Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [software]

Computer software, or just software, is a collection of computer programs and related data that provides the instructions for telling a computer what to do and how to do it.

1
vote
0answers
30 views

What guidelines can I follow to know if I can trust a software editor?

At work or at home, I often find some useful piece of software. Sometimes I may find it on a forum, mentioned on a video, or by talking to a colleague. But how do I know if the editor of the software ...
-1
votes
1answer
38 views

Is it (reasonably) save to install wechat on my linux?

Apparently it is possible to install wechat on Linux now, which I would like to do. I have no illusions that my conversation might be monitored by wechat itself or the Chinese government. However, I ...
0
votes
0answers
29 views

Software Signing Standards

Is there a software signing certificates standard, officially or by popularity? As I understand the SSL/TLS/https certificates rules are specified by the RFCs. Mixed use of servers and clients from ...
1
vote
2answers
35 views

What risks do I take using an application that always requires admin access and AV exception listing?

My knowledge level about OSs and security is extremely low. Is anyone willing to tell me whether it's risky for me to use an application that requires me to run it with admin permissions and to put it ...
-2
votes
1answer
108 views

Unauthorised transfers to developer's account in bank transaction software [closed]

Our organization has software for transactions. The person who designed this software illegally designed it in such a way that when any transaction is performed 0.5 percent of the transaction goes ...
15
votes
3answers
353 views

Are browser wrappers in software bad for users?

These days I see a lot of browser wrappers in software. For example: when you purchase something in the Steam desktop application and use PayPal, you enter your PayPal security details in a browser ...
-1
votes
1answer
65 views

Does Google Chrome collect data unrelated to browsing activity?

I'm exclusively running Firefox, but I'd like to install the leading browser Chrome for troubleshooting purposes. Browsing-related data collection isn't a concern in this case, but I'm worried if the ...
0
votes
1answer
78 views

How to search for all computers running memcached on shodan

Memcached is a caching software typically used in web servers. Many web servers like wikipedia, wordpress, flickr cache their data using Memcached software. Memcached server typically runs on port ...
1
vote
0answers
102 views

Is This a Virus?

i want to ask about a program is it a malware or a program from mozilla? When i turn on my pc it start normally but i see an open program called update.exe and it have a firefox icon on it, when i ...
2
votes
1answer
75 views

Are there ways in determining if devices such as router have been tampered with?

In working with a number of non-profit organizations, devices such as routers that may have been used by other businesses are often acquired. Equally, devices are often inherited through other ...
-1
votes
1answer
90 views

Does Bloatware on a brand new PC create security risks?

Some new computers come with software I don't need or want. It is not advertised as part of the product I am purchasing. Generally this is called Bloatware. Bloatware 1.(n) Software that ...
1
vote
2answers
71 views

When are you done decomposing threats?

Our development teams are getting the hang of STRIDE threat discovery, but one issue that remains is related to threat decomposition. The way we see threat analysis is that it consists of identifying ...
2
votes
0answers
63 views

Ethical Hacking/Bug Bounty programs: Best way to get started professionally? [closed]

I am self-employed (degree in computer science) and I have been fighting a serious illness for the past several years (and still am) which makes it pretty much impossible to take on client projects as ...
0
votes
4answers
228 views

Track who leaks your software

I'm releasing some software in python which is impossible to fully encrypt. I was thinking of changing the variable names slightly for every copy that I release. Is this a good way to figure out who ...
0
votes
1answer
542 views

Meterpreter reverse shell alternative

What can you do if you are behind NAT but can't do port forwarding and don't want to pay for a virtual server with internet-facing IP? I read the answer to this question which suggests some tunneling ...
0
votes
1answer
45 views

CSIRT Softwares [closed]

I'm wondering what kind of software Computer Security Emergency Response teams use to manage their work? For example to catalog incidents, responses and manage risks.
0
votes
1answer
134 views

Are there any good brute force programs in C#? [closed]

I'm planning to research & learn from brute force methods, but all the popular ones I found like John the Ripper or hashcat are written in C & OpenGL which I don't have much knowledge about so ...
3
votes
3answers
635 views

How to assure my customer that my software is malware proof?

We are delivering an application which our customers can use on their network cluster. Now, is there any way that we can certify that the software is malware proof and is not going to spread malware ...
16
votes
3answers
3k views

Should crash dumps (e.g. from Breakpad, Windows) be encrypted and signed?

As a software developer, should my crash dumps (e.g. from Breakpad, Windows) be encrypted and signed? I provide the ability to export crash dumps so that I can pinpoint the problem when the user ...
1
vote
1answer
32 views

How to verify Ruby on Rails projects are at current patch levels?

I've got a few Ruby on Rails systems running Ubuntu 14.04LTS. The Ubuntu version of supported Ruby is 1.9.1 but the developers use a Gemfile and Bundler which (AFAIK) installs Ruby (and gems) out-of-...
1
vote
2answers
123 views

Do software do an integrity check before executing?

I am testing a software that I need to install on my computer locally. It seems I can modify one of the .exe or .dll using msfvenom to include a malicious payload, like a reverse shell. From there, I ...
1
vote
1answer
1k views

does karabiner elements on Mac OSX contain or potentially contain malware?

I'm using Karabiner elements, an open-source program to remap the keys on my macbook air (running the latest Mac OSX High Sierra) and my apple wireless keyboard. It works very nicely. However, I am ...
3
votes
2answers
78 views

What approaches exist for ensuring security when deploying software in non-trusted environments?

Is it possible to deploy software in such a way that a rogue actor who has physical access to the hardware is unable to glean any information on the code that is running or what is being stored in ...
2
votes
2answers
66 views

Dangers in hosting software on a webserver?

I'm interested in hosting a competition in which participants (all of whom are remote) will be creating FPGA/RTL designs and judged on certain performance metrics such as speed/latency/size/etc. The ...
5
votes
1answer
86 views

Why default settings are generally weaker than optimal ones?

In nearly all software (that I've used so far) that allows to set the encryption settings, default settings are kind of weak. There is always something that you should tweak to achieve better ...
0
votes
1answer
74 views

Building software safely for malware-free distribution

I wrote a program. I want to publish a compiled executable for downloading by the public. How can I compile and distribute it without contact with my (presumably insecure and infected) operating ...
1
vote
1answer
60 views

Can an unloaded malicous.dll placed on the “drive by download ” directory be remotly exploited?

Some programs can be downloaded to the drive-by download directory through the browser , the easy way is to unpack the program on the /download directory (It is the default path if the user doesn't ...
0
votes
2answers
63 views

Why Software Configuration Management tools (SCMs) authenticate only client instead of server?

I've noted that probably all of the 4 popular Software Configuration Management Tools (SCMs), ie.: Puppet, Ansible, Chef, Salt use only clients' authentication instead of the server authentication – ...
1
vote
1answer
115 views

Avast can hijack email content sent through Frirefox?

The other day I send an email through Gmail in Firefox. Right after I clicked "Send" Avast popped up asking if I wanted to include their signature at the bottom of future emails. Surprised, I accepted ...
7
votes
1answer
1k views

ASLR bypass with info leak

Working through the Modern Binary Exploitation course from RPI here. I'm having trouble with an example on exploiting ASLR which is supposed to use a memory leak to gain information about the stack to ...
1
vote
2answers
94 views

Can a signed mobile application be altered?

If a signed mobile application is modified, then its signature and checksum become invalid. Is it possible to forge a new, valid signature?
0
votes
5answers
192 views

Are software vulnerabilities limitless?

Ok. I believe no one has thought of this perspective, so here goes. I really don't understand why software need to be constantly patch for security when programmers do a good and complete job in the ...
0
votes
1answer
55 views

Hashing standards in DB front end Software

Is there any real standard for hashing when working with user passwords in non-web based software development? I've only really ever handled passwords in Php before, where hashing is a must given the ...
0
votes
1answer
73 views

How to enforce software updates on workstations?

There are many workstations on the company network with various kind of software installed: web browsers, OpenVPN clients, remote management agents, encryption utilities and other tools. Some of the ...
1
vote
0answers
205 views

Displaying a report of top visited websites per period (HTTP and HTTPS) [closed]

I have a MikroTik router that connects to a network with multiple endpoints. All the WAN traffic flows through this router and I would like to be able to monitor (not necessarily filter) the ...
4
votes
1answer
223 views

Cleanware. What does it do and are there security risks involved?

So I get these questions quite a lot recently from friends or family. And I thought this could be a good question for Security Exchange, because I couldn't find this kind of question here. I recieved ...
1
vote
2answers
989 views

Why are hardware based random number generators considered better than software based generators?

Hardware based random number generators (RNG) get their randomness from the noise around. Software based generators get this usually from user input, like moving the mouse over a screen (like ...
2
votes
2answers
253 views

Can OSSEC detect buffer overflow attacks?

I am trying to detect buffer overflow by using OSSEC (a HIDS software) as mentioned in OSSEC rules example and OSSEC book. How can I configure OSSEC for detect a simple buffer overflow example as the ...
0
votes
1answer
181 views

USB stick encryption on specific network/domain

I am in a difficult situation here. For my company I need to make the use of USB sticks secure, their demand is that when someone uses a USB stick it will only be readable and accessible on the ...
0
votes
1answer
58 views

Tools and approaches in order to teach software security? [duplicate]

I am going to teach software security for a course lab. I would like to know is there any software- simulator and etc for providing an appropriate environment for practising common types of security ...
3
votes
1answer
5k views

What software can be used to read data from smart cards? [closed]

I have recently got this smart card reader. In the description it says that it can be used to read data from fidelity smart cards, library cards, etc. The technical card compatibility support is as ...
1
vote
2answers
78 views

How to determine if software on many client machines is up to date? [closed]

I have to take care of 200+ client machines (mainly Windows 8,8.1, 10) in an organization. There are many apps installed: web browsers, Java, Flash & many more. Are there any tools/techniques to ...
1
vote
1answer
100 views

What should be in top-down IoT Security Policy for companies engineering products to market? [closed]

You are a company creating consumer-facing IoT Devices, What things should go in a IoT product/data security policy? Initial thoughts: Privacy, Control Gates, cryptography, vulnerability/decision ...
1
vote
2answers
455 views

How to protect an offline proprietary software from being stolen

We are currently developing a software that is supposed to run on every computer of a world wide company which has many domains. We are thinking about security as we want the software to be used only ...
3
votes
2answers
136 views

Methods of determining if a software bug is a security risk?

I don't really want to get into the specifics. I found a bug from a huge software provider. As any other responsible user, I have reported the bug to the software provider. It is hard to tell if ...
1
vote
1answer
174 views

Are Portable Password Managers secure?

I have been using KeePass2 for a while now and I think it is a very good password manager. There also is a portable version and I often read recommendations for KeePass where the portable version is ...
1
vote
0answers
64 views

Best practices for the development of security solutions [closed]

IT firms developing security solutions (such as antivirus or Auth systems) are required to adopt a more sophisticated level of management and quality control while developing their products. Security ...
5
votes
6answers
417 views

What is a good data encryption strategy for a shared resource(text)?

I have a use case where I need to encrypt a piece of PII information in a database, which then can be decrypted and accessed by multiple user roles in an application (e.g the user it belongs to, ...
4
votes
1answer
166 views

Are there any IoT Systematic Creation Security Checklists?

Are you aware of any publicly available documents that would help IoT/Connected product creators develop a systematic/programmatic approach and/or process to securing such new age devices?
1
vote
2answers
341 views

How to distribute software with one time installation key in complete offline

I have the requirement that I have to distribute software in SD card. And this application should work without internet. I can share the installation key through SMS. Since application and ...