Win10: Access other logged on users' memory

First, a bit of basics: users don't have memory, processes do. Usually these are user processes (such as Alice's Notepad.exe instance), but they can also be system processes (such as services or subsystems - like Local Security Authority Subsystem, LSASS.exe - which may span user sessions and have per-user memory). As you noted, an Administrator-level user ("admin") can list the processes of other users quite easily. They can do more than that, though: they can access those processes (or any other processes on the system, except for a few that are protected for DRM reasons) as though the processes were their own. This includes full debugging access (with read - and write, though that's not relevant here - access to the process' memory), and also enumerating the open HANDLEs (files, network sockets, registry keys, named pipes, shared memory sections, etc.). Admins also can access quite a lot of logging info on the system.

To answer your specific questions:

If Bob bothers to check, this is easy. He can look in the event viewer for security events like Alice logging in and then locking her session. He can look at files that Alice has open (by checking the HANDLEs of her processes) and see what their date-modified or date-accessed timestamps are (even EFS-protected files still expose metadata like timestamps).
Currently-running programs are very easy (Task Manager, tasklist.exe, Powershell, Resource Monitor, etc.). In fact, it's almost hard to miss if he uses any of those programs. Programs that Alice closed recently are harder, but still possible; they may have Event Log entries, they may have modified data files that only they would have reasonably used, and their date-accessed timestamps on the binaries will be updated. Bob would have to go looking for those, though, rather than them just falling into his lap the way her currently-running processes would.
Same as #2, really. Knowing the exact times a program that is no longer running was started and stopped might be hard, but he could get some point when it was running just by checking timestamps on the right files, and possibly more info by looking at system or app-specific logs (assuming the app-specific logs aren't encrypted).
For processes that are still running, enumerating their open HANDLEs is easy. Several built-in programs can do it (for example, Resource Monitor), as well as common free ones such as Process Explorer. Sorting that list by file path, and looking for the paths that lead to Alice's encrypted directories/files, is easy enough.
This is trickier, though still possible. Using a debugger (such as the free WinDbg or Visual Studio Community Edition from Microsoft), you could definitely read the process' memory, but knowing where to find the data you seek could be hard. An easier option would be inject a DLL into the process (you'd need to have written the DLL, or found one online, but anybody reasonably familiar with Win32 programming and with access to a compiler could do it in well under an hour) with a DllMain function that either reads the files you care about and writes them to an unencrypted location, or simply decrypts the files themselves (or grants Bob access to them; EFS files can support multiple users accessing them).

Reading from the pagefile or hibernation file is technically possible, but is usually something you would only resort to if the computer was turned off and its RAM held no data anymore. You would need to do a decent amount of forensic work to re-construct which blocks of memory were in use by which processes for what purposes. Much easier, if you want to do raw memory access like that (which is basically what those files are, raw memory written temporarily to disk, though only incompletely in the case of the pagefile) and don't have a specific tool for finding the data you want (which you could write, but it would take a lot more effort), to use a debugger that lets you query the running system and its processes in real-time.

Taking ownership of the processes isn't actually needed; admins have debug-level access (and edit-permission level access) to all processes by default, and can (with only moderate effort) ignore the ACLs of any process (or file, or other securable object) at will. They can also take ownership of any securable object, at which point they can edit its ACL and then, if desired, set the owner back to the original owner and even restore the original ACL; so long as the admin (Bob) opened a HANDLE to the process with the desired permissions while he had given himself access, he can access the process' secrets via that HANDLE even after restoring the original access. Note that taking ownership of the process merely changes who controls access to it and some other details; it does not change the Session or Window Station of the process' windows, which means you can't move those windows onto your desktop.

One way that you didn't mention, but that deserves mention, is simply extracting Alice's EFS key, or even her password, from the running system. Since she is still logged in, her credentials will be stored in memory. The most common tools for extracting them are Mimikatz and Cain & Abel. On Win10, it is possible to protect the memory used for storing the passwords in a way that defeats typical use of Mimikatz, but this is neither the default configuration on most systems (especially home ones) nor a foolproof protection against, for example, forcing one of Alice's running programs to just export her EFS key (which can be done using standard Windows APIs, though you might need to write a DLL that calls them yourself). If you get Alice's credentials, you can then use them to log into her still-running session (through the Login screen, or over the network via Remote Desktop Protocol) and take over her session that way.

Also, if Bob is a sneaky sort, he could change Windows so that users' passwords are stored under reversible encryption, and then just decrypt Alice's password. He would have to wait for her to log in again - changing that setting has no effect on users until they log in - but he could do it if he accessed the computer subsequent to changing the setting and then letting her use it (and she didn't change it back). Alternatively, he could simply install a keylogger to record Alice's passwords.


Some bots are trying to locate files on server, how to protect?

That is just normal background traffic. All domains are crawled all the time in order to find common vulnerabilities:

Unsecured or default passworded admin areas (like the wp-admins.php in your listing)
Files containing credentials (config.php)
Files or directories that are publicly available but not linked on the page (resulting in some people thinking that makes them somewhat private)

There is nothing you can do to prevent such probes.

If there is a huge influx from a specific IP range, and you don't expect any 'legit' traffic from that range, you can blacklist it. But a lot of these scans might come from botnets, so will have a huge variety of originating IP ranges.


What impact are you expecting Windows 10 Forced Updates to have on your Penetration Testing?

whilst obviously automatic updates will have an impact in reducing the window of vulnerability for OS level bugs in Windows 10, I'd say that realistically the OS itself is less often the target these days for client-side attacks, so the impact will be limited.

Usually for client-side attacks, the vector will either be social engineering (e.g. "hey you have a virus, install this") which isn't affected by patching or one of the commonly unpatched and Internet exposed pieces of software (e.g. Flash, Java, Adobe Reader) is attacked using either a patched or 0-day issue.

For external penetration testers, usually you'd go with something like a phishing campaign followed by either credential grabbing or social engineering to get the target to execute a piece of software which would give you access to their system.

For internal testers again the auto-updating will have limited impact I'd say, as usually testers once they've got access to one machine will make use of pass-the-hash / password cracking/tools like mimikatz to get credentials, none of which rely on missing Windows patches.  The days of finding things like MS08-067 missing and easily compromising systems based on that, are coming to an end for most organisation.

That's not to say that Windows 10 won't make things harder to exploit, but that I don't think that automatic updates will be the biggest differentiator.


What exactly is IE / Chrome checking when I view the "certification path" tab on cert connection details?

What exactly is this checking? Where is Windows (or more specifically, the Crypto Shell Extension application) populating the information on this tab from?

It is showing the trust path it constructed based on the certificates sent in the SSL handshake (ignoring any root certificates sent by the server), the cached intermediate certificates from other connections, the built-in root certificates and any other certificates it has in the store. Some browsers also download missing certificates and these will be displayed too.

  How can I see exactly what the browser got in terms of the actual certificate chain (assuming that the server in question is not publicly accessible)

You will not get this information from the browser. You might use tools like openssl to display the certificates the tool gets:

openssl s_client -showcerts -servername host -connect host:port

These are in most cases the same certificates the browser sees, but a server might actually decide to return different certificates based on parameters of the SSL handshake initiated by the client. This is specifically relevant for the SNI extension so you must include the -servername option with s_client.

But to get a definite knowledge of what the browser sees you need to do a packet capture using tools like tcpdump or wireshark. When viewing the capture with wireshark you then can see the certificates sent by the server. To make sure that you don't get a session resumption where you don't see any certificates make sure you restart the browser before visiting the relevant site.


Would it be possible and advisable to create a worm to patch for WannaCrypt?

That would definitely possible. In fact, a couple of days ago it was discovered that, even before the WannaCrypt outbreak, another piece of malware was infecting computers using the ETERNALBLUE exploit and secured the systems against ETERNALBLUE afterwards. (Said malware didn't install the patch, however; instead, it blocked the port used by SMB.)

But, it wouldn't make much sense for a vigilante to create an anti-WannaCrypt worm at the moment; at this point, WannaCrypt has already spread so widely that pretty much all targeted systems that are connected to the internet have either been patched or got infected.

(Although, because WannaCrypt crashed when infecting XP computers, those could still have escaped infection without being patched, there will probably still be some unpatched XP computers out there that could be targeted by an improved version of WannaCry or similar malware.)


When is a private and public key given to a user, and why can the private key not get hacked?

[Sorry in advance for the long explanation, but you've asked good questions about a complex topic.]
Asymmetric encryption uses a keypair consisting of a public and private key; each pair of keys are generated together at the same time.
Asymmetric means "not the same".  In cryptography, we use it to mean "What the public key of a keypair encrypts, only the corresponding private key can decrypt."  The pair of keys are mathematically related to each other, but knowing the public key does not enable anyone to figure out the private key.  You can think of it this way: the public key lets you create a math equation so hard that only the private key can solve it.
Asymmetric cryptographic algorithms allow me to publish my public key, and then anyone can use it to encrypt data.  But only my private key can decrypt the message encrypted with my public key.  And when I say publish a public key, I mean just that -- the encryption is so safe I can literally paint my public key on a billboard if I want.
The public key is only half of my keypair.  What do I do with my private key?  I must keep it secret.  Otherwise, anyone with my private key can read those secret messages meant only for me.
When do I create a keypair?  Obviously I have to create it and "publish" my public key before you can encrypt any data to send to me.
So if I have a keypair, and I publish my public key; and you have a keypair and you publish your public key, we can then each encrypt messages to send to each other.  As long as we keep our private keys safe, nobody knows what we're saying to each other.  Although they can still see me sending messages to you, and they can see you sending messages to me, nobody else can read them.
But immediately a problem springs to mind: if someone publishes a public key and says "This key belongs to SuperDuperStore; please encrypt your credit card and send it to them", how do you know if that public key really belongs to SuperDuperStore, and not EvilHackers?
The primary way that's been solved is through the use of "digital certificates", and this is where it gets more complicated.  A certificate uses another form of asymmetric cryptography known as a digital signature.  The digital signature uses a keypair just like our encryption, but instead the private key is used to create a "signature" of your public key.  The signature is a big number that only the signer's private key can create, but anyone with the signer's public key can verify it.  The signature and the public key are put together in a specially formatted data structure called a certificate.  So if you know you have a copy of the signer's certificate (containing SuperDuperStore's public key), you can use the signer's public key to verify that only the signer could have created the signature.
We call these signers of other people's keys "Trusted Certificate Authorities", or CAs for short.  Their job is to prove to everyone that a public key really belongs to SuperDuperStore by signing those certificates.  They do this by verifying that each request to sign a public key really came from SuperDuperStore, or Sangstar, or John.  Once they verify the request, they digitally sign your certificate request and send you back the signed certificate.
But now it's turned into a chicken-and-egg problem - how do you trust that you have the CA's real public key?  First, we have the CA sign their own public key, creating what is called a self-signed certificate.  It's a secure document, but how do we know it's not just self-signed by EvilHackers?  By only trusting delivery of those self-signed certificates to trustworthy entities.  That copy of Windows, or MacOS, or Firefox, or Chrome, or Android, or iOS, or Linux that you're using right now?  It was shipped to you with over a hundred trusted self-signed certificates pre-installed.  Any self-signed certificate that's not already on the list wasn't signed by a trusted CA, and your browser or computer will reject it, warning you that it is not a legitimate certificate.
Finally, you asked if these keys are persistent, or if they're constantly changed.  The answer is on the signed certificates containing the public keys.  Each certificate has a "Not After" (expiration date) field, and once a certificate is too old, it is no longer trusted by anyone else.  Before that happens you'll want to get a new certificate and publish it; it turns out this is usually a good time to generate a new keypair, too.


Master offline key, shared encryption/decryption key, unique signing keys?

Your approach seems reasonable; I'd add that the master key is also used for managing user IDs (which makes it important for maintaining trust in the web of trust).

The idea behind having a single encryption key is the fact OpenPGP lacks a way to couple a given subkey to a device or user ID. For signing subkeys, on the other hand, this does not matter, an available key is used instead.

A shared encryption key is well possible to achieve also with OpenPGP smartcards (a Yubikey in the end simply acts as one) using the keytocard command in the --edit-key (not --card-edit) menu. The FSFE wiki page on OpenPGP smartcards hosts an in-depth tutorial, covering pretty much all possible scenarios of using OpenPGP smartcards (the FSFE membership card is an OpenPGP smartcard).


Should a user be able to reset his password if his email address has not been verified yet?

The correct sign up procedure is as follow:

Alices signs up with a new password and an email address (x@y)
the account is created as blocked until email address validation
Alices tries to login and only gets a message saying she must activates her account with the mails sent at the address x@y
if the validation does not occur in the expected time (between 4 and 24 hours) the account is destroyed - prevents Alice to forget to validate her mail address
Alices validates from the mail and is asked for the password. If she cannot give the correct password after three attempts the account is destroyed - prevents Eves to use Alice's account if she received the validation mail

The real problematic case (already seen in real world) is:

Alice signs up with a correct mail account from her ISP and validates it
later Alice changes ISP, uses a new email account but forget to declare it in its account
even later Alice forgets its password. Plonk! She is definitely locked out of its account

I cannot imagine a way to mitigate that problem


Running Firefox from inside a Docker container

Why not? It depends of the use your are going to do. In that way if you dowload something for example, it's going to be downloaded inside the container. It will be accessible from the host only if you specify a volume mount during docker run command. Doing that, any virus you download will be "sandboxed" inside the container.

But you must not forget that:

Containers are sharing kernel with host.
Even if you launched the container with a host non-root user, if RCE (Remote Command Execution) happens in anyway, is possible to escape from container to host.

So could be a good a idea but is not a 100% free of risks technique. It depends of the use you are going to do.


IN OAuth 2.0, how is the client secret supposed to be kept secret?

OAuth2 specification defines two types of clients

   confidential
      Clients capable of maintaining the confidentiality of their
      credentials (e.g., client implemented on a secure server with
      restricted access to the client credentials), or capable of secure
      client authentication using other means.

   public
      Clients incapable of maintaining the confidentiality of their
      credentials (e.g., clients executing on the device used by the
      resource owner, such as an installed native application or a web
      browser-based application), and incapable of secure client
      authentication via any other means.

And the use client secret are applicable only to confidential clients.

So basically You use it only when it can reside safely on secure server - and not in case of rich client (desktop, mobile, javascript in browser).

The purpose of the client secret is to prevent impersonation of the client. As you noticed without it anyone can extract credentials from end user application and perform OAuth flows on his own. But if the secret is safe server side - then one can not complete flow and obtain token.

As for using client secrets in client under the control of the general populace my recommendation is to don't use it at all as it adds nothing in terms of security.


Is it wise to show the "e-mail has been scanned by XYZ antivirus" in e-mails footer?

I don't think it's a good practice to include footers like this in email correspondences. My arguments:

It clutters your email thread, making the actual message stand out less
The info is irrelevant to most recipients
It's probably not wise to expose the anivirus mechanism to the outside if it can be prevented
As has been mentioned by Steffen already, the claim cannot be verified by the recipient anyway
Companies are supposed to have some form of antivirus checks in place anyway; "bragging" about it in email footers shouldn't be necessary.

To sum up, I personally take footers like this as a sign that something's fishy (about the mail or the company). Why would they mention that at all?


What are the best pratices to avoid my server being port scanned

Portknocking
Portknocking is a method to open ports that the firewall normally keeps closed by executing a series of connection attempts (knocks) to other ports. Upon the valid sequence of port knocks, the required port will open.
Think of portknocking as a special knock on a door for the door to open.
Here is an example from ArchLinux wiki:
$ ssh username@host
(Ctrl+c to exit) ^C
$ nmap -Pn --host_timeout 201 --max-retries 0 -p 1111 host
$ nmap -Pn --host_timeout 201 --max-retries 0 -p 2222 host
$ ssh user@host
user@host's password:

The user knocks port 1111 followed by 2222 to open up port 22 for SSH.
Portspoof
Portspoof is a program which makes interpreting port scan results very difficult, therefore slowing down being able to identify open ports.

The Portspoof program primary goal is to enhance OS security through a
set of new techniques:

All TCP ports are always open

Instead of informing an attacker that a particular port is CLOSED or FILTERED
state Portspoof will return SYN+ACK for every port connection attempt.

As a result it is impractical to use stealth (SYN, ACK, etc.) port
scanning against your system, since all ports are always reported as
OPEN.

Every open TCP port emulates a services

Portspoof has a huge database of dynamic service signatures, that will be used to fool
scanners to believe there's a legitimate service running. Scanning
software usually tries to determine a service version that is running
on an open port. Portspoof will respond to every service probe with a
valid service signature, that is dynamically generated based on a
service signature regular expression database. As a result an attacker
will not be able to determine which port numbers your system is truly
using.

Quoted from https://github.com/drk1wi/portspoof
Portspoof makes identifying listening services much more difficult and as the README states, it would take over 8 hours to identify which ports are actually listening. Identifying the real ports is so time consuming that the attackers will likely give up.
This guide shows how you can install Portspoof:

Compile the software, go in the directory where you have unzipped/put the sources and give these commands:

$./configure $ make $ sudo make install
OR
$ g++ -lpthread -Wall -g Configuration.cpp connection.cpp
Portspoof.cpp revregex.cpp Utils.cpp Fuzzer.cpp Server.cpp -o
portspoof

Configure your firewall rules:

iptables -A PREROUTING -i eth0 -p tcp -m tcp --dport 1:65535 -j REDIRECT --to-ports 4444
iptables-restore < iptables-config
(system_files directory)
Run Portspoof with service emulation:
$ portspoof -c portspoof.conf -s portspoof_signatures -D
Run Portspoof in “open port” mode:
$ portspoof -D

Add portspoof to your system’s startup scripts. To do this modify or use the default init.d script that you can found in the
‘system_files’ directory.

Combine Portknocking with Portspoof and you've got yourself a nice defense from port scanners.


Best encryption mechanism for message storage/exchange in client/server application

Problem with A - Anyone with access to the server can decrypt the message because a copy of all symmetric keys is stored on the server. Plaintext of message may be stored in server RAM temporarily when re-encrypting message

Problem with B - Why not immediately Bpk(Message)? Why use an additional session key Ka-b(message), Bpk(Ka-b). For both methods, B is unable to authenticate A or guarantee the integrity of the message. Anyone else can also request Bpk from the server. Maybe you could do ApriK(sha1(message)), Bpk(message). So when B receives the message, he can use his private key to decrypt the message, request Apk from the server, decrypt the message hash and compare it with the message he received.

Problem with C - key management issue due to large number of keys. Total no. of keys in system = (n)(n-1)/2. Handshake problem. Non repudiation is also a problem when symmetric keys are used. A can claim that he never sent the message to B. B crafted the message himself using the symmetric key which is known to him.


Can these html tags and attribs make my site vulnerable?

Src attribute could lead to XSS if you allow the user to define the protocol, for example to enter javascript: instead of http:

Example:

Additionally, you should use proper output encoding for the user controlled variables so that the user cannot escape out of the attribute/tag. For example if you have the following tag:

Without propper output encoding, the user could enter the following data:

">

Which would mean the tag would then look like this:

">


Is it safe to use rng-tools on a virtual machine?

All of this depends on the hardware (physical or virtual) available to your VM. rng-tools can only get entropy from the sources available to it. If your virtual machine has no available sources of entropy for rng-tools to use then you'll be no better off.

Some virtualization systems are however able to make hardware sourced entropy available to guests through a number of mechanisms. In some cases you can pass a hardware device directly to your guest (USB, PCI, whatever) and have rng-tools use this device. In most cases this won't be possible.

The virtio paravirtual drivers expose various IO devices to guest VMs from the hardware controlling domain (Linux kernel running KVM, dom0 in Xen). There's a virtio-rng device that allows for an entropy source to be exposed to guests. From what I can find this is pretty mature on KVM but Xen support looks to be a work in progress: http://wiki.xen.org/wiki/Virtio_On_Xen

While virtio is great, it requires the guest have virtio drivers and thus be aware of the fact that it's a VM (paravirtualized). Newer hardware like Intel IVB and HSW chips have specific CPU instructions that provide random numbers from an on-chip RNG and these can be exposed to guest VMs. You can probe for the availability of these instructions by using CPUID.

This is a brief overview and likely information enough.  If you're interested in more details there's an excellent discussion of this topic here: http://log.amitshah.net/2013/01/about-random-numbers-and-virtual-machines/

EDIT:
Sorry, I guess I provided a lot of data but never really answered the question.  Anyways here's my take on the actual question:

  Is this safe to use (from a security perspective) on a virtual machine/virtual private server where the OS only has access to virtualized hardware? Will the generated keys be sufficiently random?

When it comes to security there's nothing more damaging than thinking your configuration is secure when it isn't. Using rng-tools when it provides you with no benefit (has no hardware entropy source source to draw from) has the distinct possibility of making you think you are generating high quality random numbers (keying material?) when in fact you aren't. So I don't think using rng-tools without having an entropy source for it in your VM will make the numbers generated any less random but it may make cause you to think you're generating high quality keys when you actually aren't.

My advice would be to use the rng-tools daemon but only after verifying that you've got an entropy source available for it to use.


Incognito mode temporarily stores the cache, once you close the window, everything's gone. According to that link, very fewer details go into the Virtual Memory. But you can clear up the pagefile.sys

To wipe the free space, use tools like Eraser or CCleaner.

If not using incognito, you can clean up browsing history and cookies, you can use programs like CCleaner.

To protect your identity, take a look at project Tor or you can set up a VPN or use proxy.


/as switch to signtool.exe does that:

/as - Appends this signature. If no primary signature is present, this
signature is made the primary signature.

See: https://docs.microsoft.com/en-us/windows/win32/seccrypto/signtool


How secure is wiping an encrypted Android device?

The principle is the same whether Apple or Google does it. Most of the data stored on the device (including all user data — everything but some startup code and of course the encryption key) is encrypted, and the only way to decrypt it is with a key that is stored on the device. (The key may be itself encrypted with the unlock passcode, but that's a separate matter. For our purposes here, there is a key file, which contains the key in a potentially-recoverable form.)

Once you wipe the key file, there is no way to recover any of the encrypted data. The only information you may be able to get is a rough upper bound for how much data was stored on the device, and even this only if the device was not initialized with random data — I don't know if all Android integrations do this. The data itself can only be recovered with the key.

The data may be recoverable if you've backed up the key outside the device (or if you've backed up the data itself of course). As long as you don't leak your key backups, the data is unrecoverable once the key on the device has been wiped.

In both cases — Apple or Google — it may be possible to recover the key file from the part of the flash storage that is currently unused due to wear leveling, if that part happens to contain the key file. This isn't something you can do in software, you need a bit of electronic equipment and fiddling with the flash storage (I think you have to unsolder it from the board, which is already a major stopper for casual attackers and kills the device's resale value).


How to Man in the Middle Internal AD Traffic

ARP poisoning and IP spoofing are one way to do this with nothing more than a node on the network.

In general, what you end up doing is impersonating the AD server during negotiation.  The technical details probably aren't interesting in this context, but if you pretend to be the AD server, you can do a lot of things.

One of these things might be to pretend to support only NTLM authentication, and thereby invoke a very weak protocol which involves passing a very weak hash that you can crack in a few hours on your laptop, and thereby recover passwords.

You may also be able to exploit a weakness in Kerberos if you happen to have one, as bind authentication can be done using that as well.  The other authentication method you could force would be digest-md5, which is stronger than NTLM, but not by too much.

If you're really good, you can then pass the authentication through to the real AD server, and proceed to proxy (MitM) all the communication between the client and the server for as long as you can keep up the spoof.  Nobody will notice much.  However, Kerberos makes this hard.

So, the long and short of it is, the attacker doing this could possibly recover password hashes, and has the ability to influence them to be very weak.  This can compromise passwords.

The attacker might also be able to sniff (kerberos) authentication happening, though this is harder in switched network segments, and basically impossible with 802.1x.

Kerberos in particular makes this kind of thing fairly hard to accomplish.  For instance, the password is only used to generate a key that is shared between the server and workstation (the server retains the key, changing it only when the password changes), so there isn't really a password to crack.  This key is used to secure communications.  However, the key is symmetric and an attacker could theoretically sniff any of the kerberos data that transits the network, find the key for it, and then find a password that generates this key (honestly though the key is usually enough).  This is hard.  Microsoft has an article including exact details of how all this works, including Kerberos.

If, however, you are binding to AD as though it were LDAP and doing things like resetting passwords or authenticating using the plain method, you should definitely provide an SSL certificate and encrypt your traffic.


Is there a risk in sending the username in a password reset email?

No, there should be absolutely no security risk with this approach.

Usernames are public information and should be treated as such.

EDIT

@Polynomial pointed out a key fact I left out. My advice doesn't apply if the username in question is some piece of sensitive information like a SS number.


First: the list of trusted roots is maintained by a Microsoft Root Program and is automatically updated as program participant list changes. You can disable automatic root update, see this thread: https://stackoverflow.com/a/36077658/3997611. In any case you can get a Microsoft-signed list using this link: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab. Extract CAB and you get signed CTL. In this case, you always can compare current list with signed copy.
Next, when you are online, you are not protected much when using user account with administrative privileges. Any person with admin rights can modify this list. There is a user-scoped list of trusted roots which users can update. There is a group policy setting that locks down the user-scoped trusted root store: https://serverfault.com/a/1008039/251012


Will installing a Graphical User Interface in a server be a security problem?

Every new service or program can pose a new security risk because they can have their own vulnerabilities. X11 has their own CVE's, for instance. Then when you access it over something like VNC, you introduce other potential problems and possibilities for misconfigurations.

So, yes, there are inherent risks, but nothing specific for GUIs.


Is it possible to successfully send a spoofed UDP header with a completely unrelated source IP?

It is possible to spoof IP addresses. The issue is always the underlying protocol. For TCP/IP, you're almost out of luck unless you don't proceed with a full handshake. For UDP however, if you don't care about a response and aren't trying to build fault tolerance, you can use it.
There are several ways routers can stop IP address spoofing. The main ways for Cisco routers are:

LAN

Involve any solution that attempts to minimize asymmetric
    routing, e.g. Spanning tree protocol STP. Naturally a
    spoofed UDP packet won't have a symmetric route. The only problem is
    that the directed graph issue would entail a subset of nodes in the
    routing to support STP. Also, UDP may not be affected.

WAN

RFC 1812 addresses your concern. Note the fact that there are a lot of asymmetric routes on the internet, so it becomes a harder task.
The above RFC was referenced here:

"We considered suggesting routers also validate the source IP address
   of the sender as suggested in 8, but that methodology will not
   operate well in the real networks out there today. The method
   suggested is to look up source addresses to see that the return path
   to that address would flow out the same interface as the packet
   arrived upon. With the number of asymmetric routes in the Internet,
   this would clearly be problematic."


What would be the effects of a limited Russian/US cyber conflict be on cyber-security professionals?

any actions that a reasonable practitioner should take now

Generally speaking you should secure the systems you are responsible for so that they cannot be hacked. (but DoS would still be possible)

  How do those actions differ what should be done in the absence of this conflict?

If you were in a government position, or had government client (military, etc.), your services may be used more frequently.

But, generally speaking, systems are either secure, or they are insecure. So if you are successful at securing your systems then there's not much else to do.

Some security angles may not be receiving sufficient attention. For example an employee may bring in a foreign flash drive that installs a virus on his/her Windows machine. You should have solutions to prevent such attack vectors from being successful.

But just understand, it is possible to 100% secure a system (except from DoS).

Personally, I see successful & significant attacks as showing two issues:

The attacker is doing an unlawful act and should be prosecuted.
The developer provided weak software.

(security is by design, not an after-thought or patch)

A couple other thoughts:

Counter-attacks (as in traditional warfare) do not solve the problem.
Stopping the attacks from being attempted is not nearly as practical as securing the system in the first place.
Security is not a matter of 'strength', as it is about 'mistakes'. In traditional warefare you need a gun that is stronger than the armor. However, in cyberwarefare (again, refering to theft and hacks, not DoS), strength does not matter. It's just a matter of whether the attacker can find a hole.

Note: This answer does not address human factors. (trickory, phishing, etc.) That's a lot more detailed than I want to get in to right now.

DoS can be explained in a separate question since it is handled differently from software secure design.


Can Blind SQL/Boolean Based SQL Injections not contain break characters or comparisons?

It's important to remember that a scanner's job isn't to exploit a vulnerability - it is to find a potential vulnerability.  Imagine code like:

sql_query("SELECT * FROM `table` WHERE id=" + request.get('id'));

This code is vulnerable to SQL injection.  You could imagine doing your typical fancy SQLi payload which joins some tables from the information_schema database, tries to figure out column names and add them into the response, etc...

The problem with that course of action as a first step is that a complicated injection payload may get blocked by a WAF or similar technology.  As a result, you may end up moving on without realizing that there is an actual vulnerability there.  Also, getting reliable output back out can be quite tricky and application dependent, and often beyond the "smarts" of an automated scanner.

In contrast, (5-3) is a pretty simple payload comprised only of standard ASCII characters, has a high chance of bypassing a generic off-the-shelf WAF, and likely gives simple output that a scanner can easily understand.  Consider the results of three requests:

https://example.com/widget?id=2 (200)
https://example.com/widget?id=34343 (404)
https://example.com/widget?id=(5-3) (200)

This is boolean based SQL injection.  Which, to boil it down, means that the goal is to get a simple and easy-to-understand true/false out of the application.  Especially since most systems will return a 404 for a non-existent page, it's quite easy for the scanner to try to detect the success condition.  That last result becomes especially interesting when the scanner compares the full response body of #1 and #3, and discovers that they are identical.  The scanner can now report with high confidence that there is an SQLi vulnerability on the id parameter of the widget endpoint.

In contrast, if there was not an SQLi vulnerability, then (5-3) would most likely be treated as a string, the underlying SQL query (id='(5-3)') won't match anything, and https://example.com/widget?id=(5-3) will return a 404.

Of course, this injection payload is very useless and won't help with an actual exploit, but as one of many possible tools to try to find vulnerabilities with a minimum of false negatives, it can be useful.  The scanner might then follow up with more complicated payloads.  If those get rejected then you can move on to the more fun task of trying to put together a WAF bypass.


X.509 is wide and versatile and, in theory, anything goes.

In practice, I assume that you are talking about a SSL/TLS situation, probably as part of a HTTPS web site. The server sends his certificate (that the client validates), and then, the server asks the client to also show a certificate, which the server will validate.

In that situation, there cannot be much client-specific data that the server may validate. The important point is that validation of the client certificate happens on the server (necessarily: the certificate from the client is about convincing the server). So, if the server wants to validate some client-specific data (e.g. IP address) then the server must have access to an apparent client IP address, and see if that matches what would be written in the certificate. However, in the HTTPS ecosystem, NAT and proxies happen. Therefore, the client "true" IP address cannot be reliably obtained by the server (e.g. my true IP address is 10.0.1.101, but that's not what an HTTPS server would see, because I am behind both a NAT and a SOCKS proxy). So there is nothing for the server to validate.

In existing, deployed systems, SSL/TLS servers do not commonly validate client certificates with regards to client-specific information. I have never seen it. Instead, the server validates the certificate in abstracto (the whole signature-by-CA business, up to a root CA), regardless the apparent provenance of the incoming connection. And if the certificate validates, then the user identity is extracted from the certificate (using a server-specific method, but IIS will tend to look at the Subject Alt Name extension and extract the 'UPN', to match against what is in his Active Directory server) and the server is content with that.

Actually that's quite similar to what happens in the other direction: validation of the server certificate by the client. The client wants to make sure that it talks to the right server, so it verifies that the server's name is indeed present in the certificate. The server's IP address, on the other hand, is not in the server's certificate; it was resolved through the DNS. From the point of view of the SSL client, as far as security is concerned, how the data flows is irrelevant; it could go to any IP address or be transmitted on an IP-less serial link or be transported on the back of camels.

Short answer: your client certificate is (probably) not bound to a specific machine, if only because enforcing such a binding would be, at best, difficult. You can transfer it from one machine to another (as long as you transfer the certificate with its private key, of course).


Try http://code.google.com/p/opendlp/

  OpenDLP is a free and open source, agent- and agentless-based, centrally-managed, massively distributable data loss prevention tool released under the GPL. Given appropriate Windows, UNIX, MySQL, or MSSQL credentials, OpenDLP can simultaneously identify sensitive data at rest on hundreds or thousands of Microsoft Windows systems, UNIX systems, MySQL databases, or MSSQL databases from a centralized web application. OpenDLP has two components:


Using DNS to track browser activity on a LAN

This cannot work as you envision.

For one thing, web browsers are not the only thing that cause DNS lookups: anything (such as a network time client) that needs to convert domain names into IP addresses or vice-versa will do so.

For another, you cannot count on the browser doing a DNS lookup every time it loads a page.  The DNS resolver should cache the results so that, for example, Amazon won't be looked up more than once per minute, while visiting my home website shouldn't produce more than one lookup per hour.  Additionally, it's possible to browse websites by IP address, which doesn't generate any DNS traffic at all.

A third problem, and one that will trouble any tracking system, is that a page load doesn't equal a page view.  Some browsers perform "predictive loading" to pre-load the page they think the user is most likely to visit next, and some anti-virus programs do the same thing to pre-scan links for damaging content (one antivirus famously DDoS'd a number of sites with a poorly thought-out implementation of this).

Your best bet is to set up a transparent proxy that logs all traffic going through it.  This will let you track page-load activity for HTTP, and the IP addresses for HTTPS traffic.


Breaking out of attribute in double quotes

A blacklist approach will always be flawed.  For example,  under internet explorer you can use the vbscript: URI to execute vbscript code.  There are also ways of encoding javascript: to bypass this check.  There have been a large number of itunes exploits that rely upon the itunes: URI to exploit itunes from the browser.  This is just two examples,  but really there could be any URI handler registered on a target system.

I would run this though a htmlencode routine to encode all quote marks and angle brackets. The benefit of this is that the URL could legitimately contain quote marks without being damaged. This is because the browser will automatically perform an html-decode of all attribute values as they are loaded.  Then I would enforce that the first 4 characters are http.  If the string does not start with http:// or https://  then prepend http://


How to brute-force WPA-2 password of specific set of characters using oclHashcat?

Check the mask_attack page of the hashcat wiki.

For your case:

oclHashCat64.bin -m 2500 -a 3 -1 ?l?u?d ?1?1?1?1?1?1?1?1 [YOUR HASH OR HASH FILE]

"-m 2500" specifies the WPA/WPA2 hash type, per hashcat documentation
"-a 3" is the brute force attack mode
"-1 ?l?u?d" says to use the character set of lowercase, uppercase, and digits (the character set you desire in your question)
"?1?1?1?1?1?1?1?1" looks for precisely 8
characters using your character set

Note that I don't have access to my hash cracking box at the moment to test this.  Run oclHashCat64.bin without parameters to see the help options.

Additionally, replace the binary name with the version you're using - cudaHashCat.bin for NVidia, omit the "64" if you're using the 32-bit version, etc.


The Symantec article you are referring to is like this one.

Looking at the graphic:

Point 1 is what is generally the most interesting to security researchers, because that is where the vulnerability is.

Points 2 and 3 just show what might be possible with such a vulnerability. For example, JavaScript can be used in phishing attacks (show a fake form) or to read out any data the user enters into forms. This is what Symantec calls formjacking, but it's of course nothing new.

Their article also has a section "How are websites being compromised?", which will likely interest you.

Vulnerabilities do indeed include the option to change server-side code, though not necessarily of the main application, but especially in JavaScript dependencies.

Issues with including 3rd party JavaScript are of course nothing new either. Burp eg calls it Cross-domain script include, and OWASP warns about it as well. Including 3rd party scripts always requires complete trust in the 3rd party as well as trust in their security processes.

  Why is formjacking the big deal

Good marketing on the part of Symantec?


How to put the "trust" into trusted-timestamping

I'm assuming your thesis is done by now (hopefully), but for historical purposes and for future readers I'll still provide an answer.

Below is link to an academic paper on the topic of Bitcoin based timestamping noting the benefits and shortcomings.

Short version

Longer version

Paper Abstract:

  This paper examines the way in which blockchain technology can be used to improve the verification of integrity of evidence in digital forensics. Some background into digital forensic practices and blockchain technology are discussed to provide necessary context. A particular scalable method of verifying point-in-time existence of a piece of digital evidence, using the OpenTimestamps (OTS) service, is described, and tests are carried out to independently validate the claims made by the service. The results demonstrate that the OTS service is highly reliable with a zero false positive and false negative error rate for timestamp attestations, but that it is not suitable for time sensitive timestamping due to the variance of the accuracy of timestamps induced by block confirmation times in the Bitcoin blockchain.


How to roll my own security mechanism - avoid SSL

You're confusing SSL/TLS with its most common usage pattern, which is TLS in conjunction with X.509 certificates and a Public Key Infrastructure (PKI, RFC 5280).

While it's really important to secure a TLS connection by authenticating its server site (to prevent active MITM attacks), the TLS specification doesn't actually mandate to do it using X.509 certificates, even less using a PKI.

As @jathanism said, you can choose not to rely on a hierarchical PKI, by using a self-signed X.509 certificate. You will have to establish trust in the server certificate by some other means.

In addition, TLS can also be used with OpenPGP certificates, Kerberos or Pre-Shared Keys.

TLS itself has had very few known bugs as far as I know, e.g. there was the renegotiation bug (CVE-2009-3555), which has been fixed (more recently, there were also certain issues with certain block ciphers, which can be fixed by choosing better cipher suites, or upgrading to newer versions of TLS).

The issues you're talking about (and often discussed in the press) tend to be related to PKIs, i.e. how to establish trust in the remote party. How this should be done isn't dictated by the TLS specification itself.

If you want to try to find a better way, by all means do some research, but I'd suggest focussing on this part and leaving SSL/TLS and the cryptography side of things alone.
You'll probably find that the biggest problems regarding PKIs and their alternatives are administrative, not so much technical ones.

The other aspect of authenticating the remote party is to check you're talking to the intended party (i.e. host name verification).


How to store passwords securely in my server?

You face the problem every password manager faces. I believe that their solution is to use a symmetric algorithm to encrypt the sensitive data, and use a master password for each user to derive a decryption key for all his/her saved passwords. This master password will have to be entered every time your script/application is restarted or, in the case of a web application, every time the user logs in.

This is basically what you describe in your second bullet point. The cryptographic tool you need is PBKDF2: use this on the user's login password when it is sent. The resulting key should be suitable to encrypt/decrypt passwords in the database using MCRYPT_RIJNDAEL_256.

On a side note : make sure you use different initialization vectors each time you encrypt new data !


Can you tell OpenSSH to force a rekey according to a packet number limit?

Your answer is partially addressed in the SSH man page:

 RekeyLimit
     Specifies the maximum amount of data that may be transmitted
     before the session key is renegotiated, optionally followed a
     maximum amount of time that may pass before the session key is
     renegotiated.  The first argument is specified in bytes and may
     have a suffix of `K', `M', or `G' to indicate Kilobytes,
     Megabytes, or Gigabytes, respectively.  The default is between
     `1G' and `4G', depending on the cipher.  The optional second
     value is specified in seconds and may use any of the units docu-
     mented in the TIME FORMATS section.  The default value for
     RekeyLimit is ``default none'', which means that rekeying is per-
     formed after the cipher's default amount of data has been sent or
     received and no time based rekeying is done.

A default is already set to 1Gig and 4Gigs of data but what does that mean? If you're sending small packets, it would take a long time to rekey, if you're sending large packets, the re-keying would occur more frequently. So let me ask: "What do you think your goal is in setting this to packet amounts would accomplish?"

Rekeying was done so that no one could store/obtain/sniff chunks of data for cryptanalysis attacks. (And or side channel attacks). There is a cost to performing these types of attacks: Storage, time, knowledge of encryption/cryptanalysis. Outside of nation state sponsored programs to attack this, I have yet to see, read, or hear about a non state actor even attempting to pull this off. There are other ways to attack a system.

But to answer your question, there is no definitive method listed to do this (packet based rekeying) so you have an option: Baseline your traffic, divide total data sent, by packets sent, then use that as your rekey number. E.g. 1Gig of traffic / 1000 packets(average amount of packets it took to send 1Gig) = Rekey number.


Is a very long living WSS WebSocket Secure connection really secure?

Unless you're sending on the order of exabytes through that connection, AES should not degrade in security over that time frame.  The duration that the WebSocket is open doesn't degrade it's security, so only the data flow through it may eventually (after a lot of use) erode the security given by AES.  Keep in mind that the entire Internet generated about 1,000 exabytes per day, so unless you're routing a very significant percentage of all Internet traffic through that one WebSocket you should not need to renew your keys ever during the usage of the WebSocket.

If you still want to renew the keys the client or server may, at any time during the connection, re-issue a handshake request which re-derives master keys based on two new random values. RFC5246


Block all BotNets and TOR addresses from accessing our site

My first thought is that if it's a DDoS attack, the source is most likely going to be infected zombie machines that the operator could care less whether they're traceable because they won't lead back to him. I'm sure a good number of black hat users use Tor to try and cover their tracks, but I'm also willing to bet there are more legitimate users on Tor than not. So essentially you could block all Tor traffic, but in the end you might end up blocking more good guys than bad guys.


Why websense not allowing homepage url(youtube) but a video page?

Websense can be setup with either/or automatic and manual categorizations. In this case, I suspect that YouTube has been manually added as an "entertainment" site by your company. Video sites other than YouTube may not have been categorized.

As for creating a workaround, that's your perogative, though browsing patterns may be highlighted causing your Websense admins to apply additional filters.


How to restrict LAN addresses in a browser?

Enable the Chrome flag Block insecure private network requests.
chrome://flags/#block-insecure-private-network-requests


Can a server have cipher suites enable/disable in some ports? Can my Windows Server have SSL3 enable in port 48004, but disable on port 443?

Yes. The actual application bound to a specific port may be different or may have a different configuration. For example, you could run apache on 443 and nginx on port 8000. You may be running some other app or DB which has a web service on 48004, possibly nimbusdb.

I would check what app is actually running and see what webserver application is actually being used and how to properly configure it.

As @StackzOfZtuff noted in his comments, Qualys is only scanning 443 and does not scan other ports, so its not telling you anything about port 48004.


OAuth2 - Sending a hash of your client_secret when using the client credentials grant instead of the secret

OAuth2 says that the method of client authentication is up to the authorisation server. It can be anything. Based on RFC 6749,

  If the client type is confidential, the client and authorization server establish a client authentication method suitable for the security requirements of the authorization server.  The authorization server MAY accept any form of client authentication meeting its security requirements.

Client authentication using client id and client secret is one way. In this case you should follow the best practices for username + password authentication (for example, OWASP Authentication cheetsheet).

One of the important aspects is to not let the attacker figure out a valid username but returning generic error messages (i.e. not returning errors such as "username is invalid"). Your solution's first step would defy this.

  the client requests a random to the server by sending their client_id

If the client requests a random value from the server based on their client id, it would confirm to the attacker that the client id is valid.

If the authentication using client id and client secret is not sufficient for you, you should explore other ways of client authentication namely:

Client certificate authentication using TLS (Refer Draft RFC 8705)
Client id + Signed JWT (Refer RFC 7523).


2-factor logins consist of 2 of three things: something you either have, are, or know.  Passwords are something known, so you'd have to implement something you are or have.  Biometrics, ie  "measuring people"; iris scanners, fingerprint scanners, voiceprints, hand scanners, and facial recognition are examples of biometrics that either require specialized equipment, or can easily be fooled by someone with access to a dollar store. So unless you have a human supervising them, biometrics are out.

So that leaves something you have.

A simple and annoying way to do this is to restrict user logins to their computer.  Sure, you know Bob's password, but you don't have his computer.  So login fails.  That's about the cheapest way t o do it.  Otherwise you can issue hardware tokens.  Then you'd enter your password and the code from the hardware token or have the hardware token inserted into the USB port.

The challenge to doing this via software is having it be something you have or are.  Software by definition is generally neither of them.

PS you already know this, but you have a huge problem with people sharing passwords.  Effectively you have no audit trail or way to specifically hold someone accountable for what was done under their login.  I assume you already knew that...


RDP to Azure VMs through public IP versus VPN

VPN with 2FA authentication is the way to go.

First of all you can't do 2FA with RDP, meaning you increase security risk significantly.

RDP has had several vulnerabilities, a few of the most recent 'BlueKeep' CVE-2019-1181, CVE-2019-1182, CVE-2019-0708.

This is the scenario where convenience shouldn't win.


First thing I'd do is create a (for example) Ubuntu Live USB on a separate machine and boot that. The ransomware won't work on a Linux operating system, and you can access your hard drive. The files will still be encrypted, but for starters you gain control of the system while cutting the attacker off. You can then recover unencrypted files that have not yet been affected, if there are any.

Next, google reveals a helpful guide regarding the ransomwhere in question:

  When it scans your computer for target files, it attempts to establish a connection with its remote server, which generates and sends an online key to encrypt data. If the connection is not available or gets lost, an offline key is used then. In the future, the offline key might appear and you will be able to recover your files.

  You can determine if your files were encrypted with the offline key if your personal ID ends with t1. Otherwise, it means that an online key was used, and there are no chances to decrypt your data.

There is a tool called STOP DJVU Decryptor (can be downloaded) - disclosure, I have no experience with the same. With the .mosk extension, it appears you will only be able to decrypt your data if you are lucky enough that it was encrypted with an offline key. More info here

  You can determine if your files were encrypted with the offline key if your personal ID ends with t1

Regarding the removal of the malware:

  the easiest way to uninstall such type of a computer virus is to use a reliable antivirus program.


Has the paradox 4.5 database file encryption ever been broken?

Paradox databases have a built-in encryption-based security scheme which allows a master password to be defined for the table and many specialized auxiliary passwords to be defined for various uses it.
The original version used its own protection, and it was by-passable and the password could have been reset. Passwords for newer versions could no longer be reset. I am not sure from what version above this applies, so this is only a partial answer.
Also, take note that there were known backdoor passwords for some versions.


I believe this must be possible since its the same situation when a user stops paying for their service, they have to be able to deny the service to those who stop paying.

Maybe they dont have the protocols in place to assert an attacker or an abuser deserves to be denied of their service, but that is a different situation. The technical means must be in place or it would allow one time payers become life time users.


Although there are lots of open standards for authentication, and separating the authentication service from the application service, there are surprisingly few application providers willing to let you use your authentication service. i.e. its simply not possible to to impose your MFA solution on external providers.

That doesn't mean that you can't enforce MFA access on these services though. You just need to provide some proxy capability which can inject credentials into a session and put the MFA login on that proxy service; the users of the service never get to see the token (password, ssh key, certificate, passphrase...). This is catered for by most privileged access management solutions. I work with CyberArk which is very good at this - but also very expensive. There are other options available, but the cost of implementing any of them is likely to be orders of magnitude greater than rolling out your own google auth service.


What are the risks of having an unsecured api, if there's nothing sensitive in the database?

You don't really provide information about the actual capabilities of the API, only what the database behind the API kind of contains. Your question is based on the assumption that these information are not sensitive and that there is no value in (mis)using the API outside of your application - but at the same time you are questioning these assumptions.
Looks like what is missing here is a proper risk analysis which looks at the actual details, but for this not enough information are available (and would be out of scope anyway). But lets help with getting the approach in the right direction, so you might be able to do some analysis yourself based on your deeper knowledge of the data and API.
As for nothing sensitive: Since the details of the API are not known I can only make assumption on what information it might provide. It might for example give an attacker a way to detect that someone uses your service in the first place. It might also be interesting that some users were active at specific times. And maybe also the IP address they used can be retrieved, which then can be associated with location information. And from how long they needed to learn specific words information might be gained about their state of mind at specific times. Just to illustrate some unintended side effects of collected and publicly available information read Fitness tracking app Strava gives away location of secret US army bases.
As for attacks providing no value: There might be a business model behind your application. Simply disrupting this could actually be a value for some competitor. Also, maybe your API has bugs so that it can be used to execute code on the server side and then attack other systems? Don't just assume that your API will be used the way you've intended, but imagine how it can be misused in an unintended way.


Replicating javascript actions from different website (XSS?)

I can just include your javascript file on my page like this:

<script type="text/javascript" src="http://www.yourhomepage.com/xxx.js"></script>

This would allow me to reuse your submitpage() function from my page.


Why is the *-property in BPL security model named "star"?

When we learned about BLP in class, one of my classmates decided to email Dr. Bell and ask the question. Below is the response we got.

Too bad you haven't happened on the couple of talks I've given on old war stories.
During the oil embargo of 1972, was it?, I was driving an hour to work every day, from Worcester MA to Bedford.  One's mind wanders.
As I was driving down the slope on I-495 towards the Rte. 2 exit, I was thinking about the analogy Len and I were using to build up a "mathematical model", namely books and written documents.  And in my stupor, I suddenly realized that electronic documents weren't like printed documents in the sense that marginalia were obvious.  Changes to the document proper weren't.
When I got to work, I rushed into our office, pulling off my coat and drew the information flow picture with subjects at the middle latitude and a high object and a low object. I didn't know what the [sic] call the don't-let-subjects-open-two-objects-simultaneously-reading-high-and-writing-low.  So, old mathematician that I was, I just scribbled "*-property" at the top. We talked excitedly for a little while, then one of us (lost in the mists of time) said to the other, "you know, if we don't change the name now, we'll be stuck with it."  We couldn't think of a better, more intuitive name, so we left it *-property.
Our task lead was Steve Lipner and he hated it.  When we started the Multics Interpretation, we offered to rename it NWD for no-write-down.  And he said (and I quote) "I will defend to the death the use of *-property.  With an asterisk."  We nominated that for quote of the week and put it on our wall.
And later in life, it amused me that databases had trouble indexing the term *-property (when the DBMS used * as the wild card).  Often inserted as "star-property."
That's it.  Just couldn't think of a good, descriptive name.
Same kind of story for the "tranquility principle."  Had to call it something.   That was the best we could come up with.
So now you know.


There's no way to implement this in such a way that it is manageable and has effective security. That you have to use HTTP (and therefore not HTTPS) makes it very, very difficult to protect the system against MITM / replay attacks. Generating a hash determinisitically from the username directly does not really help - it doesn't solve the MITM problem and exposes the system to brute force attacks.

You could just generate a random value, store it in a long lasting cookie and use it as a session identifier (effectively a password surrogate) matching it to a username on first access - this will still be vulnerable to XSS and MITM - but then you've got the additional problem of how you reset the users password.

You can't get the youtube account password from the youtube - but you can get it from the user along with the youtube username and test it for validity.

I think you could do a lot worse than what is done here - using a long lasting session id, authenticated against openid or a application specific service. (But do bear in mind that this is not totally secure).


As an addition - not only is it not supported, you wouldn't want it even if it was supported.

Because https://www.google.* would then match not only https://www.google.co.uk but also https://www.google.evilattacker.com. And you can be sure that is exactly the URL attackers would use, as it would give them best leverage against CSP on majority of sites.


What's the difference between DRM and CAS?

The main difference is that Conditional Access Scrambling and Digital Rights Management are that the first is a transport protection mechanism and that the second an asset protection mechanism. With CAS you can offer a stream like with television for example and everyone who has the right key can unscramble the stream within a certain timeframe as most videostreams for television have a time based lock. This is almost all done in hardware and think about the CI+ modules for televisions as a working example of this.

DRM is a way to protect content when it is both in transport as in rest. This allows for the consumer of the content to access it when he has the right key and is not restricted to a certain timeframe as with CI+ for example where the encryption key is rotated every 120 seconds and would make playback and/or timeshifting difficult. Some DRM implementations as for example with Microsoft Office require access to Active Directory to verify the keys to access protected content, but this is mostly due to key management to not have both the protected content and the keys to unlock it on the same device.

Now with modern technologies the lines between CAS and DRM are fading slowly, but in essence you could compare it to SSL versus PGP. Both have their purposes, but CAS will most likely be around as long as we have streaming video and the solutions in hardware to support them. And most DRM implementations have to overcome how protect both the content and keys in rest, but also how to protect the interaction with the protected content.


What exactly determines which entities/servers "on the Internet" get to read my e-mails when I send them from X to Y?

There are a few layers to your question, which might be why you have not received a satisfying answer.

The first layer is simple: email sent from one email server to another is not normally encrypted. That means any server/router/node along the path can read emails. I'm not talking about email servers, just infrastructure.

The second layer is more complex. It is possible that your Gmail server sends the email directly to the recipient server, meaning only two email servers are involved. But there are so many other configurations that might also be involved:

Email server fabrics mean that there can be a cloud of servers at either end, with the ownership/control of any one server not contiguous (shared control, control in different countries/legal entities, etc.)
Mail relays might serve one end or another
Forwarders might be used on the user side, which compounds the possibilities
Email clients might have their own server fabric, so when you send the email to the recipient address, it might be served by different clients at the client-side after it hits the email server

Just keep the OSI model in mind. Yes, on one level, it can be one server talking to another. But the magic of stacks means there is a complex web at every layer and the connections between the layers can be equally complex.


Is there any way to access the contents of a cross domain iframe

Not programmatically (see below for another approach), as the same origin policy will not allow this.  If it did, that would be cause for alarm, not just in your situation. An attacker could steal CSRF tokens and perform arbitrary actions, read all data the user has access to, etc.

  I found that a subdomain of a site leaks all cookies of the site due to improper error handling

This definitely violates best practices, but I wouldn't see it as a vulnerability. Preventing this is more a defense in depth issue (similar to httponly cookies).

  Or any other way to exploit this as an account takeover?

You can combine the clickjacking issue with the cookie disclosure issue to potentially get a user to disclose the cookies to you by presenting a fake captcha with pieces of the cookie.

Basically, you create a bunch of little iframes - each containing one character of the cookie -, which you can then rearrange and distort so they look like a captcha. You then get the session cookie when a user "solves" the captcha.

Depending on the length of the session ID, more than one captcha may be required.

See this paper for a detailed description and this article for a real-world example.


I would recommend splitting your app into multiple components communicating through standardized REST APIs.

In this case you'd have a storage manager app which runs as a user with enough privileges to manage LVM volumes (or if impossible, then as root) and exposes its services through a REST API the main app (which is unprivileged) can consume. That little app should listen on an UNIX socket instead of a TCP one, for both performance and security reasons (an UNIX socket won't be able to be accessed from anywhere where as TCP could be if the firewall gets misconfigured and the app listens on any address).

This approach will also allow you to swap the low-level components with something else without modifying the main app.


How exactly do you protect against ARP spoofing in large LANs?

First of all: Except for the availability and stability of the connections, ARP spoofing is only a problem when the layers above don't implement effective measures to ensure integrity and confidentiality of the data. Since ARP spoofing is not the only way to execute a MiTM attack, you should focus on the security of the layers above first to ensure that the data cannot be tampered. (IPsec, TLS etc.)

Further it's a good practice to keep LAN segments as small as possible since the overhead of several protocols can impact the overall performance and stability. It also allows you to reduce the attack surface by isolating hosts into subnets and VLANs so that they are only available to hosts which are required to use the offered services.

Once you are done with segmentation you could re-evaluate whether static ARP tables are feasible for some of your segments. Then you could also have a look at 802.1x-2010 aka MACsec.

Anyway, prepare yourself to setup an own CA. ;)


What are the differences between the U2F and UAF FIDO authentication standards?

Seems like you've got it pretty much down. Universal Authentication Framework (UAF) is meant as a replacement for simple authentication, and Universal Second Factor (U2F) is meant to replace today's time-based, second factor authentication. While it does seem like the end-user will experience the same experience on both devices, this won't always be the case.

With UAF, the user authenticates a device with the website, and then uses a biometric from that device going forward. The user then only needs to authenticate locally from that device going forward. The website can choose whether or not it will continue to store a password (seems dumb, but it's a choice the site can make).

With U2F the service optionally can request a second factor at anytime they choose. In this case the user would have to have a fob, USB, or second device in order to login/register. This increases the chances that it's only you accessing this account since you would have to have more than one of your devices in order to login. The newest implementation is more secure than an old school time based, 6 digit codes since the cryptographic key being stored is only authorized with the website you set it to. It makes phishing with look a like requests more difficult to accomplish.


Difference between Knowledge-based IDS and behavior-based IDS

Knowledge-based is like a signature-based anti-virus: you populate a database of "badness" and look for those things.

Behaviour-based learns what is normal for the network over time, then alerts on things that are "weird".

Your whitelist approach is still "knowledge-based" because you populate the whitelist database. A behaviour-based approach would learn that Alice and Bob are normal users by watching the traffic.


How to deal with misbehaving clients on an authoritative server?

Being disconnected results in an annoyance for legitimate users if we make a mistake coding the "misbehavior detection"

With proper code review, mistakes like these can be avoided.

Killing the client eliminates the need for "clean up" response code.

Although it is important to "kill" a malicious client in order to prevent further issues, personally, I would suggest gathering as much information about the malicious source prior to "killing" the client connection.

If we don't kill the client, we might make a mistake and continue processing the bad request.

Without shunning the malicious activity, you risk further exploitation.

Killing the client prevents a compromised client from sending other potentially bad requests, at least until they log back in.

This would ultimately depend on the architecture and the design of the game, but without knowing much details about the proposed MMO, this action would definitely be an immediate mitigation but it is important to log the source of the attack (date/time/src IP/dst IP/ports/protocols/attack type) for incident response. Although cyber attacks are inevitable, collecting the aforementioned data can help you detect, contain and eradicate any further threats.


PCI-DSS - key-based shell access to internal servers?

Every user should have a key for every machine he needs to work on. This key should password protected and NOT reside on the gateway server. You should not share keys among your different user. If this is too complicated you can have a look at centrify or SSO.  Don't  forget about accountability!


Setting a domain in Veil-Evasion for payload

Just lookup the IP behind the web server with a DNS lookup. There are plenty of sites that can do this, such as: site24x7.com/find-ip-address-of-web-site.html.

Also, I have to assume you don't know what DNS is. DNS or domain name service is a way for routers/service providers to give friendly names for servers that people want to connect to. For example, instead of typing in the IP address for google, you type in google.com, and a DNS service finds the IP address of the site with that domain name so you don' t have to memorize a long chain of numbers for every site you visit.


This is a great question and as a hands on pentester who is constantly setting up layered networks... I can tell you that it's not a straight forward answer. In my experience it's going to be more about how well designed these routers/switches are than good set up practices.

1: try it. Just set it up, open wireshark, and go. If you run into issues, check wireshark. Be especially observant of ARP and DHCP calls. One major issue you might run into is confusion about having two arp tables. If the first router thinks an IP has changed (DHCP) but the 2nd router (functioning as a layer 3 switch basically) has not refreshed it's arp table... that device will be a ghost. Don't be afraid to unplug and plug the 2nd router to help issues like this.

2: How routers handle multiple "gateways" is not always great. If you plug D700 into the main router on the D700's WAN port, it can get confused. Some routers have features to mitigate this, some don't. If one of the routers can't handle the config you're setting up, I'd suggest making the IP range of the second router different from the first (10.0.0.0/24 and 192.168.0.0/24) to help with trouble shooting and confirmation of proper routing. It will force a route table on the 2nd router which might help with confusions (why is there multiple DHCP?!, says the router and devices).

3: MITM is confusing in the context used here. Most common MITM: fake SSID that imitates -either router- and when someone logs in it SSL strips and collects passwords and etc. This is a pretty specific and nasty type of attack. 2nd most common man in the middle happens if someone has already breached your network and I won't go into it because you're in serious trouble at that point no matter how you look at it. Your set up, in my opinion, doesn't really affect your exposure to MITM for a motivated attacker.

Hook it all up, and report back with errors? Happy to help troubleshoot. Good luck.


Published data sets for IDS/IPS evaluation

There is some repositories of pcap traces. Some have traces of malware, port scanning, etc.. You can then replay these traces with tcpreplay.

http://www.pcapr.net/browse?q=malware
https://www.evilfingers.com/repository/pcaps.php
http://www.caida.org/data/passive/ddos-20070804_dataset.xml < DDOS.


Many-time pad on image data, how to proceed?

You have a 337 byte key that's repeated ad nauseum and then XORed with all the bits of a image file.

You can probably exploit some factor of the BMP, like how it has Padding (at the end of each row of the pixel data so each row is a multiple of 4 bytes and typically would be zero.  So you could guess image height/widths, find where the padding would be, and then set the bits of the key at those places.

There maybe other properties of the image you can exploit; e.g., sparsity under a sparisfying transform (similar to compressed sensing), and can tweak each bit to see if leads to a better image.


Why do phishing emails have spelling and grammar mistakes?

This may well be for the same reason as many scammers rely on the tired old 'Nigerian Prince' strategy: by self-selecting for gullible targets, they can be more efficient.

In phishing, as in scams, sending the initial batch of emails is the easy part.  The hard part is coaxing information out of the target (which can require a concerted exchange of emails).  That can represent a significant investment of time.

As a result, it's really important to ensure that the people you correspond with may actually give you the information that you're after.  It can therefore be advantageous to send a badly-drafted email, on the basis that the people who respond to that are likely to be gullible enough to be phished.

(I would probably draw a distinction between these broad, drag-net approaches and targeted phishing, where you're much more likely to see carefully-crafted and legitimate-looking emails.)


How an ISP can detect if someone having a WhatsApp call or video call? without detecting or blocking the rest of the app

ISPs in general can detect VoIP connections because these network flows in general have specific network metrics such as , constant rate, a relationship between up stream and downstream and some more. However, some applications such Skype the embed all encrypted traffic on one network flow, make impossible to know how many messages has been sent. In the case of whatsappp you can take some samples and analyze but I suspect that works in a similar way as skype.


HMAC uses as key a sequence of arbitrary bytes and of arbitrary length. Some implementations of HMAC/SHA-256 may (unduly) reject keys longer than 32 bytes.

Your key should be such that it is too hard to find it by exhaustive search with non-negligible success probability. If your key comes from a strong source of random bytes (e.g. /dev/urandom), then 16 bytes are enough. If the key comes from a biological computing device (i.e. the brain of a human), then you are back to the whole problematic of passwords (which is best avoided if possible).


What phases does a network penetration test consist of?

When I engage in penetration testing, my goals go above beyond finding open ports, to finding "information" that could be used to gain access, or negatively impact the company. If you solely focus on ports (services), or CVE information, you will likely miss common indicators, and information that an attacker will not miss. Usually my penetration tests, begin as vulnerability assessments:

NMAP / Unicorn Scan (network mapping tools)
Nessus / OpenVAS (vulnerability scanners)
Separate laptop running Wireshark + SpiderLabs' Responder

Network mapping may paint a decent picture, but an off the shelf NMAP scan will not yield as much information as say a Nessus/OpenVAS scan, that can show open shares. A typical first day may include nothing more than discovery (arp scans, nmap scans, vulnerability scanning) so that I can create an attack surface.

Once an attack surface is built, work splits into automation, and manual checking. I will never run an exploits against a vulnerability, where that exploit may trigger a denial of service. Defeats the purpose, whereas I can document: "exploits are available, however they were not run due to a Denial of Service" I make this understood to client: "Door is open, attacker will come in, we didn't because we would cause chaos."

For services, I take HTTP+HTTPS servers and send them off to be tested using Nikto, Wikto, Burpsuite, and AppScan. Rinse and review, wait for output, analyze data, and go from there. For services on specific devices (e.g. SSH on a Cisco switch), I will attempt a brute force for top 50 passwords ONLY. There is a reason for this: I need to check whether I have access to ATTEMPT to make a change, and whether I (as an attacker) I will be blocked after N attempts. There is no need for me to go further than the top ten, as I can word it properly: "Attacker has the capability to repeatedly bruteforce the device unchecked. Due to the amount of time in this engagement, we checked 50 top passwords..." Again, makes no sense to attack with say RockYou password list. The reality is, given enough time an attacker may bruteforce the password... They are not being blocked from attempting it.

Information is king. For example, on many Nessus scans, I always look at the informational data. Often I find I will see something like "NFS Share World Readable" to where I can remove myself from a domain, mount a share, and lo and behold, many times I have obtained access to PST files, company confidential material. What do you think is more business critical, telling a client: "I zero day'd your SRX gateway (that you can't fix, but will have to rely on a vendor) versus: I was able to mount 10.10.10.2:/backups/CEO/backup.pst"

I disagree with the banner checking comment in the above, as organizations under some mandates are supposed to create their own banners: "Restricted use anyone will be prosecuted" not to mention it is easy for NMAP to throw out a lot of false positives. For fingerprinting, I will rely on p0f.

I often look for internal relays, as it is easier to bypass spam filters, and may send an employee a phishing email in order to test multiple things: 1) Employee awareness (did they open the email) 2) Technological mitigations (spam filters) 3) Patch management (if my attachment has client sides against IE8.0 were they triggered).

I suggest looking at Penetration Testing Execution Standard for more information that will help you with your question. There will be multiple answers to this question, but there is also using experience to begin chaining attacks. E.g. so you found a null share against a Windows machine. Take the output and build a list of users (since some null scans will get this for you), build a list of networks you didn't know about (obtained from say a public snmpwalk), chain these together with a 50 top password bruteforce against say a printer, share, etc.

---- (Added)

Also take note, prior to running any tool, if you can plug into a network and see traffic, that itself is a finding (there is no Network Access Control). If you can run Wireshark and Responder, more findings. There is a lot to do outside of firing off nmap, Nessus, Metasploit, etc. Information should be analyzed as best as possible, and with that said, experience is the biggest tool you will have in your arsenal


Web application security standards/certificates

There aren't really any "certifications" for web-apps. The closest I can think of is PCI-DSS, but the web app side of it is minimal - it's largely applicable across infrastructure and business processes, and heavily focuses on card payments.

If you're specifically looking for certifications, then web app development certs might be a good choice for a developer to get. Note that they apply to the person doing the development, not the application. A few things you can get certified for/as that come to mind are Microsoft SDL and GIAC GSSP (there's a .NET one).

In terms of maintaining security on a site, you'd usually get the site pentested by a professional organisation, review the security issues, then fix them. You don't really get any magic shiny certificate for doing this, but you do get to bask in the nice warm glow of knowing that you took security seriously. Plus your customers probably won't have to sue you for getting breached, which is always nice.

Pentesting is usually done by security consultancy companies, but recommending specific companies is outside of the scope of this site - there's no one answer, and it's largely geographically dependent.

If you're going about this so that you can add a big banner to the site saying "we're secure!", I think you'd be much better off forgetting about certifications and just focus on being transparent. Giving out details about how you do your security (e.g. password storage mechanism, account recovery policies, etc.) is the ultimate form of reassurance to a user, because it shows that you're confident enoguh to give that information out, and allows for peer review.


This is an autokey cipher. Even if the key is not available in the source code, it's still quite vulnerable to a known-plaintext attack. (Compressing the output is minimally helpful; most compression formats have a standard header which can be used as a known plaintext.)


How secure is user-mode Linux, in terms of protecting the host system?

I don't know how exactly a UML kernel is run on the host system. I'm entirely speculating, but my speculations might be useful if you can combine them with some documentation on UML implementations.

Privilege escalation in the guest with a guest-specific exploit

Being root on the guest kernel should essentially allow you to do whatever you want with the privileges of the PID that was used to run this kernel.

If running a UML kernel is done with UID 0 (which I would assume is unlikely), the process does not run in a PID namespace, and the process has been left with one of the many capabilities allowing full privileges, then you're in deep, deep trouble and should consider the whole host to be contaminated.

If that process runs with UID 0 outside a PID namespace but with some form of MAC enforcement, what it can do and how it can persist depends on the specific system. SELinux roles could come in as particularly handy to add extra protection. You're likely in trouble as well.

If the process runs with another UID, or is locked down into a PID namespace, you're more likely to be protected. The guest VM will be done for, but there should be limits to what your adversary can do and the rest of the host system could be decently protected.

Privilege escalation with an exploit also applying to the host

It's not unlikely that the host to your UML kernel is the same kernel. So, assuming an attacker has found a way to abuse an UML kernel it would be reasonable to assume they also have an exploit for the host kernel, except for:

Namespaces and MAC might provide some amount of protection by ensuring that less of the Linux syscall interface is available and that might prevent your attacker from running the exploit.
An exploit that is based on an untrusted module only present in that guest kernel would likewise not lead to a compromise of the host.


How to Ensure Post Data in Services is Safe from User Tampering In WebGL Games?

What are the standard Industry Practices for something like this. How
  Can we validate the scores on the Server?

It depends how tech-savvy your users are. A trivial way for them to tamper the data is to use a (intercepting) proxy to intercept outgoing traffic and tamper the Score value (TLS cannot prevent this).

One of the industry practices to prevent tampering and verify the authenticity of the requests is to use JWT. JWT is widely used for authentications management of REST APIs, however, it could also help to solve your problem. JWT signs all the requests and any modification of the data in transit would invalidate it on the server.

Remember, as I mentioned above it depends how technical your users are. Using JWT only stops tampering of the requests when they depart from your application. With a rare likelihood, a user can still directly access to the memory and modify something (e.g., change a game functionality, overwrite an attribute etc).


Why are all cookies with same name included when asked by server? Doesn't it raise cookie's integrity violation chances?

The Same Origin Policy creates a security boundary for client-side data defined by protocol, port and domain.

The Same Origin Policy for cookies is slightly looser, allowing the protocol and port to differ, and the domain can optionally share cookies with subdomains. Note, as you say, this is optional for the cookie writer only, not the reader.

That is, foo.example.com can write a cookie that example.com can read, even if it doesn't want to.

The solution to this is to only have one application per domain. That way two applications cannot set cookies for each other.

e.g. Vulnerable

Application running on example.com/foo which can set set cookies for example.com/bar

Not Vulnerable

Application running on foo.example.com - this is completely isolated from bar.example.org


How is it possible that hardware-encrypted flash devices are safe?

How is this in the case of hardware-encrypted pendrives? E.g. this one. Does one always require installation of drivers / software for such a device?

Yep, generally devices like that require special drivers. The drivers will be included in the device, on a read-only but unencrypted partition. You'll note that the device you linked only works with pretty specific Windows and MacOS versions, all fairly new, even though a normal flashdrive will happily work on anything back to Windows 98 or so without installing any drivers at all.

In fact, all transparent (that is, you interact with the data using a normal file browser, and it's mounted in the normal file system) encryption requires a driver. BitLocker has a driver that is present in all supported versions of Windows, and if you encrypt a flashdrive with BitLocker, it reserves a tiny bit of unencrypted space to store the necessary driver for read-only access to the flashdrive on versions and editions of Windows that don't have BitLocker already. The driver doesn't necessarily need to be kernel-mode - on OSes with support for FUSE drivers, you can use those - but then, FUSE has its own kernel-mode driver already.

  How can it be safe? Where is the encryption key stored? After all, it must be physically inside the device - in addition, unencrypted. So how can it be safe?

Why in the world would the encryption key be stored in plain text anywhere?!? The actual data encryption key - the "master" key - is never stored in plain text anywhere except in the driver's ephemeral memory, and ideally for as short a time as possible there. The only way the master key is persistently stored is encrypted, and the key used to encrypt the master key is derived from the password (using a strong, slow password-hashing function). The password itself is of course also never stored anywhere, just like your password for a web site is never stored anywhere. The reason you encrypt ("wrap") the master key with the password-derived key, rather than simply deriving the master key from the password directly, is that it lets you change the password without needing to decrypt and re-encrypt all the data (you only need to re-encrypt the master key).

Here's a typical idea of what the process of unlocking an encrypted volume might look like:

You enter your password into the software.
The software runs your password through a strong hashing function to produce a password verifier value.
The software checks that the password verifier matches the one it has stored; if not, you entered the wrong password. The verifier is stored in plain text, but its only purpose is to check whether the user entered the right password; changing the verifier doesn't let you decrypt the data (in fact, it makes it harder).
The software notes that your password is correct (the verifier matches), so it runs the password through another password hashing algorithm (might be the same algorithm with a different salt, or another algorithm entirely).
The output of this second password hashing algorithm is treated as a symmetric key, and used to decrypt the master key. The decrypted master key is stored only in the software (typically a driver)'s RAM.
The software lets you access the data on the drive, transparently using the master key to encrypt and decrypt as you write and read.
You lock and/or eject the drive, and the software deletes the master key (and your password) from its memory.

The only things that are stored persistently are the the encrypted data, the encrypted master key, and the password verifier. The password verifier cannot be used to get the original password or to decrypt the master key. The master key cannot be used to decrypt the data while it is itself encrypted. The data is safe unless the attacker can get the password.

Note, of course, that things like keyloggers and such could still capture the password as you enter it. Also, the master key does need to be stored in the software's memory, so an attacker that is able to read the software's memory (either using their own highly-privileged software, or by physically reading the RAM chips) will also be able to decrypt the drive.


With 2-factor authentication, is a backup email address or phone a good recovery option?

The whole point of 2FA is to require the second factor to login. Usually - password+token, in recovery situation - password+recovery key. Something you know + something you physically have.

If you can use secondary email as a recovery option for 2FA, the user account is protected by their password + the recovery email password, thereby defeating the goal of 2FA. The attacker will just go through the easier route.