1
vote
0answers
12 views

How is JWT implemented?

I'm using django-rest-framework-jwt in one of my APIs. As you might know, the concept is simple: you send username and password and you get a token back. The token is not stored anywhere on the ...
0
votes
1answer
20 views

What are ways I can analyze malware in an infected machine, not just clean it?

I often run into infected devices in my environment and would like to learn more about the specific infections that have gotten in. What are the best tools and techniques I could use to do this? I ...
1
vote
0answers
23 views

Snort report - 1000+ alerts in 1 minute from port 5060

I woke up this morning and could see over 1000+ of these alerts. They came in the time space 23:34 - 23:35. Can anybody tell me what that was about and should I be worried for an eventual DDoS ...
1
vote
2answers
30 views

How can I stop this remote attack?

Someone appears to be logging into my machine remotely, I am running Avast anti virus with Comodo Firewall both report no attacks.I only noticed this because on my router security logs I see the ...
-9
votes
0answers
43 views

I want to block internet in all computer [on hold]

I work in a call center, I am not in a mood to work today, how can I block internet in all the lan connected computers so that today will be holiday. All the computers are connected on lan. Please ...
1
vote
0answers
21 views

What Firefox settings should be changed from factory defaults to ensure privacy vis-à-vis Mozilla?

Besides turning off everything in Edit/Preferences/Advanced/Data Choices and browser.newtabpage.directory.ping browser.newtabpage.directory.source browser.safebrowsing... ...
1
vote
0answers
16 views

How do nested vpns through VM work?

Let's say I have 2 different VPN services (vpn1 and vpn2) both using OpenVPN and a Linux host running a guest VM. Now let's suppose I connect from the Linux host to vpn1. Then I connect from the ...
2
votes
0answers
20 views

Is it necessary to purchase an OID for ADCS? [migrated]

I am interested in utilizing ADCS to generate trusted certificates for internal web applications. However, from my readings it appears that I need to purchase an OID, which looks pretty expensive. Is ...
2
votes
1answer
24 views

On the fly encryption for unencrypted cloud services?

Today Amazon announced their Cloud Drive with unlimited storage for only 60$/yr. Microsoft did the same with Office 365 a while ago. I don't really want to entrust either service with my dearest ...
0
votes
0answers
29 views

Calling a HTTPS web service [on hold]

Background I have a Java application, one part of it is to call a HTTPS web service regarding payment (offered by a company called PayPoint). The application is sitting on a IBM Websphere server. ...
-1
votes
1answer
31 views

AES or Serpent-Twofish-AES [on hold]

I want to encrypt my private stuff like credit cards, money, RSA private keys (and so on) but I don't know if I should use AES-256 only or in combo like Serpent-Twofish-AES (I am using Veracrypt). ...
0
votes
1answer
48 views

Website being probed from the Ukraine

I have a landing page setup for my business located at www.jdmxchange.com and have been getting some strange error logs from ELMAH. I apparently have users (or bots) in the Ukraine probing the hell ...
2
votes
3answers
33 views

image steganography and tracking

We are running online press media library, in this site many brands are uploading images and track press users download and views per image. But some brand now want to add unique code in image so they ...
-5
votes
0answers
43 views

TCP instead of HTTP [on hold]

TCP is a stateful protocol and HTTP is a stateless protocol. Web application needs to maintain the session so why we use HTTP instead of TCP?
0
votes
1answer
42 views

Does VPN remote port forwarding compromise the anonymity of the VPN user?

An anonymous VPN service will typically assign the same public IP address to many VPN users. This procedure ensures that a connection cannot be traced back to the VPN subscriber: behind the veil of ...
0
votes
1answer
38 views

Unexpected/unwanted/unknown participant joined WebRTC session

While running the simpleWebRTC example Step8 of the WebRTC codelab tutorial on my local computer 192.168.2.101 (in my own home private network), when someone (that I don't know) joined in (video + ...
1
vote
0answers
35 views

Asymmetric / end to end encryption for web messaging app

Background I'm trying to design a secure and sustainable web app for messaging. The purpose is to learn how to create secure web application. The application is suppose to be written in Javascript ...
1
vote
0answers
10 views

JKS - Keystore protection and configuration file

It appears that Java Keystore is often used by web server using a configuration file, with the password opening the JKS written in it and also the password protecting the specific entry. How could ...
-1
votes
0answers
17 views

Effects of Upgrading OpenSSL library? [on hold]

we are having a Redhat linux server network proxy server [Apache http] with openssl version standing on [jae@myserver~]$ openssl version OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I am planning to ...
0
votes
0answers
24 views

Buffer overflow lab problem [migrated]

Since our security course doesn't have a lab, i'm trying to solve the Seed project's lab . http://www.cis.syr.edu/~wedu/seed/Labs_12.04/Software/Buffer_Overflow/Buffer_Overflow.pdf But there seems ...
1
vote
0answers
19 views

How to design a right VPN connection for an organisation (Interconnected MPLS link or Individual FW)

Thanks in advance for your advice We have to implement VPN connection for nearly 7 countries Option 1 : As we have private MPLS link to all 7 countries. It is been outsourced Third party. They ...
1
vote
0answers
36 views

DOS attacks on 802.11 access points

I want to carry out resource exhaustion attacks on access points which would lead to DOS condition of the access point. I would like to exhaust the client association table,by imitating a large ...
0
votes
0answers
20 views

How to convert .ad1 to .dd [on hold]

Access Data's .ad1 file type is a real pain to work with, and I acquired a .ad1 image that I need to analyze. Has anyone here been successful in converting .ad1 to a more amenable file type... maybe ...
2
votes
4answers
202 views

Could antivirus programs not just scan all files upon creation?

Could antivirus programs not just scan all files as they are created instead of using on access scanning. Would this kind of approach not be much more scure?
1
vote
0answers
27 views

Policy Privacy Italian / EU and anonymous blog [on hold]

I would like to write a personal blog without making my real identity public. It's not a "war blog" or similar, I would like to write about several personal problems and give (if possible) some ...
3
votes
1answer
52 views

How can a very small company handle PCI-DSS requirement 6.4.2?

PCI-DSS 3 requirement 6.4.2 calls for Separation of duties between development/test and production environments. Based on the guidance text and this, answer to another question, it appears ...
-1
votes
0answers
47 views

Malware builder request [on hold]

I need the builder of some malware (only for study reason): for example dyre/dyreza/dridex. I would like to understand better how they interact with OS and websites that are affected from those ...
0
votes
0answers
16 views

Email message extraction [on hold]

I'm not a professional but I've learned a lot through multiple free iPhone extraction programs. My question is can the actual email message sent from an iPhone 4 to a craigslist ad link be extracted ...
0
votes
0answers
19 views

Do I need my certificate server? [migrated]

Good afternoon. I'm getting ready to replace one of my DC's and noticed it is using the Certification Services role on it. I looked and we have about 8 outstanding certificates that have yet to ...
1
vote
1answer
96 views

“It is safe if only Port 443/HTTPS is accessible from Internet!” Is it? [on hold]

I was in discussion with a vendor to implement a backup solution and as flexible as most cloud applications nowadays, it needs to be access from anywhere on Internet without VPN or any special ...
0
votes
1answer
55 views

Why to place an email as image or replacing “name@email.com” with “name at email dot com” [duplicate]

I noticed it in, for example, the profiles of some Stack Exchange users. So I wonder: did they want to protect themselves from spamming bots this way, or ...? Does it have to do with security? ...
2
votes
2answers
70 views

After trying successful SQL injection why the result isn't getting displayed on the webpage?

Below is the PHP code I wrote that allows SQL injection with one parameter ie 'id' in this case. On trying SQL injection via putting this 2' ORDER BY 1;--' in the parameter (id field ), I get ...
0
votes
0answers
41 views

scrncap.exe is it a virus? [on hold]

I have a hidden running process with name of scrncap.exe, my Security Task Manager discovered it and gave it danger rate of 100 to be a virus or malware. from the name it appears to be software to ...
0
votes
1answer
35 views

What is the risk of using SHA1 in PGP email signatures?

SHA-1 is being phased out by a lot of major companies due to vulnerabilities. For example Chrome no longer considers it safe for public web PKI. Is it insecure to use SHA-1 for PGP email signatures?
1
vote
2answers
48 views

Anti-virus anonymity question

Many people pay for VPNs and select the VPN based on whether or not that VPN keeps logs of the user's activities and if so for how long. The motivation is privacy- they don't want their surfing habits ...
1
vote
0answers
21 views

How to import key BLOB generated from Microsoft CryptExportKey from Linux

I have a private/public key pair saved as key BLOBs which were in fact exported with the Microsoft "CryptExportKey" API. Now I need to use the same key pair (specially the public key) under Linux ...
4
votes
2answers
114 views

Decide to REST API Security

I've developed an API. I got confused and I've been reading articles for days. Actually my question is close to these but not exact (maybe a combination of them); Securing REST API that will ...
-2
votes
1answer
23 views

What is Satisfiability Modulo Theories [on hold]

I came across this term called "Satisfiability Modulo Theories", which when I Googled it, was something that is related to various theories on low level languages. How does this help in discovering ...
4
votes
1answer
42 views

Is the ProtectedData class still an acceptable method to store passwords?

I'm writing a piece of software which will have to store a users password to allow authentication with a 3rd Party service. Unfortunately, this service currently requires the use of a password rather ...
0
votes
1answer
103 views

Is my ISP hacking me? [on hold]

Today I was trying to enter my routers admin page. I put the default IP address starting with 192.168. I couldn't login so ran ipconfig, and I discovered that I was assigned a Class A address. I was ...
1
vote
0answers
27 views

mobile forensics - recovery [on hold]

Can anyone suggest good tools for recovering deleted files from mobile devices? android devices are pretty easy, but the problem i am having is iPhones... one of my devices is an old iPhone 3g. this ...
0
votes
0answers
30 views

Unable to connect to VPN, but can connect to the internet [migrated]

I have a client that is trying to access my VPN server from a newly allowed connection at his work place. He can connect to the internet and browse when he plugs in his laptop, but when he tries the ...
0
votes
0answers
29 views

Question about a forensic tool [on hold]

I used the program icopybot to look for old emails. Under the "recents" section there are email addresses as well as phone numbers that had mail & SMS sent to. There are time stamps beside them. ...
1
vote
3answers
18 views

Is PGP or S/MIME useful when both servers are self-controlled?

With regards to encryption and preventing a 3rd party from viewing my emails (and ignoring validity/signing), is encrypting an email via PGP or S/MIME useful when I control my server and my recipient ...
3
votes
0answers
63 views

Generate secure one-time codes containing information

I need to create a system that allows a user to enter codes to charge an allowance. Embedded in this code should be the amount to charge the allowance. The user would pay for a code which would then ...
1
vote
0answers
22 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
1
vote
2answers
170 views

Will gmail close my well intentioned botnet account? [on hold]

I'm part of a company that has at least 1000 PC's distributed in different buildings over a radius of 25 miles. I've been asked to make a program to survey technical information on each PC. Since ...
-1
votes
1answer
54 views

Pinging a host in another network [on hold]

Imagine this, you have a top down view of two LANs that reside in different locations.. You know which machines are on in each LAN and their private IP's.. Is it possible to send an ICMP packet from a ...
1
vote
2answers
47 views

Researchers figured out how to transmit/exfiltrate data using heat

I read article about it here and it says: Researchers at Ben-Gurion University have created a new piece of malware called BitWhisper. Infected machines can transmit data using heat they ...
1
vote
1answer
29 views

Security of access to local network via VNC over SSH tunnel

I've just set up a Raspberry Pi 2 with the latest raspbian and installed some services. For remote access I've installed tightvnc server which I set up to only allow connections from localhost. I can ...

15 30 50 per page