All Questions

Filter by
Sorted by
Tagged with
2
votes
2answers
277 views

Securing iPads and laptops in an enterprise

We have users in our organization who own iPads and we'd like to connect them to the network; however, if the users download and store sensitive data on the devices, that can pose a security issue. Is ...
12
votes
2answers
3k views

Best practices for email security

I writing a security layer for my app and I would like your input on updating users' email addresses (also used for the login). I'm interested to hear from anyone who has written an application with ...
4
votes
2answers
239 views

How do shared hosts protect different sites?

I host all my websites from a single VPN, and am about to sell some limited space of my Linode to a friend to host their new blog. It'll simply be another entry in Apache, and then a dedicated folder ...
0
votes
3answers
5k views

Number of AES-256 operations per second on a maximized Cray XE6

How many FLOPs does one AES-256 operation take in ECB mode? How many AES-256 operations in ECB mode can a maximized Cray XE6 perform per second? Cray states that it can be scaled to over 1 million ...
1
vote
1answer
2k views

Can Solaris' shadow hashes be created by better algorithms than the default DES-based hash?

By default, Solaris uses Traditional DES to encrypt password hashes in the shadow file. Is there a way to harden the security by changing this default behaviour and make it to be hashed using a ...
4
votes
4answers
311 views

what is the use of stolen personal details?

What can hackers do with personal information that includes this: First name, last name, snail mail address, mobile phone number and email address?
7
votes
2answers
3k views

What algorithms are best be cracked by GPU?

What algorithms are best being attacked by a GPU powered password cracker? For example, I heard that md5crypt that is being used in unix shadow file, is not the best choice for GPU cracking because it ...
7
votes
3answers
4k views

Is it possible to infer that a hidden truecrypt partition is likely to be present

Truecrypt contains a feature that let's you create a hidden volume. It's said that it can't be proven if a hidden volume exists. However, is it possible to infer from the state of the data on the ...
9
votes
2answers
2k views

Two certificates on smart card

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card? Background: In Sweden you can have a "citizen ...
4
votes
2answers
297 views

Salting a public hash

Does it make any sense at all to salt a hash which might be available publicly? It doesn't really make sense to me, but does anyone actually do that? UPDATE - Some more info: An acquaintance of ...
24
votes
4answers
53k views

What is the use of stolen credit card details?

What can a person with stolen credit card details do? Buy porn? Buy tons of server resources to perform an attack? What else? I'm sure that if he buys books, shoes and bicycles or transfer funds to ...
2
votes
1answer
4k views

Detected Port Scanning Attack in ESET Smart Security

I receive a number of notifications from ESET Smart Security about Port Scanning attack. But I'm behind a router. But as far as I know, computers behind a router is not accessible from others (Please ...
1
vote
2answers
966 views

How to react on a message about a pending account ban on Facebook? [closed]

Are you getting this message on chat? LAST WARNING : Your account is reported to have violated the policies that are considered annoying or insulting Facebook users. Until we system will disable ...
10
votes
2answers
18k views

Is opening both TCP/UDP less secured than just TCP or UDP when needed and why?

If application needs opened port X UDP, or X TCP combination. Is there any potential risk by opening both UDP/TCP as I usually am not sure which one the application uses?
10
votes
2answers
218 views

Encouraging security researchers to disclose vulnerabilities

What are approaches to forming solid relationships with security researchers? For example, is publishing a public PGP key on the "contact us" page of a company's website for high levels of risk ...
6
votes
2answers
913 views

International pentester certification

I've looked at the questions regarding certifications on this site and they are essentially asking what to go for. I hope that my question is distinct enough that is is not considered a dupe. I ...
63
votes
6answers
28k views

Can web sites detect whether you are using private browsing mode?

Most modern browsers support "private browsing mode" (also known in Chrome as "Incognito mode"), where the browser does not save any information to disk about your browsing while in this mode. In ...
4
votes
0answers
1k views

How can you remove your presence from the Internet? [duplicate]

How can you remove your presence from the Internet? For example from social networks, from email servers, from forums etc. Problem is how records of you are identified on the internet? We have well ...
12
votes
1answer
3k views

Closing an HTML element without using literal slashes?

I'm investigating a vulnerability in an application that echoes a user-supplied filename without sanitizing the filename. E.g. a file named test-<script>alert("evil");.txt will result in that ...
3
votes
2answers
208 views

When using a recovery disk, like AVGs boot-able CD, to scan for viruses, malware etc… what are the limitations?

What I like about about the boot-able CD concept, is it can connect to the Internet and get updates, however I'm not clear how effective they are at really finding things that are heuristic? How do ...
6
votes
3answers
1k views

Does Hash/Salted password really help when DB is compromised?

I came across this article and got a basic understanding hash, salt and brute force attack. My question is in the article, the author emphasises how hard it is to reverse the hash/salted password to ...
66
votes
4answers
69k views

Does a Virtual Machine stop malware from doing harm?

I would like to know if it is safe for the host system of a virtual machine (VM - VirtualBox OSE in my case) to execute malware. Can a virus break out and read or write data from the host system? ...
4
votes
2answers
3k views

What is more secure: ISDN, Cable Modem, DSL, T1, etc…?

This discussion came after showing a friend this Security.SE post regarding DNS attacks, and after reading about a Cable Modem MITM attack. Given the current options available to consumers, what ...
4
votes
2answers
851 views

Secure Software Development

I'm researching models on building security into the SDLC and so far have come across: BSIMM Microsoft SDL Open SAMM Are there any other documents and resources to look into? Specific tools that ...
7
votes
2answers
482 views

Ethics and economy in security research

How can we design a market for information disclosure where individual security researchers may benefit economically in an ethical way? Assume a market where the participants are governments, ...
1
vote
2answers
1k views

Strange Event Log Entry - Windows Server 2008

Reviewing some logs recently, and came across a strange failure in our Windows 2008 DC. An account failed to log on. Subject: Security ID: NULL SID Account Name: ...
3
votes
3answers
6k views

Any place where I can find some template or base documents for IT/Infosec Compliance?

We're facing an audit and we are sorely lacking in documentation regarding information security policies. I've done some Googling and have been surprised by the difficulty of finding a good "template" ...
7
votes
1answer
590 views

OpenPGP Encryption / Decryption Process Using GnuPG

I want to know if my method of encryption can ensure the security of my data if my database was hacked as well as the authenticity of the data I am decrypting. I am using GnuPG's implementation of the ...
8
votes
3answers
1k views

Global check of input/output of known hash functions

Is there a website, application, or script that will allow you to give an input/output for a hash function, run these against known functions, and return any matches? Here's one attempt to list the ...
6
votes
4answers
2k views

Server wide javascript injection

UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript. I'm troubleshooting a hacked website ...
2
votes
2answers
3k views

Secure SSL Session from losing itself into unsecure http

I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
2
votes
3answers
611 views

Identifying and preventing execution of “any” function via Late-Bound commands

The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
13
votes
3answers
4k views

How to recover securely deleted data

Since we all know files are recoverable with programs after being deleted from the recycling bin, everyone is told to do secure wipes by putting random data over the files you're deleting on the disk ...
62
votes
7answers
61k views

Trying to make a Django-based site use HTTPS-only, not sure if it's secure?

The EFF recommends using HTTPS everywhere on your site, and I'm sure this site would agree. When I asked a question about using Django to implement HTTPS on my login page, that was certainly the ...
9
votes
7answers
6k views

GPU powered Password cracking machine - buy metal or cloud?

As a IS consulting firm, we would like to have our very own password cracking machine. Great. Now, after some sketching and brain storming we concluded that GPU is the best way to go (contrary to CPU ...
10
votes
2answers
13k views

openssl verify signature

For S/MIME, I now know I can verify PKCS#7 detached signatures with: openssl smime -verify -in detachedsign.pem -content content.txt But what about non-MIME messages? So if I sign the message Hello, ...
6
votes
6answers
3k views

What is the use of password encryption?

Why do we encrypt passwords? Is it to protect the password from eavesdropping? to protect the password after saving it in database? both? or for some other reason?
3
votes
1answer
977 views

Mac sending hundreds of packets to gateway

I've got a user on my work network who brings her personal laptop (macbook) in for work. They've been having some horrendously slow network issues on everything past that hub, so I did some packet ...
12
votes
2answers
2k views

Are different hash algorithms ever used together?

I was wondering if different hashes (e.g. md5(sha1($data)) ) are ever used together for data security and if there was any reason for it (either positive or negative answer).
3
votes
2answers
652 views

Null content digitally signed message

IA technical specification I'm following requires me to send: The Digital Signature must be in the form of a null content Digitally Signed message (i.e. a PKCS#7 object containing the signature ...
11
votes
3answers
470 views

How to test if a browser add-on is safe

I came across this plug-in that started some alarm bells ringing. The add-on would help submit a website to web directories. The first 100 submissions are free, then you need to pay $20 via pay-pal (...
13
votes
4answers
14k views

How to listen to all ports (UDP and TCP) or make them all appear open (linux)

I got an external Debian server. The problem is that my university campus doesn't allow connections to go outside when the port is different than TCP port 22, 80, 443, or UDP port 123. I tested them ...
7
votes
9answers
9k views

What is the best way of securing a website logon without SSL or preshared keys?

Today I sniffed some unencrypted wlan traffic during class and I found quite a few passwords by a simple search for "pass" and "user" in wireshark. Turns out about half the sites we use for school don'...
7
votes
3answers
1k views

How effective is something like Deep Freeze against boot sector infections?

I work for an embedded system manufacturer and on our older generation systems, which are powered by Windows Embedded, a number of customers have been experiencing virus infections. Due to the real ...
2
votes
2answers
334 views

Scan Novell NetWare backend with Windows servers and clients

Could anyone provide some insight on performing an internal vulnerability assessment regarding Novell NetWare as the backend with client workstations and servers running various versions of Windows? ...
22
votes
6answers
52k views

What does “key with length of x bits” mean?

I'd like to know what it means to say "the cryptosystem C uses keys with a length of x bits". I do not understand what the bits length means... doesn't it depend on the encoding? The same word encodes ...
5
votes
3answers
34k views

How to force ALL programs to use my Proxy?

I have a local proxy on my PC. (localhost:8888) But unfortunately there are many programs which are not able to go through this proxy. So how can I force all my programs to go through my local proxy (...
2
votes
1answer
195 views

Privacy policy about links to other sites

In many of the privacy policies, I noticed there is one section as a disclaimer mainly talking about "our websites contain links to other websites, and it is your own risk/responsibility to familiar ...
12
votes
2answers
3k views

How are mobile telephony networks like LTE and HSPA encrypted?

How are mobile telephony networks like LTE (4G) and HSPA (3G) encrypted? between what parts is the communication encrypted? who has access to the keys? is symmetric or asymmetric encryption used? is ...
8
votes
3answers
2k views

How do I log all my internet-connections

How can I (maybe with a proxy, but I need names of programs!?) log all my interactions of programs with my Internet connection, so that I could see WHAT a program is sending and WHAT it is receiving. (...

15 30 50 per page