Many people falsely assuming that because the code rotates often, it is safe from brute force. This is not the case. If we assume 100 attempts per second and a code that is valid for 30 seconds, an attacker has 100*30 = 3000 guesses before the code rotates, this has a 3000 / 10^6 = 0.3% chance of success. This may seem low but this is only for 30 seconds, an attacker can try again for subsequent codes. For a 50% chance of success, they need only try for ln(50%) / ln(99.7%) = 230.7 30 second periods, or about 2 hours.

If you're not sure why rotating codes doesn't solve this, try thinking of it this way: an attacker can guess the range 000000 to 002999 for each code, and a code has a 3000 / 1000000 = 0.3% chance of being in that range, so after generating many codes there is a good chance that one will eventually fall in that range.

If you rate limit attempts to 1 every 5 seconds, it becomes ln(50%) / ln(99.9994%) 30 second periods, about 40 days. This still may not be good enough for a high value account, so I would definitely recommend additional measures to prevent brute force. What these measures should be though is harder to answer, as stated in the comments completely locking an account due to failed second factor attempts may allow DoS, and in general could be frustrating for users. It may be sufficient to log each attempt and warn the user to change their password if it passes a certain number of attempts per minute for the past day or so.

The Math

Let s be the chance of success for a single 30 second period
Let n be the number of 30 second periods
Let t be the total chance of success over all periods

If you have s chance of success, then you have 1 - s chance of failure. If you try multiple times, you can multiply the chance of failure for each try to get the total chance of failure, so (1 - s)^3 is the chance of failing with 3 tries, and 1 - (1 - s)^3 is the chance of succeeding in at least 1 of 3 tries. This allows us to come up with the following equation:

t = 1 - (1 - s)^n

Then we can solve for n given s and t:

(1 - s)^n = 1 - t
ln( (1 - s)^n ) = ln(1 - t)
n * ln(1 - s) = ln(1 - t)
n = ln(1 - t) / ln(1 - s)

So for t = 0.5 and s = 0.003:

n = ln(1 - 0.5) / ln(1 - 0.003)
  = ln(0.5) / ln(0.997)
  ≈ 230.7

If you want to know how long it would take an attacker to have a 99% chance of success with 6 tries per period (1 every 5 seconds), s = 6/1000000 = 0.000006 and t = 0.99, giving about 767,526 periods or 266.5 days. For a 1% chance at the same rate t = 0.01, which gives about 1675 periods or 14 hours.


What is the significant difference between a Rogue Access Point & Client Mis-Association

Client Misassociation just describes that the client will automatically connect to the device since it assumes that it is a previously trusted one, i.e. same SSID and maybe same MAC too. Rogue AP just means that the AP is malicious.

These two terms describe different aspects: It might be possible that the device connects automatically to a rogue AP due to client misassociation. But a user might also explicitly connect to the rogue AP since it believes that it is fine (i.e. trust sounding name like "Free City WiFi"), i.e. without client misassociation. And misassociation might also happen because of conflicting configurations and the AP does not actually need to be rogue.


It looks to me like a level of obscurity. In order to protect your admin account, the recommended way is to have a strong password, or even better an asymetric key on SSH. You can in addition provide a honey pot login named admin, but it does not add a lot of security, nor avoid logs examinations for real logins. IMHO, it would be mainly interesting if you were studying the behaviour of attackers, because no normal login attemps should occur on the honeypot.

As usually for obscurity, nothing is wrong if you do not rely on it but only see it as an additional protection level.


This is not a full answer but I want to highlight an aspect you did not mention. Apart from physical security (temper prevention and detection?) and encryption you have to be very careful what you are doing.

That means that no process having direct internet connection (web surfing, chat, skype...) or which has indirect connection (mail) should be able to access any sensitive data. The best would probably to have no internet connection at all. Another option would be to only access the internet through a companies VPN where you hopefully get the needed protection.

Unfortunately you often need direct internet access to at least establish a WLAN connection (because of capture portals) which you can use with your VPN. So one option would be to have a virtual machine and only do any connection from inside this machine.


How to Estimate time taken for Web Application Security Testing?

You cannot provide proof that it will take n days for the vulnerability assessment. You can provide them with an estimation.

When I scope an application for testing, there are a few things I look at. Most of it is what you've already covered.

What the application does (process money or HR data, or serve a blog)
How large the application is (a few URLs/pages or a lot; just content, or lots of functionality)
How complex the application is (size and complexity are not always the same thing)
How many roles are involved (eg user, admin, super admin)
Any APIs involved (eg REST, SOAP, custom)
Multiple clients involved (eg mobile, thick client, and web)

Like anything, it takes experience to be able to accurately scope an item for testing. You'll take in to consideration how long an application of similar size and complexity would take you to test, and scope appropriately. Depending on where you work, there may be a formula for x time spent on different types of functionality and other factors, that's up to your employer.

If you have the option, I would suggest listening to someone more experience on your team do the scoping so that you can understand how they do it and why they made the decisions they made. Under-scoping or over-scoping for a client can cause one or both of you issues. If you under-scope it, you or the person on your team may not have enough time to complete the testing, and over-scoping can cause the client to spend money unnecessarily. Mistakes are made of course, that's part of the learning process, but it's important to understand why things are scoped the way they are scoped before jumping in without the experience to back it up.


Ensure that a file can only be decrypted after a specific date

Time is relative. Cryptography lives in the ethereal world of abstract computing machines: there are machines that can do operations. Bigger machines can do operations faster. There is no clock that you can enforce; physical time has no meaning. In other words, if an attacker wants to get your file earlier, he just has to buy a faster computer.

Now one can still make an effort. You may be interested in time-lock puzzles. The idea is to be able to make a problem instance that is easy to build but expensive to open, where the cost is configurable. The solution found by Rivest, Shamir and Wagner (to my knowledge, this is the only practical time-lock puzzle known so far) works like this:

Generate a random RSA modulus n = pq where p and q are big primes (and also p = 3 mod 4, and q = 3 mod 4).
Generate a random x modulo n.
For some integer w, define e = 2w, and compute y = xe mod n.
Hash y with some hash function, yielding a string K that you use as key to encrypt the file you want to time-lock.
Publish x, n, w and the encrypted file. Discard p, q, y and K.

The tricky point is that computing y, in all generality, has a cost which is proportional to w: it is a succession of w modular squarings. If w is in the billions or more range, then this is going to be expensive. However, when the p and q factors are known, then one can compute e modulo p-1 and q-1, which will be a lot shorter, and the computation of y can be performed within a few milliseconds.

Of course this does not guarantee a release at a specific date; rather, it guarantees a minimum effort to unlock the puzzle. Conversion between effort and date depends on how hard attackers try...

The time-lock puzzle expressed above has some nice characteristics, in particular being impervious to parallelism. If you try to break one such puzzle and you have two computers, you won't get faster than what you could do with a single computer.

In a somewhat similar context, this time-lock puzzle is used in the Makwa password hashing function, candidate to the ongoing PHC. In password hashing, you want a configurable opening effort (albeit within a much shorter time frame, usually less than a second).


You have taken a sensible set of steps to resolve the matter yourself. Kudos for not getting stung.

However the main indicators of an issue you are reporting here seem to be related to the content rather than the technology.

  a warning notice said my account had been compromised and that the account was locked

That may have come from eBay as a result of an attackers actions or it might be part of the attackers ploy. Did you check you were using HTTPS? Did you take a note of the details on the certificate? Did you compare them with the details when you log in from elsewhere? What browser were you using?

  I wrote an email to eBay and got a response from customerhelp@ebay.com

What email client did you use (subsequently answered partially in comments)? Where did you get the address you sent the email to? Was the address you sent the email to the same as the From/Reply-to address on the response? You did say the response quoted your original email which is significant. Including the full headers from the response here might have been useful.

  I must call them by telephone to reopen my account.

Was it a toll-free number? Did you try to verify the number appeared on the eBay site using a different computer elsewhere? Did you try googling the number (again, on a device elsewhere) to see if anyone else had come across this?

  fraud [...] confirmed after writing an e-mail to spoof@ebay.com

I hope your correspondence with spoof@ebay was initiated from a different device. In this instance it would appear that your email to them was not diverted, but if you suspect that an attacker might be able to subvert one @ebay.com account, then its reasonable to assume that all the correspondence to that domain may compromised.

  How did they manage to trigger a "Your account has been locked" message on eBay

I have no idea. I think its more likely that they found a method of triggering this behaviuour at ebay rather than a MITM/MITB attack against your HTTP session. Organizations tend not to publish the secret sauce recipe by which they identify fraud. But it may have been as simple as typing in the wrong password lots of times.

  how did they ever manage to take control over customerhelp@ebay.com?

They don't need to.

It might be sufficient to control any of your device, your router, the router at your ISP, the mail server at your ISP, the DNS server at your ISP. It is also possible that the ebay mail service has been compromised. Many large organizations outsource their support to the cheapest call centre. So even when you are corresponding with the designated eBay support people, you might not be corresponding with people employed by eBay. So in addition to the servers/routers at eBay, and the servers/routers at the call centre, I think its reasonable to include actions by rogue agents currently or formerly employed by the call centre as potential candidates.

While the DKIM and partial headers suggest that the fraudulent responses were routed via eBay's servers, there is not enough information here to prove that is the case. There is enough information in the original email to prove if this is true.


If I re-install an encrypted version of Ubuntu on my laptop and fill my entire SSD up with a large .txt file, does this securely wipe the SSD?

This might work, but there is a much easier way to wipe your hard drive clean:
Boot the computer from a Ubuntu live bootable USB.  When it prompts you with the options to 'Run Ubuntu' or 'Install Ubuntu', choose 'Run Ubuntu'.
When Ubuntu loads, open the command prompt, then do sudo fdisk -l to find the location of the SSD in the file system (it will likely be /dev/sda).  Then, use the following dd command to fill the SSD with zeroes:
dd if=/dev/zero of=/dev/sda bs=4M status=progress

(assuming your SSD is /dev/sda - otherwise, change accordingly)


Is suspend-to-ram really a meaningful risk for Full Disk Encryption?

There seems to be hardware able to read the RAM, Tribble card and a couple of US gobernment related companies do produce similar devices source.

So yes, it could be possible, but it is very unlikely that regular thefts would have access to such a specific hardware.


Who first introduced the notion of attack graphs?

As the comments mention, it was Bruce Schneier in a 1999 publication:

Bruce Schneier. Attack Trees: Modeling Security Threats. Dr. Dobb’s Journal, Dec 1999.


How to do security configuration for ibm http server?

IBM Webserver is based upon Apache. Reading the Oracle article posted, it looks like they are talking about enabling entity encoding. I do not think the way that an apache based server works can blanketly tell about input since the programing language is not tightly couples to the web server. More or less what that article is saying is that that you replace < and > tags  with the html entities so they will not be interpreted as code by the browser. Most likely you will want to implement this within your app code.

If you have not already been there, start your exploration of blocking XSS with the OWASP XSS Prevent Cheat Sheet.


These three properties are usually known as the CIA triad: confidentiality, integrity and availability. They are the three main classes of security properties of any system (though not all properties fit within those three classes).

Confidentiality (i.e. secrecy) means that an attacker cannot read data that she is not supposed to be able to access. An SQL injection attack is one way to break confidentiality, if the attacker is able to inject or modify a SELECT statement (for example). An SQL injection attack could also compromise integrity, if the attacker can inject an INSERT or an UPDATE or a DELETE or other statements that modify the database.

Integrity means that the attacker cannot write to the database in unauthorized ways. It covers the addition of extra entries, modification of existing entries, deletion of entries, and anything else that changes the data. Using a trojan could compromise the database, but accessing objects with higher security roles would only be a breach of integrity if you meant a write access: a read access would break confidentiality.

Availability means that the attacker cannot prevent others from using the database. A DDOS attack is indeed a way to break availability.

There are, of course, many other ways to break these properties.


How do you know if the bios has been compromised?

The BIOS or equivalent firmware is the first thing that runs when the computer is booted, so it could easily start a lightweight hypervisor before loading the OS that will present a clean firmware image if the OS ever asks for it, while still being compromised.

So from the actual machine, there is no reliable way to check if the firmware is malicious. You can however do so from another machine by unsoldering the ROM or flash chip that holds the firmware, putting it in an appropriate reader and reading it from a known good machine (but not executing it, just merely reading) and comparing to a known good image such as one provided by the mainboard manufacturer.


What does `&==;` mean with regard to Python Django and bypassing WAFs?

Read it as: & == ;

This bullet point just means that the Django framework for Python parses both an ampersand (&) and a semicolon (;) equally as valid separators of query parameters in a given URL.

Consequently, the following URLs would be treated identically:

https://example.com/foo/bar?x=y&name=peter&debug=1
https://example.com/foo/bar?x=y;name=peter;debug=1

This is remarkable because other frameworks might not recognize the semicolon as a separator and read the second query string as a single parameter x with the value y;name=peter;debug=1. This behavior might in turn confuse WAFs which is likely why it's listed on your slides.


The chief problem with your approach is that a process doesn't need any API to check its own address space. It can just read from it; that's pretty much the definition of its address space. So an AV product can set up a "bait" process which knows what should and should not be running in its address space, and catch unexpected code.

Would you know how this bait process looks? Not realistically. The AV code can generate this bait process on the fly, so it's different every time. For another AV product this would look awfully fishy, hence the advise to never run two AV products in parallel.

There's one slight complication with this method: your hooks could be somewhat stealthy, and actually be generated on the fly via an exception handler. But this exception handler itself has to exist, and can be detected instead.


How do I secure patient data cheaply in a small doctor's office?

I'll also mention TrueCrypt, since it's a fairly simple (and free!) solution. Or, if you use Macs, use the built-in 'FileVault.'

Beyond file encryption, you should also look into other areas that could benefit from encryption, or pose a risk to the data:
* Email encryption -- Here's a relevant lifehacker article. Your should also look up your email client and provider's policies/features in this regard.
* VPNs for any remote workers; something like logmein's hamachi or similar.
* Backups, Dropbox, etc.: Review the policies and encryption-features of any backup or file sync programs you use, too.

Finally, be restrictive with file-access/sharing permissions. Deny 'Everybody' from any windows fileshares and, if possible -- I know my users balk at this -- make sure anyone who does have access to that information has a strong password.

That said, a technical solution alone is not enough; make sure your coworkers understand what needs to be protected and /why/. (Something other than 'because the government us tells us to.') This way, they can help identify data that should be secured but has somehow missed your initial review. You might also want to get them to sign some policies, too, just in case: Internet/Email use and the like: After all, encryption is pointless if the attacker knows the key, like a disgruntled or clueless employee who sends confidential/protected data by insecure means.

Have similar discussions with any service-suppliers that might handle the sensitive data. For instance, in order to ensure compliance with a local privacy regulation, we emailed our off-site backup provider asking, "Hey, we need to be XXX-compliant; do you guys do that?"

There are other things that come to mind, but I'm more a sys-admin than a sec-admin right now (thought not for lack of trying!) -- but I don't want to overload you. (Plus, I have to get back to work.)


How can I increase /proc/sys/kernel/random/entropy_avail

Do not use an online source of entropy!
If your system currently has insufficient entropy, then it will not be able to make a secure connection to random.org and any material you download from it will not be secret. Furthermore, you should not be using the blocking device anyway. It's perfectly fine to use /dev/urandom, no matter how low the entropy estimate is. If for whatever reason you are using a program that is foolishly using the blocking device, you can keep it topped off by installing haveged, a daemon that attempts to generate random data from memory latency. Please see https://www.2uo.de/myths-about-urandom for more.
If you still want to shoot yourself in the foot, then you can use an IOCTL on the random character device to adjust the entropy estimate. From random(4), the RNDADDENTROPY IOCTL is what you want:

RNDADDENTROPY
       Add some additional entropy to the input pool, incrementing
       the entropy count.  This differs from writing to /dev/random
       or /dev/urandom, which only adds some data but does not incre‐
       ment the entropy count.  The following structure is used:

           struct rand_pool_info {
               int    entropy_count;
               int    buf_size;
               __u32  buf[0];
           };

       Here entropy_count is the value added to (or subtracted from)
       the entropy count, and buf is the buffer of size buf_size
       which gets added to the entropy pool.

This IOCTL requires the CAP_SYS_ADMIN capability to function.

Very related:

Linux kernel entropy - does it matter to /dev/urandom and what is a minimum?

Feeding /dev/random entropy pool?

Is a rand from /dev/urandom secure for a login key?

Is "always use /dev/urandom" still good advice in an age of containers and isolation?


How did hackers brute force my Windows server username?

There are few ways to enumerate windows usernames, but maybe they only needed RDP.

You don't need the username or password to start a rdp connection, and some windows versions (not sure which ones, looking for them but 2008 r2 is one of them) will show the names of the users who can connect and which ones are connected already.

This "feature" will directly leak the needed username/s.

Maybe they used some tool like this one https://github.com/citronneur/rdpy (there are a few) to take a screenshot, or they just simply tried to login with a rdesktop ui program and saw something like the screenshot

Theres a nessus plugin also for this, but i doubt the used it ($$$), who knows.

There are a few ways to leak windows users, maybe they used any other.


Your telephony provider will be able to provide you with a rate sheet that outlines the different charges for different numbers.  This is as far as I know the only definative way of working out the charge, pretty much everything else is just assumption & guideline - as a for instance, 0800 numbers are free on my mobile contract, but on most of the big name mobile companies they are premium numbers and even outside your bundle.

As far as cloaking of numbers - if I understand your concern, you get charged for the number you dial - if the recipent then diverts it to a premium number - for whatever reason - they pay the premium fee.  My company does this, we provide a free fax number, but we divert it to a premium rate 'fax to e-mail' service.  We pay the premium as our fee for using the service, our clients pay nothing since they called a free phone number.

Hope that helps


My answer would always be "in comparison to what else?"

In this moment, SHA-1 is weaker than SHA-2:

https://en.wikipedia.org/wiki/Secure_Hash_Algorithms

It's got known weaknesses, a smaller number of security bits, increased risk of collisions, and SHA-2 is fairly prolific, has a good performance, and is fairly widely accepted.  So... why not use something better?

There is a reason - compatibility.  There will always be some suitably old technology out there that simply cannot (or has not) been upgraded to use the current recommended best practice.  So the big question is - does your business model benefit more from interoperability, or cryptographic strength?

My not-spending-lots-of-time-doing-math-research answer on SHA-1 vs. SHA-2 would be that it's a no brainer - SHA-2 is better.  But if you told me that your biggest customer has a substantial investment in SHA-1 only technology and can't improve the system... well... I'd probably advise finding a way to limit the scope of where and who you do SHA-1 with, and then make sure you have that customer sign a nice sounding waiver that they understand that you can't be entirely responsible for the risks of using a not-best-practices algorithm.


Response to unauthorized scan by legit company?

Whether you could pursue legal action depends on the contract and terms of service you have established, however that's probably not the right way to go as it will cost you money and lose you at least one customer. You might also discourage your customers from having penetration testing done, which would be a bad thing.

I would recommend educating all your clients as to the right way to go about having pentests done. Inform them you wholeheartedly support security testing, but that it can impact all customers if it is not done right so they should contact you to discuss scope and timings.


How to decrypt text when four first letters of the key are missing in Facebook CTF contest?

A few hints:

The letters in the key are likely to be within the ASCII printable range.
The decoded text is likely within the ASCII printable range.
It's not very hard to bruteforce a 32-bit number, even less hard if you can reduce the key space down.


So, firstly I would avoid storing credentials for a third party at all if you can. As S.L. Barth says in the comments, look at OAuth (https://developer.github.com/guides/basics-of-authentication/) and then you don't need to know the creds - it's more secure for your users, it's less hassle for you - there's reduced liability if you are breached.

If you must store them, then yes you must encrypt. This isn't optional, you just can't store passwords in plain text and you can't hash them as they need to be reversible so you can send them to your third party. Look at the Rijndael AES suite, it is available for Java. There's a post on Stack Overflow about encryption with Rijndael. https://stackoverflow.com/questions/587357/rijndael-support-in-java

Where you store them is dependent on your application architecture, your users may have unrestricted access to your storage location on a desktop application, this is why it's critical the passwords are properly encrypted.


What is the difference between openssl and mkcert and IIS self signed certificate

There is no really well-established command known as "mkcert" (there is apparently one under that name in some IBM systems). Since you are talking about IIS, I suppose that you mean MakeCert.

Certificates follow a standard called "X.509"(*). There are several tools out there who can create certificates. The main virtue of a certificate is to be signed by a Certification Authority because that's what certificates do: they transfer trust in key-name bindings from a "root CA" down to end-entities (e.g. SSL servers). A self-signed certificate does not transfer much; when you use a self-signed certificate, you are actually trying to fit some public key into the outer format of a certificate just so that protocols which require a certificate don't get some apoplexy crisis when they see it.

For your WCF service, you will need the server to own a certificate (and the corresponding private key), and the client will need to trust that certificate. The tool which creates that certificate does not matter much as long as you can instruct IIS to use that certificate-and-key, and you can configure the client to trust the certificate. Since IIS can create the key pair and the certificate in a few clicks, and you necessarily have IIS installed anyway, using IIS inherent abilities at certificate creation is probably the simplest method. You would use MakeCert.exe if you really prefer, for aesthetic reasons, to use a command-line tool; and you would use OpenSSL if you are also allergic to Microsoft tools (but then, why would you use IIS and WCF ?).

The really important point is that you need a certificate because your service will use SSL or some other protection mechanism, and you do that because you fear malicious attacks. Using certificates will help you only if you make sure that the client will trust only the certificate that you generated and installed on the server, so this means that you must take care of where you generate and store the private key, and, preferably, understand what you are doing.


Security of GPG encryption with AES and MD5 if MD5 is broken

Depending upon to what extent MD5 is "broken", a break of MD5 might enable chosen-ciphertext attacks.  However, as far as I know, it won't enable purely passive eavesdropping.

That said, the likelihood of a catastrophic break of MD5 (bad enough to compromise the secrecy of your gpg-encrypted data) is probably much lower than other risks your system faces.  I think it's unlikely that this is the weakest link in your system, or that this is anywhere near the biggest risk in your system.  This risk is likely nearly negligible, compared to other kinds of risks that tend to be present in most information systems.


Example of a double-free vulnerability in C

That code have some issues that you should correct.

If the user types "reset" the first time, you have a free of something that you didn't allocate, also the pointer should be initialize to null to help (auth = NULL)
If the user types "login" the first time, your code will generate a SIGSEV on auth->auth, you didn't allocated auth properly.
on the call malloc you should verify that the return value is not null.

There are more issues on the code, but are more related to bad programing practices than a security related from my point of view


Is it insecure to use a single antivirus exclusion list?

Excluding in each server only what may be excluded is more secure than excluding the same resources in every server because the less you exclude, the better. In the other hand you won't increase the risk too much by applying the same exclusions to every server if the exclusions are reasonable.

Imagine for a moment that one server requieres you to exclude everything and that should be propagated to all systems...that wouldn't be reasonable.


How does Tor protect against MITM attacks between the client and relay nodes?

The Tor Project hosts some bootstrapping servers called directory servers. They contain a list (a directory) with information about all Tor relays currently online. This info about each relay includes the public key. The directory is signed with one of the directory keys[1]. Those keys are distributed along with your copy of the Tor client[2].

Therefore, the answer to your question is: by having a trusted third party (similar to a certificate authority). Tor relays (called onion routers in the paper) upload their info to the directory periodically[3]. When a client connects to their guard node, they check that the connection is encrypted with the right key, as listed in the directory. Then, when proxying traffic to the middle node (between the guard and exit node), they setup an encrypted connection to that node, proxying through the guard, and checking again that the right key is used (instead of a MITM key) using the directory. Same goes for the final (exit) node.

Source: https://www.onion-router.net/Publications/tor-design.pdf

[1] "Each onion router maintains a long-term identity key and a short-term onion key.  The identity key is used to sign TLS certificates, to sign the OR’s router descriptor (a summary of its keys, address, bandwidth, exit policy, and so on), and (by directory servers) to sign directories."

[2] "Client software is pre-loaded with a list of the directory servers and their keys, to bootstrap each client’s view of the network."

[3] "Tor uses a small group of redundant, well-known onion routers to track changes in network topology and node state,including keys and exit policies. Each such directory server acts as an HTTP server, so clients can fetch current network state and router lists, and so other ORs can upload state information."


Can one use a gpg smartcard to implement FIDO2?

afaik FIDO 2 and gpg require two different architectures, thus require two different MCUs. In that the keys are not similar in their padding, and not similarly stored on the key.
If you wish, you might take a look at the technical details of the Pro 2 here, and the FIDO 2 here. Both keys store different kinds of "files" of keys.
Is there a possibility to store an authentication key on the PRO 2 or HSM, maybe, but it was not made for that. You can this question on the Nitrokey support forum, and the people there would know much better.


Verify if person belongs to the claimed university through his university email id

I know several universities/collages that leave email addresses to their alumnus.
So only thing that you can check is that the person WAS associated with the university at some point of time.

A


Is it safe to browse tor on a virtual machine using a non root user BUT the vm is using the host device's network card/adapter?

When someone compromises your virtual machine and you're using the host's network adapter, he might learn the host machine's mac address. This might compromise your anonymity. I think the FBI used an attack against Tor users using Tor for illegal purposes a few years ago that recorded the MAC address of the user's computer, so it's not just a theoretical danger.

You could change your MAC address using software on the kali installation. However, this is just a first line of defense; the hardwired MAC address can always be recovered if the attacker gains root access to your virtual machine. Virtualbox might support spoofing of the MAC address, but again, this is just another layer of defense.

An attacker might also be able to listen to your host's traffic and, depending on the network adapter, to all the wireless traffic in your vincinity (but this is also possible using a dedicated network adapter).

Then again, he might also break out of the virtual machine alltogether. There are a few working attacks that break out of VMWare on Youtube; I'm sure there are some for virtualbox too.

But I'm not sure I understand your fears: Ethical hacking is, by definition, ethical, so why would your anonymity matter?


This is because what you're trying to decode is an x86 machine code.

Here is what it looks like when disassembled: https://www.onlinedisassembler.com/odaweb/d16i42cD/0


Does prompting for security questions on new computers add any security on banking websites?

The scenario that this is designed to prevent is keylogging.  It is fairly easy to get a keylogger that will report back but somewhat more complex to make a program that will actually execute an attack remotely on another computer.  Since you don't regularly enter your security question answers, if an attacker obtains your password via a key logger, they won't be able to use it on their system without knowing the answer.

It does have somewhat limited effectiveness though as if the attacker can force your system to not be recognized, they can get you to answer the security questions as well.  It is still a slight increase in difficulty for an attacker though and is not a significant or even common burden for a user.


What reasons are there to not just send the API key as an HTTP header over HTTPS?

It's perfectly fine to send api keys as a header in the HTTPS request, since first SSL/TLS negotiation happens, and then the packet with the header is sent. The first packet to negotiate the SSL doesn't contain headers other than browser specific generic ones. This is secure and safe. AD however does have some power behind it, and in an all windows environment is actually a nifty tool to use.

As for specific advantages? See here for a good round up.

Some highlights:

Managing trusts: Access to multiple domains(forests too) from a single AD

Managing children: Changes to AD carry to all children of the AD

Managing users: Users in the AD are logged, kept track of, and kept secure across the AD, their domains, and anything else that is in the AD.


What does %APPDATA%\GnuPG\secring.gpg contain after invoking "gpg --card-edit generate"?

GnuPG stores a key stub, when you interface smart cards. OpenPGP smart cards only contain the raw key data (and key ID), but no user IDs, certifications, settings and other attributes which must be stored locally or fetched from the key server network. Furthermore, this key stub makes GnuPG aware of the card even if it is not plugged in, so it can inquire you to provide it if necessary.

This key stub contains everything but the private keys, which will never leave the card (private key operations are performed by the card instead).

If your keyring is still in the old keyring format (not the new keybox format introduced in GnuPG 2.1 for newly generated keyrings), you can also peak into the keyring using gpg --list-packets C:/Users/myaccount/AppData/Roaming/gnupg/secring.gpg or pgpdump, which provides more flags to specify the output verbosity and can also print the raw key data. Both tools are very technical and require rather intense knowledge of RFC 4880, OpenPGP for understanding the data.


Snort's great, but BASE isn't. What are some alternative front-ends?

"and the demo website wouldn't let me log on, which doesn't engender extreme confidence" ouch.. I am the developer of Snorby and i'll bet 100 USD you were typing "snorby@snorby.com" (try .org). I have never had one issue with authentication or demo downtime since the launch of Snorby 2.x.x. Please make sure you verify credentials thoroughly before you post negative comments about a project to a large audience.

Aside from Snorby I would recommend Sguil. Sguil offers full packet capture, session data and numerous other powerful features. A bad UI is a small price to pay for valuable data.


Is disallowing write to USB actually an efficient way to prevent data leakage?

One of the main reasons behind the prohibition of writing data to USB drives (I had this explained to me once) is not to prevent employees from stealing sensitive information. If they wanted to do that, they would have no end of workarounds, up to printing QR codes on A4 sheets.

Rather, it is to prevent employees from saving sensitive information on USB drives in good faith, only to have those USB drives lost or stolen.

Often in such cases you'll find that it's OK to save data on specific encrypted thumb drives that can't be decrypted in case of theft or loss: e.g. biometric-lock drives(*) or encrypted file systems that will be "seen" as physical fixed hard drives instead of removable hard drives, thereby circumventing a "cannot write to removable drives" security policy.

Windows 7+ has explicit settings that enable treating BitLocked devices (possibly with corporate keys) differently from plain USB devices.

(In my case, that was Windows XP Pro SP3 some time ago, I had a USB key with a TrueCrypt volume on it, and I was allowed to take some work at home on it. I was under orders not to copy the files anywhere else and not to use the USB drive for any other purpose. This kind of precautions is clearly directed against accidental leaks, not intentional ones).

For the same reasons, some popular file sharing sites, or sites and apps that could allow file sharing, might be blocked by company firewalls. Again, not so much to stop espionage, but to prevent people from growing too careless (at least in the powers-that-be's opinion) with corporate information.

(*) Note

Biometric lock thumb drives and (especially) hard disks aren't necessarily secure - or even encrypted, or encrypted correctly. If the memory can be physically separated from the locking part (easy for most HDD enclosures, conceivable for many USB thumb drives) someone can try to read it directly, maybe just to "reclaim" the memory itself. After all, in case of failure the finder will have just lost some time. Once he or she has the hands on the readable memory, simple curiosity might be enough to take a peek and maybe even try and decrypt it before reformatting and repurposing. With luck, the device is vulnerable and just googling its make and model will allow someone to recover the necessary tools and/or knowledge.


What does a court need to successfully prosecute a hacker?  Please cite previous cases if possible

As I recall cyberlaw is pretty up in the air as it is a newer issue.  The biggest issue, at least in the US, is proving that it actually was that person behind the keyboard.  IPs can be spoofed, pseudonyms are just that pseudonyms, and intellectual property law is fairly unrefined as well.  Also the hacker needs to be an adult or have committed a crime on a large scale, this of course is up to court discretion.  Additionally one needs to consider is the user of the script to blame or the original developer?  You can look at cases against Limewire and other P2P networks.  I believe it really comes down to did the business take all necessary precautions to prevent this in addition to the attacker's intention.  The RIAA has looked foolish in the past by trying to prosecute 12 year olds on music theft.


Where Does ClamAV Get Its Virus Signatures?

ClamAV belongs to Cisco and its Talos Group. Cisco acquired Sourcefire, the makers of Snort and ClamAV in late 2013.

http://www.cisco.com/web/about/ac49/ac0/ac1/ac259/sourcefire.html

http://www.talosintel.com/about/
http://www.cisco.com/c/en/us/products/security/talos.html

  © 2004 - 2015 Cisco and/or its affiliates. All rights reserved.

Sourcefire also belongs to Cisco: http://blog.clamav.net/2013/10/cisco-community-and-open-source.html

The signatures are on the server of ClamAV

http://www.clamwin.com/content/view/58/27/

  Where can I manually download virus definition files from?

  You can get the virus definitions without clamwin via http://

  http://database.clamav.net/main.cvd
  http://database.clamav.net/daily.cvd

  Then copy the downloaded main.cvd and daily.cvd to your database
  location which is specified in the ClamWin Preferences, File Locations
  tab.

  The default database location is: "C:Documents and SettingsAll
  Users.clamwindb"

Many big contributors are antivirus vendors and security companies:
http://www.clamav.net/about#credits

  Contributors

  ClamAV Team

  Joel Esler
  Douglas Goddard
  Nigel Houghton
  Tom Judge
  Kevin Lin
  Steve Morgan
  Matt Olney
  Dave Raynor
  Samir Sapra
  Ryan Steinmetz
  Dave Suffling
  Matt Watchinkski
  Alain Zidouemba

  ClamAV QA

  Erin Germ
  Dragos Malene
  Vijay Mistry
  Matt Donnan

  Talos Group

  Andrea Allievi
  Jonathan Arneson
  Ben Baker
  Nathan Benson
  Andrew Blunk
  Kevin Brooks
  Jaime Filson
  Paul Frank
  Erick Galinkin
  Douglas Goddard
  Richard Harman, Jr.
  Nicholas Herbert
  Shaun Hurley
  Richard Johnson
  Alex Kambis
  Brittany Lawler
  Justin Lindsey
  Chris Marczewski
  Christopher Marshall
  Nick Mavis
  Christopher McBee
  David McDaniel
  Alex McDonnell
  Kevin Miklavcic
  Patrick Mullen
  Marcin Noga
  Katie Nolan
  Carlos Pacho
  Ryan Pentney
  Nick Randolph
  Marcos Rodriguez
  Geoff Serrao
  Brandon Stultz
  Nick Suan
  Emmanuel Tacheau
  Melissa Taylor
  Angel Villegas
  Andy Walker
  Alicia Willett
  Yves Younan

  Contributors

  Aeriana, Andreas Cadhalpun, Mike Cathey, Michael Cichosz, Diego
  d'Ambra, Arnaud Jacques, Tomasz Papszun, Bill Parker, Robert
  Scroggins, Sven Strickroth, Trog, Steve Basford, Dennis de
  Messemacker, Jason Englander, Thomas Lamy, Thomas Masden, Boguslaw
  Brandys, Anthony Havé, Andreas Faust, Sebastian Andrzej Siewior

  ClamAV Emeritus

  Luca Gibelli, Török Edvin, Tomasz Kojm, Alberto Wu, Nigel Horne

Each update contains information about the sender, some mention Virus Total, VRT Sandbox and others.

Generally antivirus vendors, security researchers and contributors collaborate and share samples.

http://lists.clamav.net/pipermail/clamav-virusdb/
http://lists.clamav.net/pipermail/clamav-virusdb/2015-December/002519.html

Anyone can contribute and there is also a mailing list for community contributed signatures.

http://blog.clamav.net/2014/02/introducing-clamav-community-signatures.html
http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs


Possible to take hash from know result and algorithm?

OK, so the first issue is: do you need these rolls to be reproducible and predictable?  That is, do you need to be able to fast-forward to the 10000th roll or rewind to the 20th, and get the same result?

If you don't need that feature, then why not use a cryptographically secure random number generator instead?  This way, neither you nor an attacker can predict the results, and you don't have to worry about accidentally revealing your secret at any point.

(If you do want that feature, I think it's really worth asking why.  Would your users be happy with the idea that all results are predetermined, just kept secret?  There's also a slight bias in your implementation, and you have the extra challenge of keeping your secret a secret, etc. etc. etc.)


Making a file immutable (against kernel exploits)

If the kernel is exploited then any software based constraints on file access can be bypassed. Using an encrypted filesystem would prevent someone from booting up from a USB key or removable media, mounting the filesystem and changing the file, but not against a loadable kernel module inserted in the running system.

I remember when most hard disks had jumper settings to make them read only at the hardware level, but its been a long time since I've seen such a device. Maybe some disks still do this but you might have to do a bit of digging.

You can get USB drives with a physical switch. But they are not cheap - indeed it might be easier to set up something like a raspberry pi with read only NFS access.


Are IBM PowerPC CPUs free of the AMT issue seen with AMD and Intel?

No, Power9 does not have a function similar to the Intel ME and AMD PSP built in to the processor.  (Or, at least, no such function is documented.)  It was even chosen as the processor of choice for a security-focused platform.


Now we have upgraded openssl to openssl1.0.1 to support TLSv1.2. So,
  do I need to create a new X.509 certificate to support TLSv1.2?

A SSL/TLS server certificate asserts the identity of the server. This certificate is independent of the SSL/TLS protocol version. The SSL/TLS version is negotiated during the connection, before the certificate is presented to a client. If you enable TLSv1.2 support, then clients are able to use more secure ciphers and protect against some other attacks. You do not need to create a new certificate when changing protocol versions.

Even if the newer protocol can work with your old certificate, you might want to review the parameters of your certificate. In particular:

MD5 and SHA-1 signatures are considered insecure. Move to SHA-256.
1024-bit RSA keys are considered insecure. Consider moving to 2048-bit RSA or better.

You can check the contents of your X.509 certificate using the following command:

openssl x509 -noout -text -in your.crt

For configuring TLS parameters, you can start reading https://wiki.mozilla.org/Security/Server_Side_TLS


Will pentesting my own LAN violate ISP rules?

It's legal within the USA* to test your own equipment inside your own network.

Be aware that some of the newest ISP-provided routers (i.e. Comcast gigabit, aka Xfinity xFi) have some rudimentary security software built in, and they do internal network monitoring and detection to help homeowners secure their networks.  The most I've seen them do is alert the account holder that new devices have been added to the network, or warn you if you try to connect to a known malicious site, but it's certainly possible that it could detect other forms of behavior that it might consider hostile.  So don't be surprised if your ISP notices, and perhaps tries to "keep you safe" by blocking traffic it considers dangerous.  It's also probable that any such activity would be logged by them.

However, most ISP routers are older, and the older ones don't do any such thing.  Their security functioning is limited to simple firewalls that keep bad traffic out.

If you're concerned that you don't know if the ISP's router is monitoring your traffic, you don't have to trust it.  You can add a second router inside your network and dedicate the innermost network to your penetration testing activities.  Any network IP addresses that begin with "10.", "192.168.", or "172.16." through "172.31.", are called "Private Networks" (RFC 1918, for a more formal definition).  These are reserved address ranges that are not allowed to be routed outside of your network by your router.  So anything you send to those addresses won't leave your network, making them safe to experiment with.

* NOTE: standard disclaimers apply, this is not legal advice, it may not be accurate, I am not a lawyer, don't believe everything you read on the internet, use at your own risk.


OWASP ZAP: Add parameter to every request

You can setup a Replacer rule or create an Http Sender script.

For a Replacer rule select the type as "Request Header String" then set the regex as something like (http://example.org.*) and the replacement something like $1?myParamToAdd=someValue (Note this replacer example is untested.)

For an HttpSender script something like the following should work:

var URL_TYPE    = org.parosproxy.paros.network.HtmlParameter.Type.url;
var HtmlParameter = Java.type('org.parosproxy.paros.network.HtmlParameter');

var paramName = 'myParamToAdd';
var paramValue = 'someValuetoAdd';

function sendingRequest(msg, initiator, helper) {
  if (!msg.getRequestHeader().getURI().toString().contains(paramName + '=' + paramValue)) {
    //You might want to add a check here for the proper domain or path as well..
    var urlParams = msg.getUrlParams();
    var newParam = new HtmlParameter(URL_TYPE, paramName, paramValue);
    urlParams.add(newParam); // you could print this if you need to see what's up
    msg.setGetParams(urlParams);
  }
  return msg;
}

function responseReceived(msg, initiator, helper) {
  //Nothing to do here
}


Are there file-encryption tools that only allow access to whitelisted processes?

Process-based access control only works on data in transient memory (e.g.: RAM). Once data is stored on a semi-permanent media (e.g.: hard drive, flash drive, DVD, etc.), that media can easily be connected to a system that will not honor any access restrictions that are enforced in its native environment.

You could add process-based access control to the native environment, but that only protects against an attacker restricted to that environment who already has the ability to run code on your system. An attacker with such access pretty much has free reign on the system anyway, so it's nearly impossible to guard against such a threat. Any attempts to do so, particularly in the manner you suggest, would have to severely compromise on user experience and system usability.

At a bare minimum, I can think of three programs you'd have to whitelist for every file:

File Browser (e.g.: Explorer)
Document Viewer (e.g.: Acrobat, Word, Excel, etc.)
Antivirus (Take your pick)

Two of these are things that will very widely vary from system to system, file to file, and user to user, and all of them are subject to changes via software updates. And there's probably plenty of things I'm not thinking of. It would be nigh-impossible for the developer of the tool to properly build and maintain a comprehensive database of even just the most commonly-used programs to auto-whitelist them for the user.

Thus, the user would have to be prompted to add programs to the whitelist. These prompts would happen, at the very least, the first time each program needs to access the volume and again any time the program tries to access the volume after having had an update applied. Eventually, the prompting would reach Vista-era UAC noise levels and the user will end up either disabling the security or auto-approving - thereby rendering the feature useless.

All of this is rendered moot by any number of means (rootkits and keyloggers to start with) that are commonly used by attackers to compromise systems. The best way to keep processes from inappropriately accessing your encrypted data, is to not let such processes get installed and run in the first place.


You want a system which can somehow detect the difference between:

The user is on the chair in front of his computer, looking intently at the screen (for "reading") but not otherwise making his presence known to the computer.

and:

The user is on the chair in front of his computer, looking intently at the back of his eyelids, because he is taking a quick nap.

Said that way, it becomes rather obvious that the problem is hard. You could imagine plugging a Webcam to the computer, focused on the user's face and able to detect whether his eyes are shut or open... this seems kludgy. However, such a product is apparently on the market. You might want to give it a try -- not for automatic login (it is too easy to fool a face recognition system with a life-size photograph of the user), but for the automatic lock when the user leaves the room. Of course, this requires Webcams. Laptop computers have them.

The normal way to deal with unsolvable problems is to change the problem until it matches a solution. The common method, in this case, is to "empower" the users. This takes the form of a tradition of users jumping on each other's machines: if you find an unlocked workstation, then you send an email to the whole floor in the name of the workstation owner. The said user is then "forced" (through social pressure, not contractually -- it would probably be illegal) to pay for cookies or beers for everybody on the floor. If done properly, then the rate of unlocked workstations can significantly drop.

Unfortunately, this does not work well with people whose hierarchical level is higher than their sense of humour. The same people will also be uncooperative with any technological constraints. For instance, you could enforce smart card logon (with USB-token form factor, and automatic locking when the card is extracted) and have the users keep the smart card tethered to their wrist of belt at all times. It can be easily predicted that the users will not keep the USB token attached.

This issue is widespread. As an example, the French government just recently issued a reminder to its own ministers that they are not supposed to use "not approved" smartphones, and yet they do. Similarly, Barack Obama, upon becoming president, adamantly refused to let go of his phone, to the dismay of the Secret Service.

For people at the top management positions, the most practical method might be to simply hire an underling whose job is to type Win-L whenever his boss leaves the room. If that employee is decorative enough (which, in many cases, means that the employee is a she and is young) then such a plan will meet user approval, and be effective.


What methods can be used to prevent mistyped usernames?

Banks that issue numeric usernames are rather annoying. And while I am more paranoid that most, you're probably right that someone just fat fingered their ID and didn't realize it until they locked you out.

To answer the question, some banks do help ensure you are attempting to login with the correct user account. Those "Security Images" you see on some bank login pages, yes the banks tell you that those pictures help you ensure you're logging into their website. But the real benefit is to help users realize they're attempting to log into someone else's account. Sites that use this process will ask for your username on the main login page, then take you to a new page with your 'security image' and the password field. They may also ask for another form of authentication (security question, etc) before asking for the password if you are logging in from a computer they haven't seen you login from before.

If every time you login you see the image you selected on signup, you're more likely (assuming you use the site often enough) to notice when that image is different. This could mean that you're logging into a phishing site, but more likely, you fat fingered the user account.

EDIT: -- To answer your edit --

When dealing with numeric userids, there are only 10 digits and they're crammed in a very small area on 10-keys and mobile devices. Given many tens (or hundreds) of thousands users, the scarcity of digits and how close they are in two of the three common layouts, there is really no way to adequately ensure that any one ID is dissimilar enough from another to prevent common mistyping errors.

Also, if you think about it from a performance standpoint, detecting if a new ID is uniq is a very efficient and quick process in most well designed systems. However, detecting if a new ID is dissimilar from others would require iterating over every other user ID and comparing the two with whatever your algorithm is. This would be a (relatively) slow and painful process. With enough time and effort, you could cache ngrams and any other comparison points to help speed it up, but still, it's going to be slow.

In short, I'm not aware of any company doing this on user ids, certainly not on numeric ones.  (But I'd happily read a whitepaper or engineering blog about someone doing it)

A couple of other users (including Philipp) have mentioned checksum digits, which I didn't discuss since it I initially focused on the system side and the dissimilar usernames focus of the question. But in further thought it does have a place in this conversation. Checksums are often used to augment account numbers i.e. Credit Card numbers, which any first semester programming student can write a validation tool for. This all but eliminates mistyping and can be checked client side without posting to the entry form. It's impossible to say (without inside knowledge) if anyone is using this on numeric user accounts... I would venture that someone is, but I haven't seen it and since it wouldn't make for interesting discussion (or documentation) within the community, haven't heard of anyone doing it. I think we can all agree, your bank isn't. :)


What security settings are likely used in Obama's Blackberry?

From what I've seen, he simply isn't allowed to use it for official purposes.  He has to use a secure device instead.

http://www.intomobile.com/2009/01/21/obama-cant-give-up-his-blackberry-keeping-it-for-personal-use/


What is RSA OAEP & RSA PSS in simple terms

"Textbook"/"raw"/"unpadded" RSA has an "oops, the real world happened" problem.

Consider any RSA key whose modulus is 4096-bit. It should be nearly impossible for someone to recover a message encrypted under that key, right? Let's assume that this key has a public exponent value (e) of 3.

If Alice uses this public key to encrypt the message "No" to Bob she would do something like

"No" => ASCII("No") => 0x4E 0x6F => m=0x4E6F.
c = POW(0x4E6F, 3) MOD n => c = 0x75CCE07084F MOD n.

We know that n is a 4096-bit number (given) therefore it's larger than 0x75CCE07084F, so c=75CCE07084F.

Mallory now sees a transmission of [506 0x00s] 07 5C CE 07 08 4F.  "Hmm," she thinks, "that was a suspicious amount of zeros".  She fires up calc.exe in programmer mode (hex) to input 75CCE07084F, and switches it to decimal (8095174953039).  She copy/pastes that to Scientific mode and hits the cube root button (20079).  She cackles at the integer solution and does the copy/paste modeswitch dance to get back to hex (0x4E6F).  She further checks an ASCII chart and reconstructs that the message was likely the English word "No".  Mallory has now recovered this message without the use of the private key.

What went wrong?

The combination of the message and the exponent resulted in the modulus operation not being required. Computing n-th roots isn't pleasant, but it's not an intractable problem.

For e=3 the modulus operation won't be involved for any m whose length is less than one-third the size of the key.  For a 4096-bit key this means all m <= 170 bytes are immediately recoverable because the key wasn't relevant.

How to fix it?

One way would be to increase the minimum size of the public exponent.  That doesn't solve a secondary problem that textbook RSA has, though: sending the same message encrypted against the same key is the same every time.

Another way is to make it so that m is always "nearly n".  One could seemingly accomplish this by taking the normal message and reversing it, but that a) could exceed n, and b) fails when m ends in a lot of 0x00s.  (And that still wouldn't solve the determinism problem).

So the solution that was come up with was to always "pad" a message to ensure some high bits are set and that any exponentiation uses the modulus value.

Enter PKCS1 padding

PKCS#1 (encryption) padding looks like

00 02 [a bunch of non-zero random bytes] 00 [the message]

The number of non-zero random bytes is as many as required to make everything perfectly fit in a buffer whose size is (keysize + 7) / 8 bytes (that's divide by 8, round up).  The spec says that there's a minimum of 8.  This means that the chance of producing the same encrypted value of any message is one in 2^64, which is pretty good odds of uniqueness.  And the shorter the message is the less likely a duplicate is.

This message has a "size" of 4096-6=4090 bits. Taking it to the third produces an answer in the realm of 4090*3 = 12270 bits.  That will definitely exceed our 4096-bit modulus, so the mod is guaranteed to be involved.  We've also solved our original goal of making it so that you can't trivially decrypt the message.

What went wrong this time?

It turns out that wrong answers can "decrypt successfully".  Any message C is valid against any 4096-bit key k with odds

1/256 * 1/256 * (255/256)^8 * (1 - (255/256)^502)

("first byte is a zero", "second byte is a 2", "no zeros appear within 8 bytes", "a zero appears eventually")

0.004 * 0.004 * 0.996^8 * (1 - 0.996^502)
0.004 * 0.004 * 0.969 * (1 - 0.140)
0.004 * 0.004 * 0.969 * 0.860
1.27e-5

So approximately 1 in every 78 thousand messages is "valid", but wrong.  This can confuse Bob and make him say silly things in response.  If Eve (who has more free time than Mallory) wants to she can now start sending Bob clever gibberish and observe when he says he's confused, eventually Eve can figure out what the original message was.  (Bleichenbacher attack (Crypto.SE))

Enter OAEP padding

OAEP padding is a lot more complicated (https://tools.ietf.org/html/rfc3447#section-7.1). It is constructed in such a way that

A really high bit is still always set
Randomness is still injected, so the non-determinism is preserved
The decryption operation can determine if it got the right answer (vs "a maybe right enough" answer)

OAEP depends on a hash algorithm for the "correctness" property, and so as long as a good hash algorithm is used it means that there's no tricky secondary answers.

Okay, so what about signatures?

Similar (but different) arguments get us from textbook RSA to PKCS#1 signature padding.

The PKCS#1 to PSS transition is a bit harder to explain.  To quote from RFC 3447:

  Two signature schemes with appendix are specified in this document:
     RSASSA-PSS and RSASSA-PKCS1-v1_5.  Although no attacks are known
     against RSASSA-PKCS1-v1_5, in the interest of increased robustness,
     RSASSA-PSS is recommended for eventual adoption in new applications.
     RSASSA-PKCS1-v1_5 is included for compatibility with existing
     applications, and while still appropriate for new applications, a
     gradual transition to RSASSA-PSS is encouraged.

PSS adds randomness to the signature generation process, and a methodology for removing/verifying the randomness during verification.

Conclusion

The primitive RSA operations do what they need to do, turn a number into another number which can be turned back into the first one.  The important suffix "securely" requires a bit of constraint placed on the inputs to the functions.  The padding algorithms provide those constraints (and when new constraints are learned, new padding algorithms get invented).


What method to compress English by hand has the highest compression ratio?

You could probably have the highest compression ratio with a predefined dictionary. It could go as far as mapping a single compressed bit¹ to hundreds of pages detailing the war plans for the army.

If your scenario involves a couple of spies, they could communicate using a code book with a few keywords, on a simplified language. On the other hand, if they were writers exchanging their new novels, they would be very unhappy about any shade getting lost through the encryption layer.

¹ The error rate would be extremely high, though


Faking and injecting cryptographic certificates

Is my fake certificate now added in her browser's trusted certificate list?

Yes, depending on the browser being used. It used to be that ALL browsers behaved this way. Adding a self signed certificate to the trusted certificate store.

  If she tries to visit my website and I provide the fake certificate again is she warned again or not?

In the last few years this behavior was modified to force acceptance of the non signed certificate prior to proceeding to better protect unsavy internet users from falling victim to this sort of exploit.

  Also,how can I inject a fake certificate in a target's list of certificates so that she is not shown a warning certificate?

While this area of research (using a cluster of devices to brute force and factor a collision of the random number generator leading to a private key with which to generate a weakly signed x.509 certificate) has provided fruitful results in labs, it is not common, and very computationally expensive to do.

In order for you to 'inject a fake certificate' that would evade the browsers OSCP stapling you must have a valid signed X.509 certificate from a CA (certificate authority).


What can happen if my Flask SECRET_KEY becomes public?

If the openid connect relies on flask's session manager, then the session cookies are predictable.

Flask uses the SECRET_KEY for session management, so if I know you SECRET_KEY, I can make a bogus session cookie and impersonate another user, even the admin user.

https://github.com/pallets/flask/blob/1351d0a56580df36872b466eb245e7634c20dab5/src/flask/sessions.py

This seems the only place SECRET_KEY is used in the source code. I went to github and searched for SECRET_KEY and this is the only code that uses it. The rest of the 15 references were docs, tests, or configuration files.


First thing to remember:

nessus is not a discovery tool
is not made to be fast

BTW have a flexible networking scanner.
When you create the policy for the scan. Take a look at discovery tab and port scanning.
Can do also tcp and udp ping.
By default scan the ports in from first to the last. But there is also the random option. Play a bit with the home edition


How do i scan my AWS S3 buckets for malicious content/objects?

you can try the approach of using ClamAV which is an open-source AV.

https://github.com/upsidetravel/bucket-antivirus-function

Also Second approach if you can use the Virustotal enterprise API for scanning S3 buckets that's another thing I am trying out currently.


Allowing the storage and use of LanMan (LM) hashes is a security weakness as Lan Manager splits the password into two case insensitive 7 character pieces before hashing, which makes cracking the password hash much easier.

In general forcing NTLMv2 and disabling the storage of LM hashes is a good idea from a security perspective and as no supported version of windows requires LM hashes, would seem like a pretty safe bet these days.

A weak password can almost always be cracked if the attacker gets a hold of the hashed version of it that is stored on a system.  An attacker can use a dictionary attack which is usually pretty quick to crack many weak passwords, and for short non-dictionary passwords rainbow tables can be acquired to speed up the cracking process.


You are not right. The 'variable-length vector' construct notated as type item <min..max> in TLS includes a prefix length field; see section 3.4 in rfc8446 or 4.3 in earlier versions.

The phase-to-phase steps in the TLS1.3 key schedule use "" i.e. an empty byte sequence/string, aka nothing, null, nil, or (in some environments) epsilon, for the 'Messages' parameter to Derive-Secret; see section 7.1. The value you quoted from rfc8448, which you will observe is the same for all "tls13 derived" operations, is SHA-256 of nothing.


Force AV Scan of USB drive vs. File-Access Scan

As is usually the case it all depends on your needs. There is an argument that as long as you check everything going to or from the drive you are safe, but this won't help you if your drive is then plugged into a machine that doesn't scan it at all. You may be blamed if malware then infects that machine.


Burp configuration to allow SSL connection

You will get that error when you access Gmail, and there isn't really anything you can do about it, except to try different browsers.

This is due to HSTS (HTTP Strict Transport Security) which Google has implemented along with the option to include certificate pinning.  This means that in order to access their sites without this warning, you need not only a certificate that your computer believes is valid, but specifically a certificate that Google has said is valid.   Without an actual cert that Google has pinned, the connection won't be trusted.

HTST is generally implemented as a header so if you're an active man-in-the-middle you might have a chance to strip the header (or at least modify it to not include cert pins) before it gets to the browser, preventing it from thwarting you, but not even this method will work with Gmail, since Google properties (among others) are pat of the preloaded HSTS set that comes with some browsers, including Chrome and Firefox.  This means that your browser comes pre-installed withe the knowledge that Gmail requires HTTPS and specific, pinned certificates.

So, try different browsers, and try to strip any pinned certificates off the Strict-Transport-Security response header before it gets to the browser so that they won't impact your ability to MitM in browsers that don't have Gmail in a preloaded HSTS list.


SSL Cert Validation - Does my site need to be accessible?

Adding to what @JulianKnight said, unfortunately the cheap bulk automated SSL vendors are only really designed to handle public-facing web servers. As part of their issuance procedure they often require you to prove you control the site by placing a file at a specified URL, or something else that they can validate in an automated way. This is largely for the convenience of the CA.

It's a perfectly valid use-case to have a publicly-trusted CA issue certs for private internal-only servers (including TLS uses other than HTTP). Nothing wrong with that, but you may need to pay a little more for the cert because the $0 - $5 certs aren't really designed to handle this. In particular, you'll need to find a CA that lets you prove ownership of the domain by some other mechanism.


1) Initial Response can be taking the particular module/section of page offline or patch it on IPS or WAF. After that you should check the same yourself first with any web-proxy like Burpsuite or ZAP, if the reported vulnerability is false-positive or a real threat. You can also use a tool called SQLMAP to reduce the effort in verification.

2) For analysis part you can see, what sort of data you are able to get using that attack vector. Also you can see what roles are assigned to the web user and what privileges are granted. Depending upon the exposure and impact of vulnerability, you can decide the action.

3) For resolution, You can put server-side validation on the input vector. Also you can change the SQL statement in actual code to Parameterized SQL Query. A detailed procedure for mitigation can be found here. https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

PS: To prevent this from happening you should consider source code analysis at the time of development and after build is complete a dynamic application testing or Penetration Test. This will reduce the surprises in real-time.


Are db passwords useless for local authentication in (web) apps?

Say, for example, you had an upload page that accidentally allowed upload of php files to an executable directory or had an accidental php EXEC running on a string that a user could get a value in to.

In these cases (and many others) an attacker does not necessarily have access to files on your server, but could still execute arbitrary code that they can upload.  Insecure passwords for the MySQL local user make it easier to compromise with such code.

Good segmentation of file access permissions also can help separate multiple sites or services running on the same machine, however, it is possible for an attack against the MySQL instance (if only checking for localhost) to be compromised across sites and services since it is not aware of the executing user, only the IP address of the client.


In SSH, two algorithms are used: a key exchange algorithm (Diffie-Hellman or the elliptic-curve variant called ECDH) and a signature algorithm. The key exchange yields the secret key which will be used to encrypt data for that session. The signature is so that the client can make sure that it talks to the right server (another signature, computed by the client, may be used if the server enforces key-based client authentication).

ECDH uses a curve; most software use the standard NIST curve P-256. Curve25519 is another curve, whose "sales pitch" is that it is faster, not stronger, than P-256. The performance difference is very small in human terms: we are talking about less than a millisecond worth of computations on a small PC, and this happens only once per SSH session. You will not notice it. Neither curve can be said to be "stronger" than the other, not practically (they are both quite far in the "cannot break it" realm) nor academically (both are at the "128-bit security level").

Even when ECDH is used for the key exchange, most SSH servers and clients will use DSA or RSA keys for the signatures. If you want a signature algorithm based on elliptic curves, then that's ECDSA or Ed25519; for some technical reasons due to the precise definition of the curve equation, that's ECDSA for P-256, Ed25519 for Curve25519. There again, neither is stronger than the other, and speed difference is way too small to be detected by a human user.
However most browsers (including Firefox and Chrome) do not support ECDH any more (dh too).

Using P-256 should yield better interoperability right now, because Ed25519 is much newer and not as widespread. But, for a given server that you configure, and that you want to access from your own machines, interoperability does not matter much: you control both client and server software.

So, basically, the choice is down to aesthetics, i.e. completely up to you, with no rational reason. Security issues won't be caused by that choice anyway; the cryptographic algorithms are the strongest part of your whole system, not the weakest.


Google DNS query pointing at ISP instead of Google

Google has some servers (Edge Nodes) located into ISPs for quicker response, this is what they call the Google Global Cache. They are basically big proxy caches for serving static content (such as YouTube videos).

According to their FAQ, it is «designed for end-user networks with greater than 1Gbps of peak Google traffic»

As you have observed, Alaska Communication Systems seems to have some servers deployed in this way. Given that they have a valid Google https certificate, they seem completely legitimate.


How to audit web servers for resistance/vulnerability to BREACH

Stricto sensu, you cannot really have a generic test. In HTTP, the client announces whether it supports compression with an Accept-Encoding header line. The server will then feel allowed to use these compression schemes. @Adnan points to this blog post which describes how one can manually send a HTTP request to a server and see what the server responds with. As an audit method, to check for HTTP compression support, this has two problems:

There is no finite list of possible compression algorithms. At least gzip, deflate and compress are common. With TLS-level compression, at least, each "compression method" was specified by a single byte, so there was only 255 possible compression methods (not counting the "no compression" method), and it was possible to be exhaustive. This is not the case here.
The server is free to apply compression or not, as it sees fit, on any document. For instance, the Apache documentation shows how the decision to compress can be made to depend on the type of target document but also its emplacement in the site directory tree. IIS makes a distinction between "static compression" and "dynamic compression": static compression is applied only on pages or document which are physically files on the disk. In the case of IIS, the decision to compress, or not, is then taken depending on how the requested page is generated, so it can vary for each individual URL...

Not having much details on the attack yet, I still feel as if it is, by nature, very specific to each target site, so we have a few days before us; there is no need to already panic and declare a ban on compression. Let's first get some details on the actual attack. In other words, the "emerging advice" seems a bit premature to me.


What implications does IPv6 have for internet worms and script kiddies?

People who scan the internet will have to find a different source of addresses than just sequential enumeration. Search engines provide a great database of in-use hostnames and addresses, as does DNS.

Scanning the neighborhood might be feasible, but that depends on the neighborhood. In a subnet where DHCPv6 is being used, you can still scan other addresses, since DHCP servers typically assign addresses sequentially from a pool. If autoconfiguration (SLAAC) is used, it becomes harder. If you know what hardware to look for, you know 40 of the 64 hostbits (24 bits vendor ID + 16 bits fixed 0xfffe), and you need to brute-force 24 bits. That is doable.

If privacy extensions are in use, you can still look for SLAAC addresses since a host using privacy extensions has both his SLAAC address and his privacy address.

On server networks, most hosts will be numbered sequentially, using funny words (b00b, babe) or based on info like VLAN number or IPv4 address. These are all enumerable.

So, to sum it up, you can't scan the whole internet, but you can partially smart-scan networks.


Received email from friend but with inago.jp domain

His account might have been hacked, but not necessarily. The email is likely spoofed, and account access is not required to create a spoofed email.

Plausible ways this can happen:

An email is CC'd to a large number of recipients, which includes both you and your friend. Out of that list, one recipient's account is compromised. The attacker (or an automated bot written by the attacker) sees the recipient list of that message and spoofs a message from one person (your friend) to the rest.
Someone who has both you and your friend as contacts is victim of an account compromise. The attacker (or automated bot) sees both you and your friend in the contacts and decides to spoof a message from your friend to you.

So there's a good chance someone's account was compromised, but it may not have been your friend's. That someone might only be distantly linked to both of you.

Tell your friend to change his password and security questions anyway, but it's not reason to panic unless there's evidence that his account specifically was compromised.


Any web site can determine which of their visitors are using Tor, because a comprehensive list of Tor node IP addresses is a public part of the Tor network's operation. What actions a website takes based on that information is out of your control, so you can only expect the worst, whatever that may be.


Encrypt. VPN, ssl, https, etc. That's what they are for, to create secure channels within insecure environments.

HTTPS is an option for 'browsing'. Always make sure you are using the https version of sites instead of the http version. There are browser plug-ins that can help with that, too.

Challenge your assumption that you cannot afford VPNs, With a little knowledge, you can create your own.

Another potential solution is to find a used wifi router for free and use that to connect to your home's Internet connection. Set it up for yourself and don't tell your brother the password ...


LPORT question - I seem to not understand some concepts

You are going to have to set LPORT to two different values. LPORT on the payload should be the port you forwarded on the router (the one you can access externally). LPORT on the exploit should be a port that your attacking machine listens on, for example port 4444.

Explanation:

Since a firewall only allows port 80 and 443, you will need to forward either 80 or 443 on your router to port 4444.

For this explanation, we are going to take port 5555 as the port open on the router, and port 4444 as the port listening on the attacking computer. To deal with the firewall, you will need to use port 80 or 443 instead of port 5555.

Since you are doing this attack over the internet, and have port forwarded to your attacking machine, you are able to send data from a computer on a different network to your attacking machine. It looks something like this:

Computer on another network -> Router (port 5555) -> attacking machine (port 4444)

So since the payload is launched from another network, the only way for it to communicate with your attacking computer is on port 5555.

The exploit / handler is running on your attacking machine which is on your own network. Port 4444 is listening for data which has been routed from an external computer, though your router, and to port 4444. For this reason, the LPORT for the exploit / handler is 4444.


How can someone exploit Google's Physical Web?

A more serious attack vector is phishing or distributing malware. Set up a beacon with a legitimate and/or appealing name, broadcasting a malicious link. Given that (at least for now) this will mainly be used with Android you'd have way more success considering the security record of those devices. (but of course, Google prefers to play with beacons rather than fixing way more important issues like that one).

A solution would be to have CAs just like in the X509 world where the client software that listens for the beacons checks the broadcast's signature against its trust store, and to register a beacon you'd have to obtain a certificate from a CA which will perform verification on what you want to broadcast (so Honest Joe can't make a beacon named Bank and broadcast a phishing link).

Against broadcast strength amplification attacks the client devices should "ping" the beacons and observe how long it takes them to respond. With that you can calculate the distance to the beacon based on the speed of light in air. You can have a very strong signal, but if the beacon is physically far away it would still take a (relatively) long time to respond. However that opens up a different issue, if the client devices are now pinging beacons, then you have a privacy issue because client devices can now be detected and tracked.


What methods are there for using an encrypted database to perform logging that is legally and forensically trustworthy?

Not that I can see. An encrypted database is (partially) protected against outside attackers. For your logs to be forensically acceptable, they need to be protected from modification by you and your system administrators who have full authorised access, and since you'll have the keys to your encrypted database, the encryption doesn't help with that.


Why is using implicit grant more secure than just giving out your secret key?

Isn't this just allowing anyone to access your API regardless of
  whether they have the secret key or not?

Yes, The implicit grant lacks the ability to authenticate the client, which the other grants can do — further introducing attack vectors that the authorization grants, which require a client secret, do not experience.

The use case for implicit grant is authentication of end users and access by client to a resource (possibly owned by the end user) and should be used by SPA Apps (and any other Javascript/User-agent-based app).

If client authentication is important then a different grant must be implemented.

Implicit grant is more secure in the sense that it wouldn't expose the client secret, which can be shared across your internal applications.

Here's a good read on when to use which (OAuth2) grants and OIDC flows https://community.apigee.com/articles/41719/when-to-use-which-oauth2-grants-and-oidc-flows.html


PCI-DSS Network Segmentation and encrypted administrative interfaces

The telephony network is in scope because it transmits cardholder data. The telephony network appears to be on it's own network segment (L1) with controlled access only for administration.

You could use a bastion host for administration of all L1 systems. The bastion host could be located in its own L2 segment. This bastion host could be used by L3 systems as an administrative proxy for systems in L1/L2 segments. Access to the administrative interfaces could be limited to that bastion host only.

The above would also suit for a remote worker. That worker would use two-factor authentication to access the internal network then use a session on the bastion host to manage systems within the L1 and L2 networks.

While the Open PCI Scoping Toolkit has its merits for guidance, if you follow it strictly I find it loses some sense.

It's worth remembering that the next version of the PCI DSS will be released in October of this year (2013) and will probably have new requirements such that segmentation will no longer be adequate and isolation will be required. In your example above, you may have a trusted cardholder data environment and a fully separate untrusted corporate environment which would require two-factor authentication and separate authentication systems. More detail on this should be available in September.


Secure connection over a Unencrypted Proxy is secure?

This can be secure.

The client can issue a CONNECT request to the proxy, which basically creates a tunnel between the client and the destination server. This way, the client can set up an SSL connection through the proxy, and the proxy will see encrypted traffic. Even if someone else impersonates the proxy, he will only see encrypted traffic.

Another possibility is to do a GET request to the proxy. This asks the proxy to retrieve a page on your behalf. This is usually only used for HTTP traffic, but may also work for HTTPS traffic. If your client uses this method to retrieve a page, the proxy can view all data. Furthermore, a man-in-the-middle attacker may impersonate the proxy and also see all data.

If you use an HTTPS connection to the proxy, it is much harder for a man-in-the-middle attacker to impersonate your proxy.


Is it possible to use bitcoin miners to decrypt files/communication?

No.

Modern ASIC miners are highly specialized for the "mining" task of Bitcoin: generating partial preimages of SHA-256 hashes through brute-force searching (to be precise, a value that, when hashed, produces a hash with a given number of leading zeroes).

Breaking SHA-256-based security requires complete preimages (ie. a value that, when hashed, gives the exact hash value being sought), and the world's collective mining power is many orders of magnitude too low for this (the current hash rate is 1.33×1017 hashes per second, enough to generate a complete preimage about every 300,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000 years)

It might be possible to re-purpose Bitcoin mining rigs to break SHA-256 password hashes, since the search space is smaller.  The collective processing power could crack any eight-character password in under a second; ten-character passwords could be broken in an hour or two.  However, SHA-256 is an uncommon hash for passwords: most people use crypt, bcrypt, or MD5.  The mining rigs are too specialized to attack those or any other encryption algorithms.


Determing and deciphering an encrypted drive (knowing the password)

Probably the best place to start is to find out which software was used to encrypt the data. Without knowing that little bit, the answer could be anything.

As for the drive itself, you could try viewing the start of the data in a hex editor and see if you notice any patterns. Such would be an artifact not of the encryption scheme but rather of the software that was used to put it there. Encryption only leaves noise, but sometimes the software you use to encrypt the data will leave its own fingerprints.

The best way to get your utility to run is probably in virtualization. Install your software in a windows VM and attach your drive to the VM as a raw device.


Possible holes in this ASP.NET security design?

Check the inputs to the ASMX and for the parameters of the EXE so that you don't create a SQL injection-type of vulnerability.  Depending on the app and how the ASMX cleans the parameter calls the EXE you may be opening up the door to a wide system expolit.

Your application may be vulnerable to a DOS attack since impersonation on IIS generally isn't as scalable as other methods (such as Claims based authentication & Trusted Subsystem).

You may also see IIS/Process performance issues that can DOS yourself as the resource workers hang while running the application.  You may be better off wrapping your Caller and Win32 app in WCF.  Your authentication should flow through the WCF pipeline pretty easily.

How is the ASMX being called? Javascript or a Fat client?

If javascript is being used, make sure that you're protecting yourself from CSRF attacks (Antiforgery token + Cookie over HTTP POST or similar)


What differs the authenticity provided by RSA signing and AES-GCM?

The authentication part of AES-GCM relies on a shared key between sender and recipient which is only known to sender and recipient. In your scheme the encryption (and thus authentication) key is not bound to a specific sender, i.e. everybody knowing the public key of the recipient can create such a message. And since the public key is considered public this means everybody can do it. Thus, the authentication part of AES-GCM does not prove that the message comes from a specific sender  but only that all parts of the message come from the same sender, i.e. the one which generated the secret key.

Public key encryption with RSA or other allows instead to prove that the message comes from a specific sender, i.e. the one owning a specific private key where the recipient already knows the senders public key. This prove involves that a relevant part of the communication is signed by the private key of the sender. While the sender could sign the random key the system might break if some attacker gets access to a single key (by hacking the recipient) and could then reuse the captured key and the matching signature in all further messages (i.e. replaying the signature). Therefore instead the message itself should be signed.

In summary, AES-GCM and RSA provide different levels of authentication. Which one you need depends on your specific use case. But, if you need to be sure that the message came from a specific sender (and not some attacker) then AES-GCM alone is not sufficient.


What is the difference between probe and scan?

A scan generally means you are using the tools of a system to return precise information about it.  A probe means that you are testing inputs into a system to make educated guesses about it based on it's output.

For example, if you want to know if a website is WordPress, the admin could use the server's file manager to do a scan for files commonly associated with WordPress.  An end user who lacks that privilege may probe your site by testing to see if the site has a login page at ./wp-admin.


PCI Compliance : Capture Credit Card, make ajax call to save address, then post of Payment Provider

First of all, I'm not a QSA.

That said, because you're accepting credit card information directly on your site (even though you don't send it to your server), you need to fill out SAQ A-EP.  Among the things you certify with that SAQ are:

  All processing of cardholder data is outsourced to a PCI DSS validated third-party payment processor
  Your e-commerce website does not receive cardholder data but controls how consumers, or their cardholder data, are redirected to a PCI DSS validated third-party payment processor
  Your company does not electronically store, process, or transmit any cardholder data on your systems or premises, but relies entirely on a third party(s) to handle all these functions

Do note that "cardholder data" does not include the billing address, even though it's data about the cardholder.  In this context, it means:

  At a minimum, cardholder data consists of the full PAN. Cardholder data may also appear in the form of the full PAN plus any of the following: cardholder name, expiration date and/or service code.

So there's no issue with posting the address back to your own site, so long as the card information doesn't go with it.


To me, that's the primary benefit of SPF, not a drawback.   What's happening is that you've  prevented CNN (and spammers) from spoofing your email servers.   That's a terrible practice that they're engaged in, and I'm sure they're doing it primarily to harvest email addresses for their own uses, marketing or otherwise.   If your users are complaining that the links aren't getting through, I'd use it as an opportunity to teach them how to paste a URL into Outlook and send it properly.


What's the most secure way to circumvent encryption to enable password recovery?

To continue @Matthew's thought, let's make this very simple: do you want your admins to have access to user data or not?

I have never seen a system that completely prohibits admins from accessing the data, and also allows data recovery in the case of password loss... those two really seem contradictory.

All of the cloud services I can think of with the "we can't access it either" approach also have a data wipe as part of password recovery process. Examples:

Google Chrome passwords / bookmarks on their Dashboard.

The top 4 cloud storage providers on this list all have a policy of "You forgot your password? Too bad, byebye data!".

EDIT:

The above assumes that you want a standard, light-and-fluffy user registration / recovery process. @Xander points out that if you're willing to put some extra burden on the users then you have options.

As you suggest in your question, you can (for example) put an encrypted copy of the decryption key on the server with the files - as long as you've encrypted this key with something else, like a key derived from a second password, or a key stored in a key file that the app generates as part of the registration process. (but then if the user leaves the recovery key file on the same device that the app is on, you negate all of the security).

At the end of the day, if they forgot their password, who's to say they're trustworthy with this stuff either? I'm not sure it actually solves the core problem of "make your system idiot-proof".


How does a weakness in a random number generator lead to a compromise of the entire cryptographic process?

When you generate a private key, you do so with a source of randomness. If that source of randomness can output N different streams of bits, then, at most, you may get N different private key. This is where we like to talk of entropy, which is a measure of how big that N is. When the source of randomness is said to offer "100 bits of entropy", then it means that (roughly) N = 2100.

The attacker will want to obtain your private key. If he knows that you use a weak source with a low N (say, only 40 bits of entropy), then he can, on his own machine, enumerate all possible outputs from the random source and work out the corresponding private key.

For instance, suppose that you used a PRNG seeded with the current time, expressed in microseconds. This is the time as known by your machine. The attacker assumes that your machine is reasonably well set with the current time, say within 10 seconds. So, from the point of view of the attacker, the seed for your PRNG is known within a 10 seconds range; since the PRNG use the time in microseconds, that leaves him with N = 10000000 possible seeds. The attacker then says to himself: "IF that guy used as seed value x, THEN his code produced private key value Kx; let's see if that matches his public key... nope. So he did not use x. Let's try again with x+1 (and so on)."

So a weak PRNG is deadly in such situations.

How can you detect a weak PRNG ? Well, most of the time, you cannot. A very poor PRNG may look poor from start; for instance, if you generate two private keys and get twice the same, then there is probably something wrong... but, as the "time as seed" example shows, this is not always easy to detect: time flows continuously, so you never reuse a seed. And yet this is weak. Because weakness comes from how hard it is to guess the internal state of the random source, which is not the same as being statistically biased.

A big statistical bias is detectable and is an obvious weakness; but a PRNG can be weak without being detectable as such.

If you are a bad guy and want to make an undetectable weak PRNG, then you can take a good block cipher (say, the AES), choose some key value K, and encrypt the successive values of a counter, starting at 0. This will produce a very long stream of pseudorandom bytes which nobody will be able to prove non-random, precisely because AES is good at encrypting things. But you, as the bad guy, know K, so you can easily predict the whole stream yourself.

The only reliable way to detect a weak PRNG is to inspect the exact method by which the PRNG works, down to the low details: what physical events it gather, why can these events be considered "random", how they are mixed together with cryptographic algorithms to produce pseudorandom bytes. You cannot do that with an opaque hardware RNG, hence the current crop of rumours.