1
vote
0answers
4 views

SFTP on Windows - is it likely to be disabled?

I'm a software engineer and I'm maintaining a product that allows a user to run commands and scripts on Linux servers via an SSH connection. We now need to extend this functionality onto Windows. We ...
0
votes
1answer
8 views

Affordable FIM, log monitoring, policy enforcement/checking, IDS?

I've been working with OSSEC for awhile, and it's just been head ache. What are some linux Intrusion Detection Systems that do File Integrity Monitoring, Log Monitoring, and policy enforcement (same ...
1
vote
1answer
32 views

How was my email intercepted?

I've recently sent an email to a non-Protonmail user, using a code phrase. Someone on the recipient's home network was able to intercept the email and responded to me in detail as to the content of my ...
1
vote
2answers
16 views

Multiple Versions of Intermediate SSL Signing Certificate

I was checking out the SSL chain on onlineaccess.ncsecu.org because a network glitch made me paranoid. Both Firefox and IE on my computer have this chain: onlineaccess.ncsecu.org Serial number ...
1
vote
0answers
17 views

Basic scrypt question

Suppose we throw a regular password into scrypt to generate some data. Scrypt allows us to specify how large the output data should be. My question is, to take an extreme case, if we ask for a 1 GB ...
2
votes
0answers
20 views

A simple HMAC question

Suppose I use a key (and IV) to encrypt a piece of binary data with AES-256-CBC to produce the corresponding encrypted data. Suppose I then throw this encrypted data into HMAC-SHA512 using the same ...
3
votes
2answers
66 views

Is storing encrypted data in a database futile?

The way I see it: there are two ways to encrypt data for a web app. 1) Store a single encryption key on the server, and use it to encrypt / decrypt data at runtime. The obvious issue here is that if ...
11
votes
1answer
634 views

What is this? Virus or scanner?

I found a new file in my WP root folder and contains this text: <?php ...
-3
votes
0answers
57 views

How does a person fully secure his home IT infrastructure [on hold]

I'd like to know how to set my router to only let ten specific IP-MAC addresses through? Also if the Windows 7 OS & 8 OS can be set so that malware/spyware cannot operate to give permissions to ...
0
votes
1answer
24 views

Certificate validation Local DNS hosts file

I've a question regarding a certificate validation error I'm getting. I'm performing an https request from one machine to another (windows machines). On the destination machine I've configured a ...
1
vote
0answers
17 views

Is it okay to add CSRF synchronized token by modifying HTML from a valve/filter?

Is it okay to modify the html and add a hidden field containing the CSRF token to all the forms inside a page using a valve or a filter before going to the browser? I'm thinking on this line since I ...
-4
votes
1answer
43 views

MPR I suppose somehow I found a way to make a super hacker angry with me [on hold]

I suppose somehow I found a way to make a super hacker angry with me. I've lost three cellphones. It might have all started with the iPhone 4 getting locked then both androids to simlock. And I'm at ...
1
vote
1answer
33 views

Different types of DDoS attacks

What is behavior of UDP flood, TCP SYN flood, Ping of Death and Smurf attack?
9
votes
2answers
264 views

ISO27001 and Linux/Ubuntu

My company has ISO 27001 certification. They provided me a new laptop with Windows 8 OS in it. I asked if I can have a Linux/Ubuntu OS installed, they said that it is not possible due to the ISO 27001 ...
0
votes
1answer
29 views

Setting the HTTPOnly flag for PHPSESSID cookie

I am getting this message from my security audit: Cookie name: "PHPSESSID" Cookie domain: "xxx.xxx.xx.xxx" If possible, you should set the HTTPOnly flag for this cookie. How can I set ...
-1
votes
1answer
26 views

I can't copy files from a HDD, do I need permission from my own account?

My friend wanted me to back up all the photos and music and text documents on his hard drive so I'm trying to do that. He gave me the whole computer. It's really old. It's an OEM machine from 2005 ...
0
votes
1answer
33 views

Staying logged in as a user for remote access (such as Team Viewer) Pros & Cons

This company we newly help have no remote access policy for say, but they allow the users to use Team Viewer. I have noticed some user leave their PC logged in all night and weekends and just shut ...
1
vote
1answer
59 views

Secure Flag and HSTS in HTTPS Only site

If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
-2
votes
2answers
27 views

What is the weakness of aircracking wifi attacks?

I did not come to anything after searching Google for some time. What's preventing someone from just doing an aircrack wifi atack and do any kind of attack once logged on the victims network?
0
votes
0answers
14 views

OSSEC is making AWS EC2 instance w/ Centos 7 become unresponsive

If I start OSSEC, my Centos 7 AWS instance becomes unresponsive after a short while (under 30 mins usually). httpd and ssh do not respond ever until I go into the AWS console to reboot it. I've ...
0
votes
0answers
12 views

How to generate “CRL numbers” for X.509 CRL

(Context: I'm working a process to publish a CRL periodically -- eg once every day.) With standard X.509 certificates, "serial numbers" are required to be positive integers, but they do not need to ...
1
vote
0answers
9 views

Requirements Placed on a User of a FIPS 140-2 Validated System

Per customer requirements, I am working with a FIPS 140-2 validated network switch that is actually running in FIPS mode. This guarantees that any cryptographic operations the device performs will be ...
0
votes
0answers
24 views

Using UUIDs for non-guessable URLs

How safe is using UUIDs as URL identifier for non-guessable IDs? Specifically UUIDs generated by Python's uuid4() function, using base64 encoding. E.g. ...
2
votes
3answers
52 views

In the context of SSL Labs where is the “trust store”?

When I'm testing a site with https://www.ssllabs.com/ssltest/ I'm getting this: Could you explain: Why are there two paths? Where do they come from, where are they configured? What is this "trust ...
15
votes
6answers
2k views

Why no self-hosted email? (Snowden, Lavabit, Hushmail, NSA)

Why would anyone like Edward Snowden rely on 3rd party services like Lavabit or Hushmail to host his email? I mean it's very easy to set up a self-hosted email server. What you need: Rent VPS (even ...
1
vote
1answer
28 views

Does any VPN protocol authenticate the server?

When you connect to a server using SSL/TLS the client authenticates the server using the certificate that the server provides. If certificates mismatch an error page is shown instead. So you know you ...
0
votes
2answers
55 views

Could a compromised root CA impersonate any SSL certificate?

My question is about MITM attacks against https and how those would appear to the end user. Suppose a trusted root CA were compromised / coerced into producing fraudulent SSL certificates. What would ...
3
votes
2answers
47 views

Reset links in password expiration emails

Our organization is rolling out yearly password expiration to our 40,000+ users this fall and we have been socializing this change for some time now. However being such a large organization, our users ...
2
votes
1answer
43 views

Tools to demonstrate NO storage of cardholder data

Our organization has been asked to comply with PCI DSS. As part of IT Department, we need to demonstrate that none of our IT infrastructure stores any carhdolder data nor sensitive authetication ...
3
votes
1answer
35 views

Reading magnetic stripe on a credit/debit card with an EMV chip

Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
-1
votes
0answers
38 views

How to reset an HSM server without password? [on hold]

I purchased an HSM online but I do not know the password. Is there a way to reset a HSM server?
1
vote
1answer
37 views

Security server log review

We have a Kiwi Syslog server for Centralized logging purposes. Currently, our focuse is only on monitoring, reviewing and reporting User Account/Password Violations. We already used the necessary ...
0
votes
1answer
45 views

How can I put snort in front of nginx server

I want to prevent attacks to my nginx server. How can I proxy the requests through snort to nginx server. NFQueue's are a solution.I am able to pass packets to snort using the following rules sudo ...
1
vote
2answers
52 views

Methods to keep an autonomous log with high integrity

I'm writing a .NET desktop application that is used to send orders to a server via a REST API. To avoid leaking of our authentication token I have made it so that, when used for the first time, the ...
4
votes
1answer
47 views

How can I see which sites have set the HSTS flag in my browser?

My question is about Firefox and Chrome. Is there a possibility to see which sites have set the HSTS flag in my browser?
-1
votes
1answer
72 views

SSL and Fake Domain

I am reading information related to SSL handshake on the Internet. It seems like in the last step the domain name is compared to the domain in the certificate. How exactly is this protecting against ...
-1
votes
0answers
34 views

how to fix XSS Reflected in java [migrated]

I got fortify report which shows XSS Reflected defect from the below 2nd line. String name = request.getParameter("name"); response.getWriter().write("Name: " + name); Recommendation ...
-5
votes
1answer
61 views

Make really personalised wordlist file

i want to make a really customised wordfile with: 4 letters first + 2 numbers example: divo11 or yeve11 And not like this: p0oiw1 or u4hf3e This wordfile is really important. How can I do it?
3
votes
0answers
98 views

Bypassing Hotel Wifi authentication using VPN [on hold]

I'm currently in a hotel with pay per day WiFi, I have have logged into it a couple of times on my phone. I just turned on my VPN before logging in to the WiFi and it seems to have bypassed the hotel ...
2
votes
1answer
90 views

Facebook hacker [on hold]

My Facebook account was hacked. Searching through security and settings info, Facebook showed that someone was logged into my account from another state and showed some kind of id number. The number ...
0
votes
0answers
21 views

Improve iptables configuration [on hold]

First, I am not able to ping with ipv6 (ping6) to my server even being able to ping with ipv4 (ping). What should I modify to be able to ping to and from my server with ipv6? Second, what should I ...
0
votes
1answer
24 views

How to verify SSL cerficate If restored session after session broken?

For example: User accessed to my web through SSL wih MYCERT. Suddenly hacker break this session, set proxy between user and my web . User connected again over restored session through HACKERCERT. How ...
1
vote
1answer
68 views

Mystery IP address Hijack

I'm working on a customer's new website. To get things up and running quickly, we're maintaining his domain name service and hosting the website on another server. Customer bought the URL name years ...
1
vote
1answer
35 views

Can a salt maintain pseudo-randomness after being modified?

TL;DR: How much can a function (such as the one below) modify an initially random string before that string becomes useless as a salt for password hashing? Is there a general rule? # Function ...
2
votes
1answer
35 views

Is it possible to build completely verifiable hardware?

Reproducible builds like they are used for Bitcoin, Tor or the Debian package repository aim at making sure that the binaries you install exactly equate the source code that they are supposed to be ...
3
votes
1answer
35 views

Secure online server -> Airgap transport?

I'm facing the issue to develop a system which archives some data, which was available via a web-server some time before (to selected users). Now the question arises on how to securely transport the ...
1
vote
2answers
89 views

Is it feasible/possible to have encrypted data that looks unencrypted/innocuous?

i.e., could I send "Let's rob the store at 9 tonight" so that it is impossible to see what I'm saying, but it doesn't look like gibberish and obviously encrypted?
0
votes
1answer
36 views

Can you resalt hash/rainbow tables after finding the salt for something?

After a rainbow/hash table is salted, is it possible to resalt it after finding the correct salt instead of generating it all over again? If not, what is preventing you from doing so? How can you find ...
0
votes
1answer
34 views

Identify encryption algorithm for .enc files

I need to identify the encryption algorithm used to encrypt some files. I have the key, but I can't decrypt it using OpenSSL, because I don't know what algorithm was used to encrypt it. Is there any ...
3
votes
1answer
22 views

How safe is it to use shared SPF record domains?

I'm wondering the following, what if shared SPF records like below are used? v=spf1 include:_spf.google.com ~all v=spf1 include:spf.mandrillapp.com ~all v=spf1 include:servers.mcsv.net ~all Can it ...

15 30 50 per page