0
votes
0answers
3 views

Can't encrypt email

My friend has a problem described here: https://gpgtools.tenderapp.com/discussions/problems/18790-cannot-encrypt-an-email But the solution provided by this link did not work. What else can he try? ...
0
votes
0answers
8 views

Is the SanDisk ULLtraDIMM secure after power-down?

I found an interesting product last night called the SanDisk ULLtradDimm SSD (product page), which essentially claims drastic performance gains by plugging an SSD into a standard DDR3 memory channel. ...
0
votes
0answers
38 views

How to avoid ransomware

Malware files execute themselves after downloading them. Let's look at it from the point of view of a piece of ransomware like CryptoLocker, from Wikipedia: Crypyowall 3.0, uses a payload ...
2
votes
1answer
28 views

Issue regarding installation of SHA256 scertificate

Can anyone help me with the installation of SHA256 certificate? I have generated the certificate perfectly but there seems to be an error below: Kindly let me know why am getting the exclamation ...
1
vote
1answer
17 views

Padding of 802.11 packet with 0's in libpcap

I am trying to send probe request to Access Points.But whenever I send a probe request packet it is padded with 0's i.e I see two packets on wireshark for every packet I send : a non-padded packet and ...
0
votes
2answers
67 views

Hiding (Obfuscating) Java script

So i heard that obfuscating java script is useless and waste of time because anyone with a little of skill can decode your code. So i want to test that. This code will display a alert box saying hey ...
10
votes
3answers
629 views

How secure is Snowden's MargaretThatcheris110%SEXY password?

In an extra from Edward Snowden's interview with John Oliver, Snowdon advises that a good password to use is one such as MargaretThatcheris110%SEXY.. Also, on the Errata Security blog, Robert Graham ...
2
votes
0answers
8 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
12
votes
5answers
1k views

Unsubscribe safely

I have heard that is better to never click to any link in an email. Is it a bad idea to click to a unsubscribe link? What is the best way to unsubscribe to undesired mails?
1
vote
1answer
24 views

How to prepare FATCA data transmission files with open source tools

Here is the context: to transmit FATCA data to US IRS service the IDES protocol defines the following steps sign the XML Payload.xml file with enveloping signature, SHA-256 with RSA private key, as ...
1
vote
1answer
44 views

Can Windows 8 be PCI compliant?

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows ...
1
vote
3answers
71 views

Why not fix Android root exploit?

I see many scripts for hacking Android device and getting root, critical access level. I see millions of people apply this to their devices and do not understand the risks. Why don't Android ...
1
vote
1answer
43 views

Cloud-based IM protocols / services saving messages encrypted on server which is decryptable only by user?

I am looking for a cloud-based (i.e. not end-to-end) secure IM protocol or service. The first one comes to my mind is telegram. Here is a quote from telegram's privacy policy: Cloud Chats ...
-3
votes
0answers
30 views

How do I decrypt a RSA-SHA1 code?

I am working on one project where I am having a RSA-SHA1 modulus code and Exponent value only. which is as follows: Modulus: ...
1
vote
3answers
56 views

Knowing the MAC adress of a stolen laptop

Recently my HP 1000 laptop was stolen, is there any way to find its MAC address? I connected my laptop to a PTCL EVO (Pakistan) WiFi USB dongle, but in the device options there is nothing I could ...
3
votes
2answers
497 views

Confidentiality in Digital Signature

Recently I have been working on Digital Signature. Some common reasons for applying a Digital signature to communications are Authentication, Integrity and Non-repudiation. Does Digital Signature also ...
2
votes
2answers
176 views

Can malware provide hidden remote access to a user's desktop?

Is there a possibility that malware on a computer could be providing remote access to an external party without the computer user being aware? I.e., some kind of hidden active remote access tool? ...
1
vote
4answers
49 views

is it easier to eavesdrop on ethernet connection rather than wifi?

I heard someone say that ethernet connection is vulerable if someone can connect to your LAN, and that the traffic isn't encrypted in the way it might be if you're using WPA wifi encryption. Is this ...
1
vote
1answer
128 views

Why AJAX is not used to log in?

I'm wondering why AJAX is not used to log in nor register in most of the pages and it's used PHP reloading the whole page. Is it about security, or it's just that it's not practical at all?
2
votes
3answers
119 views

Email confirmation techniques in major sites

The way I understood traditionally for email confirmations to work is the user registers to the site with their email and then to login they must verify their email. If they have not verified ...
2
votes
1answer
29 views

Is FileVault 2 HIPAA compliant?

It looks to me like FileVault 2 uses AES 256 bit encryption for the desk. Does that mean that it meets the HIPAA "data at rest" standard? Is there something else I need to check about it?
1
vote
1answer
27 views

Can Hydra and Crunch be used in combination for HTTP-get-form? [on hold]

I'm trying to recover my router username and password without resetting the router for educational purposes. I read that Hydra can be used for "brute-forcing" http-get-form authentication that most ...
-1
votes
0answers
43 views

Do you know any tip to accomplish this xss? [on hold]

I have the following scenario: Test A: https://target/srv;?q=pwn%0Aalert(1);//&ref=B The result: <script type="text/javascript"> if ("pwn alert(1);//" != "") ...
1
vote
1answer
20 views

Why FATCA IDES “protocol” does not use RSA encrytion directly on Zip archive ?

Here is the context: to transmit FATCA data to US IRS service the IDES protocol defines the following steps sign the XML Payload.xml file with enveloping signature, SHA-256 with RSA private key, as ...
1
vote
2answers
59 views

ASP.NET session id strength

After reading this and this, I am wondering if it is considered secure to use the default ASP.NET sessionID as a means to authenticate the user. I know it would be better to implement ASP.Identity, ...
3
votes
1answer
49 views

Secure text document's fingerprint

The purpose is the same as with hashing: given set of confidential documents, I want to process them and store something secure like salted hashes/bcrypt. Later, when new document is given, I want to ...
4
votes
0answers
253 views

Firebug and cURL [migrated]

I have been using Firebug and cURL for quite a while. Firebug is amazing to capture HTTPS POST request as opposed to a network analyser as it is aware of SSL/TLS negotiation. And cURL is amazing to ...
1
vote
1answer
47 views

DDOS Server Attacks & Domain Names

I'm currently with a web hosting account whose servers seem to be constantly down due to DDOS attacks. I check my analytics daily and I'm seeing a major surge in fake traffic for several of my URLs ...
0
votes
1answer
36 views

vpn and strong authentication, how does the two work as a pair?

Dont know. maybe I was to unprecise.... I basically am asking if a SSL-VPN solution is solving both the encryption and the authentication, like that the user authenticates himself to the vpn-client ...
0
votes
1answer
41 views

VPN and authorization [on hold]

I wonder, if one should implement two factor authorization and encryption in a client-server solution, how is it done? Of course there can be many ways but some examples would be great. I imagine the ...
2
votes
0answers
30 views

Decrypting Bluetooth application data with the link key

I would like to read the application data exchanged between an Android device and a peripheral. I have managed to log the Bluetooth communication using HCI logger and open the corresponding .cap file ...
1
vote
1answer
13 views

Query on IPS reports

In the IPS reports i see multiple counts of the same exploit from the same source ip. I wonder why would someone continue to attempt exploiting a vulnerability when he must have realized in the first ...
1
vote
0answers
10 views

How to access files or getting rights access with NJrat

When I'm using NJrat to control my own computer, I can't delete, open or move some files. Are there some kind of security access I need to stop first? How can I change this to allow full access?
1
vote
0answers
29 views

Is it necessary to add CSRF tokens for REST API? [duplicate]

I have a few REST APIs for an iPhone app. It has a login and session management functionality. Currently the session has been tracked by a token set during login. Are REST services affected by CSRF ...
1
vote
1answer
30 views

LogJam hardening OpenSSH and testing it [duplicate]

I would like to harden my OpenSSH (clientsite) after the LogJam attack. I read this article https://weakdh.org/sysadmin.html and there is one paragraph, which says how to do that. Is this enough and ...
-4
votes
0answers
31 views
1
vote
0answers
25 views

OpenVPN -cipher vs -tls-cipher?

I'm currently using the -tls-cipher command on server to only allow the cipher I want (TLS-DHE-RSA-WITH-AES-256-GCM-SHA384) but there is the command -cipher too, and OpenVPN's man page is not really ...
1
vote
1answer
23 views

Is it possible to assign different UIDs to subkeys for the purpose of having multiple identities?

Many people advocate generating new primary keys for each identity they wish to have. For example, creating one primary key and associated subkeys for workplace use, and a completely different ...
-4
votes
1answer
54 views

How block SPAM effectively?

There is a spammer wrecking havoc in my company. The SPAM emails is not created by any automatic means, but by someone who changes his email every so often after we block him by email address. Any ...
-1
votes
0answers
45 views

Guide me in building a successful career in cyber security field [on hold]

I recently watched Mr.Robot tv show and i'm very impressed with elliott-cyber security engineer. I like the way he does all those protecting the servers thing :D I am very interested to know what it's ...
-1
votes
0answers
41 views

Good Places To Learn Penetration Testing With Test Server [on hold]

I am an experienced programmer and I want to get into penetration testing. I am looking for a place that has videos and I want something that comes with access to a server to test on. I don't mind ...
2
votes
3answers
94 views

AppSec interview questions?

I am preparing for a technical interview for an AppSec pen-testing position. For those of you that have had AppSec positions, what sharp-shooter questions do you think I can expect? What questions ...
1
vote
0answers
27 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
1
vote
0answers
10 views

Blinding to mask private key operations

Blinding is often used to mask private key operations when the underlying problem is integer factorization. For example, its used in both RSA and Rabin-Williams signature schemes. This presumes ...
1
vote
1answer
23 views

What's the signature structure in TLS server key exchange message?

I'm writing a TLS server. While handling ECDHE-RSA cipher suite, the server key exchange is needed. According to Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) ...
0
votes
1answer
43 views

How to securely derive a second password specific to an user

I'm giving each of my users an unique Blocktrail wallet that is protected by two API keys (which the server knows) and one passphrase (unique to each wallet). I want the wallet's passphrase to be ...
1
vote
2answers
57 views

How to crack `salt + SHA256(salt + password)` hashes with JTR?

I have a set of password hashes. Sample: 9e74437e97ff201ff38416138a22a7f3adfa3b9c10e947481bd94b16eed7df6b6e2806 From the source code of the application generating this hash I learned that the salt ...
-1
votes
0answers
53 views

TeamViewer issue [migrated]

Today I had the stupidity to grant full access to a stranger on my TeamViewer. Don't ask me why, such a foolish thing to do. So once done, he/she created an admin account on my laptop and blocked my ...
-3
votes
2answers
53 views

What is to hash a password? [duplicate]

Sorry if it's not the right place, but I can't find a translation(to spanish). Can someone explain it in another words?
0
votes
0answers
27 views

When will Chrome be patched to eliminate the Logjam exploit? [on hold]

I see IE is patched - when will Chrome also be patched to eliminate the Logjam exploit?

15 30 50 per page