0
votes
0answers
7 views

How does Facebook Lite send user and password when login?

I've recently tried to sniff username and password from Facebook Lite app for Android. I checked HTTP POST packets but I didn't see any of them. It seemed like FB Lite app didn't send username and ...
0
votes
0answers
10 views

Weird drive popped up randomly

I just had a random drive pop up as I was doing a defrag on my hard drives (windows 8.1) and I have no idea what it is or what it does. It's called: "\?\Volume{5a1f49..." what is it and is it harmful ...
4
votes
0answers
21 views

Why did browsers deprecate 1024-bit RSA, but retain SHA-1?

I was reading Mozilla's security blog Phasing out Certificates with 1024-bit RSA Keys. Effectively, some browsers are deprecating 1024-bit RSA for CAs and Subordinate CAs because the certificate must ...
0
votes
1answer
35 views

Is using a self signed certificate safer than a free ssl certificate?

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...
0
votes
0answers
12 views

Which remote or cloud backup/sync solution meets the following criteria? [on hold]

I have been searching high and low for a backup/sync solution that meets a few different needs, but have yet to find one that does the job reliably and at reasonable cost (max $20/month, preferably ...
0
votes
1answer
23 views

Who uses 1024-bit RSA?

I know they're deprecated, but does anyone still use 1024 bit RSA encryption or certificates? Do you know of any examples of systems that use it today? What would be the implication if someone ...
0
votes
1answer
14 views

Is Two-way SSL sufficient for Multiple web servers communicating to each other?

I have a fixed number of web servers. Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one ...
1
vote
1answer
19 views

Rationale behind hiding originating IP address in emails?

Gmail has been hiding originating IP addresses for quite some time now. Hotmail and Yahoo have started doing this too. Apart from obvious privacy implications of revealing the sender's IP address, is ...
0
votes
0answers
24 views

Host Protected Area forensics

I see vague notes on forensic HPA interest, but it's never specific. What kind of information can be extracted from a PC's HPA? From ...
0
votes
2answers
38 views

Is there any way to determine the location of a laptop based on the MAC address or laptop serial number? (Lenovo)

If I have the MAC address and S/N of a Lenovo 3000 Laptop, is there some way for me to find exact street location of this laptop ? This machine was stolen from me last year and was my back up machine ...
-1
votes
0answers
11 views

Analog Camera with Static IP

For office, I have couple of analog cameras and DVR system. Now, I want to watch the live video on my phone when I away. I got a fixed IP from my ISP, and have a router. But what settings to do for ...
1
vote
3answers
45 views

Should I use my trusted VPN for all my traffic?

I use my trusted VPN primarily for the sake of anonymity (to avoid data being collected about my Internet browsing), although I am aware of its security benefit -- traffic encryption. My question, ...
-5
votes
0answers
19 views

How to scan a target behind a firewall using Firewalk? [on hold]

I have used firewalk nmap script and the output of this script is: Host ip XX.XX.XX.XX Blocked ports 1,3-4,6-7,9,13,17,19-20 Traceroute: my router ip not important ip ip ... the host which in ...
2
votes
3answers
52 views

In a monitored network, can the admins tell if Tor is being used?

I'm not asking if Tor is secure, I'm asking if an observer can know you are using Tor? For example if a persons ISP or company network monitors traffic would they be able to determine with certainty ...
1
vote
1answer
46 views

Is HTML5 sessionStorage secure for temporarily storing a cryptographic key?

Assume I am building a local web application (e.g. browser extension) in HTML5 to encrypt a database locally. Access to the database is controlled by a password and a cryptographic master key is ...
0
votes
0answers
12 views

Where can I view IO device history in Windows (8/7)? [migrated]

Essentially I need to view the IO devices that have been connected/disconnected in the past, and when they'd been connected. If such logs don't exist, how can I record them? I was able to find ...
0
votes
0answers
36 views

How to begin learning about cyber security? [on hold]

I've been trying to self-teach myself various parts of cybersecurity, and I've been having a lot of trouble finding good resources for beginners. Are there any good sites visits or other resources ...
0
votes
1answer
23 views

gstatic.com resolves to local isp

In the light of Snowden revelations I become very paranoid. Yesterday I did a netstat -t -p and from my browser there were several connections pointing to my isp. I had only 2 pages open. Trying to ...
2
votes
1answer
30 views

Is it safe to enable SSLv2 ClientHello support?

In the wake of the POODLE attack, many web sites have dropped support for SSLv3. But some clients still in relatively common use as of May 2015 still initiate the handshake with an SSLv2 ClientHello ...
0
votes
2answers
33 views

How can I avoid buffer overflows when programming an Android app?

I'm just starting out in Android and I've gotten my head around general programming within Android, but I've recently started trying to research security within Android. What coding practices would ...
1
vote
0answers
17 views

Firewall in virtual machine

I'm putting my server to use as a file server and a firewall. I'm looking at KVM or Xen VM setup where file server and firewall get their own VMs and host is just supplying the hardware (so Xen way, I ...
3
votes
1answer
25 views

How does Memory Corruption apply to Android?

I have researched several DoS attacks within Android e.g.: CVE-2015-1474 CVE-2013-5933 CVE-2013-4710 CVE-2012-6301 etc. And although I found DoS attacks within Android difficult to understand at ...
1
vote
1answer
27 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
-6
votes
0answers
29 views

I have iPhone 6 plus - can my boyfriend hack into my accounts? [on hold]

I have iPhone 6 plus - can my boyfriend hack into my accounts using apps or anything?
6
votes
2answers
264 views

How does getting a remote shell via exploiting a vulnerability really work?

I can understand what a buffer overflow is and that it allows you to write in places of the memory that you shouldn't be able to. I can also grasp the concept that there may be other software ...
2
votes
1answer
24 views

REST API - XSS prevention - When and how?

I am currently developing a REST API with Java EE and MySQL, it will feed Data to a Android App. The Data comes from an AngularJS Frontend. So my questions are, when: When do I escape the data? Before ...
1
vote
1answer
40 views

Is it worth it to implement both SHA2 and SHA3 at the same time?

I'm creating a password storage system for a web server I'm building for fun. Would it be more secure for me to use both SHA2 and SHA3 for hashing, and then store them in a database? If I use both ...
0
votes
0answers
9 views

How secure are Ubiquiti Networks UniFi AP's restricted subnets?

I have a UniFI AP and create a quest network with subnet restriction 192.168.0.0/16. My local network is in 192.168.178.0/24. The gateway is 192.168.178.1. My question is: Is there a way that quests ...
1
vote
1answer
36 views

How to filter secure (HTTPS) websites by URL with regular expression?

I need to block access to certain pages on a website using regular expression and/or wildcard. The site uses https and therefore cannot be blocked using regular parental control filters (this is ...
0
votes
3answers
58 views

What does this snippet of code do exactly? found it inside a number of files on my webserver [on hold]

Okay so I found some PHP code as I was randomly editing a website I've had for a very long time and I have noticed this: <?php #2b8008# error_reporting(0); @ini_set('display_errors',0); ...
0
votes
0answers
23 views

Windows Firewall Connection Security with Certificate (2)

I have a similar problem as the question with the same title from last October. On a Windows Server 2008 machine, using Windows Firewall's Connection Security rules, I need to establish an IPsec ...
0
votes
1answer
41 views

What makes an Android application vulnerable to Directory Traversal?

Definition of Directory Traversal Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root ...
1
vote
0answers
53 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
1
vote
2answers
61 views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution ...
3
votes
3answers
58 views

Why does Windows have a place to store intermediate SSL certificates?

As I understand the process of verifying a remote computer's SSL certificate, the remote system sends its 'leaf' certificate and any intermediate certificates, but not the root certificate. Executing ...
2
votes
0answers
24 views

General Entropy as opposed to Password Entropy [duplicate]

I know that the formula for the entropy of a message is: (I believe b can be set to 2) but when calculating the entropy of a password websites usually only compute log2(p-1), ignoring the first ...
4
votes
0answers
34 views

When do shared disks “leak” data to other VMs, and how is that mitigated?

Inspired by this answer, I would like to know what are some common threats and mitigation techniques used to prevent one VM from leaking data to another via the shared storage infrastructure. ...
4
votes
3answers
850 views

Does altering characters of a file url lead to another file?

I have a link to a file which is stored in cloud: https://docs.google.com/file/d/0B8Tf19cw9c8SNnFPamhRWGFwaTq (I have edited a character from the original for privacy) So if the garbage ...
-1
votes
4answers
71 views

Security software to shutdown PC unless specific approach?

For future refence: In light of answers and critique, my question should have been: 1. How does one make sure a physical attacker with access to a powered, but locked FDE PC fails his/hers attempt to ...
3
votes
1answer
31 views

How to decrypt email with revoked key in enigmail?

Is it possible to decrypt a message which is encrypted with a revoked PGP key? I still have the private key, but Enigmail doesn't show me revoked keys neither does automatic decryption. Edit: I ...
1
vote
0answers
14 views

Logging login events on my Windows 7 desktop OS to a file [migrated]

I suspect someone is login into my computer when I check event viewer. Is it possible to have a script on windows 7 to record every login onto my windows 7 desktop pc?
3
votes
1answer
50 views

Found this textarea with PHP in it. Might it be malicious/exploitable?

I came across this textarea on the website of a Medical Center. Clients enter sensitive medical data here. What users see: HTML: <textarea name="message">&lt;?php echo ...
2
votes
1answer
50 views

How can someone sniff dial-up connection using phone line?

Let's assume we have a computer that sends packets to the internet using dial-up connection, and we have access to the analog data on the phone line(we have access to the phone line), how can we make ...
3
votes
1answer
42 views

Is it safer to store valuable information on a unsecure client or send the data through the internet?

Background: I'm creating a secure web app with the purpose to act as a no-knowledge storage for small data (we're talking a few bytes). Since all the encryption and decryption happens client-side, ...
0
votes
2answers
40 views

Is WPA(2)/AES or some derivative really perfectly secure?

It is said they are uncrackable for now, but my question is how much uncrackable are they? Of course, it requires a situation to answer this, so here comes an assumed situation(the worst possible ...
0
votes
0answers
50 views

Is there any Windows/Linux host officially available on the Internet for practicing penetration testing? [duplicate]

Is there any Windows/Linux host officially available on the Internet for practicing penetration testing? I am having continuous trouble with Virtual-Box. It is horribly slow to load and giving me ...
0
votes
2answers
34 views

Preventing SSL strip attack

Is it possible to detect a ssl strip attack by checking whether the page deliverd is https or http using javascript?I am assuming that the response page is https page instead of http?
0
votes
1answer
40 views

Can XOR be used in a Merkle Tree instead of concatenation?

I am trying to understand why, in a Merkle Tree, the concatanation between hashes is used - and not for example the XOR operation. Can they be considered the same for the purpose of a Merkle tree? I ...
15
votes
3answers
2k views

Server for School Coding Assignments

An introductory C++ course is offered every year in our university. In order for students to code in C++ and submit their assignments, we give them shell access to a Linux server. They use ssh to log ...
2
votes
1answer
26 views

How can the parallelization in CTR mode be attained?

I am using CTR mode to encrypt/decrypt files. Theoretically CTR mode is faster than CFB or CBC because of its individual operations on blocks. In my case CTR mode takes almost as long as CFB. How can ...

15 30 50 per page