0
votes
1answer
5 views

Extremely slow GnuPG 2.x Performance

I have an curious problem with my script. The script runs very fast ,when i use GnuPG 1.x. With GnuPG 2.x it runs very slow at encryption/decryption, and i have no idea why. Versions: GnuPG 1.4.20-6 ...
0
votes
0answers
7 views

Digital signature VS whole message encryption

I am newbie in information security I am trying to understand the difference between the digital signature and encryption of message. Lets consider simple example of email message. I understand how ...
-2
votes
0answers
5 views

c# code to reset password in ms word document

am doing my final year project to develop a software that will enable to recover the password in ms office document in-case people forgot, die or quite a job in certain organization. ANYONE WITH IDEA ...
1
vote
1answer
6 views

Is there a secure method of distributing keys to network-booted diskless nodes?

I have a bit of an 'initial trust' issue. We are using CoreOS to run Kubernetes, and secure both the etcd API and the Kubernetes API servers using client certificates. We are using iPXE to boot ...
0
votes
1answer
7 views

Can someone know that I'm using a VPN if they have my MAC address?

My university has a web filter, so I use a VPN to access blocked sites. They also have my MAC address. Can they identify that I'm using a VPN and what I'm doing on the internet?
2
votes
0answers
7 views

Prevent keyloggers on Linux?

Are there any mechanisms in the Linux desktop architecture to prevent malicious software keyloggers? What would be an ideal Linux setup to make it very difficult for an attacker to install a keylogger ...
0
votes
1answer
25 views

Doesn't this make 2FA irrelevant and possibly dangerous?

Article. One sentence summary: they use a smartphone as a listening device to compromise computer security. I know our bank doesn't allow us to take cell phones in at all, even if they're completely ...
0
votes
1answer
19 views

Is moving data between devices on an SD Card safer than a USB stick?

From the perspective of USB device-born malware/exploits, especially affecting firmware (e.g., can an infected computer reprogram an inserted USB memory stick to act like a keyboard and autotype ...
0
votes
1answer
12 views

How and why does case insensitive XSS work, given that javascript is case sensitive

I found out a lot of instances where XSS scripts like the following work. <iMg SrC=x OnErRoR=window.location=123> My question is: Given that javascript is a case sensitive language, how is ...
2
votes
1answer
20 views

Is storing passwords encrypted with GnuPGP on an anonymous FTP server safe?

I would like some advice on a method of storing passwords to a database on my anonymous FTP server. Basically I have login details for a few trusted users to a database server stored in a text file ...
-4
votes
0answers
9 views

are there a break in case in access control system ??(e.g rfid, biometirc) [on hold]

i want to a break in cases in access control system. i need to the articles. i need a lot of articles. please.......please......help me..... are there a perforated case in access control system ...
1
vote
1answer
7 views

Using external OAauth Authentication Service, how to manage the users's relations

I'm trying to create an API and a website client for it. Lately I've been reading a lot about OAuth2 as a security mechanism and companies that offers authentication as a service such as auth0.com or ...
1
vote
0answers
18 views

How to “stealthily” call a Java function to avoid text search?

Assume I am an attacker, I want to call an API function from an Android app, say Build.getRadioVersion(). But I want to keep this call stealthy, i.e., it cannot be searched through, e.g., grep ...
0
votes
0answers
3 views

Why ecryptfs still remain in mtab?

I use ecryptfs for encrypted lxc container container start ok and stop ok But i see even after stop this line /var/container-lxc/face/rootfs.crypt on /var/container-lxc/face/rootfs type ecryptfs ...
0
votes
2answers
19 views

Can they tell which individual computer was torrenting on shared internet connection?

I live in a shared house where multiple people use the same wi-fi (actually, there’s two: the normal frequency and 5GHz one). The internet is included in the rent. The other day I received a complaint ...
0
votes
0answers
3 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
2
votes
2answers
27 views

Can a full SSD or HDD recover deleted data?

I've always been curious. It may be a stupid question but what if you deleted a file then filled up the SSD or HDD. Could your deleted data be recovered or is it physically impossible? I know Windows ...
0
votes
1answer
28 views

How to verify the signature value in a SSL certificate?

According to RFC 3280 a certificate's basic syntax is Sequence := { tbsCertificate signatureAlgorithm signatureValue } In tbsCertificate, SubjectPublicKey is the public key of the ...
0
votes
3answers
27 views

How secure is it to use passwords consisting of one common part and one site specific prefix? [duplicate]

One of the greatest problems with passwords is having to remember different passwords for different sites. Some people use password managers, others use the password reset link every time they want to ...
3
votes
1answer
34 views

Would a DMZ be safe to use with a software firewall for home networking?

If I set up a Windows 10 PC with a software firewall (TinyWall, which is a front end for Windows Firewall) and blocked all traffic except for a few applications and ports I would be using (Minecraft ...
0
votes
0answers
4 views

What are the advatages or disadvatages of using seperate chaining over linear or quadratic probing? [migrated]

I was looking through different hash methods the other day and was curious as to what the advantages or disadvantages of using separate chaining over linear or quadratic probing. I know that with ...
2
votes
2answers
19 views

Use Nessus or focus on manual testing?

Nessus scans for a a lot of vulnerabilities, so should I focus on learning vulnerabilities that are not covered by Nessus, like directory traversal attacks? Should I work on only the vulnerabilities ...
5
votes
1answer
63 views

Can free Wi-Fi hotspot providers snoop on HTTPS communications?

Every article (and post on this website) I find on public Wi-Fi safety is mostly concerned with other people connected to the same network snooping on our communications. As far as I understand it, ...
2
votes
1answer
24 views

Can data be restored from a hard drive after using magnets to wipe the data?

Can a 512GB SATA hard disk be successfully restored after using magnets to wipe off it's data? From the movie: "The Core", https://youtu.be/g3KPSyNxnL8, rat using magnets to wipe his drive and puts ...
0
votes
1answer
18 views

Does KDE System Tray Extra Items “Clipboard” have the same security threats as the system clipboard?

Does the clipboard under kUbuntu's KDE System Tray > Extra Items "Clipboard" have the same security threats as the system clipboard? The following articles point out the insecure nature of the ...
0
votes
1answer
54 views

Avast attempts to connect to the Internet when I try to download email

The file AVAST (Software\Avast\AvastSvc.exe) tries to connect when I check my email. When I forbid access to the internet for AvastSvc.exe, I can't connect to POP3 & SMTP. I'm not sure where all ...
0
votes
0answers
4 views

How to manage logged-in state across multiple subdomains with a JWT?

So I am using JWTs to manage logged-in state for users. We also have translated sites on subdomains, eg: www.example.com // english es.example.com // spanish de.example.com // german And so on. ...
-9
votes
0answers
22 views

banking app testing information [on hold]

How to test banking android app for OWASP 10 SEQURITY RISK? PLEASE GIVE ME TOOL NAME ON WHICH EXAT RESULT WE CAN GET? AND GIVE ANDROID APP FOR DEEP TESTING? HOW TO PERFORM TESTING OF ANY BANKING ...
2
votes
1answer
27 views

How to identify and patch a hardware vulnerability?

Software and systems vulnerabilities are often patched with updates, or by avoiding the use of some OS or softwares that have multiple flaws. Regarding hardware vulnerabilities, I do not have a lot of ...
-1
votes
0answers
12 views

how to create DMZ on xDSL router [on hold]

Need to know that how xDSL router can be set to use DMZ in its firewall to reach a PC server on LAN. Should I use pubic WAN IP address for DMZ host ? The would it be accessible to public network.
8
votes
1answer
218 views

Bank complains about rooted Android. Is it really any worse than a Windows desktop?

When I use my bank's Android application, the app notices that my phone is rooted and puts up a message with a big red "danger" symbol and a message saying "vulnerable device." I totally understand ...
1
vote
1answer
15 views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
0
votes
1answer
34 views

How is UDP hijacking even possible?

My doubt is this: UDP has no sequence numbers, so what indeed is the concept behind UDP session hijacking?
6
votes
4answers
250 views

Can govt intercept End to End encrypted Whatsapp communication through the lawful interception?

Since after Whatapp started end to end encryption with an option for users to verify keys, many government security agencies like Indian one red-flagged such use of encryption. Now Yesterday the ...
0
votes
2answers
21 views

NMAP shows multiple outputs in OS detection

I am experimenting with NMAP in our network as an assignment, and I meant to do OS scan on one specific host 192.168.2.18, for which I chose the following command, nmap -O 192.168.2.18 and I was ...
0
votes
1answer
44 views

What is the best practice to secure an unattended Raspberry Pi?

I'm working on a project which involves mounting a Raspberry Pi on a self-moving vehicle. I'm looking for the best way to encrypt the Pi (entire file-system, swap, etc.), with the minimum possible ...
0
votes
1answer
20 views

How to find name of file to include in local file inclusion attack?

In a local file inclusion attack, besides guessing, is there method that allows an attacker to know the name of the right file? The name of the file to be included in a LFI attack is not always ...
1
vote
1answer
22 views

What can an attacker do with an exploited program?

If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do? Would it be able to only change data in Internet Explorer, could it modify anything on ...
2
votes
1answer
18 views

Server loaded with antivirus lets viral file go through

We have a .NET MVC website with a WCF Service as a service layer. One of the feature that the service offers is the ability to upload documents. When we asked our security consultant to test our ...
-1
votes
0answers
21 views

Explanation for these entries in the Suricata fast.log?

We have installed Suricata on our system. We have the following similar lines in our fast.log. Can anyone explain these lines? 03/17/2016-17:18:52.744707 [**] [1:2200075:1] SURICATA UDPv4 invalid ...
8
votes
0answers
55 views

Are keyboard hooks inherently malicious?

My software is using low-level keyboard and mouse Win32 hooks for legitimate reasons (if it's any relevant, it's for determining a change in the caret position of the active code pane in the VBA IDE). ...
0
votes
1answer
36 views

SRP, or hash hashes over HTTPS?

I'm designing a web API, which will use credentials from another system to authenticate. The API will require HTTPS, however I still want to avoid sending a basically plaintext password over the wire ...
1
vote
1answer
51 views

Is there readily available encryption algorithms for current computers, that is safe from quantum computers?

Is there readily available encryption algorithms for current computers, that is safe from quantum computers? I know a bunch of currently popular encryption algorithms that are safe from current ...
2
votes
0answers
14 views

What is the current state of RFID / NFC security?

I'm attempting to do some RFID and NFC cloning and replaying research, as I'm hoping to be able to demo physical security as an attack vector to a few of out clients and prospects. The downside ...
4
votes
1answer
67 views

How does reuse attack protection (RAP) work?

The grsecurity folks just released a test patch for the 4.5 Linux kernel which includes Return Address Reuse Attack Protection or RAP, a protection technique against return-oriented programming (ROP). ...
0
votes
1answer
20 views

Which HTTPS certificate is the content verified by if the content comes from multiple servers?

If a webserver has an HTTPS certificate and a page on the server pulls resources from other webservers - maybe a CDN with a protocoless path, or not, for things like static images, stylesheets, and ...
-1
votes
1answer
20 views

Testing attacks on the Signal messaging app [on hold]

I want to verify the security of the Signal messaging app. Signal is said to offer several security features. I want to try several attacks, including attacks that have worked on other more vulnerable ...
1
vote
0answers
28 views

What should I do when I find out some company user database I am listed in was leaked?

Today the antispam tool in the company I work for blocked several emails. It has been months since last time, so I took the time to analyze the quarantined messages. Since I almost never give my ...
0
votes
0answers
10 views

Potential security concerns with using Torrent Trackers Servers for establishing P2P

I am designing a small p2p system, and I am thinking of using Torrent Tracker Servers, by way of a unique infohash, which all the peers share and use to find each other. The idea being, the first ...
0
votes
3answers
78 views

Protect WordPress from brute force attacks?

One of my WordPress sites is being constantly attacked with brute force. I have the WordFence and Clef plugins installed. The number of login attempts is limited to just one. The password is very ...

15 30 50 per page