All Questions
-2
votes
4answers
88 views
If a hacker is on the same Wifi Network as I am, what can he do?
Ok so when a hacker has the wifi network's password and gets on the network, he can do things like monitor traffic, catch passwords, even access PCs, etc.
But what I'm interested of knowing is what ...
-1
votes
1answer
9 views
how to open encrypted folder
I have an encrypted directory using Windows XP Encryption. I didn't backup the certificate and I formatted my HDD to reloaded the OS as it was corrupt. I am now not able to access the encrypted ...
0
votes
2answers
38 views
What is the better way to share files between a server in DMZ and a server in the internal network?
I have to implement a solution to share some xml files between a frontend server and his backend. What is the better way regarding security?
I'm thinking in two options:
- Share a nfs in the frontend ...
3
votes
0answers
40 views
What are the tradeoffs in cost, effort, and value in moving a database server to a virtualized DMZ environment?
I am quite new to the DMZ concept and working on a project as part of my master thesis where Remote access is required for the Development environment. However, there is a functional requirement for ...
1
vote
3answers
3k views
Windows 7 Password Hash Security
I recently came across a number of sources that suggest that cracking Windows user account passwords is easy by examining their password hashes.
I understand that these hashes are stored in the SAM ...
6
votes
3answers
457 views
Does Google log my activity on service A when logged in to service B or by IP address?
Now that Google's new Privacy Policy will combine data from their various services...
Will Google associate me to my activity on one service even if I am not logged in to that service? Did they ...
-1
votes
2answers
41 views
Is it possible to encrypt a virtual machine using virtualbox?
Is it possible to encrypt a virtual machine using virtualbox, and not leave accessible to the users of the machine where it hosted, and not allow any file to be extracted it with some program ?
The ...
0
votes
0answers
30 views
Staying logged in Gmail [duplicate]
Am I allowing Google to tie my search at www.google.com with my name, if I am logged into Gmail all the time? The thing is, I want to prevent companies from tracking me on the Internet, so this ...
-3
votes
0answers
19 views
Encrypt .war file java web application? [duplicate]
Is it possible to encrypt the file .war with all its contents, and then have served understand this application? I saw something similar with JarCryp, most do not know if it's working on servers like ...
3
votes
6answers
144 views
Best source(s) for security related news? [closed]
What is the best place to go for security news? I am looking for everything from news updates to editorials to guides and research. Anywhere considered more reliable or particularly hard-hitting?
...
24
votes
10answers
3k views
Intel How Strong is Your Password page, good advice?
I came across this Intel How Strong is Your Password? page which estimates how strong your password is.
It has some advice on choosing better passwords including that you should use multiple ...
1
vote
1answer
58 views
Definitions of computer forensics and information security [closed]
I'm about to do my master and I need to make a decision on what course I should take now I have two options either computer forensics or information security
What I want to know is:
What is the ...
0
votes
3answers
108 views
Can attackers steal SSL certificate from server and use it for MITM attacks?
I'm writing an iOS app for private use to acts as a client for a PHP server. To secure the connection I'm using a self-signed SSL certificate.
Since the server is self-hosted, on the first connection ...
2
votes
2answers
84 views
Decrypt from cipher text encrypted using RSA
I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is
Public Key:
...
-2
votes
1answer
66 views
Protect java WEB application inside the server(against reverse engineering)
I have a web application running on Glassfish 3.1.2 servlet container and I need a way to protect the compiled java classes. I have tried to obfuscate the source code but it didn't work.
The project ...
0
votes
2answers
39 views
PDF files on webserver file system
We create PDF files as relevant to a customer's e-mail communication. These PDF's contain some personal information, specific to the client.
The client is emailed a link to the PDF. The link to the ...
3
votes
0answers
27 views
PKI integration in MAC OS
I have setup an ejbca pki and integrated certificates in MAC OS for S/MIME signing and encrypting. I have also set up a CRL distribution point and put the CRL online available on an HTTP server.
...
7
votes
1answer
33 views
Does it make sense to hash a session id before passing it to an advertisement partner?
My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
2
votes
1answer
55 views
Brute-Force GPU Password Crackers
Brute-force password cracker programs which claim GPU support include John the Ripper, ighashgpu, oclHashcat, and others. oclHashcat appears one of the more popular, but I am not sure which AMD/ATI ...
18
votes
5answers
470 views
Malicious Links that Respond to Browsers but not curl or wget
There are some emails with links to people's cracked websites with a malware download
Like this kind of email:
fake DHL pack station email
... the links often take the form of:
http:// ...
-4
votes
0answers
57 views
Extra/Special Security for Financial Web Apps? [closed]
I found this answer http://security.stackexchange.com/a/17999/24408.
It's a great answer, but aside from the finance industry specific processes like settling & clearing, the ...
70
votes
21answers
16k views
Lessons learned and misconceptions regarding encryption and cryptology
Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
4
votes
2answers
62 views
Why standards organizations give so short protection times for 128 bit encryption?
According to this and this, seems even 128 bit encryption should remain secure for a much longer time than what security organizations say.
I saw the standards with this: ...
10
votes
5answers
911 views
How secure is the SRP that Blizzard uses to protect passwords?
Blizzard very recently announced that their network was compromised, but they assure users in their statement that the password information that the attackers had access to was saved in a secure way:
...
1
vote
1answer
36 views
Does providing OAuth for mobile apps pose a security threat?
Let's take a look at the basic OAuth workflow:
The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...
5
votes
2answers
90 views
Is “non-repudiation” automatically proven, given the other three tenets of info security?
Just to say it, the four tenets are:
Confidentiality - The message the recipient gets can be proven not to have been read by anyone else since it was encoded.
Integrity - The message the recipient ...
3
votes
4answers
208 views
Strange android app … possibly a mass malware?
I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...
4
votes
2answers
52 views
iPhone\Network Security
A client of mine is concerned someone is retrieving data and intercepting text-messages from his iPhone and his home network. He has told me that he has seen one of the text-messages he sent to his ...
-4
votes
0answers
46 views
Where can I look for malware that may have been installed on my machine?
I want to analysis my ubuntu box to detect if it was been hacked.
My question is:
what are all the place where to look to discover if some malicious software are started ?
The following is some kind ...
16
votes
3answers
703 views
Why do a lot of Android apps (like Linkedin) require many unrelated privileges?
I wanted to install the Linkedin app on my Android phone and I was shocked when it asked for nearly all possible permissions including reading all of my private data and calendar data.
Why does any ...
6
votes
3answers
507 views
Evasion techiques for WAFs
Is there any documented techniques for evading Web application firewall for testing WAF rule configurations.
0
votes
5answers
81 views
Store username in cookie for a web site
I want to store the username for a web site in the coockie, is it secure?
What an hacker can do with this info?
-8
votes
0answers
37 views
IBOSS is ruining my day [closed]
iBoss blocks P@@xy and has an immediate Unrecognizable disability for https, how do I get past that? Oh and any URL changers don't work
-9
votes
1answer
54 views
how to determine what type of server behind a port [closed]
I use nmap to scan, and got a 22 port, but cannot ssh, I suspect is is a oracle, but not very sure, how can I determine which server stand behind the 22 port ? Is there any genereal tool to help me?
10
votes
4answers
296 views
Becoming a malware analyst?
So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
2
votes
2answers
64 views
Force clients to use proxy [closed]
Here's my network configuration:
The proxy server is running Ubuntu with Squid on port 3128 and DansGuardian on port 8080.
I'd like to force all clients to use the proxy server - specifically, ...
1
vote
0answers
42 views
Is a full backup the quickest or the longest on restoring [migrated]
Studying for Security+ with Darril Gibson's book he says that "A full backup is the easiest and quickest to restore"
Now I've been looking for another test exams and I found the MasterExam of the ...
1
vote
4answers
101 views
Free space shredding
I'm an avid fan of file system forensics but I'm an amateur so far. I've been reading up on NTFS forensics and I've noticed you sometimes can know if a file was on a certain volume even if it was ...
1
vote
0answers
46 views
POC of a Java exploit using leftover JREs
Summary: I would like to show a proof of concept of a Java exploit using an old JRE on an up-to-date machine to cut short discussions on the "but we are patched so why removing older versions" ...
1
vote
2answers
30 views
Bridge Exploit of Network Multi-function Print/Fax Devices
I performed a recent security audit and was wondering if anyone has heard or run across any known exploits against any commercial multi-function print/scan device whereby you can bridge the incoming ...
4
votes
1answer
120 views
TOR detection in network
After I read this link, I tried to understand how they manage detect TOR traffic
The most understandable source for me was this paper
He is saying TOR trafic can be detected by port, cipher suite ...
13
votes
5answers
1k views
How to be completely anonymous online?
I recently saw this post on reddit: http://www.slashgeek.net/2012/06/15/how-to-be-completely-anonymous-online/
But the majority argument, both on reddit and on comments on that post seems to be that ...
2
votes
1answer
39 views
SQLite database iphone data
I opened an sqlite database file, and it seems to have many rows that arent readable.
The data has got weird symbols including "question mark diamonds". Is it data that iphone encrypts when it goes to ...
8
votes
3answers
2k views
Why would someone register a Facebook account with a stolen email address?
I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to ...
2
votes
3answers
51 views
Storing config securely in a semi trusted shared hosting environment
I'm looking for a pattern to store a config file containing sensitive information in a semi trusted hosting environment. Semi trusted in this case meaning I trust them in general, but not with this ...
5
votes
4answers
126 views
How to know if two IP addresses point to the same web server?
Doing some testing against two IP address in the scope I find one web server in each one. Both host what it seems the same web application.
They are different public (accessible through Internet) IP ...
11
votes
2answers
4k views
Can Android phone running without SIM card be tracked (localized) by police?
I am running an Android phone without a SIM card. I am using it for web surfing.
Can the police localize my phone using the cell towers (BTS)?
In other words, I know Android phones emit radiations ...
2
votes
3answers
554 views
Capturing and decrypting my own SSL traffic
When I use browser or wget to access another site, some sites will only use HTTPS / SSL automatically. When a site doesn't provide content without encryption, how do I capture what my computer sends ...
2
votes
2answers
85 views
Identify code being run on website
I do not normally deal with internet security problems but this one has got me interested.
The issue is with a specific site, lets say test.com, and how it it visited.
If the address is typed ...
-4
votes
1answer
74 views
cant connect to network after spoofing mac [closed]
Just spoofed my mac at my school connected to router got past the fire wall but now I don't have internet access. Can some one help I am using windows 7.
