All Questions
0
votes
1answer
7 views
How can I view the NTFS $MFT using correct field names?
I am trying to view an NTFS master file table, each tool I have used so far extracts all of the entries but puts non standard headers such as STANDARD_INFORMATION_ON instead of ...
1
vote
3answers
20 views
Enforcing personal firewall for OS X
We're currently doing PCI compliance, and one of the requirements is that mobile devices that have access to systems involved in processing card data have personal firewall software installed which ...
0
votes
2answers
39 views
How do I obtain user info from SET?
I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
-7
votes
0answers
38 views
Close the virtual machine (vmware) customer [closed]
It is possible to close the virtual machine (vmware) on this machine where it is installed, and leave the remote access only certain IP ?
0
votes
0answers
31 views
What are my options in deploying an authentication certificate to iPhones and Android devices?
I need to deploy certificates to iPhone and Android devices for the purpose of Activesync and Egnnite (like Dropbox) web authentication.
Even though most access is over HTTPs via the browser, the ...
3
votes
1answer
70 views
Pen Testing ASP.NET application with Backtrack
We have developed an ASP.NET Based Enterprise Application which is is soon to be released. Now, we are concerned about the security aspects of the application. I've been looking into Backtrack 5 and ...
-1
votes
0answers
49 views
AES 256 decryption where passphrase is a file [closed]
I got an assignment to decrypt a binary file which is encrypted using aes. I have 32 byte binary file which is a key for decryption. I know how to decrypt if the key is a passphrase by using
...
4
votes
1answer
201 views
How can a website find my real IP address while I'm behind a proxy?
I just wonder how some website like WhatIsMyIP find out what your real IP address is, even if you use proxy server. It said :
Proxy Detected
and then they give your rel IP address.
Is it ...
6
votes
3answers
118 views
Security implications of an exploited router
So I completely understand that routers and local networks need to be kept locked down, etc. What real security threats can come about from an attacker who has remotely accessed (telnet or web gui) ...
1
vote
2answers
44 views
Reseting my computer to uninstall LogKext
My friend downloaded LogKext on my computer, so I'm guessing he can see every keystroke, but I've reset my computer so that it's in a condition when I first opened from the box.
Can my friend still ...
-3
votes
0answers
59 views
Recommended skills for a career in security [closed]
First let me apologize if this is an ill posed question. Let me also note that I do not in any way seek a comprehensive answer, simply your thoughts on what makes for a valuable asset to a company ...
0
votes
0answers
36 views
WPA2 audit tool as of 2013? [closed]
For the purposes of my own research, I have a very modest budget to set up a modest WPA2 brute-forcer supported by GPU(s).
I've done some homework
Brute-Force GPU Password Crackers
How to setup ...
-1
votes
0answers
50 views
What is the industry standard method for administering the change of the local administrator password for all machines on a domain? [closed]
Although there appears to be three available options, one of which is actually secure, there seems to be only two available choices that will be able to impact machines that are not powered on at the ...
2
votes
1answer
47 views
AES in CTR mode with same random IV to create same ciphertext
I am currently working on a little project.
I am trying to generate an AES key with that I would like to encrypt a private RSA key. I have to do it this way. However, I do not want to save the AES ...
6
votes
3answers
107 views
Reason for writing Self-Decrypting Virus
What is the rationale behind writing a self-decrypting virus? By this I mean a virus that has it's payload encrypted, decrypts at runtime and runs it.
How does this protect the virus from antivirus ...
-1
votes
0answers
36 views
how to open encrypted folder [migrated]
I have an encrypted directory using Windows XP Encryption. I didn't backup the certificate and I formatted my HDD to reloaded the OS as it was corrupt. I am now not able to access the encrypted ...
-3
votes
3answers
83 views
What is the better way to share files between a server in DMZ and a server in the internal network? [closed]
I have to implement a solution to share some xml files between a frontend server in a DMZ and his backend in an internal network. Both servers are Solaris 10 boxes. What is the better way regarding ...
-5
votes
2answers
71 views
Is it possible to encrypt a virtual machine using virtualbox? [closed]
Is it possible to encrypt a virtual machine using virtualbox, and not leave accessible to the users of the machine where it hosted, and not allow any file to be extracted it with some program ?
The ...
-5
votes
0answers
28 views
Encrypt .war file java web application? [duplicate]
Is it possible to encrypt the file .war with all its contents, and then have served understand this application? I saw something similar with JarCryp, most do not know if it's working on servers like ...
-1
votes
0answers
33 views
Staying logged in Gmail [duplicate]
Am I allowing Google to tie my search at www.google.com with my name, if I am logged into Gmail all the time? The thing is, I want to prevent companies from tracking me on the Internet, so this ...
3
votes
0answers
62 views
What are the tradeoffs in cost, effort, and value in moving a database server to a virtualized DMZ environment?
I am quite new to the DMZ concept and working on a project as part of my master thesis where Remote access is required for the Development environment. However, there is a functional requirement for ...
0
votes
1answer
64 views
Definitions of computer forensics and information security [closed]
I'm about to do my master and I need to make a decision on what course I should take now I have two options either computer forensics or information security
What I want to know is:
What is the ...
4
votes
1answer
41 views
PKI integration in MAC OS
I have setup an ejbca pki and integrated certificates in MAC OS for S/MIME signing and encrypting. I have also set up a CRL distribution point and put the CRL online available on an HTTP server.
...
1
vote
2answers
47 views
PDF files on webserver file system
We create PDF files as relevant to a customer's e-mail communication. These PDF's contain some personal information, specific to the client.
The client is emailed a link to the PDF. The link to the ...
8
votes
1answer
49 views
Does it make sense to hash a session id before passing it to an advertisement partner?
My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
2
votes
1answer
82 views
Brute-Force GPU Password Crackers
Brute-force password cracker programs which claim GPU support include John the Ripper, ighashgpu, oclHashcat, and others. oclHashcat appears one of the more popular, but I am not sure which AMD/ATI ...
-6
votes
0answers
73 views
Extra/Special Security for Financial Web Apps? [closed]
I found this answer http://security.stackexchange.com/a/17999/24408.
It's a great answer, but aside from the finance industry specific processes like settling & clearing, the ...
1
vote
3answers
132 views
Can attackers steal SSL certificate from server and use it for MITM attacks?
I'm writing an iOS app for private use to acts as a client for a PHP server. To secure the connection I'm using a self-signed SSL certificate.
Since the server is self-hosted, on the first connection ...
3
votes
6answers
165 views
Best source(s) for security related news? [closed]
What is the best place to go for security news? I am looking for everything from news updates to editorials to guides and research. Anywhere considered more reliable or particularly hard-hitting?
...
-5
votes
1answer
77 views
Protect java WEB application inside the server(against reverse engineering) [closed]
I have a web application running on Glassfish 3.1.2 servlet container and I need a way to protect the compiled java classes. I have tried to obfuscate the source code but it didn't work.
The project ...
2
votes
2answers
95 views
Decrypt from cipher text encrypted using RSA
I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is
Public Key:
...
4
votes
2answers
69 views
Why standards organizations give so short protection times for 128 bit encryption?
According to this and this, seems even 128 bit encryption should remain secure for a much longer time than what security organizations say.
I saw the standards with this: ...
2
votes
2answers
63 views
Does providing OAuth for mobile apps pose a security threat?
Let's take a look at the basic OAuth workflow:
The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...
5
votes
2answers
106 views
Is “non-repudiation” automatically proven, given the other three tenets of info security?
Just to say it, the four tenets are:
Confidentiality - The message the recipient gets can be proven not to have been read by anyone else since it was encoded.
Integrity - The message the recipient ...
-8
votes
0answers
40 views
IBOSS is ruining my day [closed]
iBoss blocks P@@xy and has an immediate Unrecognizable disability for https, how do I get past that? Oh and any URL changers don't work
-9
votes
1answer
57 views
how to determine what type of server behind a port [closed]
I use nmap to scan, and got a 22 port, but cannot ssh, I suspect is is a oracle, but not very sure, how can I determine which server stand behind the 22 port ? Is there any genereal tool to help me?
4
votes
2answers
58 views
iPhone\Network Security
A client of mine is concerned someone is retrieving data and intercepting text-messages from his iPhone and his home network. He has told me that he has seen one of the text-messages he sent to his ...
-4
votes
0answers
48 views
Where can I look for malware that may have been installed on my machine?
I want to analysis my ubuntu box to detect if it was been hacked.
My question is:
what are all the place where to look to discover if some malicious software are started ?
The following is some kind ...
11
votes
4answers
338 views
Becoming a malware analyst?
So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
1
vote
4answers
43 views
Is a full backup the quickest or the longest on restoring [closed]
Studying for Security+ with Darril Gibson's book he says that "A full backup is the easiest and quickest to restore"
Now I've been looking for another test exams and I found the MasterExam of the ...
0
votes
5answers
86 views
Store username in cookie for a web site
I want to store the username for a web site in the coockie, is it secure?
What an hacker can do with this info?
2
votes
0answers
50 views
POC of a Java exploit using leftover JREs
Summary: I would like to show a proof of concept of a Java exploit using an old JRE on an up-to-date machine to cut short discussions on the "but we are patched so why removing older versions" ...
18
votes
3answers
775 views
Why do a lot of Android apps (like Linkedin) require many unrelated privileges?
I wanted to install the Linkedin app on my Android phone and I was shocked when it asked for nearly all possible permissions including reading all of my private data and calendar data.
Why does any ...
1
vote
2answers
31 views
Bridge Exploit of Network Multi-function Print/Fax Devices
I performed a recent security audit and was wondering if anyone has heard or run across any known exploits against any commercial multi-function print/scan device whereby you can bridge the incoming ...
4
votes
1answer
129 views
TOR detection in network
After I read this link, I tried to understand how they manage detect TOR traffic
The most understandable source for me was this paper
He is saying TOR trafic can be detected by port, cipher suite ...
2
votes
1answer
42 views
SQLite database iphone data
I opened an sqlite database file, and it seems to have many rows that arent readable.
The data has got weird symbols including "question mark diamonds". Is it data that iphone encrypts when it goes to ...
2
votes
3answers
52 views
Storing config securely in a semi trusted shared hosting environment
I'm looking for a pattern to store a config file containing sensitive information in a semi trusted hosting environment. Semi trusted in this case meaning I trust them in general, but not with this ...
2
votes
2answers
88 views
Identify code being run on website
I do not normally deal with internet security problems but this one has got me interested.
The issue is with a specific site, lets say test.com, and how it it visited.
If the address is typed ...
2
votes
2answers
66 views
Force clients to use proxy [closed]
Here's my network configuration:
The proxy server is running Ubuntu with Squid on port 3128 and DansGuardian on port 8080.
I'd like to force all clients to use the proxy server - specifically, ...
-4
votes
1answer
75 views
cant connect to network after spoofing mac [closed]
Just spoofed my mac at my school connected to router got past the fire wall but now I don't have internet access. Can some one help I am using windows 7.
