0
votes
2answers
18 views

What type of attack is this?

Attacker purchasing something from e-store when attempting tamper requests and change transaction amount value.What type of attack is this? How to prevent this king of attack is the bank and ...
4
votes
3answers
80 views

Does it matter which platform a file is scanned on for malware?

Different operating systems use different file types and file systems. Does it make a difference to a virus scan which system it is being run on and what type of malware it's looking for? I ask ...
0
votes
0answers
4 views

What would be a problem with using a block cipher to encrypt the traffic of an online game?

I have a question and can't really find the answer. Here are my 3 possibilities. I think it is the 2nd one but want a different opinion. a)The communications require a key exchange not supported by ...
1
vote
1answer
22 views

How does this encrypted webmails works?

In the last days I was looking on Tutanota, ProtonMail, LavaBoom, and others webmails that promise to respect users privacy. For all those, the one I most liked was Tutanota. I did few tests with ...
92
votes
4answers
45k views

What exactly does it mean when Chrome reports a certificate 'does not have public audit records'?

When visiting Gmail in Chrome, if I click on the lock icon in the address bar and go to the connection tab, I received a message 'The identity of this website has been verified by Google Internet ...
0
votes
0answers
7 views

What are the main differences between a Metasploit vulnerability/exploit attack and a “R.A.T.” attack?

I explain myself: To attack with a vulnerability & exploit it with Metasploit, you have first to find a vulnerability listed. Then once you have it, you set up the whole thing and end up with a ...
0
votes
1answer
8 views

UTF8 and T61 strings, how do I see what my SSL cert uses?

How do I use the openssl x509 tool to see whether or not my strings are T61 or UTF8 encoded in the cert? Is there a better way?
0
votes
0answers
5 views

Is there mobile app for encryption a voice thru the common gsm call?

First of all sorry for my eanglish. Anyway. The point of my question is there programm which encrypt the voice of the first person, then the signal will be translating like the beep-beep sound on the ...
0
votes
0answers
10 views

How can I stop rails exposing its routes?

Today my site was probed maliciously. I have searched through the knowledge base for advice on how to block cg-bin requests but have not been able to find specific advice. A portion of the log of the ...
7
votes
0answers
60 views
+100

Is there any evidence misusing the HTTP Pragma header in responses has any effect?

I've been investigating the Pragma header, since there are already two other cache-busting HTTP response headers (Cache-Control & Expires), and I was interested in which browsers use(d) the old ...
1
vote
1answer
52 views

Is it fine to store single-use beta keys plain-text?

Is it okay to store single-use beta keys in plain-text in the database? I'll be pre-generating and storing about 2M keys. The keys get passed around so that people can sign up with it, rather than let ...
19
votes
3answers
2k views

What ways are there to verify a self-written protocol?

Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO", I haven't, technically (I'm still half way), but apart from that I am making a TLS-like protocol, but way lighter. I needed to secure ...
3
votes
3answers
101 views

Dealing with credit card data that is not charged directly

I have a client who is a reseller for vacation packages. For years they've had a payment form on their site where the end user would fill out their credit card data and the information is emailed to ...
28
votes
4answers
18k views

How do you know your server has been compromised?

I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
2
votes
1answer
83 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
3
votes
4answers
5k views

using truecrypt keyfiles with weak passwords

I'm using Truecrypt and I have multiple volumes on multiple computers. Keeping each of the 20+ character passwords straight is getting complicated, so I want to use keyfiles. Since the password is ...
1
vote
1answer
216 views

Log information for SIEM auditing in Linux

How can I know what all types of events generated by Linux. I can get this from the logs, but reading logs and noting ID's is very time consuming. All events might not be triggered. I need this ...
0
votes
0answers
10 views

Findout address of shellcode dynamically, placed on stack

I am using shellcode to spawn a shell,I am curious to findout the starting address of shellcode dynamically,which is placed on stack and not hard code the address in the shellcode kindly share your ...
1
vote
1answer
52 views

What are analytics APIs accessing when they run, and how do you block or spoof them?

What are analytics APIs accessing when they run, and how do you block or spoof them? Usually all apps from desktop or mobile app stores, MMO clients, Steam and many utilities, and many games and ...
2
votes
1answer
12 views

PGP Owner Trust Field & Signature Trust Field Distinction

I'm reading Cryptography and Network Security Principles and Practices (5th ed, p584) and reading about PGP keyrings, I'm a little confused about the differences between the owner trust field and the ...
13
votes
6answers
15k views

Recommended ssl_ciphers for security, compatibility - Perfect Forward secrecy

I'm currently using nginx with the following ciphers: ssl_ciphers HIGH:!aNULL:!eNULL:!LOW:!ADH:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS; I would like to maintain compatibility to older browsers, ...
8
votes
4answers
892 views

How can I ensure my dll has not been modified?

I have an old project in VB which created an unique pc code from MAC address and disc id. This was used to identify a pc so credentials cannot be used between pcs. This project migrated to C#, and I ...
6
votes
1answer
405 views

stack buffer overflow in the main function? [on hold]

I am trying to exploit a stack based overflow vulnerability. All the examples I can find make use of a ret address though. The buffer overflow I found is inside the main function, and I cannot find ...
1
vote
2answers
117 views

Windows Firewall Connection Security with Certificate

I've been fiddling with the Windows firewall configuration of some computers within a VMWare based LAN (no domain). To aid in my testing and debugging, I created a small, self-hosted console ...
1
vote
0answers
49 views

how many sha1 hashes per time on current hardware [on hold]

How many sha1 hashes per second can current hardware (say a 500$ gpu) compute, when the input is 256 byte long? (or any other length). The question behind is how long (or how costly) is it to mount a ...
3
votes
1answer
121 views

Can serving HTTPS to Internet Explorer on Windows XP be made secure?

Answers to Why is HTTPS not the default protocol? state that a lot of sites still use clear HTTP instead of HTTPS because all of these are true: A substantial number of visitors to the site use ...
1
vote
1answer
34 views

Minimize risk with Windows 2003 end of life

The company I’m at currently has over 500 Windows 2003 servers remaining globally in production and even though they have a refresh plan they are working through, they are not going to be done anytime ...
0
votes
0answers
12 views

SAD storage prior to authorization

Does anyone have any PCI FAQ's or articles which outline or specify PCI compliance in regards to SAD storage prior to authorization? All mention of SAD is in regards to post authorization. The use ...
1
vote
1answer
25 views

Secure Connection between two devices

I've a Device A which will communicate with multiple devices on a network (BLE and/or NFC). All the devices will be handled a Token upon authentication which somehow needs to be transferred over to ...
0
votes
1answer
46 views

How to send secure messages from a microcontroller circuit?

I have an Arduino with a GSM shield. This enables me to send short arbitrary messages to any server. What do I need to do to enable sending "secure" messages (that cannot be intercepted and have a ...
0
votes
1answer
2k views

FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?

As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack. reference- ...
1
vote
0answers
13 views

Having trouble reproducing PHP heap based buffer overflow in quoted_printable_encode

I am trying to follow the test script provided here. I've installed an apache web server with PHP version 5.3.25 and created a script with the following code: <?php // file: test.php $str = ...
1
vote
1answer
23 views

is OSSEC effective in protecting a Drupal installation?

I noticed that the 2.8.1 rules have wordpress and other products listed, but no Drupal rules. Is its safe to assume OSSEC, acting like an IPS in active mode, is just not going to block any Drupal ...
3
votes
5answers
129 views

How can I explain self-signed certificates to users?

I don't trust certificate authorities, so I'm using a self-signed certificate on my server. The server provides both a website as well as other services. Most modern SSL-capable software, upon ...
0
votes
1answer
143 views

Storing encrypted data for offline use

A user downloads a file from a server. I want to store that file locally on the user's machine so they can view offline. For protection, it should be encrypted while not being viewed. My theory is ...
0
votes
1answer
29 views

Disk level encryption + compression performance?

What are pros and cons for using disk level encryption like VeraCrypt and then turning on compression on mounted (virtually decrypted) drive? It seams to me that this can even increase some ...
-1
votes
3answers
108 views

If TLS 1.2 is considered unbreakable, why do the NSA and other agencies invest in supercomputers? [on hold]

If a 2048-bit RSA key and a 256-bit AES key are considered to be unbreakable within the foreseeable future by any kind of computer, why do the NSA and other intelligence agencies invest in ...
6
votes
2answers
2k views

What is the difference between DHE and ECDH?

I learned that perfect forward secrecy is implemented through DHE and ECDH but what is the difference between these 2 key exchanges? Also can someone explain how perfect forward secrecy works? I've ...
1
vote
2answers
36 views

Is it a ISO27001 requirement to record details of all instant messages?

Our organisation is currently working towards ISO27001 accreditation and we use Skype. We are wondering whether it is a definite requirement to record and keep logs of all the instant messages sent ...
3
votes
0answers
97 views

Is it possible to break enigma code with a todays laptop [migrated]

I have a 500 characters enigma encoded text. Random rollers were used (not the ones from wikipedia). I know of this flaw. I can guess some words that sould be in the text, but this probably doesn't ...
2
votes
1answer
117 views

How can I intercept XMPP traffic on Android?

I have been learning about security testing on Android apps, and to intercept traffic I was using Burp Suite. I know it works perfectly for HTTP/HTTPS traffic, but most of the messenger apps are using ...
0
votes
1answer
41 views

Limiting a CA to only issue valid certificates to internal web sites and clients

What are the possible defense measures that can be applied to a simple PKI (no intermediate CAs, etc.) used to authenticate clients and servers over TLS on an internal network only? Certificates ...
0
votes
1answer
16 views

Should I create one key pair per customer as Service Provider in SAML?

This is basically the reverse of what's asked in this question. I recently added SSO with SAML to a SaaS Web application that allows customer to use their existing IdP for authentication with our Web ...
1
vote
3answers
128 views

Does Wifi encryption create a private tunnel between the adapter and the accesspoint?

When non HTTP/S data is sent over Wifi, can that data be seen by other machines that happen to also be connected to that same access point? Does the privacy of the HTTP data depend on the encryption ...
3
votes
2answers
178 views

I am “Shell Shocked” - remote script downloaded and executed - can I ban file downloads as security measure

A few days ago, someone tried a series of requests on our nginx instance. All failed except one. 54.164.156.8 - - [**/Mar/2015:**********] "GET / HTTP/1.1" 200 393 "-" "() { :;};/usr/bin/perl -e ...
1
vote
1answer
69 views

Bash Shellshock

I am trying to find out if my devices are vulnerable to bash shellshock. I have run the commands found on https://shellshocker.net. It seems my devices are both susceptible to only one of the ...
1
vote
2answers
270 views

What impact do the frequency of password resets have on password reuse?

Wondering if there's any research behind the most common password reset cycle I've seen of 90-days, and if there's any research that gives any insight into how to optimize password resets to reduce ...
1
vote
0answers
65 views

How the firewall is allowing Facebook requests to bypass itself? [migrated]

I've a McAfee Firewall configured at my workplace. It actively blocks all the requests for websites like https://www.Flipkart.com https://www.Amazon.com https://www.Facebook.com I's playing ...
4
votes
1answer
56 views

Re-display password in registration form good or bad?

When a user tries to register and the data he submits are not right such as bad email, or weak password, we would display the registration page again to him with the data he just submitted along with ...
1
vote
1answer
28 views

Is it possible to convert a gpg key to a different encryption algorithm

Maybe the answer to this question is a simple and unequivocal "No", followed by "How can you possibly think that this is possible?". And if I think about it rationally this seems to be the only ...

15 30 50 per page