All Questions
68,807
questions
0
votes
2
answers
233
views
ssh remembers my key
I have a server in the web and I'm very concerned about security. I'm using custom private key
ssh-keygen -t rsa -b 4096 -C "[email protected]"
and I'm using it only for this server. I've added ...
- 125
1
vote
0
answers
146
views
Privacy terminology: Online privacy vs Internet Privacy vs Digital Privacy
While, to my eyes, Digital Privacy is the broader term ( anything digital whether online or not), I have seen all 3 used interchangeably (i.e: link vs title). Also, despite having different entries in ...
- 39
0
votes
0
answers
136
views
How to securely setup a DVR for remote viewing
I can't find any guides or helpful forums on how to securely setup a DVR system for remote video surveillance. And by setup I mean - what kind of DVR and how to setup/connect the system to the ...
- 411
1
vote
0
answers
2k
views
Is it safe to use "Iguana Tex"? Why does it trigger a virus report? [closed]
I have used Iguana Tex in the past to insert Latex equations into my power point presentations. Lately, it triggers a response from the virus check programs. According to the developer, it is a 'false ...
- 111
1
vote
1
answer
284
views
Mission Impossible like defence application project
I have a Attack and Defence security project for school and I dont know how to protect it since all classic ways are forbidden by rules ,so
Assume the following project :
A web application with the ...
- 899
1
vote
1
answer
110
views
Does a PC with many NIC's can create vulnerabilities for each network wihich it is connected?
I wonder if installing 2 more (USB to Ethernet) NICs to my PC can be risky if I need that only my PC can access to the three networks, and no any other host in these networks... Could my PC act like a ...
- 13
14
votes
2
answers
19k
views
Variable Assigned to Object Injection Sink (security/detect-object-injection)
I am testing my code on ESLint. It says:
Variable Assigned to Object Injection Sink (security/detect-object-injection).
I'm not using an outer resource to assign it to my variable, though. Is ...
- 141
7
votes
1
answer
172
views
Update intervals of VPN client code
I recently had to find a VPN client to connect to a preconfigured Cisco IPSec VPN. Of course there's Cisco's own client implementation AnyConnect, but I wanted to stick with a free alternative if ...
- 198
1
vote
0
answers
119
views
VPN or SSH or what option would work for what I want to do? [closed]
I need to have my Internet connection for work to show up as being from a specific city. They state I am not allowed to work from anywhere other than the address on my record for security reasons. ...
- 11
4
votes
1
answer
2k
views
Is it secure to rely on websocket connection?
In a client-server communication scenario over secure websocket, client is authorized securely and from there on, I have two choices:
Assign a unique random ID (session) and check that on subsequent
...
- 306
1
vote
0
answers
259
views
Is this Android FccTest App real and how do I remove it? [closed]
I have been removing unused Apps from my ZTE Zephyr Android phone and I see one called FccTest with the Force Stop and Disable buttons greyed out. It is not running. I wish to remove it, but there is ...
- 11
-5
votes
2
answers
158
views
What is the most crypto-resistive algorithm to safely send information? [closed]
What algorithm is the best to use for storing, sending passwords, account data, and other information between desktop apps over the network.
Looking for the best crypto-resistive algorithm to use in ...
2
votes
1
answer
1k
views
Can I use the same ssl cert to protect my web site and sign my app?
I'm considering buying an SSL cert from my web host provider (smarterasp.net)
They list the cert as :
SSL-S Comodo SSL Certificate - Single Domain or Subdomain
Do you know if I can use that ...
- 123
0
votes
3
answers
439
views
Tor exit node as CentOS mirror
Today we saw traffic going from CentOS servers to a Tor exit node. This caused some raised eyebrows and led us to investigate what was going on.
In the end it turned out that this exit node also acts ...
- 101
2
votes
2
answers
468
views
Use cases for GnuPG's --(import|export)-options (import|export)-(clean|minimal)
I'm wondering in which scenarios I would make use of GnuPG's non-default --(import|export)-options (import|export)-(clean|minimal)?
The only practical use case I can imagine is to export my public ...
- 121
7
votes
3
answers
1k
views
Knowing if a malware infected something else than the hdd or ssd
I saw a very interesting answer stating that something else than hdd or ssd can be infected : Can a computer virus be stored somewhere else than on the hard drive?
It is very important for me to be ...
- 75
3
votes
1
answer
806
views
Storing database credentials for multi server, multi db environment
What's the best practice for storing database credentials for an auto scaling environment, yet also requiring the ability to update database information?
For instance I have an auto-scaling site on ...
- 797
-3
votes
1
answer
418
views
Is is possible that cheap wifi repeater contains malware? [closed]
There are lot of very cheap wifi repeater on ebay (example).
Could it possible that it have malware pre-installed?
Due to cheap production cost, the repeater must not have much computational ...
- 97
14
votes
3
answers
4k
views
How would a backdoor gain persistence
I know that if you were to gain access to a system and restart it, an implanted backdoor would be killed. Or if you were to locate the backdoor in task manager you would be able to kill it. However, I'...
user160431
2
votes
1
answer
198
views
Security of assets/media on s3
I got my application written in Flask (Python 3.6) and running on EB.
I need to implement content editor which will allow to upload files on server and I would like to store them on s3. Most of ...
- 123
3
votes
2
answers
916
views
I connected to an apparently password protected WiFi without giving a password
My partner and I have just moved house and we're waiting for our internet to be connected. We're living in a group of units and as you'd expect there are numerous WiFi networks, all secured... or so I ...
- 195
1
vote
1
answer
115
views
Downloaded MailMergePro file seems to have virus attached
I downloaded MailMerge Pro from http://www.standss.com/emailmerge/download_process.asp website and i scanned it on VirusTotal.com and two of the antivirus flagged it.
I am sharing the link for same, i ...
- 153
30
votes
5
answers
22k
views
What protects a JWT from being hijacked and used to pose as the original user?
Sorry for this possibly silly question, I'm just learning about JWT so please bear with me...
I read the JWT docs extensively but I don't understand what prevents a hacker from hijacking the JWT and ...
- 425
6
votes
1
answer
5k
views
How to find out if our files are digital watermarked?
How do we find out if our files (audio, images, pdf, videos) are digital watermarked by the distributors?
- 69
5
votes
1
answer
1k
views
Is it possible to do exploit-free Linux keylogging with non-root client-only X Windows access?
Lets say that on a Linux system I use bubblewrap to sandbox an application and give it write access to /tmp/.X11-unix so that it can be an X Windows client. Is it possible for the sandboxed ...
- 153
0
votes
1
answer
144
views
What are requirements for a cookie authenticating an user?
At my company we can't use session to keep users logged because the website is splitted between node and PHP backends. We thought of generating the user a token after he logs in and store both this ...
- 131
1
vote
1
answer
347
views
What is MCO Attack
I have received an email from the Data Center that we might have been under an MCO attack, we didn't know what that meant and all they could tell is that MCO stands for "Multiple Client Outage" and ...
- 11
1
vote
0
answers
201
views
Securing Private data- Is TLS enough? [duplicate]
I have a certificate, with weak ciphers disable, following OWASP recommendations. My framework handles private data that can not be exposed. Is it enough to use TLS to secure the channel? Or should I ...
- 134
2
votes
1
answer
263
views
non-cryptographic hash function with output changing just as much as the input [closed]
The way we know (cryptographic) hashes is mostly that they are totally different if the input is changed for just the minimum amount.
md5('This is some boring string to test with') // ...
- 131
2
votes
0
answers
5k
views
SNI and hostname provided via HTTP are different error
I am using Apache 2.2 webserver on ubuntu Aws instance. My website goes down with below errors on error log,
[ssl:error] [pid 46283] AH02032: Hostname provided via SNI and hostname provided via ...
- 135
-3
votes
1
answer
847
views
What role does Java play in Cyber Security [closed]
I'm interested in the world of Cyber Security and the role that Java development plays within it. Is Java used as a language for carrying out pen testing for instance? If anyone has any pointers or ...
1
vote
0
answers
158
views
Secure deployment of xpdf on production
I have an application, which needs the functionality of converting PDF documents to text documents, and then parse them to retrieve information. I am using xpdf utility pdftotext to achieve that.
I ...
- 111
6
votes
1
answer
934
views
Curious about Microsoft "Buffer Security Check" implementation
A very quick background to help you answering my questions :
Learning IDA Interactive Disassembler, the old free edition (too expensive for a hobbyist)
15 year Linux Sysadmin & DBA experience
...
- 163
0
votes
1
answer
2k
views
Zenmap: Can't get hostnames for clients just IP addresses
I have run both a quick and intense scan on my network with Zenmap and I can't get the hostnames of the clients. If I do an ARP scan I get some hostnames and if I use Fing app on my iPhone, I can see ...
- 669
2
votes
0
answers
168
views
Node.js ENV VAR Security
Recently I had a debate with a fellow dev about where to store Node.js env vars.
I always use .env files and load these as proper ENV VARs at runtime, however my fellow dev uses JSON config files and ...
- 2,849
0
votes
1
answer
196
views
Logs for staging servers
Is it required to have logs for staging servers for PCI DSS requirements where the real cards are not used in this environments.
- 665
2
votes
2
answers
710
views
How can a website find an IP behind a proxy using DNS methods?
I read a whitepaper from Iovation in which they discussed unmasking the
IP behind a proxy.
"The method wherein the connecting host is an anonymizing proxy or
intermediate device, measuring ...
- 59
1
vote
2
answers
2k
views
How can I hide a DAO or ADODB connection string in a Word document or template?
MS Word documents have a Visual Basic component that allows processes to be executed when specified events occur.
One of these events is Document_New(), that can be used like this to pop up a "...
- 111
0
votes
1
answer
950
views
Check if a password for encrypted ms office document is correct
I am writing a Python program to decrypt a MS Office encrypted document.
Referencing This GitHub Repo for reference.
Now what I want to do is try bunch of commonly used passwords against the document....
- 101
1
vote
2
answers
2k
views
Is it dangerous to have unused Windows 10 Defender Firewall rules active?
I recently discovered that a bunch of games I've installed in the past (from legit sources) have activated many Windows Defender firewall rules viewable from wf.msc. Some of the games I have since ...
- 225
2
votes
0
answers
141
views
Can a pure external disk be a threat to Ubuntu computer
I bought a used external disk and now I wonder if any threats can occur from this. Its a disk without casing, so I'am using my own USB adapter. Is there anything else I should take care of when I ...
- 229
3
votes
1
answer
882
views
Client Certificate Authentication enough multiple server-backends and multiple server-clients
I have a flexible number of servers A (same type of servers but located in different regions, so serving different data) that need to authenticate api calls from a flexible number of servers B (same ...
- 153
2
votes
1
answer
6k
views
How to secure handshake system-to-system in RESTful API calls without user/pass?
I have system X from another department in our company that sends basic user info (not passwords) to my system using RESTful API. Both systems are using subdomains of the same domain but reside on ...
- 425
3
votes
1
answer
1k
views
What do these signatures of my PGP key mean?
When I was viewing the key information of my PGP key on a key server, I couldn't understand the meaning of some of the signatures.
Here is the key information from the key server(https://pgp.mit.edu/...
- 425
1
vote
0
answers
85
views
How to mutually share values without influencing senders [closed]
Goal
I want Alice and Bob to communicate a message without their answers influencing each other. More formally:
Alice wants to send Bob a message, a.
Bob wants to send Alice a message, b.
But Alice ...
- 119
7
votes
2
answers
16k
views
Is OWASP ESAPI still the recommended way to secure JSP pages
I noticed OWASP ESAPI hasn't been updated in a while (minor update in 2016, and before 2013). Are there better alternatives to using it i.e. using a more maintained framework's utilities for say ...
4
votes
2
answers
1k
views
How can one trace and prove who leaked a document?
Imagine I have a document with confidential information (new technology, stock information, ...)
I would like to send it to a couple of people for review
They will all sign an NDA
But someone leaks it
...
- 41
0
votes
2
answers
329
views
Possible to receive welcome emails without visiting website?
I don't know if this is the right place to ask this question, but I would like to give it a try.
A couple of days ago I was looking for a product that I wanted to buy. Visited a couple of websites, ...
3
votes
2
answers
2k
views
Unexpected TLS extension reply in server hello
What is the expected behavior when a server hello contains an unexpected reply for a TLS extension (e.g. ALPN)?
Should I (as a client) terminate the connection or just ignore the extension? Is it ...
- 133
12
votes
2
answers
5k
views
Is there greater risk to browsing websites with invalid certificates than websites with no certificate at all?
The information security community is generally very adamant that users should not proceed to visit websites that have invalid SSL certificates. Web browsers have gotten less and less cooperative with ...
- 377