From how far away can passive RFID tags be read?

At least 217 feet.

Please keep in mind this is an Ultra High Frequency UHF Gen 2 RFID tag meant for use in item sales, tracking, and inventory.  This is not the same RF technology in use by access cards. Those are generally Low Frequency (LF) and have a much longer wavelength, which results in a shorter demonstrated distance of 12-19 inches, although that is much farther than the distance claimed by the access card vendors in the interests of system security.  Most door badge readers are designed to require a distance of less than two inches.

Near Field Communications (NFC), found in credit cards, cell phones, and other payment systems, use High Frequency (HF) which falls in-between the two, and they will have a range somewhere between the two.  They have an intended operating range of only a few inches, but with an antenna and receiver designed to read them, they may have a much longer eavesdropping range, probably in the 10 foot range.  I don't know of specific experiments in distance eavesdropping on credit cards from long ranges; most such attacks have been demonstrated by disguising the reader in a backpack and reading victims' cards through their wallet on a bus or train.

Also, you should not discount specific antenna or receiver technology.  If there is value to be had in scanning an RFID tag from across a parking lot (surveillance of a person, that sort of thing) then you can be assured that someone will find a way to abuse it to obtain that value illicitly.  They may hide the antenna in a canvas-sided truck to commit their surveillance.


Is leaving the root user enabled in Mac OS X a security risk?

I don't see the quoted instruction on that Apple KB article; the closest I see is:

After completing a task as the root user, you should log out of Mac OS X and log back in using a normal or administrator account. You should disable root access if you do not use it often.

Which seems (to me) like reasonable advice.  Having the root account enabled is not a serious security risk (provided you follow good password practices), but it's usually an unnecessary security risk.

The biggest problem with having root enabled is that it's the most tempting target around for password-guessing attacks.  For example, if you have SSH enabled & accessible from the internet, you will have bots connecting and trying to guess the root password.

Basically, having root disabled decreases the number of ways for someone to take over your computer; so unless you need it, leave it turned off.


How does an IDS system use PCAP to process malicious signatures?

To answer your question: The IDS knows different protocols so it can see what runs over them. It can also interpret pcaps. A pcap is just a fileformat. The IDS understands this fileformat and can see all these different protocols. From here it just starts reading them. If it sees a protocol it understands, it will analyse it.

It's no different in concept than with logs, just different type of fileformat.


How should I more securely store files obtained by mirroring a website?

The file types you listed and the goals you presented result in a huge attack surface. Assuming a sophisticated adversary, this gives a vastly increased possibility for exploitation. PDFs and PPT/PPTX are particularly problematic. If you cannot limit yourself to far fewer file types, you will need to isolate your activities, either using privilege separation or remote virtualization.
Privilege separation
This is a solution in the case that you need to perform this activity on your local computer. While it would be difficult to individually sandbox every single application you will be using, you can create a new user on your computer with few privileges:

Disable access to su and sudo from the new user, and do not use them as that user.
Do not su to your lesser user from root to avoid TTY pushback attacks.
Use iptables to disable network access for that user.
Set resource limits to reduce the amount of damage an exploited application can do.
Use Wayland instead of Xorg if possible, or Xorg with systemd-logind to run it as non-root.
Enable and use the Secure Attention Key when finished and switching to a new session.
Scan for and remove all unnecessary setuid or setgid files, as well as setcap files.
Use an auditing framework like auditd to monitor potentially malicious activities.
Apply general system hardening such as sysctl tweaks or hardening patches.

Depending on the level of sophistication of the adversary, this may not be enough, and even for an adversary of moderate capability, this is rather incomplete, but it is a starting point. As you have to assume (most likely correctly) that the applications you are using to access these files are vulnerable to arbitrary code execution, the question turns into How can I safely run untrusted code?, which is of course extremely broad.
Virtual Private Servers
An easier solution would be to use a VPS. You can run applications remotely on the VPS rather than on your own computer and interact with it that way. Even if the VPS is completely compromised, the attack surface area is reduced to that of your SSH client and your terminal, which is fairly small. As you will not be able to directly view images over SSH (at least not safely), you may want to convert them to a very simple (and difficult to exploit) image format before transferring it to your local computer and viewing it. An example of such a format would be the PPM pixel map format. This also works for viewing PDF files, as they can be readily converted into image files using various utilities.
The host of a VPS is able to access and modify anything on the VPS. If this is an issue for you (for example, if the files are extremely sensitive, or integrity is of utmost importance), you may not want to use a VPS. This is unlikely to be an issue, and as the website you have downloaded from is already (presumably) public, there should be no confidentiality issue. You can increase the confidentiality and integrity of the data by instead using a dedicated server, although that would be more expensive.
You should keep a local backup of these files, in the case that the VPS is shut down, so that you can restore it to another VPS later. The local files should be stored in an "inert" form that will not be susceptible to exploitation of any indexers or thumbnail generators you may have on your system. This can be done for example by putting the files in an archive such as tar.
As you will need to use command line utilities rather than graphical ones, you will need to find ways to access these files over SSH. Some examples which you can do remotely on a VPS:

You can convert PNG, TIFF, JPEG, and (non-animated) GIF to PPM to safely view it locally.
XLS/XLSX can be converted to CSV, which is fine on command line. There is a good vim plugin.
RTF, DOC, DOCX, and ODF can be converted to images, which can be securely viewed locally.
I am not aware of any way to view PPT/PPTX in command line, though you can analyze them.
HTML, CSS, and JS can be viewed in a text editor or run on a remote text-based browser.
PHP can be viewed in a text editor or executed using a command-line PHP interpreter.


Do any organizations use Smart Cards other than the military?

CAC cards themselves are used only by the US Department of Defense. But similar cards are used elsewhere. By 'similar' I mean embedded-chip plastic cards that carry a picture and other secure identity information and that use PKI.

Malaysia's official ID card MyKad (also carries fingerprint)
Many EU countries, including Estonia's official ID card Isikutunnistus
Spain's official ID card (also carries biometrics, not sure what kind)
Belgium's official ID card
as well as Portugal's
The Indian state of Gujarat's driver licenses (also carries fingerprint)

As you can see it tends to be governmental organizations that have traditionally issued other forms of ID that are the ones most strongly adopting CAC-style cards.


How to monitor traffic/capture packets on your network?

Snort is an open source packet inspection tool that is designed to do exactly what you are looking for.  It requires a box with plenty of processing capacity; and it is generally hooked up to a span port on your switch in order to see all the traffic flowing on your network.


How important is a static IP address when authenticating with my server?

Somebody brute forcing my SSH key is not an issue in my mind, somebody with resources like that (if it is even possible) can easily break into your office.

Listening on a non standard SSH port is something that many people recommend, and it can't hurt. (Probably does not help either.)

The only issue I worry about with a public ssh port is that if there is a security flaw in the SSH server my server could maybe be compromised.
For that reason I have automatic updates turned on. For my "low to medium" value server that is enough, I feel. Because if that ever happens most of the internet will be at risk.

If your server is of higher value you could:

a) Look at setting up one server that listens to connections on an open ssh port and your other servers only listen to connections from that server. (Maybe even over a private network if your host has something like that).

b) Look at setting up a VPN.


In some HSMs certain kinds of keys have certain commands possible on them, for example you would not be able to use a PIN key to decrypt the value.

I'm not sure if this relates to the jPOS use case: https://github.com/jpos/jPOS/blob/master/jpos/src/main/java/org/jpos/security/jceadapter/JCESecurityModule.java#L1820

I'd like to know too


The claim that "mobile providers reject all encrypted data" is not accurate.  To my knowledge, mobile carriers don't block SSL connections or VPN connections.  Perhaps there was a miscommunication or misunderstanding of what exactly Harald meant.

On the other hand, here's one thing that is true.  Many cellular standards include some kind of link-layer encryption for the voice or data as it is transmitted over the wireless link between the phone and the base station.  However, major flaws have been found in these encryption standards.  Also, many mobile carriers will allow governments to tap into this data at the central office, after they have decrypted it.  There have also been carriers who have turned off the link-layer encryption, and governments who have required carriers/equipment vendors to turn off the link-layer encryption locally (or when exporting cellular equipment).

But, if you have a smartphone, you can still use your own end-to-end encryption to protect your own connections -- mobile carriers don't block this.  And if you use your own end-to-end encryption, or if you use apps that implement their own end-to-end encryption, those link-layers weaknesses and backdoors don't damage your security, because you've eliminated the dependence on the mobile carrier's link-layer crypto.

It is true that sending data over a mobile phone is likely to be less secure than a wired connection.  This is because most phone apps don't use end-to-end encryption, and most data is sent without any end-to-end encryption.  (For instance, most websites use unencrypted HTTP connections, rather than end-to-end HTTPS encryption.)  Therefore, most data sent from your phone is only as secure as the cellular link-layer encryption -- and that isn't terribly secure.


Can botnets be injected through open wifi to smartphones?

Barring an exploit in the drivers on a device, a smartphone would have to actually access some online service that could be compromised.  The main risk with a rogue open wifi hotspot is that when SSL encryption is not used, the rogue network can replace the responses from requests to legitimate web sites and services with its own attempts at attacks.

The user would still have to access a service on the network (or have some service configured on their phone to automatically be accessed) and an exploit would have to be returned that is able to compromise the phone.  This would generally be relatively difficult if a device is patched up to date, though may be a bigger risk if running outdated software.

It would take a rather complex attack to be able to try to compromise a large number of devices running different OSes and configurations as the services that would be called the the exploits that might allow access to take over the devices would be very different.

The only real advantage a rogue AP gives over any other attack on the Internet is that they can replace non-SSL (or otherwise authenticated and encrypted) protected calls to web sites and services with their own response.  This only simplifies getting someone to access a compromised site though, it doesn't allow anything that couldn't be accomplished through a compromised link such as what might be found in a phishing e-mail.

It's also worth pointing out that the article you linked simply points out that open wireless networks can be used as an effective network connection for controlling a mobile botnet.  It doesn't have anything to do with creating infections, just establishing that communication can be done reliably and that it makes detection of the bot nets operation through traffic analysis difficult.


It looks like there are a couple of things in your signature that won't work:

Using the /H option in PCRE utilizes the HTTP preprocessor and says that the content needs to be matched against the http_header.  When a GET request is parsed by the preprocessor, |0d 0a 0d 0a| signifies the end of the header; which means you cannot search for that inside the header.
When using flow or any HTTP preprocessors, the TCP stream is reassembled (by default, unless otherwise specified).  This means that in order to match content in the header, all of the packets that make up the HTTP request need to be observed and the request has to end before the preprocessor will be able to parse all of the parts that make up the request (e.g. http_method, http_uri, http_header).

Honestly, I am not sure what the best approach would be to write a signature to detect this activity [generically] would be, simply because it goes outside of the normal bounds of what Snort is designed to detect.

However, what I would recommend in this situation would be to find all of the publicly available tools for SlowLoris (starting with https://github.com/gkbrk/slowloris.git - available to install via pip3), run them in a testing environment and analyze what actually occurs over the wire.

I did that and this is the traffic that it generates:

GET /?1153 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0
Accept-language: en-US,en,q=0.5
X-a: 1350
X-a: 210
X-a: 518
X-a: 4622
X-a: 2951
X-a: 2666
X-a: 149
X-a: 1756
X-a: 4994
X-a: 2688

This happens on multiple connections up to the maximum number of sockets specified (150 by default).  Each connection would be kept alive with a incomplete HTTP GET request by sending an additional X-a header field every so often.

The way I would write a signature to detect this activity would be:

alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"SlowLoris.py DoS attempt"; \
    flow:established,to_server,no_stream; content:"X-a:"; dsize:<15; \
    detection_filter:track by_dst, count 3, seconds 30; \
    classtype:denial-of-service; sid:1; rev:1; )

event_filter gen_id 1, sig_id 1, type limit, track by_src, count 1, seconds 5

Important things about this rule:

Added no_stream to flow option.  This tells the Stream5 preprocessor not to bother checking how the content relates in the context of the reassembled stream.  It basically just looks at the packet itself.  Important when using the dsize option.
Added dsize:<15.  The lines that contain the X-a headers are sent in single packets.  I observed a typical packet to look like:

0000   58 2d 61 3a 20 32 36 38 38 0d 0a                 X-a: 2688..

With four random digits for the value, the length of the content is 11 bytes.  I just decided to say <15 just in case.
Added detection_filter.  I find that a combination of detection_filter in the rule combined with an event_filter gives better control for alert-rate limiting and thresholding.  The detection_filter options I specified makes sure to only fire alerts if 3 or more occur from the same source within a 30 second window.
Added an event_filter to limit how many alerts fire once the detection_filter is reached.  By limiting alerts to 1 every 5 seconds, alerting will still be loquacious enough to let you know something's going on without flooding you with extraneous alerts.

Below is sample output from live testing using Snort v2.9.9.0 for the duration of 3 minutes

SlowLoris.py

(Python3) λ slowloris -p 80 192.168.126.128
[05-12-2017 13:45:01] Attacking 192.168.126.128 with 150 sockets.
[05-12-2017 13:45:01] Creating sockets...
[05-12-2017 13:45:05] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:45:24] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:45:43] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:46:02] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:46:21] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:46:40] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:46:59] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:47:18] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:47:37] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:47:56] Sending keep-alive headers... Socket count: 7
^C

HTTP Server Log

user@host:~$ sudo python -m SimpleHTTPServer 80
Serving HTTP on 0.0.0.0 port 80 ...
192.168.126.1 - - [05/Dec/2017 13:48:01] "GET /?1061 HTTP/1.1" 200 -
192.168.126.1 - - [05/Dec/2017 13:48:01] "GET /?524 HTTP/1.1" 200 -
192.168.126.1 - - [05/Dec/2017 13:48:01] "GET /?1171 HTTP/1.1" 200 -
192.168.126.1 - - [05/Dec/2017 13:48:01] "GET /?984 HTTP/1.1" 200 -
----------------------------------------
Exception happened during processing of request from ('192.168.126.1', 61831)
Traceback (most recent call last):
  File "/usr/lib/python2.7/SocketServer.py", line 290, in _handle_request_noblock
    self.process_request(request, client_address)
  File "/usr/lib/python2.7/SocketServer.py", line 318, in process_request
    self.finish_request(request, client_address)
  File "/usr/lib/python2.7/SocketServer.py", line 331, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/usr/lib/python2.7/SocketServer.py", line 654, in __init__
    self.finish()
  File "/usr/lib/python2.7/SocketServer.py", line 713, in finish
    self.wfile.close()
  File "/usr/lib/python2.7/socket.py", line 283, in close
    self.flush()
  File "/usr/lib/python2.7/socket.py", line 307, in flush
    self._sock.sendall(view[write_offset:write_offset+buffer_size])
error: [Errno 32] Broken pipe
----------------------------------------
192.168.126.1 - - [05/Dec/2017 13:48:01] "GET /?634 HTTP/1.1" 200 -
----------------------------------------
Exception happened during processing of request from ('192.168.126.1', 61832)
Traceback (most recent call last):
  File "/usr/lib/python2.7/SocketServer.py", line 290, in _handle_request_noblock
    self.process_request(request, client_address)
  File "/usr/lib/python2.7/SocketServer.py", line 318, in process_request
    self.finish_request(request, client_address)
  File "/usr/lib/python2.7/SocketServer.py", line 331, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/usr/lib/python2.7/SocketServer.py", line 654, in __init__
    self.finish()
  File "/usr/lib/python2.7/SocketServer.py", line 713, in finish
    self.wfile.close()
  File "/usr/lib/python2.7/socket.py", line 283, in close
    self.flush()
  File "/usr/lib/python2.7/socket.py", line 307, in flush
    self._sock.sendall(view[write_offset:write_offset+buffer_size])
error: [Errno 32] Broken pipe
----------------------------------------
192.168.126.1 - - [05/Dec/2017 13:48:01] "GET /?296 HTTP/1.1" 200 -
192.168.126.1 - - [05/Dec/2017 13:48:01] "GET /?640 HTTP/1.1" 200 -
----------------------------------------
Exception happened during processing of request from ('192.168.126.1', 61834)
Traceback (most recent call last):
  File "/usr/lib/python2.7/SocketServer.py", line 290, in _handle_request_noblock
    self.process_request(request, client_address)
  File "/usr/lib/python2.7/SocketServer.py", line 318, in process_request
    self.finish_request(request, client_address)
  File "/usr/lib/python2.7/SocketServer.py", line 331, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/usr/lib/python2.7/SocketServer.py", line 654, in __init__
    self.finish()
  File "/usr/lib/python2.7/SocketServer.py", line 713, in finish
    self.wfile.close()
  File "/usr/lib/python2.7/socket.py", line 283, in close
    self.flush()
  File "/usr/lib/python2.7/socket.py", line 307, in flush
    self._sock.sendall(view[write_offset:write_offset+buffer_size])
error: [Errno 32] Broken pipe
----------------------------------------

Snort Alerts

12/05-13:45:05.348446  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61831 -> 192.168.126.128:80
12/05-13:45:24.351347  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:45:43.355735  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:46:02.358688  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:46:21.363346  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:46:40.365834  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:46:59.369221  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:47:18.372293  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:47:37.374814  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:47:56.378355  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80

Hope this helps!


How exactly can a public server be compromised?

Assuming also that the web application code (PHP in this case) was also secure and all user passwords where secure [...]

That's like saying "assuming that the lock is unpickable and the house has no windows, how could a burglar possibly break in?" You can't assume that, it's completely unrealistic. No code is perfectly secure unless it was written by the Gods themselves (and they wouldn't write it in PHP). And users do pick bad passwords and reuse them on all sorts of places, unless off course your users are Gods as well.


One way to ensure security is to have the client create a Message Authentication Code for the request and then send the MAC along with the data. The server will recreate the MAC and then validate it against that what was sent.

This is probably what is happening in your example with the "signature".


Creating ssl-certificate for third-party service

If you create a certificate only for catalog.mysite.com, this won't compromise your security (further).
All it allows this third party to do is run their server on the domain "catalog.mysite.com". They obviously can read everything sent to "catalog.mysite.com".

But if I understand you correctly, that is exactly what you want from them.

If you also add "mysite.com", "www.mysite.com" or any other subdomain to the certificate, this third party can also run a server which identifies as "mysite.com".

Some certificate authorities automatically add "mysite.com" to a certificate for "catalog.mysite.com". Don't get a certificate from them.


Class.forName injection and constructor invocation

This leaves a lot of room for abuse. Basically any static initializer and any constructor which has string parameters can be executed:
This is a common vulnerability of <something> (e. g. JSON) to Java parsers, that allow the untrusted data block to specify the classnames.

JDBC drivers are supposed to register themselves in the static initializer. Classes that use native methods are supposed to load the native library in the static init block. Furthermore there is a singleton anti-pattern of creating the instance in the static block. So it is possible to use up memory, that cannot be GCed. And of course someone might have written code that does other strange things in the static init block.

There are many classes which have side effects in their constructor. For example instantiating a FileOutputStream with a filename as parameter will empty that file, assuming that java process has write permission.

Those examples came to my mind while reading the posting. I am sure there are a lot more.

Furthere more you should consider whether showing the Stacktraces to the attacker is really necessary. It is often a good idea to hand out as little information as possible in unexpected situations. In your situation for example, it does makes a differences if a FileInputStream throws an IOException or a ClassCastException. This information might make it easier to exploit another vulnerability.

At the very minimum you must check TrustedInterface.class.isAssinableFrom(loadedClass) before invoking the constructor or use loadedClass.asSubclass(TrustedInterface.class). But I strongly recommend to use a whitelist of classnames.


It depends on the rand() implementation... the standard (POSIX / Single Unix) gives a sample implementation but any system is free to have something better.

You can see the sample code there. If that exact code is used, then the internal state is a 32-bit integer, and it suffices to get two successive 16-bit output values to recompute the internal state. Actually, any 32 bits of output are sufficient, with the generic reconstruction algorithm known as "brute force": it won't take long, for a computer, to try all possible 32-bit internal states until one is found, which matches the observed output. It is possible to recompute the state waaaaaaaaay faster by doing some linear algebra, but since brute force works well, why bother ?

In usual Linux systems, rand() is an alias for random() which is much better, but still not "good", as far as randomness goes. The srandom() function still initializes the internal state with a 32-bit seed, which is amenable to brute force. You just lose the linear algebra shortcuts; or, at least, things require a bit more mathematics. random() is not a cryptographically secure PRNG and its internal state can be rebuilt by observing some output bits. The simplest method is still brute force, and it works well.

(Also, if the application did not bother to call srandom(), then the initial seed is always 1, so brute force will work very well.)


Your best bet is to install a web application firewall like mod_security and apply rules to nip this in the butt. Apply Duo Security, to disallow unvalidated sudo commands from a compromised account.

  fr00yl00p says:

  Configure the system to alert you upon logins (e.g. per mail in sshrc    and bashrc)

This becomes too cumbersome and complex if you have systems that perform maintenance, e,g, SNMPv3, any kind of rsync accounts, etc. A better mechanism would be an alias of the last command written to terminal whenever you log in. Duo will stop a lot so check it out.

  fr00yl00p says:

  Let your firewall drop connections with obvious attack patterns. (e.g. http://spamcleaner.org/en/misc/w00tw00t.html)

This is not a feasible mechanism and you'd have to create a whitelist in parallel. Consider the fact that I can spoof connections pretending to be anyone. Imagine I generate enough spoofed messages to simulate say a CIDR /16, /8, or even /2.

  fr00yl00p says:

  Install PHPIDS (https://phpids.org/)

Unless you're willing to become an incident response analyst, you will be wasting so much time chasing false positives, you'll eventually ignore the alerts from IDS' and IPS' even well trained DFIR people spent hours at a time constantly modifying. Let alone someone who isn't accustomed to using an IDS, nor interpreting its output.

As for other recommendations, you need not block entire ranges for a webserver if you configure a WAF properly. On one of my sites, I PURPOSEFULLY keep Joomla 1.5 running and worry nothing about compromises since my WAF is written to only allow a POST from my static address. Its simplicity at its finest. My website is designed ONLY to allow GETs not POSTs so there is no need to go bezerk on rules.

You need to also be cognizant, that much traffic is generated by infected machines, so you're not stopping or blocking an attacker per-se, you're blocking one infected machine. So I wouldn't go as far as blocking entire IP blocks to a webpage. Mailserver, ssh server sure. In fact, you should have a default "BLOCK ALL" to your webserver, ONLY allowing your address to services such as SSH. However, everyone's designs/needs differ


Virus changed Google Chrome installation folder

If there's been a malware intrusion, chances are that they have elevated their privilege to administrator. If so, then you should probably think about reinstalling Windows rather than removing the malware, as its hard and toilsome to measure the impact of the malware on your OS.


Developers make bugs. One (sadly) rather common bug type in Web applications with PHP and SQL is SQL injections. A consequence of such a bug is that hostile outsiders can inject some arbitrary SQL code to be evaluated by the database.

If you have two accounts to access the database and one of them only has read permissions, then any SQL injection bug in requests made by that specific read-only account will only grant read-only access to the attacker.

That's like the inner doors in a submarine. These doors are designed to resist pressure and will be closed in case of emergency. That way, if the hull is pierced, then water will only flood part of the submarine, which will then sink slower, and the chances of survival for the crew will be greatly improved. Using separate read and write accounts for MySQL is the same kind of protection. You'd still prefer not to get hit by a torpedo at all, though; i.e. it is best if you do not allow SQL injections to happen, by using SQL properly (with prepared statements).


Burp Suite in proxy mode is able to decrypt HTTPS traffic of any systems which trust it. It does this by generating an own certificate and use this cert to register itself as a certificate authority on the system it is installed on. When it then proxies a request to a HTTPS webserver, it does the HTTPS handshake itself, decrypts the traffic, issues a certificate for the webserver signed by itself as a certificate authority, uses that certificate to re-encrypt the traffic and send both the forged certificate and the re-encrypted data to the client.

This allows Burp Suite to eavesdrop on HTTPS traffic. A user which uses a normal proxy server or doesn't trust the Burp Suite pseudo-CA would not have their credentials compromised.


FireFox inadvertedly increasing security?

Firefox allows you to configure most extensions (including Adobe Flash) to always ask before running. That behavior is what you see here. Rather then inadvertently increasing security this is purposely meant to increase security. Once this is setup you will notice that many sites ask for flash player without any (visible) flash content. Many of these are tracking attempts, however I cannot comment on a single site without evaluating its flash content.

If you want to avoid flash tracking tell Firefox to always ask and only turn on flash when there is some Flash content on the page that you care about.


Obscurity does not give you additional security, hiding a key to the door does not make your lock stronger especially if you're dealing with someone trying to pick it.
Compression prior to the encryption is only to make the input smaller which has a significant impact on the performance of the asymmetric crypto it is also handy when you need to transfer the files on the wire as they're smaller. If you mix your input or output then you need to provide the user with the way of undoing the "mixing" which could be obtained by the adversary rather easily. If you consider making this operation secret, then the question would be, why not use a one time pad instead?


Understanding VPNs : How VPNs can be used for anonymization?

"VPN" is a large umbrella concept for a variety of situations; they all have the following common points:

there is a need for confidential communication;
involved parties should, ultimately, behave as if they were part of a common shared network;
however, there is no physical separation between that private network, and the rest of the Internet; the same wires are used; separation is done cryptographically, hence the "virtual".

A typical VPN situation is when an organization wants to link two sites together. Users of computers should be able to connect to all computers on both sites as if they were all on a single LAN; but all data which has to go over the Internet (to cross from one site to another) is channeled through an encrypted tunnel. From the outside (i.e. someone eavesdropping on the link between the sites), all that can be observed is that data flows from one site to another; but the encryption covers both the data itself, and the source and destination addresses (the IP addresses of the involved hosts within the private network). The attacker only sees traffic between the external routers of both site, but cannot know which specific machines within both sites are currently communicating.

This is the level of privacy that a VPN offers: if hides both the exchanged data, and the true source and destination addresses. Attackers can still infer the amount of data, and which sites are active, but not the exact machines.

This model extends to traveling salesmen, who connect to their home office from their hotel room. They open a VPN connection, at which point their laptop is "as if" it was in the office, connected to the office network. But eavesdropper only see that the laptop is linked to "the office" in general, not what specific office server is contacted.

The distinction between VPN and proxy servers is kind of fuzzy; do not try to read too much in it. When we say "VPN", we want to emphasize that the encryption layer should work for all protocols, because the VPN is supposed to transmit IP packets; whereas a proxy is normally dedicated to a single protocol, or a small set of protocols, such as HTTP.


There is a way to delay such attacks in such a manner they would not want to spend time doing it. Make the check manual, and rate limit it per IP to 1 every X seconds. A user won't care much(depending on how long X is), and an attacker will. Especially if they want to check a LOT of emails.

To do this you'll need a cache of IP addresses that use that service, and give them a lifetime of X seconds. If they use the service and the IP is in the cache then respond with an error from the service.

Then in the form, after they're done typing the email for X seconds send of the request to check.

This will mean automated systems will not be able to use your service without delay as well, but you'd be surprised how useful that is in preventing these attacks when it no longer becomes worthwhile to them to spend time attacking it.


Web-Services come with plenty of standards for securing data - so why roll your own?  The WS-Security family of standards are supported by most Enterprise Service Buses (ESBs) out of the box and will ensure that you can integrate (which is the whole point of WS).

If you are using restful XML over HTTP (rather than SOAP) then just use the same security as you would if it were a web page.


WPA2 AES is the best encryption you can choose right now for your wireless network. You should put a large and strong password to avoid bruteforce attacks. The password should container letters (uppercase and lowercase), numbers, symbols. You can set it from 8 to 63 digits. The more larger, more difficult to crack using bruteforce. Of course, the password must not be included on any dictionary, so must be something "invented".

If you want to be secure you still should perform an important task. You must disable WPS if your access point has it enabled. With this feature enabled an alternative auth can be performed using a 8 digit pin that can be easily bruteforced. And after success doing this, your WPA2 password is revealed (no matter how large and strong is). So disable WPS is mandatory.

Androdummper, and that kind of tools are taking advantage of WPS. So if you disable it, you are more protected.


Can the server crash while testing with the sqlmap tool?

Firewalls don't block you by cookie. (But to double-check, you can always try incognito mode). Most likely you got IP banned by the WAF. Since VPN is using a different protocol and has nothing to do with your webserver, it should be working.


What is the specific basis that allows an entity to connect a cert chain to a trusted root?

It seems (from some experimentation with browsers) that pulling the RootCert is not required

The idea is that you ultimately (i.e. root) trust only a CA already known to be good (i.e. in the local trust store) and not just blindly trust any arbitrary CA certificate downloaded from the internet. Thus, pulling the root certificate from the internet is not only "not required" but it would be the wrong thing to do.

The process of determining which root CA is the correct one is essentially the same as with an intermediate CA certificate: make sure issuer CN and Authority Key Identifier (if exists) match and validate the signature. The important difference compared to an intermediate CA is that the root CA will be used as the ultimate trust anchor and therefore must be trusted already -  which is not the case for something blindly downloaded from somewhere or given by the (not yet trusted) communication peer.

For more details on how certificate validation is done see SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate?.


What is meant by "Bulk Equipment Interference"?

To expanded on what @mootmoot said in his comments, Bulk Equipment Interference is an euphemism (i.e Double Speak) for Monitoring internet connected devices over large geographical area.

You could relate this to USA's PRISM project. It essentially means that the UK will monitor your traffic in the interest of national security and it has the legal authority to do so.

While not specified, this most likely revolves around cooperation with telco and mobile providers. These organizations would be the hub that collects data, and passes it on to the GC for data analytics.

Privacy be damned in these modern times.


Protocol to identify individuals by personal SSL certificates and personal DNS addresses

You need more than just a URL or whois record which publishes information about you. What's to stop me asserting that I am Amir Mehler simply by providing the URL or DNS name to a site requiring authentication?

That means there has to be some negotiation between the the user, device, the authenticating site and the URL offered as a proof of identity. That's what openid does

  The site could then identify me in several ways, it can email me, text me or simply encrypt my data with my own public key.

Those are different services than authentication. And available elsewhere.


security updates for embedded firmware Tomato (router)

Development of the official Tomato firmware has indeed been discontinued since 2010 with version 1.28 being the latest release.

Wikipedia has a nice comparison table of various forks that have been created since then. Although it has a focus on Linksys routers, you can find current information on actively developed Tomato mods in this forum. The AdvancedTomato firmware (a fork from Shibby mod) is one possible option with fairly frequent updates.

That said, I find it suspicious that Tomato seems to have a very short record of publicly known vulnerabilities. This could either be due to well-written code or indicate that there has not been a lot of auditing since then.


Exploiting a Linux startup script that is world writable

Arrange, to run as root:

cp $(which bash) $(which bash).muhaha
chmod u+s $(which bash).muhaha

Now, executing $(which bash).muhaha -p gives root to any user. You can even run a script as root with $(which bash).muhaha -p /path/to/script.

The -p option is necessary because otherwise bash detects that it is setuid and drops root privileges as a security measure.


Erase broken external Hard Drive before returning to store

I would suggest that you try a Live CD recovery disk. This might allow you to get access to your data and use a tool like Bleachbit to securely erase it. If you can't access the data this way, then it doesn't mean your data is secure. A disk engineer might have other ways of getting at the data, for example replacing broken circuitry (if that's the problem), or a specialised test/service rig.

Attempts to erase the disk with an external EM field are unreliable and you'd have no way of knowing whether they worked.

If you can't securely erase the disk, then I guess you have to weigh up the cost of the disk against the risk of someone else accessing your data. Or, as others have suggested, talk to the store and explain the situation.

(I know it's too late now, but this is a good argument in favour of encrypting your disk in the first place.)


I don't know what the script does specifically, you may be right, but its not unlikely that its connecting to a remote server and putting some malware, ads or something else into your websites, so dont assume you are in anyway protected by Cloudflare in this case.
Given you cannot know what has happened to your server, my approach in this case is normally burn everything, make a new server with the code out of your git repo. Obviously this depends on you having a copy of the code that isnt on this server. And a database backup - otherwise you are going to need to go line my line though your code, you can download fresh copies of wordpress and your plugins, themes. Basically dont trust anything on that server anymore.
IMHO, The best protection against these types of attack is to make all the code read only to your webserver user - so assuming you have a www-data user that is running apache or fpm, then make some other user, bob, the owner of all the files and give www-data read only access.
There are disadvantages with this approach, if you want to use the wordpress admin to do updates, install plugins, etc - but its easy enough to change the file owner for a short time, and change it back, or even better do all the updates on your computer, commit everything to git, and put it on the server using git.
Also make sure you are always running the latest version of wordpress and your plugins, also keep apache/nginx/fpm updated and other parts of your server.


Does escaping/cutting of  prevents you from XSS

The problem is you can use other encoding like base64 which may get processed by you browser to create a successful XSS, use HttpContext.Current.Server.HtmlEncode() instead.

Example:

$ echo '<script>' | base64
PHNjcmlwdD4K
$echo PHNjcmlwdD4K | base64 -D
<script>

Javascript example:

 var decodedData=window.atob('PGlmcmFtZSBzcmM9L3hzcy9iYXNlLmh0bWwgd2lkdGg9MTAwJSBoZWlnaHQ9MTAwJT48L2lmcmFtZT4K');
     document.write(decodedData);

Iframe example:

src=data:text/html;base64,PHNjcmlwdD5hbGVydCgneHNzJyk8L3NjcmlwdD4K

Additional point, you may not be maintaining this code for the life of the code, a new exploit could possibly get around your filter, hopefully the maintainers of .NET would issue an update that addresses that and is applied by sys admins.


Intercept and modify simple TCP session?

TCP Session Hijacking

Let's imagine a client communicating with a server over a network connection. The client has authenticated with the server and has been granted access. So far, so good.

An attacker is on the network between the client and server, and has been keeping an eye on their session. This has given him time to learn the port and sequence numbers needed for the conversation to take place. Because he knows the sequence numbers, he can anticipate the numbers in subsequent packets (see: TCP sequence prediction attack). This is when the attacker decides to intervene.

He paralyzes the client by launching an ICMP flood, ensuring that the client cannot respond to the traffic sent by the server. This allows the attacker freedom to communicate with the server as though he were the client. Because the client is paralyzed and the server has sent out a response, the attacker gets to it first, forges a packet that appears native to the established stream, and the server is none-the-wiser.

Here is a figure to help you understand the role sequence numbers play in the protocol and how an attacker can take advantage of it:

Source: https://www.cs.umd.edu/~shankar/417-F01/Slides/chapter3b/sld003.htm

This is the best I can do, for now. I haven't been able to locate any Python code or open source tools that can do this sort of thing.


Why does it take so much time to create a secret key on a HSM?

One reason can be that the random generator is waiting for sufficient entropy.


Under what conditions is the Client trying "the next" CRL Distribution Point?

CRL distribution points are location that the client must be able to resolve to a file. If the client is unable to obtain that file, it will go to the next location.

In order to obtain that file, the client must be able to:

Understand the schema of the endpoint (HTTP, LDAP, File, Whatever...)
Resolve the host name (if appropriate).
Contact the host name using the protocol mandated by the schema (HTTP, SMB, LDAP, etc.)
Query for the file path and receive an answer that is not an error.
Obtain the file data and verify that is is signed by the relevant certificate chain. (see RFC 5280 for reference)
Verify that the file is still valid (i.e. that the "next publish date" field is not in the past)

Now, the exact behavior of the client is dependent of the implementation so it's hard to be specific and since CRL validation tends to increase connection time massively, most real-life client will, by default, include some performance optimization that will cause the actual CRL validation not to be fully performed in many cases.


How do these techniques work for protecting against SYN flood?

Maybe you should have added the line from Wikipedia preceding your list. There it states:

  There are a number of well-known countermeasures listed in RFC 4987 including:

Thus the recommended way to get details to the items of the list is to look into the mentioned RFC.

  What exactly is meant by "filtering"? Is that like an ipfilter of known hackers?

RFC 4987, 3.1 will tell you that this is about filtering incoming data based on the source address. So this is about either blacklisting known offenders or only allowing specific clients based on IP address (i.e. whitelist).

  What exactly is 'increasing backlog'? Does that just mean making more resources available?

Yes, it will increase the backlog, i.e. how many connections are accepted by the host but not are not yet accepted by the application. But the relevant part in RFC 4987 will also tell you that this method causes additional performance problems at least with the implementations at the time the RFC was written.

  What's a SYN cache? How can a cache work in this context, isn't it legitimate for the same client may need to open another connections with the same server?

Section 3.5 of the RFC will tell you that the concept is "best described by Lemon [Lem02]" but the section has also a good explanation of the concept itself. It essentially means that not the full state of a pending connection is stored at the server but only parts of it and thus it saves memory. It also replaces the socket based queue of incomplete connections with a system wide cache. I cannot see how it should cause problems with multiple connections from the same client.

See also What is the difference between SYN cookie, SYN cache, and SYN proxy?.


What's an easy way to perform a man-in-the-middle attack on SSL?

Updated:

For HTTP you can use Burp Suite's proxy (Java), or mitmproxy.
tcpcatcher is a more general Java-based GUI capture and modify proxy which might be closer to your requirements, it includes content decoding and modification (manual and programmatic). It's HTTP biased, but accepts any TCP. It has SSL support, though the only drawback seems to be there's no (documented) way to use your own specific certificate, only on-the-fly ones. You could easily use one of the options below to work around that.
ettercap includes features for ARP, ICMP (redirect), DNS and DHCP "interventions", and supports direct SSL MITM (though not currently via GUI, you need to tinker with the conf and/or command line). This seems to be the best all-in-one for most purposes.
sslsplit is another useful CLI tool, it's (mostly) for intercept and log, not modification. It's quicker to get started with than ettercap and has features like SNI inspection, dynamic certificate generation, support for *BSD and Linux FW/NAT, and OCSP/HPKP/SPDY countermeasures for HTTPS. You still have to get the traffic to it though.

If you want quick, low tech and protocol agnostic, you can get most of the way there with just OpenSSL on a unix box:

mkfifo request response
openssl s_server -quiet -no_ssl2 -cipher AES128-SHA \
  -accept 443 -cert fake.crt -key fake.key  < response | tee -a request
openssl s_client -quiet -connect www.server.com:443 < request  | tee -a response

-quiet also enables -ign_eof which suppresses special handling of characters at the start of the line (for line-buffered input), like "Q" for quit. s_client also supports basic STARTTLS capabilities: SMTP, POP3, IMAP, FTP (auth), XMPP and TELNET (from OpenSSL-1.1).

Start each openssl in a different terminal. Replace the tee's with something scripted to modify requests and replies if needed. It's not the most robust, but it might be useful. It supports DTLS, should you require that, IPv6 support requires OpenSSL-1.1. (GnuTLS supports IPv6, and since v3.0 has DTLS support too, you can almost certainly do something similar with gnutls-serv and gnutls-cli, I haven't yet tried this though.)

ncat with its -exec option should work too:

ncat --ssl --ssl-cert fake.crt --ssl-key fake.key \
  --sh-exec "openssl s_client -quiet -connect www.server.com:443" \
  -kl 127.0.0.1 4443

You can just use "--exec" and wrap up your own client in a script instead. With s_client it helps performance a lot to pre-create a session file, then add -sess_in ssl.sess -sess_out ssl.sess to your invocations.

Again, if you need to script/code the MITM yourself socat is another good (and probably the most robust) option:

CERT="cert=test.crt,key=test.key,verify=0"
SSL="cipher=AES128-SHA,method=TLSv1"
socat \
  OPENSSL-LISTEN:4443,bind=127.0.0.1,reuseaddr,$CERT,$SSL,fork  \
  EXEC:mitm.sh

With a one-liner like openssl s_client -quiet -connect www.server.com:443 in mitm.sh to start with, works just like an inetd client.

stunnel is more proxy-like than socat, it has one big advantage that I don't see anywhere else: it supports in-protocol TLS upgrades/STARTTLS, for POP3, IMAP, SMTP and a few others in client and server modes; though LDAP and FTP are notable omissions (the latter understandably). Its inetd mode can be (ab)used just as with the "exec" options above.

For modifying generic text-based common internet protocols using these methods you might be able to get away with some sed (like a more connection friendly netsed) or light expect scripting.

The multi-protocol proxy Delegate also supports external (inetd-like) handling, and integrated scripting support for matching, filtering and rewriting for a subset of the supported protocols.

The only other things I can think of close to generic protocol agnostic MITM proxies are fuzzing tools, like proxyfuzz, or multi-protocol modular ones like backfuzz (be careful searching for that last one ;-).

Other possibly useful tools (for misdirecting traffic) include:

dsniff , including arpspoof
another arpspoof this version with IPv6 support
arpsend from vzctl
dnschef DNS proxy/server (Python)

I also came across references to Zorp several times while rummaging through my notes, non-free available in both a commercial (I have no affiliation) and a GPL version. Worth a mention, due to its claims of being a modular, extensible (by way of Python) multi-protocol firewall/gateway. TLS inspection is supported in the GPL version (SSH and others seem limited to the non-GPL version).


What forensic analysis can be done with physical access to a machine but without the hard drive?

RAM contents

If it's soon after the device is powered off, there are attacks that may allow to recover RAM content, e.g. Cold Boot Attack on Wikipedia, Memory forensic data recovery utilising RAM cooling methods.

There are also some secondary things that come to mind e.g. serial numbers might be used to trace where and when (and thus by whom) parts were purchased; and there might be a firmware trace showing when the system was last used (which may be important evidence in certain cases) but that feels a very niche use case.


Why after a website password reset am I asked to login again?

There is no reason this cannot be done technically, and I see the occasional site doing it. But it would require extra code to be built, so it's cheaper to let you handle the login ;-)

The same thing happens with the confirmation link when registering: in most cases you still have to login (but in this case there are relatively more sites that auto-login, in my experience).


Avast says I don't need to use encrypted connections for my e-mail accounts

Should I not use SSL and select "none" in Outlook?

The various merits of using Avast's SSL aside, even if you use an encrypted email connection between your email client and your server, there is no guarantee that each mail relay will negotiate encrypted connections between themselves as they pass your email along, or are indeed not compromised.

There are two other considerations besides the first hop being encrypted to worry about, however. When you authenticate with a mail server, that authentication information is sent when the connection is established. If the connection is unencrypted, depending on the authentication mechanism (and whether it is designed to work over untrusted channels) it may be possible to capture the authentication details. This may allow an attacker to impersonate you and send email on your behalf.

The final consideration is that malware on your PC will have an easier time intercepting unencrypted network traffic (and so your authentication details) than encrypted - specifically, it can just generally collect network traffic (regardless of whether another application then encrypts it) rather than having to attack your email client process.

It comes down to a risk-based evaluation. If you select "none" for your SSL options, chances are high you're sending authentication data in the clear. If you use Avast's proxy, you must implicitly trust the local system (actually, you must do this anyway). If you don't, you don't benefit from virus scanning of your email, an important threat vector.

From a general security standpoint, assuming Avast's proxy is well implemented you should be fine going with that. The benefit of having your email scanned probably outweighs the risk of your loopback traffic being sniffed. Of course, adjust for your risk appetite.


Can an authoritative DNS server tell who is trying to resolve a domain name?

Not exactly. Keep in mind you won't see requests from systems which either have the dns info cached or are using a dns server which has it cached. Likewise if you have someone visiting or attacking your site who is using an external dns server the dns query will likely come from the IP address of the dns server they are using and not the visitor/attackers IP itself. So you will see the query itself but it may come from a public DNS server.


This is not the case. iOS 8 allows the use of touch ID for apps but the "fallback" for the touch ID in terms of apps are the actual app password. the 4 digit code is only used if touch ID fails to unlock your phone

on a side note, certain apps such as banking can almost definitely chose not to allow touch ID for the app itself or even high-risk functions inside the app e.g financial transactions.


Can anyone suggest good open source tools for scanning source code for vulnerabilities?

David Wheeler of FlawFinder has a great list of (30) OSS/FS & (14) Proprietary static analysis tools:

http://www.dwheeler.com/flawfinder/#othertools


The shell is probably the wrong place to do a logging of commands. A user could simply execute another shell without history or execute commands read from stdin without leaving a trace in the history. Thus it does not protect a lot against malevolent users.

Instead of securing the shell history one should securely log the commands executed by a user, no matter if these are executed by the shell or not. And this should be done so that the user is not able to execute any commands without trace. There is actually already an audit framework which can do this, see System Auditing in the RHEL documentation.

And while blockchain sounds like a nice  (and hype) technology: there are other technologies which provide the necessary security without all the overhead. For logging the activity of a non-privileged user it is enough to do the logging as root. In case one fears privilege escalation one can use the existing mechanisms of syslog to log to a remote server. And some syslog implementations also provide a way to sign the messages to prove their origin.


OpenSSL-0.9.8 is old (from 2005) and support for elliptic curves was not completely added at that point, especially for the command-line tools. OpenSSL is primarily a library; the command-line tools are provided for testing, but are often lagging in functionality. The "normal" way to use OpenSSL is programmatically, by writing C code which calls the library.

MacOS X still uses OpenSSL-0.9.8 because the OpenSSL people broke binary compatibility for some functions, preventing MacOS from doing a transparent upgrade (it could break some applications). Apple's reaction was to mark all the OpenSSL functions as "deprecated" (you get a ton of warnings if you compile C code using the system-provided OpenSSL headers) and write their own cryptographic library.

In any case, you should want to upgrade, not only for better functionality, but also for security (for instance, some algorithm implementations got some extra shielding with regards to side channel attacks) and for performance (e.g. on a 64-bit x86, RSA will be 5 or 6 times faster with 1.0.1g than with 0.9.8).


What are the most important security checks for new web applications?

OWASP has so called Top Ten Project, that shows which the most popular vulnerabilities are. But you should never limit yourself only on those checks that are listed there. I never liked how it sounds - "show me top 10 vulnerabilities". Quite similar answer is here: http://questions.securitytube.net/questions/1764/top-3-c-security-concerns, in the mean of philosophy. The first paragraph fully expresses my opinion. Let me cite:

  If your intention is to write secure code, then I would recommend to avoid such questions like "top10 vulnerabilities". There is no point in focusing only on some desired sort of bugs, because there are quite similar chances to introduce bug of typecasting, integer overflow, off-by-one, stack overflow and others if your knowledge in C/C++ is weak and you have small experience in programming.


valid PDF signature without using hardware HSM or usb Token

The CDS Certificate Policy (available here) specifies in section 6.1.1

  Subscriber key pairs must be generated in a manner that ensures that
  the private key is not known by anybody other than the Subscriber or a
  Subscriber’s authorized representative. Subscriber key pairs must be
  generated in a medium that prevents exportation or duplication and
  that meets or exceed FIPS 140-1 Level 2 certification standards.

SoftHSM is not FIPS 140-1 Level 2 compliant. As far as I know, level 2 and upper requires a hardware cryptographic module.

Note that the AATL program (successor of CDS) has similar requirements but it provides a larger set of Certification Authority which could provide you either a physical signature certificate or a signature SaaS solution.


Current session cookie shown in a HTML page on request

An interesting kind of attack that might work in this case would involve iframes (if allowed), social engineering, and a confused deputy issue (where the confused deputy is the user).
You might create a malicious website that contains a fake CAPTCHA request, where the CAPTCHA code comes from the user's cookie and is displayed with an iframe. So, for example, you could place the page that displays the cookie inside an iframe and position it carefully so that it looks good enough. Then show the user a page that says: "Our system needs to make sure you are a human, please copy the following code and paste it in the field below".
That was the first example that crossed my mind, but maybe you could come up with better tricks to convince the user to copy the code and send it to you. You might try to convince the user that the code is a temporary password to access a private area, or an error code they have to communicate to you, or a URL they need to visit. I'm not sure if the user would be able to copy-paste a text string (the fake URL) when part of the string comes from an iframe (the cookie), but you could try.


Does EMET prevent WannaCry exploit execution?

No, EMET won't prevent exploitation.

WannaCry uses the ETERNALBLUE exploit, targeting the MS17-010 vulnerability. This vulnerability exploits the Windows File Sharing Service (a.k.a SMB) on TCP port 445. This Windows File Sharing Service runs with SYSTEM level privileges, under the SYSTEM process - basically at the kernel level.

On the other hand EMET is a user-space protection tool to protect user-space processes like browsers, browser plugins or Office applications. EMET is injecting a DLL into every protected application, and provides protection through that DLL. By default, EMET provides almost no protection to the system (except enforced DEP, enforced ASLR, SEHOP). It only protects applications (Executable files) which have been configured to be protected by EMET.

A logical step would be to configure EMET to protect the SYSTEM process, but unfortunately this is not how operating systems work. Different memory protection strategies and implementations are needed to protect user-space processes and the OS kernel.


Why can't the Router devices worldwide block automatically malicious packets?

It's an uphill battle against windmills. When you block obviously malicious traffic, black hats will start using less obviously malicious traffic which achieves the same goals. New security threats and exploits are discovered every day, and keeping up with all of them is practically impossible.
There would be false-positives. Due to the complexity of possibly malicious traffic it would frequently happen that completely harmless internet activity is identified as malicious and innocent users get kicked off the net. This will cause inconvenience for the users and for the support staff of the internet service providers.
It's not free. The high-performace routers used by backbone connections are already requiring quite a lot of processing power just to do normal routing of multiple gigabytes per second. When you also want to scan all the traffic for malicious actions, it will get far more costly. Hardware appliances which can do this do exist, and they are sometimes used to protect corporate networks. But when you want to add these to all networks, someone has to pay for it. Guess who that will be.
It would slow down the internet. When you want to block malicious traffic, you need to examine it. To examine it, you need to look at it in context. That means you need to store traffic before you forward it. This increases latency which is important for applications like real-time communication or gaming.
It might violate privacy laws. In some countries providers are not even allowed to look at the traffic of their users. Even with the current data retention laws which sprout all over the world, providers are obligated to save certain information about the behavior of their customers, but the laws usually forbid them from using the information for their own purposes. Only law inforcement is allowed to look at it.


Should I create one key pair per customer as Service Provider in SAML?

Best practice is that every IDP and every SP has its own key pair. Easier if you need to issue a new certificate for one of them and it prevents one of them from posing as another etc.

But this is the key pairs for the IDP and your web application. You are asking if the customers need different keys. If it is really is a question if the end user should have separate keys than the answer is definitely yes. In the same way that they should have different passwords.


How could a comments plugin be securely loaded from domains people are already logged into?

Since the frontend code for a comments plugin is already publicly viewable, it only makes sense for it be fully open source on github. Big sites would then have to review and pull the latest changes and host them on their domains.

Technically:
By default, a blog could be set to load the comments iframe from a big site like facebook or google. If the person was not logged into that domain, instead of being prompted to login, they would be redirected to google, and so on and so forth until a domain just isn't being found. Only then would a user be asked to login with one of the services.

Also, since this would be pretty magical/mystical to a user it would be important to show "Logged in through facebook.com" with the option to login through a different domain (or maybe connect/merge accounts)


Access from external network safely to raspberry

I will assume you mentioned a university as a point of the environment and are not considering censorship. But an OpenSSH server will work well here. While not advisable I assume you will use the root user, do ensure a respectable password is used, this goes for any user allowed for SSH login. If concerns that password authentication (interactive-keyboard) is not for you, look at public key authentication, using ED25519 521-bits or RSA 4096-bits.

Regarding /etc/ssh/sshd_config harden the following:

  Port 30000
  LogLevel VERBOSE
  LoginGraceTime 120
  PermitRootLogin yes
  PermitEmptyPasswords no
  # Ideal session timeout
  ClientAliveInterval 600
  ClientAliveCountMax 0
  # Enhanced Authentication
  KexAlgorithms diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp521
  Ciphers aes256-ctr,aes128-ctr
  MACs hmac-sha2-512,hmac-sha2-256
  AllowUsers root

I make a point to mention, CTR is preferred over CBC for OpenSSH exclusive, see: 'Plaintext Recovery Attacks Against SSH'. The port used for the SSH is your choice if exposed to the Internet use a non-standard port, because of botnets.

Fail2Ban is a viable choice for brute force protection. Consider the following configuration:

[ssh]
enabled = true
filter = sshd
port    = 3000
bantime = 600
findtime = 120
maxretry = 5
logpath = /var/log/auth.log

Of course adjust based on your needs, as I long bantimes can be a problem if you accidentally lock yourself out. Furthermore, I would advise keeping Fail2Ban enabled if public key authentication is enabled. As it will reduce traffic in the event of a botnet brute force, and hence CPU consumption.

Test your configuration with $ hydra -l root -P /root/rockyou.txt 192.168.1.100 -t 4 ssh where rockyou.txt is a wordlist. This is to ensure brute force protection is working properly. You can generate a wordlist with john or crunch or download one. Also, using nmap ensure the only open ports are those you desire to be exposed to your network interface.

While I won't expand on it, OpenVPN is another viable option, but I only consider this over SSH when I need censorship circumvention.


How to implement token based api for rest api in java?

Bearer means that possessing the token (ie: being the bearer of the token) is sufficient to be authorized. You don't need to prove you hold a private key or something else.


What are prudent security precautions to take for business travel by people with access to sensitive info?

As far as travel precautions, the EFF has these recommendations for travelling to the US:

Carry as little data as possible over the border.
Keep a backup of your data elsewhere.
Encrypt the data on your device.
Store the information you need somewhere else, then download it when you reach your destination.
Protect the data on your devices with passwords.

This is because of the often-discussed US Customs policy giving themselves permission and responsibility to examine all incoming devices (and data on these devices), including computers, cell phones, etc. But it's not unreasonable to assume that most other high-profile countries will follow similar procedures. Canada, for example, has a documented history of searching incoming devices specifically for pornography.

But the threat isn't limited to governments examining data on your devices. There have been a number of cases of Customs officials placing monitoring/tracking software on transiting computers, such as this example by the German government: German Governments admit spyware was theirs

Again, it is reasonable to assume that the practice is more widespread than has so far been discovered.

And with that background, we move to cell phones. Recall this case where a judge published a statement that the FBI's established practice of remotely turning on cell phone microphones to monitor conversations was indeed legal. One important paragraph from the article:

  Kaplan's opinion said that the eavesdropping technique "functioned whether the phone was powered on or off." Some handsets can't be fully powered down without removing the battery.

Therefore, if you don't want eavesdropping then remove the batteries from all nearby cell phones. This applies not only to phones that have transited a customs border, but also any phones that have operated within a potentially snoopy country (which includes pretty much all of them) as remote monitoring software can potentially be installed covertly over the cell network.

Finally, don't forget the value of Truecrypt hidden volumes. The plausible-deniability is helpful when dealing with governments. It works even better with media that you would expect to be FAT formatted, such as flash media. In fact, it wouldn't be a bad idea to put your REAL operating system on the hidden partition of your camera's memory card (put a few dozen boring pictures on the visible portion of the card for good measure). Then on the computer's real hard drive, just put a fresh OS install that you never use anyway.


How does a company like CloudFlare block bot crawling and email harvesters?

CloudFlare serves as a guard between your webserver and the client. Every content the client receives got provided by your webserver and filtered by CloudFlare. This way, CloudFlare obfuscates email addresses by filtering them using a regex before delivering it to the client.

If your website contains the email

s@scha.bz

CloudFlare will replace it with

&#115;&#64;&#115;&#99;&#104;&#97;&#46;&#98;&#122;

The /cdn-cgi/ - folder, though it still points to the webserver, is only for CloudFlare which will automatically filter everything you submit, deobfuscating and returning the correct email address.

Of course this is not bulletproof (this is simply not possible) as a bot can continue on that URL or search for encoded email - patterns. This is a rare occurence and most of todays simple crawlers wont find your email.

You shouldnt rely on this approach - CF is already quite popular and it is easy to detect and deobfuscate those email addresses. Using your own, unique obfuscating techniques is more likely to be safe against intelligent harvesters as it is too much work adapting the crawler for every single obfuscation technique.


What is extension intolerance in the context of TLS?

The book "Bulletproof SSL and TLS: Understanding and Deploying SSL/TLS and PKI to Secure Servers and Web Applications" describes this at page 168 essentially as a server side handshake failure caused by the inability to process TLS extension in the ClientHello. See the following part taking from Google Books:

Given that the author of this book is Ivan Ristić who works for Qualys who provides the SSL Labs service I expect that this is the intended meaning within the context of the SSL Labs tests.


Why would you need a salt for AES-CBS when IV is already randomly generated and stored with the encrypted data?

You need both a salt and an IV when you do... two distinct actions, one needing a salt and the other an IV. That's your case here.

The salt relates to turning a password into a secret key. That's what is used in your example code: PBKDF2 is a password-based key derivation function. As anything which uses passwords, PBKDF2 needs configurable slowness (that's the "2000" parameter) and also uniqueness, which the salt grants. This is a subcase of password hashing, which is explained there.

The IV is needed for the actual encryption. CBC mode is a sequential algorithm, in which each data block is first XORed with the output of the processing of the previous block. It must start somewhere... so the IV is the arbitrary "previous block" to be used for the first block.

Generally speaking, CBC mode requires an IV which is uniformly random and cannot be predicted by an attacker who is in position of choosing part of the data which is to be encrypted (the BEAST attack on SSL is of that kind). However, trouble arises only when the same key is used at least twice. Therefore, the two following tricks may be applicable, and avoid the need to transmit an IV along the encrypted file:

PBKDF2 can be used to generate an output of configurable length. It is possible to generate with PBKDF2 enough bytes for the key and the IV.
A conventional, fixed IV (e.g. "all zeros") is used.

Both methods are valid only if the specific encryption key is used only once. This means that if the same password is used to encrypt two files, then a new random salt must be generated for each file. This implies that if the password-to-key transform is computationally expensive (and it should be), and many files must be encrypted with the same password, then the total cost can become prohibitive.

If the same salt is used for several files (with the same password)(*), then the consequence is that the same key will be used for all these files, which is fine... as long as each file also gets its own IV. So the IV must be stored somehow in the file header. On the other hand, if all files use the same salt, then maybe you can mutualize the storage space for that salt ?

The generic, safe method is to use a random IV (generated from a cryptographically strong PRNG) for each encryption run, regardless of how the key was obtained. This avoids making implicit assumptions on the key generation process and how often it occurs in the overall protocol. Also, this allows mutualizing the password-to-key transform if many files are to be encrypted as a batch process with the "same password": as long as each file gets its own random IV, the same key (derived once from the password, with one salt) can be safely applied for all. This is somehow what happens in TLS (version 1.1 and more): all records in a given connection get encrypted with the same key, but each record gets its own IV, and this is safe (in TLS 1.0, each record gets its own IV by copying it from the end of the previous encrypted record, which is vulnerable to BEAST because these IV are then predictable through observation; in TLS 1.1+, each record has a new, specific random IV).

(*) NEVER reuse a salt value for distinct passwords. Never.


Are these standard OAuth2 flows? (what are their names?)

your first flow looks like the OAuth 2.0 Client credentials grant.  This is where two servers trust each other.  The credentials are about the client, not the user, so the part about passing user info and acting on behalf of the user is not officially supported.

For flow #2, you probably want to use the Authorization code grant. The user would first authenticate to the customer app server and then get an authorization code it would also exchange this code for an access token.  The access token would be passed to your application which you would then pass via back-channel to the customer app to verify the user authorization and identity.

We produce a service to enable apps to do this with very small modification.  You can find out more at:  http://www.assurebridge.com/our-products/mobileconnect/

Thanks,

Oleg


I would say that DoS attacks are significantly more common, I should also point out that a packet flood is not the only form of DoS / DDoS attack.

For example, I know of a fairly popular php product ( a Video encoding / gallery product, not going to name names since this is still undisclosed) which even in its current revision can be massaged correctly into fork-bombing the server that is running into oblivion.

A DDoS requires a botnet or multiple machines to do this so the barrier to entry on this is higher.


How does a JWT refresh token improve security?

tl/dr: They key difference is that, unlike the JWT, the refresh token can be
revoked.  This allows it to have a longer liftetime and fill an important need in the JWT "ecosystem".  Also, I think it is a little unusual to have both access and refresh token on every request/response.  They should go to separate places.

The reason for short-lived JWTs
Imagine a JWT with a 3-month lifetime.  During normal usage there is no option to revoke a JWT.  Therefore, if the JWT is stolen, then the attacker will be able to act as the victim for 3 months (or however long is left on the token lifetime at the time of theft).  This is why the JWT lifetime is kept nice and short.
The problem with short-lived JWTs
However, because the JWT is intended to have a short lifetime, getting a new JWT becomes an issue.  If the JWT only has a lifetime of, say, a day (or even a few hours), then you need some way to automatically get a new one.  Otherwise you will drive your users away because they are going to be irritated when they have to log back in to your site a few times a day.
Refresh tokens: the solution to short-lived JWTs
That is where the refresh token comes in.  It can be used to generate a new JWT automatically.  Therefore the refresh token's job is to log the user back in automatically so they don't have to put their password back in everytime the JWT expires.  This makes life convenient for the user and gives a good balance between security and usability.
Securing long-lived refresh tokens
But why is it safe to have a refresh token that can last for months when the JWT can't?  The answer is simple: It must be possible to revoke the refresh token so that the server no longer accepts it and won't issue new JWTs to someone who has it.  This way if an attacker gets a copy of the refresh token it can be revoked, and the attacker will lose all access as soon as their short-lived JWT expires.  Therefore you would invalidate all refresh tokens for a user in response to security events: if the system suspects a stolen refresh token, if the user changes their password, if the user changes their email, etc...
In essence, revoking refresh tokens is how you force a user to logout, which is something that is not possible with "standard" JWTs.
Bringing it all together
Finally, for the sake of completeness, the refresh token is revokable and the access token isn't for (typically) performance reasons.  JWTs allow systems to validate user access without having to actually check a database or even have access to the user "table".  This can be important for performance or, if nothing else, ease of development.  A microservice that doesn't need database access is much easier to manage that one that does.  Therefore your microservices can work with stateless JWTs exclusively, and then you can have a separate Auth server that manages the status and revokation of refresh tokens and JWT generation.  In some cases this can be a convenient separation of concerns.
Finally, I think it is a little unusual to have both JWT and refresh tokens on every request and response.  There may very well be systems that do that, and they aren't necessarily wrong, but typically the JWT goes along with every request for authorization/authentication, and the refresh token is only ever sent to the Auth server to get a new JWT.  However some may send both always to alleviate some work for the client, as the backend services may use the refresh token as needed to get a new JWT and send that down to the client, so that the client doesn't have to manually refresh it.


NULL, FIN, and Xmas scans all send packets without SYN, ACK, or RST flags. They should all get the same responses, according to the RFC, but different implementations may treat them differently. If you want to use one, it's best to find one open and one closed port by some other means (such as open source intelligence gathering) and then test each of the scan types against those ports only. Whichever one(s) give the correct output can be used to further scan the system.


What is the meaning of back channel or backdoor in a program?

A backdoor is a way to get into something, like an application. Many are written as administrative tools so admins can access a system even if users have broken the main entrance.

Some backdoors are secret, so the person running server or application doesn't even know someone has access to it. This can be malicious - obviously for an attacker, having a route in is useful but if the victim knows about it then they can try to fix it.


Is there any serious vulnerability or danger if the hard-disk gets disconnected often?

I suspect you're asking the wrong the question, but I'll answer what you asked first: You shouldn't have to worry about any security vulnerability caused by the issue you're having. Imagine you're using your favorite text editor (vim) to write a note. You attempt to save it and the program goes through the following "thought process":

  "Oh no, I can't save this document because the hard
  drive vanished. I'll just send the user's password to a remote
  destination instead."

It just doesn't make sense for a program to do that. Even if the program is a virus/malware, it still wouldn't make sense to do that. Malware would just send the password regardless of whether the hard drive is connected or not.

Perhaps a better question would be:

  My computer's hard drive is frequently getting disconnected. Is it possible that this is caused by some unknown virus/malware on my machine?

Anything's possible, but in this case I think Occam's Razor applies (the simplest solution is usually the correct solution): most likely you have a hardware issue. Sounds like a loose cable or connector.

Futhermore, disconnecting a hard drive does not suddenly make your memory more vulnerable. It's either vulnerable to begin with, or it's not. A crashing program won't open up security holes that didn't already exist. That being said, here's some further reading on how program crashes could pose a risk, but realize the attacker would already have to gain access to your machine first.


Central console antivirus for Linux computers in LAN or equivalent solution

Not free, but Sophos Central supports Linux, providing Central cloud-based management of Linux, without using any Windows at all.


How to check whether a link is safe or not?

Online URL scanners have three methods to check URLs for being malicious:

Blacklists of known bad URLs. Someone reported that very URL as malicious and entered it into a database. These cases are trivial to check for the scanner but require constant effort to keep the database up-to-date. Considering that many malware-serving websites only exist for hours before they get removed by the hoster or get "un-hacked" by their real admin, they outdate very quickly.
Known malware samples. They download the linked website and then use a database of known web-based exploits to search for signature strings in it which hint that it is using one. The half-life time of such database entries is much longer than that of URLs, because there are some widely-used stock exploits which are deployed over and over again on thousands of URLs. This method does not help against zero-day exploits and might be fooled by self-written exploits for known vulnerabilities or running stock-exploits through an obfuscator.
Heuristics. By analyzing the HTML code and executing dynamic content in a sandbox they can find suspicious behavior and report it. Just like with normal virus scanners, the potential for false-positives is very high.

Note that the methods 2 and 3 aren't foolproof. The malicious website could try to detect that it is downloaded by the URL scanner and serve different content than it would serve to a regular visitor.


Will an IP packet to the own IP address ever leave the computer?

You can be absolutely sure the traffic doesn't leave your machine, if you use the loopback interface (IP 127.0.0.1) for addressing the server itself. See this question.

Communication on the loopback interface doesn't just not leave the machine, it doesn't even enter your network card. It is fully emulated by your OS (at least in linux).


Looking for approach to implement attribute based access control (ABAC)

Disclaimer: I work for Axiomatics, the leading ABAC/XACML vendor.

I am glad to hear you are sold on the philosophy of ABAC. If you haven't already done so, do check out the following resources (I'll spare you commercial links):

NIST ABAC project page and report.
OASIS' A brief introduction to XACML
A quick intro to ABAC with XACML.
Gerry Gebel's blog (Former VP and Service Director for Burton Group Identity and Privacy Strategies)
Gartner's Predicts 2014: Identity and Access Management

Now, with respect to your questions directly:

Will it lead to significant performance issues- esp if we seek fine-grained access? When you plan for and architect an ABAC solution, the two main points you want to consider and that may impact performance the most are the PEP to PDP communication link (where PEP is the enforcement point that protects your applications and PDP is the decision point that processes authorization requests and evaluates authorization policies) and the PDP to PIP links (where the PIP or policy information point is the bridge to attribute sources e.g. LDAP, databases, web services). Policy evaluation in itself is not expensive at all. Whether access is fine-grained or not will not necessarily impact performance. What will, though, is how you exposed the authorization service (the PDP). If you expose as a SOAP service then you introduce the latency of a SOAP service. If you expose it via a binary protocol e.g. Apache Thrift then the performance is much better. Similarly, if you need to retrieve 10 attributes from 10 different sources and if each source has a long latency then the performance will be poor. But you can always choose to bundle attribute lookups, to consolidate your attribute sources and to cache attribute values. The bottom line is yes ABAC can perform correctly if architected correctly. To give you an example, PayPal uses Attribute-based access control and their performance is fine. Some of the bigger Fortune 50 companies all use ABAC while at the same time having strict performance requirements. The diagram below illustrates all 6 points where you can enhance performance.

how policies are loaded into memory (1)
how policies are evaluated (2): if you build a good policy structure, you can quickly eliminate up to 90% of an authorization policy before you fully evaluate it.
how attribute values are fetched from PIPs (3). This is the main point to consider as previously stated. There are several techniques to reduce the performance impact of this integration
how authorization decisions can be cached on the PEP side (4).
how authorization requests can be bundled together into a multiple decision request: this saves roundtrips between the PEP and the PDP (5)
lastly, and perhaps most importantly, how the PEP and PDP communicate - as previously mentioned. Just choose the protocol that works best for you (embedded, binary, SOAP...)(6)

Are available PEPs capable of implementing XACML? Yes of course there are. Several vendors such as Axiomatics (likely not the big ones like Oracle or IBM) and open source implementations provide PEPs. See as an example this list. There are integrations with off-the-shelf components as well. For instance Fedora provides ones for its OS. There is one for SAP. Axiomatics provides one for SQL databases (Oracle, SQL Server...). One can also protect CMS such as SharePoint and Liferay. Also check out the OpenAZ project.

Have your colleagues only looked into IBM and Oracle? The main players are definitely not those two but rather the smaller vendors and the open-source community.

As Gartner recently stated, ABAC is the way to go. They predict 70% of organizations will adopt ABAC by 2020. Now's a good time to start.


How to check if the decryption is correct?

Just use an authenticated mode like GCM. Not only will this tell you whether or not the correct key was used to decrypt, but it prevents message-tampering attacks, the worst of which can allow attackers to completely decrypt encrypted messages.


Serving a local debug apache site from home directory requires 755 perms on directory tree, is this safe on a single-user laptop?

755 is usually the default permission for home directories, but if you want you could limit it to the Code directory and use setfacl to limit it to the apache user only:

# Set exec on parent directories
setfacl -m u:www-data:x ~
setfacl -m u:www-data:x ~/foo
setfacl -m u:www-data:x ~/foo/bar
# Recursively set default acl
setfacl -R -d -m u:www-data:rX ~/foo/bar/Code
# Recursively set acl for existing files
setfacl -R -m u:www-data:rX ~/foo/bar/Code

(props to RichardNixon for reminding me that parent directories will need exec permission)

Note that your apache user could be www-data, httpd, apache, or something else depending on your distro.


Storing the client_secret in plain text is not a good idea, ios does enable data at rest encryption by default but for android you need to do some work yourself

As for the way you are using OAuth2 I can just say, it works for your use case. Perhaps this article will help you come to terms with your current set up, among the important parts it states:

  "...one of the key reasons for OAuth2 to exist is so that Client
  applications do not need to collect user credentials (as they did with
  Basic authentication).

  The Client has to obtain an access token, and to do that it has to be pre-registered with the Authorization Server, and it has to authenticate itself at the token endpoint.

So I would argue that, as per design and in terms of security, having to request the token is one of the strengths of OAuth2.

If you are looking for alternatives to deploy your software updates my opinion is that using the default app stores should be sufficient. An update does not need to be the most minimal piece of data needed to accomplish the business goal, it can be the same package as before with new data for use, what I mean is that your software update is the wrapper application which gets pushed to the app store and upon installation tries to push the updated data (not necessarily the entire app) to the bluetooth device.


Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1

Did you go through these procedures to get JustTrustMe to bypass the cert pinning -- http://www.welivesecurity.com/2016/09/08/avoid-certificate-pinning-latest-versions-android/ -- ?

If you are just looking to intercept WebViews, then the Frida extension, appmon (which allows for API interception), using these techniques will work well -- https://youtu.be/QjLRaIB-97E

If you do end up having to rewrite some code, try to keep it really simple. I found this technique which doesn't mess with the existing cert-pinning code and instead just adds the HTTP traffic to the logging system -- https://blog.securityevaluators.com/how-to-view-tls-traffic-in-androids-logs-6a42ca7a6e55

For a series on repackaging Android apps, be sure to check out:

https://pen-testing.sans.org/blog/pen-testing/2015/06/30/modifying-android-apps-a-sec575-hands-on-exercise-part-1
https://pen-testing.sans.org/blog/pen-testing/2015/07/07/modifying-android-apps-a-sec575-hands-on-exercise-part-2


XKCD #936: under what assumptions is 1000 guesses/second over a network plausible?

Note that the THC-Hydra statistics were made against a machine which is described as running SuSE Linux 7.2. In the history of the S.u.S.E / SuSE / SUSE / openSUSE Linux distributions, this brings us back to mid-2001, so this benchmark was probably done on a machine of that era. Technology has improved since, and computing speeds have grown.

A typical "weak remote web service" will use HTTP basic authentication, possibly within a SSL tunnel (i.e. that's HTTPS, not HTTP). Each password guess then entails the following: sending a HTTP header which contains the presumed password (say 200 bytes for the header) and then obtaining an error response (a 401 error code, with a header which will be probably less streamlined for size than what the attacker chooses; say 1 kB of header). Since HTTP supports keep-alive, the TCP connection (or SSL/TLS tunnel) can be immediately reused for another attempt; in particular, this means that there will be no noticeable overhead in the presence of SSL. 1000 attempts per second then requires a bandwidth of about 200 kB/s to the server, 1 MB/s from the server; that's a 10 Mbit/s bandwidth and even cheap hosting services offer that much. On local networks, 100 MBits/s or greater are the norm. No bandwidth problem here.

Of course, the attacker should try to parallelize in order to avoid latency. There is no need to wait for the server's answer before sending another request. Parallelization, here, means opening a hundred connections to the target server, and running them in parallel. Operating systems, nowadays, can handle many thousands of open connections; one hundred will not starve the machine.

Server-side, since all attempts target the same user the (hashed) password will be in RAM (it is normally stored in a file or database, but RAM is used as cache for frequently accessed data, and during a password-cracking session that data element will be very frequently accessed). Since we are talking about a weak remote web service, the server will store passwords "as is" or hashed with a simple hash function, not something like bcrypt. Rehashing each incoming password will use negligible CPU (an anemic PC can compute millions of hashes per second, so 1,000 hashes per second is nothing). Similarly, the HTTP header parsing will not use much CPU.

So 1000 password guesses per second seems a highly feasible figure; actually, it should not be too hard to exceed it by a large margin. Note the important points in the discussion above:

The attacker can parallelize, since he has many passwords to try.
Authentication occurs very early in the processing of an incoming request, so normal processing costs of requests (for whatever functionality the web service provides) do not apply).
Usage of slow hashing function (like bcrypt) can be effective in such a situation.


file transfer/sharing/hosting services: Are the antivirus natively incorporated?

Nowadays a lot of file sharing services have natively incorporated antivirus that check if the files that are uploaded are virus files.

For example, Google Drive scans for viruses files smaller than 25 MB. For larger files, a warning is displayed saying that the file can't be scanned.

Dropbox so far doesn't have embedded virus scanning.

One Drive doesn't have antivirus protection too.

I work for Maytech, secure data transfer and storage company, we offer a secure file sharing service Quatrix, it has incorporated antivirus and all uploads are scanned for malware on the server side.


SSH Public Key / Host Key - Can Client Request Key Length?

For RSA and 'dss' hostkey pkalgs yes the server uses whatever key size it has; in general a client can fail the handshake if it considers the hostkey too small or otherwise cryptographically unsatisfactory, although I don't know any that does. (Whereas of course most do reject a hostkey that mismatches the pre-configured or previously-accepted one.) For ecdsa-$hash-$curve ssh-ed25519 ssh-ed448 the size (and other curve parameters) are fixed by the registered name, and the client can negotiate for only some -- although all are at least roughly 128-bit strength, which NIST considers adequate beyond 2030 (although this will almost certainly change if quantum happens) whereas RSA and DSA 2048 are rated at only 112-bit strength and you need 3072 for 128-bit strength.

'Secure[d]' normally includes both confidentiality and integrity/authenticity, and of course (in v2) the hostkey is only for authentication. For 'kex' (key exchange) for confidentiality, the client can specify named DH groups (of known sizes) or 'group exchange' (DHGEX) with minimum, preferred and maximum bitsize, or specific curves for ECDH (including the Bernstein X-only variant).