0
votes
0answers
3 views

FREAK - A downgrade attack on HTTPS to force use of RSA-EXPORT keys

Ars Technica is reporting on a new attack against HTTPS. Called FREAK, the devices reported as vulnerable include iPhones, Android devices, and Macs running OS X. The attack (as I understand it) is ...
0
votes
0answers
3 views

Why should I include a client_id in an OAUTHv2 password grant request?

Like little red riding hood, you don't know who is knocking on the door... Why even bother accepting a client_id in case of API <-> Javascript-website or API <-> Android App password grant ...
1
vote
0answers
12 views

Realistic: Exploiting a computer on BIOS/ hardware level in less than an hour? (Infinite preparation time)

I wonder how hard it it to infect a laptop or netbook in 60 minutes or less in a way the victim cannot easily clean their machine by wiping hard disk drives. Let's assume the following: The ...
1
vote
0answers
11 views

How can I view the Chrome padlock SSL certificate information in Chrome Mobile on Android?

When I'm on my Desktop Chrome, I can click on the padlock icon in the address bar and see the information about my SSL connection, like the TLS version, the certificate strength, the authority that ...
0
votes
2answers
13 views

Can a school legally access an account that a student logged in to at school?

Is this scenario legal, A school has a few public computers that can be used. The only browsers that are installed are chrome and internet explorer, and the entire network is man-in-the-middled. ...
1
vote
0answers
22 views

rootkits subverting the windows kernel source code

I just purchased the book "rootkits: subverting the windows kernel" by Greg Hoglund and James Butler for a research project at work. However, this book constantly refers to the source code that can be ...
0
votes
0answers
7 views

Tomcat client certificate authentication, client certificate not sent

I've add client certificate based authentication on our Tomcat servers. Both client and server are tomcat servers with internal CA issued certificates. Each tomcat has its own keystore (PKCS12) ...
0
votes
0answers
14 views

Decrypted True Crypt Hard drive And now it shows as RAW [on hold]

I have the recovery disk when I originally encrypted it. The volume no longer shows as encrypted but not sure if I should restore the original volume or try a data recovery software? Thank you.
3
votes
1answer
19 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
2
votes
1answer
22 views

How to grade / judge / evaluate a steganography approach?

When it comes to evaluating a text steganographic approach, I think we have to consider these things: How unlikely it is for someone to guess that there is a hidden message in the message being ...
1
vote
0answers
13 views

List of cookie parameter names to identify load balancing mechanism

I need to create my own web application security assessment methodology. Within fingerprinting section I have one test case such as "Checking for load balancing". One part of that test case is to ...
3
votes
0answers
21 views

Securing client-side data from users

So my problem, in its general form, is encrypting test questions such that a client-side testing application can access the questions while students cannot. The naive approach, in my opinion, is to ...
4
votes
1answer
14 views

What security problems does copying .Xauthority to another user present?

If I want to use a GUI application with another user (example: webbrowser), I can copy the .Xauthority file to that given user's home then I can "su - user" and start the GUI app. Question: but what ...
0
votes
1answer
34 views

What are the repercussions of a DDoS attack on a website? [on hold]

First of all, I'd like to know what exactly a DDoS attack is- my understanding is that it's a collection of infected or "zombie" computers, all controlled by a central computer, with the intent of ...
0
votes
0answers
19 views

How do you all differentiate attack protocols (inclusive too layer 7s)? [on hold]

Say like dns or tcp. Or something less usual like essyn or ntp? Would you guys mind listing differences?
5
votes
1answer
870 views

Why is my debugger detected as a Trojan by anti-virus software?

I'm trying to use a deugger (namely OllyDbg) to analyze some exe files. However, all the versions I downloaded from the Internet are considered as Trojans by some anti-virus software. (I use ...
-3
votes
1answer
77 views

I'm getting thousands of JS button clicks per second on my site. What could be doing that and why? [on hold]

I just set up a front end event tracking system using Segment.com and I found out that there are thousands of button clicks from one IP with a ~2 millisecond difference. These are not HTTP requests, ...
0
votes
2answers
59 views

Is using an free and anonymous VPN service safe? [on hold]

There are VPN services that are totally free and high speed vpn which makes me think, how can they offer such a service for free without ads nor donations? Is using this VPN safe? Regarding my ...
1
vote
0answers
33 views

Random SYN_SENT connections to Amazon EC2?

I have looked around but couldn't find anyone else with this issue. On my console (standard asus i7 laptop) running Ubuntu 14.04 LTS - I noticed in tcptrack that there are a lot of connections being ...
0
votes
1answer
32 views

DDoS Detection devices available in the market?

Wanted to know what DDoS detection devices are currently available in the market.My organisation has its dedicated firewalls and routers.But we wanted to know if there are any devices in the market ...
1
vote
0answers
18 views

Unrestricted file upload on a cloud based platform [on hold]

We have an unsecured file upload for the user to upload any file they want, our application is Azure based so they are stored as blobs not as a traditional "file on disk". Could malicious code still ...
1
vote
0answers
18 views

application/json Content-Type character set

According to the OWASP Application Security Verification Standard: V11.3 Verify that every HTTP response contains a content type header specifying a safe character set (e.g., UTF-8). According ...
11
votes
4answers
1k views

How does Android L achieve strong encryption with a low entropy passphrase?

After upgrading to Android L on my Nexus 5, I was pleased to find that I can enable encryption using a pattern as the passphrase. However, it soon got me thinking. I'm guessing the encryption key is ...
0
votes
0answers
3 views

Jradius Client : Invalid or unexpected EAP payload received [migrated]

I am trying to integrate with jradius client to communicate with Cisco ISE server for EAP-TLS authentication. I ran a sample test and below is the issue I am seeing in ISE logs: "TLS packet parsing ...
2
votes
2answers
40 views

One Time Password via Text Message: Possible exploits?

Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed? Context: A guy I know was cheated via the ...
0
votes
1answer
10 views

AES CCMP SECURITY ENGINE [on hold]

256 bit AES encryption with HMAC/SHA-256 does this do only encryption or decryption also and whether aes-ccmp protocol is more advantageous than this or not ?? which is more prefered in security ...
-2
votes
0answers
16 views

Detecting kernel process? [on hold]

How to detect the process running in the kernel of windows ? is any API is there to see the process. i don't have any idea to check.this is to check weather any illegal process is running inside the ...
0
votes
0answers
5 views

Mobile Monitoring [on hold]

Concerning monitoring the mobile device regardless to the reason behind this monitoring. What are the methods of Mobile monitoring including all installed application such as WhatsApp, Hangouts etc? ...
0
votes
0answers
18 views

KeePassX and Dropbox [duplicate]

I am currently using KeePassX on Linux to allow me to have a different strong password for each website. With this program there comes two major inconveniences: I lose access to everything in the case ...
2
votes
3answers
94 views

Sending an encrypted PGP email to someone who doesn't yet have my public key

Suppose I have the public key of a recipient I'd like to send an email to, and I've never sent this person an email before. Does it make sense to encrypt my first email to this recipient and also ...
2
votes
3answers
37 views

Clarifying self-signed certificates vs root certificate authority

I hope someone can help me understand some fundamentals on SSL certificates that I've had trouble picking up from docs, Wikipedia, and just about everywhere else on the internet. I'm working on an ...
0
votes
0answers
2 views

Prevent children of process protected by seccomp from having same seccomp protections? [migrated]

I'm writing an application which is protected by seccomp. This application uses fork() and then execvp() to run certain programs. It seems as though any child process of my program will be constrained ...
0
votes
3answers
61 views

How to make undetectable malware [on hold]

Fred Cohen in 1986 has proved in his Ph.D. thesis the undecidability of viral detection (no perfect virus checker can ever exist). My question is : Is it possible for a malware to stay very long time ...
2
votes
1answer
38 views

Does a browser have to make multiple requests to verify an SSL certificate chain?

I've learned that SSL certificates can be chained, and the browser will use the issuer's public key to verify the issuer's signature. I have read this article, which has a very helpful diagram, but it ...
0
votes
3answers
35 views

Do all non-CA certs have to be End Entity certs?

Still learning the differences between certs. Can someone explain? The internet has so far been surprising not lucid in describing certificates. *EDIT to clarify EE
0
votes
1answer
26 views

Infection through Virtual machine in NAT mode

I have a VM box configured using NAT to my host OS. It seems I can ping to the machines in my LAN. If my VM box got infected somehow my malware while surfing, would the malware be able to infect ...
1
vote
0answers
36 views

Disable webcam in Firefox [migrated]

Firefox has introduced a new "feature" called Hello, which accesses your webcam and microphone to allow you to start "conversations" with friends. For obvious reasons, I find it quite disconcerting ...
0
votes
2answers
36 views

Does preventing buffer overflow attacks prevent ROP attacks?

Would preventing buffer overflow attacks prevent Return Oriented Programming (ROP) attacks?
1
vote
0answers
17 views

CCM instead of key wrap

Is there any instance of NIST or other encryption standards using AES-CCM to encrypt/authenticate key data? I would like to use CCM over a keywrap function, but cannot find any precedent for this in ...
-3
votes
0answers
22 views

using a php hash function [duplicate]

I am a student majoring in IES specialization. Currently I have a project where I want to encrypt important information using php and I want the best hash function for storing passwords.
6
votes
0answers
24 views

I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration?

I want to send out SMIME certificates with my emails, and want to deploy the following PKI Root01 (All EKU, All Constrants, No Restrictions) PolicyInt01 (Internal applications, not trusted by 3rd ...
-1
votes
1answer
38 views

Android Device Manager lockout [on hold]

I have been HACKED!!! Someone logged into my Android Device Manager and locked me out of my own phone. Not only did they lock me out, they also wiped my phone and changed my Google, Dropbox, Lookout, ...
8
votes
1answer
383 views

“Secure” third-party inbox

My business sometimes receives emails from our clients that are sent through a "secure" third-party inbox. The client send the message through this third-party service. The third party creates an ...
-6
votes
0answers
51 views

is linux NSA-free? [on hold]

Does Linux have backdoors for 3-letter agency? or 3-letter agencys have to hack to access a computer running linux? I asked it, beacuse i believe close-source programs etc. windows, osx has nsa ...
3
votes
1answer
167 views

Weird visitor from Samara ----forum.topic5982…908.darodar.com? [on hold]

I have seen this question asked about a user from Samara,Russia, and when I sifted through all the other occurances,everything everyone else is experiencing matched my experience, except for one ...
1
vote
0answers
28 views

IIS | Block execution of files in directory

I am dealing with user uploads via a PHP application. I want to secure the server so no exploits are available to the user, such as uploading a php shell and executing it. I have set it so all ...
1
vote
1answer
64 views

Limiting Login Attempts [duplicate]

I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:- Locking a person for 15 minutes if they fail to login correctly three ...
1
vote
0answers
28 views

Spring-MVC : Encryption/Decryption with user password [migrated]

I am working on a Spring-MVC application which uses Hibernate as the ORM and PostgreSQL as the database, in which I am looking for on-the-fly encryption decryption solution, but only for 2 columns in ...
3
votes
1answer
44 views

Kerberos replay attack

Suppose I want to send a command to a print server on a netwerk that has been secured with Kerberos. To do so, I authenticate myself to the KDC and get a TGT, and then another ticket from the TGS for ...
3
votes
3answers
54 views

Account-lock security policy (username/password)

I am currently working on an application with regard to applying a security policy to the application. We are locking the account after X failed login attempts in Y minute. The account will be locked ...

15 30 50 per page