0
votes
1answer
31 views

Is there any problem using empty salts with PBDKF for this purpose?

The aim is to generate a secure key for symmetric encryption. I have a master password, from which I want to generate the key for symmetric encryption, in order to encrypt other passwords. The idea ...
6
votes
3answers
82 views

Automatic detection of a compromised web server

I'm trying to figure out if it is possible to automatically detect the the fact that the HTML or javascript files on a server have been tampered with or changed by an attacker. Our website, say ...
4
votes
1answer
106 views
+50

How to reject e-mails spoofing your own domain targeting your employees at Office365?

One problem Office365 users deal with is that an external SMTP server can spoof the domain of an organization and send e-mails to the domain users; where the e-mails appear to be from employees of the ...
1
vote
0answers
50 views

Can TLS provide integrity/authentication without confidentiality

It was a bit surprising when wikipedia has switched to TLS because we all know it's public information available to anyone, but I suppose that the real purpose for that is to provide ...
7
votes
0answers
211 views

where did they get my Gmail address?

I pointed my browser at the website of a web developer I barely know, and the page returned was his home page, with the message "Welcome myname@gmail.com!" Whoa. Where did it get my Gmail address? ...
1
vote
1answer
25 views

Envelope Encryption with asymmetric keys vs KMS

In Envelope encryption a symmetric secret key is used to sign the data and then another key is used to encrypt the secret to produce an encrypted secret key. The encrypted messages is packaged with ...
1
vote
3answers
35 views

What is a typical defense mechanism/setup against flooding back-end sql calls?

I'm interested in figuring out what is a typical scenario of preventing the following attack scenario: Back-end has as SQL server. Front end a simple "Hello World" HTML that passes an input (say user ...
0
votes
0answers
19 views

Teamviewer webclient does not use https

Using fiddler, I noticed that the traffic generated by the teamviewer webclient is plain http. Is that a security concern given that teamviewer themselves claim that https is used?
1
vote
1answer
48 views

Choosing token over Session or vice versa?

I wanted to build a secure user interaction to the server, but I stumbled upon using either token or session. Here are couple of options that I thought about: I learned JWT, built a token, and send ...
-2
votes
0answers
7 views

Network setting for kali linux host on virtual box [migrated]

I am running Kali Linux on virtual box. I do not have an external network adapter on my laptop. I am currently learning to use Metasploit. In order to set the payloads I need the IP address of Kali ...
3
votes
1answer
53 views

Bi-directional authentication in OpenVPN

I have an OpenVPN gateway setup. A CA was created on the same server with Easy-RSA. Each OpenVPN client has its own certificate-key pair issued with the abovementioned CA. Server has its own ...
0
votes
0answers
12 views

What is the goal of sign a key in BrowserID certificate?

I'm learning about the Mozilla Auth. it has an implementation of SRP protocol in https://github.com/mozilla/fxa-auth-server/blob/master/docs/overview.md and his client; example is ...
0
votes
0answers
28 views

“encrypted using an obsolete cypher suite” - After using IIS Crypto best practices [duplicate]

I've used the IIS Crypto tool, using best practices and I still get "encrypted using an obsolete cypher suite" In Google Chrome. There's so many various cypher suites, and I'm yet to find a ...
0
votes
1answer
72 views

Discovered a security flaw in a company, what to do? [duplicate]

While playing with a site I have discovered a huge security problem. The thing is, if I tell them about it they might question what was I doing in the first place. I was trying to hack my friends ...
9
votes
2answers
721 views

Firewall on smartphones

PCs communicate with the help of ports,eg. HTTP communication takes place over port 80. Due to the nature of these ports, an open port is an avenue for an attack. That's where firewalls come in. The ...
0
votes
0answers
28 views

Facebook app permissions

According to an answer to this question : Bypass app permissions, I changed by curiosity the application permission of Facebook and Messenger for the camera to always ask. I'm using CyanogenMod 12.0. ...
0
votes
1answer
27 views

Windows SQL Server Intrusion Detection [closed]

I'm looking into Snort to carry our basic intrusion detection, but finding it hard going. What other Intrusion Detection software is there that is good to use for SQL Server?
2
votes
2answers
98 views

What is this URL Injection piece of code mean?

I don't know if it's considered or not to include a single piece of code that might be malicious. But recently my site was a victim of some URL injection. I was wondering if anyone can tell me what ...
2
votes
3answers
60 views

Bypass app permissions

I'm annoyed and actually scared by all the permissions that I have to grant the applications that is running on my Android phone. Is there is a way to bypass them ? Let's say my microphone. My ...
-1
votes
1answer
24 views

need reference for pen testing test cases for network testing and application testing [closed]

Any one can help me to find any reference for penetration testing test cases, or penetration testing examples.
0
votes
1answer
19 views

Is it secure to have an iPad app run a webDAV server on localhost without authentication?

I have two iPad apps running on the same device. One is hosting a webDAV server on http://localhost:8080 without any authentication (the server is active whilst the app is foregrounded, and for a few ...
0
votes
1answer
35 views

BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”

Note: Below are some information from searching around the Internet. To skip to my main question, go to the last line of this post. I've been searching around on how to change the Volume Master Key ...
4
votes
2answers
50 views

Is it a good practice to use certificates as a mean of client identification in a cloud environment

My software system is running a cloud infrastructure where having Linux machines VPN into OpenVPN gateway is a setup requirement. Also, there may be cases when software on the aforementioned Linux ...
-5
votes
0answers
53 views

How can i crack a windows desktop software? [closed]

I am a student of information security and forensics. I need your help. The professor gave us an assignment/project to break into a desktop windows software. Each time i open it, it asks for a license ...
3
votes
2answers
632 views

Determine salt length from hash

I am writing a basic Unix password cracker in Python that would work for MD5, SHA-1 and SHA512. I know that the salt in MD5 correspond to the 2 first chars of the encrypted password, and thus I ...
0
votes
0answers
23 views

How to test rootCA for issue subCA certificate

Can I check rootCA for issue subCA test certificate before issue real subCA cert? If rootCA issue test certificate and revoke immediately, then all operation log is recorded. Do this compliance with ...
1
vote
1answer
45 views

Is there a way to sign information by when it was made? [duplicate]

Looking at this question ("Is it legal to use an online logbook?") from Aviation SE, I'm wondering if there is a way to sign information in such a way that: It ensures that there was a certain time ...
2
votes
0answers
30 views

Low-resolution account enumeration with Office365

I am interested in the intersection of account enumeration and single sign-on. Often, there will be SSO-only and non-SSO users alongside each other in an application, and in terms of improved ...
1
vote
2answers
48 views

Confidentiality and privacy

I understand that the confidentiality aimed at protecting access to the system data, while privacy aimed at protecting access to the person data. Now, could we consider anonymity as a ...
-1
votes
2answers
108 views

Run our own Certificate Authority for internal use only: safe or not? [duplicate]

According to the guide at How to Run Your Own Certificate Authority, my organization have a plan to issue our own digital certificates for internal use only (the managers will sign PDF documents to ...
-3
votes
0answers
30 views

Private Security Interference Programs? [closed]

To what extent are Gmail 'plug-ins', used in Private Security Interference Programs? Do Private Security Companies get a bit excited and 'inadvertently', break the law running interference in the VIP ...
0
votes
1answer
36 views

Getting a certificate warning for one email but not another

When I log into outlook.com using Chrome browser, I get a certificate warning for one account but not another. One says my connection is private, the other says it "may not be private". Here are the ...
1
vote
0answers
46 views

How to know which extension or software is causing ads in Chrome? [closed]

Starting yesterday, I noticed that something weird is going on with my laptop. After unlocking my laptop I found that the empty Chrome pages that I opened are getting redirected to ads. I am running ...
2
votes
1answer
44 views

UDP sockets open on all ports

I'm on osx. netstat -an -f inet gives me a bunch (around 10) of entries like these: ... udp4 0 0 *.* *.* udp46 0 0 *.* *.* ... In my ...
-3
votes
1answer
62 views

How to see all incoming and outgoing traffic of other nodes while on a LAN?

I've got two computers. A & B. While sitting on the computer A how can I see the incoming and outgoing traffic of computer B? Or can I? Note: Please try to answer in a non-technical language as ...
-1
votes
0answers
41 views

What are some common attacks to hack all nodes on a LAN? [closed]

Imagine there is a room with 20 different computers, all connected with one router. What are some common attacks that hackers could perform while sitting on one computer to hack the others?
1
vote
0answers
23 views

How to wipe disks before encryption with dm-crypt if CBC or XTS is used internally?

First, please forgive me if I'm posting this question to the wrong community. Feel free to migrate this post to the right community if I was wrong. I'm quite new to whole disk encryption (but not ...
-1
votes
0answers
37 views

Popup ads in Android app [closed]

I made an Android application and one of my user is complaining that he is seeing the pop-up ads with in my Android application. Could you help me how to track down what is causing this? As this is ...
0
votes
0answers
17 views

Is Android WLAN MAC Address vulnerable? [duplicate]

What can a person do if he/she has WLAN MAC Address of my Android Device? What can be done to save my personal information?
2
votes
1answer
82 views

Vulnerability of Java software

The JAVA software provided by Oracle is a security mess. But what exactly, in that software package is the most vulnerable. If someone install it and disables the Java plugin in the browser, will he ...
-1
votes
0answers
23 views

Trustzone working in detail [closed]

I want to know that how the trustzone technology actually works and how one can break the security to enter the secure world. The whole working I have my project on this topic.
1
vote
1answer
58 views

Best way to ensure integrity of encrypted data which is kept in a public place

I need to keep sensitive data in a de fact public place (i.e. with a user, e.g. in a cookie) and only there (no copy or hash of that data should be kept on the server). The data was encrypted AES/CBC ...
-3
votes
1answer
65 views

How to sell a new idea – “100% secure communication”, feedback wanted [closed]

I have thought of an idea (new product) to have 100% secure communication between 2 parties and would like your feedback/ideas on how to sell it. Oh, before you start that there is no such thing as ...
1
vote
0answers
36 views

Details related to the ZIP algorithm used in PGP message encryption [closed]

I am very new to PGP. PGP encryption works with hash function, asymmetric encryption, symmetric encryption and a zip algorithm (LZ77). What I know is that the zip algorithm is used to reduce the ...
0
votes
0answers
7 views

How do I bypass “Cannot Delete; file open in another location”? [migrated]

I've been trying to re-install an application, but of course, you have to delete it first, right? Well wrong in my case. Ive been trying to delete it, even going as far as going directly into file ...
0
votes
0answers
26 views

Secure HSM connectivity, direct or LAN?

What would be considered a better and secure setup for HSM: A direct connection to the server (point-to-point) Having it in the LAN and configuring VLAN?
2
votes
3answers
410 views

Password security with short passwords

I know that a long password is a good password. However, some sites require short passwords e.g. exactly 8 characters long. Under those limitations, what is a good method of creating and memorizing a ...
-1
votes
0answers
23 views

Is this legally reverse engineering - unsecured API [migrated]

Is it (in a legal sense) reverse engineering to 'hack' into a completely unsecured API? Simple REST API used in Android app No SSL (just strait HTTP) Passwords are sent in plain text over this ...
0
votes
0answers
29 views

Does anybody recognize the files below that are in my tablet and cell phone? [closed]

I have few strange files in my tablet and cell phone that comes back no matter what kind of "cleaning" I have done Does anybody regognize these files? What could they be? ...
0
votes
1answer
45 views

Security characteristics through ISO 25023 standard

Could you please help me to clarify the following: ISO 25023 standard divided security into the following 5 characteristics which are: Confidentiality characteristic (divided into) -----> Access ...

15 30 50 per page