0
votes
2answers
21 views

What information to provide when submitting a vulnerability report to a bounty program?

After finding a vulnerability in a program, one can submit it to a bounty program, such as ZDI. According to ZDI's website, they will examine the vulnerability and possibly offers a bounty. If the ...
0
votes
1answer
23 views

What evidence is there that Spideroak is significantly differnet than Lavabit?

In 2013 Lavabit shut down because a US agency was demanding access to its private SSL keys and basically the deets on whatever users the US was interested in. Lavabit shut down rather than give the US ...
0
votes
0answers
10 views

Is AES-GCM length extension attack possible using authenticated decryption?

I am looking to encrypt a piece of data using AES-GCM with a full 16-byte GCM Tag and send it over the network using UDP. Is it safe to assume using the AEAD nature of AES-GCM that performing ...
0
votes
0answers
29 views

How to use Wireshark to capture SSL+DHE encrypted mail traffic (SMTP/POP/IMAP)

(Please forgive and correct my inaccurate terminology, as I am not a security expert.) Wireshark is not decrypting my SMTP / POP / IMAP traffic, and I think it is because the "Cipher Suite" is ...
0
votes
3answers
70 views

What prevents web shop owners from misusing credit card data?

I don't own a credit card but read much about fraud with stolen credit cards. Since I don't own one, I don't know how you exactly buy online using your credit card, so please correct me, if I am wrong ...
1
vote
2answers
26 views

Is it normal if user gets logged in Facebook or Twitter after they use Like or Tweet button?

Personally I don't use social networks, so I'm not sure about their behaviour. Currently I must code website which heavily depends on "Likes" and "Tweets" about articles. Each article has Like and ...
0
votes
0answers
17 views

Windows mobile native application do have CSRF? [migrated]

I developed a windows mobile application which connects back to my web services hosted on internet to sync with the server data. I didnt put any control for CSRF on mobile application, Is it required ...
0
votes
2answers
38 views

how to encrypt a sensitive model on android and ios

I am writing a mobile app which uses a statistical model contained in binary files. I want to be able to distribute the app freely, but I don't want anyone to be able to use my model files, even on a ...
0
votes
2answers
22 views

Email “privacy” when sending within same domain

Scenario: email is hosted third party (think Outlook, Gmail etc.) I am sending email to another person with an email account on the same domain (think from user1@example.com to user2@example.com) ...
0
votes
0answers
65 views

Is Tox really secure? [on hold]

There is a new Skype-killer application called Tox. They said that it's open source and that it protects its users against governments and other adversaries that try to collect your information. But ...
-5
votes
0answers
13 views

How to whitelist a website on windows firewall and antivirus? [on hold]

I have just installed domdomsoft manga downloader software. But maybe the firewall/antivirus is blocking it. Whenever I am trying to update a website list it is showing this error 'Cannot connect to ...
0
votes
1answer
29 views

LUKS nuke efficiency

I am wondering about LUKS nuke patch efficiency. In fact, I think I don't really understand it. From what I know of LUKS, a passphrase is used to encrypt a random key (the master key), which is used ...
1
vote
1answer
49 views

John the Ripper not identifying a password contained in the username?

I have uploaded a screenshot of what exactly is going on, here: http://i.imgur.com/bJSv7C8.png I can see that single-crack mode includes a rule that looks at the username, and "slices" it to identify ...
-2
votes
0answers
19 views

How to find which program is reading a file? [migrated]

I tried delete some file but windows 8.1 reported that access is denied, which other program might read that file, but I don't run any. So it is maybe a harmful program. How can I find out which ...
1
vote
0answers
10 views

How were shift amount constants in MD5 found? [migrated]

The md5 specification gives a series of 4 rounds to execute over a 16-word block. Each round has a repeating sequence of 4 shift amounts (s in [abcd k s i]) : 7, 12, 17 and 22 for the round 1 5, 9, ...
1
vote
2answers
59 views

Viewing an infected file via FTP and code editor won't infect my PC right?

My apologies this may sound like a paranoid question... Recently my friend's website was infected by malware. With her permission, I FTP into her account to have a look and found some malicious PHP ...
1
vote
0answers
60 views

Example of a hacking attempt that failed because of a bug?

We hear all the time in popular press (and increasingly, in government publications + scholarly articles) about how "cyberattacks" make us insecure, because we have so many vulnerabilities (mostly ...
0
votes
1answer
49 views

Storing encrypted data for offline use

A user downloads a file from a server. I want to store that file locally on the user's machine so they can view offline. For protection, it should be encrypted while not being viewed. My theory is ...
-8
votes
0answers
90 views

If https is so good (as to completely replace http), why is DJB not using it? [on hold]

D. J. Bernstein, http://cr.yp.to/djb.html, @hashbreaker, is famously known for his crypto and hashbreaking abilities. Outside of the theoretical research that he is engaged in as a professor, his ...
0
votes
1answer
26 views

Iframe postmessage fraud

I've reviewed some material here and in other sites relating to secure usage of Window.postMessage. There is a bunch of material regarding best practices but one of my questions remained unanswered. ...
-1
votes
0answers
31 views

Decrypting packets with wireshark when you have the Algorithm [on hold]

Algorithm for encryption / decryption data transmitted over the network: Code: unsigned char encryptKey[264] = { 0x2b, 0x00, 0x00, 0x00, 0xda, 0x00, 0x00, 0x00, 0x58, 0x24, 0x32, 0x6a, 0xc3, ...
0
votes
0answers
9 views

Negotiate n-bits key with Diffie-Hellman protocol (or other key exchange protocol)

I've got ASCII message. I convert it to binary - then I've got 8*(ASCII message length) bits - let us assume this value will be called n. I have to negotiate key, which length (after conversion to ...
1
vote
0answers
20 views

What are analytics APIs accessing when they run, and how do you block or spoof them?

What are analytics APIs accessing when they run, and how do you block or spoof them? Usually all apps from desktop or mobile app stores, MMO clients, Steam and many utilities, and many games and ...
0
votes
1answer
86 views

How can an online hack be traced back to the perpetrators?

What sort of evidence might be used in linking, say, the Sony hack to North Korea? While I am curious about what was used in this particular case, my question is meant to be a more general question ...
0
votes
2answers
34 views

Why do I have to use multiple Keys for each direction and purpose?

I'm currently writing an examen about 'Lessons Learned in the IT-Security'. I already found some thing, which shouldn't be done. But right now I'm in trouble finding the reasons why not to do so. ...
0
votes
1answer
40 views

Is a SSL CA signed certificate necessary when connecting with IP Address?

I'm currently creating a socket server, and would like to encrypt communications. The thing is, the client will connect directly to the ip without any DNS. (Every user will know the Server's IP ...
-1
votes
1answer
27 views

Emulating Client by sending encrypted hexdump to dB server and getting response back [on hold]

So I used wireshark to retrieve a hexdump that has been encrypted with RSA. I need to figure out what the response to that would be when it comes back from the server. How I imagine it would work ...
0
votes
1answer
26 views

Two factor authentication using CVV and 3D secure code

While making online by Debit/Credit card, instead of using OTP (received on mobile), one can use a 3D secure code (verified by visa or mastercard) which is know to user. Should this qualify for two ...
1
vote
0answers
24 views

Are servers that do not implement time services vulnerable to clock skew attacks?

An article describes clock skew attack possibilities §§: These can be attacked by repeatedly connecting to the hidden service, causing its CPU load, hence temperature, to increase and so ...
2
votes
2answers
39 views

Tamper proof hardware - not resistant

Can you make a TPM (or any piece of hardware) Completely tamper-proof? The “regular” tamper resistant hardware has various physical attacks http://www.milinda-perera.com/pdf/EKKLP12a.pdf I have been ...
1
vote
0answers
59 views

Is hacking my own account illegal? [on hold]

I have just learned email hacking and I want to test it. I am well aware that if I hack into any email account, there are chances that my email service provider will track me. So if I hack into my ...
3
votes
1answer
48 views

Where to store passwords of encrypted backup drives

I have all my backup hard drives encrypted with LUKS. Currently, the passphrase is some 25+ random password that I store in my password manager KeePassX. Since I have the backup drives for the case ...
21
votes
1answer
1k views

How does CVE-2014-9390 affect me?

On 18th December, a vulnerability in git and mecurial was announced.  What are the details of the vulnerability?  Does it affect me?  What should I do?
1
vote
0answers
15 views

Snort only detect local issues

I have installed two physical machines with KVM virtualization using Red Hat as OS ( h1 and h2). In h1 I have installed the virtual machines w1 and db1 In h2 the virtual machines w2 , db1 and ids. ...
2
votes
1answer
29 views

Would a VPN with changing configs do the same job as different VMs

I was reading this question. So my question: Would using a VPN and swapping out configuration files that change your IP address mask the same as using different VMs?
1
vote
6answers
60 views

When is an antivirus program needed/useful?

Let's say I buy a computer and use the internet for services but rarely download anything and when I do it is from legitimate sources with a minimal to non-existent chance of malware. What benefits ...
4
votes
1answer
115 views

Best Practices for Security Questions

When a website asks me to enter security questions in addition to a password what is best practice on my part? This often happens with banks and other institutions but I see it less with other ...
-1
votes
1answer
41 views

Decrypting packet data without private key [on hold]

Firstly I am not doing anything illegal. How would I go about decryption a packet from the server back to the client and vice versa and get it in plain text WITHOUT using a private key. I have tried ...
-1
votes
0answers
9 views

Java Keystore best practice for large scale application [on hold]

I'm new to JCE/cryptography in general but I'm working on demo where we are going to create a public/private key combination for each users of the site. All the examples I have seen so far stores ...
2
votes
1answer
73 views

Does encrypting a file make it larger?

I encrypted a Word document using Winrar by setting a password. Surprisingly the archive was larger than the original file (631 vs 614KB). I then tested to see what would happen if encryption wasn't ...
1
vote
0answers
16 views

decrypt a soap message using openssl

I've tried to do the same as found in How to you manually decrypt a SOAP message using openssl? Unfortunatly without success... Here is my situation : I'm trying to do the same stuff only my data ...
0
votes
2answers
34 views

Calling string functions safely

I wish to implement some user callable functions in my code. I use something like this: function funcTest(){ echo "This is test function"; } if (isset($_GET['cmd'])) { $func = ...
-6
votes
1answer
43 views

Why study Information Security? [on hold]

This question might be considered as overly general, but it has occupied my mind lately. I have decided to study Information Security (to be more particular, 'Networked Systems Security') at ...
-4
votes
1answer
82 views

How The Sony Hack Was Traced, and So Quickly? [on hold]

What are the steps that are required to locate a source that have routed their traffic through multiple zombie hosts, spanning multiple networks/carrier/nations?
0
votes
2answers
27 views

HMAC: How unique does a nonce need to be if the Date is also part of the signature?

In a HTTP scheme where the HMAC-SHA256 signature is sent as part of the Authorization header, and the message input contains: The request method URL Post data Nonce Date HTTP header How unique ...
0
votes
2answers
109 views

How did piratebay.se search engine get in Chrome as an “other search engine”

I have an IT client with a user who had piratebay.se/... listed within his Chrome's (v39, 64-bit, OS X, 10.10.1) "Other Search Engine" section. I know a user could manually add it and suspect the ...
0
votes
1answer
92 views

Where can I download the Sony hack malware (for analysis)? [on hold]

I want to analyze the Sony hack Malware as there have been a lot of stories on who is responsible; from the US government implicating North Korea to news articles stating it's an inside job. The fact ...
2
votes
2answers
214 views

Is Double NAT a secure way to create a public wifi network?

I'm trying to create an open, public WiFi network in my house for guests to use, as I am hosting a (somewhat) large party later tonight. However, none of my routers have any built-in guest networking ...
0
votes
1answer
33 views

Windows 8.1 full disc encryption

I have a zenbook ux302 that I want to do a full disc encryption on. I had no problem using bitlocker on my stationary computer, but the zenbook doesn't seem to have that functionality? I have the ...
0
votes
1answer
23 views

Modern Browsers, Safe to Ignore CSRF?

For users using modern browsers, is it safe to assume they won't be able to be hijacked via CSRF and the likes? If not, how likely is it that an attack can take place?

15 30 50 per page