7
votes
1answer
3k views

Crack plain RSA given p, q and e

How would one find the secret key in a simple RSA encryption when given p, q and e?
1
vote
2answers
201 views

Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?

Question (a) Is there? and if so (b) what is a standard or accepted way for MAC systems to deal with complex software and in particular with Python, Bash and other interpreters? (in terms of ...
3
votes
1answer
400 views

Security of Openflow/SDN network

Openflow/SDN networks give a remote controller the ability to manage the behavior of network devices i.e. configurations. They can forward instruction sets to dynamically change network configuration. ...
20
votes
2answers
3k views

Which SSH security is stronger? 2 Factor or Public key

For SSH authentication, which is more secure? 2 Factor Authentication using a USB token/Google Authenticator(time based) OR Public/private key with password Or could they be both used at the same ...
0
votes
0answers
21 views

Steganalysis of outgoing traffic [duplicate]

Possible Duplicate: Detecting Steganography in images Is there any commercial traffic monitoring systems that implements steganalysis and could issue a warning upon suspicious file transfer ...
-1
votes
1answer
1k views

Changing user account passwords from PHP script - vulnerabilities? [closed]

I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I ...
7
votes
2answers
1k views

Sending data form registration forms

I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical. So how do I encrypt 'userside' and send the data to the server in encrypted form? Can ...
9
votes
1answer
897 views

Reversible, recoverable user data encryption scheme

From this earlier question, I have a general need to obfuscate a set of third-party credentials stored in a user account, which are then used in an internal Winforms software client. The scheme from ...
12
votes
4answers
3k views

PCI-DSS - one application per server?

How do I interpret the 2.2.1 point for PCI-DSS? Is "application server" 'one primary function' or does it need to be "program x server", "program y server" etc? I have a collection of applications ...
2
votes
1answer
239 views

Is this a reasonable approach to “generating” passwords? [duplicate]

Possible Duplicate: What is your way to create good passwords that can actually be remembered? I am using a self-developed "template" for my own passwords (like Facebook, Gmail etc.) I use ...
2
votes
2answers
224 views

Is it possible to boot into root's /bin/bash on a LUKS encrypted device?

I have to check the possibility of case mentioned in the title. An average Linux could be booted up into root's terminal directly without authentication by modifying kernel boot parameters. I'd like ...
347
votes
11answers
42k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
2
votes
4answers
3k views

Does a renewed certificate open old messages?

I have a digital certificate that I use to exchange messages with peers, my certificate expiration date is due next year, suppose I renew this certificate before it expires, will I be able to open the ...
2
votes
2answers
472 views

DNS cache poisoning

What are the things the attacker needs to know from the victim to perform DNS cache poisoning ? for example : IP , Port number and Transaction number what else ?
2
votes
2answers
209 views

Access via http to other protocols and ports!

Our firewall only allows HTTP port 80 but we have detected that a user accesses some other protocols and ports that we deny in our firewall. We know that he has developed an application (Console ...
2
votes
2answers
842 views

Is there any way to differentiate between a normal web request and a web service request?

I have a security layer for providing the security of the requests that come to my server. For all web request that come in a login page is shown if cookie is not present. I am now introducing web ...
6
votes
1answer
194 views

What responsibility do I have in continuing another developer's work?

My question is related to this one. I did not found anything googling around and that is why I am asking. This question I am the sole web developer for a firm, and I manage everything, from ...
1
vote
2answers
4k views

How valid is this statement “SSL sit between application layer and network layer”

taken from http://searchsecurity.techtarget.com/answer/How-does-SSL-sit-between-the-network-layer-and-application-layer The SSL protocol is quite unusual, as it doesn't just operate at one layer. ...
3
votes
3answers
1k views

length of ciphers versus length of key

ssh-keygen defaults to RSA (for SSH protocol 2) and a 2048 bit key. At this description of ssh The supported ciphers are: 3des-cbc, aes128-cbc, aes192-cbc, aes256-cbc, aes128-ctr, ...
4
votes
4answers
2k views

How to spoof an ATM transaction?

About 20 years ago, a man disappeared, but his ATM card was "supposedly" used the day after the disappearance. However, surveillance footage of the store shows no-one in the store physically used the ...
9
votes
3answers
1k views

How to subscribe to information about new vulnerabilities in selected products?

In order to be informed about critical vulnerabilities in selected products I'd want to subscribe to some list about them. I'd want to configure the list of products by myself. The question: Where ...
-1
votes
1answer
1k views

Designing DMZ(s) [closed]

I was wondering what would be the correct way to isolate servers in order to protect them and us from too much harm. Let's have two scenarios: 1) Access to Application Server from the world We have ...
12
votes
3answers
11k views

help understanding client certificate verification

I am creating an API that only certain computers should have access to. Communication will be via SSL between the server and the clients. In order to verify that a client has access, I would like to ...
5
votes
3answers
485 views

PCI compliance can prevent fines?

We're working really hard to achieve PCI compliance for a project and will likely be spending hundreds of dollars each month, but I was wondering what if, god forbid, something unlikely happens and ...
-6
votes
2answers
293 views

What technologies are recommended for E-banking? [closed]

If a Linux user need use his bank account from Internet, then what technologies and procedures should use? Is better to use the Guest Account (if exist) of the OS, or an Administrator Account? What ...
-1
votes
1answer
865 views

Prevent URL manipulations including /proc and /etc with fail2ban

I get many attacks on my debian apache server that include URL-manipulations like http://url_on_my_eserver/?username=/etc/passwd How can I block these attacks?
0
votes
1answer
353 views

Password protection of encryption and signature keys

I would like to store encrypted backup of text files on my computer. I'm developing a python script using Pycrypto to achieve that, based on this code to use the library. (current code) The basic ...
3
votes
1answer
488 views

Are man-in-the-middle attacks against p2p systems realistic?

I'm implementing a DHT based on Kademlia following this paper. The protocol described in this paper uses nonces to protect against man-in-the-middle attacks. The disadvantage is that latency gets ...
10
votes
3answers
2k views

Security tradeoffs of pathname-based MAC (e.g., TOMOYO, grsecurity, AppArmor, …)

I have been learning about MAC (Mandatory Access Control) systems in Linux. Often, but not always, these are tied to Linux Security Modules. Some systems I've looked at: SELinux, Tomoyo, AppArmor, ...
12
votes
2answers
680 views

How do I prevent my twin sister's “pulled from public record” information from being used when I try to answer security questions?

Several times in the past months, I have been asked security questions that are "pulled from public record" to verify my identity, either over the phone or on a website (Chase Bank, Walgreens ...
2
votes
1answer
362 views

what is the difference between virus, worm, trojan and other malware [closed]

Looking through the questions in IT security, I found out that there is no answer which cover this question in depth. I am aware of the answer and just hope to see something detailed about: main ...
4
votes
1answer
203 views

What physical, electronic, and software characteristics are important in a smart card?

I'm evaluating smart card readers to store a number of private keys, but don't know where to start. What criteria is important regarding smart cards and preventing the extraction or unauthorized used ...
2
votes
1answer
277 views

how does OpenSSL create X.509 certs from SPKACs?

The SPKAC ASN.1 description: PublicKeyAndChallenge ::= SEQUENCE { spki SubjectPublicKeyInfo, challenge IA5STRING } SignedPublicKeyAndChallenge ::= SEQUENCE { publicKeyAndChallenge ...
8
votes
3answers
1k views

How to authenticate a salted password?

If only the password hash is stored and the user inputs the original password, how does the program know that it is correct? I guess it could check all the possible salts but if there are 32bit salts ...
1
vote
1answer
512 views

spkac: what is the purpose of the challenge string?

The SPKAC ASN.1 description: PublicKeyAndChallenge ::= SEQUENCE { spki SubjectPublicKeyInfo, challenge IA5STRING } SignedPublicKeyAndChallenge ::= SEQUENCE { publicKeyAndChallenge ...
2
votes
3answers
3k views

KDC(Key Distribution Center) vs Asymmetric Key Exchange

Today I was reading notes about cryptography and I came across a problem that exists in Symmetric Key encryption, which is how to share the secret key across the network. 1st Method : Make use of ...
3
votes
4answers
1k views

Are malicious scripts in batch files detected by antiviruses?

We have many scripts in shared folders in our IT Department. Are malicious scripts in batch files detected by antiviruses?
0
votes
1answer
134 views

Manually monitoring your PC for Java (Oracle) exploits?

Sandboxing and AV's aside, if I wanted to manually look at/monitor my system for where they usually enter it, where could I look for possible malicious Java viruses/activity, e.g., would they first ...
0
votes
5answers
431 views

How to protect server uploads

I want to upload .jpg images to my Linux server so that clients can re-download the files when they want. Supposing unknowingly there is a trojan, worm or malware in my computer, will these be ...
6
votes
1answer
8k views

What is the fail2ban default setting for SSH login attempts?

I tried to block myself from my own server to test if fail2ban works correctly, so I tried ssh login and used a wrong password over and over. But I was blocked only after 13 failed logins instead of ...
16
votes
1answer
1k views

Do any DNS registrars support multi factor authentication?

I am looking for a DNS registrar that supports strong multi-factor authentication. Does any DNS registrar support multi-factor? Is this a legitimate need?
0
votes
0answers
79 views

Is it possible to attack system through torrent usage? [duplicate]

Possible Duplicate: What can do a hacker with ip address? I am using the Torrent for Downloading the Music and other files. I heard that using Torrent can give IPAddress information to ...
1
vote
3answers
297 views

How this kind of mechanism considered as vulnerability?

From following news, http://thehackernews.com/2012/12/etsy-for-iphone-loophole-allows.html Someone just setup a proxy to intercept traffic between browser and https protocol, then it called ...
4
votes
2answers
2k views

What did the certificate authority do with my CSR?

I needed to reach a web service which is not mine. The IT department of that web service has asked me to send them a CSR (certificate signing request). Then, he will send me back a signed certificate ...
4
votes
1answer
2k views

Where can a virus or other malware “hide” on common PC and Mac hardware?

I'm looking for a detailed list of locations that viruses can "hide" in modern hardware even after a reboot. Some things that come to mind include Boot BIOS/Firmware CPU Microcode Connected PCI ...
7
votes
1answer
984 views

Have any viruses leveraging the GPU been discovered in the wild? What is the mitigation?

This news article from 2010 discusses how a GPU can be used by a virus to avoid detection by common anti-malware/anti-virus software. The idea is to obfuscate the virus payload and leverage the GPU's ...
2
votes
1answer
291 views

Lamp server sandbox for testing malicious php script

Fortunately despite recently becoming a full time web developer, security is something I take very seriously. There's a developer that I work with who's system was recently compromised with obfuscated ...
4
votes
1answer
237 views

Key Management for PCI and Payment automation

We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : ...
3
votes
2answers
437 views

Password Manager - id_rsa as key file

I am finally taking the plunge and employing the use of a password manager. After some research I have selected KeePassX. My plan is to replace all my web passwords with random 16 character strings. ...
3
votes
1answer
78 views

Signing CertificateRequest with special privileges

Well, I am not sure if I specified the question correctly. While I was browsing web, I checked several SSL certificates and noticed that even Root Certificate doesn't have set all attributes of ...

15 30 50 per page