0
votes
0answers
6 views

Specificity of ECDH(E) in a TLS handshake

It's just a short question, but I haven't find a clear answer yet... It's in the frame of a TLS-ECDHE handshake. Where does the specificity of the ECDH, over the DH, appears ? When is an elliptical ...
0
votes
0answers
8 views

How to detect office Malwares

There are many undetectable Microsoft Office malware samples. I'm trying to detect them by dynamic analysis of cuckoos sandbox. Most of Malwares contains embedded exes but if I write rule to detect ...
-1
votes
0answers
10 views

Comparison of Vulnerability Scanners

I would like to have a comparison of Network Vulnerability scanners (Not web application scanners). Could some one recommend me a website where this is possible ? Gartner doesn't seem to have one. ...
-2
votes
0answers
12 views

Which algorithm for erase does iTunes use? [on hold]

Maybe someone knows which algorithm iTunes uses when you select restore and update?
0
votes
0answers
9 views

Difference between cisco 6509 Supervisor Engine 2T and 720 [on hold]

Is there a physical difference between the Cisco 6509 2T and the 6509 720? I see that they both have different slots. However, can we make a 2T a 720 by replacing that whole slot? or is the switch ...
2
votes
2answers
29 views

Does CVE-2015-5352 work if there is no active X-Server?

My security program shows that one of my servers is vulnerable to CVE-2015-5352. If X-Server is not running (not even installed) is the system really penetrable by that vulnerability?
5
votes
1answer
36 views

Should DSA keys be considered deprecated?

The gist of openssh deprecates dss-keys appears to be: "In light of recently discovered vulnerabilities openssh deprecates DSA keys." Does this mean I should generally consider DSA keys ...
1
vote
1answer
29 views

How does a public key authenticator work? (as opposed to public key signatures)

In the documentation for djbs library NaCl under the headline Security model you can read that the library provides public key authentication without non-repudiability (http://nacl.cr.yp.to/box.html). ...
11
votes
2answers
687 views

New vulnerability in TLS protocol?

It was figured out in the discussion of proper way to drop authenticated client session (see (proper) way to inform TLS server to drop TLS session with clientAuth). According to RFC 5246 & RFC ...
0
votes
1answer
27 views

Is it possible to issue a certificate with different attributes than in .csr?

Is it possible to issue a certificate with different attributes than in certificate siging request? I have a keypair and I generated a cert. request with extra attributes. Can the CA/RA or anybody ...
1
vote
0answers
11 views

How to disable typed arrays in firefox as rowhammer mitigation

I am concerned about the potential attack surface exposed by JavaScript typed arrays as a means of performing rowhammer attacks. Is it possible to disable (via official means or otherwise) typed ...
-3
votes
0answers
18 views

SQL Injection errors & FILE permission issues

First, does this error also entail SQL Injection? Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in /home/localhost/public_html/admin/login_check.php on line 12 If so, ...
1
vote
0answers
4 views

Unfamiliar connection alert on Little Snitch

I've got a Macbook running Yosemite 10.10.5, on wifi, sharing it with three other people in the household. I currently have Avast on my Macbook (I know, I know), and its web shield works by acting as ...
0
votes
1answer
47 views

Strange IP's on my firewall log

Check the screenshot of my router firewall log below, I can see traffic originating from strange IP addresses to my public address. What are these? I've just setup this router few hours ago, am I ...
5
votes
2answers
915 views

Is there a way to download a PHP file without it being executed?

I recently got a phishing mail of unusually bad quality; "Please imediatly sign in under the following link, as we are your bank, you know"-ish. The link points to an unconvincing URL with .php at the ...
0
votes
1answer
29 views

Is it safe to keep a virus' binary code on your local machine?

Is it safe to keep a file containing the virus (binary?) code on your local machine without executing it? I am testing my application against malicious file uploads and and wondering if it's safe to ...
0
votes
0answers
19 views

Block website for all user agents expect one and allow all user agents to specific URL [on hold]

I want to block all user agents except one for entire website, and at the same time allow access all user agents to one specific URL. When any user want to reset password I need to unblock all user ...
0
votes
2answers
50 views

Does having these ports open indicate any vulnerabilities?

I installed Ubuntu Gnome a couple of weeks ago along with a few packages and some software. When I scanned my localhost using Nmap, I got the following results. Are there any obvious vulnerabilities, ...
0
votes
0answers
56 views

Is TrueCrpyt still safe, or is VeraCrypt the better option now? [duplicate]

I know that TrueCrpyt stopped updating a while back and it has a warning saying that it may not be safe due to unpatched security issues. I have a version of windows with Bitlocker, but the fact that ...
0
votes
1answer
63 views

What are the vulnerablities for revealing IP addresses in code

One of my developers left the IP inside his code : The code is as follows : [WebMethod] public string UploadFile(byte[] f, string fileName) { try { MemoryStream ms = new MemoryStream(f); FileStream ...
0
votes
0answers
37 views

How can I hide a program from another program?

If program A scans RAM, running processes and whatever can I hide program B? Basically I don't want program A to detect program B or at least stop it from identifying it. Is this possible? or is ...
0
votes
2answers
22 views

Test registration form using brute force

I need to test if my website registration form can have problems with brute force attacks, because this form requires an invite code. Is there any tool for this kind of test?
1
vote
1answer
33 views

How to make the most secure text editor in Django?

As a follow up to this question, I'm wondering what is the most secure way (using either markup or markdown) to allow users to format their inputs and upload images in a Django app? I'm not asking ...
0
votes
0answers
9 views

Is is possible to configure IE to automatically run an EXE? [on hold]

I have a Cuckoo sandbox. When it's pointed to the URL of an EXE, a IE security dialog comes up, and asks weather to run, save, or cancel the download. Cuckoo clicks cancel because it is the button ...
-1
votes
3answers
57 views

Can these html tags and attribs make my site vulnerable?

I am developing a social website and want to allow user ONLY these html tags and attributes in their posts: tags: <img>, <b>, <strong>, <blockquote>, <a> attributes: ...
-5
votes
0answers
37 views

What infrastructure is there to attack in Lynnwood, WA? [on hold]

I've been watching this live attack site for some hours, and find it strange that Lynnwood is getting massive attention from (mostly) Chinese attacks. What's there to attack? Yes, it's in Washington, ...
4
votes
1answer
80 views

Siri DDoS over FM Radio

A few days ago i was driving home and suddenly Siri started to talk by her self in reply to a command i never gave... as you can imagine i have the "hey siri..." feature active, so i can make calls ...
0
votes
0answers
6 views

qkd - Does BB84 rely on a prearranged code? [migrated]

First of all, sorry if the title is not that clear, I'll provide an in-depth explanation behind my question. So, basically I was reading about quantum cryptography and came across BB84. The protocol ...
1
vote
1answer
37 views

Does the server certificate control the cipher suites available to secure the communications?

If a CA signs a certificate with a SHA1 signature hash algorithm, does that mean a client would be unable to communicate with the server if TLS 1.0 and below is disabled? I think what I'm asking is ...
0
votes
2answers
328 views

What current algorithms are considered (un)secure? [on hold]

With the new release of Windows 10, Microsoft has given .NET, Javascript and C++ developers a whole new bunch of options for cryptographic algorithms. Where as the old .NET code only allowed AES and ...
1
vote
0answers
24 views

msfvenom doesn’t generate raw shellcode output properly

I'm doing the Windows Buffer Overflow Exploitation section of the OSCP course, and the author uses a combination of msfpayload and msfencode to generate a windows/shell_reverse_tcp payload encoded ...
3
votes
1answer
45 views

Phishing/Malware redirection through AdExchange on Android

Issue: Yesterday I discovered a strange behaviour in the Chefkoch.de App. During the search for recipe, Firefox opens up with a (German) phishing warning screen. This happened not only on this ...
0
votes
0answers
3 views

Firewall Throughputs [migrated]

I am looking at purchasing a new UTM/Firewall device for the sole purpose of bandwidth control/utilization and guest modes. I have the following terms that are troubling and I would like someone to ...
1
vote
1answer
28 views

EMET disable DEP on IE for specific site

I'm a new user of EMET. I wanted to know if there is anyway to avoid DEP on IE for a specific site. I want to do this because I use VMware remote server and when I start a remote console, EMET starts ...
0
votes
0answers
29 views

Vecracrypt Outer Layer shows incorrect free space thus giving away the hidden layer? [on hold]

I just tried the veracrypt hidden volume for fun today, I was interested in how it works. I used the encryption on an old 2TB HDD, copied some files on the outer layer and then mounted both volumes. ...
-3
votes
0answers
11 views

/bin/bash is gone? [migrated]

I typed the following command, and now bash isn't working. $ sudo chmod a-x /bin/bash_old /bin/sh_old It just says: login: /bin/bash: No such file or directory.
-3
votes
1answer
57 views

Google News, unencrypted by default- unless logged in? [on hold]

http://news.google.com Of course, if you are logged into a Google account, it is encrypted. Otherwise, unencrypted by default.. Even when visiting Google News via a Google search result page ...
1
vote
1answer
69 views

How can storing a userId as client-side-sessions be safe?

The documentation for session handling in ninjaFramework states: [...] Ninja uses so called client-side sessions. The cookie itself stores the information you want to attach to that session. ...
17
votes
5answers
2k views

Is sha1sum still secure for downloadable software packages signature?

We use sha1sum to calculate SHA-1 hash value of our packages. Clarification about the usage: We distribute some software packages, and we want users to be able to check that what they downloaded is ...
1
vote
1answer
41 views

What is the point of signature file in signed JAR/ZIP files

The way JAR signatures (or ZIP for Android) are designed is that they have a manifest file, containing digest for each file in the archive. Then there is a "signature file" that contains digest of ...
0
votes
0answers
15 views

Disguising as another computer using SMB Relay?

I've got a server that constantly checks for the existence of certain parameters on every PC in the web using SMB, if it fails to find those parameters it marks it as a rogue PC. I've understood that ...
5
votes
1answer
69 views

(proper) way to inform TLS server to drop TLS session with clientAuth

Is there a way for a TLS client to inform the server that it doesn't intend to resume its authenticated session(s) anymore? Example: A client established authenticated session with the server ...
0
votes
1answer
34 views

Scope for information security in 2yrs down the lane? [on hold]

I'm a fresher. Very recently I started doing Java course because of the wide opportunities we get to enter into an IT industry. Now, I've got an opportunity to work for a project that's related to ...
1
vote
3answers
390 views

Securing REST API with HMAC and basic auth

I was wondering if giving users choice of a method for securing their access to API would be a good idea. Background: We are creating and deploying applications for our customers, which help them do ...
3
votes
3answers
114 views

How to spoof my IP address to JavaScript and other security concerns

Many websites require JavaScript. However, enabling JS means that a website can run a JS snippet to retrieve the user's IP address (even if they are behind a proxy or VPN). So, how can I (the user) ...
-3
votes
3answers
45 views

Reverse Engineer and Exploits researching [on hold]

Can some one give me a start point for finding exploits in software and reverse engineering? I need some kind of a book or a site... I have background with programming with high and low level such ...
0
votes
0answers
10 views

Maths for the Diffie Hellman [migrated]

With respect to the maths behind the Diffie Hellman Key exchange algorithm. Why does: (ga mod p)b mod p = gab mod p It might be fairly obvious, but what basic maths guarantees this? Why does the ...
2
votes
0answers
134 views

What is the state of cryptographic obfuscation in 2015? [migrated]

Cryptographic Obfuscation is a technique that allows one to obfuscate source code in a secure way (as opposed to insecurely mangling it into spaghetti code.) For example, here is a way to protect a ...
6
votes
2answers
58 views

Using smart cards for email encryption and SSH

Suppose I have a small organization, every user has a recent Macbook Pro, can buy a ~$25 smart card reader on Amazon, and I want to use keypairs where the private keys are on personal smartcards to do ...
2
votes
2answers
42 views

Assuring Client is Authorized to use JSON Web Token

JSON Web Tokens ( JWT ) are server-signed objects that the issuing server uses to identify a user, track session data and authorize requests. The fact that JWT are server-signed gives assurance that ...

15 30 50 per page