2
votes
2answers
45 views

In this instance, is code+security code really more secure than just a longer code?

On credit cards, the security code is printed on the back of the card (usually), on the premise that having a credit-card slip or photo of the front of the card won't allow you to use it fraudulently. ...
-1
votes
0answers
30 views

How to install webgoat on ubuntu with lamp server [closed]

Can any one give me the breif instructions for how to install Webgoat on Ubuntu 14.04 (not a server) step wise I am facing problem with setting java_home variable to java 1.5 jdk
2
votes
3answers
41 views

Best practices for HSM's used by test and production systems

Should a test/demo/non-prod system be prohibited from using the same HSM as production? Since the same master key would be used for both test and prod it seems like it could raise eyebrows but I can't ...
2
votes
1answer
77 views

Can I add 'user-identifying noise' to MP3 files to determine which user shared my file, if I find it later on the internet?

Problem I'm streaming MP3 files to users. Users are not allowed to share these files. I know that it's in the end impossible to not let anyone download the files. That's not the problem, people can ...
3
votes
2answers
155 views

XKCD-like passphrases to stdout

I'm trying to find a way to crack XKCD-like passphrases (correcthorsebatterystaple) from word dictionaries. Basically concatenate X number of words from a dictionary file. Right now it honestly ...
0
votes
0answers
31 views

OpenSSL CVE-2014-3508 - what can be read?

Per the OpenSSL announcement for CVE-2014-3508, sensitive information can be read from the stack. The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before ...
-2
votes
0answers
63 views

How close are we to eliminating username/passwords? [closed]

I just read that Gmail usernames and passwords were leaked to a Russian Forum recently and I wanted to know if "we" any closer to eliminating the old school system of "username/passwords"?
0
votes
0answers
10 views

Gnome-keyring iteration count location

I know that Gnome-keyring hashes master password between 1000 and 2000 times. It picks random number. I would like to ask where does it save this number, what is the location of that file? As far as I ...
-2
votes
1answer
57 views

Update a column using sql injection in mysql [closed]

I am beginner at sql injection and such type of security vulnerability stuff. So my problem is that I have a website in which sql injection working so to I want to know that It is possible to update a ...
1
vote
0answers
49 views

blocking certain websites, when accessing through “proxy” [migrated]

My mac at home is controlled by parental control from apple. Internet access is only allowed for certain websites. I did this because i just procrastinate too much. This works well, but there is a ...
0
votes
2answers
120 views

Trying to get rid of hackers who have access to all my devices

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get ...
2
votes
1answer
167 views

What are the typical ways to generate a One Time Password?

I'm looking for the typical ways to generate a One Time Password. I know about the HOTP and TOPT. But, in my case, the problem is that the "server" only has a display as interface and the ...
3
votes
2answers
325 views

How to keep someone from analyzing our site?

For the past days some script kiddie has been scanning our site with w3af and some basic manual checks. Although I know the site is "secure" because I analyze it almost everyday, I'm not perfect and ...
0
votes
2answers
102 views

How do I know that my connection is really encrypted?

I am using a VPN to ensure to encrypt my browsing. I wonder though if I could check somehow if the datastream really is encrypted?
16
votes
6answers
2k views

Is there a brute-force attack similar to what they demonstrate in movies [duplicate]

Since I was a teenager (that's 20 years ago) and till now-days you see movies with professionals stealing a super-computer and use it to crack a password or a home security system using brute-force (I ...
0
votes
0answers
6 views

WD My Passport read eror [migrated]

i cannot access my WD my passport. It keeps bleeping and the white light continually flashes. The PC immediately reports that E drive cannot be accessed due to I/O error. I have tried all the basic ...
8
votes
1answer
898 views

Why would HTTP client only send authentication headers once an unauthenticated request was rejected?

The default usage of HttpClient and HttpWebRequest .NET classes is setting Credentials property and then asking the class instance to perform an HTTP request. If the target requres Basic authorization ...
2
votes
2answers
64 views

Is a monolithic kernel more secure than a microkernel for a small OS?

Upon building a kernel for a small CLI system what option is the best one? I don't know much about what microkernels can do so bear with me if I'm being ignorant: In one instance, there are ...
1
vote
2answers
140 views

Opinions on my “Encryption at rest” implementation idea

Ok so basic overview of the environment I'm envisioning: Webapp w/ db backend storing sensitive data, possibly phi; standard user:pass auth due to unteachable users. My idea was to encrypt row data ...
1
vote
0answers
64 views

How do I force Firefox or any other browser to check for CRLs [migrated]

I am trying to see if I can watch the traffic that is sent and received when a browser checks for CRLs. All I can see with the latest version of Firefox is setting for OCSP. I dont see anything where ...
0
votes
0answers
30 views

Self-signed certs /keys stopped working with Thunderbird upgrade [migrated]

A recent Thunderbird release (somewhere between 27 and 31) broke my self-signed CA's which were used to vouch for my self-signed keys. I use self-signed certificates for communicating with family. ...
0
votes
3answers
72 views

How would I secure my hosts file?

I know the hosts file is often deemed obsolete by an actual DNS, but what is/are the best way(s) to secure a hosts file (Current Best Practice)? Example: Would I delete the hosts file, input known ...
0
votes
2answers
152 views

Computer hasn't been connected to internet for 2 weeks

A computer hasn't been connected to the internet for 2 weeks but has still been used. It's running Windows 8 and various notices are complaining about virus definitions and updates not being current. ...
2
votes
1answer
39 views

Preventing users abusing emailing feature of web application

Our web application offers users with the option to bulk email a bunch of interesting information to multiple email addresses at once. It's fairly easy to register an account with the service and thus ...
1
vote
2answers
92 views

Contactless session on ATM?

I'm currently reading about an access control and saw something interesting about smartcard contact & contactless. From what I understood from the book, smartcard contact is like an ATM Card. ...
1
vote
0answers
49 views

Verifying the owner of a signing key

I'm using elliptic curve cryptography (curve25519 and ed25519) for key exchange and signing. The signing and key exchange keypairs are independent. I need two users to be able to verify each other's ...
1
vote
2answers
70 views

Does NTP leak local system time?

As I understand the paper An Improved Clock-skew Measurement Technique for Revealing Hidden Services (6/23 = pdf page 3), it implies that a NTP client leaks the system's local time because of TCP ...
2
votes
4answers
91 views

Vulnerability exploitation in Java

I am not intimately familiar with Java, so this could be a stupid question. In a C program I can find buffer overflows or may be a ROP based exploit to run custom code. How is it done in the context ...
0
votes
1answer
51 views

Why is the brute force search time for hashing algorithms 2^(num_bits / 2)?

I noticed that the brute force times (the time it takes to find a message that hashes to a given hash) of various hashing algorithms seems to be 2^(num_bits / 2). For example, people say that brute ...
0
votes
1answer
161 views

Why is stackoverflow not using HTTPS for all it's page?

Most webpage from stackoverflow use http even if you are logged in. Isn't it a security issue? Could an eavesdropper steal my session and authentication cookie then impersonate me since it's sent ...
0
votes
2answers
64 views

Is it safe to use preyproject?

prey project tracks mobile devices and helps to find stolen devices. Is it safe from privacy perspective? How can I know that it doesn't spy on me?
-4
votes
1answer
78 views

Trace email without header or IP address [closed]

I have a gmail address only. It is a copy of the email. I do not have the original email. Is there anyway to trace it?
2
votes
1answer
84 views

How to safely display external pictures?

i want to write (and currently writing) a php script to display external images, not hosted on my website. Something like facebook's safe_image. What I'm currently doing is file_get_contents('pic') ...
-1
votes
1answer
52 views

Why do I target the proxy server if I send a DDoS attack from it?

I once read that if I send a DDoS attack via a proxy (for example with LOIC), I won't target the server I am trying to send a DDoS attack to but I will actually DDoS the proxy server. Most important ...
0
votes
1answer
25 views

Olly Debugger Linux not functioning

In Kali Linux whenever i open a binary after compiling the c source file, it gives an error: "The file is not a valid PE file." No debugging takes place there after. Is there any workaround for ...
0
votes
3answers
60 views

Is it possible to use OTPs for WI-FI?

Is it possible to configure an access point to use OTPs for authentication and encryption ?
0
votes
0answers
22 views

Kali Linux OllyDBG update to latest version [migrated]

Kali Linux comes with Olly Debugger version 1.0. How can i add the latest version to the Kali VM. I have already tried apt-get update but does not work.
1
vote
1answer
69 views

What are the options for acquiring disk image from a Linux computer that can't be removed from a crime scene?

If the suspect's computer is Linux, can you directly use tools such as dd or dcfldd on his computer to acquire the disk image? Or do you need to use forensic live cds like Helix, Penguin sleuth or ...
-3
votes
0answers
16 views

Log outgoing requests from software [closed]

I have a issue i would like help with. i have 2 jukeboxes that have 2 different software serials. 1 box cpu died and i had to replace the motherboard and ram, it had the same chipset so it booted ok ...
2
votes
1answer
38 views

Handling unencrypted HTTP data for a PCI compliant system - in scope for PCI DSS v3 but not v2?

We currently have a custom, cloud based application that can analyse then route HTTP and HTTPS traffic through to a domain. So if a client wants to use our service, they re-point their DNS to our ...
0
votes
1answer
47 views

How to report abuse spam with X-AntiAbuse header which was added to track abuse?

I've received the following spam e-mail (with the link to viagra site): Return-Path: <silviani@server04.funet.co.il> Received: from server04.funet.co.il (server04.funet.co.il. [212.29.215.70]) ...
0
votes
0answers
18 views

What does proxyexec + cagefs.server mean in the e-mail X-Source-Args?

I've the following headers in the e-mail which I've received as spam: X-Source: X-Source-Args: /usr/sbin/proxyexec -q -d -s /var/run/proxyexec/cagefs.sock/socket /bin/cagefs.server X-Source-Dir: ...
1
vote
1answer
41 views

Dump SSL traffic from a Java applet

I have a smartcard that can be read by websites using a Java applet (see http://www.springcard.com/online/applet_pcsc/). I would like to monitor and is to replay packets going from this java applet to ...
0
votes
1answer
47 views

HTTPS enable for proxy server or web server

Say I have 2 separated servers which are one web server (apache) and one proxy server (nginx), I want to use HTTPS for the website running on the Apache. Do I enable SSL on apache or nginx or both? ...
1
vote
0answers
39 views

Protecting data on a remote device

Background I have am developing a service which consists in a small headless client device (e.g. OLinuXino) which will contain sensitive data. The device will be plugged to a remote network (maybe ...
1
vote
1answer
26 views

Is Java javax.servlet.http.HttpServletResponse sendRedirect() auto replace the carriage return(%0d%0a) to prevent Http Header Splitting attack?

I just tried to demonstrate a simple Web app program to simulate the Http Header Splitting attack but I failed. I realise that this sendRedirect() function has filtered my carriage return and replace ...
-2
votes
0answers
69 views

Can anyone tell me what is going on in this traffic? [closed]

9/8/14 4:51:26.015 PM mDNSResponder SendARP: No interface with InterfaceID 0000000000000005 found 34 252.70.102.100.in-addr.arpa. PTR [UNKNOWNCOMPUTER]-macbook-pro.local. 9/8/14 4:51:26.015 PM ...
9
votes
4answers
210 views

What kind of factor is a physical signature?

I'm familiar with the basics of multi-factor authentication. Now I'm trying to understand how a physical signature, as written on, say, a check or a credit card receipt, would be classified: Is it ...
0
votes
1answer
116 views

How to execute an exploit without user interaction?

Is there an existing exploit, virus or malware that doesn't need any user interaction? In metasploit for example. No link to clicked, no pdf to open , no vba or exe to execute by the victim.
1
vote
1answer
71 views

What network protocol is Crashplan using?

I have been using CrashPlan for a while internally (i.e. local backup server). I would also like to setup off-site backup but my experience is that I have to forward a port from the router sitting at ...

15 30 50 per page