I am partial to the appsec side of penetration-testing.

Hunting Security Bugs
The Art of Software Security Assessment
Secure Programming with Static Analysis
Open-Source Fuzzing Tools
Fuzzing for Software Security Testing and Quality Assurance
Gray Hat Hacking, 3rd Edition
Advanced Windows Debugging
How to Break Software
Seven Deadliest Web Application Attacks
SQL Injection Attacks and Defense
Identifying Malicious Code through Reverse Engineering
The Shellcoder's Handbook (both 1st and 2nd Edition since they vary so greatly in content)
A Guide to Kernel Exploitation: Attacking the Core
Managed Code Rootkits
Mobile Application Security
Why Programs Fail, 2nd Edition
The Mac Hacker's Handbook
Gray Hat Python
The Software Vulnerability Guide
Hacking Exposed Linux, 3rd Edition
Code Reading: An Open-Souce Perspective

Most of the other answers seemed to be focused on web pen-testing or network pen-testing.

If you really want to learn network pen-testing, I'm surprised there has been no mention of:

Silence on the Wire
Network Security Assessment, 2nd Edition
Aggressive Network Self-Defense
Hacking Exposed Cisco Networks: Cisco Security Secrets & Solutions
Securing the Smart Grid: Next Generation Power Grid Security (useful for more than just Smart Grid stuff -- invaluable, and up-to-date resource for network, web, and app pen-testing)
Unauthorized Access: Physical Penetration-Testing for IT Security Teams
The Hacker's Handbook: The Strategy Behind Breaking Into and Defending Networks

If you want to learn the business process side of pen-testing, you'll have to check out Valsmith and H.D. Moore's work on Tactical Exploitation. I also recommend the Trace Security "Social Engineering: The Art of Human Hacking" book and the older "No Tech Hacking: A Guide to Social Engineering, Dumpster Diving, and Shoulder Surfing" from people who seem to have done PTES style pen-tests hundreds of times and let go with some practical knowledge of how to deal with situations instead of just technology.

You also may want to check out some fiction (e.g. Zero Day, Stealing the Network: The Complete Series Collector's Edition, Final Chapters) and some non-fiction (Zero Day Threat, Fatal System Error, No Place to Hide, etc). Yes, I've read all of this stuff except Zero Day: A Novel, which I just started. Haven't heard much about "The Lure" or Kingpin yet, but I plan on checking those out as well.


I am unable to secure a WPA handshake (4 way handshake)

First you have to make sure that your NIC can inject and that the targeted access point is in range.

aireplay-ng -9 wlo1

After running this command you should see 'Injection is working!' , and the targeted AP with a high response rate ( 50 - 100% )

Deauthentication attack sends disassocate packets to connected clients, so you need to have at least one associated client.

airodump-ng -c <ap channel> --bssid <ap mac> wlo1

There should be at least one MAC under the 'STATION' tab associated with the AP. You can use this client for a targeted attack.

aireplay-ng -0 5 -a <ap mac> -c <client mac> wlo1

You may have to run the above command several times untill you get a handshake.

You can increase or decrease the number of deauthentication packets. Sometimes one is enough, sometimes it takes ten or more. If you still can't capture a WPA handshake then maybe the issue is with your NIC. Here you'll find a list of compatible drivers, and a patching guide.


Metasploit opens Meterpreter but shows no prompt please help

The Meterpreter session has gone to the background, which is default behaviour for Metasploit now.

To view the background sessions:

sessions -l

To interact with the session:

sessions -i <session id>


Is it worth the effort to store FTP passwords encrypted?

I wouldn't bother to be honest.  Most application store their database passwords in plain text,  i don't see this as being very different.  If you are on a shared host,  make sure only your user account has read access to the file.   I also strongly recommend using SFTP or FTPS,  if you aren't using one of these protocols then you are begging to be hacked.


how to create an encrypted ssh tunnel between local machine and final machine?

In reading your question I have to assume “my local machine” is outside the company network, like in your home or somewhere on the Internet.  More well defined locations, operating systems in use and a brief description of your company environment would assist those attempting to answer questions.  For the purpose of this response I'm going to give systems identified in your question some names.

“my work machine” = work-machine
"my local machine” = home-machine
“another machine” = jumpbox

This is really a matter of company security policy.  Connections from the Internet to systems on a company's internal network are typically not allowed because they provide a path for attackers to access internal resources and ex-filtrate data.  I can only assume that the jumpbox you are connecting to is a gateway device (preferably in a DMZ) that exists for some combination of authentication, authorization and accounting, and potentially inspection.

That being said, if policy permits, you would need to have your firewall administrator permit connections from your home-machine to your work-machine.  This is typically undesirable if you're coming from a dynamic IP address that will change over time, as the firewall administrator will need to allow broad ranges of IP addresses in to the network.  Ideally, if inbound connections are permitted to your company network you will always come from the same IP address when connecting from your home-machine.

Alternatively, you could use a reverse tunnel using SSH; again, if your company policy allows outbound SSH connections.  The -R option in SSH allows you to build reverse tunnels.  For this you would require a method of connecting form your work-machine to your home-machine.  You'll need to consider following items:
    1.  Name resolution (if your IP changes at your house): There are plenty of dynamic DNS providers out there.
    2.  Port forwarding if you're behind a NAT device, such as  a DSL router.
    3.  Your home-machine or another dedicated system would have to be running SSH server to accept the ssh sessions coming from your work-machine.

Once you've configured services required in 1-3 above, you can make a connection from your work-machine to the SSH server running at your house.  From your work-machine, the command might look like this:

ssh -R 192.168.12.202:5556:127.0.0.1:22 ricardo@my.house.com:4444

If I were to speak the command above, it would go like this:  Use ssh to create a reverse tunnel (-R), opening a listing port (5556) on my ssh server (192.168.12.202). As clients connect to port 5556, forward them to port 22 on my ssh server (127.0.0.1), which is subsequently forwarded back to the machine originating the tunnel (work-machine).

There are a lot of technical tutorials out there which provide instructions for building reverse tunnels with SSH.


Is there some type of x-ray that can see through HSM or shielded integrated circuit?

X-rays lack the spatial resolution to see objects of the size required to visually map out a modern integrated circuit. Gamma rays are too energetic to be focused by any sort of lens, so they can't really be used to see through anything. Neutrinos are even more ghostly. Chances are, not a single neutrino has ever actually collided with a particle in an HSM in its entire lifetime.

Leaving aside the physics aspect of this question, I need to point out that you are assuming that being able to see the internals of the device would be a security risk. This assumption is false. At most, being able to see the internals of an HSM would reveal trade secrets. It would not necessarily reveal anything stored digitally. While I believe a charged NAND cell can be identified with extremely high-powered microscopy in a chip-off situation, anything that is capable of seeing through the IC itself, including X-ray microscopes, will likely not have nearly sufficient resolution.

This is all rendered irrelevant as modern HSMs will typically not be heavily-obfuscated internally, but they will be shielded from many sources of electromagnetic radiation. While this shielding is typically designed to frustrate fault attacks, it will still manage to block an X-ray microscope. As such, it would be necessary to perform chip-off forensics against the HSM, which is quite difficult.


How good is confidentiality with physical mail forwarding companies?

You don't have any guarantee of this. Even with the best intentions, the staff could be duped by social engineering.

You can't really minimise the risk any further than using a reputable forwarding company, but my advice would be to call them and ask about their account security practices. They may also be able to set an account note about your situation, e.g. "customer requests that no information, especially forwarding address, is revealed to anyone who calls in relation to the account, even if it's the customer themselves". At least that way you have some peace of mind over the matter.


DVWA - Odd command injection behaviour (High)

It's caused by the deliberately faulty blacklist. Pipe followed by space gets replaced with an empty string. The second pipe is immediately followed by a c and thus does not match the blacklist and hence slips through. The first pipe and space are redundant. Ip|cat should also work, as does ip%0acat and ip%26%26cat.


Are there Secure Coding Standards other that CERT?

I'm aware of two:

The OWASP Developer Guide (to go along with the OWASP Top 10).
David A. Wheeler's Secure Programming HOWTO, which is a very long and very comprehensive guide.


When deciphering the message, the recipient must have a way to ensure that the padding hasn't been modified (which obviously you cannot when the padding is random).


What is actually the purpose of encrypting the values in a cookie?

If the encryption key is stored on the server, then only the server can decrypt the cookie, and only the server can make predictable changes to the cookie.  An attacker can make changes to the cyphertext of the cookie, but they cannot know in advance what effect those changes will have.  If the cookie additionally includes a message authentication code or other anti-tampering measure, then an attacker cannot make changes to an encrypted cookie without invalidating it.

Encrypting the cookie also keeps the user and others on the same computer from being able to see what information is being stored.  This permits the server to associate sensitive information with a user (eg. "log me in automatically" information), without needing to track the session server-side.

Cookie encryption does nothing to keep cookie-stealing attacks from being used to impersonate a user; to defend against that, other measures are needed.


Can Subject Alternative Name(SAN) Certificate install on different Web Server or OS?

Yes.

You can use OpenSSL to convert the certificate into different formats as required by the application / server.

I've seen Apache / Tomcat configured a number of ways. Sometimes with a .pfx, sometimes with .pem files, and sometimes using the Java keystore.

IIS typically uses .pfx files.

With that being said, you want to make sure that your CA allows you to install the certificate on multiple servers without requiring additional compensation to be covered legally.


UFW appears to block connections from remote address, but NAT is disabled on my router

As your question isn't precise on some points, I'm making a few assumptions here:

Your "router" is a COTS router, actually a NATing device, not an actual router.
You do have more than one device within the network.
You have not configured the COTS router in a specific ways, leaving it at default settings (maybe apart from changing the WiFi password).

There are several possibilities that can lead to this kind of logs and I am partly incorporating comments on the question in this answer.

Your router might be compromised and have enabled port forwarding without you being able to see this in the GUI.
Another machine in your network might be compromised and sending UDP packets with spoofed IPs.
Your machine might be compromised and opened that forward by sending a packet first (yet, this doesn't usually work out of the box for UDP).
Your machine (maybe for legitimate reasons like peer to peer networking) may be requesting an ephemeral portforward from the router via uPnP.

Generally speaking, you shouldn't rely on a NAT as a kind of firewall. While it generally provides (some of) the effect, it's not designed for security but for usability. On the other side, you seem to be using a local packet filter - which could be configured more rigiously in regards to outgoing packets - that can help reduce risk significantly.


Malicious Links that Respond to Browsers but not curl or wget

The website seem to be be only checking the User-Agent. I tried the following

wget --user-agent="Mozilla/5.0 (Windows NT 5.2; rv:2.0.1) Gecko/20100101 Firefox/4.0.1" "http://tfdesignsandpcrepair.com/dinwnle.php?get_info=ss00_323" -O file.zip

and it seems to be working

One possibility is that you might have tried so many times without a valid User-Agent that eventually the server blocked your IP and now it's giving you 404 regardless of your request.

Update: Yes, that seems to be the reason. After 3 successful attempts to download the file, the server started throwing me a fake 404. I used a proxy, and I noticed the same behavior; 3 successful downloads and then a response with the length 153 containing:

<title>404 Not Found</title>

Not Found

The requested URL was not found on this server.


Your question is a bit vague, so I don't know exactly what you are looking for. However, in this paper a taxonomy based on HTTP methods is described:
http://140.127.40.47/psnl/publications/2008ICHIT_taxonomy.pdf


Deliberately vulnerable Flash applications?

You can use OWASP Flash Security Project. There are plenty of resources for such kind of applications: https://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project


dnsspoof doesn't spoof DNS request with IP-address of local machine

It seems that dnsspoof needs a hosts file in order to know what address to reply with for which hostnames. In your case, you want all requests to resolve to the same address. From the manpage of Dsniff dnsspoof:

-f hostsfile
          Specify  the  pathname  of  a  file in hosts(5) format. Only one
          hostname allowed per line (no aliases), although  hostnames  may
          contain wildcards (such as *.doubleclick.net).

Note that hostnames in the hosts file can contain wildcards to match multiple names in a single line. We can use this to match all hostnames with a wildcard. Create a hosts file with the following line:

192.168.1.1 *

This will result in matching all hostnames to your address, 192.168.1.1.

Note that even after doing this and running dnsspoof with the -f flag, you still may run into issues, as the real DNS reply may reach the victim before yours. Other answers may help with this issue. There are also other tools that may better suit your use case, such as DNSChef.


“Double hashing” with 2 different hash functions

This feels like re-inventing the wheel, and I doubt will achieve any tangible increase of security. The designers of those functions really considered all those aspects when creating those secure hash functions.

The addition of salt helps fight against rainbow table. Using two hash functions instead of one is useless as it still allows the computation of a rainbow table. Only a good random salt prevents and attacker from doing so.
If sha256 produces the right length for you, then use it. You're not gaining much by using sha512 beforehand. Your search space / entropy depends primarily on the password anyway.
This is also negligible. If you want to increase computation, you'd have to use a hash function like bcrypt that adds a computational workload. Hash functions are generally very fast.


How secure is JavaScript based OAuth 2.0

OAuth 2.0 pretty much requires HTTPS, as it doesn't have any means to make tokens secure. So, if google and facebook actually allow you to use OAuth2 over plain HTTP that is bad. Are you sure that is the case? I thought both of them are https-only for quite some time.

On the other hand, OAuth1 works fine over plain HTTP as it has it's own layer of secure digital signatures


What is the danger of hosting your SSL certificate yourself?

Using an SSL certificate for your websites primarily gets you two things:

Identity proofing that your website is who it says it is
Stream encryption of the data between the webserver and the client

By doing what you propose, which is normally called self-signing, prevents you from relying on the identity proofing. By using a known trusted CA the client can follow the signature chain from the certificate you present up to a root level trusted CA and gain some confidence that you are who you say you are. (It should be noted that this trust is really more like faith as CA compromises do occur and some CAs take proofing much more seriously than others.)

You will, however, still have the data encryption. So if you don't need the trust aspect, then you should be fine. Personally, I have several web sites and webapps at home that I use self-signed certificates for. Since I'm the only user, I can reasonably verify the certificate manually without the need for a 3rd party to tell me that the computer under my own desk is really the computer under my desk.


How to protect against adversaries snatching booted laptops to defeat full disk encryption?

In fact operating a computer in a public place is not a good idea. If the place you will choose can somehow be predicted, surveillance devices might be attached to e.g. film you entering your password making the snatching scenario unnecessary for your enemy.

The following measures (most taken from the comments here: https://news.ycombinator.com/item?id=8929906) could help to protect data on your laptop:

a physical connection between you and the laptop that is plugged in and shuts down the laptop once unplugged
an invisible connection (e.g. Bluetooth) that reacts to changes in the signal strength
a build in or somehow attached accelerometer that detects rapid movements of the device
a software that detects loud noise (e.g. you shouting as loud as you can)
a software that uses the camera to detect a save pattern (e.g. your face, your red sweater with that big cross in the middle)

All of these might eventually trigger in a moment where they shouldn't so you might not want them to destroy your harddrive or you should check if the data that could be compromised is "worth" an accidental loss.
Also if you are observed your enemy might eventually figure out what mechanisms are in place and will try to act accordingly.

Apart from that you should not decrypt all of your sensitive data when in a public place. You might want to decrypt only a minimal subset that is required for you to work on whatever you got to do. That will effectively minimize the amount of data available to your enemy after a successful snatching-attack.


Is SOCKS proxy lest secure than VPN? How?

SOCKS doesn't add any additional encryption by default. If your traffic is already encrypted then it will stay that way. While a VPN can encrypt everything leaving your machine, such as DNS.

SOCKS also does not protect against traffic analysis

I know you didn't ask benefits, but to help balance my argument for others, SOCKS can be a lot faster because of the lack of additional overhead encrypting.


Online backup of secret keys in crypted zip

Your keys will be exposed if an attacker

is able to get hold of the encrypted key information and
is able to actually read the keys.

The scope of (1) is not different from any other information on the server. To read the keys (2) several things might happen (also be aware that the private keys are already encrypted by GnuPG if protected with a passphrase, so an attacker will have to get around both ccrypt and the OpenPGP private key encryption):

keys not encrypted properly due to user mistake
passphrase exposed due to user mistake
passphrase can be brute-forced
issue with the encryption algorithm
issue with the implementation in ccrypt

Only you can decide whether these risk seem acceptable. Personally, I would not upload key backups, also not in encrypted form but store them safely and disconnected (they don't change often, anyway).


Insecure Deserialization in C# (.NET) - How to identify and test

Insecure deserialization is not a Java specific flaw, all languages are subject to this kind of vulnerability. Please have a look at this 2017 blackhat conference : Friday the 13th: JSON attacks, it focuses on .Net JSON serializers.

You can find a useful tool to test your developments in yoserial.

Regarding XXE, it has nothing to do with serialization, those two vulnerabilities are clearly separated in the latest OWASP's top ten.


How can the low-water mark property apply to Bell-LaPadula?

I think I'm taking the same class as you and I think I've figured out a solution to this problem, but I may be wrong. The low watermark policy of the Biba Model allows one to write up and read down, but in order to read down the subject must lower their integrity level to do so. This means that when accessing information, it is crucial that it is done in the correct order.

For the question, they're asking us to use a combination of the Bell-Lapadula model and the idea of low watermark policy, where reading down lowers the integrity level and writing up is okay provided the objects being modified are contained in the higher-level object matrix.

Hope that helps.


First time I've heard about this, but it doesn't mean it's not well-known.

Sounds a little similar to OATH HOTP / TOTP. OATH is based on RFC 4226 and seems at least at a first glance more robust. For example it uses HMAC instead of simple hash (motp uses MD5). OATH was also adopted by products like Yubikey and recently Google Authenticator.

Based on these very shallow facts, I'd say I would personally prefer OATH over this seemingly-bespoke solution. It would require a deeper analysis to really flash out the advantages/disadvantages of those schemes.

I hope this answers your first two questions.

As for the reasons for choosing it - One Time Password (OTP) not only protects against eavesdropping over the communication line. So whilst SSL will ensure the password  (or one-time-password) is transported securely, OTP ensures that even if the password is lost/stolen, it cannot be re-used. It's unique for every session. So even if someone looked over your shoulder when you typed your password, since it's a one-time password, they can't use it again.

There are some other advantages to OTP schemes, in this case it acts as a 2nd factor authentication. Not only what you know, but also what you have. In those mobile-based OTP schemes, it's usually some secret key that is stored on your phone and is used to generate the password. So an attacker will not only need your password, but also your phone (or the key on your phone), in order to authenticate as you.

Most authentication schemes are complementary to SSL and wouldn't replace it. Even if the authentication process is secure, there's usually other data being exchanged, or some kind of session established. For example, consider logging into your bank account, and then viewing transactions or transferring funds. Protecting the authentication alone (e.g. via OTP) is not enough. Same goes to just protecting the connection (using SSL without authentication). To protect it better you'd usually combine SSL with some form of user authentication.

Regarding your concern about storing PIN/key in reversible form rather than using a secure-hash. I would say this is probably an acceptable trade-off considering what you gain. OTP gives you great protection against cases where the static password might be leaked (including phishing, over-the-shoulder, people writing down their passwords, social engineering etc). Even if one OTP password is leaked, it limits its usefulness -- it can only be used once and within a limited timeframe typically. The downside is that you have to make sure your authentication server (and to some extent user devices) are well-protected. If your server is your weak-spot, then, I'm not sure secure hashes alone are going to be enough to protect you anyway. Plus, combining it with SSL and a standard (hashed) password could really boost your protection even further.


How do malware developers avoid wrecking their own computers?

Developing malware and destroying environments is the same as investigating malware to reverse it.

Your assumption about developers not being able to use different systems is incorrect. The below allow a developer to host multiple virutal machines for testing against different platform images.

Azure
AWS
Virutalbox
VMware

Virutalization allows the machines to be torn down and spun up again after deploying the malware and executing it. This is how forensic investigators reverse malware by running it in an isolated environment where they can watch how it interacts with the system - the process is the same for developing it.

Buying a second hand machine is cheap and would be done if you want the malware to target physcial machines and detect virtual environments. Take some disk images and you're good to go.

Modern malware is often made up of different stages or modules. Modular development results in it being more difficult to reverse engineer it also allows testing of the modules seperate to the whole. This way a destructive payload is not executed per test.


Exponent is just an integer; but exponents make sense only modulo the group order. If g has order q (q is necessarily a divisor of N-1 where N is the prime modulus), and x and y are two integers such that x = y mod q (i.e. q divides y-x), then gx = gy mod q. Thus, for exponent x, only x mod q matters. So you can just choose each exponent in the 1..q-1 range (it won't change anything to get an exponent outside of this range).


Can the token stay consistent (short of revocation or manual refresh), or should the token require being "refreshed" frequently? If so, what is the feasible way to handle that?

Even though if you don't want to implement OAuth I recommend to take a look at how the token handling is done in OAuth (Paragraph 1.5 and 1.5). With refresh tokens you can reduce the window of exposure if the bearer token got compromised while avoiding to ask the users to provide their credentials repeatedly.

  What is the advantage of putting the token in an HTTP header (e.g., Authorization: Token SOMERANDOMVALUE) versus just stuffing it in the body of a JSON request?

AFAIK it's done because this header field is intended for this purpose. In practice it heavily depends on the use-case. Since there is the risk that the Authorization header is automatically send by some browsers which could introduce a CSRF vulnerability, it might be not desired to do it this way if you don't want to implement a CSRF-token. So adding the authentication information to the body or a custom header field is totally ok.

Have a look at the REST Security Cheat Sheet by OWASP for more tips on secure API design. Actually the entire site is interesting  - it's a very good starting point for developing a better understanding for information security.


Is a (Radius) WiFi certificate also used by the web browsers (https)?

Installing the certificate as an EAP certificate will not cause it to be accepted for server authentication.  It becomes associated with the EAP profile for 802.1x use.  The two uses determine when the operating system (OS X) considers each one for certificate validation.


Generally not advisable.  To prevent possible bypassing of the firewall, consider adding a management zone/DMZ where the management interface would be connected. Traffic would have to pass through a firewall from the internal network to access the management interface and deny any traffic initiated from the management zone/DMZ to the internal network.

Bonus: If you have many zones of varying security levels, dedicate a firewall to the management zones/DMZs.


US Department of Labor Watering Hole Attack

How could the JavaScript that redirected the users be injected into the DOL's site in the first place?

From a cursory reading, it appears that the vulnerability is a simple XSS attack.

  What technology was used the exploit the memory vulnerability in Internet Explorer (i.e. JavaScript, JAVA, Flash, etc)?

It appears to be a Javascript-only attack. The proper fix for that particular vulnerability is simply have the users use a more modern browser.


The -Pn option means "skip host discovery and treat every host as up." When the -Pn option (formerly spelled -PN or -P0) is used, every target address will show "Host is up." Since you added --reason, you should also see a reason for the "up" determination: "received user-set." This means the reason the target was determined to be up is that you, the user, told Nmap to consider it up.


I see no problem with it from a compliance perspective. The traditional way is to use asterisks (*) or hashes (#) to block out the digits, but zeros should be fine too. The point is that you're meant to not display (i.e. hide) the real digits.

My only concern is that it could be confusing to a user that looked at the number, as it's ambiguous (from one data point) as to whether the card number legitimately had a zero as it's 7th or 12th digit, or whether that's just the mask. This isn't a compliance problem; it's just a case of a user potentially misunderstanding the use of zeroes.


RSA: Is it safe to go without padding if the message length == key length?

When you encrypt a message using RSA, padding is needed to ensure several properties:

Encrypting the same message twice must result in different outputs, to prevent a chosen plaintext attack. This is the reason why paddings are randomized.
RSA preserves some structure, padding should eliminate that structure.
When an attacker manipulates the ciphertext, you want to reject that forgery in a way that prevents the attacker from learning anything.

Many older paddings, such as PKCS#1v1.5 fail to ensure this, and thus are broken for many applications. You should use OAEP padding.

Alternatively you can just encrypt a random number of the same size as the modulus with RSA and use its hash as key for symmetric encryption (e.g. AES-GCM). This is known as RSA-KEM and doesn't need any padding. It produces larger ciphertexts but is easier to implement.


What is a 'safer' way to write down passwords?

You could think up some easy pattern, trick or algorithm that you can do in your head and then keep it secret. An example would be in the TV series The wire where they would have pager numbers where to decode they would have to 'jump over' the 5 of the keypad, so 789 would become 321.


Is Objective C (really) affected by buffer overflows?

Edit: Added code sample
Objective-C is a superset of C; anything you can do with C can be done with Objective-C and that includes lots of things you probably don't want to do (like buffer overflows). Taking a .c source file, changing the extension to .m, and compiling it with an Objective-C compiler will not prevent buffer overflows.
Additionally, the Objective-C language itself is not bounds-checked. Static buffers (as used in C; the things you get from int foo[16] or malloc(100)) are still the only inherently-supported index-accessible data structure in Objective-C, and there's nothing preventing you from reading or writing outside the bounds of one.
However, the vast majority of Objective-C code is written using a "kit" or "framework" (such as Cocoa or GNUstep) that provides a library of classes, including one or more array classes (such as NSArray), and those classes may be bounds-checked. While something like NSArray must use an unchecked memory buffer as its backing store (either directly or by wrapping some other array class), it need not expose that buffer directly. Instead, it supports messages such as objectAtIndex: which invoke methods that perform bounds checking before reading or writing from that buffer.
Even these library classes' interfaces may interact with C-style memory buffers, in which case they typically rely on you to ensure the buffer's size is correct. Getting it wrong can still result in a buffer overread or overflow, either immediately inside of the function where you passed the wrong size parameter, or later when you try to access a location that is inside the size you specified but outside the buffer's actual size. For some examples, see the NSArray methods arrayWithObjects:count: and getObjects:range:, which require the programmer to specify a C-style array and either also supply its size or at least know that its size is sufficient. These functions can cause a overread or overflow, respectively.
Apple also recently (compared to the language's 35-year history) added support for C-style array access to collections such as NSArray, but it's just syntactic sugar for the existing ways to interact with collections. You can use myNSArray[2] to retrieve the third element of the NSArray just as you could use array[2] to retrieve the third element of a C-style array, but the immediate behavior under the hood is completely different. Indexing with a C-style array is just pointer arithmetic (array[7] is exactly equivalent to *(array+7), itself equivalent - at least on byte-addressable platforms like x86/x64 and assuming "array" is a pointer-to-int - to *((int*)(((uintptr_t)array)+(sizeof(int)*7))) or *((int*)(((char*)array)+(sizeof(int)*7))), and can often be entirely implemented in a single line of x86 assembly. By comparison, myNSArray[7] is just syntactic sugar for [myNSArray objectAtIndex:7] and is a method call. It is in that method that the bounds check is implemented, the exception is raised if out-of-bounds, the indexing into the C-style buffer backing the NSArray happens, and finally the retrieved object is returned.
So, in summary, if you:

use only bounds-checked collections in your Objective-C and let the library handle all the access to their C-style buffer backing stores
never personally do any pointer arithmetic or call any function to do so when the function / receiver cannot tell or does not enforce the bounds of the pointed-to buffer
never directly or indirectly call any functions that take C-style arrays and expect you to provide their bounds and/or index

then you can mostly-safely pretend that Objective-C is unaffected by buffer overflows. (I say "mostly-safely" because there may be bugs in the libraries you use, which could result in a bounds check being missed or performed incorrectly.) Anytime you are not following those rules, or handling data tainted by not following those rules, you're at risk... even if you're using "bracket style" messages to Objective-C receivers.

// Code example for a buffer overflow in Objective-C.

// NSArray with 6 Objective-C elements
NSArray *myArray = @[ @"Buffer", @"overflows", @"can", @"happen", @"in", @"Objective-C" ];
// NSRange within the bounds of the array
NSRange myRange = NSMakeRange(1, 4);
// Buffer with room for 2 Objective-C objects
id buffer[2];
// Use an NSArray method with "bracket style" syntax to copy data to the buffer
[myArray getObjects:buffer range:myRange];
// Boom


can one pad the packets to a uniform size and frequency (or randomize their size, etc.) without significantly degrading the performance of the network and without being able to modify the applications themselves?

It is possible to add noise both in bytes and in timing and also to make traffic look like a different kind of traffic. It is also possible to make it transparent to applications at the endpoints if you have control of the endpoints itself, i.e. can create a VPN or similar.

But the less noise you add the more the original traffic patterns stand out, even if packed inside some other protocol. And how much and which kind of noise you can add without degrading the performance of the application in a significant way depends on various factors. For example with voice over IP application you cannot add too much delay too the data because otherwise the necessary real time requirements are lost. If you have enough bandwidth you could add lots of junk traffic though to hide the original traffic. With simple downloads instead there are no real time requirements so you are more free to add noise by varying timing, packet sizes etc.

  If yes, are there "off the shelf" solutions for implementing such obfuscation in a simple "one router, several desktops" kind of environment?

The are for example the pluggable transports for Tor. These are intended to make Tor traffic look like different kinds of traffic.


No, you cannot interchangeably deploy HI?S versus NI?S.  They attack different subsets of the same problem.

Most simply N* is limited to network inputs, whereas H* has access to a far richer set of inputs (files! processes! network listeners!) to be judgmental about (and has less network visibility, so usually doesn't have the rich network parsing and signature set that a N* does).

See also Can Snort be configured as HIDS?.

That said, if your concern is satisfying an auditor or security requirements that say HIDS/NIDS, then either will do - such requirements are often written solely with the goal of making sure you're taking extra steps to secure yourself, not with the goal of dictating one technology or another.


Can hash collisions be eliminated by hashing twice?

Second hash will reduce probability of collision (i.e. it is more 'secure') but unfortunately it can not completely eliminate it.

From my point of view single long hash (such as sha512) is better than two short hashes because collision for two hashes can be searched in parallel and will take less time.


Disabling SHA-1 in TLS handshake in Linux

As SHA1 is not recommended, ...

This initial assumption is wrong. The only place where SHA-1 is not recommended is where collision resistance is needed, i.e. signatures (for example signatures on certificates). SHA-1 is still fine to be used as a HMAC, it is still (together with the even older MD5) an essential part of the TLS 1.1 protocol etc.


As this particular CVE requires a malicious DNS server, all of the attack vectors you detailed (MITM, Malicious ISP, etc) are possible attack vectors. Any party that is able to redirect your DNS traffic to a malicious server (or compromise the server you're currently using) can craft the responses detailed in these articles.

This affects VPN's in the case where your connections are resolving to a specific (compromised / malicious) DNS server they are, in theory, vulnerable to this type of attack. The VPN configuration would largely dictate their vulnerability as some VPN connections may choose to override the DNS server and not "inherit" it from the DHCP when they log into the VPN. With that said, the effect on VPN Connections will depend on the configuration.


If the client is a browser, there is not guarantee to what exactly happens. The index could be cached. Also some browsers show redirects in the network console while never send by the server. Start by disabling caches, cookies and other client side storage (or use a private navigation mode). Btw, AngularJS uses extensive caching, so I almost certain its the cache.

Update

  There are no 30X redirects involved, and if there were redirects
  inside of some javascript,

No, there are indeed no redirects involved, but there are a lot of 304 responses. They explain the behavior you ask about, and what happens is the following:

To limit the number of requests, webservers can use a technique called an entity tags. If the webserver supports this and is configured to use them (Microsoft IIS is by default), upon request the server will calculate a hash for this document (based on last time changed) and includes this hash in the response (ETag header). In the next requests the client can send this hash to the server, which matches the hash with the current ETag. If they match, the server can respond with an empty 304 response (not modifier).

This empty response if what you see. Some browsers will not list these responses, because in essense 'nothing has changed'. If you disable the cache, the client will omit the If- headers in the request, causing the server to resend the document.

With caching and ETags:

Without caching an ETags:


Is there multi-factor authentication for machines?

When authenticating humans, the main danger is impersonation: someone else posing as the expected user. Since humans are biological and not digital, there must be some link between the two worlds: something which ties the concept of the physical identity to sequences of bits on which computers can feed.

We use multi-factor authentication because every single factor we could think of is kinda weak. Passwords can be guessed (they cannot be unguessable because otherwise users would not remember them) or grabbed (by recording with a fast-pace video camera the actual typing of the keyboard -- with a simple telescope, this can be done from several miles away !). Biometrics require visual control (i.e. an armed guard who verify that what goes on the fingerprint reader is indeed a human finger still attached to the rest of the human). Hardware devices can be stolen (especially smartphones, the most stolen kind of object). By piling several factors together, we hope to cope with that crummy situation.

With computers, the situation is completely different. Any computer can contain an extremely robust authentication token, e.g. a big, fat asymmetric key. The main danger for computers is subversion. Indeed, what a computer can do, it can do. Meaning that if a given server is hacked into, then all the "authentication factors" that the server could use are now equally accessible to the attacker. Thus, the scenarios which imply a failure of a computer-controlled authentication factor, i.e. the scenarios in which supplementary authentication factors would be deemed useful, are precisely the kind of scenario where extra authentication factors add no benefit at all.

You could imagine a mixed human/machine setup: computer contains a private key, used to authenticate with other computers, but the key is stored encrypted with a password that the computer does not know; it must be typed at boot time (or possibly at regular intervals). This would bring some additional security, at least in some subcases of subversion. However, servers which cannot reboot in an automated fashion tend to be unpopular with sysadmins.


In the age of BadUSB, are micro SD cards a secure alternative media immune to those style of attacks?

SD cards of any flavour do not provide processing capabilities except internally to support standardised data access. They are not a source of processing power, cheap or otherwise.

The main advantage over a USB key is that it is harder to squeeze the required hardware in them that could be used to attack a PC via the USB port. That does mean they are less vulnerable. Also, the standard interface for SD cannot be used for power which removes some of the other potential issues with a USB interface.

There are cards that do have processing capability and that have the same connector layout as SD cards, Smartcards and SIM cards for example. And there are smartcards that have significant security processing capability (most have fairly minimal capabilities) but this is not the same as the SD memory card format.

So bottom line is that SD card slots are safer than full USB ports but they are not immune to some attacks such as autoplay.

If you need more, look for a PC with a smartcard interface.


Securing HTTPS between two local applications on same system

There is no point in using HTTPS here.
Since the server and client are both on the same system, communications will occur over the loopback interface, which means the traffic will never leave the machine. To intercept the traffic on the machine itself, the attacker would need administrator privileges. If someone has admin privileges, its already game over.


Is it possible to scan a remote host in another network if I know a port that is opened?

I believe that you are asking if you can take advantage of traffic for targethost port 12345 being allowed in order to scan other ports on targethost aside from 12345.

The answer to that question is essentially "no".

Is the answer ever literally "yes"?  Actually, yes.

Once upon a time, it was possible to fool some packet filters and weak-brained firewalls into passing traffic.  If I recall, the method was to send a series of overlapping packet fragments.  The packet filter (often a router) would look at the first fragment and say "Ah! Port 12345!  I allow that, come on in!" and would pass subsequent packets without examination.  But what if the second packet fragment had an offset that overlapped where the destination port was defined?  The targethost, unlike the packet filter, is going to reassemble the packet before parsing it to determine what port it goes to.  If the targethost resolved the overlapping fragments by overwriting the original fragment (the port 12345 fragment) with the subsequent fragment (say, listing port 137) and boom!  Assuming the response packet can get out (again, something packet filters tend to do, modern stateful firewalls tend not to do) then it would be possible to scan arbitrary ports behind a firewall, piggybacking on a single permitted port.

Modern firewalls aren't that stupid, so it's generally not possible to do what you want to do today.

(It also used to be not-uncommon for packet filters to pass traffic by source port.  Yeah.  It makes handling things like DNS and FTP easier when you don't have an application-aware stateful firewall.  It also allows anybody who wants to to connect right through your firewall, as long as they source their packets from (say) port 53 or port 20.)


Commodity Conversion Cables with Write Blockers

The safest option is to use a write blocker as close to the device being made read-only as possible.  So, for example, if you're accessing a SATA drive over a USB-to-SATA adapter, use a SATA write blocker if at all possible.

Ultimately, this has to do with the fact that there are usually secondary command sets used for tunnelling commands through hardware protocol adapters.  The write blocker may not understand the command sets used to speak with the device on the other side of the adapter.  Using USB-to-SATA adapters as an example, you may see any of at least three command sets used, classic UMS, UAS, or SAT.  Pretty much all USB write blockers will handle UMS correctly, but only some handle UAS and most don't completely handle SAT (because that would require them to completely handle ATA commands too).

For the good quality write blockers, this ends up resulting in the adapter just not working without any side effects.  For the bad ones, it can let writes through, or possibly even contaminate the source device without any write commands being issued (because the write blocker may mangle the outbound command).  The problem here is that it's very difficult to be certain whether a given write blocker falls into the first type or the second type.


Are there any possible methods for us identifying byte sequences which contains some plaintext?

Hard to say :) String can be an ASCII string, unicode string, byte string, whatever. It really depends what you are trying to achieve.

In case of base64 its easy, because just 64 characters are valid to be included in base64 string: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, additionally there can be separator "="

So what you can do is to compare the data byte by byte and check if the byte matches one of characters in the defined character set. If so, add it to string, if not, print previously collected string, set it to empty and continue.

Another way is to use some tool as @TessellatingHeckler recommended. I would recommend it too because it is going to be un-achievable by your own when it comes to UTF or whatever else character encoding.

Edit: I forgot to mention that it will never be possible to collect valid strings only as some random byte sequences looking as string will not be a valid string in the end. Or you can come with some neural network ;) Humans can recognize it easily right? :)


Remote working. Is my employer able to monitor my activity

Given a clean install of a public distribution of Linux on your own computer, I should say that your employer can monitor  the activity you do with gmail suite, but not any other activity on your computer. That is, if you login to gmail suite your employer can track when you log in, when you log out, when you are reading document, writing documents, and either explicitly or implicitly when you are idle (not doing any work related activity).


PCI CVV requirement - encrypt prior to authorisation?

The requirement is to protect the data appropriately. Pre-auth, you are unlikely to have the CVV on disk (it should just be in RAM) but if you do, then yes you should encrypt, and then delete afterwards, so your assumption that "the restriction on storing sensitive authentication data applies to post authentication/processing storage" is incorrect.


Can my employer surveil me while using "remote desktop"?

No, they cannot "surveil" you unless they are also using the connection and connect back to your machine. This is unlikely, and you would notice it unless you kept the connection up and they someone hijacked your RDP session.

In the RDP connection settings, you can determine what you share from your local machine in the "Local Resources" and "More..." section.


VeraCrypt: create encrypted container: Volume Format: Options: Filesystem: None?

How it is possible

You simply get presented a virtual volume (or virtual drive with a loop/raw/non-existing partition table depending on how you look at it) that has nothing on it. Indeed you can't directly put any folder on it but you might want to format it in another file system not offered from inside Veracrypt (e.g. exFAT, ext2 on Windows, UDF?). In fact you can think of the formatting as an extra service that has nothing to do with the encryption itself. AFAIK, Verycrypt itself does not care at all about the file system when you decrypt the container then. It simply just presents the volumne to the OS which then deals with it.

What for

Like mentioned before you might want to format it some other way, maybe in some other format or with special settings. Or you have some complicated setup where you actually don't need any direct file system because you want to dedicate that volume to a database server or to be used as a raw disk for some virtual machine (which in turn lets you put a partition table and several partitions on it). Heh, now that think of it even some sort of software RAID solution should be possible.


How often should the DHE p and g factors be recycled?

So p is the modulus, and g is the generator.  You are absolutely right.  p and g are publicly known values, and the discrete log problem needs to be solved to break the Diffie-Hellman exchange.

Ephemeral Diffie-Hellman

The whole point of Ephemeral Diffie-Hellman is to provide for Perfect Forward Secrecy (PFS).  Here's an answer I already wrote up on DHE and PFS for more information.

Generators:  These are generally fairly small.  A protocol like SSH will allow you to exchange the group (RFC4419), but there are two standard values used for SSH; 2 and 5.  If you like math stuff, here's an explanation on generators in DH.
Moduli:  A modulus for DH is a large prime

These parameters need to be generated only once by the server for each size that you're looking to support.  I would use OpenSSL's functionality as it's described in their wiki.

Here's OpenSSL's Wiki on DH Parameters.

This article linked to in that wiki gives good information on PFS, and configuring your SSL/TLS enabled server to use it.  You need to make sure your server has a version that supports it, and put the PFS cipher suites (DHE and ECDHE) at the top of your list.


Nmap loads on its own, scans addresses, with a different source address than my PC. How is this possible?

The answer is that nmap has this functionality built in, I just noticed the folliwng:

Source option: "use decoy to hide identiy" code: -D

  Send fake decoy probes from spoofed addresses to hide your own
  address. Give a list of addresses separated by commas. Use RND for a
  random address and ME to set the position of your address.


USB C is just a different physical port standard. It implements the same USB 2.0 / 3.0 interface. BadUSB revolves around reprogramming the USB micro-controller to act as a human interface device and input commands when it is plugged in. USB C is as vulnerable as any other USB port standard.


Is RSA useless when my app is fully decompiled?

Short answer is: Yes, RSA is useless in this case. If all the game logic happens on client side, you cannot prevent cheating.

If your game is reporting only the final score and nothing else, no encryption can help. The game must know how to submit the score and so the full information will always have to be stored in it. You can only make it harder for the cheater by adding obfuscation and other obstacles.

I would suggest two things:

Send more than just the final score. Send some information about how the game progressed. (What was the score at certain time, when the user lost life, what decisions he took...) Then verify on the server if it is plausible to achieve such score with such game progress.
Ban any user who submits either results that are not valid, or that were submitted before. Make sure your game always produces valid results and is random enough to not likely produce the same result twice. You don't even have to let the cheater know he is banned, just hide his score from any public lists.


How do I protect password enteries in Xorg?

Banning xinput test won't help, because it's only an interface to the vulnerability, and a malicious program could access the keypresses without it.
Some comments from the blog post you link discuss sandboxing; even if it is secure (see the debate in the blog post), a concern is that most implementations just create another instance of the X server for sandboxed applications, which as you've said, is not desirable for performance reasons. However, it seems to be the most secure way to enter your passwords.

Regardless, if you're running malicious code on your computer, you have other problems (reading personal files, changing user configuration files, exploiting possible system vulnerabilities, and bad things in general). But if window isolation is important to you (it is to me), you could get involved with Wayland; as other people has said, it's a promising successor to X11.


How to protect personal data requested by Certificate Authorities from data theft?

The Online Trust Alliance (OTA), an industry organization with widespread CA membership, maintains a set of operational security best practices which all CAs should abide by. However, the documents do not recommend specific data retention policies, nor do they attempt to define PII (personally identifiable information).

The implementation of OTA Best Practices will vary from CA to CA, so the best course of action I can see is to begin by selecting a provider based on their published policies and meta-information, e.g. news stories related to CA security breaches. Once potential candidates are selected, ask them specifically about your concerns and how their policies address them.

There is no compelling reason for a CA to indefinitely retain such easily-exploited PII as a scanned passport, because this information is only used in due diligence before the issuance of a certificate.


How much information does an improperly obscured barcode leak?

To directly answer your question, you can see some research on damaged QR codes here:  http://datagenetics.com/blog/november12013/

A barcode is nothing more than a specialized font designed so that a computer can read reliably.  It's much easier for a computer to recognize and read a pattern of stripes than it is for it to read Courier or Arial.  And just like the Latin alphabet symbols you're looking at right now, the symbols have to be readable to the machine.  Just as we all agree that the letter 'O' is represented to humans by an oval shape, barcodes follow standards that describe the meanings of the stripes and dots.

However, the text that is printed by the barcode is not nearly as standardized.  Some barcodes, like the familiar UPC and EAN barcodes, are strictly numbers that identify a product, and these do follow a standard.  But others, like QR-codes, allow free-form text.  A valid QR-code may contain a URL with a web link, or a vCard with contact information, or just some random words like "Have a nice day."

So there are as many different kinds of barcodes as there are kinds of text to input.  If you want to prevent online theft, treat pictures of barcodes the same way you would treat a picture of your credit card.  Do not include photos of personal documents showing these numbers or barcodes.  This includes event tickets, gift cards, driver's licenses, and airplane tickets.  Otherwise, an online thief may make a copy and steal the value from you.

To more specifically answer your question using this information, imagine a linear barcode with left half obscured.  This is the equivalent of obscuring the first half of a sentence or word printed on the page.  The right half remains legible, although it may not contain enough information to fully convey the message.

Now picture a 2D barcode, such as a QR-code.  Many 2D symbologies are designed to include redundancy permitting accurate reading of the barcode, even when parts of the barcode are obscured or damaged.  This is needed because damage to barcodes is very common in normal handling.  So when a QR-code is generated, you can specify a level from 1-4 of redundancy you need the code to embed. They use a Reed-Solomon algorithm to add more error recovery symbols.  More redundancy allows for a greater portion of the barcode to be damaged while still maintaining readability.


SSL certificate for server authentication

You seem to have some misunderstandings.

If you make a certificate with a CA, they do not give you a private key. You have the PK of your certificate already, and the PK of the CA is secret.

With an self-signed certificate, you're acting as certificate holder and CA at the same time. Naturally, telling the people "I say that I'm thrustworthy" doesn't make you very thrustworthy.

If a REST API requires a certificate from the user, it's not meant for normal TLS, but (probably) as "login method", instead of a password. This type of certificates don't need CAs etc.


Are JSON web services vulnerable to CORF attacks?

This is not vulnerable if the content type only accepts application/json because you cant create an html form that posts that content type, and thats what you would need to do csrf if you cant use ajax, which you cant with the above CORS header. Also, if the token is in the authorization header, its not vulnerable because it wont be submitted in a csrf attack.


You almost certainly have incompatible versions of OpenSSL on the two systems. Run openssl version to check.

The reason for the failure is usually that the default message digest has changed between the two versions, with the older version using MD5 and the newer using SHA256. OpenSSL doesn't store the hash type in the output message and expects you to specify it explicitly in the command if you want to use anything but default. Try adding -md sha256 to both commands.


Applying file deltas to an encrypted file

Not yet. You are basically describing homomorphic encryption.

Basically you have a file f that you encrypt with function E() notated as E(f).

Now you have delta d which you encrypt with function E() notated as E(d).

You want the new file f' to be equal to f with the delta applied: f'=f+d

Only you dont want to decrypt either E(f) or E(d).

You want E(f) + E(d) = E(f').

And that's homorphic encryption, but it's not ready for production yet. THere are partially homomorphic cryptosystems, but I'm not sure if the file delta would fit into any of the systems. There is one fully homomorphic cryptosystem in development at IBM, but it takes a good amount of computation power and memory and is still slow for large problems.

IBM Research's page on homomorphic encryption
http://domino.research.ibm.com/comm/research_projects.nsf/pages/security.homoenc.html

Craig Gentry's PhD Thesis "Fully homomorphic encryption using ideal lattices" This is a break through paper.

Prior to Gentry's thesis there were fully homomorphic systems but those systems could not be made practical. Some existing cryptosystems, RSA for example, are partially homomorphic, meaning that homomorphic operates work for one operation (multiplication for example) but not the other (addition). They also degrade and can only do a limited number of homomorphic operations before causing errors.

Gentry's breakthrough was to establish bootstraping. In my limited understanding, bootstraping establishes a hidden struture capable of maintaining its coherence across operations.

In May of 2011 "Fully Homomorphic Encryption without Bootstrapping" was published bring homomorphic encryption one step closer to real use.


How to deal with a person who gets easily fooled by internet and mail scams?

It all depends on the person; but a good first step would be to change their default browser to Chrome or Firefox - install AdBlock Plus (http://adblockplus.org/, or similar) and Ghostery (http://www.ghostery.com/) in their browser, and a decent anti-virus (Microsoft Security Essentials (http://www.microsoft.com/mse) should be fine, and since it's free - you don't risk them just not renewing). Install Soluto (https://www.soluto.com/home) and keep an eye on any changes to default browser, etc.

Turn on auto-updating for everything, Windows, your browser, Flash, Java, etc.

Make sure UAC is on, if they like to just click through the prompts, make them non-admin and set up an admin password - that way they have to enter it to do anything and you should print that on a bit of paper under the words "THIS MAY NOT BE A GOOD IDEA".

Now, a slightly controversial one, disabling Internet Explorer: on their machine, go Start/Run and enter 'gpedit.msc', navigate to Computer Configuration / Windows Settings / Security Settings / Software Restriction Policies / right click that and choose 'New Software Restriction Policy' and then under additional rules, right click, New Path Rule and enter 'c:\Program Files\Internet Explorer\iexplore.exe', make sure it's set to Disallowed.

Going extreme (with a key, etc.) is going to be a hassle - you want the experience to be something familiar. The Group Policy edit is to prevent them bypassing Adblock or Ghostery unwittingly.

That should make it largely worry-free. Soluto should give you the ability to remotely install TeamViewer or whatever and remote in if something goes wrong, but that should cover most malware entry points.


Next steps after webmail account was compromised

For a "paranoid dial turned to 11" approach, I suggest:

On the system:

Backup all essential data.
Rebuild.
Install resident antivirus/anti-malware/firewall protection.
Install secure browser of choice, or update existing browser to latest version.
Install secure browsing and OS plugins and configurations of choice.
Make sure the OS and all applications are kept up-to-date.

For all user accounts, do the following, recusively.*

Change the password of the compromised webmail account.
Change the passwords of any accounts which use the same password as his webmail account.
Change the passwords of any accounts associated with the webmail account.

*(Example:  GMail account was compromised.  Facebook and Hotmail accounts use the same password.  Change Facebook and Hotmail passwords.  LinkedIn account is associated with Hotmail account.  Change LinkedIn password.)

Also, contact the owner of the account that sent the e-mail to you, and let them know what's happened.

This is a very high-level view of the recovery process.  In the end, it is up to you to determine to what depth certain protective measures need to be applied, based on whatever value you place on the data and/or accounts that may have been compromised.


Yes, it is possible.

If you want to have two factor authentication, which is naively supported by Windows, you could chose to use smart cards or virtual smart cards.

As far as I know, to get one time passwords for RDP authentication you'll have to use third party solutions. For example, you could try Duo security Duo Authentication for Windows Logon and RDP. Alternatively, as paj28 pointed out, you could google another ready made solutions.


The key here is privacy vs integrity.

If your data volume (/home, /var/log and anything else with sensitive data) is encrypted then you're primarily just assuring privacy, whereas for /boot you want to make sure no malicious code is placed (integrity). Note this does not imply that it needs to be encrypted. /boot almost never requires actual encryption, since it does not store private/privileged data. I'm going to presume you have locked down booting from external devices (USB).

After the UEFI/BIOS code, the first piece of code executed on your system that you control is the bootloader (e.g. grub), which reads configuration files (that may have security parameters such as disallowing boot option editing), and then your kernel+initrd, also stored on /boot. It will take a determined adversary to:

Gain physical access to your laptop
Remove the hard drive without you noticing it's been removed and replaced
Replace Grub/Grub's config/kernel/initrd with a malicious version (e.g. that captures keypresses, loads hidden daemons, or even starts a hypervisor to encapsulate your entire OS)
And deliver it back to you with no sign of tampering, performance loss, random bugs or noticing it's been missing.

It is feasible though. If you're at this level of paranoia as opposed to simply keeping your data volume hidden from random search and seizure, then you need to look into a full trusted boot setup. That's a lot of work.

A simple mitigation would be, once your system is started, check that the hashes of all files on /boot are as you expect by comparing it with a previous baseline of hashes stored in your encrypted volume. This is an after-the-fact measure though if /boot has been compromised, but at least you will know about it, and you will need to update the baseline each time you update files on /boot (e.g. new kernel version/new grub security options).

Any more assurance will require a lot more work. Trusted Boot on Linux/*nix is notoriously tricky.


Account import into gmail - is it considered safe?

Company emails should not be stored on personal accounts or devices. There are data protection/privacy issues, as well as issues around corporate control over data.
By doing this, the company loses control over the email.
Email is used for many different things, including passing files and using it as a de facto file store. To pass all that data to a personal data store is often considered a breach of data (specifics are up to the relevant data protection regulation the company is subject to).
So, it's not about Gmail. It's about the appropriate use of email in general. Gmail could be the most secure email system on the planet, and using it would still be inappropriate.


What is the "about:blank" context for browser security and privacy?

The about:blank is just a blank address-less browser screen, that will inherit the same security parameters of its caller. That said, you cannot exploit about:blank to bridge the JavaScript cross-domain access restrictions if thats what you're asking.

Despite its location is not part of your domain, it belongs to it, and will not run stuff in a different security level.


Shellshock attack scenario exploiting php

PHP can only be exploited in the shellshock-case by using it in PHP-CGI mode due to the nature how CGI works. For PHP functions like system() and exec() it is not possible to influence the environment variables unless you set them yourself in PHP. That would then be in your example something like system("HTTP_SERVER=evil.example.org /path/to/script");


Does accessing a personally owned Tor node (that only you ever visit) over the Tor network break anonymity?

No!

This is exactly what Tor hidden services are designed to accomplish.

Nothing is absolutely safe and given enough worldwide oversight and resources, Tor is vulnerable in theory. In practice the vulnerability bar is very very very high.

If you are the only user of your hidden service, you may want to make it a "Stealth Hidden Service". This requires an additional key in your Tor client, so it doesn't scale well and may limit how you chose to use it, but it adds yet more anonymity by making it difficult to identify that it exists even in the master hidden service directories.

One seemingly counter intuitive aspect is: do NOT use HTTPS on your hidden server! The Tor connection is already multiple encrypted so you don't need it for security. Worse, it may result in your client calling outside Tor to check the certificate authenticity which only you use, that might compromise your anonymity.


GnuPG on Windows (unless a copy installed from cygwin/Baboon, which obeys the standard ~/.gnupg path of the unixoid versions) has its home directory in %APPDATA%\gnupg, (usually) expanding to C:\Users\<username>\AppData\Roaming\gnupg since Windows Vista (a slightly different path for earlier versions of Windows).

This should translate to following path in cygwin:

$ gpg --homedir  /cygdrive/c/Users/Chloe/AppData/Roaming/gnupg --list-secret-keys


Does GnuPG check for revocation certificates on keyserver automaticaly?

GnuPG does not automatically fetch or refresh keys when using them. You should update your keyring regularly and on occasion, especially if you fear revoked keys.

For this reason, it is reasonable to notify known users of your key when revoking it.


Is there a bulletproof way to configure your AWS system?

Why would anyone want less security

Nobody wants less security, but high security usually are also harder and more expensive to maintain, which can also mean having more likelihood for errors. Many companies opt to use simpler system that are less secure than possible because that's good enough for their purpose.

bullet proof AWS system

There's no such thing as bulletproof system. Security at the infrastructure level is mostly a matter of configuration. Even if the underlying software itself are bug free, you can't beat a system administrator that undermines their security by configuring their firewall to allow any traffic to all machines, and then claim that their system are secure because it has state of the art bug-free firewall.


How do I change the expiry date of an ElGamal subkey?

When you edit the key, you get a list of keys. Example::

sec  dsa2048/DEADBEAF
     created: 2014-10-10  expires: 2020-09-28  usage: SC
     trust: ultimate      validity: ultimate
ssb  elg2048/DEADBEAF
     created: 2014-10-10  expires: 2017-10-10  usage: E

If you enter expire, this will affect the "main" key, or perhaps the first key, not the subkey. For the subkey, type in key 1. You should now see * next to the ssb:

sec  dsa2048/DEADBEAF
     created: 2014-10-10  expires: 2020-09-28  usage: SC
     trust: ultimate      validity: ultimate
ssb* elg2048/DEADBEAF
     created: 2014-10-10  expires: 2017-10-10  usage: E

now, an expire command will affect the subkey.


Are command injections examples of confused deputies?

A confused deputy is a concern over what entity should be in control - which is an authorization and access control problem.  This is a problem of trustworthiness, and verifying intent.  Vulnerabilities like; server-side request forgery(SSRF), client-side request forgery(CSRF), and insecure direct object reference (IDOR) fall under this category.

Injection attacks are caused by the confusion between what is data and what is code. An injection is one type of vulnerability that can be used to undermine access control systems, in that a compromised server becomes a kind of confused deputy that is useful in pivoting and post-exploitation (attack chaining).  But this isn't the only case, you could have a code injection vulnerability in a sandboxed environment - which isn't a trusted entity, but could still be used for abuse - like mining bitcoin.

Injection attacks are more or less Independent from confused deputies, but an injection could be used to take control over a trusted entity.  There are many ways that an attacker can confuse a deputy.


MD5 for passwords

Using salted md5 for passwords is a bad idea. Not because of MD5's cryptographic weaknesses, but because it's fast. This means that an attacker can try billions of candidate passwords per second on a single GPU.

What you should use are deliberately slow hash constructions, such as scrypt, bcrypt and PBKDF2. Simple salted SHA-2 is not good enough because, like most general purpose hashes, it's fast. Check out How to securely hash passwords? for details on what you should use.

MD5 for file integrity

Using MD5 for file integrity may or may not be a practical problem, depending on your exact usage scenario.

The attacks against MD5 are collision attacks, not pre-image attacks. This means an attacker can produce two files with the same hash, if he has control over both of them. But he can't match the hash of an existing file he didn't influence.

I don't know if the attacks applies to your application, but personally I'd start migrating even if you think it doesn't. It's far too easy to overlook something. Better safe than sorry.

The best solution in this context is SHA-2 (SHA-256) for now. Once SHA-3 gets standardized it will be a good choice too.


Is it possible to run Responder and/or Layer 2 ARP Poisoning over OpenVPN or an OpenVPN Ethernet Bridge?

No, it's not possible to run responder through a VPN. You must compromise a system on the network then run responder via that system. After compromising a system and gaining higher privileged access, crackmapexec would be a better option than responder.


Ingesting markup from WYSIWYG text editors

Somehow Cryptographically authenticate the HTML textarea content to prove that it was generated by trusted JavaScript in the browser?

This is a no go. For the client to sign something, it would need the key. And you can't trust the client with the key. Off course you could have  the server do the signing, but then you are back to square one again...

  The server could convert the ingested HTML to a "safe" format such as markdown.

This sounds like the way to go. Convert it to markdown, strip any HTML tags. Then convert it back to HTML and perhaps run it through a HTML purifyer to make sure there are nothing but i and b and so on in there.

Off course, it would be simpler with an editor that just produce markdown in the first place.


How to pass hash as password to ssh server

You will not be able to do that.
The password is verified by the SSH server (or better by PAM library or similar authentication backend on other platform) by taking the received password, hashing it and comparing it to the stored hashed one. There is no way to bypass this process and make the server use the hash directly for comparison.


Viable way to authenticate certificate without a web of trust?

This is a bit muddled.  SSL certificates do not use web-of-trust; they use certificate authorities (CAs).  Basically, the CAs vouch that the public key for www.example.com is such-and-such.  The web-of-trust model is used by PGP, and is intended as an alternative to CAs.  So, if you want certificates without CAs, you could look at how the web-of-trust model works -- but beware, it's not clear that it works very well in practice.

It sounds like you want to somehow do without CAs.  OK.  So what properties do you want your certificates to vouch for?  Basically, think of a certificate as a signed statement: "I promise that the public key for www.example.com is 0xD6EF...1E2, signed, Verisign".  When relying parties receive this kind of certificate, that statement tells them what they can rely upon.  In your new world, what do you want recipients to be able to rely upon?  And, if you don't want to have a Verisign present, who is going to verify that those promises are in fact true?

In short, I suggest you think about what you are trying to achieve and what security guarantees you are looking for -- then we can talk about how to achieve them without CAs.  Try to write down what you want recipients to be able to rely upon (ignoring the crypto), and who will be responsible for verifying those things are true, and then we can look at the technology.


Burpsuite - finding xss vulnerabilities in the vaadin framework

You should look for the HTTP response (tab) in the HTTP history tab. There you can see if your input was filtered or encoded in the response in any way.

But it would be easier to use the Repeater option. Just right click on your HTTP request, and select "send to Repeater". Then go to Repeater tab. Using repeater, just try to manually modify the HTTP request parameters, send the request, and look for the replied value in the response. You can resend/modify the request as many times as you want.

I must note that Burp does not have a javascript engine. That means that it would be quite hard to detect DOM based XSS this way. That also means that Burp wont throw any alert boxes if XSS is present, but you have to conclude by yourself based on the response and the way your input was encoded/filtered if XSS is possible.


If I misuse OAuth 2.0 to do authentication, am I at risk?

The main issue is making sure that you protect against the confused deputy problem.

Imagine you are using OAuth to authenticate users within your application.

However, an evil developer has their own application which also uses OAuth. Say their application is a Solitaire game, which uses Google's OAuth API. A user authenticates for Solitaire using their Google account.

However, the evil developer takes the authorisation they got from Google from the user and plays it to your app instead. Because you are using OAuth for authentication, you are taking the authorisation token as an authoritative statement that the user is in fact your user that you wanted to authenticate, but it is not - it is the attacker using the authorisation token to authenticate as that user. Therefore, the attacker has abused your authorisation in order to trick your application that the user is in fact authenticating with you.

This blog explains it well. Note that they use the phrase "cross site scripting" when I think they mean "cross site request forgery".

You can mitigate this by properly validating the audience parameter. You should also set a state and validate this on the callback because this can prevent a CSRF attack from performing a "login CSRF" attack on a user of your application (e.g. if your application synced data to Google, an attacker making another user appear to be logged in as them could steal the synced data to their Google account).

Also see this answer.


Serpent cipher technical details in-depth

Description of Serpent

I'd suggest you read the paper submitted during the AES contest:

Serpent: A Proposal for the Advanced Encryption Standard (pdf)
The Case for Serpent (pdf)
Look at the code and other papers from the Serpent homepage

Speed

Serpent is slower than Rijndael (cipher chosen to become AES), because it uses more rounds.  See these benchmarks, Serpent in CTR mode could encrypt 32 MiB/sec while AES-256 in CTR mode could encrypt 96 MiB/sec.  Additionally Serpent took 1.2 microseconds to setup key and IV while AES-256 took 0.76 microseconds.  More benchmarks from the AES contest are available here; on a variety of platforms Serpent can encrypt 2 to 4 times less data than Rjindael (granted this was Rjindael which was slightly tweaked to become AES).

Security

Roughly equal in that both when implemented properly are secure against all known computationally feasible attacks.   There are slightly better attacks on AES, but all the public attacks on AES are not computationally feasible (e.g., 4 times faster than brute-force) as well as other obscure attacks on AES (that is there's a related-key attack on AES that assuming some strange conditions is significantly better than brute force but is irrelevant for AES as typically used in a way susceptible to the attack, and then even then the best related-key attack takes 299.5 time which is not feasible).  A large reason for more attacks on AES is that AES is widely used and analyzed, Serpent is not used nearly as much as it didn't win the AES competition (Rijndael won and became AES).

Mode of Operation

The mode of the operation is independent of the block cipher used--it's a separate choice.  That is you can use either serpent or AES or any other block cipher in any block cipher modes.  A mode of operation just considers how you take a block cipher that can only be used to encrypt/decrypt blocks of a fixed size (e.g., 128-bit block for Serpent256 and AES256 - the 256-bit stands for the keysize) and use it to encrypt/decrypt arbitrarily sized blocks of text without potentially leaking information if your plaintext is redundant (except in ECB mode which is an insecure mode where you naively just split the plaintext into equal sized blocks and apply the block cipher on each block independently).


Dedicated OS vs Debian for SOHO Firewall?

All the systems I have seen (either dedicated, appliance-like ones, or "helpers" in normal distributions) boil down to building an iptables configuration.

The advantage of going though them is that you do not absolutely have, right away, to understand all the details when you use a default, well documented example configuration.

What you look for instance at a basic shorewall installation, the configuration built is HUGE compared to what you would have thought by yourself (when you are not experienced). An appliance OS will package things for you and make them maybe more straightforward. They do not add anything more, technically speaking (i.e. no special firewall functionality you would not have with a correctly configure OS and iptables).

My personal opinion is to go for the OS + iptables helper solution, you will learn a lot in the process. You may need to adjust your kernel but again, this is part of the learning.

As a side note, I reviewed recently several GUIs to manage iptables. I found that there are no modern ones (the ones which exist are either old or abandoned) while the CLI ones are solid (shorewall and firehol are two which I found interesting).


Bypass file_exists[rfi,lfi] in my code, is it possible?

Best to whitelist (not blacklist) characters allowed in $_GET['f'].

if (preg_match("[^A-Za-z0-9_-]", $_GET['f'])) {
  fail();
} else {
  // your logic here
}

Notice that I didn't put "." or "/" in the whitelist. That was intentional.


Who proposed adding heartbeat to SSL? And who proposed it's form?

The RFC6520 describing heartbeats was had R. Seggelmann of Muenster Univ. of Appl. Sciences as its first author.  Seggelmann denies intentionally introducing the flaw and claims to be unaffiliated with any intelligence agency.  Similarly, the NSA and the Director of Homeland Security has publicly denied knowing about Heartbleed vulnerability, though Bloomberg reported from two people familiar with the matter that the NSA did know about the vulnerability and regularly used it.

Granted, looking at egress logs it appears attackers were using heartbleed style attacks in the wild last year from IP addresses that appear to have been used to systematically log IRC chats (making it suspicious to be intelligence agencies).  (So even if they didn't introduce heartbeats, it appears they were aware of it and didn't publicly disclose it).

Further, weirdness things is that two independent groups apparently discovered heartbleed (google and codenomicon) on the same day over two years after OpenSSL released the vulnerable HB protocol in 1.0.1.  The google engineer tweeted claimed "Heap allocation patterns make private key exposure unlikely #heartbleed #dontpanic", while the codenomicon tweeted "We're very certain" encryption keys can be stolen.


Can I assume the email orginates at 25.152.82.59

Not really. You can maybe assume that 25.152.82.59 was somewhere in the path of the email, i.e. it could be the original sender but it could also some mail server in between forwarding the mail. And besides that the header could just be faked.


Nowadays TCP SYN attacks are not common, focus more on UDP amplification attacks over DNS, memcache and other UDP services. On the other hand, if you want to compute the traffic rate you can use the formula, IP header (20 bytes) + TCP header (20/32) bytes per packet, so is easy to know how many packets per second you need to send if you want a 1GB for example.

Another key aspect that you may consider is the "IP address spooofing", in order to avoid the detection of the source of the attack is easy spoof IP/UDP packets than IP/TCP if you want full TCP connection.


Can you recover original data from a screenshot that has been 'blacked out'?

Usually the PNG format does not support multiple layers. So when you draw over something, whatever was there before is lost.

However, the PNG format supports storage of an unlimited amount of metadata which is usually not displayed by image viewers. This feature is often used by image editors to add additional metadata to the image. One possible use-case is to store the undo-history of the image. This could mean that the previous version can be restored. To prevent this, make sure to set the exporting settings of your editor in a "export for web" mode which is supposed to strip all unnecessary data from the file. How to do this (and if it is even necessary) depends on the image editor.

Another possible faux-pas is to use an image blurring method which isn't 100% effective. You could, for example, accidentally set the opacity of your brush to almost but not completely 100%, which would mean that the section isn't recognizable by the human eye but might be made readable again by enhancing the contrast of the section. Another mistake is to use a filter which is reversible. I remember a case of a child-pornographer who got caught because he blurred out his own face with the "twirl" filter in Photoshop not realizing that when the same filter is applied in reverse, the image is restored to almost the original.


Can Arbitrary Code Execution be done using CSS Injection?

If attacker replaces original CSS file with a malicious CSS file and if the web-server sends this malicious CSS file to the client, can the attacker execute some code in the client?

Executing client-side code via CSS does not work in modern browsers.

I highly recommend taking a look at "Scriptless Attacks – Stealing the Pie Without Touching the Sill", "CSS: Cascading Style Scripting", and LiveOverflow's recent video "The Curse of Cross-Origin Stylesheets" if you are interested in learning more on scriptless attacks that rely on CSS.

  Can an attacker change the url to some malicious url, and execute some code in client?

Actually executing malicious JavaScript via url() will only work in outdated browsers.


Getting null byte injection attacks to work with PHP 5.2.17

The echo output with the \0 included is supposed to happen, nothing to worry. In order to understand the attack, you have to know how C and PHP store strings.

C

In C, a string is simply a a pointer to a memory address where the pointer points to the start of the string, and the \0 character indicates the end. No length is stored, all code that reads strings reads until the \0 character is reached. A C string can be as long as it wants to be.

PHP

In PHP, a string consists of two parts: one integer and one array. The integer denotes the length of the string and the array, the array contains the string itself. All String handling code in PHP reads that integer and knows how long the string is. It ignores the \0 character. The integer has an upper limit, and so does the length of the string.

The attack

The attack bases on this different string handling. So as you can include a \0 character into the PHP string, printing the string will include the \0 character. So your output will be /var/www/../../../etc/passwd\0.php. The magic happens the moment PHP gives that string to C: C interprets the \0 character as string termination and thinks it got /var/www/../../../etc/passwd. And this file of course exists.

The fix

From the release notes:

  Paths with NULL in them (foo\0bar.txt) are now considered as invalid. (Rasmus)

The fix mostly consists of adding if-clauses, comparing the string length with the c method (left) and the php method (right):

if (strlen(Z_STRVAL_PP(file)) != Z_STRLEN_PP(file)) {
    RETURN_FALSE;
}


Can BTRFS provide authentication on an encrypted disk?

In a way, yes. However, btrfs will silently repair the data where possible so unless there is an unrecoverable error, you won't know. Since you use LVM and btrfs, there is a good chance the data will be fragmented making it even more difficult for an attacker to change it consistently. Offline cryptanalysis of a btrfs filesystem is complicated enough on its own as the filesystem is, in my opinion, less predictable.

In respect to this, off topic - using LVM under btrfs is redundant. Btrfs features all the goodies LVM does and more. Performance-wise this is not optimal - btrfs uses extents of its own while unaware of LVM's extents. This could result in mid-extent fragmentation. It may look like a "security" feature but it is in fact not.

If you want "authenticated" data on a filesystem, the only way is signing them or at least having an off-line hash for the entire block device or any and all subsets of blocks on the device.


Why are CA's signing keys available on the internet

The CA key should be well protected against physical attacks, because you do not want it to get stolen. It is an extremely valuable asset, since the corresponding public key has been embedded in widespread operating systems. So it must lie in a tamper resistant device (a Hardware Security Module), and that module should be in a bunker with guards.

On the other hand, it makes little sense to have a protected bunker if the employees just enter and exit it all day long. For a commercial CA which issues hundreds or more of certificates every day, the employees who handle the identity verification procedure and decide that the certificate should be issued must be, in practice, located "elsewhere". So now the device with the signature key is linked to the employees through some sort of network.

Physically private networks are extremely expensive, so everybody just uses "the Internet" and some sort of cryptographic protection for that link (e.g. SSL). So there you have it: the CA is "on the Internet" because it would be impractical (i.e. very expensive) to do otherwise.

Also, a CA should periodically publish Certificate Revocation Lists, that it signs with its private key. This also requires a regular network connection. You could do it with a daily/weekly manual transfer with a USB key, but human employees are not cheap, contrary to a crontab and an ethernet cable.

Good CA use a two-tier system with an offline root, which is used only once per year (this time by entering the bunker) to issue sub-CA certificates to the machines which actually do the common certificate signing.


Does the "Special Groups" feature in Vista, 2008, R2, and Windows 7 apply to File System access?

Yes. The answer is just plain old object-access auditing with audit policy and Audit ACLs.

First, you enable the system audit policy for tracking successful access of files and object. Don't worry, this won't make insane amounts of log messages (though domain controllers do get a bitnoisier due to default Audit ACLs (SACLs)).

Second, in active directory or the file system, you find objects you want to audit access to. Edit the properties, go in advanced security settings/Audit tab. Then you add the users or groups that you want to track, then you select the type of activity you want to track.

When users access this object, the system checks if there is a SACL and if this type of access should result in a security eventlog message.

A more thorough overview:
http://technet.microsoft.com/en-us/library/cc787413(v=ws.10).aspx


Does WiFi SSID spoofing also affect known password protected networks?

The answer to your question is, no.  with a WPA-PSK authenticated network, the PSK is never actually sent over the wire, the protocol is designed to prove that both the client machine (a.k.a station) and Access point have the same key before commencing communication.

If an attacker can sniff the traffic sent between the station and the access point during the handshake process, it can attack it by trying to brute force the key value (which is why you should never use a weak key value).

There's some additional information here


BEAST: IIS6: Failing PCI scan - are these ciphers OK?

How does one disable CBC 'mode' on IIS6?

You disable all ciphers that have CBC in their name.  http://support.microsoft.com/default.aspx?scid=kb;EN-US;245030 describes how; https://www.nartac.com/Products/IISCrypto/Default.aspx provides a tool to do it for you.

Also, from that second website:

  Note - Windows Server 2003 does not support the reordering of SSL cipher suites offered by IIS. However, you can still disable weak protocols and ciphers. Also, Windows Server 2003 does not come with the AES cipher suite. Microsoft has a hotfix for this.

This means you really only have two choices:

Upgrade your operating system to Windows Server 2008, which I infer as being fully supported by the Nartac tool and is the last 32-bit version of Windows Server, so shouldn't require updating your application too much (although you really should)
Disable all CBC-named ciphers to pass your PCI check (and then re-enable them once it is done, albeit it is on your own head if you ever get caught).

Did I say that out loud?


Is there a standard checksum for verifying multipart key fragments?

There is no standard algorithm for key verification*, but there are standard checksums.
Assuming verification is done to detect simple mistakes when retrieving or submitting the key, any reliable checksum algorithm such as CRC32 will work. In fact, it can be made transparent to the key-holder by including the checksum in the key itself. This can be done easily for any key K by creating K' = K || H(K), where H is a hash or checksum. Any error in the key itself or the checksum would result in the key being discarded. The keys being input could optionally have their checksum stripped after verification. This mirrors historical techniques where encryption keys for algorithms such as DES included parity bits in the standard to ensure every 8-bit chunk is odd-parity.
You have a few options for the checksum itself. Parity bits are the easiest to implement, but are designed to detect transmission errors where only a single bit is expected to change. A human-created mistake that changes "a" to "b" will result in two changed bits and a parity bit would not detect the change. Checksums are similar, but more complicated. They calculate a sum of the weighted multiplication of each component part of the input. CRCs on the other hand are designed for efficient error detection under nearly all circumstances. They can be guaranteed free of collisions for up to a certain number of errors. They have a configurable overhead.
Which one you use is up to you. CRCs are the most effective, since performance is not an issue (you won't be verifying millions of keys per second). A commonly used standard is CRC32c. It has a 32-bit output and has a well-chosen polynomial. If you only expect single-bit errors, parity checks will be a simpler option with less overhead (only one extra bit for each chunk of data).
* As pointed out in a comment, there are standards for verifying keys called Key Check Values, or KCVs, for example ANSI X9.24-1:2009 KCV. However, these are designed to detect electronic transmission errors, not human errors.

To answer your questions directly...

My question is if there are standard checksum algorithms used for validating key entry into a multipart key exchange system?

There is no standard for validating key entry, but there are checksums that have been standardized for error detection which you can safely use in your scheme. However, there is a standard for secret sharing (multipart key input) which is not your simple K' = K0 ⊕ K1 ⊕ K2. The algorithm is called Shamir's Secret Sharing and provides configurable parameters for the number of correct keys required to calculate the secret, the amount of redundancy against incorrect keys, etc.
In order to reduce the impact of incorrect input, you can use an error correcting code. These expand the size of the key material slightly, but ensure that the original value can always be derived even if it has up to a certain number of errors. The larger the error correcting code (and associated overhead), the more errors it can correct. This allows you not just to detect a mistake, but to correct it at the same time.

Or is this something each crypto vendor typically comes up with on their own?

Most vendors come up with things on their own due to a severe case of NIH syndrome, not because there are no standard primitives to work with or best practices to adhere to. The answer also depends on the specific organization. Various US intelligence agencies tend to use (or used) fill devices which often used parity bits for key integrity. The answer here is that they do typically come up with their own, sometimes flawed, scheme. This does not mean it is necessary to do so.