Need an explanation of Cross-Site Flashing?

Flash is jailed by the some-origin policy and can only act upon a site that loads the flash applet with scripting access enabled.

However,  flash can become a vector for XSS.  The demo above lists various XSS vectors.  So for example in the extremely unlikely condition where you are loading a flash applet where the attacker can control the loadMovieNumVar variable then an attacker could execute JavaScript in the context of the site by setting this variable to javascript:alert('gotcha!').

XSS is extremely common and there are many ways that this attack can manifest. Flash based XSS is one way,  and its also extremely uncommon.


So there are several ways to answer this question, but ultimately it's going to depend on your requirements and what you have available to you.

The simplest solution is to never store the passphrase and manually
input it when required (at service start.)  That can seem onerous but
if the service is stable you're not likely to enter it often.
If you have a physical device, or if you have the ability to have
host affinity (keep your virtual machine on the same physical machine
all the time.) You can likely take advantage of a Trusted Platform
Module embedded in your device.  It's possible to store symmetric
keys in a TPM (a good breakdown is here:
https://security.stackexchange.com/a/51341/2678) it's not any more
secure really than a passphrase on disk to an active attacker, but it
is stored separately than the disk if it were to be
stolen/compromised it would require more than a simple disk copy to
discover.
The better option is you could actually store the RSA keys in the TPM
itself and the TPM can handle the keying operations instead of
holding them in a keystore directly.  If the daemon you're using can
support PKCS11 this is the best supported way.  (See Virtual
Smartcards: https://frankmorgner.github.io/vsmartcard/virtualsmartcard/README.html)  Also the Java docs: https://docs.oracle.com/javase/8/docs/technotes/guides/security/p11guide.html

These are definitely not the only ways you can do this, but it should give you some ideas.


How to secure ubuntu desktop after a hack?

As Mark says it's an extremely broad topic. People have written entire 500 page books on the subject. However the best advice for someone after a breach is:

Backup all your data and re-install. Do not try to simply clean your system. Root kits can hide very well and you don't want to miss one.
When you do re-install change all your passwords (in case of key loggers etc...) and pick secure ones.[1]
Make sure you keep your software up to date. New vulnerabilities are found all the time and it's important to patch.

Because it's a laptop the other thing I'd add is if someone has physical access then they can do pretty anything unless it's encrypted and even then if it's already switched on and decrypted, encryption may not help much.

[1] I personally like xkcd style passwords and a password safe but what the best practice with passwords is could start a holy war.


In iOS, every file and keychain item is protected using one of protection classes. Depending on the particular class used, encryption key for files and/or keychain items is computed differently, allowing (or disallowing) access while device is locked.

Available protection classes are (see "File Protection Values" in "NSFileManager Class Reference":
  * NSFileProtectionNone: file can be accessed any time, even if device is locked;
  * NSFileProtectionComplete: file can accessed only when device is unlocked (note there's ~10 seconds grace period after device is locked during which files are still accessible);
  * NSFileProtectionCompleteUnlessOpen: file can be created while device is locked, but once closed, can only be accessed when device is unlocked;
  * NSFileProtectionCompleteUntilFirstUserAuthentication: file can be accessed only if device has been unlocked at least once since boot.

Note that all classes except NSFileProtectionNone use user's passcode to derive actual file encryption key, so key is cryptographically tied to the passcode.

To answer your questions: NSFileProtectionNone is what allows iOS to access files while device is locked. This is the "weakest" protection class of all and its use is discouraged, but there are cases when its use is necessary (like the examples you provide). Yes, all the items you mention are stored in the file system like everything else, but because of NSFileProtectionNone they are encrypted with key that is not tied to the passcode and thus can be computed when device is locked.


How to escape a cookie to cause split response?

While the exact answer will depend on the technology you're using to process the request, the odds are that you can't split the header because modern frameworks have protection against response splitting.

To exploit you need to find or create a vulnerable server that somehow allows the user to inject a CRLF into a cookie. Frequently this would be done with the HTML encoding of %0D%0A but the exact encoding mechanism will vary depending on the vulnerability you have found. For example, if the server processes backslash escapes, \n\r would be appropriate.


Oligomorphism vs polymorphism vs metamorphism in malware

Polymorphic code: The (same) code takes many forms (like encryptions)
Oligomorphic code: The (same) code takes one of a few predefined forms (and thus can be possibly matched against signatures that can cover all cases)
Metamorphic code: The code mutates, so the code itself is different in each execution (but the functionality the same)


Details of a good WPA2 pre-shared key (password)?

Contrary to the originally accepted answer, a random multiword passphrase is not subject to what we usually mean when we say "dictionary attack" (that's when you just throw a large wordlist at a hash, one line at a time, maybe with a few rules thrown in). Such a simple attack would have no effect on a solid Diceware passphrase. Your seven-word Diceware-based example above, if truly randomly generated, would be randomly located in a pool of 1.7x10^27 possibilities (we often use "keyspace" as shorthand for this).

This keyspace is roughly the equivalent of a 13-character password randomly generated from the entire 95-character printable ASCII character set. Even if the password hashing method was a very fast hash (such as MD5), a 10^27 password cannot be exhausted simply by renting a few (or a few racks) of GPUs.

If this seems counter-intuitive, I encourage you to do the math. If you calculate how long it would take to exhaust a 10^27 space - see this excellent Jeremi Gosney rant on Twitter - then unless the NSA is after you (in which case, they're not going to bother with your WPA2 passphrase), either of these password methods are more than sufficient ... even if your password is stored using a really fast/bad hash like MD5.

But in this case, we're not talking about MD5. We're talking about WPA2, for which cracking speeds are much slower - for example,  on the order of 2.5 million hashes per second on a 6x 1080 GPU rig. That may sound fast, but again - do the math. Even if you assume capabilities of a trillion passwords per second (nation-state grade, which would be silly, as noted above) ... it would still take 10^27 / (1000000000000 * 60 * 60 * 24 * 365) or on the order of 10^7 or 10,000,000 years to fully exhaust the keyspace.

Your seven-word Diceware passphrase is not even faintly vulnerable to a "dictionary attack". You could literally tell a professional password cracker with a roomful of GPUs exactly which dictionary you used, what the separator is, that they're all lower case, and that there are seven words in the passphrase ... and they wouldn't be able to crack that WPA2 in your lifetime.

And even if I made three major errors in this math (which is likely, since I'm typing fast) ... and even if each of those errors makes my math off by an order of magnitude ... that's still 10,000 years.

Diceware passwords are considered to be strong for a good reason: the math doesn't lie. (And they're great for WPA2 because they're easy to type into all the weird wireless gear you have in your life.)


If someone has a hashed password, how long till they decrypt it?

Not too long.

If I understand you question correctly, you'll be using passwords that are 6 characters long, with only lowercase letters and numbers. So each character can only take be one of 36 possible outcomes (26 letters + 10 digits)

Effectively it's 36^6 combination which is 2.1 Billion.

Obviously it depends on the hash in question, and the hardware you're using, see here has a good comparison.

For e.g if you're using MD5, this would be cracked in under a second. Even with SHA-3 this wouldn't take more than hour. If you go wild with multiple high-end GPUs, this would be a walk in the park -- even if the password were truly random.

And I'm assuming you're brute-forcing every possible combination -- not from a wordlist. Most programs, like hashcat will allow you to bruteforce without a wordlist. Which seems apt for your use-case.


Does knowing part of a passphrase for sure really mean that you can "disregard" that entire part when trying to crack it?

What you're describing is a (partial) known plaintext attack. This worked when attacking a shared key cryptosystem like Enigma (see the "Wetter" message start situation they found) where knowing the state at one point help determine the state later. This doesn't work for cryptographic hash functions like where you turn a password into data for a key. The reason why is that in a cryptographic hash (e.g. PBKDF2) it is designed such that all the output depends on all the input, and changing one bit anywhere changes multiple output bits.
TL;DR: You're out of luck cryptanalytically. But linguistically you might have a path to a quicker solution. In your example if you knew the specific structure, you could make a list for candidate words/phrases and try every permutation. It would still be faster than raw brute force but possibly still longer than practical. Or hypothetically, lacking knowledge of a password structure but knowing it's natural language, you could build a probabilistic language model and have it just start generating text to try. Theoretically it's faster than brute force. Realistically you may still die of old age before it finishes.


Knowing a web application is HTTPS only, do HTTP cookie need the secure flag?

As you already said, a man in the middle could grab the cookie while in http transit when the secure flag is not set.

Note that the secure flag tells the browser to not transmit the cookie when not on a secure connection. So the other way round than what you expected.

Now, even if your website is only running on https, a man in the middle might offer http only, proxying your web application, connecting to it via https.

This way, the cookie will be sent over http whenever a user without https everywhere manually enters the URL, unless you also have the HSTS set.

But even if you have, a man in the middle could remove the header for new visitors on their http service, stealing their cookie. This however is unfortunately true for the secure flag, as well.

So, in a scenario with a man in the middle, setting the secure flag will make it harder for the attacker to gain access to cookies of users, even if your service is only offering https.


Airmon-ng/Airodump-ng - Low Beacon Count on certain networks

The majority of my issues cleared up when I passed the USB wifi adapter straight through to Kali. This leads me to suggest it's a driver issue with Ubuntu.

I'm still not picking up clients connecting to the AP but that wasn't the main question I was trying to resolve with this post.


You can do this today pretty easily by leveraging TPMs for key management and perhaps Intel SGX for a more protected execution space.

The problem with such systems is always scale of operation, management and reliability. It's trivial for me to write some code, encrypt it with your public key and send it to you, it's extremely non-trivial to do this for everyone.


Where/How is an ODBC password stored when 'saved' in Access?

I would like to point out, that the answer to the second part of the question has little to do with the first part.

Even if the password was stored in a super-strong encrypted fashion (it's not), this would still not be secure, in several aspects.

The user has complete, unfettered access to the database. I.e. he can do anything he wants (per the permissions of the shared user... The user's privileges are restricted on the database, right?). E.g. accessing any unauthorized data, deleting other users' data, inserting garbage, etc.
This sounds like there is a shared user account, that all the users have plugged into their ODBC connection... Which means, the database server has no way of limiting users' access, segregating their data, tracking who done what, etc.
In any event, the ODBC password would need to be decrypted in memory, allowing the user to grab it, and then impersonate the application and again, do whatever he wants.

You'd be much better off redesigning the application, with a middle-tier and all...
I always find it odd discussing security and MS Access in the same conversation...

If you absolutely cannot change the architecture, consider using Integrated Windows Authentication, and tying user accounts (or group) to a db role for management. That way, at least each user will have his own account on the server, you can restrict access (according to the principle of least privilege), no shared accounts, and you can track each users actions on the database.


How to enforce confidentiality while keeping the authenticity?

Is it prevented by using another pair of keys to encrypt the original Data?

Yes, you can use one set of keys for signing and one set of keys for encryption.

  How is this prevented? Is it prevented by using another pair of keys to encrypt the original Data? If so, how is the public key given to the receiver without being intercepted?

The problem of key distribution is fundamental. In practice this problem is solved by using a trusted third party called a Certificate Authority (CA).

The CA is implicitly trusted (because the manufacturer installed its root certificate in your computer) and the CA can sign a web server's (e.g., google.com) certificate to prove that the certificate belongs to the web server.

You can then verify the CA signature on the certificate. This gets rid of the MITM attack because the MITM can not obtain a signed certificate from the CA saying that the MITM is, e.g., google.com.


It's definitely possible to extract keys from memory.  Because of how modern systems work, bitcoind's address space (where its keys are stored) is accessible by other processes running as the same user and also by those with higher privilege levels.

The most universal safeguard against these sorts of attacks is to simply "erase" the key by writing over it with random bytes.  There's still a window in which this key can be read, but if an attacker is able to read your key from memory there are countless other ways they can get at it.

Depending on what processor you're running, you might also be able to take advantage of hardware features to hide your keys.  Many ARM processors specifically have a special execution space called TrustZone that can be used to separate your keys from the main address space.  Here's a paper describing such a system applied to bitcoin wallets.

This isn't in your question, but you might be interested to know that you don't necessarily need to store your primary wallet on your computer to begin with; you can easily encrypt and print out your private key, remove all evidence of it from your computer, and still receive/hold funds.  Food for thought!


The best way to approach this is to look up HOW you could hide something in an image. I'll give you a hint, it has to do with how pixels are defined. Also have a look at these sites:

http://openstego.sourceforge.net/
http://mark.goadrich.com/courses/csc350f08/labs/lab1.html


Self-signed certificates and internal cURL requests

This error occurs when a browser encounters a certificate that it does not trust.  By that I mean that the server's certificate is not installed as a trusted root certificate.  These are handled different on a browser to browser basis, but generally the error message you see allows the user to add the un-trusted certificate to its trusted certificate store if they choose.

This error does only occur when the user tries to access the page via https://, or if you redirect your http:// page to the SSL/TLS enabled webpage.  The server is responsible for handling the HTTPS request, and sending its certificate for validation.  When the browser receives the certificate the following checks should happen:

Does the browser recognize the certificate as a trusted certificate?
Is the certificate expired or revoked?
If the answer is no to both, then this message will be displayed.
Now the user is given the option to continue to the website and/or install the certificate in its trusted store.

This will not stall things on the server side, and will run without error.  The reaction to an un-trusted certificate depends upon the browser that is accessing the webpage.  Regardless, most SSl/TLS protocol implementations will allow a certain amount of time for the client to respond to this message.  If the user accepts the certificate as valid within the timeout window then the connection will proceed as normal.  If they wait too long then the user will get a "session timeout" error, and they will have to reconnect to the website.

Curl automatically verifies server certificates.  If you'd like to turn this off you can do this with -k or --insecure.  Or you can add your server certificate to the trusted store.

Add Self Signed Certificate to cURL Trusted Store

The link above will take you through the steps of determining where on your Linux system the trusted certificates are stored, and how you can add your server's certificate to be trusted.

Edit
Since the commercial software is passing along arguments to cURL, I would expect that if cURL doesn't trust the certificate that it would fail.  The user won't be able to access the page.  It's also entirely possible that the software has mechanisms for handling this error.  It may prompt the user to install the certificate, and continue the connection.  Without knowing the software it's hard to say what its exact reaction will be.


Say all the metrics you listed in your question report zero.  Does that mean your software is secure?  Does finding 0 bugs mean there are no bugs?

The reason you're having a hard time finding software-only metrics is because software doesn't exist in a vacuum.  Here's a  question that's just as difficult:  How much is a piece of software worth?

There are several questions I'd ask if someone just handed me a report with the metrics you listed here.

What security policies are your metrics being weighed against?  As much as I despise the topic (BOOOOORING!!!!) security in any organization--and therefore its software--need to be based on sound security policy.  And concentrating on software alone as you want to do in your question is sidestepping a piece it shouldn't be sidestepping.  And please note that policies can determine how severe certain bugs are in comparison to each other.

That said:

OWASP has a presentation here that may interest you.

Warnings from the presentation:
Software Security Metrics

Metrics are context sensitive and environment-dependent
Architecture dependent
Aggregation may not lead to strength

Here are a few metrics they list:

Size and complexity
Weakness/LOC (CWE)
Weakness (severity,type) over time (CVSSv2, CWE)
Cost per defect
Attack surface (# of interfaces)
Layers of security
Design Flaws (CWE)

And this paper, while not a one stop reference, does present a method of weighting specific kinds of security flaws, which could be used to develop a scoring system that you can apply to developers/applications.

And lastly, a very important statistic that I think you should consider are the number of false positives, both by testing tools AND by human testers.

And then there's CVSS.


Protecting against Firewire DMA vulnerabilities in Linux

FireWire controllers of the type used in PCs (OHCI) have the ability to allow other FireWire devices to do remote DMA.
This feature must be enabled by the driver before it works.

The SBP-2 protocol is the only FireWire protocol that uses remote DMA; therefore, the Linux kernel enables remote DMA only for SBP-2 devices (i.e., hard disks and other storage devices), or any device that claims to be a SBP-2 device.

You can disable that driver by disabling it; write the line

blacklist firewire-sbp2

into any .conf file in /etc/modprobe.d, or disable CONFIG_FIREWIRE_SBP2 when compiling the kernel.

At the moment, the firewire-sbp2 driver relies on remote DMA for data transfers, so you have to choose between FireWire storage devices and protection from remote DMA attacks.
(It would be possible to implement those transfers in software, but this has not yet been implemented.)

The ability to read/write any memory is also useful for debugging from another system, so there is the option CONFIG_FIREWIRE_OHCI_REMOTE_DMA that enables remote DMA for any FireWire device.
However, this option is not enabled by default.


What to do next for this possible buffer overflow?

There's not too much to be gained in actually exploiting it just for a demo.  You should be able to demo making your system crash from a phone borrowed from your audience, and that should adequately appall your viewers.

If you really want the dogs and ponies to bark and trot, you could rig the demo using rebase on your module.  That will let you move the address space to somewhere other than its current 61xxxxxx location, such as a nice and convenient 41xxxxxx.  It's certainly dishonest, but it's also dramatic.  If you feel guilty, tell them that it's almost no different than if someone added a new module at that address as part of a future feature enhancement.


How to handle media files from untrusted sources?

Indeed, there are many vulnerabilities in FFmpeg and alike, many of them discovered by researcher at Google with fuzzing technique. Updating your player, encoder and codecs is a must to reach a secure system as far possible.

If you have to deal with (media) files from untrusted sources, I may suggest handling them in a “virtual container“. Check out some of the solutions like VMware or VirtualBox which provide free versions.

I'm working as a security researcher and my team is relying on this approach for all critical file-types (media, documents, executables, etc.). It has some negative impact on comfort and performance, usually just in a minor way. But sometimes this is the price you have to pay for security.


Is there a real possibility of getting malware by “drive-by”?

You can lookup vulnerabilities at http://cve.mitre.org/. "CVE is a dictionary of publicly known information security vulnerabilities and exposures."

A rough search of:

Firefox, returns 888
Chrome, returns 729
Flash, returns 371

Further filtering of the severity of these would need to be done, but this gives an upper bound of found vulnerabilities.

http://web.nvd.nist.gov/view/vuln/search allows for the filtering based off of time period, with only CVE checkbox selected, searches of 3 years, and 3 months gives the following respectively:

Firefox, returns 391, 64
Chrome, returns 653, 80
Flash, returns 227, 16


No, it isn't.

If you're trying to prevent tampering, a 31-bit hash is much too short, even ignoring any shortcomings of a specific function.  If you're trying to catch data corruption, a standard hash such as CRC-32 is almost as fast and is designed for the purpose.


Using an encrypted username in API calls

Many types of encryption don't provide integrity guarantees. However, Fernet appears to:

encrypt()  Encrypts data passed. The result of this encryption is known as a “Fernet token” and has strong privacy and authenticity
guarantees.
Parameters:   data (bytes) – The message you would like to encrypt.
Returns bytes:    A secure message that cannot be read or altered without
the key. It is URL-safe base64-encoded. This is referred to as a
“Fernet token”.

So as long as the secret key remains secret, you are good.


Is anyone held responsible if a VPN/proxy that doesn't log is used for illegal purposes?

Short answer: No, that would not be a valid defense.

Let's say you penetrate a site. The site views your IP and reports you to the authorities. They then ask your ISP who had that IP at that time, and will be directed to you. That's a lot of evidence to suggest that someone from your home and/or network hacked the site. Saying it wasn't you because your local proxy doesn't keep logs is like saying you can't have done it because you cleared your history.

The anonymous VPN services are often hosted offshore, out of reach of the authorities, and not in the same network as the attacker. :P


How is wsj.com tracking users to find how many articles I have read?

If I had to implement a paywall, I'd probably go with a combination of the methods you mention.

For example, cookies will work just fine for many users, and it's efficient, so that would be the first "line of defense": If I got a cookie back from a customer, I'd use that to allow or deny entry.

If I didn't get a cookie back, I might employ ETags, and if that didn't work either, I'd fall back to Browser Fingerprinting in combination with fuzzy source IP address matching.

Browser fingerprinting is very effective (see EFF's Panopticlick for a demo) when javascript is enabled. It will yield false positives, but if you combine it with a look at the ip address block someone's connection comes from, it will be very accurate. We have a lot of computers based on an installation image at work, so you'd assume they have the same browser fingerprint - but after a few weeks of use, I did a cursory check and several fingerprints had changed. I'm not sure why. Maybe it was due to having installed additional software, which installed additional fonts on the machine.

I'd do it in this order because cookies are the standard way to do it, etags are somewhat sneaky, and fingerprinting last, because I may make false decisions with fingerprinting which impact innocent customers. Still, it would be easy to allow innocent victims access -- if I locked someone out, I'd just display a message that if they believed the message to be in error, they should accept cookies from my domain in the future.

You can find out how WSJ does it by forbidding all cookies - if WSJ still identifies you, it's not doing it solely with cookies. Do the same for local storage. Then you install a plugin which lets you block ETag-related headers, and see if they still identify you. If they do, disable Javascript. If that doesn't help, play with changing the values of various other headers, such as the Accept header, and so on.


First to answer the question of DHCP. DHCP works by sending a broadcast on a network, which means that if the DHCP server can hear the broadcast of a client (DHCP Discovery), then the client and server can negotiate an IP address.

In your case, you are going to be sat on another VLAN from the DHCP server, so effectively a separate subnet. With this in mind, if your subnet is 192.168.1.0/24 and the companies DHCP server sits on 192.168.2.0/24, your client will not be able to communicate with the DHCP server using network broadcast. This means that realistically you are free to set up a DHCP server to serve the appropriate IP address range without subsequently broadcasting out to the rest of the network.

Now it is possible to set up a DHCP Relay on your router which will pass DHCP traffic between your clients and the DHCP server of the larger company if you want to, really this is a decision for you on how you want to manage the IP addresses on your network.

Regarding firewall choice, my preference is to opt for a Linux iptables and squid proxy option. You can forward web traffic transparently to a squid proxy, this is possible using iptables:

http://www.cyberciti.biz/tips/linux-setup-transparent-proxy-squid-howto.html

Secondly, you want to filter by mac address. Squid supports this with ACL's:

https://superuser.com/questions/343983/restrict-users-with-regard-to-their-mac-addresses-is-it-possible-with-squid


What prevents this session hijacking from occurring? (SMB/CIFS example)

If the connection is unencrypted then nothing prevents this, just a lack of generic toolkit. Metasploit can handle it as can SMBRelay (never used the latter). But for example, the metasploit payload can intercept (relay) the authentication then run arbitrary code on the server.

http://pen-testing.sans.org/blog/pen-testing/2013/04/25/smb-relay-demystified-and-ntlmv2-pwnage-with-python

I may have misunderstood your question though. I'm not aware of anything that modifies the files on the fly but I dont see why it would be impossible.

Addtionally: Encryption will only help here if the server is signed, otherwise the user will not be aware if they are connecting to the correct server or the malicious one.


What's the correct way to handle a failure with Client Certificate Authentication

If authentication fails usually it's good practice to drop the connection/session, then log that as a security incident.

If the certificate is expired, consider contacting the responsible party via email or SMS and informing them.

If you notice a trend of invalid certificates then you may want to look into that as a potential attack (DoS or brute force).

Invalid certificates may be a configuration issue with a user, if you can ID the responsible user try to contact them. Most people don't really understand certs and can easily mess up the config.


How do AV vendors select malware signatures?

From what I know, both methods are used.

Signatures can be generated by automated programs that are fed malicious samples, and from there, extract strings, data, attributes, etc. that can be used to create automatically create a signature.

Also, researchers will often analyse new, unknown samples in order to search for unique strings, data, attributes, that can be used in order to create a signature. You can't really automatically release a signature for a brand new strain of malware if you have no idea of what it is first. However, since most malware share similar caracteristics, automated processes can be used to detect new samples.

You might want to take a look at Intezer, it does just that.

https://www.intezer.com/

I'm sure that many Antivirus companies also have similar "in-house" products for this.

As for your other question, usually, signatures goes through QA before being released in production, specially if they're new signatures that have been built from scratch. Though from time to time, it is possible that a bad signature gets pushed via an update, and it can result in the deletion of legitimate file (ie: system files). It happened before, it still happens today and will most likely still happen in the future.


Getting Loads of Emails 'linking' my account to Gmail accounts I know nothing about

You can create a random gmail address and then link it to an existing email address for password recovery. You can fill in any address there I believe, and you don't have to be logged into that address, which is not relevant anyway if it's not a gmail address.

So I don't know how you can stop this, but you can contact Google and ask them if they can stop it.


No, because all of them may be potentially broken by Shor’s algorithm. Such attacks may require trillions of operations on millions of physical qubits, but defending against them may still be a good practice.

In such case, symmetric cryptography may be used to solve the problem. Even though Grover’s algorithm affects the wide range of them (such as popular AES and SHA), some algorithms are still secure (GMAC59 and Poly1305) which both are MAC functions.
The field is very new and quantum cryptography field is in active research now.

Google did some research on the field with New Hope project.

Also, PQCRYPTO project has published some general recommendations.


Is it possible for a database to be impenetrable?

Security is complex, it's not just a matter of setting a timer and you'll be sure nobody can access the information in advance.

Even if your code was completely secure, your code runs on a server that might have some vulnerabilities. There might be vulnerabilities or weaknesses in the web server (Apache, Nginx, etc.), in the database software (MySQL, MariaDB, etc.), in the OS (Linux, Windows, etc.) in the machine (Intel, AMD, etc.), in your physical environment (your hosting provider's facilities or wherever you keep your servers, etc.), etc.

So yes, you can write a perfectly secure line of code that does what you want, or you can write a perfectly secure piece of software if you are skilled enough, but you won't have full control over the whole infrastructure and environment. That's why you can never really say you are "impenetrable", unfortunately.


How can I use a VPN to protect my privacy

I'm afraid your question is rather vague, but I'll provide some quick answers for various possible interpretations :

You should try out the Tor Browser Bundle because Tor has grown incredibly user friendly under Mac OS X and usually offers better 'privacy' than VPNs, especially now that Aurora uses HTTPS Everywhere by default.  There are always bandwidth considerations with Tor that might make it unsuitable.  You cannot realistically use bittorrent over Tor in particular, but you indicated web browsing.

If you aren't concerned about privacy, but reside in a country that blocks some website, then you could probably bypass their blocking by using a DNS provider outside you country.  I used this for bypassing Turkey's youtube ban in 2009 for example.

If you are only visiting such a country, your employer or university abroad might offer a free VPN service which could be used to bypass their filtering, even if they go beyond DNS filtering.  You'd enjoy some privacy from the local authorities by doing this, but not from your employer or university.

If you are a resident of a country who's filtering goes beyond DNS, there are various public service VPNs offered by humanitarian organizations like Telecomix (starting point).  There are also various commercial VPN providers if you aren't eligible for humanitarian ones (previously).

There is a delicate question about exactly when any VPN solutions offer enough privacy, but again HTTPS Everywhere improves that situation significantly.  In fact, you should also check if HTTPS Everywhere solves your problem completely all by itself.


Asynchonous Linear Feedback Shift Register : test vectors

The pedagogical A5/1 implementation (which is the only publicly known "reference" on A5/1) contains a single test vector, which the code actually tests when executed (see the test() function).

A LFSR is a structure which produces a sequence of bits from on internal state; at each "clock", a single bit is output, and the internal state is correspondingly updated. An "asynchronous" LFSR is a LFSR which you do not always clock, based on some externally specified arbitrary rule. Being asynchronous is not a property of the LFSR itself, but of how it is invoked. From the point of view of the LFSR, nothing is changed: when a "clock" occurs, one bit is produced and the internal state is updated. Consequently, you will not find test vectors for "a lone asynchronous LFSR" because there is no such thing as a LFSR being asynchronous by itself: asynchronicity stems from an extra piece which controls whether the LFSR shall be clocked or not. You may find test vectors for some algorithms which use one or several LFSR in an asynchronous fashion, e.g. A5/1.


Any practical brute-force algorithm will take into account the method a password was generated with.

If a password was randomly generated. You should assume brute-force algorithm also to be truly random. You don't know what it is, you can't claim one password is faster to find than the other, you can only tell that on average passwords would be discovered by checking half of the available pool.
In case of a password known to be generated using a random number generator with a vulnerability (some numbers more likely, some impossible), an attacker will modify the brute-force algorithm accordingly.
If it is known that passwords are human-selected (a type of weakness in the generating algorithm), an attacker will use methods applicable for such weakness including: common words, substitutions, repetitions, inclinations, order reversal, known methods, tips, tricks, padding, etc.

It's a human mind vs human mind contest. Sequential checking is statistically least effective and drawing conclusions about a given password strength based on the assumption that an opponent will use the least effective method is a fallacy.

To attack a vulnerability of human-generated password, one might use sociology (some passwords methods seem cooler than the other in respective population). Another attacker might use statistics (take millions of leaked password, analyse, apply). Yet another might consider mechanics (keys and key combinations easier to type on a certain device would be tested first).

In an example of a 4-digit number, I would start guessing with 1999, go down to 1900 before testing 2000 - 2016. Definitely I would check 9978 long before 6853 (really inconvenient to type on a PC keyboard) and 5683 (well known "love") long before the two. Someone informed might use more effective method (yes this is an exampleーthe one used in the questionーplease use it to draw a general conclusion, not to dispute the example).


How to detect self destructing emails? How to prevent from self destruction?

It is not possible to create a digital communication that will self-destruct after a certain amount of time (or upon sender's command).  This because of the nature of the message, which once reaches the recipient' machine can be copied at will.  This applies to email as well as instant messages.

Therefore any service promising you messages that self-destruct after some time (e.g. Snapchat) simply do not work.

The golden rule to remember in digital communications is that once you send a message, you have no control over it.

> any way to prevent it from self destruction?

Simply copy the message text, with full headers, and paste it into another window. (Or forward the message to another email address you control. Or start a reply quoting the original message, and save the draft. I don't know how this Gmail extension works, but if it allows this, it's dumber than I thought.)


How to prevent unintended REST API usage?

Generating an API-Token without the user knowing is absolutely not uncommon. I do this all the time and this is not a problem itself. But sending the data unencrypted is a problem. If this is a allegation given by your professor you can't do anything about it but if you just don't want to use it because of the given reason of performence I have to dissagree with you!

Using https is nothing that really slows down a mobile device that much. Many people use https all the time on their mobile phones and don't even notice that encryption is used because it's not such a big differnce in time needed.
If you really need a fast performence you can finetune the https options of your webserver. The performance intensive part is the initial handshake which includes asymmetric encryption that is used to exchange the masterkey. The masterkey is the symmetric key that is used for that session. You can set the livefime of the masterkey to a higher then default value on the serverside to avoid the performance intensive part of following ssl connections.


This is not encryption that you need. Well, you might need it too, but that won't do the whole job.

Encryption is for confidentiality: you encrypt the token if you don't want the client to learn the token contents, i.e. his permissions. Maybe you indeed want to hide that information from the client, but that's a secondary concern. The primary security characteristic that you wish to achieve is integrity: you don't want clients to be able to produce fake tokens and be granted entry. As a general rule, encryption does not provide integrity; for that you need a MAC, or a digital signature. Encryption may, as a by-product, make data alteration a bit harder, but certainly not impossible.

Digital signatures are more generic, but heavier (higher size and CPU overhead). What digital signatures provide is the following: whoever verifies the signature needs not be able to generate other signatures; the verification and generation powers are disjoint. With a MAC, the same key is used to produce the MAC and to verify it, so the two powers are equivalent. In your case, the exta genericity of signatures may be unnecessary, because both servers are yours, so you can probably arrange for a shared secret key between both servers. However, you might want to use a signature so that an attacker who obtains a read-only glimpse of the data server (e.g. through an old discarded hard disk) does not obtain enough information to be able to fake tokens, and thus obtain all write accesses for all possible users in your system.

If you follow the simple road of a shared key, and you want both encryption and MAC, then you are encouraged to use an "encryption mode" which provides both, because decades of research have come to the conclusion that mixing encryption and MAC together is a complex endeavour, prone to catastrophic silent failures. So use GCM or EAX.

If you want signatures and encryption, then again this is not a light job. An extra complication is that the power to decrypt must be on the data server side, while signature generation will be on the info server. In this model, both servers would have their own key pair. The smart thing to do would be to use an existing format and library which handles the tricky points. I suggest OpenPGP; it is a well-studied format, and there are open-source implementations available (e.g. GnuPG, which has bindings in many frameworks).

Regardless of the model and implementation, absence of direct communication between your two servers necessarily gives some extra power to the client: an evil client may decide to send the token, or not, or send another token. Replay attacks are an illustration: the client may want to send an old token value, thus allowing him entry with privileges which have since then been revoked.

One method to block replay attacks is to embed in the token an expiry date (under the protection of the MAC or signature, of course: evil clients would love to be able to modify that date). This works, but implies an inherent latency: if you decide, on the info server side, to revoke the privileges of a given user, then the said user can still use his current token until its expiration. This can lead to uncomfortable situations: emergency stop buttons should work immediately, not "within 15 minutes".

You may want to separate authentication from authorisation. Authentication is about making sure of the identity of the client; authorisation is about deciding what a given client should be allowed to do. The login+password procedure is authentication. If the bulk of the "high traffic load" comes from the password processing (e.g. because you hash password with a good password hashing function, as you should), then you might want to offload authentication on the "info server", while keeping authorisation on the "data server". In that model, the token will contain "this is Bob", instead of "the holder of this token is allowed to read data elements 1 and 2".

With such a setup, you still have an immediate, no-latency method to block indelicate users. An evil user is still himself, so his authentication token can remain valid for a long time; and if a user's password is stolen and you notice it (almost always asynchronously), you still have the option to block that user on the data server until the crisis is resolved.


Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

OpenID is a protocol for authentication while OAuth is for authorization. Authentication is about making sure that the guy you are talking to is indeed who he claims to be. Authorization is about deciding what that guy should be allowed to do.

In OpenID, authentication is delegated: server A wants to authenticate user U, but U's credentials (e.g. U's name and password) are sent to another server, B, that A trusts (at least, trusts for authenticating users). Indeed, server B makes sure that U is indeed U, and then tells to A: "ok, that's the genuine U".

In OAuth, authorization is delegated: entity A obtains from entity B an "access right" which A can show to server S to be granted access; B can thus deliver temporary, specific access keys to A without giving them too much power. You can imagine an OAuth server as the key master in a big hotel; he gives to employees keys which open the doors of the rooms that they are supposed to enter, but each key is limited (it does not give access to all rooms); furthermore, the keys self-destruct after a few hours.

To some extent, authorization can be abused into some pseudo-authentication, on the basis that if entity A obtains from B an access key through OAuth, and shows it to server S, then server S may infer that B authenticated A before granting the access key. So some people use OAuth where they should be using OpenID. This schema may or may not be enlightening; but I think this pseudo-authentication is more confusing than anything. OpenID Connect does just that: it abuses OAuth into an authentication protocol. In the hotel analogy: if I encounter a purported employee and that person shows me that he has a key which opens my room, then I suppose that this is a true employee, on the basis that the key master would not have given him a key which opens my room if he was not.


CSRF over post request without redirection?

Normally a post based CSRF exploit has a line of javascript: document.getElementById("csrf_form").submit() to submit the form without user interaction.  CSRF exploits (and many XSS exploits) are normally loaded within an invisible iframe so that the user has no idea that the browser made the request.


Making website queries and return a large amount of data, can it be exploited for DOS attack?

The fact alone that a site returns large amount of data does not mean a DOS. Many sites do this, like all the download and video portals. Don't confuse this with amplification attacks just because a small question leads to a large response. Amplification attacks are about directing this large response to some victim, which is not possible here, i.e. the original client has to read all the data.
This does not mean that there can be no DOS attack here. Maybe it is possible to use the arguments to cause complex queries against the database which causes a slow down of other clients. Maybe the application retrieves all results in memory first and one might cause memory exhaustion this way. Maybe maybe maybe ... The given information are not sufficient to decide if these things actually happen or not.


PCI DSS PenetrationTesting Requirement 11.3.4

§11.3.4 is specifically aimed at organizations that are using segmentation to limit their PCI scope.  When you say:

  So the CDE is essentially the entire company as the card machine
  connects to the internet through the broadband router.

It sounds like you're not in this category.  If the card machine is on the same flat network as all your other internal company machines, then yes, they're all in scope.  If that is the case, then §11.3.4 doesn't apply to you - here's the full text with emphasis on the parts that distinguish from what you're doing:

  11.3.4 If segmentation is used to isolate the CDE from other networks, perform penetration tests at least annually and after any changes to
  segmentation controls/methods to verify that the segmentation methods
  are operational and effective, and isolate all out-of-scope systems
  from systems in the CDE.

You're not using segmentation to isolate, so you don't need to verify you're doing so effectively.  You don't have out-of-scope systems isolated from the CDE.

So you still need to have a pen test of everything per §11.3.2 - it just doesn't need to verify your (non-existent) segmentation.


Can javascript damage data and hardware?

Modern CPUs are designed to prevent damage due to overheating. They have overheating protection that operates independently of OS or BIOS. So, it is unlikely that executing JavaScript can damage your hardware.

As to potential impact on your data, modern browsers are designed to execute JavaScript in a limited environment that is meant to prevent abuse of JavaScript to harm or steal your data.

Even though that is the intent, from time to time vulnerabilities in browsers are found that might allow attackers to affect your browser in some way - for example, crash it by tricking you into visiting a Web site that they control.

Your best protections against it:

Keep your OS up to date
Keep your browser up to date
Use a browser extension that allows execution of JavaScript from trusted domains only (Firefox, Chrome)


I interpret your question as "By setting my browser to accept third party cookies, am I making myself more vulnerable to a CSRF attack?"

The answer is no.  A CSRF attack, also known as "session riding," involves leveraging a cookie that already exists, e.g. a session cookie for a site that you are logged into.  It does not involve creating new cookies; in fact, the attacker in a CSRF scenario has no idea what the cookie value is (which is why he must ride on someone else's cookie), and therefore has no means of setting one.

The main risk with third party cookies has to do with privacy.  The ability for a site to set a third party cookie means that the first party can tell a third party where you have visited-- for example, Amazon can tell a marketing aggregator that you have browsed a specific product, and that aggregator can then cause ads for that product to appear on Facebook or other sites.  This has considerable "creepiness" factor, although there is no actual communication between Amazon and Facebook, and no actual information is being stolen by a third party that wasn't invited to do so by one of the first parties.


VPN with client certificate via managed PKI - where did private key come from?

I am taking a slight guess, however, I suspect that in browser is using generateCRMFRequest and importUserCertificate in combination. An overview of the process is given by the deprecated Javascript_crypto documentation for Firefox.

Similar things can be achieved with Internet Explorer. I haven't looked but I imagine Safari has some level of support too.

These are entirely non-standard extensions, and according to this post on the CA/Browser forum, not the future.

The key is generated locally, however, it is hard to tell whether or not the key is also sent to the CA for "archival" as in generateCRMFRequest. Since the javascript has access to the generated key, it could conceivably send it over the internet.

Final bit of info, is there a generic tool to do this in Linux? Not to my knowledge. You can certainly go through the process of:

openssl genrsa ... -out private.key
openssl req -new ... -inkey private.key -out certplease.csr

sending certplease.csr to the CA. From them you would get back a PKCS#7 certificate signed by them (and possibly other certificates in the chain, in case they are needed).

However, I don't believe there is a standard user-based private key store in Linux - rather, each desktop environment has a slightly different one.


In Windows vista and above, the OS allows change to specific MAC addresses only, which are, the addresses starting with 2A. However, as far as I know, there is no such limitation in Linux. I suggest you try to spoof your MAC again in windows, this time choose an address starting with 2A and see if it works this time.

EDIT:
It doesn't have to be exactly 2A. See comments below for more details.


Finding out if the name is encrypted and finding the encryption algorithm

Yes, there are several potential ways to find out, what algorithm was used. But lets analyze what is actually happening first.

Unrestricted file uploads are dangerous. Therefore, several different measures are suggested to protect against the different threats, including the following (quoted from the linked OWASP page):

  It is recommended to use an algorithm to determine the filenames. For
  instance, a filename can be a MD5 hash of the name of file plus the
  date of the day.

This is very likely what is happening here, except that it isn't simply an MD5 hash. There are different ways to find out, which algorithms is used:

Consult the manual. If you can find out, which software runs this part of the website, chances are, that they actually describe this mechanism in the docs. Easy as that.
Check the source code. I'm still assuming you know which software runs this part of the website. Further I'm assuming it is an open source project. In this case you can download the source code and check directly, which functionality is used.
Reversing the algorithm. In case the website is a black box for you, you can try to analyze the algorithm per hand. I did some quick manual checks and it looks like a base64 encoded value with a length of 64 bits (0111111110001101001111000010100001010111000101000110111111101001). This could be the result of a hash function but also something highly proprietary. As a next step you can try to compare the values of different uploads to see if the whole sequence changes or just part of it. Without further insights it will most likely be pretty hard to reverse the algorithm, but at least it is an option.

Please note that it can be something totally different like a random unique ID that points to a blob in a database, where the file is stored. With so little information, this is all guesswork.


OCSP responder servers and malicious site blocking

The browser sends a query to an OCSP server to verify the current validity of it's ssl/tls certificate.

Yes, with OCSP the OCSP could figure out which site the user visits. It cannot figure out which URL but it can determine the certificate the browser tries to access and thus which site. OCSP requests are not done for each HTTPS request to the same site but the response is cached for some time. Some server periodically get the OCSP response from the OCSP responder and send it together with the certificate (OCSP stapling). In this case the browser does not need to query the OCSP responder itself which is a good thing for privacy and also for performance. Apart from that the Chrome browser does not make use of OCSP anymore but instead has there own curated list of revoked certificates. Not everybody agrees that this is really the better way.

  It also queries a service to check if the website is malicious ("block reported attack sites" on firefox)

Initial versions of this feature (Google Safebrowsing) checked each site by asking a central server but this was long ago. Today a local database is updated regularly and checks are done offline against this database. Only if this offline check indicates that the site might be malicious it will go online and verify this with the central server. Thus this feature is no longer much invasion of privacy.

But there several firewall/antivirus products still behave this way and send unknown URL's to the firewall vendor which then makes another access to analyze the potentially malicious site. Some vendors even go as far as selling these profiles to interested parties like advertisers.


Is it possible to perform one-way OTR MITM?

I ended up asking on the OTR's developer mailing list and here's the response I got:

  On Wed, Apr 08, 2015 at 02:51:14PM +0200, Jacek Wielemborek wrote:

    Hello,

    Here's something that keeps bugging me for a moment. It's a hypothetical
    situation, so please refrain from question like "how did you send the FP
    to your friend?".

    My friend receives my OTR fingerprint over a secure channel (e.g.
    meeting in person), but he doesn't give the fingerprint to me and
    destroys the channel,
    Me and my friend establish a perfectly secure channel that has two
    limitations: my friend can only send messages to me (not the other way)
    and only one bit of information can be transferred.
    We agree that over this channel, he will tell me during a future OTR
    session whether my fingerprint matched what he received from me during
    step 1,
    We go back home, establish an OTR session over the internet, which
    isn't secure yet. My friend verifies my fingerprint based on what we got
    during step 1 and tells me whether it matched over channel from step 2,

    If the fingerprint he sees on the screen matches the thing he got from
    step 1, can I assume that there can be no man in the middle? In other
    words, is it possible to perform a one-way OTR MITM where my friend
    actually sees my real fingerprint, but when he responds, I can't see
    his, but one from the MITM?

    Hopefully I explained this clearly. Cheers,
    Jacek Wielemborek

  Jacek,

  Way back in OTRv1, this was actually possible.  However, the MITM
  wouldn't be able to read, write, or modify the messages; the issue
  was that your buddy would see your key as being the partner in the
  conversation, while you would see the MITM as being your partner in
  the conversation.  (The messages would actually be going to your
  true buddy, though.)

  We upgraded the key exchange protocol in 2005 to address this problem,
  and I do not believe a MITM could pull this off with OTRv2 or OTRv3
  (unless one of the endpoints were compromised, of course).

  [Even better is to exchange a shared secret in your step 1 instead,
  and then use the SMP to mutually authenticate your long-term keys.
  But this requires a secure channel in the secrecy sense, whereas
  your version only requires a secure channel in the authenticity
  sense; the latter is sometimes easier to pull off in practice.]
  --  Ian Goldberg Associate Professor and University Research Chair Cheriton School of Computer Science, University of Waterloo Visiting
  Professor, ESAT/COSIC, KU Leuven


Adding HTTPS API to legacy hardware system that uses short numeric passwords

Your solution sounds good, the vulnerability being as you mentioned the  local storage. Since the long password is "salted" with the short PIN you are still prone to attacks should the long password be known.

A way to avoid that is to use a client TLS certificate which will be presented at the server's request. This has the advantage of not being able to retrieve the stored certificate (without some effort) and the whole certificate security  zoo (notably revocation).


What capabilities does the Kazakhstan root CA have which other "trusted" CA's don't?

Would this be any different regarding capabilities to snoop and modify traffic?

In case of Kazakhstan the government essentially urged their citizen to explicitly install this CA as trust into the browsers. This is similar to how SSL interception in companies is done.
CA installed this explicit way are handled slightly differently from pre-installed CA: any pinning of a domain to a specific certificate or CA is actually ignored with many browsers in this case. This means it would be possible to intercept SSL traffic to google.com, facebook.com even though browsers like Chrome have these domain pinned to specific CA. Such interception would not be possible though if the CA just comes as pre-installed since it this case pinning is enforced.
Note that this is not a difference in the CA certificate itself, but only if it was explicitly added as trusted or if it came pre-installed with the browser/OS.


How to add certificate pinning for a certain domain to my web browser?

HPKP does not address this need.

HPKP is an extension to the HTTP protocol allowing website administrators to provide specific pining information to the browser, allowing:

To check that at least one of the certificate composing the authentication chain of the current HTTPS connection (depending on the platform architecture architecture, the server administrator may choose not to pin the final certificate but an intermediary or the root one instead),
Present an alternative Pin corresponding to backup certificate in case the primary one is lost/leaked/etc, so clients keep the ability to access the website after the certificate has been changed,
Tell the browser if the certificate pining should also be enable for sub-domains or not,
Tell the browser how long the pin is applicable in accordance with potential key migration schedule.

Would an HPKP set improperly, the browser will deny any access to the website without any direct recourse for the user. All the details above are mainly known and controlled by the server administrator, and not the final user, therefore the final user has no way to configure properly an HPKP pin in his browser.

What you may look for, instead, is for the browser to store some information concerning the certificates presented by non HPKP websites, and be able to alert you upon certificate change, up to the user then to check the new certificate and agree to continue if everything seems in order. Such feature already exists, at least on Firefox, but is handled by addons such as Certificate Patrol.


To put it straight and simple, DDOS is is making the server unavailable or denying the service to the users for a particular time.
DRDOS is sending forged requests imitating the target (victim) to millions of computers and making the target flooded by the responses from those computers.

More info on DRDOS
The attacker sends the requests from his server. Using IP address spoofing, the source address is set to that of the targeted victim, which means all the replies will go to (and flood) the target.


Get a known clean version of your site and identify the differences between the known good code the and current (hacked) production code. Study how the changes may have been made and repair.
Update the passwords.
Fix the FTP certificate issue - consider using 2 factor authentication.
Find a way to scan your code for vulnerabilities - peer review or automated analysis.
Enable logging so if this happens again you have log files. If you already have decent logging, look at the files accessed and see if there's injection via the URL.
Consider using a web application firewall.
Tell your legal department, the police, partners, customers if you believe their data to have been stolen or compromised


Using a gmail oath2 token to access web email

You cannot use the oath2 token used by applications for login via the web browser


How do I log all my internet-connections

For tracking what is sent and received, you can use a packet sniffer. I use Wireshark (formerly Ethereal).


Is it possible to have a high confidence that a password is not being reused?

If the user is allowed to pick their own password, then no, it is not possible.  Nothing prevents that user from re-using some other password from other systems you do not control as long as it fits all your password requirements.

If you do not allow a user to pick their own password, but generate a high-entropy password for them then it is possible -- if you pick a random new 80-bit password for them like LDhrcqKYcm its highly unlikely that before generation that password is used on any other systems.  Granted once you give it to the user, there's nothing preventing them from memorizing it and deciding to use it on some other system that doesn't put limits on their password.


Is there a reason why IMEI is stored in EEPROM?

In some countries (I think China is one), regulations require the phone's IMEI to change each time it's repaired.


Multiple people have the same iPhone IP address

They could be using a network carrier which does not assign an unique IP address to each user but instead has only one external IP and uses Network Address Translation to allow multiple users to browse the web with that address. Such providers are quite rare in North America and Europe, but more common in other parts of the world.

There are countries where iPhones are sold exclusively with a plan by a single carrier. In that case all iPhone users from that country would have the same ISP and when that ISP uses NAT, also the same IP address.

In that case, a geoIP database would give you the location of their provider. These databases have very varying accuracy anyway. For my current IP address, all databases I tried return just the city I live in, which has a population of over a million.

Another explanation for multiple users sharing the same IP could be that they are using the same proxy server for anonymity. But having the same mobile phone and also using the same proxy service would be quite a coincidence.

bottom-line: There is a possibility that you are dealing with different people. However, it would be quite a coincidence. When you have other reason to believe that you are dealing with one user with multiple identities, it is quite likely to be the case.


Can a machine running a packet sniffer see what nginx is forwarding on localhost to a Flask app?

If installed on localhost with sufficient permissions, Wireshark can see all your localhost traffic (with some caveats).
That said, a 'packet sniffer' in my understanding refers to something running on a different machine which sniffs packets off the actual network. It's my (perhaps not entirely correct) understanding that packets to/from localhost from/to localhost or to/from 127.0.0.1 from/to 127.0.0.1 do not end up on the network. You may want to read a bit about the loopback interface.


How do these Windows services affect the security of Windows Firewall?

Network List Service

Service name: netprofm

Description: Identifies the networks to which the computer has connected, collects and stores properties for these networks, and notifies applications when these properties change.

Critical for Windows Operation?: No, not at all, but it is managing properties such as TTL on various parameters cache'ed in our PC memory. Simply explained, its use is similar to how we cache a domain name's IP in our memory, and need to update this IP at a TTL interval when it is changed on our DNS server. If the service is disabled they it can cause properties set by other computers to not change or not be managed efficiently, but it is not critical for OS operation.

Network Location Awareness

Service name:NlaSvc

Description: The Network Location Awareness (NlaSvc) service looks for and remembers networks that you have connected to in the past and re-connects to them when they are available.

Critical for Windows Operation?: No, but if another program depends on it for auto-reconnect then it will not be able to if disabled. Its behavior can be compared exactly to that of how we reconnect automatically to known Wifi points. Disabled that doesn't cause a problem unless we're disconnected of the network and then we need to manually connect back in since the service is disabled. It is generally recommended to allow windows to manage service optimization here but if you think this is a problem you will not have then you can disable it.

 IP Sec

Reference Link: http://etutorials.org/Server+Administration/securing+windows+server+2003/Chapter+8.+IP+Security/8.2+How+Does+IPSec+Work/

Advice: Leave this one alone. :P

Credits:

I got this from a a bunch of Maximum articles and one NLA from personal experience. Hope I was of some help. :)


Suspicious visits to one URL from same user-agent but from unique IPs

Based on conversation with OP in the comments following the question, Cloudflare's web application firewall (WAF) may be a solution.  See comments for more information as to why OP feels that this problem needs to be addressed, why this problem may be difficult for him to solve on his own using mod_security, and how Cloudflare's WAF may be a more effective solution.


Q: How to do you decide that a particular key is a weak key?

That depends on the cipher (the algorithm itself). According to Wikipedia:

  In cryptography, a weak key is a key, which, used with a specific cipher, makes the cipher behave in some undesirable way.

  Q: I got some things like in case of WEP , the weak keys are those whose initialization vectors are in the form of ( B + 3,255,x).

WEP uses RC4 which, again according to Wikipedia:

  Unlike a modern stream cipher (such as those in eSTREAM), RC4 does not take a separate nonce alongside the key. This means that if a single long-term key is to be used to securely encrypt multiple streams, the protocol must specify how to combine the nonce and the long-term key to generate the stream key for RC4.

So, unlike most ciphers, the weak keys include the IV. Unfortunately the key schedule of RC4 is weak, the IV of WEP too short and the construction of combining (concatenating) the key and IV too simplistic, leading to an attack.

  Q:and does the condition for weak keys depend on the type of encryption function we use . ex - in wep , finally we are XORing the plaintext and the key sequence to get the ciphertext

Again, it depends on the cipher.

What you describe above is the general construction that a stream cipher uses to encrypt data. There are stream ciphers that have weak keys or are otherwise vulnerable. But there are certainly stream ciphers that do not have weak keys and are considered secure.

The XOR of the key stream with the plaintext is not the issue here.

Other (block) ciphers with weak keys are IDEA, Blowfish. DES is probably the best known cipher with weak keys though:

  Since all the subkeys are identical, and DES is a Feistel network, the encryption function is self-inverting; that is, despite encrypting once giving a secure-looking cipher text, encrypting twice produces the original plaintext.

This means that if an attacker was to send back you the ciphertext as plaintext for you to encrypt (i.e. using you as an encryption oracle) that the attacker would retrieve the plaintext in the special case that weak keys were used.

Needless to say, modern ciphers try to avoid weak keys; each key should be as secure as any other key.


Could John Oliver be (inadvertently?) launching DOS attacks?

Back in the day, this was called the Slashdot effect.  Accidentally DoSing a site through sudden popularity is nothing new.


How does a browser tell the difference between an intermediate cert and an end-entity cert?

There are several "flags" in certificates. one of them is for example "I am a CA" flag, another is the "Maximum Certificate chain length".
This last one limits how long a certificate chain may be.

The certificate tools such as openssl will reject signing a certificate with a certificate that does not have the CA flag.

Browsers will stop validating a chain once a non CA certificate is found.

There is no "I am an intermediate" flag, but that status can be infered by being a CA certificate that is signed by someone else.


Can a Man-in-the-Middle-Attack be achieved by adding a cloudfront distribution origin of a domain not owned by me?

What you describe is basically providing access to a website under a different domain, i.e. a domain you own yourself. This can not only be achieved with Cloudfront but also with running a reverse proxy on any publicly reachable system/VPS you control yourself.
But, you have to somehow trick the victim into visiting your site and not the original site - which is a different domain. If the victim is using a password manager it will not automatically fill in passwords, since these are for a different site. So it is less a traditional MITM attack were the victim still tries to access the original site. It is more a phishing attack, where the victim is tricked into using a different site. Nevertheless, it can be successful.


If I were to diagram your network, it sounds like you want everything inside the home to communicate with each other freely, and to be protected by a border firewall.  Because your ISP gives you a single IP address to serve the whole house, you'll need the firewall to also perform Network Address Translation (NAT), which virtually all home routers do these days.  You need a wireless access point so that your laptops can connect, and you probably want a wired Ethernet cable to connect your mini-server to the router.

This is a simple architecture, and an ordinary home router/firewall should serve you well.

Outside the home, you have wires coming in to an ADSL modem.  The ADSL modem is already providing you a wireless access point.  From this description, it sounds like the modem is already likely providing all the router/firewall/NAT services you need, and you may not have to buy anything else.  That really depends on whether or not you have the admin password and authority to configure your modem, or if your ISP runs it for you.

Assuming you have the authority, all you need to do is learn how to add some "port forwarding" rules to your router, and make a few configuration changes to improve your security.

First, log in to your router.  It will help to download the user manual for it, if it wasn't provided by your ISP.  If you don't know your router's address, view the network settings on your laptop and look for a "default gateway".  It should be a number like 192.168.1.1, 192.168.0.1, or something fairly similar.  Open your browser and navigate to http://192.168.1.1 (or whatever your gateway address is).  You'll be greeted by the logon page.  Type in the admin name and admin password for your router.

You'll probably see a "main setup" page.  There are a few things you should look for here.  First, you'll want to change the default password.  There's no sense in leaving this as a security risk.

Next, you'll need to know the IP address of your mini-server.  If you haven't assigned one already, look for the router's DHCP server settings; then look for a way to reserve a specific IP address for your server.

Next, look for a "Port Forwarding" configuration; it could be under a category named something like "Applications and Gaming".  It will have a table with at least 4 columns:  Internal port, External Port, Protocol, and Internal Address.  This is how you will externally SSH into your mini-server from the internet.  In both the Internal Port and External Port columns, type the number 22 (the SSH port).  For the protocol, select TCP.  And for the Internal Address, type the IP address of your mini-server.

I recommend shutting off UPnP support.  This will prevent any devices from automatically opening port forwarding holes without your knowledge.

Finally, you'll need to know your home IP address so you can SSH in while you're away from home.  Your ISP provides you with an IP address using DHCP, but that's dynamic and can change without warning.  Many companies offer "dynamic DNS" services, some offer free or low cost plans that let you piggyback on one of their assigned names so you can create something like alicelebi.dyndns.org.  Keeping the address up to date requires software running in your network to update their DNS servers (some home routers have this update feature built-in; again check the manual for your ADSL modem.)


Prevent change of document.location, when injecting the document.location JavaScript command

Use hashfragments.

/'.replace(/^.*$/, document.location+"#") leads to document.location='/'.replace(/^.*$/, document.location+"#") which basically takes the current URL, and put a hash fragment after it. It won't reload the page since hashfragments doesn't do so on broswers.

Put whatever you want afterward like a ;alert(1).

Since the original code contains a ' (ie document.location='/'), then don't forget to discard it, using a comment (// or /*), or by leaving your last String value unclosed (ie write var x='My String and let the original ' close the string). Otherwise, it may raise a parse error and Javascript won't be executed at all.


How can I prove that mail sent was NOT caused by the newly deployed DMARC policy?

I run quite busy domains for a year on DMARC p=reject and, after initial pains, things run now more or less unattended.

DMARC aggregate reports (RUA) are not hypothetical, surprisingly many domains does send them, and I don't mean only Google/Microsoft/Yahoo.

I haven't seen any forensic report RUF sent to me yet when there was an error (and RUA indicated the cause was DMARC).

Don't worry too much about rejections where the recipient only checked SPF or only checked DKIM, I don't see this in practice.

You absolutely need DKIM, because many people forward their mail and this immediately fails SPF check (for example they publish x@example.com, but the mail lands at name.surname@gmail.com).

Also, DKIM header has its own diagnostics flag (something like RUF/forensics) and linux opendkim installations often do send useful diagnostic messages.


Are all vulnerabilities security related?

This is one of those "it depends" situations.  Systems are vulnerable to data loss due to power failure or disk drive failure or fire or water damage, for example, and so those could be considered "vulnerabilities" that are not "security related" because they do not result in unauthorized access to data or services or equipment and are not triggered on purpose by someone seeking to cause a denial of service. Then again, if the equipment in question is, say, operating a nuclear power plant, then equipment failure becomes a security problem of a different sort.  So it really depends on what you define as a vulnerability and what you define as security.

I think of security vulnerabilities as things that would allow someone to cause unintended operation of a system (which includes unauthorized access or denial of service).  I think of vulnerabilities in general as anything which would interfere with the proper operation of a service.  So I would say "no", not all vulnerabilities are security related.


What's the rationale behind Ctrl-Alt-Del for login

This combination is called a Secure attention key. The Windows kernel is "wired" to notify Winlogon and nobody else about this combination. In this way, when you press Ctrl+Alt+Del, you can be sure† that you're typing your password in the real login form and not some other fake process trying to steal your password. For example, an application which looks exactly like the windows login.

In Linux, there's a loosely-defined equivalent which is Ctrl+Alt+Pause. However, it doesn't exactly do the same thing. It kills everything except where you're trying to input your password. So far, there's no actual equivalent that would work when running X.

† This implies a trust in the integrity of the system itself, it's still possible to patch the kernel and override this behaviour for other purposes (malicious or completely legitimate)


Yes, this is possible.  When the www or root domain are accessed, the users will see the green bar in the browser, since those sites will be returning the EV certificate.   When a user loads a page from another sub-domain, it will be served over HTTPS, but without the green bar, since those sites will be using the wildcard non-EV certificate.

If the resources are mixed, I.E. the page is loaded from a domain using the EV certificate and other resources (javascript, images, etc.) are loaded from sub-domains, the green bar will be shown because it is the certificate for the page that determines the UX, not the certificate used for secondary resources as I've also detailed in this answer.


Client certificates are used to authenticate the clients, so they should have nothing to do with your server certificate.

Step 1
Client certificates are signed by a CA. If you tell your web app (your server) to trust that CA, then your server will accept the client certificate. Simple as that. Depending on your setup, this is easy to do. For example, for Apache, you can add the following in httpd.conf:

SSLVerifyClient require
SSLVerifyDepth 1
SSLCACertificateFile conf/ssl.crt/ca.crt

Where the 'SSLCaCertificateFile' contains the path to the certificate of the CA which was used to sign the client certificates.

Step 2
Step 2 is then to make sure the client is known (but this should be irrelevant for your question). This is, the certificate is trusted now (step 1), now you have to extract the client name (which is present in the certificate), and make sure this client can be granted access.


How to identify this hashed text and if it encrypted using a key?

For the second one, I think you mean 152 characters, not 152 bytes.  The character set looks like base64, and the equals symbols at the end are another tell-tale sign that this is probably base64, as equals symbols are often used for padding in base64.
In base64, each set of 4 characters represents 3 bytes.  You have 150 characters of actual information (again, the last two equals symbols are padding).  This equates to 112.5 bytes of data ( (150/4) * 3).  That equates to 900 bits of data (8*112.5).
That's most likely not a hash, as no standard hashing algorithm produces a 900-bit result.  It's most likely not the result of AES encryption either, as AES produces blocks of 128 bits, and 900 is not a multiple of 128.


Execute a PHP function that returns an array from an XSL file

I am also a noob when it comes to XSL. To be honest, I had no idea it could be this powerful... and dangerous. But I will have a shot at this anyway.
I don't know if it is possible to get the output from a function returning an array. Perhaps you can nest function calls somehow? But given my lack of knowledge about XSL I can't tell you how. So lets work around the whole problem instead. Is there a way to get the directory listing without having to deal with arrays at all?
Enters the PHP manual. The two following functions look useful:

resource opendir ( string $path [, resource $context ] )
Opens up a directory handle to be used in subsequent closedir(), readdir(), and rewinddir() calls.

string readdir ([ resource $dir_handle ] )
Returns the name of the next entry in the directory. The entries are returned in the order in which they are stored by the filesystem. [...] If the directory handle is not specified, the last link opened by opendir() is assumed.

So you will not be able to get the resource from opendir, but since readdir kindly assumes you want to read from the last resource it might work anyway. I suggest an attack file with something like this:
<xsl:value-of select="php:function('opendir','/some/where/')"/>
<xsl:value-of select="php:function('readdir')"/>
<xsl:value-of select="php:function('readdir')"/>
<xsl:value-of select="php:function('readdir')"/>
...

Edit: Apparently there is an undocumentet php:functionString() that "will automatically convert output to a string", according to a comment on php.net. Not sure if it helps, but worth a try.


Is it appropriate to block a sender's email address

Blocking the senders e-mail address is unlikely to be an effective measure as spammers/malicious actors will commonly change the address they use on a regular basis.  That said it's worth noting in this case that a quick search for do_not_reply@apple.co.uk shows the only indexed instances of this address being spam related, so it doesn't appear to be one that Apple use.

Generally the best response for individuals to these mails is to ignore them and do not open any attachments or follow any links that they contain.

At a network or company level the best approach is likely to make use of an anti-spam service which will attempt to idenify and block this kind of message.  These systems will cut down on the volumes of spam that get through, although they are not perfect and there is always the risk of false-positives which could lead to legitimate mail being consigned to the spam folder of your mail system.


How can one execute code upon entry of folder in Windows?

Yes this is possible. One way to do this would be to create a shared folder and share it with a mangled version of your own computers localhost. When cmd.exe tries to list the files in the folder, it will "look them up" over the mangled localhost and you should be able to intercept that network trafic. I don't think this would be possible without Administrator permissions however.


The security of this scheme largely depends on how good your key generation is. If an attacker observes two key exchanges, he may calculate the xor of the two unobfuscated keys:

The values ka and kb are two unobfuscated keys. kA and kB are the associated obfuscated keys. o is the static obfuscation key.

kA = ka ^ o
kB = kb ^ o
kA ^ kB = ka ^ o ^ kb ^ o

The two instances of o cancel out, giving us ka ^ kb. This works with any two chosen session keys.

This might allow an attacker to leverage weaknesses in your random number generator, by eliminating internal states that cannot produce consecutive outputs that exhibit such a pattern.

Of course, if an attacker ever discovers the unobfuscated value of a key, through any means at all, then he may simply xor the obfuscated key with the unobfuscated key to find o, and therefore break all future communications.

In reality, this is a bad way to do it, because an attacker is likely to have access to your application. By simply reverse engineering your binary, the attacker can discover this hard-coded key and break all communications. You're relying on obscurity for your security, which goes against Kerckhoff's Principle - i.e. "the enemy knows the system".

I did something similar recently with an application that took almost exactly the same route, and it only took me an hour to completely break their crypto and reverse engineer their internal packet format. From there I wrote up a Python script that automatically decrypts the entire session from a pcap packet capture file.

If you're looking for proper end-to-end communications security, go for something like SSL. Most languages have libraries for implementing it, so it shouldn't be too difficult.

If you don't got for SSL, you're going to need to handle the following:

Cryptographic strength key generation.
Key exchange (e.g. Diffie-Hellman or hard-coded RSA public key)
3DES encryption and decryption with an appropriate mode of operation, and IV exchange.
Authentication and integrity checking, e.g. via HMAC.
Defence against timing attacks and other side-channel attacks.
Proper error handling.


URL changes to *.compute-1.amazonaws.com/ when entering website, do I have a problem?

Nah, it's fine on your end— just an HTTP redirect. See below...

curl -v http://store.curiousinventor.com/guides/PS2
*   Trying 50.16.216.49...
* TCP_NODELAY set
* Connected to store.curiousinventor.com (50.16.216.49) port 80 (#0)
> GET /guides/PS2 HTTP/1.1
> Host: store.curiousinventor.com
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
< Date: Sat, 14 Apr 2018 20:18:12 GMT
< Server: Apache
< X-Powered-By: PHP/5.5.27
< X-Frame-Options: SAMEORIGIN
< Location: http://ec2-50-16-216-49.compute-1.amazonaws.com:80/
< Content-Length: 0
< Content-Type: text/html; charset=UTF-8
<
* Connection #0 to host store.curiousinventor.com left intact

EDIT: That said, it doesn’t seem like that has anything to do with what you were looking for, so their website may have been compromised.


Organizing scheduled vulnerability scans

Nessus and other vulnerability scans will only scan using applicable packages, dependent on what ports and applications are found per host during discovery. Nessus isn't going to run a web vulnerability scan against a db process, nor will it run a windows scan against a linux server, so tailoring your scans to specific DBs and software packages is a waste of your time.

Also, one of the benefits of running vulnerability scanners on your systems is to discover things that you don't know are there. If you limit a scan to what should be there as opposed to what could be there you may miss all sorts of important things. If you scan a db server with only db related packages you could miss the gaming server that has been installed on it against policy for example.

So your best policy would be to scan everything, using every non-disruptive test. Limiting your scans wastes your time, and may make you miss something important.


If am using Stripe am I SAQ A-EP in PCI V3

That is correct. if you are using the Stripe or similar processors that utilize a redirect method to post payment data to the processor you will use the SAQ A-EP. if you use an iframe or payment is 100% hosted by a compliant service provider then you can fill out SAQ A. Here is a FAQ from the PCI council that explains things in a little more detail:

PCI SSC FAQ - iframes and redirects


What additional difficulties are present in performing ARP poisoning on a secure wireless network (WEP, WPA) vs. an insecure one?

WEP provides essentially no security whatsoever; it is at most a speed-bump.  Man-in-the-middle attacks are totally possible.

WPA does not provide security against an authorized user who knows the password.  In that situation, man-in-the-middle attacks are possible.

As far as the constantly changing elements go, it is no harder for an attacker to deal with them than for a legitimate user of the network to deal with them -- which is to say, not very hard at all.  In other words, this is not a barrier to a serious attacker.


How to save one password for all users without hashing?

My understanding of your situation:

Site A is internal and each user has their own account.
Site B is external where the institution has one user-account that everybody shares (I'm picturing access to academic journals or something).
You want to make a plugin for Site A that pulls content from Site B into Site A -- and therefore needs to automatically log into Site B.

Correct?

Naively I see a number of options:

Ask the user to type in Site B's password every time you need it, that way you're not storing it anywhere.
Ask the user to type in Site B's password once and store it in their local browser cache. This is less secure in exchange for more convenience.
The admin embed the username / password to Site B in the source code for the plugin. This is the highest convenience, but the least secure because someone could reverse-engineer the password out of the plugin (how hard this is depends on which language the plugin is in, whether the plugin runs on a server or in the browser, etc).

Basically, either you store the credentials in the plugin, or you don't.

A more complex option:

How does Site B's authentication mechanism work? I assume when you provide the correct username / password, Site B returns you some sort of authentication token? Is it possible to stand up a small server that holds the credentials, logs in for you, and returns you the token?

Like this:

Browser plugin --log-me-in-plz--> your server --[username/pass]--> Site B

               <-- auth-token--                <--auth-token--

To be honest, it sounds like your real issue here is that everyone shares one username/password. You are trying to secure something that's weak to begin with.

Have you talked to the people who run Site B? Is this the way they intend you to use their site? Do they have any other auth mechanisms besides this shared username/password? Can you get each user their own account?

Your situation seems a bit like being asked to install security systems in a mansion, but being told by the owner that they never lock the doors and they don't want to have to type in any security codes. The correct answer is to go back to the customer and say "I can't secure this, anything I do will be security theatre at best".

Given this, maybe your organization will be ok with option 3 above and just accept that if someone is determined enough, they can get the password out of the script.


Use GnuPG to verify if specified user signed file

You could, perhaps, use a keyring with only that specific key in it, and specify the keyring on the command line (using --no-default-keyring --keyring <file> )

Note that unless you have signed the key used to create the signature, the user name in GnuPG's output is not a good thing to check. Anybody can generate a valid key with a certain user name. Check the key's fingerprint instead.


This sounds like a browser redirect virus.

Does the same thing happen when you use a different browser?  If no, then there is something in Chrome.  I would start removing or disabling your extensions one by one STARTING WITH, God help us all, HOLA, until the problem goes away.

If other browsers have the same problem, then the issue is not with an extension or Chrome, but with something in your OS.

I suggest you use an intercepting proxy (Like Burp or Zap) to intercept the requests so you can have more information.  At least it will reveal the identity of "some website with tracking in the name".  This might help identify the virus and lead you to steps to remove it.

If those steps do not resolve the issue, I would also try Clam AV on Elementary OS.  Instructions are here.

Since you say it happens when testing your locally hosted web app (I assume this means addresses like http://localhost/foo are being redirected too?), it is probably like you said, local to your machine.  There is a chance that what ever is causing this has made changes to your hosts file to even redirect localhost.  So, if you open the file /etc/hosts, what do you see in there?