2
votes
1answer
51 views

What are good precautions to take before cleaning an infected website? [duplicate]

I have to work on infected websites once in a while, and I'm wondering if there are some good practices to keep my computer safe. I use my personal computer for work, so I'd like to take precautions. ...
0
votes
0answers
16 views

RFID Security - Copying/cloning cards [duplicate]

I've seen some mobile apps coming up that scan RFID cards and clone the signal so that you could use the phone in place of a card. I was under the impression that most cards implemented something like ...
4
votes
2answers
56 views

What's the best way to transform sensitive account numbers

I work on a web application that manages information about transmission setups and processes client transmission statistics to generate billing charges for the services used by these clients. The team ...
1
vote
1answer
25 views

What is the difference between certified and non-certified drives for Windows To Go?

Microsoft suggests "certified drives" for http://www.microsoft.com/en-us/windows/enterprise/products-and-technologies/devices/windowstogo.aspx, but it appears that other than confirming that these ...
0
votes
2answers
59 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
10
votes
1answer
281 views

Torrent “bad seed” attack by Sony, how does it work?

Sony recently saw a large amount of data stolen. In order to prevent the stolen data from being spread using torrents, they are doing what was called a bad seed attack. What is this attack? Is this a ...
-1
votes
1answer
38 views

Blocking Tor By Trying to Connect to an Entry Node [closed]

So, I had an idea on how to block Tor (or similar tools) from being used on your network (or ISP, which is perhaps more relevant, considering Tor's mission). I'm assuming it wouldn't work (based on ...
1
vote
2answers
37 views

How to avoid referer information leakage during password reset

Most password reset systems involve emailing the user a one-time link that lets them reset their password. The token needs to be in the URL, as most email clients do not allow HTML emails to perform ...
3
votes
1answer
43 views

How to exfiltrate data over remote desktop

I sometimes come across systems that are segregated in a way I know to be flawed. The arrangement usually looks like this: There is a general IT environment, which follows best practice: patching, ...
1
vote
2answers
37 views

Websites visited on a VPN network

My residence provide wifi and I'm using my personal computer to connect to it. I use a login and password to have access to internet. Some websites are blocked on it. Sometimes I log into VPN(using ...
2
votes
1answer
68 views

Is it possible for an open-source website be secure?

Lets say I want to develop a website with a community, and so I want it to be open source. However, this website isn't going to be static. However, it seems that revealing the database connections ...
1
vote
1answer
44 views

What are the risks of encrypting a database with a single symmetric key

An application is required to store sensitive data* on each user. Additional columns are added to the database which store cyphertext encrypted on the application server. The algorithm of choice is ...
1
vote
0answers
32 views

Telling the difference between a prepaid card and credit/debit card

In order to stop people abusing free trials, we can make sure new users are not reusing data from existing users and therefore not just signing up with a new account every month. It is reasonably ...
1
vote
3answers
83 views

Why is my IP address not my own?

When I search the geographic location of my IP address why does it show multiple cities and states that are not my own? Does this indicate someone else is sharing my IP address?
2
votes
1answer
27 views

For PCI complience, does every request need to be logged regardless of how it effects system performance?

Our cloud based service is currently undergoing changes with view to making it PCI compliant. It is a high throughput service, and there are concerns that enabling the right amount of logging on our ...
5
votes
2answers
77 views

Is e-mailing personal information significantly riskier than transmitting the same information another way?

I've been asked by bankers, school administrators, insurance agents, car salesmen, realtors, you name it to send them all kinds of information over e-mail over the years. Everything from my address ...
2
votes
2answers
65 views

Can a virtual machine be used instead of the host?

I was thinking of using a Debian guest as my main 'host' instead of my actual host (Ubuntu). Do you think this will have any advantages in terms of making it difficult for digital forensics to ...
5
votes
1answer
210 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
2
votes
1answer
139 views

Reverse Engineer this basic Hash using known answer?

Little background: I forgot one of my CCTV accounts password, so used the admin account to create a new one. However I can't access the old one as it's not possible to change a user account password, ...
4
votes
1answer
78 views

Should I be worried about this url request I received on my site?

I was checking the weekend logs of my IIS server and noticed a strange request which was blocked: ...
-1
votes
0answers
66 views

What are the likely pros and cons of this new network security device? [closed]

The people from WAW Technologies who launched the project describe this Linux appliance as the "The Swiss Army Knife of network devices". ...
8
votes
1answer
58 views

Security measures and anti-virus on server to mitigate acting as a propagation vector

We have a web application for which I've been asked to add the ability to let users upload documents that will then be visible and downloadable by other users. Those documents will typically be images ...
2
votes
0answers
36 views

HMAC-SHA256 Transaction signing [closed]

Can rfc6238 be used for transaction signing by concatenating the random seed string with transaction details (such as amount and target account number) ? Could a transaction authorization 8-cipher OTP ...
-7
votes
0answers
25 views

Black assessment tool for JavaScript [closed]

I have done many assessment on web application, in which I used various commercial tools. But I always did prefer to human intelligence. So could anybody will tell me what tools I can use to do black ...
8
votes
1answer
52 views

CSRF in ASP.NET

There's this "change password" ASP.NET form that has both event validation and viewstate enabled. There are no specific anti-csrf tokens. From I understanding, in order to execute a successful CSRF ...
7
votes
2answers
67 views

AV detection of signed malware

With the massive Sony leaks (including their private keys/certificate), i was wondering: How do major AVs deal with signed binaries? ie: Does it influence their detecting ability of the signed ...
-1
votes
0answers
30 views

honeypot configuration (honeyd) - finding attack [closed]

I want to config a local honeypot to find some attack, to do this I have installed honeyd on Ubuntu12.04.4 which is installed on my vmware. here is my config file: ### Linux Suse 8.0 template create ...
17
votes
4answers
2k views

Is sending plaintext passwords to a SQL Server database a security risk?

I have a database which has stored procedures which take plaintext passwords. It hashes them and inserts them into the DB. If an attacker has access to the DB connection, it is possible to intercept ...
57
votes
7answers
19k views

Is it possible the person sitting across from me at Starbucks was trying to hack my laptop?

I was using my laptop at a Starbucks on a table, and a person was using a laptop on the same table across from me, a couple seats to my side. He flicked some plastic thing across the table towards my ...
15
votes
2answers
826 views

Distance between two passwords

It is known that people reuse their passwords across different sites. The reuse can be done in two ways: using exactly same password for two different sites, slight modifying the password of one ...
9
votes
1answer
145 views

Is TLS in Tor useless?

I am trying to optimize the Orchid Tor client library for my needs and noticed that every connection with every node uses TLS with turned off certificate verification. Actually there are no TLS ...
0
votes
4answers
77 views

nmap mac os lots of questionable ports open

Ive been recently trying to lock down my network at home and suspect that someone has hacked my linksys router because port 3128 seems to be open through the router and I have no knowledge setting or ...
-4
votes
2answers
136 views

Using my own encryption instead of https in app

I am writing a program that uses a webserver as a backend for communication between different users. Is it okay to use my own encryption (such as ...
48
votes
6answers
5k views

Does injecting querystring values directly into HTML pose a security risk?

Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this: www.site.com/ajax/ads.asp?callback=[text injection] So filetype is application/json, and I ...
2
votes
1answer
46 views

electronic voting system

Was looking at cryptocurrency and how, as a non techy, to get involved when I began thinking about the security of it being developed to undermine the stranglehold bankers have on economy and the ...
-5
votes
0answers
22 views

differences between various screen sharing/remote desktop access softwares [closed]

I am looking for a brief explanation about the major differences between various present day screen sharing/remote desktop access software. It would also be helpful to see a short note about all ...
-8
votes
2answers
90 views

I need to hack my website [closed]

I'm writing a simple web framework for a project of mine and need to ensure that the websites it produces are secure. In order to check this I thought I might as well just try and hack my own website ...
-3
votes
2answers
81 views

Do website owners know what keywords a visitor typed in google search to get to their site? [closed]

Does google give the info to website owners / administrators... is I guess how it would work?
8
votes
3answers
115 views

What are the risks to a network if a single computer is compromised?

If I open up a dedicated server on my home network to accept incoming connections (HTTP, SSH, etc) and that machine is compromised by an outside attacker, what are the risks to other devices on the ...
36
votes
4answers
4k views

Can a neighbour who installed my router access it?

I have a bit of a security concern. I'm concerned that my neighbor sees everything on my computer, web sites I have visited, my passwords, etc. Background: He installed a Linksys router in my house ...
4
votes
1answer
53 views

Would DLL hijacking work with load-time linking?

I was wondering if DLL hijacking would work with all types of linking or just run-time linking. I hear that malware uses it and wanted to know how it works
4
votes
2answers
38 views

monitor port scan on the same segment

if theres a port scan on the same segment and it does not reach the firewall at all, it is not detectable by anything. is there any solution to that ? maybe using the windows fw on ach workstation to ...
0
votes
2answers
62 views

How to call webservice securely in Android

Hello I am working on an Android application in which I'm required to execute a few https web service calls. All my web-service URLs and Web API KEYs are in the code plus the IP address of the server. ...
5
votes
3answers
132 views

prevent session hijacking in PHP

I wrote the log In/log Out scripts of my web page and when the user logs in I store in the $_SESSION variable the user agent. Now each time a page is loaded I check if the user is logged in or not and ...
1
vote
2answers
48 views

How to create secure portable firefox?

When I need to access our school web portal I need to access it with my certificate (pfx). Since certificate needs to be installed in browser, I'm thinking (out of security reasons) to create a ...
0
votes
1answer
19 views

Collecting Information from CWE and MSB to write proof-of-concept

I am currently interested in knowing how to write some proof-of-concept code for recent vulnerabilities that are released every month by the CWE and Microsoft Security Bulletin. These websites list ...
4
votes
2answers
82 views

Is biometric passport safer than old-fashioned passport

Our government encourages the citizens to move to "smart passports", which contain biometric data such as fingerprints. They say it is safer for us because it prevents identity thefts. On the other ...
0
votes
0answers
6 views

Unable to verify the certificate from startSSL? [migrated]

I'm new to openSSL and I'm unable to verify the certificate from startSSL. The command that I use to certificate the key is : openssl verify -CAfile ca.pem mydomain.com.crt the error I got was : ...
1
vote
1answer
37 views

Are there theoretical attacks against ECC Digital Signatures?

I was asked to do a research about attacks on various digital signature schemes. There is one thing that bothers me for which I could not find a direct answer. For digital signatures that are based ...
4
votes
1answer
149 views

Are session keys just the symmetric keys?

From what I read, in TLS, the master secret is used to generate the following: a symmetric key to encrypt the SSL records. an IV (initialization vector) a key for Message Authentication Code (MAC) ...

15 30 50 per page