What ciphersuites does Java 6 support out of the box that are not broken?

I tend to go off the list that Mozilla provides, which gets updated every so often, although no where near as frequently as browsers do!

This currently suggests the following cipher order for a "modern" browser:

  ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK

This would suggest that the best option you have is DHE-RSA-AES128-SHA (which I am fairly sure is Apache speak for TLS_DHE_RSA_WITH_AES_128_CBC_SHA).

Not sure why the AES128 one would be preferred over AES256, but it is the same in the Mozilla list.

Edit

Original version stated "DHE-RSA-AES128-SHA256", which was wrong - fingers used to typing SHA256...


Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

Have you considered simply blocking the relevant ports at the firewall? Deny access from all external hosts. Using the "Windows Firewall with Advanced Networking" window (wf.msc), edit a rule, go to the Scope tab, and either set it to only work on local IP address 127.0.0.1, or to nor accept connections from any remote computers (or both). You could also add a rule that explicitly blocks connections to 135 from remote machines. Best to block both inbound and outbound, if you're really paranoid, since an attacker might present a malicious RPC server and attack you via returned data or callbacks.

I'll admit, I haven't tried this myself. Interested to hear if it works. Windows obviously doesn't require network RPC be available - the OS works fine without a network interface at all - but I expect some network functionality will stop working if you block all remote RPC endpoint mapping.


How can I disable execution of programs from Downloads directory in Windows 10?

Changing permissions on the directory is probably the best way to go, yes. In addition to being relatively easy, it has the perk of acting more like the way most Unix-like systems work, where new (in this case, downloaded) files are not executable by default. Win32 has no equivalent of the umask, but you can fake it using directory inheritance (which Unix mostly doesn't use).

A few things to bear in mind when doing this:

NTFS ACLs support both "allow" and "deny" entries, for both users and groups. They are evaluated in the following order: user deny > user allow > group deny > group allow. In other words, a deny on a specific user always wins, but an allow on a specific user beats a deny on a group the user belongs to, but if the user neither has allow nor deny entries then if any of the user's groups have a deny then this trumps any allows that the user's group has. If neither user nor any of the user's groups have either allow nor deny entries, the default is to not allow (deny).
NTFS supports permission inheritance, where an object (file, directory, reparse point, etc.) can have some permissions inherited from its container (directory). In fact, this is the way most permissions in NTFS are set; relatively few object have explicit ACLs. Note also that an object can disable inheritance (it doesn't get its container's ACLs), an ACL can be non-inheritable (contained objects won't get it, even though they have inheritance enabled), and an ACL can be inherit-only (meaning it doesn't apply to the container, only to those of its contents that allow inherited ACLs).
Following the rule of "specific beats general", an explicit ACL on an object overrides the inherited ACL if there are conflicts. As such, even if the Downloads folder doesn't give its contents the Execute permission (or indeed, denies it), any particular file within Downloads might still gain that permission by explicit ACL.
NTFS, like most file systems, re-uses the Execute permission bit on a file as the Traverse Directory permission bit. As such, removing (or denying) Execute on the Downloads directory would normally prevent you from accessing any of its contents (you could list them, so long as you still had Read permission, but couldn't read or write them, etc.). However, Windows by default ignores Traverse permission checks (you can turn this behavior off, if you want), relying on Read/Write/etc. instead. This behavior means you can have weird things, like a directory structure A\B\C\D.txt where the user has no access at all to A, B, or C, but can read and even edit D.txt so long as the permissions on that file grant such access (and the user knows the exact path). It also means that, for directories, the Execute/Traverse bit basically does nothing except for inheritance purposes.
While the Execute permission on PE-format files (.EXE, .DLL, .SYS, etc.) acts like you'd expect, the default action on many other "executable" file types that are actually executed through some program (.BAT, .JAR, .PY, .JS, possibly even .MSI. etc.) will be ignored by the OS; such files only need Read permissions, and only their interpreters/runtimes/etc. need Execute permissions.

With all that said: setting a Deny permission on Execute/Traverse for the Everyone group on the Downloads directory (and making sure it's an inheritable permission, though by default it should be) should mostly do what you want.


Is Certified | Ethical Hacker (C|EH) a scam or legitimate?

Many people in the security industry do not think highly of EC-Council, the company behind the Certified Ethical Hacker (C|EH) certification. That doesn't mean that the ceritification itself is a scam, though.

In my experience, there are very few security certs that actually provide value. Sure, studying the topics that are covered on the exam can absolutely be helpful, and may improve your knowledge, but having certifications -- with the possible exception of the OSCP -- doesn't really show that you know much about security.

That said, it depends on why you're looking to get certified in the first place. If your primary goal is demonstrating to non-technical hiring managers that you're somewhat qualified to do security work -- or if the jobs you're applying to require security certifications -- then it can absolutely be valuable. If, however, you're trying to show a technical audience that you know your stuff, holding a CEH will not accomplish your goal.

As someone who hires security engineers at several different levels, I think of CEH on about the same level as Security+ -- that is to say, it's better than nothing, but not particularly impressive. It certainly won't get you a job, but frankly, neither will more well-known certs like the CISSP.

I hope this helps. If you find the material for CEH interesting, I'd say go ahead and take the exam. It might help get your resume in the door (HR screeners will probably like it), and if you think it looks silly, you're not required to keep it on your resume.

Good luck!


Does Apple still monitor or track after having a customer support screen sharing service with ara.apple.com?

There's always possibility...

Nevertheless, why would they continue tracking and monitoring you using this tools since they can put any backdoor they want as editor of the operating system ? It would be far easier to do this directly on the OS shipped with your device.

Moreover, such a monitoring would probably be discovered and lead to a scandal...


Cloudflare's free SSL options require trusting them; what could they do to change that?

From what I understand, no, Cloudflare couldn't work any other way.

Cloudflare analyses the connection before passing it to your webserver to ensure that it's correct and coming from a legitimate client.  In order to do this, it needs to be able to see the contents of each packet from and to your server.

With SSL/TLS, each packet is encrypted and therefore not visible to Cloudflare.  It needs to be able to decrypt any traffic before it can analyse it.  To do that, it needs to have the private key for the cert used to encrypt the traffic.

The only way around this I see, is if Cloudflare sold its application that you could then self host.  That still requires trusting the application (it may forward information to Cloudflare's servers, for instance), but at least it wouldn't be hosted elsewhere and totally out of your control.  This would be a trade off, as you'd lose Cloudflare's distributed network.  You would still have some benefits (anything implemented in software e.g. SQL injection protection), but would lose anything relying on the large network  capacity (e.g. some DDoS protection).


Should I install an antivirus on my mobile phone?

This is murky territory, and most of it is based on opinion and gut feeling.

I feel it's best to simply present you with some facts and observations:

There is malware for Android, and you can get infected by downloading dodgy apps.
Pirated apps are high-risk for malware. You get what you pay for, and if you gain some value out of a pirated app, the person who cracked the app probably found some way of gaining value too.
There will be vulnerabilities in your mobile platform, some of which may be exploited by simply browsing to a dodgy site. This is reasonably rare if you're sensible, but risks go up if you're browsing porn or warez sites.
Mobile anti-virus is very much in its infancy. You are unlikely to find any product that will really protect you against any significant portion of mobile malware. It should, however, catch the common stuff like Zeus and various other nasties.
Mobile AV often has the benefit of  recommending better settings for your device to increase your security. This isn't really anything you couldn't do by yourself with a little time on Google, but it's nice to have.
The mobile AV products I've tried have not shown any significant reduction in battery life or performance. They seem to be pretty efficient and unobtrusive. This is entirely my personal experience, so YMMV.

All in all, my personal opinion is that it doesn't hurt to use a free AV package for your phone. I wouldn't pay for one, because I'm low risk and don't store anything critical on my device. If you are a high risk user, e.g. due to browsing habits, or due to the type of data you store on your phone, then you may want to consider a proper AV package. The efficacy of them, however, is yet to be proven.


A bot edited all pages on my Wordpress installation

Since your course of action was changing the password of the offending account, it seems that your theory of what happend is that that users account was breached (e.g. weak password was bruteforced live, reused password from a data dump, users computer infected by malware). That is one possible explanation, but it is not the only one, perhpas not even the likeliest one.

Another explanation is that there is a vulnerability in your WordPress installation, either in the core itself or in a plugin. If that is the case, changing a password is of little help. Your doors are still wide open and you are vulnerable. The compromise could be much worse than you expected - there may very well be some nasty malware running on your server right now.

You could try to figure out how bad it is by doing a forensics investigation. But it sounds like logs are scarce, and even with good logs this is still a tricky thing to do. So maybe the best course of action is to assume the worst.

I'd have a look at these two posts for further guidance:

"How do I deal with a compromised server?" for immediate response to the breach.
"How can I protect a Wordpress installation?" for how to secure your WP installation for the future. (There are many more resources for this on the web.)


Meaning of many failed login into my website

I think it's pretty common nowadays (based in my logs of hundreds of sites) that Wordpress websites are randomly attacked. I'm guessing you still have the login page at /wp-admin/ and that your login name is shown somewhere in your posts (author) or using the "admin" account.

Basically what some bots do, is to get your id from your site (or try with 'admin'), and try easy passwords attempts (like reversed, or very common ones). They don't do brute force because the intention is not to shutdown your website or spend so much resources in a single website. As you see, those bots try to randomly access any wordpress website with weak passwords (not your specific site). They have more chances that way than forcing a single site. In a similar way, bots try to guess your mysql web-based managing tools, which can be seen at your error logs like:

phpmyadmin/ , myadmin/ , mysql/ , etc...

In order to protect yourself against those attacks, this is what I recommend:

Use strong passwords (even better, use paraphrases of 15 chars or
longer)
Hide your username and display your name instead (however that won't
be 100% effective. Your login name may still leak). If your name is "John", don't use "john" as login name.
Add Apache Basic Authentication to your login page
If possible move away your wp-admin/ (do not use: /admin/ or
/login/). There are many ways to do it, some of them not so
effective.
You can specify which IP addresses to accept at your login page
(example: https://wordpress.org/plugins/restricted-site-access/).
Add HTTPS to your login page.
Keep your Wordpress installation up to date

In case you have administration access to your hosting server (in other words, you are not using a shared service), here are further recommendations (some applies only to Linux servers):

Use fail2ban. You can setup special rules to ban anyone who is trying to scan for phpmyadmin/ or more than X login attempts to your login page. (If you don't know how, let me know and I will post here my filters).
Update your server regularly (specially, apache, mysql and php).
Allow access to your login page only from your country (in case you don't travel often). This step will require to install geoip location libraries and to have some scripting knowledge (perhaps there is an easier way to do it?).
Use a firewall and only allow the ports you need.

I may be missing many other ways to protect yourself, but those are the onces I use at my sites (around 500) since 5 years ago, and so far no breach (that I know).


How can I test my SSO connection without having access to the Identity Provider?

In the end I used the service SSO Circle which is a freemium public IdP service that you can use to test your connection. It provides metadata, certificates, the whole shebang.

There seems to be a concurrent session limit for the free account and you don't get any error logging/deebugging tools (and the interface is a bit naff) but its certainly better than not having an IdP to test with!


SELinux ignoring /etc/sysconfig/selinux directive

Do sestatus and see what it says for "Mode from config file". If it says "permissive" there, then something else sets enforcing -- either during the boot-up process, or via the kernel command line (look for enforcing=1 in /etc/grub.conf).


I guess it all depends on your thread model and szenario. I am reading between the lines that you are afraid of what will happen if an attacker gets access to the table containing the 2FA secrets, for example by a leaked backup or SQL injection.

If this is the case, you can encrypt the secrets with a systemwide key, that is loaded into your application from some key vault. This decouples where the key is stored and where the encryped secrets are stored. But your application needs to have access to both.

If the key is derived from the user, there is always the danger that an attacker could do the same.

In my last project we decided to create dedicated MfaService, written in a different language and using a different datastorage compared to the rest of the Application. The service was written in a way that it can store the secret and check a code for validity, but never reveal the secrat again. The User Service only stored a reference to the MFA Credentials. Thus, an attacker would need to access both services, which was good enough for our usecase.


I found an RSA private key on my ransomware-infected device. Can I use it to decrypt the files?

Probably not. Your question is unclear (also because of the bad spelling):

What is this "rsa" you found in the registry?
I assume that by ".android" and "adbkey" you mean the file %USERPROFILE%\.android\adbkey.

It sounds like you stumbled upon a file created by adb (Android Debug Bridge, used to control devices in developer mode). This is the key that adb uses to identify itself to connected Android devices. On your Android device, you get a prompt whether to trust the computer, and you can store it for next time. To prove, next time, that it is the same computer, the computer has a key which it uses for authentication.

The "lots of numbers, letters and slashes" is usually base64 encoding, by the way. It often (but not always) has equals-signs at the end.

Sorry I cannot help you further, but hopefully that at least answers your question.


Device fingerprinting & Mass Computer Surveillance

A couple of things to note:

1) The internet and HTTP makes it very easy to track to track users fingerprinting and persistent client data are just 2 approaches (CPU timing is not a very effective one IME).

2) never underestimate the stupidity of the general public. While the well publicized face of device fingerprinting is in relation to abuse of privacy it protects millions (billions?) of people against online fraud

3) making your machine appear 'black' or returning false data is more likely to make it stand out than disappear

Yes there are tools freely available which attempt to undermine the effectiveness of fingerprinting. Do they work? Yes they change the fingerprint - but they don't help to protect your privacy.

The issue of privacy primarily concerns the abuse of that information - however in many places collection of such data can constitute an offence. The most effective thing you can do to protect your privacy and protect yourself from abuses of privacy is to lobby your representation for appropriate and effective laws.


Are there security issues with embedding an HTTPS iframe on an HTTP page?

If only the iframe is https, the user cannot trivially see the URL it points to.  Therefore, the source http page could be altered to point the iframe anywhere it wanted to. That's pretty much a game-over vulnerability that eliminates the advantages of https.


This site is vulnerable, if the following assumptions are correct:

example.com has something to attack (data you want to retrieve that only other users can see, or actions you want to take that only other users can take).
example.com uses cookies (without the samesite flag) or HTTP authentication (basic or digest) for session management, instead of using something like tokens stored in local/session storage.
CORS requests from subdomain.example.com sent to example.com receive a response with Access-Control-Allow-Origin: subdomain.example.com and Access-Control-Allow-Credentials: true.
The requests you want to make (in somebody else's session) to example.com are simple requests (they use content types that could be sent from HTML forms and no custom headers) or else example.com allows subdomain.example.com to specify those content types and/or headers in CORS requests.

Assuming all of the above points are true, you could write a page that makes malicious CORS requests to example.com (stealing other users' data, or stealing CSRF tokens and using them to launch CSRF attacks to take actions as other users) and (if relevant) passes the responses somewhere you can retrieve them, upload that page so it's served from subdomain.example.com, and trick victims into visiting your malicious page while signed into example.com.


When installing a new software repository, is it required to check the repository key fingerprint?

[I'm not an expert on apt or yum/dnf, so this is just an opinion.]

  some other tutorials I saw seem to actually assume the repository key will be automagically checked at a later time.

Checked against what? Against the same repository that gave it to you in the first place? If this happens to be a malicious repo, of course it's going to continue to tell you it's the real thing. There's no magic list somewhere of which keys are authentic for which repos. Well, actually there is, the list that ships with apt, but you're explicitly telling apt to modify that list.

My understanding of add-apt-repository is that once you add it, this becomes an anchor of trust against which to check all future signatures from this source. If it is malicious, then once you insert it into your trusted keys list you are open to receiving malicious / spoofed software from that developer.

Establishing trust

The real question is: where are you getting this from?

# Expected fingerprint
# 9DC8 5822 9FC7 DD38 854A E2D8 8D81 803C 0EBF CD88

If you got it from the same source that will be serving you the packages, or from a non-encrypted HTTP page, or from some sketchy blog, then that's not doing you much good.

Ideally you want to be getting the fingerprint "out of band", ie from a different source that you already have real-world trust in.


How to configure F5 load balancer and backend server both with SSL Certs

I understand the F5 LB is acting as the client in the handshake between itself and the backend server. But my understanding is the F5 is sending a request for www.example.com (host name) to the backend server. The backend SSL cert is for server1.example.com. Therefore, the request should fail because the host name being sent by the F5 does not match the host name associated with the backend server SSL cert. That is, www.example.com != server1.example.com.

I am not sure what you mean by "the request should fail."  What agent would fail it?  The server does not validate the SSL cert against the host name; the client (in this case, the LB) does.

Because it is the LB that is responsible for validating the cert, it can intelligently figure out what is going on and validate against the correct host name rather than the host name of the individual server node.

So here is approximately what happens:

Browser looks up the IP address associated with www.example.com
Browser establishes a TCP/IP connection to the address
Browser establishes a TLS connection over TCP/IP, thereby retrieving the cert from the LB (www.example.com)
Browser validates the Subject of the cert against the domain name submitted in step #1 above; if they don't match, you get a phishing warning
Browser sends HTTP payload over TCP/IP+TLS to load balancer.  This payload includes an HTTP header "Host: www.example.com"
LB evaluates load balancing rules and picks a back end server to which to direct the request.  The output of this is either a server name or IP address, depending on how you have this set up.

If it is a host name, it is used only for IP lookup; it is discarded immediately afterwards, because the name of the server node doesn't mean anything to the system overall.
If it is an IP address, the LB will just use that.  Notice that in this setup, the LB never even learns that the name of the back end server is server1.example.com; in fact it has no idea what its name is.

LB establishes TCP/IP connection to back end server
LB establishes TLS connection to back end server, thereby retrieving the cert from the back end server (www.example.com)
LB validates the subject of the back end cert against the host header provided by the original client, in step 5 (www.example.com)
LB re-encrypts the HTTP payload and submits to back end server.  It includes the HTTP header "Host: www.example.com" and may also include additional headers such as x-forwarded-for.

You should never have a host header that says server1.example.com, nor will that host name ever be used for validation of the SSL certificate.


The problem with this is that it's likely coming from an email server instead of an actual phone.

I had a similar situation, but they were benevolent circumstances. I had a difficult time working at home to know when to stop working at maybe eat. My friend set up a shell script that would run at 5pm EST that would SMS me to remind me to grab some dinner and maybe stop working if I was at a good stopping point. Each time the SMS arrived, it would be an incremented number. He had also previously set it up to remind me at lunch to eat lunch and to take cigarette breaks throughout the day. Those numbers were different even from each other and incremented on their own.

So say you find the header info and find out the email address of the sender. Great. Well, it's ridiculously easy to register a new email address, or even spoof one with an open mail relay. This can all be scripted and automated.


Is it possible to encrypt WiFi connection?

If you're using WPA2, you are encrypting the traffic between your wireless devices and the wireless AP (typically built into a router).

There are two implementations of WPA2, but I will assume you are using the pre shared key version.

It introduces encryption using this method.  It is generally acceptable for home network solutions, but not enterprises.  The reason for this, is because, with WPA2-PSK, if you know the passphrase for the network, it is possible to decrypt other people's traffic who are talking to the same SSID (wireless name), as long as they are able to capture that device's 4-way handshake (mostly trivial unless there is 802.11w involved).

WPA2-PSK is currently considered "strong" and has no known major faults.  However, it should be noted that the amount of security is derived from the strength of the password you use.
If you use a password of "abc123", your network is much less secure (from dictionary/brute force attacks) than if your password is "a0fj9sd09fj#J)()F9".


Should I allow communication on public networks?

I had the same feelings as you regarding the default selection being set to public.  After reading the other answers to this question I didn't really feel like they directly addressed your question around why Public is set to the default. So, I've done some testing and have found the following:
The default selection is based on the state of your current network. It is not based on what is considered best practice for firewall rules. If the network that you are on is set to Public, then the default checkbox is set to Public.
I think that most of us generally consider our home networks to be Private, however Windows cannot assume that is the case and so by default your network is set as Public. You can follow the steps below to set your trusted home network to Private. After you have done this, you will notice that future security prompts will default to Private rather than Public.
How to set your Trusted Home Network as a "Private" Network (windows 10):

Open up Network & Internet Settings (this should bring open the network "Status" section by default)
Click on "Change connection properties". If you have more than one network adapter, you may be connected to more than one network.  Make sure you're selecting the correct one.
Select "Private" for the Network profile.

What the default selection looks like after setting your Network to "Private":

Just to wrap everything up: the reason that Windows selects Public, Private (or Domain) based on your current network settings is because it would cause mass mayhem for most end-users if they instead defaulted to Private (or Domain). None of their apps that required inbound network connections would work because the safe default for networks is Public, while the safe default for firewall rules is Private.
Hope this helps!


Is web application connected to a database via an application server more secure?

If you distinguish between web server, application server and database then you actually mean front end, business logic and back end (storage). This is also called a multi-tier architecture with presentation tier, application tier and data tier. In this case the application server will not simply pass through any requests from the web server but only allow actions which fit the business logic. This means that all the security stuff (i.e. who can access what) is essentially done in the application server and the web server is just there to make this information accessible via a web browser.

If you instead only have web server and database then the business logic is essentially part of the web server. While this makes it often easier to start wih some web application the missing distinction between presentation and business logic will lead easily into a mess which nobody can understand anymore and which often allows to bypass the business logic and thus get direct access to the database for an attacker.

Note that the separation between the layers does not necessarily need to be done with a separate server or application, but it can also be an in-process seperation (i.e. API, classes...). But it is important that this separation can not be simply bypassed which can often be handled more securely  with a separate process or server. A missing separation between presentation and application can sometimes be seen in that you can't access specific information by HTML but they are still accessible by a JSON or XML API.


Restricted Access through Box and log commands

1) What would be the purpose of deploying customer credentials? Is there any mechanism to reduce this portion. E.g., using ssh keys where client could revoke the key afterwards. If so, you've alleviated this issue.

2) VNC connection from your staff, is this local, remote. Have you created appropriate rules to enable trusted sources to connect while dropping others?

3) when you state "connect to customers with one click" I am under the impression you could create one independent program without having to use a central machine. You could write a simple shell script to record locally (on your colleagues' machines) and have it emailed to you.

4) vnc2flv

From the "just woke up" category using vnc2flv

# Example script maybe /usr/bin/watchdog.sh
# can be entered in user’s .bashrc or .bash_profile or other

self=`whoami`
dir=/tmp/`mktemp -d /tmp/recordingXXXXX`
file=`$self`-XXXXX

printf “Recording session for $self on `date`” > $dir/README
recordwin.sh -all /tmp/$file

As simple as you can get.

1) get ID of the user
2) make a temporary directory
3) specify a temporary file
4) enter that information into a "README" file in temp directory
5) Begin recording

There are plenty of mechanisms to do this, that is a generic baseline. You could have parameters set for your colleagues the moment they log in, and when they exit (e.g. before closing session, using ssh keys, have their recordings placed in a tar and scp'd over, along with an email sent to you stating they've exited and recording is complete.)


While the page itself isn't loaded over HTTP, the order display is an Iframe that's loaded over HTTP, but posts to an HTTPS page.

While the form itself posts to an HTTPS page, the loaded frame itself is HTTP.

This is insecure due to the fact that the content of the iframe has no integrity. The page itself could be modified by a MITM to post the form to a rogue service. If you inspect the form, you can see it's sending the payment to "spreedly", which upon searching is a credit card processor.

However, there is a click handler and submit handler for the forms.

These handlers have the ability to hijack that URL, and change it right before it actually posts. Creating another avenue for your card information to be stolen.

The ordering form itself is hosted on another site, http://onlineorders.wawio.com/menu/535fe1caf61e46ae172330d8 however when I try to put https I get an invalid name error, instead identifying itself as a site called "OpenDining". If you accept the error, it'll show you the page you requested.

Don't order through them. If you want to complain to them, go here http://www.wawio.com/es/contact-us


By default, your passwords are encrypted using your Opera credentials. Only encrypted password information is stored on Opera’s server and delivered to your devices. Opera uses your account credentials to decrypt passwords when you sign into your account on your other devices. When Opera receives and decrypts synced passwords, they are stored in your computer’s Keychain.

Official Source

Locally, Opera can save encrypted passwords using your OS login data and therefore they can not be read in a different device or by a different user, so no, live-CD will not access them, unless a password recovery is performed vs. the account using them.


Salting password with the first 8 bit of the password itself

This scheme looks clever, but it isn't.

Salts are usually stored in cleartext. And they serve one purpose - to restrict the usability of precomputed hash tables. There is also the side-effect that no two hashes computed for two different user accounts with the same password will be the same.

By storing a portion of the password as a salt, you are decreasing the security posture of the application, and also complicating matters. The below points assume storage of the salt:

I would consider that the entropy associated with the password is reduced by a minimum value of the entropy associated with the 8 bits; in the Shannon model of calculating entropy of user selected passwords from a 94 character alphabet, this around 4 bits of entropy. The reduction in entropy is due to the model in use - most passwords are not a sequence of random bits, especially if they are chosen from natural languages. Concatenating n-bits from the password to itself to compute a hash will quite obviously make the contents of the password even less random, thus reducing entropy.
Using the first 8 bits of the password as the salt is in itself a poor decision, compared to using the last 8 bits, not that the latter is a good decision. It so happens that under the Shannon model for computing entropy of a password, the entropy per bit reduces as the length of the password increases. If you are using the first n bits as the salt, then you are weakening the password further, as the Shannon model works on the premise that "if the first n bit is known, then how well can anyone guess the other following bits".
Now that you've stored the password fragment in cleartext, you will need to encrypt it. That sounds easy, except that keys have to associated with a management lifecycle where you need to issue them, protect them, and discard them after a particular period; getting of this right is certainly not as easy as using a secure PRNG to generate the salt and storing this random sequence of bits in the clear.

Cryptographic properties of a salt

This is based on Paul's answer and the comments interspersed on this page. This section does not assume storage of the salt, and is rather a note on how salts must be chosen. Any data used as a salt to a password, must satisfy certain cryptographic properties. The most important one is that

  A salt must be unique across the passwords stored in the system.

If the salt is not unique, then one loses the ability to create unique hashes for every password managed by the system, leading to the possibility that a dump of hashes might reveal passwords that are used across accounts or passwords present in dictionaries.

It cannot be guaranteed that the scheme in question has this property. In fact it is easy to assume that the property is bound to be absent in a system with more than 2^8 = 256 users, rendering the scheme quite useless.

Also, if one is under the impression that this scheme can reasonably protect against pre-computed hashes then that assumption is moot. It assumes that an attacker does not have resources at his disposal to compute hashes to compromise all the accounts in a reasonable timeframe. Using a salt with the cryptographic property of being unique would have certainly slowed down the attacker by a large factor, as a computed hash would be valid only for one salt and not for the others (i.e. hashes for any password in a dictionary must be recomputed for every user). If the current scheme were to be employed, an attacker can restrict himself to computing only 1 hash per password in a dictionary, making it no different from not using a salt, thus making it pointless to have a salt in the first place.

This would lead to another property of a cryptographic salt:

  A salt must enhance the resistance of the system against bruteforce attacks and the like.

By using a salt derived from a password, one loses this property, for a hash of every password in a dictionary can be computed in more or less the same amount of time, with or without the salt.

It it to this effect that most systems are engineered to generate the salt of sufficient length using a secure PRNG. One of the comments stated that using a "service name" + "user name" combination is enough. I would say that it is a good thing to start of with. The service name typically acts as a pepper (especially when it is not stored), so that hashes themselves cannot be copied and used across services using the same hashing scheme. The username is decent enough to use as a salt, except in scenarios where the username is public (the root account in *nix, or Administrator in Windows, for example). If your usernames will be public and consistent across several deployments, then using n bits of randomness ought to be the way to go. This is an extension of the second property, in that any choice of a salt must consider resistance to bruteforce attacks across all deployments.

The followup question states -

  Instead of using first 8 bit how about the first (length of the password mod (Prime number)) of bits as a salt? would not this be securer than normal password hashing?

No, the salt is not guaranteed to be unique across user accounts. (See the first crytographic property).


HTTPS or HTTPS within VPN for WIFI security?

Regarding your 'session jacking' comments on Terry Chia's answer:

Session jacking and the technique that Firesheep uses is to target HTTP site logins taking place over a shared network connection, ie: WiFi. This is acomplished by intercepting the session cookies that the site sends back after a successful login takes place. If the connection uses SSL [aka HTTPS] then these cookies cannot be read by a third party.

When your browser indicates "not everything on this page is secure" that means that some resource was loaded over a plain HTTP connection. This does not necessarily mean you're vulnerable, since it is usually simply an image file or an included CSS/JS file.

As for VPNs, you should only trust the VPN connection as much as you trust the provider. That is to say if you're using a free service like HotSpotShield then you had better be OK with them being able to intercept every single packet you send to them. Also, since you install their VPN client software there's nothing stopping them from also installing forged root/intermediate SSL certificates on your computer that will allow them to strip off SSL protection if they feel like it.

In summary, you're best off not using a VPN that you didn't set up yourself, and ensuring that your logins and important data is transmitted via SSL/TLS protected connections, eg: HTTPS, IMAPS, POPS, etc.


Can malware bridge external storage HW power-off switches?

No. The power switch is almost always a mechanical device which cuts off the incoming power from the logic board. When it is off the connection is physically broken - a complete airgap. Malware cannot subvert this.

The only case that malware might be able to bypass a "power off" state is when the state is soft, e.g. standby. The device would have to leave its processor (either microprocessor or microcontroller) running, potentially in a low-power sleep state, with the USB interface live. Depending on the implementation, malware could potentially trigger a wake event through the USB, though it'd be device-specific and highly targeted / unusual.


What security mechanisms are in place for iOS' custom keyboards?

There is also a safety feature built into the system itself, that prevents third-party keyboards to type into password fields - when you touch a password field the system will go back to the default keyboard temporarily.

By the way, I wouldn't trust Apple to verify that apps aren't malicious. A lot of apps use libraries provided by analytic providers, and while analytics by themselves are spyware, some of them are careless enough to transmit sensitive data (location, name, email) over plain HTTP and yet be accepted just fine in the App Store.


SSH to IP instead of to fully qualified hostname: does this reduce MITM risk?

Generally, using the VPS company's API is a good idea, given its proper reliability and also enough resources to implement and maintain that on your side. After all, the SSH key management functionality may be added to said API sooner or later (maybe even upon your feature request, who knows?).

However, DNS cache poisoning alone is, to put it mildly, a rare and complex attack. And in your particular case there's also a rather short attack window (between a VPS is created and assigned a FQDN, and the first attempt to log in), which requires either a perfect timing or an inside knowledge (or both) on an attacker's side. Moreover, virtual servers in most cases are assigned rather random and obscure FQDNs, and an attacker must guess that one, too.

Next, the VPS company's DNS servers most likely retrieve the FQDN of your VPS from a local configuration file or a database of some sort. Assuming that; if your ISP and all the transit ISPs between your resolver and the VPS company's network aren't doing any evil MitM attacks; if you're able to use the VPS company's DNS servers directly to resolve the FQDN of a newly created VPS; then the only place in the network where DNS cache poisoning could be theoretically applied is at your resolver. Therefore, given the nature of the DNS poisoning attack nowadays, it would be rather easy for you to detect and properly mitigate a DNS poisoning attempt.

Also, if your threat model includes attacks of that sort, be aware that Internet routing isn't any safer than DNS. Thus it might be a good idea to set up a dedicated VPS in the same location where all subsequent virtual servers would be allocated, so that the first use of a newly created VPS would be from a machine in the same network segment, eliminating a possibility of hijacking the allocated IP address.

ARP spoofing might also be harmful in roughly the same way, though it heavily depends on the respective virtual network architecture.

Despite all that, as I've pointed out, those attacks are rather hypothetical for an average Internet-facing service. Your mileage may vary; however, I'd better focus on proper monitoring and reporting to ensure that in case anything like that happens, you'll know about that as soon as it's possible.


Could see image of previous session after restarting and switching OS

This is almost certainly a hardware fault in the video card; it's possible (but unlikely) that it's a bug in the video driver instead.  The scrambled image you're seeing is leftover data from the game, stored in the video card's memory.  Since you rebooted rather than doing a cold shutdown, the data wasn't lost due to lack of power.  On starting up, Linux asked the video card to use a certain part of its memory to display the screen and provided an image to display, but due to the aforementioned fault, the part of memory displayed was not the part the image was sent to; rather, old data from your game was displayed instead.

Yes, this is theoretically a security issue.  In practice, it's rare enough that an attacker will use something more reliable instead, such as a cold boot attack.


Security measures for a WiFi access point?

Mayank's answer had the most important part right: use WPA2 (not WEP and not no-password).  However, I want to add some points.

You should not use a "non-dictionary based word" for your AP "password", but instead use a multi-word passphrase.  Don't reuse this passphrase for anything else (that you want to keep private) as you will be sharing this password (visiting friend needs to connect their laptop) and your devices will be storing this in a recoverable way.  (And some devices will even by default store your wifi passwords in the cloud for you!)  I suggest passphrase as it's easier to tell someone "correct horse battery staple" (all lowercase spaces, between words), than "Capital T, lowercase r, zero, lowercase u-b, number four, lowercase d-o-r, ampersand, number three" and the passphrase has higher entropy  (also see discussion here).  Attacks on observed wifi handshakes can be done offline, so strong passphrases are needed.
MAC address filtering is trivial to bypass and annoying to manage.  MAC addresses are used for layer-2 (link level) addressing; so in wifi that's the radio signal between your router and any listening receiver.  Even when you have an encrypted connection; the data is being encrypted not the layer-2 packet headers.  Hence, if a router is using MAC address filtering, its quite easy to collect one packet sent from the router (to an allowed MAC address) and the attacker can then change their MAC address to clone the observed allowed MAC address.  (Yes, two different computers using the same MAC address at the same time would cause problems, but you can wait until they no longer are using it.)  Furthermore, MAC address filtering is annoying to manage, because you'll have to go into your router settings every time you add a new device to your network and copy the 12 hexademical digit MAC address (and bother with figuring out how to pull up a MAC address on every random wifi device).  People who use MAC address filtering also get suckered into thinking its very secure and then make weak choices for passphrase or think its ok to use WEP or WPS or other vulnerabilities.
Disabling SSID broadcast leads to a loss of features for no concrete gain in security.  Your mobile devices will not be able to automatically connect to the wifi network.  Your cell phone can't switch from 3G/4G radio to faster less-power hungry wifi when you get home, unless you manually press buttons to switch to the unbroadcast network, or if the device is configured to frequently broadcast I'm looking for SSID 'sdfasdfasdf' that which leaves you vulnerable to attackers with rogue access points that will reply that's me.  (Granted with WPA2 they should not be able to complete the 4-way handshake with you; but depending on your device - it may allow a connection to the same SSID that's suddenly not WPA2).  Like MAC addresses, you can eavesdrop the SSID from observing other clients connecting to the non-broadcasting network even if WPA2 is enabled.
Make sure WPS (Wifi Protected Setup) is disabled.  Many routers come with WPS enabled by default, and this allows an attacker to break into your network in under 11000 guesses.  Granted newer routers may have timeouts on consecutive attempts that may make this more difficult; but the standard suggests only a 60s timeout which only delays an attackers attempts to break in by a couple days).

As an aside, for a tad bit of extra security, I'd suggest changing your access point's SSID from the default (e.g., linksys / NETGEAR) to something uncommon.  The access point is used as the salt of the PMK (pairwise master key) in WPA2-PSK before it goes through the HMAC, hence an attacker who has observed a four-way handshake and has attacked a similar network previously can potentially save themselves some time by storing the PMKs from various common passwords with the known salt (granted they'll still have to find the PMK that generates the PTK to match the observed 4-way handshake).

TL;DR - Use WPA2 with a strong passphrase, disable WPS on your router (and change your SSID to not be something super common).  If you want you can use MAC address filtering or disable SSID broadcast, though any patient eavesdropper can easily bypass either protection.


You wouldn't decode the salt/hash pair, you would instead run the salt/hash process again every time they enter their password on your site and compare the output to the stored salt/hash pair you have.

This is to avoid ever storing plain text passwords and if you're ever breached, it makes it exponentially harder to gain usable passwords from the information stolen.

The process you choose to salt/hash is up to you. There are a lot of functions ready to do this for you, depending on the language chosen.


How do I securely store credentials and key files on my mac?

I know you quickly dismissed Apples own Keychain but I'd like to make a case for it and help guide you in the right direction of how you can use it via terminal.

It’s protected by 256-bit AES encryption.
It's backed up on cloud servers.
You can use it to store secure notes.

Locally the keychains are stored in ~/Library/Keychains/ and /Library/Keychains and Apple has a command line utility called security (/usr/bin/security) that can be used to administer. see man security for help on this command. It's fairly robust and documentation out side the man page is sparse. I was able to quickly create a keychain although I didn't spend too much time on it.

If security is too much of a learning curve, I'd recommend a python module called Keyring It has a command line utility that while is not as robust but very simple to set and get data to the keychain. I sometimes use it to store credentials for scripts instead of using .env.


Yara should have the same behavior on all platforms.  As was discovered in the comments, it's important to make sure the rules files and targets are the same on both systems (by comparing sizes, sha1sums, etc.).  It's possible for file transfers/copies to get interrupted, leading to file corruption or truncation that results in incomplete YARA matches.


OpenSSL does support Windows. You can download it hehe.

This website has a tutorial that shows how to test for SSL 2.0 support (using OpenSSL).

The command is as follows:

openssl s_client -connect localhost:443 -ssl2

EDIT: I've just tried testing my server with this command, on Windows, and everything works fine!


Challenge-response login without storing a password equivalent

Both the algorithms described here suits your description (doesn't require to store plaintext-equivalents on the server, achieves stretching and are simpler than public-key setups): http://openwall.info/wiki/people/solar/algorithms/challenge-response-authentication


ok so with the actions you've taken on your local PC it sounds like you've eliminated that as the problem (malware usually can't survive a full reformat/reinstall of windows).  So the next candidate would be your home router.

From this link you can see an example of malware which operates by changing the DNS settings on your router which would then essentially allow an attacker to inject content into your browsing sessions.

So what I'd recommend as a next step would be log into your router and look at the DNS server settings.  You'll want to set them either to ones that your ISP provides or alternatively something like Google DNS (8.8.8.8) or OpenDNS (208.67.222.222).

Can't guarantee that that'll solve the problem but it's likely not a bad next step!


Public web server and AD- based Kerberos authentication

I don't see any immediate weaknesses.  Kerberos is going to look for the user to supply an access token generated by the Kerberos server which should only be available on your private network.  The web server shouldn't know how to generate an access token that would allow access to the private network so all that could be done by compromising the service shared key of the web server would be to allow access to the webserver (which presumably the attacker already has access if they've compromised your service secret key.)

In fact, I don't believe the web server should even need access to the Kerberos server since it only needs to be able to verify a TGT which only requires knowledge of the service secret key.  The client that is logged in to the private network should be the only one with a connection to both worlds.


Mysql injection with a single `USE` statement

Quote Xenos
  Can you find such exploit for MySQL? The USE syntax seems very "poor"
  for such injection

Lets track down how USE works in MySQL and which files MySQL in the source code needs to access.

---

**Query #1**

    SET PROFILING = 1;

There are no results to be displayed.

---
**Query #2**

    USE test;

There are no results to be displayed.

---
**Query #3**

    SHOW PROFILES;

| Query_ID | Duration   | Query    |
| -------- | ---------- | -------- |
| 1        | 0.00006425 | USE test |

---
**Query #4**

    SHOW PROFILE ALL FOR QUERY 1;

| Status         | Duration | CPU_user | CPU_system | Context_voluntary | Context_involuntary | Block_ops_in | Block_ops_out | Messages_sent | Messages_received | Page_faults_major | Page_faults_minor | Swaps | Source_function       | Source_file  | Source_line |
| -------------- | -------- | -------- | ---------- | ----------------- | ------------------- | ------------ | ------------- | ------------- | ----------------- | ----------------- | ----------------- | ----- | --------------------- | ------------ | ----------- |
| starting       | 0.000038 | 0.000019 | 0.000012   | 0                 | 0                   | 0            | 0             | 0             | 0                 | 0                 | 0                 | 0     |                       |              |             |
| query end      | 0.000003 | 0.000002 | 0.000001   | 0                 | 0                   | 0            | 0             | 0             | 0                 | 0                 | 0                 | 0     | mysql_execute_command | sql_parse.cc | 4310        |
| closing tables | 0.000003 | 0.000001 | 0.000001   | 0                 | 0                   | 0            | 0             | 0             | 0                 | 0                 | 0                 | 0     | mysql_execute_command | sql_parse.cc | 4356        |
| freeing items  | 0.000009 | 0.000006 | 0.000003   | 0                 | 0                   | 0            | 0             | 0             | 0                 | 0                 | 0                 | 0     | mysql_parse           | sql_parse.cc | 4968        |
| cleaning up    | 0.000012 | 0.000007 | 0.000005   | 0                 | 0                   | 0            | 0             | 0             | 0                 | 0                 | 0                 | 0     | dispatch_command      | sql_parse.cc | 1978        |

---

see demo

MySQL basic lexer works with yacc so we check file sql_yacc.yy first.
Below is the USE keyword defined.

/* change database */

use:
          USE_SYM ident
          {
            LEX *lex=Lex;
            lex->sql_command=SQLCOM_CHANGE_DB;
            lex->select_lex->db= $2.str;
          }
        ;

When we check sql_parse.cc and within the function mysql_execute_command() we find

case SQLCOM_CHANGE_DB: {
  const LEX_CSTRING db_str = {select_lex->db, strlen(select_lex->db)};

  if (!mysql_change_db(thd, db_str, false)) my_ok(thd);

  break;
}

To answer the question.
No i could not find a possible exploit as it is very clear in the source code the <database> part in the USE <database> statement expects a "string" and does not parse and or execute a SQL statement futher.

With string i mean database_name in the format of USE database_name or with backticks.


Hashing passwords before inserting into database

You are using Rfc2898DeriveBytes, which implements PBKDF2: that's good.

You are producing a whooping 128 bytes of output, which is total overkill for password verification. 128 bits, i.e. 16 bytes, are sufficient. 128 bytes don't harm, except that they make for bulkier strings to store in your database.

You are using 10000 iterations, which might be a bit low. Higher is better. 10000 is not bad, but chances are that your server can handle ten times as many, and this would make attacks ten times harder. I suggest that you try several values, and make the count as high as is tolerable on your system, relatively to the expected workload (namely, the number of connecting users per second).

Encoding issues are best kept separate, at the storage level. The salt, the PBKDF2 output, and the password are all sequences of bytes. Rfc2898DeriveBytes can encode a String password for you, but expects the salt to be "some bytes", and produces an output which is "some bytes". For storage into the database, either use the abilities of that database to process binary data, or apply some encoding, like Base64. So, use Convert.FromBase64String() and Convert.ToBase64String() before writing and after reading, respectively. Your mixture of Base64 and UTF-8 is confusing and makes reading (auditing) your code a harder task.

Your salt generation is weird:

There is no point in making the salt length variable. Just go for 16 bytes.
There is no point in avoiding bytes of value 0. A salt is a sequence of bytes, not of characters, and 0 is not special.
There is no point in hashing the salt.

A proper salt for PBKDF2 is a sequence of at least 8 bytes, and unique (as much as possible). 16 bytes filled with the output of a strong PRNG are a good way to do that. A GUID would also work (salts need not be random, they just need to be reused as rarely as possible by normal systems, and GUID do that). In .NET, if you want to generate a good salt, simply do that:

byte[] salt = Guid.NewGuid().ToByteArray();

Alternatively, Rfc2898DeriveBytes can generate the salt for you. Upon user registration or password change, do this:

Rfc2898DeriveBytes h = new Rfc2898DeriveBytes(password, saltSize, iterations);
byte[] hashedPassword = h.GetBytes(hashSize);
byte[] salt = h.Salt;
// then store salt and hashedPassword in the database

and, upon verification:

byte[] salt = ... // read from database
Rfc2898DeriveBytes h = new Rfc2898DeriveBytes(password, salt, iterations);
byte[] hashedPassword = h.GetBytes(hashSize);
// compare hashedPassword with the stored value

You can invoke a separate PRNG like RNGCryptoServiceProvider() and do things yourself; that's what you do, and though it is weird, it is not weak. However, it is simpler to use what the system already provides. Simpler code usually means less bugs.


What is the purpose of confirming old password to create a new password?

If you are logged in and I sit down at your computer, I can lock you out of your account and transfer ownership to myself.


Steganography is the art of hiding information in other things, often related to images.

In the case of networks, you can play for example with TCP headers to send a hidden message. Here you have a paper -> http://gray-world.net/es/papers/ih05coverttcp.pdf


Data Abstraction Layers in Forensic Imaging

When you take a forensic image, you can generally take either a physical or logical image of a drive. See this article for the differences.

When you create a physical forensic image, your imager is reading the values of a drive bit by bit for the entire drive (unallocated space and all) whereas if you are to taking a logical image, the imager queries the OS and retries only the 'active' bit values within the drive.


Considering the open ports, is it more insecure to use Outline then buying a VPN from a provider?

Any time a VPN service allows inbound connections to your device, there could be a risk if you are running services on the exposed ports. So if you are worried about having any services exposed, simply don't enable that option.
Note that any VPN provider could allow this option, or maybe could allow malicious users to probe your device due to a misconfiguration on their end.


Whitelisting DNS vs. Packet filtering Firewall

I assume she expects that Umbrella will protect her from any unauthorised outbound connections because Umbrella whitelists common domains and blocks suspicious domains. A firewall also protects the machine from outbound connections.

The problem with Umbrella is that it only works on domains and not IPs. If malware on her machine is configured to reach out to an IP, Umbrella will do nothing.

Umbrealla will also not protect her from incoming connections, although that risk might be minimal if she is not running any services that can be connected to.


What are the mostly used and known or less known web tracking techniques?

Less known are:

Using Verizons supercookie: Verizon adds an HTTP-header in every HTTP-request with an unique ID for each customer even after they changed their IP-address, cleared their cookies,...
using "Cookie Matching": You are tracked by tracker A and B. You delete the cookies of A. B manages to identify you (via cookie, ETag, ...) and inserts a tracking pixel loaded from A containing your ID so that A identifies you sets the cookie etc. again. A redirects the pixel to B containing his ID so they can later do it again. A Cookie Matching exchang network often exists of more than 100 different trackers.
Using user login: Many users stay logged in in facebook while they surf and even logging out doesnt delete the cookie. Facebook like buttons are on nearly every page. Combine it with Cookie Matching and you get very far. Same for google account/"double click" (default login on Chrome browser and on Android)
HTML5 local storage: javascript can store and retrieve data on client in the HTML5 local storage. Similar to cookies, but not sent with every request by default. It is not deleted when a user only deletes cookies. http://www.w3schools.com/html/html5_webstorage.asp


What is the meaning of 'adaptative' and 'over time it can be made slower' in the context of the bcrypt algorithm?

One of the inputs to the bcrypt algorithm is the number of rekeying rounds that will be used when calculating the hash. As time passes, and the CPU power available to potential attackers increases, you can simply increase this parameter to keep up -- you'll have to find some way to re-hash all of your old stored passwords, of course.


How to prevent DirBuster to stop listing apache server side files

There are a few ways to stop this, but they aren't always recommended.

The first option is to go through all your files, with something like sed, and append all href links with a random string and then rename all the files with that string...
Basically, quickly change all names to like "randomstringfile.txt" instead of "file.txt". This can make it hard to find the files for normal people who memorize websites though.

Also you could make rules in your server to block people for a set amount of time if they request more than 100 requests in a minute or something. This breaks it severely, but not forever. A permanent ban isn't suggested, but not the worst idea either. Sort of like password guess limitations that lock you out for 5 minutes.

A final option is to break any dirbuster-like useragent. This won't stop people who understand, but will break script-kiddies, and automated scans people don't monitor.


Master dataset of all recent password and hash leaks?

As mentioned by @Matthew in the comment, the site https://haveibeenpwned.com/ is probably your best bet.  It is run by Troy Hunt (a respected security researcher) who collects the various leaks and data sets, and lets you search to see if your account has been part of one of the leaks.  He does not make available the raw dumps.  He does, however, provide an API if you want to search his data set, suitably cleaned up, to be useful for researchers, without propagating exploitable data.

API page here:

https://haveibeenpwned.com/API/v2


Should I block IP adresses that made attacks attempts and were block from an IPS through the rules?

Yes, you should.

But you should also ask yourself for how long you will block any address which got onto your blacklist. Reasonable values might range from minutes to weeks, depending indeed on the subject of availability as mentioned on the comment by @Philipp.

Of course, by blocking an IP you run the risk of blocking an otherwise legitimate user. But at the same time, you need to make sure you keep your service and up for all other users as well.

If you are just ignoring IPs which your NIPS detects, you could switch if off as well.


AES + CBC to encrypt individual local files, fixed IV?

Predictable IVs in CBC mode are vulnerable to chosen plaintext attacks.

In short, there is zero defensible reason to use a static initialization vector. It is a terrible practice and invalidates many of the guarantees provided by your choice of encryption method.

Just don't do it.


Hosting statistic tool on heroku with flask secure?

HTTP basic auth is prone to be bruteforced. Flask-HTTPAuth with digest mode could be a better solution, but there are also several security concerns to be resolved, as well as additional password and lockout policies.

Another approach colud be integration with trusted Oauth provider like Google. This way you just shift authentication-related responsibilities to 3rd party that you can trust, and it could be much easier yet reliable.


Why block outgoing network traffic with a firewall?

Blocking outbound traffic is usually of benefit in limiting what an attacker can do once they've compromised a system on your network.

So for example if they've managed to get malware onto a system (via an infected e-mail or browser page), the malware might try to "call home" to a command and control system on the Internet to get additional code downloaded or to accept tasks from a control system (e.g. sending spam)

Blocking outbound traffic can help stop this from happening, so it's not so much stopping you getting infected as making it less bad when it's happened.

Could be overkill for a home network tho' as there's a lot of programs which make connections outbound and you'd need to spend a bit of time setting up all the exceptions.


Is it possible to login to accounts if you have access to an android phone?

Like @Steffen says, mobile apps work very similar to web applications. Sometimes they consume the same APIs and use the same authentication/authorization scheme (e.g. API keys). This information needs to be stored somewhere, especially for apps that stay persistently logged in.

Most apps store sensitive information in the app's protected directory in /data, which other apps cannot read without root access. You may be out of luck unless the device is rooted, there is an RCE vulnerability in the application, the app's comms are not properly encrypted, or the target app allows debugging.

Additionally, most modern Android devices use user-data encryption at rest. So, a powered off phone (or even one with a custom recovery) is no good for circumventing permissions and recovering data.


Your question basically boils down to why do you need CSRF tokens on a login flow?
First off, CSRF protection is to prevent (OWASP):

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application

Now consider if your login flow -- whether that is a simple Form POST with username / password, or something as complex as OAuth2 -- is not protected against CSRF attacks. The user (victim) could be logged in to your app. Another tab (the attacker) could do a POST to your login page with the attacker's credentials (or OAuth2 claim). Your app would accept the attacker's credentials (it's a real account after all) and set the right cookies in the victim's browser so that they are now logged in as the attacker. This is called a Login CSRF Attack because the attacker has forced the victim to execute the unwanted action of logging in to the attacker's account.
Maybe the victim does not notice that they are now in a different account; or maybe the UI has not refreshed and still shows them logged in as them self. Imagine if they enter their credit card information into the attacker's account!

I also need to point out a couple of security flaws in your description:

a randomly generated md5 string as "state"

If you're starting with a random value, why hash it with md5? Why not just use the random value directly? Or a type 4 random GUID? If you do need to hash it, why use an old broken hash function rather than SHA-256?

My backend first checks whether the "state" in cookie matches the "state" in the response.

CSRF tokens in cookies are brittle. At minimum, you need to set SameSite=Strict on your cookie (Mozilla docs). It is always better to put CSRF tokens in a non-cookie header, but I guess if you need the CSRF token on the OAuth2 302 redirect, maybe cookie is your only option?

TL;DR login CSRF attacks are where an attacker can force the user (victim) to log into the attacker's account. You need a CSRF token on your login pages (specifically on the login POST) in order to prevent this.
There is a good related answer on this Stack Overflow post:

https://stackoverflow.com/a/15350123/1907046


Windows firewall blocking of a dynamically generated .exe

It depends on the methodology you choose to allow access. You may choose to allow access to applications you want to and create a "cleanup" or "block everything else rule" wherein besides what you've explicitly allowed everything else I'll be blocked. So in your case since you haven't allowed A.exe or B.exe they won't get network access. You can further lock this down using checksums (if your firewall permits). Meaning you can state allow Firefox.exe with checksum xxxxx to access port 80,443 outbound. I know Symantec Endpoint Protection has this feature. You may look this up on your firewall. This is useful since the malicious program may spawn a process with a whitelisted executable filename.


How to detect if a system is infected by key logger or not?

I guess it would require too much effort and still you would not be 100% sure.

Have a reliable anti malware with the latest update perform a deep scan to look for it.
If you are very well experience with the OS' processes, take a look to see if any unknown process is currently running.
Check the connected USB devices to the computer. Two keyboards are a indication

What could help you:

Use a system virtual keyboard to type in your password.


Path Disclosure without ability to read files

What you describe can be called an information disclosure vulnerability. You could use this technique as a method of fingerprinting (looking for specific operating system files, common web framework folders and files, etc.) and could prove useful in identifying a version of something on the system that is susceptible to a separate vulnerability. As you've indicated it's a web server, it could aid in exploring web application vulnerabilities such as arbitrary file upload (if the functionality exists) or otherwise.


You can use a protocol designed for exactly this: SSL/TLS.

As usual, don't roll your own cryptography. Find an existing implementation that takes care of the heavy lifting for you. For Java, that will probably be the Java Secure Socket Extension (JSSE).


Is this php smarty template statement a security flaw?

The traditional problem with using $_SERVER["PHP_SELF"] is that it includes PATH_INFO after the script URI. This means the URL can include dangerous characters which can lead to cross site scripting, f.ex if you script was script.php an attacker could append data after it like this:
https://example.com/script.php/thispart/is_path_info/"><script>alert(1)</script>

However as PATH_INFO is a configurable option for your web server, exploitation may not be possible. It is also possible to escape variables via smarty using escaping to prevent this.


Am I missing something in regards to using third-party PHP libraries?

Disclaimer: I am not a php expert, but this seems to be a question that pertains to package management in general.

Every package manager suffers from this, whether it is npm, composer, gem, etc.

npm (Node Package Manager) suffered from exactly this scenario a couple years back.

What some package managers do to mitigate this, is require repositories provide a cryptographic signature with the package being installed, so that if the package was tampered with and not signed by the owner, it will be flagged by the package manager.

Some package managers also do vulnerability scanning, for reported vulnerabilities in the version you are dependent on, so you know to upgrade.

Using third party software requires trust (on the developers, on the repository where it is imported from, on the software it depends on) for more than just security, and there are no silver bullets.

If your package manager does not do the minimum of package signing, then switch to one that does if possible or put pressure on them to do so.

If you have the backing to do so (I am not sure if this is a personal project or a work project), you (or your company) could set up your own repository that only contains packages you (or your company) has audited and configure your package manager to point to it. This keeps risk at a minimum, but requires quite a bit of effort.


What risk do International Domain Names (IDN) pose?

The most risky are so called IDN-spoofing attacks that are possible due to visually similar symbols. That is some side-effect when trying to introduce Unicode.

Regarding this topic I can recommend official Unicode consortium technical report: http://www.unicode.org/reports/tr36/, titled Unicode Security Considerations and article on Wikipedia: http://en.wikipedia.org/wiki/IDN_homograph_attack, and some more interesting reading: http://www.lookout.net/test-cases/idn-and-iri-spoofing-tests/.

Also, as addendum - FireFox extension to protect yourself: https://addons.mozilla.org/en-US/firefox/addon/621/.


In most cases, you can configure OATH-TOTP access as a backup. Sometimes, you can also register more than only one U2F key.


Ease of Getting Data On Self-Encrypting Drive From Screen-Locked Windows 7/8 Computer

It simply requires a entry level of electronics knowledge to do this. The average 'petty criminal' wouldn't care since they would simply sell the stolen hardware (also they most likely would not care in the slightest). Your danger would be if your average house-thief was effectively being sub-contracted by someone with a little bit more knowledge/experience and the intent to commit identity fraud or steal your data.

You RAM is going to need to be 'refreshed' every once in a while ( and by that I mean nano-seconds. ) when this occurs the ram is read and written to, and the pins are visible right there.

If DDR ram is cold/frozen then the data contained within a ram chip can actually survive not being refreshed for more than long enough for the ram chip to be removed, and dumped.

Once a full ram-dump occurs then ram can be replaced with a simulator and the machine can be instantly returned to its previous state with the ability to even disable the lock screen ( or alternatively just grab the HDD Decryption keys out.

There are also attacks which can be used to intercept data inline via attaching debuggers ( a lot of Nintendo 3DS / Wii / WiiU research used those techniques for sniffing live ram. )

Your best bet against the first attack I described would be to migrate to a machine which has its ram soldered directly onto its motherboard ( I know for a fact the macbook air does, as do the majority of video game consoles. )


Q: What kind of a key opens a banana? A: A monkey!


One way authentication vs two-way authentication

What is Mutual Authentication?

Mutual Auth IRL (In Real Life)

This is exactly what you do when you go to the bank. You "authenticate" the teller from the second you think about the bank.

You think "where is the bank" (location, check)
Does the bank look like a bank? (look around, looks like a bank, reputation, check)
Does the teller work for the bank? (She's behind the desk, so someone let her back there, uniform, name tag, and she is holding cash. Check)

Check, check, check. You're at a bank talking to an employee.

Now she authenticates you. Asks for
- your ID,
- your photo comes up on the screen, and
- you know your ATM pin.

Check, check, check. She trusts you are you.

Mutual authentication. You both think you know who the other is.

Mutual Auth in Computers

In computers it's about the same. Both sides need to trust each other. And bad guys could be executing a man-in-the-middle attack.

ssh

One place we use mutual authentication is SSH. You want to SSH to a server, you want to know it's really the server you think it is.

Let's say you're going to copy up some secret information. How do you know for sure you're connecting to the right server? What if somebody is trying to trick you into uploading the secret info to their server? SSH servers do prove to the client connecting to them that they have a secret key. Read about it here: https://support.alertlogic.com/hc/en-us/articles/360002999732-How-does-SSL-mutual-authentication-work-

web sites

EVERY TIME YOU LOGIN ON A SERVER you are mutually authenticating.

Your browser trusts the remote server and puts the lock in the address bar. Then you type in a username and password, and now the server trusts you.

TLS

Or HTTPS - Sometimes still called SSL, but TLS is the accurate name for the protocol.

There are same protocol exchanges that mutually authenticate. You can mutually authenticate over https. You have a "client" certificate that you use in the key exchange with the server. The server verifies your client certificate is signed by a certificate authority that the server trusts to sign client certs. Just like your browser checks that the server's cert is signed by a certificate authority that the browser trusts.

Look at mutual TLS authentication in action

NodeJS is an interesting implementation. It's both a pain in the hind at first, and sorta easy code to read once you figure it out. Have a look at this writeup and the nodejs docs.

https://blog.cloudboost.io/implementing-mutual-ssl-authentication-fc20ab2392b3

https://nodejs.org/api/tls.html

Read More

Mutual Authentication: https://en.wikipedia.org/wiki/Mutual_authentication

Definitions of authentication:

  an act, process, or method of showing something (such as an identity, a piece of art, or a financial transaction) to be real, true, or genuine : the act or process of authenticating something

Source: “Authentication.” The Merriam-Webster.com Dictionary, Merriam-Webster Inc., https://www.merriam-webster.com/dictionary/authentication. Accessed 25 January 2020.

  authentication is the process of verifying that identity. It might involve validating personal identity documents, verifying the authenticity of a website with a digital certificate,1 determining the age of an artifact by carbon dating, or ensuring that a product or document is not counterfeit.

Source: https://en.wikipedia.org/wiki/Authentication


How does forensic software detect deleted files

There are any number of different ways it can be done.  In large part, the easiest way is following the link pointers to each of the chunks, but that isn't the only way by any means. (The MFT isn't the only source of those links in many file systems as well.)

At a lower level, it can identify all the chunks and try to match some of them up on content if the files have an internal structure that allows one chunk to be matched to another.  That won't work for all files though if the pointers are removed, since some don't have much of a pattern to them, but it will work with enough that it's still a major concern, especially since unless your drive is highly fragmented, even a large file probably isn't more than a few dozen large pieces.

Basically, there are a ton of different ways you can try piecing stuff together based on either the physical structure of the drive (contiguous blocks are generally preferred if available), file system features (such as forward and reverse block links) or file structure features, which vary from file to file.

Short of total destruction, there are any number of possible ways to recover the file.  In some cases, simply removing the pointers may be enough, but a truly determined analysis can likely still put the jigsaw together by looking for fragments that make sense together, particularly if they are looking for something in particular.


Can an android phone that is flashed to a trusted safe rom still be malicious?

Custom ROMs only flash /system partition and reuse the same kernel that comes with the device. Kernel is part of boot.img in /boot. Sometimes /vendor partition is also reflashed with the custom ROM if the vendor image is patched by the maintainer but proprietary drivers and firmwares of OEM remain as it is. Other partitions like /radio, /odm and bootloader remain stock.
OEM can add spyware in any of these proprietary blobs to keep it persistent across custom ROMs. The source code they release is only of Linux kernel as required by GPL. Qualcomm also releases kernel source of their Snapdragon SoCs along with code of Hardware Abstraction Layer (HALs) on codeaurora forums (CAF). Some custom ROMs use CAF kernels and HALs released by Qualcomm. You can measure security of these public images but cannot be sure about security of what is already on your device.
Android bootloader (ABL) is protected by secure boot enforced by the SoC. Even if your blootloader is unlocked along with unlock_critical, ABL cannot be patched or replaced. A malware in bootloader can persist until end of life of the hardware. Supply chain attack tends to be stealthy because they pass signature verification on boot and their signed updates are trusted by the update manager. It comes down to who you trust. If you are trusting custom ROM, you have to trust OEM also.


Are case-insensitive passwords a bad idea?

Whether you should be worried or not depends on the sensitivity of what you're protecting.  The lock protecting my filing cabinet holding my taxes and medical information doesn't need to be that secure, and I don't worry that the lock is cheaply designed.  But I want the locks protecting my money to be extremely secure.  It does show that they may not be thinking very clearly about security when designing the system.

Making passwords not case sensitive reduces the number of possibilities dramatically.  A 6 non case sensitive character alphabet only password has 2^28 possible passwords,while a 6 character case sensitive password has  2^34 possible passwords.  This reduced search space makes an attack on a leaked hash database more feasible.

As Jeff Ferland points out below, having caps lock on doesn't mean the site isn't case sensitive.  If I type Password, then hit caps lock, it comes out pASSWORD. The case is merely inverted.  If the site is doing this, then the password is still case sensitive, but merely tries the original, and inverted password.  This merely halves the search space.  That's simply a usability/security tradeoff since people commonly have caps lock on and don't know it, and (at least IMO) a good one.

It's impossible to tell if the service is storing your password in plaintext from this one fact.  It's trivial to just change everything to one case before the hashing is done.


Preserving crime evidence from a website I do not own

Is there a standard procedure when it comes to preserving evidence of
a crime committed on a website of a third party?

Screenshots of the evidence are a good start-off point. While the text on the web pages can be modified before the screenshot is taken, it would be a very foolish thing to do so and then to submit it as evidence to the law enforcement. At least that is what is assumed by the cops who take in the initial evidence to file the case, that the submitter is not that stupid.
If you want to take this one step further, you could get the screenshots notarized by an attorney (after the attorney verifies your screenshot with the content on the website and confirms that they match) and then use them as evidence. It is generally assumed that court officials and attorneys would not want to get themselves perjured (since the attorney could need to swear in court under oath that they verified the contents at the time of signature) and hence such notarization would be mostly held as acceptable evidence.
Furthermore, most servers do have backups in some form or the other and if the evidence (screenshots) is submitted to the law enforcement officials quickly enough, they may be able to get actual confirmation from the server webmasters or owners of the site.
Forensic tools and techniques are available to take forensically acceptable backups of the site, but most of such tools are somewhat expensive and are not within the scope of most home users. They may not be needed in most cases unless advised by a lawyer.
Wget is a good tool to scrape websites/webpages but again, it is not forensically acceptable since the downloaded webpages can be manually edited in text editor.

Let's assume that a crime was committed on a website I visit, like
defamation.

The jurisdiction matters a lot. Which country are you located in and in which jurisdiction is the site server hosted in (if it's possible for you to know)?
Also, did someone use your "real name" to defame you or just a nickname moniker that you use on forums? That is also quite important to establish certain facts but this is not a part of your question and so I will not into the details.
My goal is to be able to prove to the authorities that a crime was committed so that they start an investigation.
Like I wrote above, you may need to prove that you actually suffered damage from that "defamation" before they would consider that a "crime" or take it to court or even files a police report, in some jurisdictions.

For not-so-serious crimes unless it's very easy to prosecute - e.g.
the evidence is still accessible without the need for a warrant - the
police might not even bother.

Did your opponent use their real names to attack you (using your real name) or was this just some sort of a fight on a platform like reddit where one usually does not use their real names? If real names are not used then the police may not even bother to get involved unless serious threats are made which could endanger life and such (again ths depends on the jurisdiction).
Finally please be aware that in most cases and in most jurisdictions, it would not be possible to file a case without your real name and your details ultimately becoming public data. Only in very few cases which could pose a real danger to the complaining party, the police allow the case details to remain private. Otherwise if and when the case reaches the court, in most cases your details would become public.
Are you ready for that?


Why is there no adoption of RFC 7616 (HTTP Digest Auth)

Most sites don't use any of the HTTP authentication mechanism, i.e. Basic Authentication or MD5 based Digest Authentication, because these mechanisms are very limited in what they offer. It is not even possible to logout using these authentication mechanisms.

But even the few sites which use HTTP authentication usually prefer basic authentication over HTTPS instead of digest authentication, since the last one requires that the passwords are stored at the server as plain text or equivalent, which of course is bad from a security perspective.

Thus the only advantage digest authentication has against other authentication forms is if is used with unencrypted connections. In all other cases it is worse than the other established ways of authentication. But, any kind of login  over insecure connections is considered bad anyway today. Therefore there is no need to slightly improve an already bad authentication mechanism without addressing the basic problems of it, i.e. the necessary plain text (or plain text equivalent) storage of the password.

Apart from that the weaknesses of MD5 like a bad resistance against collision attacks and pre-image attack don't really affect its use in Digest authentication, i.e. it is still suitable for this use case when used together with a proper random server defined nonce.


Keeping an ex or current spouse from accessing an account

There are a few options now.

In real life

hire a notary.

Online with (outsourced) human

Online notary using a web cam
scan and verify identification (drivers license, etc). There are services that do this but setup an elance/upwork contractor account to see it in action. Also look at the INS form that employers must use to verify their new hire is a US citizen.

Online with human you employ

call the person
ask the person to send you an email while you're on the phone with them

Online automated

text, and voice call
send snail mail
layer / parent / friend voice verificationn
deposit cash into a bank account to verify they have access
use plaid / yodlee to verify they can access a bank account (this is similar to what mint.com does)
cell phone providers have an alliance that provides cell phone to user information

Not everyone of your customers needs the full level of access though.

A customer should know which of the options will work for them.

The best bet is to use a bank account - banks have Know your Customer laws requiring them to accept IDs before opening accounts. While not full proof, it's a great improvement over what is out there otherwise. And if your app is financially related, it's not a huge step to ask the user to login to their bank account.

What not to do:

DO NOT use security questions


PROTO=UDP SPT=6881

TCP or UDP on port 6881 is usually associated with BitTorrent.  Most likely you (or a former user of your IP address) used BitTorrent for downloading something, and this is just a routine check to see if your computer is still part of the relevant BitTorrent swarm.  Nothing to worry about.

PROTO=UDP SPT=13291 DPT=54327

This could be anything.  Neither UDP port 13291 nor UDP port 54327 is associated with anything in particular; this could be backscatter, or a corrupted UDP packet, or leftovers from a VOIP session, or who-knows-what.  The one thing it probably isn't is a port scan: UDP port scans are slow, so an attacker will usually only scan ports that are likely to have something interesting on them.


Manual Checks for Signs of Infection on Windows 7

Since the nature of your question is more didactic than practical, the answer is simple: No, that process isn't useful.

The malware designer/coder is smarter than you, he knows your operating system more than you, he spent hundreds of hours in his mother's basement (or his respective agency's labs) exploring the nooks and crannies. His whole job is to make it extremely difficult for you to conventionally find his program or even be aware of its existence.

Assume that every malware installs a rootkit, patches your operating system, modifies your bootloader, flashes your BIOS, override your settings, and change the default behaviour of everything on which you're making your judgement.

Having that said, practically speaking and in the context of pre-2008 simple malware (I haven't looked into malware code/analysis for years), yes your method is an acceptable forensic approach for a beginner to intermediate level.

Finally, utilizing an antivirus software is a good idea and a very good line of defence. Just think about of the millions upon millions of signatures, patterns, and behaviours that software is able to search through to verify your files even before they could affect you.


When I download a file what security risks am I exposed to if I don't check for its integrity?

If the checksums are published on the same server which also hosts the downloads then there is not much security risks of not checking. If an attacker would be able to manipulate the downloads (s)he would probably be able to manipulate the checksums too. So the main problem is that you might not detect that the download is corrupted.

It is another case if the checksum are provided on different server than the downloads. If the checksums are served by a well protected server and are served through https, than it does not matter much if the downloaded files itself are hosted on more problematic sites and without http, at least as long as each user verified that the downloaded file matches the published checksums. Thus in this case it would be a larger security risk to not validating the checksums.


Is exposing website performance data a security risk?

So I have to admit that my first reaction was "I would never do this."  That, however, may be more because I, historically, don't like to let anybody know anything they don't need to, than for any real security reason.

So that said, the only security issues I can think of are fairly limited, and fairly esoteric.   It could be used to find a DoS or DDoS vector, if a) an attacker goes to the effort to profile your app, and b) happens to stumble upon the exact action required to stress your resources and c) it shows up definitively, or at least reasonably on your report.  That said, it's way easier just to buy some time on a botnet and throw some traffic at you, so the actual risk from the perf data itself is likely quite low.  The only exception would be if a quick look at the data shows that your site is either already under stress, or suffers under load easily.  If it advertised significant weaknesses to the world, then it's conceivable that someone might act maliciously on that information.

As to the threat from competitors, that's up to you to measure how much of a risk that really is.  Certianly lots of sites publish their traffic numbers, and for some it's quite critical to do so in order to attract advertisers, so unless you have specific reasons for wanting to keep the numbers under wraps, it may not be such a big deal.  Server perf is also not the only way, or even the best way to estimate traffic, other than perhaps general up/down trends.

So, while I'm not ready to sign off on this as a great idea, the actual security risk is probably on the low side.


Suricata rule to block particular website question

Instead of the http_header keyword, use the http_host keyword. It will specifically match against the "Host" header.

For wildcard matching you should have a look at PCRE:
Suricata User Guide » Suricata Rules » Payload keywords » pcre (Perl Compatible Regular Expressions)


Still able to recover files after running cipher.exe on windows 7

Haven't tried, but in NTFS, "deallocated space" and "metadata" is not the same thing. Try to recover a file: is it recoverable, or is it garbage? (I would agree that not deleting the name of a file is still a security risk, and freed files metadata should be considered deallocated space, but maybe Microsoft thinks differently).
Or maybe (please do not be offended, it's a thing that happens to everybody: it happened to me) you copied the example from the docs, and /W:C:\TEST will only erase the unallocated space hanging on the "TEST" node, not the entire drive C: (that would be cipher /W:C:\). Even if the TEST directory does not exist, cipher will still look for it for a long time, given the impression of being doing something while actually it is doing absolutely nothing.
TL;DR use SDelete or the Tools section in Piriform's CCleaner instead of cipher /w. Just in case.


I think this video here will give you some ideas: What happens when you steal a hackers computer (Defcon 18). This is however a MAC PC, but it will give you some ideas.


Is my email client violating my privacy?

I found a web service to test your email client, to see whether it protects your privacy:

https://emailprivacytester.com/

It automates the process of sending you an email that uses various tricks to try to track you, and then checks to see which of those succeed.  It lists 37 different methods that it implements to try to determine whether you opened the email, track you, etc.  It looks like a pretty reasonable approach.

The author has found attacks and vulnerabilities in a number of email clients, which enable an email sender to violate the privacy of the recipient.  His software implements these attacks.  He describes some of these attacks on his blog:

New Version of The Email Privacy Tester
iOS 4 iPhone Email Privacy Leak
Automated Email Privacy Tester
DNS Pre-fetch Exposure on Thunderbird and Webmail
Android Email Information Leak
Apple Mail Privacy Hole


Malwarebytes Block Outbound Connections (Guest-to-Host On VBox)

It seems you are downloading from a suspicious ip. Maybe that ip is in a blacklist... and that kind of things usually is because of a reason.

Torrent downloads are usually a way to propagate malware... so could be dangerous. Keep your eyes open and check carefully what you download before opening it, that's all.


Short answer: Yes.

The deauth-packages are part of the management control frames used in 802.x communications. That means, they are usually handled in driver-land.
So if it is not an advanced attacker (who'd probably go about this a different way anyways), you'll successfully make the attackers wifi-controller disassociate from your network.

But let's consider a worst case scenario:

Your attacker is dropping every 802-Deauth-package he's receiving. His tools are capable of constructing raw wifi frames, he's in total control of his wifi driver.

Even if you could not disassociate him, your router will still pretend the deauth happened and will discard all future packets. The attack would therefore stop non-the-less.

Also, I would not call it a brute-force last resort either. An Intrusion Detection System will be able to specially block the attackers MAC-Address.


AVG detects Kaspersky update files as infected (trojan, infected, malware)

They are false positives. Usually, is not a good idea to have two different AV software installed. One can block other as is your case.

In your case, concretely, it seems it's blocking database files. Maybe it has some known virus pattern. Of course, any AV has itself and its files as exception on detection but it is not know for other AV software and that's the reason why is detected as malware.