All Questions
67,502
questions
7
votes
1
answer
5k
views
Windows mandatory access control: How to remove “mandatory level” label from the file?
How to remove "mandatory level" label from the file?
I have two files, for the first one icacls returns
Mandatory Label\Medium Mandatory Level:(NW)
for the second icacls doesn't return ...
- 283
3
votes
1
answer
1k
views
I'm using a Cisco ASA as a VPN endpoint. Where do the VPN clients get firewalled?
I've got this ASA in front of a network that I didn't set up. It's been configured with the clicky GUI (the ASDM), not the CLI, but I'm willing to use the CLI if it makes more sense.
One of the ...
- 777
8
votes
2
answers
3k
views
3DES vs DES for VPN connections
I'm trying to get Android 2.1 phones to connect to our corporate VPN, but it would appear they only support DES rather than 3DES for encryption.
Is it safe to use DES, am I going to get hacked if I ...
- 407
15
votes
1
answer
3k
views
What's are the advantages of L2TP/IPSEC over plain IPSEC?
As the title says, my firewall (Sonicwall) can do either IPSEC or L2TP/IPSEC for VPN connections. One advantage of L2TP/IPSEC I can see is that the client computer get allocated its own IP address on ...
- 407
90
votes
10
answers
136k
views
Why do people tell me not to use VLANs for security?
I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and ...
- 1,001
4
votes
1
answer
776
views
IP reputation services – valuable tool for detecting compromises?
anyone have anecdotes on how subscribing to an IP reputation service led them to discover internal compromises?
services like:
https://www.iptrust.com/
http://ipremoval.sms.symantec.com/lookup/
- 13.8k
26
votes
5
answers
10k
views
Access to a router's GUI
During a recent visit to a coffee shop, I noticed that they hadn't bothered changing their default user name and password for their router.
I realise that someone could log on and be annoying to ...
- 957
3
votes
2
answers
2k
views
Cisco ASA Security Contexts: Any Real World Installs?
We are looking at deploying a Cisco ASA 5520-I am looking at the security contexts feature, and was wondering if anyone has deployed their ASA in this way, and how it is working out for them.
Have ...
- 1,387
10
votes
1
answer
363
views
What is your default umask set to?
What is your default umask set to? Did you run into any problem setting a stricter default umask?
- 5,089
22
votes
5
answers
4k
views
Why do some websites and programs restrict password characteristics?
There are some websites and even programs that I use that have ridiculous password restrictions. Lots of forums for instance restrict passwords to ~32 characters. Others enforce a restricted charset.
...
- 1,239
5
votes
2
answers
423
views
Issues with the use of network surveillance tool in your company?
What issues will we face with the use of network surveillance tool in the company network with respect to the Telecommunication Interception Act and Privacy Act ?
And what policies could be ...
- 51
166
votes
11
answers
119k
views
Is visiting HTTPS websites on a public hotspot secure?
It's often said that HTTPS SSL/TLS connections are encrypted and said to be secure because the communication between the server and me is encrypted (also provides server authentication) so if someone ...
- 1,905
25
votes
3
answers
89k
views
How to ensure that cookies are always sent via SSL when using ASP.NET on IIS 7.5?
Firesheep has brought the issue of insecure cookie exchanges to the forefront.
How can you ensure that all cookie exchanges are forced to occur only via an SSL-secured connection to the server when ...
- 383
7
votes
1
answer
536
views
how to configure edit-restricted mediawiki
I am planning to setup a public wiki using mediawiki, but I never used mediawiki for a public site before and I am not experienced with it, even as a user.
I am planning to create a very restricted ...
- 443
7
votes
1
answer
4k
views
Is L2TP as secure as IPSEC for VPNs?
Is it as secure to use L2TP for VPN access, rather than IPSEC? Am I introducing any risks by using L2TP?
- 407
6
votes
2
answers
5k
views
Dealing with expired or revoked signing certificates with Infopath documents
Suppose I have an Infopath form that is digitally signed today by a valid, and active user.
When that user leaves the company, we disable the account and revoke the certificate. This causes a problem ...
- 50.6k
7
votes
1
answer
1k
views
HIPAA Compliance or What measures would you recommend to secure PHI for devs?
I work with a company that sells medical supplies and equipment. As part of this, we retain patient information or Protected Health Information (PHI). What measures have you taken when providing ...
- 223
17
votes
3
answers
7k
views
How should one properly dispose of a printer or fax which is used for sensitive documents?
If you need to dispose of printers or fax machines that have handled sensitive documents, how should they be handled? Should you permit them to be donated or sold for reuse outside the organization?
...
- 27.1k
69
votes
8
answers
139k
views
What is the difference in security between a VPN- and a SSL-connection?
I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
- 5,183
12
votes
3
answers
10k
views
Prevent acccess to the C drive on Windows systems
Is it possible to prevent regular users from accessing the C drive via Windows Explorer? they should be allowed to execute certain programs. This is to ensure that employees cannot steal or copy out ...
- 389
11
votes
2
answers
6k
views
How to address XSS security issues in FCKeditor / CKeditor?
A security report we conducted through an outside company reported XSS vulnerabilities in FCKeditor which we're using in our PHP application.
They pointed out that accessing URLs such as:
http://www....
- 1,087
21
votes
6
answers
3k
views
Backing up sensitive data - pitfalls and best practices
Obviously, securely backing up sensitive data is a challenge. A remote backup is important for surviving a variety of disasters. What are some of the "gotcha's" lurking out there, and what best ...
- 20.7k
15
votes
4
answers
13k
views
What's the standard way to encrypt a file with a public key in Java?
I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the server?...
8
votes
4
answers
1k
views
What FDE (with hardware encrypted drives) for OS X works?
I'm trying to get all of our laptops doing FDE (as I'm sure lots of you are), and I've run into a problematic spot. Our Windows and Linux laptops are Dells, and they have some good BIOS integration ...
- 777
12
votes
3
answers
719
views
Do any of you who are *really* dealing with APT have any recommended intelligence feeds for SIEM/IDS/etc?
This question about Advanced Persistent Threats (APT) was posted by Rich Mogull on twitter. I copied it here because I'm curious too.
Rich posted these follow-up tweets:
And by APT I mean real ...
- 13.8k
101
votes
4
answers
122k
views
What is the difference between an X.509 "client certificate" and a normal SSL certificate?
I am setting up a web service through which my company will talk to a number of business customers' services. We will be exchanging information using SOAP. I would like to handle authentication with ...
- 1,113
48
votes
12
answers
23k
views
Is anybody using client browser certificates?
Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...
- 1,881
13
votes
4
answers
1k
views
What is the risk of a packet being sniffed when travelling over the internet without SSL/TLS?
We all know to use SSL/TLS to stop people eavesdropping on our connection, but how likely is it that an attacker will actually sniff your unencrypted password or cookie if you don't?
If we exclude ...
- 1,204
8
votes
3
answers
11k
views
What common products use Public-key cryptography?
I want know what common use products are there that use public key/private key cryptography?
- 3,083
22
votes
5
answers
5k
views
PCI Encryption Key Management
(Full disclosure: I'm already an active participant here and at StackOverflow, but for reasons that should hopefully be obvious, I'm choosing to ask this particular question anonymously).
I currently ...
- 323
11
votes
3
answers
2k
views
What prevents this exploit from working (unix SUID)?
If I have a user on a unix system where Im allowed to create new files, what prevents me from downloading an executable file onto that system which is already SUID'ed to root on a different system?
...
- 16.1k
14
votes
5
answers
2k
views
How to get into RFID auditing?
I would like to get more knowledge around RFID-systems auditing.
Does anyone have a basic guide step-by-step which I can use to set up a lab with proper RFID "sniffing" equipment?
I would like to ...
- 16.1k
7
votes
4
answers
440
views
Circumventing a "freemail" account form filter
I'll be honest - I want to download a free PDF from a website which requires me to enter my "non freeware" email address. I do have them, but I dont want to use one as I'm afraid of landing up on a ...
- 1,087
11
votes
3
answers
10k
views
Any good free SSL proxy on windows? [closed]
I'm looking for SSL proxy capable of dumping requests.
I want to test custom browser against SSL-MITM attacks.
I'm able to re-route all traffic ongoing from browser to machine with proxy.
...
- 247
16
votes
7
answers
17k
views
Disable insecure/dangerous PHP functions
Typically my job description limits me to code-review of web applications. More recently I've been asked to assist with some server-side PHP optimization where, although I am familiar with it, I lack ...
- 1,996
139
votes
9
answers
324k
views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
- 16.1k
92
votes
4
answers
19k
views
How does XSS work? [closed]
I have very little experience in web development, but I'm interested in security. However, I haven't fully understood how XSS works. Can you explain it to med? The Wikipedia article give me a good ...
- 1,039
15
votes
7
answers
834
views
UNIX Servers: Possible intrusions or attacks that do not use any of the open listen sockets
What type of attacks are there that do not use open TCP or open UDP ports?
Is it safe to assume that no open ports means no remote access?
(Excluding the possibility that there is a badware already ...
- 13.9k
13
votes
6
answers
3k
views
What tools are available to identify which country a specific IP address is located in?
In trying to identify the country a user logs in from, or to block country ranges for whatever reason (for example regulatory requirements) what tools, whether online or offline, are available?
- 249
7
votes
2
answers
2k
views
GET with additional parameters leads to "code injection" in html displayed
We got a security review done of our PHP code and the security company sent this in their report:
Request
GET /appdir/ajax/addAvail.php?counter=1216%3cscript%3ealert(0)%3c%2fscript%3e&from=1216%...
- 1,087
1
vote
2
answers
3k
views
Protecting an IIS web site hosted at home
My case is
I just registered at dyndns.com to get a domain for a website I am staging on my home computer (I know it's not considered good to do so). But the website is not big, and I don't expect to ...
- 113
9
votes
2
answers
2k
views
Storing third-party auth info securely
Suppose there's a multi-user web application that requires access to user's mailbox (on third-party service, like gmail, etc.). This access needs to be persistent. Which means we'd have to store user ...
- 1,881
12
votes
2
answers
2k
views
logging requirements for PCI for web applications
Does PCI dictate how much should be logged at an application level or simply what shouldn't be logged?
I'm struggling with too much logging right now and some people who think we should have it. From ...
- 915
8
votes
4
answers
3k
views
Escaping JavaScript constants
how can untrusted values be included in a html-page as javascript string constants? Although the case i am asking uses JSF and Rails, I think this is a general problem independent of the server side ...
- 27.2k
9
votes
5
answers
2k
views
What type of captcha will you recommend?
What type of captcha will you recommend? I am looking mainly at usability, ease of use (development too), relatively secure
Usability
I find that those captcha with very curly words/numbers are ...
jiewmeng
19
votes
5
answers
1k
views
Can you secure a web app from FireSheep without using SSL?
Assume that you want to give some web users privileged access to your website, but that you are unable (or unwilling) to offer SSL to all of them - at least past the initial login page.
In this ...
- 292
11
votes
6
answers
11k
views
Security review: "HTTP header user-agent has been set to (something)"
We got a security review done of our PHP code and they team advised this in their report (amongst other things):
/appdir/
Details
The HTTP header user-agent has been set to \" .
Request
GET /...
- 1,087
8
votes
4
answers
2k
views
Verify Mac firmware is not hacked...how to do?
I have a late model Mac computer. I allowed someone to plug in a USB drive, and my network activity changed afterwards.
Normally, Little Snitch will report every app that uses the internet. Every ...
mobileGuy
9
votes
4
answers
3k
views
Copyright issues with encryption algorithms
I'm developing application for Android/Java. Application is a kind of password manager, so I'm storing encrypted passwords under the hood of master password. There are number of encryption algorithms ...
- 367
7
votes
4
answers
393
views
Security papers or material focusing on the industrial control systems (SCADA)
Anyone know a good site or a list of resource to start to know issue related to the security of SCADA system ?
- 1,066