Consumer level switch or routers will most probably not provide any protection against ARP poisoning.

However, in the case of a small personal network directly connected to the router, you can add a permanent entry in your computer in order to associate the router IP to it's real MAC address.

Luckily enough, the command is the same on Linux and Windows hosts: arp -s <inet_addr> <hw_addr> where:

<inet_addr> represents the IP address,
<hw_addr> represents the MAC address.

This solutions presents nevertheless a few limitations:

It works best if all the hosts are connected directly to the router. If you have a switch between your hosts and your router, another host might still use ARP spoofing to confuse the switch,
In case of mobile devices, you may encounter an issue if you connect to another network using the same IP but a different MAC address (a lot of personal network have their router associated to addresses such as 192.168.0.1),
It is not salable to larger networks since it would quickly become heavy to maintain (but in this case there are often other detection / prevention measure available).


Ways to sign gpg public key so it is trusted?

Basically the problem is a matter of trust.

When you sign a file, someone needs to retrieve your public key to check the signature, but how can they be sure that this is really your signature?

GPG provide a way to do that called the Web of trust. For example, let's say you are Bob and want to discuss with Alice. You already know Ted, which is a friend of yours and you already exchanged key to discuss using GPG. You know that Ted knows Alice too. So you can ask him to give you Alice's public key and sign it. Thus when you read this key, you can check Ted's signature to be sure the key is valid.

Of course, you must have faith that Ted will behave correctly and not sign anything blindly.

So in your case, you cannot avoid this warning. The user has to be able to retrieve the key in a way he finds secure, so that he can mark this key as trusted. Unless you know other people who knows your client and can sign your key for the new client.
Bu definitely, self signed key are useless (I can make false and sign with it).


Unusual mail headers show evidence of MTA attack. Have I been pwned?

This is an attempt to exploit the current remote code execution issue in the EXIM mail server, i.e. CVE-2019-10149. See The Return of the WIZard: RCE in Exim for details and also the kind of exploit you encountered. You are safe if you are not using EXIM or run a fixed version.

From the linked article (emphasis added):

  This vulnerability is exploitable instantly by a local attacker (and by
  a remote attacker in certain non-default configurations). To remotely
  exploit this vulnerability in the default configuration, an attacker
  must keep a connection to the vulnerable server open for 7 days (by
  transmitting one byte every few minutes). However, because of the
  extreme complexity of Exim's code, we cannot guarantee that this
  exploitation method is unique; faster methods may exist.

  [...]

  Because expand_string() recognizes the "${run{ }}"
  expansion item, and because new->address is the recipient of the mail
  that is being delivered, a local attacker can simply send a mail to
  "${run{...}}@localhost" (where "localhost" is one of Exim's
  local_domains) and execute arbitrary commands, as root
  (deliver_drop_privilege is false, by default):

root@debian:~# cat /tmp/id
uid=0(root) gid=111(Debian-exim) groups=111(Debian-exim)
uid=0(root) gid=111(Debian-exim) groups=111(Debian-exim)


Protecting against CSRF when a form is being submitted via an AJAX call

Assuming the CSRF token is available to JavaScript, you can use setRequestHeader to attach the request token manually and modify your server to look for the request token in the cookie header, or for requests that should be accessible via XHR in the header you supply.


Is it more blessed to send than retrieve emails? Mandatory-TLS transmission vs IMAP over SSL retrieval

TLS in SMTP is hop by hop encryption, i.e. the mails are only encrypted between each mail server in transit but each mail server involved has full access to the decrypted mail. Otherwise these MTA would not be able to add Received or DKIM-Signature headers or similar to the mail.

Apart from that, the sender can only control if TLS is used to transmit the mail to the next hop and the recipient can control that the mail is only received by TLS from the last hop but both have no control how the mail gets transmitted between any other hops. And, TLS does not help against DNS spoofing or misconfiguration when the attacker can control which MX is involved in delivery.

IMAP with TLS instead is end-to-end encrypted. Insofar the IMAP solution would be more secure against eavesdropping by design. You could only reach a similar security with SMTP if you have control of all the hops involved. Depending on your outgoing mail server this might be done by configuring a fixed and direct route to a specific mail server of the recipient instead of relying on the common mechanisms (MX lookup) to automatically find the route.

  but then I remembered that TLS is the successor to SSL, ...

TLS and SSL are just different names the same protocol family and are often used interchangeably or are just called SSL/TLS unless a specific protocol version is meant. In fact, TLS 1.0 is practically SSL 3.1 and the amount of differences between difference between SSL 3.0 and TLS 1.0 might even be smaller than between TLS 1.2 and TLS 1.3.

  ... which I presume means stronger encryption.

Better encryption does not help at all if the attacker is not trying to sniff the traffic during transit but at the mail servers involved which is possible with the hop-by-hop encryption in SMTP but not with the end-to-end encryption in IMAP.


How to externally backup a fully encrypted disk partition

Please take a look at Duplicity, which is a tool commonly used for the exact thing you want to achieve. It can encrypt your files via GPG and it does utilize rsync to create back-ups at some destination.


Why store the password salt instead of generating it?

If the salt is a function of the password, then two exact passwords will produce the same hash.

For an arbitrary hashing function H() and an arbitrary salt generation S(Password), then

H("Password_1", S("Password_1")) = H("Password_1", S("Password_1"))

While if you use a random salt generation function RS() then

H("Password_1", RS()) != H("Password_1", RS())

As an attacker, nothing can make you happier than seeing two (or more) hashes used in two (or more) different accounts. This means at least one of two things

The password is weak (because two different users chose the same password), then the attacker could concentrate his computational cracking powers on those hashes.
The attacker can attack two (or more) accounts using the same computational effort only once.


Is PFS recommended by the NCSC in the PRIME profile for IPsec

The article provides basic principles for VPN and network design, and then gives fixed sets of encryption options without further explaining what their features are. Both PRIME (IKEv2) and foundation (IKEv1) profiles seem to use Diffie-Hellman Groups for deriving key material, providing perfect forward secrecy PFS. Explaining this or the other choices made is probably just beyond the scope of the guide.


Is it possible to tunnel my whole linux machine through http proxy?

If you want to tunnel any traffic you need to provide a tunnel entry at the network or IP layer and similar a tunnel endpoint too. A HTTP proxy is only an endpoint at the HTTP layer and can at most be used to tunnel TCP traffic with HTTP CONNECT request. And many HTTP proxies also restrict which ports or protocols such TCP traffic can use (i.e. HTTPS and WebSockets, but not arbitrary TCP).

Therefore you need to have something behind the HTTP proxy which creates a tunnel endpoint at the network level. This is what your commercial VPN provider gives you. But you could build your own tunnel endpoint if you have your own server of VPS on the internet. Once you have this you can use your VPN software to reach the tunnel endpoint through a HTTP proxy in a similar way to what your current VPN provider offers.


In using a VPN service is it possible to transmit data without giving away system configuration details?

The information about OS etc. comes from the HTTP User-Agent header. You can install some plugin to fake the User-Agent to any other you like, or strip it out altogether.

The information about screen resolution comes from the Javascript layer and you can do nothing sensible about it. You could go and hack the browser binary, for example replacing "availHeight" and "availWidth" with "awailHeight" and "awailWidth". The browser will then no longer understand requests from "availHeight". The calling site will be unable to determine your screen size, and several sites you browse will appear broken (Also, several file integrity schemes will now trip and report your browser as corrupt, infected, or otherwise unreliable).

Another possibility is disable Javascript support altogether, but then many more sites will appear broken.

Finally you can install a virtual machine with different characteristics from your own machine, and browse from there.


Difference between legitimate file transfer vs data exfiltration of confidential files using FTP

What you're looking for is the intent of the user at the time they're performing the operation, and that's very hard to determine from logs alone.  Some factors to consider:

What is the volume of data being transferred?
Does the remote endpoint belong to your company, or a partner company?
Has this user conducted transfers of this type in the past, or is the behavior unusual for the user?
Do the files being transferred make sense as a single logical data set?
Have other users connected to that host before?

This is why good analysts are so critical: they can combine the information in the logs with other information available to them.  Information outside the logs that might be useful in this case:

The user's role in the company, and how it relates both to the data being accessed as well as the transfer itself.
The time of day at the user's location.
Any open bugs/tickets/work orders requesting the data transfer.
The duration of employment of the user.

At the end of the day, you need a lot more information to determine the reason for a particular action.  Logs alone are not enough.


Why OpenVAS does not find all open ports compared to Nmap?

After studying and analyzing data from packet captures of both scans I discovered the answer. Apparently, OpenVAS works this way:

1) TCP 3way handshake on port

2) OpenVAS asks different famous protocol questions (HTTP, telnet, etc.) to get an answer with data (banners).

3) If it does get answers, it will create a report with all that data and say its open.

3)If it does not get an answer for them, OpenVAS will say its closed as he cannot give further data about the service the port is running.

So, what happened with ports 27000, 49154, 50095? These ports have very rare services running therefore OpenVAS did not ask questions for those specific and not usual protocols. As a result OpenVAS did not get answers and gave those ports as closed.

On the other hand Nmap just needs a succesful 3way handshake to give a port as open and like OpenVAS, Nmap did get 3way handshake for all those ports and did not try to get further data.

I hope I explained myself well enough. Thank you all for your help and advice.


What makes Superfish, and similar products (all herein just referred to as "Superfish"), different from corporate MitM is that Superfish is doing the MitM on the client machine. Corporate MitM is performed on a separate server or appliance.

This is important because the system performing the MitM must have the private key of a Trusted Root CA in order to work. (Strictly speaking, the Root CA doesn't need to be trusted. But the user will see red flags if it's not.)

For Superfish, that means the key has to be on the client device - one which is notoriously not well-maintained and generally very vulnerable to attacks.

For corporate MitMs, the key is on the monitoring server - typically maintained by experienced personnel who perform regular maintenance and do not do things (e.g.: web browsing, downloading extra software, opening documents, etc.) that would expose the system to unnecessary risk.

However, all SSL proxies (corporate or otherwise) still need to be carefully implemented to account for the fact that they are removing the client's ability to self-validate the remote system's certificate. Particularly this means:

The SSL proxy must properly validate the remote systems' certificates and either appropriately warn the user or drop the connection entirely when something is amiss. As Charles Duffy mentioned in the comments, properly validating certificates also requires that the proxy does not trust its own built-in CA.
Ideally, the SSL proxy should also do some integrity verification against historical or community-aggregated reference certificates. This is implemented in some web browser extensions, and under normal circumstances can be manually performed by the user, to help detect fraudulent use of otherwise-trustworty Root CAs. Since the SSL proxy removes the user's ability to do this themselves, or to effectively use a browser extension for this purpose, it would be best if the proxy could do its own checking to compensate. (Though I doubt this is available in most corporate MitM products.)

Another thing you need to be careful about, since you mentioned that this service is provided to you by an outside vendor, is that the SSL proxy can see all of your users' traffic as if it was unencrypted. (That's the very purpose of an SSL proxy.) This means that data you would otherwise want to have protected from third-party viewers is going to be fully visible by the vendor should they choose to abuse your trust.


Is there any point of arp spoofing on a wifi network?

It's true that you can examine data that way, but arp spoofing is used for many other attacks too, as you can do a lot when being the receiver of the data. You could then decide if you would like to send the packets somewhere else, to answer back with fake info (for example, a phishing site), and many others.


Any way to circumvent a 'filtered' response on NMap?

Seeing a 'filtered' state for a port has nothing to do with a "ping" or an exploitation attempt. Nmap's traffic is generally not exploitative. An adaptive firewall could detect the default (with privileges) half-open SYN scan after it has detected an open port, or it could detect any of it scan types based on the number of closed ports it tries to connect to. But most firewalls will not do this.

Using the --reason option, you can see the type of response that caused a port to be in the state it is. Most of the time, 'filtered' means that all the probes to that port timed out, and no response was seen. Sometimes, though, it can be because an ICMP Administratively Prohibited message was received. This is a good indication that a more-intelligent firewall is in place.

In the most common case, however, a filtered port simply means that a static (i.e. not adaptive) firewall has been configured to drop connections to that port. In this case, any incoming connection, whether Nmap or telnet or a browser, will be dropped.


Rule does not log X-Forwarded-For environment variable

You probably want this:

REQUEST_HEADERS:X-Forwarded-For

To me, it seems that X-Forwarded-For is not an environment variable, but a request header.

In some environments, each header is automatically converted to an environment variable, in the form HTTP_X_FORWARDED_FOR. However, it seems that in ModSecurity you can simply retrieve the request header.


Can screen blue light filter applications on android steal passwords?Do these filter apps see everything that I type?

The problem is with the DRAW OVER APPS permission. Android will not let you change any system level changes or install anything while an app is overlaying your screen. The reasoning being since the app can hide a malicious request and have the button pressed under it. Be very wary of any app that requests this permission and make sure you truly trust the developer.
Check out this link for more details on tapjacking. XDA Developers - Tapjacking


Why do heap overflows/int overflows/stack overflows/buffer overflows only happen in higher addresses?

It's because of how data is stored in memory.

When a data object larger than a single byte needs to be referred to, programs do so by remembering the address of the first byte, plus (in some fashion) the size of the object.  That first byte is (by convention) placed in the lowest-valued address of the available space, and as a result, any overflow will go off the high-addressed end.


Do credit cards which utilize an embedded chip but also have a magnetic strip, still benefit from the added security of the chip?

Most terminals that are pin and chip enabled will force the user to use the chip when it is present on the card.  The transition will be long in the usa, so the magnetic stripe is there for backward compatibiliy.


If it is truly being used for two queries and those queries are selecting a different number of columns there is no UNION SQL Injection attack that will work for both.  It's not possible to select two different number of columns at once.

It may be possible to perform other types of SQL Injection attacks like:

ID=1 OR 1=1

but you will need to experiment to see if that is possible in your particular situation.


Security implications of the contents of /proc/self/environ in LFI attacks

/proc/self/environ contains the environment of the process. In this case, only the CONTEXT_DOCUMENT_ROOT seem to be present (there would be a \0 between the two copies).

This would be possible. If your php application isn't run as a CGI, there's no need for the HTTP_ variables to appear there. The other SAPIs (such as FastCGI or an apache module) receive them in a different way.

However, even if we are only seeing the server environment, and it is not used to pass parameters to the application, it seems peculiar that typical variables like PATH or HOME don't appear there. And that the same variable appears twice doesn't make much sense, either.

Why don't you upload a basic php file to print the contents of the /proc/self/environ?

  I know that when an attacker includes /proc/self/environ and it does show their user agent, they can use tamper data for example to change their user agent to PHP code and upload a shell for example or open outbound TCP connections etc.

Not at all. In order to run code, the server would need to eval() the included User Agent, which would be quite silly.

The environment contents may be useful for gaining more info about the server (such as paths) for further attacks, though.


is it easier to get the original password if you have multiple hashes of it?

In theory, having several hashes may help; in practice, not so much.

The Theory

Let's consider SHA-256. From this function, we can define another hash function, which we will call SHB-256, such that SHB-256(m) = SHA-256(m) XOR m. In simple words, I compute the XOR of the SHA-256 and the first 256 bits of m.

This "SHB-256" is as good a cryptographic hash function as SHA-256: it is similarly resistant to collisions, preimages and second preimages. However, if I give you both SHA-256(m) and SHB-256(m), then a simple XOR of both value will yield the first 256 bits of m.

The Practice

Taking advantage of several hashes computed with the same password then relies on how "similar" the hash functions are, so as to allow "canceling" each other. This is a very ill-defined property, and (as yet) not thoroughly investigated. To my knowledge, no such shortcut is known with existing hash functions. There are a lot of details to mind; iterated functions and usage of salts make the matter even more complex.

What a realistic attacker can do when faced with multiple hashes is to use the one which will be easiest for him to attack, and ignore the others. If one of them is unsalted, then the attacker will target that one, which allows for simultaneous attack of several hashed passwords and usage of precomputed (rainbow) tables. Otherwise, he will use the function which will be most efficient when implemented on his hardware (e.g. if faced with PBKDF2 and Bcrypt, the attacker will target PBKDF2, which is easier to implement on a GPU). As @Polynomial puts it, your hashes will be as strong as the weakest of them.

An extra indirect effect is about your CPU budget. When doing registration, you will hash the user's password with all the hash functions. For the hash functions which are "configurably slow", like bcrypt or PBKDF2, this may incite you to configure them to be "a bit faster" than what you would have done if you had used only one, so as to keep your own costs within tolerable limits. This correspondingly lowers the attacker's efforts, since he has just to crack one hashes, not all of them.


What can be done to defend against acoustic keyboard evesdroping?

Not a lot in terms of practical efforts. The paper "Keyboard Acoustic Emanations" by Asonov, Agrawal gives rise to a few potential direct countermeasures:

Using a non-mechanical keyboard, e.g. a rubber membrane keyboard. This reduces a lot of the identifying transmissible audio. Unfortunately they're not very comfortable to type on.
Record key sounds from your keyboard and play them back continuously in a random order. Personally I think this would drive me completely insane.
Play very loud white noise and hope you don't end up with tinnitus.

An indirect countermeasure is to not have any microphones within range. Don't use a microphone on your computer, and put your phones in some sort of soundproof container.

Ultimately, though, I suspect this threat is only applicable to cases where you're being targeted by a nation state actor, at which point, to quote James Mickens, you're still gonna be Mossad'ed upon.


SELinux: command line tool to look security context (like selabel_lookup(3))

It looks like matchpathcon(8) (from the libselinux-utils package) does the trick:

% matchpathcon /tmp
/tmp    system_u:object_r:tmp_t:s0
% matchpathcon /tmp/foobar
/tmp/foobar     <<none>>

I think that should satisfy my needs [1].

You can use matchpathcon to verify existing files' labels:

% matchpathcon -V /tmp
/tmp verified

Although -V is a little confusing for files that have no policy defined:

% matchpathcon -V /tmp/foobar; echo $?
/tmp/foobar has context unconfined_u:object_r:user_tmp_t:s0, should be <<none>>
1

I would think a context value of <<none>> would match any context successfully instead of being flagged as an error.  The current implementation that I tested (libselinux-utils 2.4.4) flags those cases with a non-zero exit code (as shown above).

[1] My actual need is to look up the proper security context of a file in a mounted chroot image of a removable disk and set it to the proper context based on system defined policy - this will ensure the disk gets the proper security labels before being deployed.  I specifically wanted to look up the security context for /tmp in order to apply that context to a custom directory that has /tmp-like semantics.  The custom directory is not (yet) defined in a file_contexts list.


Sudo "/usr/sbin/halt", "/usr/sbin/reboot", "/usr/sbin/poweroff" - how to leverage it to privilege escalation?

The ability to invoke as root is not a property of the names halt, reboot, or poweroff, but of the files that are executed. The setuid bit is a file permission bit that means whenever you try to execute the given file, it is run with the permissions of whoever owns it (in the case of su, sudo, halt, reboot, and poweroff, root). You cannot use mucking about with $PATH to, say, make halt point to your own executable that gets invoked as root—if you hope to abuse setuid for privilege escalation, you must find a bug in an already-extant setuid program on the system (which is precisely why setuid program bugs are considered utterly critical).
EDIT: Seeing a comment on the question has made me reevaluate what the question means, and realise the following may be better suited as an answer:
If you've configured /etc/sudoers to allow normal users invocation of an absolute path only (as you have in fact done), then whether or not users can muck with the $PATH that sudo calls on (according to the manpage, changes to $PATH pass through sudo to the executed command unless the security policy resets it, although the default security policy does), they cannot invoke arbitrary binaries named halt, reboot, or poweroff, since you specified a unique path. Once again, only if those binaries themselves can be exploited, can someone cause trouble—but the attack surface is much bigger if you're allowing the execution of a binary that wasn't originally made to be setuid. You should make sure your /etc/sudoers security policy resets environment variables, to limit the range of attack (and prevent, e.g., abuse of a sudo'd shell script which uses the $PATH)—by default it does if you haven't tampered with the env_reset flag. You can double-check by setting some environment variables, including $PATH, and doing sudo env to print all the environment variables a program run by sudo gets.


Is CryptoLocker part of the TeslaCrypt ransomware family?

CryptoLocker was taken down in 2014. Some copycat ransomware developers have chosen to imitate it, but the original CryptoLocker is gone. TeslaCrypt, CryptoWall etc. are all different strains of ransomware.

However, because of the aforementioned copying of CryptoLocker's name and because it was the first ransomware to be widely succesfull, some media continue to refer to all ransomware as "CryptoLocker" even though the different ransomware strains aren't based off its code.

Edit: after comparing the description of TesCrypt given by Microsoft to the Bleeping Computer TeslaCrypt ransomware FAQ & removal guide I can confirm that TesCrypt = TeslaCrypt. The same goes for Crowti; Microsoft lists Cryptowall as an alternate name.
(I hate it that many AV vendors come up with different names for the same malware, it makes life more difficult for no good reason.)


Is there any such thing as an independent code vetting project which works for free to vet open source projects?

There is a major difference between "looks good for my own use case" and a more general code audit which can be applied to many use cases. And this difference has associated costs - why should companies bear these additional costs?
There are sometimes publicly financed or company sponsored real audits for some critical software, for example crypto libraries like OpenSSL or Botan. But don't expect any library you just like to use to undergo such a real audit. And many of these libraries would likely not survive such an audit anyway, because they are not designed with security as a major concern. Or a proper audit is simply not realistic because of a lack of proper documentation (i.e. code documentation, design documentation, ...) and a unwillingness or lack of time of the developers to invest a significant part of their own time to provide the assistance needed for a proper audit (i.e. creating documentation, design discussions, fixes ...).

We, Entity X, believe that version Y of library Z is clean, and will be using this in production."?

I guess the legal departments of many companies would block such a public statement because they fear backslash if a problem is found in these libraries and someone claims that they only used the library because they trusted this statement. And if a problem is found it will also shine a bad light on the capabilities of the auditing company, which might result in customers no longer trusting their products. Therefore companies are usually very careful before they make statements like these - which drives the cost of such an audit even higher.


Convenient Write Once Media to attach to a computer: A USB stick or device?

These WORM (write once read many) devices are by definition inconvenient and that's why there are very few of them and rather expensive. The expensive part is because it has to have hardware support.

You could try doing it on the same system with read-only rights for certain users and harden it with the immutable attribute. Even root cannot delete those files, but an attacker with full access can stop setting the immutable attribute for future files. But in the end, low level writes to the disk could change anything, so software can't be tamper proof.

Even forensics teams that deal with very sensitive electronic evidence use normal drives combined with other physical security measures like storing offsite and using fireproof safes. Keeping multiple copies of evidence and using hashes to prove they were not tampered with is another method they employ. This has the obvious downside that the data being protected is static.

Full disk encryption (FDE) serves the same purpose and that might give you some more flexibility. Although some FDE software offers read-only options on mounted volumes, in certain use cases the whole encrypted volume can be deleted.

My best advice is to send the data over a network to a different device.

If you care about logs, Synology offers syslog servers on their NAS devices.
Build your own NAS with FreeNAS that speaks syslog.
Get a cheap Raspberry PI and hook a hard-disk to it then sftp any files to it.
It can also be done more elegantly with network file systems.

To actually answer your USB requirement, I found a company that sells USB drives with WORM capabilities.


Dump specific rows from database using sqlmap

You can use --where to specify a constraint (for example you could do --where "ID=1000" to return only the record with an ID of 1000) or you can use the standard --start/--stop parameters.

As per this question you could also specify --sql-query="" to specify the select statement yourself for full control over the record set returned.


Bastion host that allows jailed users to SSH but protects private key

A possibility would be to use 'sudo' (or a script / alias relying on it).

Thanks to sudo, you can allow your users to temporarily use another (not necessarily root) in order to execute a very specific command:

Create a new account which will own the private key,
Configure sudo so your users can launch an SSH client using this account and its private key.

By this way your users will be able to run an unprivileged SSH client using a private key, without being allowed to access directly the private key itself.


Can AES and SHA-256 outputs with the same inputs be used to break each other?

This is safe if the password is safe. For example, 16 randomly generated bytes as password are fine, or perhaps a strong password that was run through a good key-derivation function (KDF) such as bcrypt, scrypt or argon2 (the slower the better, then an attacker can only do guesses at a slow rate).

You are giving more information to the attacker, so it is almost inevitable that you give away more information. There are two things I can think of:

Break one, get the other

Your scheme is broken if either someone finds a preimage attack on SHA2, or someone finds some attack in AES that leads to key recovery.

If an attacker only has the hash and not the encrypted contents, they can't use an attack on AES to crack your hash (and vice versa).

Attacks that completely break AES or SHA2 are extremely unlikely, though. Both algorithms are extremely well-studied and cracking usually happens by first degrading an algorithm substantially. If either of those two are broken, we're in pretty big trouble anyway.
Identifying a correct password guess

When cracking your encrypted bytes, an attacker will get random garbage as output upon each incorrect try. If your input (bytesToEncrypt) is also indistinguishable from random (for example if it's a Bitcoin transaction ID), an attacker will never know when they got the correct answer. (Well, perhaps they could check all Bitcoin transactions in history and find a matching one... but you get the idea.)

Now, instead, they can find an input that corresponds to the hash. Once that is found, they know that the answer is right, and they can use it to decrypt the message.

Usually, though, it's possible to check when a decryption is correct, so this is only a small advantage. And this assumes that your password can be guessed in the first place.

As said, both are very unlikely/infeasible. If your password input is secure, e.g. 16 random bytes or a very strong and KDF'd password.

So your scheme is basically safe, but it's only a small part of a larger application. If this is an important application, you should have it reviewed by a professional to be sure it's implemented correctly. (Note: that means paying someone, not just asking on a code review forum or something.)

Also, you call your inputs to AES and SHA2 "password", implying it's user-specified. A KDF is not visible in the code you posted, so you need to add that. Use a slow KDF, such as one based on bcrypt, scrypt or argon2.


Is it safe to use the SHA1 checksum of a password as a key for SHA-1?

The general response to this is correct - if your server is storing a copy of a key that's used to encrypt something in memory, there is a chance that an exploit will allow it to be stolen. (See: heartbleed)

I think it's definitely worth asking in this case why you need to store a hash and an encrypted version of the password. I can see a system in which you're logging into another service on a user's behalf and need their password, but since you mention:

  and temporarely stores it in a database, along with the other hash

I suspect this is not the case. There are very strong arguments for not using a reversible algorithm to store passwords in a web database, and I would like to understand your reasoning for wanting to do so.


What is the difference between 'Eavesdropping' and 'Remote Spying' in ISO/IEC 27005?

Eavesdropping

Reading sensitive information within a short range. In other words, eavesdropping.

For an instance, most credit cards come with a chip in their hearts. That makes it vulnerable to RFID attacks. Read this article RFID Credit Cards and Theft by Joel Johnson to know more.

Remote spying

Monitoring a device (which is not apparently yours) in another location, regardless of the range.

All you need is to gain access to remotely control the target device. A malware or a spying software on the target machine would do the needful.

You would be surprised to know Not just attackers use this to secretly monitor other devices, a lot of legal usage of this method is around us. Employers can monitor employees devices(since most of the devices are provided by the employer) and parents can use this to monitor their children(for safety purpose, etc.)


Separating "function" from "scope" in RBAC

While role-based access control (RBAC) is a major model for managing the authorizations,
implementing RBAC has some limitations and consequences.

One of the consequences is role explosion, where multiple versions (duplicates) of one role are required to separately manage access to distinct sets of data of the same class.

Role-Centric Attribute-Based Access Control is an extension to the traditional RBAC model to minimise this RBAC limitation.

Each user and object relevant for access control is associated with a set of attributes.

Attributes are assigning access control logic to users, objects, defining how users and  work together, what activities related to an object are available if a relevant attribute is assigned to a particular user.

Several approaches to RCABAC are described in literature:

use attributes to dynamically assign users to roles , for example
assign preset roles to organizational structure positions, assign
roles to business functions to simplify role assignment
treat roles as just another attribute
limit permissions of roles with attributes

Bibliography

Vincent Hu, David Ferraiolo, Richard Kuhn (NIST), Adam Schnitzer (BAH), Kenneth Sandlin, Robert Miller, Karen Scarfone, 2014, NIST, SP 800-162, Guide to Attribute Based Access Control (ABAC) Definition and Considerations

Jin, X., Sandhu, R. and Krishnan, R., 2012, October. RABAC: role-centric attribute-based access control. In International Conference on Mathematical Methods, Models, and Architectures for Computer Network Security (pp. 84-96). Springer, Berlin, Heidelberg.

Rajpoot, Q.M., Jensen, C.D. and Krishnan, R., 2015, July. Integrating attributes into role-based access control. In IFIP Annual Conference on Data and Applications Security and Privacy (pp. 242-249). Springer, Cham.

D.R. Kuhn, E.J. Coyne, T.R. Weil (2010), Adding Attributes to Role-Based Access Control, IEEE Computer (June 2010).

Other links

NIST, Role Based Access Control Project


Is salting a hash really as secure as common knowledge implies?

You have a fundamental misconception of how rainbow tables work.

A rainbow table or a hash table is built by an attacker prior to an attack. Say I build a hash table containing all the hashes of strings below 7 characters for MD5. If I compromise your database and obtain list of hashes, all I have to do is lookup the hash on the table to obtain your password.

With a salt, you cannot generate a rainbow table for a specific algorithm prior to an attack. A salt is not meant to be secret, you store it alongside the hash in your database.

x = hash(salt+password) You will then store it in your database in the format of salt+x This renders rainbow tables and hash tables useless.

As usual don't roll your own, use bcrypt, scrypt or pbkdf2 which takes care of all the details including salting for you. See How to securely hash passwords?


I downvoted your question due to the fact I believe it to be answered by the canonical resources on JWT, https://jwt.io/introduction/.

Happy to reverse that if I missed some aspect of your question, but I do think you just need to check that link - it seems to cover both your initial question and the follow up in comments


public databases of IP addresses which are involved in illegal/gray-area activities

The MXToolbox blacklist checker is a good place to start.

You can follow that up by reading some of the lists hosted at iblocklist.com particularly including the dshield list, and then some of the others.

Perhaps also look at the sources of "bad IP lists" in the Emerging Threats and Snort IDS/IPS rulesets.


Does Lawful Interception of 4G / the proposed 5G provide a back door for hackers as well?

Without access to the key, then the problem for attackers is the same as if there was no backdoor key: the attackers would have to break the encryption itself.

But ...

  If we assume that the private key of the base station is secure

Your base assumption is the one that requires challenge. That there is a key is the problem.

key handling
key misuse
key leakage
key strength
key protection

Each one of these elements needs to be secured for the key to be secure. And there are a lot of moving parts there and a lot of ways for people to cause weaknesses and ways for malicious actors to manipulate controls to their advantage.

Even if we perfectly trusted all law enforcement not to be malicious, ever (a sensitive topic on its own, but of course, impossible) then there are still lots of ways for weaknesses to creep in or for trusted people to be manipulated.

Once the door is there, it will become the intense focus of those with time, resources, and strong desire wanting access. How resilient will those with legitimate access be against such an onslaught? How perfect will those people be in engaging in the established procedures even without external pressures?

Once you cut a hole in a wall, it becomes a point of weakness. The strongest lock will not compensate for hinges that can be broken.


If you don't apply any kind of ACL then there will be no need for a mask. According to the this,

The mask entry is automatically created when needed but not provided.

And according to this if you use minimal ACL then no mask will be added.
 [arif@arif blabla]$ ls -ldha .
 drwxrwxr-x. 2 arif arif 4.0K Oct 17 06:13 .
 [arif@arif blabla]$ getfacl --omit-header .
 user::rwx
 group::rwx
 other::r-x

[arif@arif blabla]$ chmod g-wx .
[arif@arif blabla]$ getfacl --omit-header .
user::rwx
group::r--
other::r-x

[arif@arif blabla]$ setfacl -m g::rw .
[arif@arif blabla]$ getfacl --omit-header .
user::rwx
group::rw-
other::r--

According to this,

Extended ACLs also contain a mask entry and may contain any number of named user and named group entries.

So now, we will use extended ACL which results group class permissions mapped to the mask entry because as mentioned here,

In minimal ACLs, the group class permissions are identical to the owning group permissions. In extended ACLs, the group class may contain entries for additional users or groups. This results in a problem: some of these additional entries may contain permissions that are not contained in the owning group entry, so the owning group entry permissions may differ from the group class permissions.
This problem is solved by the virtue of the mask entry. With minimal ACLs, the group class permissions map to the owning group entry permissions. With extended ACLs, the group class permissions map to the mask entry permissions, whereas the owning group entry still defines the owning group permissions.

[arif@arif blabla]$ setfacl -m g:wheel:rw .
[arif@arif blabla]$ getfacl --omit-header .
user::rwx
group::rw-
group:wheel:rw-
mask::rw-
other::r--

Here, you can see that the value of group class permission is mapped to the mask despite of defining any specific mask. And this mapping approach ensures the smooth interaction of applications, regardless of whether they have ACL support. The reason for using group class permission bits as mask is described in the TRUSIX documentation as follows,

The file group class permission bits are the preferred masking field, even though they encourage permissive default access by the owning group. This choice must be made because the use of the file owner class would cause compatibility problems in programs which attempt to establish "owner-only" access, whereas the designation of the file other class could leave objects open to attack were an ACL removed or never present. An additional option of masking user entries with the file owner class permission bits and group entries with the file group class permission bits has the same disadvantages as masking against only the file owner class.

So I believe you could have said that the default value of mask is same as the group class permission value.


Which PCR we can extend by using our own code?

Short story

You can extend all of them, but it depends on the context. To understand what I mean by context we need to talk about the concept of Localities. Briefly, you can see this as some form of trust domains. By default, you're in Locality 0.

I don't see why you would need to do this but to extend all PCRs, you need to be in Locality 2. In other words, you need to load a trusted OS/MLE (an OS you wish to trust) using DRTM.

Long story

SRTM, i.e. PCRs 0-15 cannot be reset (except at boot) but they can always be extended (Locality 0 is required which, as I said earlier, is the default locality).

For DRTM, i.e. 17-22, it's a bit more complex. I'll describe it a little but the real matrix you should see is right here section 7.2.

Locality 4 is controlled by hardware/microcode so you can really see it as the root of DRTM/TXT. It's used to reset PCRs 17-20 and send the measurement of SINIT ACM (Authenticated Code Module) in PCR 17. You don't get to run code in locality 4, only TXT instructions does but you get to launch this process using the SENTER instructions.
Locality 3 refers to SINIT ACM which is responsible to validate some security settings referring to DRTM (ACPI/DMAR tables, e.g. for DMA protection), and send the measurement of the Measured Launch Environment (MLE) in PCR 18. Again, you don't get access to this locality, only SINIT does (Intel's code).
Locality 2 is for the runtime of the MLE. It can reset 20-22 and extend all PCRs. Here's where you get to run your code (whatever you decided to be your trusted OS).
Locality 1 is general purpose for the MLE.

As you can see , the different Locality level are used by DRTM to create some sort of staged trust levels.


Using Cognito access token to pass claims

Custom attributes are not available in Cognito access token. Currently it is not possible to inject additional claims in Access Token using Pre Token Generation Lambda Trigger as well. PreToken Generation Lambda Trigger allows you to customize identity token(Id Token) claims only.


Why don't sites implement a system where a wrong password causes a 3 second delay?

Generally locking accounts as proposed by raz is a very bad thing - it leads to helpdesk load, annoyed customers, and is not needed to actually prevent brute force attacks.

Temporary suspensions are used by more and more systems, often some delay that foils brute force, like 5 or 30 minutes, or by using an escalating scale, eg doubling the timeout each failed login attempt.


Getting [ERROR] Invalid target definition! while specifying https://mysitename.com in Hydra Gtk

You should NOT put the https:// part in your site parameter, see the following example:

hydra example.com http-form-post "/password.php:user=^USER^&pass=^PASS^:Bad login" -L users.txt -P pass.txt -t 10 -w 30 -o hydra-http-post-attack.txt


Do users data from europe have to be stored in the EU?

They don't have to store the data in the EU as long as the data is treated in the other country as if it was stored in the EU.

So for example, storing the data in the US is only possible thanks to the EU-US Privacy Shield. That is basically an agreement, that the US will respect the GDPR and other EU regulations for this kind of data.

That being said, there is some amount of controversy around the EU-US Privacy Shield. It may not protect all your rights fully. There are currently lawsuits filed. There however is no way to prevent this other than not using the companies that transfer your data outside EU.

Also, it is hard to enforce such an agreement, as EU officials may never find out about US agencies, such as the NSA breaking the agreement or circumventing it somehow.

PS: If you are looking for services protecting your privacy, you may wish to use services based in Switzerland, where the right for privacy is a constitutional right and any personal data requests from other countries must be confirmed by a Swiss court, in accordance with Swiss law.


Moving GIT/SVN servers to internal network segment while still allowing external collaboration

That plan should work, yes.

For git, at least, you have a number of other options afforded by its distributed nature. External collaborators can work on their own forks (in fact, they must, given how git works), and someone who has access to the internal server can then pull in their changes to the internal canonical server. Git was built with the core idea of mailing patches to a list, and git am still supports that flow. Or if the internal user has access to the external user's repo, they can add it as a remote and merge the commits in directly.

Why do external people need access? Why are you moving the repo internally?


Using metal business card holders as RFID wallets

The simple answer: yes.

A metal case, whether it is solid or a fine enough mesh will block RFID.


Can someone take down my mobile data connection?

I already answered this for WiFi.

Please read my cleaned-up version of this if you're less interested in how WiFi and cellular networks compare here, but in only the attack surface.

A lot of the things said there still apply here, I'll reduce the list to the ones that also apply to GSM/other mobile network standards:

  Physical layer attacks: Simply jam the frequency spectrum with your
  own signal. That signal might just be noise, but it might also be a
  WiFi network base station of your own under heavy load, with the nodes in that WiFi mobile network being
  configured not to play nice with others. (depending on the WiFi mobile terminal
  chipset, that can be extremely easy) Spectrum can only be used once!
  Tool: noise source (e.g. Gunn Diode, SDR device), or normal AP
  Electromagnetic sledgehammer: EMI gun. Take microwave oven
  oscillator, attach directive antenna, pray you don't cook someone's
  (your) brain, and point in the rough direction of the access point.
  Poof!
  Tool: Microwave oven, some sheet metal, lack of regard for other people's property and own health, or extended RF knowledge
  MAC and Network layer attacks: Especially for networks using WEP A5/1 (noone should
  be using this anymore, but sadly...) it's easy to forge what is called
  deauthentication packets – and thus, to throw out stations from your
  WiFi. decrypt GSM calls and fake base station knowledge
  Tool: Aircrack-NG's aireplay SDR+software base station, or hardware base station, or modified phones.
  Targetted jamming: As opposed to simply occupying the channel with noise or your own WiFi mobile network, you can also
  build a device that listens for typical WiFi packet's beginnings
  (preambles), and then, just shortly, interferes. Or just sends fake
  preambles periodically, or especially when it's silent. That way, you
  can corrupt selected packets, or fake channel occupancy.
  Tool: Commodity off-the shelf SDR
  authentication attacks: at some point, even "proper" clients for your WiFi mobile network need to register with
  the WiFi mobile network. That mechanism can of course be forced to its knees by
  simply sending hundreds of authentication requests every second, from
  randomly generated MAC addresses hardware IDs/IMEIs, or even from MAC addresses of
  clients you know (by observation) exist. There's no solution to the
  problem for the AP base station – either it succumbs to the overload of auth network registration
  packets requests, or it starts blocking out legitimate users.
  Tool: your network card a cheap mobile phone under your hardware control, 10 lines of bash scripting
  Man-in-the-Middling / access point base station spoofing: With anything short of
  WPA(2)-Enterprise, nothing proves that the access point calling itself
  "Toduas AP" is actually your Access Point. You might have heard of "Stingrays". If not, google is your friend. Simply operating a slightly
  higher-powered access point base station with the same ID string and, if necessary
  at all, a faked AP MAC address (trivial, since just a setting) operator identity, will
  "pull" clients away from your access point real network. Of course, if the spoofing
  Access Point base station doesn't know the password secret keys of the network operator(only necessary if >2G), users might quickly notice (or
  they don't); however, noticing things don't work is nice, but
  doesn't help them.
  Tool: a random normal access point any implementation of a base station. They're not expensive.

  You have to realize that it's a privilege, not a right, to have your
  WiFi use a channel. WiFi happens in the so-called ISM bands
  (Industrial, Scientific, Medical usage), where operators of
  transmitters don't have to have an explicit license. That means it's
  OK for everyone to use that spectrum, as long as they don't
  intentionally harm other devices and are not easily damaged by
  interference.

  So, it's absolutely legal for someone to operate a high-definition
  digital camera stream that occupies the whole WiFi channel. That will
  effectively shut down your WiFi.

Of course, it's illegal to interfere with mobile network operation. Illegality doesn't mean impossibility or a high probability of legal consequences for the attacker.

  If you need something that no-one can mess with, wireless is, by
  definition, not the way to go.


In general, one key per identity should be fine.

One key can include:

Several UIDs (for separate mail addresses, ...)
Several subkeys (for different devices, so you can put some subkey on your mobile; if it gets lost, revoke only this)

Advantages

Less hassle when signing keys, interacting with keyservers, cross-signing your keys
Less hassle maintaining your keys including moving to other computers, revocation certificates, ...
Less hassle when actually using it
Less pollution: If somebody wants to use your public key, it's easier to find the correct one as they're grouped in a semantic way. Imagine looking for a person's name and finding a dozen keys for all his different addresses in use, which to use for encryption?

On having multiple keys anyway

If you want to manage multiple IDs which shall not be connected directly (I can imagine a personal one, one at your employer, one for stuff which may not contain your real name - I think of governmental pressure, ...), feel of course free to use multiple primary keys.

Limitations of Subkeys

Others encrypting for you will always choose the newest subkey. There is no way to connect subkeys to specific user IDs (for example, to have different subkeys for work and home). This would be a good reason for using multiple primary keys (also, your employer might be able to require the private key, depending on your local legislation). This is not valid for signing subkeys: each computer will just use the subkey that is available; if you only distribute the specific subkey, you can easily enforce a given subkey.

GnuPG can only merge different sets of private subkeys for a primary key starting from version 2.1. Make sure to have all subkeys on a single machine and export as needed, or upgrade GnuPG. There is a way using gpgsplit and cat, but it is tedious and requires deep knowledge of RFC4880 (the OpenPGP specification).

Creating and Exporting Subkeys

Subkeys are generated by running gpg --edit-key [key-id] for the primary key, and then starting the subkey generation assistant with the addkey command (don't forget to save afterwards). To export a subkey (or set of subkeys), run gpg --export-secret-subkeys [subkey-id]! >subkey.pgp -- do not forget the exclamation mark ! , otherwise GnuPG will resolve the subkey to the associated primary key (and export this one instead). You can import it using the normal gpg --import [file] command.

I strongly recommend Debian's document on subkeys for further reading.


What does Amazon's S3 Server-side encryption protect against?

The short answer is this: We have no idea, probably none.

It might protect against stolen backups. But that assumes Amazon even makes backups. That seems very unlikely. If they did, why couldn't they recover data from their last S3 data loss? It's much cheaper and more efficient just to use multiple live copies.

Also, Amazon would need the keys on every access. So it seems very unlikely that they store the keys anywhere other than approximately the same places they store the data. So if you're  imagining a theft of live data devices, it's just as likely that they get the keys as well.

But we don't know how Amazon stores, replicates, and/or backs up data. Nor do we know where they store the keys or how they distribute them. However, I've yet to hear a plausible argument that there exists a realistic threat they protect against. The "stolen backups" theory seems to be based on the false premise that Amazon uses backups when all the evidence suggests they use multiple, live copies with the keys quite nearby.

Dropbox's encryption, however, does protect against one real threat model, albeit a very unlikely one. Dropbox stores their own keys and sends them to you, so it does protect you from a rogue Amazon employee. In exchange, you're vulnerable to a rogue Dropbox employee or Dropbox security bug.

My own opinion is that Amazon added this feature just so they could say that data could be stored encrypted. Some people will mindlessly compare check boxes on feature lists and Amazon wanted a check box on the "secure/encrypted" line. Either way, the weakest link is most likely Amazon's internal network and human security and the validity of the implementation of the code that decides whether to permit accesses or not.


GPG: Detaching Public Subkeys - why can't I do it?

Detaching Subkeys in Theory...

Detach subkeys does not correspond well with the OpenPGP model of primary keys, subkeys, user IDs, certifications and trust.

Both subkeys and user IDs are bound to the primary key, each individually. Certifications are applied on tuples of primary keys and user IDs, trust directly on primary keys.

You could very well detach a subkey from its primary key and use it (as a primary key), in necessary by fiddling with the bits in the OpenPGP packets. But without the connection with the primary key, it is in fact a completely new key without any certifications and trust (although the key material, the numbers behind it, stay the same).

... and Practice

Be aware that when exporting subkeys using gpg --export-secret-subkeys, a primary key stub is always exported, together with user IDs; because of this, GnuPG will display the "absent master key [...] reference [sec# etc.]" as you called it.

You can easily verify it by running

gpg --export-secret-subkeys [subkey-id]! | gpg --list-packets

for example (for subkey 0xDEADBEEF)

gpg --export-secret-subkeys 0xDEADBEEF! | gpg --list-packets

Make sure to include a ! after the subkey id, otherwise GnuPG will resolve the associated primary key and thus export all available subkeys!

Really Breaking Things Apart

To really separate the subkey, you could use gpgsplit, which dissects an OpenPGP message into its actual subpackets. Working with them requires deeper knowledge of the OpenPGP specifications (RFC 4880), but it makes fiddling with the individual packets (also with hex editors) and recompiling valid OpenPGP messages using cat rather easy.


Is pinging a website essentially the same as visiting the website through a browser?

They are not the same at all.

A ping request is an ICMP packet which just by default sends null data to check if the host is up (You can change around the parameters being sent (read more here).)

When you visit a website in the browser you are using the HTTP protocol which requests data and so you have a CLIENT/SERVER setup here (data is served to the client from server upon a request that is sent in the HTTP protocol).

Either way, if you are not the one sending the request but rather the service (poaulpos.net) you are using sends it, there is no traceback to you and therefore no security risk for you.


How do banks protect your account when online accounts have a weak password and MFA is not used?

Firstly, you will only get a few attempts to try to log in before the login is locked and you have to phone up to get it re-enabled.

Secondly, though you used only lower case and numbers, that doesn't mean that you couldn't have used more.

Thirdly, they use monitoring programmes that detect unusual activity and block it until it can be verified.

Finally, some level of loss is expected and built into the costs of doing business.

Of course, that doesn't mean to say that you should leave such a weak password in place - you absolutely shouldn't - getting a compromised account sorted could still cost you a lot in time as well as money.

Nor should you do business with a bank that allows such weak practices. Any decent bank would at least have a secondary factor such as forcing you to enter n out of n+++ characters from a secondary passcode. Or maybe an answer to one or more security questions.


What are the roles of the "PACKAGER" in a digital rights management system?

Encrypting the original content from the creator is a packager's main job, yes.
There's a few more things it typically does:

Add a "DRM header" to the content itself. This is usually an unencrypted blob (can be text or binary) that provides DRM-related metadata about the content. For example, the URL where the DRM client will need to go to in order to retrieve the DRM license, or the "content ID" from the DRM system's point of view.
Interface, via an API, with the license server. This is because both the packager and the license server will need to share key material.

There's more to packagers, which is however not germane to this question... for example, they can be standalone or they can be part of an encoder toolchain. If you need to know more, I recommend you ask a separate question.


I couldn't find any articles stating this and  I highly doubt they would charge you for it (unless you are using their VOIP services instead of skype). The reason for this is that some providers prioritize this type of traffic on their network and some even have special separated networks (this only works for their VOIP phones/services).

You can't really encrypt voip itself with SSL. The reason for this is that VOIP uses UDP. SSL requires a stateful protocol like TCP. So a VPN tunnel would be the only option.

If they want to know if you are using VOIP you would indeed need to do DPI with IPv4. With IPv6 this isn't necessary as IPv6 has a special header field to identify the traffic.

Your best option would still be a VPN. I don't really know of any other ways.

EDIT

Bruno suggested you can also use DTLS at implementation level.


Do large companies storing private user data ensure no single insider can abuse user data? if so, how?

First off, most companies do not employ (or follow) all the necessary procedures for preventing users from accessing data that they shouldn't be able to access.

Assuming that company X does follow the necessary procedures, these procedures would be built around a few fundamental principles:

Need-to-know access
Every user has access to the information that is mandatory given their job duties. Given that this principle is followed properly, even sysadmins should not have access to user data beyond their job duties.

Separation of duties
Every user is assigned duties that are not overlapping so that conflicts of interest are avoided. For example a sysadmin that can alter user permissions can view log files but cannot delete log entries.

Four-eye principle or Two man rule
Critical procedures must be reviewed by two individuals before taking place. This ensures that a malicious insider will not act alone. For example, if a sysadmin wishes to alter user permissions, they would need authorisation from an additional sysadmin or user to do so.

Data pseudonymization or anonymization
If for any reason, sensitive data are presented to a user (i.e. a spreadsheet that presents both sensitive and non-sensitive data), the data which is not relevant to your duties will be pseudonymized (i.e. replaced with pseudonyms) or anonymized (i.e. redacted or encrypted).


If you read the slides you linked you can see that there are several methods used to extract the encryption key.
If the encryption key is known, AES can be decrypted!


Why would an attacker include a request body with an HTTP GET request?

Could be deliberate, though nothing obvious leaps out from that specific body.

There are techniques like request smuggling that involve subtle protocol violations. See for instance:

http://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf

Might be interesting to see if the length of the request body is in fact 35870, or if something interesting appears at that place in the request stream.


ORDER BY sort direction is exploitable in SQL Injection?

If you control the sort direction, then this might be exploitable by replacing it with a desc union select <other query>. I have not tried it though.
See this post.
You will have to specify the exact number of columns of the original query, which you can find out by looking at the SQL error. In case that you don't have that information, you can find out by trial and error. Types have to match too.
EDIT: As of MySQL version 8, it is very unlikely that the approach noted above will work, because the individual select queries have to be put between parentheses. See (https://dev.mysql.com/doc/refman/8.0/en/union.html ):
ORDER BY and LIMIT in Unions

To apply an ORDER BY or LIMIT clause to an individual SELECT, parenthesize the SELECT and place the clause inside the parentheses:

(SELECT a FROM t1 WHERE a=10 AND B=1 ORDER BY a LIMIT 10)
UNION
(SELECT a FROM t2 WHERE a=11 AND B=2 ORDER BY a LIMIT 10);

Use of ORDER BY for individual SELECT statements implies nothing about the order in which the rows appear in the final result because UNION by default produces an unordered set of rows. Therefore, ORDER BY in this context typically is used in conjunction with LIMIT, to determine the subset of the selected rows to retrieve for the SELECT...


Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

Being hit hundreds or thousands of times per day is completely normal, and I wouldn't worry about it at all. There are a few major sources of suspicious traffic:

Automated scanners. A number of organizations "map" the Internet and produce a ton of traffic. They do so more or less randomly. I've gotten a lot of traffic on ports 80 and 443 despite not actually hosting a website.
Misconfigured systems. Computers are finicky things, and it's easy to accidentally start bothering another user's servers.
Script kiddies. Some attackers will blast a large number of potential targets, hoping to hit an unpatched system.

Port 53 is used for DNS. It's possible that somebody is simply mapping out DNS servers. It's also possible that an attacker is trying to exploit your systems - as long as you're up-to-date on patches, though, it's a non-issue.

So to reiterate, I wouldn't worry about this at all. You should get concerned if you start seeing enough incoming requests to constitute a denial of service, though.


How to set up a pentesting lab in Amazon Web Services?

First, a word of caution: AWS requires that you inform them of any security related test you plan on running to their infrastructure [link].

Second, Kali is not a vulnerable operating system, it is an operating system that comes with pre-installed tools so you can perform security tests on other machines.

And third, an AWS EC2 is already a virtual machine, yes you can install virtualbox in an EC2 but there is hardly ever a need for that.

Now, the type of EC2 machine you need depends on the type of test you want to run, for example if you want to probe a vulnerable web server you can run an EC2 with Ubuntu and install Webgoat or any other intentionally vulnerable web server. If you want to probe the actual server then you need to install the specific version of the operating system that you're targeting.

If you want to run both the attacker and the victim inside AWS then I suggest you create 2 separate EC2 instances, in my opinion its a bit odd to install a virtualization manager inside a virtualized machine

Related question: "Securely building a local pentest lab in a VM"

Update:
Vulnhub gives you an ISO/VMWare/Virtualbox image, you can convert this image to an AWS AMI image and create an EC2 with your custom AMI, I found this tutorial on how to do it.


What threats can come from an outdated Certificate in a private LAN

A X.509 certificate has several uses in the context of web browsing, among others the ability:

for the client (user) to check with a "trusted" entity that they indeed release that certificate to the server claiming so. This check is quite subjective (and somehow less for Extended Validation Certificates) but there is nothing better as of now.
for the server to check the connecting client. This is rarely used for "human" browsing but is common (or at least more used) for server to server communication

You can use either of them, or none - but what will always be in place  is a secure, encrypted tunnel between your browser and the target server.

This means that if you know somehow that the server you are targeting is the right one you could discard alerts from the browser. They just inform you that what you connect to is not what is claimed to be by the certificate, or that this information has not been checked by an third party (you both trust). The technical security of the connection (encryption) is not affected.

The expiration of a certificate (or incorrectness of other information it holds) invalidates its "trustfulness" but not the encryption part. Your connection is still secure. If the certificate itself was insecure (tempered with for instance) then you could not set up a connection at all.


Is there a SAML scenario where you would need an encrypted assertion if you are using SSL?

Consider where an application uses edge termination of SSL traffic. With encryption, the data is still encrypted until it reaches the specific server that decrypts the assertion. Without encryption, the data is sent over the internal network between the SSL termination and the application server in clear text.

This is a pretty common setup, especially with larger organisations, or where services like Cloudflare are used for load balancing.


Methods for slowing down a hashing algorithm

The goal isn't to make the hash slow for you to compute.  The goal is to make the hash slow for an attacker to compute. More specifically, slow for an attacker who has fast hardware and a copy of both the hash and salt, and who therefore has the ability to mount an offline attack. The attacker need not pause a thread during his computations just because you added that to your application. He is going to use software and hardware that will allow him to compute the hashes as quickly and efficiently as possible. Therefore, in order to make it computationally hard for him, with all of his fast hardware and his efficient hashing software, the hash must be computationally hard for you to compute as well.


Does DNS pinning protect against all DNS rebinding attacks?

DNS pinning does not protect against sophisticated DNS rebinding attacks.

Consider a scenario where an attacker sets up a firewall in front of their web server. You request their website, attacker.com, which results in a DNS query returning their IP address. The DNS result has a TTL (time to live) of 1 second. Normally, this means the browser should make another DNS request after 1 second has passed, however, DNS pinning instructs the browser to ignore the TTL and add some unit of time (say one hour) to it. So now, your browser won't make another DNS query for that hostname for 1 hour, 1 second. After the DNS query completes, your HTTP request is sent and the attacker sends back the website you requested with javascript code which will launch the attack.

Now, the attacker's Javascript has set up an AJAX request which waits two seconds before firing. Then it automatically requests some resource on the attacker's website again. However, the request fails. This is because the attacker has already set up a firewall rule blocking your browser's request. Now we are in the following state:

The TTL has expired on your first DNS request, but DNS pinning is still in effect
You made a request back to the attacker's website via their JS AJAX call
The request was dropped by the attacker's firewall

These three things will cause your web browser to send another DNS query despite the fact that you are using DNS pinning. In effect, the attacker has easily defeated your DNS pinning strategy by using a firewall and sending a second request outside of the TTL. DNS pinning isn't an effective strategy because there are plenty of legitimate reasons why someone's server might be down; your browser is forced to make a second DNS query in case there is another DNS record that will resolve to the correct machine (e.g. in case of a server migration, downtime, whatever). Basically, your browser has no way of knowing whether or not it's actually being attacked here; for all it knows, the server is legitimately down and so, it MUST make another DNS request.

So... why does it matter that there's a second DNS request?

The second DNS request is usually used by the attacker to return an incorrect IP address for the DNS record. Browsers have what is called a "same origin" policy which prevents webpages from making requests of resources that they do not own. Basically the way same origin works is that it says http://hostname.com can only request http://hostname.com. But it actually works using the IP address for hostname.com, not the human readable hostname itself. So in a DNS rebinding attack, when your browser makes the second DNS query that I described earlier, the attacker will return a "fake" IP address in the DNS query result. Then your browser will think, for example, that the IP address 1.1.1.1 belongs to attacker.com even though it really belongs to google.com. This allows the attacker to exploit the same origin policy of the browser; now the attacker's javascript can request stuff from google.com via AJAX. Also, they can read and set cookies and other malicious stuff. This exploits same origin policy by tricking the browser into trusting the second DNS record that was returned. Now the browser thinks hostname.com is associated with the IP address 1.1.1.1 even though it really isn't. What's a browser to do? DNS doesn't have that kind of authentication built in. :(

Preventing the DNS rebinding attack

There are a bunch of ways to prevent it, and I'm pretty sure modern browsers already have implemented protection against these attacks. One easy way to prevent it (as a web owner) is to check the HTTP host header of a request. For example if you are google.com then you would receive a request but the host header would still say attacker.com. Obviously that isn't part of your domain, so you can prevent the attack simply by dropping the request. Why would someone want to do this to begin with? Well, click fraud in advertising. Scraping search engines from many machines at once. Stealing valuable data from web sites on your internal company network. Etc.


What methodologies are useful when reverse-engineering malware / shellcode?

One method which I love is to use a API Monitoring software. My favorite is the one by Rohitab (google it) . I debug the malware in question and step through while I monitor API calls made on the software. This will provide you with a lot of information on what the malware is doing. For ex: monitoring FileRead and FileWrite calls will let you know what files the malware creates or reads. Note that this is somewhat of a gray box technique and not purely reverse engineering. Although, if you find something interesting in the API monitor, you will know in which part of the assembly the interesting part is.

Cheers.


https login iframes are secure from passive eavesdropping but won't help against active MITM.

The js vulnerabilities may have been closed, but the issue remains, as the parent html (served over http) can still be modified, including the url of the iframe. Then the MITM can set up the login page via http and that will be loaded by targeted users. Only users who are using a password manager will notice the change, as password managers treat https and http urls as different origins. This is nothing browser vendors can fix.

For example, instead of serving

<iframe src="https://site.example/login.php" name="login_frame">

the MITM attacker can serve

<iframe src="http://site.example/login.php" name="login_frame">

and serve a intercepted login page on the http page.

And javascript, as described in the original anwser, can still access the iframe attributes. Try it yourself: http://jsfiddle.net/eLqn0ky9/


From a DNS perspective, if Zone Transfers are not allowed the main ways to get similar information (i.e. information about valid hosts in the domain) would be either reconnaissance in search engines or using brute-force attacks to guess valid host names.

The search engine piece is relatively self explanatory.  You search for information relating to the target organisation and see what hosts names are exposed.  This kind of research can be automated using tools like Maltego (although this is only a small subset of its' functionality).

The DNS brute-force option essentially just guesses common host names against the target domain name.  Again there are existing security testing tools which can automate this process for example the dns-brute plugin for nmap


What is a secure DNSKEY bit length and usage time?

So is it correct to assume that these DNSKEY's are unsafe to use?

The 512-bit ones definitely, because they can be factored within such a short time frame.

The 1024-bit ones should be safe because they are most likely Zone-Signing Keys (ZSKs) that are rotated once a month or so and getting brute-force cracking time of 1024-bit RSA keys down to less than a month is still very expensive.

  Additionally, if a DNSKEY record has a (very) high time to live (TTL)
  for example a year, how would a high TTL impact DNSSEC security?

When rotating DNSKEY records you first introduce the new key into the zone, wait until every client has fetched the new key and no client has still the old one cached and then you can start using the new key. So if you have a year as your TTL for your ZSK you effectively can only rotate your ZSK once a year at most which is clearly undesirable.

Now if it is your key signing key (KSK) that has this long TTL you should be better off because these tend to use much longer keylengths (long-term secure ones) anyways. But as soon as you want to / have to rotate the ZSK you really want a "short" TTL.

  If ECDSA is used, how long (compared to RSA) do the keys have to be in
  order to be secure for DNS record signing (a lower key length)?

2048-bit RSA keys offer roughly 112-bit security, thus a 224-bit curve (eg secp224r1) has roughly the same security. 1024-bit RSA keys offer roughly 80-bit security and thus a 160-bit curve (eg secp160r1) and for 512-bit keys we have about 40-bit security which would equal to an 80-bit curve size (of which I couldn't find any examples just now). For more details on these conversions, see keylength.com and this Crypto.SE answer. In practice only 256-bit and 384-bit curves are standardized for DNSSEC.

The length of the ECDSA signature is always aboout two times the size of the curve here (encoding the x coordinates of two points). The size of an ECDSA public key is also roughly twice the curve size (unless compression is used).

  What is the practical risk of a DNSKEY getting compromised?

Basically the same as with using no DNSSEC at all, because an attacker can forge records on their way from the authoritative server to potential recursive resolvers or the end user. The only caveat here is that said systems will still think that DNSSEC protects them and thus it will pass eventual "only-DNSSEC validated records) filter.


What information is embedded in a photo taken by camera or print screen?

the coordinates where a photo was taken and the date and time it was taken

It's called EXIF metadata. It depends on the camera, or phone, or application.  Digital cameras usually save the image parameters (f-stops, ISO, shutter speed, etc) on that area. Cell phones can be configured to store coordinates too.

  Where is this information stored? Can it be deleted?

This data is stored on a special section of the file, and it does not change the image in any way. It's just a special text section that can be read/written by special software. It can be edited and deleted as well, and even contain fake/falsified data.

Deleting this data is trivial. There are a couple programs that removes that data in batch. Exifpurge is one, exiftool is another one.

  is it the same for print screen images?

It is the same, as EXIF headers are part of the JPEG specification. As most of the EXIF fields are not relevant for a screenshot application, most of the fields will be empty. You can test your screenshot application by saving a file and submitting to a EXIF metadata viewer, like this.

I am not aware of any image editor software that embeds coordinates on the EXIF headers by default.


What are the practical uses of large asymmetric keys?

For security, there is no need to go beyond 2048 bits for RSA, which is already quite some overkill. 1024 bits are already at the threshold of the feasible. We go to 2048 instead of, say, 1400 bits, because we just love powers of 2. See this site for estimates of "strength" that various organizations have come up with. Summary: RSA-2048 is quite safe for the time being, and when it ceases to be safe, it will be due to technology that does not work like technology we know today.

In the not-near future, quantum computers, if they work at all, will break all RSA keys, regardless of their length. Classical computers, on the other hand, are likely to never be able to break 2048-bit RSA because of the involved energy consumption. That is, unless some half-mad mathematician discovers a killer algorithm for integer factorization, which is, as always, an unpredictable event.

Bigger keys are largely used to appease the paranoia and flatter the ego of people who are in position to decide about technical details but lack the actual competence to do so. Big keys imply obvious network and computational overhead (a 4096-bit key will produce signatures which are twice bigger than 2048-bit RSA signatures, and it will cost about eight times as much CPU), but also interoperability issues: 2048 bits work everywhere, 4096 bits are more restrictive, and bigger keys are not widely supported yet. Thus, there are real, factual, measurable disadvantages to big keys, while the security gain can be qualified as, at best, esoteric: bigger keys are stronger only in the face of unknown technology or science, about which we can only speculate wildly.


The link provided by Schroeder is your answer to this one.

As a side note, looking at the data sheet for your ASA I would heavily recommend moving over to something new(er) - they stopped selling those back in 2013 and they lose support Sep-2018 in this case rather than just constantly upgrading all the time to get the latest features my best advice would be, replace that device.

Once Cisco stops supporting it (Sep-2018) you're going to have an incredibly hard time with getting support if something goes wrong, etc and that is a place you don't want to be (From experience) it's better to just upgrade entirely in this scenario.


How does Netsparker extract the version of SQL Server during a SQL injection?

The variable @@version returns the current SQL Server version.

Examples here:

  Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (X64)

  Apr 2 2010
  15:48:46

  Copyright (c) Microsoft Corporation

  Enterprise Edition
  (64-bit) on Windows NT 6.0 (Build 6002: Service Pack 2)

Going back to basics, to manually find a SQL injection vulnerability you would inject something like

' OR '1'='1' UNION SELECT 1;--

into an input, which would make a query execute similar to the following

SELECT * FROM foo WHERE name= '' OR '1'='1' UNION SELECT 1;--'

This would combine the results from the original, altered query, with the results from the additional 1 value column.

However, you first need to make sure the number of columns you are selecting matches the original query. So you may need to change the 1 to 1, 2, 1, 2, 3, 1, 2, 3, 4, etc, until you get your values returned.

Once you get a valid result returned from the page that contains your injected values, you simply replace one of the injected values with @@version. e.g.

SELECT * FROM foo WHERE name= '' OR '1'='1' UNION SELECT @@version,2,3;--'


Is it safe to have 2nd SSD with dangerous software? (disk encryption of the first drive turned on)

I'm using 1 SSD and I think it's safe.

You are "safe" in this sense when you have a full backup of your ssd which is not physically connected to any running computer.

Is it possible that the virus on the 2nd drive can reach the 1st drive, somehow damage the PC, or bring other unwanted effects?

Absolutely yes. If malware runs on your computer, it is trivial for the malware to destroy all of your data, no matter on which disk the data is stored in.
You should never run malware directly on your system. Either you use a dedicated computer for that or (more practically) you use a virtual machine like virtual-box or vmware with a clean OS (without any private data) to execute malware.

I thought about using a virtual machine for this purpose but found the information here that it's not 100% safe since the virtual machine can execute programs on the same CPU

This can be the only problem using a virtual machine. It is rare that attacks like this will work (depends on the malware you are using). But using a virtual machine is much more safe than using no virtual machine.


You didn't provide too much details, so in general:

One of the biggest risks in using cryptography is its inappropriate use, leading to several security vulnerabilities, eg. private key leak, known plaintext attack etc.
Unless you're an cryptography expert (and you don't seem like one), it's generally wise to use APIs of the highest possible level, that yet suits your needs. Such APIs are probably tested better than your application, so it is less chance for inappropriate use of cryptography in an API, than in your application.
This especially concerns topics like saving user passwords in a secure way (preventing attackers from being able to use rainbow tables in case they get table dump).


How to ensure account security when accessing emails when overseas?

In addition to the good suggestions mentioned here, I have a few more suggestions that may help somewhat:

Enable HTTPS in Gmail.  Tell Gmail you only want to allow HTTPS connections.
Install HTTPS-Everywhere.  This will help ensure your browser always uses HTTPS, not unencrypted HTTP.
Consider using two-factor authentication.  Google supports two-factor authentication; it calls it 2-step verification, so logging in will require access to both the browser and your phone.  You could enable this.
Encrypt your filesystem. If you are concerned about someone having physical access to your laptop (e.g., in customs; left in your hotel room; etc.) -- and you probably should be -- set up an encrypted filesystem.  Encrypt the entire filesystem on your hard disk.  PGP sells an encrypted filesystem product.  TrueCrypt is free and good.
Don't access your account from an untrusted computer. Don't access your account from a cybercafe or someone else's computer, while overseas.  That's dangerous.  If the security of the information is critical, consider buying a netbook; they're relatively cheap, and you can wipe their hard drive before and after you fly overseas.


Status of Trusted Computing and Remote Attestation deployment

Generally one has to know what TPMs and TXT and all these technologies are aimed to protect from, because there are misunderstandings.
TPMs, generally, enable 5 distinct processes, and only those:

Integrity measurement – computation of a cryptographic hash of a platform component
Authenticated boot – a process by which a platform's state (the sum of its components) is reliably measured and stored
Sealed storage – the process of storing data on a platform in such a way that the data can only be retrieved if the platform is in a particular state
Attestation – the process of reliably reporting the platform's current state
Isolated execution – enables the unhindered execution of software

From the Intel perspective, TXT is the entirety of trusted computing functions including the TPM, modifications to the operation of the processor and modifications to the operation of the chipset.

Main features of TXT technology are all those of TPMs plus

protected execution (hardware-based domain separation)
protected memory pages (providing protection against all four different ways memory can be accessed - through software, through DMA, through GPU cards, through SMM)
protected input
protected graphics
enabling trusted channels (between two computers or devices between one computer)

The Late Launch feature you mention is an optional TXT feature to enable measurements to occur after a system has been booted instead of every step of the boot processes, it's somewhat complicated.

Generally Trusted Computing is a huge project, with much research going on around the world for years, and has short term, mid term and long term goals. I must disclose here that I'm part of that research.

Now on to real implementations (although these are outside my field)

First of all, all major system manufacturers have enterprise hardware and software that makes use of TPM's, some features of it a least. Companies like Dell and HP that produce the majority of enterprise systems use software like (HP ProtectTools). In this example, pre-boot authentication is used with the help of a TPM. Microsoft has been in this research since forever, and has relased bitlocker with support for TPM before Vista. Actually bitlocker is not only about encryption: It has a separate feature named Secure Startup that implements the integrity checking part (it could be there without the encryption component). Transparent operation has to do with authentication - it can work in pre-boot auth mode as well. Also security software ventors, like symantec and mcaffee have software that relies or makes use of TPMs.

Now, I'm not aware of any other commercial or ready-for-use open source software dealing with TPM's and attestation or any other feature. (but as I said I haven't looked much, maybe another member knows more).

If you want experimental tools, proof of concept software or just papers and specifications, there are lots of that - as I said there are long-term goals in the project, and attestation is one of the long-term goals. Here is an example, reference implementation of the software stack necessary to support all features of a TPM in linux: http://www.opentc.net/publications/OpenTC_PET_prototype_documentation_v1.0.pdf (software is at http://www.opentc.net )

Just to intrigue the readers, Network Access Control is an active area of research - commercial tools may exist on that one already. The general idea in NAC using TPM's is of course to only allow a device in a network if it can be verified as secure by providing specific measurements, not only on the integrity of the booted software, but also on the level of patches applied, the anti-virus definitions, the firewall configuration... Other examples of research: Secure software download, as in a mobile carier that needs to update a phone's firmware over the air securely, specifically the software of the Software Defined Radio. Of course, Digital Video Broadcasting (DVB) is an area or research - dvb receivers already use smartcards to store keys, TPM's can be used instead.

Very-long term goals? Imagine a world where every system and mobile device has a TPM: a cryptographic coprocessor, secure storage.. and can generate public key pairs on demand, without user interaction: a worldwide PKI - research is ongoing on how to manage and what to do with that!

I think i've drifted far than the scope of the question so this should be enough.


If you don't care about security, you can do that.

Otherwise, you absolutely need a different key pair for each user. If multiple users share the same private key, they can easily impersonate each other. If you're only doing key authentication (no passwords) then they can log into each other's accounts.


Running Directory Traversal Against POST Request Headers

Directory traversal is tested as part of the ZAP active scan. By default all active scan rules are run, but you can define a scan policy which specifies exactly which rules are run, in your case just the directory traversal one.
ZAP also has the concept of active scan 'input vectors' - the things ZAP will actually attack. By default the HTTP headers will not be included, so you will need to enable these.
Its not clear from you post if you want the scan to be authenticated or not, if you do then that will complicate things - I'd start with an unauthenticated scan first and make sure thats working well before looking at authentication.


If I understood correctly, your peer's client-side certificate is not trusted by your organisation. Your ops team would have asked for a CSR to return a signed certificate that you trust, so that their (new) client-side certificate becomes trusted.
Unless there's more involved that isn't clear in the question, you don't need to send them a CSR, since your peer would not need to sign certificates for you.

About the CSR: To have a certificate signed, you need to have a key pair (private and public keys) and issue a certificate signing request (CSR) which contains bits of information and your public key. The CSR is handed over to the CA who in turn produce and return a signed certificate file for you (also containing your information, your public key and a signature).

Conversely, but less likely, if the 'client certificate' term in the error message is misleading, this could mean that your org's server side certificate isn't trusted by your peer's client software. This is where they may be asking you to change your server side certificate, hence why your ops could have decided to do initiate that by sending them your CSR.


It is usually a mistake to think of security as either it is or it isn't. You really need to do a basic risk assessment. As a comparison, ask the question "Is my house secure?" The answer to this question is not yes or no. It really depends on factors like where your house is located i.e. 30 miles from the nearest town is possibly safer than in a suburb with a high level of crime or burglaries. for my house in the country, I might have just standard locks, but for my house in the city, I might have high quality deadbolt locks, alarms, a guard dog etc. If on the other hand, I collect valuable art work and keep it in my country house and I just use my town hose as a crash pad for when I'm in town, I might invest in alarms and dogs for my country house and not really worry about the town hose as there isn't much value there and even if someone does break in, it probably won't have much impact to me.

the other point to consider is that if someone really wants to break into my house, I probably won't be able to stop them. All I can really do is make the cost of breaking in for the thief higher than the reward/value they will obtain.

The same ideas apply with respect to the use of SMS for verification etc. There are numerous reports of people having their Google mail account hacked despite using Google's two step verification (which includes an SMS code). See for example  http://gizmodo.com/how-hackers-reportedly-side-stepped-gmails-two-factor-a-1653631338 In addition to the risk of a malicious app on your phone stealing that information (there are numerous reports of banking malware which does this), there is also the risk that someone will hack your service provider and redirect your number to their phone. This is why most of the better systems don't rely only on the SMS. Often the SMS is just one bit of information which is required to gain access.

However, just like the house example, whether it is secure really depends on evaluating the risks. For example, I use an app which records todo items, bookmarks and other notes. It uses SMS as a way to recover my account should I forget my password or whenever I access it from a new device. Is this secure? For me, it is secure enough. If someone was to redirect my phone and get my SMS code and access the site, so what? They get access to my todo list and SMS messages. Most likely, it would just be an inconvenience. However, if my bank just used an SMS code to authenticate me, I would probably switch banks because this would be a much higher risk.

So, in general, SMS on its own as a form of authentication is not great, but may be sufficient for some things and is definitely not sufficient for others. If it is only part of the authentication process and requires additional information, that is probably better, but for some applications, may be a little excessive. Essentially, you need to evaluate its use in context and be wary of sweeping statements that say it is or isn't secure.


Is Node.js on Debian Jessie really insecure?

This is because a stable release of Debian must stick with the feature version of the time when it turns stable.

Debian team clearly states it in their Q&A:

  2.2 Are there package upgrades in `stable'?

  No new functionality is added to the stable release. Once a Debian version is released and tagged `stable' it will only get security updates. That is, only packages for which a security vulnerability has been found after the release will be upgraded. All the security updates are served through security.debian.org.

To maintain the functional stability, they backport security fix on their own as needed.

  Security updates serve one purpose: to supply a fix for a security vulnerability. They are not a method for sneaking additional changes into the stable release without going through normal point release procedure. Consequently, fixes for packages with security issues will not upgrade the software. The Debian Security Team will backport the necessary fixes to the version of the software distributed in `stable' instead.

On the other hand, v8 is known for rapid release cycle. V8 wiki on GitHub says

  Roughly every 6 weeks a new major Stable release is done.

It also says

  As soon as a new branch is promoted to Stable, we stop maintaining the previous stable branch. This happens every six weeks, so you should be prepared to update at least this often.

Because Jessie was released on April 2015, we had dozen of stable v8 get released.
Generally speaking, as time passes by and serveral stable v8 released, it becomes increasingly difficult for Debian team to fix their package.
Appearently, they are lacking volunteers to do backport.

You could use it on your risk, but you are explicitly guided not to.


What justification is there for Comcast to block SMTP port 25 outbound from residential service?

They block outbound connections because of home computers turned zombies, as part of spammer-controlled botnets. They don't actually block all outbound connections to port 25; they just block all connections which do not target Comcast's own SMTP server. This is a way to force all emails to go through their own SMTP server, in which they may apply spam detection and filtering tools.

Gmail using "alternate ports" is not a deliberate workaround, but a byproduct of how SMTP-within-SSL was designed. There are two ways to get SSL/TLS protection on SMTP:

The client connects then sends a STARTTLS command, and then both client and server "upgrade" the connection by doing a SSL handshake right away, on that connection.
The client connects to the server and immediately begins the SSL handshake. This works because the server expects it, instead of "normal" SMTP commands; and that works because the server is bound on another port, namely 465.