All Questions
68,284
questions
16
votes
3
answers
974
views
Are there any decent web app security scanners that can integrate with a build server?
I've spent a lot of time in TeamCity recently and the nightly code quality metrics coming from the dupe finder, FxCop and NDepend have been great.
What I'd really like to do is find a decent web app ...
- 3,950
7
votes
4
answers
1k
views
Firewall Reviews - What is in your Toolbox?
In the vein of the questions about forensics, I'd be interested to hear what tools/techniques people use on Firewall reviews, both in terms of periodic reviews as an auditor or consultant, or ...
- 62.1k
8
votes
1
answer
1k
views
SSH Brute Force Dictionaries
Request for logs please.
So, I had an interesting question posed to me around geographical trends in SSH brute force attempts. The question being "has anybody ever looked into the prevalent SSH ...
- 2,896
45
votes
7
answers
19k
views
Port Knocking is it a good idea?
Normally for a server I like to lock down SSH and other non-public service to only be accessible by certain IP addresses. However this is not always practical if the business doesn’t have static IP ...
- 9,457
14
votes
2
answers
464
views
Establishing routines on what to do if a PC gets stolen
I need to establish routines for how to handle theft of PC equipment, specifically laptops and stationary machines. Also I need to figure out how to make the consequences of stolen equipment minimal.
...
- 16.2k
9
votes
1
answer
2k
views
What were the specific security flaws with OAuth 1.0? How are they being addressed in 2.0?
I read an article documenting Twitter abruptly pulling its OAuth support back in April 2009. The article said it wouldn't specify the hole for security reasons, but mentioned "social engineering" is ...
- 193
20
votes
6
answers
13k
views
Is there a security risk running web apps in debug=“true”?
This is a copy of the original question on Stack Overflow which didn't get much love and is probably more relevant here:
There are plenty of performance reasons why apps shouldn't be run in debug="...
- 3,950
9
votes
4
answers
2k
views
A firewall without any extra features [closed]
I have Kaspersky Internet Security (KIS) installed on my system. I always keep it disabled, yet using a few practices, I kept my system virus free for years:
I disabled autorun using these tricks;
I ...
- 1,514
1
vote
1
answer
585
views
JUNIPER Junos Pulse - how to apply policy to device
We'd like to set up and use Juniper Junos Pulse on iphone and ipad for access to Corporate mail.
We have juniper SA and have prepared the policy, but how do we apply the policy to the devices?
37
votes
6
answers
30k
views
Where to get an SSL certificate for personal website?
I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
- 3,352
15
votes
5
answers
928
views
What is the potential impact of the alleged OpenBSD IPSEC attack?
Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have.
For instance, does ...
- 5,264
16
votes
3
answers
2k
views
What techniques and tools do you use to relate security events?
You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck.
Do you have any cool ...
- 13.8k
6
votes
3
answers
757
views
Are Windows security updates audited?
An IT guy said that in his company, the Windows updates (small security updates that are downloaded automatically by the Windows autoupdate) are checked by the auditor. ie: the auditor checks if every ...
- 351
8
votes
2
answers
423
views
Retaining institutional knowledge of a complex infrastructure (checkpoint, juniper, etc)
In the next month my functions will be expanded to include IT security (firewalls, VPN, PKI) in a big complex infrastructure. Can I ask you for advice on how-to be well prepared for it? What sorts of ...
17
votes
4
answers
2k
views
Network Forensics - what is in your toolbox
In similar vein to this question on computer forensics, what tools would you have in your toolbox for infrastructure and network forensics. Typical example cases would be if you were called in either ...
- 61.5k
28
votes
2
answers
8k
views
MySQL Server Hardening
Following the hardening theme....
What are some best practices, recommendations, required reading for securing MySQL.
- 15.3k
9
votes
2
answers
551
views
Practical DRM for pdfs
An organization I am consulting for is trying to find a DRM solution for an ebook that they publish internally. It is in pdf format.
Does anybody have experience with DRM for pdfs, and if so, any ...
- 1,387
4
votes
2
answers
2k
views
On iOS, what's the benefit of OpenSSL over using CFStream, CFNetwork etc. for secure sockets?
I asked this already on Stack Overflow, here. I was told I might find answers here.
- 141
18
votes
2
answers
5k
views
GnuPG/OpenPGP Key Practices
I'm looking for input on GnuPG (gpg) best practices. It's been discussed some on the gnupg-users mailing list, but I wanted to get as diverse a view as possible, so I thought to bring the topic to ...
- 16.1k
19
votes
5
answers
39k
views
Can I block based on MAC address?
If I block an IP, the attacker can work around the block by taking a new IP or use a proxy. Is it possible to make a ban based on MAC address? I want to block at the webserver level so that unwanted ...
- 399
21
votes
3
answers
586
views
Isn't openid with http an issue?
Many openid enabled sites default to http identifiers, even if the openid provider supports https (such as myopenid.com).
Does this pose a threat beside the identity being exposed? The second step of ...
- 27.2k
9
votes
3
answers
3k
views
PHP mail() Header Injection Prevention
This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
- 863
28
votes
1
answer
8k
views
iOS Encryption Details
Following on from this question, what resources are available relating to the technical specifics of how apple implement encryption on their iOS 4.x series devices?
The Apple marketing material here, ...
- 62.1k
11
votes
5
answers
3k
views
When brute-forcing DES, does knowing something about the plaintext help?
Data Encryption Standard (Wikipedia)
I know that with brute force there are 2^56 possible keys to check (56 bits, each either a 1 or 0). But let's say I know the message itself is only made up of ...
- 111
34
votes
3
answers
19k
views
Forced into using a static IV (AES)
We've had to extend our website to communicate user credentials to a suppliers website (in the query string) using AES with a 256-bit key, however they are using a static IV when decrypting the ...
- 443
8
votes
4
answers
2k
views
Scripting a search through php files for dangerous calls for manual review
I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed.
Does anyone have any recommendations for ...
- 16.2k
13
votes
2
answers
2k
views
What is a "pre-play" attack?
I understand what a replay attack is, but I keep reading about a pre-play attack. What is it? Is it when someone intercepts an unused message and blocks the sender so they can't finish using it, and ...
user643
19
votes
3
answers
3k
views
Does an ORM framework such as Hibernate completely mitigate SQL injection?
I know that to prevent all or most SQL injection attacks that you should use parametrized queries. I've been using Hibernate for a while instead of hand writing my SQL statements. Are there any known ...
- 915
19
votes
7
answers
13k
views
Any comprehensive solutions for binary code protection and anti-reverse-engineering? [closed]
Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
- 1,016
15
votes
2
answers
773
views
Detecting attempts to attack a website?
I am currently trying to implement some recommendations from OWASP AppSensor Project and I'd like to respond to the attacker when he tries to break into my website.
Is there any resource covering/...
- 1,870
5
votes
1
answer
449
views
What security implications should I consider in relation to mcollective?
The use of PuppetLab's mcollective is being planned by my company's SysOps team. I will be reviewing their use of the tool and implementation of the system.
At this point I don't have a lot of ...
- 15.3k
15
votes
3
answers
2k
views
Are there valid reasons for spoofing an address?
This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?.
Are there valid reasons to spoof an address?
- 15.3k
18
votes
5
answers
6k
views
Why don't ISPs filter on source address to prevent spoofing?
I'm under the impression that if all the ISPs were required to filter on the source IP address of all outbound packets, that spoofing would be reduced considerably.
Are any ISPs implementing this ...
- 50.7k
1
vote
1
answer
301
views
What is your experience with AlertLogic?
Do you have any insight, or experience (good or bad) regarding AlertLogic?
In what areas can they improve, what areas are they lagging in?
- 50.7k
123
votes
5
answers
28k
views
How much can I trust Tor?
How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress.
I am a political activist from India and I do not enjoy the freedom of ...
- 1,265
8
votes
3
answers
3k
views
How do I identify an unknown port/protocol that my IDS picks up?
Googling a port and protocol leads to a terse description at best, and a link farm in the average case. Most protocols on assorted, unknown high ports contain little or no plain text, and often if ...
- 3,311
11
votes
5
answers
2k
views
How can a company reduce exposure to packet spoofing? What solution should exist, but doesn't?
I'd like to understand what anti-packet-spoofing technology exists (or should exist) to verify an inbound packet. Maybe this is as simple as a Cisco ACL, Firewall Rule, implemented at the network ...
- 50.7k
15
votes
6
answers
7k
views
Can Javascript/Flash verify the SSL connection to prevent "SSL Inspection"?
I'd like to determine if an SSL webpage is being debugged through Fiddler, or if it's going through an SSL Proxy.
So some people may ask
What is the point of re-validating SSL using javascript?
...
- 50.7k
9
votes
3
answers
333
views
What is the state of Security in Comp Sci Programs
In a previous question (How can I keep my programmer collegues informed about security issues?) there was a statement:
"...and I realise that security topics are often barely known from both the ...
- 15.3k
28
votes
6
answers
7k
views
What security risks does IP spoofing bring?
By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive ...
- 16.2k
17
votes
5
answers
2k
views
How do you handle log analysis?
How do you handle log analysis in your business?
I want to establish a good way of finding exceptions and alerts in the server logs, either automatically or semi automatic (having to review ...
- 16.2k
16
votes
5
answers
739
views
How can I keep my programmer collegues informed about security issues?
I am currently finishing a college degree in programming and I find that security topics are often barely understood by both students and teachers. It leads me to think that there are a lot of ...
- 372
7
votes
3
answers
616
views
Are there any tools to detect JavaScript-based WCF/AJAX calls?
I'd like to determine if a given JavaScript contains the logic to make a AJAX/WCF call, or determine if one is being executed at runtime.
Does anything like this exist?
- 50.7k
4
votes
1
answer
438
views
Anyone use the International Domain Name (IDN) security mitigation API's? Is there a wrapper for .NET?
The International Domain Name mitigation API's are available here for download.
Has anyone used them since they were first published in 2006? Are there any pending updates to them (I can't find a ...
- 50.7k
90
votes
9
answers
22k
views
Hardening Linux Server
We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH.
To continue this trend I am interested in what steps people take to harden Linux servers. As in what ...
- 9,457
436
votes
9
answers
309k
views
Is BASIC-Auth secure if done over HTTPS?
I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used.
Can this be considered secure?
- 4,513
6
votes
1
answer
293
views
Security of rails user access/permissions plugins
I was wondering if anyone knows what the most secure user access plugin for Rails is, and if any of them prevent session fixation?
- 1,204
12
votes
2
answers
3k
views
Malware known to use port knocking to evade detection by network scanners?
Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
- 1,287
19
votes
5
answers
450
views
What questions would the Joel test for Infosec professionals consist of?
See Server Fault and the original test. In other words what are some good questions that an information security professional should ask of a prospective employer? These questions might also lend ...
- 1,287
12
votes
5
answers
300
views
Citations for inadvisability of globally unique password
I am looking for an authoritative source to back up my position in a disagreement over password policy.
I am having a disagreement with a client about the user identification/authentication process ...
- 221