All Questions
68,291
questions
-1
votes
0
answers
5
views
Avira anomalies if internet access is blocked for launchelevated.exe
Avira Antivirus does not work correctly if I prevent Internet access to one of its binaries:
launchelevated.exe
The exe file is signed by "Avira Operations GmbH".
Few questions raise up:
...
- 129
0
votes
0
answers
10
views
Where can i look which information about me exists online
I'm worried that there could be some particular information about me be published somewhere online.
I know there is haveibeenpwned.com and doxbin.com, but what other sites exist there where i can look,...
- 1
0
votes
1
answer
10
views
Are banking and finance apps safe on android phone with cracked apps
I want to install a few banking apps for my bank accounts. But I also have mod or cracked games/applications installed on my phone. But my ohone is not rooted. Will adding a banking app increase the ...
0
votes
1
answer
23
views
Apple Mail versus GMail app content security
I am trying to determine if there is a benefit to using the GMail app over the built in iOS one when it comes to security. I know that both store data locally on the phone, but the question is whether ...
- 101
0
votes
1
answer
23
views
Can an earpiece transfer virus from one phone to another? [duplicate]
I gave a friend my earpiece and her phone had audio issues prior to that, I took it back and connected it to my phone and ever since I did, my audio stopped working. Now if I try to do anything that ...
0
votes
0
answers
17
views
Is it possible to disallow external IPs from accessing a page of a React site? [migrated]
I'm currently learning React to host a personal website (on an Ubuntu server) and am port forwarding it to allow access from the internet.
However, for security reasons, I'd like one or more pages to ...
- 101
2
votes
2
answers
42
views
Debian's security tracker says a CVE is fixed, while BlackDuck scanner detects it
I stumbled across a vulnerability considered a critical security risk (CVE-2023-25139) in one of container images I build.
Debian's security tracker states it's fixed: https://security-tracker.debian....
0
votes
0
answers
20
views
Will these actions better secure my web app
I'm trying to figure out what else I should (not) do to reduce the possibility of my web app getting hacked. And like most development efforts, while it would be great to have a security expert on the ...
- 493
0
votes
0
answers
12
views
Understanding Secondary Log Hard Disk Impact on Write Speed and Data Integrity After Power Outage
I've recently come across the notion that a secondary log hard disk can be employed to enhance write operation speed in a database system. I find this concept intriguing but am struggling to grasp the ...
0
votes
1
answer
25
views
Server Side Request Forgery Vulnerability Question
I am working on a CTF called Internal. I know there are walkthroughs available but I am trying not to look at them for the time being and try and work through things myself. The admin page that is the ...
- 61
0
votes
0
answers
17
views
How to mitigate a illegal stingray2 use [closed]
How might I close the ports for every mitm attack out there, because I need to close the hole made by a pii leak to the darkweb, also does a stingray2 and other devices have a weakness?
- 1
0
votes
0
answers
17
views
which DH protocol is safer in communication with given condition? [migrated]
I am trying to understand some concepts such as DH problem and its variants. I have the following question from the book I read. (note that I translated the question from my language to english)
...
user301634
0
votes
0
answers
22
views
What can be practical vulnerabilities in an email setup? [closed]
I am trying to set up an email server using postfix, dovecot and roundcube, I am following the official documentation. I have set up separate servers for intranet and internet emails as well as set up ...
- 133
-2
votes
2
answers
81
views
Can Cellebrite be used to access any phone by the government? What is the point of encryption if they can get into any phone?
I'm currently studying forensics, and one thing that keeps coming up is the authorities breaking into phones.
There are several third party tools they can use, but one of the most popular is '...
1
vote
0
answers
56
views
Can an email trace be maliciously removed by an admin on a default Outlook setup?
I'm doing some research into email servers and how they work.
There is a function in Outlook 365 where an admin can perform several traces on emails for the past 90 days. For example, an 'enhanced ...
0
votes
0
answers
47
views
Secure boot disabled for Potential BIOS compromise on Tails OS machine
I have an ASUS computer that I use strictly for booting Tails OS from a USB. A few weeks ago I went into the BIOS and noticed that secure boot was disabled.
This computer has secure boot enabled by ...
1
vote
2
answers
49
views
Is it safe to keep a JDBC SQLite URI in source code?
If I commit the name of SQLite database in the JDBC SQLite URI in the source code like below, is it possible for an attacker to exploit the URI?
Should I replace the name of the SQLite db with code to ...
- 111
0
votes
0
answers
28
views
should I redirect user to login screen after validate email and set password?
I'm working on authentication on the backend of an application and I want to know which of the following methods is the best.
after the user registers in the application an email is sent to his email ...
- 101
0
votes
0
answers
32
views
Potential XSS bug in email form?
I have a invite users via email form on my website and I was wondering if this could be a potential XSS flaw?
I captured the request via Burp, and this is how it looks:
Input:
{
"toEnvWithEmail&...
0
votes
0
answers
14
views
Documentation on mobile-webview.gmail.com link masking?
Several google products (mainly Gmail) masks links using a fake-dns mobile-webview.gmail.com
That domain doesn't resolve anywhere, not even Google's own NS https://dnschecker.org/#A/mobile-webview....
- 213
0
votes
0
answers
60
views
How to prevent public key tampering
I have to store a document (e.g. a JSON file) on a remote PC (that my App is running on) alongside a signature to be able to verify that this file was signed by me. I have no access to this PC nor ...
- 1
3
votes
1
answer
72
views
Format string vulnerability in Java?
Can a non-sanitized user input result in a vulnerability if passed to System.out.printf (Or any equivalent function that takes a format)?
Example:
public class Demo {
public static void main(...
- 33
1
vote
0
answers
38
views
CrypTool - How to determine what type of encryption has been used?
I have a few questions about CrypTool.
How can you use the text analysis tools available in CrypTool to determine the encryption algorithm for a given ciphertext?
How can you use CrypTool's text ...
- 11
0
votes
1
answer
58
views
Is This Perfect Forward Secrecy?
I have a textbook that contains the following problem:
In practice, one master key, KM, is exchanged in a secure way (e.g. Diffie-Hellman key exchange) between the involved parties. Afterwards, ...
- 101
1
vote
1
answer
46
views
Anything I can do to combat malicious domains?
On Facebook, malware is currently trying to spread itself using the domain googlediver (dot) com, one sample of a malicious url is https://googlediver (dot) com/list-of-traveling-staff , and I believe ...
- 573
0
votes
1
answer
34
views
Can you retrieve messages from instagram or messenger off of a SIM card?
Can you retrieve personal information ie; messages from browsers, off of a SIM card?
1
vote
2
answers
72
views
Do predictable bank account numbers pose a vulnerability?
Let's say my significant other and I go to the bank to open our accounts and our account numbers end up 14682-4 and 14683-5. They are clearly sequential. Can this detail be used in any sort of attack?
- 113
0
votes
2
answers
43
views
Is using TOTP from Authenticator app on a mobile device instead of passwords inherently 2FA?
A related discussion can be found, specifically addressing the security implications of using only TOTP for single-factor authentication However, in my view, using a TOTP code from a Google ...
1
vote
1
answer
43
views
Are JWT's needed when implementing passwordless magic link authentication?
I'm working on a web application where a user gains access by clicking on a magic link sent to them by an internal co-worker. Upon clicking this link, the user is automatically authenticated and a ...
0
votes
0
answers
20
views
How to crack luks crypto 2, encryption? [closed]
I recently forgot my phrase to unlock my laptop which i bought a new one several month's ago i needed some document then suddenly i can't remember the password, can anyone help!!!
Note: I tried ...
- 1
0
votes
0
answers
34
views
YubiKey Bio for SSH login: Do I have to reauthenticate?
I'd like to use YubiKey Bio for SSH-logins. I'm wondering how often I have to show my fingerprint for authentication when I start new sessions. What's the interval? If I start a new session every 5 ...
- 101
0
votes
0
answers
25
views
When using a VPN is the device DNS cache still written to? [duplicate]
When I am using ProtonVPN, does the VPN server run DNS resolution upon receiving the request, similar to a Tor exit node, thereby bypassing the device's DNS cache?
Or do my browser's DNS queries still ...
- 101
0
votes
0
answers
45
views
Difference between running executable from disk vs removable media
I came across a strange group policy setup once and was wondering if anyone can make sense of it. We were NOT allowed to run executables that were stored on the local disk or network drives, but we ...
- 61
0
votes
0
answers
39
views
Web application rate limiting, IP blocking using different cellular networks [closed]
While testing a web application for rate limiting and IP blocking I noticed the following:
while using 4g through a GSM service provider, the server is blocking me after 300 requests
while using lte ...
0
votes
1
answer
49
views
wireshark captures vpn tun0 smtp as unencrypted, why?
I am trying to learn more about cryptography and am stumped, i dont know what direction to move to even research an answer myself so would appreciate any input.
I have a vpn set up to an adapter, tun0,...
0
votes
1
answer
59
views
How to safely download files from Telegram using Sandboxie?
I need to download certain files from Telegram. It is mostly images and videos. I am aware that even this kind of files can contain malicious code, so I want to be 100% safe. (The files usually ...
- 103
1
vote
0
answers
31
views
How GitHub Advisory assigns vulnerabilities to same components coming from different package managers?
I am trying to understand how GitHub Advisory filters vulnerabilities, particularly in the context of Bootstrap 3.3.7. In the National Vulnerability Database (NVD), the following vulnerabilities are ...
- 11
0
votes
1
answer
87
views
Is Using an Authenticator App on the Same Device as the Passwordless Application a True 2FA?
I am building an application that a user can receive an access to by an internal worker. This works using a magic link, where the user will receive a one time link to authenticate in the app. Now I ...
0
votes
0
answers
55
views
RSA vs Shor's Algorithm/Fast Factoring — Server Credentials & MITM
I've watched a lot of videos on Shor's Algorithm and Quantum Computers. Most of these videos say these two things undermine RSA via fast-factoring, but they never really explain how fast-factoring is ...
- 1
0
votes
0
answers
11
views
Webauthn: Access control for the public key credential uploaded by the user's device
I'm experimenting with adding passkeys to Drupal.
I'm using webauthn-lib 4.7.
When registering a passkey, the device generates a Public Key Credential, which is then sent to the server as stringified ...
- 101
0
votes
0
answers
6
views
VPN over VPN using Amazon EC2 instance [migrated]
I have a OpenVPN configuration file for TryHackMe that I need to connect to. However, I also need to connect to another OpenVPN Access Server hosted on an Amazon AWS EC2 instance. Is there a way that ...
0
votes
0
answers
25
views
How do I create a certificate with subject containing Octet string?
I need to create a certificate with:
subject.attribute1: 2.5.4.3 {Common Name} UTF8String
subject.attribute2: 2.5.4.92 {tagAFI} OCTET STRING
subject.attribute3: 0.9.2342.1920.0300.100.1.1 {userId} ...
0
votes
0
answers
35
views
any group to inspect txt attachments? [closed]
I received a sketchy email with a text file. I'd like to know if there's a group that enjoys investigating files and let me know who/what group sent it or if I should reset my computer. I used to live ...
0
votes
0
answers
14
views
Double-factor auth to unlock iPhone in general and, especially, Passwords app in particular? [migrated]
Is it possible to make iPhone require both FaceID and passcode when unlocking the device?
Especially Passwords app is guilty of relying solely on FaceID to pull up a password for a website or an app. ...
- 101
-1
votes
0
answers
38
views
Looking for tips on hiring malware consultant - suspected repeated android compromise [closed]
I very strongly suspect that my devices (phones, but possibly also home pcs and work network) have been hacked repeatedly by the same person. I am trying to hire a consultant that can help me look for ...
- 1
0
votes
0
answers
45
views
How to include TLS-unique value in CSR?
I'm using a GlobalSign EST Go library that provides an implementation of the RFC 7030 (EST).
So far doesn't provide any function to generate a CSR at runtime and therefore include the TLS-unique value ...
- 1
0
votes
0
answers
34
views
Disabling UAC (Windows 10) for Administrator accounts
To help improve the user experience on admin workstations, would it be ok to disable the UAC or maybe set it with a more permissive mode?
0
votes
0
answers
62
views
Are 2FA browser plugins sufficiently secure?
Regarding 2FA browser plugins, I follow the uneducated opinion that they usually provide sufficient security. Since a desktop computer is a unique device (even a virtual machine) and provides that ...
- 101
0
votes
0
answers
40
views
How to restore health of an hacked router(fritzbox)?
My fritz!box 5530 has been hacked.
I know this because the upload is always very low under 10 mb/s also if my fiber connection would to be 1gb/s|300mb/s.
And when you try router reset to factory ...
0
votes
3
answers
90
views
Over-Optimizing Security? Storing Encrypted Data on a Server While Private Key Remains With User
Assume that I have a server storing sensitive user information (think medical records). I want this data to be encrypted on my server at almost all times. Only when a doctor needs to access the data ...
