-1
votes
0answers
8 views

Onion Network Security

I was wondering if it would be more secure and reliable to create this system: First of all, I have a customised web browser with two generated private RSA keys. The first public key is sent to a ...
2
votes
1answer
21 views

What are the privacy and security risks associated with Intel's Management Engine and AMD's Platform Security Processor?

And also as an everyday user who mostly just surfs the web, are these risks a huge concern for me? Edit: Also on the similar note, are there any substantial evidences of Intel or AMD purposely ...
2
votes
1answer
25 views

Does “Certificate Authority” refer to the organization or the software?

Does the term "certificate authority" refer to the organization issuing certificates (symantec, comodo, let's encrypt, ...) or to the device and software that issues certificates from CSRs or both?
-2
votes
1answer
30 views

As a virus can use my system or browser to send spam?

I wanted to know and what is the method that a malicious person who created the possible virus uses to email people without them knowing? Do they steal credentials or use some kind of language system ...
0
votes
0answers
9 views

How to use single Tor node as proxy?

I would just like to bypass a geo check (don't care about privacy) on some website. Is it possible to use a single Tor (exit) node as a proxy? (I am hoping to set up a 1 hop Tor connection to have a ...
1
vote
0answers
13 views

If a HSM RNG is FIPS 140-2 compliant, does that imply FIPS 186-2 compliance also?

If the RNG of an HSM is said to be compliant to FIPS 140-2 (approved DRBG - SP 800-90 CTR mode) does also imply that it is compliant to FIPS 186-2?
1
vote
1answer
32 views

USB flash drive is write protected

I have this flash drive that I grabbed from work that has a few files on it I would like to delete. It is a 32GB flash drive and when trying to delete the data I get this error message: "This ...
2
votes
0answers
10 views

Is a Kerberos ticket valid with only one-way external trust between domains?

The situation is that I have two domains (Domain A and Domain B) that live on separate networks. I need to allow users in B to be authenticated with integrated windows authentication (IWA) when they ...
3
votes
0answers
141 views

My friend was fired from her job. Overnight, on her personal phone all her work contacts mysteriously disappeared

As the title stated. My friend personal email is connected to her personal phone. She works on the iPad and her work iPad is connected to her work email. She never checked her personal email on her ...
0
votes
0answers
47 views

Securing data with three USB drives problem

Here is a problem. There is a single piece of sensitive data, which is subject to update and invalidate previous non-updated copies (think of password-protected Bitcoin Core wallet.dat). There are ...
0
votes
1answer
34 views

Acquire new permission after installing an Android application

I would like to know if there is an attack that allows an installed Android application to acquire further permission that is not assigned initially during installation. I did some research and found ...
23
votes
8answers
3k views

Hosting company advised us to avoid PHP for security reasons. Are they right?

I'm doing a redesign for a client who's understandably concerned about security after having been hacked in the past. I had initially suggested using a simple PHP include for header and footer ...
-3
votes
1answer
91 views

How to get secure hashing software?

I am searching for an open source hash calculator that I can download to verify my Tails .iso image, but I also want to be able to to calculate some password hashes with a sha512 hash (which is why I ...
1
vote
1answer
34 views

Is it possible to lock down the http / https proxy settings on an iPhone?

Is there any way to lock down the proxy settings on an iPhone so that they can't be changed by anyone but the person with the password?
-1
votes
1answer
36 views

Brute force symmetric knowing asymmetric

Lets say message A is encrypted with symmetric encryption. BUT before encrypting the message, it is asymmetrically encrypted (let's say to implement VPN ...). Now if a man in the middle captures the ...
7
votes
4answers
1k views

How to store data that the computer can read but not the user?

In the TV series The Office, Dwight says he uses a diary to keep secrets from his computer. I'm wondering if the opposite is possible: can my computer create a file that it can read but I can't? I ...
1
vote
0answers
23 views

Is it a security risk when abuse mail is rejected?

When inspecting the DNS configuration for example with dnsinspect.com, the following shows up sometimes (note I used example.com): Accepts Abuse Address WARNING: Found mail servers which are not ...
1
vote
1answer
42 views

Is it realistic for a script kiddie to remotely hack into a jailbroken iPhone?

If my iPhone was jailbroken and I plugged it into a computer controlled by the hacker, unlocked the phone, and clicked "trust this computer" to share photos with it, would it be realistic for a ...
1
vote
2answers
44 views

What would it take to scan a PDF for questionable content in addition to malware?

My company is trying to implement a new feature on our site to let customers load documents accompanying an order. We know that we will need to perform some kind of malware scan by calling out to a ...
-1
votes
0answers
21 views

Topic for research and project

I have just started my 3rd year of engineering and a professor from my department has said me to start looking for a topic for my research paper and project. I was wondering to publish a research ...
1
vote
1answer
25 views

Is it possible to filter internet access on a mobile phone with a 3/4G connection with a proxy server?

If you were to put a pfSense Squid Proxy Server with Squid Guardian on a DMZ and then point a cellphone with a 3/4G connection at it for SSL and HTTP with a self-signed CA certificate installed on it; ...
2
votes
2answers
46 views

Using a hash in place of user data

I'm storing client data and they are sensitive about privacy and security of the data. In some cases, I don't need the actual data, but could work with a hash of the data. For example, in the case of ...
3
votes
0answers
62 views

Is dereferencing a null pointer in C a security risk if the program isn’t a daemon, but a small script lauched as a separate process for each request?

The following code is part of a program that is spawned at every request by the nginx’s ruby on rails script : static void time_t_to_dos_time(time_t user_supplied_time_t, int *dos_date, int *dos_time)...
0
votes
2answers
43 views

Remember me vs. persistent session for web applications

This question is intended to gather information about what the specific security advantages/disadvantages are to using a "remember me" function for an online web site relying on sessions compared with ...
2
votes
1answer
22 views

What is the expiration time threshold below which LetsEncrypt certificates will auto-renew?

I have a few domains on some server, all certified by LetsEncrypt certificates. The certificate is due to expire in 11 days, on July 9th. However, when I try to renew using /opt/letsencrypt/...
1
vote
0answers
58 views

Obfuscated PHP code found in WordPress core files and plugins

I am running a Wordpress website and I've recently found this php code injected in many of my php files. https://www.unphp.net/decode/fb4715ee71b28135f6807389df42611c/ I tried adding some print_r(...
9
votes
2answers
1k views

Does the amount of bandwith available on a network determine how strong a DoS attack should be?

I might have got the wrong end of the stick here but is it down to bandwith which determines how many packets a router or server can handle before the server is over ran and then goes offline?
0
votes
0answers
14 views

Risk to domain members in a domain that's extended into the DMZ

I am an AD administrator trying to look at things from an application server owner's perspective. Imagine a scenario where an AD domain covers authentication in both the corporate LAN and the DMZ. ...
1
vote
0answers
23 views

Is AirPlay at attack vector into a private network?

Our software dev team has an Apple TV and we want to have it connected to the corporate network to be able to reach internal resources while testing custom apps. Our ops team does not want it ...
0
votes
0answers
34 views

How to crack encrypted disk (crypto-LUKS) in an efficient way?

I had a disk encrypted by crypto-LUKS but forgotten password. I read a question posted here. LUKS HDD Encryption crack But before that I want to know if there's some free software I can use to ...
0
votes
0answers
74 views

My ISP provider is spoofing DNS [on hold]

My ISP provider is DNS spoofing OpenDNS, Google DNS, Norton DNS, Yandex DNS and all other known DNS servers. So even if I use those, I still can't access some websites. So I need a DNS server which is ...
3
votes
1answer
69 views

Besides Browsers, what other Technologies are Impacted by the Deprecation of SHA-1?

I am aware that from January 2017, browsers will start rejecting, or at least warning, users browsing sites offering SHA-1-signed certificates. Would a service be impacted if the system does not ...
2
votes
1answer
55 views

Do a DoS where you permit only your own connection?

Yesterday I was discussing with my brother, a computer scientist, if it is posible to perform a Denial of Service on a webpage so you block all the traffic to the web but you allow your connection to ...
0
votes
0answers
18 views

What are the best practices in rotating security token for a single page applications [on hold]

Does generating a new token for every request fit for a single page application. Ideally I believe for a web site which can be managed by subsequent calls to server can be managed by new token per ...
1
vote
1answer
80 views

Isn't a reverse TLS (reverse) proxy a security risk?

So, after reading Wikipedia's article on reverse SSL/TLS Proxies, I totally get the advantages it offers. But doesn't it also pose a security risk, by basically being a "man in the middle"? As a ...
0
votes
1answer
51 views

How do organizations with BYOD policy handle code theft?

Some corporations have a Bring Your Own Device (BYOD) policy, and some may allow their employees to take their laptops home for usage. What if an employee takes the code and develops something outside ...
0
votes
0answers
24 views

Does IBM DataPower firmware employ any open source technologies? [on hold]

Does IBM DataPower firmware employ any open source technologies beside GNU utilities or is it predominantly in house code and hardware processing? What about an internal OS?
0
votes
2answers
588 views

How to spoof SFTP?

Is there anyway to spoof an organisation that distributes files across the internet via SFTP? I know it's easy to spoof an IP address. But how easy is it to an SFTP link?
0
votes
0answers
11 views

Is there an original informaton source linking output of Qualys SSL report to settings in nginx and Apache configurations?

The online tool at Qualys for testing webserver SSL configurations, https://www.ssllabs.com/ssltest/index.html, produces a list of codeslike TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, ...
2
votes
1answer
37 views

Man-in-the-middle packet injection

I'm currently studying the possibility of a man-in-the-middle attack in a network consisting of a switch and 3 computers: Server/Host Client Man In The Middle The server and the client will change ...
0
votes
0answers
70 views

How does the following brute force password breaker work?

def numberToBase(n, b): """ This function will convert the number n into base b and return a list containing the digits of number n in base b """ digits = [] while n > 0: ...
0
votes
0answers
23 views

Can the instruction set be targeted directly?

Can malware directly manipulate the instruction set or is it restricted to the functions/services of the os/kernel?

15 30 50 per page