All Questions

2
votes
2answers
284 views

Is random data inserted into an encrypted stream easy to retrieve?

Given that I have two pieces of data: A large piece of encrypted data. A small, fixed-size piece of random data. I want to be able to transmit both pieces of data together, but I don't want the ...
27
votes
4answers
23k views

how long does it take to actually generate rainbow tables?

I've been reading up about rainbow tables as I think they're quite interesting cause they're actually a pretty simple concept. Anyway, I was wondering, has anyone been involved in actually generating ...
6
votes
2answers
5k views

Wireless hardware with limited range?

I have never used wireless networking at home, but am considering it. Does anyone make wireless hardware designed for single-room connectivity? Several sources have recommended WPA2, but I'd still ...
26
votes
2answers
33k views

How is OpenSSL related to OpenSSH?

Is OpenSSH using OpenSSL to encrypt traffic? Or something else?
10
votes
2answers
7k views

What is the “openssh-blacklist” package? Is it related to the Debian OpenSSL bug?

What is the "openssh-blacklist" package? Is it related to the Debians OpenSSL bug?
3
votes
4answers
3k views

Problems during Pen-testing of SCADA systems

Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
13
votes
2answers
557 views

How do you address a social engineering and or software weakness/concern in a company or organisation?

Say that you call your bank and are able to start talking about your personal finances, without having given them any real proof of your identity. Well the first thing I'd think would be to change ...
6
votes
3answers
3k views

Cisco IOS question - password management, service password encryption types

I'm university student studying for my certification exam, and I was doing some reviewing today when I found a question that I can't find an answer to. Basically, in the CCNA3 2.4.1 Cisco Netacademy ...
2
votes
1answer
568 views

IP Conflicts / Spoofing

Are there any products / os that behave differently when an duplicate IP address is detected. This may indicate an IP spoof ? Can TCP stack 'shutdown' or stop in order to protect itself ?
13
votes
5answers
5k views

Is it feasible to encrypt customers personal data? (name, address etc…)

Seeing the Sony Personal data kerfuffle unfold has gotten me thinking about the encryption and securing of personal data - obviously credit cards can (and should) be encrypted, making data breaches of ...
12
votes
3answers
300 views

Different MySQL Users Security Benefits

Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a ...
10
votes
2answers
1k views

Stretching a hash, many iterations versus longer input string

I have been reading up on various password hashing schemes, for example the SHA-based Crypt proposed by Ulrich Drepper and used in some Linux versions. A recurring theme here is to 'strengthen' or '...
3
votes
1answer
916 views

IPV6 Cryptographically Generated Address implementation

I am looking to an Cryptographically Generated Address (CGA) implementation in Java or in C++. Would be glad if someone can help.
5
votes
8answers
1k views

Biometric authentication in the real world

can anyone give a realistic estimation, based on real-world experience, of how much biometric authentication techniques are being used in the IT field?
11
votes
2answers
4k views

Is strong cryptography legal across the internet?

In many countries strong cryptography is outlawed. That means you must store the data of your users in such a way, that government of that country can always decrypt it. And if you don't, you are a ...
4
votes
3answers
476 views

How do you make sure a pdf is deleted after being viewed in the browser?

For things like images or html documents, cache headers make sure that the data is deleted when the browser is closed. However as PDFs are opened in a plugin, the cache headers do not seem to have the ...
24
votes
4answers
4k views

“Phishing” red flags and countermeasures

Given the recent spate of intrusions into various networks which have included compromise of subscriber identity and contact information, I figured it would be good for us to have a thread on how to ...
11
votes
8answers
1k views

iPhone Tracking debacle - risks and countermeasures

For those of you who are not familiar with the topic, a quick search will turn up a lot of hits, e.g. see the researcher's report at Got an iPhone or 3G iPad? Apple is recording your moves - O'Reilly ...
11
votes
6answers
3k views

How to securely store my passwords?

Regarding this: Are passwords in memory? So does someone have a good idea on how to securely store my passwords? The: "passwords.txt" -> ctrl+c; ctrl+v a passw is not very secure. I have passwords ...
18
votes
3answers
2k views

Are passwords in memory?

I have an encrypted HDD (dm_crypt). That's why I store my passwords in a simple text file. I usually copy/paste the passwords from it. Ok! Q: If I open this text file then it goes into the memory. So ...
37
votes
5answers
3k views

How do you manage security-related OCD (i.e. paranoia)?

I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though. As society has crossed into ...
4
votes
3answers
478 views

How can IT audit for installation of IIS Express?

IIS Express is a developer tool for Windows XP and higher which provides the full feature set of IIS, but without needing administrator rights. I've seen discussion by some developers who are ...
11
votes
4answers
1k views

Should I obfuscate passwords before hashing? Should I pre-hash them on the client? What about salts?

For fun, and in my spare time I'm creating a simple CMS for my own purposes (with hopes to release for wider use... later), using PHP. I'm currently working on the login scheme now, and have a few ...
6
votes
10answers
1k views

Surfing anynomously

For work I often go to China, and there I met some dissidents I would like to help. I need to upload some videos to an ftp server in Europe. I will connect through a public hotspot without ...
5
votes
4answers
734 views

Possibility of undetectable encryption system

I am not sure if it is pre-mature to ask such a question. The question is largely inspired by pondering over the question and discussions in the following link (In his answer, @Dad also raises ...
6
votes
1answer
6k views

Feistel Block Cipher

Can anybody explain, in simple terms, how Feistal Block Ciphers work. I am not a math student so I do not understand the math behind it, just would like the principles.
16
votes
1answer
4k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...
5
votes
5answers
3k views

Why re-verify with CAPTCHA on failed form entry?

Is there a reason for sites to ask for another CAPTCHA verification when some other part of the registration form, e.g. the username, was invalid?
3
votes
2answers
234 views

Encrypting a fixed format message?

I'm planning to send across TWO pieces of information over the internet from machine A A site identifier which will be like: $SiteName = "EXAMPLE" (in plaintext) Encoded text which will be like: $...
6
votes
3answers
370 views

Can you provide loss values on security breaches?

When someone says "why do we need to spend so much money and effort on security, we need to focus on market share first and once someone finds a problem we will fix it", I would like to have a list ...
23
votes
2answers
10k views

Reject IP packets with an ICMP error, or just drop them?

Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
7
votes
1answer
796 views

Reasons behind MAC Spoofing on a corporate network?

My team is inspecting some MAC Spoofing events that are triggering in our corporate environment. After talking it over with the team, this is the information that we have that is relevant.... The ...
218
votes
7answers
79k views

Password Hashing: add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
5
votes
4answers
6k views

Brute force vs other methods of recovering passwords from shadow file

Do you know any good approach for de-hashing/actually bruteforcing hashed passwords in the shadow file? On various operating systems, any good solutions/methods/programs. Or is it better to upload ...
8
votes
3answers
6k views

Why does the ★-property rule of the Bell-LaPadula Model allow information to be stored in objects with HIGHER sensitivity labels?

I'm self-studying for the CISSP exam and am having difficulty wrapping my mind around the practical side of the ★-property rule in the Bell-LaPadula Model. I understand the mechanics of it and that ...
4
votes
1answer
980 views

How can I find a CVE ID for “No Translation Available” entries in Foundstone or McAfee Vulnerability Manager?

On a recent scan using McAfee Foundstone Enterprise (newer versions are known as McAfee Vulnerability Manager), I ran into a "No Translation Available" error. It's rather frustrating that these ...
10
votes
1answer
3k views

Howto seed the PRNG in OpenSSL properly?

I am creating an application which runs on a mobile node with Ubuntu, which does not generate enough entropy bytes to the /dev/random, and does not always stay connected on the Internet to use typical ...
10
votes
6answers
1k views

Are all security requirements expected to be testable?

Many approaches exist to define security requirements. To keep it simple, i would say to define a security requirement, one need to model the threat encountered when building up misuse cases for ...
6
votes
4answers
748 views

What do you do to protect data on a Macbook in the event of theft/loss of the device?

What setup do you recommend to protect data on a MacBook in the event of theft/loss of the device? I'm specifically interested in Macs here, rather than laptops generally, and in concrete ...
30
votes
5answers
5k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
1
vote
2answers
749 views

Where can I find some “real time” discussion forums for security issues? [closed]

The place where I work was hit by the new Qakbot variant (3rd generation) a couple of days ago and it has been brutal. Unfortunately a lot of the documentation out there is from the 1st iteration of ...
1
vote
2answers
2k views

Thoughts on Tiny Encryption Algorithm (TEA, anyone)?

I'm planning to implement Tiny Encryption Algorithm and exchange data between two PHP sites. Specifically, using the code presented at PHP-einfach.de Does anyone have any experiences / thoughts / ...
3
votes
1answer
852 views

PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?

Setting up a new company with ecommerce app, and looking at PCI compliance. What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire? ...
13
votes
2answers
6k views

Is there a way for a consumer to report PCI non compliance?

Is there a way for a consumer to report PCI non compliance?
22
votes
6answers
3k views

What are the good use cases for disk encryption?

I've been researching disk/file system encryption, and on the surface it seems like a good idea for a lot of things. But as I dig further, the security it offers seems more mirage like than real. ...
11
votes
7answers
8k views

Secure memcpy for pure C

Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code... Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
21
votes
5answers
14k views

Do you detect/react to DNS tunnelling?

I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
24
votes
4answers
6k views

Computationally simple, lightweight replacement for SSL/TLS

Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
2
votes
1answer
1k views

Comprehensive book to study about wireless technology

I am searching for a comprehensive book on wireless technology that covers in detail almost everything about wireless technology, including the related protocols, security, hacks, etc. I know it is ...
10
votes
5answers
2k views

Code Review Strategies

As per my information, there is no hard and fast rule for doing a security code review but we all develop our own strategy for the same. I was wondering if we all can share the different strategies ...

15 30 50 per page