Software for testing XSS and other web sites vulnerabilities

Here are some Open Source Web Application Vulnerability Scanners that support XSS scanning:

X5S

  x5s is a Fiddler addon which aims to assist penetration testers in
  finding cross-site scripting vulnerabilities. This is not a point and
  shoot tool, it requires some understanding of how encoding issues lead
  to XSS, and it requires manual driving.

Documentation: https://xss.codeplex.com/wikipage?title=Tutorial&referringTitle=Home
Download X5S: https://xss.codeplex.com/releases/view/43170

Grabber :

  Grabber is a web application scanner. Basically it detects some kind
  of vulnerabilities    in your website. Grabber is simple, not fast but
  portable and really adaptable. This software is designed to scan small
  websites such as personals, forums etc. absolutely not big
  application: it would take too long time and flood your network.

Download it here: http://rgaucher.info/beta/grabber/
Source code on Github: https://github.com/neuroo/grabber

Vega:

  Vega is a free and open source web security scanner and web security
  testing platform to test the security of web applications. Vega can
  help you find and validate SQL Injection, Cross-Site Scripting (XSS),
  inadvertently disclosed sensitive information, and other
  vulnerabilities. It is written in Java, GUI based, and runs on Linux,
  OS X, and Windows.

Documentation: https://subgraph.com/vega/documentation/index.en.html
Download Vega: https://subgraph.com/vega/

ZAP:

  Zed Attack Proxy (ZAP) is one of the world’s most popular free
  security tools and is actively maintained by hundreds of international
  volunteers*. It can help you automatically find security
  vulnerabilities in your web applications while you are developing and
  testing your applications. Its also a great tool for experienced
  pentesters to use for manual security testing.

Documentation: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
Download ZAP: https://github.com/zaproxy/zaproxy

Wapiti

  Wapiti allows you to audit the security of your web applications.

  It performs "black-box" scans, i.e. it does not study the source code
  of the application but will scans the webpages of the deployed webapp,
  looking for scripts and forms where it can inject data.

  Once it gets this list, Wapiti acts like a fuzzer, injecting payloads
  to see if a script is vulnerable.

Documentation: http://wapiti.sourceforge.net/
Download Wapiti: https://sourceforge.net/projects/wapiti/files/

- W3af:

  w3af is a Web Application Attack and Audit Framework. The project’s
  goal is to create a framework to help you secure your web applications
  by finding and exploiting all web application vulnerabilities.

Documentation: http://w3af.org/
Download W3af: https://github.com/andresriancho/w3af/

- WebScarab:

  WebScarab is a framework for analysing applications that communicate
  using the HTTP and HTTPS protocols. It is written in Java, and is thus
  portable to many platforms. WebScarab has several modes of operation,
  implemented by a number of plugins. In its most common usage,
  WebScarab operates as an intercepting proxy, allowing the operator to
  review and modify requests created by the browser before they are sent
  to the server, and to review and modify responses returned from the
  server before they are received by the browser. WebScarab is able to
  intercept both HTTP and HTTPS communication. The operator can also
  review the conversations (requests and responses) that have passed
  through WebScarab.

Documentation: https://www.owasp.org/index.php/Category:OWASP_WebScarab_Project
Download WebScarab: https://github.com/OWASP/OWASP-WebScarab
XSS plugin: https://www.owasp.org/index.php/Webscarab_XSS-CRLF_plugin

Good luck !


What should end-users do about Heartbleed?

End users should just wait until their sysadmins contact them with further instructions. At some point, after your sysadmins have patched vulnerable systems, you may have to:

Change passwords
Login again (because all session keys and cookies need to be invalidated)
Help senior management evaluate the actual content handled by the vulnerable servers that could have been leaked, and react accordingly.

I expect that the massive key/certificate changes about to occur will go un-noticed by most users, as those take place server-side. As to the client-side root CA trusted certs, I expect that the private key counterparts will reside on air-gapped systems, and so won't have been vulnerable to this exploit. Any updates to certificate stores that are necessary will probably just occur transparently in background updates.

I summarized the bullet points above from heartbleed.com (emphasis mine):

  What is leaked primary key material and how to recover?

  These are the crown jewels, the encryption keys themselves. Leaked
  secret keys allows the attacker to decrypt any past and future traffic
  to the protected services and to impersonate the service at will. Any
  protection given by the encryption and the signatures in the X.509
  certificates can be bypassed. Recovery from this leak requires
  patching the vulnerability, revocation of the compromised keys and
  reissuing and redistributing new keys. Even doing all this will still
  leave any traffic intercepted by the attacker in the past still
  vulnerable to decryption. All this has to be done by the owners of the
  services.

  What is leaked secondary key material and how to recover?

  These are for example the user credentials (user names and
  passwords) used in the vulnerable services. Recovery from this leaks
  requires owners of the service first to restore trust to the service
  according to steps described above. After this users can start
  changing their passwords and possible encryption keys according to the
  instructions from the owners of the services that have been
  compromised. All session keys and session cookies should be invalided
  and considered compromised.

  What is leaked protected content and how to recover?

  This is the actual content handled by the vulnerable services. It
  may be personal or financial details, private communication such as
  emails or instant messages, documents or anything seen worth
  protecting by encryption. Only owners of the services will be able to
  estimate the likelihood what has been leaked and they should notify
  their users accordingly. Most important thing is to restore trust to
  the primary and secondary key material as described above. Only this
  enables safe use of the compromised services in the future.

  What is leaked collateral and how to recover?

  Leaked collateral are other details that have been exposed to the
  attacker in the leaked memory content. These may contain technical
  details such as memory addresses and security measures such as
  canaries used to protect against overflow attacks. These have only
  contemporary value and will lose their value to the attacker when
  OpenSSL has been upgraded to a fixed version.


how does this cipher work?

Assuming you are talking about the classic (broken) algorithm, KeeLoq is a 528-round block cipher utilizing a 32-bit non-linear feedback shift register (NLFSR) and 64-bit circular shift register (the key register, initialized with the key data). It has a 32-bit block size and takes a 64-bit key. Below is a diagram of a single KeeLoq encryption round, showing the NLFSR and key register:

  How is a derived key calculated from the master key and serial number?

The key is derived from the seed, a more-or-less random value usually including bits from the non-secret serial number and some padding, and the hardcoded master key. Depending on the version of the protocol, the key may be derived either by directly XORing the master key and the seed, or by decrypting the first and second half of the seed with the master key using the KeeLoq algorithm itself:

The seed, depending on the version, may contain 0, 32, 48, or 60 random bits. This seed is shared out-of-band with the remote when it is programmed during the "learning" process. If the manufacturer key is known, then decryption is as easy as brute forcing the seed which, as mentioned, contains anywhere from 0 to 60 bits. However, according to this paper, where much of the above information was found, all ICs analyzed by Eisenbarth et al. used a seed composed of only the serial number, with no random bits. As a result, the key used by those ICs is based only on the hardcoded manufacturer key with the unique per-device serial number, making theft of that key sufficient to decrypt communications.

Section 2.2 of another paper goes into more detail about the key derivation scheme.

  Serial number of what? Does the receiver need to be told the serial number of each key fob that it is paired with?

The serial number is that of the remote. It is encoded in plaintext with every transmitted packet. The receiver obtains the serial number each time a button on the remote is pressed. Below is a diagram of the 66-bit packet used by the protocol showing the 28-bit serial number being transmitted in plaintext:


Best approach for restricting remote ssh session

PermitRootLogin no
AllowUsers jack joe
MaxSessions 5

The first 2 lines of that configuration seem just fine to me. The third one is not such necessary as if someone breaks into your system, it's enough to have 1 shell to do all the evil.

In this context, you're allowing just two users to connect, that means that those users will have to use a secure enough password to not break in (at least not easily).

There are some more things you can do:

If you're using a restricted range of IPs from whom you connect to your machine, restrict port 22 just to these ranges. Drop/reject the rest.
If not, you might use GeoIP with iptables to reject all countries from whom you don't expect connections (or said differently, only allow the ones that you expect).
There are some other tools that might help you: Fail2Ban is one of them. This will make that upon X configurable attempts with bad password into your system, the IP will be banned by iptables for an amount of time (also configurable).
There are hundreds of similar tools but this would be a good enough approach to have a basically consistent configuration.


First things first: you must (I insist, must) wipe out your hard disk and reinstall from scratch. Any half-witted attacker or mere virus which could gain root access on a system will certainly not stop after adding a folder. It is highly probable that one or several backdoors have been installed, in various system utilities and/or the kernel itself, in ways which you will not be able to detect from the machine itself. So backup data files, reinstall the system, and copy back the files only after a through verification (in particular PHP source files).

A SSL/TLS connection begins by a first message sent by the client, and beginning with a header whose three first bytes will have value 0x16, 0x03 and 0x01, in that order (assuming that the client implements TLS 1.0, which is the most common case). Your log lines look like someone tried to connect to your HTTP server as if it was a HTTPS server -- and your server, unable to make sense of the bytes sent by the client, responded with an appropriate HTTP error message (which the client probably did not understand either, since it was trying to establish a TLS connection, not to exchange HTTP messages). This is probably harmless and quite possibly fully unrelated to your intrusion issue.

To prevent any further intrusion, you must only use software which has no bug -- which is not possible with current earth-based technology. The closest you can get is to maintain your system up-to-date with known security fixes; you should check for security updates on a daily basis (with Debian, this is a matter of apt-get update && apt-get dist-upgrade).


Using VPN on Android, Necessity of Rooting

The Or apps use the Tor network, which is different to a 'normal' VPN.
You don't need to root your phone to use a VPN. Check out VPN providers such as Anonymous VPN or Express VPN.
Yes, when connected to a VPN all of your data is transmitted through the VPN connection. In regards to anonymity, it's best to do some research on VPN providers before choosing one. Many VPN providers keep logs and will provide these logs to enforcement agencies if requested.
Rooting your phone alone will not offer a higher level of privacy.


What you observe is part of an initial information gathering, i.e. check what kind of services are running, what software might run on these services etc. Based on this it can be decided if the target might be vulnerable for exploiting and which exploits to try.

... the IP with attempting to connect to telnet ports, typical behavior of an infected host

Connecting to telnet ports is not necessarily a typical behavior of an infected host but can easily be done from a system which is not infected. Checking if telnet works is also part of information gathering.


Can you generate Diffie-Hellman parameters quickly

First, 512 bits is way too small. Parameters that size can be broken in a month by a small computer cluster. Use 2048.

Second, the Diffie-Hellman parameters are public information. Any sensible cryptographic library would include default parameters -- probably from RFC 3526. (Even if your library doesn't include them, you can still use RFC 3526 parameters if you convert them to its input format.) If you insist on generating your own, do it once and hardcode them. You can even do it on your PC if you'd prefer not to wait.

This Stack Overflow question (mostly) demonstrates how to do it (though it uses 1024 bits; as I said, you should use 2048):

https://stackoverflow.com/questions/2469235/dh-keypair-generation-time-on-android

Generating the DH key pair itself is basically instantaneous.

Third, writing your own cryptographic protocol to learn is great, but do not use it in real code, with real user data, money and lives at stake. Designing secure cryptography is extremely difficult. Crypto is especially dangerous because something can look good, seem to work, and still be badly insecure. It takes teams of experts years and several tries to get it right. Use TLS.


TL;DR: Android and iOS support full device encryption.

Android

Android versions above 4.4 (your device will almost certainly be above version 4.4) have the option to enable full device encryption. Some devices even come with it enabled out of the box. Android uses dm-crypt encryption, and there's a guide on how to encrypt an Android device here.

A section of the article (some things cut out)

  Start by heading into the Settings menu and tapping on “Security”. You
  can start the process by tapping the “Encrypt phone” option.

  The next screen will present a warning to let you know what to expect
  once the process is finished. If you’re ready to proceed, hit the
  “Encrypt phone” button.

  One more warning will present itself which tells you not to interrupt
  the process. Once you're ready tap the “Encrypt phone” button to
  proceed.

  The phone will then reboot and start the encryption process. A
  progress bar and estimated time till completion will show up, which
  should at least provide an idea of how long the process will take.

  Once it’s finished, the phone will reboot and you’re back in business.
  If you set up a lock screen password, PIN, or pattern, you’ll have to
  put it in now so the device will finish the boot process.

iOS

If you have an iPhone 3GS or later, an iPod touch 3rd generation or later, or any iPad then you can encrypt your device. Most modern Apple devices already use encryption by default. Apple devices use AES-256 encryption to encrypt devices (in 2012 the NSA approved AES-256 for storing top-secret data). Here is a guide on how to encrypt your Apple device.

A section of the article

  On devices running iOS 4–iOS 7, you can do this by going to the
  General settings, and choosing Passcode (or iTouch & Passcode). As for
  iOS 8-9, Passcode  (or “Touch ID & Passcode”) has its own section in
  the Settings app. Follow the prompts to create a passcode. You should
  set the “Require passcode” option to “Immediately,” so that your
  device isn't unlocked when you are not using it. Disable Simple
  Passcode so that you can use a code that's longer than 4 digits.

  If you choose a passcode that's all-numeric, you will still get a
  numeric keypad when you need to unlock your phone, which may be easier
  than typing a set of letters and symbols on a tiny virtual keyboard.
  You should still try to keep your passcode long even though Apple's
  hardware is designed to slow down password-cracking tools. Try
  creating a passcode that is more than 6 digits.

  Once you've set a passcode, scroll down to the bottom of the Passcode
  settings page. You should see a message that says “Data protection
  enabled.” This means that the device's encryption is now tied to your
  passcode, and that most data on your phone will need that code to
  unlock it.


Genuineness of Application Pentest On Jailbroken iOS Device

Generally iOS Security assessments (a.k.a penetration testing) are targeting applications running on an iOS device and not the Operating System/platform itself (which has already been subjected to a large number of assessments).

In order to effectively assess the security of an application running on iOS a jailbroken device is needed as debugging and examining the application code and runtime behaviour is difficult without access to the underlying OS.

Most security assessment companies keep a stock of Jailbroken devices, pretty much for this purpose.

Edit to address your added question. I think replication on a non-jailbroken device would depend on the issue at hand.  As an example a security issue with an application might be that it stores sensitive data such as credentials in clear text.  Now on it's own this may not be exploitable, but it's still bad security practice.  Most security assessments I've seen would show evidence of the problem but wouldn't necessarily require replication on a non-jailbroken device every time.


Izito and similar sites keeps appearing in my search results

If you're sure the search results are NOT advertisement, then they might be redirecting your searches to their servers by redirecting. Normally they do these through installing browser plugins (via bundling with free software etc.). But you're saying this happens on a brand new installation which suggests network level rerouting or root kit (unlikely)
Process of elimination:
Before doing anything, just try using a live Linux (booted from CD or flash drive) for a while and see if the problem happens again. Don't install any of your usual software, just use browser. If it does happen again, your routers/wi-fi device (or your ISP) is a suspect. Try again on a different network (try a public wi-fi for example). If that solves the problem, you know it's in your network. If it still does happen on another network (very unlikely), then there could be a firmware level infection (again very unlikely - try with another laptop then).
If you figure out the problem is only within your network, try setting your DNS manually (instead of using your ISP's DNS automatically) on that live Linux. You can use CloudFlare's free DNS service 1.1.1.1. If that solves the problem, then the problem is
with your router/wi-fi devices (infected to reroute requests) or its your ISP (very unlikely - but if it is an extremely cheap service - maybe).
Try hard resetting your router & wi-fi and then update their firmware. Review their settings (enable firewall for example). If they are too old, consider replacing them. Routers are getting targeted in last few years b/c they are easy targets. They could be hijacking DNS settings or randomly serving different content on your requests.


For OWASP webgoat (java based CTF box), the following XML leads to listing of the /etc folder
<?xml version="1.0"?>
<!DOCTYPE comment[<!ENTITY xxe SYSTEM "file:///etc/" >]>
<comment><text>file:///etc/ &xxe;</text></comment>

SYSTEM "file:///" leads to listing of root folder
For PHP XML Parsers whereby expect module is loaded, SYSTEM "expect://id" for user id and SYSTEM "expect://ls" for listing folder can be used. Note that expect does not support spaces and some characters well


Is it possible to make a more secure random number generator algorithm by XORing two or more less secure random number algorithms?

I would not recommend combining random number generators in this way without having some underlying theory to support your case.

A simple way to illustrate the issues is to consider the behavior of low-end LCG algorithms, the popular "one-liner" schemes for generating random numbers.

These can be made to produce sequences that will pass certain statistical tests, but are not suitable for cryptographic applications.  One known flaw in such generators is that the low-order bits are not random.  For example, I have observed the low bit to oscillate between 0/1, and if you have two generators like this, and you XOR that low bit, and the generators are either in phase or out of phase, in either case the result of the XOR is rather predictable.  It's not clear that you've improved the situation, but may have made it worse.

In Knuth's discussion of random number generation, he presents a humorous example of his attempts to construct a "super deluxe" generator.


Are these "Urgent Firefox Update" popups bogus?

Always, always use ad-blockers.  Browsing the web without an ad-blocker is like sex without a condom.  Always use one unless you are 100% sure the site you are browsing has malware-free ads.

I would refrain from clicking on any pop-up, especially in this case, as Firefox auto-updates in the background and requires no user input, unless a browser restart is required.


Client-only authentication instead of server-only authentication, using OpenSSL

Once a TCP connection is established, it's symmetrical, so what you're doing is possible by having the client start a TCP connection but have the server initiates the TLS handshake.

A much simpler way though, if you really don't care about server authentication, is to configure the server with self-signed certificate and then configuring the client to ignore certificate verification.

However, I'd question the wisdom of skipping server certificate verification at all. Why do you want to skip server certificate verification in the first place?


exploit document.write with unsanitized user input

To put it simply, you can't because your your payload bob); alert(1 is a string, and JavaScript knows its a string so it won't execute it. The parenthesis and semi-colon characters can be inside the string without being executed. This code could be vulnerable if, for example, you tried to concatenate the payload into an eval() statement. This is because eval will execute code inside the resulting string.

var pos=document.URL.indexOf("user=")+5;
var userInput=document.URL.substring(pos,document.URL.length);
eval("document.write('" + decodeURI(userInput) + "');");

Then domain.com/index.html?user=bob');%20alert('1 will result in the following string being executed as JavaScript:

document.write('bob'); alert('1');

(This is why eval() is generally a bad idea)

However, a good Content-Security-Policy would probably block user input in eval() as well, so this method may not work. It depends upon the policy returned by the server, or the default controls the browser might load if one isn't specified.

Alternatives to eval()

Other dangerous ways in which a developer could accidentally evaluate user controllable data without sanitisation or validation (that might not be caught by a default CSP or client-side XSS filter).

The function constructor (can define function body as a string):

var pos=document.URL.indexOf("user=")+5;
var userInput=document.URL.substring(pos,document.URL.length);
var terribleFunction = new Function( "document.write('" + decodeURI(userInput) + "');" );
terribleFunction();

A Data URI:

var pos=document.URL.indexOf("user=")+5;
var userInput=document.URL.substring(pos,document.URL.length);
var terribleScript = document.createElement('script');
terribleScript.src = 'data:text/javascript,' + encodeURIComponent("document.write('" + decodeURI(userInput) + "');");
document.body.appendChild( terribleScript );

setTimeout (although I think this method is essentially the same as eval()):

var pos=document.URL.indexOf("user=")+5;
var userInput=document.URL.substring(pos,document.URL.length);
setTimeout( "document.write('" + decodeURI(userInput) + "');" , 100 );


.local domain any possible ways in getting the extension

You cannot claim a .local domain. This is not a public top level domain but actually reserved for internal use. For more details see the Wikipedia entry about this top level domain.


How test if a tool doesn’t check for /extendedKeyUsage=?

a certificate authority should deliver certificates with arbitrary websites in the /cn= fields but without server authentication in the /extendedKeyUsage= field.

"Arbitrary websites" sounds like something that you may or may not be the admin for.

Let me get this straight. You want a publicly-trusted CA (trusted by real devices out in the world) to issue you a malformed / invalid TLS server certificate (because the EKU is wrong), for the purpose of your security research? First, I would guess that most commercial CAs issuing TLS web certs are hard-coded to populate the EKU field correctly. Second, I am not an expert on the CA/Browser Forum rules, but issuing intentionally malformed / malicious certs off a publicly-trusted root seems like the kind of thing that could get a CA in a lot of trouble. Good luck finding one.

ORIGINAL ANSWER:

  I would need a certificate authority that would allow to ...

Why not make your own CA?

Whenever I'm testing cert validation stuff, I make a quick openssl CA using openssl. If the openssl command-line intimidates you (I don't blame you) then I recommend the CA.pl convenience wrapper. Add your new root CA to the trust store of whatever app you're testing and then you have the ability to produce any kind of bizarre cert you want and make sure the application rejects it properly.

(note, you sometimes need to get pretty down into the weeds of openssl config files depending on which certificate fields you're trying to manipulate or how you want it to do the signing.)


How can I validate data on RFID chip that has RSA signatures and SHA1 hash values?

Whether you need the signature depends on the signature type.

The main standard for RSA signatures is PKCS#1. With that standard, a RSA signature is "just a signature": it can be verified with the public key and the signed data, but it embeds no data by itself. The signature is an additional element. If you just want to compare the signed data with some user input, you can completely disregard both the signature and the public key, they are irrelevant (unless you want to make sure that the data you get from the RFID is "genuine", in which case you also want to verify the signature).

However, a RSA signature is as big as the RSA modulus, so, for a 1024-bit RSA key (a rather common key size), the signature is an additional 128 bytes. In the smartcard & RFID world, where storage space and network bandwidth are extremely scarce resources, they are quite fond of another RSA signature standard called ISO 9796-2 (the standard is not free, but you can have a reasonable description in section 2 of this article). That kind of signature uses a trick which allows for the embedding of some of the message data within the signature. You get the data back when you verify the signature. With a 1024-bit RSA key and SHA-1 as hash function, the signature can embed 106 bytes worth of data, so the size overhead implied by the signature is only 22 bytes.

So, if the signature is of type ISO 9796-2, you need both the public key and the signature to recover the complete data; otherwise, you would get only part of it (the data bytes beyond the 106 which can be embedded in the signature).

(Note: ISO 9796-2 has some weaknesses; with SHA-1 and its 160-bit output, you do not get 280 security, but something lower, closer to 261 bit operations. The article I link to above shows that this is workable with some massive but not-that-expensive hardware. If you want to use ISO 9796-2 in your own designs, I suggest that you select SHA-256, not SHA-1.)

I have no idea how you can get the signature, but it can certainly be obtained as easily as the signed data itself, because it would make very little sense otherwise.


Why is a networking hub not secure? How can we make it secure?

You can't make a hub secure.  A hub, by definition, is always going to send the traffic everywhere.  The question you link to about switches is true, but a switch is still a necessary first step to adding the security you seek.  In the related question, Thomas Pornin points out that normal switches can be tricked in to sending information to the wrong place, but that is not true of all switches when properly configured.

Features such as VLANs and static routing can be configured to make sure that a router always knows exactly where traffic should go and won't go anywhere else.  It's important to understand the features of your particular router or switch to understand exactly how to configure connections.

You can't make a hub secure because it has no switching logic by definition.  A switch, on it's own, will make a best effort to figure out where to send information, but if it isn't configured with exact information, an attacker may be able to fool it.  A switch configured with exact routing information (at a port level) will obey the routing information and only send the information to the necessary ports.

If you really need to protect traffic and a hub or dynamically configured switch or router is in the network, you can instead just use an encrypted VPN to secure your data over an unsecured link.  At that point it doesn't matter if an attacker can get your data feed as they will be unable to read or alter it.


Why is my debugger detected as a Trojan by anti-virus software?

The link provided in the question seems really fishy. If it's a "patched" version supposed to get rid of limitation, it's more than probable the fixer added some kind of additional surprises (like a virus) in it. The official site already proposes a free version of the software, so I would start here to avoid getting a virus from a random stranger.

This being said, it's not impossible that anti-viruses detect innocuous programs as malwares. This happens cause AV checks for some known signatures of exploits and/or detects unusual behaviour, like access to some memory ranges for example.

Debuggers have these kinds of odd behaviours, as the need to bind to existing processes, de-route function calls, check and modify memory, etc.


How does WikiLeaks(Julian Assange) get the US Embassy cables?

The long answer is quite complicated, and up for legal discussion.

The short answer is: He (Wikileaks) asked for them, and someone sent them.


How secure is blocking all incoming connections on my ADSL or cable router?

Using this statefull firewall should stop a large amount of unwanted connections.

Statefull firewalls are not completely impenetrable, it is possible to force a user to initiate a connection using embedded javascript within a webpage. Once connection outbound has been made it could be possible for the server to respond and deliver their payload.

The Register - Hacker pierces hardware firewalls with web page

The link above gives a greater detailed example regarding exploit via the IRC protocol but the theory should be possible on a wider scale.


PPP has several extensions for that, e.g. RFC 1968 and Microsoft's MPPE. At least this pppd for Linux knows how to use MPPE, provided that the kernel was configured to support it (the bulk encryption work is done in the kernel). See the man page for how to configure algorithms and key size.

Of course, you will get encryption only if both ends of the link support it.


How can IoT and other network devices access the internet if my router works as a firewall?

When you setup your Nest, you create an account for it and sync your devices to the account. So all the information tying your app to that particular device is saved in a Nest database somewhere on their servers. In your scenario you're asking how the Nest passes through your firewall to see what your account settings have told it to do. Your phone app can't always be on the wifi to talk to the device directly (and that would somewhat defeat the purpose of it) so UPNP doesn't come into it.

It doesn't look like Nest specify which protocols they use on their site - but there is nothing stopping it from using HTTP/HTTPS to connect to your Nest account once you've put it on the Wifi. Just the same as when your friend asks you for your wifi password - no Firewall rule changes required for them to go out to the internet once you give it to them.

Nest's own Support documentation advises that Firewall issues are still a problem.

  Is upnp absolutely required to have network devices that can.be connected to from the wan?

UPNP isn't even mentioned in the Nest support documentation. UPNP is for connecting within a network, not going out to the internet. So would be useful if you had multiple Nest devices and they had the ability to talk to each other within the Wireless Network - say if your thermostat and camera could work together to determine if there was a fire - but not for talking to your app on your phone.

  On an Asus router running Merlin, how do i find whats configured so that I can review it?

You could review your Firewall settings but assuming its already working, try installing Wireshark to monitor the outbound traffic coming from your Nest device.


Random URL string: What kind of attack is this, and what can be done to stop it?

This pattern look for me like fuzz logic/testing.
The reason can be to fingerprint your infrastructure
and/or
Get/find any bug in your web software which can be explited further
and/or
Find nonsecured resources in web site for stealing some internal/customer info.
The usage of fuzz logic also seems to be for search for valid path in the web site/app(s)
P.S. Of course this above is worst case scenario, but in security IMHO this is the way to get good evaluation of particular issue


Is it risky to install a theft-protection system?

Here is the good old wikipedia info on LoJack for laptops.

As mentioned by the page, it is NOT a remote control tools, but piece of tools that trigger as "beacon" and send information back to its designated home server.

Perhaps the biggest concern is not about the computer being hijack by more sophisticated malware(as mentioned in the wiki page about rootkit installation through vulnerabilities), but the company able to monetize from the demographic data the server collected.


Is there a way to change your current UID to equal your EUID?

The Linux system calls to do this are setreuid or setresuid, both available in section 2 of the manual. The difference is that setresuid lets you choose the saved user ID, whereas setreuid sets it automatically.
If you're using C/C++, this is easy; just #define _GNU_SOURCE and #include <unistd.h> (or the equivalent to call the relevant APIs in your language of choice). Languages that allow direct calls into C APIs should be similarly easy; the functions are defined in glibc (which many Linux programs already link against). If you're using another language that wraps the relevant APIs, such as python, consult the documentation for the wrappers in that language.
To then run another program as that user, either use a member of the exec API family (possibly the execve syscall directly) to become that program, or vfork/clone a new process and then exec inside it, or use system/popen. If not on C/C++, use the suitable program-execution / process-creation API in your language of choice.


Validating Credentials - Logic in Application vs Database

Think about it this way:

Most system have multiple components. In a traditional set up this is usually a client that is distributed to the users, a server, and a database.

The database is usually a commonly used, highly optimized piece of software written by somebody else, whereas servers are very often custom software that is written by you  specifically for the clients' needs

In this example, the server talks to the clients. If the database would talk directly to the clients it generally makes your system extremely insecure because the client (and therefore your users) has access to all your data.

The client sends a request to the server asking to verify the details that were entered with the database. Once the client is verified the server decides which information the client can see, for how long the client can request that data without having to be re-verified, the amount of data that is transmitted, etc.

Take for example google. When you google your search query, you open up a Web page (the client). The client talks to the server as you are interacting with google, the server sends you back suggestions and eventually gives you the answer to your question, but you as a client don't need access to all information in google, only google's servers should have access to all this information, and should only show you what you need to know.

Another analogy, when you're in a  restaurant, you are the client, your waiter is the server, it understands what you need, and tells the kitchen (the database) what to cook you, and once it's ready it'll bring you the result. That's about exactly what a server does.

Feel free to ask further questions :-)


Attacking several browser/OS combinations with only one link

Your browser provides to every visited website a string identifying itself and your OS, in the User-Agent header.

A website could use that information to provide the appropriate file. It is quite common on normal software that the download you are offered is the one matching your system.


Is Google Chrome Extension access to SSL certificate validation output possible?

No, and it doesn't seem likely to be added as a feature.  See https://code.google.com/p/chromium/issues/detail?id=107793#c20

  I'm just deeply concerned about the code complexity cost here, which increases the opportunity for both performance and security bugs. - rsleevi@chromium.org


SQL injection vulnerability when using prepared statements in PHP

Should I escape input when using prepared statements?

No.

You really don't need to escape input if you use prepared statements. If you want an additional layer of security, use some kind of input filter (eg get me only integers, get me only valid emails, get me only alphanum, etc).

And you obviously should not escape your password, as it doesn't even go into the query.

Escaping really only means that you escape certain characters. This means that ' becomes \' or \ becomes \\. That way, if they are inside a quoted string, they are interpreted correctly. This can prevent SQL injections if the input is inserted into a quoted string, as the attacker cannot exit that string. It doesn't do anything useful if you just apply it to all input. And it's not needed if you use prepared statements.

LIKE instead of equality

You should not use LIKE if you need an exact match. Your use of LIKE here makes it easier to bruteforce your login, and makes it easy to harvest email addresses.

For example, I can sucessfully log in as foobar@example.com:pass with %@%:pass.

As you use a loop instead of just fetching one result - which is what you should do - an attacker can use %@% as a fixed email and just bruteforce the passwords.


Are common passwords at particular risk?

Some UX specialists says that it's not a good idea to refuse a password. One of the arguments is the one you provide : "but if you ban them, users will use other weak passwords", or they will add random chars like 1234 -> 12340, which is stupid, nonsensical and will then force the user to go through the "lost my password" process because he can't remember which chars he added.

You have two options. I like them both (I explain why in each) :

Let the user enter the password he wants. This goes against your question, but as I said, if you force your user to enter another password than one of the 25 known worst passwords, this will result in 1: A bad User Experience, 2: A probably lost password and the whole "lost my password" workflow. Now, what you can do, is indicate to your user that this password is weak, or even add more details by saying it is one of the worst known passwords (with a link to them), that they shouldn't use it, etc etc. If you detail this, you'll incline your users to modify their password to a more complex one because now, they know the risk. For the one that will use 1234, let them do this because there is maybe a simple reason : I often put a dumb password in some site that requests my login/pass just to see what this site provides me.
Add some rules, like "At least one number and one special char, must be a minimum of 8 long", etc. This will go against the worst password. On the other hand, if the user has a quite complex password that doesn't match one of your rules, it will result in a bad UX.

Finally, you have to choose between a good User eXperience or an improved security. Now it really depends on which kind of project you're building : if it's a basic website to upload pics of puppys, maybe you don't have to set up a complex security system. But if you're the next paypal, you should.

Regarding your question about brute force, it depends on how you set up the password storage. If you add a salt and pepper, brute force can be made against the database. If you add a captcha in the login page, or increase the time between tries and errors, brute force won't be possible.

It's possible that the attacker use the worst password first, but I'm not sure it would be quite efficient. Even if he choose the first 3 (regarding your rules about captcha and 1-3 guesses), this will greatly reduce the probability of hacking into an account.


The goal of the creator of Rakshasa was to avoid having any malware, which could potentially be flagged by an antivirus, to be stored anywhere in the machine (whether it is on the hard-disk, in a firmware, or anywhere else).

To achieve this, Jonathan Brossard (to call the creator by his name) implemented Rakshasa with the following principle:

Rakshasa is composed mainly, if not only of Opend-Source components which are usually used in legit ways. These components include a free BIOS firmware, an associated TCP stack, and software allowing to download a remote image and boot from it. Such solution is widely used in corporate scenarios like kiosk computers, thin clients or corporate rescue systems: it allows all computer to share the system image, so you have only one share image to update instead of n machines.
The main difference here is that Rakshasa will not actually download a legit system image as this is the case for above corporate examples, it will download a modified Kon-boot image (but this could have been actually anything else) and start from it.

So, if I get back to your question:

  How is the bootkit [...] infecting the connected harddrive remotely?

There is no remote infection happening here.

Actually, the creator goes very fast over the initial contamination step which is out-of-scope of his demonstration. He mentions that the initial contamination could be done for instance by the hardware provider himself, by a parcel seizure during the delivery process, or by anyone else having a physical access to the machine (even if some TPM-based security measures may make this last one more difficult).

Contamination through malicious software should also be possible, but here comes again the antivirus detection issue since it is not part of a usual software behaviour to try to flash BIOS and network cards firmwares...

Anyway, most of this presentation consider an already infected machine. This means:

The BIOS firmware has been reflashed with a custom Open-Source firmware configured to download boot kits from a set of servers owned by the attacker,
With a full fledged attack, the firmware of a network card (I suppose another PCI device may also be fine) has also been reflashed with a custom modified firmware allowing to reinfect the BIOS firmware in case it gets cleaned by the machine owner,
The hard-disk hasn't been and will never be touched to avoid any detection.

  Does this mean that there is a boot partition somewhere on a server and Rakshasa connects to this partition...

It is not really a boot partition. It it just a boot images, which are actually standard files (for the sake of the example the presenter even named them using .pdf extensions) containing binary code to be downloaded and executed by the machine during its startup sequence.

As mentioned earlier, you will most typically find such system implemented in corporate environment for thin clients, kiosk computers and as a rescue systems: instead of reading the boot instructions from the local hard-disk, such system will read instructions from a downloaded file.

  ...and makes it so to say the boot partition of the physically connected harddrives on the victims pc?

In the above mentioned corporate example, the downloaded boot image will be used instead of the hard-disk, whether because there may not be even any hard-disk at all (thin clients, kiosk computer) or because the hard-disk may not be bootable anymore and needs to be reimaged (corporate network rescue system).

Such boot images therefore contain a full operating system dedicated to whatever it should be used for.

Rakshasa used a standard way, on the contrary, do not mean to fully replace the original operating system: it wants to be as most transparent to the user as possible.

Therefore, the downloaded boot image will not contain a full operatig system, its code will only:

Contain all requested malware and payload (Kon boot, anti-security measures, etc.) and execute them in the requested order with some of them then staying resident in the memory,
Once all payloads have been successfully executed, it will give back control to the first bootable partition, ie. from now on the machine will retrieve a normal boot sequence.

As a side note (I don't remember if it was mentionned during the presentation), while this "first bootable partition" will usually be the hard-disk, it could also be a CD-ROM if the machine owner was booting from a CD instead of a hard-disk. This has some importance since it means that booting from a Live-CD as it is often recommended to avoid malware and backdoors will not bring any security against such threats.


Encrypting data in a load-balanced application - am I doing this right?

The ideal for a situation like this is to use an HSM, but baring that as an option, using the software equivalent in DPAPI is probably your next best bet.  I also don't see an issue with storing each server's copy of the key encrypted with the DPAPI key for that server/service user.

You certainly do not want to simply store the key, unprotected, in the file system.  Almost any compromise at all of your server would leak it without further protection.

One possible enhancement, though it would require a bit of programming to retrieve, is to store the key itself in DPAPI.  It's only a small level of extra protection, since the key is still stored (in encrypted form) on the system, but it makes it marginally harder to find and may make it slightly easier to access from within your program.  Without looking in to it in depth, I think that is probably what I would do.


There are a couple techniques for this that I'm aware of, one is called Backward masking. Not to be confused with the other, Backmasking.

Backmasking is arguably intentional. Regardless, it's a method of recording something backwards onto a track, as it's explained in this wikipedia article.

Backwards Masking is where there are subtle sounds or messages played in very specific and very intentional parts of a recording with the intention that the average audience member will not notice that the secret message is there, it can be done as explained in This wikipedia article.


How to reach a hidden Python function with HTML injection in a web app?

Since HTML injection affects the client only but the python function is server side you cannot reach it directly. But your HTML injection might change the requests sent by an authorized user and this way you might cause changes in the execution of the server side application which ultimately leads to the call of the hidden python function. Useful injections are for example changes of existing HTML forms, adding new forms, links or images which all ultimately result in requests to the server as authenticated user (i.e. include the cookie).

Example:

<form action=/do_something>
<form action=/call_hidden_function>  <!-- injected this line -->
...
<input type=hidden name=crsf_protection_token value=...>
<input type=submit value="Submit form">
</form>


PCI P2PE running as independent software on POS?

I guess it depends on what you mean by POS, because this isn't really a defined term.

A POI (point of interaction) is something typically that interacts with a card and a person. Some POIs have card readers and PIN entry bits, some are just secure card readers, and you can get separate PIN entry bits that don't read cards (think of an ATM where the card reader and PIN pad are separate). In retail you usually interact with a POI device (aka chip and PIN machine).

A P2PE solution requires software running inside a POI such that the card data is encrypted within the secure processing area of the POI. The POI has to have a facility called "SRED" - secure read and exchange of data, not all POIs have this. Data is then only decrypted in the (hopefully) secure data centre of the solution provider.

This is not a bad explanation: https://www.pcisecuritystandards.org/documents/P2PE_At_a_Glance_v2.pdf


A routing firewall participates in the IP process, whereas a bridging, or transparent, firewall does not. A transparent firewall acts more as a tap on a line, while a routing firewall has to forward traffic onto its next destination.

The advantages of a transparent firewall are that it can be installed in-line between two devices without having to reconfigure the IP subnet used as the interfaces on the firewall are unnumbered. From a security perspective a transparent firewall is quieter, as it does not participate in IP connections an attacker may not even know it is there unless something is blocked. An attacker will have difficulty determining the type of firewall being used.

The advantages of a routing firewall is that as it participates in the IP protocol it can do network address translation, port translation, and tricks like source port scrambling to make fingerprinting more difficult. A transparent firewall provide these types of services.

As for which to use it depends on the problem you are trying to solve. Routed firewalls provide the most capability and flexibility, but transparent firewalls can be inserted into connections without requiring substantial network changes.


There are lots of speculations, let's try it.

Assigning 127.0.0.1/8 to the network interface

On Debian it works as root to assign 127.0.0.1/8 to the network interface:

# ifconfig lo 10.0.0.1 netmask 255.0.0.0
# ifconfig eth0 127.0.0.2 netmask 255.0.0.0

and results in:

lo        Link encap:Lokale Schleife
          inet Adresse:10.0.0.1  Maske:255.0.0.0
...
eth0      Link encap:Ethernet  Hardware Adresse
          inet Adresse:127.0.0.2  Bcast:127.255.255.255  Maske:255.0.0.0
...

ping 127.0.0.1, however, fails with an Illegal Argument error:

 $ ping 127.0.0.2
 PING 127.0.0.2 (127.0.0.2) 56(84) bytes of data.
 64 bytes from 127.0.0.2: icmp_seq=1 ttl=64 time=0.030 ms

 $ ping 127.0.0.1
 connect: Invalid argument

So this is something that needs to be look at in more detail by analyzing the source code.

Pointing "localhost" to another ip-address

Editing /etc/hosts as root so that it points localhost to another ip-address works:

ping localhost
PING localhost (209.85.149.147) 56(84) bytes of data.
64 bytes from localhost (209.85.149.147): icmp_seq=2 ttl=57 time=165 ms

Whether this is an issue or not depends on the situation: The client may send a password without validating the server by either not using ssl or trusting any certificate (There are testing-certificates for localhost out there that are signed by trusted CAs). This password might be reused elsewhere or the server may accepting connections from other interfaces because it is password protected anyway.

In the standard configuration the host file has precedence over NIS and DNS, which requires local root access and makes this kind of attack pointless. But if the priority was changed, this is exploitable using the DNS or NIS servers.


What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt?

Reading
Cross-Origin Resource Sharing CORS and the Same Origin Policy SOP are your friends here.  Since the javascript in question is not hosted by http://127.0.0.1, it will run afoul of the SOP and default rules for CORS in browsers will prevent the javascript from reading the response.  That covers your immediate question - you are protected by default.
Writing
However, that "reading" part is key. The browser will in all circumstances make the request to the server. The only thing CORS does is block the JavaScript from receiving the response. As such, CORS stops an attacker from reading data from elsewhere, but doesn't stop it from sending data elsewhere.
As a result if your application were to make important state changes due to receiving a request, you may end up with issues.  Helpfully, CSRF tokens would protect you against such attacks.  To be clear, JavaScript is not even required for an attacker to send a request elsewhere (h/t mti2935) - an img tag embedded on a page you visit can trigger a GET request to any server, making it especially easy for attackers to trigger undesired actions if your server takes actions as the result of a GET request.
Therefore if your application makes state changes without CSRF protection, and the attacker knows about the endpoint, you may be in trouble.  For a real life example insecure and commonly used routers have been exploited like this.  Consider this hypothetical URL in the web application hosted by a home router:
http://admin:admin@192.168.1.1/enable_remote_admin_access

It enables remote admin access (aka adjusts config so that people can login to the admin section of the router from the internet), it has a well known URL, it requires basic authentication, and the router ships with a well known default username and password (admin:admin).  As a result an attacker creates a webpage that makes a simple GET request to the above URL.  The attacker won't get a response from the router (because of CORS) but the router still receives the request and if vulnerable, is now ready to accept admin connections from the internet.  The malicious script then phones home with the victims IP address and another quick script checks their IP address to see if there is now an accessible router.  If so, then the attacker has silently gained full control over the victim's home network simply because they visited the wrong page and were using a common, vulnerable router.
Arithmetic
Of course a custom application is much harder to take advantage of like this because it is a blind attack.  Without information about what they are attacking, it's nearly impossible to have any success.  As a result the practical risk level is likely low since the attack surface is so tiny. Still, here are some caveats to keep in mind:

All bets are off in the event of a targeted attack. If the attacker knows you run some software locally that has a vulnerability, they just need you to visit the wrong link.
CORS config is important. If your local app uses an overly permissive CORS configuration then an attacker could read the results and "browse" your application.
Depending on how the network is configured, some basic port scanning may be possible.
DNS rebinding (h/t EdC) may allow an attacker to circumvent the SOP and CORS.  There can be obstacles to such an attack, but a determined attacker may improve their odds of success by using it.


Does the ARM TrustZone technology support sealing a private key under a code hash?

Yes and no.
Strictly speaking, TrustZone is only a processor feature that provides isolation between tasks via the MMU and the memory bus. You can think of it as a poor man's virtualization: there's just the hypervisor (the TZ secure world) and the regular operating system (the TZ normal world). This architecture allows sensitive data to be manipulated outside the reach of the regular OS, but there's a major hurdle: TrustZone in itself does not provide any way to store data. So you can create a key in the secure world but not store it anywhere.
All high-end ARM processors (such as found on most smartphones and tablets) have TrustZone (it's part of the core processor architecture), but it takes more to make it useful. Some processors include additional features that make TZ useful, in particular a way to store a key. This can take the form of some write-once memory (e.g. fuses, typically a few hundred bits thereof) that is only accessible to TZ secure world code. With a protected runtime environment plus a cryptographic key that is only known to this environment, you can build a TPM-like framework to store and manipulate confidential data including signature keys. The Trusted Computing Group is working on it.
This has been used in several mobile devices, though information (especially reliable information) is scarce. Microsoft's Surface RT tablet is based on an ARM processor and has no discrete TPM chip, but has a Bitlocker implementation that is based on a firmware-based TPM, apparently using TrustZone. Several Android devices by Motorola have security features that use code in TrustZone (of course, using a protected environment is no help if the code that you put there has security holes). You can find proposals for security architectures leveraging TrustZone both in ARM promotional literature and in academic publications.
So with TrustZone and a bit more, you can indeed build a system architecture where a key can be stored in a way that cannot be extracted through purely software means. Hardware means are another matter (unlike smartcards, smartphone processors are not designed to self-destruct when someone scrapes the wrapping of the package).


Is there a "security fail forum / website" with lessons learned?

The Department of Homeland Security offers Open-Source Infrastructure Reports though daily emails, and in tandem with this you may sign up for US-DHS-CERT updates on vulnerabilities.  I don't know of a singular source with this information.

http://www.dhs.gov/dhs-daily-open-source-infrastructure-report

https://www.us-cert.gov/ncas/current-activity

For a comprehensive list, such as the one you are looking for, cross-referencing will more than likely be necessary.

For the specific format of information you are looking for, the IRC site may have this type of information, though you would be essentially entering the 'wolves den.'


what does it happen on the destination side that makes this attack effective (hypothetically) ?

A SYN flood is effective since each new SYN marks the beginning of a potential new connection and thus the system will allocate a new state (i.e. memory) and send a SYN+ACK back.
An ACK which does not match an existing connection and its state though will simply be discarded. No new memory need to be allocated for this, no data will be sent back. It still takes some time to process and it consumes bandwith, but that's it. This means an ACK attack is not very effective compared to a SYN attack.


Should I encrypt my entire hard drive, or only a partition?

Both solutions are acceptable but they have different pros and cons.

Full disk encryption:

Pros: you have no risk of leaking some sensitive data in a non encrypted partition

Cons: if things go wrong, the full disk become unreadable and you will have to try to recover/reinstall from a removable bootable media: do not forget to build and securely store it
Encrypted partition(s):

Cons: if you only encrypt a data partition, sensitive data can end in temporary files or swap file in a non encrypted partition

Pros: if things go wrong, the unencrypted partitions will be easier to recover

Following is my (subjective) advice:

If you have a recovery partition in your disk, this one should not be encrypted, but you should encrypt all windows partition be them system or data if you want to be super safe, or only the sensitive data partition if you can accept that an attacker could find traces in temp or swap files.

Alternatively, you could build a (set of) removable recovery data, and go with full disk encryption.

The initial encryption time does not really matter IMHO. It happens only once. But 10 hours for 150 Gb seems rather weird. SATA disk io throughput should allow around 100Mb/s, so encrypting 150Gb should not exceed a couple of hours.


What's the mitigation strategy for when a CA's private key is stolen?

A stolen CA private key is a bad situation indeed. Response depends on the extent of the breach, and the context.

First, it may be so that the CA private key was not exactly stolen, but merely used improperly. For instance, in the case of the Comodo event, the compromise was on Registration Authority accounts. The RA is the component who tells to the CA what to put in certificates; the RA is the part that actually maps physical identities to the physical world. In that case, the CA key was not stolen, and though certificates with wrong contents were issued, the CA still had reliable knowledge of all issued certificates. It thus sufficed to revoke the fake certificates themselves, not the CA. This is the good case, where damage is contained.

If the CA key was used and there is no reliable way to have an exhaustive list of the fake certificates, or it the CA private key was actually stolen and is now under control of the attacker, then the corresponding certificate will need to be revoked. This is done not by the CA itself, but by its upper CA.

Then, to repair all the honest sites who just "disappeared" through such revocation, a new CA can be installed, and automatically emit new certificates for all the previous clients (this assumes that we still have all the issued "honest" certificates somewhere). It suffices to copy the identities and names from the old certificate to the new one.

For business reasons, it may be negotiated to delay the compromised CA revocation until the new CA and new customer certificates have been created and deployed. There is not a lot of margin for that, though.


What can my ISP see regarding my VPN tunnel?

Your ISP would be able to see the following:

That you are using VPN
The IP address (on the ISP's network) from which you are connecting to the VPN
The IP address of the entry node of the VPN
The volume of data between any two points in time that you are sending and receiving through the VPN

Without the cooperation of the VPN provider, the ISP would not be able to see:

The web sites that you are visiting or the servers that you are connecting to

Even with the cooperation of the VPN provider, the ISP would still not be able to see the information in plaintext form that you are sending to these servers or receiving from these servers, assuming that you are using a secure protocol supported by the server, inside the VPN tunnel, such as HTTPS, SSH, SFTP, etc.

However, it should be noted that an entity that is able to surveil large swaths of the internet (such as a three-letter agency) may be able to determine the web sites that you are visiting, and the servers that you are connecting to, by using 'big data' to match up the dates and times of the chunks of packets that they see traversing your connection to your ISP, with the dates and times of the chunks of packets that they see traversing the server's connection to the server's ISP.  Even though these packets are encrypted, if they are able to match up enough of these chunks of packets over the course of time, they can determine with a high probability that it is you connecting to the server via the VPN.  Bruce Schneier writes about this in his latest book, 'Click Here to Kill Everyone'.


Guest user on Mac Book Pro is suddenly on. Was I hacked?

Apparently was turning on "Find My Mac" that turned on the guest account:
https://discussions.apple.com/thread/4145011?start=0&tstart=0


Here a cheat sheet that summarizes all nmap switches.
https://pentestlab.wordpress.com/2012/08/17/nmap-cheat-sheet/
Notice all ping-related switches begin with 'P', so I assume Pn means Ping Not.
I thing it easy to remember now :)


Does using Chrome bypass the Apple iOS gotofail bug ?

No, Chrome on iOS is not affected by this bug as it doesn't use Apple's offical SSL/TLS library.

On Mac OS X, Chrome and Mozilla Firefox are not affected either.

Note that other applications than internet browsers are affected by this bug, in fact any application that relies on Apple's SSL/TLS library to encrypt data is affected (e.g. Mail, Calendar, etc.).


Bluetooth Low Energy - Relationship between PINs and man-in-the-middle attacks

This is for BT pre-4.0:

It meas that the conversation between the 2 devices when generating the initialization key does not contain the PIN in clear text, the PIN is used in a function like this (pseudo-code):

GenerateKey(PIN, sizeof(PIN), RAND, D_ADDR)

Where:

RAND: A 128-bit ~random number generated by the device (by software).

D_ADDR: Device address, it is a unique 48 bit sequence. (IEEE).

It returns:

A 128 bit initialization key via shifting and xors (Linear feedback shift registers, the output is combined by a state machine)

Both devices will share this initialization key, which they use as their temporary link key and will be discarded after the success of the interchange.

For more technical details, check this presentation from the course CSE446 (Software for Embedded Systems, University of Washington), it goes from higher to lower level explaining all this.


How to secure Password and Salt on a deployed application

You can add a per-instance salt as well.  This would be stored in the config for the application, and would result in different hashes for each instance, even for the same salt/password combination.

Now the question arises of why you'd want to do that.  If someone has gained read access to one database and write access to another, it seems they've already got quite a bit of access.  Why would they copy a salt & password over rather than (say) just inserting a new account?


Closing unnecessary ports is a good first step, but the software running behind the ones that are open is just as important.  For instance, SSH is generally considered a secure protocol, but it's still one of the most popular ways attackers try to exploit servers. It remains a popular avenue of attack not because it's inherently insecure, but because many admins get lazy - they don't bother to update the SSH server software to the latest version, ensure that all users have strong passwords, disable login from root, use certificates, create a lockout policy, etc. etc.

So as you can see, there are about a zillion things you can do just to secure SSH alone, and each one provides one extra layer of security.  If you use all these measures, the chance that someone could still get in will be drastically reduced, but it will never be 0%.  There's no such thing as a 100% secure system.

My point is, knowing which ports are open isn't really enough to definitively say whether your AP is secure or not.  Your configuration details matter a lot, and there a ton of ways you can further increase the security of the services running on the AP.  You have to find a balance - secure enough to (reasonably) be sure that no attacker would be able to get in, but not so secure that it greatly impacts usability.

Also, you seem to be focused on securing the access point itself, but what about the network that the access point is creating and the clients connected to the network?  For example, you might want to implement WPA2-Enterprise or at least WPA2-Personal, enable client isolation, add a filter/IDS to prevent users from downloading malware, block P2P protocols and file sharing, add a usage agreement if this is a public network, block access to certain domains, log client traffic...things of that nature.


Cannot connect using ECDH-RSA-AES256-SHA

Use ECDHE instead.

I think you're mixing up ECDH and ECDHE.

$ openssl ciphers -V 'ALL:COMPLEMENTOFALL' | sort | grep ECDH | grep -- '-RSA-AES256-SHA '
      0xC0,0x0F - ECDH-RSA-AES256-SHA     SSLv3 Kx=ECDH/RSA Au=ECDH Enc=AES(256)  Mac=SHA1
      0xC0,0x14 - ECDHE-RSA-AES256-SHA    SSLv3 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA1

The "ECDH-" one uses fixed DH parameters inside the certificate. This is rarely used. And your certificate is not one such fixed-DH certificate. It has the line "Public Key Algorithm: rsaEncryption", so it's the regular RSA type certificate.
The "ECDHE-" one uses ephemeral DH parameters. This is the one that you can use with your certificate.

Further reading

Anonymous/fixed/ephemeral (EC)DH: OpenSSL Wiki: Diffie-Hellman in SSL/TLS


Is a public /admin route a security flaw?

It is not a security flaw to use a known admin URL. The things that should be secret are the management credentials, not the URL. It's like hiding a door, while really it's the key that you should keep secure.

You can protect the door better using human guards, a perimeter fence, extra secure lock, sturdy walls, etc. This should not give you a false sense of security: the lock should still be secure to let only authorized persons enter, but these measures can help.

Translating them to the digital world, you can put the admin panel behind an IP address whitelist (guards that check ID cards), have multi-factor authentication (extra secure lock), only allow connections through an internal management network interface (a fence), etc.

It slightly helps not to have a known/predictable URL, but this is mainly useful for common applications. If there are ten thousand WordPress websites out there and a security issue is found, then the first thing hacking groups do is send hack attempts to as many /wp-admin pages as possible (the standard WordPress admin URL). If you changed your URL to /wp-admin5839 then your site will not be hit in the first wave with untargeted attacks. Nevertheless, if someone means to hack specifically your site, odds are that they spent time guessing your admin page already or managed to figure it out some other way, and once the security issue becomes known, they will just use it on your hidden page before you have a chance to patch. So it doesn't help a lot, but it does help a little in some specific scenario.


Presentation on Web App Security (ACM Student Chapter)

The OWASP Top 10 is a great idea for content - although as you may see from my other posts, I always recommend a piece around business practicality, so if you can combine the talk with information on implementation and business risk I think it can make a very powerful presentation.

For example, incorporating information on how complex remediation for each of the OWASP top 10 is can be of high value (eg the code changes for reducing the risk of SQL injection attacks is relatively straightforward in coding frameworks which have input validation and output encoding modules)

You may think that that may be off-topic for technical folks, devs etc., but it will help them if they are in a position to understand business drivers (or blockers) for remediation work.


is IPSEC Authentication between local domain hosts a part of normal behaviour in a Windows network?

Short answer is: probably normal.

Windows server 2008 can use IPSec (if configured) for domain and server isolation.

It depends on the configurations and the Group Policies involved. Aside from this answer, you'll need to head over to a Windows admin forum or Superuser for specifics.


Can JSON webtokens be used to simplify the OAuth2 protocol without compromising security?

The point of the code is to prevent collection of the access token by a man-in-the-middle between the user and the authorization server.

Once the client has the code it needs to use that code in addition to its own client ID and secret and send it off to the authorization server for an access token. This has the benefit that both you and the client are authenticated/authorized against the authorization server, meaning the protected resource has some assurance every party is who they say they are. Once the client has the token, it's supposed to store the token internally and never release it to you.

The interaction between you and the client is authenticated by its own mechanism (say a session cookie), and the client then uses the access token it has internally to reach out to the protected resource.

The key here is that the client is sufficiently protected from someone grabbing the token because it's (for example) on a remote web server instead of the just running locally on your computer.

Conversely, if the client eventually reveals the token to the user, either by using it for it's own session management, or is running locally on your own computer, then the code doesn't provide any value because you can easily extract the client Id, secret, code, or token.

Adding the client Id to the token doesn't necessarily prevent stealing of the token. It just means the token was intended to be used through a given client.


The difficulty here is that the client is responsible for clearing the cookie value (whether it holds a session token or not) - from the server end, all you can do is hope that the cookie is cleared as you've requested. That's not really strongly definable - by definition, non-compliant clients wouldn't obey, so would keep the session token around.

The solution, therefore, is to unset the cookie value by whatever means you might consider valid (set it to expire in the past, empty it, set a dummy session cookie, or whatever), and expire the session token on the server side.

You control whether the server treats the session cookie provided as a valid token, so should ensure that it doesn't - at that point, it doesn't matter what the client does, and you can even pick up on "invalid" session tokens being provided as an indication that something has gone wrong - either the user has been changing the session value, the client hasn't deleted properly, or it's an attempt to use an old session (perhaps the computer was hibernated with the site open, and your session timeout has occurred).


Can I query on row-encrypted data in my database?

First off, it isn't just frequency you are protecting.  If the attacker cracked value X in your example, he now knows all 50 rows.  Let's say the rows are users, and the encrypted value is a password.  Attacker has now just popped all 50 users at once.  That's more valuable than just knowing 50 entries were the same.

Random salt and IV per row doesn't make your query impossible, per se, but does make it really difficult without doing a lot of other gyrations.  Look up the term "homomorphic encryption" which offers a number of ways to perform some searches over encrypted data.  In practice, this isn't really scalable, or done in production, but it isn't impossible.

https://en.wikipedia.org/wiki/Homomorphic_encryption

"How much security" to sacrifice for functionality, is really a question only you can answer.  What is your threat model? What's the value of the data being protected?  Security has to be in service of your business goals, not an end unto itself.  It has a cost which must be less than the value it brings.  If the attacker gets control of your search function, they get all your data any way.

In practice, if your data can fit in memory, your best bet may be to decrypt the data, search in memory over the plain text, and leave the data encrypted on disk.  If you can't, you may have to leak partial information by breaking the stored data up into searchable-sized subchunks.

You don't want to give up the masking nature of the same plain text encrypting to different cipher texts if your protected information is something like passwords, or credit card numbers.  Anything an attacker can run a forward encryption on can be used for a known plaintext attack.

Example: Baddie (with read access to your database - but not the secret) signs up for your service as a legit user, and provides "password" as her password. She then pops the database, finds her own record, and now knows all the other users who also picked "password."  Very bad.


Create OpenVPN/easy-rsa certificate from public key only

You can use import-req command to import client csr and then sign it. For more info check the documentation of easy-rsa program


Is native OpenZFS (on FreeBSD) block-level encryption secure?

According to those slides explaining OpenZFS encryption, it appears that OpenZFS encryption is far stronger than LUKS or VeraCrypt encryption.
LUKS and VeraCrypt use the XTS mode of encryption, which is not authenticated, and is vulnerable to some limited recovery of information when an attacker can have access to the encrypted data at different times. On the other hand OpenZFS encryption is authenticated and at the state of the art. Also, you should take care to disable compression when encrypting with OpenZFS.
However, this authentication comes at a cost and is the reason it was not used in XTS: for every encrypted block in ZFS, 288 bits are used for authentication and encryption metadata (salt, MAC and IV). This is space that cannot be used to record data, so one can record fewer data on the same volume with OpenZFS than with XTS.


Cross site scripting when the greater than and less than signs are escaped?

Oh yes it is!

Consider this HTML:

<a href="{{str}}">

and consider an input like:

" onmouseover="alert('GOTCHA')"

You get the picture.

If your javascript is being injected within a tag then you don't need the angle brackets. I borrowed this off this similar S/O post: https://stackoverflow.com/questions/5696244/xss-is-escaping-and-sufficient

If you are interested in filter evasion like this consult:

https://owasp.org/www-community/xss-filter-evasion-cheatsheet

This has all the common stuff.

As far as safety is concerned: Encode all the things! You never know how clever the attacker is.


For IP addresses you need to use the whois server of the appropriate Regional Internet Registry.  You can see that I've done so below by adding "-h whois.arin.net" to the (Linux) whois command line. Generally, one starts with ARIN and moves as directed.  In this case, the IP you've identified falls into ARIN's jurisdiction, and is owned by the DoD/DNIC/DISA.  Further probing of that address is... not recommended.

$ whois -h whois.arin.net 164.45.207.200

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/public/whoisinaccuracy/index.xhtml
#

#
# The following results may also be obtained via:
# https://whois.arin.net/rest/nets;q=164.45.207.200?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2
#

NetRange:       164.45.0.0 - 164.45.255.255
CIDR:           164.45.0.0/16
NetName:        DNIC-RNET-164-045
NetHandle:      NET-164-45-0-0-1
Parent:         NET164 (NET-164-0-0-0-0)
NetType:        Direct Assignment
OriginAS:
Organization:   DoD Network Information Center (DNIC)
RegDate:        1992-11-16
Updated:        2012-02-28
Ref:            https://whois.arin.net/rest/net/NET-164-45-0-0-1

OrgName:        DoD Network Information Center
OrgId:          DNIC
Address:        3990 E. Broad Street
City:           Columbus
StateProv:      OH
PostalCode:     43218
Country:        US
RegDate:
Updated:        2011-08-17
Ref:            https://whois.arin.net/rest/org/DNIC

OrgAbuseHandle: REGIS10-ARIN
OrgAbuseName:   Registration
OrgAbusePhone:  +1-844-347-2457
OrgAbuseEmail:  disa.columbus.ns.mbx.arin-registrations@mail.mil
OrgAbuseRef:    https://whois.arin.net/rest/poc/REGIS10-ARIN

OrgTechHandle: MIL-HSTMST-ARIN
OrgTechName:   Network DoD
OrgTechPhone:  +1-614-692-6337
OrgTechEmail:  disa.columbus.ns.mbx.hostmaster-dod-nic@mail.mil
OrgTechRef:    https://whois.arin.net/rest/poc/MIL-HSTMST-ARIN

OrgTechHandle: REGIS10-ARIN
OrgTechName:   Registration
OrgTechPhone:  +1-844-347-2457
OrgTechEmail:  disa.columbus.ns.mbx.arin-registrations@mail.mil
OrgTechRef:    https://whois.arin.net/rest/poc/REGIS10-ARIN

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/public/whoisinaccuracy/index.xhtml
#

$

Depending on your whois client, it may automatically follow referrals across to other Regional Registries (RIPE, APNIC, etc.) as shown below.  Even if it doesn't, the top bit of information is pretty explicit about where to go for more answers, allowing you to make the second query yourself.

$ whois -h whois.arin.net 212.27.48.10

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/public/whoisinaccuracy/index.xhtml
#

#
# The following results may also be obtained via:
# https://whois.arin.net/rest/nets;q=212.27.48.10?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2
#

NetRange:       212.0.0.0 - 212.255.255.255
CIDR:           212.0.0.0/8
NetName:        RIPE-NCC-212
NetHandle:      NET-212-0-0-0-1
Parent:          ()
NetType:        Allocated to RIPE NCC
OriginAS:
Organization:   RIPE Network Coordination Centre (RIPE)
RegDate:        1997-11-14
Updated:        2009-03-25
Comment:        These addresses have been further assigned to users in
Comment:        the RIPE NCC region. Contact information can be found in
Comment:        the RIPE database at http://www.ripe.net/whois
Ref:            https://whois.arin.net/rest/net/NET-212-0-0-0-1

ResourceLink:  https://apps.db.ripe.net/search/query.html
ResourceLink:  whois.ripe.net

OrgName:        RIPE Network Coordination Centre
OrgId:          RIPE
Address:        P.O. Box 10096
City:           Amsterdam
StateProv:
PostalCode:     1001EB
Country:        NL
RegDate:
Updated:        2013-07-29
Ref:            https://whois.arin.net/rest/org/RIPE

ReferralServer:  whois://whois.ripe.net
ResourceLink:  https://apps.db.ripe.net/search/query.html

OrgAbuseHandle: ABUSE3850-ARIN
OrgAbuseName:   Abuse Contact
OrgAbusePhone:  +31205354444
OrgAbuseEmail:  abuse@ripe.net
OrgAbuseRef:    https://whois.arin.net/rest/poc/ABUSE3850-ARIN

OrgTechHandle: RNO29-ARIN
OrgTechName:   RIPE NCC Operations
OrgTechPhone:  +31 20 535 4444
OrgTechEmail:  hostmaster@ripe.net
OrgTechRef:    https://whois.arin.net/rest/poc/RNO29-ARIN

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
# If you see inaccuracies in the results, please report at
# https://www.arin.net/public/whoisinaccuracy/index.xhtml
#

Found a referral to whois.ripe.net.

% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '212.27.48.0 - 212.27.48.255'

% Abuse contact for '212.27.48.0 - 212.27.48.255' is 'abuse@proxad.net'

inetnum:        212.27.48.0 - 212.27.48.255
netname:        FR-PROXAD
descr:          Proxad / Free SAS
descr:          Server internal infrastructure (SLB)
descr:          Bezons, France
country:        FR
admin-c:        ACP23-RIPE
tech-c:         TCP8-RIPE
status:         ASSIGNED PA
mnt-by:         PROXAD-MNT
created:        2005-09-05T15:24:55Z
last-modified:  2005-09-05T15:24:55Z
source:         RIPE
remarks:        INFRA-AW

role:           Administrative Contact for ProXad
address:        Free SAS / ProXad
address:        8, rue de la Ville L'Eveque
address:        75008 Paris
phone:          +33 1 73 50 20 00
fax-no:         +33 1 73 92 25 69
remarks:        trouble:      Information: http://www.proxad.net/
remarks:        trouble:      Spam/Abuse requests: mailto:abuse@proxad.net
admin-c:        APfP1-RIPE
tech-c:         TPfP1-RIPE
nic-hdl:        ACP23-RIPE
mnt-by:         PROXAD-MNT
abuse-mailbox:  abuse@proxad.net
created:        2002-06-26T12:46:56Z
last-modified:  2013-08-01T12:16:00Z
source:         RIPE # Filtered

role:           Technical Contact for ProXad
address:        Free SAS / ProXad
address:        8, rue de la Ville L'Eveque
address:        75008 Paris
phone:          +33 1 73 50 20 00
fax-no:         +33 1 73 92 25 69
remarks:        trouble:      Information: http://www.proxad.net/
remarks:        trouble:      Spam/Abuse requests: mailto:abuse@proxad.net
admin-c:        APfP1-RIPE
tech-c:         TPfP1-RIPE
nic-hdl:        TCP8-RIPE
mnt-by:         PROXAD-MNT
created:        2002-06-26T12:29:10Z
last-modified:  2011-06-14T09:03:07Z
source:         RIPE # Filtered
abuse-mailbox:  abuse@proxad.net

% Information related to '212.27.32.0/19AS12322'

route:          212.27.32.0/19
descr:          ProXad network / Free SA
descr:          Paris, France
origin:         AS12322
mnt-by:         PROXAD-MNT
created:        1970-01-01T00:00:00Z
last-modified:  2001-09-22T09:31:43Z
source:         RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.89.2 (HEREFORD)

$


Here's my rough guesstimate:

Code review:

1000 LOC = 1 hour
85000 LOC = 85 hours

Hourly rate: 100$/hr

85 hours * 100$/hr = 8500$

If your software uses an ORM and a well documented MVC framework, it can speed up the code review significantly.


Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?

To sign the CSR:

 openssl x509 -req -days 365 -in private.csr -signkey ca.key -out test.crt

From man x509:

  -signkey filename ... If the
  input is a certificate request then a self signed certificate is
  created using the supplied private key using the subject name in the
  request

In other words: you are creating a self signed certificate with ca.key as the key and not a certificate with private.key as key as you intended. Since you are using different ca.key you therefore get different  keys inside the generated certificate and thus different subject public key information.

What you need to do instead is to create a CA and use it to sign the CSR like this:

$ openssl req -x509 -newkey rsa:4096 -keyout c0.pem -out c0.pem -days 365
$ openssl x509 -req -days 365 -in private.csr -CA c0.pem -CAcreateserial -out test0.crt

If you do this with different CA but the same CSR you will see that all resulting certificates have the same subject public key information, using the key included in the CSR.


Should I prevent user from operating with site during some first seconds?

In theory, the website operator can prevent such attacks by using window onfocus and onblur events. For example, on window onfocus event one could create a <div> overlay over whole page for half a second, thus preventing interaction with page elements. I didn't see that in use anywhere though, and I don't suspect it will gain popularity as it will probably be bypassable anyway.

The attack you describe, created by Michael Zalewski is just one of many proof-of-concept novelty attacks demonstrating why 'the web is broken' at a fundamental level. Some of his previous attacks based on timing - HTML5 geolocation consent hijack - exploited similar vector and has been fixed at a browser level. One would suspect this class of vulnerabilities will be fixed in browsers in the (possibly far) future, but they are very tricky to fix as they exploit human imperfections that may manifest in various ways.

Long story short: You could try to experiment with onfocus and onblur events, but be prepared for browser quirks and don't spend too much time over it. It's unlikely to be massively abused by black hats.


Concepts of a secure note sharing system

Your system is flawed in the first two steps because you're storing the keys with the encrypted data on the same system. If an attacker compromises the server they can just go find the keys and use the keys to decrypt the secret notes. It's difficult to accomplish what you want to do without the users all storing a private key for encryption on their device.

Because I can't comment on your original question some more information would be useful to make a strong recommendation. Do you need users to be able to access this system for any device? Is the system Internet facing? Roughly how many users will the system support?


Is it safe to generate a password for a user during sign up in a web application?

That totally depends on your application and its requirements.

If your applications needs to verify users' email addresses, then you can send them a randomly generated token (one-time use and valid for a limited time period) for the first-time login, on the email address that they provided during sign-up. And ask them to set their own password after they use that random token to login. This way you are also verifying their email address.

If you are not concerned with email verification, you can simply ask them to choose a strong password during the sign up. In this case, don't forget to re-authenticate the users just after they sign up.

In any case, make sure that your users choose a strong password, by complying with a strong password policy. Also make sure that all password related functionality in your application (forgot password, reset password, etc.) also comply with your application's password policy.


Is it possible to detect the real IP from a modifed header

No, the IP header will have been modified to remove the sender's real IP.

If you believe the packet with the altered header originated within your network, you may be able to check network logs to find the origin of the packet.


What are the security threats of zip file uploads and what preventive actions should be taken?

One area where ZIP files could present a risk to the application the zip bomb attack.  this occurs where an archive is constructed in such a way that when it's opened it consumes a large quantity of space on the server potentially causing it to crash.

It might be possible to mitigate this issue by opening zip files on a dedicated filesystem and then aborting the unzip action if a predetermined maximum size is reached.


There is an open source ransomware called Hidden Tear. The code encrypts files with the following extensions: ".txt", ".doc", ".docx", ".xls", ".xlsx", ".ppt", ".pptx", ".odt", ".jpg", ".png", ".csv", ".sql", ".mdb", ".sln", ".php", ".asp", ".aspx", ".html", ".xml", ".psd" by default with AES 256 bit encryption.

It is open source so it could be easily customized to not only look for additional files but also the way encryption is done.


Your question should not be "How do I secure these ports" your but rather "How do I secure the services listening on these ports".

There is a wealth of knowledge on well known ports available on the internet and the services that run behind them. I would recommend researching hardening of IIS / Windows server and go from there.

It's good that you've taken a proactive approach to assess your web server, and understanding how it functions. It's not uncommon for known good services to initiate communications and open ports dynamically, so even if your research to a high number port comes empty handed it's not necessarily something to worry about. For the most part Windows IIS is pretty secure out of the box and doesn't require too much tweaking, but just ensure that you're updating your server with patches regularly. These days most attackers will focus on the web application running on your server, rather than attacking the server itself.

Using TCP View will also provide you with a look into what services are utilizing the ports.


Distributed Denial of Service Attacks could be on the application layer (and thus also Application Layer Denial of Service Attacks) but they are usually not. Most DDoS attacks are at the network and transport layer, i.e. they saturate bandwidth or they exhaust resources of the target system like in case of SYN floods.


How is Thread local storage used by malware/Virus?

You're thinking of TLS callbacks!
TLS includes TLS callbacks, an array of pointers to functions that are to run before the EP is reached.

This functionality exists so the developer can initialize the TLS data before the program is run.
Putting your malicious code here would make it somewhat unexpected to the analyst since your debugger would normally break on the entry point (and after the TLS callbacks are executed).
This would make the analysis a bit harder.


which hash algorithm takes longer time if we compare between md5 or sha256?

It depends on the hardware and software you are running. Below are comparison results between MD5 and SHA using the openssl library on my computer. But different implementations that take into account hardware acceleration will give different results. Modern CPUs have hardware acceleration for hash functions. GPUs will have better results and specialised hardware exists to accelerate hashing even further. That is especially true for SHA because it is used for crypto currency mining.
$ openssl speed md5 sha1 sha256

type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
md5              58318.02k   171878.31k   370689.37k   502232.78k   580493.45k
sha1             69045.26k   188431.38k   385979.53k   543316.53k   625854.82k
sha256           49638.66k   107537.27k   183872.51k   226793.47k   237228.26k

The 'numbers' are in 1000s of bytes per second processed.

2021 update with OpenSSL 1.1.1d: now we see md5 is often slower on newer CPU, and for larger chunks:
## PC i7-1165G7 @ 2.80GHz (2020)
OpenSSL 1.1.1d  10 Sep 2019 / built on: Mon Dec  7 20:44:45 2020 UTC
type      16 bytes    64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
md5     189018.70k  418310.85k   712090.28k   890189.14k   956293.12k   962560.00k
sha1    287134.62k  746529.17k  1474064.38k  1973607.08k  2197842.60k  2192179.20k
sha256  222301.71k  603962.47k  1213340.33k  1665262.59k  1849016.32k  1847388.84k

## Server AMD EPYC 7571 (2018)
OpenSSL 1.1.1d  10 Sep 2019 / built on: Mon Dec  7 20:44:45 2020 UTC
type      16 bytes    64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
md5      93668.33k  213979.18k   378971.56k   467472.38k   501205.67k   504064.68k
sha1    165020.82k  442991.72k   888443.48k  1188591.62k  1319236.95k  1330080.43k
sha256  142886.55k  375612.63k   791567.70k  1095950.34k  1234381.48k  1246827.86k

## Server E5-2682 v4 @ 2.50GHz (2016)
OpenSSL 1.1.1d  10 Sep 2019 / built on: Mon Dec  7 20:44:45 2020 UTC
type      16 bytes    64 bytes    256 bytes   1024 bytes   8192 bytes  16384 bytes
md5     101505.24k  207422.92k   393158.83k   453332.99k   527085.34k   490711.72k
sha1     98091.83k  249828.79k   389640.36k   675694.25k   686966.33k   721021.61k
sha256   55421.86k  130103.33k   251929.17k   302571.86k   296977.81k   338439.56k


These two options have to do with account permissions which relates to file access, network access, and more depending on the policies within an environment.

By default in Windows 10, when you launch an application you launch it as a standard user. In some instances, the OS will determine that you need administrative credentials to launch the application and automatically escalate your privileges or fire off the UAC (User Account Control) popup to ask if you want to run an application. The system them tags your system utilization and the application permissions based off the user trying to run the application.

Now, some applications like the command prompt don't always require administrative credentials. In these instances, the command prompt will run as the standard user account even if the acting user resides within the administrative group. However, if the user needed to run an administrative task from the command prompt, they will need to search for the exe, right click, and select run as administrator. In this case, the same user account is associated with the application, but the application is granted system level access.

The remaining option, "Run As User" is really helpful in enterprise environments where a help desk agent may need to support a user. Instead of logging out of the user's session, an agent could enter credentials through a screen sharing session to launch standard user level access tools that are blocked by policy to the originally logged in user.

Lastly, there are instances in which "Run as administrator" is also run by a separate user from the logged in account. This will duplicate many of the effects of the Run As User but with administrative privileges for the application.