Tag Info

New answers tagged

0

I would say you should view relationships between these 3 types of activities like that: penetration testing is a subtype of security testing which is in turn is a subtype of software testing. Security testing deals with very specific types of defects: security defects; ones that could result in compromised system, ruined reputation and stained public ...


0

If it needs to be non trivial you could: if you have a Internet connection create a online service which takes a short random token and returns a larger signed key ( and its up to you to decide if you want this to behave in a one shot manner or not ) if you do not have a Internet connection you could relax the requirements slightly and create a signature ...


3

All your client side security efforts are doomed to failure. Obfuscation and hiding your source just isn't going to work. The more valuable the data you are working with the sooner your code is going to be reverse engineered. The only logical approach to consider everything client side public. Your approach should be to focus your security on server ...


0

It's possible to design operating systems, or individual programs, so this is possible. With debugger-level access to a running application, you could probably reconstruct a close approximation to the the exe which launched it. However, that wouldn't necessarily put you in any better position to distribute the app than if you just copied the original bits. ...


2

The play store uses SSL/TLS to ensure the integrity of your downloads, just like your web browser. Basically it downloads metadata for a particular package including a plain HTTP URL and a checksum of the binary. After the download it compares the checksum to the APK and ensures they match. how can trust that I'm securely communicating to download and ...


0

OpenDLP is another project widely touted -- http://opendlp.googlecode.com -- Another is MyDLP -- https://en.wikipedia.org/wiki/MyDLP


0

There is a paid product called Identity Finder that will do just that. It can find a variety of PII, and produces a report that you can use. I am not affiliated with this product, I just use it at work.


2

ccsrch is a tool for exactly this purpose. I have seen QSAs use this as part of their audits. Personally, I'm not fond of it. I've run it against a file with 100k cards and it found all 50k of them. I got better hit rates with a python script I threw together in an afternoon. And the output requires lots of manual review to weed out false positives. ...



Top 50 recent answers are included