Questions about matters of computer, software and communication security, that is how to protect systems against attacks.

learn more… | top users | synonyms (1)

2
votes
1answer
42 views

Is a very long plain text password harder to crack than a short complicated password? [on hold]

Is it true that a password consisting of the alphabet, even of common known names is much harder to find for a computer program than a short password, even though it uses numbers and other characters? ...
0
votes
1answer
18 views

Can file snapshots aid in detecting malware?

I noticed certain programs have a feature that can have a 'snapshot' of a file from a certaim time and compare it to a more recent snapshot of the file. If one's system has a snapshot of a program ...
-1
votes
0answers
19 views

About a program that might help the Windows 7 Operating system [on hold]

I use the Windows 7 Home Edition and one BIG weakness seems to be the Windows Installer or the M.S.I. Installer. 1,000,001 things seem to be able to go wrong with it and I'm not a programmer or a ...
0
votes
1answer
17 views

Two Step Verification. 4 digits vs 6 digits

From a security level standpoint (such as Server, DataBase, Token Code, Authorization, Authentication, etc.) in regarding the Two Step Verification, usually Apple send a total of 4 digits security ...
8
votes
2answers
14 views

How does an operating system create entropy for random seeds?

On Linux, the files /dev/random and /dev/urandom files are the blocking and non-blocking (respectively) sources of pseudo-random ...
1
vote
2answers
8 views

Handling TOCTTOU with system calls

What are some of the best practices when implementing system call functionality for handling/avoiding "Time of check to time of use" (TOCTTOU) security issues?
1
vote
0answers
74 views

How does one guarantee that the commutative, associative and distributive properties hold for a type?

While most main stream programming languages allow for user defined types that can have the following properties: associative commutative distributive the only way I know of that this can ...
3
votes
3answers
78 views

Would it ever be possible for computer viruses to evolve new “genes” to allow them to perform their job?

As an A-level Biology student, I have thought a lot about the links with Biology and Computer Science, and something that often comes to mind are the links between Immunology and Computer ...
5
votes
1answer
92 views

What is the complete version of the paper: “How to Generate and Exchange Secrets (extended abstract)” by Andrew Yao?

I've found numerous places that claim that the paper "How to Generate and Exchange Secrets" by Andrew Yao introduces garbled circuits as a solution to the secure multiparty computation problem. ...
2
votes
1answer
20 views

Access control matrices: who are the subjects: users or processes?

I'm studying the basics of security in computers. The doubt I have is that the access control matrix is presented as a matrix whose rows are the subjects and the columns are the objects. Also subjects ...
1
vote
1answer
60 views

Logic applications and security protocols references request

I'm a student of logic and I'm interested in looking at logic applications, of which I am told there are many, in computer science and allied areas. I've seen some applications. More specifically, I ...
-1
votes
3answers
93 views

Computer Science - System Security : How to Prove that KISS principle is Implemented in Security? [closed]

I basically have this homework question that needs me to support the below statement. Any suggestions on how i could go around proving it ? the Exact Question was : "The KISS principle is ...
8
votes
6answers
200 views

Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?

On the matter of the Heartbleed bug, Bruce Schneier wrote in his Crypto-Gram of 15th April: '"Catastrophic" is the right word. On the scale of 1 to 10, this is an 11.' I read several years ago that a ...
4
votes
2answers
135 views

Is it theoretically exist a computer that never affected by computer virus? [closed]

Is it theoretically exist a computer that never affected by computer virus? just wonder if there could be a revolution on the computer?
0
votes
2answers
79 views

Understanding Return Oriented Programming on Harvard Architecture

I'm currently reading this paper: Code injection attacks on Harvard-architecture devices (ACM) (pdf) I understand the basics of what the attack is trying to do, but one thing really bothers me. If ...
5
votes
2answers
117 views

In general terms, how could the Thompson Hack be implemented in Microcode?

In his lecture Reflections on Trusting Trust, Ken Thompson describes a virus that infects a compiler; the infected compiler installs backdoors into programs, but the key part is that the infected ...
0
votes
0answers
5k views

Difference between Cloud router and Normal Router

I am doing my mini project on cloud computing security and I am trying to extent already done project on Security policies for Routers to enhance Network Security. I am trying to extend that to cloud ...
3
votes
2answers
142 views

Dangerous interrupts

Let's say we have a fictional operating system in the user mode. Whenever an interrupt or a trap occurs, the os would switch to the Kernel mode jumping to the address determined from the interrupt ...
2
votes
2answers
303 views

Handling untrusted string input in printf in C [closed]

I stumbled upon the MSDN Best Practices for Code Review. Under the section “Untrusted Inputs”, I found following which I didn't understand properly. Why is the following considered safe? ...
5
votes
1answer
66 views

Anonymization of dataset preserving unique identities

The $k$-anonymization paradigm (and its refinements) means to create datasets where every tuple is identical with $k-1$ others. However I'm in a situation where people are in the dataset many times. ...
9
votes
3answers
606 views

What is the branch of Computer Science that studies how Anti Virus programs work?

It is a trivial exercise in finite automata to show that there is no algorithm that can detect all the viruses, yet there are many software companies selling Anti Virus Software. Is there any part of ...
8
votes
3answers
301 views

Key secrecy vs Algorithm secrecy

it's a well known statement that "Cryptographic security must rely on a secret key instead of a secret algorithm." I would like to ask about some details about it. And which are their differences? ...
8
votes
1answer
407 views

Is WPA2 with pre-shared key an example of a zero-knowledge proof?

When setting up an access point and selecting WPA2, one must manually enter a pre-shared key (a password), PSK, into both the AP and the STA. Both parties, AP and STA, must authenticate each other. ...
2
votes
1answer
388 views

Can the Bell-LaPadula model emulate the Chinese Wall model?

I have been reading on security policies and the question wether Bell-LaPadula can be used to implement Chinese Wall. Does anyone know more about it?
3
votes
1answer
250 views

Security Lattice Construction

I am having a problem trying to solve a question on a past paper asking to design a security lattice. Here is the question: The AB model (Almost Biba) is a model for expressing integrity policies ...
1
vote
1answer
96 views

Where can I find good study material on Role Mining?

I need to cover these topics in Role Mining. If anyone knows good site which well summarizes the topics and concepts are well explained please help out. Basic role mining problem • Delta-approx RMP • ...
10
votes
1answer
529 views

How does Stack Inspection work?

This is precursor to my other, more advanced question about Stack Inspection. Stack Inspection is a security mechanism introduced in the JVM to deal with running code originating from locations ...
8
votes
2answers
551 views

Limitations of Stack Inspection

This is a follow up to the How does Stack Inspection work? that explores the notion in more detail Stack inspection is a mechanism for ensuring security in the context of the JVM and CLR virtual ...
9
votes
2answers
1k views

How does a wifi password encrypt data using WEP and WPA?

How does the password that we enter (to connect to a wireless network) encrypt the data on the wireless network? Through my reading I am not sure if the password that we enter is the same as the ...
5
votes
2answers
175 views

Fine-grained security models for XML data

Access control models are typically very coarse-grained, allowing one access to a resource (possibly with some combination of read/write/execute permission) or exclude such access. Some models of ...