All Questions
0
votes
0answers
1 views
VeraCrypt/TruCrypt - I can't understand why you'd want to create a “hidden” volume…?
I can't think of a reason as to why you'd want to create a hidden volume in VeraCrypt. It says because "you may be asked to hand the information," but why would I need to hand it over? Nobody has any ...
0
votes
0answers
2 views
Two keys in ~/.ssh directory
I originally had a DSA public key in my ~/.ssh directory on my server id_dsa.pub. The corresponding private key id_dsa is stored on my local machine.
I then generated an RSA key pair directly inside ...
0
votes
1answer
9 views
Does Google hand over captcha IPs to webmasters?
Google gets to know a user's IP when someone enters a captcha even if they are using tor (see http://www.wired.com/2014/12/google-one-click-recaptcha/). So, If I go to a non-google website, such as ...
0
votes
0answers
14 views
PHP strpos and strlen Bypass
This is from a CTF event that has ended, but a writeup has not been done for it yet, and I'm quite curious as to how it would be done.
With this code:
$a = $_GET["pl"];
if(isset($a)) {
...
1
vote
0answers
5 views
Can a Radius server mitigate an ARP spoofing attack?
I'm helping my school network administrator to try to find a way to mitigate a current ARP spoofing attack on our wifi network. We detected an unknown host (MAC address seem to change, he is probably ...
1
vote
1answer
15 views
Asking questions randomly from a set of questions instead of a password?
I was thinking about this for a while. Say we have an app for which there is an admin console, and we need to provide access to the admin console over the browser (yes, HTTPS).
For authentication, ...
3
votes
0answers
11 views
How to safely display html emails like gmail does it?
I'm building a webmail, which must be able to display html emails. But how to prevent xss and similiar attacks, while not loosing html formatting?
In gmail, when I receive some emails from, lets say, ...
0
votes
0answers
2 views
OSX Yosemite and Security/Privacy
I currently have a Macbook Pro running OSX Mavericks, being the skeptic that I am I always wait a bit before upgrading to 'new' OS versions when they are released to see how they fare both stability ...
1
vote
1answer
9 views
Certificate pinning and the key distribution problem
I (think I) understand the concept of certificate pinning. However, I'm wondering if, in the worst-case scenario: is certificate pinning any more secure than the hierarchical trust model it is built ...
-1
votes
0answers
6 views
VA Scan for Linux server Running with Apache and SQL [on hold]
I want to do VA for Ubuntu server installed with Apache and SQL.
Which open source tool you recommend?
1
vote
1answer
26 views
Is it possible to dump an exe from ram and create a distributable exe from it?
Is it possible to dump the ram and get an exe and use that ram dump to distribute an app? If so, is this something that is a practical concern and if so how best should a developer protect against it?
...
0
votes
1answer
17 views
Protecting the root ca bundle
Applications (e.g. Firefox) often include a root ca bundle file containing trusted certificates.
How can I protect those files from malicious agents trying to modify them? I think signing is not an ...
3
votes
1answer
248 views
Why are buffer overflows executed in the direction they are?
I'm following The Security Tube’s video here.
He overviews buffer overflows, and mentions how memory is executed from highest to lowest in the stack (at least with his implementation I assume). So we ...
1
vote
0answers
11 views
Vega Scanner Took Website offline? [on hold]
I used the Subgraph Vega scanner to scan a website, I wanted to get any linked social media pages from their site. Anyway soon into the scan the page went offline with a 404. I checked with different ...
0
votes
1answer
9 views
PHP and other files on the server, their visibility and access [on hold]
Let's say I would like to protect my PHP files that are on the public server and are used as a part of the website. Does anyone can easily access these files just like HTML/JS/CSS files through ...
-3
votes
0answers
21 views
reusing old bank issued security device
i have several security devices issued by banks and wondering if there is any way to reuse, reprogram or repurpose to use with more contemporary services such as lastpass and / or google authenticate? ...
1
vote
1answer
16 views
Downloading and updating the software via Playstore
I'm using android play store to download and update software for my phone. And some times its automatically updated as by settings.The play store is linked to one of my Gmail account.
Here my question ...
-5
votes
0answers
25 views
how to decode this license file [on hold]
I need to decode a license file so I can make mi own license for other users.
The string look like this:
oAZNM3RSIFR4TUaPRhoYL+1bcAvd8vS5xIWFrZF4omtI2EDMWfLCrmN/ldwvzI9HLU6KGN98rlnpn/
...
0
votes
0answers
35 views
Full key space coverage when generating a rainbow table
Many rainbow tables available online have different tables for various character sets and lengths. Are tables like these usually completely exhaustive for those character sets/lengths?
For such a ...
-5
votes
0answers
27 views
Which is best secure public DNS server for free [on hold]
Which is best secure public DNS server for free.
5
votes
3answers
119 views
Looking for credit card data and other PII in files
I'm looking for ways to check for the presence of credit-card data and other personally identifiable information in files on a network I'm testing.
Currently i'm doing this manually with the usual ...
-1
votes
0answers
16 views
How to identify the script that's sending spam from my server? [on hold]
So, this is what I wanna know. How do I identify the script that is sending spam from my server?. Server is using exim. Maldet scanning did not help much. Any advises ?
1
vote
2answers
35 views
Should a password ever be presented in plain text to a user (On a website)? Is this illegal under UK Data protections act? [on hold]
There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins.
...
2
votes
3answers
36 views
Is it good practice to let Node/Go/… act as a frontend webserver?
I'm used to writing web stuff in PHP and let Apache or nginx handle the actual HTTP handling and load my code via whatever means (mod_php, fcgi, fpm, ...). I'm under the impression that this is a ...
1
vote
0answers
14 views
Will this code run in real machine or is it some kind of Anti Reversing code? [migrated]
I am reversing a file which is not running properly in Vmware.The code from the AEP is as shown below :
POP EDI ; value of edi is 0x7C816D4F kernel32.7C816D4F
PUSH EAX ;value of eax is 0
INC ...
4
votes
4answers
61 views
What's to stop someone from just MITMing a checksum?
A lot of sites offer MD5 or SHA sums to verify the validity of your download, but why do some things rely almost entirely on this?
Is there anything in place to prevent people from just replacing ...
4
votes
2answers
30 views
Is hashing schema information for client when generating SQL queries more secure?
I'm planning to implement a web system wherein APIs and presentation for CRUD in data tables are automatically generated, like that in phpMyAdmin. How I plan to implement this is to construct SQL ...
-2
votes
0answers
19 views
Access encrypted hard drive with password login [on hold]
I was doing an anti-virus scan and there was a .ecryptfs file that the scan would always get stuck on even for days, that is because it was encrypted file. Somehow I managed to disable the function of ...
-3
votes
0answers
18 views
New case, audio not detected [on hold]
As the title says, I moved to a nzxt phantom case and now my audio say's "Not detected"
I've tried reformatting and reinstalling drivers, no help.
First person who helps me gets paypal dollars.
3
votes
3answers
285 views
Can this modified 'Many' Time Pad be made 'stronger' by using an extrememly long key?
Starting with a one time pad say you want to encrypt some small strings like the words in this sentence but you want to reuse the same OTP key for each string so that when you encounter the same word ...
2
votes
1answer
30 views
Can you steal session cookie with BREACH attack?
Most of the discussions about the BREACH vulnerability are around stealing session-based CSRF tokens. But if you can steal a session-based token, could you also steal the session token itself? ...
0
votes
0answers
17 views
No VirtualHost filter (a good practice?) [migrated]
I am trying to figure out the cons of a current setup and discovered a potential anomaly. There's a webpage hosted at (say) webpage.com. If I point my domain (say) mydomain.com to the raw IP of ...
-5
votes
0answers
42 views
Link to more active security sites? [on hold]
I have a BS/MS in Computer Science and have worked as a developer for 15 years. Currently I have been reading a lot about computer security.
Serverfault and Stackoverflow seem to be the go to place ...
0
votes
0answers
34 views
How can I encrypt in the column level of SQL for numeric data [on hold]
I want to encryption in the column level of SQL for numeric data.What should I do?Is there an algorithm for this? Where should I put the function of encrypting in the source code?
-2
votes
0answers
57 views
Am I a victim of industrial espionage? [on hold]
I had a weird experience, that I don't quite know how to explain.
My setup is this:
I have my desktop machine, which I connect to my company's VPN. On this machine I also run a VirtualBox VM with ...
1
vote
1answer
32 views
Using a Cryptovariable with an API Designed for Human-Generated Passwords
I'm working with a vendor who provides an API with a user registration method clearly designed for human-generated passwords. We're calling the API in an offline server-to-server fashion, however, ...
0
votes
1answer
23 views
Acceptable secure solution to replace static IP addresses for a web application
I am currently working as a technical lead on a project at a financial institution and have a question about how to provide the same level of security expected by the business in an application we are ...
4
votes
2answers
80 views
Shop saves credit card data from guest orders
A web shop allows customers to order as guest or to create an account.
I ordered as guest, entered my email address and the shipping address, and payed per credit card (I had to enter the security ...
-1
votes
1answer
15 views
combining imperfect random number generators for shuffling an array
Shuffling an array to create a random stream for encryption is well known. The weakness is in the security of the random number generator that performs the shuffling. But is it true or likely that the ...
-1
votes
0answers
26 views
How Does AES Encryption Work? [on hold]
I'm looking for conceptual but semi-detailed step by step explanation of the AES encryption process, from plain text to encrypted text. The explanation should assume knowledge of basic programming ...
0
votes
0answers
15 views
What else can we now do with the new GCC5 to improve codebase hardening [on hold]
Noting the recent question: What is the most hardened set of options for GCC compiling C/C++?
Is there anything else that can be shared regarding the new version of GCC, v5 for 32/64bit targets.
I'd ...
0
votes
2answers
51 views
Is it possible to take back the control from an MITM in progress? [on hold]
I heard that MITM also involves DNS poisoning, which basically tells the Net
to take a different route than it was supposed to go..
(I'm not sure if my interpretation is correct..)
Given there is an ...
2
votes
1answer
29 views
Ability to determine which PGP public keys a message has been encrypted for?
Is it possible to determine, given a PGP message that you can already decrypt, to determine which other PGP keys that message has also been encrypted for?
0
votes
1answer
15 views
Would an IM app server holding user's messages long after the content was delivered be an issue of personal data protection? [on hold]
Take a IM app like WhatsApp. If I send a message to another user while their client is offline, the server holds the message and then delivers it when the receiver's client goes online. It even has ...
2
votes
1answer
19 views
Security of reading articles via an RSS reader
Would a site or blog owner know who is reading their site if the visitor is reading it with an RSS reader? Can they get the IP of the person? Say I had a Netvibes account with RSS feeds, can the site ...
0
votes
0answers
21 views
antivirus/anti-malware vs rootkits on Windows [on hold]
As I read about rootkits I wonder how well the current antivirus vendors are with detecting them. Does anyone know of a site with a current comparison test? For example, this ...
0
votes
0answers
36 views
someone attack my wireless [on hold]
02/27/2015 15:30:03 sending ACK to 192.168.2.3
02/27/2015 15:26:11 sending OFFER to 192.168.2.2
02/27/2015 15:25:10 sending OFFER to 192.168.2.2
02/27/2015 15:25:10 sending ACK to 192.168.2.3
...
0
votes
0answers
23 views
Choosing a SSL Certificate Issuer [duplicate]
I am going to buy a new ssl certificate that supports SHA2 algorithm for our web services. Web services will be used by variaous java clients written in java6, java7 and java8.
We have got a ssl ...
8
votes
2answers
659 views
Question About HTTPS Security [duplicate]
I recently read about how HTTPS work and I have some questions to clarify. Pardon me if this sounds silly but I just need to get this clear. Correct me if I am wrong.
I got to know that as part of ...
1
vote
0answers
26 views
Imported CA certificate to Firefox Browser not working [migrated]
I created Certificate Authority (CA) according to Ubuntu help using openssl. After creating a certificate for Apache2 and adding to certificate to it, I want to import it in Firefox. In the end of ...
