0
votes
1answer
10 views

which password was paired with my gmail address

Recently media have reported that a file of about 5 million gmail address and password pairs was published on a Russian Bitcoin forum. A media article on the leak Other media have reported that the ...
0
votes
0answers
11 views

Where are my passwords stored in browser? [migrated]

When i click the remember me radio while signing into a web application, I know that my password is saved into somewhere inside my browser. I want to know the exact location of that file in my OS ...
0
votes
0answers
17 views

One time passwords using Mobile phones

It is safe to assume that the majority of users accessing the internet also possess the mobile phones. So can we take advantage of this and relieve users of remembering any passwords. Instead of ...
-1
votes
1answer
24 views

Is my Password Hashing Secure or not?

I have recently created a code for hashing password. Can you please give your advice over the security of my code? The function takes a password, then converts it to a number. #include <string> ...
-1
votes
0answers
20 views

Securing wp-admin folder - Purpose?

I am trying to understand how to secure a WordPress site. One security task I do not understand is...How important is it to protect the "wp-admin folder"? For example, I would consider limit login ...
0
votes
1answer
16 views

Creating a secure home network - Which firm ware should I use and how should I configure my firewall?

I am starting to take on more and more enterprise clients while working remotely from my home office. I have a pretty secure network at the moment, but I have a lot hardware that I am not using and ...
0
votes
0answers
32 views

How can I safely include the encryption key in the encrypted file?

I am encrypting text files using AES256 (no particular reason, that can easily be changed). Before granting access to a file, I need to verify if a party knows the correct key, but without necessarily ...
2
votes
2answers
18 views

Email account 'hacked'; do I need to regenerate my server's DKIM _domainkey?

I'm just learning about DMARC (DKIM/SPF), so I apologize if my question doesn't make sense. A few days after I installed a DMARC policy on my server I noticed that the reports from yahoo.com ...
2
votes
1answer
33 views

Does a separate internet connection increase security for remote users?

Our network admin has requested that a single remote employee purchase a separate modem in their house for "work" traffic. I question if this is a legitimate security practice of any kind especially ...
0
votes
0answers
6 views

airodump-ng + Getting near by wlan + bluetooth MAC addresses

This is a theoretical R+D where we are a company that wants to see if a particular meeting room/personal working space is free without the need of human interaction. The idea is to use a Raspberry Pi ...
0
votes
0answers
11 views

Finding the IP address origin of malware attacker behind VPN and proxies

I have a client that wants me to begin doing research on finding the origin of a persistent attacker to their network and employees. I haven't gotten the specifics yet, but I'm trying to think of ways ...
2
votes
1answer
27 views

What role do hashes play in TLS/SSL certificate validation?

After coming across this question in the Hot Network Questions section and reading the related blog post by Google, I'm starting to become curious as to what role these hash functions play in TLS/SSL ...
0
votes
0answers
7 views

How are Captive Wifi Portals secured?

I'm looking for a captive portal solution that prevents other users from stealing the session key from other active users. (or prevents the cloning the authenticated user's MAC) Is there a reliable ...
0
votes
0answers
5 views

How should a captive portal handle SSL requests, that are expired, or not authenticated?

What is the best course of action for a user that uses HTTPS anywhere, or tries to access a secure URL (from an phone based App, or from a browser)? Ideally, I'd like to get the phone to "prompt" via ...
1
vote
1answer
37 views

Suspicious phone call claiming MS Office not updated lately

I recently received two phone calls where the caller indicated that according to their log activity, MS Office has not been updated lately. They offered to help me get those updates. What kinds of ...
-1
votes
1answer
18 views

Is addslashes + htmlentities sufficiently secure?

I have addslashes(htmlentities($userInput)). It gets inserted into my database. (NOT a mysql db) Is it sufficiently safe from xss? Thank you!
0
votes
0answers
17 views

Can I terminate an SSL Tunnel at the Load Balancer in Amazon VPC? [migrated]

In other words, can the Amazon VPC load balancer be configured as an SSL Host? As a proof of concept, we've created this setup: Heroku Appserver <---> VPC Load Balancer <---> Ubuntu SSL ...
0
votes
0answers
20 views

HTTPWebRequest over SSL gives intermittent error “The request was aborted: Could not create SSL/TLS secure channel”

I am using HTTPWebRequest to connect to Java rest services hosted in Tomcat Apache server. The endpoints are configured for HTTP as well as HTTPS. There are no issues connecting to HTTP endpoints, but ...
-1
votes
1answer
42 views

Simple Ciphers to Create Secure Passwords

A shift cipher shifts every letter of a word by "n" amount and creates new word. The number of possible keys in the shift cipher is equal the size of the alphabet set from which the word is derived. ...
0
votes
0answers
12 views

Read WMI stuff on offline system?

For forensic purposes, I want to work with WMI on an offline system (dd image disk). In particular I would like to read the WMI Event Subscriptions. How can I achieve this ? Are WMI stuff located ...
10
votes
3answers
749 views

Is SHA1 weak for SSL?

I noticed that today after I scanned a site on the Qualys SSL Labs site that SSL ciphersuites which use SHA1 are now highlighted as being "Weak". It seems this has just happened; I scan sites pretty ...
3
votes
3answers
326 views

PCI compliance if not storing or transmitting credit card data

I have a networked product that we install on customer networks. The device is does not pass any of the CC data, but only sits on the same network (think Nest or Dropcam). The customer networks ...
0
votes
0answers
32 views

Suspected virus in my Windows 8.1

I suspect that I have a virus in my computer. There is a large amount of UDP traffic in my network card, I installed Wireshark and there was large amounts of UDP traffic, all of them are from the same ...
0
votes
1answer
61 views

Encrypting/decrypting our license key

We need to provide a license key to customers for our application. The actual license is XML but we need to encrypt it and then in our program decrypt it. I think it is the following, but am asking to ...
-1
votes
1answer
17 views

TPMs available on mobile with application access [on hold]

I am looking for a mobile device, preferably a smartphone or a tablet, that contains a TPM (v1.2 or 2.0) and provides application access to it through an API. Does anyone know if any such devices ...
0
votes
1answer
57 views

Keyboard “eavesdropping” just got way easier, thanks to electromagnetic emanations

Just found this article which basically suggests that electromagnetic emanations can be used to eavesdrop on what you're typing. ...
0
votes
1answer
50 views

Privacy concerns while traveling with HDDs [duplicate]

I'm traveling to UK for college and I'm bringing 2x2TB drives with me. I'm concerned about my privacy when going through the border as they might search the drives. So I came up with the following ...
-1
votes
1answer
27 views

Wiretapping requests to VPN providers

What are valid issuers of wiretapping requests aimed at VPN providers except the court of the provider's country? Is it possible that country in which jurisdiction VPN provider does not act will ...
0
votes
2answers
106 views

Longer passwords v/s Password Composition Rule

Password composition rule is being considered as a burden for the users and some experts are recommending the increase in the password length instead of enforcing users to comply with the composition ...
0
votes
2answers
35 views

How to mask my IP using a proxy server? [duplicate]

I heard that it is possible to use a proxy server to mask my true IP address and surf anonymously online. Also I have a list of valid Proxy IPs and corresponding ports. How can I use them to get ...
0
votes
2answers
38 views

How session cookies work? [on hold]

I want to know the basic working of session cookies. When i tried googling, most of the results came were based on any programming language. I am not good at coding. So it will be helpful if someone ...
0
votes
1answer
53 views

Encrypting the salt with password [duplicate]

Salts are stored in the plain text and readily available with the hashed passwords if the password database is compromised. What if we encrypt the salt using password itself? Doesn't it make offline ...
0
votes
1answer
31 views

Does the SSL/TLS client certificate “hash over all previous messages” step hash the entire TCP packets or just data?

We have which uses TLS client certificates as it's authentication mechanism between client and server. There is an IT department which wants to run this app through a firewall/proxy device of some ...
0
votes
1answer
96 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
0
votes
1answer
36 views

How to convert this shellcode to a binary data (in raw)? [on hold]

I am new in this community. I don't know if this is the right place to post it. But, I have the following problem: I have a shellcode (you can see it at the bottom of post), and I need to convert it ...
0
votes
2answers
77 views

Can viruses steal MAC addresses? Why is MAC address bad?

Can downloaded executables get my MAC address and send it to somewhere else? Also, why is it a security risk to have someone else use my MAC address, considering that it can be spoofed?
1
vote
1answer
78 views

Python implementation of AES and SHA256/512 that are FIPS-140-2 validated?

For security purposes I need to use AES encryption and SHA256/512 in my Django/Python project. I know there are various libraries out there that provide different encryption methods but I can't seem ...
12
votes
6answers
3k views

My IP (with a NAS) is targeted by a hacker. What to do? Should I be worried?

I've noticed based on the logging of my NAS that my IP is targetted by a hacker. I already took action by automaticly ban the IP address permantly after 5 unsuccesfull login attemps. Unfortunatly the ...
-2
votes
0answers
41 views

Implication in canaries that places a null [on hold]

An alternative design for a canary mechanism places the NULL value just below the return address. What is rationale for this decision? When does this method meet its objectives, and what are its ...
0
votes
0answers
27 views

OSSEC, what is it telling me about port changes?

I've been diving into OSSEC for the last couple of months, but I feel unclear on one of it's alerts. I've provided the alert below. The main difference I see in previous output and current output is ...
18
votes
4answers
2k views

What are the disadvantages of implementing HTTP authentication in a web application?

I know that there are different types of authentication mechanisms available. One among them is the HTTP authentication. What is the danger in using this method compared to other methods?
0
votes
1answer
50 views

Key Exchange using RSA

I'm trying to do key exchange using the following scheme. Server generates an RSA-2048 key pair and sends the public part to the client Client generates an RSA-592 key pair (I have to use RSA-592 ...
-1
votes
0answers
38 views

Amazon login request on port 843 to fnes.amazon.com [on hold]

I wonder if anybody knows why amazon, on their login page (both for amazon.com and for aws console login) does a request on port 843. This request is apearantly to name fnes.amazon.com My question is ...
-2
votes
1answer
29 views

what is the scope of reflected Cross site scripting in the perspective of a hacker? [on hold]

I want to know what all dangers a hacker can perform by reflected XSS
-1
votes
0answers
18 views

Drawbacks of OpenVAS [on hold]

Delibrate on any major vulnerability detection capability missing in OpenVAS compared to its commercial alternative solutions. Please.
-2
votes
0answers
14 views

DB vulnerability OpenVAS [on hold]

Could anybody comment on the strength of OpenVAS for detecting DB vulnerability.
-1
votes
3answers
121 views

What are the differences in Linux and Windows security that cause Windows to get so many more viruses? [on hold]

I am trying to gain a more detailed understanding of specific features of the Windows and Linux security models that makes Windows so much more prone to infection by viruses than Linux. As an example ...
-1
votes
3answers
52 views

Full control on cryptography vs relying on external certificate [on hold]

I have a question with regards to having full control on the cryptography which you will be using for your own application vs relying on external entities such as certification authorities? What are ...
0
votes
1answer
18 views

reading/downloading big files in metasploit module [on hold]

I am writing a post exploitation module that supports meterpreter sessions. For my module to work, I need to read/download some files from the victim machine that may be small or bigger. I am having ...
-1
votes
0answers
14 views

HMAC based authentification token [on hold]

I'm wondering if it would be a good idea to use HMAC based token (as used in OTP) or something similar. The workflow would be to authenticate with a password and then to give him a first token, used ...

15 30 50 per page