0
votes
0answers
2 views

How do I know which subkey GitHub is using for signing?

I added my gpg subkey to GitHub today and noticed that regardless of which subkey I export, the PUBLIC KEY BLOCK is the same. I have since found this post, that explains why: is-it-possible-to-export-...
2
votes
1answer
21 views

How dangerous is leaking knowledge about existence of objects which the user is not allowed to access?

It is my understanding that good security design does not reveal information about data which the user is not allowed to access. This includes information about the existence of said data, i.e. if a ...
2
votes
4answers
243 views

Is anti-Brexit petition system trustable?

In the last days I hear often about the petition to (pratically) "repeat" the Brexit referendum and I noticed that it is an online petition. I noticed that the "sign petition" form just requires name,...
-3
votes
0answers
25 views

How do I decrypt this unknown cipher text? [duplicate]

I got this unknow cipher text. Can you solve this? This looks like encoded PHP with base64/str_rot13/gzinflate eval. nI31RZG+Rxb1RZGzRMfsOdNql2K9RsesRLDVOdNqnLWtOdNqRtJtRtm1RZG8OdNrmxb1R/...
11
votes
4answers
2k views

SQL Injection is 17-year old. Why is it still around?

I'm no techie and would like your expertise in understanding this. I recently read a detailed article on SQLi for a research paper. It strikes me as odd. Why do so many data breaches still happen ...
0
votes
0answers
24 views

Creating a port snooper/sniffer

Is it possible to create a program, that monitors a traffic to a specific port, be it reserved or used defined? This is because I want to create a system that traps the attacker in a honeypot. That ...
2
votes
2answers
30 views

I have an outdated system that is no longer supported and I want to manually patch security bugs. Is it safe to do so?

How do I manually patch security bugs safely without damaging the system for information security purposes on my Ubuntu system that I am running on my Nook Simple Touch (2011 Nook)? I need to find ...
-2
votes
0answers
24 views

Decrypting keys at the software application level

Does anyone know what the most common method of decrypting data is? I.e., if something is hashed and not decrypted at the firewall, how is it usually decrypted within a system? Is it integrated into ...
0
votes
1answer
47 views

Why, after a certain character limit, are larger passwords labeled as “weak” on some sites?

On many sites we see an indicator if our password is weak, or strong, to give us a good indication to go with that password, or not. I've been noticing on some sites, that after x amount of ...
0
votes
2answers
26 views

Are there any security advantages to forcing a password-character limit on reset, but allowing unlimited character in password-login?

I was resetting a password a few moments ago, and I was given a character limit of around 10 characters to make a secure password with. After resetting the password, I went to enter my password, and ...
-3
votes
1answer
17 views

Why is MITRE not changing CVE entries that are clearly incorrect?

Why is MITRE not changing some CVE entries that are clearly wrong. I have deeply analysed and highly tested some specific vulnerabilities. The CVE reports of them are in some cases inconsistent, ...
0
votes
1answer
33 views

Do these packages indicate nefarious activities?

Being security paranoid, I could help but notice that in my autoremove list that there were two packages I did not immediately recognise and was immediately suspicious of: The first one was ...
2
votes
1answer
67 views

What does Obama's phone say about Android and phone hardware?

The recent article Goodbye Obamaberry, hello Obamadroid describes the decision to move Obama's phone from the Blackberry to the Samsung Galaxy S4. The Galaxy 4S is of course an old, foreign phone. ...
0
votes
0answers
9 views

STUN Binding Requests

When looking at network logs using Snort, I've noticed I receive STUN Binding Request informational alerts when certain websites are visited. For example, when going to investopedia, I've noticed DNS ...
-5
votes
0answers
9 views

What's RSS Validity Checker?

i'm trying to exploit XXE in challenge ! it's about XML External Entity [RSS Validity Checker] can someone tell me about this vulnerability <html><header><title>XXE</title>...
-3
votes
2answers
50 views

Need to learn information security [on hold]

I want to learn about information security so I need some good sources to help me and learn that. I'm still a beginner.
-2
votes
0answers
53 views

virus via facebook [on hold]

So, if I opened the 'tag notice' on Facebook through the Safari browser on my phone, is my iPhone contaminated with a virus now? It opened a new tab which I closed immediately as I saw the weird text.
0
votes
0answers
68 views

A JSE file was downloaded after clicking a notification on my Facebook account [duplicate]

I got a notification on Facebook that says "Finn mentioned you in a comment". After clicking the notification a file was downloaded on my phone. I found it unusual because when you click a ...
3
votes
1answer
21 views

Is using PGP/MIME or PGP Inline more secure?

Using Enigmail for Thunderbird, the setup wizard automatically sets itself to PGP/MIME and also disables HTML formatting. I am looking for security and have no idea which to use, though I do know HTML ...
0
votes
0answers
6 views

VM Introspection on Public IaaS clouds

I came across this Security SE post and a few papers on VM Introspection [1] [2] [3] What prevents cloud providers like AWS from using techniques like these to observe EC2 instance activity? If they ...
3
votes
2answers
49 views

How to secure communications between a web front-end and the web server when/where the HTTPS protocol is compromised?

A country in the Central Asia has issued a law enforcing all the ISPs to decrypt the transit HTTPS traffic and encrypt it with a special certificate issued by the government. Every client is to ...
2
votes
3answers
209 views

What information can you get from a photo?

Often in films about the FBI, we see that from a photo it's possible know: Name and surname of the photographer City where the photo was taken Latitude and Longitude of where the photo was taken ...
0
votes
2answers
36 views

Asymmetric key encryption that can have a public decryption key, but encryption key cannot be computed from that [duplicate]

Is there a way where I can distribute a public decryption key, but the encryption key cannot be computed from that key, so that anyone who reads one of my encrypted message, he/she can be quite sure ...
25
votes
8answers
3k views

Proving creation time/date of a screenshot

I have to produce a screenshot of a web page, and want to make sure others will know without any doubt that this screenshot has been produced today. That is, I would like to embed today's date in the ...
2
votes
0answers
12 views

hash function notations and existing cryptographic hash algorithms [migrated]

I am implementing Role-based access control by referencing the paper Enforcing Role-Based Access Control for Secure Data Storage in the Cloud. In page 6, they have mentioned to choose hash functions ...
4
votes
3answers
513 views

Is sending a password encrypted or as SHA1 any safer than clear text?

It seems to me that if an attacker can intercept my login request (sent with HTTP POST), then he can replay it later, no matter whether I try obfuscate it or not. What am I missing?
0
votes
1answer
21 views

Implications of replacing Java Applets with Client Side Websocket Server

I am no security expert, but do know some concepts. We have a enterprise web application which currently uses Java Applets to do some operations on files in Client's File system (Browse, create, ...
1
vote
1answer
25 views

How to implement the fix for Forward Secrecy on Debian Apache OpenSSL?

My SSL test result was an A- due to forward secrecy. I want to know how to implement the fix mentioned on this page here: https://blog.qualys.com/ssllabs/2013/06/25/ssl-labs-deploying-forward-secrecy ...
0
votes
0answers
19 views

How TLS exchange key to prevent Man In Middle Attack and sniffing? [duplicate]

I am using an SSL socket in my Qt program and implemented all requirments such as (public-key and private-key files), related libraries, and so on. Now I want to use of TLS protocol to transfer ...
0
votes
1answer
18 views

On a Linux server, is it safe to store a script containing DBI credentials in the cgi-bin of the DocumentRoot?

I understand that (at least on Linux servers) the custom is to create a ScriptAlias from a cgi-bin directory located inside the DocumentRoot (i.e. /var/www/html/cgi-bin/) to a cgi-bin directory ...
-1
votes
1answer
37 views

How Can i Bruteforce a Post-Get-Form to acquire a 6 Digit Voucher Code [on hold]

I am asking how can i Brute-force this website Website i want to Brute-force but not the User name and Password, the Code that is usually in my country found under the Cap of a Fanta Can. So i looked ...
1
vote
1answer
59 views

How to de-obfuscate a malicious payload?

I've received some spam email that led to a JavaScript file which I assume is malicious. My curiosity got the best of me so I opened the file in notepad and I'm trying to make sense of the code but I ...
0
votes
0answers
26 views

Encrypt data on mobile device by retrieving keys from server using PIN

I need to securely encrypt persistent data on a mobile device, hiding it from hacking tools. What vulnerabilities are there in this method? Encryption: user sets 4 digit PIN to "protect" data on ...
-4
votes
2answers
66 views

How to avoid WiFi attackers [on hold]

I am connecting to a WiFi network, but the signal strength is too weak and sometimes it disconnects automatically. My brother's WiFi signal is very good and the connection is fast, and he just happens ...
1
vote
2answers
64 views

Is Qubes OS more secure than running a set of activity related VMs?

I'd like to skip the argument about Linux being more secure than Windows, and purely focus on the security boundaries between Host OS and VMs. Is Qubes OS theoretically more secure than say - Windows ...
5
votes
3answers
40 views

Implications of leaving admin UI accessible to non-admin users

I am developing a system to be used internally within a company, but possibly also externally at some point in the future. From the standpoint of the system's initial users - staff, the program is ...
0
votes
0answers
48 views

Why can I login in my Facebook account with an email not the main one? [on hold]

My Facebook account was registered with a Hotmail e-mail. My secondary e-mail is an ISP e-mail. Since I remember I never had other secondary e-mail added. However today, in my laptop, I inadvertently ...
-6
votes
2answers
29 views

How to brute force this token in php, if it is possible

it is possible to brute-force this token (MD5 Hash) of the following script (PHP) in a realistic time (0,5h - 24h)? If the answer is YES, how could I do it, for example with PHP or Python? $time = ...
0
votes
2answers
35 views

How would I brute-force a Bitlocker recovery key?

I have imaged a hard disk and used passware, but to no avail - it says Encryption key External key, and not the actual key. How do you think I would go about brute forcing it? Lets assume I had ...
5
votes
0answers
23 views

List of visually similar characters, for detecting spoofing and social engineering attacks

I'm trying to detect homograph attacks and other attacks where an attacker uses a spoof domain name that looks visually similar to a trusted domain name (e.g., bankofthevvest.com instead of ...
1
vote
3answers
20 views

Building an info sec VM lab - safe to keep on my home network?

I'm a new member making my first post here. I had a very quick, and admittedly basic, question. I'm setting up an info sec lab for the first time at home. I'm trying to build some more technical ...
0
votes
1answer
21 views

Scan detection Tool better than Snort Portscan Preprocessor

I am working on detection of Scanning activities of Bots/Worms. I have found that Snort Portscan Preprocessor detects Scan activities. I have tweaked Snort Portscan Preprocessor to detect different ...

15 30 50 per page