How does the photoTAN (Cronto visual transaction signing) procedure work?

There is more information available by now.
See the Onespan (Vasco aquired Cronto and renamed itself) Community for the Integration Guide. It explains how to use their software to both GenerateCrontoSign/GenerateDynamicCrontoImage to generate Challenge graphics and QRCodeScannerSDKActivity/QRCodeScannerSDKViewController to scan and decode Graphics on Android/iOS.
https://community.onespan.com/documentation/mobile-security-suite/guides/integration-guides
Cronto is encoding Challenges and Tokens in a Colored Dot Matrix. Please see the Colored QR Codes whitepapers listed on the Wikipedia article for details on the information storage/extraction from the graphics or returned when searching for "decode color qr code"
Decoding Algorithm for color QR code: A Mobile Scanner Application
Nivedan Bhardwaj, et al.
https://www.researchgate.net/publication/309041301_Decoding_algorithm_for_color_QR_code_A_mobile_scanner_application
Robust and Fast Decoding of High-Capacity Color QR Codes for Mobile Applications
Zhibo Yang, et al.
https://arxiv.org/pdf/1704.06447.pdf
This in a way is the communication between the Bank and your OTP Token Generator. The secret is exchanged using two activation graphics, ie. the first sent via letter from your bank to you and a second (probably containing the secret) scanned during the activation process step2.
Using this secret the Cronto device will generate a OTP password after showing you the information given in the image. As I have not analysed the implementation of the QRCodeScanner I have my doubts whether it also includes the information into generating the photoTAN.
I have been able to use the secret for other OTP challenge/response in multiple OTP generators, ie. the Smartphone App of comdirect claims to support upto eight different bank accounts and therefor secrets. Hence it is possible the eavesdrop on the secret in the instance when it is visually handed over to the Cronto device (most likely step 2 of the activation process).
I just checked the Cronto I got some hours ago and it always generates the same TAN number, hence it is clearly not using any timing code.
Looking into the Image Scanner SDK available from the OneSpan / Cronto Website there are two main components to the Android AAR (QRCodeScannerSDK.aar):

an API contained in classes.jar, this is a mostly obfuscated Wrapper that deals with some Image preprocessing
a precompiled Linux ELF image libQRCronto.so, which contains the zxing matrix code library plus some cryptographic routines.

Image Scanner SDK
https://community.onespan.com/products/mobile-security-suite/sdks
I have not bothered decompiling it, but it should be possible to find the crypto scheme out in case someone wants to:
$ strings libQRCronto.so | less
_ZN5zxing11ResultPointC1Eii
...
_ZN16DataStoreAccount6getKeyERPKhRiRK10ByteBuffer
_ZN16DataStoreAccount9getKeyHexERK10ByteBufferPcRi
_ZN16DataStoreAccount9setKeyHexER10ByteBufferPKc
_ZN16DataStoreAccount9setKeyHexER10ByteBufferPKci
...
_ZN13KeyDerivation11deriveBytesEPKhiS1_iS1_iPhi
_ZN13KeyDerivation7iencodeEiiPh
_ZN13KeyDerivation9deriveIntEPKhiS1_iS1_iiRi
The following lab article has some details on creating a secure channel using the Mobile App instead of the standalone device I have.
Secure Offline Transaction Signing using MAS
https://vie-labs.com/secure-offline-transaction-signing-using-mas/
The device I have has been modified from the Stock OneSpan Cronto by my bank. It is sporting a Bank logo on the power up screen and will refuse activation codes from other banks.
Entris Banking - Login with CrontoSign Swiss
https://www.netbanking.ch/index.php?id=489&L=3&id=489


Is possible to apply an inverse function to remove a compiled object?

It depends on the watermark you've added. If the watermark changes the image in a known way without losing any image fidelity, then yes. Otherwise, no.

The key is being able to retain sufficient detail in the amended image that running the inverse function exactly reproduces the original image data. Typically, this is a very hard problem because digital image files have limited data depth.

For a simple example, imagine your function changed 1 pixel. It changes a single channel - red lets say - of that pixel by multiplying by 2. The red channel started with a value of 180, 180x2=360 but a standard png file only allows a single byte per channel = 255. So your change looses data, what should have been 360 is actually 255. Now reverse your function, 255/2 = 127, different to the original 180.

So if you can work out a clever algorithm that will never exceed the image data limits then you are OK. Good luck with that! On the other hand, if you used a different image format, you would have fewer limits so the problem would be somewhat easier.

The other way to fix the problem would be to somehow capture the missing data in the metadata. But then your "inverse" function would have to use that data somehow to restore the images full fidelity. And you would need to somehow hide or encrypt the metadata otherwise someone else could do the same thing which would make adding a watermark pretty pointless in the first instance.


Can I store a GPG revoke certificate online?

It would not be advised, especially not on any public online resources.  If the revocation keys gets in the wrong hands, someone can revoke your keys without your consent or knowledge.


How can you securely use a cloud-based CI/CD server?

One mitigation you can use is to IP restrict that upload as well - you know where a legitimate upload will come from, after all.  This will mitigate against ssh key loss through means that don't compromise the actual server (ie, backup losses, disk duplication, read only exploits, etc)

You can further mitigate using agreements - that they will follow appropriate security measures, that they will encrypt your data before backing it up, that they patch servers regularly.

I could imagine some sort of one-time-use token that gets added to your source repo project by systems you control and that change being what triggers the build.  Your webserver could reject builds without a valid token or with a token it has seen before.  This may be excessive, however, and is much more complicated. It is likely more appropriate for CI where there is a manual gate before production deploy, rather than CD where it goes in if it passes the tests, as well.


Are shatter attacks still possible in the days of User Interface Privilege Isolation?

UIPI does prevent a process with a lower integrity level from sending either a WM_TIMER or EM_GETLINE message to a higher integrity level process. These were the two message types that could be abused to elevate privileges on a system. Lower integrity level processes can still send limited message types to high level processes, but they cannot be used to take control of the processes execution. As far as DEP being the saving grace, you could use WM_TIMER or EM_GETLINE to start execution of a ROP chain. In this case you would need to find opcodes that would allow you to pivot the stack (this is where the WM_TIMER callback would send execution to) to a new location containing the addresses in your ROP chain.


Should text files or image files be virus scanned during upload?

Long, long time ago there have been a rumor that there is a virus able to infect gifs. All the wise people laughed at the idea of data executing code. But then, buffer overrun attacks have been discovered, and a bug in Internet Explorer that allowed buffer overrun in gifs, essentially executing malicious code.

The moral of this story is a double-ended one. First: there is always a possibility that data could be used as "viruslike" attack vector. Second: There was absolutely no possibility any virus-scanner could have detected it before attack was discovered.

I can only recommend scanning data files if there is a known attack which could compromise users during regular usage (and your AV detects it). Scaning every .txt for being renamed .exe seems bit overkill. More importantly, you should be ready to re-scan old, EXISTING files, in case a new attack is discovered. Scanning existing files is easy, the problem is what to do next - witholding access to the file, notifying it's owner, etc - it's a lot of work to design and implement such error-handling.

As raz said, pdfs are different beasts: they are already known to contain code and have to be scanned both on upload, and in storage in regular intervals.


StrongSwan, IPsec remote certs and cert_policy

The cert_policy constraint (swanctl.conf) enforces specific OIDs in a certificate's certificate policies extension, so that might not be what you are looking for.

As for matching identities with wildcards, strongSwan currently only allows ignoring complete RDNs (not parts of them), for instance, C=CH, O=strongSwan, CN=* (multiple RDNs may be ignored). With domain names and email addresses (e.g. in subjectAltName extensions of type dNSName/rfc822Name), only prefixes can be ignored (e.g. *.strongswan.org, or *@strongswan.org).


Generate subkeys based on less secure OpenPGP primary key

You must distinguish between security of your whole OpenPGP key (depends on your primary key) and security of encrypted/signed message (depends primarily on the subkey, but see below).

Primary Key

The primary key itself is obviously not strengthened -- all primary key operations (issuing certifications on other keys, managing user IDs, managing subkeys, issuing revocation certificates) are bound to the primary key. If an attacker gets hold of the primary key (for example, by brute-force attacks that might be feasible in future), he will be able to perform all those tasks. Additionally, the primary key has often set the signing capability bit, thus it can also issue valid certifications (in fact, this is default if you create key pairs in GnuPG).

Signing

The subkeys are used for "day-to-day work": signing and encrypting documents. For signatures, an attacker can easily create a new (and automatically trusted) subkey pair when he gets hold of the primary key, thus there is no actual use in creating a stronger subkey (of course, one could check manually which signing key was used, but this is definitely not OpenPGP best practice and standard).

Encryption

For encryption keys, the situation is different -- once a message was encrypted for a subkey, creating new encryption subkeys is of no use. With other words: an attacker will not be able to decrypt old messages encrypted before he got hold of the secret primary key. As soon as he has access to it, he will be able to issue a new encryption key and intercept messages. Implementations of OpenPGP use the newest valid subkey capable of encryption. In fact, you will not be able to read those messages any more (as you don't have access to the new secret key).

But in both cases (signing and encryption subkeys), you are at least able to realize something's wrong, as the attacker will have to distribute the new subkeys. But you won't realize an attack occured before damage may already have happened.

Wrap Up

There is some use, and as creating a new subkey pair is a cheap and easy task, why not just do so. But for a long term solution, consider phasing out your old key and switching to a new key pair instead. Maybe even consider new ECDSA keys already?


Avoiding Brute Force Attacks in a Web Based Login Form

Since HTTP is a stateless protocol, there is no concept of a wait time between tries.   The attacker can simply spawn multiple processes, and try many passwords simultaneously.

A common way to deal with the problem, and to lessen the impact on your server is by implementing a lockout policy, where you maintain a counter to track the incorrect password attempts for a given username over some specific period of time (5 wrong attempts in 5 minutes is a common default) and simply quit attempting to authenticate requests with that username for the next few minutes.


Is it reasonable to prevent timing attacks by using fixed processing time

Fixed processing time is the most basic and thorough method to defend against timing attacks: to avoid exploitation of the data you leak through timing, well, do not leak. However, it is easier said than done. The recent "Lucky Thirteen" shows that it is possible to detect timing differences with a microsecond accuracy when the target is "close" to the attacker (on the same LAN); the attack details exploit the small leak which remained in SSL implementations which were patched with regards to timing attacks -- these implementations were computing the MAC even when the decryption did not yield a proper padding, precisely so as to get a processing time which was as fixed as could be achieved; but a one-microsecond variability was hard to avoid.

If you enforce a fixed "overall" processing time (e.g. 1 second for each request) then you will run into trouble with multi-tasking operating systems. If the implementation is just a sleep() call after the main processing, then the CPU is free to handle other requests, which looks good... but leaks data, since the attacker could send other requests simultaneously and work out whether your server is busy or not. Generally speaking, by sending a lot of requests to your server, the attacker can make processing time for each request arbitrarily long, and exceed any fixed limit. If you just constrain the processing time to be an integral multiple of a fixed granularity (e.g. processing time is always n times 0.1 second, with n being an integer) then you just have "thresholds" which make the task a bit harder for the attacker, but not impossible -- and it could even help the attacker. Indeed, the "Lucky Thirteen" attack shows how the exploit of such a threshold (corresponding to the way SHA-1 and SHA-256 process data by 64-byte blocks) just needs some "phasing" and makes the statistical picture clearer.

Right now, the best defense seems to be the addition of a random delay of a few milliseconds, which will blur the picture and prevent analysis... and, also, don't let the attacker plug in the same LAN as the server. Which should go without saying.


Firewall Reviews - What is in your Toolbox?

For Firewall rule-set and device config reviews I really like Nipper.

Easy to use, but still need to be an experienced security professional to work the results as it can create a lot of noise. The latest version is good at not reporting some of the false-positives that the earlier versions did, which does make life interesting.

Only downside is they have recently gone more commercial so will need to see how the cost model works out.


Can I elicit responses from "any remote host" on "all protocols" if I want to?

I will start by answering your last question first.
What you asked is, “is it possible for protocols (agreed upon methods of communication) to elicit a response from any random device, wether it is connected to a network OR NOT.”
How would two devices, one that is connected to a network, and one that is not (one that is essentially air gapped), pass traffic to each other?
In order for any two parties to communicate, there must be some method for data to pass from source to destination and back. If you are in Hong Kong, and I am in Alberta, and I think, gee, I hope Freddy Nova hears my thoughts.... You see what I am saying. There needs to be a path of communication to follow, we don’t use magic.
Perhaps you meant to ask if there are methods for exfiltrating the data you are asking for while not being on the same network? The data you provided said there is. What is that method?
That is outside the scope of a question answer site like this. It depends on what type of systems are inside the network, what systems you have access to, what apps on those systems you have access to, what you are allowed to do. You’re asking for someone to provide you an exploit (without enough data to do so).
This is the subject of a class, not a question. If you want to learn how to do these things, or figure them out, I’d recommend hack the box. You can learn how to exploit things like this yourself.


Looks like the first part is a base64'd 128-bit hash, likely MD5, and the second part is a base64'd salt.

In hex:

Hash: 8baca03904218946ce15e51bcc8d8bdf
Salt: 730b2b5ec0ae66ed0240e3e12ab65b8a2f329eeeeac7d8

If you have other examples of the hash, it'd be easy to verify this.


Section 4 of RFC 4347 begins with this text:

  As mentioned in Section 3, DTLS is intentionally very similar to TLS.
     Therefore, instead of presenting DTLS as a new protocol, we present
     it as a series of deltas from TLS 1.1 [TLS11].  Where we do not
     explicitly call out differences, DTLS is the same as in [TLS11].

That's reasonably explicit: anything which is not described in RFC 4347, must be done as it is done in TLS 1.1. TLS 1.1 explicitly rejects support of "export" cipher suites, so DTLS does not support them either.

The RFC is like the US Supreme Court: it recognizes no power above itself. There is no "reference implementation" which would define what is supported and what is not. So there is nothing to "confirm", in a legalistic way. A weaker but more practical notion of "support" is interoperability: do existing implementations of DTLS try to support the so-called "export" cipher suites ? It seems that OpenSSL does support it:

(on the server)
$ openssl s_server -dtls1 -cipher EXP-EDH-DSS-DES-CBC-SHA
Using default temp DH parameters
Using default temp ECDH parameters
ACCEPT

(on the client)
$ openssl s_client -dtls1
CONNECTED(00000003)
depth=0 CN = localhost
(...)
---
New, TLSv1/SSLv3, Cipher is EXP-EDH-DSS-DES-CBC-SHA
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: zlib compression
Expansion: zlib compression
SSL-Session:
    Protocol  : DTLSv1
    Cipher    : EXP-EDH-DSS-DES-CBC-SHA
(...)

However, there is very little reason to use these cipher suites nowadays; they were meant to comply to US export regulations (hence the name), and the restrictions on key size have been mostly lifted a dozen years ago. No SSL/TLS implementation enables them by default, and servers which are actually configured to accept them should be exceedingly rare. If you are implementing your own DTLS code, you would not be blamed for omitting them, especially since the wording of the RFC implies that they are forbidden.


Why CVSS range 8 to 9 is almost inexistent

Disparity is due to such attacks being very specialized as reflected by the CVSS calculator.
One gross simplication of the calculator is that it is derived from the Impact of the vulnerability and how easy it is to Exploit. Easy to exploit and high impact will get you a score near 10. Hard to exploit and low impact will get you a score near 0.
CVSS 8-9 refers to specialized scenarios where
impact is absolutely devastating (i.e. high impact across all of Confidentiality, Integrity, Availability) but hard to exploit. Or easier to exploit but high impact to only one of the CIA aspects.
It is interesting that vulnerabilities in practice (as reported by cvedetails) don't tend to be that specialized, or if they are then they're not being reported.


Decent remailers who aim at providing anonymity use mix networks with encryption.

The sender wants to send his message M through the chain of remailers A, B and C (in that order). To do that, the sender encrypts the message M (complete with headers such as subject and destination address) with the public key of C. That encrypted message is then packed into another message with the address of C as destination address; that outer message is then encrypted again, this time with the public key of B. The result is again wrapped into a message with B's address as destination. That message is encrypted with A's public key, and then sent to A.

When A receives the message, it decrypts it and finds out an inner message to be sent to B. B itself will be able to decrypt it, and find the inner-inner message which is for C. C will decrypt that, and find the inner-inner-inner message M and the actual destination. That way, A won't be able to know where the message should go; also, C won't be able to know from where the message comes (because C received it from B, not from the sender). B knows nothing at all (from the point of view of B, the message is from A and sent to C).

This principle is also applied to HTTP requests in Tor, and can also be used to design electronic voting systems.


Can an attacker detect if I have a TARPIT enabled?

According to http://www.netfilter.org/projects/patch-o-matic/pom-external.html "Connections are accepted, but immediately switched to the persist state (0 byte window)...".

Since the window is send to the peer in the TCP packet a knowledgeable attacker might deduce from a packet dump that your system is either permanently overloaded because all connections stall immediately or that it is running some kind of tarpit, in which case the attacker might probably easily find out which ports are not protected by the tarpit. Most script kiddies instead will probably do not understand what's going on and just give up.


How do I know the host computer turn on or turn off?

If you're connected directly to the Modem (Given that is provided by the ISP) in most countries it works as a router (Layer 3, 2 and 1 device) meaning that it redirects traffic and it's the gateway of your LAN to the WAN.

If you got a 192.168.1.1 IP this means the modem is NATing, so it's most likely you're both on the same network. Assuming that the firewall is on default settings, the host computer should be able to reply ICMP (ping / echo request), so just figure out his IP, either by actually asking your neighbor and pinging it, or doing a ping sweep with tools like Nmap or Angry Ip Scanner and if it times-out, it's off, if it replies, it's on.

READ THIS: PING SWEEP DISCLAIMER


The handshake was integrity protected already in previous TLS versions. The early encryption is explicitly done to get more confidentially, especially to encrypt the certificate which is a major source of meta information in deep packet inspection.

  Server identity can still be leaked by other means such as server_name or SNI extension sent by a client.

It was originally planned to encrypt SNI too and was also in the earlier drafts of TLS 1.3 but it did not made it into the final version. But there is a draft for Encrypted SNI and it is implemented in some CDN like Cloudflare already and also in some browsers like Firefox. Note that ESNI is mainly useful when lots of domains are served by the same IP address which is the case mainly for CDN or large hosting providers.

There is also plain DNS as an additional leak of metadata for deep packet inspection - this is addressed by DNS over HTTPS and DNS over TLS.

This does not mean that everything is perfect, but at least less meta information are leaked than before and it gets harder for simple passive DPI to collect user information.


Loading code securely in the Trusted Execution Environment (ARM)

In a nutshell, the TEE does have its own bootloader.

The basic idea is that the CPU boots from ROM. This ROM is programmed to load a software image from persistent storage, verify that it is signed by a public key which is stored in the ROM, and transfer the execution to this software image. On an ARM platform with TrustZone, the CPU starts in secure mode, so this first software — the TEE — is executed in secure mode. At some point the TEE switches to non-secure mode and loads another software image: the “rich OS”, i.e. the main OS running on the platform.

The MMU with TrustZone separates a secure world running the TEE and a non-secure world running the rich OS. The non-secure world is less privileged than the secure world, so it cannot access the secure world's memory, in the same way a userland program cannot access the kernel's memory (though the technical details are somewhat different).
There isn't much publicly available documentation about TrustZone and associated technologies, but you can find some on ARM's website.

As real life is never so simple, what happens in practice is a chain where the ROM loads a first bootloader which loads a second bootloader, etc. As long as each stage verifies the signature of the code image of the next stage, only authenticated code can be executed. One of these loads a non-secure, non-authenticated bootloader in the normal world which in turn loads the main operating system (e.g. U-Boot and Linux). This is a secure boot chain, similar to what Microsoft requires for Windows 8. A secure boot chain ensures that only code approved by the hardware manufacturer can run. The idea of the TEE separation is to apply secure boot to the TEE, but not necessarily to the main OS.

Note that what secure boot guarantees is that only authenticated code runs. Malicious code can run if it got signed by the hardware manufacturer for whatever reason.

A Microsoft paper §6.7 gives an overview of an example secure boot chain. A Texas Instruments whitepaper describes a secure boot chain in more detail.


Are older viruses removed from virus definition files?

Detection for a piece of malware is never removed from a mainstream AV.

Detection for old or rare malware is not removed mainly because AV benchmarks and clients seeing one AV missing detection while the others have it.

Let's say a signature is added for "Malw" malware but then the persistent malware writer makes subtle changes to avoid that specific detection. So variants start trickling in: Malw.1, Malw.B, Malw.X.32768, ... . The AV company then starts seeing a pattern and produces a smarter signature that finds a common factor and detects all of the variants.

This smarter signature might be:

the same classical byte pattern but on something that doesn't change between variants
a regular-expression-like pattern
a combination of byte patterns and metadata about the executable
features extracted from emulating the malware, like packers, loading patterns and behavior

This smarter signature is slower than the simple byte pattern but when there are a lot of variant signatures, the overall performance will favor the smart signature. When the performance is better with the smart signature, the simple signatures will receive a lower priority or will be deleted. That means Some malware will lose specific detection although some AV engines will output the detection with multiple signatures, not just stop at the first detection.

Periodical re-scanning of the entire collection of malware is performed to check if some changes in the AV have lead to malware not being detected or false positives have been introduced by smart signatures.


The globalbuf variable is an uninitialised static variable, so its virtual address is not randomised.

  I know that uninitialized global and static variables are part of BSS section; and therefore I assume that BSS, Text and Data sections are not being randomized by ASLR.

The BSS section is not randomised because it is marked as uninitialised data. This is a flag that is set on the section header in the executable file. The data in this section is static, and will always have the same address every time you run the application. The unchanging pointer value you see is the virtual address of the globalbuf variable.

The text and data sections are randomised (if the application is compiled as position independent with -fPIE), because they are marked as code segment (CS) and data segment (DS) respectively. Note that code and data segments have special meaning in x86, and their base addresses are populated into the CS and DS segment registers. This is why you'll often see references like dword ptr ds:[05012340] and dword ptr cs:[00410000] in assembly - the former is an address inside the data segment (DS), and the latter is an address inside the code segment (CS). Since these are important sections, their base addresses are randomised (i.e. equally offset from a base address).


Storing server-side secret key in environment variable - is a concern?

Yes, storing credentials in plaintext is always a security concern.

Depending on what you use those credentials for (e.g. database access), you might want to look at alternative methods of authentication, which do not rely on a pre-shared key.

If you do not have any options other than storing a pre-shared key in plain text, then there are still some things you can do:

Authentication Proxy between you and the server

The concept is simple. You can set up a proxy server between your web server and your target, e.g. a database. You use a strong authentication mechanism that is independent of your web server to connect and authenticate to the proxy, which then adds credentials to each request to the database.

This way, the credentials are never accessible directly by the web server.

Cleaning up after yourself

Storing credentials in an environment variable can be done right and horribly wrong.

The wrong way is this:

export DB_CRED=user:pass
mywebserver <options...>

Why? Because this environment variable is now exported to every other process from the same shell.

The very wrong way is this:

export DB_CRED=user:pass
mywebserver --credentials $DB_CRED

This is even worse, because any user on the same system looking at the running processes will see mywebserver --credentials user:pass running.

So what is the right way? It is to launch your application like this:

DB_CRED=user:pass mywebserver <options...>

Further, you must then unset this environment variable, once it is saved in a variable of your application.

Why is this better than exporting? Because the variable DB_CRED is only set for mywebserver. If the web server then unsets the variable, it does not exist for the shell anymore, only for the process.


How to configure Burp suite in browsers while my internet connection works behind proxy.?

Burp can use an upstream proxy server.  You would set up your browser to use your burp instance (usually localhost:8080), and in Burp's options, you can set your company's proxy server (say: proxy.company.com:8080).  All traffic will pass through your company's server, after it has been handled using Burp.

To help auditing both internal (intranet) and external web applications, you can set conditional proxy servers


Your code is good for monitoring users activity on the server but to be honest, It can't help preventing DDOS attacks since the aim of DDOS attacks is to send tons of requests to the server to make it too busy to respond to its intended users.
your code seems to be doing lots of checking to determine if the number of requests has reached beyond your standards, and this means that not only the attacker has reached his goal keeping your server busy but also you are helping him with lots of processing which is done by your code.
Imagine that each time there is a request, your code has to search through database and retrieve information and then compare them and do lots of other stuff.
there is nothing you could do in PHP to stop this kind of attacks.
and also if the attacker uses UDP attack, your code will do nothing since the Apache listens to TCP port.
The only thing that can protect your website from DDOS attacks is your Hosting company. the company needs to have needed equipments like:

Firewalls
rate-limiting Switches
appropriate Routers
Application front end hardware
IPS based prevention
DDS based defense
Blackholing and sinkholing
Clean pipes

but if you need a secure login system you could use a captcha, even the one you created yourself. simply generate a random 5 digit number and create an image in PHP with the number printed in it and show the picture on the form and when the user submits the form, check if the number you generated matches with the one user entered. and also you can use PHP/JavaScript AES libraries to encrypt user inputs on the client side and decrypt them on the server.


Having the same key for several systems might be a bad idea because this necessarily means that the private key travelled between systems. The more a key travels, the less private it can be. It really depends on the context, in particular how far from each other the systems were during that moving key phase ("far" both physically and network-wise).

Giving each system its own private key and certificate is "safer" and will not induce any extra problem because SSL clients either don't remember the server's public key, or when they do they don't ask for it again. Speaking of which, for load-balancing between servers, you will want to share SSL sessions so that a client may reuse the result of a previous handshake for a new connection even if the load-balancer directed it to a new server instance (for Apache/mod_ssl, see the documentation, directive SSLSessionCache).

When each server has its own key, the server can generate it locally, and the private key never travels, which is good. The drawback is that each server will need its own specific certificate, so 20 servers imply 20 certificates. Your CA will love that; your wallet might disagree.


Is the Raspberry Pi vulnerable to injection beyond the SD Card?

The BCM2835 application processor that we use has no persistent storage on board, so an attack of the sort you describe isn't possible. The zero-stage bootloader is stored in real, honest-to-god ROM on the chip, and so can't be overwritten.


SSL server sends wrong certificate when accessed via Java

Nothing really is known about your client and the screenshots don't provide enough information about the ClientHello send by the client.

But the typical cause of this problem is that your client does not use Server Name Indication. SNI includes the expected target domain in the ClientHello and is needed if multiple domains with different certificates are hosted on the same IP address. If the client does not use SNI the handshake will either fail on the server side or the server will return one of the several certificates it has for this IP address which might not be the one the client expects.


How secure is an archive file if the password is cryptographically random?

From an information theory point of view, your password contains 32×8=256 bits of information. If your encryption key is also 256 bits long, you would need in average 2^255 tries to brute-force the key or the password: they would be of the same strength. If however your encryption key or the hash of your password is 128 bits long, it would need in average 2^127 tries to brute-force them: it would then be a waste of time to brute-force the password, guessing the encryption key would be astronomically faster, even with a less efficient algorithm.

In practice you would need the adapt the brute-forcing algorithm to check if the decryption of the archive succeeded or could succeed. This would use heuristics and possibly the checksums commonly found in archive formats.

Also, in practice, you don't event try to brute-force 2^128 combinations. You try the side door.


Does my routers self-signed certificate ever change?

This depends on your router. The certificate might be pre-generated in the factory in which case it will not change with a factory reset. But more likely is that the certificate will be generated on first startup in which case it will change after a factory reset. There is also the possibility that the factory reset is not a full reset and will preserve settings like the certificate. Or given the grasp on security several vendors have it might also be that the certificate is generated not based on real random data but on the MAC address of the device or similar constant data.


Backtrack 5 R2-64 bit cannot load database (postgres) help required?

Are you running metasploit from the menu or the command line? The database gets preconfigured if you go through the menus. I've had this same issue.

Frankly though, you should be reading the Backtrack forums for this kind of question.


PBKDF2 is Password Based Key Derivation, and is used for situations like this. The wiki lists several different implementations in various languages. It works as you describe (with a salt and pseudo-random function).

I'd caution you to think thoroughly about the model -- i.e., how will you handle password resets? Or lost passwords? Sounds like the user would lose his/her data with this model.


Bypass filtering of single quote for XSS in input field

No, XSS cannot work here without a single quote.

In javascript:alert(), the first part is the javascript protocol. You need to be in a URL context for it to work (eg inside an href attribute). It will also work - but not be necessary - in an Event Attribute (eg onload).

To perform XSS in your context, you need to be able to exit the string context of the value attribute. To do this, you need single quotes. If they are properly filtered, there is no XSS here.

(There is a slight change that the filter is not working properly; filtering may for example be done first, after which the input is handled further - eg decoded from some format - which might allow you to bypass the filter; but if you cannot bypass the filter and inject a single quote, you cannot perform XSS).


Is accepting old passwords a bad policy?

Well, I can't comment on this story of your bank, but the answer to your overall question is that it's very stupid to accept old passwords, because then users have no way to secure their account if their password is ever compromised.


Are retail POSs still storing credit card info?

In the general vein of- is security around retail credit card processing improving- the answer is yes, in fits and starts.

The main driver has been the shift towards tokenization, whose most visible champion is ApplePay, but improvement is also manifest in the presence of machines at retailers which rather than accepting a swipe of the magnetic strip hold the credit card to construct a credential using the card's chip that is only valid for that individual transaction.

The card brands- Visa and Mastercard- have been aggressive in using their compliance regime- PCI- to require improvements from retailers. Most recently, in October 2015, there was to be a shift in rules with the goal of increasing risk of fraud liability for retailers who did not move to chip-based payments. This shift has not resulted in wholesale adoption of chip-based payments, but these are framed as exceptional cases, and compliance will increase over the next few years.

PCI regulations have always distinguished between "data at rest" and "data in transit" and the compliance standards for merchants who keep data at rest have always been significantly higher. Fines and other penalties for merchants whose PCI compliance submissions- called Reports on Compliance- are found through a breach or through an audit to dramatically depart from reality are very steep.

Now, are dumb practices still in place around the retail industry? Of course they are, and there is significant inertia as retailers continue to be under enormous pressure from Amazon. Their incentives are not to add friction to the customer payment process, or to increase their own costs with wholesale adoption of new technology.


Microsoft ASMX Web Services Test form available on remote machines

When releasing a ASMX/WCF/SOAP webservice to production it's recommended to disable metadata access and turn off the test entry form. Yes, you should disable the test form for ASMX, and better yet, you should upgrade the ASMX to a WCF endpoint.

Will leaving it on lead to DoS attacks? No, probably not. Will someone try and enter in data if they come across it? Yeah. Where the problem lies though is the WSDL metadata. With the WSDL you can consume the web service from another application and call the service directly without having to go through the test form. If you turn off metadata, you can't get to the WSDL, so only clients that you trust should know about the interfaces for the service.


IP Spoofing with real IP when TCP 3-way handshake has been made

First of all, every TCP packet has a sequential identifier, which starts at a random position. (explained briefly in this discussion) So if the attacker is spoofing (non-SYN) packets (trying to hijack an existing connection), then all of those spoofed packets will be ignored or refused (depending on the type of packet) because they will be out of sequence.

So, in order for the attack to be successful, he will have to be eavesdropping on the connection so he can find out what the sequential identifier should be.

After determining the sequence. (via Passive Eavesdropping) It is easy to get the server to accept in-sequence data.

  Client A with real IP has connected ... Now, the attacker machine M sends a packet spoofing the IP address of A ... Will the ACK flag/field from server S be accepted by A?

The Acknowledgement packet will have the same sequential identifier as the Data packet sent.

The client A will not accept the Acknowledgement because the Data was sent from attacker M. (so the client is not anticipating an Acknowledgement yet)

(Unless of course this were an Active (non-passive) attack which gives the attacker more options, such as true MiTM)

However, the server will still accept the data.

Even if the client does not accept Acknowledgement of spoofed data packet, the connection will remain open. The client could even send another Data packet. The server will ignore the second Data packet because it has the same sequential identifier, but will probably repeat the Acknowledgement back to the client which would be none-the-wiser. I'm not 100% sure of this so I posted a specific question on that point just to be sure.

  The packet sent by M with spoofed IP of A gets a response from S to A. Will this response be accepted by A?

Yes, The Input and Output streams will increment their sequential identifiers separately.

Using a secure connection such as TLS will detect such TCP spoofs quite easily, so that is usually the recommended solution.


DUKPT is required for payment processing because PIN pads are comparatively weak HSMs running on low horsepower devices that are at high risk of being stolen and attacked. DUKPT exists to meet several security requirements, including the protection of past keys, the efficient production of future keys, and to ensure datagrams are always different.
AWS HSMs aren’t subject to the same limits or risks, and since their capabilities include cryptographically secure pseudo random number generation, DUKPT doesn’t make sense on that platform.

Instead of asking AWS to meet DUKPT requirements, ask your payment provider for alternatives that work in AWS.


Send a redirect after HTTPS certificate rejection

No, this isn't possible with browsers. The failure is signalled by the client, and at that point it won't retry the connection, and there's nothing the server can respond with to make that happen. If a server could cause this type of redirect it could be abused to fingerprint the client's TLS support.


How to know if a specific address is on stack or heap using immuntiy debugger?

As a general rule, you can't know just from the address. But with some context you can. Look at the SP register, for example. The stack and the heap typically grow toward each other, so in a low memory pressure environment, the addresses should be far apart.


Assuming that you are running IPS and FW-1 blade on a single system, rather than as standalones.  Also assuming that the NAT rules are part of the same FW-1 enforcement module that the IPS is running on.

The packet will enter the firewall kernel, be processed for SecureXL/ClusterXL/CoreXL, state table check, blah blah blah, go up the chain, be evaluated against security rulebase, which would determine if IPS inspection is neccessary, then processed down the chain outbound ... NATS applied, encrypt/log, and send to the OS for routing.  So the IPS would check on the untranslated IP.

I'm going to double check my SE materials when I get home but I'm 99% sure on this.

For sure 'fw ctl chain' will show you the processing order of all your FW-1 components.  what you would be looking for is that it is passed to IPS before it leaves "FW VM Outbound" (which would be with NAT rulebase applied).

Footnote:  The IPS architecture is actually different in R65 and R70.  R65 is the old SmartDefense and R70 IPS comes from the acquisition of Network Flight Recorder and the integration of that technology.  The <=R65 method of determining if a packet requires NAT is with rules (service definitions) in the security rulebase.  With R70, you have your own IPS rulebase.


Does Linux "Dirty COW" Exploit allow for privilege escalation with SE protections in place?

Short answer: SELinux cannot protect against the "Dirty Cow" exploit without SELinux implementing a proposed change and the kernel updated with this change.

In default installations (notably RedHat Linux), SELinux does not use user-level confinement.  Users and their shells run unconfined, so they would be able to access /proc/self/mem and exploit the "Dirty Cow" privilege escalation attack.

In order for SELinux to block this, users would have to be confined in such a way as not to have access to /proc/self/mem.

However, SELinux does not provide security around the kernel's handling of memory, merely process' execution and use of it.  SELinux largely applies security to the filesystem.  In the case of the COW (copy on write) exploit, memory handled by the kernel is being exploited for privilege escalation; going around SELinux protections.

It is possible for SELinux to be changed to support protections on the /proc mem files, and this has been discussed in the SELinux mailing list..


Security challenges of administrative share in windows 7

Admin shares only permit access over the network to users that are members of the computer's local Administrators group. You can disable them by configuring the AutoShareServer (for server OS) or AutoShareWks (for non-server OS) registry values:

Hive: HKEY_LOCAL_MACHINE
Subkey: System\CurrentControlSet\Services\LanmanServer\Parameters
Value name: AutoShareServer (server OS) or AutoShareWks (for non-server OS)
Value data: 0
Value type: REG_DWORD

(See https://support.microsoft.com/en-us/kb/288164)

There may be negative implications for disabling them--see https://support.microsoft.com/en-us/kb/842715.

Your teacher may be misunderstanding the scope of this feature. As noted, the admin shares are only accessible to members of Administrators (hence the name). If someone is a member of Administrators that is not supposed to be a member of Administrators, they already have the highest level of access anyway. Another way to say this: Disabling the admin shares doesn't prevent hacking; if a hacker can access them, you've been hacked already.


The answer to your question is Yes. You must convert the X.509 into a PFX and import it. There is no separate key store in Windows.

You can convert your certificate using OpenSSL with the following command:

openssl pkcs12 -export -out cert.pfx -inkey private.key -in cert.crt -certfile CACert.crt


Child iFrame hash verification of parent iFrame content

using any CORS configuration?

If Eve sets her CORS header to  Access-Control-Allow-Origin "victor.alt" Victor can verify the contents of the HTML it retrieves and verify all referenced scripts as well.

while allowing read-only access?
while limiting the the parent window's access to the content of the iFrame?

Neither of these exist, an iFrame cannot read the contents of another iFrame unless they are on the same domain.

However, you could push any user information you want to keep private from Victor into a sandboxed iFrame and using window.postMessage to communicate between frames.  Victor can monitor the activity between the two to ensure that no information is being leaked.


Is it safe to whitelist my public ip to a server, even I am behind CGNAT?

If whitelisting your public IP address is the only form auf authentication then it is not safe because with NAT (including CGNAT) this IP address might be shared at the same time with other clients. If instead whitelisting the public IP address is only additional defense and proper authentication is still done, then IP based restrictions are still useful: even if the same IP address is shared with some others which might thus pass this first line of defense it is still much better than have no whitelisting at all which would mean that all others could pass this line of defense.


Benefit of using two network interfaces for intrusion detection system

The main benefit is speed.  IDS isnt about prevention but rather about detection, so the packets that are routed to the production machine can be sent directly while the second port can mirror the traffic on the first and send it to a sniffer for the heavy lifting of the analysis.  This allows you to split the load between a dedicated production box (or cluster) and a dedicated sniffer/IDS box ... this preventing one from overloading the other.


Can a file contain its md5sum inside it?

Consider this: you create a file that contains every member of the set of 16-byte sequences. An MD5 checksum is a 16-byte sequence, so by definition this file contains its own MD5 checksum. Somewhere.


Comparing the MD5 hash to a modified word document and reverting it to original

As others have pointed out in the comments, a Word document is more than just the visible text you see.  Various bits of metadata (such as last modified time, or 'track changes' history) are stored within the file.  If even one bit of one byte were changed, the hash would be completely different.

If you wish to find out which bits have changes, you can compare the original against the modified-then-changed-back copy with a tool like the unix "cmp" (compare files) command, which will tell you the byte location of the furst difference.

Or, break out your favorite hex editor to examine the bytes in each file, and you will find your non-visible change.

Also, as others pointed out, your case is particular to Word (and other meta-data-storing file formats).  If you tried this experiment with a flat ascii text file, you would see the changed-back file have the same hash as the original.


Yes. Burp can do that. Here is a good overview about the different attack types of Burp Intruder.

What you are looking for is the "Cluster Bomb" Type with each of the four payload set to numbers from 0 to 9.


Whitelisting only particular hosts on Windows 10

You can enforce it via GPO. The steps are for GPO settings but you can use local GPO settings also.

Navigate to User Configuration > Policies > Windows Settings > Internet Explorer Maintenance > Security and then click on the “Security Zones and Content Ratings”

Modify Content ratings to "Import content ratings" > modify settings

In the approved sites tab give your whitelisted url.
In the General tab uncheck "User can see websites that have no
rating"


Does CORS interact with WebAssembly the same way it does with Javascript?

It looks like Same-Origin Policy (SOP) applies to web assembly modules.  See https://webassembly.org/docs/security/, where it states:

Additionally, each module is subject to the security policies of its embedding. Within a web browser, this includes restrictions on information flow through same-origin policy.


How does the predator network prevent outside control by an attacker?

See: wiki on SIPRNet and NIPRNet.

Essentially the two are airgapped, and should not be interconnected at any point.  In fact, measures are taken to prevent that very thing.  Nevertheless humans are on both networks, which means the results are mixed.


How secure is this method to remember security questions?

I generally dislike security questions in general; they usually ask for information that is more or less public. Mother's maiden name? Ancestry.com will tell you that. Your high school? Facebook, LinkedIn, any of a number of social media sites that use the info to suggest potential friends will not only have it, they'll advertise it if you aren't careful with your profile settings.

In this case, your source agrees, and instead of providing the actual answer, is simply making this scheme an alternate password. If the passwords he is using are random, strong and unique, that should be all that's necessary. If he's using a common password, the question hash is security through obscurity; once the fact a hash is used, and the method to generate it, are known to an attacker, it's broken.

Either way, it's not a total waste of time, but the simple fact that the way you do something is a secret outside the digital world cannot be relied upon for security within it. In this guy's case, it's not a secret that he uses this method, so he can no longer count on it to protect him and is a waste of time in his own case. The practice of using an alternate password as the answer to a security question (unrelated to the actual real-world answer to the question) is relatively secure on its own, as long as both the user and the website take the same care to protect the confidentiality of the security answers as the password itself.


Why can't someone break email or https encryption by somehow getting access to the encryption key?

Maybe you can see that it is indeed possible to send a secret over an untrusted path by the following (somehow simplifying but illustrative :-) example

You don't trust the post office and want to send me a gift

You can achieve it in the following way

You put the gift in a box and lock it with YOUR lock
You send the box to me and I additionally lock it with MY lock
I send it back to you
You remove your lock and send it back to me
I remove my lock open the box and take the gift

The mathematical approach behind key exchange protocols is somehow similar. The most fundamental of them is the Diffie-Hellman key exchange.

I hope that makes things a bit more intuitive.


Why some routers ask for PIN but can't be cracked using PIN-based attacks?

It would seem that some router manufacturers can detect brute force attempts and enter the router into a "lock down" or "safe mode".

http://kb.netgear.com/app/answers/detail/a_id/19824/~/how-do-netgear-home-routers-defend-wifi-protected-setup-pin-against-brute-force

  NETGEAR home routers will protect themselves after several failed
  attempts to authenticate as an external registrar by entering a
  lock-down state. During the lock-down state, all WPS attempts using
  the Router PIN will not work. The router will return from the
  lock-down state after a predetermined time period.


How can I calculate the entropy reduction in my system I'm going to introduce?

So basically, this is a form of plain-text attack against your algorithm.

The question is how easy it is to guess your integer. If I know "foobar" and the new password, then I can create a set of equations that try to determine the original integer. As long as the integer is larger (in qty bits) than the password (the aqtial information in the password), then I can never really calculate the actual integer.

I might, however, get enough information to make the integer 'less random'.   That sounds abstract, but let me give a very simple example.

I try to determine the value of x, which is element of [1 - 10]. The original brute force would need me to test 10 values. However, I know that the remainder of x/3=2.  That means that x is element of {2,5,8}. So I now have to test 3 values, in stead of 10.

How that exactly works out for your algorithm, and whether you have sufficient entropy left requires quite a bit of calculation in the realm of information theory. And to be honest, my information theory is a bit too rusty for this.

Another question is whether the entropy is sufficient. Compared to what? A completely random password? or "qwerty123"?

I realize that I have not answered your question, but instead made the problem slightly larger. Or I may even have completely misunderstood the question. Sorry for that.


Generally, to perform MITM attack between A & B, you must apply 3 steps:

Trick A to think you're B
Trick B to think you're A
Enable packets forwarding

To answer you question, there are 3 types of ARP packets, the normal send and reply packets, and gratuitous packets.

Using gratuitous packets, the attacker can modify or 'poison' the targets cache, so he can trick both A & B, and stay in their ARP table as a legit part of the connection.

Note that this kind of attacks can be stopped using some kind of switches which is able to sniff the network for gratuitous arp packets and re-send the correct data through the network.


What are the advantages/disadvantages of attribute-based access control?

Simple google search would give you the answer to this question.

Vendors like Axiomatics are more than willing to answer the question.

The US Government also has an opinion

You might have missed 1 Raindrop unless you follow the field, but I think it answers your question nicely:

  It seems to me that the value of XACML and ABAC is really in the use cases that they enable. It's outward focused, and unlocks value through new kinds of services. . . .

The summary is that ABAC permits you to express a rich, complex access control policy more simply.  Most access control policies (I'm looking at you RBAC) rely on ''someone'' somewhere updating a policy as employees move from job to job or responsibility to responsibility. People get added for temporary needs, and never removed.  There is a huge back end to implementing the policy.

The simplest and coolest example I can cite is from a real world example. Turns out that the bouncers/bartenders at a bar were checking ID and were memorizing/copying the information from cute  women. Then they would either stalk the women, or wait till the women had had enough to drink that their judgement was impaired and offer them a drive home.  This is an opportunity for a bad thing to happen.  The bar implemented an ABAC solution.  When the women entered they submitted their ID to a machine that either issued a wristlet or tagged the credit card as over/under 21.  The only information the bartender had was whether the person was legitimate to receive alcohol; access control (to alcohol) was decided based on a single attribute (over/under 21), without revealing any additional information.

ABAC, if implemented as part of an identity infrastructure means that when Mark Wallace moves from the developers group to the project manager's group, his access control rights will be updated because he changed supervisor, workstation, and job title, not because someone remembered that he had admin permissions and took time to update a configuration file somewhere.   The HR department feels that it is very important to keep track of who my supervisor is, and they have a vested interest in keeping that information up to date; my permissions flow from those kind of organic decisions.

Disadvantages?  There aren't a lot of deployments because it is still kind of new, and because you only get the full benefits when you deploy sufficient infrastructure.  Vendors are still playing with the right implementation of the right protocols. There is a lot left to be worked out.


Why do web sites show my iPhone using different IP addresses for HTTP and HTTPS (cellular only)?

I am just going to take a guess here.  Your telephone data carrier may have an optimizing or caching proxy for content whose IP address appears in your JSON result.  As the proxy has no visibility into encrypted HTTPS packets, it cannot proxy the content, so it may be routing directly with your public (routable) IP address.

If this is the case, your phone has one IP address but the carrier's routing shows different origin IP addresses at ipof.in.


The CORS policy is enforced by the browser, not by the server. The server just sets a couple of HTTP headers telling the browser how it wants it to behave. There is nothing that forces a proxyserver to honor those headers, and it can add, edit or remove them like it can with any other headers.

So the proxy can send the request but you can not, because as a front-end developer you are bound by the limitations the browser puts on you. There is no way around that. You will either have to set appropriate CORS-headers on your back-end, or you'll have to continue to rely on proxies.

So is CORS and the whole same origin policy useless if it can be bypassed with a simple proxy? No! Since the request is now made to acorsproxywebsite.com any cookies or other authentication information for example.com will not be included automatically in the request by the browser. That means that the proxyserver is only exposing what itself can see, and not what some other potential victim can see.


Firewall is blocking invalid URLs, what is the danger?

I want to remove that option so that it does not block invalid URLs
  anymore.

Fortinet actually has a clear article on exactly this issue.

  it's a checkbox that I can check or uncheck

The checkbox simply controls:

Enable to block web sites whose SSL certificate's CN
field does not contain a valid domain name.

and as they point out:

When a visited URL that contains a "_", the site will be blocked
with "block-invalid-url".
As per RFC 952, " A "name" (Net, Host, Gateway, or Domain name)
is a text string up to 24 characters drawn from the alphabet (A-Z),
digits (0-9), minus sign (-), and period (.).

The prohibition upon having underscores in domain names, which dates back to RFC 952, is a controversial issue which is somewhat pedantically clung to by security software.  There's some discussion of it in this answer.  In practice, having underscores in the host portion of a domain name is technically not legal, but widely practiced and does not indicate anything at all as to the security of the site.

  What is the danger of disabling the check from the firewall for
  invalid URLs?

Very low.  This is a pedantic check on RFC compliance rather than a reflection upon any actual security value.  In practice, malicious sites are not particularly likely to have "invalid" domain names.  There is no indication from the Fortinet KB article that they are drawing on any other source of data (e.g., blacklists, keywords) when determining if a URL is "bad".


How to protect against unwanted photographs?

This question is not really a true question and is more of an oxymoron.
This question is not really a true question and that may be why possible solutions on this are actively sought for, but that the 'missing something' aspect stays.
The only solution to this question that seems to work correctly and which is very simple, is (and maybe out of range): There is no need to protect against unwanted photographs at all in 99% of the time as most people don't even care who's on it. A human-social bordering question just can't be fixed with technology, no matter how hard you can justify your brain into thinking that that would be the option. Even if it seems to work as intended, it doesn't. period. Why? because human-social bordering problems are very complex, not fixed, not defined and not fixable with technology whatsoever, and that likely will not change for decades to come.
Plus, if you behave normal then why would people even consider to take out their phone right away?


Best practice to guard against an app copying private ssh keys stored under ~/.ssh?

As Naftuli Tzvi Kay stated a well worn solution is using a hardware device to manage your keys.
Some alternatives for a software solution include:

Making your private keys only readable by root / sudo
Encrypting your private key with a password, so at least it will be non trivial for the attacker to crack it if they do steal
Storing them in an encrypted directory somewhere on your local machine


You are correct on the different headers (a.k.a. banners), and that plain SSH will not traverse an HTTP proxy.  But proxies come with inbuilt traversal methods, and an HTTP proxy come with the HTTP CONNECT word.  Since you are not sure whether is is an HTTP proxy or not I'll also add info about SOCKS proxies.

There are pretty much only 2 types of proxies out there: HTTP or SOCKS (other proxies are often just hacks put together).  3128 is a (more-or-less) standard port for the squid proxy, therefore it is highly likely that is the software being used to create the proxy.  And squid can run either HTTP or SOCKS proxies.

Both Firefox and Chrome have setting to use the proxy as an HTTP proxy or a SOCKS proxy.  It is written next to the option where you input the address of the proxy.  If both work, then squid is configured to accept both.

Either way, SSH can be configured using ProxyCommand to use that command to traverse a proxy.  But you still need a command that will be capable of traversing the proxy itself.  There are several options out there, my favourite is ncat (the netcat program provided with NMAP) and I'll use it in the example below but I'll add more options at the end of the answer.

Inside your ~/.ssh/config you can add

ProxyCommand /usr/bin/ncat --proxy-type http --proxy 172.18.10.1:3128 %h %p

Where --proxy-type can also be socks4 or socks5.  SSH will use that command to traverse the proxy and then establish the connection.

Other options

Plain nc can also be used, as follows:

ProxyCommand /usr/bin/ncat -X connect -x 172.18.10.1:3128 %h %p

And for SOCKS the -X arguments should be "4" (SOCKSv4) or "5" (SOCKSv5).  Unfortunately, nc varies from platform to platform and some options may not be available.

If you still have a firewall after the proxy see Gilles's answer on unix.SE for an extra bag of tricks.

Extra note

You can disable HTTP CONNECT in squid.  And if that is disabled all bets are off, since the proxy will not allow any traffic that is not a valid HTTP WORD (that is not disabled, e.g. GET, POST) from traversing it.

Yet, the big problem with disabling HTTP CONNECT is that then HTTPS traffic cannot traverse the proxy, therefore it is unlikely that an HTTP proxy has HTTP CONNECT disabled.

Update: Can't a proxy simply allow "native" HTTPS to pass through?

This is a question in the comment by @Pacerier which I found may be interesting to address.  Full question:

  Can't a firewall allow native HTTPS while blocking HTTP CONNECT HTTPS?

Which I will mangle into (since we are talking about proxies really):

  Can't a proxy allow native HTTPS connections while blocking HTTP CONNECT HTTPS?

Yes and no.  First, a proxy do not block connections that do not go through the proxy, it only decides on connections that go directly to the proxy.  In theory a proxy could allow "native" HTTPS to go through, the problem is that "native" HTTPS is basically any stream of bytes since it is encrypted at TCP level.  In other words, HTTPS is not a protocol that is visible by looking at the packets, that is by design.

The counter argument to that would be that a proxy would be capable of checking whether a stream performs the HTTPS handshake at the beginning and, if both sides "complete" the handshake then allow any stream of bytes to continue going through this connections.  Note that one cannot know whether the connecting parties succeeded in the handshake, that is also by design, therefore a proxy can only know that a handshake was sent or not.

Assuming the above, you can now use your proxy for any protocol since you can simply fake an HTTPS handshake and then send whatever you want.  This defeats the purpose of most proxies, i.e. you turned your OSI layer 7 (HTTP) proxy into an OSI layer 4 (TCP) proxy.  And on a layer 4 proxy it does not matter anymore whether you are using HTTP, HTTPS, FTP or LDAP.

References (not very related but I took some info from there)

How to use ssh over http or https?  on unix.SE


Trusted Certificate Authorities - how do they work?

Basically, any CA does exactly what it wishes to do. However, OS and browser vendors won't accept just any CA as a "trusted root". E.g. Microsoft runs a root certificate program which defines the contractual conditions that a CA must fulfil in order to get its root CA public key included in the "trusted store" of all Windows systems. These conditions include a lot of legal details, financial agreements (notably insurances), and also that the CA respects clearly documented procedures for everything it does. In practice, the CA will have to do some research to verify domain ownership and weed out obvious phishing attempts before granting a certificate.

The CA/Browser forum is an organization which tries to establish baseline requirements for such jobs. See also WebTrust, which aims at being a faithful incarnation of the principles set out by the CA/Browser forum.

Extended Validation certificates are certificates which have been issued by CA who follow strict requirements (including anti-phishing procedures), along the lines defined by these organizations. Browsers who comply to the CA/Browser forum guidelines are supposed to display EV certificates with a specific visual indication, and not to use that indication for non-EV certificates -- in effect, EV certificates are a method to define a whitelist of "good CA" within the jungle of existing CA.

(It has been noticed that though Microsoft and Firefox and Chrome have strict rules about inclusion of commercial CA, they can hardly politically afford to reject a "government CA" from any big enough government, although these CA are not necessarily well maintained and documented. "EV" is an answer to that sad state of things: browsers will include such dubious CA but won't tag them as "EV".)


Software to simulate attacks such man-in-the-middle or DoS

In one way of answering your question, you can look at something like Kali Linux , for a suite of attacks, and Metasploitable for a vulnerable target. Place both in a virtual environment (VirtualBox?) and simulate the types of attacks that you want.

Alternatively, you don't need a specialized target, but simply a generic target using a vanilla OS.


The authoritative for .com will indicate in its signed answer that example.com is also signed (some output omitted)

$ dig +norec +dnssec a www.example.com @c.gtld-servers.net

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;www.example.com.       IN  A

;; AUTHORITY SECTION:
example.com.        172800  IN  NS  a.iana-servers.net.
example.com.        172800  IN  NS  b.iana-servers.net.
example.com.        86400   IN  DS  31589 8 1 3490A6806D47F17A34C29E2CE80E8A999FFBE4BE
example.com.        86400   IN  DS  31589 8 2 CDE0D742D6998AA554A92D890F8184C698CFAC8A26FA59875A990C03 E576343C
example.com.        86400   IN  RRSIG   DS 8 2 86400 20150503041532 20150426030532 33878 com. P7R78q8UpfNTw+oVYJkL4BizSB4b8sglabdODISZEFSP3/z7CPAXOa4C 31rbNeLvD/O0I6pmYbg33HILGyj+yxAlZj7x3LNuLzaun86S201XcLkH /Xe/tLA+kEBgwZ6RV+1Vvqc51kAcQuN0U+6v5nZFaCJ1ZhvZ/S8w7FMf dfY=

Note the RRSIG - this is signed with the key for .com, and it allows the client to validate the DS records. The DS (Delegation Signer) records, in turn, are a hash of the DNSKEY for example.com. When a client receives this reply, it knows example.com MUST be signed, and MUST be signed with a key that matches one of the DS records. If the client then gets non-DNSSEC data from the example.com name servers, it knows something is wrong and will treat the data as BOGUS.


There is no generic answer to this. It depends on the actual hash and encryption algorithms and whatever "multiple times" and "fewer" actually mean.

But I think that the general idea of this approach is wrong. Instead of trying to add security by doing hashing/encryption multiple times you should start with a known strong key derivation function (and not a simple fast hash, even if called multiple times) to derive a strong key from the password and then use a known strong encryption method. In other words: use known good primitives as they are intended and don't invent your own enhanced version of weaker primitives.


Are malicious relying parties able to abuse OpenID logins?

If you authenticate to another website with Google's OpenID system, it will tell them that the person authenticating is in control that particular GMail address. Unless they get in-line between you and another site, they can't perform a MITM attack. They can only effectively take advantage of your credentials if they pretend to be your identity provider and you put your password onto the wrong website.

For a comprehensive look at what can go wrong with OpenID, Google says it better than I do: http://sites.google.com/site/openidreview/issues


Terminology for reduced brute-force attack?

"Password Spray" is used to describe an attack in which a limited number of likely or easily guessed passwords are attempted against a number of accounts.  It's usually used for on-line (e.g., try to log in) rather than off-line (e.g., get copies of hashes) attacks.  To quote TheWindowsClub:

  Password Spray Attack is quite the opposite of Brute Force Attack. In
  Brute Force attacks, hackers choose a vulnerable ID and enter
  passwords one after another hoping some password might let them in.
  Basically, Brute Force is many passwords applied to just one ID.


Antivirus settings for developers and build machines?

This is a common problem and different dev teams solve this is a variety of ways.

The best practice is to mitigate the risks appropriately. That sounds like a way of avoiding the question, but in cases like these, it's the only real way to approach the problem.

What's "appropriate"?

The threats are:

Devs use their machines to create and release critically important product code that will run on production servers, and both code and servers have access to the business' most critical data. A compromise of the dev's machine can result in the compromise of the code, the machines, and the data the dev's code is run on.

That means that in order to protect the dev machine, which has a low critical value to the business (you could shoot it with a shotgun and the business would not care except for the replacement hardware costs) from the things with the highest critical value to the business, there needs to be a level of control/protection/defence. Some form of risk mitigation.

Devs need the appropriate tools and resources to create the critically important product code upon which the business relies. Hampering of the development process or inconvenience to the devs could negatively impact code quality, product innovation, and speed of release.

That means that whatever mitigations are put in place need to have an impact on the devs that is within some definition of tolerance and needs to support the devs in their ability to meet productivity targets.

Given these threats, how does anti-virus fit in?

Anti-virus helps to automatically respond when the machine is compromised. The more "whistles and bells" are turned on, the increased number of types of compromise can be responded to. Reducing AV protection reduces the protection between the dev machine and the "crown jewels".

If the current AV level of protection to mitigate risk #1 is increasing risk #2, then you need to start looking at reducing risk #1 in new ways so that you can reduce the level of protection to bring risk #2 back into tolerance.

Reducing risk #1 in dev environments is to:

reduce the likelihood of compromise of dev machines, and/or
reduce the impact of compromise of dev machines

The more a dev machine is only used for development and not personal activities, the lower the likelihood of compromise of that machine. Devs like to do a ton of other things on their dev machine other than coding: music, videos, email, social media, browsing, games, installing random tools they find on whatever site they fancy. If those things could be done away from the coding machine, or coding environment, then you lower the likelihood of dev machine compromise. Then the AV protection level could be reduced to a more tolerable level.

Alternatively, the coding activity could be separated from the machine itself. This is typically done by having coding environments in a protected remote environment. That way, the dev machine can be filled with malware and the code in production is unaffected. In this way, in an extreme example, it might be possible to not have any AV on the dev machine at all. The remote coding environment can similarly have reduced protection because the likelihood of its compromise is much lower.

However, if you want the devs to do whatever they want on their machines and code and upload whatever code they want to the CI process, then increasing your tolerance for delays and bugs introduced by the protection mechanisms is the only way forward while also keeping risk #1 at a tolerable level.

Specific settings

Checking each file when accessed (moved around or run in the CI steps) is important in a dynamic file system environment like a laptop. If the environment was more static and predictable, then on-access scanning can be turned off.

There could be a file upload area on the CI servers that allows the AV to scan files, and then the CI process should pass it on to the rest of the CI process. Alternatively, if you are passing code and not compiled binaries, there is no need to run AV on each file when accessed, but scanning can be scheduled. Binaries, however, should be scanned before they are run in CI.

Excluding files or file locations just means that you intentionally set up a blind spot for malware to permanently hide and typically increases risk #1 unacceptably. Instead, increase the predictability of safety in the environment and you are freer to reduce the on-access, on-demand, and dynamic protections.

What about increasing tolerance in risk #1?

For completeness sake, I will also address this.

As a dev, you have no control over the acceptable level of risk #1 and it is entirely in the hands of management. However, you could, and should, ask and challenge the acceptable level. An honestly and accurately assessed risk to the business by having compromised machines drives all the other related risks, so it is important to get it at the correct level. Just throwing mitigations/protections at the highest level at things in hopes that "bad things don't happen" doesn't help anyone and wastes the company's time and money.

How devs can express their needs to the security department

Express your general understanding and buy-in of risk #1
Ask to get to know management's acceptable levels of risk #1
Ask for their, and management's, understanding and buy-in of risk #2
Work together to come up with suggestions to reduce the likelihood and impact of risk #1 in different ways so that the level of mitigation brings risk #2 to a more tolerable level
Understand that promises and trust will only go so far and that technical boundaries and controls have to come into play at some point
Commit to regular review with the security team about the risks and the mitigations to make sure it is all still working with everyone and to seek improvements and conveniences


How can I measure (and increase) entropy on Mac OS X?

First, note that on OS X, /dev/random and /dev/urandom have the same behavior; /dev/urandom is provided as a compatibility measure with Linux. So, while you will see much advice online to use /dev/random because it will block if insufficient entropy is available, that is not the case under OS X.

/dev/random uses the Yarrow CSPRNG (developed by Schneier, Kelsey, and Ferguson). According to the random(4) manpage, the CSPRNG is regularly fed entropy by the 'SecurityServer' daemon. Unlike Linux, reading values from /dev/urandom does not exhaust an entropy "pool" and then fall back on a CSPRNG. Instead, Yarrow has a long-term state and is reseeded regularly from entropy collected in two different pools (a fast and slow pool), and reading from /dev/random pulls directly from the CSPRNG.

Still, the random(4) manpage notes:

  If the SecurityServer system daemon fails for any reason, output quality will suffer over time without any explicit indication from the random device itself.

which makes one feel very unsafe. Furthermore, it does not appear that OS X exposes a Linux-style /proc/sys/kernel/random/entropy_avail interface, so there is no way to measure how much entropy the SecurityServer daemon has fed Yarrow, nor does there appear to be a way to obtain the current size of the entropy pools.

That being said, if you are concerned about the amount of entropy currently available, you can write directly to /dev/random to feed the CSPRNG more data, e.g. echo 'hello' >/dev/random (of course, hopefully you would use actual good, random data here). Truth be told, though, the default behavior probably suffices; but if you're feeling paranoid, use a Linux live distro, maybe with a hardware RNG attached, and generate your keys from /dev/random.


Why can't Google Forms be used for elections?

In general, we can't use a third-party vendor's website for public systems, since anything can happen beyond our control.

If we host a site similar to Google Forms and it was managed by us, we may conduct elections using a centralized system.

As far as usability goes, it would be good, but in terms of security, it's a bad option, since we can't trust the results beyond our control. Apart from that, anything may happen. For example, you may bribe Google to change the results or online voting usually suspects for cheating.

Kindly have a look at this answer, which describes many types of cheats which are good examples of how online voting can be misused.


Most secure way to isolate computer on network

I agree with Neil Smithline that you should clarify the parts you are having trouble with, but I think i understand enough to give you a few answers.

For separating your computer from the rest of the network, look at setting up a hardware based firewall on your network.  I know of Fortigate and Zyxel Firewalls (Note: it takes time to learn how to configure these well).  Both can be configured to separate or treat your computer differently when it comes to internal and external traffic.  They are very complex though, so it can be a difficult learning curve.  Also it can leave holes or other issues if not configured properly, so it can be overkill.  Just an idea though, in case you want to try it out.

Anything past that is getting into good IT common sense 101.  Such as with AV/Malware scans, encrypting hard drives, configuring software AV/Firewall, and possibly other things that count more as opinion rather than best practice.

So as far as keeping client data separate, all you can do is make sure your work computer is separate from your personal computer, and make sure what you do on your work computer is controlled and monitored.  That part will be up to you, because there isn't just 1 answer (hence why Neil suggested to be more specific).


GPG subkey layout. Separate keys for C, S and E?

The distinction in signing and encryption keys is mostly a necessity for algorithms not capable of doing both: for example, when using DSA for signature, you need another ElGamal encryption subkey. Thus, by default signing and encryption have been split into separate tasks. Certifications are technically also signatures, thus those two capabilities are combined by default.

For having an offline key (and generally being able to revoke single keys, for example after trouble like Debian had with DSA and being able to calculate back the private key based on many signatures), it seems reasonable to completely split up capabilities, removing the signature capability from the primary key and creating an additional signing key.

TL;DR: Go for it, there are no disadvantages if you want to limit the primary key's use to certifications and key management anyway.


Does the HTML password field include any protection against XHR/AJAX exfiltration?

Using type="password" in HTML only prevents shoulder-surfing by obscuring the typed characters on the screen.  The actual password is available to any code that can access the document object model, and, in the absence of a TLS connection, is sent to the server in the clear.

Although not directly related to the question, I have to add that "client-side encryption" is useless.  The "encrypted" value is available through the DOM, and as far as the server is concerned, that is the password.


Can your cell phone transmissions reveal your identity?

AS Hugo stated, yes the phone can act as a tracker via it's IMEI & SIM card IMSI numbers. These are sufficient for a telco to identify the phone owner, but a third party can still identify the unique phone without necessarily knowing the registered owner. Even without actively using the phone, it pings towers to let the network know where you are in order to handle call routing for you.

Additionally with many modern smart phones, turning it off doesn't really turn it off, you need to physically remove the battery to make sure it's actually off. This can be problematic with many phones (Apple).

Putting the phone into "airplane mode" will stop it from talking to cellular towers. Unfortunately many smart apps collect WiFi SSIDs that they've seen and will report that information later after you come back online, providing an historic trail of electronic bread crumbs.

Faraday bags and such will only make your phone spike its power levels to punch through, rapidly killing the battery in the process.


Malicious user inflicting XSS attacks appears to be on my own network

Ask your network administrator about who that IP address belongs to, then pay them a visit and firmly apply a LART to the back of their head.

Should that not be an option, configure nginx to only allow connections from your own IP address. This is obviously only a good idea when your IP address is static, because otherwise you will lock yourself out when your IP changes.

Another stop-gap measure is to reconfigure nginx to require HTTP authentication for all requests. That way a user can only make any requests by providing username and password or even better with the correct certificate.

How to do this is a technical question for https://serverfault.com


The fingerprinting technology used by the EFF is nothing but the "normal" Javascript functions used by web sites to, well, operate properly. It is possible to report untrue information to the outside, but then you'd risk either "falling behind":

the untrue information you would need send along changes and yours doesn't, making you unique -- and suspicious;
the detection techniques change, and you aren't aware of it, so become unique again;

or having a really awkward navigation.

Assuming that you can use Tor or a VPN or an openshell anywhere to tunnel away your IP address, the "safest" practice in my opinion would be to fire up a virtual machine, install a stock Windows Seven on it, and use that for any privacy-sensitive operation. Do not install anything unusual on the machine, and it will truthfully report to be a stock Windows Seven machine, one among a horde of similar machines.

You have also the advantage of the machine being insulated inside your true system, and you being able to snapshot/reinstall it in a flash. Which you can do every now and then - the "you" that did all the navigation before disappears and a fresh "you" appears, with a clean history.

This can be very useful, in that you could keep a "clean" snapshot and always restore it before sensitive operations such as home banking. Some VM's also allow 'sandboxing', i.e., nothing done in the VM will actually permanently change its contents -- all system changes, malware downloaded, virus installed, keyloggers injected, disappear as soon as the virtual machine is powered down.

Any other technique would be no less intrusive, and would entail a considerable work on the browser or on some kind of anonymizing proxy designed not only to sanitize your headers and your Javascript responses (as well as the fonts!), but to do it in a believable way.

In my opinion, not only would the total amount of work be the same (or even more), but it would be a much more complicated and less stable kind of work.

Install the most common OS, keep to the bundled browser and software, resist the temptation of pimping it, and what's to tell that machine apart from literally hundreds of thousands of similar just-installed, never-maintained, computers-are-not-my-thing machines on the Internet?

Update - browsing behaviour and side channels

Now I have installed a virtual Windows 7 machine, even upgraded it to Windows 10 as Joe Q. Average would do. I'm not using Tor or VPN; all that an external site can see is that I'm connecting from Florence, Italy. There are thirty thousand connections exactly like mine. Even knowing my provider, that still leaves around nine thousand candidates. Is this sufficiently anonymous?

It turns out not to be the case. There might still be correlations that could be investigated, having sufficient access. For example I'm playing an online game and my typing is sent straight away (character buffered, not line buffered). It becomes possible to fingerprint digram and trigram delays, and with a sufficiently large corpus, establish that online user A is the same person as online user B (within the same online game, of course). The same problem could happen elsewhere.

When I surf the Internet, I tend to always hit the same sites in the same order. And of course I hit my "personal pages" on several sites, e.g. Stack Overflow, regularly. A bespoke distribution of images is already in my browser and is not downloaded at all or is bypassed with a HTTP If-Modified-Since or If-None-Match request. This combination of habit and browser helpfulness also constitutes a signature.

Given the wealth of tagging methods available to websites, it's not safe to assume that only cookies and passive data may have been collected. A site might for example advertise the need to install a font called Tracking-ff0a7a.otf, and the browser would download it dutifully. This file would not necessarily be deleted upon cache clearing, and on subsequent visits it not being re-downloaded would be proof that I've already visited the site. The font could not be the same for all users, but contain a unique combination of glyphs (e.g. the character "1" could contain a "d", "2" could contain an "e", "4" could contain a "d" again - or this could be done with rarely used font code points), and HTML5 can be used to draw a glyph string "12345678" on an invisible canvas and uploading the result as an image. The image would then spell the hex sequence, unique to me, 'deadbeef'. And this is, to all intents and purposes, a cookie.

To fight this, I may need to:

completely re-snapshot the VM after each browsing session (and reset the modem when I do). Keeping always the same VM wouldn't be enough.
use several different virtual machines, or browsers, as well as well-known proxy services or Tor (it wouldn't do for me to use a proxy that's unique to me, or for which I'm the only Florence user, for anonymity purposes).
routinely empty and/or sanitize the browser cache and remember not to always open, say, XKCD immediately after Questionable Content.
adopt two or more different "personas" for those services I want anonymity in, and those I don't care about, and take care to keep them separated in separated VMs - it only takes one slip, and logging to one believing it's the other, for a permanent link to possibly be established by a savvy enough external agency.

Audio Fingerprint

This is a very ingenious method of "fingerprinting" a system, basically consisting in turning off the audio system, then virtually playing a sound through HTML5 and analysing it back. The result will depend from the underlying audio system, which is tied to the hardware and not even to the browser. Of course, there are ways of fighting this by injecting random noise with a plugin, but this very act might turn out to be damning, since you might well be the only one using such a plugin (and therefore having a noisy audio channel) among the pool matching your "average" configuration.

A better way that I found working, but you'll have to experiment and verify this for yourself, is to use two different VM engines or configurations. For example I have two different fingerprints on the same Dell Precision M6800 in two different VMs using 4 and 8 GB of RAM and two different ICH7 AC97 Audio settings (I suspect that the additional RAM available makes the driver employ different sampling strategies, which in turn yield slightly different fingerprints. I discovered this totally by accident by the way). I assume that I could set up a third VM using VMware and/or maybe a fourth with sound disabled.

What I do not know, though, is whether the fingerprints I did manage to get are revealing the fact it's a VM (do all Windows 7 VirtualBoxen have 50b1f43716da3103fd74137f205420a8c0a845ec as hash of full buffer? Do all M6800's?)

All the above going to show that I'll better have a good reason to want anonymity: because achieving it reliably is going to be a royal pain in the rear end.


What is the best approach for securing log-in credentials on an HTML form?

To protect credentials in-transit, you use HTTPS. That is sufficient. As long as your form is delivered over HTTPS and submitted over HTTPS, everything sent and received is thoroughly protected.

As for what to use as a backend, that's up to you. Using oAuth effectively kicks the can down the road to someone else. Now you're not responsible for storing credentials, Facebook is. If instead you need to store credentials yourself, the common key-stretching answer applies.