Because cache snooping is enabled by a properly operating caching DNS server, there's no way for the DNS server to thwart it without breaking proper caching behavior.  For example, you could make a DNS server hand out all responses with a synthetic TTL, but then the use case of having individual TTL for different records is being overridden.

It is possible to poison the cache as a defensive measure.  For example, let's say the attacker is using the cache to identify anti-virus software in use.  If the defender has a program which regularly queries the DNS records used by various anti-virus software that isn't in use, then the attacker will be get indicators for multiple anti-virus packages, with most of them being false.

I wrote a program to do this a couple years ago called dnSense.


What's the point of a DMZ if it has access to a DB inside inner network?

The main aspects to consider in this case are defense-in-depth and security by design. As you rightly point out, adding layers after layers of firewalls and port forwards does increase complexity but does not defend against attacks on its own.

A successful attack is a function of time and effort, therefore anything can be compromised. Having this in mind requires you to do your threat assessment and consider the impact and likelihood of compromise of every network and every system as well as the collateral damage that arises from it.

Using your example, you use a DMZ to contain lateral movement of attackers in case of a breach. Critically, lateral movement will happen using any network and any protocol that happens to be exploitable or compromisable by leveraging previous attacks. Therefore it makes sense to minimise the scope of connectivity of a server in a DMZ -- this would be your web server.  Your port forwards on the perimeter firewall ensure that the only way to access the web servers from the Internet is via the web server ports, so again you are limiting attack surface from the Internet. In addition, you will want to ensure that the server is securely configured and that no other services are exposed in addition to those that absolutely must be exposed, and if you can, limit them using a host based firewalls to specific IP addresses further from within your network to ensure it is more difficult to be attacked from within the DMZ.

Should the web server require connectivity to a database, which it often does, then rightly so you need it to be able to contact that port. This is not a security weakness, but an operational requirement. You can either have the server on the same DMZ as the web server or in a different one. The latter is more effort but arguable better security. Again considering the database server, you'll want to harden its configuration as much as possible including using host based firewalling. The database should also be configured securely with the web server using multiple accounts with strong passwords (as opposed to using a dba account with a weak password because "it's internal"), etc.

With all this in place, what you end up with is far from being an architecture that is impossible to break into, but it is one that you have made as difficult as you possibly can to attack, compromise and move laterally from.

To compromise the database server (provided the attacker hasn't done this via the database connection on the web server), an attacker would need to somehow compromise the web server first, then proceed to attack the database. The database server needs to be weak enough (or vulnerable) to be compromised too.


SecureString how to compare against another SecureString that is safe against Timing Attacks?

I wrote a blog post about this. I came up with two solutions:

Using either Marshal.ReadByte or unsafe pointer code you can loop
over the SecureString, just as in this
answer. However, don't bail early if one of the characters is different; this is not time-safe. Instead, XOR all characters and return the result. If all characters are equal, all XORs will return 0.
Use P/Invoke and the Windows Crypto API to create a hash of the two strings, and compare those normally. Bonus points for using a random secret key to create the hash, so that the attacker can't know the hash that it being compared.

Note that this is all very advanced and protects against unlikely threats while introducing a lot of complexity. For most cases I would avoid SecureStrings.


The php function gethostbynamel is a wrapper over the native OS gethostbyname function.
The implementation can be seen here.

So the same vulnerabilities that apply to the gethostbyname syscall will apply to your code.
I don't see any existing gethostbyname vulnerabilities that would bother me.

So basically as long as you are validating the hostnames accurately, you should be fine.
See this SO answer and this text for help on regex.

Amongst the two options you posted, they don't make any difference so far as the security implications are concerned. gethostbyname is a network call, so there is a non-negligible time associated with it. This can be one of the differentiators why you'd choose to use one over the other.


UPS my choice -- How can I access my public records?

These kinds of things are a little odd from a security stand point, but they do add a slight bit of value if they are not the exclusive mechanism used.  The idea is that they should be giving a limited time to respond to the question and pull from a broad enough set of information that it would be difficult for someone other than you to have the information all at hand when it is needed.  It certainly can be fooled and shouldn't be relied on as the only method of verifying identity, but it's at least a little harder than simply saying "yes, I'm me."


There are a few benefits of using RSA wrapping / unwrapping:

the key may be kept in a secure location during wrapping / unwrapping, e.g. in a HSM the data to encrypt is supplied from the host PC, but a the key to wrap as well as the unwrapped key may be kept within a hardware module or otherwise protected location (the application gets passed a handle instead of the key value in unprotected / user memory);
a specialized wrapping mechanisms may be used to provide additional security over standard modes of operation such as a block cipher in CBC mode;
for development: the returned key may already be cast to the correct type, alleviating the need for the developer / application to perform the marshaling to/from binary.

It seems Microsoft Azure is able to use FIPS validated HSM's, so above would all good reasons to use an explicit wrap/unwrap method. Even if no HSM is used at the time, using an explicit wrap/unwrap would at least prepare you for it.


Connect to HTTPS through untrusted proxy

Some thoughts...

Make sure that the site you got is the site you requested. (and
hope the characters in the url are the same, not just look the same.)
Keep an eye out for the site reverting to http at some point, leaking information.

These are just some ideas to help those who are not security oriented. I'm still interested in an expert's answer, of course.


Why can passwords be used to encrypt data, but are less strong for authentication?

The simple answer is that it's not less strong. Encryption that's solely password-based is just as (in)secure as a equivalently-architected password-based authentication system.


Set Cookie in XHR response : How different browsers handle this?

I'm not sure if browsershots will handle this - since it seems to be mainly focused on looks, rather than behaviour.

An XHR response, if it issues a "Set-Cookie" header, it will be included in further requests.  From http://www.w3.org/TR/XMLHttpRequest:

 If the user agent supports HTTP State Management it should persist, discard
 and send cookies (as received in the Set-Cookie response header, and sent in
 the Cookie header) as applicable.

I just tested in FF13, and XHR requests set cookie values.


A reading of the manpage and a quick skim of the source to confirm indicates that (among other things) ecryptfs-setup-private creates a directory with encrypted data at ~/.Private, creates a mountpoint for decrypted data at ~/Private, and encrypts the encryption key with the login passphrase at ~/.ecryptfs/wrapped-passphrase. These paths are not configurable.

What you've done is create an ecryptfs directory at ~/.Private with a wrapped passphrase, then created a separate ecryptfs directory at ~/test using your passphrase directly as the key (bad idea). If you want to test that wrapped passphrases work properly you will need to use the ~/Private directory instead of trying to create your own.


Generally speaking, if I have an application that I know doesn't need the entire UTF8, UTF16 or UTF32 character set, I'll limit it to just what is needed.

That being said, I'd whitelist certain character sets within an encoding.  Special control characters would be either ignored or replaced using a regex or similar.

This concept is portable to other platforms and technologies.


Hash the signing key of an authentication token in database

On your first point, there are some potential downsides and points to using basic authentication over SSL that you might want to consider.

Where you're using basic auth, your token based solution might not really be needed as once a browser has sent the basic auth credentials in the first place they'll send them again with every request to that realm, so you could just check them again and not bother about the token :)
Basic auth sends the user credentials in encoded format over the link, anyone who can see the data in transit can get the creds. Now SSL will of course provide some protection but it still carries a bit of risk, in some scenarios. You might want to look at digest authentication if you persue this authentication scheme
By itself basic auth doesn't include some authentication protections which could leave your application open to attack. For example there's no account lockout, no password quality requirement, no logout functionality, no password change functionality and no protection against the one user having multiple simultaneous logins.


Spoof texting a regiatered number to yourself and relying....having a conversation

Yes, this is completely possible; your friend most likely set up a bot to reply to her when she said certain things, in order to simulate a conversation. Tell your friend nice prank :D


Does Verizon Wireless LTE network have intrusion prevention capabilities?

If you're talking about intrusion prevention in general, the answer has little to do with the wireless part of the network. Trying to "guess the password for voicemail" doesn't even require an antenna, on either end. Dig?

In any case, there is all kinds of security in these networks. Understanding the wireless standards, the PSTN, service policies, relevant laws, regulations, industry practices, and common sense will tell you much about what the big providers are doing for security. However if you want to actually compare the security practices and features of different operators' networks, there are basically only 2 ways to get that depth of information:

Get a job doing security at the network operator
Attempt to break their security yourself

Any claims made outside these 2 contexts should be considered marketing or hearsay.

TL;DR: Verizon has a huge in-house IDS/IPS system that is already broken by Chinese hackers. Maybe.


RSA itself, as specified in PKCS#1, does not mandate any specific value for the public exponent e. That value e must be relatively prime to both p-1 and q-1 (where p and q are the two factors that constitute the RSA modulus), but there is no other restriction. The exponent e does not even to be prime. It needs to be an odd integer, because p-1 and q-1 are even (since p and q are big primes, hence odd). The use of 65537 is just a widespread tradition. There is also an idea floating around that this specific value is somehow "more secure" than others (in particular using e = 3), but that's a myth. The most efficient public exponent is e = 3, though this impacts only public-key operations, which are extremely rarely the bottleneck in any given system.

In fact there is no relation whatsoever between that exponent and the attack cost. "Pratical" attacks methods for RSA try to factor the modulus, and completely disregard the public exponent value. The page you link to appears to want to use an exponent distinct of 65537 for the sole reason that some other people (that the page author does not like) recommend using 65537. This is a fascinating example of human psychology at work, but scientifically it has no value.

Generating a RSA key with an arbitrary public exponent is not harder, and most RSA libraries support it (command-line tools may be more limited). As for interoperability, you should be aware that some widespread RSA implementations, in particular the one in Windows (and thus used for SSL and for certificate validation), require the public exponent to fit on 32 bits -- not for enhanced or lowered security or whatever, but simply because it made life a bit easier for the original developer, who could devote a fixed-width small field for public exponent encoding. If you want to keep your interoperability, you should choose your public exponent in the 3 to 4294967295 range.


How to store an encryption key on shared hosting?

The only proper answer to this as Xander commented is that you can not expect proper security for sensitive data in a "Shared" environment. You are not the administrator of the server which means any security flaw or misconfiguration left open by "someone else" may result in your data being compromised. And commonly in such cases when the parties involved find anything which looks like an encryption key and some apparently encrypted files, the first thing tried is to decrypt and see whats inside.

So all in all it is best to get a host who can assure you HIPAA or PCI-DSS like data confidentiality or host the data in an environment which you or your organization has complete control over so you can secure it to acceptable levels yourself.


Installing and updating a CA certificate on a client

The Official Way

The certificate is a valid legal identification for a person/company/agency. As with any formal document you have to obtain it from an official Certificate Authority. There are many.
As a developer you have to get from them at least 2 certificates: one for your server, and one for you as a client. To get them you have to do a requisition. When you do this you'll be granted your certificate and your private key file for every certificate.

After this legal process you can install it on your apache server like this:

First you install the certificate chain in the server. These are some certificates, publicly available from the CA (certificate authority).
This chain, can be only one root certificate or many.
If there are many you put them all in a file together. There are other ways but I
found this one to be better.

Then you add this lines to you apache configuration:

SSLEngine on
SSLOptions +StdEnvVars +ExportCertData
SSLCertificateFile      /home/<youruser>/<yourCertFolder>/server.crt #server file
SSLCertificateKeyFile   /home/<youruser>/<yourCertFolder>/server.key #server private key
SSLCertificateChainFile /home/<youruser>/<yourCertFolder>/rootCA.crt #server certificate  chain
SSLCACertificateFile    /home/<youruser>/<yourCertFolder>/rootCA.crt #server CA certicate file (if you're in the test process below, should be the same file above)
SSLVerifyClient require
SSLVerifyDepth  10

Go to your browser and import the certificate chain of the CA that issued the certificates.
Import your personal certificate to it. There are some certificate types. If you bought A1 (files) certificates you just import it to the browser. If you bought an A3 token (like an USB flashdrive but for certificates) you have to first load the driver to the browser and then it will import it automatically when you enter a SSL enabled site.
The certificate you're using in the browser has to have the exact same certificate chain than the server is using or the server won't be able to validate it.
After this you should see a window asking you to select you cerficate when entering the site.

Lot of stuff huh ? believe me, learning this was an harsh process.

The Test Way

But there is something you can use as a test process. You can create you own CA and emmit your own certificates locally in your server and development machine. Here's how you do it:

First install openssl in your machine if it's not already installed. Then use these scripts:

Create CA and server certificate:

#/bin/bash
echo "Create CA private key"
openssl genrsa -des3 -passout pass:123 -out  ./rootCA.key 2048
echo "Remove passphrase"
openssl rsa -passin pass:123 -in ./rootCA.key -out ./rootCA.key
echo "Create CA self-signed certificate"
openssl req -config openssl.cnf -new -x509 -subj '/C=US/L=Dev/O=COMPANY/CN=CA' -days 99999 -key ./rootCA.key -out ./rootCA.crt
echo "Create private key for the server"
openssl genrsa -des3 -passout pass:123 -out ./server.key 2048
echo "Remove passphrase"
openssl rsa -passin pass:123 -in ./server.key -out ./server.key
echo "Create CSR for the server"
openssl req -config ./openssl.cnf -new -subj '/C=US/L=Dev/O=COMPANY/CN=server' -key  ./server.key -out ./server.csr
echo "Create certificate for the server"
openssl ca -batch -config ./openssl.cnf -days 999 -in ./server.csr -out ./server.crt -keyfile ./rootCA.key -cert ./rootCA.crt -policy policy_anything

issuing certificates:

#!/bin/bash
if [[ -z "$1" || -z "$2" ]]; then
    echo "Use: issueCertificate <NAME>"
    exit
fi
NAME=$1
DN="/C=US/L=Dev/O=COMPANY/CN=$1"
ARQ="${NAME//[[:space:]]/}"
echo -e "\nCreating folder... "
mkdir $ARQ
echo "done."
echo -e "\nCreating private key... "
openssl genrsa -des3 -passout pass:123 -out ./$ARQ/$ARQ.key 2048
echo "done."
echo -e "\nRemoving password..."
openssl rsa -passin pass:123 -in ./$ARQ/$ARQ.key -out ./$ARQ/$ARQ.key
echo "done."
echo -e "\nCreating CSR... "
openssl req -config ./openssl.cnf -new -subj "$DN" -key ./$ARQ/$ARQ.key -out ./$ARQ/$ARQ.csr
echo "done."
echo -e "\nCreating client certificate"
openssl ca -batch -config ./openssl.cnf -days 999 -in ./$ARQ/$ARQ.csr -out ./$ARQ/$ARQ.crt -keyfile ./rootCA.key -cert ./rootCA.crt -policy policy_anything
echo "done."
echo -e "\nExport client to pkcs12 and import in browser"
openssl pkcs12 -export -passout pass:123 -in ./$ARQ/$ARQ.crt -inkey ./$ARQ/$ARQ.key -    certfile ./rootCA.crt -out ./$ARQ/$ARQ.p12
echo "done."

So I guess that's all. I've has to translate some things and change some var names and constants in order to remove my company's name and this whole process is rather complex. So I appologize if I forgot something or something doesn't work. Please inform and I'll correct promptly.

Good luck. :)


Is a Kerberos ticket valid with only one-way external trust between domains?

from what i gather the IIS server is part of domain A, if so you can add a one way trust between A->B, this will cause all global/universal users in domain B to be trusted by domain A, allowing you to give access (on the IIS server) to domain B users.

for SSO/IWA you need that the IIS server be considered as part of the intranet zone by hosts in B, this will require either to have the same DNS suffix as domain A on hosts in domain B, on the same subnet or a manual addition to the intranet zone for that specific site.

a few points that i must clarify for you that will make this answer make more sense and give some insights into security boundaries in AD:

The TGT is not sent to the IIS server, only a TGS.
unless you have PAC validation enabled the IIS server will never contact the DC as part of the authentication sequence.
a trust is not a good security boundary (there are other mechanisms to limit access between domains, such as network segmentation and firewalling)
this is a great explanation about how kerberos works


What you want to do makes no sense as far as I can see.

It's also not possible with gmail.

How about using a service designed for exactly the use cases you mention, such as https://www.mailinator.com/ ?


Could Mozilla MaintenanceService be used by an other program to avoid permission problems on Program File?

It should not be possible to use the service to bypass some security e.g. to elevate privileges. Everything else is treated as a bug. Unfortunately there were a bunch of bugs in the past (for example CVE-2017-7760, CVE-2016-5253, CVE-2015-4505) which allow a local attacker to elevate privileges via the mozilla maintenance service.

If you are worried about this you can uninstall the service. In this case for further updates a fallback is used which use an elevation prompt.


Unable to intercept android app traffic neither in Burp Suite nor in Network Profiler. Can anyone help?

If Wireshark reports that the device is making DNS requests, set up a MitM DNS server (or just modify the WiFi settings on the device to point to a custom DNS server) that points the target domain(s) to your Burp host. Alternatively, if you can, edit the HOSTS file on the device to bypass DNS and treat your IP as the target domain.

If the requests are being sent to a specific IP address without performing a DNS lookup (unlikely, but not impossible), you will instead need to convince the device that your computer with Burp has the IP address it's looking for, or simply route all traffic through your computer (which I'm guessing you're already doing, if you can see the device requests in Wireshark) and configure it to route traffic intended for the target IP to the local machine instead (on Linux this can be done with iptables, I believe).

Next, configure Burp to listed on port 443 (or whatever other port(s) the TLS traffic is sent to) in "Invisible" proxy mode. In this mode, Burp simply acts as a web server and uses the SNI to generate a suitable TLS certificate and to forward the request to the host (if you choose to do that).

However, note that this will not work if the app is both validating TLS certificates (which it should be, but a surprising number of apps - especially those that avoid the standard libraries - fail to do this or do it incorrectly, such as only checking the subject name and not the chain of trust) and using its own certificate store for the list of allowed CAs (instead of the operating system's cert store), or if the app is using certificate pinning. In either of those cases, you will need to modify the app itself. If you don't have the APK, you'll need a rooted device to do this; go to the app's install location and look for anything that looks like a certificate store, key store, or certificate file, and add / replace it with your Burp certificate. The app should then trust Burp and allow you to proxy the traffic. (It is possible that the app is using cert/key pinning and the pin is hardcoded; in that case you would need to extract and decompile the app binaries to replace the key or simply skip the TLS check, and at that point it might be easier to just analyze the decompiled app).


Is it secure to create a Bitcoin address from a private key generated by Rand() instead of cryptographic elliptic curve

Using the mouse is a good choice to generate entropy, but there are better methods for generating good random numbers.

For generating a single bitcoin address for personal use, the random generator is likely good enough, but is much much much weaker than a properly random key.

If this is for any kind of system that will be generating many addresses (and therefore be a reasonably attractive target for baddies) it is very much not secure enough.

For any given OS/hardware/programming language combination, quite a bit can be deduced about the state of the random generator, especially if people can make multiple addresses, so that they can gather data. From there its a hop skip and a jump to be predicting other peoples addresses/keys. This becomes an even much worse problem if this is deployed as any kind of shared service in the cloud where the same instance of a generator may be making keys for many users

Use of a real crypographic psudeorandom generator is like 2-3 extra lines of code, and very worth the effort.


Issue to consider: You must assume the worst case scenario -you credit card info has just been stolen. The following answer deals with the actions you should take to safeguard yourself from you money being stolen as well. Note that this answer really doesnt address the mechanisms behind how your information may have been stolen (I can certainly elaborate, but that was not my initial intent here:)

Perhaps the easiest way to solve this unfortunate scenario is to call your bank (where the card was issued that is in the ATM) and report the card lost. They will immediately invalidate your current card and send you a new one (usually for free).

After I make the call, I could step away from the machine and feel very confident that there would be no further [potential] breach and move on to [potential] damage control:

Immediately find the store manager, like you did and discuss the issue with them (this is just a customer service thing and has little to do with security).
Do the same with the ATM operator and/or manufacturer. They will usually keep you posted as they perform tests to see what happened. Ideally, you just want them to find that it was just a fluke accident and that's that (perhaps they give you some compensation), but unfortunately, this scenario could have been a card skimmer that went wrong... If that is the case...
Monitor your accounts! and then perhaps...
Look into potential legal repatriations for negligence.

P.S. While you should NEVER reuse PINs, some people do so; so if that is you, change your other PINs as soon as possible.


That's (26+10)^6  combinations, at 6*16 bits per combination (I'm assuming 16 bit wide ascii because tchar)

((37^6)*(6*16)) bits = ((37^6)*(6*16))/(8*1024^3) Gigabytes = 24 gigs.

You can bring it down to 12 gigs if you use 8 bit wide char instead of 16 bit wide tchar and space is a premium for you.

EDIT: Wait, MEMORY needed? No idea, what software are you using to generate the list? It will take up this much space on your HDD when you save it though.

Also, it actually takes up 1/6th or 2/6ths more space than I originally wrote depending on whether you use 1 or 2 characters to indicate endline (1 on Linux, 2 on Windows, iirc 1 on Mac)


The reason for stating (part of) the IBAN in the mTAN message is to protect you from an attacker such as rogue browser plugin modifying the destination account. The more you hide, the greater the chance the attacker can use a collision - i.e. he has a full access to an account where the numbers not hidden match your intended transfer. As the plugin would only change the account for transactions it knows it can exploit, the bank wants to show as much as possible to lower the chance. The probability of someone intercepting the mTAN itself is probably regarded as too small to bother.

  E.g., in Germany, one could buy goods/services just knowing your name and bank account number (IBAN)

Well, this is the real problem that one should ask your bank for a clarification. An account number is neither secret nor unpredictable and should be treated as publicly accessible information. If one account number is known, one can usually also generate other valid account numbers quite easily, so one can only hope the name is checked as well.


pgp -cw symmetrically encrypts a file (using a passphrase that the user is prompted for) and subsequently securely deletes the old one.

pgp -c (symmetric encryption) is performed using gpg --symmetric or the shorthand gpg -c (which is actually compatible to the old PGP syntax). If you want to enforce IDEA, use the option --cipher-algo IDEA or enforce PGP 2.6 compatiblity using --pgp2. Use either:

gpg --pgp2 -c file
gpg --cipher-algo IDEA --symmetric file

Secure deletion (-w flag in PGP 2.6.2) is not offered by GnuPG, fall back to the tools offered by your platform instead. OS X already ships srm (secure remove), for Linux you could use wipe (probably needs to be installed first). There are also lots of other alternatives.


How to set password on applications in Mac OS to prevent an administrator to start them?

By definition, an administrator account can do anything. If you want to prevent someone from running some applications, don't give them an administrator account.


What is the HTTP "Server" response-header field used for?

Server information should be removed from HTTP responses, and its an insecure default to leak this data. This isn't a major security risk,  or even a medium security risk - but I don't feel comfortable just announcing such details to my adversaries. Having an exact version number leaks when, and how often you patch your production systems - even if the version is current.  An adversary knowing the patch cycle, means that they know when you are the weakest.

The HTTP Host header probably most useful for the Netcraft Web Server Survey.  But in terms of HTTP it shouldn't matter.  That is why we have standards, so that clients and servers written by different vendors can work together.


Why is it called a stateful and a stateless firewall?

You are almost correct. But stateful inspection allows you to have more control above data streams going through the firewall.

A Cybrary article says:

  Stateless firewalls watch network traffic and restrict or block
  packets based on source and destination addresses or other static
  values. They’re not ‘aware’ of traffic patterns or data flows. A
  stateless firewall uses simple rule-sets that do not account for the
  possibility that a packet might be received by the firewall
  ‘pretending’ to be something you asked for.

  A stateless firewall filter, also known as an access control list
  (ACL), does not statefully inspect traffic. Instead, it evaluates
  packet contents statically and does not keep track of the state of
  network connections.

  Stateful firewalls can watch traffic streams from end to end. They are
  aware of communication paths and can implement various IP Security
  (IPsec) functions such as tunnels and encryption. In technical terms,
  this means that stateful firewalls can tell what stage a TCP
  connection is in (open, open sent, synchronized, synchronization
  acknowledge or established). It can tell if the MTU has changed and
  whether packets have fragmented. etc.

They are named as such because they are really doing what the name means.

Stateless: don't remember any state, just filter the current packet passing through according to the rule list.

Stateful:  remember the state of the data stream passed through (what happened in all previous packets) and filter based on the same list as in case of stateless, but filter also based on state information.

The state information stored in the firewall memory allows you to do exactly what you asked before and much more.

You can add a rule that allows passing of the new incoming TCP connection inside (TCP packet marked with a SYN flag) and all established / related traffic inside / outside.

In case of TCP, the client (SRC IP/SRC PORT) sends SYN packet to the server (DST IP/DST PORT) to open the TCP connection. Firewall has a rule that this packet can pass (only new TCP connections to that server). Firewall now remembers the request to open the connection was sent to server (it remembers among others src IP, src port, dst IP, dst port and state of the connection - in this case CONNECT) and now expects only SYN/ACK packet from server side. No other packets of this concrete TCP connection can pass through it (in both directions). Server then sends SYN/ACK, firewall remembers HALF-OPEN state and expects only ACK flagged packet from client. Once the client sends ACK, the state of the connection is changed to CONNECTED and only packets with flag ACK (data) FIN/ACK (close connection) can pass through now. The same is happening during the connection closing procedure - so it is possible to have complete control above the protocol passing through and filter out invalid packets.

For TCP it's a bit hard to explain and understand. ICMP is much easier. There are two basic ICMP packets - ECHO and REPLY.

In case of stateful firewall you can ensure that REPLY can pass the firewall only in case the ECHO was previously sent.

In case of stateless it is possible only to control if ECHO and REPLY can pass through so the server can send REPLY anytime even if it was not asked for it.


Standard AES vs additional parameters with Rijndael - what is more secure?

128 bit blocks are fine
Yes, larger block sizes have some advantages. If your blocks are larger, then can encrypt more data with the same key until you have to roll over to a new key.
But for practical purposes it's enough. (Re-evaluate once you intend stay safe past the petabyte barrier with the same key.)
ECB is bad.
Identical input blocks are encrypted to identical output blocks. This is bad.
Unauthenticated encryption is bad.
Attackers can flip bits in your blocks, delete blocks, resort blocks, insert blocks. This is bad.
Try to use GCM
GCM is an "Authenticated Encryption" mode of operation for block ciphers. It hides repetitions in the plaintext and it seals the ciphertext against manipulation.
I don't know if this is in PHP natively. This questions suggests something like this is doable via OpenSSL:

https://stackoverflow.com/questions/28290973/gcm-authenticated-encryption-function-for-php


Using Netcat to detect the webserver type

try this:

$ netcat example.com 80 <<END
HEAD / HTTP/1.1
Host: example.com

END

The $ is a command prompt; not actually typed.

It's about as simple an HTTP request as you can get without breaking 1.1 compatibility. You'll get a Server: header which will identify the destination server software.

Alternately (and perhaps more interestingly) just use a real http client, either something like wget or curl or perl's libwww commands. Just display response headers and there you go.


Remove domain from web filter blacklists

There are a LOT of blacklists.

I use often this tool, and it currently shows 103 blacklists. You might need to check each of these:

https://mxtoolbox.com/SuperTool.aspx?action=blacklist%3astackexchange.com&run=toolpage#


Are strong WPA2 passwords "good enough" for WiFi security?

The short answer is probably.

The actual answer depends entirely on what "good enough" means to you.

Do you need to disallow WiFi altogether? Perhaps you really need Ethernet cables run in pressure-monitored shielded conduit run under an access-controlled, video-monitored raised floor with locks on the exposed ports? Okay, that is overkill for almost everyone, but just almost.

Like almost all security questions, you need a risk analysis. Maybe not a formal one, but at least go through the risks and costs in your head.

What is the impact of unauthorized access?
What are you trying to protect?
What is the impact of disclosure?

In your case, take a look at some oclHashcat performance benchmarks. How long is your WPA2 password? How big is the search space for a password that long, with those "types" of characters (digits, alphas, symbols, etc.)? GRC has a convenient calculator.

On average, an attacker will have to search half the search space to find your password. Given how fast they can search (which depends on what amount of resources the attackers are will to put forth), how long will it take to find your password?

Can you live with that? Can you simply change your password more often than that? Are you willing to take that risk?

To answer your specific questions:

yes, as the entropy on the WiFi password increases, you get security benefits in the form of an increased password search space, and
yes, unauthorized access is inevitable given enough time

My work site has a WiFi password that has a search space of 4.23 x 10^33. oclHashcat can guess 350k or so passwords a second on the system used in the benchmark. Assuming the attacker has 1,000,000 of those boxes at their disposal, or at least 1,000,000 times the compute power, they can try 3.5 x 10^11 passwords a second. It would take them on average 2 x 10^14 years to find the password. Good enough for me. Even if they are a million times luckier than average, I'll have changed the password before they find it.

Of course, they could guess right on their first try. Or in their first few minutes of guessing. Or they might have some knowledge of the password that they can reduce the search space (e.g., they know how long the password is, which characters can be used, what the first 5 characters are, etc.). Maybe the WiFi password is written on a white board that can be seen through a window from the street, making this whole discussion moot.

Again, it all comes back to what the acceptable risk is to you.


What medium for storing full-disk encryption keys is easy-to-use as well as easy-to-destroy?

Your best bet would be a CD or DVD, as they are easy to use and easy to destroy (see below), with CDs being even easier to destroy because of the different data density. The main disadvantage is that they're bigger than a flash drive, and thus also harder to conceal, but I'm not sure if that's your problem. Anyway, if you don't fear X-rays, body scanners or a  proper patdown, you could try to conceal one under your clothes.

There are shredders which can be specifically used to destroy CDs and DVDs, and if you don't have access to them, you can always improvise using a garden scissor (or any kind of scissors/blade capable of cutting through plastic and such)  and a blender. I think you could mechanically destroy a CD in this way in under 5 minutes. You can also shred them using a microwave - which is probably quicker -, or even combine different techniques.

For more information, read this question on Superuser and its answers.

The other possibility would be a USB drive or a SD card. They are smaller and easier to conceal, and easy to use, but they're also harder to destroy via improvised, mechanical means.


Is there a way to check if my site visitor has visited another site?

Generally there is a way for Chrome. You can try to exploit this vulnerability (not a product, but a demo to check if it works in your browser).
The vulnerability uses JavaScript to check from which cache the image was delivered: from F-cache or from disk cache.
Note: This method will only work if target site has a favicon.


How do you shun an IP automatically based on the number of current connections?

I believe this would be possible using the ASAs threat-detection commands. For example using threat-detection you could setup scanning-threat and then use the shun command.

One implementation would be to create an object on the ASA that acts as a whitelist and then using threat-detection scanning-threat shun exception insert whitelist group object name you would be able to shun anything that is NOT in that whitelist. Please be aware that is not the exact syntax you will have to use the docs & ? to find the exact commands however its mostly the correct syntax.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html


Secure storage/retrieval of data in a database

The point of CWE 257 is to force the authenticating app to evaluate passwords not by decrypting them and comparing to the plaintext, but by encrypting (or actually hashing) the plaintext again and comparing the opaque texts.  But yours is not the authenticating app; it's technically the client.  Apps have to store the passwords to back end systems all the time, there's no way around it.  Heck, even my browser stores passwords from time to time.

In addition, the attack vector detailed in CWE 257 doesn't apply here.  An admin can't actually decrypt the token without the user's password, because the password is the key.  So in my opinion don't worry about it.

Overall I think your idea is fine.  You might considering binding to the device (e.g. set a secure persistent cookie with plenty of entropy) and requiring the user to re-enter the token when switching devices.

One weakness is that the user will need to go dig up his token again if he ever changes his password; this may discourage him from changing it often enough.  Then again it sounds like your primary user base can't be bothered with things like that anyway.


How many iterations of fuzzing is enough?

I don't have numbers for you, or specific guidelines, but I think an important issue to point out, but was not sufficiently emphasized in those links, is Code Coverage.

It makes little sense to run a huge number of fuzz iterations, if they are all similar - from a code path point of view.
That is, "dumb fuzzing" may generate many different inputs (file/network/RPC/whatever), that look sufficiently different, but all have the same effect on the code, causing the program to take the same code paths. Obviously, this is not very effective.

Microsoft has also developed internal tools (I know of FuzzGuru) that implement "smart fuzzing". (See this talk from a few years ago discussing it). This enables MS to run much more efficient fuzzing, with much lower numbers of iterations (unofficially, of course) - simply because they can ensure much higher percentage of code coverage at each iteration.

In any event, it is important to do your fuzzing - whether "smart" or "dumb" - in combination with code coverage tools, to ensure you're getting appropriate value out of your fuzzing efforts.


Since a perfectly honest network card acts under the control of the host CPU, a malicious hardware element in the CPU can perfectly betray the user's secrets. After all, when you have some malware in your machine, the malware is just software, and it runs on the CPU -- and yet your secret data can escape.

Any piece of hardware with DMA access can read and write memory at will, and thus can modify OS and application code as it gets executed. This is sufficient to do everything that kernel-level malware can do, i.e. quite a lot of evilness. This includes the CPU itself, the GPU, the hard disk controllers, the network cards, the USB controllers...

Even if you are intent on having a dormant backdoor, which does nothing until activated from the outside, it can still be done purely in the CPU, or in the DMA controller: it suffices to have the CPU or the DMA controller inspect memory transfers and wait for a specific pattern, which triggers the hostile code. Attacker then just has to send a ping request or some other packet with the said pattern: the DMA controller will see it when it transfers it from the NIC to the main RAM, and the CPU will see it when it recomputes the IP packet checksum.

People are afraid of hardware backdoors because they feel they have no control over it -- and that's entirely true.


windows firewall turns OFF automatically

AVG Internet Security 2012 includes its own firewall function, and so yes, it shuts down the Windows Firewall when it runs. Running multiple host firewalls on Windows is unpredictable and not recommended.


What is the difference between HSM and Key server?

The point of a key server or HSM is to isolate the application from the storage (and potentially usage) of the key.  Ideally, you would want to offload and rate limit all cryptography operations to the HSM or Key Server so that the application never has access to the decryption key.

This allows you to do intrusion detections such as rate limits and such to prevent bulk decryption of records if the application server is compromised.  The attacker could still queue up records to be passed through the HSM or Keyserver for decryption, however the spike in the rate of requests would start throwing up red flags that a compromise may have occurred.

Either could potentially be more secure since both provide the same type of isolation.  A key server provides a higher degree of physical isolation, but depending on implementation, the complexity may leave a larger attack surface.  HSMs on the other hand are simpler, but also local.  Either way, if properly implemented, only a vulnerability in the interfaces themselves should allow the key to leak.


In short: wireless means data travel through the air and can thus easily be sniffed. This means you need some protection against sniffing and this is commonly done using encryption. There are established encryption methods for wireless networks (see Wikipedia:Wi-Fi Protected Access
 for details). If these are not implemented or not deemed sufficient it is also possible to run a VPN like IPSec on top of the wireless connection.

Another issue to look out for is that the devices by themselves don't have any backdoors or security problem which might be used as a backdoor. Because otherwise some attacker might reconfigure the device or get access to the encryption keys and thus can decrypt sniffed data. Running a VPN on top of the wireless connection and independently from the devices providing the connection can mitigate this issue since it is now not enough to crack the encryption of the wireless layer.


What are some well known websites that do not require multiple character sets in passwords?

These websites don't require multiple character sets in passwords:

Google Account - Includes YouTube and others
G Suite
Facebook
Wikipedia
Amazon
Reddit
Yahoo
Twitter
Instagram

Unfortunately, this list is sparse when it comes to B2B websites which may be more convincing to your B2B peers. If any readers are aware of big B2B website password policies, please add them to this list. This answer is a Community Wiki.

When possible I have linked to the password policy. When I can't find an explicit password policy, I personally verified their adherence to NIST by creating an account with the all-lowercase password.

Interestingly, although many sites do not publish their password policy, they almost universally publish password guidance recommending the smart use of multiple character sets, as doing this intelligently is sound password security and in line with NIST guidelines.


Is it safe to run XCode project in iOS simulator?

Running code from an unknown source (even in a Simulator) is risky.
If you suspect foul play first do a code audit.

Before you do a code audit with XCode however, first make sure the code base does not have any 'XCode modules' in them that might be automatically triggered. The easiest way to do this is to do a rough audit with a plain editor and if all seems ok, open it in XCode.

Use your common sense. Check first, with the least amount of 'helper tools' than slowly after you gain some confidence in the codebase add helper tools to help you in your task.


Does Bitlocker qualify as the 'Cryptographic Module' defined in FIPS140-2?

Bitlocker is a FIPS 140-2 certified module with certificate number 1339.  It is important for you to read the FIPS security policy to determine if the operating conditions conform to your environment.  For example:

The BitLocker™ components (Windows Server 2008 R2 versions: 6.1.7600.16385, 6.1.7600.16429,
6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897 and 6.1.7600.20916; SP1 versions: 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 and 6.1.7601.21675) identified in section 4 have been validated on the Microsoft Windows Server 2008 R2 and Microsoft Windows Server 2008 R2 on x64.


Due to which reason might a windows 7 password been reset to empty?

Local user password changes should register as audit events in the Windows event log, under Security. The event ID is 627: Change Password Attempt if the user changed the password himself, or 628: User Account Password Set if another user performed the change.

You can reach the log via:

  Start » Run... » eventvwr.msc » Windows Logs » Security

You can filter the log using the Filter Current Log button on the right panel, and enter 627 and 628 in the event ID filter list.


Firefox does not trust Burp Suite's certificates in case of accessing sharepoint online

This site uses the Strict-Transport-Security Header. This header normally looks something like that:

Strict-Transport-Security: max-age=31536000

The header instructs the browser that for every future request to this site it must use https and that it should fail in case there is something wrong with the certificate.

So you probably visited that site without burp before.

The following advice does not work anymore:

  You can disable HSTS checking in firefox (but only do that on a dev
  machine that you really do not use to access the web normally):

  Visit about:config and change the setting
  security.mixed_content.use_hsts to false.


Security of KeePass and Yubikey OATH-HOTP

You can not use HOTP for encrypting data. HOTP is a symmetric algorithm that relies on an authenticating party to verify the OTP value, which the user enters.

The OTP value is calculated based on a shared symmetric key and a counter.

shared means, that the user (in his device) and the authenticating party (usually the server) both have the very same key to calculate the same value. The security lies in protecting this key! Everybody who has the key (well, an the counter, but this is no problem) can calculate the OTP values.

In the keepass scenario the authenticating party is the program or better the vault-file. But you encrypt the vault file, since you want to avoid compormizing the data in case the file is stolen.

Now there is no easy way to protect/encrypt the secret shared key, if this is what you want to use to encrypt the data. You somehow encrypt the data with the data itself.

You could however try to initially encrypt the secret key and the data encryption key with the next OTP value. When the user enters the next OTP value which he can calculate with his OTP token, the secret key and the data encryption key could be decrypted. Then keepass could calculate the next (n+2) OTP value with the decrypted secret key and re-encrypt the secret key and the data encryption key.

But honestly there are so many possible flaws in such a setup, that it is much likely that you will loose your data rather quickly. Simples thing is that you push the button of your OTP token twice... or ten times.
keepass would not have ten versions of the encrypted secret key and data encryption key...

So you might end up encrypting the secret shared key with the static password. Hm. Then all your security only depends on the strength of this static password and you end up with... ...guess what: one factor.


Using separate HAProxy and API tiers, how can I ensure a request came from HAProxy?

The obvious solution is to encrypt the connection between the haproxy and the webserver. Doing this using SSL means you are adding some latency to the connection and a processing -IIRC, haproxy implements a 1:1 connections between front end and backend, otoh ATS and some other proxies make more efficient use of a pool of connections to the backend. But assuming that switching to ATS is not an option...you might consider an authenticated VPN connection such as ipsec between haproxy and webserver, or simply block access to the port used by the webserver at the router (assuming that there's nothing considered hostile on the same subnet.


How to Determine the State of a Random Number Generator?

A large number of secure protocols depend on random or secure pseudo-random numbers. Even the session ids created by most web applications for keeping track of which web request belongs to which user depends on random strings which are generated using random numbers.

If, for example, I could predict the next session id generated by a web application, I could hijack this session.

Random numbers are used to create session keys in various protocols (ssl, ssh, ...). If I could predict these keys, I could decrypt the data sent in these sessions. They are also used as nonce values, and if I can predict these, I can break a number of protocols that depend on nonces not being predictable.

how to get at the state

To guess the state of a random number generator, you usually need to observe a lot of numbers generated by the RNG.

This doesn't mean that you have to observe the application that requests these numbers. If you have access to the same RNG (which is possible if you have access to the physical server where your victim application resides), you can simply request a million or ten million numbers yourself, using another program. But usuallly you don't have direct access to the RNG, so you'd either need to passively observe ommunications for a long time or trick the server side into providing more of these numbers (for example, by connecting as a regular user and requesting encryption key rotation 100 times a second in a badly designed protocol that allows for this).

One quality of good random number generators is that they have very long periods, e.g. it takes a huge number of invocations before they start repeating themselves.

Assume for example that you have a really bad generator that starts repeating its sequence of numbers after only 256 invocations. Now if you can observe a few of these random numbers, you can easily pinpoint at which point in the sequence the random number generator is, and correctly predict all future numbers generated.

A good generator should also output numbers that pass various statistical tests. That means that for example all numbers in the output space should be generated with roughly the same frequency, that there shouldn't be detectable patterns (e.g. the RNG always alternating between even and odd numbers) etc.

If you do manage to detect a specific pattern in a RNG, apart from being able to predict parts of a future "random" number, you might figure out that this pattern always occurs when the least important 8 bits in the RNG are in a certain configuration. If you managed to identify a few such patterns that let you infer parts of the RNG's state,  you could combine these observations to yield a larger part of the whole state.

Good RNGs should take into account the whole state for each output bit they produce. But say you have one that doesn't do this. For example, assume that you have an RNG that produces numbers whose lowest bit only depends on a single bit of RNG state. This means that the RNG leaks part of its internal state with every number it produces. And if the lowest bit depended on two bits of internal state instead, the RNG would still leak important probabilistic information about the state of these two bits with every number produced.


Is having a unique key to encrypt data not sufficient

Can't we just make IV as unique and secret? Will it mean that the IV
  can now be treated as a secret Key?

Key distribution is hard, and there's no reason to make the IV a secret.

If Alice wants to send a message to Bob using symmetric encryption both must somehow already know the encryption key and the IV. To share the encryption key Alice and Bob could meet up in person once, then use the shared key to send many messages without having to physically meet again.

Now if the IV is a secret, and the IV must also change every message then Alice and Bob now have to meet to share the secret IV for every message. If they have to meet every time, then why not just share the message when they meet?

Seeing as the encryption is not weakened by an attacker knowing the IV, they might as well save themselves the hassle of meeting in person by just sending the IV with the encrypted message, rather than trying to securely exchange it. It saves them both a lot of hassle, and they're no less secure.


Why don't OSes protect against untrusted USB keyboards?

The trust model for a device you plug in to your computer is just inherently difficult.  The USB standard was created to allow literally anyone to create a USB device.  Security wasn't a factor.  Even if it was, where do you place the trust?  The movie industry tried this model with HDMI, and it's essentially failed miserably.  You can't simultaneously give someone a device that does something, and prevent them from understanding how to do the same thing.

Your example proposes to put the trust in the user.  The most obvious problem is nobody wants to type in passwords just to use a keyboard.  Barring that, would it really solve anything?

The user already trusts the device, otherwise they wouldn't be plugging it into their computer.  Since trust has already been established, why wouldn't they simply do whatever is required to get it to work?


There are various ways to fingerprint a client you're using. User-agent string is only a famous one. If you view the source code for cadburys-prizes[.]com, it uses meta refresh to redirect to httpx://bit[.]ly/2K1V332 after 2 seconds. It's possible that cadubrys-prizes may serve different content without using bit.ly. The bit.ly URL redirects to httpx://cash[.]trxmonetizer[.]com which seems to be doing the main job i.e. fingerprinting the client and presenting with whatever they feel like.

If it's doing everything on client, you can imitate any User-agent and inspect the response to dig deeper. However, it's also possible to do it on server-side for which they may or may not pass fingerprinting parameters in the request.


Is it safe to send sensitive data in the post body to an azure function?

Sending sensitive data in a post request is a common approach. Take any form-based authentication mechanism for example. A user enters his credentials in the web-frontend (browser) and a post request is sent to the web-server in the backend. If this backend actually is a classical web application or an Azure function doesn't matter.

It is important though to ensure transport security. Using HTTPS (with TLS) is state-of-the-art in this regard. Appropriate algorithms, key-lengths and modes for your HTTPS configuration are defined in public standards and guidelines. I recommend the document SOG-IS Crypto Evaluation Scheme Agreed Cryptographic Mechanisms but there are others (with very similar recommendation). Depending on your location and/or your industrial sector, there might be specific standards and guidelines that are required for compliance.

One caveat in the end - just because it is appropriate, doesn't mean it is the best option you have. I do not know your actual requirements, so I cannot advise in this regard. That's something you have to evaluate.


ECC Brainpool Standard Curves and Curve Generation with Bouncy Castle which seed to use?

You don't have to specify a seed at all.

An elliptic curve is specified by a handful of parameters:

the definition of the field you are playing on (here, the field consists in the integers modulo a given prime p);
the curve equation, here Y2 = X3 + aX + b for two constants a and b;
a conventional generator G, which is a curve point (i.e. a pair of coordinates (X,Y) which matches the curve equation);
the order n of the generator, and its cofactor h.

The order n is the smallest non-zero integer such that nG = 0; h is such that the total number of points in the curve is equal to nh. Normally, we choose the curve such that n is prime and h = 1, i.e. the generator generates the whole curve, and with a prime order suitable for Diffie-Hellman or DSA.

The seed is not needed at all to compute things with the curve. The seed was used to generate the curve itself. It is about "nothing-up-my-sleeve numbers". It is mathematically possible (or at least it may be) to generate special parameters with a hidden structure (p, a and b in the notations above) such that the curve looks good, but is in fact weak against cryptanalysis. Normal, honest curve generation looks like this: we generate completely random p, a and b, and then check the requirements in section 2 of RFC 5639; if they are not all met, try again. Special-form parameters which induce weaknesses are extremely rare, so random generation is fine.

To demonstrate that this normal process was followed, and, therefore, that the curve parameters were not crafted to be especially weak, it is customary to fully specify the PRNG used to produce all the random values, complete with its starting seed(s). Thus, third parties (e.g., you) can rerun the PRNG and the curve generation process, and see that they obtain, indeed, the same curve parameters. For the Brainpool curves, this PRNG is specified in appendix A. Here, they have two seeds because they first generate p, and only then a and b, as two distinct steps, each with its own seed.

However, there is no need to do it every time. When you do such a re-generation of the curve, you do it once, just to make sure that the parameters that you are found in the RFC are legit. In fact you don't need to do it yourself, you just need to convince yourself that someone, somewhere, has done it. In any case, the curve parameters that you are about to use are already in Bouncy Castle.

To just use the curve, the seed is not needed and can be set to null. There is a room in the ECDomainParameters class to specify a seed because some (but not all) standards for encoding the curve parameters have some provision to support including such a seed. However, this does not really apply to your case:

Your code will talk to your code; both parties thus already know what curve is used, and have no need to encode the curve parameters anywhere at all.
Even if you encode the parameters, you won't need to rerun the curve generation process, because each party will use its own, hardcoded, parameters, not the ones sent by the peer.
In any case, there is no standard for the parameter generation PRNG. Brainpool has its own, but there is no agreed-upon PRNG which would fit everybody (contrary to DSA parameters, where the standard itself includes it, see appendix A). Indeed, this can be seen in the fact that the Brainpool process uses two seeds, not one.

So, right now, the inclusion of the seed in encoded parameters, and in the ECDomainParameters class, is pure dead weight. Just set it to null and move on.

Not being myself a practitioner of the Bouncy Castle C# API, I cannot really comment on your use of it, but from a cursory look, things seem fine. Your secretPlainBytes variable seems spurious; I suppose it is the message which you will then encrypt with the agreed-upon key (resulting from the DH key exchange), using code which you don't show.


SEToolkit cloned website can be viewed over internet, but does not harvest credentials

Look at the HTML source, where is the form posting to? My guess is that it's configured for an internal address, which would cause your issue, since nobody else will be able to reach it by its internal address. Change the action= attribute in the form tag to be the public facing IP address.


Will the Credential Management API now available in Chrome 51 be widely adopted?

With all new browser recommendations and drafts it is really hard to tell. But in it's current state it is unlikely to be widely adopted anytime soon.

For starters this is a draft. Not a standard. Nothing is finalized
and subject to be changed or dropped altogether. This is the biggest
reason vendors will not be rushing to implement it.
The next step is to become a recommendation. Becoming a W3C recommendation is what most vendors consider becoming a standard. But keep in mind it is still a recommendation. A vendor is not enforced to implement it. And all major browsers for one reason or another have rejected recommendations before.
If it becomes accepted for implementation there is no telling how long it actually becomes implemented. WebRTC for example was first introduced in 2011. But modern browsers didn't start adapting it until 2013-14 at the earliest. Many others such as Safari didn't get it into development branches until this year.
It also risks being beaten out for something better. As mentioned It isn't uncommon for it to take years for a recommendation to be
implemented. And it could be possible something new is proposed and the CM API becomes deprecated before it hits the stable branch of other vendors. A reason for this is a browser rolls out their own "standard" which other vendors wish to adopt. Or a glaring security flaw is found that sets it back or potentially tarnishes its reputation.


We saw URL-decoded PHP code. What does the code mean?

It is  testing payload for code injection bug by the tool netsparker. Someone might have started the tool on your site to test for PHP code injection.

As can be simulated on writephponline.com :-

url: http://www.writephponline.com/?997=7876876

payload:-

echo chr(78).chr(69).chr(84).chr(83).chr(80).chr(65).chr(82).chr(75).chr(45).chr(80).chr(72).chr(80).chr(45).chr(48).chr(45).(44353702950*(intval($_GET[997])*4567)).chr(45);


Why would someone trust DuckDuckGo or other providers with a similar privacy policy?

I'm the founder of DuckDuckGo. D.W. is right, if we were to violate our privacy policy we could get in a lot of trouble. Additionally, I've tried to be as transparent as possible on how we operate, both in our privacy policy and on my blog.

I've thought and explored external verification, from someone like the EFF for instance, but I don't think that really would do much to assuage the core of the comment.


Can Spectre be fixed in future hardware simply by purging CPU caches?

Any side-effect of speculative execution that is visible can be used. There are some (perhaps many) side-effects that don't involve the cache at all.

From the Spectre whitepaper:

  ...  In this section we explore potential combinations and conclude that virtually any observable effect of speculatively executed code can potentially lead to leaks of sensitive information

  ...

  Instruction Timing.

  Spectre vulnerabilities do not necessarily need to involve caches.  Instructions whose timing depends on the values of the operands may leak information on the operands. In the following example, the multiplier is occupied by the speculative execution of multiply R1, R2. The timing of when the multiplier  becomes  available  for multiply R3, R4 (either for out-of-order execution  or after the misprediction is recognized) could be affected by the timing of the first multiplication, revealing information about R1 and R2.

if (false but mispredicts as true)
  multiply R1, R2
multiply R3, R4


Would our company system be more secure using a VPN?

Absolutely, yes. If your users are happy with the (minor) additional effort to access the service, VPN is a great idea. Requiring a VPN will be more secure even than requiring HTTPS access to the server, because you can then tell the firewall to block all traffic to the server from outside, dramatically reducing the attack surface.

You should of course not stop at the VPN. Since this service contains a lot of important data, you will want to secure it comprehensively.  Some key areas to consider are:

"Hardening" the server(s) - disable unneeded services, make sure your patching process is good, etc.
Securing the application - You already mention configuring the server to only respond to local requests and limiting login attempts - good ideas, do them. Consider requiring SSL anyhow. Consider two-factor. Use well established security libraries instead of trying to implement your own. Have good audit logs.
Secure policies around the app - segregation of duties, account closure processes etc. Train the users to use good passwords.
Don't forget there are three parts to the CIA triad - Confidentiality, Integrity, and Availability are equally important aspects of security.

The above uis a very sketchy overview. You'll find more info about these many areas by looking around the site: and of course ask more questions!


How much can someone see from my iPhone by connecting to my wifi

If you are transmitting anything through WiFi then an eavesdropper can capture all the transmitted packets and analyze the data. Thus, anything you transmit should be encrypted (using TLS preferbly).

And dont rely much on the WiFi encryption as most of the time (other than WPA2 enterprise), as it can be cracked by someone who knows the pre-shared key and recorded the handshake.

Otherwise, if there is an app that allows remote access or file sharing then someone may be able to hack into your phone. Especially if your iPhone is jailbroken, then  1 out of 20 iPhones/iPads can be hacked in less than a minute.

And lastly viruses, trojans and malware can also intrude on your privacy once you are connected to the Internet. Again, this happens only if your phone is jailbroken. Because according to here, there are no known iOS viruses that can infect an iPad or iPhone that has not been jailbroken.

Because iOS implements something called sandboxing, which restricted the resources that each app can use. So, a malicious app will have a hard time accessing data stored in other apps unless it is jailbroken.


How to protect printers from being hacked

Don't leave your printer exposing port 9100 to the internet.

This large-scale printer attack is nothing new. It's happened previously and is very simple to execute.

The attacker likely used Shodan to scan the entire internet for printers with port 9100 open to the internet. Due to way RAW printing over port 9100 works, all is required after this is to connect to the printer on port 9100 TCP and send the text you want to send to the printer.

Preventing this attack

All you need to do is close port 9100 externally. If there is a requirement to print remotely, this is possible in a number of ways:

Use a VPN to connect to the network, making the printer accessible as if it's in your local network
Use a different printing protocol

IPP. This is designed to be used over the internet and has built in support for authentication.
Google Cloud Print


Is there a benefit to Diffie-Hellman parameter rotation?

Naively it seems that rotation of parameters would marginally increase security in the event that one particular set of parameters is compromised, but this seems unlikely. Does anyone have input on this?

This is correct. Rotating parameters protects from  precomputation attacks against Diffie-Hellman. Any individual DH group can be subject to an extremely intensive precomputation after which each individual key agreement step can be broken very rapidly (sometimes even in real time).

The biggest danger is in using small, popular groups which various government agencies have very likely managed to attack, judging by analysis of the Snowden leaks. Generating your own group, even if you do it just once, is sufficient to protect against all but the most serious cryptanalysis efforts.

Of course, the best solution is to just use a large group (at least 3072 bits) and call it a day.


How important is local time for security?

You have a bunch of questions rolled in there.

  I guess NET::ERR_CERT_DATE_INVALID means that an HTTPs certificate is not valid.

Yes.

Here is the cert for help.ubuntu.com:

You'll notice that it has Valid From and Valid Until dates; if you try to access a site protected by this cert outside of these dates, your browser will complain. The reason certs expire is (among other reasons) to force webmasters to keep getting new certs using the latest crypto and other new security features in certificates.

When your browser is trying to decide if it trusts a certificate, it uses the system clock as the definitive source of truth for time. Sure, it'll try to use NTP, but if you (the admin user) have explicitly told it that the NTP servers are wrong, well, you're the boss.

  If an attacker can arbitrarily change the system time, which kinds of attacks allows this?

Let's consider personal computers and servers separately. I haven't done any research here, just off the top of my head.

Personal Computers

Users often play games with their system clock to get around "30-day trial" type things. If you're the company whose software is being used illegally this way, then you would consider it a security issue.
Spoofed websites. It's much easier to hack old expired certificates -- maybe it used 10 year old crypto that is easily cracked, or maybe the server was compromised 6 years ago but the CAs don't track revocation info for that long (idea credit: @immibis' answer). If an attacker can change your system clock then you won't see the warnings.

Servers

Logging. When investigating a security breach, if your servers' clocks are out of sync, it can be very difficult to piece together all the logs to figure out exactly what happened and in what order.
Logins. Things like OTP 2 factor authentication is usually time-based. If one server's clocks are behind a different server, then you could watch someone enter an OTP code, then go use it against the server that's behind because that code won't have expired yet.


Place database in the DMZ and in the internal network

Your question is a little vague, so I would advise that you consider what threat models you're trying to protect yourselves from.

The first thing to do is to define that a DMZ is a region in your network which is considered wholly or partially untrusted, because it is attached to the Internet (or some other untrusted and hostile network). The DMZ defines a security boundary between that infrastructure and your internal, more trusted environment. That security boundary is usually enforced by a firewall or similar network controls. You might be saying "yeah, I know this", but I've seen people completely misunderstanding the point of a DMZ and I want to make sure we're on solid ground.

My understanding is that you're concerned about keeping your database in the DMZ along with the web server, because you've got internal equipment from your trusted network connecting into that database. This is a common configuration, and many people do indeed get by just fine by allowing connections from the trusted network to the database in the DMZ.

However, one thing to consider is the authentication model. If you're authenticating to an MSSQL server in the DMZ via AD, and your domain controller isn't in your DMZ (I hope it's not!) you'll need to allow that AD traffic through the firewall. This isn't a good idea, really. So, utilising database replication to sync data through the DMZ boundary so that the inner database can be authenticated to via AD, while the outer (i.e. DMZ-based) database doesn't need to speak to the DC, is actually a pretty good solution.


If you are on a home connection the best solution is to restart or turn off your router for 5 minutes so you get a new IP address from your ISP ...if you still get ddossed because of skype or another program  IP grabbing use a VPN or contact your ISP about the problem


What to do with a PGP/GPG key to which I've lost the private key?

You normally would revoke the key:

Revocation is described in the link to another question on ask Ubuntu.

Basically:

  The "OpenPGP way" to remove old keys is to mark them as revoked by
  uploading special revocation certificates. These will tell other
  OpenPGP users that your key is superseded.

  Revoking keys is not possible if you don't have access to the private
  key, defined a designated revoker or a pregenerated revocation
  certificate.

Unfortunately, as you don't have access to the private key you wont be able to. Instead, you'll want to generate a new one and, if possible, let your contacts know via some other medium that your key has changed and they will need to use the new one. Often people post keys on twitter or to some other location only they control. If possible change your keys there to a new key and this time be sure to setup a revocation cert.


Is it technically possible to determine the identity of the creator/uploader of an image on Twitter?

No. Like the comment said, Twitter strips metadata for a while now. So unless you provide hints and do nothing worth a subpoena, you'll be safe.


Metasploit Starts attacking multiple targets, results in "address is already in use"

This error has nothing to do with attacking multiple targets. The error is due to the fact that the handler which is used to receive and interact with the incoming sessions are unable to bind to the port 4444. This means either another job (handler within MSF) or another process is running on the port. Run netstat -anpl | grep :4444 on the Linux prompt to determine which process is currently listening on the port. If can run the jobs command on the msf console as well to see if any prior jobs are still running. Run jobs -K to kill any running jobs and then run the exploit command again. You can change the LPORT of the payload as well to make the handler listen on another port.


Not all links are restricted to your initial request; if you include the protocol (e.g: http or https), then you can jump between both.  If you just have relative URL locations (such as: "/dir/page.php" instead of "https://site.com/dir/page.php"), then you'll stick to the same protocol.

Websites can implement Hypertext Strict Transport Security, this will force a browser to only use the HTTPS protocol for a website. The drawback is that the initial request remains vulnerable if it was done over a non-SSL channel.

When you asked about other ways that are possible, depending in your browsers mixed content handling, but an attacker could inject JavaScript in cleartext requests and access your DOM.


Can my company view my PAST browsing history of what I've done at home with *my personal* computer and *my personal* network?

No. Your history is not actively communicating for anything to be seen - hence the name "history".  If this were a work computer, it would potentially be a different answer because they could have logging or monitoring software to track its activity and upload the "history" as soon as you connected it back to the office network.  Since this is your personal computer, unless you allowed them to install some kind of logging or monitoring software, there's nothing for them to be able to see because they have no way to access your system.


Why doesn't my LoadLibraryA (LLA) hook prevent a dll injection that uses CreateRemoteThread + LLA?

It sounds like you might have already figured out what's going on (I'd have to look at the code in question, ideally running in a debugger, to say for sure though). However, I want to point out that this just doesn't actually work at all. At best, it's a speedbump that will break fragile payloads, but a knowledgeable attacker can bypass it easily. Here's a few ways, in roughly increasing complexity:

Use a different function, like LoadLibraryW or LoadLibraryExA (unless that internally calls LLA at some point, but I doubt it).
Use WriteProcessMemory (WPM) and VirtualProtectEx (VPX) to un-hook LLA, using the attacker's version of the function as the template.
Use WPM VirtualAllocEx to write the binary code of LLA into the target process, and inject your thread at that entry point.
Just dump the payload of whatever DLL you wanted to inject into the target's address space and enter that.
Do everything that LLA does (including stuff like ensuring new threads call the library's DllMain), but remotely to the target process, before even spawning a thread in it.

In other words, even if your hook prevent calling CreateRemoteThread to the address of LLA, it doesn't actually do anything significant against DLL injection in general.


Would the CORS specification consider a missing Content-Type header to imply a "simple header"?

The main idea behind the content-type restriction is that XMLHttpRequest with CORS  should not weaken the default security compared to what already can be done within the traditional security model. The traditional security model allowed the following cross-origin requests:

Simple GET requests created by the browser. That is no payload and thus also no Content-type header.
POST requests created by submitting forms. These have a payload but the Content-type (attribute enctype) could only be application/x-www-form-urlencoded, multipart/form-data or text/plain.

Anything outside of what could be done with such simple requests and form submissions must be handled more strict by default so that no new attack vector gets created. This includes any kind of custom header and any setting for content-type which are not sent by the browser by its own.


Are spam invites on Google calendar dangerous?

it is not dangerous unless you open a link, or open any kind of attachments.  of course vulnerability in Google calendar is another issue. (like zero-day exploits that are out of your hands).
in general enable two step security on your account, install update asap, and you are ok.


At the end of the day, if the computer is owned by a single user AND is inside a secure network, it shouldn't be too terrible storing it as plain text. Of course, problems might arise if the user leaves his computer unattended - But since the API you're using doesn't return session keys (which is really odd...) there's no real better solution.

Additional security you could implement is protection from XSS so the credentials don't get stolen by malware, and making sure the session storage is properly deleted after a set amount of time.


What are potential security risks when using an insecure wireless connection?

but if I rely on HTTPS (assuming a valid certificate) for all sensitive browsing, (banking, social media, e-mail, etc.) then is there still an issue?

Yes and no. It has been demonstrated that HTTPS can be circumvented, giving the user almost no clue that this happened. You can read more about this here: SSLSTRIP

On the same site you can read about a vulnerability that IE had which made HTTPS not secure (IE Basic Constraints vulnerability. Even if this vulnerability has ever since been patched, this shows that even if HTTPS is secure in itselft, one of its implementations can be broken and therefore make you vulnerable to an attack.

Finally, this article explains five ways in which you could break HTTPS.

This doesn't mean of course that HTTPS is not secure or that it's useless, far from it, but you shouldn't feel 100% safe when you are using it.

  Also, I know that it is as well trivial to obtain a user's MAC address, but I am not aware of any dangers associated with this. If I understand correctly, a MAC address is no different from a physical address, and poses no harm in the wrong hands.

It can indeed be a problem. There is one type of attack, called ARP spoofing, which allows an attacker to impersonate another computer on the LAN, thereby receiving all the packets originally addressed to the legitimate user.

This is a little different from the scenario you are picturing (obtaining another user's MAC address), because here the attacker tries to associate its own MAC address to the IP address of the victim, but it's just to show you that MAC addresses can be used to attack.

  Open ports are dangerous, is this why? In my specific case, I use things like MAMP, could this be a vulnerability if I were to use it while connected?

The answer in the link you posted is very good. Yes, you are more vulnerable than you would be without leaving that port open, because it's simply another way through which a malicious user could attack you.

  But more and more I am starting to think that with the proper counter-measures, using an open network can be no different to using a WPA/WPA2 encrypted network.

It is different, because if you encrypt your network, an attacker would first need to enter your network. If the network is properly encrypted, this could mean a huge work for the attacker, who could then simply decide that it's not worth it :)

  Assuming that I don't care about others mooching off of my internet, what are the downfalls?

As Lucas pointed out, you are responsible for your network. Suppose that some kind of illegal activities take place on your private home network, you are the one who will be held responsible (it already happened). It would be difficult, at this point, to prove that you were not involved.


It depends on the nature of the data if you are storing. Ultimately it is a security/convenience trade of.

Using strong encryption before you save it to the cloud is very secure as long as your key is strong. The draw back is you lose many features of GSuite as you are effectively now just storing binary blobs.

You also have the problem of sharing yours keys with who ever wants to view the data.

Another option may be to use GSuite for all non sensitive data and roll your own solution like own cloud for sensitive stuff. This does mean you need to set up and secure you own service and server but it gives you total control.


The tokens one gets from OAuth are basically service specific passwords. These are issued in order to allow third party services limited actions in the name of the user without the need to share the users real password with these services. Given that these tokens don't allow anything more than the the users password (usually they allow less) they also don't need to be treated any better than the users password in transport, i.e. TLS is considered sufficient.


You have to use an externally-specified character set:

$ egrep 'mixalpha-numeric ' charset.lst
mixalpha-numeric           = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]

$ crunch 19 19 -f charset.lst mixalpha-numeric -t @@@@-@@@@-@@@@-@@@@
Crunch will now generate the following amount of data: 2577832796941975552 bytes
2458412930433 MB
2400793877 GB
2344525 TB
2289 PB
Crunch will now generate the following number of lines: 16730961306185695232

I think crunch's math is off a bit there - Wolfram Alpha tells me that 62^16 is 10^28, which is 47672401706823533450263330816 (which is quite a bit bigger - 10^28 combinations)

Either way, it should be obvious that this wordlist, applied to WPA2, will not exhaust in your lifetime.

For faster hashes with smaller keyspaces, generating the candidates on-GPU (with something like hashcat or John the Ripper, which allow you to specify the mask for generation directly on-GPU), would be much faster. But for WPA2 it's probably slow enough that it won't make a difference.


To prevent fraud, you need a sufficiently low probability of the attacker guessing any valid code.
For 1 million cards, a 10^16 code will be guessed on the average each 10^10 attempts. If your site is completely secure and your API is brute force resistant, numeric should suffice to keep that approach to fraud not cost-effective.

But it's very brittle security, and the hashing protection below will be easy to crack in a database leak with such a small keyspace. IOW, an attacker with access to your DB will be able to brute-force a lot of valid codes. An alphanumeric code will provide more robust security. You can also compromise using a pattern for user-friendliness.

Since in your system the code is effectively both a login and a password, to reduce their leakage you need to change the communication protocol to eliminate transmission and storage of plaintext codes.

The simplest protocol for that would be to store Salt1 and SaltHash1=hash(Code+Salt1), then transmit Salt1 to the client, create Salt2 at the client, generate hash(hash(Code+Salt1)+Salt2) client-side and check it against hash(SaltHash1+Salt2).

That remains vulnerable if your database is compromised, as the attacker only really needs a list of valid SaltHash1 to make purchases through your API. It's also slow as you have to hash all valid codes to check one.

To make it more robust, you can rather transform all the codes with a PBKDF like Argon2id, which is a slow and irreversible function, and only store the result. Using a slow function ensures an attacker with a leaked database cannot easily brute-force all 10^16 codes to find all that fit and simulate a legit user. You still have to trust the stores not to store the code and enforce HSTS (https-only) connections.

It's impossible to make this system secure against a rogue store that logs user input - if they have the complete code, they by definition own the card. The only defense is to only permit code redemption through a form loaded directly from your server (it can be embedded in a third-party page). If you do that, no one but the user and your PBKDF ever sees the code; the store just gets your validation response.


Does TLS provide server authentication by default?

RFC 8446 (TLS 1.3) says:

  Implementations are responsible for verifying the integrity of
  certificates ... Absent a specific indication from an application profile,
  certificates should always be verified to ensure proper signing by a
  trusted certificate authority (CA)

The spec seems to say that verification needs to be supported, but doesn't exactly require it (SHOULD vs MUST), and leaves it up to the implementation and application.

There isn't a single "TLS" either. There are many different implementations, although OpenSSL is probably most common. Reading their wiki, it seems that the defaults are fairly sane and should handle verification.

However, the application gets to decide if verification is actually used. So it's possible that a poorly developed application may have verification turned off.


When you search it (apt-cache search metasploit) you see that the package is called metasploit-framework. So you can install it with apt-get install metasploit-framework -y.
And you should use apt-get update before to get the latest version.


Block unauthorized user from getting access to intranet

There are different ways of tackling this:

Disable unused ports (which should obviusly be the first line of defense)
Using port security on your switch makes it at least necessary that an attacker finds out a certain MAC address and connects to a specific port, which will stop most people from plugging their home devices into the company network. In addition to this you may activate a "suspend" mode for ports: The 1st time an invalid MAC address is detected on a port it will shut down and has to be reactivated manually by an admin.
Radius would obviously the most fitting solution for your problem. You can configure your Windows DC as a radius authentication server and then have your switches forward the authentications request using 802.1X. The result would be that anybody trying to access the network would have to enter their username and pw used on the DC. If it is not correct they will be isolated in a separate restrictive VLAN. Disadvantage: You need hardware that supports 802.1X and have to understand VLAN concepts. I will not go into details of RADIUS here. If you are interested feel free to ask.


Is it safe to use Redis to store username and hashed passwords?

I don't see any problem with using Redis if these conditions are both met:

You trust your network between your application and your Redis instance, since Redis lacks native support for SSL.
Your Redis instance requires authentication.

The user:username key shouldn't be a problem neither, as long as you correctly handle username changes (creating the new cache entry, and deleting the old one).


How to safely reinstall Windows in Thailand - avoiding BadUSB/SSD

First of all, there are plenty of tutorials on how to factory reset any massive storage device. For example, you can delete all it’s partitions and start a new full NTFS drive; it should be enough.

The danger is that you can’t reset the USB before it infects the computer where you mounted the drive, right? So we would need something like a sandbox or a discardable place to clean the USB.

_

Option 1

Running the USB in a coffee shop where you can pay for some minutes of computer usage. If something happens there, you shouldn’t worry.

Option 2

Mounting the drive on a discardable operative system. Whatever happens to the OS (I would suggest a Linux because it is easy to install and discard), you later delete it.

COMMENT: I’m not taking into account those tryhard USB devices which contain viruses by default or shall affect your BIOS or anything weird. Just a regular USB stick to which a virus has been set into the default storage.
Hope it helps!


Which benefits personal anti-spams bring w.r.t. e-mail provider's ones?

The only reason that I can think is to improve the detection on the service provider. For example a message that is not label as spam from the provider(the detection is not correct or the MTA don't have the signature or rule to detect that sample) and the user label as spam and report the issue so the provider can add new rules/signature for detect the issue. This mechanism is easy on this example but can be complicated depending on the environment, you can think for example on if the provider receives 10 messages from different users that label as spam then generate the rules/signatures, but basically is the same concept.


Attacker circumventing 2FA. How to defend?

Not all two-factor authentication schemes are the same.  Some forms of 2FA, such as sending you a text message, are not secure against this attack.  Other forms of 2FA, such as FIDO U2F, are secure against this attack -- they have been deliberately designed with this kind of attack in mind.

FIDO U2F provides two defenses against the man-in-the-middle attack:

Registration - The user registers their U2F device with a particular website ("origin"), such as google.com.  Then the U2F device will only respond to authentication requests from a registered origin; if the user is tricked into visiting goog1e.com (a phishing site), then the U2F won't respond to the request, since it can see that it is coming from a site that it hasn't been previously registered with.
Channel ID and origin binding - U2F uses the TLS Channel ID extension to prevent man-in-the-middle attacks and enable the U2F device to verify that it is talking to the same web site that the user is visiting in their web browser.  Also, the U2F device knows what origin it thinks it is talking to, and its signed authentication response includes a signature over the origin it thinks it is talking to.  This is checked by the server.  So, if the user is on goog1e.com and that page requests a U2F authentication, the response from the U2F device indicates that its response is only good for communication with goog1e.com -- if the the attacker tries to relay this response to google.com, Google can notice that something has gone wrong, as the wrong domain name is present in the signed data.

Both of these features involve integration between the U2F two-factor authentication device and the user's browser.  This integration allows the device to know what domain name (origin) the browser is visiting, and that allows the device to detect or prevent phishing and man-in-the-middle attacks.

Further reading on this mechanism:

An excerpt from the FIDO U2F spec, regarding defenses against MITM attacks.
Yubico's explanation of the protocol flows.


Unable to use PUT method on server seemingly allowing PUT

What you see in the nmap scan is the response to an OPTIONS request. It simply says that these are the things the webserver will accept (i.e. are not disabled).

That does not mean that the webserver has a means for implementing those requests; typically PUT/POST/DELETE will be handled by some sort of logic engine outside the webserver itself. Similar for the webDAV commands - but these will usually only be exposed where webDAV is explicitly installed (the webDAV module is an external component).


TL;DR: Report that your card has been compromised to your bank and ask for a new one.

You are the victim of a credit card fraud. Your bank (Bank A) noticed a suspicious activity with your debit card and froze it.

As techraf said, report that this activity was indeed fraudulent to your bank. If some unauthorized transactions were approved, you can reclaim your money. Your bank will send you a new credit/debit card.

As soon as the card is frozen, nobody is able to use your card details anymore. Your new card will have new details, thus you won't have to worry about the previous one being compromised. It won't affect the new one.

We can't tell how your current card has been compromised. Perhaps the website is not as trustful as you though, or perhaps something else happened, like:

Someone saw your card and wrote down the relevant information;
The website uses HTTP to transmit your card details to the server;
Your computer is compromised;
An in store credit card database leaked
…