Backdooring PE binary compiled with ASLR

If I understand your question, you’re missing something very fundamental about how functions must behave.

Push operations don’t “save” values per se, they store values to the stack and then decrement the stack pointer. This means that the stack pointer must be at the same value (excluding the size of the data that was pushed) in order to restore” values by popping them. Everything is in band and depends on the integrity of the stack pointer.

When your function returns to the caller, the ESP/RSP value MUST be the same as when it was called when your payload finishes. This is how a “normal” compiled function works and it is required behavior for a program to work correctly. Otherwise ret instructions would be meaningless since they depend on the stack pointer being set to to the same place that the call instruction pushed the return address

If you allocate 64 bytes of stack space in your function, for example, you should increment the stack pointer back up 64 bytes when your function is complete. Don’t forget that both ret and call will modify the stack pointer slightly as well.

To troubleshoot your code, breakpoint at the beginning and end of your payload and verify you have properly restored the stack to its original value at the end, usually via a sub instruction or by using an immediate value with the ret instruction. In my opinion using sub is clearer.

tl;dr; When writing assembly code, think of the stack as the heap and be conscious of “freeing” any allocated stack space when you are done with it or at the end of the function. Keep the stack pointer in sync like properly compiled code would.


Decrypt signature file based on plaintext

Although you are not explaining what the verification process is, it looks like the .sig file is a digital signature, guaranteeing data integrity, authentication and  non-repudiation: it means that, as long as the verification is affermative, anybody knows that the file hasn't been changed by a third party, and that the signer signed the file, with no uncertainty (the verifier knows the identity of the signer).
The signature uses a hash function (public) and a private key (by definition, non-public). Then, if you want the verification process still working after your changes you should ask the signer to digitally sign the changed file, producing a new .sig file.
No other person can do that, unless the private key of the signer is broken.

Of course you could digitally sign the changed file by yourself and get a new .sig file: in the case, the verification will work, but the verifier will know that the signer is you, and not the original signer.

All the above features are built-in in the digital signature, by design.

A fair description of digitally signing can be found here: https://en.wikipedia.org/wiki/Digital_signature
In many cases it is based on a hashing function of the SHA family is used (https://en.wikipedia.org/wiki/Secure_Hash_Algorithm) with the RSA cryptosystem (look for it on wikipedia, stackexchange is saying I can't post a 3rd link)


How to securely dispose of a smartphone?

Unless you have secrets on that phone that someone would pay a lot of money to uncover, you don't need to go overboard. A factory reset would work just fine.

To decrease the chances someone would still recover something, point the camera out of the window and let it record until it fills up all memory. Repeat if you want. Doing that will overwrite almost everything, and anything it could be recovered will mean too little to be of any use.

But if you have secrets that would make someone use a electron microscope on it, rent a clean room or spend hundreds of times the price of your phone to recover its data, physical destruction is the only safe option.


Reverse proxy isolation from insecure blog, are sessions vulnerable?

Yes, your concern is justifiable.

From the Set-Cookie documentation at Mozilla:

Path=<path-value> Optional
    Indicates a URL path that must exist in the requested resource before sending
    the Cookie header. The %x2F ("/") character is interpreted as a directory
    separator and sub directories will be matched as well (e.g. path=/docs,
    "/docs", "/docs/Web/", or "/docs/Web/HTTP" will all be matched).

That means that all cookies you set for your main app with Path=/ will be sent with requests to /blog, too.


Are there other ways to encrypt files other then TrueCrypt and BitLocker

Yeah. There are many alternative to Truecrypt and BitLocker that you can find in link below:
http://alternativeto.net/software/truecrypt/

However I software that meet you prerequisites are DiskCrypter and FreeOTFE(not supported anymore).
P.S. there is no guarantee that they are backdoor free!


User Account Control and outside processes

When teamviewer is installed it includes a daemon that runs under the system account. The client that is started under the users account only provides instructions to this daemon.

As this service already has elevated rights assigned at the time of installation (the creation of this daemon) it is possible to directly emulate key strokes as coming from the local system.


What are the likely threats to a public-facing DB instance?

It sounds like you've got a decent grasp on threats, know that what you're doing now is preferable from a security standpoint, and are facing a cost / benefit analysis. With that in mind, here are some alternate thoughts:

Configure MySQL with an SSL frontend. There are some features in MySQL for that, but stunnel may make you less crazy. While client certificates are somewhat ideal, I imagine from your VPN struggles that may not be in the cards.
Run MySQL on your machine and configure it to listen to the world and use the iptables (firewall) capability of the system to deny any connections. Create a very simple web service that upon successful authentication will add the source IP to the list of permitted hosts. Every so often you can clear the iptables statistics and remove hosts that don't generate traffic for a few days. Think of it as port knocking with an audit trail.


Distributed XAdES-X and XAdES-A signatures over multiple documents

Yes, this is possible.

The XAdES standard uses regular expressions to describe the various forms. This is how the SignedInfo field of the XAdES-X forms is described:

< ds:SignedInfo >

  < ds:CanonicalizationMethod/ >

  < ds:SignatureMethod/ >

  (< ds:Reference URI? >

    (< ds:Transforms >)?

    < ds:DigestMethod >

    < ds:DigestValue >

  < /ds:Reference >)+

  < /ds:SignedInfo >

The '+' after the reference field means that this field may appear once or more times.


security of AES where attacker can ask secure code to decrypt arbitrary cypher-text

This sounds to me like a chosen ciphertext attack. The raw AES block cipher itself is secure against it. Any cipher you would see used in a modern setting is secure against it.

Some AES implementations you would actually see in the wild are not secure against sidechannel attacks, meaning information about the computation which is not part of the function signature (not the cleartext of a submitted ciphertext). The length of time it took to compute is the most famous, and might be available to a remote network attacker. Contention over caches and execution ports is visible to code running on the same hardware but in another process or VM, and is an attack on shared hardware, possibly in a cloud environment. Measuring accustic noise from electric components might be an attack on hardware in the same room. Actually measuring electromagnetic emanations from the hardware is an attack on smart cards and the like.

The problem is that you never just use the raw AES block cipher. You need to encrypt messages longer than a single block, and you need to protect against malleability. MAC-then-Encrypt AES-CBC turned out to be so hard to implement correctly that fixing all TLS implementations deployed in the wild is now considered impossible, TLS 1.3 dropped those cipher suites and the plan for TLS use in the wild is to just age out all those bad implementations. Anybody not using AEAD in any modern design is rightfully ridiculed.

So, for example, unauthenticated AES-CBC with a padding oracle is trivially breakable, it's an exercise given to non-cryptography people to teach them that cryptography is subtle.

More in-depth information about block cipher security is on cryptography.SE. On security.SE, we'll just tell you how to avoid problems without becoming a cryptographer.

Use a modern AEAD like EAX or GCM, or at least use HMAC with Encrypt-then-MAC and corresponding MAC-then-Decrypt (and make sure the MAC covers the IV if you use CBC, though you should use CTR because it's faster). This way, you never expose crafted ciphertext to an AES circuit that has your key, and don't need to worry about it. Or use ChaCha20Poly1305, and then you don't need to worry about an insecure AES implementation (only hardware AES and bitslicing are secure, all table driven AES implementations are not secure. bitslicing is slow, so almost all AES on hardware that does not contain dedicated AES circuits is insecure. That's why ChaCha was invented).

The really correct thing to do is to not roll your own crypto and use a high level library that has a misuse resistant API like Google Tink or libsodium, etc.


TLS certificate exchange may be malformed

Given that you use Filezilla my guess is that you are using FTP. The following command connects to the FTP server, upgrades to TLS and shows you among other things the certificate chain:

openssl s_client -starttls ftp -connect rxdatadirector.catamaranrx.com:21
CONNECTED(00000003)
...
Certificate chain
 0 s:/C=US/postalCode=55343/ST=Minnesota/L=Minnetonka/street=9900 Bren Road East/O=UnitedHealth Group Inc./OU=Enterprise SSL Pro/CN=rxdatadirector.catamaranrx.com
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA
 1 s:/C=US/postalCode=55343/ST=Minnesota/L=Minnetonka/street=9900 Bren Road East/O=UnitedHealth Group Inc./OU=Enterprise SSL Pro/CN=rxdatadirector.catamaranrx.com
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA
 2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
 3 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
 4 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root

This means that this server first sends the server certificate [0], which is correct. Then it send the server certificate again [1], which is wrong. Then it send the intermediate certificate [2] which issued the server certificate , which is correct. Then it sends the next certificate in chain [3] which is also correct. But then it send the root CA [4] which should not be sent at all but will usually be simply ignored if sent.

Thus, you need to remove [1] and [4] and then it should be fine.


Private way to connect to my SQL Server database

You could create stored procedures that ONLY do what your script needs to do and then limit GenericTaskRunner's permissions on the database to allow it to execute those stored procedures ONLY. This way, even if the rest of users have the database credentials, they can only do what the script can do.

If this was not enough, then you should consider executing your Python script on a server instead of giving all users access to it.

Edit: I see in the comments that you plan to execute the Python script automatically as a Linux user. Another option is to store the database credentials in a file which only that user has read access to, and read it from the Python script when connecting to the database.


How to check browser extension behaviour?

You could run Wireshark  to check for such background activity while using the add-on.

Alternatively you can forward your traffic through a proxy like Burp or  Fiddler and analyse it there.


Installing own certificate for HTTPS sniffing?

Use mitproxy and sslsplit to manipulate your phone and make your computer pretend to be the server. You will need to install the newly forged certificate in your mobile phone so that your phone doesn't raise any warnings.
Check out this post.


What is the danger of Reflected Cross Site Scripting?

You can do a lot when you can inject code into a page.  For example, you can

steal credentials in non-HTTPOnly cookies.
send requests to a server with the user's credentials.  Think XSRF
steal secrets that are stored in JS variables.
prompt the user to download content by submitting a form
display text that seems to come from the site owners.  Think phishing.
display a password input, log keystrokes, and send the result to a site of your choosing
redirect to another site
get GPS/camera data if the user has granted that site access to the device


Why isn't MSWindows product code kept secure?

That code is an OEM product code, which means that it's baked into the firmware somewhere. Copying the code won't allow you to install Windows on another machine, so there's no real need to secure it by removing the sticker.


Safely use old windows XP machine in business network

It is not that uncommon to have these out-of-support and vulnerable machines in an organisation. It's important to perform a risk assessment to determine the impact of any vulnerabilities.
High-Level Risk Assessment
Threats:

Internet connections mean that remote threats are a problem
Local network connections mean that threats within the network (or remote threats that have gained access to the network) are a problem
Local physical access to the machine means that anyone who can interact with the machine can be a problem

Impact:

Network connections mean that the machine can be used to attack the rest of the network.
Any access means that any sensitive data on the machine is at risk (if there is sensitive data on it, like manufacturing designs)
Any access means that configurations or machine settings can be maliciously (and dangerously) changed

Mitigations:

reduce or eliminate network connections
reduce or eliminate physical access to the machines by unauthorised people

Your Specific Case
Without knowing more specific requirements for the machine in your company:
If you need Internet access (and it truly cannot be replaced by some other measure) then you need to cut it off from the rest of your network as much as possible and only allow it to receive connections only from the manufacturer and blocked from making connections out. Your perimeter and internal firewalls come into play here to design a new network. You also want to be able to monitor and recover from any anomalies that occur on the machine.
What I have done in similar situations is to turn the machine into a Virtual Machine (VM), and use VM tools to snapshot, revert, etc. and use the hypervisor to control access, networking, and monitoring. Virtualising the machine is not always possible, however.


You are mixing two things up but I'll answer both:

UAC does not pose any mitigation to a rubber ducky or a teensy or any other platform. Next time a UAC dialog pops up, try pressing CTRL + Y and see what happens. They easily overcome UAC. Using UAC is meant to prevent software running on your pc from escalating privileges without your approval, but the pc considers you (or your 'keyboard') as approval.
As for granting a user low privileges - this is a mitigation, in the sense that the rubber ducky can only do what the user can, so the more you limit the user, the more you limit the duck. There is a trade-off here. For power users solutions like duckhunt are far better in my opinion but if this is a non-technical person's computer, then this is a great mitigation method.

EDIT: according to OPs comment and edit, my first point is irrelevant. I'm not removing it since I think anyone interested in HID attack mitigation should read this.


Worthy security related certifications for a software engineer

Have you checked out SANS?  They are an excellent training and certification resource and have some software developer certifications.  Check out them out here: http://www.giac.org/certifications/software-security


Salting in encryption (rather than hashing)

A salt is a cryptographically-secure random non-repeating value, added to the password before hashing it, rendering rainbow tables useless and making it impossible to attack more than one password by attacking one hash.

An initialization vector (IV) is a cryptographically-secure random non-repeating value added as the initial state to a block cipher algorithm depending on the mode of operation, preventing the cipher from producing the same ciphertext for similar blocks of the plaintext, thus denying the attacker the opportunity to infer relationships between segments of the encrypted message.

Both a salt and an IV aren't secret information, in fact, in most cases the IV is transported with the message itself. Implemented correctly, an IV shouldn't make it any easier to "crack" the encryption. On the contrary, it should make it even harder. The security of the cipher system should depend on the secrecy of key, and only on the secrecy of the key, AKA Kerckhoffs's principle:

  That the security of a cipher system should depend on the key

Oh, also, don't implement your own crypto and use it in a production environment, AKA Don't be a Dave.


How to get openssl to use a cert without specifying it via -CAfile

There is a known OpenSSL bug where s_client doesn't check the default certificate store when you don't pass the -CApath or -CAfile argument.  OpenSSL on Ubuntu 14.04 suffers from this bug as I'll demonstrate:

Version:

ubuntu@puppetmaster:/etc/ssl$ openssl version
OpenSSL 1.0.1f 6 Jan 2014

Fails to use the default store when I don't pass the `-ca:

ubuntu@puppetmaster:/etc/ssl$ openssl s_client -quiet -connect gmail.com:443
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:0

Now I pass null as the -CApath and it works:

ubuntu@puppetmaster:/etc/ssl$ openssl s_client -quiet -connect gmail.com:443 -CApath /dev/null
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = mail.google.com
verify return:1

Unfortunately I don't think a list of affected OpenSSL versions exists.  Only way to know is to test it.


How to ensure that a program is implemented as per your recommendation?

There is no cryptographic answer to your question, because by Rice's theorem we know that any non-trivial, semantic property of any program is undecidable. You can't write a program that is able to decide if two programs are functionally equivalent or follow any of your guidelines.

What you actually need is some kind of certification process, e.g. Common Criteria. In CC there are different Evaluation Assurance Levels, and you have to find which one fits your kind of software best. The entire certification process is a huge tradeoff between assurance, effort for design and effort for testing / verification.


Can smartphone spyware work even if there is no data connection?

Yes, it's possible. A malware can simply utilize the SMS functionality in your phone to transmit formatted data from and to your phone. Heck, it might even use DTMF.

Update: After your edits, your question turned from acceptable to really bad. In any case, the most plausible scenario here is via Bluetooth.

However, I think you're just very paranoid and/or you have some troubles with your roommate. Solving this issues can't be done with hacking/counter-hacking.


X.509 Certificate Signature Collision Vulnerability

That really depends one what rules where used to trigger the warning and you gave us no information on that.

However, it is possible that your issue is that you have a certificate signed with SHA-1 which is being phased out. That being said, it doesn't make much sense: when using self-signed certificate (or root certificates), the hash is not actually ever used for validating anything.

So, you should go back to the folks who sent your that notification and ask them what they mean: if they start talking about the "certificate signature hash algorythm", you can tell them that it doesn't apply in your case since this is a self-signed cert.

Edit: As requested, here is a reference:

RFC 5280, section 4.1.1.2 (the one defining the X.509v3 standard) defines the "signatureAlgorithm" field like this:

  The signatureAlgorithm field contains the identifier for the
     cryptographic algorithm used by the CA to sign this certificate.

This means that certificates that, in the case of certificates that are NOT signed by a CA (because they are CA certs or simply self-signed), this field has no meaning.


TLS 1.2 Handshake: How is the ECDHE public key signed by server?

RFC 4492 specifies ECC for TLS1.0 and TLS1.1. It does not cover TLS1.2 because it was written before TLS1.2; notice that 4492 is less than 5246. RFC 5246 TLS1.2 changes the signature structure for all signing algorithms including ECDSA, and also adds a Hello extension to negotiate supported signing algorithms (including hash) more flexibly.
RFC 5246 A.7 Changes to RFC 4492

RFC 4492 [TLSECC] adds Elliptic Curve cipher suites to TLS.  This
document changes some of the structures used in that document.  This
section details the required changes for implementors of both RFC
4492 and TLS 1.2.  Implementors of TLS 1.2 who are not implementing
RFC 4492 do not need to read this section.
This document adds a "signature_algorithm" field to the digitally-
signed element in order to identify the signature and digest
algorithms used to create a signature.  This change applies to
digital signatures formed using ECDSA as well, thus allowing ECDSA
signatures to be used with digest algorithms other than SHA-1,
provided such use is compatible with the certificate and any
restrictions imposed by future revisions of [PKIX].
As described in Sections 7.4.2 and 7.4.6, the restrictions on the
signature algorithms used to sign certificates are no longer tied to
the cipher suite (when used by the server) or the
ClientCertificateType (when used by the client).  Thus, the
restrictions on the algorithm used to sign certificates specified in
Sections 2 and 3 of RFC 4492 are also relaxed.  As in this document,
the restrictions on the keys in the end-entity certificate remain.

In particular RFC 5246 4.7 Cryptographic Attributes

A digitally-signed element is encoded as a struct DigitallySigned:
  struct {
     SignatureAndHashAlgorithm algorithm;
     opaque signature<0..2^16-1>;
  } DigitallySigned;

The algorithm field specifies the algorithm used (see Section
7.4.1.4.1 for the definition of this field).  Note that the
introduction of the algorithm field is a change from previous
versions. .... RSA .... DSA ....

Additional points:

the server signs its ECDHE public key and the curve (which in practice,
especially for Suite B, is named form rather than explicit, thus quite small)
(edit, thanks David) as well as the nonces, with at least the client nonce proving freshness

Suite B requirements are set by NSA not NIST. IIRC Suite B
required SHA256 and SHA384 before NIST "deprecated" SHA1.

RFC 5430 was obsoleted by RFC 6460
which requires TLS1.2 and GCM as well as ECDHE-ECDSA.


Security implication of exporting private key

If the same access rules are used, and if you don't have to input your passphrase then by definition it is as safe as when it was in the key ring.

If you do have to insert your passphrase then the key may be decrypted and then encrypted back again. In that case you've got two possible security issues:

the key bits have been exposed after they have been decrypted with the password (which means that they may have been left in some kind of storage such as RAM or cache);
the key may be encrypted with a different, less secure algorithm.

Finally, you should also be sure that the file hasn't changed meaning, e.g. if it is copied as another key you may be fooled into typing the password for it.


Web App encrypting data on client with login password?

Please see this and this questions and all of the answers about client side hashing/encyption.

To sum it up, browser JavaScript is too slow for password hashing function like bcypt or scrypt which you will want to use to derive a key for AES from user password. You will need to reduce number of iterations and/or other hash parameters and thus reduce overall security of the implementation. If you want client side hashing/encyption, you will need to create browser extensions much like popular online password managers do.

EDIT:

If you or user distrusts WebApp hoster reading private data how can you trust WebApp hoster to deliver trustworthy code? What is to stop WebApp hoster injecting JavaScript code that will leak information before encryption?

To elaborate more directly about problems with browser cryptography please see these links:
https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/

https://tonyarcieri.com/whats-wrong-with-webcrypto

For a more recent opinion:

https://www.cossacklabs.com/whats-wrong-with-web-crypto.html

Regarding user privacy, you will not store plain text. You can use SSL to transmit plaintext and store it encrypted using a key derived from user password. Store hashed password for authentification. Do all encryption and hashing server side. Either that or deliver native application/web browser extension which can be signed and verified. In that case you don't have to trust WebApp hoster, you will just use it for (encrypted) data storage.


Examples of "Runtime application self-protection" (RASP) in action?

RASP takes a naive application and enables it to identify attacks and block them. There are a number of different approaches including filters, sandboxes, and full instrumentation. Here's a good independent article on RASP describing the use cases and approaches: https://securosis.com/blog/understanding-and-selecting-rasp-technology-overview.

Let's look at a simple SQL injection example. A naive application simply has no defense and gets exploited.  An application that uses PreparedStatements is safe against injection, but has no idea whether it is being attacked or not. Let's see how this works with RASP. I'm describing Contrast's instrumentation approach here.

First, the RASP is installed into the application. In this case, simply adding the RASP agent to the environment is enough. When the code loads, the RASP uses dynamic binary instrumentation to add new security sensors and analysis capability to the application. This process is very similar to how NewRelic or AppDynamics work to instrument an application for performance.

When the attack arrives at the application, RASP uses gathers data about the request, the user, the session, and any other contextual information. The attacker's request data is tracked through the application. If it looks like an attack, but never reaches a SQL query, it gets reported as a probe. This is a major difference from what a WAF can do, as WAFs are not able to see what happens inside the application and must overblock.

If the attack actually reaches a SQL query and modifies the meaning of that query, only then does RASP block the attack.  This is essentially enforcing the definition of SQL Injection, as only attacks that successfully modify the meaning of SQL queries are blocked.  This is why RASP implementation can be deployed without much configuration or training.

Ultimately, the user gets visibility into who is attacking their applications, where the attacks are coming from, the techniques being used, the exact line of code that is being targeted, and the full SQL query containing the attack.  The number of viable attacks is only a tiny fraction of the overall probes that never hit a matching vulnerability.  So the results are quite different than what a WAF can provide.

The process is roughly the same for other vulnerabilities. Although, RASP may add specific protections for known vulnerabilities in libraries and components.  RASP may also add security logging or other security features to applications.


Different certificates for the same website?

openssl s_client does not use Server Name Indication (SNI) by default while the browser does. To force SNI use the -servername parameter:

$ openssl s_client -connect objective-see.com:443 -servername objective-see.com |\
  openssl x509 -text
...
Subject: CN=objective-see.com


Bad UX kills security. Most users will look for work-arounds - and you'll be fighting your users instead of helping them / working with them.

I suggest you try this age-old technique instead. I saw this first in Open-Radius authentication and immediately liked it.

Use a time-constant, delayed response. i.e., even if you complete the verification in the back-end quickly, wait for a random time that adds up to 1s or thereabouts before responding to the user. It has multiple advantages. One of them is to discourage bruteforcing by reducing the attack speeds.

It does have a small cost though. If you have a high-traffic system then at peak times you may have too many open connections. That's not a big problem as long as you configure your software to compensate.


Prevent against OTP abuse in app sign up flow

Email Verification First

If your UX allows, you can require the user to first create an account based on their email address. Once the address is verified you can allow adding a phone number and then verify it your usual way.

A legitimate user likely has an email address already, and therefore the setup remains easy. However, an attacker would have to create a new functional mailbox (or alias) for each attempt. By rate/max limiting the phone verification by email domain, you ensure they can't automate this easily. Free mail services generally already prevent automated account creation, and you can blacklist ones that don't.

Use Invisible CAPTCHAs

There are CAPTCHAs that don't require any user interaction that you can use as well during your onboarding, for exmple: https://developers.google.com/recaptcha/docs/invisible


Remote File Injection in ARGS blocking form updating database

I am assuming your hosts are using the Atomicorp mod_security rule set. The error "Remote File Injection attempt in ARGS" is documented here; you can see the code here.

This rule disallows input that looks like a URL from all fields, on the assumption that any mention of a URL is an attempt to get the application to fetch and execute the content at that URL. This is vanishingly unlikely and pretty pointless, but no-one said WAFs were clever.

Because naturally this breaks almost every site, the rule includes loads of exceptions for widely-used web applications. It looks like if you put a string that resembles a known application in your URL (eg jomsocial/x/add), or use a known application's parameter name for your URL (eg origin), you'd probably be able to evade the rule. Of course the exceptions list contains lots of applications that actually have suffered from multiple serious security holes, but no-one said WAFs were clever.

In general WAFs like this and other complex mod_security rulesets aren't much good as intrusion protection for general-purpose web applications. They need specific configuration to recognise what input is and isn't expected, and for custom applications you wrote yourself the effort involved in doing that configuration is usually better spent making sure input is handled appropriately in the application itself.

(They can be useful for intrusion attempt detection, and for patching up problems in someone else's software you can't change - or as a temporary measure until you can fix it properly. But blanket-deploying them against random custom software is not sensible, and rewriting custom software to circumvent WAF blocks isn't really productive or sustainable.)

If your hosting company insists on using an instance of mod_security outside your control to block perfectly valid application input, I would look for a hosting company with more clever.


Question about dictionary attacks on GnuPG symmetric encryption

Yes, when using symmetric encryption with a key derived from a password, then the result in inherently subject to exhaustive search on the possible passwords, also known as "dictionary attacks". GnuPG includes the usual deterrents, namely salts (so that the attack cannot be optimized through precomputed tables) and a slow key derivation function (with thousands of internal iterations). Security still resides on the password entropy. The GnuPG documentation uses the term "passphrase" to underline the need for high password entropy (very long passwords -- in particular passwords consisting of several "words" -- tend to have high entropy).

Whether a given encryption system is deemed strong enough for US classified documents is defined by some arcane federal regulations which would never give a generic blessing on a mere algorithm description in any case. AES is, per se, an "approved" algorithm, but an actual encryption system may be "approved" only if it is an "approved" implementation of an "approved" algorithm. As far as I know, GnuPG is unlikely to be so approved, especially since it was mainly written in Germany (but, with opensource projects, you cannot really know from where the code comes -- and that's a big issue for people who "approve" implementations).


It it possible to host pre-signed html content so I don't need ever to upload my private key to a server?

TLS is used for protecting the communication between client and server. The application data are encrypted with keys which are unique for each connection and which are created during the key exchange part in the TLS handshake. The key exchange is constructed in a way that both input from client and server is used to create the keys and thus no side has full control over the encryption keys.

The recommended key exchange method is Diffie-Hellman and this is also the only one which is available in TLS 1.3. No private key of the server is even used during the key exchange and thus the private key of the server does not affect how the data gets encrypted. This also means that there is no way to pre-encrypt the data by somehow using the private key. The private key is only used for authentication, i.e. to make sure that the client is actually taking to the correct server.

And while in the older RSA key exchange method the private key of the server is involved to protect the exchanged key it does not influence which key gets created and thus pre-encrypting the contents is not possible in this case too.

In other words: the main point of the private key is to provide authentication to make sure that the client is talking to the correct server. This authentication is done by signing some kind of challenge with this private key and thus proving ownership of this key. Since this challenge is unique for each TLS session the server must actually somehow have access to the private key and cannot just offer pre-signed content.

Still, you could use a certificate in theory to sign all the static content you have and you could then transport this signed content over plain HTTP. This would not protect the content against sniffing but it would protect it against manipulation. While this kind of protection is outside of TLS you can find something like this for instance in mail (S/MIME or PGP). Still, it needs a client which will verify such signatures but there is currently no such client. But there is actually an internet draft which goes in the direction of what you want: Signing HTTP Messages
                    draft-cavage-http-signatures.


MACs are predictable in many existing environments. For example, on a typical enterprise network, you're likely to find many physical machine that are part of the same shipment from the same manufacturer and therefore have similar MACs (same OUI and consecutive low-order portion). Any system whose security depended on unpredictable MACs would fail in a typical enterprise environment.

Tying the IP address with the MAC might reveal something about the manufacturer, the type of device or the role of the device that's behind a certain address. That's unlikely to reveal anything that nmap wouldn't reveal, and for virtual machines I don't see how this would reveal anything. On the contrary, if you're worried about your network architecture being exposed, using the same naming scheme for both reduces the amount of information you're revealing (not that the MAC addresses are very likely to turn up on the outside anyway).

If your machines migrate over externally-distinguishable networks, then a MAC address becomes an identifying element and therefore a privacy concern. But in that case they'd likely change IPv4 addresses as they migrate. Tying the MAC to the dynamic IP address (if you somehow manage that — standard DHCP wouldn't apply) would increase the privacy in that case.


Redirected to unsafe page on freshly installed Windows 10

It sounds like your router has been infected by a dns hijacking malware.


Example if we examine the location of a function which prints the secret we want to leak:

(gdb) p &print_secret
$2 = (void (*)()) 0x55555555473a <print_secret>
(gdb) Quit

In the above scenario we are lucky that the hexadecimal location (55555555473a) can be written as UUUUG: and backwards because it is little-endian computer:

$ ./main $(python -c "print 'AAAAAAAAAAAAAAAA:GUUUU'") B
the secret is: blahonga
Segmentation fault (core dumped)
$

But if the location is for example bfff4a60 then that would not translate within ASCII and you get "garbage" trying to translate it. Instead you convert it to bytes

>>> bytes.fromhex("bfff4a60")
b'\xbf\xffJ`'

And use a script to output it to the program you are going to attack (see https://stackoverflow.com/questions/6624453/whats-the-correct-way-to-convert-bytes-to-a-hex-string-in-python-3):

import sys
import struct

def writeStr(v):
    sys.stdout.flush()
    sys.stdout.buffer.write(v.encode("ascii"))
    sys.stdout.flush()

def writeBytes(v):
    sys.stdout.flush()
    sys.stdout.buffer.write(v)
    sys.stdout.flush()

# Write 16 bytes
writeStr("AAAAAAAAAAAAAAAA")
# Overwrite the instruction pointer
writeBytes(b"\xffJ\xbf")
writeStr("\n")


Many DNS Server implements already this logic. You can define multiple DNS server forwarder endpoints based on the domains changing the DNS server configuration file. Then you can use a standard DNS client to point to a DNS server with this configuration.

For instance here is described how to configure dnsmasq in order to forward DNS requeste to two external DNS servers based on the domain name.


Is it possible to secure a web app without HTTPS?

No.

Even assuming you're only referring to leakage of user passwords and/or session ids (btw "secure" includes a lot more than that)...

There is simply no secure way to send a user password over the Internet in the clear, without benefit of a proper encryption protocol. Without using TLS/SSL, you'd be forced to implement this yourself - which, at best, would be insecure.

Likewise, the user's session identifier would be equally exposed, if not restricted to HTTPS only.

That said, the above all assumes a website on the public internet.
There are certain other situations which can be secured without TLS/SSL:

Internal (e.g. corporate) website, that is protected using IPsec.
A local website, on the same machine that the user is browsing from, accessible over the loopback interface only (and dependant on the machine being in use by a single user, not e.g. a shared terminal server).


Does strong naming remove the need for packing/obfuscation?

It's easy to change signed assemblies, it's just that they don't have a valid signature by the original author afterwards.

Strong naming helps with versioning(in particular required for installation in the GAC), and is a security feature in certain mixed trust scenarios. But it doesn't help much against people who have full rights on the comp where your program is running.


Is there a reason for the assumed ISIS video's OpenPGP encryption key ID being outside base-16?

Is it possible in PGP to change the settings to allow an encryption key outside of base-16? Are there settings that will allow a key of any thing you like?

No. That piece of output is shown in base 16 (hexadecimal) just because it's a good way to show binary data (in this case a hashsum).

In this case it's as if they had codified a message in morse code, and the output, in addition of dots and dashes, had commas and semicolons. The underlying "message" may have anything, but if you are showing it in morse (eg. for radio transmission) you wouldn't have commas.

  It there a way to delay encryption that would explain the date differences?

It's not that the encryption is delayed, but that the message is encrypted 3 days before the encryption key was created.

As if there could be plausible explanation, they could have generated the key in one computer, then used it in a different one, with one of them (or both) with the date set wrong. Most probably though, they were two pieces recorded recently, with the dates set manually in the past, and nobody smart enough to notice that the generated dates were inconsistent.


With just a PIN and no TPM (or removable key storage such as a USB drive or a smartcard that you need to insert to boot), it's impossible to have any meaningful security against an adversary who can access the encrypted drive. It's only a protection against someone casually walking to your desk, inserting a USB stick and rebooting your computer from the stick.

The adversary can just try all possible PIN, since all the information needed to decrypt the drive has to be present on the drive apart from the PIN. There are too few possible values for a PIN for it to be more than a moderate barrier to attack. For example, if unlocking takes 1 second of CPU time (which is an overapproximation), then a 6-digit PIN will resist for less than 12 days. A 4-digit PIN would fall in less than 1 hour and even an 8-digit PIN is manageable in 3 years of cumulated CPU time.

A strong password is a different deal because there are far more candidates for the attacker to try. A “correct horse battery staple”-type password (4 randomly generated words) would resist for around 300,000 years of cumulated CPU time.

A TPM changes the deal because when it's available, the encryption key is not derived from the PIN, but stored in the TPM. The TPM adds an additional protection: if there are too many failed attempts at guessing the PIN, it locks itself against further attempts. For the adversary to have a meaningful chance of decrypting your data, they would need to attack the TPM itself and extract the key from it, which is a lot harder than plugging the hard disk into a PC and making its CPU churn.


Is there a way to evade -Wformat-security?

You must keep secure format of the function and with using to junk arguments bypass format-security.
for example printf(var); is 100% unsafe format ! and compiler able to detect it, but printf(var1,var2) (it can be safe and also dangerous) ! the compiler is not smart enough to detect .
You can use a code like it printf(argv[1],"junk");

For Example

#include <stdio.h>
#include <stdlib.h>

int main (int argc, char * argv[])
{
  printf (argv[1],argc);
  //              ^^^^---------> Junk :)
  return EXIT_SUCCESS;
}
/*
sajjad@xxx:~$ gcc -m32 -Wall -Wextra -Wformat-security -std=c99 a.c
sajjad@xxx:~$ ./a.out %n%n%n
Bus error: 10
sajjad@xxx:~$ ./a.out %s%s%s
Bus error: 10
sajjad@xxx:~$ ./a.out %x%x%x
bffcfb242bffcfb88sajjad@xxx:~$ ./a.out %d%d%d
-10747629722-1074762872sajjad@xxx:~$ ./a.out %s
???|???sajjad@xxx:~$
/*

/*

#include <stdio.h>
#include <stdlib.h>

int main (int argc, char * argv[])
{
  char outbuf[32];
  char buffer[32];

  if (argc < 2)
  {
     fprintf (stderr, "Error missing argument!\n");
     exit (EXIT_FAILURE);
  }

  snprintf (buffer, 28, "ERR Wrong command: %8s", argv[1]);
  sprintf (outbuf,buffer, "junk");
  //                      ^^^^^^---------> Junk :)
  perror(outbuf);

  return EXIT_SUCCESS;
}

*/


HTTPS POST request header versus request body

If the transport itself is secured (i.e. https) an attacker can not sniff the data. But it might be logged at the server side and the server might later be compromised or some security leak might cause the log files to be publicly visible. Such log files usually contain the URL and they might contain other lines from the headers like User-Agent, Referer and other headers if specified with a custom log format. Thus it might be a bad idea put these API keys into the request header, unless you make sure that they don't get logged.

An argument against putting the key in the request body is that it now would be possible to create a simple HTTP form which includes the key which is easier to be used as a CSRF request. When including the API key as header instead the attacker must be able to do a XHR request and is subject to the restrictions of CORS.

Another reason for not including the key into the URL is that it might get included into the Referer header of a following request. Also the URL's are usually contained in the browsers history so that you have another place which could be compromised. This is relevant only for normal browser requests, i.e. XHR or REST requests done by applications are not affected.

Some explanation about the meaning of "header": sometimes one uses the name 'header' to distinguish the initial part of the HTTP message and the body. In this case the URL is part of the header (request line). Other times one talks about the headers (plural) and means the "field:value" pairs only, i.e. not including the request line with the URL. It is not fully clear for me which meaning is used in the question so I better covered both.


Is it harmful to redirect web bugs to localhost on hosts file?

My guess it that the Wikipedia author is referring to IE Security Zones, where the DNS name or IP address grants additional functionality to things like

ActiveX controls
Javascript
Execution of non-signed data
Access to internal (read corporate file server) data.

More info here


Can my VPN provider see the name of my WiFi?

Yes but this is not an issue with the VPN protocol per se its more an issue with data leakage of traffic exiting through that connection.

Specifically there are many ways in which geolocation can be done against the client via a number of protocols. In your case the most relevant one would be using client-side javascript to capture the wireless SSID and comparing it to a geolocation database of wireless SSID's. If ANY web server requests this data while you are using a VPN provider that information will also be sent via this connection. A more malicious VPN provider could also MITM a cleartext http session and easily add a request like that in (note: I'm not saying VPN providers do this and most likely they don't because they don't really need too in order to determine your location as most clients will leak that information via normal usage).

Note: This also means some web servers will know your SSID too.

See the Wi-Fi based positioning section and javascript geolocation demo on the following web page:

https://mobiforge.com/design-development/html5-mobile-web-a-guide-geolocation-api


Automated server security testing best practices?

There are a number of scanners out there which aren't free. Like Nexpose or Nessus which can do way more than just scanning a webserver. But they provide this functionality as well of course.

The interesting part is that these scanners can also log into your server and perform configuration reviews to a certain standard. For instance the DISA STIG is a very good baseline to test against and see if you have properly implemented your webserver in a secure way.

Aside from that, you can also test the application itself, with automated scanners like Burp or Appscan.

Another option would be to use ASV. They are normally only used for PCI-DSS compliance, but you can also use them of course even if you needn't be compliant with PCI-DSS. Their baseline scans and reports are a very good baseline assessment to see what the level of security is, as the PCI-DSS requirements are not light at all.


Using OpenSSL v1.0.1g, am I creating SSL certificate or TLS certificate?

SSL and TLS are the same thing.

To be precise, SSL is the "old name": it means Secure Sockets Layer. It was the name of the protocol originally defined by Netscape. The last version of that protocol (SSL 3.0) has been later on published as RFC 6101.

In early 1999, the protocol was turned into an IETF standard, not something owned by a private corporation. This implied a change of name, both to symbolically assert the will to push the protocol into the public, implementable by anybody, and also to avoid intellectual property issues. The new name is Transport Layer Security, aka "TLS". This also expresses the idea that TLS can be applied to various transport channels, not just sockets.

So TLS 1.0 was published as RFC 2246. The authors took the opportunity to iron out a few historical quirks, meaning that TLS 1.0 is very similar, but not completely bit-to-bit equal, to SSL 3.0. Down on the wire, TLS 1.0 clients and servers actually announce the protocol version as "SSL 3.1".

As for the certificates, there is no difference. "SSL certificate" is the colloquial term for "a certificate that is fit for a SSL server". Such a certificate would work equally well for a TLS server, and vice versa. Certificates exist outside of SSL/TLS, and there is no notion of SSL/TLS protocol version which would apply to certificates. There is no place within a certificate where it would be written "this certificate is for SSL 3.0" or "this certificate is for TLS 1.0".

OpenSSL is called OpenSSL and not OpenTLS because it is a derivative of an older library called SSLeay, which was written years before the name change to TLS. A contrario, the GnuTLS library, a competitor to OpenSSL, was started after the name switch, and is sponsored by people who value naming correction over pedagogy (let's face it, the "SSL" acronym remains much more widely known and understood than "TLS").


Do my Windows system binaries contain sensitive information?

Everybody's (me included) reflex answer to such a question will normally be: Huh huh huh (falls off chair). No! How would you think this could even work? Executables are signed nowadays, which prevents them from being modified!

However, if you consider "exe" files in general, not just those from a fresh naked Windows install, the answer must be: Careful!.

Some executables (an increasing number) are specially crafted for you. And yeah, they're signed, doesn't make a difference.

This includes at least some, but more likely most executables you downloaded from one of those modern software-as-a-service or online shop or whatever you call them things. Adobe, Steam, Office360, you name it.
I don't know the technical details about each and every of these, they're just examples that came to my mind as possible candidates. It is however certain, that among other methods, custom-signed executables exist (not just on PC, for example the Nintendo shop definitively works that way).

So, if your Windows system is not just a Windows system, but one that includes custom-signed (or what would one call it? custom-branded?) executables, then you may give out sensitive information.

Also, not all executables are the same version, and not all executables are present on every computer. Unless one also considers file creation dates, it is probably a bit far fetched to say that they provide a unique fingerprint, but this information could certainly be used to more or less identify your system, with a little error margin.

While in theory, there's probably enough combinations of features and versions to identify every atom in every computer, in practice most installs will have mostly the same features, and mostly the same versions. Which amounts to maybe a few dozen million real permutations. But still, if it's a problem that someone might tell that's this-and-that combination points to your specific computer with, say, 85-90% likelihood, then... be aware.
Mind you, it's not so much different with genetic analysis, although of course numbers are much bigger in that case. Folklore tells us that siblings are 50% genetically identical, but in reality, complete strangers are 98% genetically identical. That's because, well, they need these genes in that particular composition to even exist (you will be surprised how much you have in common with, say, a rat or a bunny!). But even if people are mostly identical in almost everything, there's enough in the small, remaining bit to tell quite a lot about someone.


Generally the solutions to this problem are:

Don't store sensitive data in memory (could be dificult to achieve in some cases);
Encrypt data stored in memory (raises the problem of managing/securing encryption keys);
Minimise the time sensitive data is stored in memory (i.e. scrub [overwrite] it as soon as it is used, then find a method to obtain it again if needed);

For the purpose of authentication, the password is required once to verify the stored hash, after that it won't be needed any more until the next login.

Memory based attacks are relatively complex and usually require physical access, so keep that in mind to assess your business risk.

Above all, make sure whatever is left in memory (even temporarily) or on disk that is sensitive data cannot be reused elsewhere (i.e. on another thick client) - this is where the big risk comes in. Static keys shared across multiple (all?) devices, accounts that work elsewhere, shared local passwords and local secrets, private keys, etc.


XSS attack remediation in older technologies

Fundamentally XSS is one of:

Failure of input validation
Failure of output escaping

If you have well known data entry points you can potentially clean all input. If you must preserve special characters and formatting then you must also escape output. Output escaping is non-trivial and depends on the context of the output (e.g. in a link, in an anchor, in a text block, in a form field). It's well worth using a standard library to carry out this action.

This OWASP article has more information: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

A web application FW may also provide some level of protection if configured correctly depending on the nature of your data.


Yes, that's the point. Technically, the parameter which is non-secret but alters the hashing process is called a salt. The salt is as powerful as it is unique; the more unique it is, the more it prevents attackers from doing parallel attacks (precomputed tables such as rainbow tables are a kind of parallel attack, if seen in the proper space-time referential). In WPA/WPA2, the SSID is used as salt on the basis that different WiFi routers will use different SSID.

This is not 100% effective: since each user can choose his SSID, without a global SSID allocation system, some SSID values are widely more popular than others (the default values chosen by manufacturers also lead to high SSID reuse). This site, for instance, reports that as many as 2.357% of all WiFi routers use "linksys" as SSID. This prompted some people to actually compute rainbow tables for these most common SSID and passwords (e.g. there).


Made my password a few characters over the 64 character count and can't mount

In general, when you make a password that's "too long" for a system, what actually happens is that it gets truncated to the system's max length, then hashed, and the result of the hashing function(s) is used for authentication purposes.

Therefore, the general approach to getting access when you created a password that's too long is to truncate the password yourself.  In this case, your password is likely to be the first 64 characters of what you chose as your password, based on veracrypt's max password length.


What is this kind of low-intensity, non-hacking attack on a web service?

This sounds like the behaviour of an uptime service. These connect from multiple locations at a regular interval, and are designed to alert the server owner in the event of problems.

In this case, it looks like the server owner had set up such a service, and then forgotten about it, since the server didn't have any problems - the alerting service wouldn't send alerts unless there were issues, so it's easy to forget about them.

Answering question in comment: why perform extra checks? Several reasons:

Verifies that an issue exists on the target server, rather than on the testing server
Allows for geographical testing, by making requests from multiple locations
Allows for more complex tests, such as response times, whilst avoiding network problems which might affect individual servers
Ensures that the uptime service itself doesn't suffer outages from single servers going down!


[This answer was true in June 2016.  It is not in $NOW; see Wikipedia.]

Yes, StartCom is a legitimate Certificate Authority.

On the plus side, they were at one time the only provider which would hand out free SSL certificates which were recognized by the major browsers.  (There's competition now in Let's Encrypt).

On the minus side, their web site design and implementation is clunky, non-intuitive, and lacks pretty.

(The danconnor link @ZN13 provided appears to be someone wanted more pretty and didn't expect rigidity out of the CA process...........

............you should expect rigidity out of the CA process.)


What is this PowerShell script sending Discord info to random server?

Checking the domain and it's siblings on VirusTotal can be useful.

According to VirusTotal the parent rblx.dev domain points to an IP (91.195.240.94) which looks like a malware command & control server. So I'd say chances are high your PC has been compromised, and you might want to reimage it entirely (particularly as whoever dropped the scripts has elevated privileges already).


Both UIDs are signed by the key, and the public part of the key is, well, public.  Therefore it does not really make sense to use only one of the UIDs to sign something.  You sign with the private key, the same private key which signed both UIDs (that's how you verify that something came from that UID).

You can of course make two copies of your ~/.gnupg directory (or the equivalent on MS Windows) and run:

gpg --edit-key <key>
gpg> deluid 1

On one copy and

gpg --edit-key <key>
gpg> deluid 2

On the other.  And use one copy on your personal machine and another on the work machine.  The resulting signatures from both would be absolutely the same, and, moreover, if you upload both to a keyserver it will likely merge the UIDs once again.

The only real advantage would be that a person with access to your work machine would not know your personal email.  And vice-versa.  (All that given that you do not upload the public key to a keyserver of course).

All that said, I'm pretty confident you are after two keypairs (or even keychains): one for work matters and another for personal matters.

If you need badly the separation between work and personal projects, two keyparis are definitley the way to go.  And managing two keypairs/keychains instead of one isn't a big overhead for GPG or even key backups.


XSS prevention in single page web applications

But I don't think the above protect my application from all XSS attacks. Do I need to anything more than the above?

These headers will not magically protect you from all XSS attacks. X-XSS-Protection only lets you tune what the browser does if its heuristics detect a potential XSS (reflected XSS only). And X-Frame-Options is not about XSS at all but about preventing Clickjacking.

As long as your application needs Javascript there is simply no magic header which will prevent XSS. You can limit the impact of potential XSS with a strict Content-Security-Policy but other then that you just need to have proper coding, validating and sanitizing all input etc. See OWASP: XSS Prevention Cheat Sheet for more information.


Protect password/authenticating during transit over (insecure) TCP socket for a game

As Martin suggested in the comments, I would highly suggest using TLS. Even if your audience is young teens, disclosing the salt to the client is not a good idea.

For example, what would happen if the salt for the hashes is hard-coded into your web application and an attacker exploits a vulnerability to extract the bcrypt password hashes? If the attacker can determine the salt from the client, then the attacker can start cracking the password hashes with less effort.

Some good resources on why you shouldn't roll your own crypto can be found here and here.


OAuth provider that authenticates only by phone?

There is not, it's not based on FIDO

Look up sim swapping.


Here are three ways.

To expose network configuration and related flaws, security issues can be detected using what is known as a penetration test or pen test.
To expose application-level flaws, security issues can be detected using an AppScan.
Automated tests aren't perfect, and aren't very creative (they just run scripts looking for known weaknesses) so if you're really interested in security you can hire a white hat cracker to try and bust into your system and create a report of issues.  Sounds like you are already serving in that role, sort of, and there are people who do this sort of thing professionally as well.


How do I use "openssl s_client" to test for (absence of) SSLv3 support?

OpenSSL s_client
To check if you have disabled the SSLv3 support, then run the following
openssl s_client -connect example.com:443 -ssl3

which should produce something like
3073927320:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1258:SSL alert number 40
3073927320:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596:

meaning SSLv3 is disabled on the server.  Otherwise the connection will established successfully.
Nmap
Alternatively, you can use nmap to scan server for supported version:
# nmap --script ssl-enum-ciphers example.com
Starting Nmap 6.47 ( http://nmap.org ) at 2014-10-15 03:19 PDT
Nmap scan report for example.com (203.0.113.100)
Host is up (0.090s latency).
rDNS record for 203.0.113.100: edge.example.com
Not shown: 997 filtered ports
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https
| ssl-enum-ciphers:
|   **SSLv3: No supported ciphers found**
|   TLSv1.0:


There are many factors but these are some:

They're non-standard binary files. Not based on XML/JSON/YML/etc, which means that each Adobe product developer has to reinvent their own parsers, which is one of the most difficult and tedious tasks for programmers.
These files are often designed with efficient processing, with little thoughts given to ease of writing secure implementation. For example, PDF contains an xref table, which contains the byte offset that programs have to seek() to find sections. If that's not bad enough, this xref table is located at the end of the file, necessitating PDF parser to read the file backwards from the end of the file. To add even more to complication, there can be more than one such xref tables in a single file, and some entries can be inactive or overridden by later entries.
The binary format can contain conflicting information. For example, a PDF section can be specified in different ways: each section contains the length of the section in ASCII numbers, an "endobj" marker, and entries according to the xref table. These conflicting informations means that different parts of Adobe's product and different implementations may rely on different ways to interpret the same section.
These file formats can contain Turing-complete executable code. A PDF file can contain Javascript code, a SWF file can contain ActionScript. Like any other document macro language (e.g. VBScript in MS Office files, JavaScript in HTML), these Turing-complete languages are a source of bugs of their own.
PDF touts itself as a format that should look the same everywhere, and you can open ancient PDF and expect it to render the same in modern readers. Some ancient PDF generators produced faulty PDF, which happens to rely on a bug in the old Reader/Acrobat. Rather than fixing the program and rejecting these faulty files as corrupted, Adobe programmed these hacks to keep these faulty files readable. Unfortunately, these hacks aren't documented, so it makes it difficult for other implementations to keep up with Adobe on how exactly to parse these malformed documents.
The formats have massive amount of features that's tangential to document formatting. Rather than using separate layers, Adobe like to implement everything in their own format specification. For example, many document formats like ODF, DOCX, JAR are simple XML/Class or and other metadata in a regular zip file. PDF intermixes compressed format into regular data stream, you can't just use a regular zlib decompressor to get uncompressed PDF. Same thing with digital signatures and version control.

Adobe is still making a lot of money despite these problems, which is probably the biggest reason why they don't really feel the need to care to change their developer culture.


How NTLM SSO is preformed on smartcard Kerberos logon?

When you do a PKINIT authentication to the KDC an additional field is included in the krbtgt response in the PAC called PAC_CREDENTIAL_INFO. This includes supplemental credentials for your logon such as the NTLM hash and the data is encrypted to the PK (DH) session key. The PAC is stuffed into the TGT where it's unreadable by the client.
The client then requests a service ticket to the workstation, asking for the workstation ticket, using the TGT it just received. KDC obliges, and copies the PAC from the TGT into the service ticket, including the supplemental credential data. The client receives the ticket and can now decrypt the PAC. The client still has the DH session key from earlier, so it decrypts the encrypted supplemental credentials and if it contains the NTLM hash it processes as it normally would if it were a password logon.
https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/2f9cae55-350a-423e-a692-1d16659e544a


How to copy Subject Alternative Names in csr while signing a cert?

It is not possible to specify a SAN in OpenSSL solely at the command line*.

FWIW, I wrote a wrapper that allows you to do that by dynamically generating a temporary openssl.cnf behind the scenes for you:  one_genkey

  A script for creating Certificate Signing Requests from the CLI,
  hiding the OpenSSL config file complexity.

*Per dave_thompson_085's pointer to this answer, openssl 1.1.1 added an -addext option to req which will allow this.  The sheer ingenuity of contortions provided in all the other answers on that page are a testament to how big a pain this has been for all time leading up to openssl 1.1.1, and all those systems (cough RHEL) still languishing with something other than the head branch.


OpenID Connect, OAuth2, and deleted accounts

I was thinking that as part of the registration with their original OAuth2 provider (e.g. Facebook), I would request their email address

You can try to use the e-mail address as a unique key, and it might mostly work, but it's fraught with problems.

If the user registers with a Google Account or a Yahoo account, the provided E-Mail address will most likely be tied to the account. So when the account gets deleted, the E-Mail address perishes, too.
If a user deletes an account from an identity provider that is also providing the user with his e-mail address (see point 1), then a simple attack becomes possible: Eve can register a new account with the identity provider and reactivate the e-mail address, but now it will belong to Eve instead of the original user.
There is no guarantee that different identity providers will send you the same e-mail address for a given user. In fact, it's rather unlikely. So you won't be able to identify the "same" user based on the e-mail address in the ID token.

If you really need to have a user access his account despite his having deleted the account he usually logs in with, you need to set up an alternative form of authentication before he deletes the account. For example, you could let him link his account with multiple identity providers, provide him with an emergency "access token" that can be used to redeem an account (either directly or by asking for his phone number of an alternative e-mail address), or use any of the security question schemes other sites use.


Pubkey is INCLUDED in privkey
It's a bit confusing but the way these members of the keypair are saved is such that the pubkey is a proper subset of the information inside the privkey.
This means that all the information of the pubkey is contained inside the privkey structure.
So what the AWS guys are doing is using openssl's -pubout switch to derive the pubkey from the privkey and then take the checksum. And they compare that to the checksum that is DIRECTLY taken off of the pubkey.
Further reading
In depth explanation about how improperly and properly check if a cert's pubkey matches a privkey:

2017-07-20, Hanno Böck, How I tricked Symantec with a Fake Private Key (Archived here.)


Does sudo ever de-escalate privilege while the program/command/service is running?

As far as I know, starting a service with sudo will run the service with root rights. These will not be dropped during the lifetime of the service.

However, if you use su root you switch to root user and every command you issue will be executed as root. This is something you should be aware of and not start other services which do not require root privileges. In that sense it might be 'safer' to use sudo.
But that is more a user/administrator risk.


Odd requests to health_check.js show up in Fiddler

It's a Chrome extension.  What's happening is that some extension is injecting its own ads into webpages.  That way, they can get the revenue instead of the webpage you are visiting.

This JS file seems to be a blacklist of sites where they won't inject ads (or so, I am assuming).

Reference: http://stopmalvertising.com/security/bookmark-sentry-google-allows-ads-in-chrome-apps-and-extensions.html


ICMP here is not used to perform the MITM attack, but indirectly to enable it. In short, it's used to circumvent ARP spoofing protections:

Some MITM attack (not specified in the citation) is the goal.
ARP spoofing is used as a tool to alter victim's routing, helping in gaining MITM position.
Different operating systems handle unsolicited ARP responses differently i.e. the OS can reject them. The ICMP packet is used to make the victim's OS try and connect the machine it tries to reply. If the destination IP / MAC pair is not already cached, it invokes an ARP request. After that, the ARP response becomes expected.

Despite the chronological order is actually 3-2-1, the reasoning is easier to understand if you start from the expected results and then ask how to achieve them. In other words, you have read a story of the execution of an attack, whereas a story of how the attack was planned would have been more educative.


Can RSA (or any public/private key algorithm) be repeated for large amounts of data?

RSA encryption works on messages which are no longer than the public key modulus size (actually the limit is slightly below that, e.g. 117 bytes for a 1024-bit RSA key). The usual method for encrypting things with RSA is to use a hybrid mode: you create a random symmetric key (a bunch of random bytes, with a cryptographically secure random number generator), you encrypt symmetrically your data with that key (using a symmetric cipher such as AES), and you encrypt the symmetric key with RSA. Symmetric ciphers can deal with arbitrary length data. A symmetric key is rather short, typically 16 or 32 bytes, so there is no problem in encrypting that with RSA.

Be warned that you are in the process of designing your own cryptographic protocol, which is a very bad idea. Actually the first and foremost of all cryptography-related bad ideas. Even for something as simple-looking as asymmetric encryption of a blob, people who have tried to design such a protocol have gone through years of multiple versions and security holes, painfully plugged one by one. You should really use an existing protocol for that. One such protocol is OpenPGP. Bouncy Castle is an opensource library which has a C# version, and which includes an OpenPGP implementation. Use it, and you will live longer and happier.


Where does Active Directory store user hashes?

The hashes are located in NTDS.dit, although some software can inject into the LSASS process and extract them in-memory. In terms of which DC to use, this data should be replicated across each controller. You may see minor differences where a password has been changed on one and not yet copied the others (more on replication timings), but it is likely that the majority will be up-to-date.

quarks-pwdump expects you to use the Volume Shadow Copy method (utilising Volume Shadow Service - VSS) to retrieve NTDS.dit manually. The tool can then be used to parse hashes from this file. This in is contrast to dumping local hashes where the tool injects into the LSASS process. Using VSS (or registry backups for local dumping) can generally be safer and quieter than using an in-memory technique. These should be preferred where possible, which may be what Quarks are trying to promote.

The VSS method is detailed here (although this is to dump the registry hives, so needs to be adapted to NTDS.dit): http://bernardodamele.blogspot.co.uk/2011/12/dump-windows-password-hashes.html

A follow up post on NTDS.dit: http://bernardodamele.blogspot.co.uk/2011/12/dump-windows-password-hashes_16.html

Once you've retrieved the file, you can use quarks-pwdump to parse it with -dhd and -nt path/to/file/NTDS.dit (which is a hell of a lot easier than using NTDSXtract).


How to create non-generic security requirements for an idea phase?

This sounds like a great application for threat modeling as part of the design process. If you’re unfamiliar, threat modeling is a technique involving the creation of threat landscapes, where a product/service/system is analyzed to find potential risks. Fundamentally, threat models are simply conceptual decompositions addressing potential threats, so they can really take any format. It’s common, though, to build visual diagrams of threat models to illustrate, particularly using a specific unified design scheme. Microsoft has a popular threat modeling tool for the visual task, and OWASP has a project for an OSS threat model diagramming tool as well. Good luck!


Are Sun/Oracle's SPARC processors invulnerable to buffer overrun exploits?

The problem with buffer overruns is that a buffer is overrun -- this is nonsensical, i.e. it is a bug, after which application code behaviour ceases to follow the pre-ordained plan.

The classical, let's even say primitive, method to exploit a buffer overflow is to overwrite the return address slot of a function, so that execution is derailed into a location that the attacker controls. This works only for stack-based buffers, and the industry has come up with various countermeasures to make exploitation harder for the attacker, e.g. canaries (to detect an overflow before using the return address slot) and ASLR (to make the jump less reliably controlled by the attacker).

The SPARC architecture includes register windows, which can be viewed as a dedicated in-CPU stack, kept outside of the main memory address space. Thus, it can be construed that SPARC are somehow "immune" to buffer overflows since the return address slot cannot be overwritten with a memory based access. However, this is not true, for the following reasons:

The register windows are only in limited number (at most 32 in the architecture definition); when the call depth exceeds the number of windows in the CPU, an exception occurs and a dedicated routine flushes some of them into RAM, to be loaded back at a later time. Thus, the windows really work as a cache over RAM; consequence is that a return address slot can still be overwritten in some cases.
There is more than the return address slot in life. Basically, any field that functionally contains a pointer to some code is a nice target for attackers. Object-oriented languages such as C++ are full of such slots, both on the stack and in main RAM (these are called vtables). The return address slot in only traditionally the main attacker target, because 20 years ago it was the easiest to reach. (A famous exploit that leveraged such non-stack function pointers after a buffer overflow was the PS3 Jailbreak.)
Any overwrite of data can be helpful to the attacker; though injecting his own code gives him the highest power, other kinds of overflow can still lead to successful exploitation. Think, for instance, of the heartbleed bug which was all the rage a few months ago; it made thousands of sysadmins and so-called security experts scream and run around in panic ("like headless chickens", as they say around here); and yet it was only a read overflow, where nothing at all was overwritten.

A crucial point is that all these canaries and ASLR and register windows are just ways to try to cope with the aftermath of the overflow. The application has still derailed, and data was still damaged. It would be much better to act a little bit earlier, and prevent the overflow from occurring. Ideally with rigorous compile-time analysis (possibly with the help of the compiler), or at least by blocking the overflow attempt at runtime, turning it into some exception: the application still stops functioning properly, but at least it does so cleanly, without blindly keeping on with damaged memory structures.

Thus, for defence against buffer overflows, the interesting technology acquired (and then killed) by Oracle is not SPARC, but Java.


Is Enabling DEP (Data Execution Prevention) For All Programs Worth the Risks?

To understand what DEP does, you first need to know a little bit about how memory is laid out in a process.  The key concept is that code (instructions the CPU can execute) and data (stacks and objects) exist in separate areas of memory.  User input, files, program data, etc. all live in the data areas of memory.

DEP allows this separation to be enforced by marking the code pages in memory as "executable".  By similarly NOT marking data pages, the processor can now recognize when a region of memory is intended for CPU instructions and when it is not.  As a protection, the CPU will fault, allowing the OS to terminate the process when DEP is enabled and the processor finds itself trying to run code from data memory.

In summary, this means that a user cannot simply input data containing executable code and, through a vulnerability, point the processor's instruction pointer to that data, and begin executing code, as was previously possible before widespread DEP adoption.

As a security mechanism, this is one strategy to mitigate an exploit running arbitrary/malicious code on a system.  However, modern exploits are typical able to defeat DEP.

I've not encountered a program that cannot handle DEP, ever, and I've had it enabled since it was first offered in Windows XP SP2.  That's not to say that there aren't programs that might be disrupted by it but modern programs, even immensely complex ones like web browsers, are able to operate when DEP is enabled.

Given hardware support for DEP as indicated in the screenshot above and widespread modern application support for DEP (as well as more advanced mitigations like ASLR) you shouldn't notice any performance differences with DEP enabled and there's some additional security provided over having it disabled.  Given this, I see no point in running DEP for system services only: there's no harm in running it for everything.  If you encounter something that is crashing due to DEP, you could add that individual program to the blacklist though I'd also consider finding a product that's more current and I'd absolutely not allow an Internet facing application to run without DEP (and all other available exploitation mitigations) enabled.  I'm not aware of risks caused by enabling DEP globally: I'd assert that your accepting risk by not doing so.


nmap giving different scan results based on scan type

Your first command line, nmap -p 1-65535 hostname, specifies all 65535 ports will be scanned.  Your second command line does not specify which ports to scan, so nmap will default to the top 1000 ports.
The difference between your two scans is the set of ports you're scanning.  The second scan is a small subset of the first, and so its results are a subset of the first scan.
Both scans are scanning TCP (implicit -sT on the first, explicit -sS on the second) and the second scans UDP as well (-sU).  The amount of UDP findings was probably very small if anything; it's really the number of TCP ports scanned that's making the difference.
Try adding -p 1-65535 to the second command line to equalize the scans.


The RFC's dont technically deal with standards for code signing or TLS/SSL per se. Rather, they set the standards for x.509 certificates and PKI. Such as how you should construct a x.509 certificate using asn1 (RFC 5280) and then how it should be encoded to create a certificate.
The standards for TLS/SSL and code signing certificates which are issued by Certificate Authorities (CA's) such as GlobalSign, Digicert, Sectigo, etc are subject to the CA/B forum Baseline requirements. Code signing certificates for the Windows ecosystem fall into this category.
However, if you are signing code on Linux you might be using a PGP certificate and key to apply the signature. In this scenario, you would be using the PGP web of trust instead of CA's.

As I understand the SSL/TLS/https certificates rules are specified by the RFCs. Mixed use of servers and clients from different vendors will just interoperate without a problem. Does such kind of standard ways exist for software signing?

Code signing, document signing, TLS/SSL, S/MIME, are all examples of different types of x.509 certificates being used for different purposes. The x.509 certificate and key files are essentially cross platform because they all adhere to the same RFC's on how to construct and use the files. You can use the x.509 certificate to apply a digital signature to a file. How to construct digital signatures is (I think) in RFC 2315.

Or is that each software OS would use their own way of signing and need the package vendors to follow? Or ask in a specific situation, if the package signing is working well on a Linux system, would it work on other OS or platforms?

How each OS handles the signatures varies. Windows requires code to be signed using a code signing certificate issued via a CA. If the code is executing at the kernal level, then you have to buy a EV Code Signing certificate and submit the code to Microsoft for review. Linux however does not require code to be signed by a code signing certificate. Instead, Linux uses the PGP web of trust to verify PGP signatures in the repository. Packages ported from Linux to Windows will not be trusted on Windows because Windows doesnt use the PGP web of trust. Same in reverse, Windows applications ported to Linux will not be trusted unless you sign it with a PGP key and you import the PGP certificate into the clients PGP keystore. Apple also has its own requirements and you can find their documentation here.


Preventing dangerous CSV Formula Injection

I don't think that stripping some characters can be a strong solution, especially if you develop the functionality by yourself: someone could manage to bypass this check by encoding these characters for examples, and get the formula executed anyway (Maybe your CSV reader, i.e. Excel, parse the formula differently than you and execute it anyway). Best solution is to use already tested mitigations, like the one you mentioned of putting a single quote at the beginning of the string. Another solution is provided by NCC Group in this report:

  When performing a CSV Export, for any cell that starts with an =, -,
  ", @, or +, add a space to the beginning and remove any tab characters
  (0x09) in the cell. Alternatively, prepend each cell field with a
  single quote, so that their content will be read as text by the
  spreadsheet editor.


Renew access token for OAuth2 implicit grant

If you control the CAS then it is upto you how you access a new access token.

Since your user has already authorised the SPA using your CAS, if the session is still valid with the CAS there is no need to ask them to reauthenticate using their credentials.

Of course, it is upto your acceptable risk level for how long they should remain authenticated at the CAS. If it is a high security application, then you may wish to reduce the session timeout or ask yourself why the access token expiration has been set to expire earlier than the CAS session timeout.

Original answer:

Take a look at the Refresh Tokens section.

The session being valid at the CAS should mean that the user agent has a valid refresh token - this is what is needed in order to renew the access token for the user.

  Refresh tokens are credentials used to obtain access tokens.  Refresh
  tokens are issued to the client by the authorization server and are
  used to obtain a new access token when the current access token
  becomes invalid or expires

Correction: Refresh Tokens are not to be issued for implicit grants.

  The authorization server MUST NOT issue a refresh token.

The "presence" of the resource owner is only relied upon for initial authorisation.


Privacy concerns while traveling with HDDs

If any of your solutions are about the government not knowing how to decrypt or detect a filesystem is wrong. They have equipment to make anything, so don't count on hiding anything from them. If they are suspicious, they can simply confiscate your drives and you will never sww those again.

I would create a encrypted RAID 0 array (or LVM partitions) using both disks, and mail them using separate couriers, on separate dates, to separate destinations. Couriers are less likely to open your mail and read your disks.


How to protect my server from continous login attempts (Ubuntu)

Use key-based authentication for SSH instead of password authentication
Change your SSHd port to something other than 22 . This is security through obscurity but is probably justifiable in this case.
fail2ban users that try to connect on port 22 or try password authentication


The Cisco ASA config you have provided appears to use CISCO PIX-MD5 hashes.

Both the VPN settings mentioned above and the enable/passwd are not salted, contrary to what the hashcat.net thread suggests in Peleus's post.
It is worth while checking this site: Nitrix Hash Generator
In there you can enter 'cisco' as the password and you'll recieve the common

  2KFQnbNIdI.2KYOU

hash back out as you have in the above config. You can repeat the process for blank

If you've used oclHashcat-plus before, the following command worked perfectly to crack it on windows for me.

  cudaHashcat-plus64.exe --hash-type 2400 C:\Users\user\Desktop\hashes.txt C:\Users\user\Desktop\password.lst

On my machine i got about 70,000k/s with GPU acceleration.
I always recommend using a good word-list like this: crackstation's list


Q:Is there a way to only allow certain processes on my DMZ server to access the remote ports?

A: You need a UTM box or Next Generation Firewall to do that. These boxes can work with application layer of each connection and distinguish between different applications so you can allow only certain applications traffic to pass. A good example of a free box is SOPHOS UTM that you can test.


Verification code within mobile phone applications

The use of six digits allows you to have one million available combinations.

While you state "Is there a problem that two different users (with two different phone numbers) will get the same generated 4 digits code? if this is a problem, obviously 6 digits code won't resolve it" - well actually, no - a six digit code gives you more available numbers and for a company with a userbase measured in hundreds of millions of users the available combinations is an important factor.

The generation of verification codes is also discussed in this Stack Overflow question: "How to generate a verification code/number?".


OAuth token vs. application-specific password: any meaningful benefit?

Using an app-specific password requires going into the target service, generating a new app-specific password, going to the destination app (Thunderbird, in this case) and entering the credentials.

Using OAuth only requires opening Thunderbird, adding your account using your normal username/password, and then clicking a button to approve that you want OAuth to set the permissions up for you.  You never see the password/token, you have nothing to copy/paste, etc.  So, it's easier to set up (usually), is safer, in the sense that you never see the password/token and nobody could look over your shoulder to jot it down to use as a backdoor access (masquerading as whatever app you generated it for, even though it really isn't - there's nothing stopping you from using an app-specific password on multiple devices simultaneously), whereas the OAuth token is literally on an app-by-app basis (unless I'm misinformed).


Is it possible to use same certificate on several machines by exporting it?

Generally speaking, if you can export the private key and import it into another machine then yes you can use it on multiple machines.

This assumes that key is actually exportable, and that the bank isn't doing any other checks that tie the key to a particular computer.


DNS does not use ICMP. It uses UDP (and rarely TCP) port 53.

The firewall/router the captive portal contols either does not block that port or it is the DNS server and is responding.

All other traffic are of course blocked until you log in.

Response to comment:

For 2), UDP has no session control, i.e. it just sends a packet without checking if it has been received or if there's even any one to receive it. So it's impossible to know if a connection worked unless you managed to receive some response from the server based on the data you send.

If you did receive response, it is possible UDP packets are entirely unblocked (which I'd consider as a poor design for a captive portal.)

For 1), ping under different systems use different mechanism. Many use ICMP Echo messages, but some attempt TCP connections or send special UDP packets to force a response. Sometimes firewall rules are not set up to block them consistently, so ping is not always trustworthy in unusual network setups.


It really depends on the SOC and how it structures it team. In the real world Level 1, 2 and 3 analysts may be expected to build parsers/connectors to normalise logs for the SIEM.

Given the descriptions in your question however I would say that none of these roles are right.

The role I would expect to be handle this task would be a Technical Lead. Someone who’s job it is to administer and maintain the SoC tools.


Why do VPN Providers ask for installation of Root CA?

This allows the VPN server to decrypt your encrypted traffic. For corporate VPNs, this is common in order to comply with policies that require monitoring. It may also be used by free VPNs for the purpose of injecting ads, which could not be done otherwise. The reason they cannot get a legitimate CA to sign it is because they want a certificate that is valid for every site, including Google and Facebook and Stack Exchange. No CA will give vpncompany.example.com a certificate that is valid for google.com.

  With that in mind, does it even make sense to use VPN for privacy?

Unless your goal is to be able to safely use open Wi-Fi without risking some script kiddie stealing your passwords, then no, it does not make sense. The "private" in Virtual Private Network refers to IANA-reserved private IP addresses (e.g. 10.0.0.0/8), not the right to privacy or anything of the sort.

  how is this game working and no one is calling it out?

But people do call it out! A lot of people tell you VPNs are not useful for privacy or anonymity, but they're always ignored by the hordes of people who buy into VPN marketing schemes who suggest everyone buys a VPN. In reality, there are only three valid uses of a VPN, the first of which is the biggest one:

Internal networking (e.g. a corporate VPN to get you onto a company network).
Protect your data when using an insecure public network (e.g. at an airport).
Torrent relatively safely (for those who are too poor to afford a seedbox).

  Therefore, the solution I came up with was deploying my own Root CA certificate with my VPN client which will use it to verify my server and so they can connect to me.

No! Don't create a root certificate! Those are capable of overriding every other certificate. What you would want to create is a single self-signed certificate for authentication with OpenVPN (or whatever protocol you are using). There is absolutely no need for a root certificate in that circumstance.


WannaCry exploits a set of flaws in Microsoft's implementation of the SMB1 protocol.  Since these are implementation flaws rather than structural flaws in the protocol itself, Linux systems cannot be automatically infected, but can be if manually installed.  This is true regardless of if the systems are running Samba, Wine, or any other Windows-emulation layer.


Cyber security specialist vs. consultant vs. architect

Quick disclaimer: these types of job descriptions will vary from company to company and sometimes even between departments or HR staff. This is just my general impression after working in this field for quite some time now.

The required skill distribution (tech vs non-tech) largely depend on the project you are working on and your carreer step but generally you need a good technical background, ideally with experience in software dev, networking and other relevant fields. And project management skills should be a must for anyone working in the IT field. Customer - or interpersonal in general - skills will most likely be more important for consultants, as they are usually external entities with lots of customer contact.

As for payment, from my experience internal security staff gets paid more than consultants. But YMMV and - as with most of this topic - it largely depends on your company/potential future employers.

Consultant

Generally, you're providing IT security knowledge for a client because that client has no or not enough relevant knowledge themself. You're an external who is adding value to a project.
As for the skill set, it depends on the phase of the project and the type of the project.
For example, you might work for a client during the conception phase of a new e-commerce website. In that phase you need a good technical background and overview (know about secure design principles, methods to achieve the relevant parts of CIA and so on). Your main responsibilities will be to aid solution architects, business analyists and the likes to create a secure-by-design concept and try to catch potential vulnerabilities before they even come into existance.

Another example would be that you work during the implementation phase of said project. Then you will - depending on your statement of work with the client - also have a look on the actual implementation of the concept you supported. Then you need deeper technical understanding, know how the specific programming language works, know its pitfalls. E.g. if it's a C++ project, you need to know that buffer overflows exist and how to avoid them. If it's a JSP website, you need to know how XSS (and other OWASP-Top 10s) work and how to mitigate those vulns.

Architect

This position is most of the times internal and you could basically also act as the internal version of a external consultant. But just like any position, this can be fullfilled either by internal staff or external staff.
Generally, this is more in line with the common positon of CISO or internal IT security department. In that position, you should have a complete overview of your company's IT infrastructure and the protection mechanisms that are in place like IDS/IPS, firewalls, network configuration (DMZ/Bastion topography) and so on. You will be the one who tries to think like an adversary, anticipate which parts of your landscape are the "low hanging fruits" and where attackers might have a valid surface.

You also help design and secure other parts of your company's needs like knowledge sharing infrastructure, identity and access management and so on.

Specialist

TBH, I only heard this term as a "catch-all". It's kinda similar to when TV stations interview a "$RANDOMTOPIC expert" for a short segment. I have never met an "IT Security Specialist" in the wild and most of the time anybody has at least some field in which s/he specializes.


How can I spoof a phone call and make it appear to come from another phone?

There are many VoIP services that provide ID-spoofing functionality

Jumblo: Create an account and add some credit to it (10 Euros minimum excluding VAT), then install their Android app, login, the go to Settings and choose "Add Caller ID" then add the number. (Requires SMS verification) *

Skype: You can create an online number (15 Euros minimum) then add some credit to it (10 Euros minimum). Then go to the Caller ID page, and add the number you want. (Requires SMS verification) *

SpoofCard (10 U.S. Dollars minimum) (No SMS verification required)

SpoofTell (0.10 U.S. Dollars per call) (No SMS verification required)

* One way to acquire the SMS verification code from the target phone is by configuring the Caller ID number at the time the employee has left their phone unattended at a restaurant or a bar. Another possibility is by stopping the employee in the street and asking them to borrow their phone for an urgent call.


Is sharing a CSRF token between Rails apps secure?

Yes, there's no problem with using the same CSRF token since it is already sharing the same auth token.

As long as the token is regenerated per new session and both the API and the APP check that the CSRF token is associated with that particular session then this should mitigate CSRF.