0
votes
0answers
3 views

Stalking and harassment

I believe my ex wife is redirecting my yahoo and google accounts and somehow has access to anything I do online. How can I tell if my suspicions are correct. She is director of I.T. of a large company ...
0
votes
0answers
2 views

Looking for a good wireless access point incident response scenario for PCI review. Any suggestions?

Looking to build a wireless access point scenario to test out our Incident Reponse planning.
0
votes
0answers
25 views

Are there any paper/human strong crypto systems?

Are there any paper/human executed crypto systems that have reasonable strength? I am aware of a few candidates so far Solitare from Cryptonomicon https://en.wikipedia.org/wiki/Solitaire_(cipher) ...
-1
votes
0answers
22 views

Do iPhone Chrome & Safari keep refreshing and sending my IP address to websites while in background?

You can put a browser like Safari or Chrome into the background on iOS without closing your tabs. Will they keep refreshing themselves and send out personal details like your IP address? What about ...
-5
votes
1answer
30 views

Opinions on Vpn service [on hold]

I am interested in unspyable.com Vpn service as it does not log any data, offers off shore servers and offer multi log servers. Is there any Vpn service that does everything so anonymously?
0
votes
1answer
9 views

Are X.509 nameConstraints on certificates supported on OS X?

I have the "chain" of certificates on a test machine right now: A self-signed CA cert, in my Keychain and trusted & trusted by Firefox. A CA cert with with the following, X509v3 Name ...
0
votes
4answers
162 views

about CSRF on form submit

I'm surely missing something in the picture of how CSRF attacks and protections are working. My understanding in a form-submit scenery is the protection rely on a unpredictable token, someway is ...
0
votes
1answer
26 views

Installing Ubuntu with a potentially compromised USB drive

I would like to use an USB Stick that is possibly flashed with the Bad USB firmware as an Ubuntu Live System while having an USB Disk containing a PDF file connected as well. The reason for this is ...
-10
votes
0answers
31 views

Simple question about lists [on hold]

Question When data changes In multiple lists and all lists are not updated, this causes ? Options (1) Data redundancy (2) Information overload (3) Duplicate data (4) Data consistency (5) Data ...
0
votes
0answers
13 views

SSLstrip performs DOS

I was trying sslstrip on my windows pc as a target since Internet Explorer seems to be the only browser vulnerable to this attack. I deleted all my history and when the site gets stripped to http the ...
0
votes
0answers
19 views

Security implications of CA signed SSL cert for local development

Curious to know the security implications and potential risks involved with getting a CA signed cert for localdev.mydomain.com, and issuing it to all the developers who might need to spin up a local ...
1
vote
0answers
31 views

Is it possible to Exploit this Line Feed?

During a security assessment on a website I found a a redirection link that was reflecting the values in the Location header. The first thing that came to my mind was CRLF injection so I tried a few ...
2
votes
0answers
17 views

Is Bluetooth Low Energy Injection possible?

Mike Ryan claims that it is possible to inject packets (probably with Ubertooth) in an ongoing BLE conversation. His attempt to do so lead to jamming the connection (Sources 1 and 2). The Bluetooth ...
0
votes
1answer
17 views

BAD USB attack possible while screen is locked?

If i leave my screen locked and someone sticks in a thumbdrive that was manipulated using the bad USB exploit would an attack be possible?
2
votes
2answers
24 views

Could my DNS requests get manipulated while using tor?

I just downloaded Tor Browser Bundle and extracted it. I had no copy of my Tor Nodes Settings so i just browsed using the standard nodes and i forgot to disabke Java Script. I did not notice ...
1
vote
1answer
34 views

Can an XOR cipher be broken if the plaintext is an incrementing number?

Many moons ago, I was working with a team that was building a public-facing website. We originally built the system using auto-incrementing numeric primary keys as the public identifier for each piece ...
-4
votes
3answers
46 views

Does MEGA cloud service say ALL the truth?

If this is not the right community for this question please inform me where to ask :-) I am talking about: encryption no enceyption key kept by MEGA and so on. I found many reviews confirming ...
2
votes
2answers
40 views

Forwarding an SSL connection

My general question: Can a two-way SSL connection be forwarded to a 3rd server? The specifics: I have a WebLogic server supporting two way-SSL, client side's cert is from their CAC card. The ...
-2
votes
0answers
54 views

How can I prevent Microsoft spying? [on hold]

I have some serious (private) files on my computer, but I still want to upgrade to Windows 10 safely. I can't just encrypt them and put them somewhere else, I am working on them, and need to keep ...
-2
votes
1answer
29 views

Using a index.php script in my iOS app, what should I do to secure it?

I am really new using web servers and security. I have just written a backend for my iOS app in PHP. It's hosted on a Linode apache server. The index.php us located at http://www.example.com/API/. I'm ...
0
votes
0answers
17 views

What is the most secure method for web session handling for multiple domain?

Based on the current standing of web security, what is the most secure / recommended method for web session handling: session cookies, cookie jars, web tokens, or anything else? The requirement is to ...
2
votes
1answer
35 views

OpenSSL Certificate Expiry

I'm trying to use OpenSSL to verify that an SSL certificate is still valid, but I keep getting strange results. The example site that I'm testing with (expired.badssl.com) has an expired SSL ...
0
votes
0answers
12 views

Multiple user type management - token based authentication

I am currently working on an e-commerce application. The application has different users: Customers Merchants Logistics Admin The current db structure has a different table for each of these user ...
4
votes
1answer
1k views

Is my modem compromised?

My modem automatically changes its DNS server from Norton DNS server to AdClick server. How do I prevent this from happen again? Is it possible to have protection from these for modem? How do I check ...
2
votes
0answers
17 views

How to analyse a suspicious Encapsulated Postscript file?

How can you analyze an encapsulated PostScript file that has a standard header, but is way too big? There is a EPS file which has a size of 1.8MB. When it is reconverted to EPS, the resulting file is ...
1
vote
2answers
71 views

Yahoo mail hacked - how to recover, how did it happen and how to prevent?

I was yesterday informed by some friends that they received spam mails with my name as sender. The sender addresses look like firstnamelastname@spacepc.pt and firstnamelastname@revistaplot.com with ...
-7
votes
0answers
37 views

What information is hidden in the code [duplicate]

In the below code what email id is hidden ? ...
2
votes
1answer
32 views

Checksum Calculation for Source Code tar balls downloads

Http sites like OpenSSL provide checksum for each source code tarball available for download HTTPS sites like GitHub usually do not provide checksum with 'download zip' option. Some sites although ...
1
vote
2answers
73 views

How long should Windows 10 pins be?

Pins in other contexts seem to usually be only four or six characters long, but this seems to be vulnerable to brute force attacks. However, I am not very knowledgeable about this, so there may very ...
-1
votes
1answer
37 views

Any audited cryptography library? [on hold]

Is there any open source crypto library (C,C++,Java,whatever) that has been audited by well known cryptographers and which is confirmed to be correctly implemented ? By correctly implemented I mean ...
-1
votes
1answer
23 views

Formal functional relationship between risk and CVSS

The Common Vulnerability Scoring System (CVSS) allows, among other things, to quantify the severity of software vulnerabilities. What is the functional relationship between a CVSS and the associated ...
0
votes
1answer
27 views

How to detect port scan on SIEM within LAN or same Network?

Let's suppose a host machine in the client environment has been infected and its performing port scanning on other machine within the LAN or same Network without passing through Firewall: On what ...
3
votes
1answer
141 views

How to protect a Wifi network from Microsoft WiFi Sense

Microsoft is deploying a new feature, WiFi Sense, which provides users a way to easily share passwords to wireless networks with all of their contacts. This introduces a new security failure mode: a ...
0
votes
0answers
16 views

Behaviour of DNS query packet

When the configured name server resolver is not reachable, the query packet will retransmitted after certain t times (in windows, every 1 seconds until 8 seconds,max). The behaviour of the legitimate ...
2
votes
1answer
32 views

How to determine which program accessed the Mac Camera?

The green light on my laptop's camera just flashed on and then off after 1 second. I am extremely concerned about this since I am not running any programs which could have enabled the camera. I ...
4
votes
2answers
347 views

Questions on true anonymity

I am going to use Tails to connect to Tor through VPN which has AES-256 data encryption, SHA-256 data authentication and RSA-4096 handshake encryption on my Mac on my school's WiFi (as public as I can ...
3
votes
1answer
55 views

Do card issuers give merchants new expiry dates for recurring payments? [on hold]

Recently I got an email from, let's say, “Company X” saying: some banks provide updated expiration dates for automatically renewing subscriptions I find it really hard to imagine that my bank ...
0
votes
1answer
67 views

Scam caller claimed to have elderly friend's “Windows unique identifier”

An elderly friend received a telephone call similar to this Information Security SE post and this one. The caller claimed that my friend's computer had a problem that needed to be fixed. My friend ...
0
votes
0answers
14 views

How secure is the TAP Windows Adapter V9? [duplicate]

I use Cyberghost to browse the web on public wifi. How secure is the network adapter? Cyberghost uses OpenVPN which utilizes TAP Windows Adapter V9. I am asking this, because I believe at the ...
1
vote
0answers
15 views

Mod Security - How can I email alerts from logs for incident response? [on hold]

We are in a production environment and I have mod_security WAF storing logs in /var/log/foo.log . We are wanting to have alerts that we have fine tuned , upon being logged to be sent to us via email ...
3
votes
1answer
39 views

How secure is VOIP?

I was at a friend's house who uses VOIP on his own private WiFi for his phone calls. He made a call over VOIP (Voice Over Internet Protocol) that included the need to verbally state his credit card ...
1
vote
1answer
39 views

What is the difference between Key Derivation Function and (salted) Hash?

I see in this post that the main difference is that KDF outputs have "certain randomness properties", and I don't understand what does it mean. Suposing that that "certain randomness properties" are ...
0
votes
1answer
27 views

Should I use the certificate serial number or the subject key identifier to look up public key?

I'm designing an API authentication mechanism similar to the one AWS use. As part of that, I need to look up which public key belongs to which user to verify. The public keys come from x509 ...
3
votes
5answers
70 views

How can I uniquely identify an user when cookies are not an option?

In web application development, how can I uniquely identify an user when cookies are not an option and IPs are dynamic? Are the patterns which I can combine and then created a hash to be used as a ...
1
vote
1answer
32 views

SQL Injection from Data Import Files

We process a lot of batch files and do an initial batch file import via the LOAD DATA LOCAL INFILE call in MySQL. Is there a tool / standard out there that can scan or help to mitigate SQL injection ...
1
vote
2answers
57 views

ECC and RSA 10K stronger claim

There are a lot of websites where it is claimed something akin to this but no explanation on the basis. "ECC key size of 256 bits is equivalent to a 3072-bit RSA key and 10,000 times stronger than a ...
2
votes
0answers
10 views

Freshness for SGX enclaves

Future Intel processors will support SGX (Software Guard Extensions), which allows running security-critical software on your processor in a way that is isolated from all the other code. The hardware ...
2
votes
1answer
57 views

Simple exploit leads to wrong EIP and EBP

I have a simple program: void bug(char *arg1) { char name[128]; strcpy(name, arg1); printf("Hello %s\n", name); } int main(int argc, char **argv) { if (argc < 2) { ...
-4
votes
1answer
32 views

How to verify perfect secrecy of a cryptosystem? [on hold]

Playing with an encryption algorithm. how can i prove it's information-theoretically secure?
1
vote
2answers
46 views

What measures must be taken to securely authenticate from web traffic to a WebSocket connection?

Obviously TLS is a must for any and all secure authentication. Please turn your paranoia settings up to 11 for this. Background: (In case people are unfamiliar with the WebSocket (WS) protocol and ...

15 30 50 per page