All Questions

Filter by
Sorted by
Tagged with
3
votes
1answer
318 views

Is there a way to use multiple firewalls / antivirus for penetration testing?

I don't really know how to do either, but I was wondering if it was possible to have multiple firewalls / virus scanners installed at once, and use a 3rd party program to specify which one is running ...
1
vote
1answer
868 views

What are the possible types of intrusions that a IDS protects against? [closed]

I am implementing an IDS and just want to know that what are the possibilities with which the intrusion can occur. I am just doing a literature survey over the attacks possible so I want to know that ...
4
votes
1answer
315 views

Can I safely post the output of lspci, lsusb, lshw?

I'm having trouble with my SD card, and have been asked to inspect the output of tail -f /var/log/syslog, sudo lspci -v -nn, sudo lsusb, and sudo lshw. tail shows nothing when I insert the card, so ...
2
votes
1answer
508 views

Will htmlspecialchars (php) be enough for making secure PDF files with user entered data?

My app creates an PDF file and uses an user entered info. How can I avoid all attacks with PDF vector? Will htmlspecialchars be enough? I don't want to enable JavaScript in PDF.
13
votes
1answer
1k views

SCADA / PLC exploit code was released in metasploit. Now what?

Wired reports that there are many security issues with Programmable Logic Controllers (PLCs) and now there is an easy to use tool to scan and detect vulnerabilities. They say it's so easy, the ...
2
votes
1answer
328 views

Is 90 day expiration for unique URL too long?

A web application I've been developing has a new use case that has me searching for something easier than username/password authentication. Current users don't sign up for the service themselves ...
2
votes
1answer
193 views

Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? [closed]

As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
7
votes
3answers
780 views

What is the most secure way to lock a Linux Distros Desktop?

So it's an everyday thing... people don't want to turn off their computer while their going out to the toilet..., etc. So they hit "ALT+CTRL+L", and the GNOME-screensaver locks their Desktop. After ...
1
vote
1answer
2k views

Are there any reviews or user experiences with Secretsync?

I haven't been able to find much in the way of professional reviews for Secretsync - http://getsecretsync.com/ss/ But i'm wondering how it compares to Boxcryptor and Truecrypt. How secure is ...
1
vote
2answers
21k views

Bypassing XSS filters [duplicate]

Possible Duplicate: New XSS cheatsheet? Can anyone give me list of ways to encode XSS payload , or to be precise what are the ways to encode XSS payload to bypass encoding of <> or (). I know ...
3
votes
2answers
1k views

Restrict user login to a specific machine

How do you restrict user access to a corporate web site to a particular machine ? including the following conditions : Each user is meant to use his credentials ONLY from the assigned machine. The ...
6
votes
1answer
9k views

Is this jQuery ajax call vulnerable to XSS?

If somebody can edit $("#field").val(), can they change the url property here to point to another location? $.ajax({ url: "http://mywebsite/script?param=" + $("#field").val(), dataType: "jsonp", ...
2
votes
1answer
815 views

How secure are native iPhone - PUSH Services

The native app is sending the UDID to the service provider in order to receive push notifications through APNS. How is it possible to prevent tampered requests (modified UDID) from getting processed ...
36
votes
5answers
8k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
5
votes
2answers
2k views

What are the practical differences between SELinux targeted mode and a capability based OS?

I recently asked a question about the differences between capabilities and mandatory access controls. Among the answers I got the point was made that systems like SE Linux in targeted mode are not a ...
1
vote
1answer
2k views

How to best authenticate a desktop client with a scaleable backend via SOAP / REST service?

I'm trying to find a solid architecture for authenticating users against a database. I have a game client, which I plan to serve up a request with. The transport doesn't really matter, but at this ...
3
votes
2answers
625 views

HTTP + HTTPS + One Time Pad/stream cipher

I'm designing a web application where users will exchange short messages with the server very frequently (for instance, a few characters every second). I want the whole communication to be ...
5
votes
3answers
590 views

What to consider in an SLA to ensure secure software when outsourcing software development?

To ensure secure development in the off shore team what are considerations to be taken into account in the SLA? I got this as a reference: http://www.it-director.com/enterprise/technology/content.php?...
15
votes
3answers
3k views

VPS security best practice

I've just signed up for a linux VPS to host a website I've been creating and I need some advice on the best approach to secure it. I've previously been hosting it off a VM in the house, but I want to ...
2
votes
2answers
924 views

What does “if the Crypto Officer performs this operation” mean in this BitLocker security policy?

In the document Windows Server 2008 R2 BitLocker™ Drive Encryption Security Policy For FIPS 140-2 Validation, in the section 6.1.2 FIPS 140-2 Security Rules bullet point 2 it says: BitLocker™ will ...
9
votes
7answers
5k views

Verify the password of an encrypted file without waiting for complete decryption

I am currently working on an application that encrypts files with AES 256. The problem is that I want the user to see whether the password is wrong before the file is decrypted. For example if you ...
3
votes
4answers
4k views

SQL query sanitation (black list)

I have a following problem/challenge: Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports. These reports can be ...
22
votes
8answers
45k views

Tracking down a rogue access point

Over the course of about a month we have received multiple reports of a rogue access point attempting to intercept traffic. I suspect an attacker is using a wifi pineapple, or similar hardware device....
4
votes
4answers
738 views

Top Mobile Device Security Concerns? [closed]

What does everyone see as the top security concerns for mobile devices at the present time? I am working on a paper on the topic, but it seemed worth asking here to see if I might have missed ...
5
votes
2answers
4k views

Security Engineers - What Do They Do?

I'm starting my MS in Computer Science (I hold a BS currently) soon and I'm considering specializing in cyber security. I'll be taking courses such as cryptography, biometrics, network security, ...
14
votes
6answers
19k views

Regulations that specify password length?

I have read: PCI DSS 1.2 SOX 404 AR 25-2 ISO 27001 But only PCI DSS specifies a minimum password length. Are there any other regulations that dictate password lengths for any industry? NIST ...
3
votes
3answers
909 views

Security issues with email accounts

I am starting to become wary of giving out my email account to anyone, just by doing reconnaissance it is evident how easy it is to pull so much information from a person just by a email, There is a ...
8
votes
3answers
3k views

Who (which process) is calling curl?

On my mac (Lion), I know that curl is bing used by some unknown process to communicate with a server. Basically I installed little Snitch and find out that "somebody" is using curl periodically. ...
8
votes
2answers
2k views

Is BitLocker on a virtual machine still FIPS 140-2 compliant?

BitLocker can be used as a cryptographic module to fulfill FIPS 140-2 security level 1 compliance. In a common setup, USB thumb drives can be used to unlock drives encrypted by BitLocker on startup. ...
3
votes
1answer
472 views

Running Untrusted Software on Local Network

So I need to run a bit of software on my local network that I just have the .exe for. The caveat is: The software needs access to the internet to produce a bunch of files. I need to access those ...
3
votes
5answers
541 views

Exchanging private keys

I would like to understand something about security. Say two parties have a private piece of data (e.g. a password or license key) and the receiver needs to know that the sender has the same key and ...
11
votes
2answers
5k views

How does Google not care about “spaces” in Application-specific passwords?

I have recently setup "2-step verification" for my Google account. One of the features is the ability to create "Application-specific passwords " for devices that do not support the 2 step process. (...
11
votes
2answers
802 views

Is it a security risk to remind users of the password requirements at login?

I regularly find myself trying to login to websites where I don't remember the password I use. I make some guesses as to what I might have used but usually wind up having to reset it. One thing that ...
6
votes
4answers
3k views

Security concerns from publicly visible Hudson & Jenkins servers?

A friend's start-up has implemented a number of business critical services on a Hudson/Jenkins server run on a Tomcat container. This is not an open-source project, in fact many aspects of this ...
5
votes
2answers
188 views

What kind of cache-related attacks exists on the Web?

What kind of cache-related attacks exists in modern Web world? The only one I'm aware of is Cache Poisoning. Is there anything else I should be worrying about?
10
votes
2answers
3k views

Rootkits on Mac OS X

Is there known existence of rootkits for Mac OS X, and can you please provide examples? What software would you recommend to detect rootkits on OS/X? From a software developer's perspective, can you ...
16
votes
2answers
85k views

How do hackers take advantage of open ports as a vector for an attack?

It is widespread knowledge, and therefore a common practice, to close open ports on any machines connected to the internet. If for example, a typical program uses port xyz as it's communication ...
2
votes
2answers
7k views

How much does it cost to protect your website against DDOS, by tier?

Cross-posted to Quora Today several financial institutes in Israel (banks, stock exchange) were DDOSed. They decided to block all foreign IPs as a first aid measure. While I agree that it was ...
8
votes
1answer
3k views

ASP.NET HTTP Response Splitting Attack

By default ASP.NET checks for HTTP Response Splitting attack when you do Response.Redirect: Response.Redirect("/MySite/Default.aspx?lang=foobar%0d%0aContentLength:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%...
4
votes
2answers
1k views

Can one get infected through visiting a site with a PHP script on it and if yes, how?

I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP? Since it's serverside it shouldn't have access to the visitor's ...
3
votes
1answer
2k views

Can SSL server choose a session ID '0' in the 'Server Hello' message?

Can s SSL server in response to 'CLIENT_HELLO' request choose a NULL value for the session ID in its response, SERVER_HELLO? Is it OK?
7
votes
3answers
2k views

How secure are self decrypting HTML files for data storage?

I recently came across a JavaScript self decrypting archive. Is it secure enough to be used as a portable password storage tool? The author has even challenged it to be cracked.
22
votes
4answers
7k views

Role Based Access Control + Data Ownership based permissions

Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to data ownership? For example: Bob is a doctor and has the role ...
3
votes
1answer
3k views

encode der with openssl

When you issue openssl dgst -sign key <file it follows the PKCS#1 standard to generate a digital signature. hash file with some hash digest function encode the hashed value in DER format, ...
7
votes
4answers
1k views

Is a wireless receiver a security weak point?

I have bought the Logitech Wireless Presenter R400, and it includes a Wireless receiver that it should be plugged in to the computer in order for the remote send signals to the computer. I would like ...
4
votes
1answer
1k views

X.509 algorithm identifier parameters vs. extension values

From the X.509 specs: AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } ...
3
votes
1answer
2k views

Why doesn't asn1parse parse all DER encoding strings?

I have a file - crl.txt - that contains the following: MDYwNKAyoDCGLmh0dHA6Ly93d3cyLnB1YmxpYy10cnVzdC5jb20vY3JsL2N0L2N0cm9vdC5jcmw= It's from one of the extensions in a particular X.509 cert. Why ...
6
votes
3answers
318 views

Is XSS dangerous on web without login/sensitive user's data?

Is XSS dangerous when the web application doesn't have a login/register function, the user isn't logged in or when the website doesn't store any sensitive user information?
5
votes
3answers
6k views

My server is used for DDoS attacks

I have webserver (centos + cpanel), and one of the clients used my server for DDoS-ing, how can I identify that client/user? What logs should I look to, is there any settings I can modify so such ...
5
votes
1answer
1k views

Sniffing IMAPS traffic! Are there any tools for this?

I've got a problem where someone has implemented a custom IMAP Server. I need to write a custom application to get a list of emails, and fetch messages. Problem is, every library I've tried to use ...

15 30 50 per page