-4
votes
0answers
25 views

If https is so good (as to completely replace http), why is DJB not using it? [on hold]

D. J. Bernstein, http://cr.yp.to/djb.html, @hashbreaker, is famously known for his crypto and hashbreaking abilities. Outside of the theoretical research that he is engaged in as a professor, his ...
0
votes
0answers
6 views

Iframe postmessage fraud

I've reviewed some material here and in other sites relating to secure usage of Window.postMessage. There is a bunch of material regarding best practices but one of my questions remained unanswered. ...
-1
votes
0answers
15 views

Decrypting packets with wireshark when you have the Algorithm

Algorithm for encryption / decryption data transmitted over the network: Code: unsigned char encryptKey[264] = { 0x2b, 0x00, 0x00, 0x00, 0xda, 0x00, 0x00, 0x00, 0x58, 0x24, 0x32, 0x6a, 0xc3, ...
0
votes
0answers
4 views

Negotiate n-bits key with Diffie-Hellman protocol (or other key exchange protocol)

I've got ASCII message. I convert it to binary - then I've got 8*(ASCII message length) bits - let us assume this value will be called n. I have to negotiate key, which length (after conversion to ...
1
vote
0answers
8 views

What are analytics APIs accessing when they run, and how do you block or spoof them?

What are analytics APIs accessing when they run, and how do you block or spoof them? Usually all apps from desktop or mobile app stores, MMO clients, Steam and many utilities, and many games and ...
0
votes
1answer
35 views

How can an online hack be traced back to the perpetrators?

What sort of evidence might be used in linking, say, the Sony hack to North Korea? While I am curious about what was used in this particular case, my question is meant to be a more general question ...
0
votes
0answers
6 views

Why do I have to use multiple Keys for each direction and purpose?

I'm currently writing an examen about 'Lessons Learned in the IT-Security'. I already found some thing, which shouldn't be done. But right now I'm in trouble finding the reasons why not to do so. ...
-1
votes
1answer
26 views

Is a SSL CA signed certificate necessary when connecting with IP Address?

I'm currently creating a socket server, and would like to encrypt communications. The thing is, the client will connect directly to the ip without any DNS. (Every user will know the Server's IP ...
0
votes
1answer
14 views

Emulating Client by sending encrypted hexdump to dB server and getting response back

So I used wireshark to retrieve a hexdump that has been encrypted with RSA. I need to figure out what the response to that would be when it comes back from the server. How I imagine it would work ...
0
votes
1answer
10 views

Two factor authentication using CVV and 3D secure code

While making online by Debit/Credit card, instead of using OTP (received on mobile), one can use a 3D secure code (verified by visa or mastercard) which is know to user. Should this qualify for two ...
1
vote
0answers
13 views

Are servers that do not implement time services vulnerable to clock skew attacks?

An article describes clock skew attack possibilities §§: These can be attacked by repeatedly connecting to the hidden service, causing its CPU load, hence temperature, to increase and so ...
2
votes
0answers
14 views

Tamper proof hardware - not resistant

Can you make a TPM (or any piece of hardware) Completely tamper-proof? The “regular” tamper resistant hardware has various physical attacks http://www.milinda-perera.com/pdf/EKKLP12a.pdf I have been ...
1
vote
0answers
32 views

Is hacking my own account illegal? [on hold]

I have just learned email hacking and I want to test it. I am well aware that if I hack into any email account, there are chances that my email service provider will track me. So if I hack into my ...
2
votes
0answers
18 views

Where to store passwords of encrypted backup drives

I have all my backup hard drives encrypted with LUKS. Currently, the passphrase is some 25+ random password that I store in my password manager KeePassX. Since I have the backup drives for the case ...
8
votes
1answer
360 views

How does CVE-2014-9390 affect me?

On 18th December, a vulnerability in git and mecurial was announced.  What are the details of the vulnerability?  Does it affect me?  What should I do?
1
vote
0answers
12 views

Snort only detect local issues

I have installed two physical machines with KVM virtualization using Red Hat as OS ( h1 and h2). In h1 I have installed the virtual machines w1 and db1 In h2 the virtual machines w2 , db1 and ids. ...
2
votes
1answer
24 views

Would a VPN with changing configs do the same job as different VMs

I was reading this question. So my question: Would using a VPN and swapping out configuration files that change your IP address mask the same as using different VMs?
0
votes
4answers
31 views

When is an antivirus program needed/useful?

Let's say I buy a computer and use the internet for services but rarely download anything and when I do it is from legitimate sources with a minimal to non-existent chance of malware. What benefits ...
0
votes
0answers
27 views

Best Practces for Security Questions

When a website asks me to enter security questions in addition to a password what is best practice on my part? This often happens with banks and other institutions but I see it less with other ...
-1
votes
1answer
34 views

Decrypting packet data without private key

Firstly I am not doing anything illegal. How would I go about decryption a packet from the server back to the client and vice versa and get it in plain text WITHOUT using a private key. I have tried ...
-1
votes
0answers
9 views

Java Keystore best practice for large scale application [on hold]

I'm new to JCE/cryptography in general but I'm working on demo where we are going to create a public/private key combination for each users of the site. All the examples I have seen so far stores ...
2
votes
1answer
51 views

Does encrypting a file make it larger?

I encrypted a Word document using Winrar by setting a password. Surprisingly the archive was larger than the original file (631 vs 614KB). I then tested to see what would happen if encryption wasn't ...
1
vote
0answers
15 views

decrypt a soap message using openssl

I've tried to do the same as found in How to you manually decrypt a SOAP message using openssl? Unfortunatly without success... Here is my situation : I'm trying to do the same stuff only my data ...
0
votes
2answers
29 views

Calling string functions safely

I wish to implement some user callable functions in my code. I use something like this: function funcTest(){ echo "This is test function"; } if (isset($_GET['cmd'])) { $func = ...
-6
votes
1answer
37 views

Why study Information Security? [on hold]

This question might be considered as overly general, but it has occupied my mind lately. I have decided to study Information Security (to be more particular, 'Networked Systems Security') at ...
-4
votes
1answer
62 views

How The Sony Hack Was Traced, and So Quickly? [on hold]

What are the steps that are required to locate a source that have routed their traffic through multiple zombie hosts, spanning multiple networks/carrier/nations?
0
votes
2answers
24 views

HMAC: How unique does a nonce need to be if the Date is also part of the signature?

In a HTTP scheme where the HMAC-SHA256 signature is sent as part of the Authorization header, and the message input contains: The request method URL Post data Nonce Date HTTP header How unique ...
0
votes
2answers
87 views

How did piratebay.se search engine get in Chrome as an “other search engine”

I have an IT client with a user who had piratebay.se/... listed within his Chrome's (v39, 64-bit, OS X, 10.10.1) "Other Search Engine" section. I know a user could manually add it and suspect the ...
0
votes
1answer
73 views

Where can I download the Sony hack malware (for analysis)? [on hold]

I want to analyze the Sony hack Malware as there have been a lot of stories on who is responsible; from the US government implicating North Korea to news articles stating it's an inside job. The fact ...
2
votes
2answers
206 views

Is Double NAT a secure way to create a public wifi network?

I'm trying to create an open, public WiFi network in my house for guests to use, as I am hosting a (somewhat) large party later tonight. However, none of my routers have any built-in guest networking ...
0
votes
1answer
27 views

Windows 8.1 full disc encryption

I have a zenbook ux302 that I want to do a full disc encryption on. I had no problem using bitlocker on my stationary computer, but the zenbook doesn't seem to have that functionality? I have the ...
0
votes
1answer
19 views

Modern Browsers, Safe to Ignore CSRF?

For users using modern browsers, is it safe to assume they won't be able to be hijacked via CSRF and the likes? If not, how likely is it that an attack can take place?
0
votes
2answers
29 views

Doesn't seem to be able to capture the packets I need

I've been trying to capture Telegram messaging application's packets (for my class project) but I couldn't get anything out of the punch of captured packets I got. Telegram does AES-256 encryption ...
0
votes
0answers
56 views

Good password hashing algorithm compatible with PHP and Linux apps [duplicate]

I'm looking for a password hash method for a new server system. The hashes must be generated from PHP code and verified from PHP as well as by a number of applications on a Linux system. I know that ...
0
votes
2answers
68 views

Only HTTP(S) port is open. Why do I need to worry about unpatched software?

Unpatched software poses no risk by themselves. They're only problematic when someone exploits it. How could malware get into my system if I do have unpatched software in general and I'm connected to ...
0
votes
1answer
37 views

Why is browsing while logged onto a VPN from public wifi more secure than not?

I've been trying to wrap my brain around VPNs for a while now, but can't find a good source that answers the questions I have. In particular, I can't understand why browsing from a public access ...
0
votes
0answers
18 views

How encryption/decryption of RSA private key by passphrase works?

I would like to know how exactly the encryption of private key by passphrase works. I am a software developer with no background in cryptography and I know only some basics. When I open the private ...
0
votes
0answers
22 views

SHA256.DB30.com listing of email account

After searching a gmail account in Google I've found a result for the website SHA256.DB30.com. The page just shows the name of the gmail account and a list with major and minor hash. From my basic ...
1
vote
3answers
42 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
0
votes
1answer
12 views

Tails OS for Android and PC?

Can I use Tails OS on a USB-stick on both an Android tablet and a PC, or do I have to have two different versions? Would I have to go into the BIOS to make this work?
0
votes
1answer
18 views

CSRF Guard: Injects token in POST Request?

I have implemented CSRF Guard into my web application. It's working fine for GET requests (with AJAX and without AJAX) however for POST request token is not getting injected into the request that's ...
1
vote
1answer
9 views

Safe storage service for private keys

Is it currently technically (as opposed to financially) possible to provide a fairly secure means of providing a storage facility for private keys, not excluding physical verification etc? As in, you ...
0
votes
1answer
29 views

How to prevent outgoing UDP attacks?

My server has been the target from hackers 3 times in the last month, and the attack seem to follow the same pattern. The attack another site from my server using UDP connection. The report from my ...
0
votes
1answer
19 views

Why is there a path to a .pdb file in an exe I am trying to reverse?

My query is ,if I'm seeing a .pdb path in a exe(VC++) what conclusion can I draw from it.Why does the exe have these paths and does it have significance in malware analysis? eg ...
4
votes
1answer
39 views

Suspecious js file sent as email attachment

I received a js file with following code in my spam folder but I decided to take a look into the file. Do anybody of you know what does this code might do? var evl='';function nr() { evl = '}; ' + ...
1
vote
3answers
71 views

Security in Windows 7 vs Ubuntu

I have two semi-related questions about the security-related reasons I hear for switching to Ubuntu over Windows 7 (or from other Windows OSs to other Linux distributions). Someone people say that ...
0
votes
1answer
26 views

Mobile Game Auth Token Stolen [on hold]

Basically someone sniffed my packets and stole my auth token/cookie for a mobile game I have played on for a year and spent thousands on (crazy I know) and now they are controlling my account through ...
-2
votes
2answers
35 views

Is Firefox on Ubuntu less secured (does it not confine Flash)?

Ubuntu Linux makes it easy to install Flash as soon as you encounter it. Just like Firefox on Windows really! Installing it on Ubuntu even provides security updates through the standard OS method. ...
8
votes
3answers
395 views

How do RSA SecureID ® Keys Work?

I have been using RSA SecureID ® Keys for quite some time now (perhaps 10 years), for things such as securely my home banking account online or accessing my company's network of computers from home. ...
-3
votes
0answers
34 views

Preview of Planned Backdoors in Smart phones and their OSs [on hold]

I want to know if there are planned backdoors or not in hardware and its OS. I am not interested in those backdoors which come and go. However, note that there can be agreements between the ...

15 30 50 per page