0
votes
0answers
12 views

Is there a practical way to identify security vulnerabilities that were published following a full disclosure policy?

I am conducting a study about the different vulnerability disclosure policies in an effort to determine how long it takes for a given vendor to issue a fix/patch, depending on how a given ...
0
votes
1answer
21 views

Retrieve password of an encrypted hard drive

I have an hard drive that uses hardware encryption. After not using it for a while, I forgot the code of this drive. This code is needed to reset the drive, but don't give access to any data. The ...
0
votes
0answers
5 views

Creating subkeys for an existing GPG key

I have an existing GPG key which has been used infrequently. All capabilities appear to be bound to the master key, there are no subkeys. /home/user/.gnupg/pubring.gpg ------------------------------ ...
2
votes
1answer
42 views

What does “probability space is over coin flips of algorithm M” mean?

In the book The Algorithmic Foundations of Differential Privacy by Cynthia Dwork, Aaron Roth on page 16 (actually page 20 in the pdf viewer) it says at the very bottom of the page: Definition 2.2 (...
-1
votes
0answers
28 views

XSS attack without special chars

I found a website vulnerable to XSS, but it disallows these characters: ( ) / \ Can I do an XSS attack without these characters?
0
votes
2answers
31 views

Why not have an identical session cookie for different user's devices?

Here is my table structure: // users +----+--------+------------------------+------------------+-------------------------------+ | id | name | email | cookie | /* some ...
7
votes
2answers
1k views

Hacking a car “in real life”

There are lots of papers concerning car hacking. It is often done with physical access (by the OBD interface for example), sometimes without (Remote Exploitation of an Unaltered Passenger Vehicle). ...
-6
votes
0answers
41 views

How strong is this cipher suite?

Are there any shortcomings in this SSLCipherSuite? EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !...
1
vote
2answers
37 views

CAPTCHA code refreshing vulnerability

Question is not programmatic but rather conceptual. When a user is trying to fill an e.g. contact form and then CAPTCHA code (if any) if he/she accidentally refreshes the page or doesn't fill a ...
0
votes
0answers
25 views

ARP spoofing on WLAN: seeing only traffic coming back

I am attempting to capture network traffic of my mobile device connected to switched network via WIFI, utilizing arpspoof. I did all steps tutorials mention. What I see in Wireshark is only a half ...
3
votes
1answer
57 views

Is it possible to clone my contactless debit card while it's in my pocket?

I have a bank account that I never use, someone cloned my debit card and used it to buy something in Brazil in order to make sure the cloning was successful then they started making transactions of £...
0
votes
0answers
26 views

How do malware save configuration of C&C-server?

Malware must communicate with a command and control server. In order to be able to do that the malware must know specific things about that server (e.g. hostname, port, username, password...). Of ...
0
votes
0answers
26 views

Trying to build an offline virus total type product

I have been tasked with finding a way to scan a file using multiple AV products. The machines this is to be used on cannot be connected to the web, due to lab restrictions and the AV products cannot ...
2
votes
2answers
50 views

Can identification imply authentication in biometric systems?

I know the difference between Identification and Authentication, which are basically claiming who you are and proving that claim. In terms of a system, they are username and password in general. But ...
0
votes
1answer
58 views

Can we safely distribute password protected .p12 file?

I have a password protected .pfx file and I would like to know if it safe to share it on GitHub. The intention is to ensure that companies can trust a dll file of the Tweetinvi open source library. ...
0
votes
1answer
15 views

How to best manage multiple applications using the internet with Firewall

Im not new too Linux (Ubuntu 14.x) however I must admit that I have never bothered with a Firewall until now. Im currently using Ubuntu's inbuilt firewall (UFW) with a graphical plugin (GUFW), which I ...
0
votes
1answer
14 views

Replace certificates simultaneously on remote servers?

A third party server sends us signed messages that we verify. When its certificate is about to expire, the third party generates a new key pair and sends us the new certificate. At some point, the ...
0
votes
0answers
12 views

How do I know which subkey GitHub is using for signing?

I added my gpg subkey to GitHub today and noticed that regardless of which subkey I export, the PUBLIC KEY BLOCK is the same. I have since found this post, that explains why: is-it-possible-to-export-...
3
votes
1answer
56 views

How dangerous is leaking knowledge about existence of objects which the user is not allowed to access?

It is my understanding that good security design does not reveal information about data which the user is not allowed to access. This includes information about the existence of said data, i.e. if a ...
29
votes
8answers
3k views

Is the UK Parliament e-petition system trustworthy?

Over the last few days, I've been hearing often about the petition to (pratically) "repeat" the Brexit referendum and I noticed that it is an online petition. I noticed that the "sign petition" form ...
-4
votes
0answers
28 views

How do I decrypt this unknown cipher text? [duplicate]

I got this unknow cipher text. Can you solve this? This looks like encoded PHP with base64/str_rot13/gzinflate eval. nI31RZG+Rxb1RZGzRMfsOdNql2K9RsesRLDVOdNqnLWtOdNqRtJtRtm1RZG8OdNrmxb1R/...
45
votes
8answers
7k views

SQL injection is 17 years old. Why is it still around?

I'm no techie and would like your expertise in understanding this. I recently read a detailed article on SQLi for a research paper. It strikes me as odd. Why do so many data breaches still happen ...
0
votes
0answers
33 views

Creating a port snooper/sniffer [on hold]

Is it possible to create a program, that monitors a traffic to a specific port, be it reserved or used defined? This is because I want to create a system that traps the attacker in a honeypot. That ...
2
votes
2answers
56 views

Is it safe to manually patch security bugs in an outdated system, that is no longer supported?

How do I manually patch security bugs safely without damaging the system for information security purposes on my Ubuntu system that I am running on my Nook Simple Touch (2011 Nook)? I need to find ...
-2
votes
1answer
42 views

Decrypting keys at the software application level

Does anyone know what the most common method of decrypting data is? I.e., if something is hashed and not decrypted at the firewall, how is it usually decrypted within a system? Is it integrated into ...
2
votes
1answer
82 views

Why, after a certain character limit, are larger passwords labeled as “weak” on some sites?

On many sites we see an indicator if our password is weak, or strong, to give us a good indication to go with that password, or not. I've been noticing on some sites, that after x amount of ...
0
votes
3answers
50 views

Are there any security advantages to forcing a password-character limit on reset, but allowing unlimited character in password-login?

I was resetting a password a few moments ago, and I was given a character limit of around 10 characters to make a secure password with. After resetting the password, I went to enter my password, and ...
-3
votes
1answer
28 views

Why is MITRE not changing CVE entries that are clearly incorrect?

Why is MITRE not changing some CVE entries that are clearly wrong. I have deeply analysed and highly tested some specific vulnerabilities. The CVE reports of them are in some cases inconsistent, ...
0
votes
1answer
46 views

Do these packages indicate nefarious activities?

Being security paranoid, I could help but notice that in my autoremove list that there were two packages I did not immediately recognise and was immediately suspicious of: The first one was ...
4
votes
1answer
95 views

What does Obama's phone say about Android and phone hardware?

The recent article Goodbye Obamaberry, hello Obamadroid describes the decision to move Obama's phone from the Blackberry to the Samsung Galaxy S4. The Galaxy 4S is of course an old, foreign phone. ...
0
votes
0answers
11 views

STUN Binding Requests

When looking at network logs using Snort, I've noticed I receive STUN Binding Request informational alerts when certain websites are visited. For example, when going to investopedia, I've noticed DNS ...
-5
votes
0answers
11 views

What's RSS Validity Checker? [on hold]

i'm trying to exploit XXE in challenge ! it's about XML External Entity [RSS Validity Checker] can someone tell me about this vulnerability <html><header><title>XXE</title>...
-3
votes
2answers
61 views

Need to learn information security [on hold]

I want to learn about information security so I need some good sources to help me and learn that. I'm still a beginner.
-2
votes
0answers
88 views

virus via facebook [on hold]

So, if I opened the 'tag notice' on Facebook through the Safari browser on my phone, is my iPhone contaminated with a virus now? It opened a new tab which I closed immediately as I saw the weird text.
0
votes
0answers
68 views

A JSE file was downloaded after clicking a notification on my Facebook account [duplicate]

I got a notification on Facebook that says "Finn mentioned you in a comment". After clicking the notification a file was downloaded on my phone. I found it unusual because when you click a ...
3
votes
1answer
23 views

Is using PGP/MIME or PGP Inline more secure?

Using Enigmail for Thunderbird, the setup wizard automatically sets itself to PGP/MIME and also disables HTML formatting. I am looking for security and have no idea which to use, though I do know HTML ...
0
votes
0answers
9 views

VM Introspection on Public IaaS clouds

I came across this Security SE post and a few papers on VM Introspection [1] [2] [3] What prevents cloud providers like AWS from using techniques like these to observe EC2 instance activity? If they ...
3
votes
2answers
60 views

How to secure communications between a web front-end and the web server when/where the HTTPS protocol is compromised?

A country in the Central Asia has issued a law enforcing all the ISPs to decrypt the transit HTTPS traffic and encrypt it with a special certificate issued by the government. Every client is to ...
2
votes
3answers
228 views

What information can you get from a photo?

Often in films about the FBI, we see that from a photo it's possible know: Name and surname of the photographer City where the photo was taken Latitude and Longitude of where the photo was taken ...
0
votes
2answers
45 views

Asymmetric key encryption that can have a public decryption key, but encryption key cannot be computed from that [duplicate]

Is there a way where I can distribute a public decryption key, but the encryption key cannot be computed from that key, so that anyone who reads one of my encrypted message, he/she can be quite sure ...
32
votes
9answers
5k views

Proving creation time/date of a screenshot

I have to produce a screenshot of a web page, and want to make sure others will know without any doubt that this screenshot has been produced today. That is, I would like to embed today's date in the ...

15 30 50 per page