Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [research]

An activity meant to understand the way a mechanism or system works. The study or examination of a security problem or class of security problems.

0
votes
2answers
108 views

Top contenders to replace passwords?

Passwords and humans don't mix particularly well. We can't come up with random ones very well, we can't remember random ones very well, we re-use them (I'm talking about all humans here, maybe not ...
0
votes
0answers
38 views

Naming rules for newly detected malware samples using known malware components?

I came across a malicious executable that was dropped by a malicious script. The executable (let's call it malfile.exe) employs NanoCore, which is a modular RAT made up of DLL plugins written in .NET. ...
1
vote
0answers
56 views

Android Debugging: Error accessing memory address [closed]

I'm attempting to debug different native binaries in my Android device using the adb shell and gdbserver. I receive the following error when i place a breakpoint in a program using gdb and continue ...
3
votes
0answers
55 views

Research on pedestrian trajectories' interaction with camera placement

I'm looking for empirical research on whether pedestrian walking trajectories are affected by areas under video surveillance. Maybe this would depend on the interval after a camera is prominently ...
2
votes
0answers
278 views

Detect kASLR/ASLR within a Linux firmware image without running it

I'm currently looking into exploit mitigation techniques and I've come across a question I can't find an answer to just now. To detect the presence of let's says PIE or Canaries within a binary there ...
0
votes
2answers
112 views

Are there any real instances of threats to machine learning systems?

I recently read a paper on The security of Machine Learning. Are there any instances of attacks against machine learning systems besides spam filters?
0
votes
1answer
84 views

What are the known ways to gain complete access to hardware audio?

Are there any known ways to gain access to firmware (bios/EFI) and permanently change the audio in a way that would effect the quality (Clarity, Volume, Frequency Range, Dynamic Range). For instance ...
2
votes
0answers
179 views

Implementation of existing smart lock methods

Smart lock? Apple, Android, Google, and now Microsoft have a feature called "auto|smart|dynamic|proximity lock" which enables to unlock your computer by simply carrying a (Bluetooth) support device ...
1
vote
0answers
119 views

What is the typical half-life of a virus/worm on the internet?

I am curious about the typical half-life (i.e., loosely relating to radioactive half-life here), if one has been measured/estimated, for the average virus/worm on the internet. Has anyone done a ...
2
votes
1answer
70 views

Are there any cryptographic techniques which combine encryption with false packet prevention? What is this called?

Assume that two devices are communicating via some sort of method that can be publicly viewed, and replicated. Attackers have the ability to replicate information sent between the two, and attackers ...
6
votes
3answers
831 views

How can I crawl the internet for malware?

For anyone who wants to study malware, there are a few websites that publish malware samples and/or URL feeds for anyone to retrieve and study. As opposed to performing such file-based analysis, I ...
0
votes
1answer
94 views

How do I decide my specialization in cyber security? [closed]

I have done web security and interested in learning mobile security, IOT security, malware analysis etc. Will doing all of this make me "Jack of all but master of none". I have a limited time to ...
1
vote
1answer
48 views

Continuous learning: Identifying/ Leveraging papers on new research, best practices, etc [closed]

As we all know there are so many resources with awesome information security related content. Does any one have best practices for managing the large influx of these papers and blog posts across ...
1
vote
1answer
86 views

Who are some renowned academicians or PhD guides in Information Security? [closed]

The question might seem opinion based, but I wish to know who are some people who are academicians or PhD guides in the field of Information Security?
3
votes
2answers
75 views

Latest Vulnerability Information for IT Security Research

Are there any web sites where one can visit to see the latest disclosed vulnerabilities in order to further develop IT security research skills and keep up-to-date?
3
votes
1answer
253 views

Is it possible to do research in both Computer Architecture and Security

I just finished with my MSc in Computer Science and Engineering (Security study-line) with a thesis on cache timing attacks on virtualized environments. I also have an MEng in Electronic and ...
0
votes
1answer
98 views

How can I proceed with my research on applying machine learning in Cyber Security? [closed]

I have two years of experience as a pen tester, I want to do masters in machine learning and security and research in finding ways to tackle current security problems through machine learning. Also ...
0
votes
1answer
112 views

How can I trust a mobile app? [closed]

Nowadays we are putting a lot of trust in mobile apps in order to survive in a globalized society. We are even under a kind of peer pressure which madly drives us to use these new applications. One ...
-3
votes
1answer
173 views

Need to learn information security [closed]

I want to learn about information security so I need some good sources to help me and learn that. I'm still a beginner.
1
vote
1answer
249 views

Hops encountered More for spam Mails than Legitimate Mails

Background I am working with email headers for spam detection. Each E-Mail header contains many "Received:" headers fields. Each "Received:" header is added by an intermediate Smtp/Mail server in the ...
7
votes
1answer
350 views

What is the current state of RFID / NFC security?

I'm attempting to do some RFID and NFC cloning and replaying research, as I'm hoping to be able to demo physical security as an attack vector to a few of out clients and prospects. The downside (...
2
votes
1answer
354 views

Deliberate Vulnerable Openstack images for penetration testing/training or research

I was just wondering if there are already deliberate vulnerable Openstack images for penetration testing/training or research. Something in line with OWASP's DVWA e.t.c....there quite a lot out there ...
4
votes
1answer
516 views

What are active research topics in SSL/TLS?

I don't know whether it is right to ask a question here for my MTech dissertation. I thought there is no good place in the world where I can find security experts like here. I am interested in doing ...
6
votes
3answers
138 views

Ethics & releasing research with no viable solution [duplicate]

I've been doing some pretty interesting research that involves abusing a particular technology to carry out malicious behavior. Normally, upon completion of my research, I'd hand over all of my work ...
7
votes
1answer
158 views

Restricting access to “hacking” sites and tools

I tried following a link from a post on this site and discovered that insecure.org is blocked by our internet proxy. What are the potential benefits and risks of allowing access to such sites to ...
1
vote
1answer
76 views

Didn't understood what the purpose of the newly discovered TCP Faking attack

Source: http://lgms.nl/blog-2 Hey guys, I've been reading through the research paper but didn't understand the purpose of the attack. What the attacker will want to exploit here ?
0
votes
1answer
169 views

How do you go about researching and discovering zero days? [closed]

How do you go about researching and discovering zero days? Breakdown the process. What positions can I expect to see that offers a more offensive and research oriented approach to security? i see How ...
1
vote
3answers
991 views

How can I create a research botnet within VMware?

For educational purposes I am attempting to create a botnet within VMware making use of 3 or 4 machines (So I can attack a 5th virtual machine using this botnet), but the issue I'm facing is I can't ...
5
votes
1answer
126 views

Quantitative Security Analysis of Open Source Repos like CRAN and NPM

Is anyone aware of any quantitative analysis or research on the security of CRAN or NPM? e.g. How much malware is hosted, rate of compromise, speed to close, number of attack vectors, CERT reports ...
6
votes
1answer
240 views

Attacks Against Password Managers

What threat models and currently known attacks against online and/or offline Password Managers exist, that do not base on CSRF, XSS or autofill behaviour? I have found two publications from usenix....
12
votes
1answer
210 views

Where is the best place to get descriptions of malware?

I'm looking for a source of descriptions of 1990s to early 2000s malware; I have searched for a very long time yet found very little. I require information such as payload activation dates, files ...
0
votes
1answer
108 views

Should a Web Search with Evernote results be a concern?

While using a Chromium based browser (Chromodo) and doing a regular Google search, Evernote is now appearing on the side with "related results in your notes". Does anyone know how they are doing it?...
5
votes
1answer
1k views

Do home video surveillance cameras work as deterrents?

After an alarming uptick in automotive and household burglaries, Our neighborhood is chatting about installing video cameras on their houses. I'm looking for research that shows whether or not they ...
2
votes
0answers
38 views

Verification of implementations of security protocols

I'm interested in how an implementation of a security protocol can be verified correct and complete. The AVISPA project (http://www.avispa-project.org/) can be used to verify the protocol. I guess ...
1
vote
0answers
217 views

Hashcat Turkish character problem [closed]

I'm using cudahashcat, it haven't special chars like "öçşĞÜ" in standart charsets. I defined charsets with windows-1254 and other encoding types(and -1 öÖçÇğĞşŞüÜıİ?a parameter), i tried but they didn'...
4
votes
1answer
1k views

Lighteater - BIOS/UEFI vulnerable

I am currently a bit confused, I have read today an article about the BIOS-rootkit Lighteater made by John Loucaides and Andrew Furtaki. In their presentation 'How many million BIOSes would you like ...
3
votes
2answers
216 views

Why do researcher need to control all C&C servers of a botnet?

Why do researcher need to control all C&C servers of a botnet? Wouldn't it be easier to spread a deinstall command to all reachable PCs to cripple the botnet? This could be done over and over ...
2
votes
1answer
5k views

how to extract a valid digital certificate and put it on other program

I am working on this matter as a graduate, but I need some help. how can extract a valid digital certificate to put it on other program? can I put a digital certificate on other executables and be ...
5
votes
2answers
585 views

How should I document my Public Key Infrastructure?

I'm preparing to document a 3 tier PKI (with multiple second level policy CAs) and want to create a document that is useful, technical, and not too overwhelming to the non-PKI expert. I suppose the ...
1
vote
0answers
3k views

Codeigniter RESTful web api creation for mobile and web applications general guidelines

I'm having application with running good in codeigniter, mysql and jquery. Currently we are planning to evaluate our web application with mobile application. So we planned to develop web application, ...
0
votes
1answer
353 views

Where can I download the Sony hack malware (for analysis)? [closed]

I want to analyze the Sony hack Malware. I would like to perform my own independent analysis of this malware; where can I download this malware so I can analyze it? Trend Micro has analyzed the ...
3
votes
1answer
106 views

Who defined the term “fully homomorphic encryption”?

Rivest et al. proposed the concept of privacy homomorphisms, but did not distinguish between partial versus fully homomorphic encryption. Gentry seems to take for granted the idea that fully ...
1
vote
2answers
351 views

Search engine forensics?

I read an article that th3j35t3r (hacker alias) had written awhile ago and could not find it again to reference so I will do my best to explain correctly. An anonymous individual tried to dox ...
2
votes
1answer
142 views

I want to filter Snort rules by date written [closed]

I would like the ability to look at Snort rules that were written in specific date ranges only given a collection of .rules files from either Sourcefire or Emerging Threats. Is this possible?
9
votes
1answer
825 views

E-voting: receipt-free, verifiable, and anonymous

Background In response to a system design concept, a question was posed: How do you achieve electronic voting, anonymity, and verifiability at the same time? I was informed that most experts in ...
-2
votes
1answer
343 views

Best and most current sites for security breaches [duplicate]

I'm taking my masters in cyber-security and as a student I come across a lot of garbage when doing research. What are sites with the latest security breaches? Thanks for the help in advanced. My ...
2
votes
1answer
648 views

Tools to make a security researchers life easier - tracking vulnerability research [closed]

I've been a developer for quite some time, and as part of my on-going learning process I've learnt how to spot and remedy broken (and insecure) code written by others. Recently, I've found myself ...
14
votes
2answers
4k views

How many passwords does the average user know?

Looking for research on the count and complexity of passwords that an average user is actively using. Note: Also, just to be clear, by research, this is not a request for you to respond with an ...
1
vote
1answer
199 views

Botnet fingerprinting

Does anyone know of any research of papers on fingerprinting botnets? If a given target is being brute forced or DDoSed do methods exist to determine if a brute force or DDoS on another target are ...
3
votes
2answers
1k views

Valid Characters For Magnetic stripe

We bought some Magnetic stripe cards and I'm writing a program that will get talked to by a mag card reader. What I need help with is that I can't, for the life of me, find out what characters are ...