Methods of mitigating threats from keyloggers

Is there a common method that such malware uses to send its collection back to the hacker? For instance, do they generally contact a server directly and separately, or utilize an existing connection through a web browser or other benign program?

Not with any consistency there isn't. Here's a range of methods Mr Hacker could use:

Listen, a-la simple shell script. Basically this method relies upon the attacker probing for then connecting to the port in question. Fairly naive and easy to mitigate - only allow outbound connections, ever. Do this in spite of NAT as IPv6 will make those NAT defences disappear.
Outbound connection by a component of the malware. These actually break down into further sections:

To some odd port number, like dodgy.site.example:1337. Clearly, you should be blocking outbound connections to ports you don't need, but in the context of a home environment this might not be practical.
Via email. Either to a known smtp relay, dedicated smtp relay or directly (MX lookup + straight to the mailbox). In any case, do NOT allow traffic out on port 25 or even 587. Identify either a local trusted relay or a remote one and only allow connections on port 25/587 outbound to that machine. Enforce TLS and authenticated login.
Looking like a legitimate protocol, e.g. I've connected to https://dodgysite.example but not talking that protocol. SPI/Deep packet inspection may find these sort of things, or it may not.
Actually being a legitimate protocol. Does an HTTP POST look suspicious to you? Me neither, but given I just want to get data somewhere, CGI will handle collection nicely and HTTP POST is probably allowed everywhere. Would make an ideal data submission vector.

In both of the above two cases, an authenticated proxy server might help, simply because it reduces the chance of an outbound connection as not all malware is capable of detecting or using proxies.

Several improvements can be made on these from the malware perspective.

Hooking another application and executing any of the outbound/inbound connections in the context of that process.
Using a rootkit to simply refuse to allow local (as in on the system) scanning software to even know the outbound connection exists.

What is the solution?

Well, probably the best way is to keep your computer clean in the first place. Prevention is absolutely better than cure, especially in the case of a kernel level infection. However, knowing you have a problem is clearly important too, so:

Intrusion detection systems.
Monitor logs for suspicious activity. Firewall logs, operating system logs etc. See IDS, but do it yourself too.

That's about it. If all the ports you don't need are turned off and you're passing all connections you want through proxies or reasonably scanning them, the best you can do is reactive defence in this case.

From a personal perspective, I am very much interested in Mandatory Access Control. I honestly think a lot of benefit can be derived from designating specific resources an application requires and I say that as a programmer as it helps define specifications. If you're using a platform capable of some level of MAC you might be interested in investigating it. I've also recently answered a question on Sandboxie which looks like an excellent piece of kit for Windows.


Why is CVE-2017-5461 rated Critical with CVSS Score 9.8?

AC:L means Attack Complexity is Low,
  Don't think so. as it require attacker to forge a special certificate.

I don't see why this should not count as low complexity. The attack does not require that the certificate is signed by a trusted CA since the bug is in parsing the certificate which is done before the trust chain can be checked.

  A:H means Availability Impact is high.
  how is this the case? why would a successful attempt break the
  availability of application?

From the bug description of what the attacker could do: "could cause it [the application] to crash or execute arbitrary code, using the permissions of the user running an application compiled against the NSS library.". In other words: the attacker can make the application to crash which definitely impacts the availability. Even worse, the attacker might be able to execute code with the permissions of the application which might further impact the availability and might also be used as a starting point to get deeper access using a local privilege escalation attack.


How to make a decent Certificate Signing Request (CSR)?

When you create the Certificate Signing Request, you simply need to specify what level of encryption you desire.

For example, for 2048-bit:

openssl req -new -newkey rsa:2048 -nodes -out Test.csr -keyout Test.key

There are a bunch of tools here that will tell you what command to use based on your Operating System and requirements: https://www.digicert.com/csr-creation.htm

When submitting your CSR, make sure you are getting a SHA-2 certificate, as SHA-1 will soon be obsolete.

For protecting against POODLE, as raz mentioned, it is not about the certificates installed. It is up to how you allow your server to authenticate encrypted communication. All versions of SSL need to be disabled on your server to force authentication over TLS instead.


How safe is it to open source access to MySQL database on github, only permitting SELECT query?

This is not safe to do. Do not expose MySQL servers to public access.

Any user with SELECT access to a MySQL database can execute a denial-of-service attack by performing queries which generate excessive CPU load. A simple example is SELECT BENCHMARK(1e20,1); performing a series of CROSS JOINs between large tables would have a similar effect.
Allowing an unlimited number of users to connect with these credentials may allow them to consume all available connections on the server, preventing other users from accessing the server.
Information about the source address and current queries being run by other users connected with the same credentials will be leaked through SHOW PROCESSLIST, even if the user does not have the PROCESS privilege.
Allowing any user to access the MySQL server may expose the server to exploits which require access by an authenticated user. No public exploits of this sort are currently known, but it is possible that one will emerge at some point.


Besides, of course, being a string that the script can search for in the server's response.

Thats probably exactly what it is.

  [D]oes this attack/test belong to a larger battery of well-known attacks?

There are countless test suites and bots, and it's quite simple to script your own. If you want to know what this particular one is up to, your best bet is to just look through the server logs.

Since it's trying random query parameters, it's probably just a bot black box testing anything that might work. I wouldn't be to worried about it. If you have a server on the internet, this is what you get.

Your desire to battle test your server is commendable though! Doing some pen testing or scanning on yourself is a great idea. I would not pick the scan based on what I find in the logs, though. Find a tool designed for the language and frameworks you are using.


Is it a good idea to notify a user that they signed up with a social-login account?

Generally, the fewer things you say, the better off you are. I wouldn't tell the user anything.

Actually, if you are going to use social login, I would recommend not having any other login alternative. All you really need is a user's unique identity (within your system) e.g. their email address. (Note: in some countries, you cannot use email as an identifier).

If you do offer social login, why go through the burden of maintaining username/passwords for those individuals? The day you get hacked, the damage will be minimal.


Associate guest orders with account if email matches?

No, no no.   This is not a good idea under any circumstances.  Guest orders are guest orders, period.  They require contact information, shipping information, and payment information...Always.

Logging in provides the convenience of having none/some/all of this information pre-populated, and it's a requirement for having orders automatically associated to an account.   Without a login process, you'd be essentially authenticating a user based on email address alone, which could never be sufficient.

The only reasonable compromise I see if that if a guest user creates an order using the email address of a known user, add it to a queue and the next time that user logs into the site you might then ask them if it was their order and if perhaps they'd like to add it to their account for tracking/record keeping purposes, and give them the option to either confirm or deny that it was theirs.

Associating it to their account automatically would simply be a bad idea, not only for the reasons that you and GoD have already stated, but from a user experience perspective in any case that isn't on the happy (designed use) path.


Securing Webservice from response spoofing?

Yes, it is possible for someone to potentially spoof your server to a client. However, that only introduces a risk to the client and not to your service.

Since you will be keeping track of the users credit on the server and you will similarly be validating authentication via the server, the user can't cause you any problems.

Surely, the worst that could happen is that someone inserts a spoof service on other peoples clients in order to obtain credentials. But there are far bigger and easier targets - not something you are likely to worry about for a long time. You would, in any case, reduce that concern by using HTTPS with certificate pinning so that the client browser knows when they are not on a valid site.


Easy way? Get whoever provided you the key file to give you a valid one, because they one they gave you is damaged or was generated incorrectly.

Without seeing the key itself, nobody will be able to give you more information than that, short of a lot of guesses of ways that the key could be invalid or a lot of instruction on the format of OpenPGP keys sufficient for you to recognize the problem with the key yourself.


What is the safest way to copy a file from an untrusted system?

If your adversary has access to U and is able to modify that .mov file, and if you're expecting an imminent threat coming from U, then there's no safe way to copy that file and run it on T.

An active persistent threat will find/pay for zero-day exploits and craft a version of the .mov file that will exploit a vulnerability in your media player, media libraries, codecs, or operating system.

Excluding such cases, I think the best way is to:

Update all the packages on your Linux operating system.
Copy the file from U on a storage medium (USB stick).
Disable all autoplay/autorun features on T and plug the stick in T.
Use the command cp in the command line to copy that file and that file only from the USB stick to T.
Unplug the USB stick.
Run the file using your updated media player.

Using this method you minimize the risk of cross-contamination from the USB stick, and you maintain (to a large extent) an air-gap between T and U.


Challenge-Response Application in E-banking

Thanks to comments from @Anders (thx!), I'm unsure if the password generator is a shared service or a personal authentication token like digipass or SecureID.

Password generator is a shared service

In this situation, Alice can only get the signed response H(R,K) by proving to the password generator that she is Alice by presenting her PIN. If Alice knew K, then she could calculate H(R,K) on her own. This would allow Alice to pose as any user to Bob. The communication would be:

Alice --> Bob: I'm Joe User
Bob --> Alice: R
Alice --> Bob: H(R,K) which Alice calculated on her own

Alice has now successfully spoofed Joe User.

Password generator is a personal authentication token

In this situation, the token is being used to implement 2FA. The something you know factor is Alice's PIN, and the something you have factor is the authentication token. If Alice knows the K that is stored on her token, then she can compute H(R,K) on her own. This would allow her to log into the system using only a single factor, namely something that she knows. While there are two somethings: her PIN and K, it is still only the something you know factor. As the whole point of the token is to implement 2FA, K must be kept secret from Alice.


Is there a way to bypass escape function in javascript?

Sure, lets say you have the following PHP code that is vulnerable to XSS:

<?php
print "<script>var t=escape('".$_GET['t']."')</script>";
?>

You can supply this file with the following XSS Prof of Concept to get an alert window:

http://localhost/xss.php?t=');alert('xss');//


Inspecting every packet leaving the system for sensitive information ?

What you're looking for is network data loss prevention.

There are some costly solutions from Code Green Networks, Symantec, etc.  One free and GNU GPL-licensed ones is MyDLP (specifically you'll want the MyDLP-Network product) that does this.


Can a website identify me if I go in privacy mode with a different IP ? Or should I use a different computer?

You can not be sure for that without testing because such websites combine more than one technique to identify their users. For example if you use the same computer with a reliable VPN, you still may be identified if the website in question relies for example on browser fingerprinting and/or operating system fingerprinting identification techniques.

Some websites can identify you even if you use Tor browser, VPN ... etc (after suspicion of bad behaviors a user may perform) as they analyze the way how you write.


Windows Credential Guard protects credentials but not the remote access with the same credentials?

Credential Guard is intended to protect derived credentials that can be used to move laterally between devices. This turns out to have a real practical impact to attacks because it increases the level of sophistication required. That doesn't make it perfect, but it does make it pretty good.

In order for Credential Guard to protect credentials it needs to understand how the credential is to be used. That limits it to credentials used for Windows auth. There's no way to reason about what any other type of generic credential is used for, so therefore it can't know how it can be used, and therefore can't protect it. Credential Guard could simply block retrieval of passwords, but doing things like that has a tendency to reeeeeally piss off app developers (and users) that listened to Microsoft and are doing the right thing and not rolling their own credential caches because it breaks something that's considered relatively safe.

But again, in this case though cached Windows credentials are protected. You don't get access to the raw credentials; you only get a ticket to the remote service on behalf of those credentials. You can only access that one service -- you can't take that ticket and access whatever you want. This breaks lateral movement. This is also why unconstrained delegation doesn't work.

Whether this is acceptable or not is a matter of whether you think single-sign on is a good thing. You don't get SSO if a user can't request a ticket to a remote service, and there's no way to distinguish between a real user running as some account, or an evil user running as some account.

For completeness there's also the logon cache which is used to validate interactive logins, but that doesn't store raw credentials either. All it stores is a hash used to validate incoming passwords.


What's the basis for recommending resetting my email password when an unknown account password is compromised?

This is the most salient part:

you should change your account password for that website, and also any of your other passwords that are the same as that password.

Many people are not security savvy. Some people reuse the same password across multiple accounts. Like both their email and bank accounts. This is what enables credential stuffing attacks to succeed. This is not saying that you are security naive. If the bank is sending this to everyone affected then they're reasoning that this situation applies to some amount of people involved. Remember that the credential dump included the email address associated with the password. The second attack to attempt would be checking that password against that email account.
I have to send out these notifications from time-to-time. I prefer adding some additional suggested steps:

Change your password for the affected service.
Choose a strong password (password strength advice goes here).
Do not use the same password across multiple services.
Use a password manager (suggestions go here).
Do not use your corporate email address for personal business.

Suggestions 2 and 3 go towards defeating credential stuffing. Suggestion 4 is meant to make suggestions 2 and 3 less painful.


Mobile numbers capture and transmit data

Yes,

You can build a GSM basestation using an USRP and the OpenBTS.

What you do, is announce that you are a basestation for i.e. AT&T, and if you have better signal power than other basestations in the area, AT&T cellular phones will start connecting to your basestation.

Normally, the mobile phones would encrypt the sent data using keys that only AT&T knows, but if you tell the phones not to encrypt, they gladly oblige.

At this point, you will be acting as their basestation. You can intercept calls and SMS's. And you can of course also send SMS's to the phones associated with your basestation.

You will not be sending messages to their phone numbers, but you will sending it to their ISMI's.

More random links:

Airprobe, Monitoring Gsm Traffic With Usrp (Har 2009) - http://www.securitytube.net/video/574

Gsm Srsly (Shmoocon 2010) - http://www.securitytube.net/video/924

Gsm Security At Brucon 2010 - http://www.securitytube.net/video/1293


LUKS is just the encryption to the disk itself. LUKS can exist on any partition and the filesystem is whatever it has been formatted to. If you're running ZFS and you create a /dev/loop point for it and encrypt it with LUKS, you'll be running whatever file system you use to format the /dev/mapper/device, in an encrypted container, on top of zfs. Ex: EXT3|LUKS|loop|zfs

Learn about using lvm. You'll thank me.


Is it safe to expose port 22 on a database VM?

I have a VM in the cloud (Azure), which will be hosting my production
database. Is it safe to have port 22 open for my SSH connection?

No, it is not safe.
While I'm not sure why you'd need this in the first place, this allows for anyone on the public Internet to connect to your database. Even if you have certificate-based, multi-factor authentication in place it is still not safe. There is no need to needlessly expose your database. You should configure a bastion host (or Azure equivalent), or ideally a VPN connection to your network for management and allow port 22 between those two servers.

it also has a public IP address, is this safe too?

It's safe for some servers, but not your production database. The reasons for this are the same as exposing port 22 because the concept is the same regardless of port exposed when it's your production database you're talking about.
The overall idea here is to create a secure architecture -- the best way to do that is limiting interaction with your database. Especially direct access. See multi-tiered architecture. That's the Google Image Search for it since pictures explain it much better than text. But here's the Wiki on it.
If this is for a personal project, ask away and experiment. If you leave port 22 open to the world I guarantee you'll have people trying to break into your system in <24hrs, but you can always restore to a snapshot or tear it down and build a new VM entirely.
If this is for a true production database for a company and you are tasked with building out the architecture, you need to hire a consultant. I don't say that as an insult, but there are a thousand ways this can go wrong and it would be best to hire an expert.


On the days of stateless firewalls, was there any reason for using firewall in the place of router?

The first generation of firewalls was only simple layer 3 device

I don't think this is true. Contrary to routers the first generation of packet filter firewalls already worked at layer 4, i.e. they could filter TCP and UDP traffic by port number already and thus selectively allow access to specific services like SMTP (port 25) or HTTP (port 80).

The most important difference between these stateless packet filter firewalls and the current stateful versions is that stateful has the concept of connections while stateless had not. This means especially that with a stateful firewall it is possible to accept incoming packets matching outgoing connections while with stateless firewalls this is not possible.

Because of this a stateless firewall offers not a lot protection for hosts which work as a client, i.e. which are the source of outgoing connections. But it is useful for hosts which only work as a server, i.e. where only connections from outside gets accepted on selected ports. And even today it can make sense to not always track the state for such incoming connections because state tracking needs more resources both in memory and processing time.


Wireshark can't decrypt WPA2 LAN traffic

OK, let's start with the basics, to decrypt the traffic you need the PTK (Pairwise transient key) which is dynamically generated every connection (hence you need to capture the 4-way handshake) and is derived from the PMK (or PSK) which is generated by the PBKDF2 and has two inputs (It has more but are hardcoded) that you already have.

For Wireshark to decrypt the traffic it needs the capture the four way handshake (From here it takes the ANounce, SNounce and MIC to verify if the PTK matches the conversation) and provide the PMK.

To provide the PMK just add the passphase to the 802.11 key list in Edit->Preferences->IEEE 802.11 with the right syntax

wpa-pwd:passphrase:SSID
OR
wpa-pwd:passphrase

The SSID is optional, Wireshark can get it from the handshake when it sees it.

IF YOU USE wpa-psk: you need to manually compute the PMK (PSK) with the PBKDF2 function and write the output (256-bit key) after it, like this:

wpa-psk:47389...30413

Here's the guide from the wiki. Maybe you're just missing the wpa-pwd: in the key field.

  pwd in format pass:ESSID

FINAL SOLUTION

In Wireshark select the channel in which the AP in on. (Provided by doremifasolasido)


To what extent should we defend against leaked credentials being tested against our system?

Strongly consider converting to 2FA emails for first-time computer registration.

"Dear Andy Savage, we've noticed this is the first time you've used this browser to log in to our service.  To help keep your account safe, we've sent an email to your registered email address at a****e@g****.com.  Please click the link in the email to confirm this really is you."

Most of your customers have already received a dozen such letters, and will barely notice the "inconvenience" you're imagining.  If they bother to consider it, they might believe you're doing some magical security things that they don't understand, or they might think you're just blowing fake security smoke at them.  And yes, some will be confused and/or frightened because it's not what they expect.  You can minimize that by gathering existing login info now, and pre-setting cookies on all their existing browsers today so that they never even see the prompt.

Whatever fallout you get from this will pale in comparison to the blame you will receive for any Account Take-Overs that happen.  It's one thing to confuse them, but they'll have a completely different reaction if they think that you were hacked or you allowed them to be hacked (hint: most clients can't or won't make the distinction.)


Modern hashes like SHA-256 provide a strong protection against hash collision attacks, that is it is practically impossible to create a different program which has the same hash as the original program - no matter if the size is the same or differs.

This still leaves the possibility that the attacker not only modifies the file but also the accompanying hash, which means you have to find a way to transfer the hash in a secure way to the user.


This is precisely as secure as depositing a check at the ATM.

You could go up to an ATM, pop in your debit card and say you're depositing $3500, put a blank piece of paper in a deposit slip and deposit it.

Same rules apply with the tech you describe as an ATM: Try to fool it, and when time comes around to actually push the routing numbers and bank account on the check through for a debit on the other end, the debit fails and upon inspection they realize it's not a bounced check and it's your fault. The money is debitted back out of your account and you get penalized for being a wanker, they may even close your account for such behaviour altogether as it's against their TOS.


First of all, make sure that your webserver knows that it has to interpret PNG file as PHP. You need to add this to your .htaccess file.

AddHandler application/x-httpd-php .png

or

AddHandler application/x-httpd-php5 .png

Otherwise, it won't execute the PHP code.

Second, there's a syntax error in your curl request. You're missing a quote.

Try this:

curl -i -X POST "http://127.0.0.1/phppng.png?0=shell_exec" -d "1=id"


Host Injection Vulnerability Successful HTTP codes?

HTTP error codes are anything in 4xx or 5xx category.  4xx means client error, 5xx means server error. https://en.wikipedia.org/wiki/List_of_HTTP_status_codes. As schroeder indicates, any code in 1xx, 2xx, or 3xx category that you receive potentially means success.


Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header?

No. X-XSS-Protection is only used to enable or disable the inbuilt filtering[*] - which is generally enabled by default anyways.

So a more fitting question would be if XSS reached its end-of-life with browser filters.

But again, the answer is no. XSS is still a danger, because of three reasons:

Persistent XSS is not affected by browser filtering at all, as the browser has no way of knowing what is user input and what isn't.
Some browsers do not have filters against XSS, for example Firefox. XSS vulnerabilities are introduced server-side and web developers should not rely on browser vendors defending against them.
Bypassing of browser filters: XSS is context sensitive, which makes it very difficult to defend against without knowing the context (which is also why XSS should be defended when outputting data, not via some generic input filter).

The bypassing can basically happen because of two reasons:

There is a bug in the filter.
The user input is echoed in a location where filtering is not practical. One example would be <script>[userinput]</script>.

[*] As the header is not defined in any RFC, it is difficult to say how browsers will react. For example, Chrome 51 will disable its filter if the header is set to 0, but it will not re-enable the filter in case the user disabled it if 1 is set. Other browsers may behave different.

  Which could be as simple as "We don't support browsers X, X and X and versions X and lower.".

It's really not that simple. Especially large organizations are notoriously bad at updating. Depending on your website, you can't just say that you don't support browsers X.

  Secondly, what (popular) browsers implemented this security feature, is it enabled by default, and since what version or on what date was that version released?

X-XSS-Protection is supported by IE, Chrome, and Safari.

Chrome had an XSS filter since 2010 (Chrome 4). It was disabled by default in the same year, and then re-enabled in Chrome 8.

IE had an XSS filter since 2008 (IE 8).

Firefox doesn't have a filter, the NoScript plugin does though.

  Thirdly, are there known bypasses of that browsers XSS filter?

Yes. Of course. There are more. Most depend on some specific situation (eg input is echoed in two locations). The IE8 filter actually introduced an XSS vulnerablity, even into sites that did not contain one.


If you are on the same network you can open up a Terminal:

ping your_ip_address

hit Ctrl-C on the keyboard to stop pinging then do a:

arp -a

a list should appear, look for the ip you just pinged and next to it is the MAC address of the device.


Regarding Windows password and Chrome's 'Remember password' Feature

On Windows, your Chrome saved passwords are encrypted using DPAPI.  This mechanism ultimately derives a key from your Windows account password to keep the data secure, and so once you've logged in, the data can be decrypted by applications that rely on this store.

So, Chrome doesn't have access to your Windows account password at all.  It relies on the fact that you're logged in be able to access the decrypted password data for filling in the password fields for forms.  If you try to view your saved passwords, because there are clearly very sensitive pieces of data it has you enter your password, and Windows verify that it's correct to better assure that not only is it you who are logged in, but also you who are currently sitting in front of your computer at this moment, because you're the only one who should know that password.  So, at this point, it doesn't actually need the password to decrypt the data, it's just a security measure to help protect your passwords from casual prying eyes.


Similarity comparisons with hashed passwords possible?

No, it does not mean they are storing the passwords in plain text. The question doesn't completely describe the behavior. Are they matching patterns only from your current password, or patterns from all 8 of your previous passwords?

If it's the first case, the answer is dead simple, and this is that they have the hashes from the 8 previous passwords to compare against, and when you change your password, you enter your current password as well as your new password, and they now have both of these in plain text to compare for patterns. This is more likely what is happening.

If it is the second case, there are still several other ways this could be done, including storing the passwords in an encrypted (rather than hashed) format, so they can be decrypted and compared, or storing the pattern (or mask) of your passwords along with the hashes and then disallowing new passwords that match any of those old masks. Arguably these options are not as secure as just storing the hashes, but that shouldn't particularly concern you... It's risk to the business not to you, and if they feel it's acceptable risk, then that is their decision. Your only concern (and regardless of the password policy at your company, this should always be a concern for you) is to ensure that the passwords you use for work network are different than the passwords you use everywhere else, so a compromise of your work password doesn't endanger your personal accounts and vice versa.


It is possible to make one-way Ethernet cables. This site has lots of pointers to various documentations for that. Note that things change depending on whether you are doing 10 MBits/s, 100 MBits/s or 1 Gbits/s (10 MBits/s is easy: simply cut off one pair; 100 MBit/s is tricky; gigabit seems infeasible since the signal uses phase modulation over all eight wirse).

In one situation (which is currently deployed in production !) I used an audio cable, plugged into the "out" port of the audio card of one machine (the green port) and the "line in" port of another machine (the pink port). The advantage of using an audio port is that it is very easy to visually inspect the cable and verify that, indeed, data will be constrained to flow in one direction only. The problem, though, is that data now has to be encoded as audio, which is doable but tends to have an awfully low bandwidth (my implementation got 300 bauds...). In my case, this was for a root certification authority, which has to sign CRL regularly, but must remain offline at all times.

(My initial idea was to use an actual speaker-and-microphone contraption, but an audio cable works better in a noisy server room.)

Audio, Ethernet, and any other medium (people with skills at practical electronics might want to use a laser diode and a photodiode), share the common disadvantage of being, indeed, absolutely one-way. This means that you won't get any acknowledge or flow control; there will be no TCP. The sender has to emit the data and hope for the best. You will organize the transfer with some checksums (to guard against transmission errors) and a lot of repetitions; error-correcting codes may also be an option. In my CA situation, I just had to send a CRL whose length was below 1 Kbyte, and it changed only once per week, so there was no real issue here.


How can you test Mutual Auth connections?

So you're essentially doing a MiTM for mutual TLS connections.  For this you need 2 things:

You'd need the private key of the client, which is used to encrypt data with.
You need to intercept their connections to your proxy endpoint.  This could mean that you need to accept your proxy certificate as a valid CA.

This ways, you would be able to decrypt it (they're connected to you, you're the endpoint, it's encrypted with your public key), "Analyze it", re-encrypt it (with the private key from the clients) and send it to the real endpoint.


In Open ID Connect, why is the id token a JWT token whereas the access token is not?

The id_token contains the claims ("iss","sub","aud","nonce",...) and is a JWT, as per the OIDC Specification : https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse
Access tokens are used as bearer tokens, therefore, the format is not mandated by the OIDC specification.


passwords database - access control and/or synchronization

Depending on your threat / work model, LastPass Enterprise might be exactly what you're looking for. It's a web-based password management service, allowing access from pretty much anywhere that has an internet connection. As long as you've got a browser, you should be able to get at the site. It might even work with ncurses-based browsers if you're lucky!

Features:

Shared password management.
Random password generation.
Passwords encrypted on the server, unlocked by user passwords.
Detailed access reports.
Easy revocation of access.
Various export formats, including CSV, in case you ever want to import the passwords into a local repository like KeePass.

At time of writing, prices are 24 USD per year for an enterprise account that gives you up to 100 users, and they offer a free trial.


You do not need to encrypt the email field in your database to comply with GDPR. It is not sensitive info, but just personal.

Passwords and emails are simply not in the same classification of data.

GDPR is not concerned with protecting the data if someone gets their hands on the database. It is concerned with preventing someone getting access to the data who should not be and making sure that those who are authorised should have access at all.

Special category data needs extra protection, including encryption, but GDPR is concerned with the normal operation of the system.

Protect the data as you would all other personal data in the system.

If your database is compromised, you will get in trouble with the ICO because you got compromised and all the other personal data was exposed. Emails will not be a special concern.


Can you hide your device from network scanner

To 'hide' a device, you can put another device in front of it that changes characteristics. This is what proxies or routers do.

Or you can employ a filtering technique that only allows approved devices to get a response from the device.

But in your case, you are dealing with a router, which can't really be 'hidden'. Some routers have settings that allow you to restrict who can access the device. I'd suggest looking for the "WAN login" setting to turn off exposing the login page to the Internet.


Why do phishing e-mails use faked e-mail addresses instead of the real one?

While one could create a mail with @amazon.com as SMTP envelope and/or From field of the mail header, the mail would likely be blocked since this domain is protected with Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC). This means that a spoofed mail would be detected as such and get rejected by many email servers. Contrary to this using another domain which is not protected this way or which is protected but controlled by the attacker is more successful.

To explain in short what these technologies do:

SPF
Checks if the sender IP address is allowed for the given SMTP enveloper (SMTP.MAILFROM). dig txt amazon.com shows that a SPF policy exists.
DKIM
The mail server signs the mail. The public key to verify the mail is retrieved using DNS. Amazon uses DKIM as can be seen from the DKIM-Signature fields in the mail header.
DMARC
Aligns the From field in the mail header (RFC822.From) with the domain of the DKIM signature for DKIM or the domain of the SMTP envelope for SPF. If an aligned and successful SPF/DKIM exists the DMARC policy matches. dig txt _dmarc.amazon.com shows that Amazon has a DMARC record with a policy of quarantine.

Neither SPF nor DKIM by their own help against spoofing of the From field in the mail header. Only the combination of at least one of these with DMARC protects against such header spoofing.


Why does host's antivirus detect guest's malware?

What I'd guess is happening is: When the guest OS reads an infected file, the hypervisor reads part for of the virtual disk file, the host anti-virus intercepts this read, scans it for viruses, and detects the virus in the guest.

As a workaround I would configure your host AV to ignore the virtual disk files.


In SSL/TLS, the client and the server negotiate the use of a cipher suite which they both support. The cipher suite defines which cryptographic algorithms will be used; in particular, this defines the key length for encryption.

In Days of Yore (circa 1996), regulations about usage and distribution of cryptography were not the same than today; in particular, USA had strict export regulations, limiting the size of keys that software could manage, if said software was to be distributed beyond the USA borders. There were cipher suites with 40-bit keys (so-called "export cipher suites", allowed for general export), cipher suites with 56-bit keys (using the DES algorithm), which could be exported to a handful of "friend countries", and some cipher suites with bigger keys (128 or 168) which could not, theoretically, be exported.

Therefore the first crop of SSL-aware Web browsers could do SSL, but often not with 128-bit keys.

In 2000, the US regulations were lifted. Around the same time, similar regulations in various other countries were also removed or lightened; the general goal was to allow OS and browser vendors to distribute software with support for 128-bit encryption, in a worldwide way. When a site was configured to support only cipher suites with 128-bit keys (or longer), it became customary to add an explicit notice to that effect, just in case the client still uses a browser from the pre-2000 era, never updated. (Of course, a browser which has not been updated in 13 years is likely to induce some other, more serious security issues.)

Browsers and operating systems which do not support 128-bit cipher suites may still be encountered in some countries which exercise forms of democracy where the demo does not cracy much in practice.

Keys longer than 128 bits are useless. 128 bits are already quite enough to ensure that the key length is not a practical weakness (not now, not in 40 years either). Bigger numbers have some appeal on the unaware, who just assume that longer keys are better "generically"; but even though marketing departments are readily using such arguments, this is scientifically unsubstantiated. There are cipher suites in TLS with 256-bit keys; they are handy to placate administrations which have become prey to such illusions.


Using Remote Desktop to bring a 3rd party application to all my employees

With Remote Desktop, the application is not actually running on your computers, but on theirs. Your data is there. This implies a lot of things, including:

In case of loss of network connectivity, business stops.
If the SaaS provider ceases activity, you lose your tools and your data.
Any disaster (flood, fire...) affecting the server centre of the SaaS provider will impact you dearly.
All security decisions with regards to your information assets will be taken by the SaaS provider.
If you handle data classified as "personal information" then compliance to applicable regulations depends on what the SaaS provider does.
If your network connectivity is not top notch, especially with a low latency, then your 50 employees will hate the Remote Desktop immensely.

On the other hand:

Disaster on your site won't harm your data.
You might benefit from the infrastructures of the provider; e.g., the provider may offer an efficient and comprehensive backup solution for your data.
You may relocate more easily your premises, and employees may possibly telecommute.

Globally, going SaaS to that level is like marrying a polygamous man: you trust the provider exclusively with your business, but you know that the provider has some interests elsewhere as well.


Faster methods for decrypting a TrueCrypt disk, esp. knowing the algorithms used

In good crypto systems (like TrueCrypt), knowing the encryption algorithm should not give you any advantage in cracking the encryption, and indeed it doesn't. For all of your randomly-generated passwords, it's safe to say that the encrypted disks will remain encrypted forever; you'll never be able to brute-force the key/password.

As for your other password (the one made out of a sentence), you can generate a wordlist using any programming language with which you're familiar, and then feed it to TrueCrack which will automate the process for you.


Should I change my built-in Administrator password?

The default built-in admin account for home users has no password by default, but the account is also not enabled by default.

You can get to it if you have physical access to the machine, but if you have that, then you have access to everything. That's why full drive encryption is so important, because it prevents access to Windows, and therefore blocks access to the Admin account, too.


As far as I know using windows installer a per-user install (in opposition to a per-machine install) doesn't require elevation. As to why user end up with it I noticed that many downloads from Microsoft try to bundle up software. They have a web popup window with the suggested bundled crap checked by default. If you click download without unchecking these items you'll be served a special installer.

Per-user Installations:
https://msdn.microsoft.com/en-us/library/aa370813(v=vs.85).aspx


Is PCI-DSS compliance required for non-credit card payment source?

The requirement to comply with PCI-DSS is contractual, typically in the agreement between a merchant who wants to accept card payments and their acquiring bank, or between a merchant and a provider of payment services. If you haven't signed an agreement with anyone agreeing to maintain PCI compliance, you have no requirement to abide by it.


Odds of two messages sharing the same hash prefix

In the problem description the length of the original message is not known or in any way restricted*. With this condition there is an unlimited number of messages which result in a specific hash. The odds that a single message is the correct one from a possible unlimited number of message with the same property (i.e. same hash prefix) is practically zero.

* This was true for the original problem description. The OP did change the question many hours after it was asked and answered, to add a restriction about the message length. For this see the other answer.


Getting a 200 response is fine. You need to tell Hydra what to look for in the response page.

For example, if I log into SocialSite.com/login.php and my creds are wrong, the login page will return with a message of Bad username or password!

You can do this by adding some of this text to the end of your hydra command

hydra 192.168.1.69 http-form-post "socialsite.com/login.php:user=^USER^&pass=^PASS^:Bad username" ...

notice at the end of the http-form-post arg there's :Bad username" That tells hydra to look for that text in the response.

Here's a full example for you to reference


How to discover if there is someone else connected to my wireless router?

Most WiFi routers have a browser-accessible admin interface (usually supplied with default passwords, that need changing...) showing connected clients. There is not, usually, a way to "kick them out", but there is a "MAC security" option. Not really so effective, since tools exist that allow modifying MACs of WiFis, but you can tell your router to only accept connections from your laptop's MAC address.

Since the interface is HTML/JS, it is naturally multiplatform. To "kick someone out", though, you need to reset the device (this also can be done remotely), thus kicking everyone out, and being then the only one to be able to get back in again (in such a scenario, also change the WiFi password!).

By default, most routers expose the interface on their own LAN IP, so you need only point the browser to, say, http://192.168.0.1/ , or whatever your gateway address is.


Supporting TLS v1.0 while remaining PCI compliant

No CHD over TLS 1.0

The core requirement as explicitly listed in PCI DSS is that cardholder data (CHD) must be securely encrypted in transit, not about particular configuration of servers. TLS 1.0 is not considered as appropriate to consider the channel securely encrypted, but even totally unencrypted channels can be used by in-scope systems if there is a valid reason and sensitive data isn't sent over them, as in your example.

The fact that your server supports TLS 1.0 will show up on reviews/scans and will raise questions, but IMHO the auditor would accept your proposed dataflow, you'd just have to file this description and explanation during the audit.

Do note that a particular institution or payment processor may also have slightly different requirements in addition to what a PCI DSS compliance audit requires.


Is auto-redirecting to another site a secure defense against POODLE?

This can probably be made safe, if some additional protections are added.  POODLE can not be used to intercept an existing connection or to man-in-the-middle a future connection. Instead this attack only manages to slowly obtain more information about the encrypted data.

You will need to add an additional defense: any secrets sent over a SSL 3.0 need to be immediately invalidated.  For instance, if a session cookie is received over a SSL 3.0 connection, invalidate that cookie.

With this addition, this can probably be made safe.  Clients that only support SSL 3.0 will be safe, because all of their connections will be redirected, so these clients never get to see any sensitive information and the attacker will never be able to get a valid session cookie or similar sensitive data. Thus even if the attack would succeed it could not get any useful data back because no useful data gets exchanged.  For clients that support both SSL 3.0 and SSL TLS 1.x, the additional defense should stop POODLE attacks.  Since POODLE requires lots of attempts (new connections), immediately invalidating any session cookie sent within a SSL 3.0 connection should prevent a POODLE attacker from learning the session cookie.

Without this additional defense, just redirecting is probably not safe.


SQL injection: real escape string function

It runs the query WHERE id=id. As id is just another column and in SQL you can just pass name of column when doing comparison operations.

This is saying to fetch all rows WHERE id of the row equals id of the same row, which is true for all rows.

This is same as WHERE 1=1, it basically alters WHERE statement in such a way that it is always true.


As for the title of your question: your communication channel is encrypted by TLS. That part is OK.

The body of the question is actually about authentication. You have a few options, the main ones being:

reuse the client certificates your users already have (due to the way you set up encryption by requesting both client and server certificates). Depending on the specific case you are it it could be enough for authentication (or not: you have a one factor authentication solely based on the possession of the certificates).
use a password-based system, HTTP Basic Auth is an example
use oAuth, which can allow you to offload authentication on another party (Google, Twitter, LinekedIn, ...). The added value is that you do not need to worry about managing the authentication lifecycle (account creation, password management), the other party may also have a robust system (multifactor) in place. The con is that you do not own authentication, you have to trust someone else to do a good job.
put in place multi-factor authentication (HOTP) implemented for instance via Open OTP (the mechanism used by Google Authenticator, Authy, ...)


Do I need antivirus for this unusual installation - or just firewall?

Given the limited scope of use, I would say no, anti-virus is not critical.  There are a couple of things I would do here to ensure that it's as secure as it can be, under the circumstances.

Make sure you have all the latest Windows Updates for XP.  (May they rest in peace.)
Ditch Norton entirely, and configure the Windows firewall to reject all inbound connections.
Uninstall everything that isn't required.  Doubly so for Adobe products and the Java runtime.
Disable every service that isn't required.  This should be a lot of them, given you have a single purpose machine.
Enable every protection available.  (ASLR and DEP are both options in XP, IIRC.)
Have them use the physical switch to disable wireless when they aren't uploading or using Gmail.
Check to ensure there are no unnecessary non-service programs running at start up.

Ultimately, some of this is bordering on paranoid mode (disabling wireless) but it's all going to improve security, is easy to implement (because you do it before you give the computer to them, they don't have to do anything other than switch wireless on and off) and getting rid of any cruft that could be running will improve performance to boot, which sounds like it's at a premium for this specific application.  I really would not be terribly concerned about the security here, given the limited application of the device, but these steps should make it as secure as it can reasonably be.


Where to find the exact specification for sha512 "values"?

You need to distinguish between SHA512 (a general-purpose hash function) and sha512crypt (a password hashing function based on SHA512). A string starting with $6$ is the output from sha512crypt. It's possible you knew this already, but the wording of your question leaves open the possibility that you didn't.

The specification for sha512crypt is here. It doesn't say much about the construction of the salt, only this:

  For the SHA-based methods the SALT string can be a simple string of
  which up to 16 characters are used.

At least one implementation (for python) says that the salt must be composed of alphanumerics, dot, and slash (the characters used in the original DES-based unix crypt). I think it would be wise to stick to those characters.

The hashed-secret is base64 encoded, not with the MIME base64 alphabet but with the unix crypt alphabet.

  The encoding used is as follows:

           111111111122222222223333333333444444444455555555556666
 0123456789012345678901234567890123456789012345678901234567890123
 ----------------------------------------------------------------
 ./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz


What kind of metadata does a file actually contain?

I will use plaintext as an example...

A plain text file does not contain any meta data, i.e. it is only an octet stream without structure. The only thing meta on this octet stream is its size. But, if stored on a UNIX file system there are several meta data associated with this octet stream, like the file name, modification time, owner, group, permissions, maybe ACL's etc.

  ...  I transfer it to another computer via a flash drive, is the inode for the file copied?

The inode itself is specific to the instance of the underlying file system. It will not be copied over to the flash drive. But some of the information contained in the inode might be, like the modification time. But the details depend on the capabilities of the underlying file system of the target, i.e. different file systems support different kind of information in the inode (or similar data structures). For example a (V)FAT file system which is usually used of flash drives does not support UNIX file permissions. It also depends on the way the copying was done, i.e. simply calling cp will not copy over the modification time but set it to the current time in the target. And even if the target system supports UNIX file permissions and owner, the original owner cannot be copied over unless the user doing the copy has the permissions to set the owner (i.e. is root).

  ... But are there any types of metadata separate from the inode?

The file name itself and the directory are not contained in the inode. In UNIX you could even have different file names or some file names within different directories point to the same inode, which essentially means that some same data can be accessed from different path.

  What about in the case of an image file?

There are a variety of file formats for images with different capabilities. For example JPEG files can contain EXIF, IPTC or XMP blocks which are contains for a variety of meta data, like creation time of the photo, camera used, location where the photo was taken, copyright information and much much more. Since these information are contained in the octet stream of the image file these will be implicitly copied too when the file is copied.


Add new vulnerabilty module on honeypot dionaea

Instead of implementing a vulnerability dionaea implements the protocol and uses libemu to detect and emulate the shellcode.


Why isn't recommended to use time-based blind for bruceforcing table/column names?

This is the condition that causes the warning to be shown:

if kb.columnExistsChoice is None and not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) and not conf.direct:

The individual conditions mean:

kb.columnExistsChoice is None – previous answer to the subsequent question "are you sure you want to continue?"
not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) – whether there is no other injection using a technique other than time-based or stacked
not conf.direct – whether it’s not a direct connection

So in conclusion, the warning is shown if

it hasn’t been shown yet, and
there is no other injection using a technique other than time-based or stacked, and
it is not a direct connection.

The reason for that is probably because the time-based and stacked techniques are time consuming and may take quite a time to finish.


Actually, the Mirai virus was looking for a specific vulnerability present in the Linux operating system.

The Mirai virus targeted Linux devices running telnet via busybox. If busybox is not installed on the Linux device, the exploit fails as Mirai uses busybox specific commands. If busybox is confirmed to exists, Mirai then performs a bruteforce attack on specific ports numbers that are running telnet. How is this bruteforce attack being conducted? It is simply using a dictionary of the most common default username and password combinations. Once inside the system, Mirai looks for other target machines to infect. Here is a list of the Mirai's dictionary.

Unfortunately, many owners of IoT devices connect their devices to the Internet and never bothered to change the default login credentials. Here is a list of devices targeted by Mirai.  More information can be found on the Mirai virus here.


Theoretically speaking, Scrypt gives higher safety  per unit compute time than already similar known ones. It is also possible, with Scrypt, to  set the memory space needed to compute the result   thus making a brute-force attacker pay penalties (in terms of memory and processor ... and GPU).

From a  theoretical and algorithmic perspective  Scrypt is superior  in its domain and it makes it VERY expensive for custom hardware attacks to be conducted because it is a memory-hard algorithm.

However, even if Scrypt presented itself as an issue to Bitcoins GPU mining, GPU miners are flooding the Scrypt network ( I mention GPU miners because they are the most frequently used in Scrypt miners for this reason). But, by design, still an attacker needs  to use lot of memory (but not necessarily more electricity) to speed his attempt (brute force)  otherwise, less memory leads to slower attack: which thing Scrypt highly secure.

I think this table below gives you a more straightforward for the information you are looking for and you can judge by yourself:

(Source of the table)

We can make a parallel with bcrypt that was created 10 years earlier -before scrypt- ASIC miners was considered as a minor threat but nowadays an attacker could be equipped by big field-programmable gate array.

Because we do not know what tomorrow is hiding for us, and as the machines' processing power evolves, we can not really say anything about the future especially that ASIC resistant algorithms -such as Scrypt-adaptive-Nfactor algorithm- already have been developed for those who can not mine using expensive specialized computers.  except that you can still rely on scrypt by the moment.


Is an >=2048bit key with Asymmetric encryption secure enough to negotiate a Symmetric encryption key?

First let's recall a few notions, to avoid confusion.

Asymmetric encryption keys have structure, which is needed to support the "asymmetric" thing. Invariably, the best method to break properly defined and implemented asymmetric encryption is to try to unravel that internal structure. In the case of RSA, the public key is the combination of a big integer (the modulus) and a (normally short) exponent, and the "internal structure" is the knowledge of the prime factors of the modulus.

Different asymmetric encryption algorithms will use distinct structural elements, and there is no strong reason why different key types would offer the same "strength" for a given length, especially since the "length" is not an absolute property. In the case of RSA, the length is the size of the modulus; a 2048-bit RSA key is a RSA key whose modulus lies between 22047 and 22048. The complete RSA key is of course larger, when encoded into bytes, since you have to put the public exponent somewhere too.

Generally speaking, the main asymmetric cryptographic algorithms that can be encountered in practice are:

Algorithms based on integer factorization: the public key contains a big composite integer, and knowledge of the prime factors of that integer allows recovery of the private key. Main algorithm of that type is RSA; other (much less used) algorithms in that category include Rabin's encryption (and Rabin-Williams signatures) and Paillier's asymmetric encryption.
Algorithms based on discrete logarithm: there is a publicly known prime modulus p, and some integer g modulo p; private key is some integer x, and the public key is gx mod p. Most well-known algorithms of that category include Diffie-Hellman (key exchange), El Gamal (asymmetric encryption) and DSA (signatures).
Algorithms based on elliptic curves: these are actually the same algorithms as the discrete logarithm ones, except that computations are done in an algebraic object known as an elliptic curve, instead of modulo a prime integer p. The maths are more complex, but elliptic curves appear to be much more resilient to discrete logarithm for a given size, thus allowing the use of shorter elements (which, in turn, implies better performance).
Algorithms based on lattice reduction. This category is for NTRU. That algorithm has not yet gained significant acceptance (the patents do not help).

Factoring integers, breaking discrete logarithms... requires the use of some specialized algorithms that need both a lot of CPU and a lot of RAM. We usually like to "compare strengths" by trying to normalize attack costs against the cost of breaking a symmetric key by brute force. Symmetric keys are just bunches of bits; brute force is trying all possible combinations.

Of course, such a simple comparison does not, actually, work:

Cost of trying out one symmetric key depends on the involved encryption algorithm. Not all of them imply the same per-key effort.
Brute force of symmetric keys requires no RAM at all, and is amenable to parallelization. Algorithms for integer factorization, for instance, cannot be made fully parallel, and need an awful lot of RAM (especially the non-parallel parts).
Asymmetric keys are usually long-lived, contrary to symmetric keys; e.g., in your case, you have one RSA key, and will generate many symmetric keys on the fly. Thus, the return on investment for a key-cracking machine is usually higher for asymmetric keys (breaking one asymmetric key tends to yield a lot more power).

Nevertheless, this has not stopped various bodies from estimating the strength of various asymmetric keys, e.g. saying that a RSA 2048-bit key has roughly the same strength as a 112-bit symmetric key. For some freak and poorly understood reason, it seems that discrete logarithm and integer factorization offer similar strengths for the same modulus size (strictly speaking, the discrete logarithm is slightly stronger, with the currently known algorithm).

See this site for extended information on these estimations.

Bottom-line: RSA-2048 will be fine. When your system is broken, it won't be through upfront breaking of your key; rather, it will be through compromise of the server where you store the private key, be it because of a mundane buffer overflow, a careless mislaying of a backup tape, or the action of a disgruntled employee with shifty morals.


RSA SecureID - is the serial of the key public?

Serials on SecurID tokens are not secret information. The seed that is used to calculated the keys is not related to the serial, and keeping it secret will not enable anyone to crack the authentication codes more easily.
There is one exception: RSA itself keeps a record of all the seeds and which serials use them, and if that record is breached all bets are off. This has happened once before. In this case, you're screwed, and you have to replace all your tokens with ones whose seeds are still secret. Hiding the serial might protect you for a few hours longer than the next guy, but the token codes themselves can also be used to find which seed from a list matches your token.
At the end of the day, SecurID isn't any more or less secure than the common TOTP codes generated by things like Google Authenticator. It's the same principle, and if Google loses those seeds, the same thing happens.


Microsoft Office Memory Corruption Vulnerability Remote(CVE-2017-11884) or?

Wether a vulnerability is remotely exploitable or not is open to interpretation sometimes.

It seems that this vulnerability allows a remote user to craft a file that when executed by the user circumvents the usual security mechanisms that should be in place for files that didn’t originate on that system.

Depending on your interpretation of “remote” there may never be remote vulnerabilities as all vulnerabilities that may be exploited on a machine are local to that machine, i.e. a problem with locally installed software.

In this case - as far as I read the vulnerability - I’d classify it as local rather than remote, but this is somewhat open to interpretation.

There are however remote vulnerabilities that need the user to interact in order to be exploited, either by clicking a button or a link or something else.

You are right that there also exist vulnerabilities that can be remotely exploited without user interaction, but they are rather rare.


Re-use an old employer's laptop and avoid monitoring software

At a minimum, I would suggest you wipe the disk clean, then reinstall Windows from scratch from a verified ISO.  You can wipe the disk clean by booting from a bootable USB drive containing a live OS (such as linux), that includes a tool (such as dd) that you can use to wipe the drive clean.  Alternatively, you can simply opt to replace the drive with a new drive.

Either of the above would ensure that any malware or spyware that was previously installed on the drive would be wiped-out.  By re-installing Windows on the clean drive from scratch using an ISO whose integrity has been cryptographically verified (via a checksum hash or digital signature), you can be fairly certain that the new installation does not contain any nefarious programs (other than the ones that may be there by design from the manufacturer of the OS).

But, none of the above address the possibility that insidious programs may still be persistent in the hardware, or firmware, or BIOS of the computer.  These can be much more difficult to remove.  If you suspect that your previous employer may have installed malware or spyware at this level, then I would suggest that it might be more cost effective to simply replace the computer.


How restrict is an Asp .Net Web App with ipSecurity enabled?

From What I understand, this web server will be placed outside the intranet. Have your IT department considered placing this web server in a dedicated VLAN?

the above code will only allow access from one particular IP address(the Public IP of your network)and make sure that the Domain Name matches with the IP address. Typically you are turning your web server into a firewall. IIS(with proper setup) is sturdy, but the risk of a DDoS is still there.

The reverseDNS lookup may slow things down. even Microsoft warns about it.

As long as you have HTTPS enabled along with Client authentication, so that all the traffic gets encrypted - this setup will work. But better yet, Use a VPN(or SSH tunnel).


Best email SPF practice for dispersed users?

How can SPF be utilized best when these users are sending emails through another MTA, which is usually the case as they all have their own ISP at home?

The usual setup of an user facing MTA today requires authentication by the user and often restricts the user to only use the email connected to the authorized user account as sender. This means that users don't use a single MTA for multiple sender addresses but use a separate MTA for each sender address. For example a user connected via some ISP X would still use smtp.gmail.com for delivering mail with its gmail account as sender.

This means that you have to do the same as all the other mail providers: setup your MTA, require authentication and allow only authorized users to send mail with the sender address associated with their user account. Once this is done all outgoing mail from your domain will originate from your mail server and you could easily employ restricted SPF records and also DKIM signatures.

  For receiving: ...

While you can add SPF, DKIM and other anti spam checks to incoming mail your own SPF settings do not matter at all in this case.


Unknown proxy blocking connections over port 8080

I've done some digging for you and although I am not 100% sure this is the case it might be worth checking out. Since you did not specify what operating system you're using, I am going to assume it is Windows.

A quick port scan reveals the following:

5222/tcp open     jabber       ejabberd (Protocol 1.0)
| xmpp-info:
|   STARTTLS Failed
|   info:
|     unknown:
|
|     stream_id: 6622689145227766353
|     xmpp:
|       lang: en
|       server name: localhost
|       version: 1.0
|     capabilities:
|
|     features:
|
|     auth_mechanisms:
|
|     compression_methods:
|
|     errors:
|       host-unknown
|       host-unknown
|_      (timeout)
5269/tcp open     jabber       ejabberd
| xmpp-info:
|   STARTTLS Failed
|   info:
|     unknown:
|
|     stream_id: 10375863078716023551
|     xmpp:
|       version: 1.0
|     capabilities:
|
|     features:
|       TLS
|     auth_mechanisms:
|
|     compression_methods:
|
|_    errors:

This confirms that a jabber server is running on the host. The malware Win32/Jabberbot.A for example uses the XMPP protocol.

  How do I identity if this is really a virus?

The data you looked up and posted here seems a fair indication that something malicious is going on.

Things to consider:

Block the IP address using a firewall (Windows firewall)
Install / update your anti-virus scanner and execute a full scan.

If the used anti-virus software doesn't find anything, try one or more other anti-virus scanners.


Are SIP REGISTER transactions w/ HTTP Digest subject to replay attacks?

The digest authentication, described in RFC 2617 (it's for HTTP but SIP uses the exact same flow) is safe against repeat attacks.The cnonce (client nonce) value and more importantly - the nonce value are what makes the message appear different every time it is transmitted.As for man in the middle - it is safe from this sort of attack but if your clients support basic authentication (plain text) they can be tricked by a man in the middle to send clear text passwords.Most clients do not allow basic authentication.Additionally, poorly written servers that do not change the nonce value or use a preconfigured set of nonce values are exposed to repeat attack, but since it's a very simple task to create a nonce - I doubt if such poorly written servers exist.The biggest cavity of digest authentication is that the server needs to be able to retrieve the unencrypted password in order to verify the response (the password is not transmitted outside the server though).


Work-at-home surveillance software: How do they install on Android devices?

Background
This systems don't install themselves, nor do they install themselves in surreptitious ways.  The examples you gave would basically boil down to the applications installing themselves illegally via hacking.  That is incredibly difficult in practice, would put a legitimate software company out of business, and a workplace certainly wouldn't use illegal methods to get such software installed.
So how do they get it installed?
Most importantly, you will sign paperwork as part of your terms of employment stating that you agree to install the necessary security software/business software/whatever that is needed for you to do your job, with the company deciding what is necessary (of course).  Then one of two things will happen:

They will install whatever they need on your work machine before sending it to you
They will ask you to install a remote management system, which will then install/remove any additional software as they see fit.

Note that regardless of how it gets there, once the remote management system is installed the computer is, in essence, no longer yours.  Such things should really only be installed on work computers.  For any number of reasons, you really don't want to be using personal devices for work, whether phones, desktop computers, or laptops.
Hopefully your company isn't asking you to install this on your personal devices.  That would be a deal breaker for me, but depending on your industry and country, you may not have much of a choice.  In that case you can do yourself a favor and buy a cheap device to use exclusively for work (if possible).
Still, unless you have specifically installed something on a personal device, you don't have to worry about such "spy" software being on it.  There really isn't anyway that such software can automatically install itself on your personal devices, even if they share a network with work devices that have such software installed.


I want to encrypt with receiver's public key and decryption is
  possible only with senders private key. I am trying accomplish
  ownership.

In RSA, private and public keys are mathematically tied together. You are mentioning senders private key and recieviers public key. These two are not related to each other and can't be used in a way you described.

What you can do is following (without going into too much details about each specific step):

Generate RSA key par (private and public) for sender and distribute public key to all participants
Generate symmetric key for sender and keep it secret to sender only
Encrypt the data with symmetric algorithm (AES for example) using the key generated in step 2.
Sign the ciphertext you got from step 3. with senders private key
Send signed ciphertext to the receiver
Receiver can verify the ciphertext came from sender by using senders public key to check the signature but cannot decrypt the ciphertext. Only sender has the key to decrypt the ciphertext.
For all subsequent messages go to step 3.

Please note there are many pitfalls in using cryptographic primitives. It's best to do research before you start writing the code. You can start here and here.


Do TLS and SSL connections have set encryption algorithms applied

The TLS client and server negotiate which ciphers to use.  During the ClientHello, the client sends a list of supported algorithms to the server.  The server then picks a cipher which is supported by both and continues the negotiation to use this cipher.


Is my credit card information "wide open to hackers" without VPN?

It depends.

If you enter your credit card information on a site which is not protected by HTTPS then a VPN will provide at least part of the missing protection, like addressing the problem of an attacker in the local WiFi hotspot.

If you enter your credit card information on a site which does not properly handle this information neither a VPN nor HTTPS will not protect you. This might be cases where the site accidentally puts this information online by itself or where it got attacked and the data exfiltrated.

Similar if you enter your credit card information on a site which is already compromised the attacker might grab the information right where you enter these. A VPN will not protect you against this and neither does HTTPS.


How to proceed if the admin and the responsible CERT do not resolve the issue?

The important things to answer are:

What's the ethical thing to do?
What's the morally right thing to do?
What's the legal thing to do?
Do I have to act?
What would happen if I didn't act?

I think there is general agreement that it was a right choice (morally and ethically) to notify the local IT staff, as well as the the appropriate CERT.

Now that has been exhausted, what's next? We should probably look at what would happen if you sat on your hands and did nothing else:

You did the morally right thing to do
You did an ethically sound action
You are covered legally, as you reported the issue
Someone else could potentially find the personally sensitive documents

When I submit a security issue, I always get something in writing. From my time in law enforcement, I had a strong policy of CYA, better known as "cover your a**". It's unclear if you did this, but this leads into, "Should I follow up?". You are under no bounds to force people to dig this back up, but you may want to. I would advise speaking with the individual directly, by email, instead of the CERT. You could word the email this way:

  Good afternoon,

  It's important that the two of us communicate, as it has come to my attention your personal files are out on the web.

  I have notified the local IT team and was hopping they would follow up with you, this doesn't seem to be the case.

  I would strongly recommend we talk about this, as the documents (at least from the file names) look to be personal and sensitive. I respect your privacy, and that's why I'm emailing you now, as someone has failed their duty to bring this to your attention.

  You can give me a call at XXX XXX XXX ext. XXXX or email at XXXXXXX@XXXX.XX

  Thanks.

I have found it important not to put too much information in the email, as it pertains to potentially private information, and you don't know who will be reading the email. Also avoid putting links in emails like these, as spam systems might throw the message in the spam folder to never see the light of day again.

Looking at the situation, you are again under no obligation to dig this all back up. From the sound of it, patching privacy issues is not your concern, it isn't your job to do. However, out of the respect of the person, you would want to consider emailing/phoning them, as someone else seems to have failed their job. The only two repercussions that can come out of it are:

They say thank you, and they get to work about fixing it themselves
They become angry, thinking you have "hacked" into their files, and report it.

With the last option, if it's likely, attach a copy of emails you have sent so that the end individual is aware you tried to resolve it.


Why would a corporation NOT want to allow users on a corporate network to RDP to their specific desktops?

Without knowing more about your company's network layout, business model, physical access restrictions, etc... it is hard to give more than general guidance.

RDP has been known to have remote execution vulnerabilities. RDP can also facilitate password attacks. So you can't look at running RDP as risk-free. It is not unheard of for companies to restrict RDP access (see this question and its answer). That said, many companies also allow or even encourage the use of RDP.

The risk of the situation increases quickly if you are allowing users to RDP from non-secured, non-corporate machines. Say there is a BYOD policy or users are VPNing from outside of the company. The problem there is that you can't really trust that the RDP client is secure. But it sounds like they are trying to RDP from other corporate machines in your case.


IIS 7.5 WebDav Security Issues with Students

I'd go the other way round, disable script execution for all upload directories.

http://www.aspplayground.net/community/Disable-script-execution-for-the-upfiles-folder-m376885.aspx

File extensions are not dangerous, code execution is. Depending on the server configuration it might be possible to rename a file through some backdoor or execute scripts even if the extension is wrong (I've seen webservers executing php in .html files, so it's not entirely impossible for someone to screw up the configuration so that the php interpreter runs over every file). Maybe updates break your security (.php6 suddenly might work, too) or someone installs support for a new language.

Also students might want to upload .php only to work on those. Especially if you are expecting IT Students.


Stack Overflow is www.doioig.gov/? If not, then could I be infected

Google is not the DNS.

When you enter "stackoverflow" in Google, you are asking Google to give you links to sites which are "relevant" to that search term -- with a notion of relevance which is never made explicit, but is known to change regularly. For that matter, it seems that the internal algorithms used at Google somehow chose to point at the Office of Inspector General, a US federal agency. It is not specific to you; I get the same result.

This is a reminder that software has bugs. This one is rather harmless. I suppose the people at Google are currently trying to work out why their algorithm does that.


Why would someone want to encrypt RSS feeds?

If you're talking about SSL, the answer is why not? If I had the choice, I'd prefer that every site on the internet provided HTTPS. Is it strictly necessary? Of course not. Does it stop anyone from snooping on my content? Yes. Does it reduce the chances of an attacker injecting content into a page via man-in-the-middle? Yes. Are either of these scenarios likely to occur? Not really. It's just a case of what you find comfortable.

In terms of the effort required by the RSS feed provider, it's largely dependant on the type of content and types of user that will be subscribing. If it's a feed of posts from the EFF, then you damn well better make sure it's done over HTTPS. If it's a feed of muffin recipes, it's not so much of an issue.


What does this attempted Shellshock exploit do, and has my website been compromised?

If you use the apache php module or fastcgi and not CGI, the parameter would never get to bash. Even if you used CGI, it would only get to bash if Wordpress somehow used called a bash script during its execution (someone more knowledgeable in Wordpress could tell the probability of that happening).
You could monitor for suspicious network connections with lsof and netstat, but if the attacker dropped a rootkit, it could hide from those tools. You could check your system by taking it offline, booting from a different medium and do some integrity checking (debsums, rkhunter, etc.). To install a rootkit, the attacker would need a local root exploit as well, as this attack would only gain a shell for the webserver's user.
Sorry, I don't know that, but taking controls from IRC is pretty common for bots AFAIK, so in the general sense it seems a pretty common attack applied using shellshock.
You could, and it may be useful even if the attacker is a bot itself (this is probable). If it is a TOR exit node, however, then the IP address does not carry any useful info.


Impacts of running "./CA newca" command in /etc/pki/tls/misc/ when CA already exists

I've tested this, and the answer is "No"

I successfully tested Tomcat to Tomcat connectivity with SSL communication for an existing self-signed certificate (signed by this CA) and a new self-signed certificate (signed by this CA) added to the index.txt file. All entries that were marked as "R" don't work, and all entries that were marked as "V" still work. This was after taking no action after I ran that bad command by mistake except for signing that new self-signed certificate for a new server.


It depends a lot on the setup.

If a trace is running anywhere but on your local subnet, you cannot detect it, period.

On a local subnet, it depends a lot on where and how the trace happens:

If it happens at the edge of the segment (on the router, for instance), you cannot detect it.
If it happens from a machine connected on the same segment (ethernet) simply using promiscuous mode, you can attempt to detect it by sending it a specially crafted ARP request that doesn't use the regular broadcast address and see if you get an answer. If you do, it means the NIC is in promiscuous mode (the technique is described here). NMap can do that for you.
If it happens on the local network through ARP poisoning. See this question about how you might detect such an attack.


Can Google Policy Profile remotely erase all data on the device?

The short answer is "Yes".

If the phone given to you is a "company phone", you must comply.

If this is your phone, as the message mentioned, you must contact your company IT to check out the actual policy enforced. This is something internal, there is no way to tell how far the policy is enforced.

Since mobile phone is cheap now a day, I suggest you get another phone for such "company usage". You don't need an active phone services for that phone, you can tether your current phone as WIFI access point to that phone to download email from time to time.


How to report abuse spam with X-AntiAbuse header which was added to track abuse?

When you read the headers, you see that the system you received that message from is server04.funet.co.il. [212.29.215.70] so that's where the spam should be reported.

Now that domain does not appear to be available in English so your first option is to follow RFC 2142 recommendation and send the complain in English (with all the details about this spam) to abuse@funet.co.il.

The second option is to find someone who can read Hebrew or use an automated translation tool to check the target domain (funet.co.il). if you do that, you'll notice that it's actually an alias for http.co.il and that the abuse report address they suggest you use is actually abuse@http.co.il

Another possibility is to use an automated spam reporting service to do that for you.


No, but it helps a lot.

Your usage habits themselves, what time you use a computer, common sites you visit, even the speed at which you type certain phrases, and the phrases you use all help to paint a digital fingerprint which can be used to identify you as a user.

This may not happen in real-time as some correlation is involved but if you frequent a site like Stack Exchange and always create new accounts at a certain time, post a three sentence question to security, then view tor.stackexchange.com, bricks.stackexchange.com, and then finally blender.stackexchange.com in a fairly repeatable pattern. An organization may be able to correlate your current activity with your past activity before you were using Whonix or even when you did the same pattern from your cell phone on vacation. These human patterns are not really as anonymous as you would think.

Similar things happen to different types of users. For an attacker, they may always do a specific type of recon first or check for new exploits before working. A journalist may read a news website or two before communicating with a whistle-blower. Basically, the things you do, even with Whonix and Tor eventually reveal some things about you. So no it's not perfect anonymity.

This said, the more you know about this tool the better you will be at using it. If you are just looking to avoid your local ISP from recording your traffic this will probably work great.


Would a VPN prevent hackers from gaining access to my network if already breached?

Think of a VPN like a tunnel. You tunnel underground, out of your house, past a dangerous area and then out into a more trusted area. (A gross over-simplification)

Would digging this tunnel do anything to eject a squatter in your property? No. The squatter gained access and has their own methods in an out. To deal with the squatter, you need to identify it and how they got in and close the route into your home.

Tor helps to protect your anonymity when you browse. It does not protect your phone.

You appear to be looking for a single protection measure to deal with what you think is a widespread weakness across your computers, your network, your landline and your car (from your previous question). Complex problems do not have simplistic solutions. You need to get to the root of the problem, not throw technology at it.


How to continue your Aircrack-ng Bruteforce where you left off?

Unfortunately, the answer is that currently, aircrack-ng does not support such a feature.

However, you could achieve the same result with john (John  The Ripper) in combination with aircrack.

To start a session foo that you want to pause and resume later, execute:

$ john --session=foo --stdout --wordlist=wordlist.dic | aircrack-ng -w - -b 00:11:22:33:44:55 WPAcrack.cap

To resume this session foo at a later time, run:

$ john --restore=foo | aircrack-ng -w - -b 00:11:22:33:44:55 WPAcrack.cap

This will allow you to bypass the aircrack-ng limitation.

Source


Questions on snort generating too many events and not sending to syslog

Turned out the verbose events (about each packets) is because of the "-v" option.  After removing it, I don't see them.

The alert shows up in a file "alert" in the default directory /var/log/snort.  One can change it by the command line option -l <new directory>.

I don't know why snort is not sending the syslog using UDP socket.  "strace" command showed me it's actually using UNIX socket. Specifying the destination in configure file (emerging.conf) output alert_syslog: host=192.168.181.1:514, LOG_AUTH LOG_ALERT didn't help.  Had to put a workaround by using a script that listens on unix socket and send it using UDP socket.


Yes, it is very normal for compliance scanning software to require the scanner's IP to be whitelisted in the local firewall.

The concept of compliance scanning is to scan the entire system to ensure a fully adhered to baseline at the very least.  That's excellent that the firewall is doing its job, you now know that.  But you also need the compliance scanner to scan the system to ensure patching, account, local security, general settings, etc, compliance as well.  In order to allow that, you'll need to give the external scanner full network access to the target systems, which includes whitelisting the scanners IPs in the firewall.

Does this all makes sense?


What are sensitive Wordpress site directories

On Wordpress, user-generated content is supposed to go into /wp-content while other file names and directories (content inside /wp-admin, /wp-includes) are mostly static and predictable as they belong to the Wordpress core.

Directory listing inside /wp-content can help you enumerate uploaded media files (/uploads), themes (/themes) and most importantly plugins (/plugins). Being able to list all installed plugins without tedious guessing helps to quickly identify outdated versions - which is a great advantage since vulnerable plugins are one of the most common entry points. I've also seen some plugins use their own caching mechanisms and store potentially sensitive data in files with randomized names. A /tmp directory inside /wp-content is common, too.

While that's not limited to Wordpress, you might also stumble upon database backups or legacy files with changed names (e.g. wp-config.php_old) that you wouldn't discover by brute forcing paths. To identify all user-generated files I'd suggest you simply spider the index and diff the directory structure against a default installation.

But although directory listing on Wordpress facilitates information gathering, it usually doesn't pose an immediate, exploitable threat.


Proper way to combine multiple secrets into one HMAC key?

At first it seemed to me that XORing the crypto-random secret keys is a good solution because the resulting key is also cryptographically secure (ref. https://crypto.stackexchange.com/questions/48145/xor-a-set-of-random-numbers), i.e. HMAC(claims, secret1 ^ secret2). But for this to work you would need to share your deployment secrets - avoid if possible.

The advantage of nesting the HMAC calculations like HMAC(HMAC(claims, secret1), secret2) is that each deployment can calculate the HMAC w/o sharing its secret with any other deployments.

As an alternative, a better solution might be XOR of the HMAC results instead of nesting them, i.e. HMAC(claims, secret1) ^ HMAC(claims, secret2). This approach retains more information from the claims for each HMAC operation.


How to securely sanitize data tapes, and audit the results?

Regarding the reuse of recycled tape; the business may appear sound but the technical parts are not. Even apart from the issue of securely wiping data, it is hard to determine if tapes were properly stored before they were sent to you for recycling. Magnetic tape is susceptible to mold damage if stored in high humidity conditions.

Unless it is used for forensic(skim data using non-traditional method) or other research purpose, the next viable step of recycling magnetic tape material is to create counterfeit/ after market product or even "refurbished as new".

Use of research or forensic techniques to recover data means that data not recoverable by normal methods doesn't mean the data can't be recovered at all. Any method that claims safe wiping of data by today's forensic standard may also be insufficient for future forensic methodologies.

If your facility signs any sort of strict data destruction agreement with a client, reuse of the client's tapes should be avoided at all costs. Your business would risk major legal liability if someone could prove your data destruction destruction facility didn't destroy the tapes.


Why I recived user-set on my Nmap analyze?

The user-set reason is shown if the reason is set to ER_USER. (This is stored in an enum in portreasons.cc of the nmap github repository.

This mapping is set in portreasons.cc:

reason_map_type::reason_map_type(){
reason_map[ER_RESETPEER] = reason_string("reset","resets");
reason_map[ER_UNKNOWN] = reason_string("unknown-response","unknown-responses");
reason_map[ER_USER] = reason_string("user-set","user-sets");

There is only a single point in the NMAP project when the ER_USER reason is set, and that is in this piece of code:

...
        if (pingtype == PINGTYPE_NONE && !arpping_done)
          hs->hostbatch[i]->reason.reason_id = ER_USER;
        else
          hs->hostbatch[i]->reason.reason_id = ER_LOCALHOST;
...

Your Pn flag indicates that there should be no ping used, so the above pingtype == PINGTYPE_NONE, is set by this flag, which validates the first part of the conditional.

Now, there's only the !arpping_done left, which appears to be "false" in your result, as the reason ER_USER is printed in the end.

The flag is initialized as false
And the only code that sets it to true is:

  /* First I'll do the ARP ping if all of the machines in the group are
     directly connected over ethernet.  I may need the MAC addresses
     later anyway. */
  if (hs->hostbatch[0]->ifType() == devt_ethernet &&
      hs->hostbatch[0]->af() == AF_INET &&
      hs->hostbatch[0]->directlyConnected() &&
      o.sendpref != PACKET_SEND_IP_STRONG &&
      (pingtype == PINGTYPE_ARP || o.implicitARPPing)) {
    arpping(hs->hostbatch, hs->current_batch_sz);
    arpping_done = true;
  }

/* No other interface types are supported by ND ping except devt_ethernet
     at the moment. */
  if (hs->hostbatch[0]->ifType() == devt_ethernet &&
      hs->hostbatch[0]->af() == AF_INET6 &&
      hs->hostbatch[0]->directlyConnected() &&
      o.sendpref != PACKET_SEND_IP_STRONG &&
      (pingtype == PINGTYPE_ARP || o.implicitARPPing)) {
    arpping(hs->hostbatch, hs->current_batch_sz);
    arpping_done = true;
}

Which might seem confusing, but is explained in the comment:

  I'll do the ARP ping if all of the machines in the group are
       directly connected over ethernet.

Source

So ARP Scanning will only be done if you're targeting a machine on the local network, which i assume isn't the case.

Also from the docs, to explain the code above a little better than i did:

  For machines on a local ethernet network, ARP scanning will still be performed (unless --disable-arp-ping or --send-ip is specified) because Nmap needs MAC addresses to further scan target hosts. In previous versions of Nmap, -Pn was -P0 and -PN.

As to why no further results are shown:

-Sn (No port scan)

  This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the host
  discovery probes. This is often known as a “ping scan”, but you can
  also request that traceroute and NSE host scripts be run. This is by
  default one step more intrusive than the list scan, and can often be
  used for the same purposes. It allows light reconnaissance of a target
  network without attracting much attention. Knowing how many hosts are
  up is more valuable to attackers than the list provided by list scan
  of every single IP and host name.

So, a short conclusion:
Pn causes you to get a true pingtype == PINGTYPE_NONE, the reason that ARP Ping is interpreted as false is likely that the target device is not in yoru LAN, or isn't responding to ARP queries. sn tells nmap NOT to scan ports.


Your string has an unintended line break at the end. Use -n to omit the trailing newline character:

echo -n 'testpassword' | sha256sum > mypassword

Otherwise you end up with a different hash:

$ echo testpassword | sha256sum
e0d7d338cb1259086d775c964fba50b2a84244ba4cd2815e9f6f4a8d9daaa656  -
$ echo -n testpassword | sha256sum
9f735e0df9a1ddc702bf0a1a7b83033f9f7153a00c29de82cedadc9957289b05  -

Then just proceed as you did.
Demo:

$ echo -n "abc123" | sha256sum | cut -f 1 -d " " > password
$ john --format=raw-sha256 password
$ john --show password
?:abc123

1 password hash cracked, 0 left

(I used cut to remove the hyphen after the hash.)


Possible to get sshd (openssh) to log the public key of failed key based login attempts?

You can set the log level to VERBOSE or higher (DEBUG3) in the sshd_config file.

e.g.:
LogLevel DEBUG3

This will log hashes (for my Cent-OS setup) of the offered keys to /var/log/secure


Is there any way to send data securely from multiple As to B in the presence of eavesdropper, without losing anonymity like in a public key exchange?

You can implement this scheme by doing the following:

1.1)  Create a key pair.

1.2)  Sign the key pair using your private key.

1.3)  For each subordinate, encrypt the key pair using the subordinate's public key, and send the encrypted key pair to the subordinate along with the signature that you created in step 1.2.  Note, you are sending the same key pair to all subordinates.

Then, each subordinate does the following:

2.1)  Subordinate decrypts the key pair that you sent in step 1.3 above using subordinate's private key, and verifies the signature to ensure that it was sent by you.  Now, the subordinate has the key pair that you created in step 1.1, and can verify that it was sent by you.

2.2)  Subordinate signs the report using the private key from the key pair created in step 1.1.  Subordinate encrypts the report using your public key, and sends the encrypted report along with the signature.

Upon the receipt of a report from a recipient, you do the following:

3.1)  Decrypt the report using your private key.

3.2)  Verify the signature using the public key of the key pair created in step 1.1.

Because only the group of subordinates has the keypair that you created in step 1.1, this ensures that it was one of the subordinates that signed the report.  However, because all of the subordinates in the group have the same keypair that you created in step 1.1., you have no way of determining which subordinate signed the report.