4
votes
5answers
424 views

Is there a domain specific language for security policies

Is there a domain specific language popular for defining security policies that are applicable across systems, domains or enterprises ? Edit: Typically to express security policies at network level ...
9
votes
2answers
7k views

when to use nonce?

I have trouble understanding nonce. I read a very good answer related to nonce by @Thomas Pornin, but it is too complicated for me as I am new to cryptography. From what I know, nonce is used to ...
5
votes
3answers
3k views

optimal way to salt password?

A good way to salt password? I have read a few answers related to salting password. But I started to get confused. I came across few functions people used to generate salt like: mcrypt_create_iv() ...
6
votes
1answer
6k views

Is PBKDF2 only SHA1 in C#?

I can't find a way of specifying the hashing algorithm used by the PBKDF2 (the Rfc2898DeriveBytes class) implementation in C# System.Security.Cryptography. It seems to be just SHA1. Am I missing ...
6
votes
2answers
3k views

How do I know if my encryption algorithm is strong enough?

I am using ruby and have the following encryption algorithm: @@secret_key = Digest::SHA256.hexdigest(key) encrypted = Encryptor.encrypt("encrypt this", key: @@secret_key) encoded = Base64.encode64(...
27
votes
1answer
22k views

How should API keys be generated?

I want to make sure requests can't be forged and sent on to my server. In order to do this I need to generate an API key per user on my system. The purpose of the key will be to sign requests on the ...
4
votes
1answer
180 views

What are some security measurements that can be taken with Windows Phone?

In corporate security it's often important to have confidential information, such as email, encrypted on your phone. How does Windows Phone (not Windows Mobile) cope with these issues?
2
votes
0answers
137 views

Need a little help with Metasploit and Java? [closed]

I'm a junior programmer and i was asked in my job to test java using metasploit... I followed this detailed environment: https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-...
7
votes
3answers
831 views

How does KeePass master key derivation increase security?

I don't understand how KeePass key derivation increases the security of the password db at all. First I'll try to explain what I understood from the key derivation described here. I'll use some pseudo ...
3
votes
2answers
691 views

Implementing brute force attacks on hash values in Javascript

I'm working for my bachelor thesis at the end of which I aim to implement a proof-of-concept Javascript-based hash cracker. The idea is to work like this: Users can submit a hash value along with ...
9
votes
3answers
687 views

Building list of vulnerabilities that should be verified during pentest

I am currently studying how to do server pentesting and need some advice/protip related to methology/best practices. People often mention that it is a good idea to gather intelligence and enumerate ...
4
votes
2answers
641 views

Security concerns about my webapp

I read though OWASP very carefully, but I am not sure about some parts of my website. I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read ...
8
votes
4answers
1k views

Are Java applets more secure than regular forms for login?

In Norway we have something called BankID which is a login solution for banks and other stuff. It consists (from a users point of view) of a Java applet where you enter your SSN (person number), a one ...
3
votes
4answers
500 views

Has any virus attempted to compromise the anti-virus database?

I was using an old version of Norton Anti Virus and the Live Update wouldn't run. The solution was to rename a file. This got me thinking if a virus could replace an anti-virus database with it's own ...
6
votes
2answers
2k views

Adding custom data in X.509 certificate

I am using SSL with client authentication. I need to send some extra data while sending the client certificate? Can I send it in the certificate? Can I use the extension fields in certificate for that ...
-4
votes
1answer
207 views

Secure Traffic model for Web application Protection

Web Application Firewalls relies on negative and positive security traffic rules to protect web application from being exploit. My question is that is their any other web traffic modelling technique ...
5
votes
1answer
1k views

truecrypt second encryption of the master and XTS key with a back door password

this table was published by (Ubuntu Privacy Remix Team ), in an analysis document, anyway i was quite skeptical. On file based containers as well as on completely encrypted partitions or drives ...
15
votes
2answers
4k views

Does AES-192 provide better encryption than AES-256?

this wikipedia article describing AES says: Related-key attacks can break AES-192 and AES-256 with complexities 2^176 and 2^99.5, respectively. Does this mean that AES-256 is actually a weaker ...
3
votes
2answers
286 views

Unecrypted connection to server - safe?

I am using heroku and cloudflare. I am going to release my website but I don't want do it without SSL. Now I always need an heroku addon to add my SSL certificates which costs $20/month. Cloudflare ...
3
votes
1answer
104 views

SSL Based Denial of Services due to Message Digest

On a very high level, its known that SSL/TLS uses message digests to verify the integrity of the messages sent. However, the question I have in mind is : How does SSL ensure a DoS does not happen ...
5
votes
1answer
3k views

XSS inside CSS when " is encoded?

I'm trying to make XSS work on one site.It allows me to edit CSS which is then included inside web page source , but it won't allow me to use " , only ' . Source is like this: body { margin: 0; ...
4
votes
3answers
331 views

Are there any known botnets targetting smartphones?

Are there any known botnets that specifically target smartphones? What is their topology and how are they controlled? What are they used for?
6
votes
2answers
5k views

iPhone full disk encryption and theft protection?

Is it possible to fully encrypt an iPhone? What cipher does it use and are there any weaknesses? How can I protect my valuable data, such as email, when my iPhone gets stolen?
29
votes
1answer
3k views

How does a new SMS message overwrite a previous one?

During a talk from a vendor, the speaker mentioned that their product used a "little known feature" of SMS in order to overwrite the last text message received from them. This feature was being used ...
9
votes
4answers
19k views

How can SMS spoofing be detected?

SMS spoofing involves faking the source ID, by replacing it with alphanumeric text. This can be useful for mobile providers, but can lead to security issues such as social engineering. How can we as ...
5
votes
1answer
324 views

Android, how to protect in case of theft

What are some steps to take into account to protect an Android phone in case of theft? Smartphones are everywhere now, before the market was dominated by Blackberry and Windows Mobile. These days ...
5
votes
2answers
2k views

How to harden my Buffalo LinkStation Pro?

The Buffalo LinkStation Pro Duo that we use can be pretty easily hacked into. The good thing about this is that this NAS runs Linux and can therby be improved in features, e.g. running an NFS or LDAP ...
5
votes
1answer
79 views

Should different web apps running on VDS each have their own user account?

I deployed my second rails app on my VDS with capistrano. Should I configure that application server to run as a different user, or the same as the first application? If I run applications as ...
7
votes
2answers
179 views

Is there any security benefit to separating an RFID chip from an ID badge?

This seems to be a question that blurs the line between physical and IT security, but I'm hoping it's relevant enough! In order to meet with PCI standards, our company recently switched from an open ...
8
votes
1answer
2k views

How can an admin choose which Snort rules to enable?

The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection attacks, port ...
2
votes
2answers
8k views

How to set up a user-friendly NAS encryption?

We recently installed one NAS drive (Buffalo LinkStation Pro Duo, LS-WVL, running the most recent Firmware version 1.6 to be precise) in our (small) company network. Currently, there is no encryption ...
21
votes
2answers
1k views

Cohen's problem

Fred Cohen determined theoritically that viral detetction is an undecidable problem. Can anyone provide an intuitive reasoning for that? Background Fred Cohen experimented with computer viruses ...
9
votes
6answers
2k views

POP3/IMAP Stronger Authentication

We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have ...
53
votes
4answers
116k views

Is SHA1 better than md5 only because it generates a hash of 160 bits?

It is well known that SHA1 is recommended more than md5 for hashing since md5 is practically broken as lot of collisions have been found. With the birthday attack, it is possible to get a collision ...
9
votes
4answers
5k views

mitigating anonymous DOS (tor combined with pyloris)

I found this rather scary video in youtube, that takes DOS to a whole new level, by making it look like coming from multiple sources. As a counter measure to Rsnake (Robert Hansen) slowloris.py script,...
15
votes
4answers
3k views

Tools to help test the security of Android applications [closed]

What are some decent frameworks to test the security of Android applications? With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
11
votes
2answers
5k views

Best way to report a foreigner attacker's ip to authorities?

I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe? From your experience what is the ...
15
votes
7answers
30k views

Where does SSL encryption take place?

I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
10
votes
3answers
5k views

SOCKS proxy security concerns

As claimed, "A socks proxy simply transfers data from a client to a server, not penetrating into this data contents (therefore it can work with HTTP, FTP, SMTP, POP3, NNTP, etc.)", I really can't buy ...
80
votes
3answers
105k views

Token-based authentication - Securing the token

I have developed a backend REST API for a mobile app and I am now looking to implement token-based authentication for it to avoid having to prompt the user to login on every run of the app. What I ...
2
votes
1answer
231 views

Safe User Login Questions

I need help determining how safe the login is. First of all, I have been reading this: The Definitive Guide To Forms based Website Authentication It's really well written, great information most of ...
17
votes
8answers
6k views

Is TrueCrypt safe enough to store clear-text-passwords?

The reason: I want to be able to use a portable USB drive to access my passwords on any machine and OS. TrueCrypt seems to be the only program that has sufficient support on all major platforms. So I ...
15
votes
2answers
10k views

Bypassing the BIOS password

Are there any reliable methods that allow an attacker to bypass a BIOS password, or alter BIOS settings without entering the password? A few ideas come to mind: The old battery trick (remove ...
6
votes
3answers
1k views

Why is tunneling so important in pen testing?

I am curious why tunneling is so important in pen testing. If one has control of one machine in a network, then using that machine, one can run nmap and web apps and try to find out vulnerabilities.. ...
7
votes
4answers
1k views

Tracking stolen laptop which has a login password

I have been reading about solutions that track your computer in case of missing. Since I'm using Ubuntu 12.04, the best option would be prey for me, but I'm open to other suggestions. The question is ...
0
votes
0answers
66 views

Can you port-scan a LAN, from outside the LAN? [duplicate]

Possible Duplicate: Scanning A Subnet Externaly Is it possible to scan ports on machines in a LAN, from outside that LAN? For example, I've got machines in my LAN network and want to check ...
6
votes
2answers
2k views

Can remote LogMeIn Hamachi users access our local LAN?

Unknown to me, one of the kids has installed LogMeIn Hamachi on his PC so that he can access and play on his pal's Minecraft server, and vice versa. However, my lack of fu when it comes to these ...
3
votes
0answers
111 views

How should I manage my passwords? [duplicate]

Possible Duplicate: What is a good practical (and sane) way to manage all your passwords for online sites? So even if I come up with memorable passwords like "correct horse battery staple," I ...
4
votes
1answer
337 views

Reverse Engineering for .rtf files

I've received lately a .rtf attachment on my work email from an untrusted email account. I suspect the attacker is exploiting "Microsoft Security Bulletin MS12-029" vulnerability. What are the ...
5
votes
2answers
293 views

Upgrading to latest software version for security reasons

I have some software that I want to upgrade to improve security. The current version I'm on is 2.6.2. Is it better to upgrade to the latest version of the entire product line which is 2.8 or should I ...

15 30 50 per page