0
votes
0answers
2 views

Is hacking my own account illegal?

I have just learned email hacking and I want to test it. I am well aware that if I hack into any email account, there are chances that my email service provider will track me. So if I hack into my ...
18
votes
5answers
3k views

Does too long a salt reduce the security of a stored password hash?

Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs? I was ...
2
votes
2answers
5k views

How to block all access to Akami deploy servers and Apple push servers?

I no longer blindly trust the numerous connections that occur at night and during the day that always go to "content" and "push" servers like: a23-33-37-54.deploy.akamaitechnologies.com ...
2
votes
2answers
39 views

How does CVE-2014-9390 affect me?

On 18th December, a vulnerability in git and mecurial was announced.  What are the details of the vulnerability?  Does it affect me?  What should I do?
1
vote
0answers
10 views

Snort only detect local issues

I have installed two physical machines with KVM virtualization using Red Hat as OS ( h1 and h2). In h1 I have installed the virtual machines w1 and db1 In h2 the virtual machines w2 , db1 and ids. ...
2
votes
1answer
38 views

What method could a white-box attacker use to track the deletion of memory / files?

A rather theoretical question: Assuming there is memory with a malware inside it. The malware's goal is to detect if a legit application is about to delete contents of the memory. If recognized, the ...
0
votes
2answers
26 views

Doesn't seem to be able to capture the packets I need

I've been trying to capture Telegram messaging application's packets (for my class project) but I couldn't get anything out of the punch of captured packets I got. Telegram does AES-256 encryption ...
1
vote
0answers
10 views

Where to store passwords of encrypted backup drives

I have all my backup hard drives encrypted with LUKS. Currently, the passphrase is some 25+ random password that I store in my password manager KeePassX. Since I have the backup drives for the case ...
1
vote
2answers
182 views
+50

What benefits are there for security architecture being a separate discipline to enterprise architecture?

Had this question at Owasp Scotland this evening, and didn't get useful answers. Is there too much specialisation in security now which means that enterprise architects can't know enough to delivery ...
2
votes
1answer
18 views

Would a VPN with changing configs do the same job as different VMs

I was reading this question. So my question: Would using a VPN and swapping out configuration files that change your IP address mask the same as using different VMs?
0
votes
3answers
21 views

When is an antivirus program needed/useful?

Let's say I buy a computer and use the internet for services but rarely download anything and when I do it is from legitimate sources with a minimal to non-existent chance of malware. What benefits ...
0
votes
1answer
59 views

What does proxyexec + cagefs.server mean in the e-mail X-Source-Args?

I've the following headers in the e-mail which I've received as spam: X-Source: X-Source-Args: /usr/sbin/proxyexec -q -d -s /var/run/proxyexec/cagefs.sock/socket /bin/cagefs.server X-Source-Dir: ...
3
votes
2answers
127 views

Best way to store/retrieve sensitive key files?

We have our web servers running in AWS EC2. We have about 30 API Keys/passwords/etc (sensitive data) which is set in the environment for our app to use. Whenever we deploy, we start a new server ...
0
votes
2answers
25 views

Calling string functions safely

I wish to implement some user callable functions in my code. I use something like this: function funcTest(){ echo "This is test function"; } if (isset($_GET['cmd'])) { $func = ...
-1
votes
1answer
22 views

Decrypting packet data without private key

Firstly I am not doing anything illegal. How would I go about decryption a packet from the server back to the client and vice versa and get it in plain text WITHOUT using a private key. I have tried ...
0
votes
0answers
14 views

Best Practces for Security Questions

When a website asks me to enter security questions in addition to a password what is best practice on my part? This often happens with banks and other institutions but I see it less with other ...
0
votes
2answers
69 views

How did piratebay.se search engine get in Chrome as an “other search engine”

I have an IT client with a user who had piratebay.se/... listed within his Chrome's (v39, 64-bit, OS X, 10.10.1) "Other Search Engine" section. I know a user could manually add it and suspect the ...
69
votes
7answers
40k views

How secure are virtual machines really? False sense of security?

I was reading this CompTIA Security+ SYO-201 book, and the author David Prowse claims that: Whichever VM you select, the VM cannot cross the software boundaries set in place. For example, a ...
280
votes
4answers
83k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
411
votes
3answers
178k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the ...
-1
votes
2answers
34 views

Does encrypting a file make it larger?

I encrypted a Word document using Winrar by setting a password. Surprisingly the archive was larger than the original file (631 vs 614KB). I then tested to see what would happen if encryption wasn't ...
5
votes
2answers
78 views
+50

What is the difference between ISO 27001 and ISO 27002?

What is the difference between ISO 27001 and ISO 27002? Are they related to each other or not?
1
vote
3answers
39 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
-1
votes
0answers
6 views

Java Keystore best practice for large scale application

I'm new to JCE/cryptography in general but I'm working on demo where we are going to create a public/private key combination for each users of the site. All the examples I have seen so far stores ...
1
vote
0answers
12 views

decrypt a soap message using openssl

I've tried to do the same as found in How to you manually decrypt a SOAP message using openssl? Unfortunatly without success... Here is my situation : I'm trying to do the same stuff only my data ...
0
votes
1answer
20 views

HMAC: How unique does a nonce need to be if the Date is also part of the signature?

In a HTTP scheme where the HMAC-SHA256 signature is sent as part of the Authorization header, and the message input contains: The request method URL Post data Nonce Date HTTP header How unique ...
0
votes
1answer
197 views

Are temporary files an issue when opening and editing an encrypted 7z file?

I am new to security and encryption. I want to store important information like passwords and pin codes so I don't forget them. So far I have been using LastPass but I would prefer a solution I ...
-6
votes
1answer
33 views

Why study Information Security? [on hold]

This question might be considered as overly general, but it has occupied my mind lately. I have decided to study Information Security (to be more particular, 'Networked Systems Security') at ...
1
vote
1answer
90 views

Mobile, WebServices and SSL

I just started dipping my feet into security and SSL. I looked at various videos to try and understand how the magic happens and I have the general idea now, but most of them deal with it taking the ...
-4
votes
1answer
41 views

How The Sony Hack Was Traced, and So Quickly?

Let me preface this by saying I am not a network security specialist... I am a run of the mill sysadmin, so I'm just laying out how I understand it from my perception of standard networking and ...
14
votes
2answers
768 views

Is there a reason to use TrueCrypt over VeraCrypt?

I am looking to encrypt a few drives of mine, and my ONLY interest is security. It is OK if my VeraCrypt volumes are not compatible with TrueCrypt, and vice versa. There is a lot of talk about ...
0
votes
1answer
20 views

Windows 8.1 full disc encryption

I have a zenbook ux302 that I want to do a full disc encryption on. I had no problem using bitlocker on my stationary computer, but the zenbook doesn't seem to have that functionality? I have the ...
0
votes
1answer
51 views

Where can I download the Sony hack malware (for analysis)? [on hold]

I want to analyze the Sony hack Malware as there have been a lot of stories on who is responsible; from the US government implicating North Korea to news articles stating it's an inside job. The fact ...
0
votes
1answer
48 views

User Binding Request with credentials in Lync Dump

I've dumped a call between two lync clients and saw that there were some UDP packets that look like this: Server -> Client 1132 14.495362000 <serverip> <clientip> STUN 146 ...
0
votes
0answers
51 views

How to ensure all traffic goes through VPN?

I want to make sure all traffic goes through the VPN. The VPN manager has an option to enable a "kill-switch" which cuts off the internet if the VPN is not being used, however this feature buggy and ...
2
votes
2answers
200 views

Is Double NAT a secure way to create a public wifi network?

I'm trying to create an open, public WiFi network in my house for guests to use, as I am hosting a (somewhat) large party later tonight. However, none of my routers have any built-in guest networking ...
2
votes
1answer
88 views

NaCL: Encrypt file to multiple recipients

I am trying to understand the Networking And Cryptography Library (NaCL). Consider i have a file that i want to send to multiple recipients. PGP or S/MIME supports multiple recipients by encrypting ...
0
votes
0answers
52 views

Good password hashing algorithm compatible with PHP and Linux apps

I'm looking for a password hash method for a new server system. The hashes must be generated from PHP code and verified from PHP as well as by a number of applications on a Linux system. I know that ...
3
votes
2answers
222 views

Is there a need to have XSS filters when I'm saving data as XML?

My web-app takes some configs from the user and saves into an XML file (it was not done to stop XSS). The input is XML encoded so that the ",& ... and such characters don't break the XML ...
0
votes
1answer
28 views

Security risk of allowing ICMP “destination unreachable” packets on AWS

If I configure an Amazon AWS VPC, should I explicitly allow ICMP "destination unreachable" packets outbound? I am wanting the VPC firewall to block everything by default, however does this mean this ...
2
votes
1answer
251 views

Making a bitcoin-like secure mail protocol, how to tackle public keys?

I'm making a new mail protocol (probably already exists, but I've learnt a lot of things about security and privacy on the way). Here's the summary(much simpler if you know bitcoin's inner workings): ...
0
votes
1answer
18 views

Modern Browsers, Safe to Ignore CSRF?

For users using modern browsers, is it safe to assume they won't be able to be hijacked via CSRF and the likes? If not, how likely is it that an attack can take place?
15
votes
4answers
2k views

Detecting and preventing 'phone home' behavior in PDF files

I have received several PDF documents via email from someone I do not trust. I need to read the documents and respond to them. They are not encrypted. I want to make sure the documents are ...
15
votes
3answers
915 views

Linux-based Turla trojan

There are several articles describing the newly discovered Linux-based Turla trojan. But basically, all these articles repeat the same, very limited, information. Can anybody provide more details, ...
0
votes
2answers
60 views

Only HTTP(S) port is open. Why do I need to worry about unpatched software?

Unpatched software poses no risk by themselves. They're only problematic when someone exploits it. How could malware get into my system if I do have unpatched software in general and I'm connected to ...
2
votes
1answer
62 views

Powershell opened up, switched to administrator mode and ran scripts all without me touching my computer. How worried should I be?

I'm on a laptop running Window 8.1 connected to the internet running Kaspersky. I am the sole user and administrator of this laptop. While going about my usual work, I paused for a moment (hands off ...
0
votes
1answer
10 views

Tails OS for Android and PC?

Can I use Tails OS on a USB-stick on both an Android tablet and a PC, or do I have to have two different versions? Would I have to go into the BIOS to make this work?
8
votes
3answers
1k views

Does the entire AES encrypted dataset have to be present to be 'cracked'?

I am implementing an AES 256 algorithm on credit cards and I am wondering if I would be strengthening or weakening the encrypted dataset if I split the dataset and persisted it in two locations. I ...
2
votes
1answer
1k views

How can I find the process that is trying to use smtp to send email?

Previously I asked Who (which process) is calling curl? and I got very good answers (this answer in particular) which basically replace the curl binary with a shell script that logs each call to curl ...
8
votes
2answers
2k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...

15 30 50 per page