-2
votes
1answer
67 views

Fiddler Can decrypt https traffic

So apparently, a software called fiddler is able to very easily decrypt secure https traffic with a click of a few buttons: http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/DecryptHTTPS I ...
1
vote
1answer
137 views

linux hidden OS

I have been reading about hidden volume OS with truecrypt, and now with its successor, VeraCrypt. https://veracrypt.codeplex.com/wikipage?title=VeraCrypt%20Hidden%20Operating%20System But Couldn't ...
0
votes
0answers
16 views

Hostname based Access Controls from clients with shared IPs

I have been pondering this question for some time now: Can you really use hostnames as access controls, especially when clients might be behind proxies or routers performing NAT (or any other shared ...
1
vote
0answers
27 views

Is malware or screen capture possible with iMac as external display?

If using a foreign iMac as an external display (through the Thunderbolt to Thunderbolt, or Mini DisplayPort to Mini DisplayPort cable, and Command+F2 on the iMac, as per iMac Target Display Mode FAQ), ...
0
votes
1answer
67 views

Free way to hide geographical location (ie. IP address) from a website that blocks Tor [closed]

recently a website that I am frequently on blocked Tor which I was using to hide my IP address and therefore my geographical location. I can't spend any money on a VPN, and I need to keep my ...
0
votes
2answers
59 views

Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?

When accessing a HTTPS site by IP address, if the IP address is not in the alternate names field, the browser will throw an error about the certificate not matching. Would this be considered a low ...
2
votes
1answer
60 views

How practicable is application whitelisting

I understand that application whitelisting is better and more accurate than black listing. However, my question is, if you whitelist a directory, won't the malware also be able execute in that ...
0
votes
1answer
30 views

Browser Unable to Fully Authenticate HTTPS

I'm attempting to fully verify the HTTPS encryption using Chrome & Firefox but both browsers currently display the connection as 'including resources which are not secure'. I have tried using ...
1
vote
3answers
138 views

Is this approach to backups secure?

I've got an existing (personal) backup service which I'm rewriting from the ground up to be secure. At present, I just store files (and diffs) in AWS S3 with no encryption. It works fine but I'd like ...
1
vote
1answer
35 views

Block An IP Address Scanner On Mac [on hold]

I'm working on an prototype that can spot network scanners, which is working and it spits out the IP address of the scanners, but I need to block them now. Is there any way to block an IP address ...
0
votes
0answers
23 views

How does the Blowfish algorithm key initialization work [migrated]

I'm having some trouble understanding the Blowfish encryption algorithm. From the Wikipedia article... "The secret key is then, byte by byte, cycling the key if necessary, XORed with all the ...
0
votes
2answers
37 views

Disclosure and HTTP status codes

Disclaimer: yes, I have checked the Which HTTP status codes are interesting from a security point of view? which sounds relevant but not entirely. These days it's supposed to be a good practice to ...
0
votes
0answers
16 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
-2
votes
1answer
43 views

Is VBScript an actual tool to attack users?

While I was reading a ASP.NET book I found that is supports VBScript but this made me think if VBScript is still a tool of hackers to attack other users, I guess only Internet Explorer users, As I ...
5
votes
1answer
72 views

How does consent.exe know what to display?

consent.exe is responsible for showning the UAC dialog. Looking at the command line parameters with Process Explorer, I see the following: consent.exe 1316 748 000000004385BD60 I have read How ...
0
votes
0answers
25 views

Trailing space in email subject caused SMTP to stop sending emails. Why? [closed]

I faced this scenario recently where a trailing space in the subject of an email caused the SMTP server to stop sending that email and any other email after that. Why would this happen? And how does ...
0
votes
1answer
32 views

Is an attacker looking at encrypted non-boot partition able to tell if this is VeraCrypt, TrueCrypt or DiksCryptor?

In theory an encrypted partition WITH encrypted partition header as created by mentioned encryption software, should be nearly random-looking. But maybe there are some clues, like offsets, double ...
0
votes
0answers
21 views

Should I take an Information Security Course as an Elective? [closed]

I'm currently enrolled in university and I was wondering if I should take information security course offered by the school. I've been to the student guidance office but they didn't have a lot to ...
0
votes
1answer
19 views

Evaluation keyexchange for automation [closed]

Target: Secure communication between server S and Master M Server S executes script downloaded from Master M (securely) Problem: Small footprint - use existing software (base install of a ...
10
votes
2answers
1k views

Why is Symantec/Verisign CA appearing as an invalid authority? [closed]

Typical browsing to www.BankOfAmerica.com got me an ERR_CERT_AUTHORITY_INVALID error. This was with an up-to-date production version of Google Chrome for Mac. I tried with Safari, and got the same ...
0
votes
2answers
55 views

Is it possible to transfer digital malware over analog channels of communication? [closed]

I have come across the interesting concept of data transfer to an air-gapped computer that avoids even USB sticks (to avoid stuxnet e.g.), where the premise is basically that to avoid malware and ...
-6
votes
0answers
26 views

spoofing a cell phone number to a 900 service [closed]

How do I spoof an unwanted incoming cell phone call to a 900 number and have the incoming cell phone's provider charge them for the 900 call. JOE
-4
votes
0answers
31 views

FORWARD A CALL TO A 900 SERVICE [closed]

Can I spoof an incoming cell call to a 900 service? Secondly, would I be charged for the call or will the cell caller I spoofed be charged for the 900 call? JOE
0
votes
2answers
80 views

Hidden Malware on a windows OS able to startup [closed]

How do hackers hide there malware on windows, to startup and be impossible to find then delete. The results I found that a hacker can use to hide his malware: (found here) Windows: Setting hidden ...
3
votes
1answer
61 views

(httpd log files) What kind of attack is? How can I prevent it? [duplicate]

In my log files I see hundreds of these registers. I have to say that the client ip changes sometimes. So there are 3 or 4 ips sending this requests... The othersite.something (that I ommited) is ...
0
votes
1answer
20 views

Block size of CTR, CFB and OFB mode of AES in openssl

I am using openssl library. In all documents and webpages it is written that the block size is 128 bites(common for all AES modes). But what I observed in openssl is, for CTR, CFB and OFB modes the ...
9
votes
2answers
2k views

How can I prevent a man-in-the-middle (MITM) attack on my Android app API?

I checked out the app Packet Capture. This app is able to decrypt my app APIs (SSL Enabled) data by mounting a MITM attack using the Android VPN service. This does not even require root. How can I ...
0
votes
2answers
42 views

Full Disk Encryption, Single User System: User/Root Passwords required?

Are there any security issues of having no (or weak) passwords for user and root account on a single user system with full disk encryption (except boot partition)? Assuming no SSH server is running, ...
0
votes
0answers
25 views

GPG: Import UID [closed]

I have not yet submitted my keys to a keyserver. I have one UID, but I wish to change its email address. As my master key is only saved on an encrypted USB device, I performed the following steps: ...
0
votes
0answers
23 views

Advertisements shown when page is viewed in Chromium but not when viewed in Firefox [closed]

The title says it all, i keep on seeing advertisements when i open pages in Chromium, those ads are shown in portions of the page (not popups) usually at the bottom and/or the top of the page and do ...
-4
votes
0answers
67 views

Encryption Protocol: good or bad [closed]

reconnecting to another question (Problem with Encryption Protocol) I'd like to understand how to reason on this type of problems. First of all: we are using symmetric keys. Right? Alice encrypts ...
10
votes
1answer
595 views

Drupal server compromised - I want to investigate the attack technique / compromise

I've got a drupal site running on an up to date CentOS 7 LAMP AWS EC2 instance (freshly installed a couple of months ago) and I've just found out that somehow, probably through a poorly coded 3rd ...
-2
votes
1answer
15 views

Applications of the message recovery schemes [closed]

What are the applications of the message recovery in the digital signature schemes?
3
votes
1answer
83 views

Is it possible for malware to be in the BIOS or in hardware?

Is it possible for malware to be written in the BIOS section and loaded on every fresh Windows Install? If it is possible, can this affect Linux (Ubuntu and others) operating systems as well?
2
votes
0answers
19 views

get x and y components of ec public key using openssl [migrated]

I am generating a KeyPair for ECC from curve 'secp128r1' using openssl Steps I followed : first I generated a private key using the command openssl ecparam -genkey -name secp128r1 -noout -out ...
3
votes
0answers
80 views

What is the most efficient password scheme in terms of entropy per convenience [closed]

Although the main points are right, but now six words are needed, which is both inconvenient to remember, and inconvenient to type. My question is, has then been any case studies on the most ...
3
votes
1answer
89 views

Client Certificates

After countless hours of reading I have come to the find that mutual authentication via client certificates seemed to be a viable and appropriate solution for the following scenario. I have a ...
1
vote
0answers
25 views

Why don't merchants use chip reader on credit card terminal? [closed]

Most merchants I've been to in the past few years have updated their credit card terminals to accept the chip+pin system. My credit card has had a chip for the past two years. Yet on these new ...
1
vote
0answers
11 views

VSFTPD- memory attacks [closed]

How are memory attacks prevented via the VSFTPD server? The platform I am using is Ubuntu. Please I am not currently having a problem I am just requesting knowledge concerning the subject stated ...
1
vote
1answer
46 views

If using a different password for every application is considered good practice, why is using a directory so widespread?

The title pretty much sums it all. We are always told that we should use a different password for every site and application, so that if one of those accounts is compromised, the others will still be ...
1
vote
2answers
59 views

Is chaining multiple VPNs a good way to reach anonymity on the internet?

I would like to chain a couple, say 6 or 7, VPNs together to create a sort of "super" encrypted lane on the internet. I'm not too concerned about speeds, all I want is privacy and anonymity. I've ...
1
vote
1answer
39 views

I think i might have accidentally clicked a phishing link, how can i be sure? [closed]

Long story short I might have accidentaly clicked a phishing link is there any kind of test I can do or anything I can do to check?
4
votes
3answers
197 views

Is AES 256 secure enough for putting Backups to AWS or Dropbox?

How long would it take with current hardware to hack an Disk Image which was encrypted with AES 256? I ask because i want to backup personal files (contracts, tax-things, code, keys, private ...
2
votes
0answers
23 views

Why does Hydra not stop when it finds a password? [closed]

Why does Hydra 8.1 not stop when it finds a password? I am using the -P option with a file that has over 5 Million passwords in it and the correct SSH password is located at approx. line 2100, but ...
2
votes
1answer
50 views

Why use a password manager to protect browser logons when e-mail client is neglected?

Friends use password managers like lastpass or dashlane which have plugins for the browser, but not for the email clients (thunderbird or livemail). But surely the email password is the Achilles heel ...
1
vote
1answer
36 views

Reading encrypted data before sent to remote server

I'm developing a mobile app (Android only for now) to provide a disposable e-mail service to users. Users will be given temporary e-mail addresses so they can receive and read e-mails for a certain ...
1
vote
2answers
50 views

Difference between DNS spoofing and phishing [closed]

I am writing a bachelor thesis and I am having a hard time figuring out the difference between phishing and DNS spoofing. From what I understand, DNS spoofing is a way to achieve a succesfull phishing ...
2
votes
1answer
25 views

GPG: What public key do I have to publish?

I just created a master key and two subkeys. The first subkey is used for encryption, the second one for signing. Now i am wondering what public key do I have to publish on my website. Does is ...
1
vote
0answers
19 views

Examples of “Runtime application self-protection” (RASP) in action?

I'm having a hard time figuring out what "Runtime Application Self-Protection" (RASP) really is, though I see it mentioned in the press. The best description I've seen of the possible benefits, along ...
0
votes
0answers
35 views

Breadcrumb trail / audit log / evidence-gathering after server breach? [closed]

In a typical case of server breach, what would be the most thorough & efficient manner of collecting a breadcrumb trail of all actions performed by a malicious user? The unique IP being known, ...

15 30 50 per page