0
votes
0answers
3 views

Assymetric encryption in php

Can one do asymmetric encryption in php using php_encrypt() and php_decrypt(), using the public and private keys respectively as the key? Would it work? I prefer this to openssl_public_encrypt() and ...
0
votes
1answer
4 views

Does Google 2-step verification protect user from session hijacking?

After signing in Google 2-Step verification scenario, user should enter verification code which sends to his mobile. Without it, he couldn't access to Gmail account. Consider an attacker does session ...
1
vote
2answers
11 views

Does my brokerage/bank use poor password security measures?

I'm no expert. Could someone please tell me if I'm overreacting? After the Heartbleed news broke, I changed a lot of passwords. Here's what I discovered when changing the password on my all-in-one ...
0
votes
1answer
24 views

“No hack no fee” pen-testing agreements

How common is it for penetration tests to be arranged on a "no hack, no fee" basis (analogous to "no win, no fee" legal engagements), and why? A web search yielded only one firm advertising such a ...
0
votes
0answers
19 views

What makes iOS more secure than other phone OS

Let's start off with an example. Here in Canada, credit card companies cannot upgrade you credit card limit. You need to make a request, that will then get analyzed and then, depending on your status ...
0
votes
0answers
10 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
1
vote
3answers
40 views

Robots.txt and admin areas

I'm using some popular commercial forum software and to help secure the admin area more I have changed the name of the admin folder; however I was wondering, with regards to robots.txt if I go ahead ...
1
vote
1answer
16 views

SmartCard for private keys - personal usage

I've just found my notebook has a SmartCard reader. Would it be wise/possible/practical to buy a single SmartCard, transfer my private key on that (somehow), and use it as my primary private key ...
0
votes
1answer
25 views

Forensics in the cloud

I recently did a university module on digital forensics and learned a lot about the process, and techniques, of digital forensics investigations. We didn't actually cover the cloud although I ...
-1
votes
0answers
13 views

Merging two dmains ( active directory server)

I've a requirement of merging two domains. Our domain will be merged with a other domain.This work will be done by AD team.From security point of view what are the points I need to be bothered about ...
7
votes
5answers
192 views

How to get top management support for security projects?

I am facing an issue regarding security projects, for example: last year we bought an antivirus licence for 500 (end point security), and made a policy in order to force everyone to install it, ...
0
votes
0answers
24 views

Are Images/Videos sent through WhatsApp stoed on the server for too long? If yes, are they secure

The WhatsApp privacy policy states that messages once delivered are deleted from the server forever. But in case of "files"(I'm assuming them to be attachments like images and videos) it says and I ...
1
vote
1answer
55 views

Is wiping memory at code/end good practise?

Sometimes passwords/hash/keys & other private information is stored in variables and hence in memory/RAM during code execution. while some situations (i.e. Linux Kernels see here Is there any ...
2
votes
1answer
21 views

IKEv2: Why is it important “that each side sign the other side's nonce”

I am currently diging deep into the IKEv2 protocol. In the description of the Authentication (RFC5996, p. 48), the following statement is given: "It is critical to the security of the exchange that ...
-1
votes
1answer
32 views

Spyware for feature phones

There are a lot of spywares for android and ios smartphones. Are there spywares for feature phones ? I am using this samsung phone, which is basic. I am wondering if somebody who has access to this ...
11
votes
5answers
617 views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole ? ...
1
vote
2answers
41 views

Does having a seperate e-mail account only for security, increase security?

In this article about increasing the security of lastpass the author suggests For additional security, you can have LastPass send security-related emails to a special security email address ...
0
votes
0answers
24 views

URL filtering , issues with URL

I am working on a URL filtering project . I have a database given to me which contain URLs need to be blocked (eg: a.b.com/d/e). I get uri and domain from http request. I compare what I get with my ...
0
votes
0answers
72 views

Security jobs that suit disabled workers [on hold]

I was in a bad accident which has left me with some severe limitations in how I can work. Due to my disabilities I will only be able to work from my home. I understand that this is a very unique ...
-1
votes
0answers
19 views

Filtering of incoming and outgoing packets in a firewall

In general, egress http packets should be allowed to pass through the firewalls. Ingress http packets, however, should go through firewall inspections. Suppose the Web server is placed in DMZ. If an ...
1
vote
0answers
17 views

Securely calculating encoding efficiency

I have a rather odd security requirement that I must keep the amount of potentially encoded information in a record under 250 kilobytes. That's not a lot of data, so I was thinking of calculating the ...
3
votes
2answers
56 views

Letting users pick up where they left off…without logging in (is this bad form?)

I have a Grails app I'm working on that allows users to fill out a fairly lengthy application form. One of the requirements I've been given is to NOT require users to log in or create any sort of ...
1
vote
2answers
134 views

Google Accessed My MSN Account!

I just received a notification from Microsoft that my Microsoft account has been blocked because it's been accessed by an IP address that's never accessed it before. I received this notification as a ...
0
votes
0answers
60 views

What major vulnerabilities have there been to TLS libraries? [on hold]

I'm trying to compile a list of large security vulnerabilities in TLS (and SSL) libraries. Examples of things I'm looking for are: Heartbleed Goto fail The Firefox/NSS PKCS11 (IIRC) parsing bug
0
votes
0answers
15 views

DTLS CertificateVerify doubt

In DTLS 1.2 RFC 6347, section 4.2.6: CertificateVerify and Finished messages have the same format as in TLS. Hash calculations include entire handshake messages, including DTLS-specific fields: ...
1
vote
1answer
90 views

What should I do when I need to store passwords for usage in 3rd party softwrae?

I have a desktop WPF application which authenticates with Dynamics CRM 2011. I ask for the username and password of the user and use them to connect to Dynamics CRM 2011 using ...
1
vote
1answer
29 views

Can you export a report from OWASP Zap based off a individual website?

I have a list of 30 websites I have scanned. I need to pull out a report for each individual website. Is it possible to do? Right now I am just running a report and getting the results for all 30 and ...
2
votes
1answer
32 views

Is the following code seeding OpenSSL's PRNG necessary, superfluous, or harmful?

As I was going through Crypt::SSLeay, preparing it for the next release, I noticed the following code, written way before my time, ... int rand_bytes_read; static int bNotFirstTime; char buf[ 1024 ...
3
votes
2answers
44 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
1
vote
0answers
21 views

Ruby OpenSSL vs Linux openssl

I have a difficulty reconciling Ruby's OpenSSL library with the standard Linux command line openssl. What I'm trying to do here is encrypt the string mysecretstring with the password foobar but first ...
-4
votes
1answer
51 views

Most secure SSH server [on hold]

Which SSH server (compatible with Debian Wheezy) has the fewest (if any) exploitable security bugs?
2
votes
1answer
18 views

OpenVPN seamless migration from 1024-bit RSA to 2048-bit RSA keys

The company I work for has a few OpenVPN servers used by over 200 employees. The servers were deployed a few years ago using the default easyrsa settings and now we want to upgrade to stronger ...
0
votes
2answers
50 views

Check if i'm using a filtered network [on hold]

I would like to know if the connection in my office is filtered, because i cannot access Faceboook neither Youtube but i can access google with no problems, but Tor i can access all the websites. i ...
0
votes
1answer
28 views

Is it good idea to rely on Mifare UID for security/authorization reasons?

Some of you may know that nowadays I think you can purchase chinese cards, where you can write any UID you want, hence emulating the UID of a legitimate Mifare (e.g., Classic) card. My question is: ...
-1
votes
1answer
35 views

Use SSH config file with Putty [on hold]

I'm using SourceTree (a Git GUI) which uses PuTTY as SSH client. I need to push some code into a repository for which I need to tunnel through SSH to do so. The trouble is, the repository and SSH ...
0
votes
0answers
34 views

Reverse proxy and corporate PKI

Here at OU=PKI we've been requested to issue a certificate with CA capabilities to install it in our reverse proxy, so that it could issue trustable certificates for every single web. (SSL ending) ...
0
votes
1answer
44 views

Increase hydra brute force login attempts

I have recently came to know about hydra and i am playing with it using brute force. The number of login attempts are almost 10 attempts / second, I am trying with my password, so if my password ...
-1
votes
0answers
24 views

How can i access in host file whiles using a proxy server [migrated]

I using a proxy server (Freegate to be specific). I an unable to access the connections (dns mappings) that i have set in my host file. That is i want to access "127.0.0.1 YourInstanceName" whiles ...
1
vote
1answer
37 views

Understanding the details of SPI in IKE and IPsec

I'm currently learning IKE and IPsec for an exam. I have a lot of information on how Security Parameter Indexes (SPI) are used in both protocols, but I'm having some problems figuring out the ...
0
votes
0answers
30 views

How to install Metasploit on Mavericks + MacPorts?

I would like to install Metasploit on an hardened OS. For this purpose I chose Mavericks just because I'm able to harden this OS pretty far. I would like to install Metasploit with MacPorts because ...
0
votes
2answers
28 views

How to avoid session sharing inside the same network

I was thinking about a situation to avoid session sharing or hijacking, validating the IP the user logged in against the ip that is accessing any page after log in. It was working until I figured it's ...
-2
votes
1answer
42 views

Personal details and last 4 digits of credit card [on hold]

Recently, I was asked by a car rental agency in Los Angeles to provide the following personal details, to secure a car rental: Full name Date of birth Address Driver's license number Passport number ...
1
vote
2answers
54 views

Is hashing a DLL useful to protect from DLL hijacking?

I want to make sure that the dynamic link libraries used by my application can't be replaced with other libraries of the same name, in order to inject malicious code. Therefore, I thought about ...
0
votes
3answers
55 views

How do big companies ensure that other people don't register a new top level domain with their name?

For example today there are ".codes", ".farm" and ".vaijes" newly available. How do big companies like google, facebook, twitter, .. keep sure that they are the first who register their name on the ...
-1
votes
1answer
34 views

OpenSource considered harmfull?

What would you think about military strategist who is publishing full plans for all of important infrastructure? I think that person will be stupid. Can be this analogy case with OpenSource? Here is ...
0
votes
1answer
26 views

Is there a general name for this sort of cryptographic protocol?

Is there a general name for this sort of cryptographic protocol? If so what sort of assymetric/symmetric encryption functions tend to be used for this protocol?
0
votes
1answer
21 views

What is the point to the IPEK in DUKPT?

I'm trying to understand the DUKPT (Derived Unique Key Per Transaction) system used for PIN devices, but I'm getting hung up on the IPEK. This blog post has an image where the sequence is: BDK ...
5
votes
3answers
105 views

How are private keys stored on disk?

I have a public and secret key pair in my .ssh folder. How is the secret key being stored on disk? What I mean is .. Is it possible for someone to hack into my computer, steal the secret key and use ...
11
votes
3answers
933 views

NTP DDoS Attack on Home Servers

After some half-good script kiddies found out about this exploit or DDoS method, they have been doing it like crazy to websites, game servers, and now my home servers which allows me to work on some ...
0
votes
1answer
15 views

Challenge Response Login Authentication with Password Salt

I want to implement a challenge-response login authentication for my web application. My understanding is that the server has to send back the password salt for the user so that the user can ...

15 30 50 per page