Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Questions about matters of computer, software and communication security, that is how to protect systems against attacks.

48
votes
6answers
10k views

Keeping a String Secret in (Open) Source Code

I have finished developing an app for Android and intend to publish it with GPL -- I want it to be open source. However, the nature of the application (a game) is that it asks riddles and has the ...
18
votes
2answers
5k views

How does an operating system create entropy for random seeds?

On Linux, the files /dev/random and /dev/urandom files are the blocking and non-blocking (respectively) sources of pseudo-random ...
12
votes
2answers
4k views

How does a wifi password encrypt data using WEP and WPA?

How does the password that we enter (to connect to a wireless network) encrypt the data on the wireless network? Through my reading I am not sure if the password that we enter is the same as the ...
11
votes
1answer
2k views

How does Stack Inspection work?

This is precursor to my other, more advanced question about Stack Inspection. Stack Inspection is a security mechanism introduced in the JVM to deal with running code originating from locations ...
9
votes
3answers
947 views

What is the branch of Computer Science that studies how Anti Virus programs work?

It is a trivial exercise in finite automata to show that there is no algorithm that can detect all the viruses, yet there are many software companies selling Anti Virus Software. Is there any part of ...
9
votes
6answers
360 views

Could program verification techniques prevent bugs of the genre of Heartbleed from occurring?

On the matter of the Heartbleed bug, Bruce Schneier wrote in his Crypto-Gram of 15th April: '"Catastrophic" is the right word. On the scale of 1 to 10, this is an 11.' I read several years ago that a ...
9
votes
2answers
780 views

Can you prevent a man in the middle from reading the message?

I have heard about all these Man-In-The-Middle Attack preventions and I am wondering, how this can possibly work if the man in the middle only listens to your stream and does not want to change the ...
9
votes
1answer
2k views

What is oblivious RAM and how does it work?

Could anybody explain me what exactly oblivious RAM is? I found the following explanation which makes it kind of clear to me, but I would like to get a sense of the technical aspects: Encryption ...
9
votes
1answer
537 views

Is WPA2 with pre-shared key an example of a zero-knowledge proof?

When setting up an access point and selecting WPA2, one must manually enter a pre-shared key (a password), PSK, into both the AP and the STA. Both parties, AP and STA, must authenticate each other. ...
8
votes
5answers
2k views

Would it ever be possible for computer viruses to evolve new “genes” to allow them to perform their job?

As an A-level Biology student, I have thought a lot about the links with Biology and Computer Science, and something that often comes to mind are the links between Immunology and Computer Security/...
8
votes
3answers
1k views

Key secrecy vs Algorithm secrecy

it's a well known statement that "Cryptographic security must rely on a secret key instead of a secret algorithm." I would like to ask about some details about it. And which are their differences? ...
8
votes
2answers
1k views

Limitations of Stack Inspection

This is a follow up to the How does Stack Inspection work? that explores the notion in more detail Stack inspection is a mechanism for ensuring security in the context of the JVM and CLR virtual ...
8
votes
2answers
87 views

Running an algorithm on data remotely and ensuring answer has not been tampered with

I´ve been thinking about this particular computing/crypto/database problem for years and I just want to know if there are already solutions to it. To be honest I don´t even know what field this ...
7
votes
2answers
147 views

Zero-knowledge proof: Abstract example

So I was reading about ZKP on wikipedia, the abstract example in summary goes like this: Peggy wants to prove to Victor that she knows the secret to a door inside a cave that connect A and B ...
6
votes
2answers
206 views

Fine-grained security models for XML data

Access control models are typically very coarse-grained, allowing one access to a resource (possibly with some combination of read/write/execute permission) or exclude such access. Some models of ...
5
votes
1answer
98 views

Anonymization of dataset preserving unique identities

The $k$-anonymization paradigm (and its refinements) means to create datasets where every tuple is identical with $k-1$ others. However I'm in a situation where people are in the dataset many times. ...
5
votes
2answers
394 views

What is the complete version of the paper: “How to Generate and Exchange Secrets (extended abstract)” by Andrew Yao?

I've found numerous places that claim that the paper "How to Generate and Exchange Secrets" by Andrew Yao introduces garbled circuits as a solution to the secure multiparty computation problem. ...
5
votes
2answers
162 views

In general terms, how could the Thompson Hack be implemented in Microcode?

In his lecture Reflections on Trusting Trust, Ken Thompson describes a virus that infects a compiler; the infected compiler installs backdoors into programs, but the key part is that the infected ...
4
votes
2answers
271 views

Is it theoretically exist a computer that never affected by computer virus? [closed]

Is it theoretically exist a computer that never affected by computer virus? just wonder if there could be a revolution on the computer?
3
votes
2answers
945 views

Dangerous interrupts

Let's say we have a fictional operating system in the user mode. Whenever an interrupt or a trap occurs, the os would switch to the Kernel mode jumping to the address determined from the interrupt ...
3
votes
1answer
357 views

Computer Security versions of the Halting Problem

I'm plenty familiar with the Halting Problem for Turing Machines. It occurred to me after reading several posts on this site that it would be interesting, educational and useful to start a list of ...
3
votes
2answers
2k views

Can the Bell-LaPadula model emulate the Chinese Wall model?

I have been reading on security policies and the question wether Bell-LaPadula can be used to implement Chinese Wall. Does anyone know more about it?
3
votes
1answer
820 views

Security Lattice Construction

I am having a problem trying to solve a question on a past paper asking to design a security lattice. Here is the question: The AB model (Almost Biba) is a model for expressing integrity policies ...
3
votes
1answer
260 views

Why do ACLs (access control lists) have better persistence than capabilities?

Although I understand the principles on which both ACLs and Capabilities operate, I do not see why on system restart it would be favourable to store privileges by using ACLs, instead of capabilities ...
3
votes
0answers
234 views

How is Chinese Remainder Theorem used in the proof of correctness for RSA

Question At the very end of (most) proofs of RSA's correctness we have something like $$m^{ed}\equiv m\pmod p$$ $$m^{ed}\equiv m\pmod q$$ Therefore by the Chinese Remainder Theorem (CRT) $$m^{ed}\...
2
votes
3answers
231 views

Can software itself be encrypted?

Imagine that I need to install my server in a remote location, so my algorithm can do something fancy (collocation of server at a financial exchange is how I thought of this question, but it applies ...
2
votes
2answers
1k views

Handling untrusted string input in printf in C [closed]

I stumbled upon the MSDN Best Practices for Code Review. Under the section “Untrusted Inputs”, I found following which I didn't understand properly. Why is the following considered safe? ...
2
votes
1answer
44 views

What exactly would stop me from registering a domain from my own nameserver? [closed]

Can I just make a nameserver and claim away? Are there implemented measures to stop this from happening?
2
votes
1answer
203 views

Can Eve impersonate Alice or Bob by using a replay attack?

For my computer science study, I have to design a replay attack (if possible) for the following authentication protocols. I use the standard security protocol notation. In these protocols, $A$ is ...
2
votes
2answers
57 views

Password authentication over an insecure connection

I was thinking a way to send password to server secure way without using secure connection,I found one solution.I want to find flaw in this.(Note: I am begginer,dont judge me, I know little about ...
2
votes
1answer
47 views

How is tamper-proofing of software evaluated for effectiveness?

How is tamper-proofing of software evaluated for effectiveness? I've been implementing a few algorithms listed within Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for ...
2
votes
1answer
72 views

User recognition through keystroke pattern

Hello thank you for taking time looking at this question. Is it possible to determine the keystroke patterns for a certain user? My idea is that, when the user enters their username & password it ...
2
votes
1answer
43 views

Oblivious RAM write protection

I'm trying to understand how oblivious RAM works, specifically path oblivious RAM. While I understand how this technique offers protection when reading data - multiple randomly distributed reads ...
2
votes
1answer
54 views

How to make a “Secure by Design” client-server communication?

Is there a way to have a secure by design client-server communication in a sense that the server can check if the client is not a modified version? What I'd like to do is give the user access to both ...
2
votes
3answers
43 views

Existence of functions that only tests memberships without revealing any information about the members

Given a set of strings $\{s_1, s_2, \cdots, s_n\}$, is there a way to encode them to a program $P$, such that given some string,$s$, the program can test the membership efficiently (deterministically ...
2
votes
1answer
24 views

Formally modelling and describing access rights

Is there a formal theory or framework described in text books that models access rights in a mathematical way. I would expect things similar to the following: We have data (objects). We have ...
2
votes
1answer
323 views

Access control matrices: who are the subjects: users or processes?

I'm studying the basics of security in computers. The doubt I have is that the access control matrix is presented as a matrix whose rows are the subjects and the columns are the objects. Also subjects ...
2
votes
0answers
42 views

Agreeing on a Time in a Trustless Network

Imagine a chord-like network $N$. each machine $m \in N$ is directly connected to $N_m \subset N$. Without relying on official timeservers, I want all machines to synchronize to some time with ...
2
votes
0answers
53 views

How does a vpn connection work?

I have been looking into vpn (virtual private network). And I wanted to know more about the theory, how does it work really: what does it do with the packages? why is it secure? (or why can it be ...
2
votes
4answers
166 views

Using two hash functions for increased password security?

Forgive me for my brief knowledge on hash functions as I am not from a computer science background, however I am researching password security for my thesis and have been looking into hashing ...
2
votes
0answers
64 views

Could an OS relinquish control back to the bootloader?

I'm wondering if it is feasible for an OS to return control back to the bootloader, and boot a second OS after itself. Reason being -- I've been musing on bootkits, and wondering if it would be ...
2
votes
1answer
133 views

Is a very long plain text password harder to crack than a short complicated password? [closed]

Is it true that a password consisting of the alphabet, even of common known names is much harder to find for a computer program than a short password, even though it uses numbers and other characters?
1
vote
2answers
407 views

Understanding Return Oriented Programming on Harvard Architecture

I'm currently reading this paper: Code injection attacks on Harvard-architecture devices (ACM) (pdf) I understand the basics of what the attack is trying to do, but one thing really bothers me. If ...
1
vote
1answer
126 views

Where can I find good study material on Role Mining?

I need to cover these topics in Role Mining. If anyone knows good site which well summarizes the topics and concepts are well explained please help out. Basic role mining problem • Delta-approx RMP • ...
1
vote
1answer
334 views

How pictures and videos are usually loaded in Memory? [closed]

Lets assume I'm talking about Jpeg and Mp4 and a general video player(not sure if different ones load it differently, if they do please tell) So do video players (process) usually load the entire ...
1
vote
2answers
39 views

Would limiting the number of operations in a transaction prevent SQL injection?

In my understanding all SQL injections need to add another operation to the one intended by the programmer. For example, a badly written query: ...
1
vote
1answer
54 views

Are there any examples of programming synthesis in vulnerability research?

Program Synthesis To borrow from Microsoft: Program synthesis is the task of automatically discovering an executable piece of code given user intent expressed using various forms of constraints ...
1
vote
2answers
68 views

Why is the star property important

According to the Bell-Lapadula model, write access is only to Subject $S$ on object $O$ provided if: $L(S) \leq L(O)$ where $L$ is the clearance level for $S$ and classification for $O$. This seams ...
1
vote
2answers
78 views

Handling TOCTTOU with system calls

What are some of the best practices when implementing system call functionality for handling/avoiding "Time of check to time of use" (TOCTTOU) security issues?
1
vote
1answer
81 views

Logic applications and security protocols references request

I'm a student of logic and I'm interested in looking at logic applications, of which I am told there are many, in computer science and allied areas. I've seen some applications. More specifically, I ...