0
votes
0answers
17 views

How does Facebook really identify requests?

Today I have discovered something very strange. It seems like Facebook is playing some kind of unfair game for identifying one's online identity. So, here is what I have done: I have a regular ...
1
vote
1answer
23 views

Find out the identity of the person that called you

I don't know if it's the best place to ask questions like this, but I once heard that if a number that you don't know called you, you can acces a website (that I don't remember now), you write the ...
0
votes
0answers
12 views

Sending Group Keys over network

For multicast encryption one user creates group keys on his local (Symetric and asymetric). If we encrypt these with other group user's public keys and send over networks . Is this acceptable? Can ...
0
votes
0answers
14 views

Possible Infection - fkapp.herokuapp.com

So recently I noticed that when I open a new tab, in chrome, then try to enter either a search term or a website, the notification in the bottom left of the window tells me that it is: "Waiting for ...
0
votes
0answers
16 views

Ipsec Native VPN on Windows 8 or 10

I have a Cisco PIX, and have been using the Cisco VPN client on windows however I would like to enable this to work with the native Windows 8/10 VPN client. It works fine with the native clients for ...
0
votes
1answer
18 views

Preventing installation of VPN software on home computers?

How can users be prevented from installing VPN software on their home computers?
0
votes
1answer
21 views

Simulation of cloud based digital signature with Hardware Security Module (HSM)

I am working on a cloud-based digital signature with a Hardware Security Module (HSM). I know that PKCS#11 AND Microsoft CryptoAPI implementation is required. I want to simulate the total process. For ...
1
vote
1answer
24 views

How secure/private is the browsing history on browsers?

I've been using Aviator secure browser for a while which insists that you run private mode by default (cookies and history wiped after every session), which makes me wonder how secure the history is ...
-1
votes
0answers
28 views

Can a text appear to be sent from a phone, although the owner never text it?

My husband received a few emails starting off with a credit card number, but this credit card number was sent to him. He responded to the text 3 times about negotiating money. When I found the text, ...
5
votes
1answer
42 views

Firefox trying to connect to other lan computers

While running Wireshark trying to troubleshoot some other issues, I noticed several SYN connections to ports 80 and 443 on the workstation I was using. The packets were dropped. These were coming from ...
8
votes
0answers
118 views

Huge potential security risk in Android Lollipop?

I know a lot of people are advocating an "encrypt and wipe" procedure for selling used Android phones. But according to the AOSP website, in Android 5.x Lollipop: Created fast encryption, which ...
5
votes
2answers
912 views

What is the purpose of these weird non-spam emails?

A mail made it through the spam filter and i wonder what the purpose is. It is not spam. Tracking? But how? Who? and why? In the source code there are this weird passages like ... =EA=85=9F ...
-2
votes
0answers
12 views

Any better alternate tools for Maldet? [on hold]

Is there any better tools to scan for malware available in Linux ? The only drawback what we find with Maldet is, It is not able to detect all the malware. But it does capture most of them.
0
votes
1answer
25 views

Hacked bluetooth speaker

I recently purchased a new OontZ Angle Plus bluetooth speaker and I believe that it has been hacked. I can't connect any of my devices to it, the bluetooth light indicates that it has been paired ...
-3
votes
0answers
18 views

How vulnerable could be this VB code?

I guess this could lead to path manipulation. Not being from a Windows background, I have to guess since parameters are not being sanitized but still I have to verify this code here: dim fs, f, path ...
-3
votes
1answer
48 views

How can I prevent Windows 10 spying? [on hold]

I have some serious (private) files on my computer, but I still want to upgrade to Windows 10 safely. I can't just encrypt them and put them somewhere else, I am working on them, and need to keep ...
0
votes
0answers
39 views

Undetected virus

My PC has contracted a virus. I noticed weird behaviour from my PC, and investigated the matter. I still don't know how I got infected, but the result is someone having administrator access on my PC ...
0
votes
0answers
39 views

An odd pentest - what to charge? [on hold]

I'm a Live-Hacker, so my usual job involves getting a call, setting up a keynote that includes breaking various things and getting paid a fixed amount. However, I was asked to perfom a pentest on a ...
1
vote
0answers
12 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
1
vote
1answer
28 views

How to determine if it is safe to install apk files from alternative android app stores?

Several sites offer APK downloads (1, 2, 3). Is there a way to determine if a given website/apk is safe to install?
3
votes
2answers
49 views

How can Microsoft Wi-Fi Sense share just the internet connection?

According to the Wi‑Fi Sense FAQ When you share network access, your contacts get Internet access only. For example, if you share your home Wi-Fi network, your contacts won't have access to ...
0
votes
1answer
33 views

Weird ssh staircase effect when remote key has changed

I reinstalled one of my machines and gave it new ssh keys, which should yield warnings when I connect to it from a machine I have connected from earlier. First I get the big warning that the remote ...
1
vote
1answer
23 views

Is it safe to create a user account using the id_token provided by google's sign in?

I have a chrome extension which allows users to exclusively login with google and no other provider. In my (node + couchdb) backend I need to construct a user account from the auth Response provided ...
0
votes
0answers
19 views

Should universal delete, or “the right to be forgotten”, be an extension to OpenID Connect “signout” or authentication in general?

There are different levels of maturity various OpenID connect implementations may have. One of the optional features is the session management and sign out feature. Now that this has finally ...
-2
votes
0answers
31 views

ARP Poisoning attack simulator [on hold]

I want to simulate ARP Poisoning attack and calculate routing time, etc. What is the best simulator for my work? Thanks a lot.
-1
votes
0answers
31 views

Is actor secure? [on hold]

Actor is a message application made by former Telegram contributors. As opposed to Telegram, Actor is completely open source (client and server) and instructions are available to self host. From the ...
18
votes
3answers
2k views

What security scheme is used by PDF password encryption, and why is it so weak?

Many PDFs are distributed as encrypted PDFs to lock out some of their functionality (eg printing, writing, copying). However, PDF cracking software is available online, which usually cracks the PDF ...
2
votes
1answer
27 views

Protect against cgi-bin/php attacks centos

I am facing some strange attack while I was checking Apache logs: OST ...
14
votes
2answers
3k views

Is this an attempted SQL injection?

Looking through error logs I found lots of requests to a web-app where the URL contains: ...
5
votes
4answers
1k views

Self-signed certificated not working over Internet?

I self-signed certifications are not working over Internet. What can be the problems? Here are the setup details: Have a windows Virtual Machine in Azure with IIS Setup. Setup a self-signed ...
-4
votes
1answer
41 views

How do I read SSL data sent to my PC [on hold]

I see lot of posts for reading data using Wireshark, but it uses private keys. When the data is sent to my PC, how do I read it, if the server is not mine ? I am sure the browser or the applications ...
2
votes
0answers
29 views

Malicious RCE functions in CGI and Java

I know there are some functions in CGI and Java that can be abused to perform remote code execution attack. For example we can see abuse of "eval" function in Movable Type CMS: sub ...
3
votes
1answer
62 views

How secure is Scrypt, really?

I've been recently taking a hard look at the scrypt system for storing users' passwords. However, I'm rather worried about it's security because of things like Litecoin miners. Is scrypt secure ...
1
vote
0answers
25 views

Risks associated with switching ISPs/Telco providers

What are the risks associated with switching Internet Service Providers and/or Telco providers (i.e. Telstra -> Optus), if any? This is in relation to a larger organisation with a wide area network. ...
-2
votes
0answers
28 views

Alternative to ICANN DNS [on hold]

From what I've read: DNS is for mapping IP addresses to a corresponding name. The organization that is responsible for creating, managing and distributing domain names is ICANN. So, if we have a ...
18
votes
7answers
2k views

When do honest people need privacy or anonymity? (e.g. they have nothing to hide) [on hold]

I'm having a discussion with someone who thinks they don't need technical measures of privacy or anonymity. Common arguments against needing to care about privacy or anonymity include: Everything ...
1
vote
1answer
87 views

Reverse engineering of a global hash salt from known plaintext and hash

First of all i'm not asking what is a hash, or something else. I will try to explain what i'm searching clearly: Let's say I have a dump of a database, all the passwords of this database are hashed, ...
0
votes
0answers
8 views

What is the correct mask to use with 224.0.0.0? [migrated]

What is the best mask to use to allow computers to use the multicast IP address 224.0.0.0? I've only seen IP addresses using the lower 8 bits, in my case I just see 22 and 251. So my firewall uses ...
3
votes
4answers
171 views

Is encryption possible at the physical layer?

When we talk about encryption in relation to the OSI Model we usually hear about encryption at Application (Email - PGP), Transport (SSL), Network (IPSec) and even Data Link Layer (WPA). But I have ...
0
votes
1answer
36 views

Can the Belkin WeMo switch be attacked without the attacker knowing my WiFi password?

The Belkin WeMo switch lets you turn on and off electric sockets over WiFi using an app. Apart from the WiFi password, is there another potential vulnerability of this device that could let an ...
0
votes
0answers
7 views

SPF - Will softfail get inherited when included? [migrated]

If I add the SPF-policy v=spf1 include:_spf.google.com -all to my domain, will the -all have some effect or will the ~all from _spf.google.com get "inherited" to my domain?
-3
votes
0answers
30 views

How to block users from downloading files [migrated]

I have recently installed Wi-Fi at home and the bundle quickly finishes due to a lot of downloads. So how do you block sites on the network so that no-one can randomly download?
0
votes
1answer
30 views

How do I get Kc from my SIM card?

Since listening to a few Defcon talks on SIM cards and, more recently, the NSA Playset, I've become interested in GSM. This page gives a fairly good tutorial on getting Kraken set up, but apparently ...
-1
votes
2answers
48 views

What can someone do to my computer with access to the modem?

I had to give my new neighbor my WiFi password. He's now connected to my internet and I worried about some things: The modem is connected to my PC. What can he possibly do while he's on my internet? ...
-2
votes
0answers
56 views

How ChopChop attack works? [on hold]

I am confused with ChopChop attack. During running ChopChop, sometimes I see Dest.MAC = ff:ff:ff:ff:ff:ff or sometimes, I see another MAC address. What's the difference between Dest.mac= ...
3
votes
1answer
77 views

Protecting SSH service with many inexperienced users

One of the universities I know has a rather unique password policy. They issue shell accounts to all computing students with strong passwords that are unchangeable. It is done via the passwd -n flag ...
0
votes
1answer
45 views

Oracle Sql Injection Reverse Shell [on hold]

I am testing for SQL Injection on a website that uses ASP code. I can successfully get all the databases and tables. Current user has DBA privileges. I wonder how can I get a reverse shell by using ...
1
vote
1answer
49 views

Sign certificate for localhost

I'm using HTTPS Node.js server on my localhost, and every restart (PC), when I go to 'https://localhost' I get the certificate message (Chrome). I want to ask how to install the certificate?
1
vote
3answers
55 views

TLS domain name mismatch

Suppose I want to talk to example.com over TLS the and server I am redirected to is foo.com. But during the handshake it can prove it holds the private key that matches example.com certificate. Why ...
-2
votes
2answers
55 views

How does SSL work? Simpler Explanation? [duplicate]

I'd like to explain my understanding first then ask a question. This question is meant as a simpler overview of other question..and talks about implication and not process as much. My understanding ...

15 30 50 per page