What audit procedures are applied to ENotaries and to the software they use?

In some countries, there is a specific legal framework for such things; of course, every country has its own... In France, it is the Référentiel Général de Sécurité, which feeds on Common Criteria. The gist of the thing: the relevant administrative organization (the ANSSI) publishes a Target of Evaluation which describes all the features that a given service should have. This covers things like the precision of the clock of the time stamp authority, the process used to control physical access to servers, the background checks of the criminal and debt records of people who have developed the code, the compliance to relevant standards, and so on.

An organization who wishes to get its system "certified" then hires an independent audit firm, which verifies that the system complies with the rules in the ToE. It then talks to the ANSSI, which does a few verifications itself (in particular that the audit firm is indeed independent and trustworthy), then finally grants a formal recognition of the system as being compliant. This links to a set of local laws which more or less mean that when a certified notary system is used, the notarized documents are presumed valid, and if someone wants to contest their validity, then he has to bring proof elements (i.e. the burden of proof is on who contests rather than on who asserts).

It takes several months, a substantial amount of money (dozens of thousands of dollars), and a terrifying lot of paperwork.


Highly anonymous proxies vs anonymous proxies

No technical mechanism is used to distinguish an anonymous proxy from a "high" anonymous proxy (sometimes called an "elite" proxy). The only difference is that the latter is not found on common blacklists such as the DNSBL. This is typically done by giving a unique IP address to each person, so spammers will not be using the same IP as you and getting it on a blacklist.

Non-anonymous proxy - Sometimes incorrectly called a transparent proxy, a non-anonymous proxy is one that transmits your IP address in X-Forwarded-For. These proxies are not usually on blacklists because your original IP address is known to any site you are connecting to, allowing them to blacklist based on this forwarded IP. These proxies forward your IP address specifically to allow destination sites to block any given proxy user's IP address, rather than the entire IP. This lets the proxy serve its primary function (e.g. caching).
Anonymous proxy - These proxies simply do not forward your IP address. They are usually abused by spammers, and because the destination server cannot distinguish a legitimate user from a spammer, it is forced to block the entire proxy, usually through public blacklists.
High anonymous proxy - These proxies are the same as anonymous proxies, but are not found on blacklists. This is usually accomplished by giving each person a different IP address or by retiring an IP address and using a new one as soon as it becomes listed on any popular IP blacklist. These proxies may or may not reveal that they are proxies via rDNS lookups.

Be aware that high anonymous proxies are designed only to prevent the IP address from being put on blacklists to make navigating the web less of a pain, not to hide the fact that you are using a proxy from anyone who actually wants to find out. There are countless ways to determine the fact that you are using a proxy which cannot be avoided. Furthermore, neither honest proxies, nor commercial VPNs provide particularly good anonymity due to traffic analysis attacks, among other things. Using a network such as Tor designed from the ground up for anonymity is required for strong anonymity, though they make no attempt to hide that you are using it from the destination.


Possibility for Multi-layer VPN or queries through TOR?

Yes all queries that can be sent over TCP can be sent over TOR.


Convert SHA-256 to SHA-1 and MD5 - Increase bit length/entropy?

And it is longer than the input string, with 288bit instead of 256bit. So did we actually increased the entropy?

No, you did not increase the entropy.

In this context, "entropy" basically refers to the probability of any particular guess about the content or value being correct.

If I tell you that I have hashed a single lowercase US English letter's ASCII representation using SHA256, and that the hash is hexadecimal ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb, then the entropy of that value isn't 256 bits, but rather closer to five bits (log2(26) ~ 4.7) because you only need to make at most 26 guesses to arrive at the conclusion that the letter I hashed was a. (For completeness, what I really did was printf 'a' | sha256sum -b on a UTF-8 native system.)

The entropy, thus, can never be greater than that of the input. And the input is, at best, the initial hash, which has 256 bits worth of entropy. (It could have less, if the string you hashed has less than 256 bits of entropy and the attacker can guess that and its value somehow.) Each hash calculation can be assumed to be O(1) when the input size is fixed.

So by concatenating the SHA-1 and MD5 hashes of a string that is a SHA-256 hash, you can never get more entropy than 256 bits' worth. All you are doing is making it longer, and possibly obscuring its origin.

Now, in some situations, using multiple hashes actually makes sense. For example, many Linux package managers use and validate multiple, different hashes for the same file. This isn't done to increase the entropy of the hash value, though; it's done to make finding a valid collision harder, because in such a situation the preimage or collision attack must work equally against all hashes used. Such an attack against a modern cryptographic hash is already difficult enough for most purposes; mounting a similar attack against several different hashes simultaneously would be orders of magnitude more difficult.


Some initial first next steps I would undertake are:

Take a look at the device MAC address, the first three bytes are a vendor ID, it might help elucidate what the device is, or at the very least the manufacturer of the network device.
Look up the services that use that port. It could be a dynamically used port from an application, I've seen "Xsan. Xsan Filesystem Access". Do you have storage area network devices or Macs on your network?
Then I'd start looking to see if any of the substrings in the nmap report are useful. I see "RTSPRequest", I'm going to venture and say RTSP is "Real Time Streaming Protocol (RTSP)". I'm starting to suspect a streaming video server is involved here, maybe even an Apple TV device.
The DLNADOC string also supports the function of this service might be related to streaming media.

Since this looks like a media server I'll stop here. But you could continue looking into the other substrings (FourOhFourRequest for instance), telnet in and send http commands to the web-server, try common paths to see if any web pages exist...


Can any Windows app install a kernel driver? if not, then how can Anti-Viruses install kernel drivers?

On Windows your require local admin permissions to install drivers. I.e. either running as administrator or the user allowing via a UAC prompt.

If malware has that then yes it could install its own. This is why generally you should use a low privilege account and only offer admin passwords in prompts that are expected.


Yes, you can use a proxy. Your two questions will answer with one application, you need to set up this. You can use NGINX.

NGINX is opensource software for web serving, reverse proxying, caching, load balancing, media streaming, and more.

Here's my answer to your questions:

Yes you can use nginx proxy to protect your admin panel, Here's the link
https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/
You use Nginx proxy again in the same server, what you need to do is setup a virtual host or server Blocks and proxy pass if you want to other api to your domain
https://www.nginx.com/resources/wiki/start/topics/examples/server_blocks/


HTTP Basic auth password storage more secure than Digest auth

The choice isn't just between basic auth and digest auth if you are using SSL.  Digest auth is preferable to basic auth if you have no SSL, though still leaves you a bit vulnerable to man in the middle attacks; though it makes it them more complicated than basic auth.

However, I'd avoid basic auth for several reasons:

an ugly interface to login (a barely configurable pop-up alert when you first go to a protected page) versus an optional login form somewhere on the page.
on a bad login attempt, 401 - Unauthorized messages are worse than a customizable wrong password screen; where maybe you add a CAPTCHA, or have links that could remind username based on email address, or reset a lost password, or create a new account.
You generally can't log out of Basic Auth login without closing the browser.

For this reason, I'd recommend using cookie-based sessions (over SSL) for those reasons, where again you use a strong hash (e.g., bcrypt) to store the password.


Challenges of setting up responsible disclosure for my course

There is some work within ISO/IEC on this, have not looked into it, but would be interested in hearing more, see http://www.iso.org/iso/catalogue_detail.htm?csnumber=45170 (hefty paywall, though).


How can I launch DHCP starvation attack in WLAN?

I think you must create a "fake association" first with that mac to the AP in order to be able to launch that DHCPDISCOVER message. It seems your access point is doing a "good work" protecting the network but it can be avoided.

Maybe you can create some kind of script to change the mac, create the association, and then launch the starvation attack.


How to make John the Ripper output example hashes for a given hash type?

The jumbo version of john has a --list=format-details option. By default, it outputs one record per hash type for all hash types, with tab-separated values of a variety of information about that hash type (maximum password length, long name, etc.). You can also specify a hash type.

So for a specific hash type:

$ john --list=format-details --format=descrypt | cut -f15
CCNf8Sbh3HDfQ

The plaintext can vary - for hash types that have minimum lengths, etc. or if a particular failure mode is being tested for. In this case:

CCNf8Sbh3HDfQ:U*U*U*U*


Defending against private key leaks such as those enabled by Heartbleed

PFS does, in fact, prevent reading the log files after-the-fact. The only use for a captured private key in a PFS arrangement is impersonation. You can't use it for passive snooping in any context, either after-the-fact or indeed live.

This is because in a PFS configuration, the ephermal session key is generated using Diffie-Hellman between the two parties rather than being simply delivered as part of the handshake. And since with a DH key negotiation, the generated key cannot be derived by an observer, the certificate key is of no use to an eavesdropper.

But if the adversary instead inserts himself as a man-in-the-middle, impersonating the server, then the D-H negotiation happens with the adversary instead of the true server. In that case, the adversary gets the ephemeral key and can decrypt the conversation as it happens ... and indeed must participate in the conversation, either relaying messages to the true server, or simply posing as the server on his own.


There is no World Overlord because there are too many candidates for the post.

The whole X.509 protocol is completely up to the task of having a single root CA. However, there is no single root CA because people could not agree about who should thus be entrusted with complete power over all certificates.

Or, from another point of view, there is a Global Root. He is called Bill Gates. Internet Explorer will validate a certificate against a list of locally known and trusted root CA, and that list comes with Windows, and is updated through the official update mechanisms from Microsoft. Therefore, for 99.9% of the people (who don't fiddle with their locally installed root CA), Microsoft decides, ultimately, what root CA are trusted. In that sense, Microsoft is the Global Root (at least for all Windows users).


Could a computer program be used to automate testing for trapdoors?

It depends on what your requirements are.

A sufficiently complex and well-designed system could be used to identify the most simple backdoors or trapdoors in most programming languages. However, if a language is Turing complete, any single expression or function can be expressed in an infinite number of ways, which makes such analysis equal to the halting problem.

A quick example of this is adding a and b together, to produce c.

c = a + b
c = (-a) - (-b)
c = (a - 1) + (b + 1)
c = ((a * 2) + (b * 2)) / 2

All of these are equal, and there are an infinite number of other ways to perform the same calculation. This gets even more complex when there are different instructions that can be used to do (almost) the same thing.

Most current vulnerability analysis that focuses on static analysis of executables works by identifying compiler artefacts, i.e. oddities and idiosyncrasies of individual compilers that allow for signature-based matching of potentially vulnerable code fragments. However, the automated tools spit out a large number of false positives, so a skilled person still has to sift through the results.

Since a backdoor is an is not a defined artefact, i.e. a backdoor may exist in a whole variety of different forms (e.g. backdoor account, reverse shell, hidden files, etc.), it is even more difficult to identify such problems. If the backdoor is something like an intentional buffer misuse to allow for easy buffer overflow exploitation, then it may well be possible to detect such a problem. If it's something more complex, like a particular secret command used to disable file access control, then it's nearly impossible.


What is the difference between a HIDS/HIPS and an anti virus?

First, you talk about HIDS and HIPS.

The 'D' stands for "Detection". It means that the protection system will be able to detect and alert upon a possible security event, but it will not attempt to block anything.
The 'P' stands for "Prevention". This means that when the protection system detects a possible security event, it will automatically try to block it.

Since an anti-virus main use is to actively block the access to files detected as malicious, then it would be nearer to an HIPS than and HIDS.

Are they the same thing? This is a good question, especially since Wikipedia states that "The lines become very blurred here, as many of the tools overlap in functionality."

Historically speaking: no. An anti-virus primary goal is to detect and block access to malicious files, while and HIPS solution has a broader goal: it may track changes on the file system (to detect changes not necessarily implying any malicious code, like an unexpected settings change for instance), analyze log filess (system and application logs), check the system components to detect any irregularities, and indeed also try to detect potential malware.

An HIPS solution may be either composed of several different software and the anti-virus be only of them, or one may go toward all-in-one solutions where a single tool will bundle all these functions.

The fact is that nowadays end-user's anti-virus are a bit more than simple anti-virus, over time they have accumulated a very large panel of features turning them more into security suites which can be indeed perceived as end-user's HIPS solutions.

So, my answer here is two folds:

A basic anti-virus, whose only goal is to detect and block access to malicious files, is only a part of an HIPS solution,
Current end-user's anti-virus go well over this, they are often renamed as security suites and are becoming end-user's HIPS solutions.


I don't think so. You might try and see whether it's possible to exploit MS99-049 through a specially crafted SMB request, but it's a long shot, and anyway, the PC might be patched.

Other possibilities for hacking (not instant RCE) are creating an executable in the hope it will be launched on the remote system (something like StripPoker_Install.exe), or an executable containing a resource exploit against Explorer - again, someone has to open the upload folder on the remote site - or check whether some services are installed after all, e.g. DCOM.

As for the need to restart the OS, an unpatched Windows 95 will do that anyway sooner or later.


How can google's ReCaptcha verify identity *and* train AI?

Very simple: They ask multiple people.

When you need to fill out recaptcha, they show you images they have shown many people before, and for those they know the correct answer and they score you on those. But they also show you images which they have not shown many people before. They do not have enough answers for those images to know what the correct answer is. They do not score your answer for those images, but they record your answer. When enough answers are collected for an image, Google become reasonably sure about the correct answer and can start using this image for scoring.

Obviously, it's more complicated than that (for example, they use their machine learning on the images, which is probably at least 90% accurate, so they have a good idea about the correct answer even if you are the first person shown this image on recaptcha), but that's the idea.


If an individual could get enough control of your server that he could change the root password, then he basically owns the machine and keeps on owning it even if you changed the password back:

The vulnerability through which the intruder came in still exists until you find it and fix it, so he can come back at will.
The first task any half-witted intruder performs upon entering a machine is to plant a few extra accesses in case the sysadmin tries to get away with a few simple cleaning procedures on the machine. This is called a backdoor. People with root access can plant backdoors which you will never find from the machine itself (because the backdoor includes a kernel modification whose job is to hide the backdoor).

Therefore the only sane thing to do with your machine is to do what is traditionally called in these parts "nuke it from orbit". You are due for a reformat + reinstall from scratch. Sorry. Tough luck. For your next install, try to choose stronger passwords and to apply security updates more often (you should aim at daily updates, to minimize risks of compromise).

At least, the key advantage of IT over Medicine is that in the field of IT, you do not get sued for reformatting patients.


What are the resources that an auditor would need to access in read mode?

"Audit" is such a broad category that this question is not answerable in its current form.  If you're about to undergo a PCI-DSS audit, there are checklists to go by: https://www.pcisecuritystandards.org/security_standards/documents.php.  If you're accrediting a system for the US DoD, you'll need the DIACAP documentation.  If you're doing an internal audit, local IT management will decide.


Which is potentially more secure, an encrypted secondary drive or local NAS box?

I think it depends on what threat you are trying to protect against. But anyway, on Windows it should probably by ransomware these days. My thoughts below apply to other malware as well.

Keeping your files on a NAS accessible via Windows file sharing (SMB) is not much different and not much more secure than a local disk. Encryption of the disk does not help if it's mounted all the time anyway.

The problem with protecting against ransomware (and part of the reason it's so successful) is that if you can automate backups (the backup drive can be mounted automatically), the malware can also mount and access it, and recent ransomware quite possibly will do that. Even if it needs a password from you, the ransomware can (in theory at least) sit in the background until you type that password once, and then it can access your drive anytime.

So you should have offline backups, where offline means really offline, as in the NAS switched off or something like that. Backups on write-once media could also be an option, but not very feasible, especially not for home use.

So I think it comes down to a reasonably secure backup strategy, and what exactly is reasonably secure for you depends on your scenario. For example you may want to make a truly offline backup (by physically switching on a NAS, making the backup and then switching it off) once a week, and a daily backup to a password protected drive that is not always mounted. Obviously this is just one example, several conflicting factors need to be balanced (convenience, importance of your data, what timespan of data you can afford to lose, etc).

In short and as always, it's about cost and benefit. Your defense should be proportionate to your risk.


I used a work VPN on my personal computer at home while doing..."non-work" things...am I in trouble/can they see me?

I think they can.
Assuming that the 192.168.1.0 network is your home-network and the 10.2.100.0 network the VPN network, this line in your routing table:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.158 25

0.0.0.0 0.0.0.0 On-link 10.2.100.225 1

Show that the VPN Gateway has a lower Metric value than your home gateway.
This means that all routing to any IP address (0.0.0.0) will first be TRIED over the VPN.

If the VPN is configured to block this, your normal route will be followed, but, technically, your company can LOG packets incoming on the VPN interface.

So to your question, "CAN they see what I'm doing", the answer is, yes, likely.


How does a Tor exit node know the public key of the client?

The client uses Diffie-Hellman to negotiate a session key with each node when establishing a circuit. This is done incrementally, so each DH handshake (after the first) is routed through the existing partial circuit.

https://svn.torproject.org/svn/projects/design-paper/tor-design.html#subsubsec:constructing-a-circuit

So, the exit node has a shared session key with someone, but doesn't know who.

Note also that the exit node does not add multiple layers of encryption to the response like the client does for the request. Rather, the exit encrypts the response with the session key for the client, and sends it back to the previous node in the circuit, which repeats the process. When it finally reaches the client, a layer of encryption has been added at each node, by that node. The client has a session key shared with each node, so it can peel back all the layers.


Is it possible to do arp spoofing on remote system?

ARP packets are communicated within the boundaries of a single network, never routed across internetwork nodes, so you can only perform ARP attacks on computers being on the same network as you are (eg. phones, computers connected to the same Wifi).

To find hosts on your network you can do the following:

Figure out your IP and the subnet mask. Run the ifconfig command and look for a line like this inet addr:192.168.1.101  Bcast:192.168.1.255  Mask:255.255.255.0 This indicates that your IP is 192.168.1.101 and the subnet mask is 255.255.255.0. This means, that hosts with IP of 192.168.1.x (where x can be anything between 1 and 254) are on your network so potentially vulnerable to ARP spoofing.
To find hosts on your network you can use nmap. Nmap has a lot of options, but as a quick start you can run it like this: nmap -v -A 192.168.1.101/24. The option -v stands for verbose output, -A is used to perform OS detection and other stuff, the IP needs to be yours, and /24 stands for the subnet mask. (It is the number of 1s in the binary representation of the subnet mask. In the beginning it is enough to know, that 255.0.0.0 = /8, 255.255.0.0 = /16 and 255.255.255.0 = /24).

Now you can perform the same attacks as you did with your virtual machine. On a home network it will most likely work, although on larger network they might have some defense system. See this answer for more info.

And as always: only perform any test on a network you own or if you have permission beforehand. Running nmap itself might trigger an alarm (eg. NOD32 will display an alert), so be careful.


How does stored procedure prevents SQL injection?

Stored procedures are a form of parameterised query. The fundamental problem that causes SQL injection is data being treated as query language.

$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";

In this example, if I set $password to foo' OR 'x'='x, we get this:

SELECT * FROM users WHERE username = 'blah' AND password = 'foo' OR 'x'='x'

Since the character 'x' is always equal to the character 'x', this query will always return rows regardless of whether the user / pass is correct. The database can't know that you didn't intend this, because it's only being given a string with no context.

In order to prevent this, you have to be able to know the difference between the query and the data. Stored procedures solve this problem by writing the query beforehand, with markers for parameters, so that data can be passed into them later. For example:

SELECT * FROM users WHERE username = ? AND password = ?

The database driver sends the name of this stored procedure (or, in standard parameterised queries, just the query text itself) and a list of parameters, as distinct separate entities in the protocol. This means that the database server can parse the query string as query language safely, and treat parameters solely as data, without any ambiguity.

I also wrote a longer answer a while back that explains all of this in a more verbose way, if that's any use to you.


Under what circumstances can WPA be cracked?

It is susceptible to KRACK Attack. KRACK is attack is Key reinstallation attack. WPA2 also susceptible 2 KRACK attack.  WPA based on LEAP or TKIP and it use single passphrase for authentication. It is possible to brute-force very easily. Because passphrase is static.


How can someone hack my PC if I am connecting to the internet through NAT?

Generally speaking, most NAT boxes also happen to provide some firewall-like protection: they tend to block incoming connections.

This is not an inherent or necessary property of NAT; it is just that most consumer devices that provide NAT also happen to provide this sort of firewalling as well.  (Technically speaking, NAT does not necessarily imply any blocking of incoming connections.)

Nonetheless, for NAT devices that do block inbound connections (i.e., most of them), you do get some of the benefits of a firewall.  This makes it harder for someone to connect to your PCs behind the NAT and attack them.  In practice, this provides a sort of "poor man's firewall" that works pretty well against a common class of attacks.

However, NAT is far from a silver bullet.  People can still compromise your PC, even if your NAT, in a variety of ways:

A malicious website could exploit a vulnerability in your browser, a malicious email could exploit a vulnerability in your mail client, a social engineering attack could trick you into revealing your password or installing malware, a file you download over a file-sharing network could be malicious, and so on.
An attacker could attack your NAT box directly, e.g., by exploiting an open Wifi link, by drive-by pharming, by guessing your NAT box's administrator password, etc.
An attacker could fool your NAT into allowing an inbound connection, using the NAT pinning attack.  This is basically a technical vulnerability in NAT boxes which illustrate that their incidental connection-blocking can in some cases be defeated.

For more detailed elaboration on all of these points, I recommend you read the answers to How important is NAT as a security layer? and What kind of attacks against home router's NAT do exist?.  There is a lot of good information there.


As VMWare workstation provides USB Passthrough, it should be fine using USB wireless cards and doing testing from a kali/linux Virtual Machine.

I say should as there's always a risk of bugs in how VMWare passes the data through to the guest VM, so it could have an impact in some circumstances.  That said, my experience of VMWare Workstation and using USB devices in guests has been pretty positive, so yep overall I'd say that's a reasonable solution to your problem.


How can documents held in cloud storage be safeguarded against malware?

Yes, they can access these documents, and some malware even searches them out.

The protections are the same as if you were not using remote storage: backups, journaling file systems, version control.

Your specific cloud provider might have additional tools, but that will be up to the individual vendors.


Snort: Arpspoof preprocessor events not showing up in BASE UI

After some debugging, I've found that the issue is due to the BASE caching code. It looks (among others) for '(spp_%' instead of 'spp_%', which is the correct start of the arpspoof preprocessor signature name. So i changed the part of the query that is created from line 234 in base_cache.inc.php:

  /* Preprocessor events only */
  # The original "(sig_name LIKE '(spp_%')" is too limited. Cf.
  # /usr/local/src/snort-2.8.3.1_unpatched/etc/gen-msg.map
  # /usr/local/src/snort-2.8.3.1_unpatched/src/generators.h
  # Currently I have included all the names that I have found in
  # these files.
  # Note: Do always add '%' in LIKE-statements. Otherwise the entries
  #       won't match.
  if ( $db->baseGetDBversion() >= 100 ) {
    $schema_specific[3] = " ( " .
                          "(sig_name LIKE '(spp_%') OR " .
                          "(sig_name LIKE '(spo_%') OR " .
                          "(sig_name LIKE '(snort_decoder)%') OR " .
                          "(sig_name LIKE '(http_decode)%') OR " .
                          "(sig_name LIKE '(http_inspect)%') OR " .
                          "(sig_name LIKE '(portscan)%') OR " .
                          "(sig_name LIKE '(flow-portscan)%') OR " .
                          "(sig_name LIKE '(frag3)%') OR " .
                          "(sig_name LIKE '(smtp)%') OR " .
                          "(sig_name LIKE '(ftp_pp)%') OR " .
                          "(sig_name LIKE '(telnet_pp)%') OR " .
                          "(sig_name LIKE '(ssh)%') OR " .
                          "(sig_name LIKE '(stream5)%') OR " .
                          "(sig_name LIKE '(dcerpc)%') OR " .
                          "(sig_name LIKE '(dns)%') OR " .
                          "(sig_name LIKE '(ppm)%') OR " .
                          "(sig_name LIKE 'spp_%') OR " .
                          "(sig_name LIKE 'spo_%') OR " .
                          "(sig_name LIKE 'snort_decoder%') OR " .
                          "(sig_name LIKE 'http_decode%') OR " .
                          "(sig_name LIKE 'http_inspect%') OR " .
                          "(sig_name LIKE 'portscan%') OR " .
                          "(sig_name LIKE 'flow-portscan%') OR " .
                          "(sig_name LIKE 'frag3%') OR " .
                          "(sig_name LIKE 'smtp%') OR " .
                          "(sig_name LIKE 'ftp_pp%') OR " .
                          "(sig_name LIKE 'telnet_pp%') OR " .
                          "(sig_name LIKE 'ssh%') OR " .
                          "(sig_name LIKE 'stream5%') OR " .
                          "(sig_name LIKE 'dcerpc%') OR " .
                          "(sig_name LIKE 'dns%') OR " .
                          "(sig_name LIKE 'ppm%') " .
                          " ) ";

And all events are logged now.


How sharing location via web actually works? (It gets my exact house address)

I think @neil-smithline is right, when I go to the What's my IP address page I don't get asked for my location, but there is a button which says "Location not accurate? Update your IP location" which then does ask for the browsers geolocation.

As for how your browser knows your location when you don't have a GPS in your laptop, from the article @neil-smithline linked to:

  By default, Firefox uses Google Location Services to determine your location by sending:

  Your computer’s IP address,
  information about the nearby wireless access points, and
  a random client identifier, which is assigned by Google, that expires every 2 weeks.

The important part is the "information about the nearby wireless access points" bit. Google has a database of wireless networks that include the BSSID and the location. It is kept up to date in a number of ways, for example Google Street View cars recording WiFi, or people's phones with GPS enabled reporting back which WiFi networks are in the area, I believe Ingress reports that information back to Google as well (but I could be wrong).

Just using a list of near by wireless access points you can get a location to within a few meters. There is a public database called WiGLE that provides a similar service for example.


How can an access point spoof me into connecting?

I'm going to go out on a limb here and could be wrong, but...

If there are two APs using the same encryption level and the same passphrase, then I believe most wireless clients will happily connect to either without raising a fuss.  I do not believe that the equivalent of an SSH host key is used to fingerprint the original "authentic" AP.

Therefore, if an attacker knows the passphrase in use by an AP, they can imitate that AP and either hijack traffic or perform a man-in-the-middle attack.

I am reasonably sure that this was my experience when I temporarily configured a second AP in my house with the same passphrase, using XP and Windows 7 clients.

It may be that the protocol supports an AP host key, but that the Windows client implementation does not take advantage of it.  As I say, I'm going out on a limb here, basing my response on limited experience which I recall hazily.  I'm sure someone will let me know if I'm wrong!


It depends on what security features you are looking for; specifically, how much you mistrust your own computer.

If you just need the decryption key to reside on a USB device, then you can put a key file on a basic USB flash drive, and use GnuPG. The key will of course make it to the main computer, because the computer will do the actual decryption work. But at least the key will not be written to a file on the computer; it will be in RAM only. This is the cheap method. It works in the case where you do not trust your computer when it is powered down; e.g. this is a laptop and you fear that it could be stolen while you are not using it.

To go one step further, you may want to consider encrypted drives like these ones. The encryption and decryption keys are known to the device only, and all encryption and decryption occur in the device, not the host computer. Some models can even be unlocked with fingerprints (a reader is embedded in the device). If the host computer is hostile (e.g. compromised with a nasty virus), it can still plunder your data when the device is inserted and unlocked, but at least you have some control on when such things may happen.

If you have really sensitive data that must never be shown to a potentially compromised computer, then the most natural solution is to buy a dedicated computer, kept offline, for this data.


Did Cisco not patch this vulnerability in these modems?

The products that aren't being patched are considered EOL (End of Life) or obsolete. Their entire cable modem line, including all the DPXX models, was sold to Technicolor.

You can find more information here: http://www.cisco.com/c/dam/en_us/about/ac49/ac0/ac1/ac259/docs/connected-devices.pdf


Design and Security Architecture - where should IPS/IDS be placed?

Not far from a matter of taste... More exactly it really depends on too many factors to allow a definitive answer. Just some hints:

the sooner is better if you want to be warned against attacks against the edge server or the firewall itself
after the edge can be better if you have very high traffic to avoid a bottleneck at the IDS/IPS
after the edge can make sense if you have HTTPS traffic decrypted at the edge level and want to analyse it

But you could also imagine a Network IDS close to the firewall for non TLS encrypted traffic and Host IDS on the application servers for the TLS encrypted part


Why is the setuid bit not working when I execute this binary?

I think you're on the right track with the assembly code example you gave, and in particular, the part that makes the system call to setreuid. However, you're trying to set the real and effective user IDs to 0. According to the man page, that's not going to work.

  Unprivileged users may only set the real user ID to the real user ID or the effective user ID.

Source: http://man7.org/linux/man-pages/man2/setreuid.2.html

In narnia0.c, you can see that there is a call to setreuid(geteuid(),geteuid()); before the system("/bin/sh") call. So I believe you need to adjust your system call to setreuid in assembly to something similar.

I found an old write-up for narnia0 which includes the narnia0.c source code as it was at the time of the write-up, and it doesn't include that setreuid call. This makes sense since old write-ups for narnia1 didn't have to include a call to setreuid in the shellcode either. Something must have changed either in the way the system is set up or in the way the effective user id is handled when spawning a shell.

Now, shellcode that executes some other command (e.g. cat) directly rather than trying to spawn a shell actually works (can access narnia2 files) without a prior call to setreuid, so it seems that whatever changed is only having an impact on launching a shell. Perhaps the shell itself changed so that now it resets the effective user id to the real user id on launch, but I'm just guessing at this point (although that would explain all of the above).


Does it make sense to have the application block users by IP as well as the firewalls?

PHP offers great opportunities to mix configuration data, business layer code, HTML and javascript in the same script. Yet IMHO it is not a good practice, because it tends to make writing and executing tests harder.
Here the list of allowed IP addresses is a configuration data. Having to search such data through the code if you later install the application on a different system with different allowed address is not maintainer friendly.
For the point whether IP addresses control should reside inside or outside the application, it is largely a general design decision. Either you specify that the app will not worry for IP security, and it should be protected with a firewall, or you want the app to have as few external configuration as possible and you keep it inside. The first way better respects the single concern principle, but requires a proficient firewall admin. The second way is probably less versatile, but the application will run anywhere with a minimal external configuration. Different use cases and a different public target.


Your Web browser will always try to authenticate the server's certificate; it will complain loudly when it cannot. The point about optional authentication is for the "DH_anon" cipher suites in which there is no authentication at all. Such cipher suites are, by definition, insecure against active attackers, and thus should not be used. Web browsers don't support them by default, or even at all.

Some servers may also require some certificate from the client, but this is pretty rare because client certificates are a rarity, and most people don't have any. This mostly occurs with some bank sites, and if that's your case then you should already know it.

Key size does not impact whether authentication occurs or not. Of course, if the server uses a pathetically small key, this may endanger the safety of communications -- but your up-to-date browser should warn you in that case.

The key size as indicated in the cipher suite name (as the "128" in "TLS_RSA_WITH_RC4_128_SHA") does not relate to the RSA / DSA / whatever key used for the asymmetric encryption, but to the symmetric encryption algorithm used afterwards to actually encrypt the bulk of the data.

More generally, you seem a bit confused about what "authentication" means. In usual SSL connections, between a Web browser (the client) and a Web server, along the HTTPS protocol, there are two "authentications" which take place:

During the initial establishment of the connection (the "handshake"), the server shows his asymmetric public key to the client as part of its certificate, and the client validates that certificate. The validation process is the method by which the client makes sure that the public key it sees is indeed owned by the intended server. Once the client has obtained some guarantee that the public key is correct, it accepts to use it for the cryptographic elements of the handshake, which indirectly authenticates the server for the whole subsequent data exchanges.
Once the handshake has been done and the SSL/TLS tunnel established, the server may require some sort of authentication from the client (password, cookie...). This happens at the HTTP level, not at the SSL level; this is completely unrelated to SSL, except that most client-to-server authentication mechanisms can be deemed "safe" only when they occur within a secured tunnel, e.g. some established SSL connection.

The relationship between the cipher suite and the authentications is the following:

The cipher suite may mandate a specific key type (e.g. RSA or DSA), and things will work only if the public key, as found in the server's certificate, is of that type.
The client-to-server authentication is secure only insofar as the SSL/TLS tunnel ensures confidentiality and integrity; there are weak cipher suites which do not do that well. Fortunately, these cipher suites were defined to comply with old US export regulations and are no longer activated by default or even supported by modern Web browsers (except maybe in some countries, which may insist on their citizens using weak cipher suites).


What encryption is possible for ReadyBoost?

ReadyBoost by default uses Advanced Encryption Standard 128 (AES-128) encryption, which should be sufficient. I doubt very highly that your grandmother's cookie recipe needs DoD grade encryption. If the system is in contact with highly confidential information, perhaps you should invest in more RAM and find a full-disk encryption solution (also enable encryption on dump/log & hibernation files).
I haven't tried this, but you could attempt encrypting the USB with TrueCrypt. In order for ReadyBoost to work, it will need to be mounted in TrueCrypt (since Windows can't work with data that is encrypted by the user). All subsequent data that is written to the drive will be encrypted (both by ReadyBoost and TrueCrypt). This of course presents a new threat, if someone took your computer (or transferred data) while the drive was mounted in Windows and TrueCrypt it would be in plain text.
Since ReadyBoost is only used for cache purposes, read/write overhead due to encryption/decryption won't be noticed. Typically, if data is eligible for cache-storage, it's no longer in use anyway. You should also make sure that the cache on the drive is cleared at shutdown, since you'll no longer need it (I don't think Windows will clear drive's contents, even if it is for cache purposes, I could be wrong!).
Additionally, you should consider clearing your virtual paging file on shutdown as well, it will add a significant overhead to your shutdown time though. So if you need quick graceful shutdown to clear your session keys from memory (FBI knocking?), this may not be a good idea.

Windows Administration - Inside the Windows Vista Kernel: Part 2 (Underneath figure 1: ReadyBoost device test results in the registry)
ReadyBoost Q&A (Q: Isn't user data on a removable device a security risk?)


"holding open" encrypted home with local ssh

If someone gains access to your system by software means while the encrypted filesystem is mounted, they gain access to the filesystem.

If someone gains access to your system by software means while the encrypted filesystem is not mounted, they may still gain access to the filesystem: it depends when you detect the intrusion. If they manage to gain root (and not just access as some other confined system daemon), then they can plant malware that will record the filesystem's password and decryption key the next time you enter the decryption password.

If someone gains access to your system by hardware means while the encrypted filesystem is mounted, they may gain access to the filesystem. For example, they can perform a warm RAM extraction and dump the keys from memory.

So by keeping the directories unencrypted you are increasing the risk window. However, the only way to reduce that risk is to stop operating the server — the server process needs to access its data anyway.

Keeping a Screen process running, as opposed to, say, turning off automatic unmounting, only has a security impact if there is a vulnerability in Screen. Screen is a mature, fairly stable program, so the likelihood that an as yet unknown vulnerability will be discovered in it is rather low. Screen's security relies on file permissions (the ownership of the socket directory), so in any case anything that can affect it is highly likely to be able to affect the service-providing daemon as well.

In practical terms, this approach does not increase the risk beyond that inherent in running the daemon in the first place.


Does Gmail's 'preview' feature for documents in the browser prevent malware?

It will prevent any exploitation of any vulnerabilities unique to the application that you would use to normally open the attachment (e.g. Adobe reader, image viewer, etc).

It will not prevent exploitation of vulnerabilities in the browser due to rendering the attachment (although this would hard as the attacker would have to create a browser exploit that works with the specific implementation of the previewer that Google are using).

And it will not prevent exploitation of vulnerabilities in any algorithms or libraries shared with the previewer and your usual application. However, for the preview, again the attacker would need to craft the attachment in a specific way to not only exploit the library, but to have this exploit then generate the appropriate browser exploit. The browser exploit could take the form of a simple attack vector such as an XSS attack though, which would be easier to achieve.


I'm getting a suspicious link that starts with account.youtube.com, can someone explain what this link does?

I'm not going to click on that URL but what it appears to do is:

You can only see the beginning, it looks OK and possibly important to you.
If you don't examine the remainder of the URL it seems safe to click on.
When you click on it you are redirected to Google and logout.
Next you are redirected to a BitLy URL shortener.
The BitLy redirects you to the Baidu search engine.
The Baidu URL has an "Associate ID" attached.
You could be directed to a previously saved search, and the associate gets credited.
IF any of the subsequent sites you see are malicious then since you are logged out of Google (and thus YouTube too) they probably will ask for your name and password, offering to log you back in. The chances of the page asking for your password being a fake Google login webpage are very good.

ALWAYS enable 2-Step Authentication !

Once you give your Google account away they can use it to upvote their favourites and make posts that seem to come from you. Even if you don't give out your password the Associate still gets a credit for your click-through.

So, it may or may not be "malicious" (lead to something "harmful") but it certainly gives someone credit for your click.

This (in its various forms) is explained here: "From Baidu to Google’s Open Redirects", here "How Malware Campaigns Employ Google Redirects and Analytics" or here, on a Google Support webpage: "Detect and get rid of unwanted sneaky mobile redirects".

If you don't have a good reason to click on something don't click on it - it's going to take you off of the page you are on.


Regardless of the type of application, having only one set of credentials is certainly bad practice. For starters, since it's shared, it's more likely to be treated less carefully; e.g. written down in places where people are likely to see, and thus could more easily fall into the hands of an attacker. Once the password is compromised, it's a bigger deal to change it since you need to notify everyone.
It also greatly reduces your ability to audit user activities; without an unique user ID, you can't track who is doing what.
If the company already uses a central authentication service (e.g. active directory/LDAP) or single-sign-on (SSO), it would be ideal to instead rely on that for authentication, with the added benefit that all the user information is already there, as well as group/permission information.


Which Domain Validation category does DKIM fall under?

DKIM does not use any certificates at all and is also unrelated to TLS. This means that  a question about the kind of validation related to the subject of a certificate does not relate to DKIM at all.

For DKIM the domain owner itself associates a public key only (not a certificate) with the domain by putting it into a DNS TXT record and then uses the associated private key to add a signature to mails sent through the domain owners mail server. By checking this signature against the public key the recipient can verify that the mail was actually sent through the domain owners server which makes forging the sender harder.


There have been experiments with mail services, where the recipient must complete a CAPTCHA before reading your message and revealing your true identity and e-mail address.

Google has had a "mailhide" API up and running for website developers, but I haven't looked into a way to be useful to end users.

To answer your question directly - unfortunately, I do not think there is a direct way of finding out whether an e-mail address is used by spammers or can be trusted. If you receive an e-mail and look up the headers and sender identity, then you can lookup their reputation based on IP address, domain SPF and other criteria, but it isn't a guarantee. That's probably one of the reasons why we have been having this cat-and-mouse game with spammers for years - reputation is based more or less on the domain name rather than the reputation of an individual e-mail account.

The trust domain for e-mails has typically been that if you are sending a message to an e-mail address, then you implicitly trust that the address is genuine, whereas the focus has been more or less on filtering the incoming messages (spam filters, junk mail folders, etc.). Maybe it's a great feature that we're missing in our e-mail clients and servers?


Why is it dangerous to open a suspicious email?

There is a small risk of an unknown bug — or a known but unpatched one — in your mail client allowing an attack by just viewing a message.

I think, though, that this very broad advice is also given as a defense against some types of phishing scams. Social engineering attacks are common and can lead to serious trouble. Making sure people are at least suspicious is a first line of defense. It is like telling an elderly grandparent to never give their credit card info over the phone — okay, sure, there are plenty of circumstances where doing that is relatively safe, but when they keep getting scammed over and over, it's easier to just say: don't do it.

Likewise, not opening mail keeps you from reading about the plight of an orphan in a war-torn region who has unexpectedly found a cache of Nazi gold and just needs $500 to smuggle it out and they'll share half with you, and your heart just goes out, and also that money wouldn't hurt.... Or, while you know the rule about attachments, this one says that it's pictures of the cutest kittens ever, and how can that be harmful — I'll just click it and okay now there are these boxes saying do I want to allow it, which is annoying because of course I do because I want to see the kittens....


How to Remotely Retrieve Password Hash from Computer

There are a number of ways to remotely access a system outside of SSH. Hint: look at the sharing tab in your sys pref. Don't forget about VNC and 3rd party tools (LogMeIn, etc.).

Also, if you are considering network layer attacks, you can use network spoofing attacks for Directory-based auth protocols. See Responder as an example (mainly for Windows netNTLM hashes via NBT-NS and LLMNR, but OSX can support these as well if in a Windows Enterprise environment).

  Supports NTLMv1, NTLMv2 hashes with Extended Security NTLMSSP by
  default. Successfully tested from Windows 95 to Server 2012 RC, Samba
  and Mac OSX Lion. Clear text password is supported for NT4, and LM
  hashing downgrade when the --lm option is set. This functionality is
  enabled by default when the tool is launched.


Is PrinceXML exploitable if I control the template

SymbolHound is a useful search engine for these sorts of things.

Most often I've seen this with ASP (ASP .NET?  ASP MVC?  I can't keep them straight) code.  It's also the same syntax used by ERB, a Ruby templating engine.


How to establish VPN connection through Tor?

Actually, tor only provides a socks proxy. So your OpenVPN, for example, needs one additional line:

socks-proxy 127.0.0.1 9050

Additionally, you have to exclude tor traffic from vpn, which will not be too easy, and there is plenty room for mistakes.

Actually, I don't see any advantage for you, using vpn over tor, as it might be very unstable and break when changing the exit node, which will happen from time to time.

But if you run tor over vpn, you have better protection againts dns leaks, or misconfigurated apps. Also, if the vpn connection breaks, there is still tor.


Must a Diffie-Hellman group value persist?

Your inferences are correct; in fact, they are more often expressed the other way round: while each instance (TLS handshake) uses its own group, it is possible to reuse the same group between instances, regardless of whether they are for the same server or a distinct server. All the Logjam business was about clients and servers using a weak group (because the modulus was too short); the reuse of that group by many servers merely extended the scope of the attack.

There is no relation whatsoever between the group and the certificate or domain; group parameters are sent by the server for each handshake, so that clients do not need to remember anything about that group -- and, in practice, clients do not try to remember anything about the group, so they won't do anything special if a given group is reused or not reused.

However, one must take into account that group generation is kinda expensive. It is not necessarily as long as what OpenSSL does, because OpenSSL insists on using a "safe prime", which is overkill here (and, arguably, not "safer" in any way than a non-safe prime, because the terminology is merely traditional). Yet, producing a new group is still a matter of a few seconds of CPU, so you do not want to do that for each incoming connection. What could be done is generating fresh DH parameters upon server start -- thus, the parameters would not have to be saved in any file.

Pragmatically, existing Web servers (say, Apache) can read parameters from a file, and the guide you link to advocates generating a DH group unique to your server. The main value in generating your own group is that it allows you to generate a strong group, i.e. with a large enough modulus. That the group is not shared by other servers is only of secondary importance.

Note that for elliptic curves, everybody works with the same group (i.e. the same curve), because deployed implementations are specialized for that specific curve(*) and cannot handle any other. If group reuse was really an issue, then elliptic curves would have to be deactivated ASAP. Fortunately, reuse is not a problem.

(*) Actually two curves, NIST's P-256 and P-384, which are part of NSA Suite B; for some reason, this suite is increasingly taken by browser vendors as some kind of Gospel, to be followed to the letter, otherwise the gods will strike you with lightning.


Can AES encryption prevent modifying bits in a wireless protocol?

My understanding of NFC is that, as a standard, it doesn't offer any provision for encryption of data security.

This means you'll have to implement security on top of it.

So first: the important part: do not try to implement it yourself:

You do not have the understanding necessary to design it properly (as demonstrated by your question)
Even with proper design, implementing security properly is a hard problem even for experience programmers and designers
There are plenty of libraries (starting with OpenSSL) that will provide you with the necessary tools for the task, are scrutinized by the best minds in the business for potential weakness and issues (even if old implementation bugs surface from time to time).

Now for the specific part of your question: AES is a bloc cypher. In itself, it does not provide with either authentication or data integrity. All it does is describe how you can use a key to encrypt a single fixed size block of data. You need to couple it with a block cipher mode of operation to add the properties necessary to make it useful in practice: apply it on arbitrary length steam of data, protect against replay attack, data modification, authentication, etc. All these properties depends on the mode of operation you pick.


Does setting a firmware password add security if FileVault 2 is enabled?

The firmware password adds very little value to the protection of your device. There have already been published loopholes for either:

Resetting the firmware password
Nullifying it completely

On several versions of the Mac OS. The FileVault encryption will be sufficient for protecting your information.


take a look at distributed hash tables, magnet links and the bit-coin protocol.

I guess it is most certainly possible, but the complexity would easiely reach that of a larger rfc. too large to be discussed here.


2)overkill unless people are uploading something like ssn's or CC's, in which case it could be useful if a proxy, vpn, malicious access point, or other service stops https

3)sql injection if SQL, other problems if not.

after uploading the file you need to make sure it gets displayed as an image


I want to start learning fuzzing windows applications, where should I start?

The approaches and techniques in the book Windows Stack Exploitation: Bypass Protection are straightforward and well-grounded.

While the book's examples use Sulley, I recommend that you also look at FuzzLabs as an introductory Windows-app fuzz-testing suite. The most-advanced fuzz-testing suite is Driller, which I believe will be released at the DARPA Cyber Grand Challenge in Aug 2016 -- but there are many other valid techniques.

Using the qemu-user framework with pwndbg can allow quick prototyping and execution of Windows executables under a classic Linux environment. The binary.ninja framework is a commercial solution that many are talking about as the next-generation of exploitation development. However, binja is geared towards exploit dev using binary analysis techniques -- still very-valid -- and I recommend some older books such as Identifying Malicious Code Through Reverse Engineering or even The Software Vulnerability Guide.


Does CCleaner permanently delete temp files?

It depends how you delete the files with ccleaner. There is a option for simple file deletion and overwriting (you can chose to overwrite multiple times also) the deleted files. Normally deleted files can be recovered till they are overwritten naturally by the operating system as part of using the freed disk space for saving other files data but overwritten files cant be recovered. as per my knowledge i hvnt come accross any tool that can recover overwritten files. Anyone having recovery experience of such files can add few more details to the answer.


No real information on specific attacks, but as for how the network looks...
For the most part it would be mostly the same, though with different common services around (in addition to implementations of regular, common protocols).

One big difference, though, would be SPNEGO/NTLM all over the place, though by now it should be mostly Kerberos anyway.
Also SMB (for file sharing).

I'm not sure this is really the answer you need, but it may be able to help you narrow your focus to ask a more specific question.


Does the bash shell function import feature inevitably give rise to privilege escalation problem?

These tests are run on an unpatched system:

# ls='() { echo NO; }' bash -c 'ls'
NO

the * wildcard is required or perl will replace system call with a fork/exec combination

# ls='() { echo NO; }' perl -e 'system("ls *");'
NO

However ls is not a builtin:

# type ls
ls is hashed (/bin/ls)
# type echo
echo is a shell builtin

So lets try overriding built-in echo
("command" overides the built-in to avoid recursion):

# echo='() { command echo NO; }' bash -c 'echo YES'
NO

So far we showed that:

it can override a built-in
and does not require a script to be called
even when the first argument is not a script
every call to "system" is a vector, giving privileges of the caller

I think naked "system" and "popen" are rotten, I think most uses of these don't bother to escape shell meta-characters in user data.

I have this invocation when I want to have the shell produce pipelines or use shell built-ins, but it still requires fork/exec:

exec("sh", "-c", "\"$0\" \"$1\" | tee -a \"$2\"", ...);

The technique gets bash to refer to the arguments of the -c commands, $0 being the first such argument, or "--" can be used as a filler:

exec("sh", "-c", "\"$1\" \"$2\" | tee -a \"$3\"", "--", ...);

This test is run on a patched system:

$ env "BASH_FUNC_ls()=() { echo NO ; }" bash -c 'ls'
NO

showing clearly that this issue is nothing to do with shellshock.

While authors of scripts or script-using tools should know to validate user input, and should know to validate/clean the environment (as it contains user input) some parts of the environment can need to be preserved, and it can't always be easy to see which they might be;

XAUTHORITY, DBUS_SESSION_BUS_ADDRESS, XDG_SESSION_DESKTOP, SSH_AUTH_SOCK are a few and other important environment variables may not yet be invented

it is called "environment" for a reason. The PATH can maybe be sanitised, but the first command issued to system() can be surplanted

The sudoedit man page writes:

Running shell scripts via sudo can expose the same kernel bugs that make
setuid shell scripts unsafe on some operating systems (if your OS has a
/dev/fd/ directory, setuid shell scripts are generally safe).

However this will not be true for setuid bash shell scripts unless they refuse to import all bash functions


Randomly selected words converted into sentence. Did I lose passphrase strength or gain it?

Intro
Given that you're using a diceware list, I'll follow the one found here but this applies to any list (except for the average word size and some details in the instructions).
Properties of the diceware list
The instructions for using the diceware list make it clear that the overarching goal is to avoid bias when constructing a passphrase, starting from the use of dice and fixed list, down to the very specific instructions that should be followed to the letter. For example, it is specified:

If you do roll several dice at a time, read the dice from left to
right.

So what do you gain if you follow these steps exactly:

a random passphrase with easy to evaluate entropy
no personal bias in the choice or order of words

Attacks

A blind brute force attack will need to crack a password of size approximately 4.2 (the average word length in the diceware list) times the number of words, plus spaces. Using even 4 words is making this infeasible.
An attack knowing that you used diceware will be in similar dire straits. Each word added to the passphrase adds another 12.9 bits of entropy so 5 words is 64.5 bits. This will already be fairly strong.
A dictionary or phrase attack will not do any better than the above attack since the set of words to try is exactly the diceware list and the random order does not make full phrases a good attack vector.

Modifying the passphrase
The simplest way to illustrate this is to use an (admittedly contrived) example.
Let's take the following six words obtained (in this order) by following the instructions: dog, quick, fox, lazy, jump, brown.
But my memory is not doing so well these days and I can quickly massage these words into something much more memorable:
The quick brown fox jumps over the lazy dog.
This is presuming that I'm feeling free to change the order and insert words like the, over, and punctuation.
Let's now look at our previous attacks:

The blind brute force attack now has to deal with a much longer password and will do considerably worse.
An attack knowing that you used diceware is now in hot water since either those words did not exist in the list, or the number of words massively increased as did the entropy.
A dictionary or phrase attack is where we hit trouble. This is a fairly well known sentence, which is the reason it popped into my head.

For this exaggerated example, the dictionary attack with phrases might find my passphrase in very little time. This shows why bias in password selection can be a dangerous thing.
Summary
It comes down to two things: which attacks are being used, and how common your new passphrase is. You only control the latter.
My take on this would be to stick to the strict anti-bias rules of the diceware list. They are there precisely to avoid this kind of situation.
That said, your new passphrase may not be that much worse than the original but it's really hard to tell due to the very subjective nature of personal bias.
Additional notes
The instructions warn about this specific case:

You should also start over if your passphrase is a recognizable
sentence or phrase in the language you are using

They also allow for additional punctuation but also chosen randomly for both the type and the position. I've omitted mentioning them before since they can be considered part of the diceware method, though the same caveat applies for intentionally-placed punctuation.


Wordpress.org pages refresh when logging out of Gmail

The short answer is no.

Wordpress has quite a few community-developed plugins that integrate features from Google services onto Wordpress sites that can be found in their "Plugin Directory". Examples from a search for the keyword "Google" on the Plugin Directory.

Since these plugins are not officially developed by Google, odds are that not all of them use the most aesthetic/efficient code. Sounds like that particular plugin has the page refreshing if the session detects a google login change, so that Wordpress can receive the new Google information from your browsing session, which would inform the site/plugin of a new user/no user for the +1 button, adsense info, etc. to associate with.


What are the potential vulnerabilities of allowing non-root users to run apt-get?

apt-get update -o APT::Update::Pre-Invoke::=/bin/sh

From GTFOBins

This gives you a root shell on the system. No creating packages and adding fake repos; this will give the user who runs this command easy and simple access to root.

So, in answer to your question, you are effectively giving root to every user who has access to this binary. If you are willing to do this, then you might as well just give them sudo access or the root password.


Are there significant security risks in trusting randomized subdomains to run JS?

Ideally, sites will use subresource integrity mechanisms, as described by the w3c

This will allow you (well, ideally your browser on your behalf) to verify that you are getting the file you expect from the content delivery network, by verifying that the hash matches the expected one, as defined in the main resource.

If they do not, you are probably out of luck - your 'trust the first time, investigate if it fails to match the next time' is probably as good as you get - that's why they created this standard.


Storing SSH private keys on an Android device

Alternatively, you might consider the JuiceSSH client. It stores your keys in its private app directory. In addition, it encrypts its storage so even jailbroken phones offer some level of protection.

Sources:
- @JuiceSSH: "External storage won't work as keys are imported into the internal JuiceSSH database".
- @JuiceSSH: "They [ssh keys] are stored in an encrypted SQL database, but you can export them by long-pressing on the identity".


Is passlib cryptocontext verify method security for timing attacks?

In password hashing and verification the majority of time is done in the computation of the hash. Only a small fraction of time is spend during verification for comparing the computed hash value with the stored hash value. And even this comparison is on basically comparing "randomish" data since they are the output of hash functions. And even if one could just measure the timing of the final comparison from hashed entered password to hashed stored password, it would not help to reverse engineer the original password since the hashes used are non-reversible.
In other words: timing attacks against established password hashing algorithms can not be used to determine the original password, no matter how the actual implementation is done. Additional protection against timing attacks in the implementations is not needed.


Is the 64-bits length of the original string padded as well in the MD5 hashfunction?

In decimal, 1234, 01234, 0000000001234, and so on all represent the same number. The unique ten-digit representation of that number is 0000001234.

Likewise, the unique 64-digit base-2 representation of 56 (decimal) is 0000000000000000000000000000000000000000000000000000000000111000. So your guess is correct.

But you've made two other errors. First, at least one bit of padding is always added. Your message is 448 bits long, so 512 bits of padding must be added to made its length congruent to 448 (mod 512). Second, the 64-bit length is the length in bits, not bytes. So in all, your 448-bit message is followed by 10000...0000111000000, for a total length of 1024 bits.


Ars Technica did a superb piece on this a couple of years ago. A woman who is a real estate agent and publishes her cell phone, was inundated with junk calls. What was odd about these was

They were fully automated calls
They never played a message
They used a different number every time

They detailed her nightmare

On the first night, France went to bed, slept for 7.5 hours, and woke up to 225 missed calls, she said. The calls continued at roughly the same pace for the rest of the five-day stretch, putting the number of calls at somewhere around 700 a day.
France installed robocall blocking tools on her phone, but they didn't stop the flood. Unfortunately, anti-robocall services that rely primarily on blacklists of known scam numbers generally don't block calls when the Caller ID has been spoofed to hide the caller's true number.

They included this quote from a security researcher (emphasis mine)

Because it's an old, circuit-switched network, none of the switches along the way need to know who actually is placing the call. I was shocked to find out that the Caller ID is just an optional part of the original address message that gets sent along. You don't need it, and nobody is checking it along the way for authenticity, and, really this means you can put that to be whatever you want. To top it off, there are a lot of online services that allow you to send out phone calls and specify exactly what Caller ID you want them to come from.

I've had to explain this to numerous family and friends. The pinnacle there was my father-in-law, who called me up one day to ask how he got robo-dialed from his own number. I even get random calls sometimes from people saying "I'm returning your call" when I have no idea who they even are, let alone know how to call them.
Caller ID is never verified. That is hard to explain to most people, because their cell phone sends a proper ID and they can't easily spoof it. But the rise of VOIP, combined with the plummeting cost of phone calls in general and turnkey software that makes spoofing a breeze, has made this an incredibly cheap way to spam and scam people, especially from abroad. The FCC is proposing some changes to address this, but those changes are likely years off.


It all depends on how your application authenticated users. ZAP can handle pretty much any type of authentication, but configuring it can be non trivial. We are actively working on improving this.
Have a look at this tutorial video.
If your app uses a standard login form then see here.

I'd recommend getting authentication working with the ZAP desktop first (as this makes debugging much easier) and once thats working translating the same steps to your script.
For more help ask on the ZAP User Group.


Using a password hash...as the password?

Nope. It's a great idea. The trick is getting those hashes into different sites' length and complexity requirements.

PwdHash is one great example. It uses HMAC-MD5, but it drops so many bits from the output it's probably fine. (That's a technical term. Besides, MD5 pre-image resistance is still unbroken.) More importantly, they solved the problem of length and complexity requirements nicely, and there's working software for it on many different platforms (Firefox, Chrome, Mac OS, iOS, Android, the website itself).

Master Password is another app, which uses HMAC-SHA-256, but is only available on Mac and iOS. Also, it is a bit wonky in its encoding technique. Its defaults are way too low-entropy because they try to be "pronouncable" by controlling vowel positions. I submitted a bug report and was told that entropy is irrelevant and to go soak my head. It's fine if you use the paranoid setting for serialization, but it's too much of a headache compared to PwdHash for me.

It's a bit sad that this is the state of the art in this category, and it's also sad that the PwdHash people didn't just use scrypt.


As I understand it, Yubikey acts like a USB keyboard. You plug it in your computer, place the cursor in a form field, press the button on the Yubikey, and it sends out a text string of 44 characters to the computer like you are typing those 44 characters. The computer doesn't know the difference between you typing it or the Yubikey generating it.

A website like a Wordpress site with Yubikey plugin, or the Lastpass addon in Firefox, or any other website that has a Yubikey option, has a login form with username, password, and Yubikey password. You enter your username and password, place the cursor in the Yubikey field, then press the Yubikey button, and it enters the Yubikey password into the field.

Then the form is submitted, and the Yubikey is validated in the Yubicloud. The website checks if the entered Yubikey password is valid. The Yubikey itself does not connect to the Yubicloud. It's just a device generating a string sending it out acting like a keyboard, and it does not connect to the internet or anything except as that keyboard.

Before all this works, you need to update your account on the website to use Yubikey. That means you need to link your key to the account. That way the Yubicloud can check the generated code and validate it against your account.

The website of course needs to implement the Yubikey functionality, which is available as a free service for website owners.

If the Yubikey gets lost, you can use the normal recovery methods the website has to recover your account and disable the Yubikey. Normally this means that you get a password recovery link via email, and that link disables the Yubikey function in your account.

I mailed Yubikey support to see if this answer is correct. They said this explanation was correct, except that it explained only one part of the way the key works.

The other answers here don't give any real explanation. Even the Linuxjournal article doesn't explain it this way. The accepted answer gives a black-box answer - not what I was looking for when I opened this page. I hope this answer gives a better explanation and writing it made me understand the Yubikey better.


Targeted acoustic keylogging attack prevention

In my opinion acoustic cryptanalysis is more of a proof of concept then to be used in real applications.

What is possible to do?

A few years ago guys from MIT (if I am not wrong) were able to log every keys on a mechanical keyboard using an Android/IOS phone application and just by placing that specific phone near the keyboard.

Things you can do to mitigate:

Use on screen keyboard.
Ensure that there aren't any other device near your computer
Use Snowden type pillow even if it's a bit paranoia (or not)
Use smart card/ smart usb authentification
Randomly generate frequencies in the 400-12000 Hz range (which seems to be the one containing keystrokes sounds) and use headphones


Securing Google Chrome Browser against the Logjam exploit on Windows

Edit 2015-09-03: Fixed.

Fixed as of Chrome version 45 from 2015-09-01. WeakDH.org now reports:
Good News! Your browser is safe against the Logjam attack.

Most of original post preserved below.

Batch Workaround
A workaround is to create a batch file that starts Chrome and explicitly disables all ephemeral DH suites.

There are different blacklists strings floating around the internet at the moment. Below is my attempt.

Cipher suites are identified by their hex ID. And IANA has the official list of registered cipher suites.

But rather than pick and choose from that list, I decided to let OpenSSL (v1.0.2) do that for me. The suites are these:

openssl ciphers -V DHE | sort

0x00,0x11 - EXP-EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH(512)  Au=DSS  Enc=DES(40)   Mac=SHA1 export
0x00,0x12 - EDH-DSS-DES-CBC-SHA     SSLv3 Kx=DH       Au=DSS  Enc=DES(56)   Mac=SHA1
0x00,0x13 - EDH-DSS-DES-CBC3-SHA    SSLv3 Kx=DH       Au=DSS  Enc=3DES(168) Mac=SHA1
0x00,0x14 - EXP-EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH(512)  Au=RSA  Enc=DES(40)   Mac=SHA1 export
0x00,0x15 - EDH-RSA-DES-CBC-SHA     SSLv3 Kx=DH       Au=RSA  Enc=DES(56)   Mac=SHA1
0x00,0x16 - EDH-RSA-DES-CBC3-SHA    SSLv3 Kx=DH       Au=RSA  Enc=3DES(168) Mac=SHA1
0x00,0x32 - DHE-DSS-AES128-SHA      SSLv3 Kx=DH       Au=DSS  Enc=AES(128)  Mac=SHA1
0x00,0x33 - DHE-RSA-AES128-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA1
0x00,0x38 - DHE-DSS-AES256-SHA      SSLv3 Kx=DH       Au=DSS  Enc=AES(256)  Mac=SHA1
0x00,0x39 - DHE-RSA-AES256-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA1
0x00,0x40 - DHE-DSS-AES128-SHA256   TLSv1.2 Kx=DH     Au=DSS  Enc=AES(128)  Mac=SHA256
0x00,0x44 - DHE-DSS-CAMELLIA128-SHA SSLv3 Kx=DH       Au=DSS  Enc=Camellia(128) Mac=SHA1
0x00,0x45 - DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH       Au=RSA  Enc=Camellia(128) Mac=SHA1
0x00,0x67 - DHE-RSA-AES128-SHA256   TLSv1.2 Kx=DH     Au=RSA  Enc=AES(128)  Mac=SHA256
0x00,0x6A - DHE-DSS-AES256-SHA256   TLSv1.2 Kx=DH     Au=DSS  Enc=AES(256)  Mac=SHA256
0x00,0x6B - DHE-RSA-AES256-SHA256   TLSv1.2 Kx=DH     Au=RSA  Enc=AES(256)  Mac=SHA256
0x00,0x87 - DHE-DSS-CAMELLIA256-SHA SSLv3 Kx=DH       Au=DSS  Enc=Camellia(256) Mac=SHA1
0x00,0x88 - DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH       Au=RSA  Enc=Camellia(256) Mac=SHA1
0x00,0x99 - DHE-DSS-SEED-SHA        SSLv3 Kx=DH       Au=DSS  Enc=SEED(128) Mac=SHA1
0x00,0x9A - DHE-RSA-SEED-SHA        SSLv3 Kx=DH       Au=RSA  Enc=SEED(128) Mac=SHA1
0x00,0x9E - DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH   Au=RSA  Enc=AESGCM(128) Mac=AEAD
0x00,0x9F - DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH   Au=RSA  Enc=AESGCM(256) Mac=AEAD
0x00,0xA2 - DHE-DSS-AES128-GCM-SHA256 TLSv1.2 Kx=DH   Au=DSS  Enc=AESGCM(128) Mac=AEAD
0x00,0xA3 - DHE-DSS-AES256-GCM-SHA384 TLSv1.2 Kx=DH   Au=DSS  Enc=AESGCM(256) Mac=AEAD

And here's an ugly little script that I used to just pick the hex IDs from the list above and generate the blacklist string for me:

openssl ciphers -V DHE |
sort |
awk '{print $1}' |
sed 's/,0x//g' |
xargs echo |
sed 's/ /,/g' |
sed 's/^/--cipher-suite-blacklist=/'

And this is the output of that command:

  --cipher-suite-blacklist=0x0011,0x0012,0x0013,0x0014,0x0015,0x0016,0x0032,0x0033,0x0038,0x0039,0x0040,0x0044,0x0045,0x0067,0x006A,0x006B,0x0087,0x0088,0x0099,0x009A,0x009E,0x009F,0x00A2,0x00A3

(Disclaimer: This string is probably too long. I don't think Chrome even supports all of these cipher suites. (You could check using the SSL Labs client test.))

Update 2015-07-03: Chrome still vulnerable.

The official Logjam page, https://WeakDH.org/, checks for 512 bit DHE support. It internally uses the https://dhe512.zmap.io/ domain to check. Ability to connect to this domain is rated as a failure.

Chrome fails.
Internet Explorer, Safari, Firefox pass.

The actual minimum DHE bit lengths used are these:

Chrome uses a 512 bits minimum.
Internet Explorer uses a 1024 bits minimum.
Safari uses a 768 bit minimum.
Firefox uses a 1023 (not 1024) bits minimum.

(See also: Wikipedia: Logjam)

Some DH key lengths to test are here:

https://dh480.badssl.com/, Chrome rejects this with ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY.
https://dh512.badssl.com/, Chrome accepts this.
https://dh1024.badssl.com/, Chrome accepts this.
https://dh2048.badssl.com/, Chrome accepts this.

But: The a 1024 bit minimum has been announced for Chrome 45. (And I think this means September 2015. But I don't really understand the Chrome release model.)


Nothing. Transparent means it does not change anything for the user and application, so you don't have to rewrite your apps to use it, unlike TLS. You don't have to copy certificates and keys around etc. It is basically an ease of use thing. You just enable it and it works.


Avast antivirus found Malwaregen[trj] on Mac

It might be more probable that you downloaded a torrent that had some malware in it. I doubt the guys over at uTorrent would risk putting malware in their binaries :) (unless you downloaded uTorrent from an unofficial source).

A trojan can be used for spying, but more often than not, unless it is a targeted attack, it usually means other things such as stealing your credentials, stealing files, adding your computer to a botnet to mine bitcoins or click ads etc.

Antiviruses could be wrong. But better safe than sorry. Unless you can eliminate the threat, you might want to consider reinstalling your Mac OS.


Is it possible to make a laptop useless to thieves?

First of all, my condolences for your loss! Hope you're alright.

If I understood correctly, your general concern is how to totally prevent further stolen device usage (and/or sale) by a criminal.

In this case, this question won't ever have any answer that would age well, because whenever your machine becomes unreachable physically, the only way to ensure no further damage is to nuke it from orbit.

And, in any case, even with the Apple's "Find My Mac" service (or with the "Find My Device" feature of Windows 10), you definitely wouldn't be able to prevent disassembling your laptop and selling the components as spare parts.

Note that the laptops deemed hard to resell in one piece, like Macbooks, are known to be easy to sell disassembled for pricey spare parts; therefore, there's no specific advantage to Macbooks here. (Apple constantly makes its devices harder and harder to fix and repair, so, like I said, this answer won't age well.)

Apart from that, depending on the particular laptop model and the hardware configuration, there may be different ways (with different level of reliability) to brick the device or its components. In general, those matters have something in common with re-flashing some of the built-in devices. If you're really concerned, you may even try to pick a laptop which is easy to kill with software; generally, googling might help you here.

There would hardly appear any initiative by the laptop vendors for making their devices easier to brick, because:

Making a device sustainable against physical access and damage is enormously costly and is effectively a never-ending arms race, as the DRM initiative quite clearly shows us;
It doesn't look like that's the incentive of the laptop vendors who won't really earn a lot in this battle (actually, probably quite vice versa).

The simplest way to brick a device in case of a thieft and an arbitrary laptop is probably to attach a yellow Post-it to your laptop with something on the lines of password: 123 on it, and to run a bricking script when the incorrect password is entered. This won't be reliable, and nothing would be, but this would probably work in most of the cases.


WhatsApp has an end-to-end encryption feature, this should protect you from most threats.

Here's another thing, WhatsApp is compromised by NSA. Its mother company, Facebook, has been proven to be in NSA's PRISM program. So, if the NSA is in your threat model then I'd advise to avoid WhatsApp and use a more security-oriented OTR software, like Signal, or Wire.


Best practice for Users to avoid fraud for Direct Debit enabled bank accounts?

The system is safe by design: the best practice is to simply use the system's built‑in protection.

Unlike debit cards, you can ask your bank to enable a safe whitelist of IBAN account numbers allowed to withdraw from your IBAN. Any attempts to initiate a debit from an unauthorized account will result in payment rejections.

Though this option isn’t always available for online-only banks.


There are two parts to this question:

Don't let people see the algorithm, implementation, etc.  This is standard IT security, and I'll discuss below some possible defenses.
Don't let people learn anything from their interaction with the algorithm.  This part may be a little less obvious, but if you allow people you don't trust to feed inputs to the algorithm and observe the outputs, then (depending upon the specifics of the situation) they might be able to learn something of your secret sauce.  You'll have to determine whether that is indeed the case, and how to defend against it (e.g., by limiting access to inputs or outputs to the algorithm).

As far as how to protect the algorithm and its implementation, there is a range of possible defenses.  Each has its own tradeoffs, and you'll need to evaluate them in the context of their business impact as well as the degree of risk you are facing.

Isolation.   Run the code on its own server.  Store the source code on a totally separate system.  Choose a limited group of developers who are given access to it.  Keep it separate from all of your usual systems.
Hardening. Configure the server that runs this code in a highly secure way.  Don't run anything else on the server.  Lock down the configuration.  Set up firewalls and strict access control.  If you search on this site, you'll find a great deal of information on server hardening.
Network separation. Run the server on a local internal network only, which is completely disconnected from the Internet (no machine on that local network is connected to the Internet, or to anything that's connected to the Internet, or anything that's connected to, etc., to anything that's connected to the Internet, transitively).  I recommend using strict red/black separation, as it helps ensure separation.
Airgapping. Alternatively, disconnect the server from every network entirely, and use only sneakernet.  However, instead of carrying data on USB sticks, I would recommend using write-once media (e.g., CD-R, DVD, etc.), as that reduces the risk of viruses travelling the wrong direction.  Turn off autorun etc.  Set up software on the critical server that checks the contents of the DVD before using it (e.g., checking that it is of the expected type, has the expected format, and so forth).
Physical security. Restrict access to the servers on which this algorithm and code runs and lives, to a limited set of trusted staff.

See also Contract requires me to work with sensitive IP, severe penalties for loss of data to 3rd parties. Some protection pointers please for some additional techniques that may be of interest (even though the situation is a bit different).


Proxychains dosen't work, DNS leak test shows location

By default Firefox does not do DNS lookups over the SOCKS proxy. You have to check the appropriate checkbox when configuring the proxy in Firefox. As example see https://i.stack.imgur.com/vB93s.png but in the current version of Firefox the dialog looks slightly different.


Does transmitting first 6 and last 4 digits of the card number and expire date require PCI DSS compliance?

From a PCI DSS standpoint it is not considered "Cardholder Data" unless it includes the full Primary Account Number (the 16 digit card number) so if that never touches your systems then they are indeed out of scope.

If you are looking at it beyond purely PCI then I would look at whether you actually need that much - transmitting/storing the first six and last four leaves only 10,000 possible combinations to get the "full" PAN, there is still some work to go from there to get sufficient details to "steal" the card but unless you have a specific reason for needing that much of the PAN why do it?


Are there file downloading programs that calculate checksums during the download process?

A very similar question has already been answered on Unix & Linux Stackexchange.

  wget -O - http://example.com/file | tee file | md5sum > file.md5

Just replace the md5sum with sha1sum and it should work. Note that the proposed solution works only with *nix operating systems - getting it to work within Windows might be a challenge (but the Bash Subsystem for Windows or Cygwin might work for you).

Edit:

As I was asked in the comments how this works, I'll explain it here:

wget -O - http://example.com/file downloads the file (in sequential order) and outputs its content on the console. The pipe | allows me to forward this data to the next program: tee file stores the output of wget into the file file and forwards the data to the last program in the chain. md5sum > file.md5 calculates the md5-hash and stores it in file.md5.

Performance: (YMMV!)

Downloading a big file (4GB) from a local server takes roughly 80 seconds
Calculating the hash of the file (when stored locally) takes 70 seconds
Doing both simultaneously takes again 80 seconds, resulting in a speed boost of almost 50%.


Credentials for scanning a database server's vulnerabilities

There are two general types of tools out there (and I realize I'm over-simplifying the matter), which I'll call penetration tools and risk analysis tools. We might also refer to them by other names, such as prevention tools and mitigation analysis tools, which has a similar meaning in most cases. Prevention covers preventing an attack, and mitigation refers to minimizing the impact of a successful attack.

Penetration tools cover session spoofing, cross-site scripting, exploit checking, SQL injections, privilege escalation, and so on. All of these attacks should be performed from the perspective of an unprivileged user, so no credentials should be specified at all (or possibly a guest user or basic user with limited privileges). After all, if you log a tool in as "root", it has already penetrated the system, thus negating the purpose of the tests. There's no need to "test" how much damage root can do, because everyone knows (or should know) that once root is compromised, the entire server is unreliable until it's been fully re-secured physically and in offline mode.

The second class of tools, risk analysis, aim to cover the impact of what happens after penetration has occurred. For example, if there's an SQL injection vulnerability, such a test would show if you can then trick the system into dumping every user name and password. These tools may require administrative or non-administrative credentials, if only to analyze the risk of a compromised account or direct database access.

The specific tools you're using should tell you what each test does, and what type of credentials the test will require. Providing the wrong credentials, or providing credentials when none should be given, will invalidate the results of the test.

This is something that you will need to sit down and logically think out for each test you're going to perform. Ask questions like "does this test attempt to gain access to the system?" or "does this test check the structure of my databases?" If the test is about gaining access, it shouldn't require credentials. If the test is about analyzing what happens after penetration, credentials are probably required.

As a final word of advice, if you don't feel qualified to run these tools, or you don't know, for sure, what a tool does, consult an expert. The only stupid questions are those left unasked. While a forum like IS SE is a great place to get answers to hard-pressed questions, you'll probably find that a 10 minute dialogue between someone with more experience with a particular tool or test will have far greater impact than a forum like this, where questions appear and are eventually answered.

The rule of thumb here is that if a question is particularly broad, you should expect to have to ask many questions, which means a chat is in order. IS SE provides a chat room, which I suggest you visit, as well as many other places where you could find people with experience in the matter, such as IRC or even the support personnel of the tools you're using.


What is the motivation behind supporting both `none` and `self` attestation in WebAuthN?

This is most likely for backwards compatibility. Chrome 67 started using self attestation for U2F (the U2F spec doesn't allow for "none") for specific keys that were discovered to not meet the 100,000 batch requirement to preserve privacy.


Encryption Algorithms with an error code for wrong password

[Your question is a little bit unclear to me, but I'll try to do a good job]

OK. From 3&4 I can see that the strength of your key simply depends on the strength of the password and the salt.

Your proposal isn't bad but it is definitely not a good practice. Reason is simple: Consider a case in which the wrong password is entered. How will you find out this is the wrong password? It will just throw gibberish and you can't find out if it is the original plaintext.

But, there are 2 ways to get around this to a certain extent.
a)Store the hash of the original message and compare it to the hash of the decrypted message. If there is a mismatch, then the password is wrong. This can be in-effective in the light of rainbow-tables. But, salting along with one-way hashing funcitons can help you get around the problem posed by rainbow table.

b) In case you want to avoid hashing as given in 'a', then use a pre-defined set of characters as header and footer. Your code must be able to look for this pattern at the correct location once it is decrypted. So if this fails, then the password is wrong.

Encryption algorithms throw no error message. Your code can be modified to introduce an error message if you need one.


Popup alert even when a site deletes the alert function?

The alert function is actually a property of the global window object. As such, you can access it using bracket notation. If the string alert is blocked, you can break it up into multiple parts. Try this payload:
window["al" + "ert"](1)


How do I safely inspect a potentially malicious website?

Why not just send the URL to Virustotal? Accessing a malicious website can be tricky. Using curl, wget, links -dump can be tricky depending on how the malicious content is served up. For example:

<IfModule mod_rewrite.c>
 RewriteEngine On
 RewriteCond %{HTTP_USER_AGENT}
 RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|libwww\-perl|curl|wget).* [NC]
 RewriteRule ^(.*)$ - [F,L]
</IfModule>

Using mod_rewrite, I can feed you non-malicious pages. I can send you elsewhere, do whatever I'd like. Further, I can change payloads e.g.: instead of feeding you malicious, I can just change it to a non-malicious "Hello World" javascript. This may trick you into thinking my malicious website is harmless.

Normally when I have to visit a malicious website, I have a virtualized sandbox which runs burpsuite for interception, Squid proxy server, and a few other tools (noscript, ghostery, etc). What is the ultimate purpose of visiting outside of curiosity?


Advantages and disadvantages of Stream versus Block Ciphers

While both are symmetric ciphers, stream ciphers are based on generating an "infinite" cryptograpic keystream, and using that to encrypt one bit or byte at a time (similar to the one-time pad), whereas block ciphers work on larger chunks of data (i.e. blocks) at a time, often combining blocks for additional security (e.g. AES in CBC mode).

Stream ciphers are typically faster than block, but that has it's own price.
Block ciphers typically require more memory, since they work on larger chunks of data and often have "carry over" from previous blocks, whereas since stream ciphers work on only a few bits at a time they have relatively low memory requirements (and therefore cheaper to implement in limited scenarios such as embedded devices, firmware, and esp. hardware).
Stream ciphers are more difficult to implement correctly, and prone to weaknesses based on usage - since the principles are similar to one-time pad, the keystream has very strict requirements. On the other hand, that's usually the tricky part, and can be offloaded to e.g. an external box.
Because block ciphers encrypt a whole block at a time (and furthermore have "feedback" modes which are most recommended), they are more susceptible to noise in transmission, that is if you mess up one part of the data, all the rest is probably unrecoverable. Whereas with stream ciphers bytes are individually encrypted with no connection to other chunks of data (in most ciphers/modes), and often have support for interruptions on the line.
Also, stream ciphers do not provide integrity protection or authentication, whereas some block ciphers (depending on mode) can provide integrity protection, in addition to confidentiality.
Because of all the above, stream ciphers are usually best for cases where the amount of data is either unknown, or continuous - such as network streams. Block ciphers, on the other hand, or more useful when the amount of data is pre-known - such as a file, data fields, or request/response protocols, such as HTTP where the length of the total message is known already at the beginning.