Unanswered Questions
4,256 questions with no upvoted or accepted answers
16
votes
0answers
867 views
Emacs and EasyPG not performing public key encryption
I have a file which I edit and encrypt following this guide.
I'm a noob as far as security goes and thought that the point of including the line which specifies the cryptographic key to use
-*- mode:...
12
votes
1answer
772 views
How are TPMs provisioned for Intel Trusted Execution Environment (TXT)?
For Intel TXT to work, the TPM must be provisioned. Intel provides some tools for doing this but many are protected by non-public login or an NDA. Many OEM platform vendors provision their boards and ...
10
votes
2answers
658 views
How does MDK3 carry out deauth attacks?
With aireplay, you have to specify both the AP and client to send deauth frames to, but MDK3 doesn't require an AP mac address. Does it just scan the desired channel for beacons until it finds an AP ...
9
votes
0answers
113 views
Are browser wrappers in software bad for users?
These days I see a lot of browser wrappers in software. For example:
when you purchase something in the Steam desktop application and use PayPal, you enter your PayPal security details in a browser ...
9
votes
0answers
439 views
OpenSSL EVP aes_256_cbc Initialization Vector Size
I'm looking at the crypto library examples (programmed in c) provided for OpenSSL EVP on OpenSSL Wiki.
Their example for a 128 bit Initialization Vector is as follows:
/* A 128 bit IV */
...
9
votes
0answers
980 views
Openid connect nonce replay attack
The openid connect specification adds a nonce parameter to the authorize endpoint, which must be echoed back as a claim in the id_token. It claims that the purpose of this parameter is to prevent ...
9
votes
1answer
272 views
Pin required for accessing (smartcard) Card Authentication Slot
So let me set the stage:
I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html
I made a couple ...
9
votes
2answers
2k views
dnsspoof not spoofing (requests and forwards real DNS packet)
I was trying to use dnsspoof but it did not work as expected. These are the steps I followed:
Set IP forward in kernel to 1
arpspoof -i eth0 -t 192.168.1.39 -r 192.168.1.1 and arpspoof -i eth0 -t 192....
9
votes
0answers
599 views
How to properly secure an ActiveMQ instance, and what are all of the different files for?
I'm trying to configure user based authentication for ActiveMQ, and I'm pretty confused about the many different files involved in this process. I've read ActiveMQ's security page, but I still have ...
8
votes
2answers
579 views
Does Wannacry spread outside its private subnet to adjacent private subnets?
Does a Wannacry-infected computer on an internal network with a private IP address attempt to spread to other privately-addressed subnets?
I have not found a definitive answer online.
Cisco says:
...
8
votes
3answers
5k views
SQL Injection Escaping Challenge Security Shepherd
I am using Security Shepherd as a training tool and I am now in challenge SQL Injection Escaping Challenge. The challenge is as it can be seen below:
When I makae a query just like the one above (...
8
votes
2answers
2k views
importing OpenVAS xml in metasploit
I am practising in my lab with some metasploitable machines, and I just realised that the vulns declared by OpenVAS 6.01 in the scan report aren’t imported in Metasploit 4.11.5 by the db_import report-...
7
votes
1answer
250 views
PSD2 compliant two factor authentication
According to PSD2 the elements of the multi-factor authentication must be independent so the compromise of one element does not compromise the other.
Here is the article from the directive:
*...
7
votes
0answers
218 views
Can SRP be implemented using libsodium
I am using libsodium for cryptography and I want to use SRP for key exchange. The wikipedia page lists a python example, but I am not sure if and how I could convert this to libsodium function calls.
...
7
votes
3answers
5k views
What is a AUTH-KEY in the security of the computers?
I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
