Is inputting credit card numbers over a mobile phone secure?

Is this a secure or even common practice, and does it put me at risk
of having my credit card details stolen?

This is common practice, and if done properly, is secure.  This is what's referred to as a CNP (Card Not Present) transaction.
Securing card transactions over telephony is challenging and there is a PCI Security Standards document dedicated to this topic - Protecting Telephone Based Payment Card Data.
Unfortunately, you have no way of verifying how securely your mobile network provider has implemented their call center - just as you have no way of verifying most of the web sites you submit your card to, or the restaurant around the corner.  But you can trust that your card provider has chargeback mechanisms allowing you to dispute fraudulent transactions; the security carrot with credit cards is not that they'll never be defrauded, but that the cardholder will be reimbursed if fraud occurs.


Is "permission (role) granting" safer, than giving direct access to primary account?

In a sensitive system, user accounts should never be shared. This is for liability, auditability, nonrepudiation, and compliance reasons. So giving out the main account is out of the question.


Can revoked certificates be "lost" if the base CRL is updated before expiration?

Base and delta CRL are linked together through the CRL Number. The "CRL number" is a monotonically increasing integer that, roughly speaking, characterizes the age of the information contained in the CRL.

From the point of view of the validator (the "client"), a delta CRL can never be used alone, but only in combination with a base CRL, subject to the conditions listed in section 5.2.4. Basically:

A non-delta CRL contains a number b in its CRL Number extension.
A delta CRL contains a number d in its CRL Number extension and a "base CRL number" e in its Delta CRL Indicator extension.
The delta and non-delta CRL can be combined only if d > b ≥ e.

In simple terms, the delta CRL contains all the information about revocations that occurred before instant d and after instant e. Thus, the delta can be combined with the non-delta CRL only if the non-delta contains information that dates from some moment within that range; otherwise, some revocation may be missed.

(The combination is deemed equivalent to a complete CRL from instant d, and it can be used as "base CRL" for further delta CRL merging, recursively.)

An important point to realize is that revocation is, nominally, a one-way trip: certificates cannot be "unrevoked". Hence, if a CRL specifies that a given certificate is revoked, then further CRL from the same source will also list that
certificate as revoked (until the certificate expires). (There is a special revocation reason code that is called "remove from CRL" and tries to work as some form of unrevocation, but it does not work well in practice.)

The Freshest CRL extension, if present, notifies the client of the existence and location of delta CRL that may be used to "freshen" a CRL at (supposedly) low cost (since delta CRL are meant to be short). That extension may appear in a certificate or in a base CRL. When that extension is present, some implementation will insist on obtaining a delta CRL that can be combined with a base CRL (subject to the rules explained above) and will reject the certificate if they just obtain a complete CRL.

Microsoft's PKI (Active Directory Certificate Services), when configured to produce delta CRL, will systematically issue a new, empty delta CRL when it issues a non-delta CRL, thus maintaining the property than whenever a non-delta CRL exists, a formally newer (higher "CRL number") delta CRL is available as well. Clients who get an "updated base CRL" will refuse to combine it with an older delta CRL, but will download the new delta CRL.


This link gives a pretty good explanation. In particular, this section talks about how to verify packages.

In a nutshell when you install packages your system check that they are signed with a known key, using public key crypto. This guarantees that the packages come from a "trusted" source. In your case some packages were signed with an unknown key and you chose to ignore that warning.

To answer your question I'd recommend to let the system do all the authenticity checks; it's a job computers do much better than humans. All you have to do once is to make sure that your keys are the correct ones.

Please note that my explanation is an over-simplification and that I use the word "trust" loosely; a "trusted" source is a source that keeps their secret key secure. If a malicious attacker were to lay hands on Debian's secret key for package signing there's a much bigger problem than yours.


"MAC function must resist existential forgery under chosen-plaintext attacks", what does that mean?

An existential forgery of a chosen plaintext is having the ability as an attacker to obtain a valid MAC for a plaintext of your chosing, without knowing the key required to generate a correct MAC.

A common vector for this is a timing attack, and that would work like this:

The attacker sends a message, and an HMAC (really just a sequences of bytes the same length as the HMAC) and times the response from the decryption system.
The attacker then sends the same message, and the same pseudo-HMAC repeatedly, with the exception that he now iterates though every (256) possible value for the first byte of the HMAC.
If the decryption system is returning an error immediately on finding a mismatch between bytes, one of these iterations (the one with the same first byte value as calculated by the decryption system) should take slightly longer to return. If the attacker can can detect that difference, he now knows the correct first byte for the correct HMAC for the message given the decryption system's HMAC key.
The attacker sends the same message and HMAC, this time with the known correct first byte, iterating over the second byte, until again, he finds the byte that causes the decryption system to take slightly longer to respond with an error. The attacker now knows the second byte of the correct HMAC.
Rinse and repeat for every successive byte in the HMAC, until a valid HMAC has been derived for the attacker's chosen message, sans key.

This is why HMAC comparison needs to be constant-time, comparing all the bytes of the submitted HMAC to the calculated HMAC before returning a response. This way, no matter the position of any incorrect bytes, the time to error will always be equal. The attacker no longer has a way to tell what or where the incorrect bytes are.

And most of this answer is copied directly from my answer to: Timing attack against HMAC in authenticated encryption? hence the references to HMAC specifically.


There may be modern forms of CAPTCHA that do not have automated tools yet, but a quick Google search will provide tools to crack various CAPTCHA systems with varying success rates.

In addition, not only are there sites that pay people to interpret CAPTCHAs (including Amazon's Mechanical Turk), but some warez include a CAPTCHA that must be passed in order to allow the user to access the software, but the CAPTCHA is a capture of a live crack attempt from some other source.


Can the conversion of a malicious PDF to image be exploitable?

As always, it depends. Potentially every piece of code operating on user-controlled data is exploitable if it contains bugs in implementation (it does). However common pdf attacks are targeted at popular viewer applications, not automated converters, so your potential adversary is a targeted and capable hacker. They are less common, much more dangerous and are attracted to financial organizations ;)

  Can the process of converting a potentially malicious PDF file be exploitable?

Yes. Here your security depends on the security of your chosen library. For example, image processing library Imagemagic and video processing library ffmpeg have 535 and 314 CVEs respectively. Some of those allow the attacker to execute arbitrary code on your machine.

The most popular (AFAIK) pdf processing library (Apache PDFBox) is written in Java, so it's relatively hard to perform memory corruption attacks, however, it's not immune from all attacks and has 4 CVEs to show that. It's unfair to compare the numbers here since PDFBox is much less popular than the other two libraries.

The fact that PDF is one of the craziest formats ever invented (here, play some breakout.pdf) doesn't help with security.

The main takeaway is that just like a malicious image can exploit imagemagic and malicious video can exploit ffmpeg, malicious pdf can exploit your chosen library.

  Or convert the PDF to PDF/A

I would imagine that converting to PDF/A allows you to save more useful information for later processing than converting to plain image, so that's a plus. As for security, this reduces the attack surface for the readers that would subsequently open the converted PDF/A and changes codepath inside pdf converter, but it's impossible to say whether this codepath is safer or not.

Either way, you need to care about the security of your converter. The principle of least privilege is very useful here. Extract your pdf converter into a separate process/container and allow it to take pdfs from one dir, convert them, and store them in another dir. No process spawning, no network access, execution timeouts, etc.

  Is the presence of a network anti-malware product going to help?

I'm skeptical. Despite how much AV vendors push "behavioral analysis" technologies, the bulk of AV job is just comparing files with signatures of common viruses. Attack on specific pdf parser will probably be quite uncommon, perhaps even 0-day, so you shouldn't rely on AV catching it.

Some kind of network activity analysis could make the attack harder to pull off unnoticed or even prevent it, but nothing can guarantee security here.


Is data stored in core data on iOS secure?

There are multiple parts to this answer. First, everything stored on the file system of an iOS device is encrypted, provided the device uses a passcode. Hence with respect to the data actually on the iOS device, provided you're not trying to hide the data from the user who knows the passcode, you can have some confidence that core data is secure.

However just to be clear, Core Data is not actually a way of storing data. It is a common interface to an object store, which is usually backed by sqlite on the device's file system.

As pointed out by André, this sqlite file may be backed up, leaving it exposed to prying eyes.

Apple's recommendation (that I agree with) is that passwords should only ever be stored in the keychain, which is easy to do, and allows you to control when the entry is accessible (ie. while the device is locked, after first unlock, etc.).

Other apps can never access your app's data in iOS, irrespective of where you write it (unless jailbroken).

Here's a Ray Wenderlich tutorial that walks you through doing this with swift: https://www.raywenderlich.com/92667/securing-ios-data-keychain-touch-id-1password


Is an outdated library in a Windows user mode desktop application an actual security risk?

... it does not "talk to the internet ...

There is a difference between does not usually talk to the internet or is not able to talk to the internet. As long as the application is not somehow sandboxed or firewalled some exploit can likely make the application talk to the internet.

... this application is a local tool only ...

Just because it runs locally does not mean it does not process data originating from untrusted sources. Even if it does not retrieve the data itself, it might be confronted with such data. Thus the impact of the vulnerability depends on the actual use case, which is unknown.
If the application processes only data fully generated by yourself then there is likely no problem. If instead you feed data into the application from potentially untrusted sources or if the generated data include data from untrusted sources without proper sanitization then there might be a problem, since you no longer have full control over the data.
Note also that the application might be associated with specific file extensions, in which case calling the application with untrusted input might be done by accident.


Has it been mathematically proven that antivirus can't detect all viruses?

Under one possible interpretation of that, it's a result of Rice's theorem. A program is malicious if it performs some malicious action, which makes it a semantic property. Some programs are malicious and some aren't, which makes it a non-trivial property. Thus, by Rice's theorem, it's undecidable in the general case whether a program is malicious.


MITM attack on WPA-PSK using fake AP: Can the password be intercepted from normal Windows AP-logon mechanism?

For your example (WPA2-Personal), the answer is no, not without bruteforcing it. At least not as long as Windows adheres and continues to adhere to the official standard. Presenting a fake login page like you did is AFAIK the only way to try to get the password, but this may indeed trigger some warnings as it is not standard behaviour.

However, with WPA2-Enterprise, you might be lucky in two cases:

a vulnerable EAP implementation is chosen  (e.g. lightweight EAP is considered very insecure, EAP-MSCHAPv2 is also broken). The general recommendation nowadays is to use EAP-TLS or PEAP-MSCHAPV2.
EAP-TLS is chosen, but the supplicant does not validate the server's certificate (or you can forge the real certificate). By extension, PEAP-MSCHAPv2 will also be 'broken' in this case.


The process you've described should result in handshake packets, assuming that the deauth packets are successful in forcing the device to re-attach to the network. A couple of suggestions.

I'm guessing that placement of all the devices is ok (e.g they're quite near to each other physically).  If the device in monitor mode is further away there's always a risk that it wont see all the traffic.
I'd suggest getting a couple of devices (your macbook and perhaps a phone or tablet) and shutting them down and then re-start them.  When a device starts up and connects to the network it definitely should send a handshake packet.  If you don't see one then, does suggest something more fundamental is wrong (although off the top of my head not sure what !)

Typically when I do this on engagements, I'll leave airodump running for a couple of hours or more, and on a relatively busy network it'll see some devices connecting. DeAuth is a useful idea but I'm always a bit leary of knocking people off the network.


Does a searchable public database exist of (hostname; ip) mappings?

Yes, there are several services out there that provide (limited) information about domains shared on one or more IP's:

https://www.yougetsignal.com/tools/web-sites-on-web-server/
https://viewdns.info/reversedns/

In case you want to collect data yourself, you could create an account on czds.icann.org and request access to specific zone files. Using those zone files you could create your own database and/or service.


Is MS-CHAPv2 in windows 8.1 secure in 2020? In Windows 10?

You can't fix MSCHAPv2; it's fundamentally dependent on the security of two independently-computable DES keys, which is... not quite trivial to brute-force at home but is doable in a day or less with a surprisingly cheap amount of hardware or even AWS time. It's not an implementation bug (which could be fixed); any implementation that conforms to the specification and is compatible with other implementations will be vulnerable. Any improvement would require changing the protocol itself, which would break compatibility; it'd be v3 rather than v2 at that point.
Microsoft has basically given up on securing MSCHAP, instructing users to instead use a secure transport (at which point you may as well send the passwords in the clear or close to it, within the tunnel, but oh well). There are also other authentication protocols that are much, much better (SRP is a cool one, but not that widely implemented in VPNs or similar at this time). Pretty much all OSes and most third-party VPN software supports at least a few of those better protocols, too.


Is it possible to save scanned biometrics and use it later

Biometrics is just data. Yes, it is possible to take captured biometric data and 'replay' it back into the system. BUT, the more important question is how the system protects against this. This is a known problem with multiple ways of combating it.

So, yes, it is possible but only if the system is so poorly designed that one would have to question the system's validity at performing core principles.


Is XSS dangerous on web without login/sensitive user's data?

Of course!
False information could be inserted into a webpage with XSS. Imagine if Microsoft had a giant banner on their front page stating they would shut down the whole company, their shares could drop significantly, just because of a XSS attack, without anyone logging in.


Bob does not "generate" the signature with Alice's public key. Signature generation requires the private key. What Bob does is verifying the signature; verification needs only the public key.

Indeed, the public key can safely be made public precisely because knowing the public key is not sufficient to generate signatures.

(You may have been confused by some explanation about how a signature is "encryption with the private key". This is a very widespread but also flawed and confusing explanation, that is best ignored.)


In these two scenarios:

If someone can do a change in the database in another way.
Also if someone can steal the cookies of a user (session hijacking).

An attacker would already have access the user's session. They would need to exploit a vulnerability to get to that point, but at this point the session is already compromised, so the additional impact is none.

This scenario:

Admin user adds malicious content into the user’s profile.

Depends a bit on the system design, but most systems allow admins to have access to users profiles, for example by doing a password reset. So in most systems, the additional impact here is none.

If you use a CVSS v3 calculator, and set the CIA impacts all to none, it doesn't matter how you set the other values, the output is 0.0. This is why self-XSS is usually regarded as matter of best practice only and not a vulnerability.

One thing to be aware of is CSRF. If the self-XSS injection point is vulnerable to CSRF then this is a vulnerability.


Security Training for corporate Facebook users

Twitter and Facebook are very different.  Many people successfully use Twitter for professional activities: either tweeting, or following others.  If you are tweeting, it is easy to set up a separate Twitter account for your professional life, to keep work and personal life separate.  I think your client should probably allow people to use Twitter for their professional work.  Offering training is not a bad idea.

Expecting employees to let someone from HR friend them on Facebook, though, raises a whole host of issues.  I do not recommend going there.


Is it secure to make my Threema ID public?

Nope, you should be just fine sharing your Threema-ID. The reason being that your communication is protected with end to end encryption.

  Strength of the encryption: The asymmetric ECC based encryption used by Threema has a strength of 255 bits. Accordingto a NIST estimate (page 64), this corresponds at least with the strength provided by 2048 bit RSA. ECDH on Curve25519 is used in conjunction with a hash function and a random nonce to derive a unique 256 bit symmetric key for each message, and the stream cipher XSalsa20 is then used to encrypt the message. A 128 bit message authentication code (MAC) is also added to each message to detect manipulations/forgeries.

Sharing your ID is akin to sharing your public key. Unless someone has the private key, your communication will remain secure, regardless of who has access to your public key. Threema does all encryption and decryption of messages locally, according to its FAQ, so your private key remains in your possession at all times. And if you want to communicate securely, you need the other party to access your public key.

On top of these facts, you don't have to reply/add anyone who you do not trust. So if anything feels fishy, you can just nuke that person from your "friends" list.

More info on the encryption techniques Threema employs can be found here


What Are the Algorithm and techniques of IP Traceback?

You, as an individual, can't find who's behind an IP address.

Well, you can grab an IP address via social-engineering tricks if you suspect someone, but if you have no idea who to suspect, then you're basically out of options here.

The FBI is a government agency, they can just ask your Internet Service Provider because the law may allow them to do so during an investigation.

Your ISP have your personal information, they'll communicate them to the FBI: it's that easy.


Need to access old forgotten router that only supports SSLv3

Internet Explorer 11 supports it, but you have to go to Advanced options Tab to enable it.


Cisco IOS question - password management, service password encryption types

I can't help with your basic problem, but this should help motivate folks to get it right, as your question asks.  It is depressing hearing over and over how badly broken password storage is on important platforms.

A bit of googling yields this information on how bad "type 7" password storage is.  Note that tt uses "Vigenère obfuscation" (not really encryption): Deobfuscating Cisco IOS Passwords - CT3

I'm still puzzled as to why Cisco wanted the server to have access to cleartext passwords, as noted in that link.

Update: As described at Cisco IOS Password Encryption Facts - Cisco Systems:

  In order to support certain authentication protocols (notably CHAP), the system needs access to the clear text of user passwords, and therefore must store them using a reversible algorithm.

The requirement for plain-text password storage on the server side is a good reason that CHAP (Challenge-handshake authentication protocol - Wikipedia) is a bad idea.


Session Hijacking through sessionId brute-forcing possible?

Probably not.

owasp says that a session identifier should be at least 128 bit long to prevent session bruteforcing. They give these example calculations:

  With a 64 bit session identifier, assume 32 bits of entropy. For a
  large web site, assume that the attacker can try 1,000 guesses per
  second and that there are 10,000 valid session identifiers at any
  given moment. Given these assumptions, the expected time for an
  attacker to successfully guess a valid session identifier is less than
  4 minutes.

  Now assume a 128 bit session identifier that provides 64 bits of
  entropy. With a very large web site, an attacker might try 10,000
  guesses per second with 100,000 valid session identifiers available to
  be guessed. Given these assumptions, the expected time for an attacker
  to successfully guess a valid session identifier is greater than 292
  years.

Even if we assume than an attacker can perform 10 million attempts per second, it would still take them 3 month to get a valid id in the last example given.

The session id of PHP for example seems to be 160 bits per default (I think, the documentation isn't so good), you can also set it yourself.

  How can I, as an application developer, prevent this ?

Apart from using a strong enough ID, you could also bind a session to an IP, or link it to a TLS session, that way, even if an attacker does obtain the session (via bruteforcing or in a different way), they cannot use it. And you could also block IPs that are using too many attempts with invalid session IDs.


How can I validate time-sensitive data is coming from a mobile app, and not being forged?

As others have noted you can never trust the client, ever. You can make it difficult for people but there will always be attacks they can perform:

Artificially inflate measure of round trip time (RTT)
Extract encryption keys
Alter local clocks

Monitoring for suspicious behavior / timing irregularities may be possible though extremely difficult. For example what are typical RTT for people on a certain network / location and what is the typical variance in this? (e.g. statistical anomaly detection: http://en.wikipedia.org/wiki/Anomaly_detection )

A combination of making it hard and detecting anomalies would probably be the best you can do such that someone goes to a lot of effort, and then gets their scores wiped and account suspended for a while - similar to failing a doping test...


Do PHP redirect information disclosure also apply to other languages or framework?

Likely (almost?) any framework which does not stop executing the code after the Location header is sent behaves that way. It is perfectly fine from the perspective of HTTP that a response with a location header also has a HTTP body. It is also perfectly normal that the web application might need to do more processing even after issuing the redirect.

  So, if you're using this as a way to avoid user accessing pages where they should be logged in, ...

You should never treat  a user as authenticated if the user is not actually authenticated. Simply adding some header field to the HTTP response will not stop execution of the current code.


Mobile authentication with password as param in get request over ssl

Yes, insist to change the request to POST.

The main issue here is the fact username and password will be saved in logs. As best practice no logs should contain sensitive information even if they are very secured.

This is clearly specified in rfc2616:

  15.1.3 Encoding Sensitive Information in URI's

  Because the source of a link might be private information or might
  reveal an otherwise private information source, it is strongly
  recommended that the user be able to select whether or not the Referer
  field is sent. For example, a browser client could have a toggle
  switch for browsing openly/anonymously, which would respectively
  enable/disable the sending of Referer and From information.

  Clients SHOULD NOT include a Referer header field in a (non-secure)
  HTTP request if the referring page was transferred with a secure
  protocol.

  Authors of services which use the HTTP protocol SHOULD NOT use GET
  based forms for the submission of sensitive data, because this will
  cause this data to be encoded in the Request-URI. Many existing
  servers, proxies, and user agents will log the request URI in some
  place where it might be visible to third parties. Servers can use
  POST-based form submission instead


What does it mean for a digital certificate to be "signed"?

Ideally, it means that someone looked at the certificate and decided that it is correct and legitimate. Once they've done that, they want to tell people "Hey, I've verified that this certificate is good. I trust it". To do this, they use their signing key to sign the certificate.
Now when someone gets the certificate they can see who signed the certificate. If they trust one of the signers, they can trust the certificate itself. This is the basis of Web Of Trust in PKI.
The actual signing probably depends on what kind of certificate it is. I think this is a useful read.

A digital certificate consists of three things:

A public key.
Certificate information. ("Identity" information about
the user, such as name, user ID, and so on.)
One or more digital signatures.

Typically the "one or more digital signatures" part is done by listing a set of encrypted hashes of the certificate. So when you want to sign a certificate, you would compute the hash of the certificate, encrypt it using your private signing key, and add it to the cumulative list of digital signatures.


Application that uses USB token to assign user on a server

A USB token is usually a mean to precisely ensure that the user accesses the website in person. So this goes quite against any form of automation.

Theoretically you may leave the USB token connected for the use of the automated system, but that would defeat all what the USB token authentication is for (unless you consider it as a cheap HSM alternative, it would make sense but would be a complete different security schema).

Most probably you need to add a specific token-less authentication for your automated application. This usually go through a supplementary access with lower privileges than the actual user, for instance limited to (some) web API accesses and no web interface access.


How to decode traffic on a LAN whose SSL certificates are expired

The expired certificate itself wouldn't really allow you to decrypt the data, but it does open up a major "vulnerability", albeit it's more of a social one - most users are now accustomed to ignoring certificate warnings from their browsers.  Thus, if you perform a man-in-the-middle attack most users will probably click straight through the certificate warning, allowing you to capture their data.  They probably won't notice that the warning is slightly different from previous ones or that the certificate is different.


Ask him how you can ensure your system is working, if you can't run a test with a real card, owned by you.  Also, what's to say you are testing? Maybe you are placing your own order for your usage. ;)

The rule is designed to prevent you from grabbing all your customers' credit card numbers, and trying to use those in your development environment.


Quick review of generally how VPN's work: your computer, which is assigned an IP address by your ISP, connects to a remote VPN server, which has a different IP address assigned to it. The VPN server agrees to send and receive traffic for you, basically acting like a mail forwarder. Normally when you visit a website or check your mail the servers which you connect to will see your IP address as the originator of that traffic. When you're connected to the VPN server and you access a website or check your mail, those remote servers only see the IP address of the VPN server that you're connected through.

Now your question: since I'm connecting to the VPN's server at the same time as other folks, if they happen to do a Bad Thing and the FBI or other Three Letter Acronym Agencies get called in, will I be implicated since my traffic is also coming from this server?

The answer: very unlikely. The FBI/TLA's first line of investigation will be to identify and contact the owner of the IP address (ie: the VPN provider). If the VPN provider keeps logs of who was connecting to what (yikes), then they'll provide that to the FBI/TLA for correlation analysis. If the VPN provider does not keep logs, then that's up to them to fight that legal battle. While there may be public traces out there of you accessing other servers via the VPN (say, while logged in to a bulletin board which also logs your source IP address), that evidence is very circumstantial and is not likely to lead to any legal actionable investigations anytime soon. Legal investigation aside, any security analyst  worth their salt that happens to be looking into an attack and traces it back to a VPN IP will assume that the attacker is using this VPN to mask their identity and will not conclude that every user of that VPN is also malicious.

tl;dr: Using a shared VPN is not likely to lead the police to your door anytime soon.


How secure is a mobile e-banking authentication app that requires an NFC card plus a pin to authenticate the user?

Usually NFC cards, as with EMV tap card payments use asymmetric encryption for an authentication challenge and response, and the card has a unique private key that is never output anywhere. Assuming this is how it works in your situation, and the bank doesn't authorize all phones when only one provides a the correct response it should be fine. To illustrate:

The attacker steals your phone and not the nfc card. You then get a new phone and install the same app. Lets say worst case scenario the code that the bank sends out is to your email and the attacker has access to your email. With your new phone you request a login. The attacker sees the email and attempts to log in. The bank then request both devices to use the NFC card to respond to a challenge. You succeed and the attacker does not. The bank authorizes only your session on your phone.

This should be secure as long as the bank clearly keeps its sessions correctly. And assuming that the NFC card does in fact use a secure scheme to generate and load private keys, the nfc card cannot be duplicated (short of gaining physical access and dissembling the IC's, or performing a successful DPA which I think is unlikely on an NFC chip because EM interference).

I personally would use this scheme accept I keep my cards and cell phone together!


What to do with output files from binwalk?

Discard those files and keep searching.

All that binwalk has discovered here is that PNG images contain a zlib-encoded stream. This is normal -- PNG uses zlib to compress the image stream. The extracted files are the zlib stream and the decompressed image data, which are probably not helpful.

(Interestingly, the image appears to contain some JPEG artifacts. Are you sure you haven't inadvertently converted it from another format?)


How can I temporary disable folders links like Users\All Users in order to perform a forensic analysis?

Windows naturally tries to deference NTFS junction points, much like Linux automatically dereferences mount points and symlinks. You can't get around this directly in the Windows OS, as Windows needs junction points to operate correctly, except possibly when using an alternate shell in Safe Mode, although this would probably have some interesting side effects while logged in. The only way to "disable" a NTFS junction is to delete it entirely, not something you could do in read-only mode.

What you can do, however, is not use Windows directly. For example, boot your system in Linux, possibly using a cheap USB stick and a Linux-on-a-stick, and you can mount the image directly into Linux, and perform all the find operations you want without worrying about it wandering into your hard drive, since your drive won't be mounted, and Linux has no notion of drive letters anyways. Your mileage may vary here, as NTFS support, while quite excellent, is not quite as good as Windows' own NTFS support. Personally, I would just as soon whip out a copy of Ubuntu USB version, boot it, mount the image, and go exploring.

Another excellent alternative would be to simply mount the drive in a VM running Windows. You probably qualify for Windows XP Mode if you're using almost any modern version of Windows. Install, mount the drive, and examine to your heart's content. Since you're in a VM, any damage done to the drive will only harm the VM, and not your computer. You can reinstall it as many times as you need, and as long as you've backed up that hard drive image, you can "reformat" back to that image as often as you desire. At that point, you could recklessly experiment with deleting those junction points, assigning a new letter to your boot drive, etc.


Company does not want any names on phishing reports

This initial campaign established a baseline first.  So, yes, it's normal.  "How do we as a company stand?  To what level do we need to train?  Do we have, as a whole, secure users or do we have, as a whole, unsecure users?"  This report establishes this and the extent to which management needs to engage in phishing training.  Were only 5% of users to fall for the phish attempt, then the training focus would be very different. As it stands, now management knows that they have, essentially, a corporate-wide problem and that a phish campaign basically stands a 70% chance of succeeding.

Now, when the company does future phishing training, they can compare results and determine whether the training was successful.  "We initially fell for it 70% of the time.  This time, we fell for it 68% of the time.  It was therefore, not successful." Or "We initially fell for it 70% of the time and now fell for it 50% of the time.  We're doing better, but need further training."


Could SSL-like encryption be used for not password-protected wireless access points?

Basically, the key pair of the server works as a kind of passphrase for the HTTPS connection.
The public key is added to the certificate, which is then signed by a certificate authority trusted by the client.

HTTPS requires the website to get a certificate, as you mentioned.
This certificate is must be trusted by the client, otherwise the client will deny the connection.

To get a certificate from a certificate authority that is trusted by the clients, the domain owners must prove they are the actual owners of the domain for which they are getting the certificate.
So the certificate is only valid for that domain.

In order for the clients of the open network to connect to websites through HTTPS, they will need to trust your system to be that website. In fact they will need to trust you for being any website whatsoever. Actually, you would be a man-in-the-middle, and could read and change anything that goes through that line, the clients couldn't know about it. The level of trust given by the clients would be too high.


Iptables as vpn killswitch but access to internal network

I had the same problem and a couple of similar ones so here's my complete iptables OUTPUT chain which is all I use and should solve your problem and then some.

-A OUTPUT -d 192.168.1.0/24 -j ACCEPT
-A OUTPUT -o lo -m owner --uid-owner 110 -j ACCEPT
-A OUTPUT ! -o tun+ -m owner --uid-owner 110 -j DROP

Here's what all it's doing:

-A OUTPUT -d 192.168.1.0/24 -j ACCEPT

This command allows all traffic on your local network.  The -d parameter causes the rule to apply to all traffic going to the destination ip.  Change 192.168.1 to the first three parts of your local network ip address.  For example if your local network ip ranges is from 15.15.15.0 to 15.15.15.255 change that line to

-A OUTPUT -d 15.15.15.0/24 -j ACCEPT

The .0/24 at the end will include all ip addresses on that network.

-A OUTPUT -o lo -m owner --uid-owner 110 -j ACCEPT

This allows local programs on your computer to talk to each other.  This was causing problems for me so I thought I would include it.  Specifically one of my programs needed this to work with the vpn client.

-A OUTPUT ! -o tun+ -m owner --uid-owner 110 -j DROP

These two commands drop any outgoing packets that don't go out a tun connection.  In yours you use eth0 instead of tun+.  Have you tested whether that actually works as a kill switch?  I don't think it should because when your vpn connection goes down eth0 should remain.

In order for this to work the order matters. If the accept commands aren't first they will get blocked by the drop commands.


Performance sucks

It's better than a couple of years ago, but still not great.
Low latency anonymizers are prone to traffic analysis.

In particular if somebody can observe your traffic and your target's traffic, they can correlate that.

Anonymous remailers avoid this problem by adding longer delays, but you can't use them for interactive applications, such as browsing the web.
Exit nodes see your traffic in plain

If you don't use a secure protocol on top of Tor, the exit node can sniff your passwords etc. Using SSL or SSH you should be fine, but be sure to validate the certificate/fingerprints.

This doesn't apply to using hidden services, since there is no exit node, and MitM attacks are prevented by the fingerprint in the domain. But be careful that you're accessing the correct domain, they're pretty hard to memorize/verify.

One interesting variant is connecting to a VPN over Tor. That helps with 3), provided you trust the VPN, but you need to figure out a way to buy VPN access anonymously.


It is unclear what the actual security and usability requirements are, but if you want to prevent spoofing of the sender you need to authenticate the sender somehow.

This could for example be done with PGP or S/MIME signed mails, although most users are not able to send such mails. It could also be done by fingerprinting the mail client used for sending and/or the transport path and require some other form of authentication when this fingerprint changes (like a reply-mail the user has to acknowledge or a link which need to be visited). One could also require some one time token (TAN) to be send together with each mail and offer the user to load more such tokens once authenticated on the web site.

And one could probably imagine various other methods with different trade offs between security and usability. But again, the actual security and usability requirements here are not clear.


Why does the SQL Injection technique INTO OUTFILE sometimes not work?

It depends on the privileges the dbuser has. If there's no file privilege, into outfile just doesn't work. No bypass for that.


List of good security podcast one should listen to

As someone who spends a lot of time listening to podcasts I'll rattle off a few I've found to be very enjoyable.

Eurotrash Security Podcast

Probably my favourite podcast as it's European albeit a bit light on technical content. News and chat based mainly. They cover a lot of the conferences which is good if you can't get to many (like me). The European slant on the news is particularly good as there is quite a difference between US data privacy law and European so often there are considerations which don't get covered on the other podcasts I'll now list.

I also enjoy their MicroTrash podcasts. Short interviews with people, typically regarding their talks at conferences.

Pauldotcom Security Weekly

Almost the de facto security podcast. Despite the advertising and the stick they get for being corporate I still rate this as just about the best podcast all round (if it weren't for my European bias it would be my favourite). The show provides regular segments of news, interviews and technical stuff.  Lots of in jokes so I suggest you download the back catalogue (I did, took me about six months to get through it, they've been going five years).

Exotic Liability

What can you say about this one? If you're looking for pound-for-pound security content then EL is perhaps a bit lighter than the others but what you do get is the unique view of the world shared by Chris Nickerson and Ryan Jones. Be prepared for lots of swearing, outrageous, completely inappropriate jokes that will leave you crying with laughter in the car (or wherever you listen) grateful that no-one knows what you were laughing at. You're going to hell if you listen. ;-)

In between the laughs what you will get is straight-talking, no nonsense opinion on the state of information security today. Chris and Ryan's qualification to discuss security is beyond question (for me anyway) and sometimes you can learn an awful lot from a throw-away comment from one of those guys. They get your brain thinking about security in the right way imho. Nickerson focuses on security from a perspective of business impact. CEO's don't care if you got "root". They do care if you got their data.

Social Engineer Podcast

This is another excellent podcast focused, as you might imagine from the name, on the human element of security. The guys behind it include Muts and Chris from Offensive Security (think BackTrack) and Rel1k (Dave Kennedy) who wrote the Social Engineering Toolkit (SET).

The thing I like about it is they have a guest interview each month who is nothing to do with security, typically. They try to interview people who use social engineering skills, such as framing, micro-expressions or plain acting, in their day-to-day jobs in order to get a much broader view of the world of human manipulation. If you enjoy human psychology like me it's fascinating.

Southern Fried Security Podcast

Only listened to a couple of episodes of this but I enjoyed the short, news focused format. They tend to keep it to half an hour.

Infosec Daily Podcast

Literally it's daily. I've got a massive stack to listen to and again, I've only managed to listen to a couple but again, the guys behind it are well regarded in the industry so got to be worth a listen.

Security Justice is also supposed to be good although I've not listened to any of those yet. This is co-hosted by Jack Daniel, someone again who is well regarded in the industry.

All of these are easy to find in iTunes, if I can work out how to extract a link from iTunes to each I'll try and post them on here later.


With full access to the disk of an IIS web server, could you access the database server?

When Windows machines are part of an Active Directory domain, Kerberos is used to manage authentication. With Kerberos, the domain controller is the game master: everybody trust it, and none other. Which means that when the Web site connects to the database, the machine which contains the Web site (let's call it "WWW") talks to the domain controller ("DC") and uses a secret value, stored in the entrails of WWW, to convince DC that it is exactly that machine, sane and sound of spirit and body: the secret value is accessible only to the most privileged process in WWW.

Once DC is convinced, it honours the request from WWW which is: "give me a ticket which I can show to the database, proving that I am user 'SomeDomain\SomeAccount' trying to connect to the database under that name". That ticket is the result of a cryptographic computation that the database server (DB) will verify by talking to the DC ("Is this ticket valid right now ?"). Tickets embed a timeout and are short-lived.

What does it mean for our problem ? It means that an attacker obtaining a full copy of the hard disk of WWW learns the secret value that WWW uses to authenticate to the DC. This does not give him any secret which would be sufficient to connect to the DB directly. Indeed, the DB trusts only DC. So, in order to actually connect to DB, the attacker has to pose as WWW, i.e. boot a machine on the same network, which will use its knowledge of the hard disk contents of WWW to convince DC that it is the rightful WWW, and obtain a connection ticket which will please DB. Moreover, in order to achieve that, the genuine WWW machine will have to be shut down or at least disconnected from the network, because if the DC sees two machines simultaneously, both claiming to be WWW and knowing the WWW-specific secret to that effect, then the DC is likely to go irate and cease to talk to both.

Summary: In your scenario, the theft of a copy of the complete disk of the Web server will allow rogue connections to the database only in case of an active attack in which the attacker runs a fake machine in lieu of the genuine Web server. This is equivalent to taking administrator-level control of the Web server (whether the attacker switches the hardware or not is actually irrelevant). To succeed in connecting to the database, the domain controller must still be involved.


SQL injection: insert data from Get request

I'm assuming that you would like to figure out the exact method yourself and are only looking to be pointed in the right direction.

PHP database query methods typically only allow a single query per call. So you have to make an injection that is part of the one query that is executed.

However, I'm pretty sure you can't INSERT data using injection, only manipulate the outcome of a SELECT.


Does having in-browser password managers further the risks of successful CSRF attacks?

The term "CSRF" is very broad and, in my opinion, your definition of CSRF is not entirely accurate. A CSRF vulnerability's abilities depend on what endpoint is actually vulnerable to CSRF. Being able to send a request on behalf of a user that changes their profile picture, for example, wouldn't fall under your definition of CSRF above. If you have discovered a CSRF vulnerability on example.com, for instance, this does not necessarily affect your password manager per se. A far more significant attack in the context of password managers, is stored XSS or a subdomain takeover whereby an adversary can trick the victim's password manager into auto-filling a sign-in form, because the password manager trusts the origin.

(Source: https://twitter.com/albinowax/status/1011623832766111744)

It sounds to me like this is probably what you had in mind but were associating this attack vector with CSRF. On the other hand, a CSRF vulnerability in your password manager might be something to be concerned about, but that is a vulnerability in the password manager itself and not the page the user is currently visiting.


Would Homebrew +package updates have an additive effect with Apple security updates?

It should improve security if you leverage it to regularly update packages that Apple is either shipping out of date, or not maintaining and patching. Example

  Does Homebrew have known security issues in and of itself?

Without a full security review this answer is unknown. Worth digging around reported issues for other security related issues.

  ... Would installing a package manager and associated updates change the system configuration such that, in the hands of a relatively inexperienced admin, it will ultimately be in a more vulnerable state?

This question leaves a lot to speculation. I believe the homebrew documentation and its community is large enough that this should not be an issue. Deeper dive into considering ways to secure OSX.


Ideas for storing documents and hash values

If possible, have the sender sign them using PGP instead of just providing MD5 hash.

If that is not possible, than the second best thing would be to verify the hash and then sign the document using your own PGP key.

In both cases, you can store the signature in a file next to the PDF. This will allow you to verify the documents were not changed.


How to get rid of ad.doubleclick.net malware?

ad.doubleclick.net is not malware. It’s an advertising link retuned by Google to redirect your browser to the desired site. DoubleClick is Google’s advertising company. They use this referral scheme in order to track your browsing habits (to learn what words you searched for that led you to click on their ad), and for Google to collect a referral bonus for displaying such a good advertisement that you clicked on it. You are just seeing an error because your browser can’t get to their servers.

The error you’re seeing is because you have ad.doubleclick.net blocked in your computer somehow. You may be browsing using a “proxy” that is blocking that address; your router or firewall may be blocking the doubleclick.net domain; you may have blocked doubleclick in your hosts file; you may have installed a DNS ad blocker like pi-hole; or maybe you have installed any number of tools that might block these requests.


Generation of a shared nonce that cannot be pre computed

[Note: This question has been re-posted on crypto.SE.]

Let's break down the problem into two parts:

The first problem is that you want something that looks random to an outside attacker (ie is unpredictable), but can be computed by anybody in the know.

That sounds a lot like a Cryptographically secure pseudorandom number generator (CPRNG) where all nodes use the same seed. Then each hour (or each minute) you could take the next number in the random sequence - ie current_nonce = cprng.getSequence()[ numberOfHoursSinceLaunch() ];.

The problem that needs to be solved is the Key Distribution Problem - or in this case, the Seed Distribution Problem (since the seed is acting as the shared secret).

You could look at Key Agreement Protocols:

  In cryptography, a key-agreement protocol is a protocol whereby two or more parties can agree on a key in such a way that both influence the outcome. ... Protocols that are useful in practice also do not reveal to any eavesdropping party what key has been agreed upon.

Or you could go lower-tech and have an admin place the seed on each node by some secure method (SSH, USB key, etc). Or you could set up a client-authenticated TLS network where each node has a client cert that they can use to request the seed. There are many ways to skin this particular cat.

EDIT in response to re-post on crypto.se:

The second problem is that you want some system where even if a node has all the seeds material, it can not compute the secret until some fixed time in the future. This is actually a commonly asked question on Security.SE and Crypto.SE. The generic name for this is Time-Capsule Cryptography, on a Time-Lock Puzzle. Here is a famous post on the topic. There are solutions to this, but they all have the flavour of "if you run your processor on full, it will take them at least X days to compute the secret. I don't think that is what you want.

A practical solution to this problem would be to give each node a client-SSL cert. Have a master server that generates the nonces, then have the nodes log in to the master using their certs to retrieve the daily nonce.


Is it possible to reset digital camera shutter counter?

In general? No. For some specific models? Yes.

for some Canon models supported by CHDK, you can sometimes gain write access to internal memory counters.
some other models have two batteries (and a capacitor) and pulling both batteries out, waiting long enough to drain the feed capacitor, will zero all counters.
sometimes re-flashing the firmware will do the trick.

For this reason, if you buy a camera, do not rely on the frame counter but request a receipt or, if possible, verify the camera serial number on the appropriate site (sometimes you can ask a service centre. High-end cameras often have a device history record so that you can know e.g. that your "almost new" camera has had half its circuitry replaced three years ago. The data isn't online, but the service people can access it).

And if you sell a camera...

A: if you sell to some dummy, he won't check anything and you'll be able to sell him a used camera as new. But you would have been able to do so even without the hack, which was therefore useless.
B: if you sell to a non-dummy, he will check the frame counter, notice that it doesn't match the model age / dirt / scuff marks / gear smoothness / LCD luminosity / whatever, and correctly deduce that you're trying to pull a fast one. And you'll probably have lost the sale and your credibility; the hack in this case has been harmful.

The frame counter reset trick is likely to be worthwhile only on a very narrow range of buyer gullibility, and you'll have to balance the likelihood of pegging someone in that range against the likelihood of meeting someone in the wrong range, and the risk of misjudging where the mark actually stands.


From the nmap documentation:

  Another cause of duplicate fingerprints is embedded devices which
  share a common OS. For example, a printer from one vendor and an
  ethernet switch from another may actually share an embedded OS from a
  third vendor. In many cases, subtle differences between the devices
  still allow them to be distinguished. But sometimes Nmap must simply
  list a group of possibilities such as Cisco 1200-series WAP, HP
  ProCurve 2650 switch, or Xerox Phaser 7400N or 8550DT printer.

So, it is possible that the target runs an embedded OS similar to the HP models listed in your scan.


How to ensure security between devices from different manufacturers over multicast

The obvious solution would be certificates but because we can't guarantee internet access we can't add knowledge of new certificates once a device has shipped.

Sometimes, the truth is obvious: You need to cryptographically make sure the sending device is who it claims to be. That's a certificate's job!

So, you can't do an online check. Doesn't really matter -- an online check wouldn't be any more secure than the trust of a CA verified locally.

Thus:

build a certificate authority
issue certificates to manufacturers, signing their public keys.
manufacturers use their private keys to sign device certificates individually
devices send signed messages
devices must verify the signature of messages by

requesting the sender's certificate from the sender, comparing message to certificate ("was this message signed with the private key that corresponds to the public key that was signed within this certificate?")
verifying the sender's signature by checking whether the sender can actually offer a signature of a manufacturer ("was this public key actually signed by a manufacturer?")
verifying (including requesting the manufacturer's certificate from the sending device, if not available on the receiving side) that the manufacturer has a signature from your CA ("was this manufacturer's public key actually signed by someone with access to the CA's private key?")


Can Acronis True Image decrypt your files?

The 'worth' of the encryption in this case (which has nothing to do with the actual encryption as I'll explain below) is completely opinion-based, so you better rephrase that. But I'll try to explain the meaning of the EULA:
This means that they have the symmetric AES key to do the decryption. Their encryption isn't worth nothing per se, it is worth as much as you are willing to trust Acronis. Meaning, the AES encryption is in place, but they have the ability to decrypt your data. The question is do they? or will they? These are questions no one on this site will be able to answer. And the decision of trusting them is yours to make.


Is it a good idea to do double AES encryption with 2 different keys, when one is held by the user and one stored on the server?

If the server is going to decrypt the data when presented with the user's key, that second layer of encryption does not protect against a leaked user's key.  Whoever has that key can decrypt the data.

A second layer of encryption does make a brute force attack harder, but if the key for the second layer is stored with the data that advantage vanishes as well.

Finally, your biggest worry isn't the user leaking the key, it is the user losing access to the key.  "I've got a new computer; please send my secret key again."


This is a pretty scary thing to be doing, as by definition, you are wanting to look at sensitive, user-submitted data on those computers. Sure, you might catch the occasional wrongdoer, but you're going to be capturing quite a lot of normal people's passwords, emails, etc.

Which is probably opening a whole slew of liability to whoever owns the computer lab.

I'd contact your local legal department for advice here - its most likely better to go down the path of becoming a common carrier, and legally shielded from random user's activities, then it is to try and prevent them. Likewise, your plugin may become the target for a malicious actor, who can skip breaking into websites, and just capture the data from your tool.


To me there are 3 possibilities:

Endpoint surveillance program, one that is hidden from the user. Even with admin privilege, you might have missed it. For all I know it could be custom made, or even part of the OS.
Real world observation, people talk.
Firewall/traffic monitor. Someone maybe just saw flashgames.com coming from a certain IP address and made the mental connection. It's not hard to imagine.


Using external OAauth Authentication Service, how to manage the users's relations

With OAuth (including OAuth2 or OpenID for that matter) you would still have a local user entity. Where you store information about this user is up to you. In the case of your example, you would create a user table in your database, just as you normally would.

What is different is that you do not store authentication information (such as passwords1) in your user table, because, with OAuth, you offload the authentication part to the OAuth provider and, as a result, don't need this information.

Any data you need in your local application will still be stored in locally.

1 There is some debate on whether or not 'remember me' information should be stored locally or that a round trip to the OAuth provider should be made instead.


How can I prevent XSS on a $_POST input?

Don't think about protecting your inputs to prevent XSS - it should all be about output.

XSS, and other code injection vulnerabilities happen when data is not properly escaped or converted for the context in which it will be used.

How you do that depends on the output technology and context. As  AndrolGenhald mentioned in the comments, if you are outputting directly from PHP, without using a templating library, and you want to use a variable in the context of HTML code, then you should pass it through the  htmlspecialchars function. With other contexts and technologies the answer will be different. You need to find the correct way to escape data for each context.

If you can make sure you're always escaping data on output correctly, then you shouldn't use FILTER_SANITIZE_STRING. That irreversibly strips various things out of the string, rather than simply making them safe. On a well made website like StackExchange I'm free to submit the code <script>alert('XSS')</script>, and it doesn't get stripped, it just gets encoded so the browser safely displays it instead of executing it.

The code in your question doesn't include any output, so it can't itself be vulnerable to XSS. You need to show code that produces some output if you want to know if it does it safely.


Details matter.

As @Ricky points out, showing truncated HMAC values won't help the attacker finding the secret key, compared to a similar situation where the HMAC values would not be truncated. This makes sense: the truncation only removes information.

However, the attacker is not ultimately after the secret key. What the attacker really wants is to make forgeries, i.e. compute some HMAC values that the computer will accept as its own. Finding out the secret key allows making forgeries, but the ability to make forgeries does not necessarily entail knowledge of the private key.

Fortunately, HMAC tends to behave like a PRF, so there are two known methods to make a forgery:

Perform a brute force enumeration of possible keys until the right one is found (one that matches a few known value+HMAC pairs). This attack is defeated by choosing the key is in space large enough to make the enumeration unrealistic (i.e. you generate a 128-bit key with a cryptographically strong PRNG).
Luck. The attacker sends a random sequence of bits as HMAC value and hopes that it will work. This attack is defeated by not truncating HMAC values to too small a length, and/or applying other mitigations such as allowing only one try and irrevocably rejecting devices that once showed even a single bogus HMAC value (as you do).

The "luck" attack works with probability 2-n, where n is the size (in bits) of your truncated HMAC output. I.e. with a 32-bit output, then a luck-based forgery has probability 1 in 4 billions or so to go undetected. This is the best that can be done with a 32-bit output, in all generality; that HMAC behaves as a PRF means that it is "optimal" in that respect. If you truncate to 8 bits, then the attack success probability is 1 in 256, which is probably too much for comfort. But this is your decision to make, based on your usage context.

Also (again as @Ricky points out), beware of replay attacks. A valid MAC, assuming that there was no forgery, only demonstrates to the computer that it saw and "approved" the message contents at some point -- but not that it was the last message that it saw. Old message-HMAC pairs can be sent again by a fake device. To defeat replay attacks, you must maintain some state on the computer (the computer must remember something about the device, e.g. a "message sequence number", that is part of the data over which the MAC is computed, and incremented for each message).


No, there's no way to do it. Without setting connection parameter limits, there's even no way to make it relatively difficult. If a legitimate user can access your website, they can copy its contents, and if they can do it normally with a browser, then they can script it.

You might setup User-Agent restrictions, cookie validation, maximum connections, and many other techniques, but none will stop somebody determined to copy your website.


Is it good practice to send passwords in separate emails, and why?

There is added noise to the channel if you send them separately, assuming there is a delay in sending the second email the attacker would have to listen for a longer period of time and filter more content. It is simply a little bit safer than sending everything in the same package, think of ordering a safe box and shipping the keys along with it, its basically the same idea.

You are right in thinking that sending the password via a different channel (sms, phone, etc) is more secure, however it also requires more management and collection of more information, the logistics of doing it come with an added cost.


Authentication without sending password over network

You are basically describing Digest access authentication. Only that it is not "encrypts the nonce with a key derived from the password" but that the nonce is hashed together with a value derived from the password. The basic idea of not sending the password but instead a response based on some server challenge and the password is the same though. The weakness is also the same: the server needs to know the password or some equivalent and thus cannot store it securely.


padding problem in sha-1 hashed password

There are different variants of base64 encoding; while none I know of should produce a \, you might be better off just to use a URL-compatible version (which is done in java like the first google hit says).

Obiter Dictum:

There is usually no good reason to use 3DES and not AES. 3DES has long been deprecated.
Sha1 is not a good key derivation function, please use one that is designed for this purpose, like PBKDF2.


Can I use DCT and LSB method for multiple watermarking?

Since you usually compress images, which would do something very similar, at least in the case of jpeg compression, but would completely omit or severely reduce LSBs, I guess, no, in practice not.

If you're sending around full-color pictures uncompressed, at least I'd look at the entropy of your LSBs and the PSD, and the latter would probably lead to the suspicion that you're using steganography.


New to ossec - what does active response do out of the box

With OSSEC ver. 2.7.1, ossec.conf (by default located in /var/ossec/etc) contains the following active response configuration:

<!-- Active Response Config -->
<active-response>
  <!-- This response is going to execute the host-deny
     - command for every event that fires a rule with
     - level (severity) >= 6.
     - The IP is going to be blocked for  600 seconds.
     -->
  <command>host-deny</command>
  <location>local</location>
  <level>6</level>
  <timeout>600</timeout>
</active-response>

<active-response>
  <!-- Firewall Drop response. Block the IP for
     - 600 seconds on the firewall (iptables,
     - ipfilter, etc).
     -->
  <command>firewall-drop</command>
  <location>local</location>
  <level>6</level>
  <timeout>600</timeout>
</active-response>

So any active OSSEC rule that fires with both a severity >= 6 and successful identification of the source IP will trigger the temporary blocking of the IP address (600 seconds by default).  This is assuming you answered yes to the following server installation question:

  Do you want to enable active response? (y/n) [y]:

In ossec-local.conf, you can see the active command dependencies (i.e. "expect = srcip"):

<command>
  <name>host-deny</name>
  <executable>host-deny.sh</executable>
  <expect>srcip</expect>
  <timeout_allowed>yes</timeout_allowed>
</command>

<command>
  <name>firewall-drop</name>
  <executable>firewall-drop.sh</executable>
  <expect>srcip</expect>
  <timeout_allowed>yes</timeout_allowed>
</command>

In /var/ossec/rules/syslog_rules.xml, you can find the rule that generated the User missed the password more than one time alert:

<rule id="2502" level="10">
  <match>more authentication failures;|REPEATED login failures</match>
  <description>User missed the password more than one time</description>
  <group>authentication_failed,</group>
</rule>

The rule definition above has a level (i.e. severity) of 10, so that should trigger the temporary IP block.

In /var/ossec/rules/sshd_rules.xml, you can find the rule that generated the Multiple SSHD authentication failures alert:

<rule id="5720" level="10" frequency="6">
  <if_matched_sid>5716</if_matched_sid>
  <same_source_ip />
  <description>Multiple SSHD authentication failures.</description>
  <group>authentication_failures,</group>
</rule>

Again, the above rule definition specifies level 10, so that should trigger the temporary IP block.

In /var/ossec/rules/sshd_rules.xml, you can find the rule that generated the SSHD authentication failed alert:

<rule id="5716" level="5">
  <if_sid>5700</if_sid>
  <match>^Failed|^error: PAM: Authentication</match>
  <description>SSHD authentication failed.</description>
  <group>authentication_failed,</group>
</rule>

The above rule definition specifies level 5, so this rule would not trigger the temporary IP block.

Port scanning with nmap will result in a temporary IP block based on this OSSEC rule (i.e. 10 connection attempts within 90 seconds, level 10 alert):

<!-- Scan signatures -->
  <group name="syslog,recon,">
    <rule id="40601" level="10" frequency="10" timeframe="90" ignore="90">
      <if_matched_group>connection_attempt</if_matched_group>
      <description>Network scan from same source ip.</description>
      <same_source_ip />
    </rule>
</group> <!-- SYSLOG,SCANS -->


How to intercept and analyze mobile SSL application traffic?

If your on or have access to a Mac or Linux box, a great application to intercept https traffic along with http is MITMProxy. Not only is it great for viewing the traffic as it is passed through, but you can modify it very easily. All that is needed to view https traffic is to install the provided certificates on the device you want to intercept, then change the proxy settings on your target device to your computers IP, and set the port to 8080. More info is available in their documentation.


Renewing Microsoft Certificate Services Root Certificate

Root certificates (strictly speaking, "trust anchors") are supposed to be long-lived; as you notice, changing a root certificate is expensive because it must not be done lightly: that certificate concentrates the whole security of your certificates and what they are used for. For interoperability, you probably want to keep the validity dates below year 2038, because there are some (many) systems out there which internally encode dates as a count of seconds since January 1st, 1970, over a signed 32-bit integer. On a specific date of year 2038, the count will wrap around, into negative values, and hilarity ensues. This is the binary equivalent of the Y2K bug. Hopefully, when we reach that fateful date, most architectures will have switched to a 64-bit model where this issue will not occur for a long long time; or at least to a count over an unsigned 32-bit integer, which buys an extra 68 years. (Y2K turned out to be quite minor, so there is no reason to panic. Yet.)

For RSA keys, 2048 bits ought to be enough for long term security. This is, of course, a bet on future technology and science, hence there is no guarantee. Visit this site for a complete treatment of recommended key lengths. Alternatively, see if you can use ECDSA for your root certificate: almost all ECDSA implementations support the "P-521" standard curve, which offers "521-bit security", supposedly equivalent to a 15360-bit-or-so RSA key (i.e. no worry for a long time).

If your new root certificate uses the same key and the same name, then it will match previously issued certificates, and things will be fine. If you change the key and/or the name, then you will have to issue new certificates. Possibly, if you use intermediate CA certificates, then only those will have to be reissued. The "normal" way of managing a root key rollover is to define the new root, insert it in all verifier devices without removing the old root; after a few years, when all certificates which relate to the old root have expired, you can remove it from the verifier systems.

Of course, the main reason why you would want to change the root is that you believe that the key has been around for too long; reusing the same key defeats the purpose. Note that the root is, by nature, unique: there is one private key to worry about, located in a single place, normally a hardened tamper-resistant HSM (Hardware Security Module). The point of such a HSM is that the key cannot be stolen without you knowing it. So, as long as you use a big enough key to begin with, you will not have to change the key -- or, if you do, then you have to do it urgently. At that point, root validity dates are moot: if the root key is stolen, you want the new key to be deployed now (at least, by the end of the week), not within the next three years. Hence, the "current practice" is to make a long-lived root with a big key, and to set the root end-of-validity a few years beyond your own predicted retirement date (so that this will be someone's else problem).


SQL Injection : How to begin when the id parameter value is not numeric

The type of argument there should play no role in SQL injection other then how the SQL query is formed in the first place.

SQL injection abuses a SQL query being created from the parameter as a string. Web server treats the whole URL as a string and parses all the parameters as string as well. So even when the id is numeric, such as 1, it is treated by a web server as string and the code then inserts it as a string. This allows you to insert special characters, which would not be possible if only numbers were allowed.

However, there may be difference in the SQL query. When using string in a SQL query, the string has to be enclosed in single quotes '. Numbers can, but don't have to be.
Number: SELECT * FROM Test WHERE id = $NUMBER;
String: SELECT * FROM Test WHERE id = '$TEXT';

When you have a string enclosed in quotes, you have to close the quotes first. So for example you would send A'; DROP TABLES *;-- which would give you:
SELECT * FROM Test WHERE id = 'A'; DROP TABLES *; --'.
You can see the ' finishing the first ' so that your DROP TABLES *; command is treated as a command and not as text. The -- is used for comments in SQL and here we use it to get rid of the closing '. Otherwise, it would cause a malformed SQL query.

Please note that numbers CAN also use quotes in a query, so using this escaping method may be useful to try even if the site only uses numbers in the parameter. Also, depending on the SQL engine, other types of quotes then single quotes, such as double quotes may be usable, which would change how you have to escape them.


Adding photos to Truecrypted, airgapped laptop from camera safely

I would trust a USB or SD card over transferring it via an Internet connection.

Once you put the gapless computer on the Internet, you have no idea what's going to come down the pipe.  Applications might start auto-updating, in which case you are downloading and installing EXEs from untrusted sources over an untrusted network, which is exactly what you are trying to prevent by keeping the machine off the network.

To your third point, TAILS should not be confused with a secure OS. It's not. It's a TOR proxied OS. The purpose of TOR isn't security, it's a limited form of privacy. Instead of trusting your local ISP, you are pushing your trust to TOR exits, but you know nothing about who is actually running those TOR exits. It could be a black hat. It could be GCHQ.

When an attacker controls your network, as in the TAILS architecture, there are all sorts of new types of attacks they can potentially use against you, such as DNS spoofing, malicious code injection, etc.  So, I'd stay away from TOR or TAILS when you are looking for a secure environment. It's not their purpose and in fact creates more threats.


Store encrypted data locally on the phone that the Android and iOS app itself decrypts

If the app can access the data locally (on the user's device), then a determined individual can as well. If you really want to keep the values secret you could consider having the app send the user's input to a server (which you would control) which both stores the secret values and computes the value for the user. The server would then send the value back to the app to display.

This would improve your update problem as you could simply update the servers values whenever a change is required.

Note that someone could easily submit numerous inputs and map them to outputs which, depending on what type of computations are being done, could allow them to deduce the secret values.


Your ISP can know your password any time it's sent unencrypted over your internet connection. If you don't want them to know your password, don't send it unencrypted over the internet:

Avoid login pages that use HTTP (always use HTTPS and don't visit sites with expired or invalid SSL certificates)
Don't use FTP or other services/protocols that don't encrypt your password in transit

Also follow general security guidelines for passwords, such as never reusing the same password.

Additionally, if you are worried that your ISP (or anybody else in between you and the remote server you're communicating with) is watching you, then you also need to take additional steps, such as:

Ensuring that all websites you are logged in to are using HTTPS, so that your cookies can't be snatched from the HTTP request (you're logged in to this site, where HTTPS isn't available, so your ISP can already log in as you here if they want to)
Verifying you are talking to the right server (for example, with SSH, ensure you use fingerprint verification and take notice if a server's fingerprint changes).

If you are only worried about your ISP (or your government), you can improve your position significantly by using an offshore VPN so that all of your traffic is routed through a server outside of their reach. Your data will still be sent unencrypted over the internet, but will be encrypted between the VPN and you, which is enough to prevent your ISP from reading it.


Is privacy compromised when sharing SHA-1 hashed URLs?

It's better but not perfect.

While it is (currently) impossible to get the URL for a given hash, of course every URL has the same hash.

So it is not possible to see all the URLs a user browses, but it is quite likely to get most of them.

While it isn’t possible to see user A visits HASH1 and conclude that HASH1 means fancyDomainBelongingToUserA-NoOneElseVisits.com, it is for example possible to just calculate the hash for CheatOnMyWife.fancytld and then see which users visit that site.

I wouldn’t consider that to be protecting the users privacy.

Also just matching users who visit a lot of similar domains can be pretty revealing.


Well,if you only want HTTP access, it would be enough to open port 80 tcp (HTTP) to the outside.

You can also open port 53 (udp & tcp) so they can use a public dns server, or provide a dns resolver yourself for your customers (not open to the internet). You might decide to ditch dns and expect them to input IP addresses directly, but that's unlikely to be enjoyed by your users.

However, that way you are not suporting HTTPS, which means they won't be able to access many websites, from their bank (I need to log in there in order to authorise this purchase on your shop…) to twitter (I just wanted me to tweet how fun your park was…) or Wikipedia. So also port 443 tcp would be a minimum.

However, there are websites for which you would need port 8000, port 8080, port 8888…

Plus, although you claim that you only want to provide website access, I'm pretty sure your customers expect to connect their smartphones and be able to use their apps, which -although predominantly they will be HTTP(S)-based- may use any port.

Would that help you with your DDOS attacks? That seems unlikely. You don't specify the details in which you were attacked, but even for the small cases in which it was launched from the inside, they could do it with only port 80 open. It is more important to properly limit the resources by your different clients to ensure a fair use of them. Up to blocking of abusive devices if needed.


The "rings" nomenclature (0-3) you usually see these days started with the requested privilege level field in segment selectors as part of the design of x86 protected mode.

Back in the day, it was possible to make exclusive sections of the memory space called segments. In "real mode" it was necessary since you only had 20-bit addressable memory. When protected mode came along it still offered segmentation, but also privilege levels. Levels 0-2 are "supervisor" level and can do most things. Rings 1-2 cannot run privileged instructions but this is the only real limit; otherwise they are as privileged as ring 0.

Ring 3 meanwhile is "user mode". If you have your segment selector set to point to this ring, you require the help of the kernel via some system call interface in order to do anything requiring privileged CPU or memory access.

These days, it's pretty much required in 64-bit x86 to not use segmentation. However, segment selectors are still there - all segments just overlap and cover the entire address space.

So, the original purpose of ring 0-3 was to isolate privilege between user mode code and the kernel and stop user mode code walking all over system control structures.

Then virtualization became a thing on x86 and Intel/AMD decided to add hardware support for it. This requires a piece of supervisor (hypervisor) code to set up some control structures (called VMCS) defining the virtual machines and then call vmenter and handle vmexit i.e. conditions on which the virtual machine needs help from the hypervisor.

This piece of code is referred to as "ring -1". There is no such actual privilege level, but since it can host multiple kernels all of which believe they have ring 0 access to the system, it makes sense.

System Management Mode is another beast with special instructions. Firmware (your BIOS) sets up a SMM handler to handle System Management Interrupts - configurable depending on what the firmware wants to be notified of. When these events are triggered, the OS (or even hypervisor) is suspended and a special address space is entered. This area is supposed to be invisible to the OS itself, while executing on the same processor. Hence "ring -2", since it is more privileged than a hypervisor would be.

You'll also hear "ring -3" mentioned here and there in reference to Intel ME or AMD's PSP. This is a second processor running a separate firmware (Intel I believe uses ARC SoC processors) capable of doing anything it likes to the primary system. Ostensibly this is to provide IPMI/remote management of hardware type functionality. It can run whenever there is power to the hardware regardless of whether the main system is powered on or not - its purpose, as I say, would be to power on the main system.

From a security perspective, the lower ring you can get yourself into, the more undetectable you can make yourself. The bluepill research was about hiding from an OS the fact it was truly running in a VM. Later research has been done on SMM persistence. SMM persistence for example would potentially allow you to reinstall your malware even on a complete wipe of the hard disk and reinstall. Intel ME potentially opens up an always on persistent networked chip to install malware on the main target.

I've stuck to Intel chips here but you should be aware other platforms work differently. For example, ARM chips have "supervisor" and "user" modes, amongst others.


how to make a web based system that connects only the authorized user in the wi-fi access

The usual method is called "Captive Portal".

When the client first connects, all web page requests are intercepted and sent to the the login page instead. (Any non-web traffic sent at this point is dropped.)

One the user authenticates, the access point notes that it's authenticated, and subsequently allows traffic from that connection through to the Internet.


There are two primary techniques for mitigating stack based buffer overflows.

The first technique is attacking the problem at the roots. Buffer overflows occur when a program tries to write outside the bounds of a data structure. The most effective way to stop a buffer overflow is to stop this from occurring. Use a programming language, be it Java, Python, Ruby, that will manage the memory for you. If you must use C, ensure that you perform proper checks before writing to a buffer.

The second technique involves mitigating the damage a buffer overflow can cause. Techniques like stack canaries, DEP and ASLR fall under this category. They work to limit the damage a buffer overflow can cause by making it more difficult for an attacker to execute arbitrary code after an overflow. Such techniques can be defeated. For more information about DEP and ASLR, see this question.


Expiration of superadmin.p12 certificate

From the directory where you've installed EJBCA:
./ejbca.sh ra setuserstatus superadmin 10
./ejbca.sh ra setclearpwd superadmin <MY PASSWD>
./ejbca.sh batch

where <MY PASSWD> is your new password.


You can exploit the != comparison of strpos’s return value and false as 0 != false is false:

var_dump(0 != false); // bool(false)

This is due to implicit type conversion to boolean, where 0 is converted to false.

So you only need to ensure one of the strpos returns 0, which means $id has to start with either union or select, for example:

id=union' union select 'foo', 'bar

Since strpos($id,"union") returns 0, strpos($id,"union")!=false is false, $counter gets incremented only once and the query is executed with the injected SQL.


XSS Vector without  symbols or equal sign?

So landing an XSS where there's some filtering can be done a number of ways.  An important consideration is where user input is appearing in the resulting page.  For example if the user input is landing in the middle of a JavaScript block then the filters you're seeing won't really slow you down at all, something like ');alert(1); might work just fine.

If you're landing in the middle of an HTML element or in a parameter value it might be a bit trickier.  A first port of call there would likely be to try encoding your vector or adding additional instances of your characters to catch out naive filters that don't canonicalize the data properly before filtering it.  Good sources of potential vectors for this kind of thing are HTML5 Security Cheatsheet and the OWASP XSS Filter Evasion Cheatsheet


Why can't all wireless cards perform packet injection?

The term "packet injection" usually means interfering with a established session between two other devices, for which you need a driver that supports monitor mode.


CEH Incident Response phases: Investigation vs Analysis

The short version is that investigation is gathering information, and analysis is putting information (gathered from the investigation) into a comprehensive picture.

The ECcouncil (CEH governing body) says

  Computer hacking forensic investigation is the process of detecting hacking attacks and properly extracting evidence to report the crime and conduct audits to prevent future attacks.

After this information is obtained, an analysis can be made about the information. An analysis might include the risk of a repeat attack, what information was taken, other vulnerable systems that might also be exploited, what was the attacker searching for, etc.


When you run Reaver it creates a session file in the current folder to allow you to resume in case the execution gets interrupted. You can run reaver to create the session file, stop it then edit the session file. The very first line contains the pin it was at when stopped.

Change that to the PIN value you want to start at (like 70000000). Then run reaver again with your parameters. It will ask you if you want to resume the session. Say yes and proceed.

Alternatively you can add -s <session file> to your parameters and it will resume the session automatically.


Nmap / Qualys say 3DES is available, but OpenSSL fails to connect

That error means that the openssl tool could not find a cipher that matches "DES-CBC3-SHA" so it did not even attempt to connect. Your OpenSSL has been built without 3DES support (as has mine, OpenSSL 1.1.0g on Ubuntu 18.04).

The actual output when there's a mismatch looks like this:

$ openssl s_client -connect example.com:443 -cipher CHACHA20
CONNECTED(00000003)
140576084648384:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/record/rec_layer_s3.c:1399:SSL alert number 40
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 128 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1550260584
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---


There are several dot11 classes that are declared to help with low network layers.  However, based on their less than adequate documentation that WEP is the only secure protocol that is somewhat supported.  Scapy's manual shows some WiFi sniffing, but doesn't really delve too much into Wireless communication.

All-in-all you'd probably have to hack together a mixed solution of raw data, and some of their classes to do what you want.  Not impossible, but not as easy as spoofing other protocols with Scapy.


To What Extent does an Attacker Have Access to the Browser History through the CSS Pseudoclass :visited Styles?

CSS history leak is now fixed by http://dbaron.org/mozilla/visited-privacy
So to answer the question in the subject: negligible (just very outdated browsers, probably some <10%). However, history leaks are still the case.

For the descriptions of  real risks of history leaks here:
http://w2spconf.com/2010/papers/p26.pdf and http://petsymposium.org/2012/papers/hotpets12-4-johnny.pdf

Although CSS hack are solved, you must remember histories might leak due to multitude of channels: interactive techniques:  http://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper010.pdf
 (can be now greatly simplified and improved)
or timing analyses (a classic paper here http://selfsecurity.org/technotes/websec/webtiming.pdf; now practical approach would be much more effective, see also references in previous papers).

The attackers can be: visited sites (so all 3rd-party scripts as well and yes, it can be used to track users also using other techniques then the ones discussed above).

It was also maliciously exploited by at least several sites http://cseweb.ucsd.edu/~d1jang/papers/ccs10.pdf

The references in these papers are also informative.


First, there is a difference between hashing and encryption. SHA256 is a hashing function, not an encryption function.

Secondly, since SHA256 is not an encryption function, it cannot be decrypted. What you mean is probably reversing it. In that case, SHA256 cannot be reversed because it's a one-way function. Reversing it would cause a preimage attack, which defeats its design goal.

Thirdly, SHA256 verification works by computing it again and comparing the result with the result at hand. If both results match, then the verification is successful. The theoretical background is that it's difficult to find another input which gives the same hash result. Violation of this creates a second-preimage attack, which defeats its design goal.

Finally, digital signatures are not simply hash and key combinations. But a hash function may improve its security.


Closing handles of a process as a regular user

Considering the only way you could get to the process is through debugging hooks (I think). The Local Security policy in windows 7 has the following for the debug permission:

  Debug programs

  This user right determines which users can attach a debugger to any
  process or to the kernel. Developers who are debugging their own
  applications do not need to be assigned this user right. Developers
  who are debugging new system components will need this user right to
  be able to do so. This user right provides complete access to
  sensitive and critical operating system components.

  Caution

  Assigning this user right can be a security risk. Only assign this
  user right to trusted users.

  Default: Administrators

If this is the case only users with this permission could cause the issue you're referring to. Your bigger issue is users that are able to escalate permissions, but that's the battle we all fight.


Security provided through MAC filtering: Wired vs. Wireless Networks

In wireless networks, the signals travel through the air; anybody can listen to them and capture the source MAC address. Therefore, it's easy for an attacker to find out the white-listed MAC addresses and impersonate them.
Think of it this way: A group of friends talking to each others, and they only talk to people they know. When one of them says something, he always says his name in the beginning. So, for example, Jack says "Hey, I'm Jack. Today I blah blah blah". If you happen to pass by them, you can hear one of their names and use it in the beginning of your sentence. They'd think that you're Jack. (Please ignore their ability to see you and recognize your voice)

In wired networks (more specifically, switch-wired networks), the signals travel through the wires from the hosts to the switch; it's much more difficult for an attacker to listen to them an capture the source MAC address.
Think of it this way: The same situation in the previous example, but instead of talking, the friends are sending each others post-it notes directly, hand-to-hand. You, as an outsider, have no idea what they're talking about and their names are, so, theoretically, you cannot pretend to be one of them.

In short, what makes MAC filtering ineffective is an attacker who knows a valid MAC address. By having a valid MAC address, the attacker is able to impersonate it and "convince" the server/router/AP that he is the white-listed device.
In wireless network it's easier to capture and acquire a valid MAC address than it is in wired netwroks. That's why MAC filtering is less effective in wireless networks than wired networks.


How does ndpi actually detect the HTTP protocol?

What is the high level view of categorizing the packet as HTTP (or any "x" protocol)?

Standard port numbers are as close as you get to an an official classification of application-layer protocols. But in practice, services often don't adhere to their default ports and there is simply no universal way to detect which layer-7 protocol is being used. Therefore, deep packet inspection relies in large part on regular expression heuristics or just basic string comparison (as in the referenced code from nDPI).
In most cases there is just no better way of detecting a protocol than by looking for typical patterns in the (preferably initial) packets - like a GET request line with subsequent headers to identify an HTTP connection.
Consequently, you're right that it's easy to evade these checks by obscuring the protocol (often done by BitTorrent applications). The discontinued Linux Layer 7 filter project has a FAQ that addresses these concerns:

Q: Isn't this just another pointless step in an arms race in which protocols will continually adapt to evade classification?
A: You can look at it like that, but essentially no. Internet standards like HTTP will not do this. Only P2P programs and the like will. This means that, at worst, what you will need to do is to shape the "unknown" classification down, leaving the most bandwidth for known protocols like HTTP, SMTP, and so on.

Also have a look at the l7protocols wiki which documents various methods of protocol identification, most of them regex-based.


What stops a developer from accessing credit card details and other secret data from a company

PCI DSS sections 6, 7, and 8 all bear on this question.
For example, part of 6.3.2 which requires code review:

Code changes are reviewed by  individuals other than the originating
code author, and by individuals  knowledgeable about code-review
techniques and secure coding  practices.

6.4 with change control:

A separation of duties between personnel assigned to  the
development/test environments and those assigned  to the production
environment.

7.1 controlling access... in many environments the developer who writes code never accesses the operational systems where it's used with live data:

Limit access to system  components and cardholder data to  only those
individuals whose job  requires such access.

And a touch of 8.7 to put restraints on those people with access:

Examine database and application configuration settings to  verify
that all user access to, user queries of, and user actions on  (for
example, move, copy, delete), the database are through  programmatic
methods only (for example, through stored  procedures).

Now, that all said, can a trusted insider every be perfectly defended against?    No, because of the very definition of "trusted".  This is true in all places (how many spies have been "trusted"?  John Anthony Walker comes to mind.)  But there are best practices for defending against such a threat , for mitigating them, and the PCI DSS formalizes as requirements a number of these practices (for credit cards... other secrets are on their own!)
(And @Stephen-Touset points out, 3.5.2 requires:

Store secret and private keys  used to encrypt/decrypt cardholder
data in one (or more) of the following  forms at all times:

And one of those ways is:

Within a secure cryptographic  device (such as a host security  module
(HSM) or PTS-approved  point-of-interaction device)

Which has the advantage of escrowing the actual key material away from day-to-day users and administrators.)