4
votes
1answer
563 views

Anomaly Intrusion Detection relevant features

I am researching on Anomaly Intrusion Detection to implement one. At this phase, I am searching for relevant features to network traffic. I found 41 features from KDD CUP'99 project (the paper: WENKE ...
4
votes
1answer
1k views

Replacing weak SSH fingerprint algorithms

Even though MD5 has been broken for years and its vulnerabilities have been used to create real-world rogue X.509 CAs and other horrible things, OpenSSH and PuTTY still use MD5 as the default public ...
9
votes
1answer
1k views

Is HSTS (Strict-Transport-Security header) for HTTP or HTTPS?

Is the Strict-Transport-Security header intended for HTTP or HTTPS? What I mean is, do I respond with this header on a HTTP connection which in turn tells the browser to use HTTPS only from that point ...
3
votes
2answers
262 views

CVE-2012-4448 pci-scan

I'm currently failing a PCI scan due to CVE-2012-4448 The recommended resolution from Security Metrics is to upgrade to a wordpress version higher than 3.4.2, however currently that is the highest ...
11
votes
2answers
25k views

Advice on what to do after being hacked? [duplicate]

After running a system scan earlier today, I found that my computer had been infected by a trojan horse. My reason for running the scan was because Windows kept shutting down and then recovering. ...
32
votes
11answers
4k views

Is it safe to use a weak password as long as I have two-factor authentication?

I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
-1
votes
1answer
505 views

When I open my gmail account,this shows,does this mean my account is hacked? [closed]

When I open my gmail acccount I see a dialogue box that reads like shown in the image?Does it mean my account is hacked?
4
votes
2answers
208 views

Secure Wireless Implementations

For quite a while now, I have grown to treat wireless networks as inherently insecure. As part of this, I put them on the public Internet and require VPN connections to access company resources. My ...
3
votes
2answers
267 views

Secure login across two web apps

I have an requirement to implement cross-domain login for two web apps (APP1 and APP2) so that a user can access APP2 once they have logged into APP1. APP2 needs to know an ID of the user who is ...
3
votes
1answer
217 views

SRP: Can the client authenticate using only the stored hash?

Based on the description of SRP, it seems that it would be possible for a client application to cache the hashed password x and reuse it for subsequent authentifications. The actual password p doesn't ...
3
votes
3answers
233 views

If I host a web form which submits CC details to a provider, are there PCI implications form host?

I'm wondering if anyone has any thoughts on a specific question I have. I read a lot about systems that 'store, process, submit' CC data requiring compliance. If I host a form on my website which ...
2
votes
1answer
550 views

Apache2 SSLCipherSuite - why use anything other than high?

I am currently participating a lecture in my university that is called "system architecture and security". One part of this semester is to setup our own slice and hack each others. We also have to ...
0
votes
1answer
354 views

Cloud application Vulnerability assessment

Do you think server side assessment of application is important when application is hosted on a cloud like Amazon? Assessment on software used to host the application not the actual application, e.g. ...
2
votes
1answer
152 views

Is there a website or free downloadable program to identify and remove malware from an ISO file?

Is there a website or free downloadable program that allows a user to identify and remove multiple types of malware from an ISO file?
3
votes
2answers
101 views

SPF and Articles from News Sites

Suppose I activate SPF in my environment. I am now strictly enforcing SPF records from sending domains. There are many execs in the company who like to forward news stories from CNN and such to ...
5
votes
4answers
791 views

Is JavaScript self-injection dangerous?

I have a toy web application that can be described roughly as a per-user key-value store. After logging in, the user can view and modify her set of key-value pairs. The keys and values are stored in a ...
12
votes
3answers
4k views

Can you extract memory contents from a hibernated Windows machine?

In a recent discussion about hardware hacks, attacks surrounding Windows hibernate popped up. I am not entirely convinced that it would be viable to get stuff out of the memory saved to disk. When ...
3
votes
2answers
1k views

Tools for analyzing Perl 5 code? [closed]

I'm looking for good tools for analyzing and/or detecting security issues in a large software project written in Perl 5. It could be static or dynamic analysis. I know that Perl is undecidable, but ...
-5
votes
6answers
12k views

Will antivirus detect all keyloggers?

Our company schedules Security Training courses for our personnel. In order for us to test them, we develop code such as keyloggers which we email to our personnel to detect stupid personnel, and of ...
5
votes
3answers
267 views

Does a 'reset password' website facility give away too much information?

If a website has a reset password facility (which will e-mail the account holder a reset link), does this facility reveal too much information by allowing someone to probe who holds an account by ...
3
votes
2answers
921 views

User authentication + database encryption with same password

I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES ecnryption key from a more ...
1
vote
2answers
751 views

Is dual control password is a feasible way to secure against unauthorized login?

I see that some organizations practice dual control password especially when it comes to critical system logins, etc. Is it feasible to implement such policy considering certain trade off such as ...
-1
votes
1answer
66 views

Are there any benifits to backing up when you have all the original installation disks? [closed]

Is there any benefit to doing a full system backup or differential backup if you have all the installers for programs you use and no special settings are needed? Most of my data files can be deleted ...
3
votes
4answers
477 views

Login form authentication logic

I am building my login form action, and I want to make sure my logic is solid and as secure as possible. 1.) First I check if the provided e-mail address exists in database, if not, I show a generic ...
2
votes
3answers
1k views

“Don't serve content over HTTP” - what does this mean, exactly?

In doing some research regarding SSL, I came across this topic. One of the common suggestions was not to serve content over HTTP. What does that mean from a website development POV? Referencing ...
21
votes
2answers
5k views

How can vending machines be hacked? And how can I prevent it?

I am developing a vending machine and want to make it secure. In a comment to my previous question, @Polynomial said "Vending machines (and similar devices) can often be pwned via buffer overflows on ...
2
votes
3answers
1k views

Why are triggers not often used to secure a database?

I did an intern for a company becoming PCI compliant and instead of using triggers to prevent SQL injection, I went through 1000s (if not more) lines of web-app code and called functions every time ...
2
votes
1answer
149 views

What metrics are available on malware?

All the main AV have a risk rating or severity level, how do they determine what is "low","high",etc.?
5
votes
1answer
1k views

UPS my choice — How can I access my public records?

I was signing up for UPS my choice and they asked me some security questions. It asked me questions that signified that it was able to figure out: Who my father is and when my father was born. My ...
6
votes
3answers
197 views

Getting automatically logged in to others session via Wi-Fi

Recently, I experienced a very strange behaviour on our Wi-Fi network: we share a Wi-Fi network using a simple router. One of us pays the bills and he's the one, who got the management account from ...
3
votes
2answers
548 views

Can a whitespace regex character be used to perform a javascript injection?

if I want to validate the input of a <textarea>, and want it to contain, for example, only numerical values, but even want to give users the possibility to insert new lines, I can selected ...
2
votes
1answer
213 views

Exposure risk of knowing only social security number?

Up until recently I was under the impression that the social security number was insufficient information to perform identity theft, and that in practice you will at least need the victim's SSN and ...
15
votes
4answers
15k views

What type of attacks can be used vs MongoDB?

I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
0
votes
1answer
270 views

Malicious PHP code can run in cache. Solution?

I have a module that I cache some details (w/c is from the input of the user) to lessen the load of my database The way how I cache is by creating html page with the details of the user using ...
2
votes
3answers
330 views

Passwords In Securing Network Devices

I don't do anything with corporate IT and networking, but I know enough to handle and get networks going. Anyway, something I ran into in my travels when it comes to the occasions of working on ...
5
votes
2answers
1k views

Spoofing USSD messages

I'm looking into USSD messages for a project I'm currently working upon and hoping someone can shed some light into spoofing. Firstly, I know it should be possible if you have the relevant ...
2
votes
3answers
2k views

Key Exchange using PKI

I'm new to the field of cryptography and trying out a sample program to understand PKI key exchange mechanism. I tried creating a self signed certificate using openssl openssl req -x509 -nodes ...
7
votes
1answer
314 views

Encryption in an embeddded system

After accepting an answer to my previous question, I am beginning to have doubts. I want to updating pricing information in vending machines by inserting an SD card with new pricing. I have to ...
3
votes
2answers
416 views

Is my email client violating my privacy?

There are many ways that emails can be used to violate the privacy of the recipient (Return-Receipt-To:, web bugs, iframes loaded from an external page, and other email tracking methods). It may be ...
1
vote
2answers
478 views

Seeking lightweight encryption - shareable between Delphi & C

I want to encrypt a text file in Delphi & decrypt it, line by line, in C on an embedded system which does not have much RAM (so, only one line in RAM at a time). FOSS must be available for both ...
2
votes
3answers
212 views

Does requiring users to fill out a PDF w/ CC information and mail it back violate PCI compliance?

I'm attempting to place an order with an American company and I reside outside of America. Upon placing the order (and already submitting payment) I received an email asking me to fill out a PDF ...
3
votes
3answers
1k views

Online security check via command line

My scenario is that I have a VPS with Apache (mostly for development of my own projects) accessed via SSH; and I time to time I would like to do a quick check just to be sure that there's no potential ...
108
votes
8answers
7k views

Attacking an office printer?

I did an nmap scan on an advanced office printer that has a domain name and is accessible from outside the corporate network. Surprisingly I found many open ports like http:80, https:443, and ...
23
votes
4answers
1k views

How can a web application protect users when the browser doesn't support HSTS?

HTTP Strict Transport Security (HSTS) is a very useful feature at preventing OWASP a9 violations and attacks like SSLStrip which try and prevent the client from making a secure connection. This ...
4
votes
3answers
744 views

Are stack & heap overflow exploits no longer effective?

Do all new OSes implement the no execute bit in order to overcome vulnerabilities that could be used to execute malicious code? for example, is it implemented in Win7? Does that mean that the ...
3
votes
5answers
1k views

How will microvirtualisation change the security field, if at all?

Will this reduce the number of exploitable vulnerabilities in common operating systems? Will the only path in be to exploit the VM itself? Marketing blurb from Bromium's website below. ... ...
-2
votes
2answers
914 views

What software can I used to edit and replay packets? [closed]

From the Wikipedia article on anti-replay: The main goal of anti-replay is to avoid hackers injecting or making changes in packets that travel from a source to a destination. Is this commonly ...
0
votes
2answers
127 views

How should permissions be stored?

In a system where users have multiple permissions that may overlap (i.e. "Write" might not include "Read" etc.) what is the best way to keep them in the database? Both in terms of security and ...
2
votes
1answer
2k views

File upload vulnerability: rename solution?

I have a module in which the user can upload images. I searched Google for different kinds of upload attacks checking dimension of the image (still vulnerable) checking of file extension ...
1
vote
1answer
124 views

Determing and deciphering an encrypted drive (knowing the password)

I have a Western Digital external drive (my passport essential 500GB), which comes with a little software that allows you to encrypt your data (which I did sometime ago). Unfortunately, this software ...

15 30 50 per page