0
votes
0answers
3 views

Malicious JS code detection techniques

I am looking for a list (as long as possible) of techniques used to detect malicious JavaScript code.
0
votes
0answers
2 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
0
votes
1answer
7 views

Robots.txt and admin areas

I'm using some popular commercial forum software and to help secure the admin area more I have changed the name of the admin folder; however I was wondering, with regards to robots.txt if I go ahead ...
8
votes
4answers
440 views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole ? ...
5
votes
5answers
76 views

How to get top management support for security projects?

I am facing some issue regarding to security projects, for example: last year we bought 500 license of An antivirus (End point security), and made a policy also to force everyone to install it, ...
2
votes
4answers
681 views

Vulnerability scanning applicability for PCI DSS

I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one ...
0
votes
2answers
1k views

SSL Handshake failed

I’m working on windows desktop application which is created using C++ (IDE : Qt creator). It has login panel, where i do user validation via https connection using openssl 1.0 library. Application is ...
7
votes
4answers
2k views

How can I encrypt a file using `gpg` without including the recipient's key ID?

An OpenPGP encrypted file will include the key ID of the intended recipient's public encryption key, as explained in this question. Is there any way to remove that information from the resulting ...
1
vote
0answers
10 views

SmartCard for private keys - personal usage

I've just found my notebook has a SmartCard reader. Would it be wise/possible/practical to buy a single SmartCard, transfer my private key on that (somehow), and use it as my primary private key ...
0
votes
1answer
21 views

Forensics in the cloud

I recently did a university module on digital forensics and learned a lot about the process, and techniques, of digital forensics investigations. We didn't actually cover the cloud although I ...
1
vote
0answers
141 views

How the author found the initialization vector for the AES CBC whatsapp CRYPT5 db uses?

I was going through DECIPHERING MSGSTORE.DB.CRYPT5, THE NEW DATABASE WHATSAPP & Steal WhatsApp update. The author of the first link published a decryptor which sets the iv for the aes_192_cbc to ...
1
vote
1answer
66 views

Making a bitcoin-like secure mail protocol, how to tackle public keys?

I'm making a new mail protocol (probably already exists, but I've learnt a lot of things about security and privacy on the way). Here's the summary(much simpler if you know bitcoin's inner workings): ...
-1
votes
0answers
11 views

Merging two dmains ( active directory server)

I've a requirement of merging two domains. Our domain will be merged with a other domain.This work will be done by AD team.From security point of view what are the points I need to be bothered about ...
2
votes
1answer
27 views

What is the exactly mean of these CPE file fields?

I am working in the development of an application that have to download and parse this CPE file definition: http://static.nvd.nist.gov/feeds/xml/cpe/dictionary/official-cpe-dictionary_v2.3.xml My ...
3
votes
1answer
165 views

unexpected thumbprint when connecting via remote desktop - what now?

I have an Amazon EC2 instance in a VPC. I have not logged into it for some time, so I used the Amazon EC2 CLI with ec2-get-console-output to check what the thumbprint should be when I connect. To my ...
41
votes
11answers
6k views
+100

What makes it illegal to use the information learned by exploiting a bug?

According to news reports, arrests have already been made in relation to the Heartbleed bug. It sounds like this person managed to gain access to the website's database by capturing the credentials ...
2
votes
1answer
19 views

IKEv2: Why is it important “that each side sign the other side's nonce”

I am currently diging deep into the IKEv2 protocol. In the description of the Authentication (RFC5996, p. 48), the following statement is given: "It is critical to the security of the exchange that ...
0
votes
0answers
22 views

Are Images/Videos sent through WhatsApp stoed on the server for too long? If yes, are they secure

The WhatsApp privacy policy states that messages once delivered are deleted from the server forever. But in case of "files"(I'm assuming them to be attachments like images and videos) it says and I ...
-1
votes
1answer
29 views

Spyware for feature phones

There are a lot of spywares for android and ios smartphones. Are there spywares for feature phones ? I am using this samsung phone, which is basic. I am wondering if somebody who has access to this ...
1
vote
1answer
54 views

Is wiping memory at code/end good practise?

Sometimes passwords/hash/keys & other private information is stored in variables and hence in memory/RAM during code execution. while some situations (i.e. Linux Kernels see here Is there any ...
1
vote
1answer
88 views

What should I do when I need to store passwords for usage in 3rd party softwrae?

I have a desktop WPF application which authenticates with Dynamics CRM 2011. I ask for the username and password of the user and use them to connect to Dynamics CRM 2011 using ...
3
votes
2answers
44 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
1
vote
2answers
39 views

Does having a seperate e-mail account only for security, increase security?

In this article about increasing the security of lastpass the author suggests For additional security, you can have LastPass send security-related emails to a special security email address ...
1
vote
1answer
76 views

OpenSSL Code Review

Is there to be a review in the code of OpenSSL any time in the near future? It seems OpenBSD is doing a controversial one, in that the review is also "Ripping out some windows-specific cruft". But is ...
0
votes
2answers
28 views

How to avoid session sharing inside the same network

I was thinking about a situation to avoid session sharing or hijacking, validating the IP the user logged in against the ip that is accessing any page after log in. It was working until I figured it's ...
26
votes
4answers
1k views

Is generating random numbers using a smartphone camera a good idea?

Forgive my ignorance on the subject, but I wish to know more and asking (stupid) questions are one way. I was reading http://www.random.org/randomness/ and this idea popped into my head (before the ...
1
vote
1answer
22 views

Can you export a report from OWASP Zap based off a individual website?

I have a list of 30 websites I have scanned. I need to pull out a report for each individual website. Is it possible to do? Right now I am just running a report and getting the results for all 30 and ...
2
votes
1answer
102 views

File Fault 1 password from memory dump

I have a osx 10.9 machine with a File Vault1 encrypted user partition. I would like to remove the encryption, but I don't remember the "master key" which is the only way to remove encryption ...
28
votes
6answers
2k views

Should I obscure database primary keys (IDs) in application front end?

I'm working on an application which allows a moderator to edit information of user. So, at the moment, I have URL's like http://www.example.com/user/1/edit http://www.example.com/user/2/edit I'm a ...
2
votes
1answer
56 views

Do Javascript malware signatures exist?

Are there signatures for malicious JavaScript codes as they exist for other viruses/worms/trojans developed in other programming languages ? If so, are these javascript malware signatures defined ...
11
votes
3answers
929 views

NTP DDoS Attack on Home Servers

After some half-good script kiddies found out about this exploit or DDoS method, they have been doing it like crazy to websites, game servers, and now my home servers which allows me to work on some ...
0
votes
0answers
24 views

URL filtering , issues with URL

I am working on a URL filtering project . I have a database given to me which contain URLs need to be blocked (eg: a.b.com/d/e). I get uri and domain from http request. I compare what I get with my ...
1
vote
0answers
54 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
36
votes
7answers
4k views
+150

Can “cat-ing” a file be a potential security risk?

I often use cat on the console to view the contents of files, and every now and then I accidentally cat a binary file which basically produces gibberish and system beeps. However today I've ...
-1
votes
0answers
19 views

Filtering of incoming and outgoing packets in a firewall

In general, egress http packets should be allowed to pass through the firewalls. Ingress http packets, however, should go through firewall inspections. Suppose the Web server is placed in DMZ. If an ...
4
votes
2answers
86 views

Guidance for “image based” password reset challenge

Thycotic has a Password Reset Server that allows the user to select from several images. What general guidance is there for an image-based password reset challenge question? Examples may include ...
0
votes
0answers
66 views

Security jobs that suit disabled workers [on hold]

I was in a bad accident which has left me with some severe limitations in how I can work. Due to my disabilities I will only be able to work from my home. I understand that this is a very unique ...
1
vote
2answers
129 views

Google Accessed My MSN Account!

I just received a notification from Microsoft that my Microsoft account has been blocked because it's been accessed by an IP address that's never accessed it before. I received this notification as a ...
1
vote
0answers
17 views

Securely calculating encoding efficiency

I have a rather odd security requirement that I must keep the amount of potentially encoded information in a record under 250 kilobytes. That's not a lot of data, so I was thinking of calculating the ...
3
votes
2answers
54 views

Letting users pick up where they left off…without logging in (is this bad form?)

I have a Grails app I'm working on that allows users to fill out a fairly lengthy application form. One of the requirements I've been given is to NOT require users to log in or create any sort of ...
14
votes
10answers
11k views

How to simulate DDoS attacks from the Internet?

The idea behind security tests is easy. You want to know what a hacker can do - you hire a security expert who acts like a hacker to see how far he can get. You want to know what an evil admin can do ...
2
votes
1answer
1k views

SHA1 hash encoded with base64 results not consistent?

When i take a hash of user input test123+ i get the following base64 result:- YaddchSU52yztwIMdtHzkg3p1oA= The results have been obtained using the online sha1 convertor I m failing to understand how ...
2
votes
1answer
57 views

Access control on a primarily windows LAN [on hold]

This question is a bit broad, but I'm hoping someone can point me in the right direction. I administer a small LAN at work with 15-20 machines on it. They are running Windows XP - Windows 8 and I have ...
0
votes
3answers
296 views

nmap.online inconsistent results

I recently used nmap online to test my firewall security on the WAN port. I purposely did some port forwarding but received inconsistent results. I opened ports 6881 to 6889 on the firewall and did 2 ...
5
votes
3answers
96 views

How are private keys stored on disk?

I have a public and secret key pair in my .ssh folder. How is the secret key being stored on disk? What I mean is .. Is it possible for someone to hack into my computer, steal the secret key and use ...
2
votes
1answer
144 views
+200

Security in large-scale SOAs

Let's assume a service-oriented architecture (SOA) with hundreds of services. The services are completely isolated – what is behind their APIs is an implementation detail. Different services can have ...
0
votes
2answers
95 views

Secure Way of Encrypting Your Bash Shell Script [duplicate]

How can I encrypt my bash shell script on Linux server The shell script contain credentials of other servers for remote access. The problem is I do not want others with same level of access to view ...
0
votes
4answers
142 views

What is a good way to be alerted of major security patches for software I use? [duplicate]

I maintain a few webservers running ubuntu, apache, mysql, and python/django. I update all the libraries quarterly, but I'd like to update more often when a patch for a major vulnerability is ...
0
votes
0answers
59 views

What major vulnerabilities have there been to TLS libraries? [on hold]

I'm trying to compile a list of large security vulnerabilities in TLS (and SSL) libraries. Examples of things I'm looking for are: Heartbleed Goto fail The Firefox/NSS PKCS11 (IIRC) parsing bug
8
votes
3answers
4k views

Proxy vs. Firewall

I understand that very simply put a proxy is a sort of 'man in the middle' allowing/denying access to certain services/resources. Strictly in terms of security (I mean here privacy, parental control ...

15 30 50 per page