All Questions

0
votes
0answers
2 views

Pages, groups or forums suitable for publishing a Location Privacy Survey

I am doing my thesis regarding to location privacy in online social networks. During my work, I have prepared a survey and need to publish it online. I have considered some groups in Facebook to ...
0
votes
0answers
8 views

Capture a packet at the MAC layer

I want to implement a security solution similar to MACsec that captures a packet with its entirety (including the MAC header) at an intermediate network node (e.g linux based switch) and put it back ...
0
votes
0answers
17 views

Why does my TLS configuration not work with IE 8 / XP?

After all the last news about TLS/SSL faults and problems, I'm working on strengthening our TLS config — yes, I dropped SSL; at least, that's something. The main effort is to enforce, as much as ...
0
votes
1answer
7 views

SSH and shared secrets

There was a question on a quiz I took, about different authentication methods that SSH uses. The answers were combintions of the following four: username/password public key authentication shared ...
0
votes
0answers
10 views

Using salt or secret for Hmac

I'm working on a web API. We are going to use Hmac256 for signature hashing. From what I can gather, the secret is a key used to initialize the hash algorithm (ie to generate a random number). The ...
0
votes
0answers
19 views

Encrypted alert with code 21 for connection [migrated]

I've got a device that connected to the server and successfully did the handshake and received application data, however later when client sends keep-alive requests server sends back encrypted alert ...
0
votes
0answers
9 views

Are paravirtualized drivers a security risk?

Below is a copy of my answer that I gave in some other thread (Would running VMs inside of VMs be a more secure way to study viruses, etc?) about a topic of security of nested virtualization. I would ...
0
votes
1answer
7 views

Should a 2FA recovery key be stored along with a password?

Many websites give you a recovery key or a list of recovery codes that can be used in place of 2FA tokens if you lose your phone or can't access your token generator. What are the recommended ...
2
votes
2answers
20 views

Find the destination script of an inbound TCP connection on our shared webserver

We have a shared webserver which is being monitored constantly by our ZABBIX agent. On some hours of day we have unusual TCP traffic on port 80. Lets say we have over 400 connections from IP address ...
0
votes
0answers
11 views

Configuring Macs in a windows domain? [migrated]

I recently came across This article highlighting issues with ICMP redirects on a number of platforms (iOS/Android) and specifically Mac's. When speaking to my admin/support staff, they raised the ...
0
votes
0answers
29 views

Active Directory Injection attack

Is there a possible way of injecting code to pull data from Active directory? I have written a PHP page that executes Powershell and is able to change passwords to a controlled group of people. ...
-1
votes
0answers
7 views

Comparison of DD-WRT and TomatoUSB Firmware Compatibility With OpenVPN

Information on the comparative compatibility of DD-WRT and TomatoUSB firmware with OpenVPN would be appreciated. I am trying to decide whether to flash DD-WRT or TomatoUSB firmware to a router to be ...
0
votes
1answer
28 views

Security of mainframes?

I am very intrigued as to how mainframes seem to be much more secure than the servers. Malware targeted are mainframes are very rare. It is due to security through obscurity? Since few people have ...
0
votes
1answer
17 views

Shielding electromagnetic wave

I tried putting mobile phone in a microwave oven and close it, putting the phone in a fridge, a cooker and close it,... every time the phone still can receive the call from other phone which means ...
1
vote
0answers
18 views

Use of safe prime in RSA digital signature scheme

For the RSA digital signature scheme , Alice has a pair of public and private keys as denoted by Public key : (e,n) Private key : (d,n) Assuming Alice wants to send a message M to Bob , she would ...
2
votes
1answer
7 views

What is “PGP Global Directory Verification Key”?

In the server keys of the MIT, there is several signatures from "PGP Global Directory Verification Key". Example (from http://pgp.mit.edu/pks/lookup?op=vindex&search=0xB63024F96C73DA99): sig ...
1
vote
2answers
42 views

MITM on program with no proxy settings

I'm trying to inspect the traffic of a program (which is running on my computer) that uses SSL over TCP to a non-standard port. The traffic may or may not be HTTP traffic, likely isn't. Neither ...
0
votes
0answers
15 views

OpenVPN Client Authentication and CA

How does a client verify that the OpenVPN server certificate was signed by the master CA? Based on OpenVPN setup clients are usually supplied with only their own certificate and private key and CA ...
0
votes
1answer
22 views

Add certificate authority to one browser only

For testing purposes, I'd like to add a "CA" to the list of trusted-CA's of one browser - and use it only for testing. I want to make sure that it won't get added to the computer's trusted CA list. ...
0
votes
0answers
23 views

With SSL: not saving sessions, cookies not being sent

My purpose is to have a fully SSL site. The web host gave this format of URL for my shared server SSL: https://hostaddress.net/example/ where www.example.com is the domain name. I conducted the ...
1
vote
0answers
17 views

should I encrypt a certificate used only for automation?

I have a PEM file used only for automatic builds and tests on amazon. My project is open source and I am keeping all information on github. If the information is sensitive, I encrypt it and still ...
4
votes
2answers
237 views

What port services can hackers use to break into a server?

I am getting ready to run my first server. I will use ufw to disable every port except port 22 for ssh and port 80 for http. I am curious though. Suppose theoretically I left every port open except ...
1
vote
0answers
27 views

How will SHA1 deprecation affect SHA1 roots in OS/Browser trust stores.

I understand the SHA1 deprecation policy applies to CA's issuing SHA2 end-entity certs and intermediates starting Jan 2017 but how will this policy affect the actual root certificates in OS/Browser ...
-2
votes
1answer
23 views

how to use tor in linux kali with other applications

I want to know how to open applications as nmap and recon-ng through tor first I have kali linux v 1.0.9 and tor I tried using proxychains recon-ng but all I get is that the normal banner of ...
-2
votes
0answers
17 views

Form YouTube clip get EXIF data [on hold]

I was wondering if you can from the clip, which is published on the portal Youtube gain some EXIF data. Thanks and best regards.
1
vote
1answer
33 views

How secure is a MD5 hash of an 128bit key

Apparently, for the Android KeyChain an encrypted master key is stored along the MD5 hash of the unencrypted Key. How secure is that? MD5 is known to have collisions, but I guess we can assume with an ...
0
votes
2answers
22 views

Exploit failed [unreachable]: Rex::ConnectionTimeout The connection timed out(remote host ip)

I keep getting this when I start to exploit, trying to exploit my xp machine but this keeps happening, I can not find the fix anywhere, I don't believe I am the only one getting this.. I am a ...
0
votes
1answer
88 views

Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
0
votes
1answer
22 views

Reading HTML mail with PGP/Mime encryption in Thunderbird with Enigmail

Yesterday I asked how to configure Thunderbird with Enigmail to use PGP/Mime encryption for signing emails. This works, but I noticed one problem. I don't know if this is common to Thunderbird, or ...
0
votes
1answer
43 views

TLS Authentication/OpenVPN/MITM Attacks on Public Wifi

My question is about how an SSL VPN connection such as OpenVPN is protected against MITM/Spoofing attacks on a public Wifi. For example, if somebody has a 'pineapple' or router setup as a honeypot ...
0
votes
2answers
8 views

Limit VirtualBox guests to one network interface

I have one Linux (Ubuntu) box and inside two Virtualbox guests (guest1 + guest2). The host has two interfaces. (eth0 + eth1) I need to define: Host uses only eth0 Guest1 uses eth1 Guest2 uses eth0 ...
0
votes
0answers
4 views

Where can I get name of the person who registered Windows and his organization? [migrated]

Having access to an image of a system which I can't boot up on a virtual machine, how could I figure out who registered Windows and its organization? I can use Autopsy to access the files, but don't ...
0
votes
1answer
22 views

PCI DSS Compliance for a Level 4 organization

We are a small company and process less than 500 Credit Card transactions each year so we fall under Level 4 category merchants. The company heads wants to make sure that we are PCI compliant at all ...
1
vote
2answers
83 views

I was hacked, but I don't know why [on hold]

Tonight I found by accident that someone had injected a bunch of crap links into the bottom of my personal site's index.html page. I thought it was a script at first, but after going into my FTP ...
12
votes
7answers
2k views

What makes it difficult to have a hardware antivirus

MS Windows is always vulnerable to virus and worms and having an antivirus is almost necessary. How is possible that hardware antiviruses don't exist? The idea sounds pretty good, if the antivirus ...
0
votes
2answers
30 views

Access token vs. UserID + access token

My goal is to associate (authenticate) hardware devices to users in the database. The access token is generated via webinterface. It is then entered into the hardware device by the user, and the ...
0
votes
0answers
11 views

TLS authentication on Openvpn server

I'm not sure if this question can be applied elsewhere and that's why posting it here. The matter is that I want to setup hardened(as far as possible) VPN server. No the issue is that tls handshake ...
1
vote
1answer
55 views

Arbitrary code execution by opening a webpage by IE?

I came across this piece of HTML code today: <!doctype html> <html> <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" > <head> </head> <body> <SCRIPT ...
-1
votes
0answers
23 views

How can I make an OVAL description of my project's dependencies and query vulnerability databases with it? [on hold]

I am not a system administrator but am a software developer. I would like to monitor the libraries I depend upon for my software for security vulnerabilities. Is it possible to use OVAL to create a ...
-1
votes
1answer
56 views

how to gain root access to linux machine? [on hold]

I am a security auditor and I have faced the following situation: A development company that has a group of Linux machines gives limited access to their users. They asked me to find out all the ...
0
votes
3answers
36 views

What are the pitfalls of repeating a password multiple times for increased length and entropy?

Many of us are familiar with this comic. If I had a word like "catfish" and just repeated it an arbitrary amount of times, say n, it would be theoretically stronger. Wouldn't it? One pitfall I ...
0
votes
0answers
8 views

Roboo HTTP bot mitigation vs alternatives (senginx, possible others)?

I've been tasked with working out a bot mitigation facility here. So far this seems to be what pops up in google for "HTTP Bot mitigation": https://github.com/yuri-gushin/Roboo I've been perusing ...
1
vote
2answers
47 views

Is a server absolutely safe if the attacker don't know unknown bug?

If a server installed all patches for known bugs and the attacker can't do a 0-day attack, then is the server absolutely safe?
0
votes
1answer
40 views

Effective Free and Anonymous Web Form Encryption

I've got a website and I would like the users to be able to login securely but I don't want to spend any money on SSL / certificates and I would like to stay anonymous i.e. not give the certificates ...
2
votes
2answers
20 views

Simple PBKDF2 vs. scrypt question

scrypt was designed to use more memory. We can use its parameters to specify (approximately) how much memory we want it to require. But both scrypt and PBKDF2 allow us to specify the output data ...
0
votes
3answers
22 views

How can I scan hosted POP3 or IMAP e-mail for viruses?

In our company we use a hosting provider for e-mails and it seems they don't scan incoming email against viruses. And our employees does not very careful about attachments... So we deal with virus ...
0
votes
0answers
28 views

Victim loses Internet connection during MITM attack

I tried to do MITM attack on my network. I enabled ettercap, marked my router as TARGET1 and my second computer as TARGET2. Then I enabled 'ARP Spoofing'. I do not know why - but after this operation ...
0
votes
3answers
58 views

Why do credit cards have chips, if I can purchase online without the chip being read?

Credit cards (and debit cards) are used in three different ways: In person + pin. The seller requires me to insert my card with the chip and input the PIN number to complete the transaction. In ...
1
vote
0answers
23 views

Use PGP/Mime with Thunderbird and Enigmail [migrated]

I would like to sign all my mail with my PGP key, and no matter if the recipient uses PGP or not, it should not confuse them. Last week I read a discussion that inline PGP is not good pratice, and I ...
1
vote
0answers
15 views

Safety in Access Control Matrix and Take-Grant Model

I'm learning about the Take-Grant Model and Access Control Matrix, and I have a couple of questions regarding leaking and the safety question. Definitions These are the definitions I am using (see ...

15 30 50 per page