0
votes
0answers
6 views

Replacing files with infected files on anonymous ftp server

I am creating a new question as i now have another question which was raised from a previous answered question post. What im trying to figure out is would this scenario be possible. I have an ...
0
votes
1answer
6 views

How to properly hash a key? big vs small digest

We have to roll (decommission) database access keys often, but it's important to know which key each system is using in order to avoid removing a key in use thus creating unavailability. We want each ...
0
votes
1answer
2 views

NTRUEncrypt in SSL and GPG encryption

Commonly used cryptosystems like RSA or ECC, on the other hand, will be broken if and when quantum computers become available. - https://tbuktu.github.io/ntru/ How can we introduce NTRU in GPG ...
1
vote
1answer
6 views

Always setgroups before setuid?

On GNU/Linux systems that are build using RPM packages, the rpmlint utility complains about programs that don't call setgroups before setuid. The idea is that before dropping privileges, a process ...
2
votes
1answer
9 views

Single Page Application with REST API backend based on XML, queried by dynamic XPath

A web application I'm developing will be a Single Page Application (SPA) that will interact with a REST API backend, through jQuery.ajax() calls. The SPA and API will both be served over an https/TLS ...
0
votes
0answers
14 views

Raspberry Pi IDS/FireWall - Should I?

I was excited to setup an IDS/FireWall with my new Raspberry Pi on a standard home network. Reading threats to SSH and Linux, now I am not so sure. Setup by an experienced amateur I'm now concerned ...
0
votes
2answers
23 views

My cellphone is infected, and it keeps coming back

Please bear with me as English is not my native language My Android smartphone downloads apps automatically without any interaction. Generally the apps are known but some are unknown apps. I can only ...
-2
votes
0answers
23 views

Why mobile app developers don't encrypt the user data?

I have been wondering why mobile applications don't actually encrypt the user data and only use SSL or certificate pinning? Otherwise MITM attack or tools that help bypass certificate pinning can be ...
2
votes
0answers
28 views

Why more Android applications (compared to iOS) use certificate pinning?

I used mitmproxy to test the same 50 apps on iOS and Android and noticed that more than 50% of the Android applications compared to 23% of iOS, used certificate pinning. Is there any explanation as ...
1
vote
1answer
13 views

Why mobile applications share device characteristics with third parties?

It is known that mobile applications can share with third parties many different types of data from information about the device to search terms used in the application. I understand that search ...
0
votes
1answer
31 views

Why does Sidekick say that my boyfriend who emails me from Malaysia is in the US?

I am emailing my boyfriend. He is working in Malaysia right now. I use Sidekick for all my emails. He always opens them by his computer and that does not tell me his location. One time he opened ...
-1
votes
0answers
40 views

What size key does Capital One use for its symmetric and asymmetric encryption?

I looked on their site but couldn't find anything. I'm trying to get a general idea of what different banks use in to encrypt and decrypt their data, but it's hard to find the information.
0
votes
0answers
5 views

Disable ssh logins with weak passwords [migrated]

Imagine an insane Debian server administrator, that added users with a weak password for a start and a hint, that they have to change it on the first login. Now that he uses secure passwords only, is ...
4
votes
3answers
277 views

What are the alternatives to door passcodes?

Passwords have been a problem since the dawn of computing. They tend to be either so complex that no one can remember them, or so obvious that anyone could guess them. ... Some users ...
-4
votes
0answers
76 views

Can someone help me dissect this virus? [on hold]

It's a well known virus found on USB sticks, where it will hide the data in the pendrive and creates a shortcut of the pendrive inside pendrive. Plug this into any other computer, and the virus ...
0
votes
1answer
32 views

Are Windows Superseding Patches not fully securing my systems?

I have completed a Nessus vulnerability scan of a Windows system. The scan is indicating that some windows patches are missing, but the patches are superseded patches and the most recent version of ...
1
vote
0answers
32 views

Is it possible to identify the source of message in whatsapp?

Is it possible to identify the real source of message in whatsapp? Scenario : Texting whatsapp message to a group,one of the group member forwards it to another and it goes on atlast one day it ...
2
votes
1answer
16 views

Sending non-expiring access token on each request vs using refresh tokens?

When securing REST APIs for mobile applications, what you often see is the use of refresh tokens. They exist because: Access Tokens have expiration date. We don't want the user to have to enter his ...
0
votes
2answers
47 views

Pros and cons of password policy filtering common weak passwords? [duplicate]

We all know the basics "password rules" when a user register on a website, such as: more than 8 characters, must contain an upper case letter, must contain numbers and so on Why don't websites ...
1
vote
1answer
56 views

Is it possible to use the Linux “echo” command maliciously?

While testing a web application today, I came across a function that passed arguments to dig in linux terminal. After some fiddling about I was able to pass the echo command using pipes and echo my ...
8
votes
2answers
1k views

Is it possible to transfer a virus through browser video?

I know that there is already a question related to viruses in videos, but the implication in the other question is that videos in question have been downloaded and played by media software on the ...
0
votes
2answers
104 views

Sniffing WhatsApp chat using Wireshark

Suppose two persons are using WhatsApp on Android. How can I see the communication between them if I have Wireshark running on a PC listening on network interface card? I know the communication ...
0
votes
0answers
16 views

Securing several Servers (Certificates)

I got a Question regarding Certificates. We got a situation, where only "Server 4" and its clients are given in the picture above. That Server4 (SLES11) and its Clients are using a self signed ...
1
vote
0answers
37 views

Which is the correct algorithm while checksumming a portion of code?

As part of my research, I came across a technique in a paper which applies checksumming on a portion of code. I want to implement it. Here is the research paper which talks about the checksumming ...
14
votes
3answers
2k views

Can .wmv files be used as viruses against VLC on Linux?

I was stupid and did not check a video file I downloaded from an untrustworthy source. It was .wmv file with no readable properties of the video. I know that .wmv videos can download viruses. What I ...
3
votes
1answer
139 views

Why does my SHA256 certificate get encrypted with 168 bit 3DES?

We use S/Mime certificates for internal emails within our company. The certificates signature algorithm are all SHA256RSA with a hash of SHA256. I have confirmed the public keys are RSA(2048bits). ...
1
vote
0answers
24 views

Snort false positive, yet suspicious

I have Snort installed and tuned nicely with ET Rules on my pfSense, both my pfSense and the modem are using Googles public DNS 8.8.8.8. Recently I was denied access to google.com, and by reviewing ...
1
vote
0answers
22 views

How to increase security for my OpenVPN clients?

The idea is simple, I want to increase security on the client-side. Beside the encryption, I'd like to keep them away from malicious websites/files. I had in my mind ClamAV and maybe HAVP, but at the ...
0
votes
0answers
8 views

Can 125Khz RFID reader communicate with Hitag chips [on hold]

I have a question which is quite simple, can a standard EM4100, EM4305, T5577 RFID reader (such as an arduino shield or a USB/serial) communicate with a Hitag key ? (assuming the reader has write ...
2
votes
1answer
42 views

Is there a security risk in using pointers instead of struct instances?

Recently during a code review, a senior developer asked me to replace a pointer with structure instance in a utility method. He asked me to do so for security purpose. One reason that I could think of ...
-2
votes
1answer
39 views

I am investigating the physical access control system weakness [on hold]

physical access control system -> Biometrics, RFID system, digital door lock I am investigating the weaknesses of physical access control systems. I need a newspaper article that a malicious person ...
0
votes
2answers
22 views

What are some metrics to be used to evaluate SaaS security?

Some examples: static code analysis (Fortify) code coverage (bugs being a potential source of vulnerabilities) others?
1
vote
2answers
19 views

How to rank the security strength of a cloud SaaS app

If my manager asked me to rank how secure/vulnerable our SaaS system is, what methods are available to do so? I know there are certifications available but I'm looking for something which can be ...
2
votes
0answers
48 views

How to securely delete full vm

We have a Windows 7 virtual machine on VMware Workstation 11. The VM is now encrypted (using Workstation) but wasn’t always. The VM has confidential information on it and as we no longer need it, we ...
1
vote
1answer
44 views

Virus/Trojan attached to GnuPG encrypted file

Is it possible to infect a file encrypted using GnuPG? For example, if I had an encrypted file on an unsecured public ftp server, would someone be able to copy that file and attach a virus/trojan ...
1
vote
2answers
107 views

Why won't Firefox accept my certificate?

I've been trying to get stunnel to work with my signed certificate (with a CA that I've trusted in Firefox). The error is: 127.0.0.1:5559 uses an invalid security certificate. The certificate is ...
-5
votes
2answers
47 views

Noob to tor/tails/darknet…forgot to disable Javascript. What to do now?

I am a noob as stated in title. I didn't know how to disable Javascript before visiting some not-so-legit sites. So what can I do? I was using tor, I know this is not enough so I have tails ring a ...
-4
votes
2answers
84 views

TV and audio hacking

I have been stalked now for over a year. I think they are doing it over the DirectTV because they can hear me and I can hear them. Is it possible they are recording me like a movie live through ...
0
votes
0answers
19 views

Extremely slow GnuPG 2.x Performance [migrated]

I have an curious problem with my script. The script runs very fast ,when i use GnuPG 1.x. With GnuPG 2.x it runs very slow at encryption/decryption, and i have no idea why. Versions: GnuPG 1.4.20-6 ...
2
votes
1answer
83 views

What is the difference between a digital signature and whole message encryption?

I am newbie in information security I am trying to understand the difference between a digital signature and encryption of a message. Lets consider simple example of email message. I understand how ...
-9
votes
0answers
25 views

c# code to reset password in ms word document [on hold]

am doing my final year project to develop a software that will enable to recover the password in ms office document in-case people forgot, die or quite a job in certain organization. ANYONE WITH IDEA ...
1
vote
1answer
21 views

Is there a secure method of distributing keys to network-booted diskless nodes?

I have a bit of an 'initial trust' issue. We are using CoreOS to run Kubernetes, and secure both the etcd API and the Kubernetes API servers using client certificates. We are using iPXE to boot ...
-2
votes
2answers
37 views

Can someone know that I'm using a VPN if they have my MAC address? [duplicate]

My university has a web filter, so I use a VPN to access blocked sites. They also have my MAC address. Can they identify that I'm using a VPN and what I'm doing on the internet?
5
votes
0answers
41 views

Prevent keyloggers on Linux?

Are there any mechanisms in the Linux desktop architecture to prevent malicious software keyloggers? What would be an ideal Linux setup to make it very difficult for an attacker to install a keylogger ...
1
vote
1answer
63 views

Doesn't this make 2FA irrelevant and possibly dangerous?

Article. One sentence summary: they use a smartphone as a listening device to compromise computer security. I know our bank doesn't allow us to take cell phones in at all, even if they're completely ...
0
votes
1answer
33 views

Is moving data between devices on an SD Card safer than a USB stick?

From the perspective of USB device-born malware/exploits, especially affecting firmware (e.g., can an infected computer reprogram an inserted USB memory stick to act like a keyboard and autotype ...
2
votes
1answer
34 views

How and why does case insensitive XSS work, given that JavaScript is case sensitive?

I found a lot of instances where XSS scripts like the following work: <iMg SrC=x OnErRoR=window.location=123> Given that JavaScript is a case sensitive language, how is the browser able to ...
2
votes
1answer
66 views

Is storing passwords encrypted with GnuPGP on an anonymous FTP server safe?

I would like some advice on a method of storing passwords to a database on my anonymous FTP server. Basically I have login details for a few trusted users to a database server stored in a text file ...
1
vote
1answer
18 views

Using external OAauth Authentication Service, how to manage the users's relations

I'm trying to create an API and a website client for it. Lately I've been reading a lot about OAuth2 as a security mechanism and companies that offers authentication as a service such as auth0.com or ...
1
vote
0answers
30 views

How to “stealthily” call a Java function to avoid text search?

Assume I am an attacker, I want to call an API function from an Android app, say Build.getRadioVersion(). But I want to keep this call stealthy, i.e., it cannot be searched through, e.g., grep ...

15 30 50 per page