All Questions

Filter by
Sorted by
Tagged with
1
vote
1answer
68 views

Why is sudo's usage of timestamp files insecure?

Sudo and Opendoas on Linux use timestamp files to keep track of how long it's been since you've last entered your password. Doas on BSD uses a kernel feature instead. Why is the latter considered more ...
0
votes
1answer
32 views

Is it possible to recover data from a bricked smartphone?

I have a smartphone that got bricked last year without warning, and it was deemed unrepairable by multiple repair centers. I did have personal stuff on it. If I recycle this phone, can someone down ...
0
votes
0answers
12 views

Status of Asynchronous Remote Key Generation in the developing WebAuthn standard?

Today I read this blog entry by Yubico regarding Asynchronous Remote Key Generation. This proposal solves, in my view, the largest outstanding problem in the widescale adoption of challenge-response ...
0
votes
0answers
36 views

How would one be able to abuse which fields are linked to which record in a password manager? [closed]

I am currently making my own password manager as my main project. But of course, I want to make it sturdy, in case I release it to the public. The password manager follows this simple structure: A ...
0
votes
2answers
51 views

can virtualbox be used to access a locked website without being tracked and without getting detected of using a virtual machine?

I need to open a website where access is denied in my country. I would like to know if virtualbox can be used to solve this issue. my concern is if they can detect that I am using a virtual machine. ...
-3
votes
0answers
39 views

What are the 5 major Factors influencing how security can be implemented in a networked environment [closed]

Knowledge on securing information systems
1
vote
1answer
59 views

Is this paper on stack canaries outdated?

According to this paper on defeating stackguard, it seems canaries are placed lower in the stack (higher address) than EBP, allowing the attacker to overwrite EBP without being noticed. But when I ...
0
votes
0answers
17 views

Multiple independent systems solving the same problem [closed]

A security researcher told me that in certain production systems that should have high fault-tolerance several independent subsystems are used to perform the same task. If at least 2/3 subsystems ...
0
votes
1answer
34 views

Is character restriction ever a safe mechanism against code injection / better than input sanitisation?

Many services still restrict the special characters allowed in passwords and similar with the argument that it prevents injection attacks. Now, there are many good arguments against this such as ...
0
votes
1answer
31 views

Is there any risk installing and using WeChat in phone or computer

Is there any legitimate concerns of using WeChat in phone or computer? Is it possible they expose message data to others or for their own use? Also, will the installation of the official WeChat app ...
-1
votes
1answer
37 views

How can a closed security network be hacked through a connected network?

Let's say I want to set up a few security cameras in the front and back of my house. However, I am going to keep them on a closed network. They will be connected to a router that does not have an ...
0
votes
1answer
17 views

Cpanel Phising Link

Today I received a cpanel phishing link and I clicked on it. It redirected to another cpanel. I decide to look at the url, and here it is redirect url https://example.net/esg9/cpanel.php?token=...
0
votes
0answers
9 views

Could my Windows 7 VM access my network and perhaps my host internet history or data?

I have a Windows 7 Pro VM running on an Ubuntu 20.04 host. I'm a bit new to VirtualBox and set up the VM but it was too slow to do anything so I took a snapshot and closed it. I think my Ubuntu host ...
1
vote
1answer
25 views

Cookies VS localStorage (JavaScript Security)

I know that HTTP requests made by the site get the browser's localStorage for a site, and document.cookie is encrypted for HTTPs websites, but I'm still wondering the risk of storing sensitive ...
0
votes
0answers
39 views

Is there a well-defined algorithm to find preimages of md5?

I know md5 is no longer secure. But is there an algorithm running in polynomial time to find preimages of a given hash, or is it just bruteforce ?
1
vote
0answers
31 views

Is "drag-drop files" computer backup sufficient to avoid most malware/ have all my files?

I'm debating dragging all my files onto an external hard drive manually - rather than a time machine backup - and then pulling over any specific files I need if I ever need them. Afterwards, I'll ...
0
votes
0answers
40 views

Steganography image CTF question

I am new to the CTF. I've already solved a couple of different steganography tasks, but there is one that I just can't figure out. So I've been given this image and flag is hidden there. All I know is ...
0
votes
0answers
18 views

Authenticating/ identifying dynamic UI Client to Back-End [duplicate]

The title may be a bit misleading so I will try to make this as clear as possible. We have several microservices that expose endpoints and they communicate to each other. They needed to authenticate ...
4
votes
4answers
502 views

Do Key-Derivation Functions pose a Denial-of-Service Threat for APIs?

Imagine a simple API, which offers an endpoint POST /account/authenticate, which takes a username and password, then returns a JWT on success and an error on failure. In the backend, the endpoint uses ...
0
votes
0answers
11 views

Wireshark -Protocol Hierarchy Omitting large amount of subprotocol traffic [closed]

Originally posted on Network Engineering: To Summarize, the total of my subprotocol/subvariant packet percentages do not sum up to its header, the total TCP % Packets noted by the tool. Transport ...
0
votes
0answers
37 views

When does a Threat Actor (TA) become an Advanced Persistent Threat (APT)? [closed]

I'm new to the threat intelligence aspect of cyber security and I was wondering, when does a TA become an APT? For example, TA406 which operates on behalf of the North Korean government, why isn't an ...
-1
votes
1answer
98 views

How to secure backend API access?

In the good old days, you made server-side websites using PHP or something like that, now we have modern web apps divided into front-end and back-end (usually API Rest), you can't rely on CORS because ...
0
votes
1answer
59 views

Creating Wordlist from specific characters and numbers using Mentalist or similar program

I have locked myself out of my Win 10 Microsoft account by forgetting my password and need to get back into it. I have extracted the hash for the account. I've been researching wordlists and hash ...
0
votes
0answers
35 views

What are the IP address with subnet mask of essential data Center and countries?

I would like to prevent connect residential IP and mobile device and Internet of things IP Is there a white list of IPv4 and IPv6 address with subnet mask of essential data Center only by countries? ...
1
vote
1answer
46 views

How to make sure my laptop (Ubuntu 20.04) is secure with a Windows 7 VM?

I have an old laptop which is running Ubuntu 20.04 and I am planning to use a virtual machine of Windows 7 Pro (using VirtualBox maybe). As its an old laptop and not my primary source of using the ...
0
votes
0answers
18 views

Sometimes all my accounts are logged out on Google Chrome, why is it? [closed]

Sometimes all my remembered accounts on Google Chrome are logged out. Including Gmail, Twitter, Facebook, Reddit. Why is it? should I concern about it?
0
votes
0answers
22 views

Does Microsoft scan the contents of documents uploaded to onedrives personal vault?

Specifically do they, but not "Can they" only because I'm fully aware that they are, and always have been, capable of intruding on any/all personal/sensitive data that isn't encrypted on a ...
0
votes
0answers
49 views

How to protect a game server's login information [closed]

I am supposed to act as if I am writing a security recommendation report for a game company. All I have been told is that the game is linked to social media login information so a breach in the game's ...
0
votes
1answer
49 views

What can happen when you click on a bad link? [duplicate]

I sleepily clicked on this bad link yesterday (DONT CLICK Unless you know what you're doing: https://6to.me/idsoni7kjv with a "?fbclid=" param - presumably identifying me) I'm wondering how ...
0
votes
0answers
22 views

cookie forging: How to replace session cookies

I am working on a pen-testing challenge, where I want to see if the session cookie can be forged by leveraging the vulnerable flask application (i can't disclose the url due to agreement). I have been ...
0
votes
1answer
45 views

Does TLS retransmit corrupted messages?

If a bit gets flipped by the network in a TLS stream, then the message integrity check in TLS will fail. Does TLS retransmit the affected message? Or does it do something else, like terminate the ...
0
votes
1answer
34 views

How to make a HAR file safe to send?

A big web service asked me to upload a .HAR file from Chrome incognito to help them with my support request. What sensitive information could I expose please and how can I remove it? I don't mind IP ...
3
votes
2answers
103 views

Can an SD card (or microsd card) emulate an HID device?

In a similar manner to a usb rubber ducky, can one use an SD card to emulate an HID device (such as a mouse or keyboard)? If so, how could this be implemented, and how can it be protected against?
0
votes
0answers
16 views

GitLab with api scope and confidentiality unchecked. What are the privacy risks?

I just created a GitLab application to connect it with StackEdit.io. I created it by following the instructions on this GitLab docs page. I had to create the GitLab application with api scope and I ...
0
votes
0answers
35 views

Does secure boot protect you from infected BIOS/firmware?

About secure boot, I've visited intel's website and they said: The feature defines an entirely new interface between operating system and firmware/BIOS. When enabled and fully configured, Secure Boot ...
-1
votes
1answer
74 views

Can modern radios/ham sets/digital walkie talkies be exploited?

Given the fact that modern radios/walkie talkies/ham sets have CPUs on them...would it be possible to exploit them? I am thinking in the following scenario: -There is a vulnerability in the function ...
2
votes
1answer
48 views

Approval of GPG key strategy

I am a beginner in anything related to GPG and I have now read quite some stuff about it to get a better idea. I think i grasped most of the concepts by now. I've worked out a GPG key strategy and i ...
0
votes
1answer
57 views

What is considered a secure way to store JWT in browser?

I'd like to rewrite a monolithic social website to use JWT for authentication instead of traditional cookie/sessionm, and I'm looking for a secure implementation. I read here that: You might think an ...
0
votes
0answers
22 views

OpenId with Biometrics - should I write a custom login + OIDC

We are trying to arrive at a solution for an enterprise app Different Users have different Authentication Methods User Type 1 - Password + Captcha User type 2 - Biometric [Not device-based] + ...
0
votes
0answers
4 views

How to know details of a particular file? [migrated]

A heic file was sent to me via email. Is it possible to know when that particular heic file is created by the original user?
0
votes
1answer
27 views

How can 2FA help prevent formjacking?

This article by Avira (part of NortonLifeLock) claims that 2FA (2-Factor Authentication) may be sufficient to protect against formjacking: Enable 2-Factor Authentication: Create strong and complex ...
0
votes
3answers
107 views

Would FreeBSD and OpenBSD have similar known-past-vulnerability stats if they were configured similarly?

OpenBSD has had much fewer "code execution" vulnerabilities and even fewer exploits than FreeBSD, according to https://cvedetails.com : https://www.cvedetails.com/product/163/Openbsd-...
0
votes
1answer
33 views

O365 MFA: Challenge (Approve or Deny) sign on - dangerous?

I have been searching resources online about proper MFA/2FA (with O365 specifically) considerations. How is the MFA push challenge notification to Approve or Deny a sign-on not dangerous? I have yet ...
1
vote
3answers
90 views

Are TLS v1.3 connections over open Wi-Fi secure?

If a non-compromised device is connected to the internet via open Wi-Fi, anyone can view the traffic. But if all the connections to the servers use a reasonably secure cryptographic protocol (such as ...
0
votes
0answers
10 views

What hash based digital signature algorithms exist that have reasonably small signature sizes? [migrated]

What hash based digital signature algorithms exist that have reasonably small signature sizes? By reasonably small, I mean not much bigger than what you would get with a 256-bit ECDSA (which I ...
2
votes
2answers
109 views

Is it foolish to trust a Wi-Fi network just because it uses a specific recognized SSID?

This article in the Avira (part of NortonLifeLock) security blog discusses (vaguely) security risks of public Wi-Fi. The article states: Man in the middle attacks are also a very prominent threat, ...
0
votes
2answers
57 views

How to be sure there are only encrypted data on my backend

I am coding an online password manager as part of my apprenticeship. I have already coded the full backend to synchronize the encrypted data and a frontend that encrypts and decrypts data with AES. So ...
0
votes
1answer
83 views

Can a hacker bypass UEFI password without changing or restting it?

Can a hacker locally bypass UEFI password without changing or resetting it ?
3
votes
2answers
181 views

Is it a bad idea to replace passwords with OTP?

As I understand things, given a user with proper password management (e.g. with a libre password manager like KeePassXC) the only realistic threat is having passwords leaked the following ways: A: ...
0
votes
0answers
20 views

Guidance to NSRL 'Goodware' for reference data sets with no malware Hashes?

Im looking to test a set of YARA rules against a corpus of 'goodware'. Virustotal's own blog [2] suggests use of the National Software Reference Library [1] however the NRSL RDS(Data Sets) have ...

15 30 50 per page