1
vote
1answer
12 views

Public Key Pinning and subdomains

Shortly I have intend to install new webserver and I'd like to secure users a little bit more. I already have domain, (virtual) server and everything else that matters when configuring a server. ...
1
vote
1answer
18 views

SSH: Only allow known IPs

I want to allow only a known IP address block to SSH into our servers. I have Windows Server 2012, R2, CentOS 7 and Ubuntu 12 and 14. What is the best practice for each OS to accomplish this?
3
votes
2answers
12 views

FIPS 140-2 Compliance vs Validation & Products vs. Modules vs. Ciphers

Some vendors appear to advertise their products as using "FIPS 140-2 compliant algorithms & ciphers". However, some of these products cannot be found on the NIST website that lists validated ...
3
votes
0answers
14 views

iOS application pentest without jailbreak

Is it possible to run a security assessment on an iOS application using a non-jailbroken device? My device was recently restored (recovered - no SHSH blobs) to iOS 8.4.1 (as Apple doesn't like ...
2
votes
0answers
16 views

NX + ASLR bypass - troubles with return address of .bss

I have one problem, while doing NX + ASLR bypass. I'm going through this tutorial step-by-step. Everything is going well, I have prepared my exploit, just with another address and some small ...
0
votes
0answers
17 views

What information can be gained given only a phone number? [on hold]

What personal information can be obtained given only a phone number? What information is your phone number publicly (or privately, but with easy access) linked to? Here is the way I am looking at ...
1
vote
1answer
23 views

Problems executing shellcode via nop-sled

My shellcode instructions are changing during execution. I'm not sure why. Here is what my shellcode looks like: => 0xbffff0b3: nop 0xbffff0b4: nop 0xbffff0b5: xor eax,eax ...
3
votes
2answers
75 views

Best way to scan for an eliminate earlier versions of SSL/TLS in a production environment

Due to new PCI DSS standards mandating that nothing lower than TLS 1.2 be used in a PCI environment, I am tasked with phasing out anything lower than TLS 1.2 on every device in this environment by our ...
-4
votes
0answers
39 views

File Deletion & Recovery [on hold]

Picture number 1 and 2 is an example, of what I need to complete for picture number 3. I attached an image to this, because I thought it would be easier then explaining it out myself. Basically, ...
0
votes
1answer
36 views

How to secure a websocket connection with challenge-response?

TL;DR Given that all of the state information for a web browser is accessible to a (potentially hostile) user, how can challenge-response authentication between the browser and the server be ...
3
votes
1answer
505 views

download file/folder anonymously on a ssh session

I rent a paid VPS hosted online and want to transform it to a sort of treasure chest where I can upload and download files privately. For this purpose I want to do this operation over the Tor network. ...
1
vote
3answers
54 views

Difference between OpenSSL and keytool

I was wondering about differences between using OpenSSl or Keytool and generating certificates by them. I think Keytool is used by Java community but for someone who is not remotely connected to Java ...
0
votes
0answers
59 views

CryptWall virus attack [on hold]

Is there something new about any solution to decrypt all my files that are infected with the CryptWall virus? All my files have extension *.abc.
1
vote
3answers
46 views

Addons in Chrome

When installing any add on in Chrome, a set of permissions is needed to be granted to the add on. Many addons(including popular ones like Pocket and Adblock) have Read and change all the data on the ...
1
vote
1answer
30 views

Antivirus monitoring activity: why do they not have an internal firewall to prevent processes' access to user's documents?

A question that arises after an updated and licensed version of Norton Internet Security has detected a trojan installed in my new laptop (Win7 installed on 26 Aug'15 and fully updated). Trojan ...
-3
votes
2answers
34 views

Data to be Logged in a Web Application [on hold]

What data should be logged in a web application? From all the perspective such as security, user access, data modification, path traveled by a user in application and anything that matters.
0
votes
0answers
16 views

How to establish previous modification dates of a file? [migrated]

I've got some files (.ini and .lnk) and would like to establish their previous modification dates. Unfortunately no shadow copies are present. Is there any way to do that? I run Windows Vista. Thanks ...
0
votes
1answer
12 views

Integrate POS client with HSM Luna

I want to integrate and test a terminal device (PED) with HSM Luna. But I'm not able to understand steps clearly, as to what is done when a new device is integrated. Can anyone please help with this. ...
1
vote
0answers
20 views

verifying digest signed with private key using a C program

I'll explain all the steps I've done so far and conclude with my question. using OpenSSL 1.0.1e-fips 11 Feb 2013 Generating a private and public key openssl genrsa -des3 -out private.pem 2048 ...
1
vote
1answer
41 views

Purpose of client and server random numbers in SSL Handshake

I could not understand why in the Client hello and Server hello in SSL Handshake client needs to send to server (publicly) a random number and vice versa. From these numbers a Pre-Master secret will ...
2
votes
2answers
47 views

Is encryption application credentials using certificate encryption good practice?

I'm working on a small web application. The web application needs access to a database, so the application needs access to a database username and password. The application runs in an environment ...
3
votes
1answer
58 views

End-to-End (Point-to-Point?) Email encryption

I'm looking into providing security for the email server I recently deployed, however the subject matter is a touch more complex than I anticipated and I would appreciate confirmation or correction of ...
2
votes
2answers
34 views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
8
votes
0answers
49 views

How can mobile sign-on be secured from imposter authentication screens?

History seems to have come almost full circle where old issues are shown in new/emerging technologies. Background If you trust the operating system, Windows originally had the Control - Alt - Delete ...
1
vote
3answers
56 views

How secure is this token url for subcontractors with no accounts?

Imagine you are a cab company that subcontracts independent drivers to drive within certain cities and towns. You send the subcontractor a link to a page that has fields for the subcontractor to ...
3
votes
2answers
43 views

Wordpress infected with Trojan

So recently our (VPS CentOS6.5) server began hosting a WP site that was, or became, infected (via revslider plugin) with some kind of trojan (probably spam sender, as we ended up on Spamhaus list very ...
0
votes
1answer
26 views

Vulnerabilities despite FIDO U2F?

FIDO U2F seems much more secure than one-time-passwords (OTP), especially TOTP, because of the challenge-response architecture. In what ways is a U2F user still vulnerable? I presume if a user's ...
4
votes
2answers
48 views

Are the rules used to validate certificates in the major browsers documented anywhere?

I'm trying to get a certificate that's good for two subdomains. Essentially, the TLS equivalent of the human-level logical cert "*.*.example.com". I've tried: Name constraints: these work in the ...
0
votes
1answer
38 views

Authentication on remote, unmanned, unconnected machines/devices

What proven methods exist for authentication of a user on remote, unconnected machines/devices where establishing unique login credentials for the users isn't practical due to the number of ...
-4
votes
0answers
15 views

is the market for android antivirus app too saturated? [on hold]

i wanted to develop an antivirus for the android platform and wondered if it was a still a good idea? Is there anything i can offer from the world of information security that is not already available ...
0
votes
1answer
44 views

Definition of security incident [on hold]

What's a security incident in information security? Can an unsuccessful attack (blocked by an IPS for instance) or an attack without real impact (a port scan for instance) be considered a security ...
7
votes
3answers
4k views

CV to a Suspicious Professor [on hold]

Here's the situation: we have this professor this semester who is an excellent teacher and is very friendly, but he has some ego issues. He promised a few of us internships at Princeton, Stanford, ...
0
votes
1answer
35 views

What security problems are exposed by running untrusted macros in excel?

Here's a 2015 article arguing that Macro-based malware is making a comeback. Obviously running untrusted macros is bad news, but what are the specific problems? As far as I understand, VBA can do ...
8
votes
2answers
1k views

Are all SSL/TLS implementations vulnerable to the Heartbleed bug? [on hold]

I've learned the theory behind the SSL/TLS protocols and how effective they are to achieve a secure communication between clients and servers. Do all the implementations OpenSSL, PolarSSL, MatrixSSL, ...
10
votes
2answers
1k views

Why should I choose SHA (such as SHa-512), instead of bcrypt or PBKDF2, for FIPS-compliance?

Due to regulation, my company needs to be FIPS-compliant. I was looking at the current list of FIPS-approved cryptographical methods and I notice that neither bcrypt or PBKDF2 are in this list. ...
0
votes
1answer
65 views

what is the most secure hash for virus definition databases in 2015?

I have been told, if I wanted to create virus signatures from infected files to use for detection in the future, I should be careful as some of them are prone to collision attacks?
0
votes
1answer
63 views

How does LastPass know that Microsoft.com uses the password for Live.com?

When I visit Microsoft.com, the LastPass dropdown lists my username/password for login.live.com. It does something similar for Playstation.com and several other sites. How does it know? Are these ...
0
votes
0answers
8 views

Enabled FIPS on a luks encrypted CentOS system - boot password not longer recognized [migrated]

I have a CentOS VM instance which was software encrypted during install. The system booted fine (after entering the boot decryption password). My project requires enabling FIPS for OpenSSL, so I ...
0
votes
2answers
38 views

Difference between virus and trojan?

To my current understanding: a virus is a program that does not self replicate and relies on the host file being spread, it has malicious intent. A trojan is a program that is run be deceiving the ...
0
votes
0answers
28 views

Breaking EncFS given .encfs6.xml

I forgot the password of a EncFS folder (created, went to vacation, forgot). But I remember how the password was created (e.g. was a sequence of 4 dictionary words). So I decided to try to find the ...
4
votes
1answer
69 views

How to Man-in-the-middle a whole network?

When performing a MiTM attack, you generally need to specify the router's IP address and the "victim" IP address. I'm trying to demonstrate to a business owner why he needs to secure his network, but ...
1
vote
0answers
33 views

Docker: Central daemon model is flawed?

I've read this article about CoreOS's new container runtime, rkt, and I'm curious about this section: Why not just fork Docker? From a security and composability perspective, the Docker ...
4
votes
2answers
43 views

Input validation: how to do it if I must accept HTML as part of my input?

I'm writing a service which receives FHIR data and it stores it. FHIR is an HL7 healthcare information standard format which contains HTML by definition, embedded into a JSON or XML, (to ensure ...
-3
votes
0answers
30 views

Any One Who Can Bypass Web Sultan Webapplication Firewall [on hold]

Any One Here in this Panel Who Can bypass this WebSultan xss based firewall link: http://anonkhan.host56.com
0
votes
0answers
18 views

How to change MAC address on Windows Phone 8.1? [on hold]

I did't find any method to change MAC address for Windows Phone devices, unlike the Android devices, so I want to know if there is a way to change my Lumia 525 MAC address.
7
votes
2answers
1k views

Spoof IP adress after a TCP handshake

I know it is not possible to perform a successful TCP Handshake with a spoofed IP-Address. However I wonder: Is it possible to spoof the IP once a TCP handshake was performed successfully? For ...
9
votes
4answers
2k views

How to break MAC address filtering?

If a MAC filter prevents you from connecting to a network, how can you break it or include your device's MAC in that filter?
0
votes
1answer
48 views

How can you draw attention to your web application honeypot? [duplicate]

Unsatisfied with existing software, I'm currently toying around with writing a web application honeypot. My question is: how do you draw the attention of attackers and automated attacking software to ...
0
votes
2answers
72 views

Store password in Public Domain using files and md5sum

Whenever I check integrity of a file using md5sum, I get a string of alphanumeric characters to compare and verify if it was downloaded correctly. Couldn't the concatenation of several of those ...
0
votes
0answers
33 views

End to end encrypted calendar [on hold]

What end-to-end encryption options exist for calendars? I am looking for a way to efficiently encrypt and store calendar entries myself (so not relying on Google calendar etc). For email there is for ...

15 30 50 per page