Is there any difference for OS fingerprint technique used in Nmap inside -A and -O?

-A without root privileges does not perform OS detection. The -A option is a shorthand to enable many of Nmap's advanced capabilities:

OS detection (-O)
service version detection (-sV)
NSE script scanning (-sC), and
traceroute (--traceroute)

Of these, OS detection and traceroute require root privileges. The other two features (with the exception of just a few NSE scripts) do not require root privileges. When you use the -A option, Nmap will enable as many of these features as it can at your current privilege level, and it will not complain or give an indication that it is leaving any out.


How to validate CSRFGuard token on the server side?

After exploring the code for a couple weeks trying to find a way to validate the token on the server side, I found that it is stored in the HttpSession session variable. Look at the fetchCsrfToken method from the JavaScriptServlet class .

Based on that, I'm validating the token at server side as follows:

String CSRFToken = request.getHeader("OWASP_CSRFTOKEN");
if(CSRFToken.equals(tokenValue)) {
    // Code to execute if the token is valid
} else {
    // Code to execute if the token is not valid
}

I hope this is helpful to others who use the OWASP CSRFGuard library.


How to tell if an email is encrypted, or just corrupted?

They are standards for encryption of mails, notable S/MIME and PGP. There is defined how the encrypted message gets encapsulated so that the mail client knows that it is encrypted. These encapsulations have a very specific Content-Type headers or at least specific markers in the content, i.e. markers like

 -----BEGIN PGP MESSAGE-----

or Content-Type's like

  Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";
  Content-Type: application/pkcs7-mime; name=smime.p7s

If you find any of these when looking at the source code of the message then the message is encrypted. If not then the message is probably corrupted. The source code of the message can be seen when opening the .eml file in notepad or similar or if you are using the appropriate function of the mail client (if there is such function).


Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I'd recommend Virtutech's SIMICS software. Note that Virtutech was bought by Intel and assigned to their subsidiary: Wind River.

Simics is a SIMULATOR, which has important distinctions from an EMULATOR (like qemu). See https://stackoverflow.com/questions/1584617/simulator-or-emulator-what-is-the-difference for specifics on the differences.

Simics simulates many (hundreds?) of architectures. You select the specific one you are interested in (in your case, the architecture in use by the desired printer) and load it's environment within simics. Then you load the software (kernel & OS if it has an OS) that you want to test. Afterwards you execute simics and it boots and executes the target software exactly as it would execute on the native hardware. This is a chief benefit of simulators versus emulators.

With simics you can pause execution, set breakpoints in the kernel, and reverse a crash! Indeed, you can encounter a crash and then effectively execute in reverse to understand what led to the crash. You cannot easily do that in an emulator and even if you were to attempt it the internal state of the emulator differs from the real hardware architecture of the target so the results are mixed.

BLUF: you need a SIMULATOR not an EMULATOR.

[edit]: Link to simics information: http://www.windriver.com/products/simics/


Replay attack example for validating nonce?

As per OpenID Connect Core documentation:

  The nonce parameter value needs to include per-session state and be
  unguessable to attackers. One method to achieve this for Web Server
  Clients is to store a cryptographically random value as an HttpOnly
  session cookie and use a cryptographic hash of the value as the nonce
  parameter. In that case, the nonce in the returned ID Token is
  compared to the hash of the session cookie to detect ID Token replay
  by third parties. A related method applicable to JavaScript Clients is
  to store the cryptographically random value in HTML5 local storage and
  use a cryptographic hash of this value.

So yes it is acceptable to store it in a cookie, but it is recommended to use a secure hash such as SHA-2 when this value is sent to the authorisation server from the user's browser.

This protects against a stolen token, because the attacker that has stolen the token will not have this session cookie on your site, and is unable to guess or reconstruct it because the value is hashed when sent externally.

The attacker would be on the internet, because if the user is local all bets are off - they would be able to access the token sent to your application, and would be able to access this session cookie.

So what is it protecting against?

Remember that if you are relying on OpenID to authenticate your users, you are trusting a third party. In an ideal world, the security of the provider is absolute and nobody can intercept the token. However, if there's a weakness in the chain between the user and the OpenID Provider, for example there's an unreported token leakage vulnerability there allowing an attacker to observe the token, the nonce will ensure that they cannot login to your application by replaying the redirect to your site.

The value of a nonce over simply validating they have any session on your site is that it pairs their original access to your site when you redirected to the provider, with the return to your site.


Is it safe to expose a logging socket endpoint in a chrooted environment?

Let's start with what we know:

You have a process running in an isolated environment
You want that process to communicate with the logging system

It follows therefore that you need to provide some way to route the communication from your process to the logging daemon. There's two ways to do this: Unix sockets or TCP sockets.

To the application, Unix sockets and TCP sockets are roughly identical. In both cases, you connect to the socket and start sending/receiving traffic. But Unix sockets have the security advantage that you can use file permissions to control who can connect to them.

So you're wondering how it could possibly be safe to allow the process to connect to the logging system... but if your process can't see the logging system, then how could you expect it to generate log entries?

To be clear, a unix socket does not give anyone complete control over the process that owns the socket. Instead it allows someone to open up a connection to the process that owns the socket, exactly like using a network connection, but without the network.


What you're talking about sounds similar to what John The Ripper and Hashcat offer with rules based password cracking.

This essentially defines a set of rules to generate passwords rather than relying on straight brute-force.  There more information on the hashcat site or the John Site

There's probably some interesting work to do there in comparison of various rules options and different password dumps..


Encrypting multiple blocks with an asymmetric scheme

Asymmetric encryption is indeed usually used as part of hybrid encryption: a random symmetric key K is generated by the sender; K is encrypted with the public key of the recipient, and the bulk of the data is encrypted with a symmetric encryption algorithm using K as key. This is basically using asymmetric encryption as a key exchange algorithm.

In fact this is not usually done that way; it is always done that way. There are several good reasons for that, namely that:

We do not really know how to do "pure" asymmetric encryption securely. For symmetric encryption we have a lot of theory and practice on modes of operation; but for something like RSA we are still in the dark in that respect.
Asymmetric encryption incurs size expansion; the encrypted text is necessarily larger than the source message ("necessarily" because of randomization, which is needed in order to defeat exhaustive search on the plaintext data). If asymmetric encryption is used throughout, then the size overhead for a big message becomes non-negligible. A contrario, with hybrid encryption the overhead is fixed even if you encrypt gigabytes of data.
Asymmetric encryption and decryption is computationally more expensive than symmetric encryption.

These reasons feed each other: e.g. modes of operation for asymmetric encryption are not studied because it would be expensive anyway, for no clear gain.

A consequence is that a normal RSA implementation will accept to encrypt messages only up to the inherent size limit of the algorithm, and will not try to "split" the message into individually encrypted blocks or anything like that.

The only cases where asymmetric encryption is used without hybrid encryption are:

Specialized cases where the data to encrypt is always short.
Advanced protocols in which the sender must be able to prove some algebraic property about that which is encrypted, and/or homomorphic encryption (this is typical of electronic vote protocols). In these cases, the messages to encrypt are not just any sequence of bits; they have a lot of mathematical structure, and will again be short.


Does nmap limit probes when using time limiting on decoy scans?

From the source:

    This function also handles the sending of decoys. There is no fine-grained
    control of this; all decoys are sent at once on one call of this function.
    This means that decoys do not honor any scan delay and may violate congestion
    control limits. */
static UltraProbe *sendIPScanProbe(UltraScanInfo *USI, HostScanStats *hss,
                               const probespec *pspec, u8 tryno, u8 pingseq) {

It appears that each probe will be sent from your real source address according to your timing options, but at the same time it will be sent from all your decoys. So your target should see synchronized -T1 scans from number_of_decoys + 1 different sources, which will be number_of_decoys + 1 times more packets than a non-decoy scan.


Why do people check the passport on key signing events?

Key signing parties are, indeed, kind of useless if it's between people who have never encountered each-other before. Unless you're an expert at recognizing forged documents, you would never be able to tell a real passport from a well-done fake passport (or, worse, a real laminated ID from a fake laminated ID, if it's from another state of province). Also, it's in the human nature to act agreeable when dealing with other humans, so nobody is going to poke at an ID trying to see if it's a fake or a real thing. The shut-in human nerd you'll be dealing with will just smile, say something like "yeah, it looks like an ID" and agree sign your key -- all while feeling super awkward and embarrassed.

The OpenPGP standard actually has a mechanism to indicate how much effort you've put into verifying someone's identity. If you run gpg with --ask-cert-level when signing a key, it will offer you a way to indicate how much identity validation you've done, from "none at all" to "very extensive verification." This option is off by default because extremely few people use it correctly, so it's pretty meaningless these days.

Meaningful keysigning parties do not involve passports or any other kind of identification documents, because they happen between people who know each other from previous engagements. For example, when someone like Linus Torvalds signs a key belonging to another Linux kernel developer, he does not do it to indicate that "this is Dirk Hohndel because I checked his government-issued ID," but to say "this key belongs to a person whom I know as Dirk Hohndel." It is not important to other Linux kernel developers under which name Dirk files his taxes -- all they really want to know is that "this is the same Dirk who works with Linus Torvalds."

So, if you're attending a keysigning party where nobody knows each-other, just leave -- any key signatures obtained at such events will have very little value.


Is it safe and secure to disable sandbox of google chrome in Kali Linux or any distribution of Linux?

Instead of running any browser as root, you should create a new unprivileged user to run Chrome.

As @McMatty quoted, disabling the sandbox removes an essential security layer that's protecting you from compromise if an attacker exploits a vulnerability in the browser.

Also note that Kali Linux is a special-purpose OS that's not meant to be for everyday use. (The fact that root is the default user is a hint at that.) So if find yourself starting to customize it a lot, you might want to change your setup, using your main OS alongside Kali which you only use for pentesting.


Algorithm to generate NTLMv2 Hash in PHP

I sorted out the correct algorithm for PHP. Thanks for the contribution. Following is the code:

function GenerateNTMLv2($password, $account, $domain, $client_challenge, $server_challenge) {

    $unicode_password= iconv ( 'UTF-8', 'UTF-16LE', $password );

    $NTLM_Key = mhash ( MHASH_MD4, $unicode_password);
    $NTLM_Hash = mhash ( MHASH_MD5, iconv ( 'UTF-8', 'UTF-16LE', strtoupper ( $account ) . $domain ), $NTLM_Key );
    $NTLM_Chal_Hash = mhash ( MHASH_MD5, pack ( "H*", $server_challenge . $client_challenge ), $NTLM_Hash );

    return strtoupper ( bin2hex ( $NTLM_Chal_Hash ) );
}


You can't really do much about it yourself , except for reporting it to the police (because it's a scam attempt which is obviously illegal).

Avoiding receiving such messages isn't easy, since the attackers are either using a number database they bought somewhere (with your number in it) or they generate the numbers randomly (spray and pray tactic, hoping someone will bite the bait). They might not even know if you have an Android phone.

Warning relatives and friends is a good idea. Also suggest them blacklisting the number you got the scam message from.


Is `tls_preempt_cipherlist = yes` in postfix a good idea nowadays?

The documentation of Postfix is very specific in that the problem occurs if a client offers ciphers which the client does not implement properly. To cite from the documentation:

  ... some SSL clients have listed lower priority ciphers that they did not implement correctly. If the server chooses a cipher that the client prefers less, it may select a cipher whose client implementation is flawed.

In other words: problems occur with this setting if the client a) has broken ciphers in the first place and b) offers these ciphers even though they are broken and c) relies on the server not to pick the broken ciphers the client offers.

"Windows 2003 Microsoft Exchange clients" where only provided as a known example of such broken implementation which does not mean that their are no other broken implementations. Contrary to HTTPS (where it is not uncommon that servers prefer there own cipher order) there is a large variety in mail clients (including MTA trying to forward mail to the next hop) and the chance to communicate with some broken implementation is therefore usually higher. This does not mean though that setting tls_preempt_cipher_list=no will work around these problems in all cases. But it might increase the chance a bit that client and server will actually agree on a cipher which is properly implemented in the client.

Apart from that it should actually not really matter if the server picks the cipher based on the clients or the servers preference. What matters though is that the server has only ciphers configured which are considered secure. In this case it does not matter if the client offers insecure ciphers since the server will not pick these as common ciphers, no matter if the cipher preference is taken from client or server.


Is it good practice to store information about a subkey inside a hash?

TL;DR yes, when it comes to protecting the password on the server it is secure to store the configuration parameters such as iteration count and salt / salt size on the server. As mentioned in the chat session, it is common to do so for e.g. bcrypt, using a different textual format.

The question is if it is secure to store the configuration parameters of the algorithm, not just the algorithm. And yes, this is secure. The configuration parameters do not give any information on the used password, so storing them with the salt (and possibly password hash, for password verification) doesn't leak any confidential information to an attacker.

And just like the Kerckhoffs principle applies to the algorithm, it is also valid for these kind of configuration parameters. Fortunately, if these parameters are changed then the password verification will simply fail.

Base 64 encoding doesn't play a role in determining the security so it is left out of this answer.

For other functions / configuration parameters the parameter may need additional protection. For instance the size of an authentication tag in authenticated encryption (or simple HMAC) should not be altered by an adversary. This could be an issue in protocol negotiation.

Similarly if the iteration count / work factor is communicated to a client (for partial offloading of the work, for instance) then you may want to protect the iteration count against change. But these kind of parameters are generally just available on the server and passwords / hashes send are generally protected by a TLS connection which you should be using.

Personally I prefer simply storing a single version instead of the explicit parameters. The parameters are then specific to a version (hardcoded), so I don't have to parse / validate any information other than the version. This is less dynamic than storing them separately but often complexity is as much an problem as rigidness.


How do SRP (and PAKE generally) protect against verifier leak

Even if an attacker breaches the server database, and obtains the userid (u), verifier (v), and salt (s) for a client, the attacker would not be able to use this information to login as that client.

See https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol.  Step 4 is where the client computes the client session key, as follows:

S_c = pow(B - k * pow(g, x, N), a + u * x, N)   [eq 1]

The verifier was previously calculated as:

v = pow(g, x, N)   [eq 2]

So, knowing the verifier, the attacker could re-write eq 1 as:

S_c = pow(B - k * v, a + u * x, N)   [eq 3]

B was previously sent from the server, k and N are constants known to both parties, a is computed on the client side, the client has everything he needs to calculate u, v was obtained from the server in the breach - but what about x?  Before calculating the client session key, the client must first calculate x as follows:

x = H(s, I, p)   [eq 4]

where s is the salt (obtained from the server in the breach), I is the user id (also obtained from the server in the breach) and p is the password.

Without the password, the attacker cannot compute x, therefore the attacker cannot compute the session key.  Without the session key, the client cannot authenticate with the server.  So knowing u, v, and s for a client is not enough for an attacker login as that client.  The attacker must also know x, which is calculated from the password.

However, x is equivalent to the plaintext password.  This is why the client should not store x.


Are there any tools for automated penetration testing of Silverlight applications?

Short Answer: No (though with the speed of the web, by the time you read this things might have changed...)

Long Answer: There are several that may be helpful, but I haven't tried them

WCF binary soap plugin for Burp Suite
SoapUI


Is SSH with key authentification safe in untrusted network?

can the eavesdropper gain access to my server?
if no - what mechanism is preventing this sort of attack?

No - The connection used to communicate the authentication is secure from eavesdropping using Diffie-Hellman key exchange as part of the process and digitally signing the protocol steps as proof that tampering hasn't occurred. Read the following: How does SSH use both RSA and Diffie-Hellman?

how would the answers change if I were using passwords instead of keys?

A password will likely lower the "brute-force-ability" of gaining access to the server, as your password is likely to be a lot lower in bits than the keys used.


How realistic it is to be a target of BGP hijacking?

BGP hijacks happen all the time. Both by accident (mostly by typos in router configurations by network engineers), but sometimes on purpose to reroute traffic via a specific network to do man-in-the-middle attacks.

It's hard to quantify 'how often'. I'd say it's not that common, but of course it could just be a case of bad luck with a typo.

However, one important thing is you can verify this. For example, RIPE NCC collects historical routing data and offers you a tool called BGPlay to watch back what happened to a specific IP range in time. You could use that to verify if the IP range of your VPS instance is seen with another AS number as source during the downtime you experienced. If RIPE Stat hasn't detected it, there's a fair chance they're making this up.


Is there any harm to writing a short plain-text string to authorized_keys?

I agree that it is better not to write the file, but I expect the risk to be minimal.
Or even better, thanks @dave-thompson-085, mark your short string as a "# comment"

The format of .ssh/authorized_keys records is "[option,option,...] <Type> <base64> [name]".
It seems as long as the first word of the short string does not match any known key type or option, the rest of the malformed line should be safely ignored.

There are other risks, but they are hard to estimate:

Some other tool for auto-editing authorized_keys may get confused
Just the right key type (matching the first word) may be invented in the far, far future
Just the right option and key type (matching the first two words) may be invented
Code path dealing with invalid key types or options may not be throroughly tested.


What's the usage of the signature algorithm in TLS_DH_* cipher suites?

As noted by @dave_thompson_085 in his comment above, the names DH_DSS, DH_RSA, ECDH_ECDSA, and ECDH_RSA are historical (see RFC5246, 7.4.2). Actually, the signature algorithms RSA, DSS in the names of these cipher suites have no meaning.

In TLS 1.1, however, as indicated by @StackzOfZtuff , there had been the convention that in a DH_RSA cipher suite a server certificate has to used that is signed by RSA (and similar for the other suites) (see RFC2246, 7.4.2).


Convergence HTTPS - what are the Notary servers?

In human words: notary servers are trusted servers that add a "yet another" security level, which actually tries to eliminate MITM (Man-In-The-Middle) attacks.

Notaries act as a mediator to ascertain the validity of a Certificate Authority. Notary servers keep consistency checks on CA root certificates to ensure that a certificate presented by the web-server to the client is consistent with what the Notary server has come to know over an extended period of time.

A "Notary Service" would eliminate the need for operating system vendors to include list of trusted CAs but instead publish list of Notary servers. This option dynamically updates clients as soon as a CA is compromised. The only problem today is that currently, there are not enough "notary servers" available on the internet.

If you're looking for a good example of this type of implementation, you can find it in DNS Root Name Servers which securely maintain Zone records for the internet.

I bet that this practical example is easier to understand than my technical explanation of the definition. ;)


Potential dangers of re-locating critical systems to cloud

"The cloud" is marketing-speak for "other people's servers", so I will use that term instead.

When you move critical systems to other people's servers, you need to be aware that they have physical access to the server and to their network connections. When they are not trustworthy, they are able to steal your data or eavesdrop on your network traffic.

A sensible precaution is to use full-disk encryption so that even when they look at the filesystems of their servers, they don't learn what your systems which run on them are doing. Which technologies are available for this depends on the operating system you are using.

Another important precaution is to make sure that any remote access is encrypted and well authenticated (preferably by certificate and password). Remember that you are no longer talking to your own servers in your own datacenter via your local area network. You are now communicating with other people's servers via a normal internet connection. When possible, the servers should be configured to only allow access from your IP addresses, when the people who own them are able and willing to make that happen.

However, when you believe you can trust your provider, having your software run on their servers can even have a security benefit. People who provide such services as their primary business model usually(!) have lots of know-how about how to properly secure a datacenter against logical and physical attacks. They might also be able to provide a better uptime than you do. When your organization lacks the know-how and resources for proper datacenter operation, letting someone else handle this might not be a bad decision. But you should do your research about the security track record of the people whose servers you are running your systems on.


This sounds fine, and seems like a good solution to protect the session cookie against XSS attacks by duplicating the value of username into a non-http only cookie.

All your authorisation checks should be being made server-side anyway. So if your client wants to do something server-side, it sends the request and then the server makes the authorisation checks itself, not taking into account the non-http only cookie at all - it just uses the session cookie protected by http only.

If the non-http only is used for UI purposes only, it can't harm the session because the server will vet all requests using the session cookie.


Protonmail cannot read my mail — but can detect if it is spam?

As you hint in your third point, it's a difference if the mail is from and to a Protonmal account, or if one side is an third-party server.

For the cases where the sender or receiver (one of them) is not a Protonmail user, they DO read the mail, as they say themselves: https://protonmail.com/blog/encrypted-email-spam-filtering/

Part of the text there:

  First, the IP address of the incoming SMTP server is checked against spam blacklists which contain IP addresses of servers we have previously received spam from. If we receive a hit, the message is rejected.
  Secondly, the message is passed through our customized Bayesian filters which marks suspicious messages as spam.
  Next, we generate checksums of incoming messages and check them against a database of known spam messages. If there is a match, we mark the message as spam. The checksums are done in such a way that it is also effective against mutating spam emails.

  ...

  All this is done in memory so that by the time anything is permanently stored to disk, the email is already un-readable to us. This gives us a very limited window to perform spam filtering on incoming messages.

  ...

TL;DR. they encrypt the received mail after filtering it / filter after decrypting before sending.
They still say they "can't read anything" despite anything running through their spam filter is not secure from admins and developers.

To be fair, even without filter the server must handle the unencrypted mail at some point, if the sender/receiver is external... but "they never can read it" is nonsense.

About internal mails from and to Protonmail, I have not found a similar post - but there are (probably) some official statements on the internet.

That they factor in if receivers mark something as spam.
That they take care to block anyone over a treshold (unlike some mail providers who just don't care).
And that there is a limit how many mails can be send in a certain time (making mass spam harder).


Different private keys for one common-name spread across two servers

Different private keys for one ... certificate

This is not possible. The certificate signs a single CSR, based on a single Private Key.

The other Private Key would have to be signed with a different certificate.

  Do certificate providers allow you to have multiple certificates with the same common name ...

@Matt Nordhoff is exactly right here.

  Depending on your certificate authority, you may be able to use the "Reissue" button and do it for free. (As long as it doesn't automatically revoke!)

This might actually work!

I don't know if this is a recommended solution. I'd be more comfortable if the CA officially supported this solution.

  Or you can use Let's Encrypt.

Assuming your certificate is Domain Validation only (most are) then you could automate the certificate renewal process, and make use of letsencrypt.org's free 90 day certificates.

I believe Let's Encrypt is trying to eliminate the use of unencrypted HTTP by allowing webservers to automatically maintain HTTPS certificates by default.


Prevent an application from making any network access on macOS

You can use sandbox-exec

Usage: sandbox-exec -n no-network someProgram


Hash(master + hostname) password scheme for a server pool

A few ideas:

Use a scheme that allows you to easily "bump" the passwords to a successive value for when the passwords need to be changed. If you ever need to give someone your server password (which does happen in certain types of emergencies), then you'll want to change the password in order to revoke access. Don't block yourself into keeping a password you can't easily change.
Don't use passwords for day-to-day interactions with the server. SSH keys are categorically better, especially when you have lots of servers to manage. Learn how to use an ssh key agent (ssh-add on *nix, and pageant on windows), which helps you simplify key management and gives you no excuse for not encrypting your private key.
Also, LastPass. Not really relevant to ssh and root passwords, but if you're managing lots of servers, you'll probably be putting lots of passwords into browsers. This is secure and reduces your incentive to re-use passwords.

As an implementation note, I just wanted to point out that your hash input has an implicit \n at the end that gets put there by echo. So if you ever attempt to replicate the password in Perl or using some other tool, just keep that in mind. Alternately: echo -n 'foo' 'bar' | md5sum. See also: echo $(</root/secret.txt) "hostname" | md5sum


How to completely prevent bufferoverflows in networking software?

It depends on what you call buffer overflow.

It is possible and easy to make software which never writes outside of a buffer. All it takes is a programming language which checks array bounds, e.g. Python, Java, C#, VB, Pascal, Ruby... in fact almost any language except C, C++, Forth and Assembly. In a language which checks array bounds, any attempt at overflowing a buffer triggers an error condition (e.g. an exception is thrown) which prevents the unwanted memory write.

It is difficult to make software which never attempts at writing outside a buffer. The bounds checking prevents the buffer from truly overflowing, but the code is still trying to do something which does not make sense, and that's a bug. Not allowing the write to happen is good, but the thread/process still crashes (it turns a remote shell exploit into a denial of service, which is better, but not good). Writing bug-free code is theoretically feasible, but it never happens in practice (the only application which is reputed truly bug-free is Knuth's Metafont).

There are a lot of people who work on the concept of proving correctness of code. In a rather strong sense (see the halting problem), it is not possible to make a generic correctness prover, but one can hope that a few hints added in the source code could help an automatic prover. This means using some specific languages which allow for this sort of things to happen (e.g. Esterel or Eiffel). As far as I know, a programmer who thinks a lot is still needed in the process. It has been said that NASA pays quite a lot for having software without bugs (I heard around 20000$ per line of code !) and yet this is not guaranteed (when Apollo 11 landed on the Moon, the on-board computer crashed, and Armstrong had to do the landing manually, in true Hollywood fashion).


One year later, is Heartbleed still something the end-user needs to be careful against?

A quick Google search returns a few articles discussing Heartbleed one year after the announcement.

Fortune magazine on April 7 2015 cites a report saying that 74% of the Fortune 2000 have still not patched.

So, yes, this is still a problem.


JS challenge based on computational complexity

An attacker can generate a token randomly without spending any resources on your computation. Thus it will not prevent attackers from brute-forcing.
For simplicity, suppose your tokens consist of 4 alphanumeric characters. An attacker will not waste time computing your algorithm and will instead generate all possible tokens directly: 0000, 0001, ..., 000a, ..., 000z, 0010, 0011, ..., 001a, ..., 001z, ..., 002z, ..., zzzz, ..., ZZZZ.
If you have longer tokens, the approach remains the same. You cannot force the attacker use your algorithm.
There can be many solutions for your problem. For instance:

You can generate tokens randomly and they should be long enough. Formally, make sure they have entropy 90 - 100 bits. If you use 64-characters set, then tokens should consist of 16 or more characters. You can store tokens in the database. Validation would mean checking if the token is available in the database and if it is not expired. Brute-forcing such long tokens will take much resources and a lot of time.
You can use signed tokens. E.g. use JWT. Then you don't need database. When you receive a token, first check signature. If invalid, then just ignore the request.


GPG offers symetric encryption of single files which can be integrated with most file managers.

Ususally this works in some way where you right click on a file and select "encrypt" from a context menu. This is common with dolphin and nautilus and there is probably some solution to do this in windows explorer as well.

Alternatively there are encryption layers for file systems. In GNU/Linux for example you could use fuse encfs, to have a folder encrypted. You can set up your dropbox client to only sync the encrypted folder while working on the mounted unencripted representation.

Even easier: encfs offers a reverse view: you can take an unencrypted folder and mount it to folder which then contains a virtual, encrypted representation of the files. Have this crypto view synced via dropbox and you wouldn't even change your workflow.


How can you sniff packets from a switch?

From this site

  You generally need to use your switches monitor mode which can dedicate a port to connect your (Wireshark) capturing device. It's sometimes called 'port mirroring' or 'port monitoring'.


How to study for cyber security basic level exam?

The best thing to studying for any exam is to find the exam outline. These are the topic areas that are to be covered in the exam. Sometimes known as the Common Body of Knowledge (CBK) or Domains.

Failing that buy a book on the exam and good luck. Without knowning the exam I can't be anymore detailed.


How can I detect a MITM when the communication partner is in on it?

If your communication partner is on the same team as the MitM, it's no longer a MithM.  There is no secret your partner could know that they couldn't share with the MitM.  Similarly, you have no way to prevent your partner from simply relaying the information after you exchange it.  If your partner can read it, they can pass the information to the MitM after the fact.

This is why trust is important in secure communications.  When you are talking to another system, you have to have trust in who you are talking to and how they will behave with it.  There are many different ways to attempt to establish trust, but it's fundamentally on you to decide if a communication is secure enough or not based on what trust information is available.


To respond directly to your questions:

  do i need some kind of auto ban ip system?
  failed login ip banning & logging?

Yes, don't try to reinvent anything and use fail2ban (just a good regex expression and you are protected.)

  any linux-server security modifications? i did not modify anything yet

I would recommend selinux with domains and all that stuff, but is pretty hard. A good firewall, tcpwrappers and updates should be enough.

  how do i protect my website from all spam bots/spiders? identify&ban

Captcha as system is ok.
Check referrer
Use javascript before submitting.
https://stackoverflow.com/questions/677419/how-to-detect-search-engine-bots-with-php

As checklist I recommend you OWASP top 10 (https://www.owasp.org/index.php/Top_10_2013-Top_10).
If you want more details get OWASP Cheatsheets Book: https://www.owasp.org/images/9/9a/OWASP_Cheatsheets_Book.pdf

Regarding security options on server side I also recommend:

WAF (mod_security + OWASP rule set) will be essential on your web app.
Chroot Webserver.
Hide webserver Signature
Disable Directory Listing
Use mod_evasive (agains DOS)
Turn off Server Side Includes and CGI Execution if you don't use them.
Uninstall everything what is not necessary.
Force yourself and do not install anything from sources, it will be harder to upgrade.

Good luck.


How to securely share files with other individuals?

I have a collection of files I would like to securely share with a small number of other people.

Are the other people remote?  If they are in your office, the cheapest and most secure way is to go low tech.  Physically secure the machine; keep it off any network; and allow physical access only to the keyboard/mouse/screen.

That's the only way you are going to achieve all of those things.  If multiple people need access at the same time, you need multiple kiosks in the secure room.


Is the same key used for Authorization and Encryption? (SSH Tunnel)

TL;DR: In SSH your private key is not used for encryption at all, it's only used to prove who you are. Each new connection to the server will establish a different encryption session key.

Here are some good primers on how the SSH handshake works:

Understanding the SSH Encryption and Connection Process
How does SSH Work

  I also know think that SSH encrypts data using private and public keys.

Actually, the public and private key are only used for the authentication part of the SSH handshake, not for the encryption part. From those articles, the SSH handshake comes in two steps:

Set up encryption: Use Diffie-Hellman to establish a shared encryption key that both the client and server know, but someone eavesdropping can't know.
Authentication: both client and server use their public keys and private keys to prove that they are who they say they are.

  Authentication occurs by using the -i and specifying an included private key. The idea of this is to ensure that all traffic is encrypted.

How did you jump from authentication to encryption? Your traffic will be encrypted even if you use password-based authentication because authentication and encryption are unrelated parts of the SSH handshake.

  I am am afraid that by all clients having the same private key they may be able to decrypt traffic from other clients

Each new connection to the server will establish a different session key using the Diffie-Hellman key exchange method. This is independent of your private key. To the best of my knowledge, each session is totally isolated from the others, even if they are for the same user or use the same private key.


Claims based authentication to log on to a device

I don't think you're going to find anything substantial. Windows 10 supports auth via Azure AD which supports a federated IdP via WS-Trust.

Chrome OS supports google accounts, which can be backed by a SAML IdP.

In either case they have special implementations that rely on username/password combinations.


In case of TOTP code generation, why do products prefer a generic authenticator apps, such as Google Authenticator?

In my opinion you are essentially asking why developers rely on existing and established apps instead of inventing their own? There are many reasons for this, like

crypto is hard so better use something proven
shorter time to market
less development costs
maybe these apps are already familiar to the end user, i.e. less friction for the user and less support costs for the developer


Is D parameter of the RSA strong enough to be used as secret for HMAC calculation?

Do not do this. No, it's not ok.

What you're looking for is to protect the integrity of some message. You would like to use HMAC, which is the correct algorithm. The question is: how to link up RSA and HMAC and all messages.

You should use standard Public Key Signing.

Generate a random HMAC Key (size is the same as the size of the hash used for HMAC).
Compute HMAC(Message,Key_HMAC).
Compute Sign(HMAC,Key_RSA).

Package Message||Key_HMAC||Signature and distribute as needed.

To check integrity, recompute HMAC and verify signature over it.

Every server sharing the same self signed Signing certificate is OK. Or, you could create a root certificate and provision four Signing certificates each signed by the root cert, one per server. If you properly sign the message and package it in a PKCS envelope, the server that signed it will package it's certificate with the signature and each server can separately verify the signature as it trusts the root of the attached certificate. This may take up a lot of space (PKI signature can be large) per signed message.


How does the WhatsApp chat history recovery work together with their encryption mechanism?

WhatsApp includes a feature to explicitely cope with users losing their phones or the phones being broken. That feature is discussed in a article from the Guardian where it is seen as a back door:

WhatsApp has the ability to force the generation of new encryption keys for offline users, unbeknown to the sender and recipient of the messages, and to make the sender re-encrypt messages with new keys and send them again for any messages that have not been marked as delivered.
The recipient is not made aware of this change in encryption, while the sender is only notified if they have opted-in to encryption warnings in settings, and only after the messages have been re-sent. This re-encryption and rebroadcasting of previously undelivered messages effectively allows WhatsApp to intercept and read some users’ messages.
[Whatsapp justifies that to cope when] a contact’s security code has changed. We know the most common reasons this happens are because someone has switched phones or reinstalled WhatsApp. This is because in many parts of the world, people frequently change devices and Sim cards. In these situations, we want to make sure people’s messages are delivered, not lost in transit.

That indeed allows you to recover your chat history in your new phone without any access to the old key. But that also mean that it is easier to steal WhatsApp exchange that end to end encryption should allow. And it also means that WhatsApp can actually give the full history to legal authorities if they were asked to, simply by simulating a new device...


Is asymmetric encryption is safe on the Internet? Can't a hacker just pose as a valid user?

If you don't have prior knowledge of the keys, and no secure channel or other means for verifying keys, then it of course breaks down in the face of an attacker who can modify messages.

But. We have certificate authorities on the internet that we trust. We trust that they only issue a key for the domain example.org to the entity that can demonstrate control over example.org in some way.

The keys of those certificate authorities is embedded in many pieces of modern software, e.g. Firefox, Windows, Linux distributions, Java and so forth. The certificate used by example.org will be signed by the CA, making it impossible to fake it. As the certificate of the CA is pre-distributed, it can't be intercepted by a trivial MiTM-attack.

In organizations, a private Public Key Infrastructure may be configured, so that the organization can issue key material them self, and configure trust more flexibly than by relying on external trust agencies.

Software such as GPG relies not on central agencies, but rather a web of trust. I may know Bob, so I meet him and sign his key with mine. You may know Alice, who knows me, and also as signed my key. This way you can establish trust to a key you acquired over an insecure channel.

For private citizens, you can verify a key by e.g. phoning the person, and checking that the fingerprint is equal to what it should be. The finger print is not secret, so it does not matter if anyone listens in on this conversation; they will learn naught, but it will allow you to verify the key.


MS-Cache is a pretty simple format - it's an MD4 hash of the password, followed by the username in lower case, and hashed together MD4( MD4(Unicode(password)) + Unicode(tolower(username)) ). I'm not sure of the technical difference between MS-Cache and v2; but nothing I can find suggests they're not susceptible to a RainbowTable attack (in fact, Cain & Abel seems to have support for MS-Cache and MS-Cache v2 tables - "Added MSCACHE v2 Hashes Cryptanalysis via Sorted Rainbow Tables" in v4.9.4).

The MS-Cache credentials are not stored on the domain controller (except for users that logon to it directly) - they are stored as MD4 hashes of the passwords, related to the username. You may be interested in this technet piece about how they're hadled.

Regarding GPU accelleration, it looks like John the Ripper has MD4 support; that may be what you're after. Otherwise there is this article on attacking Windows passwords with the GPU (specifically, you may be able to adapt ighashgpu for your purposes) and, as mentioned by Lucas in the comments below; rcracki_mt has GPU support.

[Update]

MS-Cache v2 is described in detail (with code) at openwall.info, and importantly PassLib mentions it's also known as 'DCC2', which may help with future searches (though info is frustratingly scant). As for attacks against it, from openwall:

  In other words, incremental brute-force attacking for different search spaces, depending on the character set and the password length, will take ages. So it is a good idea to do some intelligent password guessing when attacking DCC2 hashes, i.e. rule-based dictionary and probabilistic attacks.

With that python module and PassLib you should be able to put together something involving PyCUDA and PassLib, but it doesn't look like it's been done by anyone before.


How to intercept and replace request URL through Burp Proxy?

There is a sample extension to do this. Here is the description:

This extension demonstrates how to redirect outgoing HTTP requests from one host to another. This task might arise, for example, if you have mapped out an application which then moves to a different staging URL. By simply redirecting traffic to the new hostname, you can continue to drive your testing from the original site map.
The extension works as follows:

It registers itself as an HTTP listener.
For outgoing request messages, it retrieves the HTTP service for the request.
If the HTTP service host matches the "from" host, it uses a helper method to build a new HTTP service using the "to" host, and other details unchanged.
It updates the HTTP request with the new HTTP service.

Note: The sample code uses "host1.example.org" and "host2.example.org" as the "from" and "to" hostnames. You should edit the code to use your own hostnames before using it.


Does CVE-2020-0601 (CRYPT32.DLL critical exploit) affect Windows 7 and is there a patch to fix it?

After seeing multiple answers with mixed conclusions here and in Google searches, as well as no thorough explanations on whether or not Windows 7 is effected by this vulnerability, I took it upon myself to determine the true answer and show my testing process.

Below are screenshots of a fresh Windows 10 installation in a Virtual Machine(VM) within which I use a website (https://curveballtest.com/) that has Proof-Of-Concepts(PoC) available for this vulnerability, this is a control to prove this is working.

Windows 10

Information about the Windows 10 installation.

Showing the https://curveballtest.com/ PoC for spoofing certificates for HTTPS working on the Windows 10 installation.

Showing the https://curveballtest.com/ PoC for spoofing signing for an executable working on the Windows 10 installation.

Now I have also created a fresh Windows 7 installation in a VM, below are the results for the https://curveballtest.com/ PoCs.

Windows 7

Information about the Windows 7 installation.

Showing the https://curveballtest.com/ PoC for spoofing certificates for HTTPS NOT working on the Windows 7 installation.

Showing the https://curveballtest.com/ PoC for spoofing signing for an executable NOT working on the Windows 7 installation.

From this testing, we can effectively conclude that Windows 7 is NOT vulnerable to CVE-2020-0601.


Why windows 7 ulitmate can't run exe file? Facing NTVDM CPU error?

NTVDM is a virtual environment set up for executing 16-bit programs.  This was probably compiled/created incorrectly, or screwed up during transfer.


This really boils down to how much programming knowledge that you have as well as whether or not you want to host this onto a database and / or whether you want to to store them into a file, costs may vary with this.
There is, an alternative with using Google spreadsheets and that you can tick the option "Do not capture email addresses" .. This should allow you to do the anonymous entries acceptable. Source: Google - Answers
They basically state that:

You have created the form in Google Apps for your company domain. You should have unchecked the option that e-mail addresses should be captured.
See 1, i.e. "If you use Google Apps, you can choose to record the email addresses of people who fill out your form. To do this, select the checkbox next to 'Automatically collect respondent's yourdomain.com username' while you create the form. Survey recipients will see a message at the top of the form explaining that their username will be collected automatically."

For the duplicate entries, you can use the following formular: =countif(A:A,A1)>1 source: highlight cell if value duplicate in same column for google spreadsheet
This will then hightlight all of the entries that contain duplicate values.
I hope this helps you.
EDIT:
You are probably better to use a database for this task. This could be fairly simple, providing that you have a domain of some sort and just host it on a single page. Essentially, what would happen is:

You would ideally create a single form on a page, asking for the persons
username that they want to vote for.
If you wanted to capture the name of the user, you can, you can also check
for duplicate entries using a small sql query and then ignore any entries
that were made.
At the end of the process, run queries, this can be used to select counts,
distincts etc..

ANOTHER APPROACH:
Carry on using the methods that have been described, through Google Forms / Spreadsheet. At the end of the process, download the data that you have collected into a CSV form, create a local database (sql, mongoDB etc..), import the data into the database and then perform your queries. This will save you time AND if you are tracking their usernames will also allow you to perform distinct queries etc.. This would essentially solve a lot of your problems and make this process more efficient.


Is WPA2 TKIP+AES with WPS disabled and strong keys secure? What about WPA2 Enterprise against a RADIUS server?

Disable weak/legacy encryption: WEP, WPA, and WPA2-PSK-TKIP.
Especially, WPA2-PSK-TKIP is oftentimes enabled by default. TKIP
(Temporal Key Integrity Protocol) uses insecure RC4 for encryption!
It was an interim solution to replace WEP and was deprecated more
than five years ago.
Enable strong encryption only: WPA2-PSK-CCMP.
CCMP (Counter-Mode/CBC-MAC Protocol) is sometimes called
“WPA2-Personal” or “WPA2-AES”.

Derived from https://infosec-handbook.eu/blog/hns1-hello-world/

So, WPA2-AES is secure (do not use TKIP). WPA2 Enterprise uses different technologies/protocols. In general, it is also secure.


... if an XMLHttpRequest should send cookies, the withcredentials-flag has to be set. And even then, the target server has to implement a CORS header for the request to be successful. ...  which browsers already implement those counter measures and if they are enough as defense or if we still have to implement CSRF mitigations in our applications.

CORS for XHR is not a new mitigation and it even isn't a mitigation against previously working attacks at all. When XMLHttpRequest was designed no cross-origin requests were possible at all. And only with the introduction of CORS this restrictions was changed and replaced with cross-origin requests controlled by a CORS policy. Thus, all the old browsers which did not implement CORS were not affected by CSRF via XHR in the first place.

Nevertheless, CSRF is still a problem and can still be used the same way as it could in the past. XHR is not needed as a vector for CSRF attacks at all and it did not work in the past anyway. Instead cross-site image includes, cross-site form submits or similar can be used, which still automatically send the necessary credentials and cookies cross-site.  The new samesite attribute for cookies can be used to prevent this but it has to be explicitly set by the application and not all browsers support it yet.

Therefore proper CSRF protection is still needed today.

What happens if CSRF protection is not properly implement can be seen for example by recent news like Hackers Launching Massive Cyber Attack Against 800,000 DrayTek Routers by Exploiting zero-day Vulnerability.


Yes they exist (like this Russian one uefilog on github
Also Hardware key loggers would capture this information.
And in theory one could implement an hardware keylogger in the BIOS itself.

How likely they are is a different matter. in most cases its easier to capture this information through other means. (side-channel, social engineering, Hardware key-logger, etc).

But this is one of the use-cases for Smart-card readers with separated numbered keyboard .


Can a Trojan hide itself, so its activity doesn't appear in task manager process?

Yes. There are a number of ways:

Directly patch Task Manager's process at runtime so that its enumeration code skips over your process.
Run "processless", by loading a DLL into a process (e.g. via AppInit_DLLs) or injecting code into process memory and starting a thread (via VirtualAllocEx / WriteProcessMemory / CreateRemoteThread).
Hook the Process32First / Process32Next functions in every process (incl. task manager) to "skip" your process when the enumeration is performed.
Hook CreateToolhelp32Snapshot so that the mapped section's memory (see here for how snapshots work) is modified ahead of time, so that Process32First / Process32Next end up reading from fake data.
Hook ntdll.dll!NtQuerySystemInformation and, if SystemProcessInformation is passed, patch the results to skip over your process. This is a lower level hook than the above calls.
Load a kernel-mode driver which hooks the kernel-mode handler for SystemProcessInformation queries. I don't know the real name for this in Windows (it's not documented) but essentially there's a table of handlers which NtQuerySystemInformation looks through for this purpose, and you just have to hook the right one.  Here's the ReactOS implementation of the actual handler. In this you'd just mess with the returned structs so that your process isn't shown.
Hook the SSDT to catch  the transition between user-mode and kernel-mode for when various process enumeration APIs are called.
Use Direct Kernel Object Manipulation (DKOM) to modify the EPROCESS structures in memory so that your process is hidden from the kernel entirely. The kernel maintains a circularly linked list of structures which represent all running processes, with FLink and BLink fields as forward and backward pointers respectively. By manipulating those pointers to jump over your process, then manipulating your process' pointers to go back to themselves, the kernel will skip over your process during enumeration. This is a common rootkit technique.


Security Implications of a ssh proxy vs ssh tunnel via a box I don't own

There is no difference between those two methods as far as security is concerned.

In both cases, you first establish a connection between your current computer and the ssh proxy and then tunnel another connexion to your desktop or cluster inside the original connexion.

If you don't trust the intermediary server, your main concern should be to make sure that you're actually connecting to the real computers at the end and that your connection has not been tampered with by the ssh proxy.

To check this, you should compare the ssh host key fingerprints from your desktop and cluster computers to the one you accepted in your ~/.ssh/known_hosts file. If there is a mismatch, you ssh sessions have been intercepted (MITM) since the very beginning.

This is a perfect example of the importance of the often undervalued question asked upon a first ssh connexion:

The authenticity of host 'example.com (192.168.0.1)' can't be established.
RSA key fingerprint is xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
Are you sure you want to continue connecting (yes/no)?


You are correct. Under normal conditions, simply putting a link on a page is insufficient to hack that page. It may be a problem to put a malicious link on an insecure website, if said link is specially crafted to exploit a bug like XSS, but that is not an issue if you simply put your link on her page.


First, determine which variant of ransomeware you've been hit by. Depending on which one, you may have more options.

As @Ohnana has said generally ransomware operators are true to their word, it's in their interest after all. If it became known that certain groups never allowed data to be decrypted, they'd stop getting money from their victims.

That being said I'd suggest that it is important before you pay to try and establish which variant you've become a victim of. There's freely available decryption tools for several variants, and there's at least one documented variant which contains a bug which makes decryption impossible.

Once you've established which variant you have you will be able to quickly research what you can expect the decryption process to be, and if you can do it using a free tool rather than by paying the ransomware operator.


Issuing certificates to two departments from same ROOT CA so one does not trust the other

It might be least-problematic to set up a new root CA for Department-New for dev work. On their machines install both root certs (rootCA-general and rootCA-dev) into the trust store, on everybody else's machines only install rootCA-general.


How to replace a constant identifier, for a resource on a network, with a variable one?

All modern authentication systems assume at the basic level that the client holds some type of information that can be used to prove it’s identity and that information should be kept secret. That could be a user name, password, public/private key pair, etc...

If that information is compromised then the authentication chain is broken and the secret needs to be changed.

In your questions and comments you mention that the client is completely subverted which basically rules out an authentication system and that user interaction is not possible. Obviously this is no small matter and could be made much harder with other layers of protection to prevent the host from being compromised in the first place.

However assuming the client is completely compromised the question is not how you implement an authentication system but how you perform integrity verification of the client. This could be achieved through behavioural analysis more specifically in the realm of Intrusion Prevention/Detection. If you can’t trust the client then use of an endpoint agent on the client would not be an option and your detection method would need to be completely external from the client.

This leaves you with possibly two options that I can think of:

Network based Intrusion Prevention to quarantine suspicious clients from the network.
Hypervisor based protection such as VMware’s vmSafe API (vmSafe) which allows out-of-box inspection of a client. Which means that you can hook into an API that allows you to inspect what is running on the CPU and in memory without being inside the attack surface and vulnerable to an attack. In this case protection for root kit and virus detection is already available.

In both cases your exact requirements may not be met, it is unclear your exact intent however it is possible. However these solution would still be used with an authentication system on the client, just used to help detect if the client is compromised.

Hope that helps, if not perhaps you can give some specifics on the exact implementation.


Is there any security threat due to advertisements?

You've probably downloaded and installed a piece of adware like the Social Search Toolbar or something similar. Such adware are known to force install certain browser addons/extensions/plugins that inject advertisement boxes and/or popups into the webpages you visit.

The good news is that the vast majority of those adware aren't really sophisticated and can be easily removed. Go to your browser's addon's page and try to find anything suspicious then copy the name and try to find removal instructions on Google. For example, there are tens of results on how to remove the Social Search Toolbar.


Any value in a web-server closing connections on bad requests (or bad pages)?

The value is in avoiding having higher-level application software (php, wordpress, whatever) work with and possibly mishandle malformed requests.  Since the nginx layer is evaluating for protocol correctness, and not attempting to actually do anything with the request, it's providing a pre-filter.

Terminating the connection abruptly doesn't win you much.  It tells the attacker what defensive system you're using, and the same means would be achieved with a generic 404 response with less usefulness to the attacker.  But it's the sort of dramatic security theater that crops up now and again, and it doesn't do any real harm to anyone.


Can an empty uploaded file cause any security issues?

I would say it's just security in depth. There are probably no reasons to accept an empty files and this could potentially lead to unexpected behaviors and security  issues.


When the software is popular, security-relevant and open source (like Veracrypt), then there will often be people who will audit it and report vulnerabilities. VeraCrypt is based on TrueCrypt 7.1, which got a comprehensive audit a while ago. Many open source projects also got public bugtrackers where known bugs are reported.

But when you download your copy of the program from an untrusted mirror, you can not be sure that it is compiled from the original sourcedcode. That's why many projects publish cryptographic checksums or PGP signatures to verify that the files served by the mirrors are identical to the official builds. When you look at the download site from VeraCrypt, for example, you will notice that they have a public PGP key and a PGP signature for each of their downloads. You can use GnuPG to verify these files.

But when the sourcecode of a software is not available, then all proof you have that it does not have vulnerabilities (whether intentional or unintentional) is the word of the developer (and maybe that of any 3rd parties they gave the sourcecode to for review). That's why some security professionals do not recommend to use closed source security products.


Secure data storage using password derived key. How to deal with lost password?

Hard to tell how exactly you are encrypting things. In the exact situation you've described user's data is lost and nothing can be done.

However, if you are doing the whole scenario (mind you, there are many pitfalls, and it's easy to devise something that only appears secure), you have some options/

One possible scenario is that the user data is encrypted using a random key. This random key is then encrypted using password-derived key.

Good things about this schema:

When user changes password you don't have to re-encrypt all of his data, only the encrypted key, so password changing can finish in a reasonable time.
You can have several 'slots', each one containing the actual encryption key encrypted by something different - user password, some master password, whatever, use your imagination.

Bad things:

It's much easier steal the encrypted slot, mount an off-line password crack, and then return with known key and steal all data.
You have to be extra careful when disposing of a key - if you 'forget' the password, but not completely wipe data from slot, it remains open for password cracking.
Your master password/key/whatever is a much better target than user's individual passwords - after all you'll probably have one master password, that can unlock all users' data.
You subvert trust in your system - previously only user had access to his data, now the administrator has it as well.


SQL injection on PostgreSQL in integer field?

It's not an SQL injection, and shouldn't be directly exploitable as one, since you've used a named parameter (:sendTo) instead of directly concatenating strings.

However, it is indeed exploitable, because an attacker can simply change the ID number and cause your server to spam other accounts with emails.

Also, cases like this one, where the client sends the wrong type of input, will trigger informative error messages; an attacker now knows that you're running PostgreSQL, for example.

Generally, passing input directly to SQL queries without validating it is a very risky practice.


I'd say that the off pocket isn't any better than powering down your phone and in terms of usability it's possibly worse, as some phones will run their batteries down quicker when out of coverage.

Oddly given their target marketing the best use I can think of for this is for law enforcement to use it when acquiring mobile phones for forensic review as it stops remote wipe while not powering them down which could lose valuable information.


OAuth is a delegation protocol that helps with authorization decisions (source). In fact, it doesn't really provide authentication, and it likely doesn't know or care whether you are still authenticated or not at the identity provider (Facebook).

If you look into how OAuth works, all that really happens is that an access token is generated by the identity provider, and is given to the client website (GitLab). This token will have authorization to access the Facebook Graph API on your behalf. Once GitLab has pulled the necessary information from the API, it doesn't really need to access it anymore. Thus, GitLab doesn't keep checking whether or not you are still logged into Facebook. The token itself is probably still valid as well until it expires.

TL;DR: Facebook Connect (which uses OAuth) grants GitLab access to query information about the user from Facebook. GitLab uses this to identify the user and that's it.


Confusing about Ephemeral Diffie-Hellman

Presumably, this is a follow-up of your previous question.

EDH differs from static DH in that static DH always uses the same DH keys.
In contrast, when using EDH, keys are temporary and re-generated every time (or their re-use should be avoided, at least).

EDH doesn't provide authentication on its own, but the fact that the server signs the content of its server key exchange message which contains "a Diffie-Hellman public key with which the client can complete a key exchange (with the result being the premaster secret)" implies that this DH public key is authenticated by this signature.

This is described in TLS 1.1 Section F.1.1.3:

  When Diffie-Hellman key exchange is used, the server can either
  supply a certificate containing fixed Diffie-Hellman parameters or
  use the server key exchange message to send a set of temporary
  Diffie-Hellman parameters signed with a DSS or RSA certificate.
  Temporary parameters are hashed with the hello.random values before
  signing to ensure that attackers do not replay old parameters.  In
  either case, the client can verify the certificate or signature to
  ensure that the parameters belong to the server.


Basically, you should use the option -tamper and use the tamper scripts. However, please consult the command line helper, or visit the SQLmap wiki page.


Does one need to be a good programmer to perform secure source code analysis?

It depends on what is meant by "secure source code analysis."  One can do anything one pleases.  The issue, I presume, is when someone else has asked for something called "secure source code analysis," and one wonders why one is not qualified for it.

In many cases, such analysis must be done by a Subject Matter Expert (SME).  In the final product, a SME will deliver a statement basically saying "I declare this code to be secure," with an understanding that is a more profound statement than "I looked for a bunch of known patterns, and found no problems."

If you were interested in the authentic translation of a Chinese philosophy, would you trust an individual who knew a great deal about philosophy, and had a bunch of cheat sheets to help decipher it, but did not actually know Chinese?

One great example that comes to mind is a bug that hit a SQL engine.  Forgive me for not having the name of which engine, or which version so you can verify, I have had trouble finding it since.  However, the error was poignant.   The error was in code that looked like this:

int storeDataInCircularBuffer(Buffer* dest, const char* src, size_t length)
{
    if (dest->putPtr + length < dest->putPtr)
        return ERROR; // prevent buffer overflow caused by overflow
    if (dest->putPtr + length > dest->endPtr) {
        ... // write the data in two parts
        return OK;
    } else {
        ... // write the data in one part
        return OK;
    }
}

This code was intended to be part of a circular buffer.  In a circular buffer when you reach the end of the buffer, you wrap around.  Sometimes this forces you to break the incoming message into two parts, which is okay.  However, in this SQL program, they were concerned with the case where length could be large enough to cause dest->putPtr + length to overflow, creating an opportunity for a buffer overflow because the next check wouldn't work right.  So they put in a test: if (dest->putPtr + length < dest->putPtr).  Their logic was that the only way this statement could ever be true is if an overflow occurred, thus we catch the overflow.

This created a security hole that actually got exploited, and had to be patched.  Why?  Well, unbeknownst to the original author, the C++ spec declares that overflow of a pointer is undefined behavior, meaning the compiler can do anything it wants.  As it so happened, when the original author tested it, gcc actually emitted the correct code.  However, a few versions later, gcc did have optimizations to leverage this.  It saw that there was no defined behavior where that if statement could pass its test, and optimized it out!

Thus, for a few versions, people had SQL servers which had an exploit, even though the code had explicit checks to prevent said exploit!

Fundamentally programming languages are very powerful tools that can bite the developer with ease.  Analyzing whether this will occur does require a solid foundation in the language in question.

(Edit: Greg Bacon was great enough to dig up a CERT warning on this: Vulnerability Note VU#162289 C compilers may silently discard some wraparound checks., and also this related one.  Thanks Greg!)


How do I decrypt an Adobe Triple DES ECB-mode encrypted password?

The encryption key was never published and triple DES itself is strong enough to not brute force, so you have to use some of the other mistakes to attempt to recover your password.

Your options are: exploit the fact that they used ECB and use the hints.

To do this you will find your encrypted password and see if other users had the same block. For example, say your encrypted password blocks were (shortened for simplicity): 87bef a31cd and you find another user that had 87bef 37cfe you know that the first 8 characters (since DES blocksize is 8 bytes) of your password are the same as the first 8 of the other user. Then you can use their hint to help figure your password out. Same process applies to subsequent blocks.


What you are witnessing is probably a mitigation for a common vulnerability, OWASP 2013 A10, Unvalidated Redirects and Forwards.

If the application simply redirected to the URL found in the JSON, verbatim, you'd have a problem.  Basically anyone who tampers with that JSON could send your browser anywhere they want.  This is called an unvalidated redirect.

But the application doesn't do that.  Instead, it redirects to a handler within the RootServerOfApplication.com domain, passing the URL from the JSON document as an argument.

Presumably, RootServerOfApplication.com/NameOfAplication takes a look at the URL and ensures it is valid (e.g. maybe it makes sure the domain is in a white list, one that presumbly includes cloud.com).  This mechanism would prevent it from forwarding an end user to myevilurl.org.

You should check it out.  Try pasting https://RootServerOfApplication.com/NameOfApplication/^^The URL above with https instead of http%73^^ directly into your browser and see where it takes you.


How to not use database identifiers in a URL in the context of a REST API

The answer is not far away, you need an Id to extract the user, however, the Id would be an UUID instead of running number which can easily be pooled.
You can easily use code libraries to generate the UUID for your continence.


Effect of Source Code Leakage of a security suite on security

There is possibly a short term raised threat potential, as you can guarantee attackers will be trawling through the code to find weaknesses, however there will also be a number of white hats doing the same, as well as code review teams from organisations that use Kaspersky, so issues may well be found, but the end result is likely to be a more secure codebase than might otherwise have been the case.

Many eyes, and all that.

The relative risk is difficult to estimate though, because it is a high likelihood that attackers have already been reverse engineering and disecting AV code anyway - so in this case the addition of the good guys to the review pool could skey the risk downwards.


Can DD on its own be used to acquire a hard drive?

The most important part of the forensic investigation is to prove beyond a doubt the integrity of your evidence.

A good way to do this is to compare the hash of the acquired disk image against the hash of the original disk which should have been taken when the disk is recovered from the crime scene. Said hash should most probably be on the chain of custody form.

If a hardware write blocker cannot be used, I would suggest booting the system in question into a live Linux CD that mounts the disk in read-only mode. A forensics live CD like Helix can do this automatically.

Instead of using the standard dd tool, I would suggest dcfldd, a version of dd specifically for forensics use. It has a bunch of features useful for forensics investigation that the standard dd tool does not, such as on-the-fly hashing.


Is there any reason to allow Python fetches of my Web server's pages?

You have a Web site; it is meant to provide pages to whoever asks for them. That's the whole point of a Web site. What sense would it make to refuse to send the page to some people ? Especially if the exclusion criterion is the User-Agent string, which is freely chosen by the client. Any individual with nefarious intentions can masquerade his software so that it would appear, on your side, as a basic Internet Explorer or Chrome or whatever; even if it was sensible to exclude HTTP clients which happen to be written in Python, filtering on the User-Agent would simply reject clients who are honest enough to admit using Python as their programming language.

It is plausible that this specific client is some sort of Web crawler. You cannot really prevent Web crawlers from slurping the data from your Web site, as long as you allow browsing from unauthenticated users, though you can install some mitigation measures against systematic site-wide download (that's what Google does, for Google Maps: if they see too many requests from a given client within a given time frame, they suspect foul play). You can document your unwillingness to see your site inspected by Web crawlers, with a robots.txt file; most crawlers honour that file. But this won't stop any determined crawler. Best course of action is to:

either implement and deploy authentication procedures, refusing access to people who have not been duly authenticated with, e.g., a user name or password;
or accept that public data is public, and there is no such thing as "public except for evil people".


What happens if my private key gets stolen in the web of trust?

You can publish the revocation certificate. Ideally, you should've generated a revocation certificate while you generated the key pair, so that you can still revoke even if you later lose access to the private key. If not, you can generate the revocation certificate as long as you have access to the private key.

When you publish a revocation certificate, your users have to download the revocation certificate before they'd notice that your key should no longer be trusted. They can do this by syncing their keyring with the key server where you've published your revocation certificate.


Is a rand from glibc's rand secure for a login key?

No. The PRNG in typical C libraries is designed for speed, not for security. It's usually appropriate for numerical simulations and games (in good-quality implementations — there are implementations out there, mostly old ones, where it's not appropriate for anything), but not for cryptography. A cryptographic PRNG must be unpredictable, i.e. an attacker who generates a series of numbers must not be able to make a good guess at the next number. The typical C library PRNG strives for speed and good statistical properties but not for unpredictability.

As of Glibc 2.7, rand and friends use a linear congruential PRNG or a linear feedback shift register depending on the available seed length.

To generate key material or any other random number involved in cryptography (including non-secret things like nonces that nonetheless need to be unpredictable), obtain all bits from a crypto-quality RNG. Linux's /dev/urandom (or any other unix that has /dev/urandom) is fine for that. You must use it for each byte of each key; using it as a seed of the C library PRNG is not good (there would be a strong correlation between the keys). A library such as OpenSSL is another choice; it'll probably use /dev/urandom under the hood as a seed but may be a little faster if you're generating large volumes of random data.


Using a pen drive + secure certificate instead of sudo passwords

When you talk about a pen drive and certificate based authentication, you probably want two-factor-authentication (2FA). This means that you do not use the pen drive instead of the password but in addition to the password. If I understood your question correctly, you are not doing this for usability but for added security, therefore 2FA is the way to go.

It is possible to configure sudo with 2FA - e.g. there is a guide for a Yubikey implementation. This is just an example, as the configuration will depend on the actual hardware you are using. Any FIDO/U2F device that's supported by your OS can be used.

For the sake of completeness, you actually can configure sudo to work without a password, just using the pen drive, but I would not recommend this from a security perspective. Both options are shown in chapter 4.a) and 4.b) respectively in this guide for Fedora.


Running a brief asm script inline for dynamic analysis

Is there a reason you can't just study the code? 30 lines of ASM should be easy to understand. Just add comments explaining what each line does, and you'll understand it in no time. This will be even easier given how quickly you can look up exactly what an individual instruction does.
Although I would agree that it is unlikely to be capable of doing anything dangerous on its own with only a single syscall, you should never underestimate the ingenuity some developers can have. It is perfectly possible to design shellcode to trick a disassembler into showing you code which is not actually there, as DEF CON talk a few years ago pointed out. 30 lines of x86 assembly is plenty for a stage 1 payload.
Chances are it's completely harmless. I wouldn't bet my life on it, though.

You can use seccomp on Linux to isolate it. Seccomp is a Linux feature which filters system calls. There are two modes for seccomp, mode 1 and mode 2. Seccomp mode 1 is the most strict mode. When a program enables this mode, it is limited to using only four hardcoded syscalls: read(), write(), exit(), and rt_sigreturn(). Mode 2 is more complex, and uses a userspace-generated eBPF filter to specify a custom whitelist of syscalls and syscall arguments. For a very simple piece of shellcode, you would only need mode 1.
Activating mode 1 seccomp is simple. Taken from another answer I wrote on another StackExchange site, a sample program that securely executes a function that returns 42 in bytecode:
#include <unistd.h>
#include <stdint.h>
#include <stdio.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <linux/seccomp.h>

/* "mov al,42; ret" aka "return 42" */
static const unsigned char code[] = "\xb0\x2a\xc3";

void main(void)
{
    int fd[2], ret;

    /* spawn child process, connected by a pipe */
    pipe(fd);
    if (fork() == 0) {
        close(fd[0]);

        /* enter mode 1 seccomp and execute untrusted bytecode */
        prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT);
        ret = (*(uint8_t(*)())code)();

        /* send result over pipe, and exit */
        write(fd[1], &ret, sizeof(ret));
        syscall(SYS_exit, 0);
    } else {
        close(fd[1]);

        /* read the result from the pipe, and print it */
        read(fd[0], &ret, sizeof(ret));
        printf("untrusted bytecode returned %d\n", ret);
    }
}

You would want to replace code[] with the shellcode you want to test.
You mentioned that there is one syscall to time(). On most Linux systems, this is not a true syscall, but a vDSO. If it is actually a direct syscall, you would need to use mode 2 seccomp and explicitly whitelist it. For this, you would want to use libseccomp to abstract away the complexity.


Nmap does not make temporary logs, but Zenmap and Metasploit (and probably Armitage) automatically save XML output to a temp file for later parsing. Unfortunately, Nmap's --resume feature does not support resuming from XML (yet).

Some general observations that may help in the future:

Always save output. Get in the habit, because even though a results viewer or other tool may use the raw output to fill a database model, it will likely miss some information that you may want to use later.
Use a terminal multiplexer like GNU Screen or tmux to avoid losing long-running processes when your connection hiccups. Along those lines, check whether Armitage kept running your scan even when you disconnected.


To properly test your appliance  and website I would get some pentesters involved and hand them over the rule set you are currently using. This will assist them in trying to create custom malicious payloads which would traverse the WAF for which you can then create additional rules.

I would also make them test the application which you are protecting without a WAF, as this will purely test the security of your application. (A WAF is not a miracle to protect a badly secured web application)

If you don't have a budget have  a look at Burp (not free) or ZAP and gather some custom payloads from the internet yourself to fuzz your application with.


IPsec uses IKE (Internet Key Exchange) to establish a security association, which includes identifying the other party.

IKE is commonly done using x.509 certs (The same type of certs you already use for everything else). These certs allow each party to rely on the authority of the issuing CA to identify the other party (They must both trust that CA).

IKE can also be done through other means, like a pre-shared key. This allows no intrinsic way to verify the identity of the other party.


Can all your public files on Dropbox be accessed by anyone with one of the links?

They're sort of correct. Let me explain.

In Dropbox, there are two ways to share files. Sharing a link to a file from any folder will generate a link in the following form: https://www.dropbox.com/s/randomkey/filename Anyone can access the file you posted with that link. However, each time a file is shared like that, a new random key is generated and associated with that file. Other files cannot be accessed using that key.

However, there is also the "Public" folder in Dropbox. Files shared from this folder generates links differently, in the form: https://dl.dropboxusercontent.com/u/userid/filename In this form, any file from your public folder can be accessed, because your user ID will not change. Someone would have to know the filename of what they're retrieving if they're accessing a file you did provide a link to, but it is a public folder.

Thus, they're sort of correct, but it's not really a security flaw because you're declaring the files as public anyways. No files are public unless you place them in your public folder, declaring them as so.


Can my /boot be compromised if I Suspend my notebook?

They don't have to power off your machine to disconnect (not necessarily remove) the hard disk from your notebook and reconnect it to a different machine, modify the /boot partition, and then reconnect it to your notebook. As long as the notebook is sleeping, it won't even notice. On your next boot, you could be compromised. There are methods to remove SDRAM and read its contents. Of course these take a moderately sophisticated attacker.


What CSS is considered Safe or Unsafe within a multi tenant website?

There are two issues.

CSS can contain Javascript.  Older browsers will execute the Javascript.  The Javascript receives all of the privileges accorded to the web site, so this would allow each tenant to gain privileges he/she should not receive (e.g., privileges to mess with other tenants, or to mess with your surrounding site).  For instance, the Samy worm and a recent Facebook vulnerability both involved malicious CSS.
Newer browsers will not execute the Javascript, but there are still many older browsers out there.  Ways of including Javascript or other active content in CSS include expressions like url(javascript:alert()), url("http://evil.com/evil.js"), expression(alert()), -moz-binding:, behavior:, and possibly others.

CSS from one tenant can try to set styles on the HTML for other tenants, or for your surrounding site.  This might cause negative impacts.

In principle, you could write a CSS sanitizer to defend against these attacks and still allow tenants to specify their own CSS.  However, that is quite tricky to do right and it would be easy to introduce a mistake, so it's not something to undertake lightly.


A self signed certificate is fine as long as you ensure it is strongly generated.  It won't have implied trust, but if it is going between two end points you know, then you can independently establish trust and add the certificate to the trusted certificate list.

The second question is really up to you depending on how you want the connection to function.  It will protect in between the firewalls either way and will protect even behind the firewalls if you go all the way to the machine, but it will have to bypass the firewall unless you also tell the firewalls about the keys and use a key exchange that the firewalls can follow.


How it creates the private channel on the internet

It creates a connection between the VPN entry (usually directly on the client) and the VPN exit and then encapsulates all traffic into this connection. Imagine a train which transports passengers between two stations instead of the passengers walking this way by themselves.
The "private" comes from encryption so that nobody can see what is inside. Imagine the same train having no windows, so that nobody can look inside who is riding the train.

How it hides our IP address

It does not explicitly hide it. Using the analogy with the train again: the receiver has a limited view and can only see where the passengers exit the train (VPN exit) but not where they started their journey (VPN entry).

How the encryption happens

The details on how encryption works are really a topic by its own, especially if encryption is used which cannot easily broken. Try wikipedia:Encryption for an overview about the topic.
But essentially it is some (often publicly known) algorithm which has a secret key and which uses this key to somehow change (encrypt) the input. The output then gets later put into another matching algorithm with the same key (symmetric encryption) or a matching key (asymmetric encryption) to decrypt the data again. The goal is to make decryption possible only if the secret is known and not otherwise.


High bounce rate due to attacker is using website's mail system

Find a library you can use to parse out domains. Anything with a dot in it should use this library to look for a domain, and then a matching domain would get rejected from the form. This will at least require some obfuscation (like asuspeci . tk). You'll likely still block some legitimate names (you might be surprised how varied naming conventions are), so don't go after obfuscation too hard.

Captcha services have their own algorithms for ratcheting up the difficulty proportional to the user's perceived risk, so I'd suggest them (in addition to traditional rate limiting) as a form of soft rate limiting even if your attacker(s) are passing them. Captcha providers also have analytics to look for abuse, so you'd be helping them help you in this regard.

Here's a prospective rate limiting tweak: put the submitter's IP in the confirmation link (which allows victims to potentially identify their attackers) and don't let that IP submit more submission requests if there are already ~five pending (no confirmation click yet).


How would an attacker know the Gateway IP's of 2 VPN endpoints?

You're assuming the attacker has knowledge of both devices. The particular address you've listed is no stranger to random attacks. SANS Internet Storm Center lists it, it has appeared on other watch lists as well. One can conclude that this is either part of a botnet or some other automated scanning/hacker/badguy machine.

Botnets, compromised machines, etc., have a tendency to fire off massive amounts of recon scans against numerous amounts of machines. Think about it, if you were an attacker, why wouldn't you leverage one machine to scan many? What these machines do, is scour random, and or defined network blocks, enumerate what is visible, what is not, and pass this at times to other machines to perform the exploitation.

Consider the following:

Attacker Botnet
Recon machine: 61.160.213.108
Exploit machine: 10.10.1.2

Recon machine goes out scours the net for potential victims. When/if it finds them, it usually passes it off to another machine to perform an exploit, or bruteforce attack. In the event you were vigilant and noticed a probe, you could block the Recon Machine, but the reality is, exploit machine will likely partake, or implement the attack.

While you perceive that the Recon Machine knows about your infrastructure, there is a high likelihood the initial probe was random. Then of course there is the alternative. Someone is targeting your network. In the event they were, it is not difficult to obtain information on companies, and the networks associated with them. Consider a random company: ACME, if I were targeting their network, I could use Arin and simply say: "Hey Arin, show me what networks might be associated with ACME" and with that information, I can target each network I find:

There are plenty of ways someone can target you, but my guess is, each network of yours that was found, was likely random.


Windows XP expiry security vulnerability of POS

There's two areas of risk that you'll need to look at for this.

First, the security risk.  If you have a firewall blocking all inbound connections and the appliance only runs "trusted" code which you validate before loading on to it, and doesn't run anything (like a web browser) that would allow the user to introduce new untrusted code onto the system, then in most circumstances you're probably not at serious risk with this appliance.
Second, is compliance/regulatory risk.  If this is a PoS system does it process card holder data?  If so then you need to worry about PCI compliance and unfortunately compliance doesn't tend to always go purely on risk.  You should ask your QSA about XP and whether it's possible to have a PCI compliance XP system (my non-QSA guess is that it's not as it's an unpatchable unsupported system...)


Final-Mile Shipping Company Wants Customer Email Address - PCI Compliance Issue? (United States)

my concern is that providing this email address to other businesses in
  our manufacturing and delivery pipeline will have PCI compliance
  consequences.

No, PCI does not care about email address at all.  The only time it's mentioned in the DSS is to state you can't send unencrypted PAN via email.

  Can anyone provide any insights about how I should approach this problem?

If the company has a legitimate business need - if phone-related delays are credible - and your contract with them states they'll only use email for shipping purposes, then it's a reasonable thing to do.  If you don't trust them on either of those points, then you have a problematic relationship with your business partner.

You may also want to get an expert opinion (read: lawyer) about PII laws and what impact they have on the information sharing.  That will probably boil down to making sure the limited use of the PII is contractually stated, but YLMMV (Your Lawyer's Mileage May Vary).


How is the use of Process Monitor a security risk?

Process Monitor needs to run with Administrator rights. In fact, it installs a driver to peek on the actions performed on the filesystem, registry, network, etc.
As it obtains data system-wide, the concern of IT might be that you might get access to data you shouldn't, either for the system/setup or -if this was a shared machine- of other users. ProcessMonitor only shows metadata but even that might be too much information (e.g. suppose someone was working on file Z:\Departments\Human resources\Dec 2020 massive layoff\Schedule.docx!).
However, I think the concern will be more basic. Process Monitor need to run as administrator, and it is likely it would be possible to escalate privileges from it. I think their decision of letting you use the program needed, but with someone from IT supervising you is a good solution.


What tools can be use for Security Auditing for Redhat

Free automated assessment tools are notoriously missing. Historically we had Bastille, which was reasonably not terrible, it also hasn't been updated since 2008 and doesn't support any of the EL releases of RedHat. Currently we do have Tiger, which requires a fair bit of configuration to be properly useful. It is also infrequently updated, the current release being from 2010, but it does provide some baseline usefulness.

In any event, in order to audit a system, you must first know what you're going to audit against. So pick a standard that fits for your environment (both technically and business process) and start using it. Depending on which standard you pick there may be assessment tools available. For example, if you are a CIS member then you can use the CIS-CAT tool to audit systems against their standards. If you are a Nessus Pro Feed customer then you can use their auditing system to test a system against a number of standards including CIS and DISA STIGS.

Configuration auditing isn't necessarily easy, and will likely require some capital outlay, but it is a necessary step if you're going to claim to use a standard.

If you are unable, or unwilling, to lay out money for an automated tool the next best step is to perform a manual assessment. I wouldn't recommend if, but if you do, I would start with these steps:

Pick a standard.
Thoroughly read the standard and compare it against your environment and business needs.
Throw out the changes that are unnecessary or aren't worth implementing (for whatever reason).
Convert the remaining items to a checklist.
For each checklist item determine a testing method to determine if the particular item has been completed.
Compare your system against the checklist and make sure everything has been addressed.