0
votes
0answers
3 views

using intermediate files for login and other files is secure?

i am developing web application. at some point i am using intermediate files. for ex for ex. login user loads login page after submit it redirect to direct.asp or direct.php file. after that direct ...
0
votes
1answer
16 views

How can DH provide a known secret to two parties over an unencrypted connection without it being reverse engineered via MITM?

Without using Private and Public keypairs, i do not understand how Diffie-Hellman is able to generate a secret key between two parties on the internet without passing something between that could be ...
1
vote
3answers
134 views

Is it better to use a root password, or use 'sudo bash'?

When I am doing a lot of sudo operations, I like to spawn a bash shell from sudo to make the operations go quicker. I am against assigning a root password because I do not like the root account ...
0
votes
0answers
23 views

HTTP vs. HTTPS- detailed procedure to implement HTTPS

I have a third party system deployed on Apache web server and Jbose application server, but no SSL implemented. Please tell me the detail procedure on how can I implement the HTTPS feature on my ...
0
votes
1answer
28 views

Buzzfeed just downloaded a binary file to my PC, unasked

The file is binary, named '96748', and it's 12.8kb in size. Ubuntu thinks it's an swf. Thank god I was in a Linux VM and not Windows. It doesn't seem to have done anything, and it's just sitting there ...
2
votes
0answers
44 views

What is the ideal anonymous workstation setup?

My goal is to build a perfect stationary workstation from which I can work anonymously. Most instructions on being anonymous usually involve, at some point, moving around and switching from coffee ...
0
votes
1answer
32 views

Uniqueness of name in cryptography

If I publish my public key (I think I understand how this works, I'm still learning encryption) and I have a common name, could this leas to problems at all? OR does the email part guarantee that this ...
1
vote
2answers
55 views

Can ISP use MITM attack to “break” encrypted traffic?

Use connection of A and B as an example. Their communications were encrypted by Public Key Encryption. Before they exchange their public key, ISP MITM attacked. A got "B"'s public key (ISP generated) ...
0
votes
2answers
33 views

How can a keylogger gather & transmit data from a client-only webapp run from file?

For a client-side only webapp run from file, how can a keylogger gather data and then transmit it? In this scenario, please limit the scope to the client code only, that an attacker somehow has ...
1
vote
0answers
15 views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
0
votes
1answer
36 views

Why is the HTTP Server header not used by most servers, but the User agent used by most browsers? [on hold]

I've read that the Server header would disclose information, and that its use would be bad. The arguments made in that question also apply for the User agent header. So why is it still used, and not a ...
0
votes
1answer
31 views

How secure is user-mode Linux, in terms of protecting the host system?

Two questions about User-Mode Linux: Suppose that a privilege escalation attack is used to gain root in a UML guest. Assuming modern (3.0 or later) host and guest kernels, is it trivial to escape ...
0
votes
0answers
23 views

What is known about recent zero day flaw with Tails and what level of confidence can we put on Tails to be able to keep us anonymous?

Following is a excerpt from COMPUTERWORLD Yesterday, in talking about the zero-day vulnerability in Tails, Exodus Intelligence wrote: "We publicized the fact that we’ve discovered these ...
0
votes
1answer
20 views

Is server-side access control sufficient or should I encrypt querystrings

I've got an ASP Classic system that passes around sequential ids corresponding to keys in the database. I had gotten an encryption module (chilkat, an activex control) that I was using to encrypt and ...
1
vote
2answers
32 views

Do cell-phones exist with open source baseband processors?

In a recent question (can't seem to find now), someone asked: Is it possible to track a phone which is off? and received a response of Who's to say that it's really off? Your phone has both ...
1
vote
0answers
29 views

How to further analyze suspicious traffic

I've been monitoring my network traffic with Little Snitch, and today, when launching Chrome, just the default Chrome tab (shows most frequent sites), it alerted me Chrome was trying to connect over ...
0
votes
1answer
26 views

Google safe browsing vs traditional anti-malware scanners

What is the difference between using Google Safe Browsing and using other traditional anti-webmalware tools ? Which one is more efficient to protect against malicious web content ?
1
vote
1answer
26 views

Server + Client certificate vs Server certificate + Client password

There are three different ways how TLS (1.2) can be used: server and client authenticate, only the server authenticates or neither authenticates. If neither server nor client authenticates using a ...
31
votes
0answers
2k views

Can you prove that an open source program is running the same code that it claims to be? [duplicate]

So if a group has made open source software, and the source code is available on github, and is bundled with an executable in their main download, can it be proven that the executable is compiled from ...
0
votes
0answers
17 views

Export non-extractable private key from Keychain on OS X

I have a PKI certificate in Keychain Access.app on OS X 10.9, together with the private key. The manual page for /usr/bin/security indicates that there is a -x option for security import to specify ...
2
votes
1answer
48 views

security reviews of third party code

I am not familiar with all the steps involved in a full-fledged information security review of an in-house developed application, so I am wondering whether or not the following scenario is ...
0
votes
1answer
62 views

Spoofing public IPv4 address

How can I spoof my public IPv4 address to another without using proxys? I don't need any response, the TCP handshake needn't be completed! I just want to send a SYN packet with spoofed (specific) ...
0
votes
1answer
131 views

How were hackers able to alter the text of my pages without a form or querystring?

I maintain a small site that runs old-fashioned classic ASP pages with an Access backend. Recently, the site got hacked. The attacker managed to add a large quantity of code to the index.asp page. ...
0
votes
1answer
45 views

How can LastPass enforce 2-factor authentication

I've recently started using LastPass and one of the things you can set as a policy for you password vault is Prevent offline access when using Google Authenticator. The local cache can be ...
-1
votes
0answers
26 views

Basic Security tool in Python [on hold]

I am new to python and scripting in general. Are there any recommendations on any basic security tool project I can start which tests both security and programming skills? For e.g. If I want to find ...
0
votes
2answers
30 views

How can I mitigate attacks that rely on poisoned data as a developer?

A few years ago, there was a high-profile attack on a Wired editor, where the hackers added a credit card to the target's amazon account, then used that self-added credit card to gain access to the ...
1
vote
1answer
37 views

Auth / Login token schema

According to this answer, a valid login token schema would consist of the username (U) the time of issuance (T) and secret key K owned by the server only The suggestion then is to concatenate the ...
-2
votes
1answer
40 views

Problem in downloading and browsing [on hold]

My downloads stop completing and some page in the browser appearing blank or with text only without css or js and so on, some program after complete return me a message when trying to start ...
27
votes
1answer
2k views

How does a SIM card prevent cloning?

I have read a few articles about SIM cards, stating that the chip inside them uses some cryptographic magic to prevent people from cloning your number. This to me seems borderline impossible, given ...
0
votes
1answer
29 views

What are JS malware techniques attacks?

Malicious JavaScript (generated by malicious hosted PHP code for example ) can lead to attacks. What are the types of attack that malicious javascript could perform ?
0
votes
1answer
35 views

Is it possible to distinguish between a SHA256 hash and an ecc256 key?

If an attacker were just given 256 bits, and they were either a SHA256 hash or a 256 bit elliptic curve key, would they be able to tell which one it is? Just out of curiosity, would they be able to ...
-1
votes
0answers
20 views

Convert hex MAC address to floating point [on hold]

How do I convert a MAC address to a floating point? I have tried to convert it to a decimal, but it gives me a long number, and I'm trying to get to a 3-digit number.
11
votes
1answer
239 views

Questions about the 2013 php.net malware

On October 24th, 2013, the admins of the famous php.net website said that their website delivered malware to its visitors using a drive-by download attacK. I have several questions about this malware, ...
0
votes
2answers
500 views

How to get MAC address via IP [on hold]

I have an IP address of a computer which I am currently away from, and I need the MAC address. How do I get the MAC address if I ony have the IP?
2
votes
2answers
47 views

Preventing a Computational DoS Attack in Public Key Cryptosystems

I'm designing a server which accepts anonymous messages using ECIES: as in, anonymous users send the server an ephemeral EC public key, and the server uses ECDH to derive a shared secret, and some KDF ...
-3
votes
0answers
13 views

Secure server not working with mac mail and microsoft outlook [on hold]

Secure server Now days we are getting lot of Domain advertisements on Facebook .Seeing those I took two domains on line after one month of follow up I can not configure it on my Microsoft outlook as ...
0
votes
0answers
63 views

Cracking a 6-character alphanumeric password Windows dialog box

To put this problem in context, I have a touch monitor screen whose firmware program is protected by a password. The firmware program is downloaded over RS232 via a Windows utility program provided ...
0
votes
1answer
31 views

Web site blocked by Windows defender and is marked as unsafe in IE

I posted this originally on Drupal Stack Exchange, and it was recommended that I try here for an answer. Here is the original question: Visiting my Drupal 7 site just now with IE 11, I get this ...
0
votes
1answer
31 views

Better way to store user authentication on phone app

We are creating an app and registration of user happens in following way. User sends via app: email-id/phone and username. Server sends a pin to enter in app via phone/email. User enters the pin in ...
1
vote
2answers
35 views

PyCrypto Possible To Check If File Already AES Encrypted?

import os, random, struct from Crypto.Cipher import AES def encrypt_file(key, in_filename, out_filename=None, chunksize=64*1024): """ Encrypts a file using AES (CBC mode) with the given ...
-1
votes
2answers
42 views

How to prevent accessing secure cross-domain data store

I have a client that needs to be able to secure a data site from hackers. This is the methodology we currently are looking at: server.com (web server) —> HTTP JSON API request —> dataStore.net (data ...
0
votes
1answer
63 views

How do SSL/TLS certificates work?

I'm trying to understand how SSL/TLS certificates work, but I'm missing something. I have obtained my current understanding from this website: ...
3
votes
3answers
591 views

Websites Forcing Weak Password Standards (Updated) [duplicate]

Please Note: I am not going to name the websites which have these horrible standards for their clients and users. I have had to change my passwords for my routine update just recently in the last ...
5
votes
2answers
288 views

Is it possible to ping a LAN card through its MAC address? [duplicate]

As you can start a PC through its 'WAKE ON LAN' feature on private networks, can you trace someone's online status through their MAC address over the internet ?
-1
votes
0answers
32 views

Outbound Traffic Blocked? [on hold]

I'm kind of new to networking. I'm working at a business that has solar panels installed on the roof. Recently, the solar reader has been unable to send data out on the network. There's a router ...
0
votes
1answer
26 views

Where is the TOTP secret key stored on client applications?

I'm new to concept of TOTP, but as I understand, 16-character base32-encoded shared secret is stored in the client application(for example Authy, FreeOTP)? This means that if I remove the application, ...
11
votes
3answers
2k views

Known characters in passwords?

I generate passwords for everything that requires security using the following method: ksoviero@ksoviero-Latitude-E7440:~$ head -c 16 /dev/urandom | base64 gorv/cp+lSiwiEfKck2dVg== 256^16 ...
4
votes
1answer
78 views

Is a Linux environment PCI compliant if the swap file is not encrypted and PANs are loaded into RAM?

Is a Linux environment PCI compliant if the swap partition/file is not encrypted and PANs are loaded into RAM by an application?
1
vote
2answers
66 views

Will a DDOS attack prevent outbound traffic?

Imagine a scenario where there is a DDOS attack against a target - clients would be unable to connect to the target, but I would like to know if the target could initiate a connection to the outside, ...
0
votes
1answer
58 views

Spying cellphones [on hold]

Today I read an article on a French newspaper that our government listens to us when we use our cell phones. I wonder what type of programming methodoly or technology that allows this espionnage ?

15 30 50 per page