0
votes
0answers
2 views

Can location apps locate a lost phone if someone switches out the SIM card?

I lost my T-mobile Galaxy S7 somewhere between the front seat of my car in the parking lot at the grocery store and the first few aisles inside the store. (None of us remember exactly if I actually ...
0
votes
0answers
3 views

Is traffic not encrypted given ERR_CERT_COMMON_NAME_INVALID?

If I am shown ERR_CERT_COMMON_NAME_INVALID, and I can see that the domains do not match (cert for *.example.com but I am visiting https://foobar.com), do I understand correctly that someone packet ...
0
votes
1answer
26 views

Why would a site demand passwords to consist of digits only?

My bank's internet banking site enforces a pretty weird policy: it does not allow you to set a password that has anything but digits in it. The only reason I can imagine is that they are using not an ...
0
votes
0answers
11 views

Information collected by Windows 10

I am thinking about installing Windows 10 on a machine. However I am concerned about the information Windows 10 collects. I have searched a bit but haven't been able to find what information Windows ...
0
votes
0answers
8 views

How to protect API from from malicious usage

We are developing a community portal service using Java-Spring and Angular UI. We are also going to have an Android app soon. Our back-end exposes many services via REST API. There are couple of ...
0
votes
0answers
12 views

Netcat seems to close the connection from the attack box?

I am trying a practice box, and am running into trouble stabilising a connection. I have an RFI vulnerability that allows me to run commands on an Apache server, but does not lead to an interactive ...
6
votes
3answers
202 views

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

In 2013, a Citibank employee had a bad performance review that ticked him off. The results were devastating: Specifically, at approximately 6:03 p.m. that evening, Brown knowingly transmitted a ...
0
votes
0answers
8 views

How dangerous the fact that selinux is permissive/lacking on android? what should one be wary of?

So there is this ROM who due to some constrains has its SELINUX set on permissive most of the time. The phone has its root disabled. Now I'm not really sure what are the consequences of such a state ...
0
votes
0answers
12 views

DMZ with Reverse Proxy for both Web and Email servers

I have both a web server and email server, instead of placing these two "public" servers in the DMZ, instead In the DMZ I was going to place a Reverse Proxy. for the Web Server: Firewall accepts port ...
0
votes
0answers
19 views

Data dump - realse, as insurance

Just trying to figure out the best way, to set up a data dump mechanism as a safety insurance. A timed data dump which could be only deactivated by me, and released in case of my absence (harm). And ...
2
votes
0answers
22 views

OAuth - initial log in to get API key

I've been reasearching how major web systems implement OAuth in their RESTful API. Here is how Paypal describes theirs: Basically the question comes down to the "note" part of the picture. Say ...
0
votes
0answers
11 views

Is comparing the thumbprint of a SSL certificate secure enough?

I was wondering if comparing the X509Certificate2.Thumbprint of two certificates count as a save way to identify if a certificate is correct or not. Of course this would only work for specific ...
0
votes
1answer
17 views

Does stretching a hash increase a denial-of-service (DoS) risk and does brute-force protection mitigates that?

Disclaimer: I noticed several questions on this site but none really answer this two questions directly. Therefor I do not consider this duplicate. Personally I really like the article called Some ...
0
votes
1answer
29 views

Where do magic constants for signature algorithms come from?

For example, I've seen 3031300d060960864801650304020105000420 as an identifier for RSA/SHA256, 3020300c06082a864886f70d020505000410 for RSA/MD5. Where do these values come from? I ran into one of ...
-4
votes
1answer
36 views

What are the best all-in-one security tools for linux?

What are the best all-in-one security tools for linux? Please list them by open-source and commercial, and functionality. Thanks.
1
vote
1answer
44 views

Does SFTP cost more to implement than FTP?

This is a two part question. How does the implementation of SFTP differ over FTP? (Account Creation, Setup of connection) Is it more expensive (in terms of time/cost) to do so? In this scenario I ...
0
votes
0answers
20 views

I currently have a downed laptop. I want to install Tails on my Android flash card so I can use it as a boot card on the laptop [on hold]

Does anyone know how to install Tails on an sd card from an Android tablet? Thanks
0
votes
0answers
17 views

Options to do regarding a hacked twitch stream with a known twitter, used email and (maybe fake) name

In short, a friend of mine under DzyDzyDino's stream. I contacted him and together we were able to obtain a bit of information. First, though, the overall situation. I managed to contact him via ...
1
vote
1answer
32 views

Security implications of using an algorithm to lengthen and salt passwords before using them?

I have created a JavaScript bookmarklet which, among other things, base64 encodes my plain-text passwords combined with information from the site's domain name. The idea is that base64 output is ...
0
votes
0answers
11 views

PGP key transision: Strong RSA subkey under weak DSA masterkey?

I have a DSA/ElGamal 1024/2048 PGP key and want to migrate to a stronger set. I see two options but I'm unsure which is smarter. a) Keep DSA 1024 Masterkey, generate 4096 RSA subkey b) Ditch the ...
0
votes
1answer
13 views

ISO27001: Scoping Definition for Data Hosted on Cloud

I'm trying to define a scoping definition, as required by ISO27001, for a company that offers advice to customers based on health-related data. The strength of this company is its advice that offers ...
7
votes
1answer
63 views

How could Firefox password manager talk to Chrome password manager?

I recently installed Firefox and realised that it was able to successfully import all passwords that were stored in Chrome. I had been using a sync passphrase in Chrome and I expect it to store the ...
0
votes
0answers
37 views

Surveillance cameras go offline every 30 minutes or so

I'm setting up a 4 camera security system with an Anran Digital Video Recorder (Model NVR6008T), and keep having the cameras go offline approximately every 25-30 minutes. They stay offline for ...
0
votes
1answer
38 views

What are all these connection attempts in my firewall log?

I've read many similar answers, but they all dealt with machines that were running publicly accessible services. In my case, I have a (newly installed and fully patched) Ubuntu machine that is used as ...
0
votes
0answers
7 views

Is there any guideline to configure Mutual Certificates Security(MCS) using WSIT-Security for Glassfish-Metro WS?

I am building a WebService using Java with Metro WS-Stack and looking for a guideline to learn the concept and configure the practical usage of it on NetbeansIDE. Any leads on this?
0
votes
0answers
26 views

How Do Botnets Leverage LAMP stacks and Web Servers?

I understand MySQL databases, PHP, HTML forms, etc. And I also understand that basic botnets rely on client bots that communicate with a central command-and-control server. However, if someone were ...
0
votes
0answers
11 views

Netfilter SNAT DNAT interaction

In this example [root@real-server]# iptables -t nat -A PREROUTING -d 205.254.211.17 -j DNAT --to-destination 192.168.100.17 [root@real-server]# iptables -t nat -A POSTROUTING -s 192.168.100.17 -j ...
0
votes
0answers
17 views

credit card skimming and protection information [on hold]

please i would like to know if a skimmer could possibly add 0's, write info using card reader and withdraw from POS or ATM. All info related to this would be appreciated
1
vote
1answer
18 views

Deep attestation of VM's

Hypervisors like Xen have virtual TPM (vTPM) support. In cloud environments, are there any implementations where such vTPM's are being used during remote attestation in addition to the host TPM based ...
0
votes
1answer
30 views

Problem with configuring PEAP to only accept users with client certificate. (freeradius)

I'm currently trying to configure PEAP. I had no problems configuring it without the use of client certificates. But I want to only accept people who have a valid cert. However, the clients can ...
2
votes
0answers
15 views

What is the benefit of OAuth “one-time code flow (hybrid authentication)”?

With reference to the omniauth-google-oauth2 gem which describes what it calls "One-time Code Flow (Hybrid Authentication)" as such: This hybrid authentication flow has significant functional and ...
1
vote
1answer
25 views

Bitlocker encrypted drive access from other machines

Can drives encrypted with Bitlocker be moved to different machines and accessed as long as the password is known? For example, via an external drive enclosure? Or is the encryption tied to the ...
0
votes
0answers
14 views

Is it possible to list a directory provided it has a valid index file?

Provided you have a server running apache and a website setup with an index.html file in every directory, could you get apache to return a directory listing if your website was configured to display ...
3
votes
2answers
53 views

Is a password protected SSH key necessary on an encrypted system?

I have a laptop running Linux encrypted using dmcrypt. To use git, I just created an SSH key, but did not password-protect it. Since my hard drive is already encrypted, is there any benefit to ...
1
vote
1answer
22 views

DROWN CVE-2016-0800 Patch Missing on Centos 7

My security admin is worried that my OpenSSL version does not contain a patch for DROWN (cve-2016-0800). I ran a yum update and have installed the latest Centos 7 OpenSSL: openssl-1.0.1e-51.el7_2.5....
4
votes
4answers
59 views

Do I need a new CSR for a certificate renewal?

I want to renew my expired certificate I'm using in Tomcat for SSL. Other posts indicate that to renew my certificate I need to create a new CSR and obtain a new certificate and import into my ...
0
votes
1answer
36 views

during change of IP address - adware infection

I have a puzzling situation. I have build a small site for a friend which I am hosting together with other site I have. His domain is registered with a certain company which is also an ISP provider. ...
0
votes
0answers
30 views

Symmetric/Asymmetric/Hashes Strongest to Weakest & Rounds

I am well aware strongest to weakest in terms of hashing, however, I have been reading about rounds to do with hashing. Also, discovered symmetric/asymmetric e.g. AES, Twofish etc have rounds also. ...
0
votes
0answers
23 views

iframe basic auth or token security

We have two sites, both are trusted. On site1 we store the username and password for the user for site2. We make api calls on site1's backend to site2 via basic auth (all over HTTPS). I know this ...
0
votes
1answer
30 views

What does it mean by rendering image in php? [on hold]

I just saw a webpage, when i requested it, it showed me every content except image, then it did a POST request to a file named render-image.php and after that image was appeared. What does it mean? I ...
-4
votes
1answer
38 views

Need help identifying cipher (hash type?) [on hold]

This is it: c6dd657d235344b4fcbf5ba88a47550d6992d16e It probably contains coordinates. Not sure tho.
0
votes
0answers
9 views

Weird problem on airbase-ng

The situation is pretty simple, I'm trying to create a rogue AP, am I missing something? No matter what I do I get the same error message: I tried using different bssid and essid's with the ...
-2
votes
1answer
30 views

How can I see mobile version websites on PC/Mac while using a privacy secure browser such as Tor [on hold]

Tor doesn't recommend downloading plugins to enable mobile site viewing... So is there any other "secure" browser that'll let me see mobile sites securely?
16
votes
6answers
2k views

How should high net worth individuals secure their financial accounts?

I try to follow account security best-practices (strong random passwords, password manager, multi-factor authentication, etc.) but I still find myself worried about potential compromises to my ...
1
vote
0answers
76 views

How to check for vulnerability against WPAD / HTTPS attacks?

As described at New attack bypasses HTTPS protection on Macs, Windows, and Linux | Ars Technica, there is a newly identified attack at wifi hotspots etc that can expose the URLs you use even if they ...
-4
votes
0answers
33 views

decryption https traffic from a mobile app [on hold]

I'm looking for to decrypt https requests from an mobile app. I have been using charless and fiddler to fetch some requests made in the app but am receiving errors : SSL certificate error.
0
votes
0answers
35 views

is there an equivalent of setgid bit on windows?

Is there a possiblity on Windows to have an executable that always runs with the process privileges of the owner and not the one that starts the executable?
0
votes
0answers
39 views

Firewall source and destination IP validation

For an external firewall interface, why is it a good idea to validate that the source IP address was initiated from an internal IP, or why it originated from an external IP? If, hypothetically, the ...
2
votes
1answer
44 views

What are read state and write state in SSL connections?

The SSL handshake contains the change_cipher_spec. When this change_cipher_spec is received, the pending read state is copied to current read state, and when change_cipher_spec is sent, the pending ...
4
votes
1answer
46 views

Why is `cd` restricted in rbash/restricted bash?

The bash manual says: A restricted shell behaves identically to bash with the exception that the following are disallowed or not performed: Changing directories with the cd builtin. Why ...

15 30 50 per page