-1
votes
0answers
10 views

are companies in singapore required to comply with PCI?

How long can CC info be kept by the company? Can only keep the last 4 digits of CC info with name of card owner?
1
vote
2answers
11 views

SSL Certificate Trust Model

I have been looking at the SSL Certificate Trust Model, and there is something that does not make sense. If I am correct, the trust model makes it that if there is a chain of certificates with a ...
0
votes
1answer
13 views

Can the aproximated date on which a given Encryption Algorithm will become prone to brute force be predicted?

I have a very elementary understanding about encryption so this question may have false assumptions, Lets take an encryption algorithm that is impractical to break through bruteforce with today's ...
1
vote
1answer
32 views

How long can a pkcs#8 passphrase be?

A program is using a private key to read messages. To improve security, besides randomness, I'm trying to create the longest passphrase that makes sense. How long should it be? After which amount of ...
1
vote
0answers
12 views

How does TCP stealth work and what are advantages compared to Single Packet Authorization?

Today I read the first time about a draft of TCP Stealth: The proposal modifies the TCP three-way handshake by only accepting connections from clients that transmit a proof of knowledge of a shared ...
-4
votes
1answer
24 views

Requirment for encryption algorithem to be secure/safe

When we call encryption algorithem safe/secure? I can list following: is not possible to find key from cipher text is not possible to find plain text from cipher text Resistant to brute-force ...
-1
votes
0answers
17 views

Can I used the command line to disable settings in Yosemite that have made my Mac visible?

Recent changes to my machine as the result of an upgrade to Yosemite (OS X 10.10) have made my machine visible on Bluetooth and Bonjour, where it was not visible before. Is there a command line way ...
0
votes
0answers
14 views

IIS 8.5 TLS 1.2 not working [migrated]

I have Windows 8.1 with IIS 8.5 and have run the script from http://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12 to enable TLS 1.2, but Qualys SSLLabs says my server ...
0
votes
1answer
16 views

Encrypted NAS where only clients know the (decryption) key

Is there an implementation of a file-sharing network protocol where the server has no idea what data is being stored, but can serve the encrypted files to clients that will decrypt them on-the-fly (if ...
1
vote
0answers
20 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
-2
votes
0answers
5 views

Cycript iOS Runtime Manipulation [on hold]

How to change the label in an ios app using Cycript?
-1
votes
1answer
44 views

How will Gmail be able to detect SPAM and display ads when emails are encrypted end-to-end?

Context Google is making end-to-end encryption easier to use. SPAM How will they be able to perform SPAM detection when the email is transmitted and stored encryptedly? I suppose that if the SPAM ...
1
vote
1answer
42 views

How to use Intel Ivy Bridge's RNG?

I read that Intel Ivy Bridge processors provide a RNG (RdRand). But how do I use this? My CPU E3-1270v2 does not provide a RNG flag. flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr ...
1
vote
1answer
44 views

Can Facebook login to my app?

This sounds maybe like a stupid question, but I'm wondering myself if this is theoretically possible. Let's say I'm using Facebook login in my app. If the login is successful I get I get back an ...
2
votes
2answers
57 views

Security concerns with iframes

Are there any security concerns I should be aware of, if I want to give users the ability to embed iframes(for things like Youtube videos) in their generated content on my site. The user generated ...
0
votes
0answers
18 views

some Concerns about security in online merchants sites

I want clarification regarding some concerns about online merchants : is there some standard classification for online merchants ? how can you recognize if the site is real or fake ? through using ...
0
votes
0answers
27 views

Using HMAC when sending data through an untrusted server

I have a set up like this: Payment Server (PS) <> Front End (FE) <> Client JS. I need to get some data from the Client JS to the PS, without the FE being able to modify it and have PS prove ...
4
votes
3answers
217 views

Security Implications of using Base64 Encoding with Encryption

Are there any security implications of converting a byte-array encryption key into a Base64 string before use? I am creating a generic encryption helper for a project, and for the sake of consistency ...
0
votes
3answers
34 views

Confusion over a firewall and proxy

A proxy usually controls HTTP(S) traffic going outbound. IE it can be blocked, and so forth. How is this different to a firewall working on port 80/443? Also, if a firewall is to control outbound ...
-3
votes
0answers
39 views

Fastest dictionary attacker? [on hold]

I made the ultimate wordlist, every possible combination of a-z 1-9 uppercase and lowercase, but by my math, it would take like 8 years for it to be completed at the very most if it did 1 password per ...
0
votes
0answers
29 views

Facebook full IP log [on hold]

Today my account was accessed from unauthorized device. My first step was to kill all active sessions, but now I'm not able to see his IP. Is there any way to see the whole IP log from past days?
1
vote
3answers
30 views

Socket.IO Client Security

I am new to Node.js and Socket.IO. According to documentation the client side code is something like: <script src="/socket.io/socket.io.js"></script> <script> var socket = ...
3
votes
4answers
70 views

Hardware token to authenticate web application

My company is developing a web application, and I was asked to research how to do hardware-based token authentication to login into our web application. Let me repeat: basically there will be a web ...
3
votes
1answer
48 views

Is it any more secure to use a HTML form instead of a javascript popup?

Assuming both use session authentication, token validation and forced https: Is there any difference in security between submitting data via a JS popup <> ajax endpoint, and a standard web page ...
0
votes
0answers
56 views

What is attacker trying to do with my server?

Some is trying to access this link (and similar ones) frequently in my site: http://mysite.com/upload/RS=%5EADAJVxZ5NB.GMTgFV3EMEJX3sN22Jw- Note that my server doesn't have an upload folder inside ...
0
votes
0answers
35 views

Code injection in PHP [on hold]

May I know what is the possible attack through $title = $_POST['title'] ? Is this a code injection in php? how the attacker exploit on this? Below are part of the codes. Thank you. $title = ...
1
vote
2answers
54 views

Will Ad Block Plus block the ads that give someone Cryptowall 2.0?

Now I already know that making sure your browser plugins are either non-existent or up-to-date is one way of being on the safe side against ransomeware like Cryptowall 2.0; but since clicking ads are ...
1
vote
2answers
83 views

What agency digitally signed Cryptowall 2.0 so that it can run without being detected?

What agency issued a digital signature for the Cryptowall 2.0 ransomware virus? Is it too early to tell? As far as I know this is how Microsoft planned to prevent malware, by adding a digital ...
0
votes
1answer
15 views

Create Virtual Machine from Encase image

I have used Encase to capture a disk image in a forensics nvestigation. The problem is that a certain application that resides in the image won't run if it is not installed properly. I want to boot ...
0
votes
1answer
61 views

Windows Sever Access Control

Windows server manages access control through DAC and MAC. What can be the possible reasons for using DAC and MAC and not using RBAC?
2
votes
3answers
35 views

Encryption while logged in

If I'm using full disk encryption on my home computer, and it's online, are the hard drive contents encrypted when I'm logged in and using the machine (from the perspective of an online attacker - no ...
-1
votes
3answers
91 views

Gmail, Yahoo, Hotmail , and so on; How do they check the content of an attached password-protected archived file like Winrar?

How is it possible that mailing systems like Gmail, Yahoo, and Hotmail are able to check the content of an attached password-protected archived file like WINRAR, if the password cannot be guessed, ...
1
vote
1answer
29 views

Can Suricata IPS detect and prevent ARP poisoning attacks?

Does Suricata IPS have the capability to detect and prevent ARP poisoning attacks? Snort uses a preprocessor that decodes ARP packets and detects ARP attacks, but I couldn't find any such capability ...
-1
votes
0answers
83 views

CVE-2014-4113 Proof of Concept Code? [on hold]

In recent events, Microsoft has patched 3 major vulnerabilities that allowed privilege escalation or remote code execution one way or another. One of these was CVE-2014-4113. A high-level explanation ...
0
votes
0answers
20 views

Heartbleed Check (OpenVPN Support)

I'm searching for a Heartbleed Checker with OpenVPN/UDP Support. All the Heartbleed Tools support only TCP, but not UDP. Is there any variant with UDP Support?
-1
votes
0answers
13 views

Is revealing DBUS_SESSION_BUS_ADDRESS variable a vulnerability? [migrated]

I found this instructions: Using notify-send with cron Revealing the content of your DBUS_SESSION_BUS_ADDRESS like in this answer gives access to every user logged in to your session: #!/bin/sh ...
-4
votes
2answers
50 views

Android Penetration Testing

I need to do pen test for android mobile application. I have an android mobile and laptop connected to same wi-fi network. I need to intercept/capture the requests/traffic of the mobile in the laptop ...
-1
votes
0answers
38 views

How to determine possible encryption type of a given data [duplicate]

I have a encrypted data which consist of 2 numbers: A random number of form 0.110134486415522 This number is always less than 1 and is generated at start of every session encrypted numerical ...
0
votes
4answers
89 views

If a large companies website's robots.txt file has no Disallow section, does this mean I am free to write code to crawl their website? [on hold]

If a large companies website's robots.txt file has no Disallow section, does this mean I am free to write code to crawl their website? The website in question is basically a data warehouse for the ...
-1
votes
1answer
34 views

Permutation based file secure

I have a thought. 1. Take a file. 2. Read number of bytes. If its less than 2048, padd it till 2048 3. Read each byte. And create a single file which contains the particular byte. Give a random name ...
0
votes
2answers
81 views

Advice - When just starting your career, what are the best certifications to eyeball? [on hold]

Im just starting out in school to study Network and Info Security. I know this is the field I want to invest my time and study into. Well over 200k security jobs went unfulfilled last year. My ...
1
vote
2answers
49 views

Can BadUsb only be delivered via USB?

BadUsb works by infecting a computer when plugged into the USB port. Is it also possible for an attacker who gains control of a system, such as remote access, to then infect any connected USB ...
1
vote
1answer
30 views

Is it safe to use private key encryption for lots of small blocks of data themselves?

I currently handle small JSONs of sensitive information which are guaranteed to be smaller than 100 bytes. You can encrypt up to ~500 bytes with a 4096 RSA key. Is it safe/secure to store these ...
0
votes
1answer
48 views

How negative are virtual machines (vms) to /dev/urandom?

I looked at the questions here and here. This then piqued my interest as I've recently been involved with looking into FIPS compliance, and in my vm environment /dev/urandom compliance testing ...
0
votes
1answer
36 views

Malicious JavaScript — Troj/JSRedir — Gumblar

I have a client with a website receiving AV warnings from Microsoft Security Essentials. A further investigation revealed that the site is blacklisted by Yandex.com, due to a report that the site ...
1
vote
0answers
32 views

Setting up VPN connection for devices behind firewall [migrated]

I am new to network security concepts and I want to know how to set up a VPN connection to a home network. I followed this tutorial but still unable to connect. My router has onboard Tomato VPN and ...
-1
votes
0answers
15 views

Reducing noise on exe download Snort rule

What is the best way to reduce noise on Snort rules dealing with .exe/.dll downloads from trusted sources? I'm getting a lot of alerts from Windows and Adobe updates, I've been modifying the rule to ...
0
votes
2answers
69 views

Why do browsers probe and fallback (or, why SSL_MODE_SEND_FALLBACK_SCSV)?

I've been following POODLE and the SSL_MODE_SEND_FALLBACK_SCSV TLS extension. I never really paid much attention to it, but it appears SSL_MODE_SEND_FALLBACK_SCSV is needed for clients like browsers ...
-1
votes
0answers
33 views

How do services like reputation.com work?

A service found at [https://manageurid.com/][1] promises to remove personal information from "unauthorized sites". Reputation.com offers a similar service. My question is this: how does this work? ...
0
votes
0answers
22 views

What unique device fingerprinting information can an iOS8 app collect?

As a follow-on to this question: What unique fingerprinting information can an iOS7 app collect? What remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 8? Can ...

15 30 50 per page