0
votes
0answers
1 views

VeraCrypt/TruCrypt - I can't understand why you'd want to create a “hidden” volume…?

I can't think of a reason as to why you'd want to create a hidden volume in VeraCrypt. It says because "you may be asked to hand the information," but why would I need to hand it over? Nobody has any ...
0
votes
0answers
2 views

Two keys in ~/.ssh directory

I originally had a DSA public key in my ~/.ssh directory on my server id_dsa.pub. The corresponding private key id_dsa is stored on my local machine. I then generated an RSA key pair directly inside ...
0
votes
1answer
9 views

Does Google hand over captcha IPs to webmasters?

Google gets to know a user's IP when someone enters a captcha even if they are using tor (see http://www.wired.com/2014/12/google-one-click-recaptcha/). So, If I go to a non-google website, such as ...
0
votes
0answers
14 views

PHP strpos and strlen Bypass

This is from a CTF event that has ended, but a writeup has not been done for it yet, and I'm quite curious as to how it would be done. With this code: $a = $_GET["pl"]; if(isset($a)) { ...
1
vote
0answers
5 views

Can a Radius server mitigate an ARP spoofing attack?

I'm helping my school network administrator to try to find a way to mitigate a current ARP spoofing attack on our wifi network. We detected an unknown host (MAC address seem to change, he is probably ...
1
vote
1answer
15 views

Asking questions randomly from a set of questions instead of a password?

I was thinking about this for a while. Say we have an app for which there is an admin console, and we need to provide access to the admin console over the browser (yes, HTTPS). For authentication, ...
3
votes
0answers
11 views

How to safely display html emails like gmail does it?

I'm building a webmail, which must be able to display html emails. But how to prevent xss and similiar attacks, while not loosing html formatting? In gmail, when I receive some emails from, lets say, ...
0
votes
0answers
2 views

OSX Yosemite and Security/Privacy

I currently have a Macbook Pro running OSX Mavericks, being the skeptic that I am I always wait a bit before upgrading to 'new' OS versions when they are released to see how they fare both stability ...
1
vote
1answer
9 views

Certificate pinning and the key distribution problem

I (think I) understand the concept of certificate pinning. However, I'm wondering if, in the worst-case scenario: is certificate pinning any more secure than the hierarchical trust model it is built ...
-1
votes
0answers
6 views

VA Scan for Linux server Running with Apache and SQL [on hold]

I want to do VA for Ubuntu server installed with Apache and SQL. Which open source tool you recommend?
1
vote
1answer
26 views

Is it possible to dump an exe from ram and create a distributable exe from it?

Is it possible to dump the ram and get an exe and use that ram dump to distribute an app? If so, is this something that is a practical concern and if so how best should a developer protect against it? ...
0
votes
1answer
17 views

Protecting the root ca bundle

Applications (e.g. Firefox) often include a root ca bundle file containing trusted certificates. How can I protect those files from malicious agents trying to modify them? I think signing is not an ...
3
votes
1answer
248 views

Why are buffer overflows executed in the direction they are?

I'm following The Security Tube’s video here. He overviews buffer overflows, and mentions how memory is executed from highest to lowest in the stack (at least with his implementation I assume). So we ...
1
vote
0answers
11 views

Vega Scanner Took Website offline? [on hold]

I used the Subgraph Vega scanner to scan a website, I wanted to get any linked social media pages from their site. Anyway soon into the scan the page went offline with a 404. I checked with different ...
0
votes
1answer
9 views

PHP and other files on the server, their visibility and access [on hold]

Let's say I would like to protect my PHP files that are on the public server and are used as a part of the website. Does anyone can easily access these files just like HTML/JS/CSS files through ...
-3
votes
0answers
21 views

reusing old bank issued security device

i have several security devices issued by banks and wondering if there is any way to reuse, reprogram or repurpose to use with more contemporary services such as lastpass and / or google authenticate? ...
1
vote
1answer
16 views

Downloading and updating the software via Playstore

I'm using android play store to download and update software for my phone. And some times its automatically updated as by settings.The play store is linked to one of my Gmail account. Here my question ...
-5
votes
0answers
25 views

how to decode this license file [on hold]

I need to decode a license file so I can make mi own license for other users. The string look like this: oAZNM3RSIFR4TUaPRhoYL+1bcAvd8vS5xIWFrZF4omtI2EDMWfLCrmN/ldwvzI9HLU6KGN98rlnpn/ ...
0
votes
0answers
35 views

Full key space coverage when generating a rainbow table

Many rainbow tables available online have different tables for various character sets and lengths. Are tables like these usually completely exhaustive for those character sets/lengths? For such a ...
-5
votes
0answers
27 views

Which is best secure public DNS server for free [on hold]

Which is best secure public DNS server for free.
5
votes
3answers
119 views

Looking for credit card data and other PII in files

I'm looking for ways to check for the presence of credit-card data and other personally identifiable information in files on a network I'm testing. Currently i'm doing this manually with the usual ...
-1
votes
0answers
16 views

How to identify the script that's sending spam from my server? [on hold]

So, this is what I wanna know. How do I identify the script that is sending spam from my server?. Server is using exim. Maldet scanning did not help much. Any advises ?
1
vote
2answers
35 views

Should a password ever be presented in plain text to a user (On a website)? Is this illegal under UK Data protections act? [on hold]

There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins. ...
2
votes
3answers
36 views

Is it good practice to let Node/Go/… act as a frontend webserver?

I'm used to writing web stuff in PHP and let Apache or nginx handle the actual HTTP handling and load my code via whatever means (mod_php, fcgi, fpm, ...). I'm under the impression that this is a ...
1
vote
0answers
14 views

Will this code run in real machine or is it some kind of Anti Reversing code? [migrated]

I am reversing a file which is not running properly in Vmware.The code from the AEP is as shown below : POP EDI ; value of edi is 0x7C816D4F kernel32.7C816D4F PUSH EAX ;value of eax is 0 INC ...
4
votes
4answers
61 views

What's to stop someone from just MITMing a checksum?

A lot of sites offer MD5 or SHA sums to verify the validity of your download, but why do some things rely almost entirely on this? Is there anything in place to prevent people from just replacing ...
4
votes
2answers
30 views

Is hashing schema information for client when generating SQL queries more secure?

I'm planning to implement a web system wherein APIs and presentation for CRUD in data tables are automatically generated, like that in phpMyAdmin. How I plan to implement this is to construct SQL ...
-2
votes
0answers
19 views

Access encrypted hard drive with password login [on hold]

I was doing an anti-virus scan and there was a .ecryptfs file that the scan would always get stuck on even for days, that is because it was encrypted file. Somehow I managed to disable the function of ...
-3
votes
0answers
18 views

New case, audio not detected [on hold]

As the title says, I moved to a nzxt phantom case and now my audio say's "Not detected" I've tried reformatting and reinstalling drivers, no help. First person who helps me gets paypal dollars.
3
votes
3answers
285 views

Can this modified 'Many' Time Pad be made 'stronger' by using an extrememly long key?

Starting with a one time pad say you want to encrypt some small strings like the words in this sentence but you want to reuse the same OTP key for each string so that when you encounter the same word ...
2
votes
1answer
30 views

Can you steal session cookie with BREACH attack?

Most of the discussions about the BREACH vulnerability are around stealing session-based CSRF tokens. But if you can steal a session-based token, could you also steal the session token itself? ...
0
votes
0answers
17 views

No VirtualHost filter (a good practice?) [migrated]

I am trying to figure out the cons of a current setup and discovered a potential anomaly. There's a webpage hosted at (say) webpage.com. If I point my domain (say) mydomain.com to the raw IP of ...
-5
votes
0answers
42 views

Link to more active security sites? [on hold]

I have a BS/MS in Computer Science and have worked as a developer for 15 years. Currently I have been reading a lot about computer security. Serverfault and Stackoverflow seem to be the go to place ...
0
votes
0answers
34 views

How can I encrypt in the column level of SQL for numeric data [on hold]

I want to encryption in the column level of SQL for numeric data.What should I do?Is there an algorithm for this? Where should I put the function of encrypting in the source code?
-2
votes
0answers
57 views

Am I a victim of industrial espionage? [on hold]

I had a weird experience, that I don't quite know how to explain. My setup is this: I have my desktop machine, which I connect to my company's VPN. On this machine I also run a VirtualBox VM with ...
1
vote
1answer
32 views

Using a Cryptovariable with an API Designed for Human-Generated Passwords

I'm working with a vendor who provides an API with a user registration method clearly designed for human-generated passwords. We're calling the API in an offline server-to-server fashion, however, ...
0
votes
1answer
23 views

Acceptable secure solution to replace static IP addresses for a web application

I am currently working as a technical lead on a project at a financial institution and have a question about how to provide the same level of security expected by the business in an application we are ...
4
votes
2answers
80 views

Shop saves credit card data from guest orders

A web shop allows customers to order as guest or to create an account. I ordered as guest, entered my email address and the shipping address, and payed per credit card (I had to enter the security ...
-1
votes
1answer
15 views

combining imperfect random number generators for shuffling an array

Shuffling an array to create a random stream for encryption is well known. The weakness is in the security of the random number generator that performs the shuffling. But is it true or likely that the ...
-1
votes
0answers
26 views

How Does AES Encryption Work? [on hold]

I'm looking for conceptual but semi-detailed step by step explanation of the AES encryption process, from plain text to encrypted text. The explanation should assume knowledge of basic programming ...
0
votes
0answers
15 views

What else can we now do with the new GCC5 to improve codebase hardening [on hold]

Noting the recent question: What is the most hardened set of options for GCC compiling C/C++? Is there anything else that can be shared regarding the new version of GCC, v5 for 32/64bit targets. I'd ...
0
votes
2answers
51 views

Is it possible to take back the control from an MITM in progress? [on hold]

I heard that MITM also involves DNS poisoning, which basically tells the Net to take a different route than it was supposed to go.. (I'm not sure if my interpretation is correct..) Given there is an ...
2
votes
1answer
29 views

Ability to determine which PGP public keys a message has been encrypted for?

Is it possible to determine, given a PGP message that you can already decrypt, to determine which other PGP keys that message has also been encrypted for?
0
votes
1answer
15 views

Would an IM app server holding user's messages long after the content was delivered be an issue of personal data protection? [on hold]

Take a IM app like WhatsApp. If I send a message to another user while their client is offline, the server holds the message and then delivers it when the receiver's client goes online. It even has ...
2
votes
1answer
19 views

Security of reading articles via an RSS reader

Would a site or blog owner know who is reading their site if the visitor is reading it with an RSS reader? Can they get the IP of the person? Say I had a Netvibes account with RSS feeds, can the site ...
0
votes
0answers
21 views

antivirus/anti-malware vs rootkits on Windows [on hold]

As I read about rootkits I wonder how well the current antivirus vendors are with detecting them. Does anyone know of a site with a current comparison test? For example, this ...
0
votes
0answers
36 views

someone attack my wireless [on hold]

02/27/2015 15:30:03 sending ACK to 192.168.2.3 02/27/2015 15:26:11 sending OFFER to 192.168.2.2 02/27/2015 15:25:10 sending OFFER to 192.168.2.2 02/27/2015 15:25:10 sending ACK to 192.168.2.3 ...
0
votes
0answers
23 views

Choosing a SSL Certificate Issuer [duplicate]

I am going to buy a new ssl certificate that supports SHA2 algorithm for our web services. Web services will be used by variaous java clients written in java6, java7 and java8. We have got a ssl ...
8
votes
2answers
659 views

Question About HTTPS Security [duplicate]

I recently read about how HTTPS work and I have some questions to clarify. Pardon me if this sounds silly but I just need to get this clear. Correct me if I am wrong. I got to know that as part of ...
1
vote
0answers
26 views

Imported CA certificate to Firefox Browser not working [migrated]

I created Certificate Authority (CA) according to Ubuntu help using openssl. After creating a certificate for Apache2 and adding to certificate to it, I want to import it in Firefox. In the end of ...

15 30 50 per page