1
vote
4answers
31 views

GET and POST request vulnerable to CSRF attack?

Are both GET and POST request vulnerable to CSRF? Should we use PUT instead?
0
votes
1answer
11 views

Why Use IPSEC AH vs ESP?

I am refreshing my understanding of IPSEC. IPSec is an IETF defined set of security services that use open standards to provide data confidentiality, integrity, and authentication between peers. ...
0
votes
1answer
10 views

Block a certain services in Windows 7

I intend to block a service for example snare service or lync service in windows 7, how do I do it?
1
vote
1answer
24 views

RC4 encryption of torrents safety

Torrent clients offer encryption of traffic using RC4, and people consider this, like, very safe to hide traffic information from ISP. Now since I have a website with SSL encryption, I know that RC4 ...
0
votes
2answers
31 views

Is TLS v1 really secure for VOIP and video calling?

Many applications are still using TLS v1 for video conferencing and VOIP calls. Is TLS v1 really secure for video and voice & video calling? or can some one can easily snoop your sessions with ...
0
votes
0answers
6 views

Can you find the search space? [migrated]

Let A is a random number and has 512 bits.we make B from A and B has 1024 bits.Process of B is following: C=f(A) that f is hash and C has 160 bits.Then C pass in a parallel manner 7 different hash ...
0
votes
0answers
25 views

Resource on Torrent poisoning

Can someone explain how torrent poisoning attacks work ? I am looking for some tutorials on how to do it ? What are the countermeasures that someone can use to defend themselves against it ?
0
votes
1answer
35 views

Security concerns of browser injected JS

To employ end-to-end encryption, I am using a small tool that encrypts contents that is then posted and stored on our servers. While there are several concerns on client based encryption, I think it ...
0
votes
1answer
16 views

Guidelines for time for encryption key regeneration

I am looking at using a third party key distribution protocol. I do not have much details of the internals itself. However I am required to configure the time for regeneration of the (128 bit ...
0
votes
0answers
24 views

What items should be on a malware remediation checklist?

Edit: Let's assume Windows 7 and potentially Windows Server 2003/2008. IMHO, any machine that has malware should be reimaged/reformatted/OS reinstalled before it is deployed back into the ...
0
votes
2answers
75 views

LUKS HDD Encryption crack

I need help. I actually encrypted two mouths ago my external HDD with LUKS but know i have lost my password. I am so depressed because, all of my life is on this HDD. Is there any possibility to get ...
-1
votes
0answers
21 views

Anonymous web purchases [on hold]

Are there any web services that allow you to purchase goods online in a way that maintains anonymity? I understand some things need to be kept (like a ledger for order invoices), but it should be ...
11
votes
5answers
1k views

Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?

As far as I know, in order to securely delete the hard drive's contents, one should fill it with zeroes or, for added security and harder recoverability, random data first and then all zeroes. In ...
0
votes
0answers
19 views

How can I debug a running process on my computer? [on hold]

Using GDB can I debug a process ID to see where a particular variable is stored in memory? Consider that: I'm running a javascript game which is running in my browser, and I'm on Kali Linux. Can I ...
2
votes
2answers
67 views

Are hashes of hashes used for password storage in practice? Why/why not?

A naive developers might store a password in the database directly, which would then be compared directly with the password sent from a client. A more security conscious developer might instead store ...
3
votes
2answers
275 views

What stops an SSH server from MITMing logins?

When I read this question about what gets signed with the private key by the client I wondered: What stops the following scenario from happening: A client connects to an SSH server. The SSH server ...
0
votes
0answers
11 views

Shouldn't DNSCurve be parallel to DNSSEC at root level for diversity?

As per the answer at If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?, it's been determined that one of the reasons that DNSCurve is behind DNSSEC is due to the nature of the ...
-1
votes
0answers
39 views

How does Facebook Lite send user and password when login?

I've recently tried to sniff username and password from Facebook Lite app for Android. I checked HTTP POST packets but I didn't see any of them. It seemed like FB Lite app didn't send username and ...
0
votes
0answers
31 views

Weird drive popped up randomly [migrated]

I just had a random drive pop up as I was doing a defrag on my hard drives (windows 8.1) and I have no idea what it is or what it does. It's called: "\?\Volume{5a1f49..." what is it and is it harmful ...
4
votes
0answers
44 views

Why did browsers deprecate 1024-bit RSA, but retain SHA-1?

I was reading Mozilla's security blog Phasing out Certificates with 1024-bit RSA Keys. Effectively, some browsers are deprecating 1024-bit RSA for CAs and Subordinate CAs because the certificate must ...
5
votes
2answers
79 views

Is using a self signed certificate safer than a free ssl certificate? [duplicate]

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...
0
votes
0answers
18 views

Which remote or cloud backup/sync solution meets the following criteria? [on hold]

I have been searching high and low for a backup/sync solution that meets a few different needs, but have yet to find one that does the job reliably and at reasonable cost (max $20/month, preferably ...
1
vote
1answer
36 views

Who uses 1024-bit RSA?

I know they're deprecated, but does anyone still use 1024 bit RSA encryption or certificates? Do you know of any examples of systems that use it today? What would be the implication if someone ...
1
vote
1answer
24 views

Is Two-way SSL sufficient for Multiple web servers communicating to each other?

I have a fixed number of web servers. Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one ...
1
vote
1answer
39 views

Rationale behind hiding originating IP address in emails?

Gmail has been hiding originating IP addresses for quite some time now. Hotmail and Yahoo have started doing this too. Apart from obvious privacy implications of revealing the sender's IP address, is ...
0
votes
0answers
30 views

Host Protected Area forensics

I see vague notes on forensic HPA interest, but it's never specific. What kind of information can be extracted from a PC's HPA? From ...
0
votes
2answers
52 views

Is there any way to determine the location of a laptop based on the MAC address or laptop serial number? (Lenovo)

If I have the MAC address and S/N of a Lenovo 3000 Laptop, is there some way for me to find exact street location of this laptop ? This machine was stolen from me last year and was my back up machine ...
-1
votes
0answers
17 views

Analog Camera with Static IP [on hold]

For office, I have couple of analog cameras and DVR system. Now, I want to watch the live video on my phone when I away. I got a fixed IP from my ISP, and have a router. But what settings to do for ...
1
vote
3answers
63 views

Should I use my trusted VPN for all my traffic?

I use my trusted VPN primarily for the sake of anonymity (to avoid data being collected about my Internet browsing), although I am aware of its security benefit -- traffic encryption. My question, ...
-5
votes
0answers
24 views

How to scan a target behind a firewall using Firewalk? [on hold]

I have used firewalk nmap script and the output of this script is: Host ip XX.XX.XX.XX Blocked ports 1,3-4,6-7,9,13,17,19-20 Traceroute: my router ip not important ip ip ... the host which in ...
5
votes
3answers
95 views

In a monitored network, can the admins tell if Tor is being used?

I'm not asking if Tor is secure, I'm asking if an observer can know you are using Tor? For example if a persons ISP or company network monitors traffic would they be able to determine with certainty ...
1
vote
1answer
54 views

Is HTML5 sessionStorage secure for temporarily storing a cryptographic key?

Assume I am building a local web application (e.g. browser extension) in HTML5 to encrypt a database locally. Access to the database is controlled by a password and a cryptographic master key is ...
0
votes
0answers
12 views

Where can I view IO device history in Windows (8/7)? [migrated]

Essentially I need to view the IO devices that have been connected/disconnected in the past, and when they'd been connected. If such logs don't exist, how can I record them? I was able to find ...
0
votes
0answers
39 views

How to begin learning about cyber security? [on hold]

I've been trying to self-teach myself various parts of cybersecurity, and I've been having a lot of trouble finding good resources for beginners. Are there any good sites visits or other resources ...
0
votes
1answer
27 views

gstatic.com resolves to local isp

In the light of Snowden revelations I become very paranoid. Yesterday I did a netstat -t -p and from my browser there were several connections pointing to my isp. I had only 2 pages open. Trying to ...
2
votes
1answer
34 views

Is it safe to enable SSLv2 ClientHello support?

In the wake of the POODLE attack, many web sites have dropped support for SSLv3. But some clients still in relatively common use as of May 2015 still initiate the handshake with an SSLv2 ClientHello ...
2
votes
3answers
46 views

How can I avoid buffer overflows when programming an Android app? [on hold]

I'm just starting out in Android and I've gotten my head around general programming within Android, but I've recently started trying to research security within Android. What coding practices would ...
1
vote
0answers
18 views

Firewall in virtual machine

I'm putting my server to use as a file server and a firewall. I'm looking at KVM or Xen VM setup where file server and firewall get their own VMs and host is just supplying the hardware (so Xen way, I ...
3
votes
1answer
28 views

How does Memory Corruption apply to Android?

I have researched several DoS attacks within Android e.g.: CVE-2015-1474 CVE-2013-5933 CVE-2013-4710 CVE-2012-6301 etc. And although I found DoS attacks within Android difficult to understand at ...
2
votes
1answer
29 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
-6
votes
0answers
31 views

I have iPhone 6 plus - can my boyfriend hack into my accounts? [on hold]

I have iPhone 6 plus - can my boyfriend hack into my accounts using apps or anything?
6
votes
2answers
275 views

How does getting a remote shell via exploiting a vulnerability really work?

I can understand what a buffer overflow is and that it allows you to write in places of the memory that you shouldn't be able to. I can also grasp the concept that there may be other software ...
2
votes
1answer
25 views

REST API - XSS prevention - When and how?

I am currently developing a REST API with Java EE and MySQL, it will feed Data to a Android App. The Data comes from an AngularJS Frontend. So my questions are, when: When do I escape the data? Before ...
1
vote
1answer
44 views

Is it worth it to implement both SHA2 and SHA3 at the same time?

I'm creating a password storage system for a web server I'm building for fun. Would it be more secure for me to use both SHA2 and SHA3 for hashing, and then store them in a database? If I use both ...
0
votes
0answers
11 views

How secure are Ubiquiti Networks UniFi AP's restricted subnets?

I have a UniFI AP and create a quest network with subnet restriction 192.168.0.0/16. My local network is in 192.168.178.0/24. The gateway is 192.168.178.1. My question is: Is there a way that quests ...
1
vote
1answer
43 views

How to filter secure (HTTPS) websites by URL with regular expression?

I need to block access to certain pages on a website using regular expression and/or wildcard. The site uses https and therefore cannot be blocked using regular parental control filters (this is ...
0
votes
3answers
59 views

What does this snippet of code do exactly? found it inside a number of files on my webserver [on hold]

Okay so I found some PHP code as I was randomly editing a website I've had for a very long time and I have noticed this: <?php #2b8008# error_reporting(0); @ini_set('display_errors',0); ...
0
votes
0answers
24 views

Windows Firewall Connection Security with Certificate (2)

I have a similar problem as the question with the same title from last October. On a Windows Server 2008 machine, using Windows Firewall's Connection Security rules, I need to establish an IPsec ...
0
votes
1answer
47 views

What makes an Android application vulnerable to Directory Traversal?

Definition of Directory Traversal Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root ...
1
vote
0answers
55 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...

15 30 50 per page