1
vote
1answer
26 views

TLS 1.2 Older Browser Compatibility

We are in the process of upgrading our webservers to support TLS 1.2 but I have heard rumor of very old browsers, such as those used as kiosks will fall over when trying to connect to a server that ...
0
votes
3answers
118 views

Is there any virus that can cause physical damage [duplicate]

Like damaging a chip on the motherboard, increase the fan's speed till something explodes or anything similar to that. I am not an IT guru but I never came across a malicious code that couldn't be ...
1
vote
2answers
50 views

Is it Possible to use one commercial SSL Certificate to issue end user certs?

My organization is preparing to purchase some 50 "units" from Symantec, with which we can purchase Verisign SSL certificates of varying authentication levels. Our organization does not have--but ...
1
vote
0answers
37 views

If earlier the SIM card is used in multiple mobile device; can we find or trace those mobile's imei numbers?

Can we trace the imei numbers of mobile devices in which SIM card was used previously, & if it was used in multiple mobile devices?
0
votes
1answer
50 views

Using different algorithms to slow down GPU password cracking

I have some job related files I have already compressed with 7Z. I have protected each with good 10 character passwords consisting of upper, and lower cases, numbers and special characters. And I ...
1
vote
1answer
62 views

Obfuscation alternatives

So I've made a tool for web developers and now I want to sell it, but I don't want all web developers to see my code (PHP). I do know there are PHP Obfuscators, but I don't want to use them, as they ...
0
votes
1answer
27 views

Can i know how chosen ciphertext attack work on textbook RSA

I am very new to cryptography and I am confused with something? Here is the homework question I am having trouble with: Write a program to attack the Textbook RSA Encryption Scheme, in order to ...
1
vote
3answers
106 views

What is Reflected XSS?

Fed up with the following definition. Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that ...
1
vote
1answer
46 views

Prevent someone from using your site for phishing?

So I have a site where users can create online surveys and send them out to whomever they like. Over the past few months we have seen an uptick in one particular user who creates an account, then ...
0
votes
2answers
74 views

Authenticate WCF call to ADFS through Web Application Proxy (WAP)

Currently we authenticate WCF calls TO a service via ADFS, using the following procedure: Firstly, we get a SAML token from ADFS using (var factory = new WSTrustChannelFactory( new ...
0
votes
1answer
42 views

Identifying attacks by network activity

Is it posible (and how) to tell from a network dump if there is a buffer overflow attack, DoS or brute force attack? A DDoS would be more obvious to identify, but those attacks mentioned above I think ...
1
vote
1answer
55 views

Certificate validation with 802.1x PEAP

I recently learned about how WPA-PSK works. If I understand correctly, the 4-way handshake enables the protocol to ensure mutual possession of the PMK (and therefor, the PSK) without sending the ...
1
vote
1answer
27 views

OpenSSL TLS 1.1 Cipher Suites

https://www.openssl.org/docs/apps/ciphers.html listed a set of cipher suites supported by different protocol versions, but I don't see a TLS 1.1 list. Anybody could help me to understand where to get ...
-1
votes
3answers
72 views

What does one call the strategy of using “pre-password transforms” as passwords?

Suppose that instead of using, say, Google, let me in! as my Google password, I used some consistent transform of this string, say ZWE1NjMyNm? What search keywords would be helpful to search for ...
4
votes
2answers
1k views

Can installing Snort make me vulnerable?

I am using Ubuntu and am wondering if installing Snort on my host can make me more vulnerable?
0
votes
1answer
24 views

Is there any benefit to providing multiple types of public keys?

Say I have a page on my website which lists public keys to be used in case people would either allow me access to a server, or send me encrypted information. Is there any benefit to me providing ...
0
votes
1answer
86 views

ssh always too many authentication failures

No matter on which server I try to connect via password login, I always get the error message Too many authentication failures for If I have exchanged the ssh-keys, I can login without password as ...
-2
votes
1answer
24 views

Track mail sender from Mesh network [closed]

Mesh network have one router connected to WAN or Internet so IP address is allocated to that router will be exiting point for all the nodes.. and other routers will have Internet connection from that ...
0
votes
1answer
58 views

REST API: does securing the first call with a CAPTCHA make sense?

Let's say I have an iOS/Android app which rely on a custom REST API for things such as account management (register, login, password reset, get/set user-related data). There is no good way to ...
1
vote
2answers
46 views

injected code decode

Recently I saw a domain of mine was hacked and the hacker have injected his code in some encryption format as below. <?php $l___l_='base'.(32*2).'_de'.'code';$l___l_=$l___l_(str_replace("\n", '', ...
0
votes
4answers
123 views

Why must every OTP be unique

All OTP systems that I have observed, send a new OTP every time a user requests for an OTP. (for example whatsapp) Only the latest OTP is valid and an OTP can only be used for X hours. I am wondering ...
0
votes
0answers
32 views

What are the risks of submiting from iframe to a SSL site?

I have a SSL site where a user can select items to purchase, register and pay. For payment, the user is redirected to a payment gateway. Once the payment is completed, the user is redirected to our ...
3
votes
2answers
97 views

What tools does the Google safe browsing service rely on?

What are the tools Google uses to blacklist a website as being malicious (hosting a web malware)? I know it is partly fed by users themselves who can enter unsafe URLs into Google's database. But ...
2
votes
2answers
81 views

How do I ensure that my Ubuntu download has not been tampered with?

I am downloading Ubuntu Linux, and would like to make sure that my download has not been tampered with. Ubuntu has a GPG key, which I could use to make sure that the download is valid -- but how do I ...
0
votes
2answers
191 views

Sophos virus protection continuously blocking codegv.ru

While using google chrome I keep getting a pop-up from Sophos saying "High Risk Website Blocked - Access has been blocked to "codegv.ru" It happens every time I perform any action in google chrome. ...
0
votes
0answers
11 views

How to test ldap that authenticates with kerberos

I want to test an ldap directory with ldapsearch. No passwords are stored in the LDAP directory. Account passwords are stored in Kerberos and LDAP contains a pointer to the Kerberos principal. The ...
0
votes
0answers
67 views

Why does an ATM withdrawal take so much time? [closed]

Why does it take so long to withdraw money from any ATM, excluding the time waiting for user input? In this example video it took 18 seconds from accepting the amount to getting the cash, but it ...
0
votes
2answers
22 views

Edit Ettercap password sniffer engine?

I'm using Ettercap as MITM for testing on sniffing password but I'm not getting some POST request data containing "usuario" (user in spanish) and "clave" (password in spanish). I'd like to know if ...
1
vote
1answer
153 views

Using AES as a Stream Cipher

I need to send a lot of small messages that are usually between 128 bits and 256 bits long, and each message is encrypted with a separate 128 bit AES key. Therefore, to send each message with the key ...
-2
votes
0answers
35 views

home IDS/IPS - Security Onion [closed]

I am looking at making my own home IDS/IPS and have the ability to send the logs to dShield. I would like to get the opinion of the community of the below device would work well with a 76Meg down and ...
0
votes
0answers
28 views

DOS attack to increase packets received from a single request?

Is there any attack out there that can be implemented where a single request to a server i host for example responds by sending the same file say 20 times back ? the idea behind the attack is to DOS ...
0
votes
1answer
27 views

Ubuntu digital oceans root login?

When you create digital oceans it creates the user as root user, i have SSH key set up with it is it ok to use this root account for sftp and daily use or should i create another user account and stay ...
0
votes
1answer
25 views

Analyzing UPnP entries from home router

I'm using a tplink router for my home LAN and just noticed that in the UPnP section in its control panel there are two entries with App description: Teredo of tipe: UDP and ports: 55566 and 49868 How ...
0
votes
4answers
170 views

How does a hashing function always return the same length hash?

I've been looking into what hashing functions are, what they do, &c. I was just wondering: how does a hashing function always return the same length hash? How does hashing work? does not explain ...
1
vote
2answers
79 views

Where is the identification process when I use a key fob to unlock a door

I can understand that typing my user name on the computer is "identification" and providing the password is "authentication" but when I use a smart card or a key fob I see no identification taking ...
-5
votes
3answers
107 views

Is MS Windows more secure than Linux on this aspect?

The administrator account can be renamed which means the hacker needs to figure out two pieces of information : the user name and the password while there is always one root account in Linux named ...
2
votes
2answers
70 views

Should security phrases be hashed?

I didn't think of this before but today I just realised that in soke sites, pw recovery is possible if you know the answers to security questions like What is your mother's maiden name? In this ...
0
votes
3answers
73 views

How important it is to change password regularly? [duplicate]

A WWW-site guided me to change the password regularly. Should I believe what the say, if my current password is long enough random string?
2
votes
1answer
80 views

How can I design a password reset function, which does not reduce security for users who can remember their password?

We have a web app for which some users want to have a password reset function. I don't want to enforce a particular level of security for the users. So if a user picks a strong password which she is ...
0
votes
2answers
53 views

Is my ssh server safe because I use DenyHosts and don't allow root access?

I am by no means an expert in online security so I wanted to outline the steps I am taking to remain as safe as possible yet still make it as easy as possible to gain access to my system from anywhere ...
2
votes
1answer
70 views

Is it safe to use virtual mobile numbers for verification

Is it safe to use virtual mobile numbers for account verification & authentication for services such as PayPal, Twitter, Gmail, Linkekdin, etc.? And what is the security drawback for this?
1
vote
4answers
146 views

Authentication with an untrusted server

I asked a related question earlier, but I want to ask a broader version this time: To simplify things let's say I've developed an application that allows users to send messages in a chat room, and to ...
1
vote
0answers
21 views

arpspoof Delay Time between replies

"arpspoof" arp replies every second and I think about what is a reasonable time to send arp replies without affecting the network performance, or just making arpspoof not so noticiable. Is there any ...
-2
votes
2answers
91 views

Is scraping this website legal? [closed]

I'm thinking of developing a third-party client for Quora in Windows Phone. There are a few but they just run Quora in a mobile browser. The problem is there is no public or open APIs of Quora. And ...
-1
votes
4answers
55 views

How difficult is it to protect your storage from data recovery

Many of my customers refuse to sell or recycle their old hard drives or mobile phones because everybody now-days talks about how popular data recovery program's are. Isn't it enough to use a software ...
0
votes
1answer
33 views

Throttle network based on OS [closed]

What do I need to learn/know to throttle a clients network based on his/her operating system. For example: Someone in my network using Kali Linux... I would like to throttle their traffic to ...
0
votes
2answers
56 views

Are there any flaws in my design for a paper-based OTP grid?

I'm trying to implement two-factor authentication on the cheap for a website of mine. My bank uses this sort of grid-based OTP system, so I wanted to emulate it in my application: Cards are ...
0
votes
1answer
61 views

Getting back control of my android phone [closed]

I am not 100% sure if the TWRP recovery and my android system (newest version of cyanogen mode) were clean of malware at the time i installed them onto my android phone. I did this on a Windows 7 ...
0
votes
2answers
56 views

If malware was detected in browser local storage does computer need to be nuked from orbit

I haven't used Windows partition since mid-June and I booted the system once again just a few days ago. My first action was as usual update all programs marked to be updated (including Windows ...
0
votes
0answers
27 views

Can PXE boot of Hyper-V VMs be disabled? [closed]

Hyper-V virtual machines have the ability to PXE boot. Obviously, PXE boot raises some security concerns. The problem is, unlike a typical physical machine's firmware, there isn't an obvious way to ...

15 30 50 per page