1
vote
1answer
35 views

How someone would routinely email out a Google Doc [closed]

I have seen an issue where an account has been compromised and someone is routinely emailing out the contents of a google doc to another gmail account. The account password has been changed and the ...
-2
votes
2answers
114 views

Is it illegal to access a public file that contain private information? [closed]

There is a website that I was testing to see if they have any vulnerability. To my surprise I found that one of the folders, like /docs with index of /, and they have a file that will contain all ...
4
votes
2answers
74 views

What are you doing if you notice a MITM attack against a Linux server? [closed]

I got this question at a job interview, but I did not know the answer. I think they expected some shell command or packages, which can help react to the attack. Assume that, you are a system admin and ...
0
votes
0answers
4 views

JWT Signature Validation [migrated]

I want to verify the JSON payload for Sender using shared key. I went through some sites and came up with this simple code to just verify only signature. import java.security.InvalidKeyException; ...
0
votes
1answer
75 views

Safely encrypting data received through HTTPS

I am receiving sensitive data over an HTTPS connection and need to store this on disk, encrypted so no one can tamper with it, but for reading later on. Each user in the system has a password. The ...
2
votes
1answer
54 views

Tell if someone accessed my filesystem

In the organization I work for, the computers are connected in a network, and I can access each PC's filesystem via '\' if I state the "Master User" credentials, once the login window pops up. since ...
0
votes
1answer
108 views

Crypto Ransomware - How decryption is done when user accept to cooperate?

When you have been "hacked" and you accept to pay for decrypting your encrypted files, how the attacker do the job ? I understood that a symmetric key is used, itself encrypted by the attacker public ...
-2
votes
0answers
24 views

Security Tool To Control File Transfers on a Virtual Machine [closed]

We are a small small software development company. I want to create for each developer a virtual machine for the developments. Only the virtual machines will have access to the source codes which are ...
0
votes
0answers
24 views

Utimaco CryptoServer Simulator [closed]

I am trying to simulate an Amazon HSM using Utimaco CryptoSrever simulator, but I don't know how to do. I have been searching manuals in Utimaco Site and in the downloaded zip but only I have found ...
17
votes
6answers
2k views

What does “random” mean in the context of password creation?

Disclaimer: as you will see from my question I'm a total outsider in this subject, just very curious. I was wondering how easy it would be to crack a password-protected RAR5 file, and I found many ...
0
votes
0answers
6 views

Key Confirmation Attack [Key Distribution Center (KDC)] [migrated]

Okay this is how I understood it according to this: Alice A establishes a connection to KDC and prepares for session key Exchange R1 A encrypts the request with her key kA(A, B) meaning "need a ...
1
vote
0answers
38 views

OpenSSL: Allow CBC ciphers for TLS but prevent for SSL3

In my server application using OpenSSL, to prevent the poodle attack, I added an option to fully allow/prevent SSL3 protocol. SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2); //Prevent SSLv2 ...
1
vote
0answers
68 views

How to remove yellow tracking dots from a document?

Assume I have a document which I supspect to have yellow tracking dots. How can I remove them while keeping the actual information on the document? Is making a b&w copy enough? Is the copy machine ...
21
votes
2answers
2k views

Can a Trojan hide itself, so its activity doesn't appear in task manager process? [duplicate]

Can malicious software hide itself, so its activity doesn't appear in the list of processes from Task Manager? Can it hide itself so when someone is controlling your computer, even if you open Task ...
1
vote
2answers
326 views

XSS when some keywords are prevented on the server side

When I scan website with burp suite pro, I encountered a XSS. This XSS is <a b=c> When Burp suite test other payloads that contain keywords like script, alert, onerror, this parameters ...
-1
votes
0answers
21 views

Https and FTPS security [duplicate]

Since booth FTPS and HTTPS are protocols over SSL/TLS, is it correct to assume that both are 100% equivalent in terms of security? Or am I missing something?
-4
votes
0answers
30 views

injection of a malicious php file to the webroot folder [closed]

an attacker has inject an php file to the webroot folder where all the files and folders relating to many websites are reside. the php file can upload any file to current working directory of web ...
2
votes
0answers
19 views

What does “PIN encrypted under LMK” mean?

What does PIN encrypted under LMK mean? From what I understand the Local Master Key is only there to encrypt other keys. I was reading some code and I saw function names like encryptClearToLmk or ...
1
vote
0answers
24 views

Website Link in Signature corrupted while transmission [closed]

We placed our website link in our email signature for last one week. This link apparently converted into something corrupt, so all our mails gets bounced. We scan our web server files using ClamAV ...
25
votes
2answers
3k views

Is Clickjacking a real security vulnerability?

As I understand it, this is how an attacker would exploit clickjacking: Create a new website malicioussite.com which includes my site in a frame, but overlays malicious input fields or buttons over ...
3
votes
2answers
78 views

What is considered an acceptable, secure method of remotely connecting to a Linux system?

Given that VNC and X11 were not developed with security in mind, what do people typically see done to remotely connect to a Linux system where a GUI is required. While SSH access alone might be ...
1
vote
2answers
90 views

security concern of user submitted bash command

Recently I am building a web service that user input will be used to run a bash command on the server side. What are the security problem I need to take care? Right now I find one that user could ...
0
votes
2answers
51 views

Would Insecure Direct References and SQL Injection be solved by using Row-Level Security and Per-User Connection Strings?

Regarding the following OWASP Vulnerabilities: Insecure Direct Object References By that I mean letting someone see /account/123/not-theirs (this could be the wrong reference I'm using above). SQL ...
0
votes
1answer
35 views

What could be the scope of ISO 27000 standards?

If a company wants to certify against some of ISO 27000-series standards (let's say ISO 27001 and ISO 27005), what could possibly be certified? I mean, is it IT processes in general in the ...
0
votes
3answers
98 views

Is it really necessary to hash user passwords when I already protect my database against SQL injection? [duplicate]

I'm developing a school, I just applied all the SQL injection protections that exist and database security, administrative roles, parametrized queries, sanitize input from the client. But FOOL ME! I ...
0
votes
1answer
21 views

how does mdm (mobile device management ) work in byod environment to control the camera?

what i want to know is how mdm (mobile device management ) works in byod environment to control the camera from clicking pictures of a printed document?is there a way other than to shut off the ...
0
votes
0answers
11 views

How may I get the Adminstrative Authorizaton or access for an encryption green color folder, ?" [closed]

I have create an encryption of my one of the folder then it become green color, and automatically generated a folder on my DOCUMENT folder, but later I unfortunately deleted the folder, although I had ...
0
votes
2answers
62 views

Is my WiFi connection protected?

In my college the WiFi is open type connection and before I connect to it using my laptop with windows 8.1, it displays message "Other people might be able to see info you send over this network " ...
0
votes
0answers
46 views

Is it safe to encrypt data by simply randomizing chunks based on a permutation? [migrated]

Say I want to encrypt the following text: "Today is March the 22nd, 2015". And say want to encrypt 8-byte blocks of data using the following permutation [6,3,0,1,5,7,2,4] to swap characters at those ...
12
votes
1answer
598 views

Why is the truncate function for HMAC one time passwords so complicated?

I've been reading through RFC4226 as part of some research and I was wondering why the function to truncate the HMAC was so complicated. As far as I understand it, the last 4 bits of the HMAC define ...
2
votes
2answers
49 views

Converting ECC Private key to PKCS#1 format

Is there any way to convert an ECC private key to RSA PKCS#1 format? I have tried converting it to PKCS#8 first using OpenSSL: openssl pkcs8 -topk8 -nocrypt -in EC_key.pem -out pkcs8_key.pem This ...
8
votes
1answer
137 views

Is it unwise to use Redis to store PII, private keys, and other secrets?

I'm reviewing a system that is using Redis to store all client secrets, private keys, and other things. The problem is that Redis loads the entire DB into RAM Since SSL's heartbleed, Rowhammer, and ...
1
vote
1answer
21 views

Choosing a cipher and MAC for an SSH connection

The cipher and mac selection according to this are in some sort of order in a config file. How do the client and server know that they are using the same ones though? Is this information exchanged in ...
-1
votes
0answers
18 views

What are the Wifi security problems that a normal user can experience which will make the user unable to connect to the Internet? [closed]

Some examples are: 1. a user types in an invalid username and password to access a WiFi. 2. the date/time in the computer is wrong (say, 1980) which can lead to root certificates being invalid. 3. ...
-2
votes
2answers
50 views

Which is first job or certificates

Here goes a question I have in my mind after I finish my study and start looking for a job. I have visited many recruiting websites and also clicked on many career tabs on companies websites. There ...
5
votes
1answer
110 views

Is port forwarding inherently unsafe?

I had an argument with a person a few months ago when I proposed we forward port 12xyz to an internal SSH server. The target server was tied down in a manner similar to the one recommended by ...
0
votes
0answers
19 views

Using an older copy of glibc in Ubuntu 14.04 LTS for heap exploitation [closed]

I am exploring the techniques of heap overflow using the unlink() technique in Ubuntu 14.04 LTS. I have studied the unlink() technique for the dlmalloc memory allocation algorithm, but I am not sure ...
1
vote
1answer
85 views

Why crack WEP or WPA/WPA2 PSK when it can be sniffed through monitor mode capture?

I am pretty new to the domain of wireless security and am trying to understand the various techniques used for compromising wireless networks. There are a few things that I am not able to co-relate ...
2
votes
1answer
82 views

DHE_DSS vs. DHE_RSA

I have been studying to learn about various cipher suites and their performance; I'm wondering about the difference between DHE_DSS_AES256_CBC ciphersuites and DHE_RSA_AES256_CBC ciphersuites. I ...
0
votes
0answers
32 views

Confused about SSL certificates needed for Windows proxy [migrated]

I am completely new to security, and I'm confused about what kind and how many SSL certificates I need. I have a REST API server running on a windows server 2012. It's currently listening to HTTP ...
-1
votes
2answers
49 views

Server Files Got Exposed, What Security Steps Should I Take? [duplicate]

so I made a script that would accept a GET request through a script on my page download the url in the GET and then echo the response. Sort of like an in browser proxy. Basically someone found out ...
2
votes
0answers
26 views

Why were CBC_SHA256 ciphersuites like TLS_RSA_WITH_AES_128_CBC_SHA256 defined?

It is my understanding that: In TLS, the hash function is used only in HMAC construct. SHA-1 is secure when used in HMAC. TLS 1.2 switched the PRF used to derive the symmetric keys to no weaker than ...
5
votes
1answer
381 views

How to protect from caller-id spoofing?

Yesterday, I listened about caller-id spoofing and was left astonished as it's misuse can result in severe consequences for victim. Please tell me how to protect myself from this prank and is there ...
0
votes
1answer
29 views

Splitting data between wifi networks for security

Does there exist, software or technology, that can use more than one wifi network, in such a way that only part of the data travels through each 'side'? You would probably need an end address like a ...
5
votes
1answer
51 views

Return oriented programming without int 0x80

I have a program with a stack based buffer overflow. It is running PIE with ASLR and DEP, however there is a section of executable code that is at a fixed location. However, this region does not ...
0
votes
0answers
20 views

What legal protection is afforded for email in transit? [closed]

What legal protection is afforded for email in transit?---- ---------It seems to me that emails in transit is offered less protection than emails that has already been stored on server, which is ...
1
vote
1answer
56 views

Password sharing with spouse or mate (bulk-change shared passwords (via cloud service))? [closed]

I've read on New Scientist magazine that in 80% of all cases when people in a relationship share a place where they live one of the spouses knows the other's password, thus making the question I am ...
1
vote
2answers
82 views

Is it possible to set up a second router with the same SSID to get the password? [duplicate]

Suppose we have an WLAN which is secured with WPA2. Its SSID is easybell123. Could an attacker who wants to get the password of easybell123 create a WLAN with the same SSID in the same area wait ...
3
votes
1answer
26 views

Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?

Short OpenPGP key IDs (with 32 bits / 8 hex characters) are subject to collision attacks. It is strongly recommended to stop using 32 bit IDs: Stop using 32bit key ids It takes 4 seconds to ...
2
votes
2answers
32 views

non-https winscp website

The whole point of WinSCP is to provide a secure channel between a computer and a server. "Secure" means that there is a possibility of an attacker that can view or modify bytes sent both ways. Let's ...

15 30 50 per page