2
votes
0answers
20 views

What are the recommended scrypt cost factors for 2016?

I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?
-2
votes
0answers
13 views

Confused in pursuing a field as a recent graduate [on hold]

I am working in a Software Development firm as Java Developer. But, I am not interested in coding in Java right now and I have the option to shift to Networking which I find interesting. So, I am ...
0
votes
0answers
18 views

Why is Fragmentaion done on layer 3 (Network layer) [migrated]

Why is fragmentation done on network layer and why not on other layers ? Fragmentation means splitting the packet into to small pieces and sent from source to destination. The maximum MTU size is ...
2
votes
0answers
13 views

How to enable self signed certificates in Windows 10?

I want to use a Yubikey 4 with Windows 10 Pro for Bitlocker and login with my TPM. Unfortunately, I found out I need to enable self signed certificates and all the guides on the Internet I found were ...
0
votes
0answers
4 views

Mobile Security and Vulnerability Analysis tool [migrated]

What tools should I use to test the security of my iOS application? What are the open source tools available to make vulnerability assessment of an iOS and android application? Any online tool which ...
0
votes
1answer
18 views

What security policies and practices could one practice to safegaurd against being inebriated?

My passwords for the most part as well as access procedures I could do while inebriated/intoxicated. Be it a simple login/password login to email or VPN and accessing a database. This might sound ...
2
votes
2answers
115 views

Why is 128bit AES considered very strong but 160bit SHA depreciated?

Why is 128bit AES considered very strong but 160bit SHA 'insufficiently secure'? Google/chrome/browsers seems to drop support for SHA1 SSL certificates. I assume it's more simple to calculate SHA than ...
13
votes
4answers
909 views

I almost searched my password, but didn't press enter. Because of autocomplete, is my password at risk?

Without even thinking about it, I typed my password into the Google search bar, but I didn't press enter. Since autocomplete is on, does that mean my password has been logged or indexed somewhere? ...
1
vote
0answers
21 views

Should the RTP feed from a surveillance camera be protected?

I see a lot of camera system and they're either using RSTP over RTP or just RTP. Most of the times they are on straight HTTP for the login, some will be on HTTPS, but unless forced (which I have ...
3
votes
1answer
26 views

Transport Layer Encryption vs. Application Layer Encryption

Can anyone tell me the key differences between Transport layer encryption and Application layer encryption and outline example use cases where each are most appropriate? The research I have done so ...
1
vote
3answers
34 views

Is there an added benefit to authentication within a part of an application, after authenticated into the main application?

Essentially I have a application that is 2 parts. One part is on the user's machine, which will upload files to my server, and the other part is a web application that works with those files. ...
-3
votes
0answers
75 views

Somehow hackers have used my email box to sign up me here!

I use same login name and password to many sites but this is strange, somebody used my email account to sign me up on stack exchange but also on Paypal but on the first mentioned with login ...
0
votes
1answer
22 views

Samsung SSD 840/850 EVO with DiskCryptor?

Samsung's 840/850 EVO SSDs have hardware full disk encryption feature, however the stock disk management app (Magician) only mentions BitLocker's support. Encrypted Drive feature provided by ...
-1
votes
0answers
30 views

Is there a list of currently active botnets?

I am a researcher, I want a list of currently active botnets names, I prepared a list but unfortunately, C&Cs of most of them are now down and they have gone offline. (For example fast-flux and ...
16
votes
10answers
1k views

Could keystroke timing improve security on a password?

When I was young, and had just started out in my software-development career 20 years ago, I wrote a little bit of code on my Amiga that took a password, but also recorded (within some threshold), the ...
0
votes
0answers
20 views

Response Header Exploit in Set-Cookie?

I'm looking at our internal testing servers and noticed this in the response headers in Burpsuite when sending data to an API we have (Apache/PHP) Set-Cookie: raw=0 The site/page delivers a XML ...
2
votes
1answer
58 views

Spoofing an NTP server to allow bruteforce on any smartphone

We all know that smartphones (i'll take iPhone as an example) rely on SNTP/NTP servers to update a device's time and date. So, by creating an SNTP server that mimics Apple's server, we can actually ...
1
vote
1answer
28 views

Looking for Defensive security training or content

We all know there is a lot of "offensive security" classes and content but what about "Defensive Security" how to look for bugs and leaks in your perimeter.
1
vote
0answers
44 views

Unknown MAC in network

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I ...
0
votes
1answer
52 views

Is `/dev/urandom` secure to generate a salt on a Virtual Machine?

I've read the new password_hash() function from PHP uses /dev/urandom to generate a secure salt, however this assumes some noise from device drivers. Is possible that /dev/urandom is not so random ...
0
votes
0answers
34 views

PHP null byte exploit through cookie

I have a challenge(centos) where I found a null byte based path traversal vulnerability in the 'user' cookie on a simple PHP/5.1.6 on Apache/2.2.3 based web app. I'm able to include the /etc/passwd ...
0
votes
0answers
4 views

Securing an error-reporting API against spamming

We are planning/spec'ing a REST API for communication with an iOS app an external team is building. For most calls, the API key hardcoded into the application and a session ID produced on our side ...
-1
votes
0answers
11 views

How can I be sure that gochange.co is a secured service?

I heard about gochange.co somewhere but i'm not sure they won't mess with my bank account. How can I trust this service? is it any good?
0
votes
0answers
23 views

Security issue with CSRF token

My website has CSRF vulnerabilities. I have tried to mitigate the risk. Whenever users try to perform CSRF attack, they will be redirected to login page for re-authentication. On top of that, I ...
0
votes
2answers
42 views

Converting an intranet site to internet

We currently have a web application with client sensitive data that is only accessible by the intranet. The management wants to open this to the internet because there will be a need to have other ...
2
votes
0answers
43 views

Why would someone upload many iptables files during a security breach and are they a cause for concern?

My workplace had multiple unauthorized access security failures over the last month. Since then, most computers have been scrubbed and user accounts purged. Data was recovered from offsite backups and ...
0
votes
0answers
30 views

MAC-spoofing / unsolicited incoming ARP reply detected - what to do?

I am behind a Linksys router. I have my computer connected to the router via cable. I have a WPA2 security set up. I am on Win 7. I have just been notified by Symantec antivirus with the following: ...
0
votes
0answers
27 views

HTTPS iFrame embedded in HTTP page - PCI implications?

I'm currently volunteering at a nonprofit. While researching something unrelated, I noticed that a $sisteragency was using an embedded iFrame to accept online donations. While the frame's source uses ...
3
votes
1answer
65 views

How secure is my system for a password reset?

I am using my custom Parse Server with Heroku which I am pretty sure (99%) that it is decently secure using things like oAuth2 and 1 way hashed passwords. The problem is I am trying to implement my ...
2
votes
1answer
18 views

What security implications does DNS prefetching have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsers already knows where to send the request the instance you click the link. This is ...
17
votes
2answers
2k views

How do I remove my website from the malware database?

I have a website which is basically a service platform. As far as I know there is no malware in my website (at least not found according to these free scanners). However, Check Point malware database ...
0
votes
0answers
24 views

Secure Systems Design Principles Excercise

I've been asked to find which Principles are being violated in this situation: I have the program "su" that is similar to the UNIX one (It gives you access to another user if you are a SuperUser, ...
-3
votes
0answers
27 views

owasp security for android app pupose [on hold]

i have developed one android app for banking purpose it will go to server for fetching data and the user can see real ip used by android application as well ip address of server through man in middle ...
-4
votes
0answers
37 views

OWASP security for android app [on hold]

i have developed one android app for banking purpose it will go to server for fetching data and the user can see real ip used by android application as well ip address of server through man in middle ...
0
votes
0answers
20 views

Why /proc/self/environ no output through injection

What on a CentOS machine would stop a null byte injection from displaying the output of /proc/self/environ and /proc/$PID/environ or /proc/$PID/fd/12 ? According to this article, all folders under ...
0
votes
2answers
47 views

Is spoofing the origin IP in a TCP header an effective “anonymity” strategy?

I know just enough about TCP to know there's a header which, among other things, contains the origin IP and target IP of that packet, which the internet uses to guide it to its destination and then on ...
0
votes
1answer
30 views

How do connection relays strengthen anonymity?

We've all heard of the concept of some geek bouncing their internet connection over a number of servers to hide their trail when doing something secretive. I'm curious about why this is done. I know ...
4
votes
3answers
69 views

Could Google Chrome's lack of a download confirmation dialog be a security vulnerability?

Suppose the user is playing a game like flappy bird that requires constant tapping in the lower left area of the screen (where the downloaded file needs to be clicked). Then while the user is ...
2
votes
2answers
40 views

Does typical Ransomware only 'attack' certain folders/filetypes

I expect this is very much on a per malware and OS basis so could potentially be very broad hence the typical. A user's computer has been infected by a piece of malware which aims to encrypt all ...
0
votes
0answers
7 views

Security of encrypted data on Mac and multiple accounts on same computer

I'd like to use Boxcrypter to encrypt files shared via iCloud (OS X 10.11). The computer is connected to a network and my account is a network account. While the computer is primarily used by myself, ...
-2
votes
0answers
48 views

What is this program because I can't uninstall it [on hold]

So there is this program on my pc but it is in full chinese and I don't know what it's called and in Programs and Features there is no sign of that program. This is what it looks like: ...
2
votes
0answers
36 views

Something phishy going on with email [duplicate]

I own my own domain. For a month or so I've been getting emails from addresses I don't know with "see attached image" or "find the attached invoice", with a zip/rar file attached. Of course, I ...
0
votes
1answer
30 views

Threat Modelling Examples (Distributed Systems)

I have threat modelled applications in the past, but I'd like to threat model a distributed system. However for other people I'm with, who have never done it at all, I'd like to check out some ...
-1
votes
0answers
30 views

SQL injection using only Scala syntax?

Is there a way to perform an SQL injection using only Scala syntax (not importing any Java)? From what I've seen online all the examples were based on importing Java things and then using it for the ...
31
votes
4answers
2k views

Does FTPS (FTP+S) offer better security than SFTP on the server side?

I had an exchange with some third party sysadmin yesterday regarding the setup of a file transfer interface between our servers. I suggested using SFTP because our application has good support for ...
-3
votes
0answers
25 views

threema opensource client secure? [on hold]

i found a project that support the 'secure messaging client' "Threema" on linux (and even windows). (simple said, Threema is: like a secure Whatsapp Alternative from swizerland - further explanation: ...
-3
votes
0answers
99 views

What all websites are safe to try SQL injection in India? [on hold]

I am a beginner and I am learning SQL injection from various sites but before trying this method, I want to know on which all sites it would be safe to try this method in India? I am learning SQL ...
1
vote
0answers
64 views

Is this cascading encryption, and is my security weakened as a result?

I'm trying to understand what is, and what is not, considered cascading encryption. All of the posts and conversations I've read over the past few days discourage the practice, including this article. ...
1
vote
0answers
15 views

How did I get a signed cert back with a wildcard common name when I submitted a csr with a specific common name? [duplicate]

Apologies if this is obvious but I'm hoping for some clarification here. I generated a CSR on an appliance of mine. This CSR had a specific common name (let's call it foo.domain.com). I then sent ...
1
vote
1answer
38 views

SQLMap deleted database items

While doing test on my website, SQLMap deleted data in my database tables. Everything is corrupt. What is a safe way of using this tool without touching other items on a live server? How do you use ...

15 30 50 per page