashing, preventing sql injection, CSRF, etc.) but am completely at a loss for finding a solution to common-case encryption ...
1
vote
0answers
251 views

Virtual Pentesting Lab on popular Enterprise level UTM and SIEM

I’m planning to add a new Penetration Testing Segment to my personal “Pen Lab”. It’ll be centered around Vulnerability Assessments /Penetration Testing on market leading Next-Gen Enterprise SIEM,UTM,...
1
vote
0answers
174 views

Android app downgrading TLS protocol to SSL 3.0

I performed vulnerability testing of some Android mobile applications I helped develop and I noticed some odd behavior. The applications used the default Android 5.0.2 cipher suite list that includes ...
1
vote
0answers
156 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. I'...
1
vote
0answers
97 views

Constructing a tainted string for arc injection

I'm new to security and currently referring to Robert Seacord's Secure Coding in C and C++. In chapter 2 of the same, the author talks about arc injection, wherein he passes the flow of control in the ...
1
vote
0answers
87 views

what security features a good Email Service Provider (for marketing) should have?

To choose the right Email Service Provider (ESP) for e-mail marketing processes, what are security requirements and checklists that we should pay attention to and ask for from vendors? In other ...
1
vote
0answers
175 views

Amazon Web Services - Relational Database Service - Security Scan

My company is utilizing AWS for it's infrastructure including Mysql RDS instances for our databases. Everything we have is in a VPC and requires access through our VPN. Our databases are all not ...
1
vote
1answer
174 views

Secure no-login REST API for very few clients

I'm designing a very simple data collection device for a research project. Because we are logging, among other stuff, the GPS position of actual vehicles, we need to protect the data. Since we ...
1
vote
1answer
88 views

TPM - number of AIKs and signing key [closed]

I try to learn a bit about the TPM and have a few questions I could not solve by myself. There are some privacy concerns about using the EK for identifying a TPM. I do not get these privacy concerns....
1
vote
1answer
102 views

ssl+symmetric with my own encryption algorithm? [closed]

I am a final year student currently doing my project, the title is "Mitigating man in the middle attacks using ssl+symmetric key algorithm". I would like to create my own encryption algorithm. I need ...
1
vote
0answers
19 views

List of cookie parameter names to identify load balancing mechanism [duplicate]

I need to create my own web application security assessment methodology. Within fingerprinting section I have one test case such as "Checking for load balancing". One part of that test case is to ...
1
vote
0answers
120 views

IIS | Block execution of files in directory

I am dealing with user uploads via a PHP application. I want to secure the server so no exploits are available to the user, such as uploading a php shell and executing it. I have set it so all ...
1
vote
0answers
173 views

Can a Radius server mitigate an ARP spoofing attack?

I'm helping my school network administrator to try to find a way to mitigate a current ARP spoofing attack on our wifi network. We detected an unknown host (MAC address seem to change, he is probably ...
1
vote
2answers
134 views

Should a password ever be presented in plain text to a user (On a website)? Is this illegal under UK Data protections act? [closed]

There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins. ...
1
vote
0answers
168 views

Making the Firefox key and CSR creation process transparent

Background I was a bit surprised that several CAs do not allow anymore to send a plain old CSR in text form to them which was created in the classic fashion with OpenSSL or similar. But this would ...
1
vote
0answers
138 views

How should an ISP approach Mutual Auth TLS for SMTP email? (Domain Auth Email)

I'm looking for an easy to deploy way to make email clients (MUAs) display my email messages in a secure manner. PGP and SMIME both do this today, but they are high touch, and require software or ...
1
vote
0answers
95 views

Does Activesync certificate authentication replace a password, or act as 2 factor?

I am looking at Activesync authentication and want to know if Certificate Authentication ignores a client username and password or Certificate Authentication requires a username and password ...
1
vote
0answers
38 views

What are some scenarios I would use MSFT Certificate Enrollment Web Services?

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds. When setting this up, I ...
1
vote
0answers
33 views

Is it dangerous to allow users to edit the CSS styles? [duplicate]

I'm working on a blog site, and I plan to allow bloggers to completely edit the style sheet for their own blogs I assume this isn't dangerous, since CSS is client side, but I thought it'd be best to ...
1
vote
0answers
57 views

How to use reflection attack in this simple protocol?

The following mutual authentication protocol has been designed to be resilient against reflection attacks. This is done by ensuring that the challenge from the initiator looks different from the ...
1
vote
0answers
76 views

Android 5 encryption

There's been lots of talk about the allegedly improved encryption in Android 5. Some questions about this: What is the maximum length for passphrases? (i.e. is it still limited to 16 characters?) ...
1
vote
0answers
198 views

How actually Lenovo's Superfish works in general (step-by-step)?

There isn`t a clear, step-by-step explanation about Superfish adware here, all questions and answers are kind of specific for different aspects of it, but nothing in general. So, how Lenovo's ...
1
vote
0answers
52 views

authentication token not stored in DB

I am implementing a webserver and the guideline I am following suggests: - to create token by a Serializer that takes the IdUser, a symmetric key and an expiry date - provide it to the user but not ...
1
vote
0answers
236 views

Is generating custom authentication token for WCF service requests a good practice?

I have public WCF web service which works over https. There are lots of technical restrictions on client side, so I can't use any advanced schemes like oauth. I have registered users and some of them ...
1
vote
0answers
68 views

Certificate advice for deploying code-signed software as a 3rd party vendor

I am in the process of developing an application for an organization, and am looking for a sanity check on my strategy, especially given the the nature of the SuperFish nonsense that was exposed. The ...
1
vote
0answers
27 views

How can i know my security level as “ SSL 256 bit encryption” [duplicate]

I am using openssl tool to create certificate self-signed certificate I have known that [2048 bit SSL] it is the length of the public key then what about [256 bit encryption] how can i know type of ...
1
vote
0answers
128 views

Through signing process with HSM Luna, What device perform the signing?

I'v succesfully configure and test character String signin usign Java and HSM Luna SA through PKCS11. My question is, In wich processor cryptographic operations are perform? In wich way HSM Luna ...
1
vote
0answers
59 views

Airgapped network security: feasable to prevent precompiled code from running to limit vulnerability to hacked firmware?

I'm not sure if this is the right medium to ask this but I'm looking for pointers or if this is being done. I realize that this is still a bit of a open question. When internal network holds critical ...
1
vote
1answer
251 views

Can Google's administrators be trusted with Google Authenticator? [duplicate]

Suppose there is an evil Google administrator who has full access to every server or network at Google. Will such a person be able to abuse the Google Authenticator technology to gain access to non-...
1
vote
1answer
417 views

What is the purpose of the CA-BUNDLE on a webserver?

So I purchase a certificate from DigiCert. The process goes like this: Generate private key and CSR on web server. Submit CSR to DigiCert. Get a signed certificate back as well as their root ...
1
vote
1answer
202 views

User Authentication for a public website in 2015 [closed]

I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...
1
vote
0answers
108 views

Questions about SRP algorithm

I trying to use SRP algorithm but I have some questions: Is that a good choice to use for registration and authorization SRP algorithm with SSL/TLS? And for all other transmission using just SSL/TLS?...
1
vote
0answers
110 views

Store 2-legged one-time password's key securely

I have a system with a OTP authentication and I need a method to encrypt the main "secret algorithm". In my system each OTP has a pair named "solution" and it is also changing like the OTP. I need to ...

15 30 50 per page