0
votes
0answers
7 views

Reformatting drive from a GUID partition to an MBR partition

I understand that Truecrypt is not compatible with an GUID partition but that is the limit of my knowledge. I am currently using a system that has a GUID partition but doesn't have bitlocker ...
0
votes
1answer
11 views

Could a spoken (TTS) SMS-based 2FA be intercepted?

Today I am feeling brave, and have a nagging question to ask. It's probably incredibly obvious and/or stupid, but I won't know until I ask. In mid-June, Lastpass made news again, and I've since been ...
0
votes
0answers
8 views

Can Client Certificates be tied to a Specific Server Certificate?

I have a Root Certificate Authority and and Intermediate Certificate Authority. I have created a certificate for the server. SSL on Apache is working fine. Browser recognizes my Chain of Trust with ...
-1
votes
0answers
15 views

a pdf that is really a zip with a pdf inside?

I have a pdf file but really is a zip file with another pdf file inside ( so the file wx000.pdf when renamed to wx000.zip ) when trying to open the zip you will see the pdf inside but ask you for a ...
1
vote
0answers
18 views

What are some or all the security compliances?

What are some of the security related compliances such as HIPAA, NIST or PCI-DSS? is there a comprehensive list of all of them or some real major ones?
1
vote
1answer
40 views

Why am I getting the message that Security Stack Exchange is only partially encrypted?

I realize that this is an information website but it does concern me a bit that I'm getting the message that this website does not supply ownership information. Does this mean that my posts can be ...
-2
votes
2answers
31 views

HTML Sanitization

Is just removing < and > from any user input before it is displayed sufficient to prevent a website from being hacked? If not, how else could a website be attacked? I really have no idea what I am ...
1
vote
1answer
24 views

Best method for securing text based messages

If I wanted to use a device for the sole purpose of sending and receiving text based messages, could it be done so that the messages from A to B are as secure as possible, the information is easily ...
1
vote
1answer
25 views

Receiving random numbers in GET request query string. Exploit?

I recently spun up a web server and have been receiving hits where the client appends a random number, for example "12345" as a query string to the root (/) endpoint. Here's an example log entry: ...
0
votes
0answers
24 views

How to track who created a fake Gmail account using my name

I was forwarded an e-mail from my boss that was sent from a fake Gmail account that was created with my first and last name in the username, and included in the message were extremely derogatory and ...
-4
votes
1answer
33 views

Is a ZIP file password easy to break?

I thought that ZIP file passwords were a fairly decent protection. I came across this video, that seems to indicate otherwise. https://www.youtube.com/watch?v=SqRSNuJSm4o [12 minutes view time] ...
4
votes
3answers
274 views

SFTP on Windows - is it likely to be disabled?

I'm a software engineer and I'm maintaining a product that allows a user to run commands and scripts on Linux servers via an SSH connection. We now need to extend this functionality onto Windows. We ...
0
votes
1answer
19 views

Affordable FIM, log monitoring, policy enforcement/checking, IDS?

I've been working with OSSEC for awhile, and it's just been head ache. What are some linux Intrusion Detection Systems that do File Integrity Monitoring, Log Monitoring, and policy enforcement (same ...
1
vote
1answer
57 views

How was my email intercepted?

I've recently sent an email to a non-Protonmail user, using a code phrase. Someone on the recipient's home network was able to intercept the email and responded to me in detail as to the content of my ...
1
vote
2answers
20 views

Multiple Versions of Intermediate SSL Signing Certificate

I was checking out the SSL chain on onlineaccess.ncsecu.org because a network glitch made me paranoid. Both Firefox and IE on my computer have this chain: onlineaccess.ncsecu.org Serial number ...
1
vote
0answers
23 views

Basic scrypt question

Suppose we throw a regular password into scrypt to generate some data. Scrypt allows us to specify how large the output data should be. My question is, to take an extreme case, if we ask for a 1 GB ...
2
votes
0answers
22 views

A simple HMAC question

Suppose I use a key (and IV) to encrypt a piece of binary data with AES-256-CBC to produce the corresponding encrypted data. Suppose I then throw this encrypted data into HMAC-SHA512 using the same ...
4
votes
2answers
111 views

Is storing encrypted data in a database futile?

The way I see it: there are two ways to encrypt data for a web app. 1) Store a single encryption key on the server, and use it to encrypt / decrypt data at runtime. The obvious issue here is that if ...
15
votes
1answer
1k views

What is this? Virus or scanner?

I found a new file in my WP root folder and contains this text: <?php ...
-3
votes
0answers
62 views

How does a person fully secure his home IT infrastructure [on hold]

I'd like to know how to set my router to only let ten specific IP-MAC addresses through? Also if the Windows 7 OS & 8 OS can be set so that malware/spyware cannot operate to give permissions to ...
0
votes
1answer
25 views

Certificate validation Local DNS hosts file

I've a question regarding a certificate validation error I'm getting. I'm performing an https request from one machine to another (windows machines). On the destination machine I've configured a ...
1
vote
0answers
19 views

Is it okay to add CSRF synchronized token by modifying HTML from a valve/filter?

Is it okay to modify the html and add a hidden field containing the CSRF token to all the forms inside a page using a valve or a filter before going to the browser? I'm thinking on this line since I ...
-4
votes
1answer
48 views

MPR I suppose somehow I found a way to make a super hacker angry with me [on hold]

I suppose somehow I found a way to make a super hacker angry with me. I've lost three cellphones. It might have all started with the iPhone 4 getting locked then both androids to simlock. And I'm at ...
1
vote
1answer
40 views

Different types of DDoS attacks

What is behavior of UDP flood, TCP SYN flood, Ping of Death and Smurf attack?
13
votes
2answers
493 views

ISO27001 and Linux/Ubuntu

My company has ISO 27001 certification. They provided me a new laptop with Windows 8 OS in it. I asked if I can have a Linux/Ubuntu OS installed, they said that it is not possible due to the ISO 27001 ...
0
votes
1answer
29 views

Setting the HTTPOnly flag for PHPSESSID cookie

I am getting this message from my security audit: Cookie name: "PHPSESSID" Cookie domain: "xxx.xxx.xx.xxx" If possible, you should set the HTTPOnly flag for this cookie. How can I set ...
-1
votes
2answers
35 views

I can't copy files from a HDD, do I need permission from my own account?

My friend wanted me to backup all the photos and music and text documents on his hard drive so I'm trying to do that. He gave me the whole computer. It's an OEM machine from 2005 running Windows XP. ...
0
votes
1answer
36 views

Staying logged in as a user for remote access (such as Team Viewer) Pros & Cons

This company we newly help have no remote access policy for say, but they allow the users to use Team Viewer. I have noticed some user leave their PC logged in all night and weekends and just shut ...
1
vote
1answer
62 views

Secure Flag and HSTS in HTTPS Only site

If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
-2
votes
2answers
32 views

What is the weakness of aircracking wifi attacks?

I did not come to anything after searching Google for some time. What's preventing someone from just doing an aircrack wifi atack and do any kind of attack once logged on the victims network?
0
votes
0answers
14 views

OSSEC is making AWS EC2 instance w/ Centos 7 become unresponsive

If I start OSSEC, my Centos 7 AWS instance becomes unresponsive after a short while (under 30 mins usually). httpd and ssh do not respond ever until I go into the AWS console to reboot it. I've ...
0
votes
0answers
13 views

How to generate “CRL numbers” for X.509 CRL

(Context: I'm working a process to publish a CRL periodically -- eg once every day.) With standard X.509 certificates, "serial numbers" are required to be positive integers, but they do not need to ...
1
vote
0answers
10 views

Requirements Placed on a User of a FIPS 140-2 Validated System

Per customer requirements, I am working with a FIPS 140-2 validated network switch that is actually running in FIPS mode. This guarantees that any cryptographic operations the device performs will be ...
0
votes
0answers
28 views

Using UUIDs for non-guessable URLs

How safe is using UUIDs as URL identifier for non-guessable IDs? Specifically UUIDs generated by Python's uuid4() function, using base64 encoding. E.g. ...
2
votes
3answers
55 views

In the context of SSL Labs where is the “trust store”?

When I'm testing a site with https://www.ssllabs.com/ssltest/ I'm getting this: Could you explain: Why are there two paths? Where do they come from, where are they configured? What is this "trust ...
21
votes
6answers
3k views

Why no self-hosted email? (Snowden, Lavabit, Hushmail, NSA)

Why would anyone like Edward Snowden rely on 3rd party services like Lavabit or Hushmail to host his email? I mean it's very easy to set up a self-hosted email server. What you need: Rent VPS (even ...
1
vote
1answer
30 views

Does any VPN protocol authenticate the server?

When you connect to a server using SSL/TLS the client authenticates the server using the certificate that the server provides. If certificates mismatch an error page is shown instead. So you know you ...
0
votes
2answers
65 views

Could a compromised root CA impersonate any SSL certificate?

My question is about MITM attacks against https and how those would appear to the end user. Suppose a trusted root CA were compromised / coerced into producing fraudulent SSL certificates. What would ...
4
votes
2answers
63 views

Reset links in password expiration emails

Our organization is rolling out yearly password expiration to our 40,000+ users this fall and we have been socializing this change for some time now. However being such a large organization, our users ...
2
votes
1answer
45 views

Tools to demonstrate NO storage of cardholder data

Our organization has been asked to comply with PCI DSS. As part of IT Department, we need to demonstrate that none of our IT infrastructure stores any carhdolder data nor sensitive authetication ...
3
votes
1answer
36 views

Reading magnetic stripe on a credit/debit card with an EMV chip

Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
-1
votes
0answers
38 views

How to reset an HSM server without password? [on hold]

I purchased an HSM online but I do not know the password. Is there a way to reset a HSM server?
1
vote
1answer
38 views

Security server log review

We have a Kiwi Syslog server for Centralized logging purposes. Currently, our focuse is only on monitoring, reviewing and reporting User Account/Password Violations. We already used the necessary ...
0
votes
1answer
48 views

How can I put snort in front of nginx server

I want to prevent attacks to my nginx server. How can I proxy the requests through snort to nginx server. NFQueue's are a solution.I am able to pass packets to snort using the following rules sudo ...
1
vote
2answers
53 views

Methods to keep an autonomous log with high integrity

I'm writing a .NET desktop application that is used to send orders to a server via a REST API. To avoid leaking of our authentication token I have made it so that, when used for the first time, the ...
4
votes
1answer
49 views

How can I see which sites have set the HSTS flag in my browser?

My question is about Firefox and Chrome. Is there a possibility to see which sites have set the HSTS flag in my browser?
-1
votes
1answer
72 views

SSL and Fake Domain

I am reading information related to SSL handshake on the Internet. It seems like in the last step the domain name is compared to the domain in the certificate. How exactly is this protecting against ...
-1
votes
0answers
34 views

how to fix XSS Reflected in java [migrated]

I got fortify report which shows XSS Reflected defect from the below 2nd line. String name = request.getParameter("name"); response.getWriter().write("Name: " + name); Recommendation ...
-5
votes
1answer
62 views

Make really personalised wordlist file

i want to make a really customised wordfile with: 4 letters first + 2 numbers example: divo11 or yeve11 And not like this: p0oiw1 or u4hf3e This wordfile is really important. How can I do it?
3
votes
0answers
103 views

Bypassing Hotel Wifi authentication using VPN [on hold]

I'm currently in a hotel with pay per day WiFi, I have have logged into it a couple of times on my phone. I just turned on my VPN before logging in to the WiFi and it seems to have bypassed the hotel ...

15 30 50 per page