1
vote
1answer
14 views

can multiple encryption of data with multiple keys increase the security?

I mean: does encrypting data multiple times have an effect on diffusion and confusion? Does it increase security, or does it have no effect? Is it useless? Does it make it harder to break the secret, ...
0
votes
0answers
10 views

Is it safe to whitelist CDN domains?

I am trying to whitelist URLs for my PC but I want to eventually roll out the rules to my small company's firewall. But I'm having trouble with CDNs since a page may load content from many distinct ...
1
vote
1answer
34 views

Legality of writing exploits for educational purposes (USA, Canada)

Is it legal for me to write a small exploit (possibly to a closed issue) and put it up on the internet for everyone to see (as a tutorial). I have been researching the legality of exploiting ...
2
votes
1answer
8 views

Is it particularly unsafe to use openvpn or pptp with only username/password authentication instead of certificates?

I use a vpn server (supporting pptp and openvpn) built in to my router at home to make a secure connection back to my home network. I currently use OpenVPN with certificate authentication, but since ...
0
votes
2answers
37 views

How to check if the SSL certificate is deployed correctly onto a server?Also, how can we check if it is working?

I have installed a SSL certificates on a server. Now, I want to check if it is correctly installed and they are working correctly. Because I have heard from my friend that when you are installing you ...
0
votes
2answers
69 views

Malware script uploaded - CPU has been maxed out

I received notifications that the CPU was maxed out. Using Process Manager in WHM, I could see that commands named "fuckyou" was running some kind of cron sript on our server. The file it was calling ...
2
votes
4answers
153 views

How to run nmap HTTP scripts on unusual ports

How can I make nmap run the HTTP-scripts on ports that are unusual for HTTP, say TCP port 123? On something like nmap -n --script="http* ..." -p123 target nmap does nothing except to check that port ...
2
votes
1answer
27 views

User-friendly TLS certificate validation

I'm designing an application in which clients generate their own TLS certificates ad-hoc (there's no central authority). When two clients interact for a first time, I need for them to mutually check ...
-5
votes
0answers
23 views

Is the host OS and data 100% safe if I install dangerous cracked software in Virtual Machine? [duplicate]

There are two "hack" software core which are Bol and L# for the game LOL, the software let the player to semi auto or total auto in game by running scripts. There were people used Bol and somehow Bol ...
1
vote
0answers
35 views

Strange IPs in Active connections

To start, I have no clue if this is the right place to post this. If it's not, I'm terribly sorry! I have an ASUS RT-AC66U router, and I'm not the most tech-savvy individual. Earlier today, the ...
4
votes
3answers
61 views

How do I convince others of the importance of password management?

I just got married, and my wife and I are in the midst of combining finances, etc. We set up a joint bank account and the first thing I do during the account setup phase is generate a 16-character ...
0
votes
2answers
49 views

Prevent MITM between custom phone app and local server

We're building a Wifi enabled device. The device will be installed locally on each client's office and people in the the small office will connect to this Wifi enabled device, They will send/receive ...
3
votes
2answers
54 views

Is VM per service a reasonable server security model?

Let's say I am hosting several services on my server, for instance, email and a web page. I am concerned that the web server software may have unknown vulnerabilities in it, which will allow an ...
1
vote
1answer
18 views

Are there any known breaches of the .NET AppDomain isolation?

.NET AppDomains provide several levels of isolation for untrusted or partially trusted code. The AppDomain sandbox is widely deployed in ASP.NET and Silverlight, although only the latter of these is ...
2
votes
0answers
41 views

How to create TLS SHA256 certificate request [migrated]

One of our business partners is requesting us to use a TLS SHA256 certificate to connect to their APIs. I am not sure how to generate these requests. I have used openssl in the past to create these ...
0
votes
0answers
22 views

No internet access using Airbase [migrated]

I'm using Airbase to set up a rogue wireless AP, but when I go to connect to it, I can connect to the AP, but I can;t get on the internet. Here are the commands I'm using. Can anyone tell me what I ...
0
votes
1answer
51 views

XSS with a torrent [on hold]

Is it possible to XSS using a BitTorrent tracker. I have been hearing that you can use a torrent to perform XSS. Is it possible ? If so whats the general idea ?
0
votes
1answer
25 views

WPA2 Protection (books?) [on hold]

I have recently read this article: http://www.tomshardware.com/reviews/wireless-security-hack,2981-5.html. It gives an excellent basic insight on how WPA work. However I want to learn more, I want to ...
0
votes
0answers
40 views

What lessons learned can be gained from the Sands Casino hack?

I'm looking for a concise summary of what was done right, and what lessons could be learned with the Sands Casino hack. One take away that I saw is the need to audit for, and purge locally cached ...
1
vote
1answer
20 views

FireFTP security [on hold]

I've just installed the FireFTP plugin for Firefox, I have been using Adobe Dreamweaver's FTP up to now but wanted to try something different. When I opened it up and saw all of my computer's files ...
1
vote
1answer
28 views

SSH: What's the difference or interplay between /etc/ssh/[host files] and ~/.ssh/[public key]

I'm new to SSH after a decade of dabbling with Ubuntu and other Linux builds. Today I successfully setup SSH, but I had a few hangups and headaches along the way. Although the system is now running ...
1
vote
0answers
62 views

someone may be doing something nasty

I have an ssh server. earlier toady, I was about to login to my server, when I got a message that said something along the lines of "Someone may be trying to do something nasty" and indicating a man ...
0
votes
1answer
23 views

Diceware & Database hosting [duplicate]

I'm currently setting up a new SQL database with DotEasy as my Hosting/Database provider. I've heard a lot about Diceware being one of the best methods of creating a really strong password, so I ...
0
votes
0answers
20 views

Webserver Stress Tool [on hold]

Can you recommend me a stress tool for my web server? I'm running debian 7 with webmin (VPS), currently i'm using apache,mysql,ssh,fail2ban. I also have scanned my server with nessus and LSAT without ...
8
votes
1answer
61 views

Why can't we bypass DNSSEC

DNSSEC is a suite of security extensions to enhance DNS security. (e.g.: avoid cache poisoning) However I was wondering how does the resolver know that the next NS will use DNSSEC? E.g.: Someone ...
0
votes
1answer
47 views

Do I need dedicated firewall? [on hold]

I have two servers in the datacenter. FreeBSD <--> Windows Server FreeBSD configured as a gateway for Windows Server. What is the best: FreeBSD has only firewall. All services are on the Win ...
1
vote
2answers
66 views

Protecting the BIOS from malware [on hold]

The BIOS operates at a lower level than the OS, so antivirus software cannot scan it. Is there any other security software that we should use to protect the BIOS?
1
vote
3answers
57 views

Securing a secondary login page for inputting a multi-factor auth token

I would like to implement the following use case: User lands on the login page User submits login credentials Credentials are validated and they are redirected to another page for inputting the ...
0
votes
0answers
51 views

Windows Server 2008 R2 - SHA2 based Cipher Suites [migrated]

I am currently in the process of upgrading the SSL certificates for various websites that I manage from SHA1 to SHA2 compatible certificates. To date we have always used 'RSA' as the key exchange ...
5
votes
1answer
71 views

Showing bank routing/account numbers, and storing them safely

EDIT: This is for the UK/Europe region. I've been scratching my head reading other posts similar to this one about safely storing bank routing and account numbers. I know that routing numbers can be ...
0
votes
3answers
262 views

Sending database name in request headers

I am doing a project with an architecture of single server and multiple database. Every client request will contain a header containing database name that this request should connect. Is this a good ...
4
votes
2answers
140 views

Why does the first call to DecryptUpdate in AES-CBC return 16 fewer bytes?

While decrypting a file by CBC mode of AES algorithm, the output length is 16 bytes lesser than that of the input length. For example if you pass a buffer of 512 bytes it decrypts 496 bytes. It ...
5
votes
2answers
616 views

Facebook POST request capture

I have been trying to test a sniff on facebook POST request forms using wireshark (filtered HTTP). At login form, I would try login, and then check wireshark and see that no packet was captured. ...
1
vote
2answers
92 views

How can I find out who is behind a Mac address?

I was connecting a bluetooth device to my tablet and noticed that when scanning for the devices one "device" was actually a Mac address. We (me and my husband) have been under a hacker attack already ...
1
vote
0answers
52 views

How to recreate the Freak attack?

Currently I am trying to recreate the Freak attack on a virtual machine. For this purpose I set up a Linux Mint 17.1 system with Apache 2.4.7 (with a self signed certificate) and OpenSSL 1.0.1f. I ...
2
votes
0answers
28 views

Are there any Distributed/mesh-like/P2P VPNs? [migrated]

I have my personal VPN, connecting several devices so they can have fixed IP addresses on an always-reachable network (as long as they are connected to the Internet). This is necessary for me, since ...
0
votes
0answers
24 views

How exactly BitDefender Box achieve its “security” ? Should i trust them? [on hold]

BitDefender Box is a hardware from BitDefender company that acts as AV to all devices connected to network and can be a router too, but they disclose very little about how they achieve their ...
1
vote
0answers
9 views

OBKG on smartcard with PKCS#11

I have a new smart card with an on board PKCS#11 module and operate in a Win 8 environment. Like many cards, it can generate its own key pairs for enhanced security (only the public key can leave ...
1
vote
1answer
62 views

Storing encryption key in a cookie?

I have a website issue that I am addressing by storing an encryption key in a cookie. I want to describe my issue and my solution, and see if someone smarter about such things than I thinks this is a ...
0
votes
0answers
30 views

bell lapadula model and composite services

I am studying the security of composite services. The Bell-Lapadula model is useful for access control. Can I use this model for access control in composite services? The security level of each ...
0
votes
1answer
24 views

Boot Attacks possible on encryption keys used in virtual machines

Is it possible for an attacker to restore passwords or encryption keys that one has used in a virtual machine the same way like restoring keys that have been used in a standard system applying a boot ...
-1
votes
1answer
52 views

How to test if my server is secure? [on hold]

I'm using a debian7 VPS for hosting my websites. I have only installed webmin, apache, mysql, SSH and a wordpress website. I always update my packages and wordpress version. What is the best (free) ...
55
votes
2answers
3k views

How to publish scanned documents anonymously?

I was thinking of the following question for a long time and did not find a lot of material* in the web and nothing at all on Security.SE. I think its a very interesting question as it covers ...
1
vote
3answers
62 views

Methods to have multiple Anti Virus installed on one machine

I am running Windows 8.1 Pro, Ideally I would like to have the top 5 Anti Virus installed but I am aware it is not advised as they can clash with each other. I was wondering if there is a favoured ...
8
votes
2answers
606 views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
34
votes
4answers
4k views

Does read-only access to the database prevent sql injection?

I have a web api that connects to my SQL Server using a read-only connection and want to allow tech savvy users of my api to enter an SQL where clause on the querystring. I basically just want to tack ...
0
votes
1answer
19 views

Is there any use in an AIA Extension in a Certificate directly issued by a Root CA?

While most documentation I've read states that there is no requirement to have the AIA extension in a self-signed Root certificate (logical enough), I can't find anything that tells me not to do so in ...
0
votes
0answers
33 views

startups - securing data and applications on laptop [on hold]

I am starting an organisation of web development. I owned some laptop(s) for same reason. Employee can carry those laptops at home. But when they will be login to system in office, they can have ...
1
vote
1answer
48 views

Android email encryption [on hold]

Is there a reliable (in terms of security), open-source application for handling (send/receive + en-/decrypt) encrypted emails on Android? Something like TextSecure for emails. I just found a command ...
0
votes
0answers
25 views

On firefox behind corporate proxy, intercepting on WebGoat using burp Suite error [migrated]

i'm following a tutorial on hacking web application WebGoat using burp suite I've downloaded webGoat which now runs on port 8080, set up burp suit and the browser connection as in the pictures, but ...

15 30 50 per page