What is the entropy of a call to java.lang.Math.random()?

The representable values of any floating point scheme including 754 are never uniformly spaced. The values returned by Math.random and equivalently Random.nextDouble are uniform in the range [0,1) but are only a small fraction of the double values in that range.

The Java-default Random never has entropy over 48 bits and depending on seeding can be less, and as forest commented it doesn't even try to be secure -- techniques for breaking an LCG (Linear Congruential Generator) given a few outputs have been known for decades. In contrast there are very nearly 2^62 double values in the stated range.


Prevent Users from Downloading Javascript, Images

If it has been loaded into the browser, it has been downloaded to your computer's memory. The webpage might attempt to stop you from saving an image (by e.g. disabling right click?) or similar, but if you go into the source of the webpage, you should always be able to find the location of the image or the .js file; if you can load it into the browser, I'm pretty sure you can't block it from being accessed as such and therefore saved. If nothing else, you could scour your computer's temporary files to find the file you're looking for.

I know this isn't really an answer to your question ('How can I stop people doing this'), but I think necessary to point out.

Think about this: if you can't download it, how can the browser display or execute it?


Is it possible become root through a broken symlink owned by root and globally writeable?

The permissions on a symbolic link are mostly meaningless.  If you don't have read permission, you can't see where it points, and if you don't have write permission, you can't retarget it, but that's all -- and actually creating a link with permissions other than 0777 is quite the trick.  The permissions on the target of the link determine what you can do with the target: if you were to replace the target of a root-owned broken link with a file you created, the target would be owned by you, and would act appropriately regardless of whether you accessed it directly or through the link.


Encryption algorithm selection in IPsec Phase 2

The mechanisms differ for IKEv1 and IKEv2 and whether the initial Phase 2 (CHILD_SA) is created or one is created/rekeyed later.

With IKEv1/ISAKMP every IPsec SA is created with a Quick Mode exchange, which contains the SA, Proposal and Transform payloads used to negotiate the algorithms (see RFC 2408, section 4.2). These algorithms don't have to be the same as those used for the ISAKMP SA. PRF is enabled by negotiating a DH group and establishing a shared secret with a DH exchange. Thus, already the first Phase 2 SA can negotiate key material independent of the Phase 1 SA.

With IKEv2 an initial CHILD_SA is created already with the IKE_AUTH exchange. The algorithms are negotiated with SA payloads that contain proposal and transform substructures (not full payloads). As with IKEv1 the algorithms negotiated don't have to be the same as those for the IKE_SA. However, since the key material for this initial SA is derived from the IKE keys, negotiated with a DH exchange during the IKE_SA_INIT exchange, there will never be a DH group negotiated for this SA (see RFC 7296, end of section 1.2). To establish additional CHILD_SAs or to rekey existing ones CREATE_CHILD_SA exchanges are used. The payload used to transport the proposals/algorithms is the same SA payload used during the initial exchanges. In these exchanges a DH group may be negotiated and a DH exchange can be used to create key material that is independent of the IKE keys.


Statistical Anomaly Detection with machine learning applications to IDS

This Wikipedia article is a bit of a stub, but has a couple of references to start with.

Theoretical issues with ML based IDSs are that they can be fooled in a number of ways, for example by forcing them to mis-train as in this article. Think of this attack as what spammers do to confuse Bayesian filters.

A huge practical issue is that this approach is extremely slow for modern network speeds. The amount of processing that has to happen for every packet is probably going to grind such an IDS to a halt on a few Mbps.

Traffic packet sets are hard to find. There is this very old one http://nsl.cs.unb.ca/NSL-KDD/ that used to be popular. There is also http://www.netresec.com/?page=PcapFiles.


How much security does double VPN layer adds?

There is no general answer to that.

Usually, a security system is implemented to protect against a specific set of threats. In your case, implementing two layers of protection could have resulted from the necessity to protect against a number of potential threats:

Improper access control of application in network 2 from users in network 1
Requirement of using a known weak VPN product as first access layer.
Different networks being managers by different teams.
General network access security guidelines (for instance "no direct access to systems in network 2 from external system").


How does a brute force attack actually determine it has succeeded?

If you have some known plaintext, then you can try all keys and find the one that decrypts to the known plaintext.  You might think this would never happen, but it's actually pretty common, due to protocol structure.

Alternatively, if you know the plaintext has some particular structure -- say, it is English text -- you can do trial decryptions and keep only the ones that produce something that looks like sensible English text.  For instance, you might check that the high bit of every character is off, or use letter or bigram frequencies.

For these reasons, it would be a mistake to think that this is a serious barrier to an attacker.  If the security of your system relies upon the assumption that the attacker won't be able to get known plaintext, or won't be able to recognize a valid decryption, then there's something wrong with the design of your system: it probably isn't as secure as you think it is.

For further details, here is a research paper on the subject:

David Wagner and Steven M. Bellovin.  A programmable plaintext recognizer.  1994.

Here's a quote from the paper: "Most types of text can be efficiently attacked: typically [...] we can expect to find the decryption key 90% of the time by using three ciphertext blocks.  Moreover, binary executables also fall to our ciphertext-only key search machine so long as the attacker knows for which architecture the binaries were compiled".


What knowledge is neccessary to work in computer security?

It really depends on what you want to do in computer security.  To be a generalist, you are going to want to put more time in to getting a solid understanding of the principals of cryptography, if not the exact algorithms.  Without this, it would be kind of like a carpenter that doesn't know what different wood working tools are used for.  They wouldn't know when to pick which tool.  Number 4 and 5 are really the same thing I think.  You can't have a good understanding of how cryptography works practically (the limitations and strengths) without also understanding the theory behind it at a similar level, at least in my experience.

Good is also a rather nebulous term since it could have any number of meanings.  Certainly it would be beneficial (probably critical) to know enough to hold a coherent conversation with a specialist in each of the particular fields.


Thanks for the recommendations. I ended up reinstalling everything from scratch. Also applied Uberhumus suggestion of setting scan order to random.

Other settings I applied:

Maximum concurrently executed NVTs per host = 4.
Maximum concurrently scanned hosts = 5.
I created targets with about 50 hosts per scan.
Disabled the "automatic suspend" in power options.

By doing this I was able to complete the scans.

Hope this helps anybody facing the same issue.


You can also use ssl:// as the identifier in your connection request but you need to set protocol as TLS[specific versions if you are intended to block few, TLSV1, TLSV1_1, TLSV1_2 etc].

We used java clients which worked for us. If you are using GUI clients like MQTTBox, they use mqtts:// for TLS. I dont know if it works as you already aware what mqtts is!!


Https certificate change effects on established secure channels

The change of a certificate in a web-server is not just a basic configuration setting. For example, changing a certificate for a website on apache requires a full restart.

This means that the established connections will be cut off by the restart anyway. Suppose you do this fast enough, subsequent request from user that were using your website will have to renegotiate their sessions (since the server will have forgotten them). So they will be served the new certificate from now on.

Certificate pinning is by definition a client-side action (see What is certificate pinning?) change of certificate will require a change of the pin (unless you pinned the signing certificate that issues your keys).


How to get user and verify password so that the usernames are kept private?

The easiest option I can see here is to avoid immediately returning from the first branch of the code. Instead, continue forward with a bogus hashed_password value and still do the verification.

function authenticate(username, password):
    let user = get_user_from_model(username)
    let hashed_password = BCRYPT_HASH_FOR_MISSING_USERS

    if user is found:
        hashed_password = get_password(user)

    if verify_bcrypt(password, hashed_password) and user is found:
        return "Authenticated"
    else:
        return "Invalid username and/or password"

This way you always do the same steps - you would do a roundtrip to the storage to fetch the user information and do the hashing as well. Only the verification against a non-existent user would always fail.


How secure is VirtualBox for privacy/anonymity?

I just put some opinions from this link:

If they wanted to include backdoors in VirtualBox, they would've closed the source a long time ago. Why would they spend time implementing a backdoor in open-source software that, if ever detected, would pretty much lead to everyone abandoning the software en masse? Leaving it open allows potentially thousands of individuals to comb through different areas of the source as they look for bugs and compile it on their own. There are too many eyes on it for me to buy into the notion of backdoors being likely. Yes, it's still possible. Anything is possible if you want to speak in technicalities.

You can download the source, review it, and compile it yourself.

Generally, yes, a backdoor is possible in any kind of software.

Yes it is possible but if the guest OS is installed in a TC container they need a backdoor also in TC before they are able to have access to the guest OS, and atm i dont think TC has backdoors, even if in these weeks some users are investigating about that.

and also this Virtualbox Programming Guide and Reference

that says: – there are no hidden backdoors into the virtualization engine for our own frontends.

but I think nobody can prove his/her opinion.(the answers are opinion-based not expert-based)


To whom do I report this bizarre behavior (possibly hijacked website or DNS highjack)?

The owner of the website.

Showing malicious pages only in certain cases, instead of always, is a well-known pattern of infected sites/servers to make detection harder.
Random example, if the referrer is empty then only show the "good" site => the website owner (who doesn't need to search his own site in Google) may not notice the infection at all, even if he visits the site every day for years.


Is it technically possible to configure two different SSL certificates for the same domain?

Yes and No.

It's possible to have multiple certs that all have the same domain name on it.  You could have a Comodo example.org cert and an Entrust example.org cert, both of them valid and official, no problem.  I believe some load balancers will rotate which one is used on a per-connection basis, but only in a round-robin fashion.

The No is that you're asking if you can select which cert to use based on the URI (/ vs. /criticalpath).  The problem is, the URI is only available after the SSL connection has been nailed up using one of the two certs.  So you can't really choose which cert to use based on information you can only have after you've chosen the cert.

Now, I'm not going to say 100% it's impossible.  With Apache, for example, you can set the SSLCipherSuite configuration on a per-directory basis, so I wouldn't be surprised if there was some way to force a renegotiation that would involve a new cert.  But I rather suspect it's practically unimplemented even if it is theoretically possible.  (Apache SSLCertificate* is per-server or per-vhost, not per-directory).

Appendix: Musings upon renegotiation

Disclaimer: I haven't done any of this, it's a layman's interpretation of the RFCs and other documents.  Dozens of people here are far more qualified to comment than I.

I'm going to look at TLS 1.2 since it's neatly described within RFC 5246.

Section 7.4.1.1, "The HelloRequest message MAY be sent by the server at any time."  That should trigger the Client to renegotiate the connection.  (The client MAY ignore that request, and the server MAY drop the connection if the client ignores the request for too long.)

A renegotiation looks very much like an initial negotiation, although it may pass some information from the previous negotiation forward to try and smooth the path (e.g., here's the cipher we agreed upon last time).  So the Client sends a ClientHello, then the server sends a ServerHello, then the server sends a Server Certificate (7.4.2).

So my read of the RFC is that, yes, a server can force renegotiation of a connection, including the selection of a different server certificate.

I'll be honest with you, I don't know that you'll find existing software that will do what you want to do.  I would suggest you start playing with Perl Crypto::OpenSSL or Python's ssl lib to see if you can test it out.


A certificate site name mismatch when using preinstalled Toshiba software? (Superfish?)

It is hard to tell you exactly what is going on because we don't know what request actually triggered the message and you do.

What it looks like, however, is that for some reason, a secure request intended for Toshiba's update server went to www.bcrea.bc.ca. There can be many reason for this but few are really encouraging:

Something in your DNS resolution is being exploited to redirect requests to different web site. Given the nature of the target web site (a real estate company), that purpose could be either advertising or a DDoS attempt. Note that this could very well be the result of a locally installed trojan.
Toshiba's DNS server (or, possibly, the CDN that handle their traffic) is misconfigured and pointing you to the wrong (network) location.
The update client you're using is incorrectly interpreting the answer it is getting from Toshiba's update server and it is using a link sent as advertisement as a link to the actual content it is expecting.

At this point, it is hard to give you any more details since there isn't much more information. I would suggest that you treat your system as potentially compromised (running an AV check would be a first step). You might as well ask the question to Toshiba support: since they are the ones who provided you with the problematic tool, they might help you figure out what is happening.

In all likeliness, however, you aren't seeing the result of superfish (or similar TLS terminating proxy software) since the certificate details you provided reference a valid CA but an invalid host name.


When should I use Message layer encryption vs transport layer encryption

I'm confused about what you are asking, and I think you might be a bit confused about some of the concepts, so let me try to guess what you might be getting at and see if I can clear this up.

I think you are asking about the difference between end-to-end encryption vs hop-to-hop encryption.  In end-to-end encryption, the sender encrypts it, and then the encrypted message can traverse over multiple hops, but the multiple hops do not have access to the message; the ciphertext is not decrypted until it reaches the final recipient.  In hop-to-hop encryption, each hop decrypts and then re-encrypts it for the next hop).  Generally speaking, end-to-end encryption is preferable, because it avoids the need to place any trust in the intermediate hops.  So, try to use end-to-end encryption whenever you can.

TLS can be used for either end-to-end encryption or hop-to-hop encryption.  That's an orthogonal issue.  It just comes down to which two nodes you declare to be the endpoints of a TLS connection.


Yes, why not. Key generation (including key generation for ECDH) and private key operations are relatively efficient compared to other cryptosystems such as RSA.

There are some things to keep in mind:

standard ECC operations such as ECDSA do require a good random number generator to be present (this can be avoided by using deterministic signature schemes such as described in RFC 6979;
the small key size makes it relatively simple to use quantum computers to break the system (calculations on smaller number mean less qubits required).

RSA keys of the same strength are only 4 times harder to crack on a QC if current research is any indication. That may not be much of a difference when push comes to shove.

Note that although ECC is relatively efficient compared to RSA, it still requires a fast (Montgomery) multiplier. On smart cards this is usually implemented in hardware - and with good reason. Compared with symmetric crypto, it's still a dog; doing 256 bit modular exponentiation on a 8 bit processor may take - ahem - some time to complete.

You might also require side channel attack protection as well.


What alternatives are there when SSH is being actively filtered?

From what I heard earlier today, https/ssl flows correctly through your borders.

You should hence check out Corkscrew.

Similarly to netcat, it's used to wrap ssh in https to allow the use of https proxies.

Another solution would be to use LSH which, by having a different signature than ssh, works from Iran as Siavash noted it in his message.


Can a survey website viewed in Firefox trick the user into sending stored passwords?

So the way that saved passwords work is that the password you store is associated with a specific domain where you've manually entered the password, and then chosen to save it for future use.

So, if I choose to save a password for https://login.example.com, and that's the only password I've ever saved, it's not going to auto-populate on any domain or protocol other than https://login.example.com. Not for http://login.example.com (unsecured) or https://www.example.com, and certainly not for some random malicious domain that is attempting to emulate the UI of the genuine login in an attempt to trick you into entering your credentials.

There is the potential for attacks if malicious users can figure out how to inject form fields into pages that are served by a domain where you've chosen to save credentials, and I believe there was an in-the-wild exploit based on this approach on MySpace a few years ago, but I'm not aware of any currently know risk to saved passwords from malicious third-party domains.


Automating Social Engineering Prevention

You cannot prevent social engineering entirely, so you need to work on damage limitation. Social engineering only works on people who have the privilege to do something, or know something important. If you remove the sensitive information and risky privileges, you massively reduce your security footprint.

What you're looking for is separation of duties, combined with proper authentication. That is, you give each user the absolute minimum privileges they need to do their job, but allow them to escalate a task or procedure to a superior that has the required privileges, or pass the operation onto an alternate department that has the required privilege. You also provide proper authentication mechanisms to enforce identity.

For example, in a bank you might give the call centre staff the ability to change your credit limit, but not the ability to flag a transaction as fraudulent. The fraud department would be able to flag a transaction, but not change your credit limit. Furthermore, the call centre staff could not approve a loan directly, but would be able to send the loan application to their manager, who can approve or reject the application. All access to the system should be enforced by a password and hardware token (e.g. swipe card, RSA Securekey, etc.) at minimum, so that identity is enforced and a chain of custody can be proven.

In order to access privileged locations (e.g. server room, or a login via SSH) you should require multi-factor authentication. Social engineering is effective at getting things you know, but nowhere near as effective at getting things you have or are. Use proper physical security and digital authentication that requires two-factor or three-factor authentication in order to gain access. In cases where a highly sensitive asset is being accessed, require multi-factor authentication from more than one employee.

On top of all of this, use audit logging everywhere. Every single change that a person makes should be logged, with appropriate measures taken to ensure that logs cannot be destroyed or falsified. This provides a way to identify problems, and leaves you with legal recourse should an employee do something malevolent.


DNS hijack redirect from one HTTPS hostname to another?

For example if I type in to my browser https://www.santanderbank.com and an attacker has taken over that DNS, can they redirect that to a valid https://www.santanderb4nk.com without the browser warning me? Assume the attacker has the certificate to www.santanderb4nk.com but does not have the certificate to www.santanderbank.com.

For a redirection a HTTP request has to be made which results in a redirect response (i.e. HTTP response code 302 or similar and a Location header). When redirecting away from a HTTPS site to some other site the browser first has to make a successful TLS connection to the original site in order to send the HTTP request and get the HTTP response which contains the redirection. To make a successful TLS connection the certificate for this original site needs to be valid, i.e. signed by a trusted CA and matching the name of the site as visible in the URL (i.e. DNS CNAME attacks will not help).

This means the scenario you describe, where the attacker does not have a valid certificate for the original site, will usually result in a warning inside the browser. But the attack might work silently if the user is using some SSL intercepting software (like certain Antivirus or Adware) which does not properly validate certificates, as described in this paper.

But I think the Wired article describes a different scenario, in which the attacker successfully got valid certificates for the real domains. In this case   no warnings will occur since the browser usually does not care which CA issued a certificate as long as the CA is trusted. HPKP can help against this kind of attack.


Getting started with SmartCards; what equipment do I need, what do I need to know?

There are a few different types of Smart Cards, here are the types my old Dell 6420 supports:

Type "A" : ISO14443A — 106 kbps, 212 kbps, 424 kbps, and 848 kbps
Type "B" : ISO14443B — 106 kbps, 212 kbps, 424 kbps, and 848 kbps
HID iClass
Contactless
ISO15693 (Proximity card)
FIPS201 see also NXP  Fire

What are you going to use the Smartcard for?  Signatures, Encryption, or Authentication?  Will the smart card be part of a Common Access Control (CAC) solution?

If you're using it for Authentication know that it's very difficult to get it to work across multiple platforms.  For example, pretend you want to integrate Windows, iPads, Snow Leopard and Linux.  Currently integration of a unified Smart Card authentication is impossible without relying on 3rd party software.  As of Jan 2011, Apple's Federal Engineering Management suggest not using out of the box OSX support for Smartcards.

Thursby's PKard for iOS software extends CAC support to Apple iPads and iPhones
Coolkey is a LDAP server that provides smart card login, single sign-on, secure messaging, and secure email access.

Here is a ton of information on how to set up a PKI and ROOT CA that allows for smartcard use.

Also this document describes the Homeland Security HSPD-12 smart card security standard and related Active Directory configuration.

Lastly, SmartCard deployment is much more than the technology involved.  I suggest also learning about the processes of securely provisioning them.

Microsoft has a Solution Accelerator for Secure Access using Smart Cards available here that includes technical solutions, hypothetical scenarios and technical requirements on how this can be done.


What are the go-to books on server security?

I don't think such a definite set of books exists- there is a lot to security, and everyone on here is going to have a different opinion on what papers and books are superior and inferior. For example, some books cover certain topics excellently but others vaguely. Some are perfect for a certain type of individual, with a specific skill and level, but absolutely trivial and boring for another.

Personally I think you are best researching one specific topic at a time, with a variety of resources that you have picked. So instead of grabbing a suggested, broad, security book and reading it from front to back, pick up several books and resources, and read how they each cover one specific topic. Make your way through topics using an array of resources.

While doing this ensure you remain hands on. You don't want to just read, you want to actually do it yourself. So set up a local server environment and get to work; set up your own experiments and be prepared to break things (recursive: breaking, fixing, securing).

Securing a server also involves securing the applications running on it. There is no point having a super secure server if the main application running is vulnerable to SQL injection and remote file inclusion. That then opens up the available learning content massively. So make sure you remain open. Also remember, even if you take all precautions, you still, sooner or later fail; Keep damage minimisation and mitigation on your mind- limit scope and verify backups.

Digital security is a long, forever changing road.

If you were to provide a bit about yourself: your skills and proficiencies, maybe someone would be able to recommend some starting resources and topics (are you a confident server administrator and/or engineer? / are you aware of the top server/web application vulnerabilities? / What is your experience in digital security? / What type of application and server you are working on? / etc)


Is ExpressVPN using hidden trackers or spyware?

I work for ExpressVPN. No, this is not malware. Here’s what’s happening:

The ExpressVPN app for Windows is composed of two parts: the UI and
the “engine”. The UI runs as a regular Windows app. The engine
(xvpnd.exe) runs as a Windows service and is responsible for
controlling the VPN. One benefit of this design is that the VPN is
not affected if the app crashes, and that the VPN killswitch can
start as early as possible on boot.
The app and engine communicate with each other using http. That’s why you see the engine listening on port 2015. Important: the engine binds to the local network only. No outside traffic can reach that port.
When the user connects to the VPN, the engine is responsible for testing which of our VPN endpoints is likely to give the most reliable and fastest VPN connection. It does that by sending UDP packets to various VPN server IP addresses. The IP you mentioned (199.19.94.101) belongs to our “Canada - Toronto” VPN server location.
It’s possible you encountered a bug here. The engine is only supposed to test VPN servers when you’re about to connect to a location, and it seems what you’ve reproduced is a case where the engine was testing VPN servers regardless. Our team is investigating and will fix once we determine the root cause. Thanks for raising the issue.
We ourselves haven't been able to reproduce the warning yet in Malwarebytes, however we will contact them for further information. In the meantime you can add an exclusion for ExpressVPN by following these steps: https://support.malwarebytes.org/customer/portal/articles/1835329-how-do-i-stop-malwarebytes-anti-malware-from-blocking-scanning-a-file-or-program-that-i-trust-?b_id=6438


If I send someone a google search results link, am I sending them any information about me?

If you want to know that, Read
The Ultimate Guide to the Google Search Parameters and Advanced Google Search. The google search query structure is broken down into chunks and has detailed information about their purpose. You will get to know what the parameters in your search queries are.
The following are some of the decodings of Google's search query syntax.
Basic Search URL:
https://www.google.com/search?
hl=en
&q=test
&btnG=Google+Search

Advanced Search URI
https://www.google.com/search?
as_q=test (query string)
&hl=en (language)
&num=10 (number of results [10,20,30,50,100])
&btnG=Google+Search
&as_epq= (complete phrase)
&as_oq= (at least one)
&as_eq= (excluding)
&lr= (language results. [lang_countrycode])
&as_ft=i (filetype include or exclude. [i,e])
&as_filetype= (filetype extension)
&as_qdr=all (date [all,M3,m6,y])
&as_nlo= (number range, low)
&as_nhi= (number range, high)
&as_occt=any (terms occur [any,title,body,url,links])
&as_dt=i (restrict by domain [i,e])
&as_sitesearch= (restrict by [site])
&as_rights= (usage rights [cc_publicdomain,cc_attribute,cc_sharealike,cc_noncommercial,cc_nonderived]
&safe=images (safesearch [safe=on,images=off])
&as_rq= (similar pages)
&as_lq= (pages that link)
&gl=us (2-digit country code in lowercase)
&btnI=I%27m+Feeling+Lucky


ByPass usb GPO with iphone -and probably other mobile-

It's most likely connecting as a Media Device or Camera. There's a seperate GPO for each type of removable media. Perhaps this particular policy only enforces against flash drives.

This is quite common on androids.. I can switch my device to be a Camera and bypass our GPO for blocking removable devices.


Does a signed hash reveal any information about the original message?

I believe this is a case of the XY problem. You are trying to allow authentication in your protocol scheme, and you are asking how to securely do it using a method which you implicitly assume is necessary. The reality is that there are already plenty of ways to prove that a given key is authentic without sending over a hash of the key. I suggest you read into how TLS provides authentication without actually signing the session key itself. As that's the subject for another question, I'll answer specifically as to whether or not the signed hash of a message (such as a shared key) reveals any information about the contents of the original message (tl;dr the answer is no, it does not).
Signing a message involves computing the hash of the message and signing the hash. Because the signature depends only on the value of the hash, we can safely ignore the signature. It gives away no more information about the message than the hash itself. So can we attack the hash?
An attack that would allow someone to learn information about the input to a hash function given only the digest itself is called a (first-)preimage attack. More specifically, this is an attack against some hash function f where given only digest h, one is able to find an arbitrary message m such that f(m) = h faster than exhaustive search. All modern cryptographic hashes*, such as SHA-512, are conjectured to be preimage-resistant. As such, providing the hash to a message gives away no information about the message itself. The only possible way an attacker could find the message is if it is short enough that it is feasible to brute force the message until a matching hash is found.
For future reference, there are three classes of attacks against a cryptographic hash function f:

Preimage attack - Given h where f(m) = h, find any m' such that f(m') = h.

2nd preimage attack - Given m, find any m' such that m ≠ m' and f(m) = f(m').

Collision attack - Find any pair of m and m' such that m ≠ m' and f(m) = f(m').

An unbroken cryptographic hash with a digest length of n is assumed to have a first-preimage and second-preimage resistance of 2n and a collision resistance of 2n/2. This is the case for SHA-512.
* Formally, a collision and preimage-resistant cryptographic hash is defined as a function that maps an arbitrary-length input to fixed-length output. For a message space of {0,1}* and some fixed n, the algorithm for cryptographic hash function f is defined as {0,1}* → {0,1}n. This is explained in more detail in an answer on Crypto.SE.


EFS serves two purposes:

It encrypts your data at rest. An attacker who steals your computer but doesn't know your password cannot recover the encrypted data.
It secures files on a multi-user system in such a way that other users cannot read the files, even if the ACLs permit it. For example, any member of the Administrators group can usually override the ACLs to gain access to any file. With EFS, even an Administrator cannot decrypt the file (unless they were granted access to the encrypted data specifically, which is not something you're likely to do by accident).

Note that even if an Administrator resets your password, they can't access your encrypted files. In fact, resetting a password makes EFS-encrypted files permanently unrecoverable.

Now, if you're worried about attackers with access to your account, then you need to use a different mechanism, yes. Some good options:

VeraCrypt, based on the TrueCrypt project (before it was disbanded). Also lets you create entire encrypted volumes that can't be accessed without the password (although once mounted, they remain accessible without re-entering the password until you close them).
PGP (or more likely, GPG, which is free and open source). Lets you encrypt files either with a password, or with a public key; in the latter case they can't be decrypted without the private key, which is usually itself password-protected.
BitLocker, a full-disk - technically full-volume - encryption feature built into some Windows editions. Used on a on a removable drive, you can set a password (though once it is plugged in and the passkey entered, Windows will keep the drive decrypted until you reboot your PC or eject the drive).
7-Zip, a compression and archive management tool. Supports much higher-quality encryption than the (trivially breakable) legacy Zip encryption. Not really a crypto tool, but seems to have decent crypto quality.

Using Word as an encryption tool is... not a great idea, but if you have a modern version it's probably OK (at least for Word files). Office used to use really awful encryption, but it's supposedly better now. Still, you really ought to use something focused on crypto instead.


Purpose of client and server random numbers in SSL Handshake

The Pre-Master Secret is derived from the above random numbers (except where Diffie-Hellman is used). It is then encrypted with the Server's Public Key and sent to the Server. the catch is, this encrypted message can ONLY be decrypted by the Server's private key. so if an attacker knows/has the server's private key(the golden key), then its all over already - don't even bother with the TLS.

More information on the random numbers can be found on: Why does the SSL/TLS handshake have a client and server random?


It is a kind of challenge-response protocol, which means that if an eavesdropper manages to read the communication, they'll only have part of the password.
In the same way, it offers a little protection against shoulder surfing.

Whether this really enhances security is open for debate. Eavesdropping should be prevented by proper use of TLS.

One drawback is that the server must know at least part of the plaintext password. Or hashes of several parts of the passowrd, which effectively splits a long password in several smaller ones that are easier to brute-force.

Also, as @Matthew points out in their comment, this might give away the length of the password to an attacker, if the password interface is poorly implemented.

I'm generally in favor of challenge-response protocols for authentication and identification, but this seems a poor implementation of one.


stack buffer overflow in the main function?

You've run into the hardest part of exploiting a buffer overflow: determining how to get the code to execute. Injecting code is trivial once you've found the vulnerability, but getting the CPU to start executing that code, not so much.

Without a strong understanding of stack frame layout, you will find the rest difficult to follow.

One point of note is that in C, main, from the process's viewpoint, is just another function that is called (this is different in C++ see comment below). While you think of it as the beginning of execution, to the CPU it is a full function call with a return address on the stack. So exploiting a flaw in main is the same as exploiting a flaw in any other function.

As an attacker, all you can do with a buffer overflow is write to the data section of the process, you need to find a way to have the process read something from data that controls what will be executed. Basically, you need a place in data memory where the process will look to determine what should be executed next (ie: to determine the value of the program counter or PC).

The most common type of locations in data memory that affects the PC are a function's return pointer. When returning from a function, the CPU will read the return pointer off of the stack and set the PC to it (or the instruction after it - details CPU dependent). Unless you return from the main function it is very unlikely that you'll execute a successful attack. You'll need some place in data, preferably on the heap, where the processor will read data that is used to set the PC.

The other "common" (tho much less common) places in data memory that are used to exploit a buffer overflow attack are function pointers followed by a function call, and exception tables followed by an exception. Neither of these seem applicable to your application. So you probably have a non-exploitable stack buffer overflow vulnerability. The worst I suspect that you can do is crash your app.

The steps the attacker needs to take for a standard stack buffer overflow exploitation are:

Identify stack buffer overflow vulnerability.
Determine address of stack at time of vulnerability.
Determine address of function return pointer in current stack frame.
Write code (frequently called shellcode) for attack.
Create input that loads code and modifies function return pointer to point to shellcode on stack.

So now that you've found the vulnerability, you need to determine the stack address for call to main. The easiest way to do this is to print the address of id. Next, the return pointer's location. This is likely two words lower in memory than id. Something like (char *)id-2*sizeof(int).

The next step is to write your shellcode. I'd suggest you create a function in your program that prints the string "attack successful" and then exits. Make your shellcode a call to this function.

Now sit down and layout the data on the stack (this stack frame layout reference should help) including a return address jumping to your id variable's buffer. Convert the stack data to ASCII and input it to the program.

This page has a more concrete example of what I've described.


Do HP ProCurve 1810G Config files have password hashes or other sensitive info?

The password is very likely somewhere in that binary blob, so yes, you should keep the backup file safe.

A while back I stumbled across http://www.happyhacking.org/Happy_Hacking/Blog/Entries/2010/3/20_HP_ProCurve_1810G_Take_2.html which has some details on the binary.

btw: the 1810G stores the base64-encoded password in your authentication cookie, so you might want to take care of that as well...


Is there any disadvantage in using OpenNIC for DNS resolution?

NameBench is a Google engineer's side project.  It can test a large number of DNS servers to make sure that their resolution is "safe", and not a source of censorship.  It will try and resolve common domain names like www.paypal.com, and make sure that they are pointing to the right location.  (Not of the censorship checks are working properly at the time of this writing,  but this feature still works.)

Namebench also performs speed checks.  When I ran it i found out that level3's DNS resolution servers where on average 4 times as fast as the ones provided by my ISP. Also my ISP was maliciously redirecting failed DNS lookups to a spam page,  which is why I was looking to replace them in the first place.


When you are browsing TOR hidden services, the TOR system already provides end-to-end encryption, so another TLS layer is redundant. It is in fact counter-productive, because one of the goals of TLS is to de-anonymize the server. It makes no sense to go through the trouble to set up a hidden service and then get a certificate from a certificate authority which tells the whole world who you are. Well, you could use a self-signed certificate (some people seem to do this, otherwise Orchid wouldn't explicitly disable verification), but a certificate not signed by a certificate authority can be replaced by a man-in-the-middle so it only provides protection from a passive eavesdropper.

However, when you browse normal websites via TOR, TLS is even more important than usual, because the exit node can eavesdrop on your traffic in cleartext and even manipulate it. There were already exit nodes spotted in the wild which exploit this by inserting advertising or even malware into websites their users browse or to sniff logins for popular websites. Using TLS makes this impossible, but only when used correctly (which means with certificate validation. An unvalidated certificate could be from the malicious exit node).


Security considerations in storage of audit logs

As an IT auditor, let me give you an answer from experience.

Segregation of duties - SOD

It is a good practice and core principle to segregate employees who operate or administer the system from which audit logs are produced from employees such as myself, with responsibilities to review these logs for fraud / malicious activity / security vulnerabilities. If these duties are not segregated, then a single individual can undermine the system by making a malicious change, and cover his wrongdoing by modifying the audit logs to hide his actions. To illustrate, the following individuals in general should not have access to log data.

Security administrators
Computer operations personnel
Data base administrators

To expand on the above examples, if a security administrator has access to logs data, he can escalate his own privileges to allow for improper access greater than is appropriate for his job duties, a violation of the security principle of Least Privilege. To prevent or deter detection, he can delete and / or falsify values for log entries of date, user ID...etc. The same reasoning applies to items 2 and 3.

To prevent the aforementioned, logs can be centrally stored in a server in which access is strictly controlled to individuals with specific roles - RBAC. Periodic review of individuals having access to logs should be conducted and improper access rights should be removed immediately upon discovery.

Secure storage of logs

Log data should be backed up on a regular basis and the backup should be stored offsite away from main company operations. This is to ensure that if a disaster (ex: Fire or flood) were to occur at the main company site, data loss will be mitigated.If logs contain sensitive information, log backups should be encrypted using strong cryptography such as AES 256. A written method, such as receipts should be used to track shipping and receipt of these logs. Periodically, a reconciliation of backup media should be taken against the tracking documentation, with any failed reconciliations promptly investigated.

Monitoring procedures regarding security and confidentiality of backup storage should be documented. If these responsibilities are delegated to a third party to perform, SLAs and a contract should ideally be in place, explicitly specifying the duties of each party (Company and vendor), and ideally include a right to audit clause in the contract. Log retention length of time should be documented in a retention policy known to all individuals with a job role of handling backups.

Finally, to learn more, this is an authoritative source from ISACA.


Can I access my own account logs at Godaddy without a subpoena?

As others have already said, this is more a legal question not a security question. But to be blunt the answers aren't so long:

Yes they have full rights to deny anything you are not entitled to by the contract you agreed to when you signed up. Think of it this way, you host a server and you have users that can log in. do they have rights to your back-end logs? probably not. nor would you want them to. Do they have rights to their profile information? Maybe, depends on your TOS.
Privacy policy is the only other way. privacy policy throughout history has been the best way to get information or hold accountable a company that states one. since not adhering to it can be deemed fraud. I don't know go-daddy's PP, nor do i know if it would help you. but if for nothing else, give it a look through and see if you can leverage any part of it to come back to them without having to go through a legal process.

That pretty much sums it up i think.


Sophos virus protection continuously blocking codegv.ru

check your chrome extensions - you might have accidentally installed a malicious extension


SELinux and text relocations exploitability

There are two major points to make. The first is that a major strength of SELinux policy is to prevent exploitation of unknown vulnerabilities. Given that they are unknown, a CVE will not exist.

The second is that permitting text relocation also permits an exploit to write and execute whatever code it would like to execute, or allows it to modify existing code in memory. You reference Ulrich's short blurb which also contains his "fixing the problem" article; both of which are excellent and explain the problem.

The "need to perform text relocations" is not itself a vulnerability; it just makes some vulnerabilities in the program or libraries easy to exploit.


The value of salt is not in its secrecy, it's in its differentiation and the added complexity. You've touched on this a bit.

First, two passwords hashed with different salts have different resulting hashes. Therefore, an attacker cannot look at a password table and discover users who share the same password.

Second, as you write, a rainbow table could be pre computed for a large set of password inputs, allowing fast, O(1) time, password recovery. However, this is often for unsalted passwords.

Third, the salt for a password hash is unique to that hash and should be the same size (bit length) as the hash algorithm. A single rainbow table is the size of all password inputs. Assuming 8 character passwords, case sensitive alphanumeric plus symbols (let's say 10 extra) so that's 72 characters. 8*log2(72) is about 50 bits. So, the rainbow table storage for sha-1 hashed passwords is 50+160 or 2^210 bits.

At 2^202 bytes of storage, that's already larger than all the current storage on the planet. I think we can conclude two things: 1) not all passwords are placed in a rainbow table and 2) unsalted rainbow tables are already fairly large.

Now, creating rainbows for every possible salt means requiring 210*160 or 2^33600 bits of storage. Where to put all that data (other universes) pales in comparison to the time required to create them (beyond the end of our universe).

Rainbow tables per salt ain't going to happen.

The proper attack is to capture the password database and run a dictionary attack against individual entries using the non-secret and password specific salts.


Intel SGX and MSRs - what do developers need to know?

This is a great question! Never thought about this until you asked.
Firstly, code running inside a secure enclave runs in ring 3. So all restrictions that apply to untrusted non enclave ring 3 code apply. So an enclave cannot write to MSR's.

Next, the specs don't explicitly mention anything about MSR's but it does tell you about interaction with IA32 features. For the branch tracing example you gave, look at the section on LBR(last branch record). This tells you exactly how it interacts. From my understanding, EENTER/EXIT instructions are seen as one long branch each to the entry point inside the enclave. Anything that happens after you jump to code inside the enclave is not recorded or visible to untrusted code no matter the privilege because the branch records are popped out of the LBR stack on enclave exit. It is only visible on a debug opt in entry that can be set by the developer of the enclave and as the name clearly states, the enclave is in debug mode.(See chapter 7,section 5 on branch tracing.) So the side channel you are talking about should not be possible.

Branch tracing side channel attacks might not be an issue, but other kinds of performance monitoring could be an issue.  Page faults, memory accesses, cache behavior, etc. can still be monitored. Cache-based side channel attacks are still possible as well. So yes side-channel attacks are possible against enclave code. The Haven paper from Microsoft explains the kind of limitations that SGX still has in terms of side-channel attacks.

And to answer your question, what an enclave developer needs to know about MSR's depends on what kind of attacks the developer expects in his code. I assume there will be some sort of threat modeling while designing and developing the enclave and based on what threats you expect, you need to figure out how SGX treats these threats. The branch side channel attach is an example of figuring out how SGX treats it.

For the most part, I expect any MSR/register/processor state that could leak information about the enclave and its execution are hidden/protected from untrusted code, privileged or unprivileged and an enclave writer need not worry about it.


If I want to protect a string from modification, is it enough to salt and hash it?

This technique can be implemented reasonably securely. I would view this as an advanced technique for high performance: something you should only do if you're sure you know what you're doing. If you don't need high performance, it's simpler to have the server validate the user is authorised for each request. Having said that, this pattern is actually quite widely used, especially when a dynamic website hands off to a content delivery network.

You should use HMAC to generate your hash. You can use HMAC with any hash; for this purpose SHA-1 is quite adequate. Among other things, this protects you from Length Extension Attacks.

The simplest arrangement is that the hash contains a fixed server secret and the URL. The problem with this is that once a user has a URL with the hash, this is valid forever. You can't revoke a user's access to a particular resource.

We can partially fix this by including a timestamp in the URL. When you generate the hash, use the current timestamp. When you verify a hash, also verify that the timestamp is within a period you consider acceptable (perhaps 24 hours). There are other approaches to fixing this, such as including the user's session ID in the URL, although this would require a database lookup to verify the hash.


Are there risks to having many uids on my gpg key?

It may be useful to use different subkeys for each distinct purpose in order to compartmentalize them. You may want to have one subkey for the email you use for your personal correspondence, and another subkey for work-related emails. You can have yet another for git. While you don't have to do this, it's often a good idea to minimize the exposure each key gets. Even if your work is not particularly sensitive or you don't think you're at risk, it's always a good idea to ensure that no one who manages to steal your key through personal channels can reuse them for other purposes.
There are a few other benefits to using multiple subkeys:

Each subkey can use a different password of a different strength.

You can set the expiration date for each subkey differently.

You can revoke individual subkeys, for example if you quit your job.

It gives better granularity if you are part of the Web of Trust.


Yes, it works by remembering your MAC address. When you connect to a router – a firewall redirects you to a web page for authentication. If you pass authentication step then your MAC address is added to the whitelist.

It doesn't necessary map your MAC address to a specific IP. It just redirects all http(s) traffic to the authentication page if the MAC address is not in the whitelist.

Yes, MAC address can be spoofed easily. Using aircrack-ng toolkit you can monitor nearby clients connected to the WiFi and use their MAC address to skip the authentication.


Is it possible to use WebAuthn for digitally signing documents in the browser?

Yes, this is possible
A security challenge for the Web Authentication API can by any byte array (of at least 16 bytes), and it will be signed by the clients secure private key. It can therefore also be used to sign documents or messages of all types by passing the document as a PublicKeyCredentialRequestOptions.challenge in the call to navigator.credentials.get().
The PublicKeyCredential returned by the call contains a response property, which contains a signature property which is the signature you are looking for.
The example code from developer.mozilla.com slightly modified to fit your use-case:
fetch(/* get file from server */).then(response => response.arrayBuffer()).then(fileFromServer => {
    const options = {
        challenge: fileFromServer,
        rp: {
            name: "Example CORP",
            id  : "login.example.com"
        },
        user: {
            id: userId,
            name: "jdoe@example.com",
            displayName: "John Doe"
        },
        pubKeyCredParams: [
            {
                type: "public-key",
                alg: -7
            }
        ]
    }

    navigator.credentials.get({  publickey: options })
        .then(function (pubKeyCredential) {
            const signature = pubKeyCredential.response.signature

            fetch(/* Send signature to server */)
    }).catch(function (err) {
      // Deal with any error
    })
})


Is the service join.me actually a huge security risk?

While the "watching a screen" aspect of that site is pure flash, the screen sharing component is not.  When you attempt to share your screen, it downloads an executable to install; an .exe on Windows, and a .pkg on Mac.

So, yes - it's a foreign binary with the capability to steal all of the data you mentioned and more; but the sharing isn't using flash, so your fears on its access to data outside of the browser are (thankfully) not the case.


What happens if a Dropbox folder is encrypted by WannaCrypt / WannaCry?

If your local files get encrypted and synced they will also be encrypted in your online folders. Luckily Dropbox supports file versioning (https://www.dropbox.com/help/security/recover-older-versions) so if you happened to have your files in Dropbox get encrypted you can restore them easily.


I suggest the Microsoft Press book titled "Threat Modeling"


Library or service for rate limiting credit card transactions by IP

I would say: Ask your acquirer. If you roll your own library or use a 3rd party service, the rate limiting might not Count towards you in "fraud fighting score" at all, and you will still be liable if the order makes it through.

If you select such services by your acquirer, then the acquirer knows that you are actively fighting against fraud, and the acquirer might swallow any fraud that happens to originate from you, and you might also even get lower rates.

I would say, one great thing to do is block so the issuing country of the credit card must match the IP country of the visitor. Then you have closed the door for a large amount of fraud.
If your service is only usable in a few countries, you can also lock down so only those countries (both when it comes to IP and card issuance country) is permitted.

Another thing you can do is to use Verified by visa/3DSecure. VBV/3DS will trigger even if the expiry date or CVV is invalid, so the customer will not get to know if the card is valid unless the customer does authenticate Verified By Visa/3DSecure correctly.

You can use VBV/3DS in 2 modes: Either you use it in the "normal" mode, where cards without VBV/3DS will go through without problems. But you can also ask your acquirer to set your service to REQUIRE VBV/3DS, eg if the card issuer does not support VBV/3DS, the transaction is rejected. Not all acquirers might have this service available.


The easiest way is to pass in just the hostnames and let Nmap do the name resolution. In this case, all the ssl-* NSE scripts will use SNI to pass the server name you passed on the command line. That's not always possible, of course. Some times you have to specify IP address and you still want to provide or detect the hostname.

Over on Nmap's Github repo there is a pull request to add a script argument that will do just that. It can only handle one name at a time, but it's worth trying out. I'll probably be adding it to the next Nmap release, now that you've brought it back to my attention.

A more complete solution might be to allow users to provide a reverse mapping of IP address to name. We already have that present in the reverse-DNS (PTR) records, but these are not always the names that TLS services actually use. You are more than welcome to chime in on Github or via the nmap-dev mailing list.


Isn't using pbkdf2 + scrypt + bcrypt best?

PBKDF2, scrypt and bcrypt are all configurable; they can be made as slow as you want. The limiting point is not the computer, but the user's patience.

For example, suppose that the user will go irate if the password processing (e.g. to unlock an archive file) takes more than 6 seconds. If you use bcrypt only, then you can tune it up so that it takes 6 seconds on your machine. But if you use PBKDF2 and scrypt and bcrypt in succession, then they will have to fit together in the 6-second budget, meaning that, in practice, you'll configure them with lower iteration counts, e.g. 2 seconds each. From that point of view, using three algorithms in succession is no better than one; what matter is the total time.

The point of this configurable slowness is that it makes things harder for the attacker; you want to choose an algorithm that makes each password guess as expensive as possible for the attacker. The attacker does not have necessarily the same hardware as you (e.g. he will likely try to use a GPU), so each algorithm may be more or less "good". The attacker can always buy a PC such as yours, and thus do in 6 seconds what you do in 6 seconds; however, the attacker may sometimes buy a more specialized hardware which will be better than yours for that specific task. This is especially the case with PBKDF2 and GPU. As a defender, you want to avoid such a situation. Thus, some algorithms are better than others, and, in the PBKDF2 / bcrypt / scrypt triad, one may assume that one algorithm is "stronger" in the sense explained above.

Therefore, using just that algorithm, alone and with its configuration adjusted so that it takes as much time as you can tolerate, will be optimal. By definition, using all three algorithms in succession cannot be as strong as that unique algorithm alone. In practice, this means that you should use bcrypt: the budget you spend on PBKDF2 is squandered security, since, for the same CPU usage on your machine, bcrypt would have provided more resistance (see this for some details about bcrypt vs scrypt, and that for even more details on password hashing in general).


Should I blur my fingerprint when I share a picture/scan of a document containing it?

You may want to blur it out.  Fingerprint readers are pretty aggressive at picking up partial prints, and the way fingerprints can be easily forged there's no reason to post them publicly.

However; you need to be aware that fingerprints are not secret.  You leave usable prints on every glossy surface you touch, and duplicating them and fooling readers has been demonstrated by amateurs for decades, using several different techniques. Always take care that the fingerprint isn't your only layer of defense.  For example, if you have an iPhone with a fingerprint reader, make sure you still require a passcode to access your credit card data or password list.  You always want an additional layer of security around your more sensitive data.

The good thing about most fingerprint readers is that they require the attacker to be "local".  A foreign hacker can't trick your iPhone into believing his scan of your fingerprint.


I suggest running Network Monitor (from Microsoft themselves) continuously, with a big buffer. NM works with a RAM buffer to save the captured data, and when the buffer is full, old packets are discarded; so you can let it run unattended. Then wait for one of the suspicious connections to happen; at that point, stop the capture and save the trace.

This will give you a fair bit of context (if your buffer is wide enough, a few minutes or even hours of previous traffic). Moreover, NM tries to link data exchanges with the processes (and even when it fails, you can use the trace to understand what was happening on the machine at that precise time, and thus pinpoint the probable culprit).

It also seems that NM can be automated to some extent.


Windows: What are the security implication of adding Network Service account to “Event Log Readers” group?

The security implication of this would be that if an application which is running under Network Service is compromised, an attacker would be able to read those event logs.

The preferred way to handle this situation is to create a new login with similar permissions to network service, and to give that access to the event logs.


How much security would I lose if I enabled "easy enter" pins on an android device?

It would not take away any security. Simple, Easy enter pins would simply auto-OK or auto-ENTER when 4 digits have been entered - just like iPhone. However, it would still mean that incorrect attempts are counted and at too many attempts the device is locked and require online authentication via google account.

The implications "Easy Enter" could have, is if the device is in pocket along with some other things in your pocket, and it accidentially push the home or Power button leading the touchscreen being activated, then Those things (like keys, wallets etc) can accidentially enter too many incorrect pins in a row , causing the device to be locked.


A man-in-the-middle attack is a simultaneous double impersonation: Charlie poses as Alice when he talks to Bob, as Bob when he talks to Alice. Since both conversations are simultaneous, Charlie can elect to pass chunks of data from Alice directly to Bob and vice-versa, adding his own parts selectively.

If Alice and Bob have a shared secret K, which Charlie does not know, then they can use encryption and MAC to prevent Charlie from doing a successful MitM (Charlie can still cut the wire and disrupt communications, though -- but he can no longer alter data without being detected, or read confidential data). The trick is to reach the point there such a secret K is shared; all the business with certificates and handshake in SSL is about doing just that.


For Windows, Linux, macOS with no previously-installed agents (e.g., either free or commercial agents such as SCCM, JAMF, osquery, LimaCharlie, FireEye HX, Crowdstrike Falcon, et al), I would jump to either GRR or NBD. For Windows, there is an NBD-Server project that can attach either memory (via GRR/Rekall's winpmem) as well as disks to NBD server TCP ports. For Unix and Linux OSes, it's simply nbd-server, available as a package on most distributions (or you can compile it to a specific platform).

The client should probably be a Linux machine and be able to load the NBD driver and use the nbd-client from userspace with The SleuthKit and filesystem mount tools. I have used CAINE Linux as the NBD client as it contains all of the tools necessary (N.B., others prefer SIFT, or via GIFT). You can then use plaso to acquire artifacts. For a full list see the formats here -- https://github.com/log2timeline/plaso/wiki -- or check out the --help and --info flags for each of the plaso tools. One of the best ways to work cases and collaborate on timeline data is to use a tool such as Google Timesketch.

In a way, the above would be running forensics on it, but I still think it's the best way. If you want to run around networks for hunting operations, perhaps check out Kansa or PowerForensics, but both of these are Windows-specific due to their reliance on PowerShell. CrowdStrike also has a wonderful free, open-source software (FOSS) solution, Falcon Orchestrator, that is built for your purpose -- but again, only Windows-specific. The nicest thing about NBD, pmem, and plaso is that you only have to teach the concepts to your staff once and they apply equally-well to all platforms.


Shared Apple Dev Accounts Two Factor Auth

One of the purposes of 2FA is to prevent the sharing of a single/central account by multiple members of a developer team, the way you say you have been doing.
Just considering issues you raised, with this kind of sharing model:

can't track who actually accessed the account and did some actions
when a developer leaves, they can still access the account, unless you change the password (and then everybody sharing the account need to be informed about the new password, except the developer who just left). It is all too easy to forget the change the password, and former developers could have such unauthorized access for months or years.

2FA helps to enforce better security. As you suggested, you may need to make some changes in your work processes, e.g., a single user (or maybe 2 or 3?) managing the admin management of the apps, etc.


As @dave_thompson_085 above points out, there is only one way to do this with OpenSSL which is:
openssl pkcs8 -topk8 -in key_pkcs1_encrypted.pem -outform DER -out key_pkcs8_encrypted.der
As he says, beware that OpenSSL gets a bit "kludgy" where support for encrypted PKCS8 is concerned (specifically pkey cannot read PKCS8-encrypted format input files).


Are there any proposals for email verification without a confirmation email?

BrowserID is a mechanism that allows websites to confirm the e-mail address of a user without each website needing to send an e-mail.  Mozilla Persona added the ability to do so in a less centralized way that enhances privacy somewhat however it did still require central servers that Mozilla no longer provides.

Alternatively an X509 client-cert that includes the e-mail address would work although it raises the bar somewhat as regards ease of use.


Is symlink race a very common vulnerability in UNIX systems

So this should answer the question of "is symlink common?"

A search on the MITRE database shows there are 4 CVEs for a Linux Symlink Race condition vulnerability. For comparison, there are 2749 Linux CVEs known to MITRE.

Linux at the kernel level has protections against this. Kees Cook created a patch for Linux to prevent this problem:

  The solution is to permit symlinks to only be followed when outside a sticky
  world-writable directory, or when the uid of the symlink and follower match,
  or when the directory owner matches the symlink's owner.


What program can Decrypt specific a Folder/Files during Windows Boot/Loading? (Windows)

I am unaware of a software, that would exactly work as you described it.

However I would strongly advise against your described procedure, as it might not give you as much security as you would probably expect. See here for examples. I'd therefore recommend heading for full disk encryption which can easily be done i.e. with Veracrypt.

Do you have any specific reasons, why you would like to avoid full disk encryption?

In the end, it depends on your attacker model, which way to go. I guess there might be less software out there with your described procedure, as it won't defend well against common attacker models.


Depleted DB User Connections leads to DoS

The best thing i could think about is to fix the application and the Environment that it will work correctly and closes all DB Connections after use. And if the CronJob runs some time and don't close it's Connections this could also be a problem.


It's not exactly what you requested but at least these two are worth a look in my opinion.

There's a general and abstract notation for describing security protocols, which is being used to describe quite complicated stuff such as Kerberos. The Needham-Schröder protocol can also be expressed this way. Again, not really what you were looking for, but made me think of it.
On a more fundamental level, I suggest you take a look at the Cryptol language which attempts to make implementation of crypto closer to what one would see in a textbook. However, the point of Cryptol is more in decribing functions than messages.

Anyway, first post here after years of lurking and feeding on others. Hope this helps a bit.


How can I build a simple website that contains SQL injection vulnerabilities?

There's an app for that. See https://owasp.org/www-project-juice-shop/
It's a project designed to break all the rules, so you can study it. You can try and find all the problems, not only sql-injection.


Should I use SHA-512 with many rounds or bcrypt/scrypt

Based on clarification from the OP, I will change my answer.

So you're doing something equivalent to:

sha-512x100000("stackexchange.com"|"master password")

... that's really not a great idea. Your choice of hash function is not your biggest problem here. As an attacker, once I crack one of your passwords and recover the master password, it becomes trivial for me to crack all your other accounts.

I would suggest you switch to using passwords derived from /dev/random, or using a proper password manager.

ORIGINAL ANSWER

Yes, please do not use SHA-X hash functions for password hashing. You'd be better to switch to something designed to be a password hashing function.

SHA-2 hashes (which include SHA-224, SHA-256, SHA-384, and SHA-512) were designed for performance: it was part of the design requirement that software and hardware implementations of these hash functions be as fast as possible. Assuming that your server is using a software implementation of SHA-512 and the attacker trying to brute-force the passwords is using either a GPU rig, or dedicated SHA-512 hardware, then you are giving the attacker an advantage over you because they can perform guesses with much higher efficiency than the server can generate the hashes in the first place.

In short, SHA hashes are designed to be fast - especially in hardware. A very bad property for a password hashing function.

bcrypt, scrypt, and to a lesser extent PBKDF2, are designed to be slow and inefficient in hardware -- very good properties for password hashing functions.

Of those three (bcrypt, scrypt, and PBKDF2) it looks like scrypt is the most modern and the best choice. Though, from the results of the 2013 - 2015 Password Hashing Competition, it seems that Argon2 (and the runner-ups Catena, Lyra2, yescrypt and Makwa) blow scrypt out of the water, so use one of those if you have it available.


Is it a security issue to show the complete bank account number in your payment methods?

It probabbly is:

An account number (complete of course) it's a medium-high level information.
So showing it completely may be a chance for a attacker to steal it, as for example, using a remote-VNC malware.

In most of cases, having only the account number won't mean a risk of being a fraud victim, as it requires some other info (as CVV, PIN-code, or any other additional security measure). But it's a leak of information.

Any platform with a good security should not show the complete account number if it is not needed.


What are the qualities of a good cipher?

I think you missed to make it immune against differential crpytoanalysis. But that means that you first have to study what differential cryptoanalysis actually is, and that is probably a bigger project than implementing a "fun" cipher...


Containerization vs. Chroot in shared hosting

First, chroot is not a security feature in any Unix systems. A privileged user can perform a second chroot to break out. See here

In a docker environment, processes and network are isolated so can't try to read kernel memory or use more RAM than allowed thanks to namespaces. Indeed, if any user inside a container is able to escape it using some sort of kernel exploit, it will be a user with the docker engine privileges so it will have access to all of them in the host machine but in that scenarios with chroot all is more easy.
Therefore, Docker in general is more secure than a chroot configuration because chroot is meant as a tool for isolating processes for installation, debugging, and legacy library usage.

Secondly, a Wordpress core can start clean every time you start the container but in chroot, writes are permanent. Also, It is possible for the containers to even lack a shell so if someone upload a phpshell it will fail.

More info: Can I make my online server more secure using Docker?


Should I be concerned about Wayback Machine trying to load scripts from unauthenticated sources?

No, not unless you are using a browser that does not block unauthenticated sources (i.e. plain HTTP) when loading an authenticated source (i.e. HTTPS). Most modern browsers will do this.

The error in this case is:

  Mixed Content: The page at 'https://web.archive.org/' was loaded over
  HTTPS, but requested an insecure XMLHttpRequest endpoint
  'http://wwwb-sentry.us.archive.org/api/3/store...

As the browser blocked the request, it cannot be intercepted by an eavesdropper or Man-In-The-Middle on the connection, therefore you are safe.

It is likely a configuration error on Wayback Machine sending the request over HTTP instead of HTTPS.


How safe are data you dial to a call center?

Your sensitive information travels through different mediums and systems to get to the bank, and yes, there are vulnerabilities along this path.

First, it is transmitted from your finger tips to your dialler application. It can be intercepted by malware running on your phone. There is a new vulnerability in Android called Stagefright that can get full access to an Android phone.
Before exiting the phone, the data is sent to a different part of the phone which does the actual communication called the baseband processor that runs a realtime OS. There were  some vulnerabilities in this OS, some of the most interesting were presented here.
Then the audio tones (DTMF) are encrypted and sent overt the air to a GSM base station. In almost all of the world, GSM is encrypted and almost any phone will notify you if there is no encryption. The problem here is that 2G communication is using the A5/1 encryption scheme that was purposely weakened for governmental access and it's easy and cheap to intercept and break it. 3G and 4G have better encryption but an attacker can jam the safer frequencies around the target and force the target phone to use the vulnerable 2G. An bigger issue here is that some banks use SMS to authenticate banking operations, and SMS is always over the 2G network.
There was also the allegation that the NSA hacked the database of most of the world's SIM encryption keys, but Gemalto swears NSA didn't get to the keys.
But the phone can be talking to a fake base station. This kind of fake GSM tower is often called an IMSI-catcher and is available to law enforcement and also attackers. There is open source software and hardware to build a fake base station and it was demoed in 2010.
Then the information travels inside the telecom network where it might be intercepted by a well placed attacker or governments that obtains a legal wiretap. In 2014 the SS7 attack was made public. It allows to track and intercept 3G communication anywhere in the world, not just local.
The last step is in the bank's systems. That looks like a safer place because banks take security more seriously than common businesses, but you can't really know for sure until an assessment can validate that.

Going back to your questions:

  Is such data cyphered? I don't know much about phone communications
  but I guess there are nodes between me and my interlocutor. May I
  trust these nodes?

As I said, voice communication is encrypted but there are vulnerabilities in different parts of the network

  May somebody listen to the conversation and catch
  my credentials?

It is possible. It depends on your phone, the capabilities of the attacker and the vulnerabilities of your mobile-phone operator.

  May somebody spoof the phone number of my bank to
  catch my credentials?

There is no GSM vulnerability I know of that works like that but there has been malware that will block access to your online banking then will make you call a phone number pretending to be form the bank. This way a user is less suspicious when giving sensitivity information away.

  Shouldn't my passcode be hashed? Is it stored as
  plain? I think even my bank should not know my passcode.

I don't know what is the actual process when you access your bank via a phone call, but your bank doesn't have to store your passcode in plaintext. When you transmit it, it could then be hashed and compared to a hashed version stored in the bank's computers. This is no different from web authentication where passwords transmitted in plaintext.

But don't panic, the overall risk of you specifically being targeted this way is rather low because the bad guys have other easier ways of stealing from large numbers of users. The risk is lowered also because many attacks on GSM require physical proximity and increased sophistication. Banks can quickly close such vulnerabilities because they notice if some cards or accounts are being compromised and they will track down the source of the compromise.


Is this strategy end 2 end encryption and secure?

On first inspection, I don't see anything egregiously wrong with your scheme, however I question why it's necessary and whether it's actually adding any value.

To summarize @schroeder and @Nat's comments: you are spending a lot of effort to essentially re-invent TLS session encryption from the ground up, and then wrap it inside an existing TLS (HTTPS) session. This seems a little pointless. From the way I read your question, your goal is to have secure data transmission from the user to your server. That's exactly what TLS (HTTPS) was invented for!

If your reason for inventing this scheme is that you don't trust user data to be flowing unencrypted between your TLS endpoint (front-end load-balancer?) and your database, then perhaps your effort would be better spent segregating and hardening your production network.

The usual "Don't Roll Your Own" warnings apply.


Why was WPS not patched to make it secure?

Ask the WiFi Alliance.

It's probably the same reason the glaringly-obvious security hole was put in there in the first place.  The people making decisions for WPS standard apparently do not care about security (or are mindbogglingly incompetent).  Any freshman CS student giving it the least bit of thought will know its a mistake to check whether half of a password works and differentiate between which half failed in your response as described in your standard (so you don't even need to do a timing attack to differentiate the two cases).  The only reason it was not immediately obvious to everyone when WPS-enabled routers first came out is that the standard documenting how WPS works is not free ($100) if you aren't a member (and membership costs a company $15k/year).

Granted, I believe many (most?) hardware manufacturers tried to patch WPS by just rate-limiting the number of bad attempts per second -- granted rate-limiting doesn't help much when you only need at most 11000 attempts to break a WPS pin (on average half of that).  At the same time, presumably legitimate users may want to use this WPS feature, so they probably can't rate limit too severely and you can possibly get around the rate-limit by frequently changing your MAC address.  WPS was a bad idea which became much worse with their actual severely flawed implementation.


Svchost without name 50%cpu using and can't access to "Service tab"

It looks like it is a crypto miner virus. Once it was happened to me. I realized it when I have listened my network using Wireshark. svchost was commanded to communicate with a pool server of Monero coin. I found the only solution by restoring my C drive. Apologize, I can not come up with a nice solution. I had to write this as comment not as answer, but my reputation is not sufficient for commenting, and I would like warn you about the miner virus from my experience;

It is a malware infects in svchost.exe, so it is not possible to kill it since Windows recognizes it as a system process.
Usually its encoders work very well so that virustotal or any anti-malwares can not detect anything.
Do not try to log-in to interface of your router while you have this malware, since it is going to steal your router credentials and change your proxy or dns settings.
Do not make any online shopping with your bank or credit cards on this infected pc.
It is not only a miner virus. It is a strong Trojan which has many capabilities such as disabling Windows Defender, breaking Windows Updates. ( That's the reason why your restoring is failing ), listening your keyboard strokes, might be getting screenshots as well.

Windows 10 has a feature to return to a fresh re-install without removing your personal files. Restore Windows 10 to Factory Settings.  This will definitely save you from the dangerous trojan.


Attack from different blacklisted IP which belongs to different GEO location

The source MAC that you see is always going to be the MAC address of your router that's sending the packet along the last hop.  MAC addresses aren't routed; they're only visible between the two devices handing the packet to each other.

Given a packet routed from A to D via routers B and C:

[A] --> [B] ---> [C] --> [D]

B will see A as the source MAC address.
C will see B as the source MAC address.
D will see C as the source MAC address.

Given the MAC address of 00:00:CA:00:00:03 that the OP has provided in the comments:

The first three bytes are the Vendor ("Organizationally Unique Identifier", or "OUI").  These can be looked up to determine who manufactured the ethernet card you're seeing:

Wireshark OUI Lookup Tool says: 00:00:CA ARRIS Group, Inc.

If you Google ARRIS Group their Wikipedia page is the third hit:

  Arris Group is an American telecommunications equipment manufacturing
  company that provides cable operators with high-speed data, video and
  telephony systems for homes and businesses....

  ...

  Two of the company's popular home telephony modems are the TM402P and
  the TM502G. The firm also produces the SBG6782-AC wireless cable
  modem-and-router (residential gateway) unit, among other
  telecommunications and data-transfer products.

In other words, they make cable modems, which are the routers that your Cable company uses to provide Internet to your Firewall.


HIPAA compliant blob storage architecture

You're actually best off using an existing product. There's plenty of risk in rolling your own crypto storage system. So many ways to make an error in security or data integrity it's not funny. One commercial product off the top of my head is StorageSecure by Safenet. They specialize in this stuff. There are also quite a few academic and open source projects you can draw on if you're insistent on homebrew.

Fabric Project
http://www.cs.cornell.edu/Projects/fabric/
Has a secure programming language, distributed architecture, protection of computations, and protection of data. Free IIRC.

Tahoe-LAFS
https://tahoe-lafs.org/trac/tahoe-lafs
Distributed, fault-tolerant, encrypted storage architecture that allows clients to insure security of data despite compromised storage nodes. Free.

Securing data in storage: A review of current research http://arxiv.org/pdf/cs/0409034.pdf
A whole bunch of schemes and comparison of protections.

Encrypted storage of medical data on a grid
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.163.9593&rep=rep1&type=pdf
Right up your alley, eh?

I'm leaving off various full system, file system, and file level encryption tools as I figure you know of them. However, I will mention that a poor man's solution to app-level data encryption is to give each app and/or classification category an encrypted volume a la eCryptfs or Truecrypt. And then restrict it to that partition using permissions, mandatory access controls, etc. If you know how to use the tool and read/write to a file, you have encrypted storage. You also know it will work reliably as each will have been battle tested plenty.


It's fine to reuse the data from the old certificate, but do NOT send anyone your new private key. The convention is to send a certificate authority a CSR (certificate signing request), which will contain the client's public key, start date, end date and distinguished name (country, common name, organization name, etc.). The only thing missing is the certificate authority's signature, which they will append to your CSR, thereby making it an actual certificate.


Should I use random usernames for a MySQL database?

There's no benefit to going to lengths obfuscating username as long the database does not return a descriptive login error, for instance "username or password incorrect". There will already be many possible usernames, and no way for an attacker to know whether they are using a valid one. Having a descriptive username is often operationally helpful in a larger organization, username 7Uy$kk020G1g doesn't give an admin much to go on. If you're managing the whole thing then that's not a problem.

If the database returns a descriptive login message, for instance "username does not exist", then it's a different story as you don't want to make it easy for an attacker to guess the username. Randomizing the username seems like overkill to me, but there's no harm in it as long as it's documented.


To cite from SSL_get_default_timeout:

  Whenever a new session is negotiated, it is assigned a timeout value, after which it will not be accepted for session reuse.

In other words:

The timeout gets assigned when the session gets created, not when the session gets used. This means the timeout will not be reset ever.
After the timeout the session will no longer be accepted for reuse. Note that this does not mean that a current session will be shutdown, only that a new handshake with this session will not result in a session reuse.


Attack vector: Internet Service Provider

ISPs cannot block port forwarding. Port Forwarding is an action of a service. They can block ports, and initiating connections incoming to your IP.

In order to troubleshoot, you will need packet traces before and after your router. This is not an InfoSec problem, this is a basic networking problem.


VPNs vulnerable to MiTM because ANY certificate goes

Short answer:

Nope, can't be done. This is because a reputable Certificate Authority will not issue a certificate for a domain that your sysadmin does not control.

Long answer:

It can be done under some scenarios.

For example - if you're using OpenVPN to create a TLS connection to a VPN concentrator elsewhere in the world called...say...awesomevpn.sx, one of the first steps in the TLS handshake is server certificate validation. Your sysadmin could attempt to MITM this connection, but he would not be able to present a certificate for awesomevpn.sx because no CA will issue it to him, which would cause the connection to fail.

However, consider a scenario where a company has contracted a vendor to install packet inspection appliances. In order to perform MITM attacks on secure connections, the vendors will compel the installation of their own "root" certs onto client machines. That way, they can use their own CA to sign certificates for any domain. This can be done on the fly by the inspection appliances. When those certificates are presented to the client during the MITM sequence, they will be accepted, allowing the connection to complete, and the packets to be inspected in the clear.

This sounds like a weakness of the CA system, but remember that in a corporate environment, you do not have physical control over the machines owned by the company. Without physical control, it's game over in terms of security.

So the explanation you've been given is missing a key point - they did not mention the requirement to install their own root certs on client machines. It has nothing to do with a weakness in the VPN clients, or the various protocols used for secure connections.


Why do I need Kerberos when I could just use a username and password to access services?

Why doesn't the system admin just create a user account for each user on each server, so that the users can use their username and password to access whatever resources they wish to access?

Imagine you have 50 users and 50 servers.  For the sake of simplicity, suppose that all 50 users are supposed to have access to all 50 servers, they all have the same privileges on all servers, and we never have to change these privileges.  This is 2,500 password entries in total that need to be created.

Adding a new user

When you add a new user, the admin has to go to all 50 servers and add that one user to all of them.  This would need the admin to run the create user command in all 50 servers.  That bit can be automated, but the part that cannot be safely automated is that the user would need to enter their password 50 times, once per server.

Why this latter problem?  Because password authentication systems are designed so that they do not retain a copy of the password, not even an encrypted copy.  So when the user enters their new password on server #1, that server forgets the password right away, so they'd have to enter it yet again for server #2, and #3, etc.

Adding a new server

Maybe now you're thinking that you could write a script that:

Runs on server X;
Asks the new user to enter their new password;
Asks the administrator for their password;
Logs in to servers #1 through #50, and creates the user account on each of them with the same password.

That's a bit dodgy, but even if you go for it, you're still left with another, bigger problem.  Suppose your company buys a new server, and we now need our 50 users to have access on this server.  Well, since none of the servers contains a copy of the users' passwords, the administrator would have to go to each user and have them enter a password for their account in the new server.  And there's no getting around this unless you kept copies of users' passwords—which again, is an insecure practice.

Centralized password database

To solve these problems you really need your user/password database to be centralized in one place, and to have all the servers consult that database to authenticate usernames and passwords.  This is really the bare minimum you need for a manageable multiuser/multiserver environment.  Now:

When you add a new user, all the servers automatically pick it up from the central database.
When you add a new server, it automatically picks up all the users from the central database.

There's a variety of mechanisms for doing this, albeit they're still short of what Kerberos offers.

Kerberos

Once you have such a centralized database it makes sense to buff it up with more features, both for ease of management and for convenience.  Kerberos adds the ability that, when an user has successfully logged in to one service, that service "remembers" the fact and is able to "prove" to other services that this user logged in successfully.  So those other services, presented with such proof, will let the user in without asking them for a password.

This offers a mix of convenience and safety:

Users don't get asked for their password over and over when they've already entered it successfully once that day.
When you have programmers who write programs that access multiple servers, and those servers require authentication, the programs can now authenticate to those servers without having to present a password, by reusing the credentials of the server account they run under.

The latter is important because it minimizes or kills an insecure but all too common practice: automated programs that require you to put copies of usernames and passwords in configuration files.  Again, a key idea of secure password management is do not store copies of passwords, not even encrypted copies.


Difference between a behaviour-based security and traditional firewall?

A traditional firewall allows or denies something based on the rules you defined. Any traffic passing through there will be filtered by the rules. If you want to change something (to adapt to a new threat) you will have to alter your rules.

Behavior-based security systems are designed to 'learn' what patters of usage you have in our network. After a while, they determine how traffic behaves overall and make automatically some general rules to allow those learned patters. If something unusual appears in the network, there will be triggered alerts or denial of traffic depending on the configuration. For example, if the system finds that your average user sends 50 e-mail per day, it makes a rule for that. If a user suddenly sends 500 instead, it will be blocked or signaled as suspect.


TrueCrypts full Disk Encryption still secure?

even if they were not able to decrypt in 2012, that doesn't mean that the NSA will take the locked door entrance when they already have a backdoor open, seeing as  they are known for having backdoor in many OS distributions, as well as being able to decrypt HTTPS. these documents are also from 2012, and truecrypt has stopped support for almost a year now, so we have to assume that by now the NSA is able to decrypt it.

sources:
http://truecrypt.sourceforge.net/
http://www.theverge.com/2014/12/28/7458159/encryption-standards-the-nsa-cant-crack-pgp-tor-otr-snowden


Did you notice this little message on the microsoft article you posted??:

  It is necessary to restart the computer after modifying this setting
  for the changes to take effect.

You also didn't mention it but have you checked to ensure the setting is actually applying?

gpresult /h policy.html


What is the most secure way to store the password on a physical medium (paper, etc)?

How about writing it on good stock paper using a pigment ink pen so it does not fade (within a few decades).

But write only two thirds of it on one sheet, another 2/3 on another sheet, and the last 2/3 on a third piece, and give them to three (trusted, obviously) friends - that way, any one of them don't have your password, but any two of them together do.

Eg. Jim gets APPLxx, Joe gets xxPLES, and Jack gets APxxES. Any two of them will be able to reconstruct APPLES, alone they would be guessing.


Are the cascading ciphers in Veracrypt susceptible to the meet-in-the-middle attack? (MITM)

Yes, it is vulnerable to a meet-in-the-middle attack. In particular, the three 256-bit ciphers do not provide you with 768-bit security. Instead, it provides "only" 512-bits of security, and a proper meet-in-the-middle attack would require an obscene amount of storage space to pull off as well. This is not a problem though, because the cascading ciphers are not used to increase the keyspace. In fact, the largest hash that is used to derive the password has a 512-bit output. The real reason multiple ciphers are used is to alleviate concerns that one or more of the ciphers has a fatal cryptographic weakness that allows for breaking it faster than brute force. Whether or not this is a reasonable concern is debatable, as all the options are quite solid, but that was the intention.