The higher education institution that I attend uses Eduroam

If you are using eduroam, then you are connecting to your wireless network with some form of 802.1X authentication and the wireless infrastructure must support WPA2/AES per eduroam requirements (they may additionally support WPA or TKIP).

802.1X uses a supplicant on the client device that connects to a RADIUS server to authenticate. The vast majority of eduroam authentications use EAP methods that utilize a TLS tunnel from the supplicant to the RADIUS server to protect user credentials. (I have only personally seen statistics from eduroam US, but for those 99.99% of authentication attempts use EAP-PEAP, EAP-TTLS, or EAP-TLS).

Once you are authenticated, unless the wireless deployment is old (pre-802.11n) or poorly implemented AND your wireless device doesn't prefer WPA2/AES, your wireless traffic is secured using AES encryption that is negotiated using unique keying material generated during your authentication. The use of TKIP (predecessor to AES) causes a wireless network to disable HT/VHT data rates (802.11n and newer data rates) so isn't even available on most wireless networks utilizing 802.1X authentication today.

  I am a bit concerned about the risk of sensitive information (such as login details) being stolen while I use the internet at the institute I attend (such as through other malicious users on the institutes LAN intercepting my traffic.)

Since you seem primarily concerned about malicious users on the network (and in the sake of brevity), I am going to disregard concerns about your school/staff intercepting traffic or your data being captured due to compromises on your device. Especially since you don't provide any information in those regards.

Assuming the use of AES encryption, your traffic is secure between your device and the access point (AP) of your school. Since AES encryption employed in wireless is still considered secure, no other device will be able to capture and decrypt this traffic.

Once your traffic reaches the AP, there would need to be some sort of compromise on your school's network for your data to be compromised. But then most services you access will be using TLS to encrypt traffic between your application and the server (for example, HTTPS in your web browser), especially when passing sensitive information (and if it isn't I would be more worried about that information being passed unencrypted on the Internet than even a compromised school network).

There is a possibility of compromised data if you let your device connect to rogue AP impersonating your school's wireless network. Most EAP supplicants provide protection from this in some way, either through configuration or at least providing you the option to confirm that the RADIUS server/SSL certificate your device is presented is valid. So make sure you configure this in your EAP supplicant or actually confirm the information you a about to approve is valid.

  This may just be my paranoida, but do I have anything to worry about my information being stolen while connecting my personal laptop to my educational institutes network?

Never hurts to worry about information being stolen, and not just when connecting to [insert service here].

During your authentication when connecting to a "eduroam" wireless network? No (as long as you are connecting to your school's RADIUS server). Even if you connect to eduroam at another school, the TLS tunnel is formed between the EAP supplicant on your device and your school's RADIUS server.

From users capturing wireless traffic between your device and the AP? No, 802.1X and AES on wireless is still generally considered the most secure method of connecting to wireless (as long as you are connecting to your school's RADIUS server).

From your school's network being compromised? No more so than any other traffic you send over the Internet (i.e. you should assume traffic over the Internet is compromised so sensitive information should be encrypted).

From your school or their staff capturing data? Possible but probably unlikely. Of most concern would be if your school is one that has implemented some form of TLS intercept (most school's do not).

From your device connecting to a rogue AP or your device being compromised? Absolutely, but then again in the first case you aren't really connected to your school's network (and there isn't a good reason for someone to impersonate your school's network) and in the second case it wouldn't matter to which network you were connected.


PCI-DSS requires you to be compliant if you store, transmit, or process credit cards.  Although you are not storing them in full, does the full credit card number ever reside (even temporarily) on your site?  If so, you are subject to the SAQ-D.

The only level (singular) you potentially qualify for is the SAQ-A which deals with merchants who have ecommerce or mail/telephone order transactions.

SAQ-A states

Your company handles only card-not-present (e-commerce or mail/telephone-order) transactions;
Your company does not store, process, or transmit any cardholder data on your systems or
premises, but relies entirely on third party service provider(s) to handle all these functions;
Your company has confirmed that the third party(s) handling storage, processing, and/or
transmission of cardholder data is PCI DSS compliant;
Your company retains only paper reports or receipts with cardholder data, and these documents are not received electronically; and
Your company does not store any cardholder data in electronic format.

SAQ-B is for merchants who use card-reading devices.

SAQ-C is basically for businesses that use Point-of-Sale computing systems or virtual terminals.

SAQ-D is for everyone else.

It sounds like card details are entering your system.  Even though your intentions are to use a third party processor, this is not the intention of SAQ-A.  SAQ-A is meant for third-party processing such that the card details NEVER enter your system (think Paypal).


Need advices on API key & secret generation?

I think you're confusing the security requirements for client IDs and secrets.

Client ID: Must be unique, better if unguessable. While they are typically not publicly advertised, they are not treated as carefully as secrets are.
Secrets: Must be unguessable and kept private. A potential leak of a secret is a security incident, requiring immediate revocation of the key.

What your client IDs look like is sort of a matter of taste. The examples in the oauth.com site you reference includes keys of varying sizes and formats. A random number is a fine choice. Something like (in pseudocode):

clientID = base64Encode(secureRandom(16)); // 16 bytes, 128 bits, 22 characters

In some situations you could use a non-secure random number, but there are situations where that may lead to predictability. So just stick with the secure random number generator - it's only a little slower and guaranteed to be safe.

The only way to generate a secret is with a secure random number generator:

secret = base64Encode(secureRandom(32)); // 32 bytes, 256 bits, 43 characters

Secrets should never be stored in clear-text. Encrypt them and store the encryption key somewhere secure.

You mentioned GUIDs, but even the random version 4 ones vary by implementation, some being secure and others not. So I'd just stay away from them. You also mentioned SHA256 and SHA512 hash algorithms. It is possible to use those in the calculation of a random number, but it's complex to get that right. Just stick with a secure random number generator and you'll be safe.

As you are already using Spring, RandomValueStringGenerator is probably a good choice for the implementation. Just create generators of the correct number of bytes. You can also look at the source code of that class for reference.


Why should canary values be chosen at runtime instead of compile time?

A canary value chosen at compile-time is constant from run to run, across all copies of the program.  This means an attacker can figure it out by analyzing the program; once they know it, they can set up their overflow attack so that the overflow over-writes the canary with the same value it had originally, making the attack undetectable.

If the canary value is chosen at runtime, on the other hand, an attacker needs to guess it on the first try.  If they guess wrong, the attack will be detected; ideally, this would trigger the application developer to find and fix the bug that permitted the overflow in the first place.

A minor benefit is that it increases the security against brute-force attacks slightly: for example, an attacker trying to guess a static 32-bit canary through trial-and-error will need to make an average of 2 billion guesses, where a runtime-chosen canary will take an average of around 3 billion guesses because the canary can change to a value the attacker has already tried.


When do governments allow export of cryptography software?

From this Apache link, ECCN 5D002 can be summarized as:

Software specially designed or modified for the development,
production or use of any of the other software of this list, or
software designed to certify other software on this list; or
Software using a "symmetric algorithm" employing a key length in
excess of 56-bits; or
Software using an "asymmetric algorithm" where the security of the
algorithm is based on: factorization of integers in excess of 512
bits (e.g., RSA), computation of discrete logarithms in a
multiplicative group of a finite field of size greater than 512 bits
(e.g., Diffie-Hellman over Z/pZ), or other discrete logarithms in a
group in excess of 112 bits (e.g., Diffie-Hellman over an elliptic
curve).
Software designed or modified to perform cryptanalytic functions If
the cryptographic functionality is limited to one of the above
definitions, it should be classified as ECCN 5D002, and the remaining
two steps should be taken (described below). If the release may
contain cryptographic functionality beyond what is described above,
please contact the ASF Vice President for Legal Affairs.

In a nuttshell, it appears to mean that if it is software that encrypts with keys above a certain strength, it gets classified as cryptographic software. But I don't speak lawyer, so~


How to find a wep key inside a pcap file with only 2 IV?

In order to break WEP you need to catch 2 packets with the same key and reused IVs. The number of packets in order to break the key depends on the length of the IV, but you usually need more than one thousand.

In your case probably your 3 packets do not share the same IVs. This means that you cannot break easily the key. Your only way will be brute forcing the key and for that, you do not need any live attack.

You can use airdecap-ng for bruteforce the key.


How to securely store passwords for an online team based password manager?

An easy apporach would be that you could store the Passwords as PGP Encrypted messages where every member of the defined group is considered a recipient (for example GPG Keychain on Mac adds your on key as recipient per default so you can decrypt already encrypted messages to others).

So one user wants to add a password he encrypts it with pub-keys of his teammates and all can decrypt it with their private keys. still if the DB gets hacked nobody can decrypt it without the private keys of the team members.

If you store your Private Keys properly this could be a relatively safe alternative


Using Ipod touch at work: Can they tell what I am looking at?

Short answer is yes, it is possible for the Access Point owner to monitor which sites you connect to. It is also possible for them to work out that the IPod Touch is yours either through sniffing HTTP traffic or by monitoring the devices location and usage time compared to your building access records and desk location.

If you need to install any app or certificate to connect to your corporate WiFi it is far easier for them to do this.

Given it is possible, are they, is a different question. Most company IT departments are not interested in tracking down what sites you are on, specially on your own devices.


Your IP is blacklisted for a reason, not just because you use Burp or Appscan. A possibility is that they have a mechanism to detect:

Too many connections to the site
An offending User-Agent
Too many malicious HTTP requests

Try to discover first how or why it classifies you as malicious and try to circumvent then the protection.

Web sites does not usually blacklist IPs. Usually legitimate users do a lot of requests to a site so blacklisting them should easily would cause DoS events.

An offending User-Agent is a possibility, but I think with a low probability. Try changing the User-Agent to something friendly.

The last possibility, in the case it is really blacklisting your IP, is that they implement a WAF. The WAF is detecting malicious packets. Try WAF bypassing techniques to avoid the WAF blacklisting you.


Run XSS payload after syntax error in script tag?

If there is a syntax error inside a script tag, no code in the block will be executed, neither above or below it. So to get some code running, you have two options:

Fix the syntax error using the code you are injecting. Depedning on what kind of error it is, this may or may not be possible. E.g. closing a quote two lines up sounds impossible, but balancing brackets should be doable.
End the script tag with the syntax error, and start a new clean one. If there is no filter at all you can inject e.g. <script>alert("XSS");</script><script>-


As HTTP is the stateless protocol, which means a web server treats every request coming to it as an independent request i.e communication consists of independent pairs of request and response. So in order to maintain the session between client and server, cookies are one of the techniques to do so. There are various other techniques to maintain the session.

Cookies are the key value pair (for every unique key, a value is associated with it e.g. session_id = 12345). It is sent by the website and stored in the browser. The next time user visits the same website, the cookies are automatically sent to it.

Now coming to your concern "I visit, there is a popup that says that they use cookies", there is no issue regarding what cookies you receive from the website. A cookie on its own cannot do any harm to the system because it does not contain any code, but it can assist in attack, check Why is it necessary to scan cookies

Cache is the temporary memory which browser uses to make the user experience better by storing the frequently visited webpage information like .css files. It speeds up the process so that data does not have to be fetched from its original location and, therefore, saves time. From the end user point of view, one must not worry regarding security issues related to browser cache. As a developer, it is important to test the browser cache issues.


This is called step up authentication; I can't find any non-IBM references to it, but it has been discussed repeatedly in Identity Ecosystem Steering Group working group meetings.  I've been less involved for the past year, but this was one of those topics that we all recognize as valuable, but not urgent.  (so please, work on this, do the research and present a solution).

I thought I recalled mention of this in NIST 800-63, but I can't find it right now.   Closely related to your question, is what NIST calls "multi-token authentication" where multiple independent tokens are used in tandem to achieve a higher level of assurance.

  The Claimant presents token authenticators generated by two or more tokens to prove his or her identity to the Verifier. The combination of tokens is characterized by the combination of factors used by the tokens (both inherent in the manifestation of the tokens, and those used to activate the tokens). A Verifier that requires a Claimant to enter a password and use a single-factor cryptographic device is an example of multi-token authentication. The combination is considered multi-factor, since the password is something you know and the cryptographic device is something you have. NIST 800-63

If you can't find anything on step-up authentication, you might look for people who are working in multi-token authentication.

I think I've also heard this referred to as dynamic authentication, but it appears that Visa has absorbed that term for a proprietary technique, so I would discard that as a search term.


Is the convertomp3.com website hacked? :)

No, the site convertonmp3.com is not hacked. It is distributing malware by design. That is the business model of this and many other similar sites.

At the above link, you get a “Download with ConvertOnMP3.com Download Manager” checkbox which is ticked by default. (This did not appear for me until I browsed with a Windows web browser; YMMV.) If you click the download link without unticking the box then instead of the .mp3 you get a .exe file. That is the file virustotal is complaining about (note the filename is listed as “The_Supermen_Lovers_feat_Mani_Hoffman_Starlight_Official_Video.mp3.exe”.

The executable is a downloader from the pay-per-install programme at installpath.com (related domains: keenondownload.com, leadingdownload.com), which will then install a selection of adware depending on whoever is paying them at the time.


I'm just guessing without having read the book - but my guess is "Message Security" is how hard it is to figure out the plaintext when you just have the ciphertext, and "Key Security" is how hard it is to figure out the encryption key (when you have the ciphertext, and may or may not have the plaintext).  It's conceivable that it could be easier to decrypt a message without knowing the encryption key than it would be to figure out what the encryption key was.


You do not need Truecrypt or to encrypt the partition.
Encrypting the partition after removing it will simply supply a powerful overwrite. It works beautifully, but not because it's encrypting: just because encrypting a new, empty partition is, at most, exactly the same thing as overwriting the old one with random data.
On modern hardware, forensic techniques are not capable of recovering overwritten information economically. It is possible, but the cost is staggering.
Recovery is based on detecting redundant and residual information, but both types of information inevitably decrease when information density and I/O rate go up. Nowadays, both media density and speed are such that redundancy and residual are minimal, which means that recovering lost information requires technology, skill and time. All three are expensive (a magnetic scanning microscope capable of appreciating hysteresis residue at the single bit level is still priced at around one million USD).
So, overwriting is enough.
And if you really feel paranoid, you can overwrite the same information again (and again).
Suppose you want to make /dev/sda (the whole disk) unreadable. Just boot from an external medium (e.g. a Linux live distro) and run one of the following commands
dd if=/dev/zero of=/dev/sda bs=1G count=1 # Faster but incomplete
dd if=/dev/zero of=/dev/sda           # Faster
dd if=/dev/urandom of=/dev/sda        # Possibly more accurate

Zeroing the disk up to the first gigabyte kills the partition table and likely all metadata for the first partition. It is possible and reasonably affordable to recover most of the data on the first partition (past the first gigabyte); it is possible and easy enough, even for unskilled personnel, to recover the whole data for any further partition after the first one (sda2, sda3, ...). You can zero the first gigabyte of each partition first (use of=/dev/sdaX), then the disk, if you want to quickly trash all partitions.

Zeroing the whole disk makes the data utterly unrecoverable for wannabes, skilled people and recovery specialists. It is still maybe possible to recover something using ruinously expensive equipment. If you have a zeroed disk, do not send it to data recovery professionals as you would just waste money; but a black government lab with million-dollar equipment might be able to pick up the stray magnetism from the platters, and recover information from that. They would also probably have the budget for rubber-hosing the same information out of you.

Overwriting the disk with random information makes the data twice as hard to recover. See above. It also takes several hours for a large disk.

You can also, on some disks, trigger the SECURE ERASE procedure, which is like the above but done in hardware and somewhat faster. You can use hdparm for that using the --security-erase-enhanced flag if the HDD supports it.
A faster and more secure alternative (not always allowed)
I have now for three times "erased" the HDDs in laptops I had to give back by purchasing brand new HDDs from a local retail shop and swapping them. A 1TB 2.5" HDD costed about €80 one year ago. It saved me all worries of "data recovery" - you can't recover something that's never been there - and it took less than ten minutes to perform the swap. Plus, I have a full backup of all I had on those laptops, since I kept the old disks.
Given that I would have been charged more than €80 to perform a reliable secure erase on a laptop (I myself would charge you more than that), I feel I ended up ahead.
Of course, you need to be allowed to tamper with the laptop at the "screwdriver" level.
In the future
There are some disks that implement hardware based disk encryption. What does this mean? It means that upon disk initialization, in the factory, a unique code is generated and stored into permanent rewritable memory in the hard disk. From then on, all data sent to the hard disk will be encrypted using that code before being written on the magnetic platters, and will be decrypted upon reading.
From the user's point of view, nothing is different from normal. You could (actually you usually need to) encrypt again the data if you want to have it protected by Bitlocker or Truecrypt or the like. Since encryption speed is way faster than host data transfer rate, no difference in disk speed will be detected.
Except that now - if a command is sent to the hard disk to forget the encryption key and generate another - the whole content of the disk can be lost forever in a few milliseconds. Unfortunately, on these devices, if the controller board containing the key is damaged, the data is also instantly made unrecoverable (controller failures are usually recovered by replacing the controller with a compatible one. Here, the new controller would have no way of knowing the encryption key, and would thus be able to access the drive physically, but not to decrypt it correctly).
(This kind of firmware usually allows for the key to either be transparently used, as above, or specified or be further protected by a BIOS supplied key at boot time through a specific protocol called OPAL).
So, if you can get a laptop with OPAL/HDE capabilities, secure disk erasure would be a matter of a couple of minutes.


Analyzing Tor traffic through Deep Packet Inspection?

I found this question interesting.
I will try to answer to each question assuming that I consider DPI, in this case, equivalent to SSL/TLS Man in The Middle.
The DPI which only observe some clues in the cleartext parts of a frame (like in the paper you mentioned) are not able to recover the encrypted parts. This way could permit to block some Tor nodes but the privacy stay untouched.

A government could do it if it was able to own one of the hundred Certification Authorities (CA) embedded in the OS and the browsers. Maybe, in the large list of CAs, some of them are in Turkey and could let the government access to their private keys to sign rogue certificates on the fly. Then the government need to intercept the traffic at some point (with an ISP or in a place where the cables are managed) to substitute its certificates.
This way, it can observe encrypted content like VPN or SSL/TLS.
BUT this way is quite detectable. Someone who travel in turkey could save the displayed certificate of a website and see that it is different from the one from its own country.
The technology to perform this DPI is not a high level one. With the participation of the ISP, the cpu involved in the interception is not even the problem of the government except if it puts a black box in the ISP infrastructure (then this blackbox needs to decrypt/observe/reencrypt on the fly without lower the network speed).
The amount of resources needed to analyze all the traffic intercepted, and the storage capacity are quite very huge but not so so expensive for a government.
In this case DPI is all or nothing : you serve your certificate instead of the real one and the victim talk to you instead of the real server. Some kind of crypto attacks over the traffic could be used to retrieve part of the packet without performing a Man in The Middle, but the processing for each packet would be discouraging
Even if the government uses a huge DPI system over the national traffic with the participation of some CAs and ISP, without no one noticing this and without no disclosure from a whistleblower (in the ISP or the CA), some protections exist against this threat model as HPKP and Certificate Transparency. But, theoretically, if someone can make a complete DPI (read the encrypted parts) without being visible, yes Tor is useless in this case.
One action could be the use of a foreign VPN with a certificate signed by a foreign CA (a CA in Europe, USA, ...). Then, when you mount your VPN tunnel you could check if the root CA received correspond to this CA (if you see a turkish CA instead, there is a problem ^^) at this time you could abort the connection. If the initial connection succeed, the VPN will make all the further connections for you, outside of the influence of the government.

I'm not overskilled in this domain but I don't know any other way of feasible DPI than SSL/TLS Man in The Middle.
And this way is not stealth enough to be widely used without being identified in some days/hours.
So I don't think that Turkey implements it.


This is simply not possible. The reason for that is that the MySQL module of PHP does not allow one to append complete queries. So this won't work:

http://victim.com/index.php?id=1'; UPDATE anytable SET anyattribute='anyvalue' --

You also can't use UNION to append a UPDATE, DELETE or INSERT Query because it only allows one to join SELECT statements.

You can UPDATE a MySQL database through an SQL Injection only if the original query is a UPDATE query. And also this is much more limited than SQL Injections in SELECT statements to extract data.

But there is another way you might be able to alter data. In your injection you use the load_file function. If this function works you can use it to read the content of the .php files searching for the mysql_connect method which will contain the credentials for the databse. You can then with these credentials connect to the database under some conditions and query the database directly.

And finally: I strongly suggest you not to use tools like sqlmap till the moment you are able to exploit SQL Injections blindfolded and with one hand tied to your back because you don't learn much just using sqlmap.


SSL Handshake failure when antivirus is enabled

Check "Scan encrypted connections" option
It seems Kaspersky does SSL interception (Man in the Middle).

Kaspersky KB entry 6851: SSL connection scan by Kaspersky Anti-Virus version 6.0.4.x (Archived here.)

I would appreciate if someone could explain this behavior

Some clients may use certificate pinning. And those can not be easily Man-in-the-middled by using a different certificate. Try turning SSL interception off.
(Please tell me what clients these are! I'm curious.)
From Certificate Pinning:

One way to detect and block many kinds of MITM attacks is "certificate
pinning", sometimes called "SSL pinning" but more accurately called
"public key pinning".[229] A client that does key pinning adds an
extra step beyond the normal X.509 certificate validation: After
obtaining the server's certificate in the standard way, the client
checks the public key(s) in the server's certificate chain against a
set of (hashes of) public keys for the server name. Typically the
public key hashes are bundled with the application.

Just to clarify, this isn't an attack.  The man in the middle performed by Kasperky is used to scan HTTP traffic for malicious web data.  This is what they mean by Scan Encrypted Connections.

how I can bypass this without changing my customer's anti-virus settings

I don't know if this is possible. Depends on the client software. Google Chrome for example will not enforce pins for locally added CAs. (Archived here.) This is explicitly meant to allow SSL/TLS interception. Some other client software may not be so lenient.
Further reading

Sec-SE: Kaspersky Antivirus “secure connection scan” as broken as Superfish?
Hanno Böck, 2015-04-26, How Kaspersky makes you vulnerable to the FREAK attack and other ways Antivirus software lowers your HTTPS security (Archived here.)


Recommended operational security for generating one's primary key pair?

"Relatively free of malware" is probably not good enough if you're going to run the key generation on the installed OS, and probably irrelevant (to key generation) if you're going to use a LiveOS.  (I'm ignoring here the possibility of firmware exploits aka BadBIOS, since your threat model doesn't seem to encompass them, and they're basically impossible to defend against given the current state of things.)

Your process seems mostly reasonable, but keep in mind that even without the master private key, having your crypt & signing subkeys on those other machines does pose some risk.  While you can always replace them if they're compromised, that won't prevent someone from decrypting data that was encrypted prior to rotating keys, and they can still sign things as you until you revoke your key (and the verifiers pick up the revocation!).

Also, keep in mind that settings like cert-digest-algo SHA512 may cause interoperability problems with people using significantly older versions of software, particularly old versions of the commercial PGP.  If you're not concerned by that, then carry on.

For your paper backups, I'd look at Paperkey, which is written by David Shaw, one of the authors of RFC 4880 (the OpenPGP spec), which strips down the key to the bare components needed to reconstruct it.  This means you can print a much smaller key, increasing your likelihood of success when you go to scan+OCR or re-enter your paper backup.


How to trace who sent mail with attachment

You should contact Gmail abuse, if the headers clearly show the message is actually from Gmail and the message is against their policies or terms of use. If the From: address is spoofed, you can use mail headers to track the actual originating server, but it's likely a hijacked server without any actual connection to the offender. It's still worth to contact them, just to give them an advice to check their systems and remove possible malware.

The file may or may not contain some clues, but if it only causes harm without any benefit to the attacker, there's probably nothing. However, most malware try to benefit somehow, for example sending your confidential information somewhere, and following that information might get you somewhere. On frauds involving money the money is usually easier to track, but that would be job for the police. Frankly, that's when the damage has already occurred, and we try to prevent it.

Best way to handle this would still be to remove the message and move on. Spammers have been among us for decades and they aren't going anywhere. Sometimes they even come up  with something new, like the "self-abusing" blackmail scam; with Bitcoin involved it's impossible to track the money, and the perpetrator doesn't need access to the mailbox for the originating address.


EMV choose crypto method between SDA/DDA/CDA

I got it.
You have to the AIP field as follows:

To retrieve the AIP, according to "EMV Book 3 - Application Specification", use te Tag 0x80 Format 1 reply for GET PROCESSING OPTIONS contained:
x82: Application Interchange Profile (AIP),
x94: Application File Locator (AFL).


CSRF Origin and Referer Header just check host?

Not sure I agree with the premise that checking referer and origin headers is the best defence. In a few corner cases both of these headers will be missing. In these cases the only safe option is to block the request, which could break functionality for a few legitimate users.

If this is still the path you want to take, OWASP has a lot of good info on the technicalities:

Start with the origin header, and if it is missing use the referer header.
Again, if none of these are present, you must block.
Comparing URL:s might seem simple, but it is actually a very tricky thing to do. Make sure your comparison is sound, and e.g. that good.com.evil.com does not pass as good.com. That is just an example, I am sure there are more pitfalls out there. Preferably you should use a good well tested library for this task.
It's probably good to check that the scheme is either http:// or https://. Not sure if there are any attacks that can be used if this check is not done, but  god knows what clever tricks there are out there with data URI:s or what not.

If you want other options, consider the classics such as anti-CSRF tokens or double submit cookies. Or for an API, just using a bearer token in the authentication header does the trick.


How can I safely view the code of a VBA macro?

Microsoft Office fileas are actually nothing but glorified zip files. If you change the extention to .zip you can extract the content. There you should find the file word\vbaProject.bin that contains the VBA macros. However, as the extention suggests, this file is binary and is not much help in letting you read the source code.

Fortunately Microsoft has published the specs for the format, and there are a number of programs that can help you. I have not tried any of them, but there is a nice list on Decalage. Check it out for more details! These are the programs listed there:

olevba
oledump.py
officeparser.py
OfficeMalScanner

A minor detail: A docx file should not contain a macro, as those are not allowed in docx files. According to Microsoft:

  Word lets you save macros in two Word file types: a Word Macro-Enabled Document file (.docm) and a Word Macro-Enabled Template file (.dotm).


Why is caller ID spoofing so simple, and catching offenders so hard?

The simple answer is that this is not considered a vulnerability - the protocol stack is not designed to authenticate the caller.

From @schroeder's Wikipedia link on Caller ID:

  Additionally, nothing ensures that the number sent by a switch is the actual number where the call originated; the telephone switch initiating the call may send any digit string desired as caller ID.

There are various implementations in place around the world, but even (or especially) in the more recent ones there is functionality to replace actual ID with another one.

The reasons behind this are almost entirely historical - back in the day the call was completed by a human operator physically connecting a cable between caller and receiver. No ID was required. If the operator needed to connect to another operator in a remote state or country, all they would need to inform the other operator is the receiver ID.

As that was modernised, and machines replaced human operators, the process was still the same - a connection was built between based on the receiver ID, as the caller is already connected.

With the continuous move towards traffic being carried over IP rather than analogue lines, identifying information is becoming more available to telcos, so there will come a time when ID information should be available, but there still seems to be a business model for telcos to allow companies to pay for spoofed IDs, and as long as there is money in it - the service is unlikely to go away.


Is a pre-shared secret enough for encryption?

Yes!

Cyphers can take all kinds of forms. By definition a secret is all that is needed.

Doesn't mean it will be secure enough...

http://www.brighthub.com/computing/enterprise-security/articles/65254.aspx

EDIT:
If you're proposing to actually implement something like that in production, I would repeat the seasoned advice in other posts. Use already proven algorithms and libraries.
That usually means that, in your scenario, A encrypts with B public key, and B decrypts with B private key.

Also, consider once A or B falls, it's complete disaster. Attackers can fake any point in the network, create any message or read any messages that ever passed through the network or ever will.


Automatically import/deploy/distribute private key to users for use with S/MIME

What you are looking for is a PGP Key Management Server associated with some sort of desktop app like https://www.gpg4win.org

There are plenty of guides if you google/duckduckgo how to setup a key server


Should I return meaningful error code in case of internal error?

Which practice is better?

It depends on your needs.  There is no "secure" or "not secure", only "secure enough for my needs".  Which is better depends on your particular risk/benefit tradeoff willingness.  As such, this is rarely an answerable question in a security context.

  Does returning specific internal error codes can help attackers in their penetrations attempts?

Probably not.  You certainly shouldn't be returning stack traces or the like, but a vague error description is probably unlikely to help a would-be attacker.  However, a vague error description is probably also unlikely to be very helpful during debugging.  As a result I'm going to ask the obvious question:

Don't you have logging on in your system?

For instance, in my API calls if there is an error in production I simply return (a JSON document) that says "Internal Error" along with a 500 status code.  This works out well for our front-end developers.  When they see that they just stop and come bug me because they know the problem isn't on their end.  For my part, I then just go look in my server logs which tell me exactly what happened.  There is nothing that can potentially leak to outsiders, and I have all the debugging information I need to fix whatever the problem is.

In short, it sounds like what you need is some detailed logging that is only accessible internally.


Why am I able to bypass a website's authentication?

From development point of view, what is done wrong here that allows to bypass the authentication

Putting private content in a place where it can be accessed with no controls.

It seems that the website designer has written some php scripts that check the authentication details and serve up the content if it passes but has forgotten that he has put the actual content files in a place where the web server will just serve them up.

  and how should it be fixed?

The quickest fix would be to reconfigure the web server not to serve .html files from that directory but that seems like a band aid. Directories where secret stuff is stored should be kept seperate from directories to be served up directly by the webserver and ideally should be completely outside the "web root".


First off: notifying the police and three letter agencies that are responsible is exactly the right thing to do.

To your questions:

Not quite. But that does not mean that the attacker is US-based or that it's the attacker's bank account.

For all that matters, it could be the bank account of someone previously fished that has no relevant balance.

Using that as the destination for a wire transfer scam is tricky: it covers the attacker's identity and adds a false sense of security, as the destination account is with a US bank rather than some shady off shore bank.
No. Please just leave that to your government and the law enforcement agencies. Cross reference this question and its answers.


VirtualBox 3D acceleration security risk

'How likely' is kind of a hard question to answer. But I am going to try and analyze the risk to give you a feel for the 'likelihood'.

The main problem here is that your host machine (clean) is giving to the guest (potentially infected) unsupervised, direct access to the hardware drivers, in this case OpenGL and Direct3d. This access is only as safe as the drivers the guest can access.

Unfortunately, those drivers are not always secure and bugs in drivers are found very often. This should probably help us estimate the 'likelihood' of such malware.

To complete your understanding, consider the market for virtual machine escaping malware. At the last Pwn2Own competition, VM escape exploits fetched $105,000 to the winners. And that's for a reason. Escaping from a VM means you can compromise the underlying host, which defeats the whole point of virtualization (at least for security reasons).

So I'd say it is very likely malware will target drivers that reside in the host.


Are there any dangers in exposing git sha1 commit hashes?

As explained there, the SHA-1 hashes are identifiers for the stored objects, including commits -- they are computed deterministically from the object contents. There is no secret in there. Though SHA-1 is nominally one-way, this would theoretically allow an attacker, who wants to guess the contents of an object, to verify whether his guess is correct or not. This would entail guessing exactly, down to the last bit, including time stamps and other similar things.

If your object contains some secret data which can be brute-forced (e.g. a password, subject to dictionary attacks), then an attacker might use the SHA-1 hash as a test. This seems hard because of the condition on guessing everything else properly, but the possibility is there. Therefore, if your commit contains such secret data, you are right to change the hash value -- but in that case, don't change it slightly, because a quasi-match is as good as an exact match on hash values, for the attacker. Change the hash values completely: replace each one of them with a sequence of 40 random hexadecimal characters.

Note that knowing the hash values does not grant any other extra power to the attacker; in particular, they do not give him access to the repository.


How do you verify the key given by remmina (libfreerdp2)

freerdp is now displaying the remote desktop thumbprint in SHA256 format.  Before that, it was displaying it in SHA1 format.  Windows is still displaying it in SHA1 format hence when you look at it visually, the numbers don't match.
You can extract the certificate in Windows and generate a SHA256 for the certificate. Run the following on the extracted certificate:
openssl x509 -noout -fingerprint -sha256 -inform der -in remotedesktop_cert_der_x509.cer


Apparmor - how to 'allow everything' rule, then tighten up?

This is not the right approach.

In general, blacklisting is a poor basis for a security policy - it should be based on whitelisting - and the syntax of AppArmor is predicated on this. To that end, you should start with no specifics in the profile, but set the profile action to complain instead of enforce. You can set this in the profile (flags=(complain)) or using the aa-complain command. Then the specific directives to permit an operation become redundant.

I believe the authoritative documentation is that published by SuSE. But, briefly, for file access the config format is:

<object> <permissions>,

Note that the globbing in object (if its a path) is slightly different from what you may be familiar with at the command line. There's more dbus specific stuff here.


DMZ and LAN data exchange - what direction should connections be made?

What you're really asking is which direction TCP connections can be opened as that's what needs to be put into stateful firewall rules. The goal of having a DMZ is to provide a buffer zone that will limit the spread of malware and prevent hacked systems from accessing internal systems, so allowing DMZ systems to connect to systems in the LAN is inherently risky. It's safer to allow LAN systems to open connections to DMZ systems as it's hard to spread malware or hack systems through connections opened to a system. That doesn't mean you can't ever allow the DMZ to connect to the LAN, sometimes it is unavoidable, but it should be as little as possible.


Is using video editing software to fill SSD with junk video secure?

Generally, it is suggested to investigate if the SSD vendor advises a method for secure erasure of their product.

Often a security feature (like ATA SECURE ERASE) is present that will help you achieve secure erasure. The remaining risks here are:

The vendor built in method could have bugs and be subject to vulnerabilities and attacks
As this often involves discarding cryptographic keys from the SSD but leaves the cipher text untouched the standard of encryption we use at the present moment will eventually become subject to attacks in the future when computational resources are available to brute-force keys

While your method seems generally feasible I think we cannot answer whether this will fully wipe all data as it largely depends on the vendor implementation.

I think one known risk is that there is old data remaining on the media in unaddressable areas which would not be touched by you writing a video file.

However, maybe the more relevant question is for you to judge how sensitive the data is that was stored on the SSD? This should help to evaluate how thorough your erasure needs to be to arrive at the level of sanatization of the media you are looking for.


Keeping TrueCrypt keyfiles in plain sight

The KeePass documentation specifically recommends not to do this:

  ... The point of a key file is that you have something to
  authenticate with (in contrast to master passwords, where you know
  something), for example a file on a USB stick. The key file content
  (i.e. the key data contained within the key file) needs to be kept
  secret. The point is not to keep the location of the key file secret —
  selecting a file out of thousands existing on your hard disk basically
  doesn't increase security at all, because it's very easy for
  malware/attackers to find out the correct file (for example by
  observing the last access times of files, the recently used files list
  of Windows, malware scanner logs, etc.). Trying to keep the key file
  location secret is security by obscurity, i.e. not really effective.


Detect trojan/keylogger/virus on a businees network

You provide almost no information: I can barely deduce that you're running Windows from the software you used.

The key question is, how do you know that a computer is infected? This will probably give you the key about how to find out which computer it is.

Lacking information, I'll just list some of the almost infinite possibilities:

some files get accessed and damaged/deleted => you can check access logs where available, or check out network connections using, if nothing else avails, NETSTAT -na in a shell. The victim computer will show connections from the attacking IP.
information gets stolen. If you know this, it is because you found the information where it shouldn't have been. Try disseminating false information, different from PC to PC. If you later find that your corporate website has been accessed using passwordAssignedToEmiliosComputer, you'll know that Emilio's PC is the one to investigate.
the configurations or running images of the PCs are different. You can check the former using REGEDIT, even if it's time consuming, and the latter by running the task manager.
If whatever the virus does implies a lot of network activity, perhaps you can see it with a network analyzer, or by running a diagnostic on the switches, or... at the very least, looking at their blinkenlights (I had to do this once or twice).
Number the PCs from 1 to 50. Disconnect all even-numbered computers and see if whatever symptoms you observed cease. If they don't, try disconnecting the odd-numbered computers. If now they do, you're left with 25 PCs to examine. Number them from 1 to 25 and repeat. You're left with 12 or 13 PCs to examine. Then 6 or 7. Then 3 or 4. Then 1 or 2.


How to Edit Malicious Webpage in BindTCP

Browser Autopwn has a HTMLContent option, which allows you to show a custom page instead of the usual, blank one.

Quoting Rapid7:

  The HTMLContent option allows you to serve a basic HTML web page to the browser instead of having a blank one. It supports two syntaxes:

  set HTMLContent Hello world!

  The above example will basically print "Hello world!" on the browser while exploits are tested against it. Here's another one:

  set HTMLContent file://tmp/hello_world.html

  The above example will load file /tmp/hello_world.html and that's what the browser will see. Most likely the second syntax is how you'd want to use the Content option.

  Keep in mind that you should probably try to keep HTMLContent as simple as possible, otherwise there is a possibility that it might actually influence the reliability of the exploits, especially the ones that do memory corruption.

As an aside, this link is the first Google search result for "browser autopwn" "blank". I don't mean to be rude but I think that, before starting launching exploits left and right, you should be able to research issues on your own. Stackexchange and other forums can be useful, but when you're going to do this kind of thing as a job, you may not have enough time to wait for an answer.

Google (or DuckDuckgo, or similar alternatives)+man/show options/... will go a long way.


A proxy server is a machine that is relaying traffic on your behalf. You can't "download a proxy", you are (probably) downloading an application that connects to a proxy server. When you use a website offering a proxy web-app, it too is relaying traffic.

The question you linked to does not appear to assume that use of webapp-proxies - in fact the word "proxy" only appears once on that page.

A VPN is not a proxy server! A proxy server relays traffic on your behalf. A VPN creates a secure connection to a VPN concentrator, and from that point on your traffic will enter and exit the gateway of the destination network.

Does that help? (I don't understand the part of your question concerning "attacks through the browser").

I suppose you could download a Virtual Machine configured to act as a proxy, but I'm sure this is not what the question is asking :)


How does limiting the number of results from a SQL query help?

limit how many results get returned

This sounds a bit silly. It is possible to exploit a SQL injection even if the query returns no result, or even if the results are not displayed at all.

In case you wonder: if you can inject something that can trigger a data-dependent database error, or application error, or make it return zero or one result, then you can query the database for boolean tests, like:

email REGEXP "^[a-k]"? yes
email REGEXP "^[a-g]"? yes
email REGEXP "^[a-d]"? no
email REGEXP "^[e-g]"? yes, no need to ask!

keep narrowing it down... Then with a bit of patience, a script, dichotomy, and regexps, you can dump any line in any table, including information_schema which should be your first target btw. A while ago some guy bragged on a french forum about his site being safe with one such vulnerability, two hours later I had all passwords, which were stored in cleartext inside an old backup copy of a table somewhere inside a schema he had forgotten about...

Also, said willing victim thought magic quotes were safe. So I couldn't inject any ' but... CHAR() can build any string just fine without any '...

It is also possible to make the server run a very long and intensive query (a kind of DOS attack) which returns no result, so the LIMIT won't help in this case either. For extra LULZ you can make the query lock every row with a SELECT FOR UPDATE then hang until the page times out with a huge UNION. This DOS'es the whole website.

Also if you can inject a "--" or a ";" to comment out the rest of the query, then the LIMIT is of course, commented out. Timeless classic, set id=" OR 1; --" in the forum "delete your own post" thingie and ... tada!

DELETE FROM posts WHERE id=1234 OR 1 -- LIMIT 1

IMO the best way to avoid SQL injection is to use a framework or DB library that makes it more convenient and faster to use the safe method instead of the unsafe method. Then, there is no temptation to cut corners...

Some implementations of bound parameters fail this test, because they are inconvenient to use and/or badly designed. Consider the following PHP/PDO example:

$stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email) VALUES (?, ?, ?)");
$stmt->bind_param("sss", $firstname, $lastname, $email);
$stmt->execute();

This uses three lines of code instead of one. Even worse, the variable types are hidden somewhere inside the bind_param call, they are positional, and inside a string which will be duplicated all over the code. Plus if you have 20 columns, which one is the int when the type string is "sssssssssssssisss" ? OK, move the cursor, count the characters, one, two, three... Also the type is given by a char, so when using postgres and your column is of type "array of ints" or "polygon" it won't work so you'll have to revert to an unsafe method, perhaps quote manually... aaargh...

$req = $bdd->prepare('INSERT INTO decisions(decision, numero, publique, date, ip) VALUES(:decision, :numero, :publique, NOW(), :ip)');
$req->execute(array(
    'decision' => $want,
    'numero' => $nombremagique,
    'publique' => $publique,
    'ip' => $ip
    ));

This is one step up, as the parameters are now named instead of positional, which is a lot easier to use. But you still have prepare/execute, which (unless using PDO's fake prepared statements which I believe only work on MySQL) results in two database roundtrips, which means the safe method is slower than the unsafe one. This is also a failure, because the safe method should be the best, the easiest to use, and also the fastest if we want to avoid temptation of cutting corners...

A much better option in this case would be to use an ORM. Create an object and do object->insert(). If the ORM is good, it will check the types, and handle the queries in a safe way.

For raw queries, my favorite interface is python's DBAPI, I will use psycopg2 as an example:

conn.execute("SELECT * FROM ... WHERE firstname=%s AND lastname=%s", (val1,val2))

It only takes one line, one database roundtrip, it is fast, arguments are automatically escaped and converted according to their types, even user types can have custom encoders/decoders added, it handles unicode, basically it does everything.

data = {'firstname': 'Bob', 'lastname': 'Smith'}
conn.execute("SELECT * FROM ... WHERE firstname=%(firstname)s AND lastname=%(lastname)s", data)

Named arguments can also be used. This is usually more convenient, as the arguments will usually come from something like a form library, which would deliver them packed into a dict/associative array.

So, to answer your question, I would be wary of random tidbits like "add a limit" ; a systematic approach is much better, like I said the interface used to query the DB should make the safe choice the obvious choice, faster, easier, more convenient, etc.


IT support and security concerns regarding local VM's

Technically speaking there is very little risk in running an insecure VM on a secure machine IF that VM does not have network access (after all this is how you research malware). If it does have network access then you've essentially just circumvented all security safeguards.

From a security perspective, assume that your VM will be insecure and thus full of malware (let's just assume). If you have the VM completely isolated from the outside world and therefore your own system, it's perfectly benign. This is akin to a proper biological lab with a hot agent -work gets done, people go home, no problems. If you were to have network access to that VM, it's akin to that same biolab but leaving the doors open.

As a developer, I constantly run into problems like this and to be honest, changes/exceptions like this generally are not a decision your employer can make. The security policies are devised when the contract is created. You just have to do your best to work within them.

As per your comment, there are no real secure ways to truly 'limit' the VMs network access because it is inside the host PC (and thus its network). At the VM level there are very strict (not invulnerable, but strict) methods in place to prevent network access if you deny it as setup. If you choose to enable say a certain port during setup that introduces so many vulnerabilities associated with that port.

As you stated, your company allows you to RDP to your machine at work. While personally, I find this a huge security risk, this does give you some options...

The simplest option is to simply RDP out to your machine at home and do some heavy unrestricted lifting there.

None of these methods are the most efficient for a programmer nor are the security policies in place to make things easy.

I would suggest opening a dialogue with your employer and outline your frustrations. If there is something you need and do not have then that is a legitimate concern. In the world of contracting there is very little room in negotiating just how tasks are done.


Does StackGuard prevent Format String Attacks

No, StackGuard is not intended to protect against these types of attacks, nor does it in practice.

StackGuard specifically targets buffer overflows. When a buffer on the stack is overwritten, an attacker typically tries to overwrite the saved return address at the top of the stack frame. StackGuard inserts a canary value before the saved return address, and typically checks that it matches the known good canary before returning. If it doesn't match, then there was an overflow attempt and the program should exit.

Format strings are not buffer overflows and usually do not have the same goal. While a buffer overflow blindly "smashes the stack", format string exploits are a bit more precise. If you wanted to change the saved return address and knew the stack address where it's located, you could write directly to that address, leaving the rest of the stack (and canary) intact. This provides greater flexibility for an attacker in many cases, since buffer overflows don't allow you to simply skip over the canary.

StackGuard also has no affect on the GOT overwrite you mentioned, since this doesn't affect the stack at all. The proper mitigation to GOT overwrite is full RELRO (Relocation Read-Only). Due to startup performance costs of full RELRO, most binaries (and gcc defaults) only use partial RELRO. Partial still leaves the .got.plt writable, which is the part used for this type of attack, so it is not effective for preventing format string attacks either.

The -D_FORTIFY_SOURCE=2 option to gcc prevents strings stored in read-write memory from using the %n specifier, preventing an attacker from overwriting memory. It does not prevent read primitives, however, so an attacker may still be able to leak critical data from the stack (e.g. the canary).


Strange unsolicited email sent to almost never used email address

A critical piece of information is, is your old mail account - not its password - easily guessable and related to you?

For example, my old ADSL company by default assigned me an authenticating username (only valid on copper, so totally superfluous - if I can authenticate at all, then I'm physically connected!). I never used it anywhere.

But if my name is Mario Rossi and my email is mrossi@gnail.com, and I use ThatProvider, then I surely have also a Mario.Rossi@ThatProvider.it address.

I too set up a forwarding, thinking that the company would send there some email of interest to me (such as "Service Interruption Next Thursday"). (Actually they never did, and used my public email address instead. But I sort of forgot/didntcared the forwarding in place).

And so a coupla years ago some smart guy generated

for name in MostFrequentItalianNames:
    for surname in MostFrequentItalianSurnames:
        address = name + "." + surname + "@ThatProvider.it"

and let fly with a million emails. I got two of them.

(On an unrelated note, it got even better. From my IP on a Usenet post, my name and surname could be garnered as well as the fact that I was a ThatProvider customer. A targeted attempt using "Name.Surname@ThatProvider.it" as login, and passwords from { Name, Surname, admin, password, apritisesamo, pippo, pluto, topolino... } on my home router HTTP remote administration interface immediately followed).

So, if your old account is similarly generated, and there is a relation between your old name/surname and the domain being offered OR some googleable connection between same, this could have happened to you too.


Security of AES against known plaintext attack if no IV is used?

You've described an Electronic Code Book (ECB) system, which is inherently vulnerable regardless of the encryption algorithm used to encrypt the data.  With an ECB system, an attacker doesn't care what cryptographic algorithm is used, he just passes plaintext in to the system, then compares the ciphertext results against the rest of the already encrypted data, looking for a match.  It is irrelevant if the system encrypts the data with AES, DES, uses a SHA-256 hash, or even uses the plaintext as a key to look up a random number from a database.

Conversely, that means that this type of attack reveals virtually no information about the encryption used.  Therefore, it isn't revealing any information that could be used to recover the key.

EDIT:

Based on your comments below, you're interested in what is called an "Adaptive Chosen-Ciphertext Attack", which is where the attacker can obtain the plaintext for any cipher message desired, and use it to attempt to recover information about the key, and then request further information based on what is learned from earlier iterations.  This is the "most powerful" of the family of attacks on cryptographic algorithms.  Encryption algorithms are specifically designed to resist the exact kinds of attack you're describing.

To have mathematical proof that an algorithm is secure against this is to pass an "indistinguishability test".  Given two ciphertext messages and one plaintext message, and the knowledge that the plaintext was encrypted to create one of the two messages, the attacker must not be able to do any better than making a 50/50 guess which encrypted message is associated with the plaintext.  Despite over 20 years of intense research by legions of well-respected cryptographers and mathematicians, no one has demonstrated the ability to attack AES-256 (or even AES-128) in this way.

Plenty of cryptosystems that use AES have been broken, of course, but those are due to other factors:  weakness in protocol designs (the POODLE attack, the BEAST attack, etc.); weaknesses in protocol implementations (the heartbleed attacks, cache-timing attacks, etc.), and weaknesses in implementations that lead to side channel attacks, (the Bouncy Castle timing attacks, differential power analysis, etc.)

The strength of AES (and most block ciphers) comes from cycling the plaintext through "rounds" of encryption.  Each round is where the bits of plaintext are scrambled differently according to the bits of the key.  This scrambled data is then fed back into the scrambling algorithm again and again.  After 10, 12, or 16 rounds of scrambling, the scrambled output is considered encrypted to the point where every single bit is indistinguishable from random data.

A different way to think of it might be to look at a chess board after a game has been played.  Does the final state tell you exactly each move that was used to arrive there?  To a novice, no, but a chess expert could probably figure it out.  So you take that mixed up chess board, leaving all the pieces still on it and add more pieces and play another game on top of the previous one; mixing all the pieces together again and again, and repeat that 9 more times.  Even a grand master chess player can't unwind the final state of the board after all those mixed up games.

Much research has been done using "reduced rounds" attacks on the algorithm, where they deliberately weaken AES by reducing the number of loops to the point at which they can identify bits of the key.  For example, AES-128 normally iterates for 10 rounds, but instead they may iterate only 8 times, and then learn enough about the key so they can beat the indistinguishability test.  But nobody has been able to unwind the full algorithm itself in such a way that they have learned anything about the keys.


In the bug report you linked, the developer tries to overwrite the password in memory. This changes only the memory contents and has no other side effects.

An optimizing compiler may change the code in any way it likes as long as it does not change the behavior of the program. The behavior of the program is its input and output, but not its memory contents. So if you overwrite a password in memory, the compiler is free to remove that, since removing it has no effect on the working of the program.

I think as a developer you need to accept the fact that you have no control over the memory contents, instead of fighting the compiler.


Hash a list of strings in a collision-resistant way

You can use the following canonical form of an array of strings:

<fixedLen1>string1><fixedLen2><string2>...

Implementation:

def list_digest(strings):
    import hashlib, struct
    hash = hashlib.sha1()
    for s in strings:
        hash.update(struct.pack("I", len(s)))
        hash.update(s)
    return hash.hexdigest()


Mobile phone is picking up 13 bluetooth devices and not sure what they are?

It doesn't take much to get up to 13 MAC addresses. For example, a family of four nearby with 4 cellphones, 3 laptops, a printer, a console game system, a internet router/gateway, an Alexa, a Kindle and a iPad would do it.

How many MAC addresses can you account for in your house? Laptops, desktops, cable internet modem or gateway, printers, tablets, game systems, Roku, Kindle, etc?


How to bypass the following PHP function

Basically, this kind of mechanism is known as blacklist validation. Blacklist validation is weaker because a skilled attacker could evade your validation functions or send values that your function did not expect.

There are so many ways to bypass blacklist filters: https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

For your block of code, I used an HTML-encoded payload and it worked for me. Reason is your list does not account for this type of payload.

If you want to mitigate the XSS risk, then you should do:

1) White-list validation at server-side

White-listing only passes expected data using a regular expression for validating the data.

2) Contextual-output encoding:

See https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet.


What are the security implications using a Refresh Token in a SPA using Authorisation Code Flow + PKCE

Spec-compliant authorization code grant does not issue refresh tokens, that's one of many reasons why it's recommended. (Implicit grant also does not issue refresh tokens). With authorization code grant you're supposed to obtain a new access token without a refresh token by either relying on the existing authorization server session and performing the authorization code grant redirect again or via an iframe a la OpenID Connect.

The overall topic of protecting a refresh token is well documented in oAuth 2.0 Security Best Current Practices (BCP).


Nessus doesn't find self-written plugins

It seems that nessus-update-plugins doesn't only fetch the newest updates from the nessus servers, but also tells the daemon about the new files that are placed in the plugin folder.
So /opt/nessus/sbin/nessus-update-plugins does the job.


Why would Tor not be vulnerable to this easy-sounding attack?

GCHQ / the NSA considered this to be a viable approach to attacking Tor in 2012, see slide 22 of their Tor Stinks presentation, where they discuss creating lots of slow nodes advertised as high bandwidth.  (Slide 19 is related, but focuses on compromised networks and end servers.)

The end goal of course, is to force your target off the Tor network onto a less secure network.


Generate every alphanumerical combination in crunch within 8-20 characters in length

I think this is a strange one, some people say that the word list would be too big, but surely with some common sense and basic odds. There must be a way to reduce the size. Firstly can't crunch split the password file up for you, I haven't used it but im sure i read it can. Granted you'd still have allot of smaller files.
But then think about wifi passwords you never see these passwords have more than 3 or 4 of the same digit next to each other. IE AAAAgjrienfoe or fnen3333kfk (not saying it doesnt exit) So if you figured a way to delete all instances of this you would reduce your password size significantly. Then if you split your password list up onto multiple computers, again reducing the time. If you had 50 Raspberry Pis it wouldnt take as long as if you had 1.
There's always ways to reduce time and combinations.


Detected virus in pdf - should I be worried (CVE-2014-8449)?

CVE-2014-8449 "Integer overflow in Adobe Reader and Acrobat 10.x
  before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows
  attackers to execute arbitrary code via unspecified vectors"

This means that it was possible to provide a malicious pdf that, when opened with Adobe Acrobat Reader (older than those versions, when they fixed the bug), the attacker could execute malicious code (such as downloading and executing a more-advanced virus).

So yes, it's a reason to be worried. Could it be a false positive? Maybe. I don't know the certainty of that rule. I would certainly not open such file with a vulnerable version (unless I was attempting to trigger the virus).

  Should I just get rid of the pdf?

Probably. Where does the pdf come from?


Does every modern buffer overflow require multiple exploits in end user devices to be utilized?

It depends on your definition of "exploit", what piece of software you're targeting, and where the bug is.

For example, if I found a bug in Chrome's renderer (i.e. the thing that draws webpages on your screen) that gave me code execution, I'd only have code execution in the sandboxed context of the renderer process that runs in low integrity mode. I'd then need to find a sandbox escape (e.g. via exploiting a bug in one of the privileged Chrome IPC services offered to the renderer process) that allows me to gain code execution in a higher privileged Chrome process, then possibly another bug to escape API restrictions or other sandboxing protections. However, if I were to find a bug in the privileged Chrome process itself that was somehow possible to trigger from JavaScript, I would probably need only that bug.

By comparison, if I found a bug in Call of Duty 5 that let me gain remote code execution from a corrupted voice chat packet (using that example because voice chat is usually direct peer-to-peer) then I might get immediate code execution as the user.

Bypassing mitigations isn't itself considered an exploit - we usually refer to it as a technique. You may have to leverage multiple techniques in order to build a successful exploit, and those techniques may have to rely upon problems or mistakes in the code or build config, but those problems aren't generally considered vulnerabilities. As an example, a process might have ASLR but load a DLL which was not configured with ASLR enabled, allowing an attacker who was building an exploit to utilise the fixed address space of that module in order to build a ROP chain. The lack of ASLR on that module might be raised as an issue alongside the actual vulnerability, but most would not consider it a vulnerability on its own.

You're correct that it is generally difficult to bypass all mitigations on modern systems. The exploit mitigations on modern operating systems are generally doing their jobs well. On a heap use-after-free bug in a Windows application that has CFG + (Hi)ASLR + DEP + ACG + EAF/IAF enabled you're pretty much relying on pure luck that the bug you found and the memory layout you're presented with gives you enough control to be able to come up with a workable JOP chain. This often requires great skill and weeks of work. Ultimately the exploit mitigations are designed to increase the cost of developing working exploits when vulnerabilities are found, and I would say that the economics of building exploits on properly configured modern software is shifting further away from the attackers' favour.


Why does Sage Ransomeware blacklist League of Legends, steamapps, etc.?

I'm guessing these games are fairly large (GTA V is 10s of gigabytes). Therefor, it would take a considerable amount of time to encrypt these which increases the chance of being detected. Often these games store the profiles in another directory which might be included in the encryption process. The game can be reinstalled but the profile might not be recoverable.


A second bank card arrived with the same PIN

What's the use of hashing a 4 digit PIN? You only need 10.000 rounds to get the PIN back, even if each PIN has its own salt. They are probably stored encrypted, for local employees etc, but for an engineer working there it won't be a big problem to get the PIN out of the database.


This is unlikely to be secure for a number of reasons. Primarily XOR is only secure for a one time pad - you are reusing the key (your "seed" is the key here).

If a party knows any individual secret they can calculate the seed - and hence read all others. I.e. secret([known]) XOR [knownValue] yields seed. This entirely defeats the point of having multiple unique secrets - you could just as well use the seed value everywhere as your secret.

  The user will get a result even using a wrong seed and he doesn't know if he got the correct secrets.

Are the plaintext secret values random binary? If not an attacker can just brute force trying seed values then manually reviewing seeds that provide only printable characters for each key. If the secrets are words or phrases this becomes even easier.

Why are you trying to re-invent the wheel? You have basically described an offline password manager with very poor encryption. Why not just use an offline password manager which uses a modern trusted secure encryption scheme?


Strange browsing problem, unknown images

It's really hard to tell with only this much information. Investigating this could be a forensics challenge rather than a simple Q&A. Some things to look at:

Does it only happen on your computer, or also on smartphones or other computers in the same network?
Does your computer only do it on your network or also elsewhere? (If it's a desktop computer, I guess you can't test that.)
Does it also happen when you boot a Linux live boot (e.g. Ubuntu)?
Are there strange things running at startup? See task manager (ctrl+shift+escape) -> startup tab.
There are probably processes you don't recognize, but perhaps something strange jumps out, so are there weird processes running?
Did you download an illegal version of Windows? Since 10 is free I can't imagine why but if you did, that might contain viruses by itself.
Where are the images located? If you right click on one and then click something like "open in new tab" or "view image" or "show properties", what URL is it hosted on?
What is the last thing you did or installed before it started again? You might be using a fake version of certain software, e.g. when downloading Ccleaner you might have used the wrong download button. Many ads are fake download buttons, trying to get you to download fake software.

Etc.


How did Anonymous use UTF-16 ASCII to fool PHP escaping?

First of all "UTF-16 ASCII encoding" is a contradiction, since UTF-16 and ASCII are mutually-exclusive encoding schemes. But presumably he's just referring to using Unicode to bypass filtering mechanisms.

The general principle is this: we often think of characters encoded in ASCII -- "A" is the number 65, "z" is the number 122. But that's not the only character encoding scheme; because the world uses more than just the English alphabet, we need to represent far more characters than that. Hence, Unicode, which has representations for pretty much every character in every language ever written, from Sinhala to Klingon.

Representing all those characters (approx. 1.1 Million possible, not all in use) in a numeric form is a real challenge. You could use 32 bits, but that's a waste of space since 3 of the 4 bytes are usually zero. You could use a variable length, but then you can't do constant-time substring operations. So a number of standards exist, one of which is UTF-16 (which you probably guessed uses 16-bit characters).

Not all programmers are used to the idea of dealing with multiple character sets, even though the underlying framework will often support them. So sometimes filtering rules or precautions will be established using the assumption that characters will be represented in UTF-8 or ASCII, which they usually are.

So the filter looks for a given string, like \" for example, which in ASCII and UTF-8 correspond to the pattern {92,34}. But in UTF-16 it looks different; it's actually {0,92,0,34}, which is just different enough to slip by a filter that wasn't expecting it.

And while the filter doesn't understand UTF-16, the underlying framework does, so the content gets normalized and interpreted just the same as anything else, allowing the query to continue unfiltered.

EDIT TO ADD:
Note that PHP is exceptionally poor at handling character encodings; and if anything, that's understating the issue. PHP by default treats all strings as ASCII, meaning internal functions such as strstr and preg_replace simply assume that all strings are ASCII-encoded. If that sounds dangerously inadequate, that's because it is. But in their defense, remember that PHP predates UTF-16 by about a year, and all this is supposedly fixed in PHP version 6.

In the meantime, the mbstring library was created to address this deficiency, but it's neither widely deployed nor undersood. If you're lucky enough to have this extension available to you, you can use mbstring.overload in your php.ini file to force internal string-processing functions to be replaced with multibyte-aware alternatives. This can also be activated using the php_admin_value directive in your .htaccess files.

Another useful function is mb_internal_encoding, which sets the encoding used internally by PHP to represent strings. By using a unicode-compatible internal encoding, you may alleviate some nastiness. At least one reference I read (but unfortunately can't find now) suggests that by setting the internal encoding to UTF-8, you enable additional processing on inbound strings that normalizes them to a single encoding. On the other hand, at least one other reference suggests that PHP behaves as stupidly as possible in this regard, and simply slurps data down unmodified irrespective of its encoding, and lets you deal with the aftermath. While the former makes more sense, with what I know about PHP, I think the latter is just as likely.

As a final alternative; and I mention this only partly in jest, is to just not use PHP and instead adopt a better-designed architecture. It's hard to come up with a framework this popular that has so many fundamental problems as PHP does. The language, the implementation, the development team, the plugin architecture, the security model -- it really is a shame that PHP is as widely deployed as it is. But this is, of course, just an opinion.


How long is too long being out of InfoSec

I've had spurts where I've been out of infosec for years. Was it too long? No, it was very easy to catch up. If you're competent, infosec, like many other skills, is like riding a bike.

The biggest thing you have to worry about is explaining the gap in your resume, as WhiteWinterWolf states. Employers don't want to know you were out of work because you wanted to help raise a baby. What if your wife gets pregnant again? Off you go, huh?! You said you're changing countries, though... that is a perfectly valid excuse.

But this is opinion-based...


Is the content of my RAM kept if the OS is shut down but the PC is still running?

Main RAM is DRAM: it keeps its contents as long as it is regularly refreshed, and the refresh is done automatically by the hardware. Thus, as first-level approximation, RAM contents are preserved across a reboot.

However, there are various ways by which the RAM contents from before the reboot may not live long:

During a reboot, control is passed to the BIOS. The BIOS may perform a quick on-boot "RAM test" which involves writing and re-reading the complete RAM contents. Whether the BIOS does that depends on both its brand, and its configuration. If it does, then the data contents are lost.
The OS, right after boot, considers that the previous RAM contents, if any, are to be ignored. From its point of view, the RAM is "free", and the OS will begin to use the RAM for its own usages. In particular, RAM will be used as a cache for disk access, so all bytes read from disk after boot will go through RAM until it is filled up. Such RAM usage, mechanically, destroys the information which was there before.
In any case, when an application asks the OS to provide some RAM, the OS takes care to zeroize the contents of that RAM. Even if old data lingers from the previous boot, applications won't see it. If you want to inspect scraps of data from before the last boot, you will need to do it with some kernel-level tricks.

In other words, previous RAM contents may linger, but the whole of the system is designed to ignore such data, so you won't easily observe it.

When DRAM ceases to be refreshed, in particular when it is unpowered, it loses its contents in a matter of seconds or, at most, minutes (this depends a lot on the chip details and the temperature; see this answer for some pointers on that subject).

Cold boot attacks are attacks that try to plunder data from RAM after a power-down or reboot. The attacker tries not to let the normal OS boot up, as this process will necessarily use a substantial amount of RAM and thereby destroy its previous contents.


Email tracking is typically accomplished by embedding a transparent, 1x1 image in the body of the email message. The image is hosted externally at a unique URL controlled by Mailgun, so Mailgun can track whether the image has been downloaded.

It doesn't matter whether your browser/email client downloads the image, or whether Google downloads the image and sends it to your browser. In the end, in order to show the image someone has to download it which will trigger the tracking alert.

It is not a foolproof method, since users who disable fetching of remote content and don't opt to show images won't download the image as you've discovered. In the opposite direction, some email providers automatically visit all URLs in an email to scan for malware, so the tracker can trip even if the user has not opened the email.


So you're running port 443 on a web server using plain HTTP (no TLS/SSL)?

Best practise is to close any ports that are not being used.

It depends on where the web root for port 443 is configured to look on your server. If this is the same location as your normal website then this could be a risk if there are certain items that need to be secured via configuration that is missing on this second webroot's setup.

If it is configured to look elsewhere, then files could be unintentionally exposed.

It is not a security risk to your users because they will not see https:// or the padlock in the browser address bar. They would simply see http://example.com:443/ which gives the same security as port 80 would (http://example.com/).


This almost entirely depends on whether you're temporarily or permanently dropping privileges.

In the case of temporarily dropping privileges, it's actually ill-advised to call setgroups with a single group as you'll be wiping the list of ancillary groups, potentially making it impossible (without external intervention) to restore the process back to its original privilege level.

In the case of permanently dropping privileges, it is important to clear the ancillary groups list in order to make it more difficult for an exploit to re-instate privileges after they are dropped. The problem arises when you attempt to do this the wrong way around: if you setuid to a non-zero value first (meaning you're no longer root), then call setgroups, the effective uid of the process is now no longer root, meaning that the internal setgid call fails. Doing it the other way around doesn't have this problem because calling setgid first doesn't alter the effective uid of the process, allowing setuid to be called.

More info can be found here:

CERT C rule POS36-C
Dropping Privileges in setuid Programs


What is a practical example of an action that violates the non-interference model?

The non-interference model is all about preventing covert channels through shared resources or inference attacks.

An example can be the following:
Suppose that two users of different security levels are working on the same system (remotely, using shells for example).
The lower level user should not be know anything about the work done by the higher level user. But, he can infer things through observing shared resources as the cpu utilisation or the disk usage: the ability to do that creates a covert channel.
Another example: say that the lower level user is working on a file, and suddenly the file gets locked because a user with higher privileges has opened it and is reading it. By observing this, the lower level user can infer what higher level users are doing right now, which leads him to have knowledge he should not permitted to have (this knowledge would be the fact that he knows the file is important enough for someone with higher clearance to read it).


Can a virtual machine be used instead of the host?

Yes it is possible but unnecessary in your case.

People often use VMs to isolate potentially malicious applications from their main host and to have some sort of rewind button to restore the VM to a previous state in case something goes wrong in there, but looks like that's not what you want to do.

To defeat forensics all you need is full disk encryption with a strong key (long passphrase or key file), which will be impossible to defeat if done correctly; note that I said forensics and forensics only, if you're dealing with someone that can alter your machine while you leave it unattended (evil maid attack) you'll need to look into sealing your key into a TPM which will only unseal them if the machine hasn't been altered (on Linux there's TrustedGRUB which appears able to take advantage of a TPM but I didn't try it).

Your solution is a disaster both in terms of performance (you do encryption two times, both on the host and in the guest, 2x more overhead with only marginal security gain) and usability (as I said earlier, you can get the same security while getting native performance using full disk encryption).

As for deleting sensitive files on an unencrypted partition, you can use shred which overwrites the file multiple times, note that using it on an SSD is most likely counter-productive since the SSD's controller will write the new data on a different block of memory and not overwrite the same one, so in the end you'll only wear out your SSD faster; also note that while the file itself may be destroyed, your OS may keep fragments of the file or even the entire file somewhere else for other purposes, photo thumbnails for example; but none if this is necessary if you use full disk encryption assuming your key stays secret.


Extra EKUs set in client certificate a security risk?

It depends on your security policy. If your policy requires a separate certificate for each application/service, then it is bad. If your security policy allows single certificate use for multiple applications/services (where applicable), it is ok.

There is no universal approach, each has its own advantages and disadvantages. For example, when requiring separate certificate for each application, you increase administrative efforts (since you have to maintain multiple certificates), but reduce couplings. A failure in single certificate will affect only single service, other services are not affected.

When you reuse single certificate in multiple applications, you reduce administrative efforts (as only single certificate per device must be maintained). On the other hand, a failure in certificate will affect all applications the certificate is associated with.


Why doesn't IPSec ESP protect the IP-Header?

Yes, when using ESP the source IP address may be modified by an attacker.  But unless this results in an amplification attack I don't really see a point in doing that. An attacker who is in the position to modify the IP addresses can also just drop traffic or passively read it (if it is not encrypted), however, will not be able to forge new packets, no matter which protocol is used.

While the two protocols may be combined (e.g. use ESP only for confidentiality and AH for integrity), the integrity functionality provided by ESP affords about the same security with less overhead (especially when using AEAD algorithms), RFC 4302 (AH):

  ESP may be used to provide the same anti-replay and similar
     integrity services, and it also provides a confidentiality
     (encryption) service.  The primary difference between the integrity
     provided by ESP and AH is the extent of the coverage.  Specifically,
     ESP does not protect any IP header fields unless those fields are
     encapsulated by ESP (e.g., via use of tunnel mode).

So if protecting parts of the outer IP header (and extension headers) is not a requirement, ESP basically provides the same functionality as AH. ESP may even be used without confidentiality, RFC 4303 (ESP):

  Integrity-only ESP is an attractive alternative to AH in many
      contexts, e.g., because it is faster to process and more amenable to
      pipelining in many implementations.


Storing token in a cookie is not a solution to the CSRF problem. The CSRF vulnerability arises from the fact, that browser automatically sends cookies along with the request. As a result application considers that request as coming from valid (and authenticated) user. The only thing that attacker needs is the exact request that should be send. Introducing random Anti-CSRF token (request specific or session specific) causes it impossible (or just very difficult) to prepare valid request (in general case attacker doesn't know the valid value for anti-csrf token) and such a request will be dropped by server.

If you put your token in a cookie, it will be send to the server automatically, just as session cookie, so you don't get any additional protection from that.

EDIT:
I might misunderstood your question. You may be talking about so called double submitted cookies pattern where the same value is sent in hidden field and cookie.

Yes, this approach is acceptable when storing the CSRF token in session is problematic, you can read more about this here: Double Submit Cookies .