0
votes
1answer
7 views

Why are buffer overflows executed in the direction they are?

I'm following The Security Tube's video here: https://www.youtube.com/watch?v=RF7DF4kfs1E He overviews buffer overflows, and mentions how memory is executed from highest to lowest in the stack (at ...
1
vote
0answers
8 views

Vega Scanner Took Website offline? [on hold]

I used the Subgraph Vega scanner to scan a website, I wanted to get any linked social media pages from their site. Anyway soon into the scan the page went offline with a 404. I checked with different ...
0
votes
1answer
5 views

PHP and other files on the server, their visibility and access

Let's say I would like to protect my PHP files that are on the public server and are used as a part of the website. Does anyone can easily access these files just like HTML/JS/CSS files through ...
-3
votes
0answers
16 views

reusing old bank issued security device

i have several security devices issued by banks and wondering if there is any way to reuse, reprogram or repurpose to use with more contemporary services such as lastpass and / or google authenticate? ...
1
vote
1answer
15 views

Downloading and updating the software via Playstore

I'm using android play store to download and update software for my phone. And some times its automatically updated as by settings.The play store is linked to one of my Gmail account. Here my question ...
-4
votes
0answers
22 views

how to decode this license file [on hold]

I need to decode a license file so I can make mi own license for other users. The string look like this: oAZNM3RSIFR4TUaPRhoYL+1bcAvd8vS5xIWFrZF4omtI2EDMWfLCrmN/ldwvzI9HLU6KGN98rlnpn/ ...
0
votes
0answers
27 views

Full key space coverage when generating a rainbow table

Many rainbow tables available online have different tables for various character sets and lengths. Are tables like these usually completely exhaustive for those character sets/lengths? For such a ...
-5
votes
0answers
22 views

Which is best secure public DNS server for free [on hold]

Which is best secure public DNS server for free.
5
votes
3answers
113 views

Looking for credit card data and other PII in files

I'm looking for ways to check for the presence of credit-card data and other personally identifiable information in files on a network I'm testing. Currently i'm doing this manually with the usual ...
-1
votes
0answers
14 views

How to identify the script that's sending spam from my server? [on hold]

So, this is what I wanna know. How do I identify the script that is sending spam from my server?. Server is using exim. Maldet scanning did not help much. Any advises ?
1
vote
2answers
33 views

Should a password ever be presented in plain text to a user (On a website)? Is this illegal under UK Data protections act? [on hold]

There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins. ...
1
vote
2answers
25 views

Is it good practice to let Node/Go/… act as a frontend webserver?

I'm used to writing web stuff in PHP and let Apache or nginx handle the actual HTTP handling and load my code via whatever means (mod_php, fcgi, fpm, ...). I'm under the impression that this is a ...
1
vote
0answers
14 views

Will this code run in real machine or is it some kind of Anti Reversing code? [migrated]

I am reversing a file which is not running properly in Vmware.The code from the AEP is as shown below : POP EDI ; value of edi is 0x7C816D4F kernel32.7C816D4F PUSH EAX ;value of eax is 0 INC ...
3
votes
4answers
53 views

What's to stop someone from just MITMing a checksum?

A lot of sites offer MD5 or SHA sums to verify the validity of your download, but why do some things rely almost entirely on this? Is there anything in place to prevent people from just replacing ...
4
votes
2answers
28 views

Is hashing schema information for client when generating SQL queries more secure?

I'm planning to implement a web system wherein APIs and presentation for CRUD in data tables are automatically generated, like that in phpMyAdmin. How I plan to implement this is to construct SQL ...
-2
votes
0answers
17 views

Access encrypted hard drive with password login [on hold]

I was doing an anti-virus scan and there was a .ecryptfs file that the scan would always get stuck on even for days, that is because it was encrypted file. Somehow I managed to disable the function of ...
-3
votes
0answers
17 views

New case, audio not detected [on hold]

As the title says, I moved to a nzxt phantom case and now my audio say's "Not detected" I've tried reformatting and reinstalling drivers, no help. First person who helps me gets paypal dollars.
3
votes
3answers
277 views

Can this modified 'Many' Time Pad be made 'stronger' by using an extrememly long key?

Starting with a one time pad say you want to encrypt some small strings like the words in this sentence but you want to reuse the same OTP key for each string so that when you encounter the same word ...
2
votes
1answer
28 views

Can you steal session cookie with BREACH attack?

Most of the discussions about the BREACH vulnerability are around stealing session-based CSRF tokens. But if you can steal a session-based token, could you also steal the session token itself? ...
0
votes
0answers
17 views

No VirtualHost filter (a good practice?) [migrated]

I am trying to figure out the cons of a current setup and discovered a potential anomaly. There's a webpage hosted at (say) webpage.com. If I point my domain (say) mydomain.com to the raw IP of ...
-5
votes
0answers
40 views

Link to more active security sites? [on hold]

I have a BS/MS in Computer Science and have worked as a developer for 15 years. Currently I have been reading a lot about computer security. Serverfault and Stackoverflow seem to be the go to place ...
0
votes
0answers
30 views

How can I encrypt in the column level of SQL for numeric data [on hold]

I want to encryption in the column level of SQL for numeric data.What should I do?Is there an algorithm for this? Where should I put the function of encrypting in the source code?
-2
votes
0answers
56 views

Am I a victim of industrial espionage? [on hold]

I had a weird experience, that I don't quite know how to explain. My setup is this: I have my desktop machine, which I connect to my company's VPN. On this machine I also run a VirtualBox VM with ...
1
vote
1answer
31 views

Using a Cryptovariable with an API Designed for Human-Generated Passwords

I'm working with a vendor who provides an API with a user registration method clearly designed for human-generated passwords. We're calling the API in an offline server-to-server fashion, however, ...
0
votes
1answer
23 views

Acceptable secure solution to replace static IP addresses for a web application

I am currently working as a technical lead on a project at a financial institution and have a question about how to provide the same level of security expected by the business in an application we are ...
4
votes
2answers
77 views

Shop saves credit card data from guest orders

A web shop allows customers to order as guest or to create an account. I ordered as guest, entered my email address and the shipping address, and payed per credit card (I had to enter the security ...
-1
votes
1answer
15 views

combining imperfect random number generators for shuffling an array

Shuffling an array to create a random stream for encryption is well known. The weakness is in the security of the random number generator that performs the shuffling. But is it true or likely that the ...
-1
votes
0answers
24 views

How Does AES Encryption Work? [on hold]

I'm looking for conceptual but semi-detailed step by step explanation of the AES encryption process, from plain text to encrypted text. The explanation should assume knowledge of basic programming ...
0
votes
0answers
12 views

What else can we now do with the new GCC5 to improve codebase hardening [on hold]

Noting the recent question: What is the most hardened set of options for GCC compiling C/C++? Is there anything else that can be shared regarding the new version of GCC, v5 for 32/64bit targets. I'd ...
0
votes
2answers
51 views

Is it possible to take back the control from an MITM in progress? [on hold]

I heard that MITM also involves DNS poisoning, which basically tells the Net to take a different route than it was supposed to go.. (I'm not sure if my interpretation is correct..) Given there is an ...
2
votes
1answer
27 views

Ability to determine which PGP public keys a message has been encrypted for?

Is it possible to determine, given a PGP message that you can already decrypt, to determine which other PGP keys that message has also been encrypted for?
0
votes
1answer
15 views

Would an IM app server holding user's messages long after the content was delivered be an issue of personal data protection? [on hold]

Take a IM app like WhatsApp. If I send a message to another user while their client is offline, the server holds the message and then delivers it when the receiver's client goes online. It even has ...
2
votes
1answer
18 views

Security of reading articles via an RSS reader

Would a site or blog owner know who is reading their site if the visitor is reading it with an RSS reader? Can they get the IP of the person? Say I had a Netvibes account with RSS feeds, can the site ...
0
votes
0answers
21 views

antivirus/anti-malware vs rootkits on Windows [on hold]

As I read about rootkits I wonder how well the current antivirus vendors are with detecting them. Does anyone know of a site with a current comparison test? For example, this ...
0
votes
0answers
33 views

someone attack my wireless [on hold]

02/27/2015 15:30:03 sending ACK to 192.168.2.3 02/27/2015 15:26:11 sending OFFER to 192.168.2.2 02/27/2015 15:25:10 sending OFFER to 192.168.2.2 02/27/2015 15:25:10 sending ACK to 192.168.2.3 ...
0
votes
0answers
23 views

Choosing a SSL Certificate Issuer [duplicate]

I am going to buy a new ssl certificate that supports SHA2 algorithm for our web services. Web services will be used by variaous java clients written in java6, java7 and java8. We have got a ssl ...
8
votes
2answers
658 views

Question About HTTPS Security [duplicate]

I recently read about how HTTPS work and I have some questions to clarify. Pardon me if this sounds silly but I just need to get this clear. Correct me if I am wrong. I got to know that as part of ...
1
vote
0answers
26 views

Imported CA certificate to Firefox Browser not working [migrated]

I created Certificate Authority (CA) according to Ubuntu help using openssl. After creating a certificate for Apache2 and adding to certificate to it, I want to import it in Firefox. In the end of ...
3
votes
0answers
21 views

How do I request a certificate from CEP / CES on a Microsoft CA on OSX or Linux? [migrated]

This article describes how to request a certificate from AD CS (Active Directory Certificate Services) from a non-domain joined windows computer. I would think the same principals apply to non ...
-2
votes
0answers
33 views

are there commonly known risks of PHP generated email? [migrated]

In the following code, an email is sent via PHP, Apache, and Linux. A comment from a website user, $comment, and her $emailFrom address, are obviously potentially of an unknown nature. Do these fields ...
-2
votes
0answers
19 views

How i can secure authentication with php? [on hold]

I have an identification with id and password , after the user enters the ID and password, then script php search in the database ( mysql) if the id and password exists in the table. Can you tell me ...
3
votes
1answer
96 views

Do WebGoat style XSS attacks still work?

I am going through the WebGoat exercises, to refresh my knowledge of XSS attacks. Specifically, I am doing the Stage 1 XSS exercise. This exercise has a form that deliberately does not sanitize ...
0
votes
1answer
22 views

Why first kerberos message is not ciphered

When analysing Kerberos exchange (and other similars as Needham, Denning, etc.) I wonder why the first message where the identities of the client and remote are not encrypted. In case not encrypted I ...
0
votes
0answers
20 views

Is iris identification a better way to protect your system than password protection? [on hold]

There are many iris scanners already launched in the market. Many are buying them and try to combine them with Computers to maximize protection. Do you think that this kind of protection is enough?
0
votes
3answers
85 views

How to make a secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces, one is a service like application that handles all the logics, the other one is a GUI application that just works as a ...
0
votes
0answers
17 views

Can we outsource IPS and SIEM monitoring to a service provider? [on hold]

We are planning to outsource our IPS and SIEM monitoring to a service provider. My question is do they have to be PCI Compliant certified as well?. How about if they remote in our environment and ...
1
vote
1answer
16 views

Can we use same Active directory / Proxy servers for PCI and Non PCI Segment users?

Can we use the same AD server for both PCI VLAN user and Non PCI VLAN users? How about proxy, we have a Proxy but both PCI and Non PCI user's traffic are flowing through those Proxy. But we have ...
0
votes
0answers
11 views

Best practices to invalidate JWT while changing passwords and logout in node.js?

I would like to know the best practices to invalidate JWT without hitting db while changing password/logout. I have the idea below to handle above 2 cases by hitting the user database. 1.Incase of ...
-4
votes
0answers
45 views

I'm asking for input I'm not sure what's going on [on hold]

My son has not been able to download anything on his phone. We both have an LG optimus. It says that his filtering level does not allow him downloads. I went into his phone and tried to change his ...
-1
votes
1answer
35 views

Do we need to same PGP version for decryption [on hold]

Requirement: In our company Location A uses PGP encryption and sending data over internet. In Location B, we have to decrypt the file. Question is what do we require in Location B Do we need to ...

15 30 50 per page