Tag Info

New answers tagged

3

All your client side security efforts are doomed to failure. Obfuscation and hiding your source just isn't going to work. The more valuable the data you are working with the sooner your code is going to be reverse engineered. The only logical approach to consider everything client side public. Your approach should be to focus your security on server ...


0

It's possible to design operating systems, or individual programs, so this is possible. With debugger-level access to a running application, you could probably reconstruct a close approximation to the the exe which launched it. However, that wouldn't necessarily put you in any better position to distribute the app than if you just copied the original bits. ...


2

The play store uses SSL/TLS to ensure the integrity of your downloads, just like your web browser. Basically it downloads metadata for a particular package including a plain HTTP URL and a checksum of the binary. After the download it compares the checksum to the APK and ensures they match. how can trust that I'm securely communicating to download and ...


0

OpenDLP is another project widely touted -- http://opendlp.googlecode.com -- Another is MyDLP -- https://en.wikipedia.org/wiki/MyDLP


0

There is a paid product called Identity Finder that will do just that. It can find a variety of PII, and produces a report that you can use. I am not affiliated with this product, I just use it at work.


2

ccsrch is a tool for exactly this purpose. I have seen QSAs use this as part of their audits. Personally, I'm not fond of it. I've run it against a file with 100k cards and it found all 50k of them. I got better hit rates with a python script I threw together in an afternoon. And the output requires lots of manual review to weed out false positives. ...


0

Sometimes you never get any feedback at all. It's just part of the game. It could also be a case of lots of people passing it over as "it's not their job to to look at this issue/component " in fact it's possible that nobody is working on that specific component anymore .. P.s. I assume you got a cve number and included it with the report ?


0

Is steam a security problem at work. Well like any other program it will have vulnerabilities. And it allows installing other programs that will also have vulnerabilities. SO yes just like Windows, IE and Office it has security issues. And in the settings you can have it send information back to the steam servers about your computer (this may be on by ...


1

Linus Law (the more people have access to the sourcecode, the more people will find and report bugs) only applies when people have an incentive to get bugs fixed. This incentive usually only exists when they use the software. So when your software is highly optimized for you and you don't expect that a larger community will form around it, you won't get many ...


0

It depends on what software it is, I imagine you get far more scrutiny for open source AV/firewall or anything that listens on a socket with a privileged account. However something like a CLI application to generate shellcode will probably only receive QA type responses.


2

I'm assuming data is entered by some sort of front end, with a list of fields? For arguments sake I'll assume 4 fields. In the first field do this: ''',(SELECT @@version), (SELECT @@version), (SELECT @@version))-- In the other fields put anything you want because they're commented out by the double dash anyway. This should return the server version to you ...



Top 50 recent answers are included