1
vote
1answer
12 views

How to Stop DDoS Attacks by simple function on web server?

This is the similar question DDoS - Impossible to stop? I have an overview ideas of the preventing ddos attacks, in a simple way. Please clarify me, if my thinking is wrong. Option 1 From the basic ...
-1
votes
1answer
19 views

Is it possible for a website, by knowing the public IP only, to detect the exact smartphone device I'm using?

If with the same smartphone device I surf to one website (each time with a different IP, different SIM card and no saved cookies or cache), is it possile to detect that I'm using the same device? If ...
0
votes
0answers
10 views

Unexpected Windows Certificate Store Behaviour

I have a WCF client/server application, which is working almost perfectly. During install I add three keys to the Windows Certificate Store: the client key (incl. private key) the server's public ...
0
votes
1answer
21 views

Is a random work factor an increase or decrease of security?

Assume you use a proven hashing algorithm, like bcrypt with a work factor of 10 or PBKDF2 with 10K iterations. Normally that's really secure already and would give enough security already for most ...
2
votes
2answers
18 views

Log of all processes running on a computer

I'm new to the security domain and I want to ask - Does every program leave an 'imprint' in a log of some kind, in a laptop or a PC - of whatever process it ran. If yes, can they be analysed?
-1
votes
0answers
6 views

What is threat tree in threat modeling?

I have went through research thesis of how different methodologies can be implemented to make the security testing beneficial in fly using AGILE testing methodology and also an extension to it called ...
1
vote
2answers
41 views

Can a properly implemented TLS connection be intercepted?

Assuming a TLS connection where both the server and client perfectly adhere to the pertinent standards. Can an transparent HTTPS proxy intercept the TLS connection? (Assuming the "mock CA" ...
1
vote
2answers
20 views

Unencrypted FTP to transfer encrypted data - okay if IP-restricted?

If unencrypted FTP over the public internet is the only file transfer option for a particular situation, what security concerns are applicable assuming: The data being transferred is strongly ...
0
votes
0answers
11 views

best practices for handling self-registration?

For example, with a bank's credit card activation/registration, that user is required to authenticate with a unique code that was mailed to their address. If they don't get that mailout-with-the-code, ...
2
votes
3answers
165 views

Implications of hashing to UTF-8 in a cryptographic function

I know that most hash functions today use Base64 encoding for their functions, resulting in hashes that use a-Z and 0-9, and, sometimes, other special characters. This results in 62-76ish possible ...
0
votes
3answers
90 views

Data exposed through campus proxy

I want to connect with Firefox to my university campus proxy, in order to access subscribed research journals, but first I need to know, which of the transmitted data through the network are visible ...
0
votes
0answers
5 views

how to compile with gcc for another architecture and kernel version [migrated]

I am working on: Linux 3.18.0-kali3-586 #1 Debian 3.18.6-1~kali2 (2015-03-02) i686 GNU/Linux I want to compile a C file using gcc for another Linux system: Linux version 2.6.9-89.EL ...
0
votes
0answers
31 views

Authorization before Authentication?

From a conceptual point of view, can authorization occurs without authentication taking place first? I'm thinking about few cases where authorization seems to occur without authentication taking place ...
-3
votes
1answer
40 views

How do I get the password knowing part of it and the length [on hold]

I'm new to all this, I'm trying to use Hash Suite to find a password with a word + 2 numbers. I know what the word is but not the numbers but I also know the length of the passwords ... What do I have ...
0
votes
1answer
24 views

Securing communication over LAN in VPS provider

I'm curious about best practice when connecting from app to DB in a cloud provider. A quick rundown of our setup. We have 4 servers all on the same provider, in the same region running as VPS. Ngnix ...
0
votes
0answers
49 views

Security Issue on windows 8 [on hold]

I am new to network security and similar technologies and I have encountered something very unusual with my machine. I've been learning some hacking and backdoor tricks to enhance my abilities as a ...
1
vote
1answer
18 views

airodump-ng also transmitting?

I recently started using airodump-ng to monitor nearby WLAN network packets. I noticed it was picking up a WPA signal with almost perfect signal strength. I then noticed ifconfig was reporting ...
2
votes
1answer
11 views

How to verify a password/key on subsequent key derivations

The first time a user logs in to our app, we derive an AES key from their password using PBKDF2. The AES key is kept in RAM only and used to encrypt and wrap other keys and data during the session. ...
8
votes
4answers
2k views

Accidentally came across the source code for some malware, what to do?

I accidentally, the other day, went to a dodgy site, and today I discovered that in my cache there lay a text file. And after reading the contents of the file, I have deduced that it is the source ...
7
votes
2answers
33 views

Is there any information I shouldn't include in questions about my GPG aside from my private key?

There are many questions I have about GPG, but what stops me asking is knowing that I may add output to a question that I shouldn't release publicly. Is it a risk to paste in the result of gpg -K? ...
1
vote
1answer
29 views

Specificity of ECDHE in a TLS handshake

It's just a short question, but I haven't find a clear answer yet... It's in the frame of a TLS-ECDHE handshake. Where does the specificity of the ECDHE, over the DHE, appears ? At which point do ...
0
votes
0answers
17 views

How to detect office Malwares [on hold]

There are many undetectable Microsoft Office malware samples. I'm trying to detect them by dynamic analysis of cuckoos sandbox. Most of Malwares contains embedded exes but if I write rule to detect ...
-2
votes
0answers
17 views

Comparison of Vulnerability Scanners [on hold]

I would like to have a comparison of Network Vulnerability scanners (Not web application scanners). Could some one recommend me a website where this is possible ? Gartner doesn't seem to have one. ...
-4
votes
0answers
21 views

Which algorithm for erase does iTunes use? [on hold]

Maybe someone knows which algorithm iTunes uses when you select restore and update?
0
votes
0answers
9 views

Difference between cisco 6509 Supervisor Engine 2T and 720 [on hold]

Is there a physical difference between the Cisco 6509 2T and the 6509 720? I see that they both have different slots. However, can we make a 2T a 720 by replacing that whole slot? or is the switch ...
2
votes
2answers
37 views

Does CVE-2015-5352 work if there is no active X-Server?

My security program shows that one of my servers is vulnerable to CVE-2015-5352. If X-Server is not running (not even installed) is the system really penetrable by that vulnerability?
5
votes
1answer
45 views

Should DSA keys be considered deprecated?

The gist of openssh deprecates dss-keys appears to be: "In light of recently discovered vulnerabilities openssh deprecates DSA keys." Does this mean I should generally consider DSA keys ...
1
vote
1answer
40 views

How does a public key authenticator work? (as opposed to public key signatures)

In the documentation for djbs library NaCl under the headline Security model you can read that the library provides public key authentication without non-repudiability (http://nacl.cr.yp.to/box.html). ...
18
votes
3answers
2k views

New denial-of-service vulnerability in TLS protocol, based on shooting down other users' sessions?

I think I have a new denial-of-service attack on TLS, and I'd like you to check whether this is a real vulnerability. I recently learned about the proper way to drop an authenticated client session ...
1
vote
1answer
35 views

Is it possible to issue a certificate with different attributes than in .csr?

Is it possible to issue a certificate with different attributes than in certificate siging request? I have a keypair and I generated a cert. request with extra attributes. Can the CA/RA or anybody ...
1
vote
0answers
11 views

How to disable typed arrays in firefox as rowhammer mitigation

I am concerned about the potential attack surface exposed by JavaScript typed arrays as a means of performing rowhammer attacks. Is it possible to disable (via official means or otherwise) typed ...
-4
votes
0answers
22 views

SQL Injection errors & FILE permission issues

First, does this error also entail SQL Injection? Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in /home/localhost/public_html/admin/login_check.php on line 12 If so, ...
1
vote
0answers
4 views

Unfamiliar connection alert on Little Snitch

I've got a Macbook running Yosemite 10.10.5, on wifi, sharing it with three other people in the household. I currently have Avast on my Macbook (I know, I know), and its web shield works by acting as ...
0
votes
1answer
54 views

Strange IP's on my firewall log

Check the screenshot of my router firewall log below, I can see traffic originating from strange IP addresses to my public address. What are these? I've just setup this router few hours ago, am I ...
10
votes
3answers
2k views

Is there a way to download a PHP file without it being executed?

I recently got a phishing mail of unusually bad quality; "Please imediatly sign in under the following link, as we are your bank, you know"-ish. The link points to an unconvincing URL with .php at the ...
0
votes
1answer
35 views

Is it safe to keep a virus' binary code on your local machine?

Is it safe to keep a file containing the virus (binary?) code on your local machine without executing it? I am testing my application against malicious file uploads and and wondering if it's safe to ...
0
votes
0answers
21 views

Block website for all user agents expect one and allow all user agents to specific URL [on hold]

I want to block all user agents except one for entire website, and at the same time allow access all user agents to one specific URL. When any user want to reset password I need to unblock all user ...
0
votes
2answers
59 views

Does having these ports open indicate any vulnerabilities?

I installed Ubuntu Gnome a couple of weeks ago along with a few packages and some software. When I scanned my localhost using Nmap, I got the following results. Are there any obvious vulnerabilities, ...
0
votes
0answers
57 views

Is TrueCrpyt still safe, or is VeraCrypt the better option now? [duplicate]

I know that TrueCrpyt stopped updating a while back and it has a warning saying that it may not be safe due to unpatched security issues. I have a version of windows with Bitlocker, but the fact that ...
0
votes
1answer
79 views

What are the vulnerablities for revealing IP addresses in code

One of my developers left the IP inside his code : The code is as follows : [WebMethod] public string UploadFile(byte[] f, string fileName) { try { MemoryStream ms = new ...
1
vote
1answer
61 views

How can I hide a program from another program?

If program A scans RAM, running processes and whatever, can I hide program B from being detected by A? Basically, I don't want program A to detect program B, or at least, stop it from identifying ...
0
votes
2answers
28 views

Test registration form using brute force

I need to test if my website registration form can have problems with brute force attacks, because this form requires an invite code. Is there any tool for this kind of test?
1
vote
1answer
36 views

How to make the most secure text editor in Django?

As a follow up to this question, I'm wondering what is the most secure way (using either markup or markdown) to allow users to format their inputs and upload images in a Django app? I'm not asking ...
0
votes
0answers
12 views

Is is possible to configure IE to automatically run an EXE? [on hold]

I have a Cuckoo sandbox. When it's pointed to the URL of an EXE, a IE security dialog comes up, and asks weather to run, save, or cancel the download. Cuckoo clicks cancel because it is the button ...
-1
votes
3answers
64 views

Can these html tags and attribs make my site vulnerable?

I am developing a social website and want to allow user ONLY these html tags and attributes in their posts: tags: <img>, <b>, <strong>, <blockquote>, <a> attributes: ...
-5
votes
0answers
39 views

What infrastructure is there to attack in Lynnwood, WA? [on hold]

I've been watching this live attack site for some hours, and find it strange that Lynnwood is getting massive attention from (mostly) Chinese attacks. What's there to attack? Yes, it's in Washington, ...
5
votes
1answer
89 views

Siri DDoS over FM Radio

A few days ago i was driving home and suddenly Siri started to talk by her self in reply to a command i never gave... as you can imagine i have the "hey siri..." feature active, so i can make calls ...
0
votes
0answers
6 views

qkd - Does BB84 rely on a prearranged code? [migrated]

First of all, sorry if the title is not that clear, I'll provide an in-depth explanation behind my question. So, basically I was reading about quantum cryptography and came across BB84. The protocol ...
1
vote
1answer
38 views

Does the server certificate control the cipher suites available to secure the communications?

If a CA signs a certificate with a SHA1 signature hash algorithm, does that mean a client would be unable to communicate with the server if TLS 1.0 and below is disabled? I think what I'm asking is ...
0
votes
2answers
344 views

What current algorithms are considered (un)secure? [on hold]

With the new release of Windows 10, Microsoft has given .NET, Javascript and C++ developers a whole new bunch of options for cryptographic algorithms. Where as the old .NET code only allowed AES and ...

15 30 50 per page