-1
votes
0answers
7 views

One WAN connection causing huge data usage on the other WAN port of the router TL-ER6120 [on hold]

We have a TP Link router TL-ER6120 with two WAN ports. We have two ISP broadband connections (with Static IPs) connected to these two WAN ports. We are noticing that when both connections are up, ...
-7
votes
0answers
23 views

Firewalls are not build to protect [on hold]

The advance firewalls are build to protect DOS & DDOS. But the older firewalls are not protect the Dos, Ddos.
-1
votes
1answer
19 views

Random IPs in ARP/RARP table with the same mac address?

I was looking at my router settings and saw a bunch of IPs with the same mac address in the ARP/RARP table. The GEOlocation of them all ranges across my country, any ideas to why they are there? ...
-2
votes
0answers
14 views

information about vpn [on hold]

AGR mein aik VPN server k sath connect hun my real ip is 192.168.8.9 and virtual ip is 44.25.453.213 ab agr at same time koi aur bhi ise vpn server k sath connect hai tw uska virtual ip kya aye ga ?
0
votes
0answers
32 views

Is it possible for an attacker to log keystrokes of a bluetooth or wireless keyboard

Bluetooth and wireless keyboards are sending keystrokes wirelessly. Could this mean that an attacker (or spy) can log the keystrokes by monitoring the wireless or Bluetooth radio waves (or whatever)? ...
2
votes
1answer
27 views

Can you trace someone through picture header information?

I learned that jpg, png, bmp and most image files contain headers and plain text in them. I decided to open a jpg file in Notepad and saw a bunch of information and I was wondering if there was a way ...
1
vote
1answer
45 views

Do hackers still use iterative password cracking techniques?

It's World Password Day! Rejoice, for today is the day that all of our friends will change their passwords from abc123 to 123abc!!! While we're on the topic of passwords, one thing websites do to ...
0
votes
0answers
8 views

Is it ok to use one key pair for my authentication endpoint?

I have an web endpoint that checks user passwords, then issues signed JWT tokens to the client if password matches what we have in the database. The JWT is signed with a RSA private key using RS512. ...
0
votes
0answers
7 views

Data integrity and authentication of an Arduino using JSON Web Tokens and HMACs

I have a school project involving an Arduino-based sensor that needs to send sensor readings to a server via HTTP. The sensor readings do not need to be encrypted (it's okay that people know what they ...
-3
votes
0answers
15 views

needing help with a lot of things including GitHub Jason format code pulse someone has hacked my system and all sorts of stuff [on hold]

I know nothing about any of this but I know a lot of stuff is going on they have access to Everything I Do please help but it greatly be appreciated any information at all thank you so much
2
votes
2answers
21 views

Should HSTS header be sent on an error response?

We need to configure our loadbalancer to send the HSTS header and we are debating whether or not to send the header on HTTP 4xx/5xx responses. Our main concern is application layer DDos attacks. We ...
0
votes
0answers
12 views

DVWA hydra brute not matching

I am trying to brute force DVWA on low security. I disabled the first authentification as well. However when I ran my hydra script it doesn't match it with correct password. Here is my query hydra -l ...
0
votes
1answer
39 views

Is a password-protected excel file considered secure versus encrypted file or email

I understand that encryption is the highest form of security for document/data storage. While a password-protected document is more secure than one without password protection, if the document is ...
3
votes
5answers
459 views

How secure is changing or adding a single character in your passphrase?

I'd wager quite a many people are required to periodically change their passwords for certain applications or even at the office. I'd also wager that a large percentage of these people "change" their ...
0
votes
1answer
14 views

Can a 3rd party validate the origin of an HTTPS session?

I'm wondering if HTTPS can be used as proof that a server reported an answer. If I understand correctly, the initial handshake is for HTTPS is the only time that the public/private key of the server ...
0
votes
2answers
76 views

How can you be sure that there is a virus on your computer?

Am I being paranoid? I'm seeing signs of a virus everywhere on my computers but I have no way of being sure. I've tried scanning with Windows Defender multiple times but haven't found anything. My ...
0
votes
1answer
25 views

Getting user to login, then checking if someone is logged in already

I'm horrible at security so I was curious if you guys had any ideas. I recently wrote an application in Python that I will be selling to select people. The information on the application is private ...
2
votes
4answers
524 views

Can malware bridge external storage HW power-off switches?

Right now I have a backup setup which involves a 3.5" external USB-HDD with a seperate power-supply (as is usual for such drives). This HDD is internally a standard SATA HDD with USB+Power wrappers. ...
12
votes
6answers
888 views

Find matching phone numbers without actually knowing them

We have a mobile app that, given two users, needs to let them see what common contacts they have based on their phone numbers. How can we do this in a cryptographically secure way and respecting the ...
1
vote
0answers
25 views

Vulnerabilities of using a token based authentication such as this

I'm developing a backend REST API for one of my mobile apps. I'm looking to create a token-based authentication system that would allow for a persistent login and I'm wondering if there are any ...
-1
votes
0answers
19 views

I would like information regarding possible security violation [duplicate]

How to figure out if someone has been using TeamViewer 8 to access my computer remotely?
1
vote
1answer
28 views

Using TOTP instead of passwords for IoT device authentication

I am trying to come up with a way to authenticate an IoT device to a server. Since the device is "un-monitored", I cannot expect a user to enter a password on the device whenever the device starts or ...
0
votes
2answers
45 views

Asp.net web forms is not generating a new session id if a user logs out and logs back in

Asp.net web forms is not generating a new session id if a user logs out and logs back in. Is this a major security risk? We're using SSL.
-1
votes
1answer
29 views

Running an app in docker on Windows

If I run an app in a docker container using Kitematic, does that help protect my system from that app? I mean: does it prevent any problems if the app tries to damage the Operating System?
0
votes
2answers
62 views

Obfuscate Identity for Password Reset Information

I am just wondering your opinions on why it would/would not be a good idea to mask or obfuscate email address data in a password reset web submission once the user has entered their username informing ...
0
votes
1answer
53 views

How does a DNS provider provide SSL?

I use CloudFlare as my DNS provider for my domain, and I learned that they provide SSL. I was confused as to how a DNS provider can provide SSL because my communications between the client and my ...
2
votes
0answers
23 views

How can I ensure that phone app traffic is using HTTPS? [duplicate]

When I access a website, I know just by looking at the URL whether it's HTTPS or HTTP. If I'm using an app on my phone, I cannot see this. So if say the app wants me to enter a password in to create ...
0
votes
2answers
66 views

How do data breaches of account login information end up in plaintext?

For example, see this story. Am I missing something here? Are the login details actually still encrypted? I don't understand how it is possible for a data breach of what I assume is encrypted ...
1
vote
1answer
31 views

How can I list all self-signed certificates in my stores on a Windows client?

I'm on a mission to list the self-signed certificates ('issued by' and 'issued to' match) on my machine via an automated method. PowerShell is available for use. Preferably the results would be ...
16
votes
2answers
2k views

Why I am getting Facebook login pop up for every site?

My Chrome browser keeps prompting me for Facebook authentication, even though I have never logged on to Facebook from my PC. I am using Chrome browser from my company where they have a strong proxy ...
0
votes
0answers
7 views

How to configure Tor browser without Vidalia on Mac OS X? [migrated]

I have a problem with finding a configuration file for my downloaded Tor browser bundle (the default installation from project webpage). I want to adjust some advanced settings for my Tor browser, and ...
3
votes
1answer
37 views

How can AES-CBC be used for LUKS encryption, when the ciphertext is not static?

In CBC mode of operation, ciphertext from previous block is used as IV in next block. How then can AES-CBC be used for disk encryption (LUKS), when the data on the disk (ie the ciphertext) keeps ...
2
votes
1answer
36 views

How to detect, inspect and delete a super cookie of a specific website?

Definition of supercookie from the paper I am reading: "Supercookies settle in parts of the system that are harder to erase, and include the usage of Flash Local Shared Objects and IE Local ...
3
votes
0answers
36 views

Is there a place where I can upload my honeypot logs to?

Maybe a weird question but I've had a public facing HTTP/SSH honeypot for a little bit over a year now and was wondering if there was any place that I can upload my logs to? There are a bunch of ...
5
votes
0answers
36 views

Is it possible to disable all PHP functions not used in my application?

I want to secure my PHP installation. I can disable some functions, like system(), exec() etc using disable_functions in php.ini. But I can forget to disable some dangerous functions. Is it possible ...
3
votes
1answer
40 views

Can canvas fingerprinting be prevented?

How can canvas fingerprinting be prevented in web browsers? The site Panopticlick said I had a hash of WebGL fingerprint of 5 bits of entropy. I installed CanvasBlocker addon and tested again and it ...
2
votes
2answers
27 views

Is QUIC (Quick UDP Internet Connections) safe to allow through firewall?

Our firewall currently blocks QUIC (UDP 443) traffic which seems to be enabled by default in Google Chrome. Is it safe to allow QUIC or should I wait until it is implemented in all the major browsers? ...
0
votes
1answer
26 views

How to check if any host trying to connect back to the my executable(application)?

Last month i have downloaded some hacking tools!!! After that i'm having a strong feeling that some host trying to connect back to the application(don't know whether i'm been monitored or not). Is ...
3
votes
2answers
49 views

For high entropy credentials, is SHA256 hashing good enough?

Let's say I've got a database of high-entropy credentials (e.g. 256-bit random values) used as API keys by clients. I'd like to hash them in my database so that a database compromise doesn't allow an ...
2
votes
2answers
115 views

Suspicious Network Activity - is my system compromised?

When using Firefox to open a blank page, I have a weird network connection that shows under Network Activity in Resource Monitor (Windows 7). The address is: insiders-guide.pacedev.com. A ...
1
vote
1answer
20 views

How could you detect and defend against this type of (local) man-in-the-middle attack?

Consider this type of non-standard man-in-the-middle attack, which is fundamentally the same nature of attack without the poisoning phase being required: Someone cuts the internet line at your ...
-2
votes
1answer
22 views

Is it fundamentally possible to prove a current industry standard end-to-end system of secure data storage and transfer?

I know we can design an ultra simple system that is proven to perform one thing with perfect security. We've done that. That's called a proven system, and it has been done with micro-kernels. (An ...
0
votes
0answers
20 views

Should RSA primes p and q should differ in length by “a few digits”? [migrated]

When generating RSA keys in the original RSA paper it is stated: "to gain additional protection against sophisticated factoring algorithms, p and q should differ in length by a few digits" Why is ...
0
votes
1answer
22 views

Null byte injection to run PHP?

A website accepts form input and outputs it to the screen, but replaces every <? to <--? turning them to comments. Let's say I POST the following: <?php echo "xy"; /* arbitrary php code */ ...
59
votes
8answers
8k views

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

I received the following email, addressed to me at an email address on my personal domain (for which I run my own mail server on a VPS): FORWARD THIS MAIL TO WHOEVER IS IMPORTANT IN YOUR COMPANY ...
0
votes
0answers
5 views

how do i fixed this “Ports are being used. Please change ports numbers.” in samsung all in one security system? [migrated]

I have a samsung all in one security camera system and I had set up my camera system online and it was working perfectly almost a week. One day i wasn't able to view my camera online so just checked ...
1
vote
2answers
26 views

How do hardware OTPs work - from a developer's perspective?

I've recently stumbled across the Gemalto IDPrime MD series of smartcards which offer PKI and OTP functionality (I know the difference in key management / generation and user oriented usage). Now I ...
0
votes
0answers
20 views

Are any container solutions secure enough to run fully un-trusted code, particularly as a VPS service?

A number of answers here on this Stack Exchange argue that containers are inherently insecure and one should never run untrusted code in a container, let alone run a container built entirely by ...
3
votes
2answers
53 views

Why does OWASP ASVS require HTTP responses to have a content header specifying a character set?

The OWASP Application Security Verification Standard (ASVS), Version 3, states in clause V11.2: Verify that every HTTP response contains a content type header specifying a safe character set ...
0
votes
2answers
126 views

How to prevent the latest ImageMagick vulnerability?

According to the CVE-2016–3714 there are a some vulnerabilities in the ImageMagick program (4 packages) : Insufficient filtering for filename passed to delegate's command allows remote code ...

15 30 50 per page