Questions tagged [software]

Computer software, or just software, is a collection of computer programs and related data that provides the instructions for telling a computer what to do and how to do it.

Filter by
Sorted by
Tagged with
1
vote
1answer
106 views

Is anything missing in the offline software licensing plan?

I'm working on a piece of software written in VB.NET for Windows machines (mainly Windows Server). I have some understanding of cryptography and security, but I want some good old fashioned peer ...
2
votes
1answer
61 views

When writing software do all programs have a signature? [closed]

I have always been curious if all software have a signature for whatever reason or is only related to AV.
1
vote
2answers
112 views

Notepad++ updater had no tittle or info. Is this okay?

While updating Notepad++, the updater window showed no title or information. Is this okay from security point of view ?
0
votes
0answers
103 views

How do hacking groups get a license anonymously for threat emulation software like Cobalt Strike?

I've seen that a lot of hacking groups replicate techniques and attacks from red teams using software like Cobalt Strike and Powershell frameworks for offensive security and red teaming like Nishang ...
1
vote
2answers
83 views

Can plugins for text editors and IDEs be malicious?

I'm always a little cautious about plugins I install for text editors or browsers, but can they be dangerous and cause the text editor or browser to behave in a malicious way? For example, can a ...
3
votes
1answer
60 views

Why are security properties non-compositional?

I had a lecture in security and it was stated that security properties are non-compositional. I don't quite understand what that means and can't find anything in the internet about that. Can anyone ...
-2
votes
1answer
42 views

Is Using A Firewall with LibreOffice Enough If Not, Any Recommendations? [closed]

I recently learned a little about LibreOffice and OpenOffice. I am considering using LibreOffice on my laptop but am concerned about security. What I've read online (the terminology) is over my head. ...
0
votes
0answers
51 views

Verify that a Software Restriction Policy (SRP) rule is effectively applied?

I am running Windows 10 Pro and I would like to check the software restriction policies, with timestamps on the logs if possible. Indeed, I found a solution but without timestamping on the logs. ...
1
vote
1answer
99 views

Understanding which privacy tools provide very similar functionality

https://amiunique.org/tools has a list of recommended privacy tools. uBlock Ghostery HTTPS Everywhere Lightbeam AdBlock Plus Disconnect Privacy Badger NoScript Self-destructing cookies However, aren'...
3
votes
1answer
72 views

how to verify turbotax software

I bought turbotax software from amazon (downloaded mac version). Therefore, I know it is safe to use. However, if one wants to verify the software has not been tampered with how do we do that ?. Mac ...
0
votes
0answers
47 views

Does WinRar leave cache of opened Zip Archives (Nothing extracted)

Downloaded a .zip, via a secure app that deleted the only place it was downloaded (supposedly, who knows if defragmentation left other traces, the download happened by accident, on main OS WIN10, no ...
1
vote
0answers
36 views

What guidelines can I follow to know if I can trust a software editor?

At work or at home, I often find some useful piece of software. Sometimes I may find it on a forum, mentioned on a video, or by talking to a colleague. But how do I know if the editor of the software ...
-1
votes
1answer
62 views

Is it (reasonably) save to install wechat on my linux?

Apparently it is possible to install wechat on Linux now, which I would like to do. I have no illusions that my conversation might be monitored by wechat itself or the Chinese government. However, I ...
0
votes
1answer
65 views

Software Signing Standards

Is there a software signing certificates standard, officially or by popularity? As I understand the SSL/TLS/https certificates rules are specified by the RFCs. Mixed use of servers and clients from ...
1
vote
2answers
39 views

What risks do I take using an application that always requires admin access and AV exception listing?

My knowledge level about OSs and security is extremely low. Is anyone willing to tell me whether it's risky for me to use an application that requires me to run it with admin permissions and to put it ...
-2
votes
1answer
116 views

Unauthorised transfers to developer's account in bank transaction software [closed]

Our organization has software for transactions. The person who designed this software illegally designed it in such a way that when any transaction is performed 0.5 percent of the transaction goes ...
15
votes
3answers
403 views

Are browser wrappers in software bad for users?

These days I see a lot of browser wrappers in software. For example: when you purchase something in the Steam desktop application and use PayPal, you enter your PayPal security details in a browser ...
-1
votes
1answer
76 views

Does Google Chrome collect data unrelated to browsing activity?

I'm exclusively running Firefox, but I'd like to install the leading browser Chrome for troubleshooting purposes. Browsing-related data collection isn't a concern in this case, but I'm worried if the ...
1
vote
2answers
253 views

How to search for all computers running memcached on shodan

Memcached is a caching software typically used in web servers. Many web servers like wikipedia, wordpress, flickr cache their data using Memcached software. Memcached server typically runs on port ...
1
vote
0answers
152 views

Is This a Virus?

i want to ask about a program is it a malware or a program from mozilla? When i turn on my pc it start normally but i see an open program called update.exe and it have a firefox icon on it, when i ...
2
votes
1answer
94 views

Are there ways in determining if devices such as router have been tampered with?

In working with a number of non-profit organizations, devices such as routers that may have been used by other businesses are often acquired. Equally, devices are often inherited through other ...
-1
votes
1answer
97 views

Does Bloatware on a brand new PC create security risks?

Some new computers come with software I don't need or want. It is not advertised as part of the product I am purchasing. Generally this is called Bloatware. Bloatware 1.(n) Software that ...
1
vote
2answers
75 views

When are you done decomposing threats?

Our development teams are getting the hang of STRIDE threat discovery, but one issue that remains is related to threat decomposition. The way we see threat analysis is that it consists of identifying ...
2
votes
0answers
81 views

Ethical Hacking/Bug Bounty programs: Best way to get started professionally? [closed]

I am self-employed (degree in computer science) and I have been fighting a serious illness for the past several years (and still am) which makes it pretty much impossible to take on client projects as ...
0
votes
4answers
246 views

Track who leaks your software

I'm releasing some software in python which is impossible to fully encrypt. I was thinking of changing the variable names slightly for every copy that I release. Is this a good way to figure out who ...
0
votes
1answer
667 views

Meterpreter reverse shell alternative

What can you do if you are behind NAT but can't do port forwarding and don't want to pay for a virtual server with internet-facing IP? I read the answer to this question which suggests some tunneling ...
0
votes
1answer
86 views

CSIRT Softwares [closed]

I'm wondering what kind of software Computer Security Emergency Response teams use to manage their work? For example to catalog incidents, responses and manage risks.
0
votes
1answer
139 views

Are there any good brute force programs in C#? [closed]

I'm planning to research & learn from brute force methods, but all the popular ones I found like John the Ripper or hashcat are written in C & OpenGL which I don't have much knowledge about so ...
3
votes
3answers
658 views

How to assure my customer that my software is malware proof?

We are delivering an application which our customers can use on their network cluster. Now, is there any way that we can certify that the software is malware proof and is not going to spread malware ...
16
votes
3answers
3k views

Should crash dumps (e.g. from Breakpad, Windows) be encrypted and signed?

As a software developer, should my crash dumps (e.g. from Breakpad, Windows) be encrypted and signed? I provide the ability to export crash dumps so that I can pinpoint the problem when the user ...
1
vote
1answer
42 views

How to verify Ruby on Rails projects are at current patch levels?

I've got a few Ruby on Rails systems running Ubuntu 14.04LTS. The Ubuntu version of supported Ruby is 1.9.1 but the developers use a Gemfile and Bundler which (AFAIK) installs Ruby (and gems) out-of-...
1
vote
2answers
137 views

Do software do an integrity check before executing?

I am testing a software that I need to install on my computer locally. It seems I can modify one of the .exe or .dll using msfvenom to include a malicious payload, like a reverse shell. From there, I ...
2
votes
1answer
2k views

does karabiner elements on Mac OSX contain or potentially contain malware?

I'm using Karabiner elements, an open-source program to remap the keys on my macbook air (running the latest Mac OSX High Sierra) and my apple wireless keyboard. It works very nicely. However, I am ...
3
votes
2answers
82 views

What approaches exist for ensuring security when deploying software in non-trusted environments?

Is it possible to deploy software in such a way that a rogue actor who has physical access to the hardware is unable to glean any information on the code that is running or what is being stored in ...
2
votes
2answers
69 views

Dangers in hosting software on a webserver?

I'm interested in hosting a competition in which participants (all of whom are remote) will be creating FPGA/RTL designs and judged on certain performance metrics such as speed/latency/size/etc. The ...
6
votes
1answer
89 views

Why default settings are generally weaker than optimal ones?

In nearly all software (that I've used so far) that allows to set the encryption settings, default settings are kind of weak. There is always something that you should tweak to achieve better ...
0
votes
1answer
81 views

Building software safely for malware-free distribution

I wrote a program. I want to publish a compiled executable for downloading by the public. How can I compile and distribute it without contact with my (presumably insecure and infected) operating ...
1
vote
1answer
61 views

Can an unloaded malicous.dll placed on the “drive by download ” directory be remotly exploited?

Some programs can be downloaded to the drive-by download directory through the browser , the easy way is to unpack the program on the /download directory (It is the default path if the user doesn't ...
0
votes
2answers
69 views

Why Software Configuration Management tools (SCMs) authenticate only client instead of server?

I've noted that probably all of the 4 popular Software Configuration Management Tools (SCMs), ie.: Puppet, Ansible, Chef, Salt use only clients' authentication instead of the server authentication – ...
2
votes
1answer
121 views

Avast can hijack email content sent through Frirefox?

The other day I send an email through Gmail in Firefox. Right after I clicked "Send" Avast popped up asking if I wanted to include their signature at the bottom of future emails. Surprised, I accepted ...
8
votes
1answer
2k views

ASLR bypass with info leak

Working through the Modern Binary Exploitation course from RPI here. I'm having trouble with an example on exploiting ASLR which is supposed to use a memory leak to gain information about the stack to ...
1
vote
2answers
97 views

Can a signed mobile application be altered?

If a signed mobile application is modified, then its signature and checksum become invalid. Is it possible to forge a new, valid signature?
0
votes
5answers
206 views

Are software vulnerabilities limitless?

Ok. I believe no one has thought of this perspective, so here goes. I really don't understand why software need to be constantly patch for security when programmers do a good and complete job in the ...
0
votes
1answer
59 views

Hashing standards in DB front end Software

Is there any real standard for hashing when working with user passwords in non-web based software development? I've only really ever handled passwords in Php before, where hashing is a must given the ...
0
votes
1answer
81 views

How to enforce software updates on workstations?

There are many workstations on the company network with various kind of software installed: web browsers, OpenVPN clients, remote management agents, encryption utilities and other tools. Some of the ...
1
vote
0answers
258 views

Displaying a report of top visited websites per period (HTTP and HTTPS) [closed]

I have a MikroTik router that connects to a network with multiple endpoints. All the WAN traffic flows through this router and I would like to be able to monitor (not necessarily filter) the ...
4
votes
1answer
243 views

Cleanware. What does it do and are there security risks involved?

So I get these questions quite a lot recently from friends or family. And I thought this could be a good question for Security Exchange, because I couldn't find this kind of question here. I recieved ...
1
vote
2answers
1k views

Why are hardware based random number generators considered better than software based generators?

Hardware based random number generators (RNG) get their randomness from the noise around. Software based generators get this usually from user input, like moving the mouse over a screen (like ...
2
votes
2answers
286 views

Can OSSEC detect buffer overflow attacks?

I am trying to detect buffer overflow by using OSSEC (a HIDS software) as mentioned in OSSEC rules example and OSSEC book. How can I configure OSSEC for detect a simple buffer overflow example as the ...
0
votes
1answer
221 views

USB stick encryption on specific network/domain

I am in a difficult situation here. For my company I need to make the use of USB sticks secure, their demand is that when someone uses a USB stick it will only be readable and accessible on the ...