0
votes
0answers
2 views

How does OTR's authentication using “Question and answer” protect against MiTM?

I've read that the answer has something to do Socialist Millionaire, but I still don't understand how can the user be protected against malicious Man In The Middle, which would capture the question ...
0
votes
1answer
6 views

MITM attack disconnect target machine

When i am making arp spoof to preform mitm attack the target machine internet disconnect and appeare yellow triangle on the internet icon why ??
0
votes
0answers
6 views

MITM protection, key distribution

I want to make sure each of my apps users only get their own data, and that nobody tampers with it or sniffs it in a MITM fashion. Encryption of everything should be the solution, right? But how do I ...
0
votes
0answers
10 views

Perform THC-Hydra Dictionary attack on Microsoft forefront TMG login

I work as an IT consultant in a High School. Recently, a student was able to gain access to a teacher's account on the school intranet. When questioned, he simply stated that he "hacked" the system ...
0
votes
1answer
9 views

Implementing MITM attack on MAN or WAN

Is it possible to implement MITM attack on larger networks than LAN? For example is is possible to implement such an attack on the whole network of an ISP?
1
vote
1answer
12 views

When to apply for a CVE?

When you find a vulnerability, do you contact CVE assigners before contacting the vendor or after the vendor has fixed the problem? PS: do not link to How are CVE identifiers assigned and managed?, ...
0
votes
0answers
9 views

An XSS attack is working on Firefox but not on Chrome..Suggest changes to make it work on Chrome

I am able to inject this: http://domain.com/search/songs/<img src='alert(document.cookie)' onerror='alert(document.cookie)'> to the page HTML. The onerror event is giving me the cookie on my ...
-2
votes
0answers
13 views

bash script find word and return value [on hold]

i need to search in the file x.html and find the name of input and it will return tha value of the input . forexemple x.html have: the script must return to me the value when i give him the name of ...
-1
votes
1answer
17 views

Can we take text from copyrighted books in our mobile app for education purpose [on hold]

If I copy some text from a book which have copyrights, then can we use their data, to make our smartphone apps? By doing so will I break the law, if so what actions can be taken upon me...? And what ...
1
vote
0answers
20 views

Are dialers obsolete?

My antivirus picked up an infection by Dialer/Coulomb. The definition of a dialer is a piece of malware that dials a number that charges money. How would it do this, is this from when modems were ...
0
votes
1answer
9 views

OIOSAML: assertion consumer does not work

I wrote a simple system with SP-initiating Web SSO scenario based on OIOSAML. To test the system, I deployed it on the remote host. However AssertionConsumerServiceURL, where I specified URL, on which ...
1
vote
0answers
18 views

Should my server ever need to directly communicate with the NAT gateway? [migrated]

What I mean by ``directly communicate'' Does it ever need to receive packets with the gateway's IP address as the source IP address, or send packets with the gateway's IP address as the destination ...
0
votes
3answers
46 views

Recommendation for identity system

I want to develop a system, something like a comment system for a website, that ensures I know who is posting comments. The content that is exchanged is not valuable and does not need to be encrypted, ...
0
votes
2answers
44 views

Showing CAPTCHA

I'd like to show a CAPTCHA to prevent brute forcing attempts, but I was thinking of showing it whenever a user fails for an invalid username/password combination after X attempts, regardless of ...
1
vote
2answers
53 views

Byte swapping encryption algorithm security flaws?

Honesty commands me straight away to say that I'm not a professional, but I'm fascinated by data encryption. This algorithm won't be used in production code, so please don't flood me with "Don't ...
0
votes
1answer
26 views

Authentication for my app

i'm currently building an authentication module and got a question about something, I have setup a server with an api and want my users to authenticate to this server but everything with angular is ...
0
votes
4answers
38 views

Can a virus on the host affect the VM guest [duplicate]

let me explain my problem. The wifi on my macbook suddenly stopped working so tried to use my usb wifi adapter on a linux VM. But the funny thing is that nothing works on the guest vm either... Well ...
2
votes
1answer
33 views

Usefulness of bcrypt(UUIDv4())

One of my colleagues is working on securing OAuth 2 client IDs and secrets for our OAuth server and he has come up with this scheme where he would not only use UUID v4 to generate random values, but ...
0
votes
0answers
45 views

Apple ID phishing lead to my router infected?

For future visitors, I will try to be as general as possible, but I must include details to give you a full picture. As my Apple ID's security email address belongs to my brother, he forwarded an ...
0
votes
3answers
31 views

what can we do with a xss non persistentvulnerabilities

Sorry for this stupid question but i'm thinking about what an attacker can do with a non persistent XSS attack on a website ? An attacker can just do try to phishing me with a malicious url , steal ...
1
vote
0answers
23 views

Can a malicious user do any harm using /dev/kvm?

I'd like to know if giving access to Intel version of /dev/kvm on Linux to a user that just wants to spawn VMs gives him any extra privileges. That is, are her VMs subject to process scheduling just ...
11
votes
5answers
1k views

Should I let a user know they have entered an unknown username or email address?

On my website I have a password reset page that users can use if they have forgotten their password. On this page they can enter their username or their email address and hit "reset" which will send ...
0
votes
0answers
12 views

What are tools like webutation or mywot worth, and are they a threat to my privacy? [on hold]

sometimes when looking for Firefox advices on security/privacy, plugins like WOT or Webutation are recommended. What are the implication of this tools ? Who is behind them, and with what intents ?
0
votes
1answer
49 views

A no-login approach to authenticating a certain device, MAC-Address as password?

I have created a REST api, and now i'm thinking about authentication. I want the mobile application's flow for the user to be very simple: only having to enter a username and then this username ...
0
votes
0answers
32 views

If an SD card is stolen, is there any way to know on which date last photo was taken? [on hold]

I use a Canon 60D. My SD card was stolen. Someone else took the camera and returned it to me without the SD card. Is there any way to find out on which date the last photo was taken by this camera?
0
votes
1answer
49 views

Should remote access (RDP/SSH) only be allowed for VPN clients? Or should RDP and SSH be opened the public?

I am about to push hard against the powers that be and recommend that strongly that we shift our many (20+) consultants off of direct public access to RDP & SSH, to VPN clients (connecting to a ...
0
votes
1answer
35 views

Is there any need to penetration test a GoogleAppEngine solution?

Is there any need to penetration test a GoogleAppEngine solution? Or will it be protected by googles existing infrastructure?
8
votes
4answers
868 views

Why enable SMTP STARTTLS if OpenSSL is dangerous?

There are a bunch of people in the anti-surveillance movement who are virtually demanding that I enable SMTP STARTTLS support in my environment, in order to enable opportunistic MTA-to-MTA encryption. ...
-5
votes
0answers
61 views

How to hack someone ip address and remote control [on hold]

is it possible for hacking someone computer through ip address and remote control without permission that computer ,,, is there any software available for that , please tell me hacking tips
2
votes
4answers
105 views

password generating algorithm

I read the question about the relevancy of the xkcd password creation algorithm. Would it be more secure if you used a string of common words with a function that only you knew that would rearrange ...
-1
votes
0answers
12 views

Cannot send session cache limiter - headers already sent [on hold]

In my index.php i have create a code like this <?php ob_start(); session_start();?> it above the html tag. before it was okay but when i edit the file it give me warning that Cannot send ...
-1
votes
0answers
23 views

Port forwarding does not work for http sites [migrated]

I am connecting to office network through VPN. I have two servers A and B. I have ssh tomcat access to A through VPN but not to B. When I ssh into A, from there I can ssh into B. Also, B is running ...
0
votes
0answers
43 views

Advantages/Disadvantages of session resuming in security protocols [on hold]

Aside from no need for a new key, are there any advantages (or disadvantages) of session resuming in TLS?
0
votes
1answer
53 views

Any example where client certification is required? [on hold]

There are some optional cases in SSL/TLS where server can demand the certificate of the client. Can anyone give me any example regarding this? Thank you.
0
votes
1answer
26 views

Is an Antivirus scan via network share equivalent to an offline scan of the system?

When a system is suspected to be infected, one of the measures often recommended for cleaning the system (without actually taking the "nuke from orbit" approach) is to scan the drive with anti-malware ...
2
votes
1answer
53 views

Do SSL / X.509 certs cover all ports for a host?

Or are certs both host- and port-specific (excepting wildcard certs)? I would assume they aren't, because they're supposed to verify a domain, but at the same time I've never seen anyone run HTTPS on ...
0
votes
0answers
29 views

Steps for creating a test environment where GUIDs are exploitable?

I have been using GUIDs as un-guessable tokens in various situations for some time. I came across this question/answer which seems to suggest that while this is ok in some situations, it should not ...
0
votes
1answer
25 views

What parameters to check to say that a computer running Windows is slow in responding because of infection?

When interaction between the user and the operating system is too slow (Windows become slow in responding to different user's request): what parameters could we check (and that we could use within a ...
1
vote
1answer
33 views

Is it safe to call an untrusted service with jquery.ajax and dataType 'jsonp'

From what I understand, the JSON-P technique generates a script tag into the DOM of an HTML page to get across the single-origin restrictions imposed on the XMLHttpRequest JavaScript API for AJAX ...
4
votes
3answers
108 views

What implementations are possible for dual control?

An organization requires employees to use 2 person authentication in some scenarios. That is, when accessing, say, a server, secret knowledge from 2 people should be used for authentication. No one ...
0
votes
0answers
16 views

Looking for a way to back up checkpoint .tgz config file securely using scp/sftp [on hold]

I am looking for a secure way to back up a checkpoint firewall's config .tgz file. Here's the rub... The checkpoint firewall is running IPSO which will not allow me to provide a password in the ...
1
vote
2answers
79 views

How can Joe Citizen report or at least hamper a phone-based PC scammer?

Within the last week, I've received 3 phone calls at 3 different locations from technicians who are calling "from Microsoft" about "Windows problems" that they've detected on my PC. Which they ...
1
vote
1answer
23 views

Exchange 2013 blocks txt file attachments - are there security reasons?

My Exchange Admin is setting up 2013, and it is set to block txt file attachments specifically (as well as others). I have tried searching for risks associated with txt attachments but could not ...
4
votes
3answers
161 views

Would it be secure to generate random number using AES?

I know that there are already tools out there to generate cryptographic random number, but I was wondering if using AES could do the same. For example, I have a secret key for AES on my server and a ...
1
vote
2answers
27 views

Should application logs be available to admins or just superuser?

I'm developing a kind of standard web-application, to be hosted internally on few customer's servers (not a public service, startup or anything like that). A kind of CMS, e-learning platform or ...
1
vote
1answer
27 views

What are the webmalware effects on Windows XP?

I am redirecting URLs to a virtual machine (Windows operating system) to check if there is malware on the website i want to visit (JavaScript attacks, drive-by download attacks, infected pictures/PDF ...
-2
votes
0answers
47 views

Could remailers achieve their goals under conditions of ubiquitous (total) surveillance?

I am not certain but I am afraid that the answer to the question would be negative, if the following arguments couldn't be clearly refuted: A sender of a message has to choose a (first) node of the ...
0
votes
1answer
42 views

Preparation for Blue Team Competitions [on hold]

I am a CS student, and am considering competing in the National Collegiate Cyber Defense Competition. Although I have a fair amount of experience in programming competitions (e.g. ACM at High School ...
2
votes
2answers
88 views

Is it possible to keep your harddrive data safe from being copied and recovered

One of my friend challenged me that if my laptop is turned on then he can attach a device to it, just like in movies which will copy all data of my computer to his hard drive without touching a single ...
0
votes
0answers
29 views

Firewall init script [migrated]

On Debian, what is the best way to start an iptables firewall script : /etc/init.d/firewall_script.sh in /etc/network/interfaces, add post-up /etc/network/if-up.d/firewall_script.sh Do you check ...

15 30 50 per page