What are the advantages of EV Certificate?

Extended Validation certificates are intended to show the user more visibly the institution to which they were issued. The technical aspects of the certificates themselves is combined with visual clues in the user interface of the application verifying them: the green bar and a visible name next to the location bar in the browser.

For example, the EV certificate at http://www.paypal.com/ will make the browser show a green bar and display "PayPal, Inc." next to it. This is designed not only to link the certificate to the domain owner (like standard domain-validated certificates do), but also link it to a more physical institution (here, PayPal, Inc.). To do this, the CA must verify that the named institution is indeed the one owning the domain.

Ultimately, this is more about making a more authenticated link between the domain name and the company name than making "more secure" certificates. From a cipher suite point of view (which is what determines the encryption algorithm and key size), EV certificates are no different from DV certificates (blue bar).

Stepping back a little, you need to realise that the effectiveness of HTTPS relies on the user checking that it's used correctly. (The server has no way to find out whether the client is victim of a MITM attack otherwise, unless using client-certificates too.) This means that the users have to:

check that HTTPS is used when they expect it to be,
check that there are no warnings,
check that the website they're using is indeed the one they're intending to visit, which leads to a couple of sub-points:

checking that it's the domain name they expect,
checking that the domain name belongs to the company they expect.

EV certificates are intended to solve that last sub-point. If you already know that amazon.com belongs to Amazon.com, Inc. or that google.com belongs to Google Inc., you don't really need them.

I'm not personally convinced that this approach completely works, since they can be misused (see NatWest/RBS example below) and some CAs seem to propagate vague (and potentially misleading) information as to what they really are, in an effort to promote them.

In general, if your users already know that your domain name is yours, you don't really need one.

Here are more details from a previous answer I gave to a similar question:

  [...]

  The domain-validated certificates guarantee you that the certificate
  was issued to the owner of that domain. No more, but no less (I'm
  assuming the validation procedure was correct here). In many cases,
  this is sufficient. It all depends on whether the website you are
  promoting needs to be linked to an institution that is already well
  known off-line. Certificates that are validated against an
  organisation (OV and EV certs) are mainly useful when you need to tie
  the domain to a physical organisation too.

  For example, it's useful for a institution that was initially known
  via its building (e.g. Bank of America) to be able to say that a
  certificate for bankofamerica.com is indeed for the place where you've
  given your physical money. In this case, it makes sense to use an OV
  or EV certificate. This can also be useful is there is ambiguity
  regarding which institution is behind the domain name (e.g. apple.com
  and apple.co.uk), which is even more important is the similar domain
  name is owned by a rival/attacker using the name similarity for bad
  purposes.

  In contrast, www.google.com is what defines Google to the public;
  Google has no need to prove that google.com belongs to the real
  Google. As a result, it's using a domain-validated certificate (same
  for amazon.com).

  Again, this is really useful if the user knows how to check this.
  Browsers don't really help here. Firefox just says "which is run by
  (unknown)" if you want more details about the cert at www.google.com,
  without really saying what is meant by this.

  Extended-validation certificates are an attempt to improve this, by
  making the organisation-validation procedure more strict, and by
  making the result more visible: green bar and more visible
  organisation.

  Unfortunately, this is sometimes used in a way that increases
  confusion, I think. Here is an example that you can check by yourself:
  one of the large UK banks (NatWest) uses the https://www.nwolb.com/
  for its on-line banking services. It's far from obvious that the
  domain name belongs to NatWest (who also own the more logical
  natwest.co.uk name, by the way). Worse, the extended validation (if
  you check the name next to the green bar) is done against "Royal Bank
  of Scotland Group plc".

  For those who follow financial news, it makes sense because both RBS
  and NatWest belong to the same group, but technically, RBS and NatWest
  are competitors (and both have branches on the high street in the UK
  -- although that's going to change). If your user doesn't have that extra knowledge about which groups trade under which name, the fact
  that a certificate is issued to the name of a potential competitor
  should ring alarm bells. If, as a user, you saw a certificate on
  gooooogle.com issued to Microsoft or Yahoo, however green the bar is,
  you should not treat this as Google's site.

  One point to bear in mind with EV certificates is that their
  configuration is hard-coded into the browsers. This is a compile-time
  setting, which cannot be configured later on (unlike normal trusted
  certificate stores, where you could add your own institutional CA
  cert, for example). From a more cynical point of view, some could
  consider this as a convenient way for the main players to keep a
  strong position in the market.


Anonymized posting mechanism for members-only-post mailing lists

mailman mailing list already have a setting for that, see anonymous_list. This setting can be set by a list administrator from the web interface, it doesn't need access to the server.
On the other hand, if what you want is that your members are able to write to the list from new, temporary mails (so that even the mailing list doesn't know the poster identity), you can set a moderator password and let that be known by all subscribers.
Anyone in the group can by providing that password in a header so the email passes, or by directly logging in the web interface themselves and approving the held message they just sent.


Content Security Policy https: and data: meaning

Content-Security-Policy: img-src 'self' https: data:;

I would read that out loud as "images can be loaded from the current domain, or any https:// url, or are data:// url".
So having https: basically means that images can be loaded by reference from any 3rd party website. In this day and age, that's basically all websites. So that sorta defeats the purpose of having this directive in the first place.
data: is a bit more subtle; this is intended if you want to embed an image directly into an HTML document; ie you don't want the page to make an external GET to fetch the image. W3Docs give this example which is the data for a 5x5 pixel red dot.
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4
  //8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==" alt="Red dot" />

Embedding an image of any reasonable size will be much larger, for example here is my StackExchange avatar (some random site, not sure if this link will go dead at some point).
So again, allowing data: kinda defeats the whole point of this CSP directive.

What's the point of CSP: img-src anyway?
Content-Security-Policy is generally viewed as a second line of defense against XSS; say an attacker has found a bug in your UI that lets them inject arbitrary javascript into the page that users load; having a tight CSP on your page can sandbox what that malicious javascript can do.
I think the point of the img-src directive is to prevent:

Website defacement: embedding images into your page that are unprofessional, lead to phishing, or otherwise damage your website.
Exploit vulnerabilities in a client's image parser. Historically there have been, for example, buffer overflows in the Android media parser, and an attacker may be embedding a crafted jpeg on your webpage with the goal of taking over devices of your users.

You'll have to decide for yourself whether the legitimate functionality of your website needs the UI client to be able to load images from arbitrary https URLs, or to directly embed data: encoded images, but if you don't, then you should probably take out those CSP directives in order to maximize the protection you're getting from your CSP.


I'm not convinced that we should.  SHA-3 has some nice features for sure, but for the reasons I list below, I would probably suggest using SHA-2 or BLAKE2 for the time being.  Even NIST themselves say:

  Currently there is no need to transition applications from SHA-2 to SHA-3.

That said, you may still be thinking "why not"?

SHA-3 is not yet FIPS-140 compliant.  Without FIPS 140-3, it is out of reach of non-military government agencies and government contractors.  If you are worried about FIPS compliance, you are stuck with the SHA-2 suite for now.  SHA-3 was included in FIPS 140-2 Annex A, and even though this document still says "Draft" on the cover page it appears to have been finalized via these two pages.
Performance.  SHA-3 is incredibly fast in hardware (ASIC) implementations.  However, it is much slower in software running on CPUs with limited registers, meaning it's less useful generally*.  Its primary competitor (at least, in the aftermath of the competition) is BLAKE2, which has shown to be much faster on general CPUs and is sometimes favored over Keccak/SHA-3 for other reasons.  While I feel that NIST understated the in-software performance differences between finalists, their comments on performance in the last round of decision making may be helpful to provide context.  From NISTIR 7896, section 3.2:

  a. All five finalists perform well enough to be usable in most applications.
  b. None of the five finalists is the best for every application, and none offers really compelling improvements over the SHA-2 algorithms.
  c. The ARX-based algorithms, BLAKE and Skein, perform extremely well in software.
  d. Keccak has a clear advantage in throughput/area performance in hardware implementations.
  e. Grøstl and JH are considerably slower than the other three algorithms in most software implementations.

Potentially unnecessary prudence.  It is also worth noting that BLAKE got negative remarks due to how similar it was to SHA-2.  Out of prudence, this helped Keccak/SHA-3 win the competition.  From NISTIR 7896, section 3.4:

  b. Because SHA-2 is an ARX-based design with a key schedule, it has some important design elements in common with BLAKE and Skein, although neither is closely related to SHA-2. However, cryptanalytic tools that apply to SHA-2 in the future seem more likely to apply to BLAKE or Skein than to the other three finalists.

* Recall that we're discussing cryptographic hash functions here, not necessarily password hashing functions or KDFs.

Some more reading that may be worth the time:

NIST may not have you in mind, by Adam Langley
The Keccak sponge function family
NISTIR 7896
BLAKE2: “Harder, Better, Faster, Stronger” Than MD5
Why Replace SHA-1 with BLAKE2?
Maybe Skip SHA-3


You can roll your own, but you probably will make a major security mistake if you are not an expert in security/cryptography or have had your scheme analyzed by multiple experts.  I'm more willing to bet on an open-source publicly known encryption scheme that's out there for all to see and analyze.  More eyes means more likely that the current version doesn't have major vulnerabilities, as opposed to something developed in-house by non-experts.

From Phil Zimmermann's (PGP creator) Introduction to Cryptography (Page 54):

  When I was in college in the early 70s, I devised what I believed was a brilliant
  encryption scheme. A simple pseudorandom number stream was added to the
  plaintext stream to create ciphertext. This would seemingly thwart any
  frequency analysis of the ciphertext, and would be uncrackable even to the
  most resourceful government intelligence agencies. I felt so smug about my
  achievement.

  Years later, I discovered this same scheme in several introductory
  cryptography texts and tutorial papers. How nice. Other cryptographers had
  thought of the same scheme. Unfortunately, the scheme was presented as a
  simple homework assignment on how to use elementary cryptanalytic
  techniques to trivially crack it. So much for my brilliant scheme.

  From this humbling experience I learned how easy it is to fall into a false sense
  of security when devising an encryption algorithm. Most people don’t realize
  how fiendishly difficult it is to devise an encryption algorithm that can
  withstand a prolonged and determined attack by a resourceful opponent.

(This question has more discussion of the above quote.)

If you are not convinced of "Don't Roll Your Own [Cryptography/Security]", then you probably are not an expert and there are many mistakes you likely will make.

Is your application robust against:

Timing Attacks.  E.g., to the nanoseconds do completely-bad keys and partially-bad keys take the same amount of time in the aggregate to fail?  Otherwise, this timing information can be exploited to find the correct key/password.
Trivial Brute Force Attacks; e.g., that can be done in within seconds to years (when you worry about it being broken within a few years).  Maybe your idea of security may be a 1 in a billion (1 000 000 000) chance of breaking in (what if someone with a bot net tries a few billion times?).  My idea is to aim for something like 1 in ~2128 ( 34 000 000 000 000 000 000 000 000 000 000 000), which is roughly ten million billion billion times more secure and completely outside the realm of guessing your way in.
Attacks on user accounts in parallel; e.g., you may hash passwords with the same (or worse no) 'salt' on all password hashes in the database like what happened with the  leaked LinkedIn hashes.
Attack any specific account trivially simply.  Maybe there was a unique random salt with each simply hashed (e.g., MD5/SHA1/SHA2) password, but as you can try billions of possible passwords on any hash each second, so using common password lists, dictionary attacks, etc. it may only take an attacker seconds to crack most accounts. Use strong cryptographic hashes like bcrypt or PBKDF2 to avoid or key-strengthen regular hashes by a suitable factor (typically 10(3-8)).
Attacks on guessable/weak "random" numbers.  Maybe you use microtime/MT-rand or too little information to seed the pseudo-random number like Debian OpenSSL did a few years back.
Attacks that bypass protections.  Maybe you did hashing/input validation client side in  web application and this was bypassed by the user altering the scripts.  Or you have local application that the client tries running in a virtual machine or disassembles to reverse engineer it/alter the memory/ or otherwise cheat somehow.
Other attacks, including (but not attempting to be a complete list) CSRF, XSS, SQL injection, network eavesdropping, replay attacks, Man in the Middle attacks, buffer overflows, etc.  Best protections very quickly summarized.

CSRF: require randomly generated CSRF tokens on POST actions; XSS: always validate/escape untrusted user-input before inputting into the database and displaying to user/browser.
SQLi: always use bound parameters and limit how many results get returned.
Eavesdropping: encrypt sensitive network traffic.
Replay: put unique one-time nonces in each transaction.
MitM: Web of Trust/Same as site last visited/Certificate issued by trusted CA.
Buffer overflows: safe programming language/libraries/executable space protection/etc).

You are only as strong as your weakest exploitable link.  Also just because you aren't rolling your own scheme, doesn't mean your scheme will be secure,  it's quite likely that the person who created what you rolled out was not an expert, or created an otherwise weak scheme.


What is 1024 in "The length MUST NOT exceed 2^14 + 1024" in TLS?

These numbers don't “mean” anything, they're just numbers chosen to be sensible.

For compression, the reason is given just above:

  Compression must be lossless and may not increase the content length by more than 1024 bytes.

Since the content may be at most 2^14 bytes long, the compressed version of it may be at most 2^14 + 1024 bytes long. If a TLS endpoint receives a TLSCompressed fragment that is too large, it is allowed (and even expected) to terminate the connection, because the sender is sending it invalid data. This sort of limitation allows TLS endpoints to know the maximum amount of memory they will need to support a connection in the worst case.

For TLSCiphertext, a payload of at most 2^14 + 1024 bytes is encrypted. The result has some overhead (nonce, authentication tag, padding) that depends on the encryption method. This clause guarantees that no matter what the encryption method is, the overhead will never be more than 1024 bytes. (Actually the wording here does not guarantee this limit for the overhead when the payload is less than 2^14 bytes. There is an explicit guarantee in §6.2.3.3 for AEAD ciphers, but not for the other ciphers, which is probably an oversight.)


Need DNS changer app (or method) which actively locks DNS servers

Instead of locking DNS records, you can try to block all DNS requests.

If the problem is that you then cannot add new DNS records to domains that are not in the hosts file, just check all incoming DNS requests and see if the domain is in the hosts file. If it already is, block the DNS packet, so it doesn't change, if it is not in the hosts file, add the domain to the hosts file.


Risk involved with using SSH for CTF challenges?

OverTheWire is a very reputable site that has been used for war games/training for a long time. You don't have anything to worry about there.

As far as SSH goes, Kali does not by default run an SSH server, only the client. This means that you can make outbound connections, but a remote server cannot attach to your SSH session and send commands back. Just take caution and avoid trying to make a connection back to your machine for any reasons.


Don't bother writing your own site for a practice like that. Instead, make use of the plentiful resources on the web.

A good practice target is the Damn Vulnerable Web Application(DVWA) project. The OWASP WebGoat project is another nice one.


Persistent exploits on "baremetal" cloud hosting services

It is unlikely, but not impossible.

As previously mentioned, cloud hosting services use hypervisors to isolate VMs from each other (if there is more than one) and to isolate the VMs from the underlying OS and hardware.

Hypervisors, however, are not immune to vulnerabilities. Here is an example of vulnerabilities affecting Xen (a popular hypervisor). Not all vulnerabilities allows an attacker to break out from the hypervisor, but it happens.

Let us consider an attacker that successfully escalated its privileges to hypervisor level. In addition, the attacker needs to find vulnerabilities to insert a backdoor/implant in the firmware itself. Again, this is unlikely, but not impossible. It is possible that the firmware integrity is not verified at boot time or during an update. It is also possible that the firmware vendor did not respect the specification or that there is a vulnerability.

The combination of successfully finding and exploiting vulnerabilities in a hypervisor and firmware is low, but not impossible.

Knowing if such risk is worth considering depends on your threat model.
For example, it is worth considering in the case of a highly motivated and resourceful attacker.

One would still argue that it would be simpler for the attacker to use another vector. For example, a phishing campaign targeting the cloud provider employees?


Do WiFi passwords remain accessible significantly after logging in?

To be able to reconnect to a WiFi router, with out prompting the user every time for the shared secret, the client operating system needs to remember the shared secret.

Some operating systems make this "hard" for a user to see, but this will not prevent a determined user from recovering the shared secret.

Yes this is a weakness, but then so is any scheme based on a secret shared with all your users. If you want better security on WiFi look into using client-side certificates using 802.1x. Again the credentials are still stored on the client device so anyone with access to the unlocked device will be able to get access to that certificate, but at least the cert is only tied to one user and is easier to revoke then a shared secret.

Edit - Captive Portals

Some places do do this, usually hotels, search for "Captive Portals". This approach has many weaknesses, most prominently it is not implemented in the WiFi protocols.
This is often overcome by the router redirecting all http traffic from a given MAC to the captive portal until the client has logged in. If you start every session with a plain text HTTP request this is almost acceptable. If however you start your WiFi Session with a POP3,IMAP,SSH,HTTPS etc. session this work significantly less well.
Another weakness of most of these systems is that they are based on MAC address, which is snoop-able and spoof-able.


Can a Certificate Authority associated with Active Directory publish a client certificate to a browser?

You can use Group Policy to install the certificate on the client machines.  You will need to bind the certificate to your site through IIS/Apache to complete the process.  Keep in mind that you will need to ensure that your internal CA is trusted by your internal clients.

I think this is in fact reasonably secure, and one of the use cases that Certificate Services was designed to accommodate.

Here is a link from MSDN detailing the specifics of implementing such a system: https://msdn.microsoft.com/en-us/library/bb727098.aspx


Is it possible to create a certificate for a key pair which I do not possess?

Your understanding of certificate signing process
Yup, I think you generally have this right. One minor quibble is that it's not necessarily the DN that's being verified; nowadays the important information is usually carried in the SubjectAlternativeName field(s). Often a CA will only require the CSR to contain a public key and signature, and any other metadata in the CSR is ignored and taken instead from your account info.
Also, to elaborate on your 2., the CSR format is specified in RFC 2989 and does indeed include a mandatory signature field. Any CA worth their salt should validate an incoming CSR by checking that the signature validates under the public key contained in the CSR and reject the CSR if it does not.
 4.2 CertificationRequest

   A certification request shall have ASN.1 type CertificationRequest:

   CertificationRequest ::= SEQUENCE {
        certificationRequestInfo CertificationRequestInfo,
        signatureAlgorithm AlgorithmIdentifier{{ SignatureAlgorithms }},
        signature          BIT STRING
   }

Scenario:

I have a public key for which I do not possess the corresponding private key.

Can I create a CSR without the private key?

Technically yes, you can throw any random bits into the signature field and have a syntactically-valid CSR, but anyone trying to process the CSR should reject it because it has a broken signature.

Can I create a certificate for this CSR if I am the CA and I ignore to validate the private key ownership?

If you're the CA you can do whatever you like. You don't even need a CSR; if you have access to the CA private key then you can create certificates containing data you want by producing the X.509 ToBeSigned (TBS) structure in a hex editor, signing it, and stuffing the TBS structure and signature bytes into the right place in an X.509 object.

Can the above be trivially demonstrated using openssl commands which are available or does it need tweaks and custom tools?

This I would need to go away and play with, which I don't have time for right now. The core question is whether openssl has a setting to disable CSR Proof-of-Possession (PoP) checks when issuing a cert from a CSR. If yes, then it'll happily sign any broken CSR you give it.


Nothing has changed in the industry. Qualys is now just highlighting what we already know.

It is to give you a reminder that you should move away from SHA-1. It's not generally considered a critical problem yet, but should be sorted as part of normal refresh/update cycles.


The short answer is:No.

It was absolutely not targeted because of the use of the remote code execution vulnerability used in EternalBlue (leaked from NSA hack)  to spread the malware , they probably scanned the entire internet for vulnerable systems with exposed 445/tcp port (allowing the exploit of the SMB - an application-layer network protocol mainly used for providing shared access to files)


Suppose I regularly use JWTs from AUTH SERVER to sign in to several several websites, including A and B. Without the aud claim, the JWTs would be identical. This would allow a malicious admin from A to use my JWT to authenticate to B.


How to identify if a field is encrypted?

Depending on what types of data you're expecting, you could try looking at the entropy (randomness) of the data. Properly encrypted data should be pretty much indistinguishable from random noise, and will have a much higher entropy than any kind of structured data.

Shannon entropy is a common way of determining the level of "randomness" of strings - you can find plenty of example code in various languages.

There are some other kinds of data that will also have very high entropy (images, compressed data, etc), but you can probably check for these looking at the signatures/magic bytes.

Not foolproof, but might give you a good starting point.


What are the requirements of becoming a WHOIS Proxy or Privacy service (not a registrar)?

The ICANN says:

There are two general types of these services:

A Privacy Service lists alternative, reliable contact information, like an address or phone number, in WHOIS while keeping the domain name registered to its beneficial user as the registrant.
A Proxy Service registers the domain name itself and licenses use of the domain name to its customer. The contact information of the service provider is displayed rather than the customer’s contact information. The Proxy Service provider maintains all rights as a registrant (such as to manage, renew, transfer and delete the domain name), and assumes all responsibility for the domain name and its manner of use.

As well as:

Proxy and privacy services are among the least developed of the WHOIS policy areas. Until the adoption of the 2013 RAA, there were few ICANN rules or policies applicable to these types of services, which at times resulted in unpredictable outcomes for stakeholders affected by these services. The 2013 RAA includes an Interim Specification that describes a minimum set of requirements for privacy and proxy services offered by a Registrar or its affiliates. These requirements were adopted on a temporary basis (expiring on 1/1/2017), to allow for the GNSO to recommend appropriate policies to apply to the provision of these services. In conjunction with these policy development activities, ICANN is committed to establishing an accreditation program for privacy and proxy service providers to establish a contractual framework for enforcing these new rules and policies on a consistent basis, across all commercial providers of these services. For information on how to participate in these policy development activities applicable to privacy and proxy services, please visit the Get Involved section of the site.


Type about:support in firefox
Click Profile Folder | Open Folder which should open your profile folder.
Find file called SiteSecurityServiceState.txt and open it
Find the entry for your site url and remove it. Entry would looks something like - github.com:HSTS  120 17242   1521194647604,1,1
Make sure for above firefox is closed so that it does not overwrite it.

Firefox stores HSTS entries in this file with their expiration periods. Removing this entry should allow you to hit http url. TO further prevent it you can probably change permission of this file to read only.
More details - Understanding HTTP Strict Transport Security (HSTS)
NOTE : This will not work for well known sites like google as those lists are preloaded by browsers. Works fine for others. See above link for details.


Along with advice on how to use Burp, you should also not forget to customise the following:

Form Submission:

To set suitable names and values for forms submitted by Burp, as I presume you don't want to send 'Weiner' :-)

Within the Burp window - navigate to the 'Spider' tab and then the 'options' menu. From here you should update the standard values within the forms section:

Click on each value and select 'edit', change the value and then click on the 'update' field before selecting the next value:

Payload:

You can also edit the default payloads that are used within Burp. This can be done by unpacking the .jar file. This example uses 7Zip to unpack the latest Burp file.

Firstly right click on the .jar file and select open with 7Zip. This will show:

Then open up burp\PayloadStrings\:

From this folder, select fuzzing - full.pay. Within this file you will see options that can be configured to your specific needs (highlighted in the following image):

Spider:

For manual spidering then Burps own help page has the following advice:

  passively spider as you browse - If checked, Burp Spider will process
  all HTTP requests made through Burp
  Proxy, to identify links and forms on
  web pages visited. Using this option
  can enable Burp Spider to build up a
  detailed picture of an application's
  contents even when you have only
  browsed a subset of that content with
  your browser, because all content that
  is linked from visited content is
  automatically added to the Suite site
  map.

This is done by visiting the 'Spider' tab and then selecting the 'options' tab:

This way, you control the generation of the site map without flooding the host with traffic.

Hope this helps.


Is there a way to calculate the complexity of an XSS-vector?

I'd suggest that trying to apply numeric values to abstract constructs like "risk", "impact" and "likelihood" isn't likely to be a great idea.

The problem is that each of these terms tends to be both subjective (what's likely to one person isn't likely to another) and extremely situational (the impact of XSS on one site will be likely different to another), so realistically there's very limited use in doing it (apart from to appease management who insist on quantification and ranking of things)

You can see loads of examples of these kinds of problems where people try to quantify vulnerabilities.  A good example with CVSS is this.

Having an open telnet port (an entirely unencrypted service) is CVSS 4 according to Rapid7 or perhaps 5.8 if you listen to Tenable , so obviously subjective as it's the same issue.  Then for added fun you can compare to having a self-signed certificate, which whilst not always ideal, is better than no encryption at all, but Tenable rate this as CVSS 6.4 , so higher severity than no encryption at all ! (Rapid7 has this one as 4)

Given that people can't even agree on consistent ratings for identical findings, I'd recommend against trying to rank things like XSS which have a much greater variety to them.


Retrieving malware report information from malware network

Learn more about sandbox environments, try Cuckoo sandbox.
You can configure everything, so that it takes screenshots (which are not infected) and generate other information.


How to implement authenticated encryption using pycrypto or a python library?

PGP (python-gnupg) really sounds like the way you want to go.

Public key crypto is messy because the actual asymmetric cipher is only used to encrypt a one-time session key, which is then used with symmetric crypto (e.g. AES) to encrypt your files. Managing all of that manually would be a headache. But PGP already has all of the details worked out, you just have to call the appropriate functions.

Plus, you have pre-built CLI tools (gpg) to allow you to work with messages outside your app.


Or maybe it is bluetooth? I found something like that: Bluetooth PAN and this, which says

  My Mac reports very similar IP addresses for both, starting with 172.20.10 and differing only in the last octet.

It seems like you could be able to get IP address for a bluetooth connection like that. Try to investigate more into it, because from what I saw, different MACs in iPads and iPhones are only for wifi and bluetooth.


Orbit Downloader botnet program removal [solved]

System restore is almost enough . And since it has been discovered it has been flagged by almost every AV so yeah don't worry about it .


Can viruses steal MAC addresses? Why is MAC address bad?

I think there's a massive misundestanding about what a MAC Address is.

Nobody should get worried about MAC address. Period. Unless the attacker is in the same physical network segment than you, a MAC is useless. MAC address never leave the local network, they are easily changed, faked or cloned, they are not unique even if they were meant to be (there are stories of people with duplicate MAC addresses on they networks), and if the government wants to identify you, your browser if orders of magnitude easier than the MAC. They can hack your computer outright, and get everything. MAC won't change a thing.

So don't bother thinking about the MAC.

Now, the questions:

Viruses getting my MAC:

Yes, it's possible. The getmac command on Windows or ifconfig on Linux can get it. Any program can execute the same and get your MAC. Any program can transmit it over the Internet.

It's a security risk?

No, it's not. A virus infecting your computer is a security problem. If some unknown program is reading your MAC, the program is the problem, not what the information it reads.

What if someone else uses it?

Unless they are on the same network segment than you, nothing happens. If your network card is a cheap Chinese board, at least one thousand computers are using the exact same MAC as you, right now.

I've seen reports of MAC reuse for years, and you can find much more.


Is there any way for a Content-Security-Policy to block a CSS function, (specifically the url() function)?

Content Security Policy provides only a way to restrict the target of a request based on the context of the target but not on the actual source of the target. Thus it is not possible to restrict access specifically for url() called from a CSS but it is possible to restrict access for images.

Since your objective is to make sure that no IP leaks occur I think restricting only url() from CSS might be the wrong approach from start. While url() from CSS might be the only way available for users it is not the only way other sites can be accessed from within your code in general. For But for leaking IP it does not actually matter what the source of the request was, i.e. user provided URL's or your own code. So it might be better to simply have a list of white-listed sites where embedding is allowed and deny access to all others and apply this list globally to your site.


Is there any way to securely hide data on physical media?

I believe requiring full plausible deniability leaves only Steganography:

Hide in images (approach of Freedo)
Hidden TrueCrypt partition (this is basically Steganography as well, on a (visible) partition instead of an image)

However there is one big problem with these approaches, the software to read (and most often also write) the data must not be found.
If you want everything on local disk (or other local media like CD's) this is actually a big problem as the presence of such application will raise suspicion and might very likely destroy your plausible deniability.

The solution I see for this is to download the application every time you need it but then you need a way to leave as few trails as possible. Systems like the Tor network should provide a solution here, the presence of Tor should in my opinion not undermine the plausible deniability.

And be sure to be very thorough in removing the application after using it as a lot of applications leave traces behind after removal.


How do I get SSH to prompt me with the RSA key instead of the ECDSA key?

You can also tell the server what algorithm to use from the client (for example if you already have the rsa fingerprint written down and are physically far from the server)

  ssh -oHostKeyAlgorithms='ssh-rsa' host


TURLA is the final stage of a large and sophisticated family of malware.  There have been known Windows versions since at least 2010. This 40 page presentation is the most comprehensive resource I have seen, for either platform.

TURLA - development & operations

Some Windows Highlights

Stage 0: attack stage - infection vector
Stage 1: reconnaissance stage - initial backdoor
Stage 2: lateral movements
Stage 3: access established stage -TURLA deployed
On each stage they can quit if they lose interest in target

Stage 0: Injection Vectors

Spear Phishing (CVE-2013-3346)(CVE-2013-5065)
Watering Holes [Adobe Update social engineering / Java exploits (CVE-2012-1723), Adobe Flash exploits or Internet Explorer 6,7,8 exploits]
Third party supplier compromise

Stage 1: Reconaissance Stage

Initial backdoor - WipBot/Epic/TavDig
WipBot is a combination of a zero-day and a CVE-2013-3346 exploit
Exports functions with same names as TURLA. No other similarities
Breaks debugging and most malware sandboxes
Process hops several times, wipes its own PE section
Further described in Kaspersky Lab report

Stage 2: Lateral Movements

Refine C&C
Further penetrate network
Utilize new backdoor
Gets Domain Admin credentials

Stage 3: Turla

Dropped on select machines for long-term compromise
Machines can be compromised for years without detection

Other Resources

The 'Penguin Turla' - Kaspersky Lab (linux specific details)
Symantec Report - Turla

Linux Highlights

Turla module written in C/C++
Based on cd00r
Executable is statically linked against multiple libraries
Its functionality includes hidden network communications, arbitrary remote command execution, and remote management
Much of its code is based on public sources
Cannot be detected with netstat
Does not require root access

Linux Executable Characteristics

ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, stripped

Linux Statically Linked Libraries

glibc2.3.2 - the GNU C library
openssl v0.9.6 - an older OpenSSL library
libpcap - tcpdump's network capture library

Linux C&C Details

First stage C&C is hardcoded. Known activity @ news-bbc.podzone[.]org
pDNS IP: 80.248.65.183

Linux Startup/Execution Details

Process requires two parameters: ID (a numeric value used as a part of the "magic packet for authentication") and an existing network interface name
The parameters can be inputted two different ways: from STDIN, or from dropper a launching the sample
After the ID and interface name are entered and the process launched, the backdoor's process PID is returned

Linux Magic Packet

Statically links PCAP libraries
Gets raw socket, applies filter, captures packets
Checks for an ACK number in the TCP header, or the second byte from the UDP packet body
If condition is met, execution jumps to packet payload contents and creates regular socket
Backdoor uses new socket to connect to source address of Magic Packets
Backdoor reports its own PID and IP, waits to receive commands
Arriving commands are executed with a "/bin/sh -c " script

Final Notes

Everything regarding the linux version was from the Kaspersky report. Unfortunately, detecting seems to be very difficult at this point.

"Although Linux variants from the Turla framework were known to exist, we haven't seen any in the wild yet." - Kaspersky Lab


Is ping of death attack specific to ICMP or could it also happen with other transport protocols?

The ping of death was caused by a bug in handling invalid packets. Such bugs are not restricted to ICMP but can happen with other protocols too. In fact, the more complex a protocol is the more likely bugs in handling unexpected data will be. For example in 2016 Cisco ASA had a critical bug in which it was possible for an attacker to execute code on the machine (CVE-2016-1287) with a malformed IKE (UDP) packet. Or in 2011 it was possible to DOS the Apache web server with a few crafted HTTP (TCP) requests (CVE-2011-3192). Other examples are the SQL Slammer worm which caused major disruptions of internet traffic in 2003 and could be triggered by a single UDP packet. And there are many more cases.


Does Digital Certificate affect privacy of the user?

You don't define your adversaries.

Certificates can be used to authenticate users, much in the same fashion (albeit more secure) as passwords.

For instance you may use PKI to authenticate your self to the bank, and the browser may use it for every request. In that case the bank has essentially zero chance of confusing two users, even if they swap IP's or other characteristics.

On the other hand, someone reading the encrypted traffic over the wire would optimally not be able to learn anything about the communication. Some information will leak from metadata, such as source and destination IP's.

Put simply certificates are a tool to authenticate resources, be it users or server.


Can a driver(malware) hide it self from device manager?

Can drivers?
Yes. Most Windows (and Linux and Mac) drivers run in kernel mode and have full access to the operating system, including the parts that store the list of drivers. They can erase themselves from that list (and similar lists) and still continue to operate. It would have to be done on purpose, maliciously.
Plus, Device Manager shows devices, not drivers.
Plus, the driver is the one that knows whether the device is enabled! It could pretend to Windows that the device is disabled, while actually it's enabled and transmitting spy data.
"forest" mentioned in a comment that some hardware can be turned off. Of course even a driver can't use the hardware if it's turned off. I strongly suspect the driver can turn it back on without Windows noticing.

Can firmware?
Yes. Except if the device with the firmware is turned off (as pointed out by "forest"). If your wi-fi card is turned off (no power) then it doesn't matter what firmware's on it. If it's turned on though, it can do evil stuff. If it's different firmware that's infected (like your BIOS/UEFI) then it can turn on the wi-fi card and then do evil wi-fi things.
Firmware doing evil wi-fi things and drivers doing normal wi-fi things would be likely to clash with each other and cause the wi-fi card to stop working properly, so it's not likely, but it's possible.


How can JavaScript be tampered with while viewing a web page?

BURP proxy allows you to modify http request made by the browser as well as http responses.  Using this tool you could modify JavaScript or modify the requests made by JavaScript to attack the server-side system.

Also you can edit JavaScript using Chrome's Developer Tools or firebug for firefox.


Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?

If you are able to modify the binary and get the process to still execute, then yes, that works. Make sure to modify the pinned cert with the right level of replacement (i.e. a leaf cert with a leaf cert or an intermediate CA with a CA or whatever), and of course keep the original around in case modifying it breaks something else.

I assume the cert / key isn't in its own file? I've seen that before, and it makes everything really easy; just replace the contents of the file with your proxy's cert and you're good to go.


How does LastPass' grid multi-factor authentication work behind the scenes?

I don't know exactly what you mean by "decrypt any secret defined ahead of time" but it seems that it is a second challenge response system, and the 2nd factor (something you have) is your printed grid.
Technically it works exactly as other similar systems work. On their part of the system, your grid is stored somewhere and is associated with your user identity. When logging in, the system chooses 4 random characters of the grid, you look them up and provide them. If there's a match there and a match on the password part, you are get logged in.

On further implementation details, the grid is nothing more that a 260 character string which is stored along your other details and 4 different characters are chosen each time to be asked.


How to get Hashcat keyspace for combined princeProcessor plus rule-based attack

Keyspace from a piped source cannot be calculated by hashcat, because hashcat does not know how many words will be received (which should make sense, if you think about how pipes work in Unix).
If your rules are simple, you can approximate your total keyspace by running your hashcat command against a baseline wordlist (say, 10,000 or 100,000 words), and then multiplying that keyspace by the total number of permutations expected to be generated by pp64 (using the number from its own --keyspace parameter. But that is going to be very back-of-the-napkin, because keyspace calculation isn't always linear and doesn't necessarily mean what you might expect.
Instead, since you're probably looking to get a rough estimate of how much time it's going to take to run your attack, set keyspace aside. It isn't as useful as the actual runtime for time estimates.
Instead,  do the same baseline test run as above, but instead of using --keyspace, just run it long enough to get a stable time estimate from hashcat's status output.
For example, if 100,000 words with your specified ruleset takes 10 minutes, then multiply that time by the total number of permutations you're expecting from pp64, divided by 100,000.
That should give you a practical runtime estimate.


Safe to use setuid with absolutely no input?

If I'm understanding your question correctly, I believe the easiest solution is:

chgrp <user> /path/to/syncfile

All of what you are trying to do can be accomplished with chmod, chgroup, or chown.
(*not enough rep to hyperlink >2 times)

This command above will keep the syncfile owned by owner, while giving group ownership to user.
User group permissions must be set correctly with chmod for this to work. eg.

chmod 754 syncfile.foo

or

chmod 750 syncfile.foo

Where 754 gives +rwx to owner, +r-x to file group (user), +r to all others..
Or where 750 gives the same, but does not give all others read permissions.


Can a system administrator check if their website is being scraped by a headless browser?

TL;DR "System administrators can spot a headless request with ease": NO. They can surely spot some headless requests with ease. But in general, that's not true.

Quite obviously, it all depends on how the requests are done (how much effort to disguise them) and how the logs are checked and what countermeasures adopted (how much effort goes into penetrating the disguise).

The fact is that an automated (headless or not) browser and a human can, and often do, perform requests in different ways, with different patterns. When they do, this difference can be spotted more or less easily.

The difference is often "intentional", i.e., it derives from a design choice - typically not executing some scripts or not downloading (some) images to reduce traffic, seeing and following transparent links or hidden parts of the DOM. Navigation patterns are clearly influenced by a human's response times. Also, patience and scope of the navigation might be inhuman by need - if you need to scrape a whole website, you won't use a "human like" navigation even if you could. And if you see someone browsing sequentially the whole site, you might not care for it even if you know it's a human.

A browser could also be analyzed actively, e.g. by intercepting mouse events and relaying them via AJAX; even if a headless browser correctly interpreted the Javascript code and was able to perform, in theory, those requests, it would never by itself understand that a human would perforce generate those events, or know how to credibly do the same.

But should a browser (headless or not) be controlled by a mouse and keyboard-like interface by an AI designed to interpret a screen rendering through OCR and scripting, and scrape a site like a human would, it would be almost impossible - and almost certainly intolerably rife with false positives - to tell it apart from a real human being.


You've answered the question yourself. You're trying to implement DRM to prevent users from getting the video off the device. In practice there is little you can do to prevent this. There will always be ways to copy the stream, even intercepting the stream (it has to be displayed on the device at some point right?).

So the only thing you can do is make it harder, but not impossible to copy it. You can also include some meta data to the video when streaming or when downloaded to identify the user which leaked the video.


How exactly was Sony Pictures hacked November 2014?

Thanks to Bob Brown's hint and an article on Ars Technica he is probably referring to, we get to know at least some details on the hack rather than just gossip.

From the article:

  And it still remains unclear how the malware was implanted on Sony Pictures’ network in the first place—or how multiple terabytes of data from corporate systems could have been hauled out of the network within just a few days of the wiper attack.

According to the article, one malware used in the attack is Destover or a variant thereof, also known as (a) Wiper, which has also been subsequently code-signed with a Sony certificate and was used to remove/destroy data on the victim's computers, e.g. to cover up and remove traces of an intrusion.

UPDATE:
According to Security Week, attackers used a worm for Windows networks (referred to as SMB Worm Tool) to propagate their malware with brute-force authentication code and tools for file transfer, system survey, process manipulation, file time matching and proxy capability, an arbitrary code execution mechanism and aforementioned features to erase and destroy data.

A related Security Week article also refers to the US CERT alert detailing some Indicators of Compromise (IOC), i.e. hashes of the malware that can be added to security solutions / intrusion detection systems and malware detection engines.


As Lie Ryan says, Tor is a low-latency network. It also uses a large number of nodes basically run by anyone who wants to run one (which is a problem because it's difficult to trust individual nodes). Good anonymity is achieved by randomly selecting two nodes that together with your mostly fixed, but initially also randomly selected entry guard make up a proxy chain, or "onion route".

There is another way to build anonymity networks (such as JAP/JonDo or whatever it's current name is): With JonDo, there is a much lower number of powerful nodes, run by known entities, which each route lots of traffic. As with Tor, the client also chooses a "mixer cascade" of nodes, but each node collects incoming packets, reorders them and sends them out at aproximately the same time. So if Eve observes the incoming and outgoing traffic of a node, she can't connect an outgoing packet to an incoming one. JonDo offers an okay user experience despite collecting and reordering packets (with means it adds a bit of latency) because it doesn't allow the client to use just any combination of nodes as a mixer cascade and there aren't all that many nodes in the first place, so the individual nodes always have enough traffic so they don't have to wait too long before they have collected enough packets to send out the next batch.

Note that since JonDo is basically low-latency like Tor, an attack that correlates traffic timings between the user and the first node and between the last node and the target server will still work. Also, traffic size correlation will work fine when done at traffic ingress and egress boundaries of the anonymity network.

There is no known countermeasure against these attacks in low latency mixer networks (except maybe generating a large volume of cover traffic, but I don't know any network that implements this.). Even with high-latency mixer networks such as mixminion for anonymous e-mail, which protect you against timing correlation, size correlation will still work.

Aside: Your question seems to imply that you need to control two nodes for traffic correlation to work. But for timing and message size correlation attacks to work, you don't actually need to be in control of any nodes at all. You can also just observe traffic to/from these nodes. This means that if you can get access to several very large internet exchanges such as the world's largest, the DE-CIX in Frankfurt (to which German signal intelligence, which is known to cooperate with other sigint agencies, had access in the past, and probably still does), sea cable termination points and so on, your chances that you'll be able to observe the right traffic increase a lot. This is why Tor warns you that it won't protect you against a global adversary, e.g. one who has global traffic surveillance capabilities.


I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help?

If your customer is concerned about DDoS then a standard Pen. test isn't the route to go.  Leaving aside the question of whether it's a valid concern, one approach would be to look at doing load testing on the site.  There are companies who will perform load testing to see how much traffic the site/server can handle before becoming unavailable.  This would give you an idea of how it will react to heavy load.  Obviously if you do that sort of testing, you should inform and get approval from Rackspace, so they don't misinterpret it as an attack. :)

That said, some DDoS attacks don't follow similar patterns to standard traffic (e.g. attacks which use DNS amplification).  If that's a serious concern I'd recommend looking at DDoS protection services (e.g. CloudFlare/Akamai) as realistically there's not a lot you can do about that kind of thing at the server or even potentially the ISP level in the case of large attacks.


Does figuring out what one password hashes to allow you to crack all identical passwords?

Yes, sort of.  Ideally two values are stored.  A unique salt, and a hash of the salt+password.  A globally unique salt is generated and stored for each password.
Again, sort of.  First the salt for that user account is retrieved from the database, then the salt+password is hashed and compared to the hash value sotred in the database.
No, because the salt will be different for each user, resulting in a different final hash value for each user.
See 3.  The salt is the additional security/differentiation component that prevents the hashes from being the same.


The token that you are speaking about is not generated in the mobile app. It is generated in the 3rd-party authentication servers and passed to your mobile app. Your mobile app has to pass it back to the servers to validate your apps's authorization.

Regarding security of the token, assuming that you are using SSL, you can pass the token in either a query parameter as you suggest or as a message header. The Authorization header is the standard one to use, but, as you own both the mobile app and your server, you can put it in any header.

My preference is to never put anything that needs to be kept secure in a query parameter. URLs have a nasty habit of getting exposed via logs or other mechanisms. So I prefer using the header.

When you communicate with the 3rd-party servers like Google, you'll have to use whatever mechanism they require.


Through Javascript File API, which should be used as a standard for any web file interaction the only things about file that are known to the javascript and the server are:

bytes of the file (for readability)
name of the file
size of the file
type of the file (.txt etc.)

direct answer to your question is in this SO question when somebody wanted to do exactly that (try the jfiddle examples to test that not one will show full path when you select a file): How to get full path of selected file on change of input file using javascript

There are some APIs that allowed you to do this (ActiveX) but they are mostly getting phased out.


Why does a web site operator need to trust an openid provider?

Basically, you don't need to trust an OpenID provider: the user does.

Let's compare, from the strict perspective of authentication, passwords with OpenID.

Password: User: “hey, server, it's me! You know it's me because no one else knows the magic word correcthorsebatterystaple, which I told you when I created the account.”
OpenID: User: “hey, server, it's me! You know it's me because johndoeblog.com/openid says it's me, and I told you to trust johndoeblog.com/openid when it says it's me when I created the account.”

In both cases, as a server, you rely on the user's willingness and ability to choose a reliable authentication method. With passwords, the user must choose a password that nobody else knows. With OpenID, the user must choose an OpenID endpoint that nobody else can use.

For authentication purposes, there is no reason, as a server operator, to prefer one OpenID provider to another. You may (or may not) prefer to recommend OpenID providers who you know to be reliable, but you do not need to trust the OpenID provider in any way to authenticate the user.

Both cases rely equally on the user's cooperation to ensure that the user who paid is the one who uses the service. A password-authenticated user can share their password; an OpenID-authenticated user can allow the use of their OpenID endpoint.

All this is because you only care about the user's identity as account #1234 on your server. It would of course be completely different if you wanted to know that the owner of account #1234 is known as Joe Bloggs to the government of Syldavia: then you would need to trust the OpenID provider to provide you with Joe Bloggs's real name.

One minor reason to trust an OpenID provider is to offload the work of limiting account creation rates: if you know that Myriad has measures in place to restrict the account creation rate, and you only accept Myriad OpenID accounts, then this automatically restricts the account creation rate for your service. This doesn't apply to you: given that you're running a for-pay service, account creation rate restriction is built in.


If we use only client nonce and not server nonce, which attack vectors become possible?

Replay attack becomes possible. Because an attacker can choose his client nonce, he can just choose a nonce that a legitimate user picked and replay his login.

Note that technically you can get rid of the additional round-trip by choosing a predictable nonce as server nonce, such as the current time + user name. Then you store the last used time by user and only accept nonces with higher time to prevent replay. While this is not as secure as an random nonce, it may be enough for some use-cases.

Namely with this approach, you may have to implement a grace period for clocks, that are not precise, accepting nonces which are off by some time. An attacker may be able to obtain a token and use it within this time period, where he would not be able to use it directly, though this is quite unlikely. An attacker may also be able to get tokens for future if he can manipulate the clients clock. And possibly other vectors may be opened by using this approach.


Does an url that redirecting infinitely have any impact to website?

Not really.
The cost of a 302 Redirect should be negligible.
Moreover, most browsers detect an infinite loop at the second or third iteration (if no cookies are involved, then at the second). So you're getting double or triple load for that one endpoint; it's no great mischief.
If this is caused by a bug such as a wrong .htaccess rewrite rule, so that all your site behaves this way, then you do have a problem - your site is now unreachable - but usually, resource-wise, it means that a navigation made up of maybe five or more GETs will be broken into just two. SPAs and heavy-AJAX sites might be impacted more, but you'd need to get into edge cases for it to really be a significant problem.
Of course, this doesn't mean you don't have to fix it ;-) (not sure since I'm a complete and utter ignorant SEO-wise, but I don't think this can be good for your site ranking). By the same token, this situation might be indicative of below-average attention to the site's workings, and encourage some attacker - it's called the Broken Window effect.


Should I use different browsers for surfing and logging into accounts?

Malware needs to be dropped to your host to scrape the saved passwords, it can't be done by the malicious website itself.

Unless the malware (say, dropped by an exploit kit) targets only a particular browser, all the popular browsers are vulnerable because all the saved passwords are stored somewhere on your computer. I think in general saving passwords on a separate browser does slightly increase the security but there are better ways to protect these credentials (e.g. password managers and protection against exploit kits).

If your concern is saving the credentials in the browser maybe you should take a look in how different browsers manage saved passwords and choose a browser according to that:
http://raidersec.blogspot.se/2013/06/how-browsers-store-your-passwords-and.html
http://www.pcworld.com/article/261259/can_you_trust_your_browser_with_your_passwords_.html
(Please note these links are a bit old and some information might be outdated)


Unvalidated redirects do not necessarily apply here. An unvalidated redirect is something more along the lines of an attacker being able to send a victim to a destination of the attacker's choosing. If you read the example on the OWASP page you linked at the bottom, you will see that the attacker crafts a URL that can be sent to a victim using social engineering or otherwise. A static redirect coming from a server is a completely different scenario.

While rickrolling an attacker may seem amusing, legitimate users would be quite confused if they are given a link to your site which automatically rickrolls them, decreasing the user's trust.


You should consider the following criteria:

Privacy - In which condition the VPN provider will give your credential and data to other legal institutions?
Security - Dose the VPN provider has any responsive penetration testing made by a 3rd party?
Uptime - Average uptime.
Back-up solution - What if the VPN provider is taken down ... how will you work in those condition? Do they have back-up equipment at another location?
What's the law and the general monitoring level in that specific country?
Price and solutions/penalties in case they can't provide the service.


TPM2 generate Key pair according to PCR values

You can't.

I'm assuming you want your TPM to generate a key deterministicly depending on PCR values. The TPM will always use TRNG entropy for key generation (except for the primary keys) (see TPM2 Spec Part 1 - 11.4.9 Key Generation).

What you could do in theory is generating the key outside the TPM and loading it afterwards. I really doubt that this is a good idea, though.

Also: I think basing a secret key on PCR values is not a good idea, either.

Edit: what you might want to actually do is sealing the key. Basically, that is having a security policy associated with that key which prevents using it when your PCRs do not have a known good value.


Why is not checking the origin of postMessage insecure?

Imagine that the superSecretToken token was something retrieved from your service's server and was specific to the authenticated user. Or imagine that it was the user's bank balance.

Then any random webpage on the internet could embed your page in an iframe, and whenever someone visited the attacker's page and happened to be logged into your service, the iframe would postMessage the user's bank balance or whatever to the attacker's page. It gets even worse if the iframe accepts commands to make changes to the user's account, because then the attacker's page could send an arbitrary message to the iframe to make changes in the user's account, etc.


Is "Windows" mode inherently more secure than Forms authentication for .NET web apps?

In my experience, the biggest problem is that Windows authentication tends to conflate authentication and authorization. Just because a user has a Windows account does not mean they should be able to access a resource!

A simple example would be machine accounts. In an Active Directory system, machine accounts get Kerberos tokens just like users do. Most implementations of Windows auth I've seen trust that just because a user can be positively identified (authenticated) they are also authorized to access the protected resource, so any machine account will be able to access the protected resource.


How to prevent user guess the key (password), if he have access to all the data (except the key)

Be very careful.  Don't ignore the fact that an attacker can brute force the SSNs from your database without knowing the encryption key.

If your attacker can use your system to encrypt an SSN, (perhaps by signing up a user, changing the value of SSN, and watching for the changed encrypted SSN field in the database) he can learn encrypted SSNs simply by trial and error.  Imagine him setting the SSN to 000-00-0000.  Your system encrypts it, and he compares the encrypted value to all the other encrypted SSNs in your database.  If his test value matches one of the other values, he has learned that person's SSN.  He then changes his SSN to 000-00-0001, and tries again.

Given 999,999,999 tries, he will be able to build up a "rainbow table" that contains every possible SSN.  But he certainly doesn't need to do that much work to make a profit.

Most attackers are opportunistic.  They don't need every SSN in your database to commit identity fraud, they only need to guess one SSN to start stealing.  (The more SSNs they steal, the richer they can get, so of course they want as many as they can.)  So maybe they only have time to run their attack for a little while, and they will still be satisfied with guessing a few.

The more people in the database, the more likely the attacker will be successful quicker.

Additionally, it's much easier than random guessing.  Many people are unaware that until just a few years ago, SSNs were issued by geographic region.

Consider an attacker from Utah that wants to commit identity fraud using a Utah address.  His attack will guess only numbers in the range from 528-00-0000 through 529-99-9999.  That only takes 2 million guesses, not 1 billion, and is likely to have a high rate of success on your customers that have Utah listed as the state on their address.

The search space for SSNs is so small it is easily searchable by an attacker with modest resources.  You need to take extra steps to protect the data and the systems from this kind of attack.


How to securely ask for passwords of customer as consultancy firm?

You don't.

When you teach users to give their username and password to someone, you train them to be vulnerable to phishing or other social engineering attacks.

Instead, design the system in a way that an administrator can view and edit these settings without requiring the users credentials.

When you are in a situation where you really need to see things from the perspective of the user to troubleshoot a problem, ask the user to type in the password for you and then let them show you the problem. This can be done either in person or with a remote administration tool.

When you are in a situation where the customer has credentials you need in your application to integrate with a 3rd party solution, develop your application in a way that a non-technical user has an easy to use user interface to set these credentials. You will need that anyway in case the customer needs to change them and you are unavailable.

The user won't have to enter this until the application is deployed on their own servers. During development you should use a test account on your end to interface with the 3rd parties. You definitely don't want to cause any costs to your customer because you ran some tests on the 3rd party payment interfaces which didn't work out the way you expected.


Is it safe to store APK signing passwords in private git repository?

Not really, no. As nbering said, it is very hard to remove it from git history if you ever want to share it. Git is also not really meant to hold this kind of information.
Not much. The password only encrypts the key, so without the encrypted key, they can't really do anything.
A lot. They can create a version of your app with malware inside it and pass it as yours. However, without access to your appstore account, they may not be able to publish it directly. This still allows them to distribute it in other ways, eg. through different appstores or using the web. If they do gain access to your appstore account, they can publish their malware version as an update and users would have no way of knowing.
Yes and no. If you use manual builds, then you can just add the file into gitignore and distribute it in other ways. If you use autonomous builds, most git sites support special functionality for storing secrets.


Did the October 21, 2016 DDoS attack on Dyn's DNS service cause Bandwidth Exhausion?

TL;DR: The attacks effectively capped out allocated memory buffers and ran CPU usage up to capacity, leaving the servers unable to respond to legitimate requests. Bandwidth Exhaustion rarely occurs with SYN attacks, because very little bandwidth is required for SYN attacks and/or bogus DNS lookups.

A TCP SYN flood simply fills up available memory buffers while the server waits for non-existent ACK packets to return. Very little bandwidth is consumed in this attack, and can take down a server with small TCP pools even if they had literally unlimited bandwidth, because the bandwidth isn't the source of the bottleneck, the memory held by the pending connections are.

You can visualize this like a telephone operator's switchboard, where many of the calls are just people breathing into the other end of line without actually saying anything useful; legitimate callers have to wait for the operator to decide to hang up on all the prank calls. Eventually, there's no more spare phone lines so legitimate callers effectively get a busy tone and have to try again later.

A prepend attack also uses very little bandwidth, as the scripts simply ask for random sub-domain names of the target domain, forcing the DNS server to spend time performing recursive look ups and repeatedly querying DNS records for entries not in its cache. In this case, instead of memory being the bottleneck, the CPU fills that role by performing a lot more work than it has to for legitimate requests.

You can visualize this sort of attack as many people calling the operator at the switchboard, each asking to speak to non-existent people. The operator has to take time initially to look up each request before telling the caller that there's nobody there by that name, while callers that want to talk to known people have to wait for all the lookups the operator has to go through. This works best if you visualize the operator having a huge phone book and they have to spend a lot of time flipping pages to determine if the name actually exists.

Bandwidth Exhaustion, by way of comparison, is when the network becomes saturated with data trying to reach the server. In this case, neither the server's memory nor processing power are the bottleneck, but instead depends on the network exceeding 100% capacity for some length of time. The best way to accomplish this type of attack is to send really large packets really fast, from as many locations as possible.

This is harder to visualize, but imagine many prank calls coming in at once, and the operator at the switchboard has to wait for each person to finish saying what they have to say before going on to the next call. Each prank call is actually some person prattling on about their entire life story and family history for the last 50 years, tying up the lines for that caller that simply wants to be transferred. It's not a such a perfect analogy as it is for the others, though, because this is actually effectively occurring upstream from the operator. It's out of their control.


Running browser as different user (in Linux)

So in theory running an application as a separate user may provide some security benefit in that in the event of the application having a security issue, the application may not be able to access data belonging to the primary user.

That said against that you need to weigh the usability problems of your browser not necessarily having access to data for your primary user.  Also this approach only provides a benefit if you have relatively restrictive file permissions (e.g. it doesn't help protect files that are world readable/writable)


Is it safe to disable SATA ports in the BIOS to isolate the corresponding hard drives from malware?

BIOS is software, malware is software, they potentially have the same capabilities.

I would go with a physical barrier: unplugging the drives or disconnectng their power supply.


How does Wifi Blocking work? Can it be detected / prevented?

Accesspoint blocking works by continually sending deauth packets to the client and access point.  De-auth packets can be easily spoofed.  Both sides then believe that they need to re-authenticate so they do so.  If this is done continuously you can prevent all clients from associating with an AP since they're continuously in an authentication loop.

It's trivial to detect by looking for a flood of de-auth packets on the network.  De-authentication is part of the specification, and involves both client and AP.  So even if the AP had a means to detect and ignore de-auth attacks, it wouldn't help unless the client also implemented a similar mechanism.

There's been some talk of "authenticated deuthentication" to prevent de-auth from an unauthorized party in the first place, but AFAIK it hasn't gone anywhere.


What is the difference between "web penetration testing" and "web application penetration testing"?

For a customer I deal with, the distinction has been:

"web penetration testing" is testing the security of a web server as configured for production (for example, RHEL 7.4 with SELinux in enforcing mode running Apache HTTPD 2.4 fronting a Tomcat server with two servlets on the same machine where httpd is listening on port 443 for all traffic and Tomcat is listening on port 8443 for traffic only from localhost and iptables is blocking external access to  port 8443). This is looking for vulnerabilities in the overall configuration of the server.
"web application penetration testing" is testing the security of the design and configuration of the web application itself, absent other protections it may rely on. From the example above, this would mean penetration testing the Tomcat server and servlets after deliberately allowing traffic through iptables on port 8443 and disabling SELinux. This is looking for vulnerabilities in the application itself that might be completely, partly, or not mitigated depending on how the server it is running on is configured.


How does Freenet maintain access to 'freesites' while retaining plausible deniability about content?

Below I have supplied the "basic" information required to achieve "understanding" of how the data is stored a accessed; this information has come directly from the Freenet web site. I would suggest viewing the following, "Understand Freenet" ,if you wish to read further.

How can many people access a freesite if they aren't the author (and can't decrypt it)?

  The Datastore

  All Freenet nodes contribute with a part of their harddrive space to
  store files. The files are stored encrypted in the store-directory in
  the Freenet installation directory.

  Unlike other peer-to-peer networks, you as a user has little or no
  control over what is stored in your datastore. Instead, files are kept
  or deleted depending on how popular they are. This is to ensure that
  Freenet is censorship resistant. The only possible way to remove
  something from Freenet is to not search for it, and hope that
  everybody else does the same.

  It is hard, but not impossible, to determine which files that are
  stored in your local Freenet Datastore. This is to enable plausible
  deniability as to what kind of material that lies on your harddrive in
  the datastore.

  The initial diskspace allocated for the datastore is 5% of available
  disk space if it is over 20GB, 10% if it is over 10GB, 512MB if under
  10GB, and 256MB if under 5GB. You can change the store size at any
  time, the more the better, both for your personal browsing and for
  Freenet as a whole.

  Freenet Routing

  Initially, each node has no information about the performance of the
  other nodes it knows about. This means that routing of requests is
  essentially random. But since different nodes have different
  randomness, they will disagree about where to send a request, given a
  key. So the data in a newly-started Freenet will be distributed
  somewhat randomly.

  As more documents are inserted by the same node, they will begin to
  cluster with data items whose keys (see below) are similar, because
  the same routing rules are used for all of them. More importantly, as
  data items and requests from different nodes "cross paths", they will
  begin to share clustering information as well.

  The result is that the network will self-organize into a distributed,
  clustered structure where nodes tend to hold data items that are close
  together in key space. There will probably be multiple such clusters
  throughout the network, any given document being replicated numerous
  times, depending on how much it is used.

  Freenet keys

  Each file that exists on Freenet has a key associated with it. Freenet
  0.7 has various types of keys. Keys are used for everything on freenet, and are a kind of URI (e.g. freenet:=KSK@sample.txt).

  Most keys are hashes: there is no notion of semantic closeness when
  speaking of key closeness. Therefore there will be no correlation
  between key closeness and similar popularity of data as there might be
  if keys did exhibit some semantic meaning, thus avoiding bottlenecks
  caused by popular subjects.

If you are interested, here is a direct link to Ian Clarke's paper "Freenet: A Distributed Anonymous Information Storage and Retrieval System" hosted by the computer science department at the University of Iowa.


I would recommend utilizing OpenID for authentication. This way you do not have to handle authentication and the storage/maintenance of user credentials in your own DB.

regarding CSRF, with angular its simple. Angular has a built in mechanism that will look for a CSRF token in a specific cookie and than send it as a http header in each request made with Angular's $http module. What your backend needs to do is populate (once per session) the cookie with a cryptographically secure random token (Angular recommend a digest of the user authentication token with a salt) and then validate the correctness of the http header upon request in your REST API.


Ettercap error - 'ARP poisoning needs a non empty hosts list'

The problem is that you are using the NAT adapter. ARP spoofing relies on the Address Resolution Protocol (ARP), which functions between layers 2 and 3 of the OSI model. Since you are behind a NAT, your Kali machine and the target machines are on two distinct layer 2 subnets, and ARP will not traverse both subnets.

The solution would be to use a bridged adapter instead, so that all machines are on the same subnet.


Can anyone using my wifi see what I'm browsing?

Well, that depends. If you are not being attacked (MITM, other users in promiscuous mode etc...) then the other users on your LAN can't really inspect your traffic, but your ISP can. Even if your traffic is encrypted, the ISP can't see exactly what you're visiting but it can use unencrypted information to gain some knowledge about your internet traffic and browsing activity, such as your DNS queries which are usually unencrypted. This can be suffice for your ISP to know most of the domains you visit etc...

Also your ISP could analyze your traffic patterns (or other unencrypted metadata) and extract useful information. For example, according to this article every youtube video has a unique traffic pattern when streamed to your device so if someone has access to your traffic, even if it is encrypted he can extract useful information. Those kind of attacks are called side channel attacks. Now if you are under attack, with what your ISP can do by default, the attacker can do also or worse.

  Tor safe for this issue?

Tor or VPN in general, can be used to tunnel your traffic and hide/protect it from potential attackers. In this case even your ISP can't see as much information as before, but it knows that you are using Tor/VPN etc... Though, you must be sure that the VPN/Tor servers are legit and trustworthy. For example, in my opinion you shouldn't use Tor to transmit sensitive information since nothing guarantees that the servers your traffic gets tunneled through are trustworthy.


Reflected XSS in form action - understanding

Does this mean that reflected xss can't be achieved here?

The xss can not be achieved here because the context of outbound encoding(URL encoding) is correct which means URL encoding is applied to data reflecting in the URL and as owasp suggests, the outbound encoding is one of the solution for XSS vulnerability.
CSP and xss auditors in browser also plays a role in preventing xss.


Port forwarding to ip address in LAN that is not available

Risks? Almost none.

The expected responses are:

On case 1:

router returns Destination Unreachable message to the client
router ignores packet and let the connection time out on the client

On case 2:

Computer sends back a TCP RST and drops the connection
Computer ignores packet and let the connection time out

If you have a router without port forward, but with NAT, unless the internal service uses STUN, UPnP or another NAT traversal tool, they are essentially inaccessible. Packets will reach the router, which don't have that port open, and router resets the connection.

If you have a router without port forwarding and you have public IP addresses on all your computers, you will expose all of them to the Internet. Without a firewall protecting them, you are inviting trouble with big, bright neon billboards...


Why don't video conferencing web applications ask permission for screen sharing?

Either way, the user agent responds by presenting a user interface that prompts the user to choose the screen area to share. Both of these implementations of startCapture() return the MediaStream containing the captured display imagery.

Taken from MDN description of screen share API
When you press the screen share button, the browser shows you a list of windows, screens and so forth that you can share. By selecting what to share on that screen, you grant permission. In other words the selection and giving permission is a single step process.


Why don't banks sign their email using S/MIME?

It's usually a costs vs. benefits decision.

Costs:

Create your own CA infrastructure or buy a public certificate for each sender
Teach employees how to use it
Teach employees how not to use it, especially how to make sure that the secret key is really kept secret
Teach the customers what this strange stuff in the mail means
Properly deal with certificate expiration, revocation and all this stuff
...

Benefits:

Usually the argumentation goes like this: nobody else is using this so there cannot be lots of benefits

Thus unless the benefits are higher than the costs or some regulations require the use of signed mails it will not be implemented.

Apart from that correctly using S/MIME is not that simple for the recipient too. While there might be indicators which show if a mail is signed or not few understand how these indicators look like, what kind of different indicators there are and that you should not trust any indicators which are included in the mail itself and try make the user believe that everything is secure: i.e. something like trust seals, "scanned by whatever antivirus" messages etc.
Thus there is also the cost of teaching all the users.


Bettercap output file is empty after capture

Is it possible that your ethernet port isn't yielding anything? Try it with another interface e.g. wlan0 to see if that yields anything.

A suggestion: I think you're using the legacy version of bettercap. There's a new version (https://www.bettercap.org/) that takes less space, is more reliable, and faster - according to the website. If you got bettercap by typing "apt-get", that's going to download the old version.


How do you capture ALL the traffic from an Android app?

You are unable to intercept Facebook traffic because it uses SSL pinning.

On pen-testing an android application you may come across four different scenarios. I will list them down below concisely. A much more detailed article can be found here >> My Blog The article also contains videos which you can refer to.

Non-SSL Application

This is the simplest Android application which you may come across. Games are examples. Much of the traffic goes over http. To intercept the traffic you only have to point the wifi proxy settings of the device/emulator to the laptop where Burp/Zap proxy is running.

Applications which uses HTTPS traffic and rely on device's trusted credentials

Applications like Instagram uses HTTPS to communicate with the server however they rely on the device's trusted credentials. To intercept this traffic you can add your proxy certificate to your device's trusted credentials by adding opening the same from Settings > Security > Trusted credentials

Applications which uses SSL pinning

Certain applications may use SSL pinning to ensure the application being secure even at the event of a trusted credential getting compromised. Cydia substrate module Android Trust Killer or Xposed Module JustTrustMe can be used to bypass SSL pinning control.

Applications which use their own Credential Store

The Facebook Android application uses it's pwn credential store and that's why you are not able to intercept the traffic normally. To bypass this you will have to dissassemble the application to smali code. Add the certificate in desired format to the code, recompile it, sign it and install it again. The process is detailed here >> Blog by DewHurst Security.


Authenticate user just by clicking a link on external website

You could implement something like OAuth 2.0 (example). Basically, you have an application, authentication server, and resource server. The application wants to access your resource through an authentication/authorization server. A series of token exchanges in a particular way makes this possible to do securely.


sqlmap won't give me results i'm looking for

For legal reasons you should only attempt to hack websites you have explicit permission to test. Random websites on the internet doesn't meet that criteria unless you're doing a bugbounty (in which case sqlmap is probably the wrong approach). A better option would be to install a web application designed for learning security, such as the Damn Vulnerable Web Application on your local machine or a VM and then run sqlmap against it.


Password protect an internal hard drive in a shared Windows PC where all users are administrators

There's a concept in threat modelling called spheres of control. A sphere of control is effectively the things in a system that a particular actor has control over. Actors are usually people with different roles, such as unauthenticated users, logged in users, administrators, etc., and each of these has their own sphere of control. If you think about how these spheres overlap, or might overlap, you can better understand what resources each actor has access to (or at least should have access to) and use that to identify where your risks might be concentrated.
You have one sphere for everyone. You, the trusted user, have persistent admin access on an OS and they, the untrusted users, have exactly the same level of persistent access. No matter what control you put in place, they can circumvent it, because you have the same sphere of control as an untrusted user.
For the purposes of my answer here I'm going to ignore the potential for hardware modification. While they're technically possible, your students probably don't have sufficient motivation and resources to implement such attacks, and if I included them in the threat model my answer would be much more complicated and bleak.
What you need to do is create two separate spheres of control, and enforce the separation with a security boundary. If the students require administrative access on the OS, you cannot enforce separation between you and them on that OS. To demonstrate why this is the case, imagine the scenario in which you use full-disk encryption (FDE) such as BitLocker, LUKS, or VeraCrypt in order to encrypt the data on your drive. You hand the laptop off to a student, with your disk encrypted. They can't unlock the drive because they don't have your password, but they can install a keylogger on the system and steal your password the next time you unlock the disk.
One way around this is to install a second copy of the OS onto your hard disk, then use FDE to encrypt it, resulting in a multi-boot system where students get access to one "dirty" instance of the OS, and you get access to a "clean" instance of the OS. When the system boots, the POST or bootloader gives the user two options to boot from, and they cannot boot from your copy of the OS without knowing the FDE password. The FDE password entry is done outside of the OS, so it is outside of the students' control sphere. This creates two separate spheres of control with a strong security boundary that is (given certain caveats) outside their sphere of control.
You can improve the security of this approach if you use a TPM with your FDE, to prevent brute-force attacks, and enable Secure Boot to prevent manipulation of the bootloader and preboot authentication binaries. This is made more difficult to mess with if you apply a BIOS administrator password.

Regarding setting up FDE, you've got a few options. If you're using Windows 10 Pro you'll have access to BitLocker, which is the most convenient. Unfortunately it isn't available on Windows 10 Home edition.
To enable BitLocker on a data drive (i.e. a drive that the OS isn't installed on) you can just type BitLocker into the start menu search and then click "Turn BitLocker on" on the fixed data drive you want to encrypt. By default, when you start the computer the drive will be locked, and when you try to open it in Explorer it'll ask you for your password to unlock the drive. You can later right click the drive and lock it again. It's a manual process, although obviously it locks the drive automatically when you shut down the computer.
One important caveat is that when you unlock a drive, it is accessible by all users that are logged on. So if you're logged in and have unlocked the drive, then hand the laptop to a student who uses Switch User to also log in at the same time, they'll be able to read the unlocked disk. You should lock the disk manually or shut down before giving them the laptop.
It's worth noting that BitLocker may present you with an option to automatically unlock the drive on startup. This is usually used for situations where you want to have a data drive encrypted as well as your OS drive, but don't want the inconvenience of having to manually unlock the drive on startup. Unfortunately this cannot be done on a per-user basis, so you shouldn't choose this option in your situation.
If you don't have Windows 10 Pro, and therefore don't have BitLocker, you could use VeraCrypt instead. Launch VeraCrypt, click Create Volume, pick "Encrypt a non-system partition/drive", select "Standard VeraCrypt" volume, click "Select Device...", pick the partition associated with the drive you want to encrypt, then choose "Encrypt partition in place". You can then pick your password and encrypt the volume. When you want to unlock it later, you just launch VeraCrypt, pick the partition to mount, and unlock it with your password. The same precautions apply as with BitLocker in terms of giving students access to the laptop while the drive is unlocked.


Why do so many spam emails lately contain a lot of unicode characters?

Usually those are UTF8 sequences that resemble other characters, without being them.

For example   is not the text "this string", and therefore does not trigger UCE detectors as spam, while you probably read it as "this string", as the sender intended.

On the other hand, it is weirdly encoded, so it can happen that it is decoded incorrectly. And " " becomes ����������� or other mojibake.


modifying an httponly cookie before sending the request

HTTPONLY is an optional flag denying Javascript to access the cookie, but the user is not constrained by that. It's intended to mitigate Cross Site Scripting,  not to protect the cookie from tampering.

  can an http request be altered on the client side ( with a browser, preferably ) to modify the value of an httponly cookie?

Yes, and it's trivial. A cookie is in complete control of the user. He could just install an extension to view/edit cookies, or to tamper the request.

Remember that the cookie is an user provided information, and don't blindly trust any cookie. If you need to store user's data, store it serverside, inside a session, and forward only the session cookie to the client. With enough entropy, bruteforcing the session cookie will be close to impossible.


Security of Log Files - Injecting malicious code in Log files

Yes,  log file injection can be useful in the exploitation process.  For example,  here is an exploit that uses a PHP Local File Include vulnerability to execute PHP code within Apache's access_log file.   This exploit pattern is common in the LAMP world.

Most systems lack protection against this attack pattern.  Usually log files are protected by the operating systems file access controls.  AppArmor and SELinux can prevent a process from accessing an arbitrary file or directory. PHP's open_base_dir can prevent PHP from including files outside of the application directory.

Remote Logging is a great solution to both Local File Include Attacks,  as well as the threat posed by an attacker compromising the machine and manipulating the log file to hide her tracks.


Using the Symantec VIP Access smartphone software for 2FA

if I use Symantec VIP Access for both SiteA and SiteB, doesn't this effectively give SiteA TOTP tokens that it can use to impersonate me on SiteB?

Yes. 2FA does not necessarily fully negate the risks of password reuse. I doubt Symantec would allow the same code to be used twice (the system requires the service to send the code to Symantec for validation) - but a malicious service could easy enough not validate you with Symantec themselves.

It is worth noting sites can optionally integrate push based notification (where the app asks Symantec to ask your phone to generate a token for it) or QR based authentication (where a QR code is presented which your phone uses when generating the token). Both of these would remove that risk.

  Symantec doesn't support any way to backup its secret -- their documented work-around for a lost, broken, or replaced smartphone is to contact technical support at for each system with which I've registered my "credential ID".

This appears to be by design. I'd agree its a poor decision. However from a security / marketing perspective its arguably better - if someone steals your phone you'll probably notice, if someone cloned your token you might not.

  do I have any better alternatives than (futilely) asking administrators of systems that use Symantec VIP Access to switch to something that doesn't suck?

The only other option is to complain to Symantec. Although i'd argue complaining to their customers is likely to have a bigger impact.


There are a bunch of different questions packed in here, so I'm just going to answer the surface-level ones.

Are temporary / single-use PINs acceptable in security circles?

Absolutely, but only if it's either A) one time use, or B) sufficiently long to prevent brute-forcing (ie 256 bits of randomness).

Example A: Google account verification email, the thing that's blanked out is a random one time use access token. If you try to click it twice, the second try will bounce:

Example B: It's also common to use this for generating a link for anonymous access to content, but here it's not one time use so the token needs sufficiently long and sufficiently random to prevent brute-forcing.

Is a 3 digit PIN long enough?

Maybe? Locking out a PIN after 2 incorrect attempts may solve your problem, but it also presents an easy avenue for an attacker to DOS your service (ie keep your users perpetually locked out and thus block them from accessing the service).

Personally, I would ditch the idea that the PIN is "replacing" a password, and instead follow Google's lead by emailing out a long one-time-use link that tells the server which user and which course to grant them access to. This will be both lower friction for your users, and less to go wrong from a security perspective.