0
votes
0answers
6 views

SSH cache secrets

Why does SSH use public key crypto each time you connect to the server? RSA/DSA are computationally expensive, so why can't they just be used the first time to share a secret, and then in the future ...
0
votes
1answer
13 views

Protection of eduroam credentials

Recently my educational institution officially switched over from the their own wireless network to eduroam. If I understand correctly from the FAQ, credential authentication is performed on the ...
-1
votes
0answers
12 views

Http splitting attack via webgoat

I'm trying to do the webgoat http splitting attack, I'm using firefox and burp suite. Note that I have already read the question that is already posted (Why is this response splitting attack not ...
3
votes
1answer
17 views

Should Flash be disabled, or are sandboxes secure enough?

Flash is a hot bed of vulnerabilities. Chrome contains a built in version of Flash, running in sandboxed mode. Obviously, this method is safer than running Flash as a plugin in either Firefox or IE. ...
-2
votes
0answers
8 views

PCI Compliance for 2checkout Payment API

I am using 2checkout Payment API for payments which requires PCI compliance, for which I registered with 2checkout's PCI partner Trustwave. Trustwave scanned my server and this scan passed. The next ...
1
vote
0answers
16 views

Chosen plain text and chose ciphertext definitions clarification

I am trying to understand a concept of CPA and CCA attack and I cannot get one thing from the definition. If an attacker can execute a CPA attack for something like Send 100 dollars to attacker ...
2
votes
1answer
17 views

New certificate but what about the keys?

One of our SSL certificates has expired and along with that so has the keys. I have a re-newed certificate but no re-newed keys. The posting Should I change the private key when renewing a ...
-2
votes
2answers
24 views

Use of Nmap ssl/http md5 and SHA1 hashes

I have below stated result on of the system by map: 443/tcp open ssl/http Apache httpd 2.0.52 ((CentOS)) | http-methods: GET HEAD POST OPTIONS TRACE | Potentially risky methods: TRACE |_See ...
1
vote
0answers
13 views

What is a “roving” backdoor?

What is a "roving" backdoor? I understand the general concept of a backdoor. Emphasis on keyword qualifier: "roving"...
3
votes
1answer
33 views

Is encrypted data a good random source?

Given that someone needs my encryption key to predict the output, can I encrypt arbitrary data (zeroes, system logs, personal photos) with AES and a secure passphrase, and use the result as a ...
0
votes
1answer
7 views

How to see absolute difference between DV and OV certificates?

I know that browsers show no difference to the user between OV and DV certificates, but what is a sure way to find out if a certificate IS or ISNT an OV certificate? Also, are there any technical ...
1
vote
0answers
7 views

Limited Buffer Size for shellcode on 64 bits machine

This question bother me for so long and I hope someone can give me an answer for that. I have a code snippet which have the classic strcpy vulnerability int main(int argc, char argv[][]){ char ...
5
votes
0answers
27 views

Locking Linux system to work on certain hardware only

Is there a way of locking a Linux system to work with a specific (pre-defined) hardware only? I am developing a commercial product and want to make it a bit harder for someone to clone the whole ...
0
votes
0answers
31 views

How to know our mobile number or phone has been hacked?

We have a Xiaomi Redmi 2 phone and a sim card in it. Yesterday we started receiving angry and swearing text messages. we called the numbers back and apparently a mass angry text messages have been ...
3
votes
1answer
30 views

How important is split-horizon DNS?

Split DNS returns different results depending on the source IP. It's commonly promoted as significant security measure for internal resources, for limiting enumeration and discovery. I've had many ...
-2
votes
2answers
39 views

XSS TRACE method

Could TRACE METHOD cause harm to my website? If this request is made: TRACE / <script>confirm("Java Script !")</script> HTTP/1.1 Host: xxxxxdomain.com X-Wing: ...
5
votes
3answers
57 views

Forgot password and revealing whether account exists

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
-2
votes
0answers
25 views

Restarting a wifi router with too many connections at the same time? [on hold]

Will router restart itself if receives too many connections at the same time, i.e. 200 connections. Will a enough big number of simultaneous connections bring the router down? Will this work? I ...
1
vote
2answers
46 views

How much information a Flash program (Flash app) can gather about computer when running?

Does anyone know if a Flash web application has access to local hard drive? What about OS information or hardware information? If I allow webcam and microphone access, how much information can it get ...
2
votes
2answers
134 views

Is always using HTTPS a good idea?

OK, this question might seem a no-brainer for a professional but keep in mind I am not a professional web developer so my knowledge in this field is very limited. I have been pondering over time ...
-2
votes
0answers
29 views

IP address in my ISP's netblock resolves to google

This appears to be the same as in the following question 'google.com' DNS resolved to addresses of ISP I have noticed that everytime I start a browser, I was getting a connection to one or ...
-5
votes
0answers
20 views

advantages of torrent clients, torrent P2P [on hold]

With the passage of time, torrents have become popular. Speed, reliability, data distribution are some of the advantages of torrent clients. What are some torrent clients that users can use to their ...
1
vote
0answers
40 views

How to store a file securely on the windows file system?

Problem: I have a windows service running under local system account. I have a blob of data that I want to store securely and persistently between reboots. I have decided to store it as afile( as ...
1
vote
1answer
24 views

302 redirect and the body on the page (you are redirected to …)

I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this: ...
2
votes
2answers
50 views

SSL stripping in home network

I am trying to monitor the traffic of some "smart devices" in my home (TV, coffee machine, ...) but most of them communicate over SSL. What possibilities are there to look into SSL encrypted ...
4
votes
2answers
37 views

Understanding Digital Certification as as a whole starting from a normal http request

I am very new to security and i do not come from an IT background. Please pardon me if i ask some very simple and questions that don't make sense. I am trying to understand the difference between ...
-1
votes
0answers
14 views

Is 3DES is a weak cipher? [duplicate]

Our application runs on JBoss 6 + jdk 1.7. We use the jdk provided SSL provider. The server.xml file contains SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA in the cipher lists. Is it a weak cipher? Should we ...
1
vote
2answers
53 views

Does WhatsApp disclose the sender's IP address?

Does WhatsApp disclose the sender's IP address? Is it possible to get it by running netstat -a or via Wireshark?
4
votes
1answer
60 views

How can I demonstrate that 3 independent root CAs validated my domain?

I am concerned about the hacking of a root CA and want to buy 3 SSL certs from completely different providers who will independently validate my identity. Then at presentation time, I will send all 3 ...
0
votes
2answers
70 views

Why is Facebook planning to drop support for SHA-1 encrypted sites, when they themselves use a SHA-1 certificate?

I noticed this problem when I implemented the Facebook Like Button plugin on my website, and got this error in my browser console: Hmm, I'm assuming that Firefox is talking about the last request, ...
-2
votes
1answer
38 views

Security of stock iPod vs. hardened Android [on hold]

http://www.wired.com/2015/08/secure-way-communicate-IPOs-touch/ https://www.lawfareblog.com/iphones-fbi-and-going-dark I'm looking for some advice on how to affordably secure my electronic ...
4
votes
2answers
48 views

Can a website have multiple valid TLS certs looping back to multiple root CAs in case one of them is compromised?

Sometimes, CAs get compromised, like Diginotar or Comodo. In such an incident, anything can happen from individual certs being revoked to the entire tree being scrubbed from the cert store. A company ...
3
votes
2answers
87 views

My IP address switched suddenly and then switched back

Sometimes I look at the login history of my blog account (a Tumblr blog) to make sure no one else is logging in (because I have private posts that I want to keep private). Even though today I ...
1
vote
0answers
23 views

At what point is information encrypted when communicating from a C# program over HTTPS? [on hold]

So I was running a communication log on an application I support I noticed that within the log there was a request string that displayed my password in cipher-text, but the next request string down, ...
0
votes
1answer
22 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
3
votes
1answer
43 views

How wifi sense actually connects to any network?

I read that using Wi-Fi sense, we can share our Wi-Fi networks with others and it stores pre-shared keys on Microsoft servers. Please help me understand the below scenario: I am sharing my network ...
0
votes
0answers
10 views

Executing ELF binaries in OSX [migrated]

I have a CTF related question and I was wondering if someone can point me to the right direction. I work on OSX Yosemite and I was going through some wargames and older CTF challenges. My goal is to ...
1
vote
1answer
31 views

Reflected XSS quote not encoded

I am attempting to exploit URL with a reflected XSS as follows: http://domain.com/vuln_parm= The contents of vuln_parm gets returned to the user as follows: <div attrib1="" attrib2="" ...
1
vote
2answers
23 views

Device visibility on a network

At my college dorm's Wi-Fi network, one device can play to any other network-connected, YouTube-enabled device on that network. Apple devices can also AirPlay to the one Apple TV connected here. How ...
2
votes
3answers
53 views

Site hack with email phishing scam

We have a small business website that has been compromised. They are somehow getting customers order details and contacting them requesting their credit card details. We have had our web team and a ...
7
votes
2answers
149 views

Why is Tor over HTTPs insecure?

I don't get how a HTTPs connection over Tor can be insecure. Where's the difference between a normal HTTPs connection and a TOR -> HTTP connection? Many sites recommend to use the Onion-URL instead of ...
1
vote
2answers
83 views

securely storing passwords that can be retrieved

I'm trying to build a web application that can store passwords of other services like Facebook, Gmail ...etc. These passwords can be later retrieved and shown to the user. This has to be a web ...
1
vote
0answers
16 views

SSH-Keygen Fingerprint providing Letters and Numbers Result [on hold]

I've been using SSH and public key crypto for a few months. I've run into a new problem with my install of the newest public beta of OS X, and can't find an answer online. When I run SSH-Keygen -lf ...
0
votes
0answers
12 views

Proving an encrypted message contains (but does not 100% consist of) a plain-text message? [migrated]

I have keypair (u,r), and two pieces of data, X and Y. I reveal X publicly but keep Y secret. Y has high entropy. I then combine X and Y, into c(X,Y) = Z. I encrypt Z, into "encrypt(Z,u) = Q". r ...
14
votes
4answers
1k views

What is the difference between http and https with a self-signed SSL certificate?

A colleague of mine has told me he doesn't see why there is a warning when visiting a HTTPS website with a self-signed certificate saying that the security may be compromised, but there is no warning ...
1
vote
0answers
23 views

Configure CLAMAV for XML inspection

How would I configure clamav to look for XML exploits. I am not even sure if it supports it but from reading the conf file I am not really seeing any mention of XML. to test this I have literally ...
1
vote
0answers
58 views

Virtual phone number [on hold]

I want to set up an account for a certain service while remaining anonymous. This service requires phone activation and where I live it not possible to activate a sim card without submitting id to the ...
-2
votes
1answer
73 views

How to secure server when the root password is changed [on hold]

I have a server and I develop a web application for my customer. I have the server credentials but I wonder what if my customer changes the server credentials after I have completed the application, ...
3
votes
1answer
96 views

OS login password: How does it work?

I am making an application to create a password for a user. I am a bit baffled over how it all works though. Namely I want to be sure that my application will store the correct hash so the user can ...
30
votes
4answers
4k views

How does a hacker know how many times a password was hashed?

I've been reading a lot of questions about security and hash functions on this site and others. I am not an expert, just a curious mind and in my understanding the more iterations used to hash a ...

15 30 50 per page