-1
votes
0answers
5 views

Java Keystore best practice for large scale application

I'm new to JCE/cryptography in general but I'm working on demo where we are going to create a public/private key combination for each users of the site. All the examples I have seen so far stores ...
0
votes
2answers
21 views

Does encrypting a file make it larger?

I encrypted a Word document using Winrar by setting a password. Surprisingly the archive was larger than the original file (631 vs 614KB). I then tested to see what would happen if encryption wasn't ...
1
vote
0answers
7 views

decrypt a soap message using openssl

I've tried to do the same as found in How to you manually decrypt a SOAP message using openssl? Unfortunatly without success... Here is my situation : I'm trying to do the same stuff only my data ...
0
votes
0answers
7 views

Calling string functions safely

I wish to implement some user callable functions in my code. I use something like this: function funcTest(){ echo "This is test function"; } if (isset($_GET['cmd'])) { $func = ...
-6
votes
1answer
21 views

Why study Information Security?

This question might be considered as overly general, but it has occupied my mind lately. I have decided to study Information Security (to be more particular, 'Networked Systems Security') at ...
-4
votes
1answer
31 views

How The Sony Hack Was Traced, and So Quickly?

Let me preface this by saying I am not a network security specialist... I am a run of the mill sysadmin, so I'm just laying out how I understand it from my perception of standard networking and ...
0
votes
1answer
17 views

HMAC: How unique does a nonce need to be if the Date is also part of the signature?

In a HTTP scheme where the HMAC-SHA256 signature is sent as part of the Authorization header, and the message input contains: The request method URL Post data Nonce Date HTTP header How unique ...
0
votes
1answer
37 views

How did piratebay.se search engine get in Chrome as an “other search engine”

I have an IT client with a user who had piratebay.se/... listed within his Chrome's (v39, 64-bit, OS X, 10.10.1) "Other Search Engine" section. I know a user could manually add it and suspect the ...
0
votes
1answer
42 views

Where can I download the Sony hack malware (for analysis)? [on hold]

I want to analyze the Sony hack Malware as there have been a lot of stories on who is responsible; from the US government implicating North Korea to news articles stating it's an inside job. The fact ...
2
votes
2answers
186 views

Is Double NAT a secure way to create a public wifi network?

I'm trying to create an open, public WiFi network in my house for guests to use, as I am hosting a (somewhat) large party later tonight. However, none of my routers have any built-in guest networking ...
0
votes
1answer
16 views

Windows 8.1 full disc encryption

I have a zenbook ux302 that I want to do a full disc encryption on. I had no problem using bitlocker on my stationary computer, but the zenbook doesn't seem to have that functionality? I have the ...
0
votes
1answer
17 views

Modern Browsers, Safe to Ignore CSRF?

For users using modern browsers, is it safe to assume they won't be able to be hijacked via CSRF and the likes? If not, how likely is it that an attack can take place?
0
votes
2answers
17 views

Doesn't seem to be able to capture the packets I need

I've been trying to capture Telegram messaging application's packets (for my class project) but I couldn't get anything out of the punch of captured packets I got. Telegram does AES-256 encryption ...
0
votes
0answers
48 views

Good password hashing algorithm compatible with PHP and Linux apps

I'm looking for a password hash method for a new server system. The hashes must be generated from PHP code and verified from PHP as well as by a number of applications on a Linux system. I know that ...
0
votes
2answers
55 views

Only HTTP(S) port is open. Why do I need to worry about unpatched software?

Unpatched software poses no risk by themselves. They're only problematic when someone exploits it. How could malware get into my system if I do have unpatched software in general and I'm connected to ...
0
votes
1answer
34 views

Why is browsing while logged onto a VPN from public wifi more secure than not?

I've been trying to wrap my brain around VPNs for a while now, but can't find a good source that answers the questions I have. In particular, I can't understand why browsing from a public access ...
0
votes
0answers
14 views

How encryption/decryption of RSA private key by passphrase works?

I would like to know how exactly the encryption of private key by passphrase works. I am a software developer with no background in cryptography and I know only some basics. When I open the private ...
0
votes
0answers
14 views

SHA256.DB30.com listing of email account

After searching a gmail account in Google I've found a result for the website SHA256.DB30.com. The page just shows the name of the gmail account and a list with major and minor hash. From my basic ...
1
vote
3answers
31 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
0
votes
1answer
10 views

Tails OS for Android and PC?

Can I use Tails OS on a USB-stick on both an Android tablet and a PC, or do I have to have two different versions? Would I have to go into the BIOS to make this work?
0
votes
1answer
17 views

CSRF Guard: Injects token in POST Request?

I have implemented CSRF Guard into my web application. It's working fine for GET requests (with AJAX and without AJAX) however for POST request token is not getting injected into the request that's ...
1
vote
1answer
7 views

Safe storage service for private keys

Is it currently technically (as opposed to financially) possible to provide a fairly secure means of providing a storage facility for private keys, not excluding physical verification etc? As in, you ...
0
votes
1answer
28 views

How to prevent outgoing UDP attacks?

My server has been the target from hackers 3 times in the last month, and the attack seem to follow the same pattern. The attack another site from my server using UDP connection. The report from my ...
0
votes
1answer
18 views

Why is there a path to a .pdb file in an exe I am trying to reverse?

My query is ,if I'm seeing a .pdb path in a exe(VC++) what conclusion can I draw from it.Why does the exe have these paths and does it have significance in malware analysis? eg ...
4
votes
1answer
34 views

Suspecious js file sent as email attachment

I received a js file with following code in my spam folder but I decided to take a look into the file. Do anybody of you know what does this code might do? var evl='';function nr() { evl = '}; ' + ...
1
vote
3answers
65 views

Security in Windows 7 vs Ubuntu

I have two semi-related questions about the security-related reasons I hear for switching to Ubuntu over Windows 7 (or from other Windows OSs to other Linux distributions). Someone people say that ...
0
votes
1answer
25 views

Mobile Game Auth Token Stolen [on hold]

Basically someone sniffed my packets and stole my auth token/cookie for a mobile game I have played on for a year and spent thousands on (crazy I know) and now they are controlling my account through ...
-2
votes
2answers
28 views

Is Firefox on Ubuntu less secured (does it not confine Flash)?

Ubuntu Linux makes it easy to install Flash as soon as you encounter it. Just like Firefox on Windows really! Installing it on Ubuntu even provides security updates through the standard OS method. ...
8
votes
3answers
382 views

How do RSA SecureID ® Keys Work?

I have been using RSA SecureID ® Keys for quite some time now (perhaps 10 years), for things such as securely my home banking account online or accessing my company's network of computers from home. ...
-3
votes
0answers
33 views

Preview of Planned Backdoors in Smart phones and their OSs [on hold]

I want to know if there are planned backdoors or not in hardware and its OS. I am not interested in those backdoors which come and go. However, note that there can be agreements between the ...
2
votes
2answers
67 views

How to ensure that a login is really going over http?

So I've been offered the chance to go to a day long security awareness event hosted by some organization. On their site, I noticed the login box in the corner, but the site was delivered on HTTP. ...
1
vote
0answers
15 views

Force TLS on mobile app

i'm developing a mobile application for iOS and Android. On this app i'm asking resources on a secure server through ajax. Server's developers asked me to force the call in order that we use TLS ...
2
votes
3answers
228 views

How secure is an Activation Email?

Is there any risk to an Activation Email? My ASP.NET Site is set up so that a user has to check their Email and click an activation link which is made of a GUID created as their user ID in the SQL ...
-6
votes
2answers
49 views

Large web application security challenges [on hold]

What are the biggest challenges of security in web applications? I want to do a search in the area but I'm not sure what I want to look, I want something that people think it is impossible to serve ...
1
vote
1answer
27 views

Best practices for usefully storing two factor authentication backup codes?

For a lot of web services offering two factor authentication, after setting up the system, you are given a short list of backup codes (one-time pads) that are around 7-10 characters long. These are ...
1
vote
0answers
32 views

Obtaining login scripts for a domain?

I have read that a useful technique in penetration testing is to obtain the login scripts for a domain, as they may often have passwords obfuscated in there or other useful information. However, in ...
2
votes
1answer
49 views

Is tor really fully decentralized?

I think, somewhere an initial list of the connectable peers had to download. Manipulating this list, or the server providing this list, weren't a serious security compromise of the whole network?
0
votes
3answers
96 views

How are computers identified across networks?

IP addresses are assigned to computers when they connect to the internet and change depending on your location. However, I read that your computer also has an address that doesn't change. So, when ...
1
vote
0answers
24 views

How to locate a domain controller on a Windows network when not a member?

Is there a way to determine which machine on an active directory network is the domain controller, if on a computer not logged on to the domain? This is for a penetration test, going in blind. I've ...
3
votes
1answer
66 views

What is investigated after a possible hack on servers?

My question follows recent news of the Sony hacking incident. I was wondering what type of investigation is conducted by a security firm or the FBI. For example, if the network servers were hacked, ...
7
votes
3answers
929 views

Does the entire AES encrypted dataset have to be present to be 'cracked'?

I am implementing an AES 256 algorithm on credit cards and I am wondering if I would be strengthening or weakening the encrypted dataset if I split the dataset and persisted it in two locations. I ...
1
vote
2answers
31 views

What do we have to keep in mind when opening up our data to a third party?

We have a database with pictures (amongst other things). We have a few apps that can connect to this database via a php webservice (send https requests to a php file to retrieve stuff from the db and ...
1
vote
1answer
18 views

What are the practical risks of using IKE Aggressive mode with a pre-shared key?

Our scanning vendor is marking us down because we are using IKEv1 in Aggressive Mode with a pre-shared key. We are using Sonicwall's Global VPN Client to connect to the VPN device in question. I ...
1
vote
0answers
14 views

Compatibility issue if two wordpress security plugins are used together

My Wordpress installation uses sukuri as well as wordfence for security. Is there any possibilty that using both of them together might create any compatibility issues? I have this doubt because ...
2
votes
2answers
52 views

Connecting trusted and untrusted networks

We have two domains that are isolated. First domain is the Corp LAN, the second is an hostile untrusted network with untrusted clients that could contain malware. Clients on the untrusted network ...
4
votes
1answer
81 views

About onion packet and onion routing?

I was just wondering if anyone has a diagram showing what is encrypted inside an onion packet when it leaves the sender? When a Tor client sends the packet out, wouldn't the entry onion node know ...
0
votes
2answers
65 views

What is the best resource to learn malware analysis? [on hold]

I am looking for a resource that helps learn malware analysis. I know about the practical malware analysis book but i am looking for something other than a book. For example a Site or video tutorials. ...
3
votes
2answers
46 views

Web server interaction with a database server

It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How ...
0
votes
1answer
26 views

Security risk of allowing ICMP “destination unreachable” packets on AWS

If I configure an Amazon AWS VPC, should I explicitly allow ICMP "destination unreachable" packets outbound? I am wanting the VPC firewall to block everything by default, however does this mean this ...
0
votes
1answer
33 views

SFTP or FTP through VPN?

I'm struggling to find out whether or not I should set up SFTP since I already connect to the internet using a secure VPN. Is the security using FTP through a VPN (using OpenVPN, more specifically ...

15 30 50 per page