How long should zip encryption password be for it take 10 years to crack?

If you are using ZipCrypto for encryption, then any password length is insecure.
You are using the ZipCrypto cipher, rather than the more secure AES. ZipCrypto is extremely weak, as it is based internally on a non-cryptographic construction called a CRC. It is highly vulnerable to a known-plaintext attack, which in practice does not require knowing exactly what your Zip file contains, only a minuscule portion. This can typically be satisfied by using the header of a file, which is typically known for the vast majority of commonly compressed files.
The attack, discovered in the 90s, is detailed in A Known Plaintext Attack on the PKZIP Stream Cipher. With 13 bytes of known plaintext, the full key can be recovered with a complexity of 238, which is not much. In fact, it took only a few hours on a personal computer, and that was with 90s hardware! Attacks only get better over time, and the attack against ZipCrypto is no exception to this trend: An Improved Known Plaintext Attack on PKZIP Encryption Algorithm.

If you switch to the newer Zip encryption format which supports AES, then you can securely encrypt files and trust that they will stay confidential indefinitely. Assuming you want a minimum of 128 bits of security and are choosing a password from a set of 62 symbols (an alphanumeric password), you would want to use at least 22 characters, as log2(6222) ≈ 131 bits and, obviously, 131 ≥ 128. Zip encryption of any kind does not provide integrity, but you specified that you only need confidentiality.


The problem with secret URLs is that they can be leaked in a variety of ways.

Images, Javascript, Stylesheets, and fonts can leak the URL of the webpage you are visiting. For example, if your secret page includes something like <img src="http://example.com" /> then when your browser grabs the image it may include the URL to the secret page in the Referer header. There are some use cases (https to http traffic, or browser overrides) that will prevent the browser from sending the header, but generally, this is a common way for your secret URL to be leaked.

While you can watch your own network traffic (use the "network profile" feature in Chrome or Firefox) when loading the page to see whether the URL is leaked, the main concern is that any change in the page could introduce a leak.

Two high profile cases of leaked secret URLs include Google Docs and Dropbox.

Is this inadequate security for something like an IaaS portal?

As I mentioned above, you could use the network profile feature of your browser to test whether the page is leaking the URL. However, the biggest concern is the fragility of this system. Unlike something like a password, the user has no control over the web page implementation, and accidentally including an external resource in a style sheet is far too easy. This isn't to say the system is insecure, just that it is a bit fragile.

If I were using the IaaS portal, I would ask that they include an additional access control mechanism beyond a URL that is easily leaked.


I wouldn't be surprised if there is hardware out there that can solve the problems you listed, but I would hazard a guess that they are very domain/environment-specific.

Then again, when you think about each problem seperately...

RF interception: The solution is proper shielding (and grounding of the shield)
Keylogger: Encryption isn't going to solve this problem.  A keyboard that can't be unplugged indetectably, nor taken apart could work.
Camera watching over head: SCIF room, or varient thereof.  http://en.wikipedia.org/wiki/Sensitive_Compartmented_Information_Facility

Actually, that last one solves all (most?) of the problems.

Seperating each problem into seperate solutions in this case (IMO) is sort of like remedying the symptoms of a disease, instead of the disease itself.

EDIT: While the question was intended to be very specifc in nature with regard to devices on the market, I don't really know if an answer can be given without adding proper context.


How to fully mask my computer without using tor?

Tor is probably your best bet, but if that isn't an option consider finding a reputable VPN you think you can trust.

Ultimately it depends who your adversary is. If you're living in a despotic regime with access to the VPN or the ability to strongarm them you're probably not going to do very well.

But if you pay a reputable company outside your country that hopefully wouldn't sell you out then you should be okay.

Tor is better though. You don't have to trust a company to keep you safe(r). There are still problems with Tor too (correlation attacks by people who own entry and exit nodes or monitor large portions of the internet.

There are way to many risks to say you wont get tracked back to your machine, but these methods will make it harder.


Why would output from sqlmap be trimmed?

Per the sqlmap source code at [Github 1], this warning occurs when the returned data size from the SQL server is less than that requested:

trimmed = _("%s(?P<result>.*?)<" % (kb.chars.start))

            if trimmed:
                warnMsg = "possible server trimmed output detected "
                warnMsg += "(probably due to its length and/or content): "

This can occur if the SQL programmer decides to be able to query the database element, but not return the whole item.  The TEXTSIZE command is one way to do so in SQL Server (there are several others).

The primary reason is to check if there is any data without transferring a large block of data.  Hash values are not large, but some systems do truncate password hash values and use the stored partial hash value.  Truncating hash values is not a good practice, see Does truncating the cryptographic hash make it impossible to crack?.

Note that changing to --hex would only effect the format of the output display, not the overall size in characters or bytes of the display (01001001 in binary, = 0x49 in hex, =73 in decimal, = the letter "I" in ASCII, but one byte regardless).


You could script up example based testing pretty easily. With a sample request, sqlmap can do the rest. The only thing it doesnt do by default I believe is path paramters, but that as well could be incorporated into your script. The issue with this is that it will exponentially increase the amount of time it takes for unit tests to run and is generally not done this way because of that. Its up to you and your developers to determine if time added is acceptable. In my experience, it generally isn’t. You could also build somethig out that launches sql map in a separate thread, for example, when something is deployed to stage, and alert security if something is found. This way it wouldnt block your build. Example based testing would be the answer to your question though.


Are stack overflows using memcpy possible with modern compilers?

Looks like it's still possible to overflow if you try (or just make a mistake) with this example implementation of memcpy:

$ cat mc.c
#include <string.h>
#include <stdio.h>

#undef memcpy
#define bos0(dest) __builtin_object_size (dest, 0)
#define memcpy(dest, src, n) \
    __builtin___memcpy_chk (dest, src, n, bos0 (dest))

int main() {
    char baz[64];
    char bar[16];
    char foo[16];
    char* f = foo;
    char* b = baz;
    int len = 26;

    strncpy(baz, "abcdefghijklmnopqrstuvwxyz", 26);
    memset(bar, 0, sizeof(bar));
    memcpy(f, b, len); // [a-z] is bigger than foo, will overflow into bar
    printf("Evidence of buffer overflow: %s\n", bar);
    printf("now press enter to see runtime detection working properly: \n");
    (void)getchar(); // pause for user input
    memcpy(foo, bar, len);  // buffer overflow detected at runtime
    return 0;
}
$ g++ -Wall mc.c
$ ./a.out
Evidence of buffer overflow: qrstuvwxyz
now press enter to see runtime detection working properly:

*** buffer overflow detected ***: ./a.out terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x731af)[0x7fe0327391af]
    <snip>
Aborted
$


Drive with deniable encryption and multiple independent file systems

There is no better way then checking a magic number.
All the other options have disadvantages that are unacceptable to me.
So the creating procedure is the following:

Fill the file or disk with random data
Divide file or disk into blocks of 1 GB
Ask the user for a password
Hash that password with an adequate algorithm
Select a random block and write a header (encrypted with the hash) with the magical number to ensure correct decryption later
Mount the block minus the header as an encrypted file-system (encrypted with the hash).

To get the data back the following procedure needs to be followed:

Ask the user for a password
Hash that password with an adequate algorithm
Divide the file or disk into blocks of 1 GB
Go to the start of each block and decrypt the first n bytes with the hashed password
Check if the decrypted data matches the magical number
Go to the next block if not


How can I tell whether this computer is part of a botnet?

For the identification of any presence of infection of botnet, close any running programs that will send requests(browser, game, skype, etc) and you can use wireshark to check for any abnormal traffic.

For a personal computer checkup, you can try Hijackthis or DDS. Get a log of either one of it and analyze for any suspicious programs(you can google for the filename of the program and the path that it SHOULD be at).

A website that you may use to perform a checkup on the file would be systemlookup.com. Just check on the filename at the search bar and type the filename of the file that you wanted to search.

You may also check the CLSID(can be found at Hijackthis's logs) of the file to verify the validity of the file by selecting CLSID on the search bar of systemlookup and copy pasting the CLSID into the search bar and search for it.

NOTE: The two programs above are not a virus removal tool but a check up tool instead.

You can take the incentive to remove the potential malware yourself, but do it at your own risk and do it if and only if you are very sure that it is a malware(through many inspection on the file).

However, if you do not have the knowledge or you require any help on removing the malware, you can seek assistance at bleepingcomputer
If you do need help at bleepingcomputer, please read this before posting


Is it safe to store my login credentials in a Veracrypt volume?

"Safe" is relative. In general Veracrypt has a good reputation and supports strong crypto.

Assuming reasonable use, your weakest link is your stated 8-character password.

It may be safe enough depending upon the password and the expected threat, but why limit yourself to an 8-character password?

Veracrypt supports "pass phrases" up to 64 characters. You can make an easy to remember multiword sentence that is potentially much stronger than 8 characters.

 *Granted it's always possible to make poor passwords and phrases.*

Additionally, Veracrypt supports a user custom PIM (Personal Iterations Multiplier). This creates an alternate iteration count from that of the default, which means brute forcing has to account for the custom PIM as well as the password/phrase. Of course this also means you have to remember this custom PIM as well.

If for whatever reason you feel you need to use only an 8-character password, I'd suggest also using a custom PIM.


Xavier59's answer is correct, in that protonmail uses SRP.  Therefore (under normal circumstances) your password is never sent to protonmail's server.
However, the SRP is implemented in javascript, which is served by protonmail's server.  If protonmail were to be compromised, or if protonmail were to 'go rogue', they could easily serve javascript that captures your password after you enter it, and sends the password back to their servers.  Then, they would have everything necessary to decrypt your private key, and then decrypt your messages.
This is why javascript cryptography is a 'chicken-and-egg' problem.  If you can't trust the server with your secrets, then how can you trust the server to deliver secure code?  See https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/ for some good reading on this subject.

Edit 9/24/2020
I sent the following email to security@protonmail.com on 9/21/2020, inviting Protonmail to weigh-in on this subject.  I've not received a response from Protonmail as of yet, but if/when I do, I will update here.

Hello ProtonMail Team,
First off, I’d like to thank you for building ProtonMail.  You’ve
managed to make end-to-end encrypted email as simple to use as
webmail, which is truly groundbreaking.
I am a moderator at security.stackexchange.com, and several questions
have come up recently about ProtonMail (and other services that rely
on in-browser crypto to implement ‘zero-access’ systems), in the
context of the ‘Browser Crypto Chicken-and-Egg Problem’ .
On your page at https://protonmail.com/security-details, it reads,
‘your data is encrypted in a way that makes it inaccessible to us’,
and ‘data is encrypted on the client side using an encryption key that
we do not have access to’.  However, it would seem that if ProtonMail
were to ‘go rogue’ (or if ProtonMail were to be coerced, or if an
attacker were to gain access to ProtonMail’s servers, etc.), it would
be possible for ProtonMail to modify the client-side code served by
Protonmail’s servers, such that the code captures the user’s private
keys or plaintext information, and sends these secrets back to the
server (or somewhere else).  As you may know, this problem was coined
‘The Browser Crypto Chicken-and-Egg Problem’ by security researcher
Thomas Ptecek in 2011.  In other words, if users can’t trust the
server with your secrets, than how can users trust the server to serve
secure crypto code?
Copied below are links to a few questions on
security.stackexchange.com where this subject has come up recently.
Some of these questions (and their ensuing responses) also contain
some interesting ideas around solutions to this problem:
Can protonmail access my passwords and hence my secrets?
Solution to the ‘Browser Crypto Chicken-and-Egg Problem’?
What’s wrong with in-browser cryptography in 2017?
Problems with in Browser Crypto
I’m curious if ProtonMail has any comment on this subject.
Specifically, if ProtonMail were to go rogue, would it be possible for
ProtonMail to access users’ secrets by modifying the client-side code
that you serve?  If so, has ProtonMail considered any solutions to
this problem?  I’d be interested in reading any comments that you have
on this subject – either in a response from you to this email; or
better yet, in a response from you to one of the questions above on
security.stackexchange.com.

Edit 10/20/2020
I received the following reply from the security team at ProtonMail.  For anyone interested in this subject, I recommend watching the video referenced in the reply.

The robustness of ProtonMail’s cryptographic architecture, and whether
or not users can trust it, is something that comes up from time to
time.The discussion around whether or not ProtonMail could access
users’ secrets by modifying the client-side code boils down to two
more fundamental questions:

Are browsers suitable for cryptography?
Can you trust the source
of the software you use?

With regards to the first question, browsers have evolved a lot since
security researcher Thomas Ptecek published his report in 2011.
Currently, browsers expose not only a the systems built-in random
number generator, but the entire Web Crypto API, which means that
cryptography can be done natively, instead of implemented via
JavaScript. ProtonMail does indeed leverage the Web Crypto API instead
of doing cryptography in JavaScript. The second question is more
difficult to answer. It’s a question that is not specific to
ProtonMail, but applies to all software in existence today (including
software which is not downloaded from web browsers). While open-source
code helps provide transparency, testing and verifying whether or not
software has been compromised is not feasible for the average user.
Some people view web browsers to be more susceptible to this problem
(we don’t entirely agree because users don’t really verify the code of
the software they download from e.g. Google Play either), and if that
is the case, one mitigation ProtonMail provides is by offering open
source native applications on all platforms, so you can use the
service without using a web browser if you wish. Long story short, in
today’s software delivery model, be this through the web browser or
via another channel, users need to trust the source and hope that
someone with the necessary skills notices and flags the tampering. We
recognize that this is an issue (not unique to ProtonMail), and are
working on a solution, called Source Code Transparency. The idea is to
publish a hash of the source code which everyone verifies to ensure
that they’re all running the same source code. An independent third
party would then evaluate and assert the integrity of the delivered
software. This process would not only increase everybody’s trust in
the source code, but would also make it much more difficult for us to
attack any specific user (as running an attack would mean all our
users, who run the same source code, would be impacted, and so the
risk of detection is higher). You can find more details at a talk we
gave at FOSDEM (Free and Open source Software Developers’ European
Meeting) earlier this year:
https://archive.fosdem.org/2020/schedule/event/dip_securing_protonmail/
We hope this helps clarify a bit our thoughts on the topic. Thank you
again for reaching out to us.


Do android apps have signatures like Window executables?

All android apps must be signed by developers using self-signed certificates or by third-parties, such as an OEM, mobile operator, or alternate market. When apps are updated, the updated versions must be signed by the same developer. Additionally, applications can share permissions if they are signed by the same developer.

Apps on Google Play are also signed by Google Play. By default, Android blocks the installation of apps that are not signed by Google Play, unless the user has specifically enabled the "Unknown Sources" option under Security Settings.

References:

https://source.android.com/security/overview/app-security.html#application-signing
https://developer.android.com/distribute/tools/open-distribution.html
https://developer.android.com/studio/publish/app-signing.html


How to simply and efficiently generate different keys from one password?

Technically, PBKDF2 can produce an arbitrary long output (it is a Key Derivation Function), but it has issues for that: PBKDF2 uses HMAC over some hash function, which has output length k bits (e.g. k = 160 for the usual SHA-1). If you ask for more output than that size, then the computational cost rises quickly: if you want 320 bits, it will cost twice as much as 160 bits.

Unfortunately, though PBKDF2 is "strengthened" to deter dictionary attacks, the attacker's cost will not rise as fast. Consider for instance that you use PBKDF2/SHA-1 to produce 256 bits worth of key material: 128 bits for symmetric encryption, then 128 bits for a MAC. As the defender (the normal user) you must get your whole 256 bits. The attacker, on the other hand, does not need as much; he can simply produce the first 128 bits, at half the cost, and see if decryption yields non-junk data.

This is a known issue with PBKDF2. Note that the same issue would appear if you used another password hashing function twice, with two different salts: you pay for the hashing twice, but the attacker can ignore one of the keys, and will thereby be twice faster than you.

If you prefer to use bcrypt, then you run into another issue, which is that bcrypt is not a KDF; its output size is 192 bits. No more. Its processing time does not depend upon its output size, because its output size is fixed.

The generic method is to run a password hashing function, and then expand the output with a Key Derivation Function. That's what @CodesInChaos suggests, with HKDF-Expand. There are several KDF out there; usually, for my own designs/proposals, I rely on HMAC_DRBG, from NIST SP800-90 and X9.62 (e.g. in this). Ideally, you want a KDF which is well-vetted, i.e. which has been investigated by cryptographers, and they found nothing bad to say about it (or, even better, they produced "security proofs").

If you are in a hurry and don't need a lot of key material, a relatively simpler method is to hash the password hashing function output with SHA-512. This will give you 512 bits worth of key material.


Is it possible to block psexec without blocking regular SMB access?

For psexec to work, you must already have local admin credentials for the target. If you don't want people using psexec to a given computer, the proper solution is to not give them admin rights there. Otherwise, they could just undo whatever you do anyway.


Is it possible to intercept Airdrop data transfer be intercepted?

These are actually two different questions.

Airdrop

According to Apple, Airdrop transports the data directly from device to device end employs TLS-encryption for the transport. Therefore, nobody should be able to intercept the transferred data.

You should keep in mind though, that your legitimate recipient can forward the image to anybody or publish it! Think twice before you share sensitive data!

WiFi-Usage

When you are logged into the WiFi of your school, the school will be able to monitor all unencrypted connections you make. If you use HTTPS for browsing & searching, your school will not be able to tell what data was exchanged, however it will be able to tell, which host your device connected to. Also, the DNS traffic will be readable for your school, which will reveal which domain names your device tried to resolve.

Your school might also try to tamper with HTTPs by deploying a Proxy or trying to downgrade to HTTP in order to access your encrypted communication as well. If you have not accepted a school certificate authority, this should be easily detectable.


In theory all you need to do is to setup a route in your OS's routing table so that the second VPN's server IP will be routed via the first one. You may also have to fix the default route after the second VPN is connected.

In reality, whether you can do this depends on the OS and the VPN client. Android for example only support one VPN natively.


Where to get patches for recent CVEs announced for glibc?

Searching for CVE-2016-5417 points to nvd.nist.giv which has as resource listed a link to a patch.

Note that these source patches are usually only for versions still supported by the authors of the software, i.e. often only the latest versions. And it might also be that the patch includes not only a fix for this specific issue but for multiple issues. In such cases you either depend on your distributor to provide you with a fixed version of the software or you need to have the know-how to extract the essential patch from a bigger one, maybe modify it for your software version and apply it - i.e. do yourself what the distributor usually does for you.


OpenSSL Certificate Renewal with same keys and NO CSR

So how do I go about using OpenSSL to accept the new .cer file and associate it with the existing private key? I have all the relevant passwords/passphrases, etc.

You don't need to "associate" the new certificate with the existing private key because it already is. The CA simply used the public key in the existing certificate (where your private key is for) for the new certificate. And since the public key is still the same even if the certificate has been changed  the private key is the same too.


Those headers are of use to a compliant browser that can take action upon them.
API responses handled by a piece of code that parses them into something else will probably not be inspected for these headers or acted upon. However nothing stops browsers from doing API calls, against which these headers will come into play.
It is unusual that JSON content ends up being rendered directly on a browser, but it does happen. When it does, it is as critical to properly sanitise it as it if were any other piece of data.


How does Windows use the TPM for BitLocker encryption without an attacker being able to do the same?

The volume master key is encrypted by one or more key protectors. You have a range of key protectors to choose from depending on the machine's configuration and hardware, each can be used to unlock the volume master key independently.

In your configuration above you have two encrypted copies of the volume master key - a TPM key protector, as well as a Numerical Password key protector - a 48-bit recovery password which itself decrypts the volume master key.

  Raw data is encrypted with the full volume encryption key, which is then encrypted with the volume master key. The volume master key is in turn encrypted by one of several possible methods depending on your authentication (that is, key protectors or TPM) and recovery scenarios.

  The full volume encryption key is encrypted by the volume master key and stored in the encrypted drive. The volume master key is encrypted by the appropriate key protector and stored in the encrypted drive. If BitLocker has been suspended, the clear key that is used to encrypt the volume master key is also stored in the encrypted drive, along with the encrypted volume master key.

  This storage process ensures that the volume master key is never stored unencrypted and is protected unless you disable BitLocker. The keys are also saved to two additional locations on the drive for redundancy. The keys can be read and processed by the boot manager.

BitLocker Key Management FAQ

When you access a disk protected by BitLocker, such as when starting the computer for the OS volume, BitLocker requests access to the key protector.

For a recovery password key protector, you are required to type it in to the pre-boot environment.

The TPM Key Protector is a special key protector that (a) stores the encryption key inside tamper-resistant non-exportable memory in the chip, and (b) uses the capabilities of the security processor to perform validation of the machine's current configuration before releasing the key from its encrypted memory to the Operating System.

When BitLocker with a TPM key protector is initialised, a validation profile is created in the TPM chip of the machine which includes the readings of a number of Platform Configuration Registers (PCRs). Each PCR represents the state or value of a number of boot-critical components and services. This validation profile is the 'known good' state of the machine.

Each time the machine is booted, the TPM measures these PCRs again. Provided the PCRs match the known-good profile, the TPM releases the key to the Operating System enabling the automatic unlock of the disk and the remainder of the boot process. Additionally, a PIN may need to be inputted to provide additional authentication to the TPM of the user (highly recommended).

If the value of any of these have changed (e.g. the Master Boot Record (MBR) code has been modified by an attacker to display or release the encryption key in the clear), the PCR will have changed when assessed by the TPM during boot, the system is not deemed to be secure and the TPM will not release the key. In this case another key protector is tried - which is often prompting the user to input the recovery password.

Whilst Windows provides a secure by design default configuration, you can change the PCRs that are assessed and read more about the functions of each PCR in the relevant Group Policy settings for BitLocker PCRs:

Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives\Configure TPM platform validation profile (...)

This is fundamentally what stops a malicious user from accessing the volume master key via the TPM.

Further reading: How does the TPM perform integrity measurements on a system?


How can I detect spyware on a smartphone

Possible signs there is Spyware present may include:

Higher battery usage
Higher than normal data usage
Strange background noise during phone calls
Unknown apps installed
Apple ID login request

Any suspicion of a device being infected, the best course of action in my opinion is to factory reset the device (nuke it from orbit).

If this is not an option, installing a reputable antivirus application from the Apple store may be an alternative course of action.


Why Microsoft leaves known security flaws?

When the physical security of the computer is not ensured then there are probably dozens of different attack vectors. You can also remove the Administrator password to allow logon without password, you can steal the NTLM hash from the registry hive and try to crack it with John the Ripper and there are probably others I don't know about. These 2 things work up to Win7 without any problems.

The answer is simple: Password protect your BIOS and/or encrypt the hard disk.


Why doesn't outlook 2013 meet modern security standards?

That specific GMail account flag simply allows system that uses standard SMTP to connect without using OAUTH2.

The only secure password authentication method gmail allows SMTP clients to use is a (non.standard) XOAUTH2 SASL mechanism (the correct tag is actually OAUTHBEARER).

GMail has decided to refuse all other secure login mechanism: you're either using their own flavor of OAUTH2 SASL or you need to enable that flag and use the LOGIN (i.e. cleartext) password. Security-wise, your password is still proetcted by the TLS encryption. What changes is that the client application needs to keep your password in an encrypted format while, with OAuth, it keeps an access token (a per-application password, if you want).

In other words: it's not that Outlook does not "meet modern security standards", it's that google have a very peculiar view of what these standards are.


Where to store AES keys when encrypting files at rest?

Let's call the system that performs the encryption E and any system that stores the encrypted files S (for storage).

Files stored on S are secure as long as the attacker doesn't have the corresponding key.

Since you don't want to use an HSM we can assume that any keys stored on E will be compromised if E is compromised. Now you have basically two options for storage: disk or memory. On disk is pretty trivial: you use OS ACL's to restrict access to the encryption key, and hope that it will be fine. For in memory you can build a system that requires you to manually supply a master secret (typing in, read a QR code via webcam, etc.) when the encryption service starts (or on key rotation, see below). This way the key can't be accessed via vulnerabilities that provide FS access only (e.g. path traversal). Note that in Python you will have a hard time erasing secrets from memory, but you can use dirty hacks like this.

(note that Virtualization Based Security can "emulate" extra HW that would have remarkable benefits but I don't think this matches your use-case)

Expecting the compromise of E, it would be a good idea to periodically rotate keys (and move old keys away from E to safe offline storage) so any incident won't affect files encrypted with previous keys. The key rotation period should depend on your needs.

Edit: In case of a decent cipher like AES encryption large number of files with the same key is not a problem, so using a single key doesn't result in weaker encryption than using multiple keys. At the end of the day it's about key management.

The use of per file or per user encrpytion also depends on the key management requirements. Per user keys can make sense if you need to decrypt files on a per-user basis. Per file passwords can limit the impact of a compromise but archiving old keys can be problematic and you should keep in mind that systems usually remain in a compromised state for extended periods of time, so this may not help much more than a sane periodic rekey process.


Find SHA256 if I only have part of the string

You may be able to compute a SHA256 of part1-part2, if you already knew SHA256(part1), and the value for part2.  This relies on a vulnerability in the underlying method of hash construction SHA256 uses (https://en.wikipedia.org/wiki/Length_extension_attack).

EDIT: To clarify the algorithm SHA256 will pad any input to a multiple of some given size.

Soo really you could think of it as SHA256(part1||padding), where 'padding' means x00 repeated till size(part1||padding) mod 512 = 0 (since SHA256 has a block size of 512 https://en.wikipedia.org/wiki/Secure_Hash_Algorithm).  This becomes a problem if any padding needs to be added to part1.


Why not ask for a password and 2-factor token at the same time?

Many OTP systems allow you to receive an OTP by SMS/email. So the system has to know when to send you an OTP.

You might suggest that there could just be a "request OTP" button next to the form. But then anyone can repeatedly click on the button, meaning that you will receive a huge amount of spam email/SMS.

You might suggest fixing that issue by limiting the rate of OTPs. But then I can cause you a denial of service by requesting your full quota of OTPs so that you can't log in.

A simple solution to this is to only send an OTP to a user that has provided a valid password.


Segmentation fault error when calling user defined function in shellcode

As Joshua said, just mov(e) the address of the target function into a register and call that regsiter. Assemble that and use its opcodes, because you need a shellcode(opcodes) that would be executed, and not a function address.

When func() is called after typecasing("stuff") into a function pointer as you wrote

void (*func)() = (void (*)())stuff;
func();

Exploit:

I used your C code and just modified target function a bit to

void target(){
    //Magic Happens Here
        puts("You won");
        exit(0);
}

Compiled it with following gcc flags: gcc -fno-stack-protector -z execstack vuln.c

I did it on 64 bit architecture, so the binary is ELF 64bit. Now run the binary in gdb, and find the address of "target" function as:

(gdb) p target
$1 = {<text variable, no debug info>}` **0x4006dd** `<target>

Go here and assemble the following x64 instructions (for x86 use eax instead of rax). Example:

mov rax ,0x4006dd
call rax

It gives the following shellcode: **\x48\xC7\xC0\xDD\x06\x40\x00\xFF\xD0**

Now write it into the file

python -c "print '\x48\xC7\xC0\xDD\x06\x40\x00\xFF\xD0'" > exp
root@BOX:~# cat exp| ./a.out

You can type 50 bytes:
**You won**

root@BOX:~#`

Thus executing the target function.


1. Request

  [...] why do we need the next 3 (Certificate Status Type, Responder ID list Length, Request Extensions Length)[...]?

The status_request is defined in RFC 6066, section 8. Certificate Status Request.

Certificate Status Type: OCSP (1)

Boring. It's the only defined value right now. Field is for future extensibility, I guess.

Responder ID list Length: 0

From the RFC:

  In the OCSPStatusRequest, the "ResponderIDs" provides a list of OCSP
     responders that the client trusts.  A zero-length "responder_id_list"
     sequence has the special meaning that the responders are implicitly
     known to the server, e.g., by prior arrangement.

And this is meant especially for "constrained clients", like embedded systems, that only know a handful of CAs.

From the RFC:

  "Extensions" is imported from [RFC5280].  A
     zero-length "request_extensions" value means that there are no
     extensions (as opposed to a zero-length ASN.1 SEQUENCE, which is not
     valid for the "Extensions" type).

Dunno. I don't really understand the imported from RFC5280. But I guess it might refer specifically to section 5.2.1 of that RFC5280. But I don't really understand that section either.

2. Response

  [...] What are the fields byKey and ResponseType ID? [...]

The byKey field is just an identifier for the OCSP responder. So that the client can decide if he trusts that responder/signer or not. And it can be either byName or byKey

  Does the client need to match the Certificate status type with what was sent in the client hello?

Absolutely. But there only is one type defined at the moment, no anything other than OCSP (1) is going to be undefined/wrong/useless anyway.

3. Chain?

  I understand that revocation checks need to be done for all certificates in the chain. How does this fit in with stapling?

AFAIK: not too well. But there is an effort to introduce "Multi-Stapling" (from 2013):

  With the necessary support in TLS clients and servers it would be possible to use OCSP stapling for the intermediate CA certificates, too. Checking this information in connection with a stapled OCSP response is referred to as “multi-stapling.”

  Multi-stapling should have been as simple as defining a new method for the Certificate Status extension and including that method in the list of methods supported by the client. Unfortunately, that was not the case.


How is printf() in C/C++ a Buffer overflow vulnerability?

It is possible to have issues with printf(), by using as format string a user-provided argument, i.e. printf(arg) instead of printf("%s", arg). I have seen it done way too often. Since the caller did not push extra arguments, a string with some spurious % specifiers can be used to read whatever is on the stack, and with %n some values can be written to memory (%n means: "the next argument is an int *; go write there the number of characters emitted so far).

However, I find it more plausible that the article you quote contains a simple typographical mistake, and really means sprintf(), not printf().

(I could also argue that apart from gets(), there is no inherently vulnerable C function; only functions which need to be used with care. The so-called "safe" replacements like snprintf() don't actually solve the problem; they hide it by replacing a buffer overflow with a silent truncation, which is less noisy but not necessarily better.)


How does a nonce reset allow for decryption?

This is because of being able to figure out the keystream for a given key and nonce when you can get both to be reused and the stream contains predictable information.

In many ciphers, a key is used to produce a series of ones and zeros that are xor'd with the data to produce an encrypted value.  This string of ones and zeros is known as the keystream.  If you are able to reuse a nonce and the keystream isn't altered based on the content of previous plaintext blocks, then you can look for known packets to appear in the content.  When these known packets occur, you will see a predictable pattern occur and will be able to determine that you know that portion of the keystream.

By repeating the process, you eventually can gain more and more knowledge of the keystream and can then read or manipulate anything found on a known portion of the keystream.  RC4 is EXTREMELY vulnerable to nonce reuse as it is a pure xor'd keystream.  Similarly CTR modes of AES will be extremely susceptible.  AES CBC-MAC will be a bit less impacted, however doing constant key resetting could potentially bypass the chaining due to always using the same set of initial blocks, so some information leakage would potentially still be possible, especially for the attacker faking a new client where racing will not be a factor.


Do the new instruction sets found on Intel's Haswell Architecture make any difference in cryptographic operations?

Most of these operations are "trivial": they replace combinations of two or three existing opcodes. For instance, the BLSR type of instruction is, as specified in the page you link to, equivalent to a subtraction followed by a bitwise AND. This could already be done. Extra operations don't harm, and compilers will benefit from them, and, undoubtly, some cryptographic functions will gain a few cycles through use of some of these opcodes, but there is no groundbreaking result to expect.

Among the instructions, the most interesting are the counting ones (LZCNT, TZCNT) because counting the number of leading or trailing zeros in a register of N bits has cost O(log N) when using "classic" opcodes. These operations have some use in some corner cases of computations on big integers. In particular, I think this will help for binary GCD, which is used to compute divisions in finite fields -- an important step in computations over elliptic curves. Right now, division in finite fields is so expensive (when compared with multiplication) that it is worthwhile to use projective coordinates to compute things on elliptic curves: this implies about ten times as many operations, but avoids a lot of divisions, so it adds up to net gains. A fast implementation of binary GCD might change that picture a bit. For more uses of counting operations, see this Wikipedia page.

What may really boost things up is not the new instructions, but the larger registers. AVX2 offers 256-bit registers; that's room enough to compute eight SHA-256 in parallel, just like SSE2 allows for four parallel SHA-256. Password cracking software will benefit from this... (although GPU are arguably better). There is ongoing work for defining tree hashing modes for turning a given hash function into a system which benefits from parallelism; e.g. see this article (from the Keccak, aka SHA-3, designers). NIST has expressed their will to define some standard in that respect.

Of course, it still takes some particular scenario to benefit from such CPU gains. In most uses of hashing (or encryption or whatever), the cryptography is not the bottleneck; I/O is. When you hash files, you cannot hash them faster than you can read them from the disk.


Example of application that doesn't require "strong authentication"

Protections are in place to combat risks. If the risks are low, then the protections can be low.

Think about a forum site. There might be no reason for the site to use "strong protection", because all you really want to do is to be able to identify who is contributing. It could be determined that the site needs very weak protections in that case.

The answer to your question is in the risk analysis. Provide the appropriate protections to combat the risks you identify.

Edit post Clarification:

The business owner's perspective is based on a risk calculation. What are the risks if someone is misidentified, what are the costs if such a risk is realized, and what is the cost to put in stronger protections to reduce that risk? If the costs to reduce are greater than the cost of a realized risk, then it is not cost-effective, from a business point of view, to introduce the stronger protections.

ISO 27005 provides this risk management framework.


Can my school read my GroupMe messages since they are not end-to-end encrypted?

If the application performs encryption on the traffic (and you haven't configured your phone in a special way for this net, like adding an extra CA provided by them), your school will not know what you said.

Not to mention that even if they had the technical ability to view the traffic, it could be illegal for them to look at your messages.

On the other hand, you mention that you “confirmed that the school is not performing a MITM attack by comparing grc fingerprints”. I guess you mean that you went to https://www.grc.com/fingerprints.htm and… compared the fingerprints listed there to the ones shown by your browser?

This has a couple of issues:

First of all, a MITM that intercepted all traffic might also replace the fingerprints that page shows (they would need to be quite determined, but it'd be possible). It would be better that you compared the fingerprints shown by your browser in the suspected network, with those when you are on a believed-to-be-safe network (eg. your home). Note that by default no client would accept such MITM certificates (the system would need to be configured to trust them). And if GroupME app is properly coded, it won't accept an invalid certificate…
That they are not doing MITM on one server doesn't mean they don't on any. They might not MITM pages that are listed as safe in a their proxy solution, but OTOH intercept with their own certificate pages in a different category (eg. social) to perform additional checking.

Even if the connection was not intercepted, GroupMe itself (or anyone with proper access to where it saves the data) could technically access that (it may or may not be legal).

This is in contrast to end-to-end encryption, where only the other device can decrypt the message (and where checking the conversation fingerprint with the other recipient shows that there has been no interception).

Nonetheless, even if the message safely reached the other device, a third party could still know about it, including by being forwarded, shown to another pupil (see what Mike told me!), confiscated, or even from analysis of external factors (a teacher may not know their exact communication during an exam, but if two pupils hold the same answers, he will conclude they cheated).


What is behaviourism and heuristic control in anti-virus software and how does it work?

Heuristic are:

learning techniques
common sense
discoveries

Their objective is to recognise a virus by analysing its code (not limited to). If a program is programmed to open a certain file, or to load/read certain memory address.
These methods are based on multiple criteria. They eventually can run program in virtual environment to monitor for known virus schemes : replication, stealth etc.

Behaviourism is analysis in real time. By analysing what a program is doing (file I/O, memory I/O, network I/O, use of the PC during idle time, ...) you can assess whether it is legitimate or not. If one program begins firing packet on 100 IP addresses on each port, you can be sure it's a virus, because it is not a normal behaviour for a program.

I would conclude saying this: behaviourism deals with unknown behaviour (certainly try to profile the user behaviour to detect changes in normal activity) and it certainly uses heuristic. Heuristics objective is to detect an unknown virus, or variant, but the scheme they are looking for are well known.

Some references:

Wikipedia of course: http://en.wikipedia.org/wiki/Antivirus_software ; http://en.wikipedia.org/wiki/Heuristics
Some journalistic article : http://systemtechnologygroup.com/Behavior_Blocking.pdf
One paper on the subject: http://www.springerlink.com/content/t3r27639x9533601/ (maybe access limited)


DoD 52220.22-M (3 Pass wipe) and Virtual Machines

This answer won’t make you happy because it won’t match government check box security.

First of all, the 3 Pass Wipe derives from a decades obsolete MFM disk technology that no one uses. It makes no sense on modern disk drives. Yes I know – government rules.

The same type of issue occurs with an e-mail “spill”. No one is going to wipe the main email server drive due to an individual “spill”. Instead the affected accounts will be manually sanitized and sometimes if the spill is bad enough, a free-space wipe on the server will be performed.

Similarly to the email server, depending upon the severity of the issue:

The VM disk file can be manually cleaned and compressed
The VM disk file can be wiped
The ESXi hard drive can have free-space wiped after VM deletion/wiping.

3 Pass Wiping of a VM is just security theater, but it may check bureaucratic boxes.

None of this meets Old School remediation standards, but times change and even the government has to change.

Throw in the likely possibility that the VM virtual disks may actually reside on a virtual LUN from a RAID array of physical drives in a SAN and Old School goes right out the window.


Can password be stolen when doing SSL/TLS-protected IMAP/SMTP in public network

First, the bounced spam messages you see can happen no matter if your credentials where stolen. Sender spoofing is actually very common when sending spam. It is similar to writing a different address than yours as sender on the envelope of a snail mail - everybody can do this easily.

As for the possibility of stealing your credentials: this depends on your specific configuration. If IMAP or SMTP are configured to not enforce TLS but to use TLS only when available (i.e. optional, not mandatory) the attacker could mount a man in the middle attack (ARP spoofing, DNS spoofing etc) and claim to be a mail server which does not support TLS. If your mail client only uses TLS optionally it will continue with the connection and login without TLS, thus presenting the credentials to the attacker.

If instead both IMAP and SMTP in your client are setup for mandatory TLS with full validation of the certificate and rejection if the certificate cannot be fully trusted, then a man in the middle attack is not possible without making changes to your system, provided that the attacker did not get access to the original certificate and key of the server or managed to get a valid certificate from a trusted CA (both unlikely).


openssl - generating rsa key pair - public key

The RSA private key format includes all the public elements. When you get the private key you really have both the private and public key.

This is described in PKCS#1 (the leading RSA standard); private key format is an encoded ASN.1 structure which contains:

  RSAPrivateKey ::= SEQUENCE {
      version           Version,
      modulus           INTEGER,  -- n
      publicExponent    INTEGER,  -- e
      privateExponent   INTEGER,  -- d
      prime1            INTEGER,  -- p
      prime2            INTEGER,  -- q
      exponent1         INTEGER,  -- d mod (p-1)
      exponent2         INTEGER,  -- d mod (q-1)
      coefficient       INTEGER,  -- (inverse of q) mod p
      otherPrimeInfos   OtherPrimeInfos OPTIONAL
  }

The public key really consists in the modulus and public exponent, which are both in the private key structure, as shown above.

Now your question might be: "what if I want the public key 'alone' ?"

OpenSSL lives in and by the X.509 world. In X.509, public key don't exist as stand-alone values; and there is no standard file format for lone public keys. An application is supposed to use public keys that it found in certificates. This is quite apparent in the SSL/TLS protocol (which is the primary support goal of OpenSSL): when the client sends its public key, it sends it as a certificate. Therefore, if you want the public key in a file, arrange for it to be stored in a certificates (possibly self-signed). The OpenSSL req sub-command, with the -x509 flag, can help.

Of course, every rule has exceptions, so there is also a method to get the public key "only" from the private key; this is what @uwotm8 shows in his answer. However, the resulting public key, which will look like this:

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDzYY+BpIuKouSnoemSwHwC25uW
Xc0zX1gl8NtG5UQP2U4Lda0s5XbBJm4O2W+RkOgR1f1d5cGOXRPd6Q9ntw3MYQv6
ubsMRZUaOT4vCpykWfPi/VfsQEPlWHw2pulYAyumx/sw8tX5i9NC2e2bY4eWwo22
BELyXpNdoGozSje8PQIDAQAB
-----END PUBLIC KEY-----

is not really usable anywhere, because this is a non-standard format.

(Technically this is a SubjectPublicKeyInfo element as it appears in an X.509 certificate, but it is not supposed to appear outside of an X.509 certificate.)


The MachineKey.Protect method automatically generates a random IV during encryption. You can see this in effect by protecting the same values multiple times:

for (int n = 0; n < 10; n++)
{
    byte[] data = MachineKey.Protect(Encoding.ASCII.GetBytes("This is a test."), "testing");
    var sb = new StringBuilder();
    for (int i = 0; i < data.Length; i++)
        sb.AppendFormat("{0:x2}", data[i]);
    Console.WriteLine(sb.ToString());
}

Output:

beb18d854f133f948e090a9d563d5670f3ccf9d337449357fba831e728e105fed44785e432d3f1dbe8c50a7f867570a3ce7d198b51faf34fb3f44511c876f715
dd62fe62ca56ff6f9cf4bb6b0f715f77106aa11ef081105099800850ce38a2d7d8d986f35f8e0db3ac32d5702a7cbfb2efb421770449a90587cd4895ec70a5af
fa548a8fb928fa3039eed3b2d0bf2fc53c4899da39acaad443170726f8a2fdfacf40684542b5429445c82f66cac529f94a750c2ec52532984e752e722f6accfa
ef37f809db93f2e8e1a45a58bc5def741239be955038b87d8712dcb8bfbae853e2dd21556b836dde41c56dcce6970c699107cc9a796dbbf14cf8ff231cfe7f08
fdb4e87ee327dfe4b0d3ae3edf66a4b3dc9eab7434d8e730eaf3424034bd2b6935b0b92613b13bf703cac6951d92761e9a34ec815dd5e66e9e514baf5181edab
1203a0891da6e7bc09f6037a3419be62a07dbb1b5e3c3ab2449e7163e5b082d9a6ef4338b17132e95e04ef8df00582afca2aa0576003260766f256659b971f11
0a96d6f17169789d86c0812c810826efe356c5ec5ad4f88d1d79620c7d9a31b665244e095ef711a3f555b29ac04dc684de4971396cdb621c34c6753ad16cbebe
0a537e35e7554831c0870e762996f3b9d23ed3ae3363133341097e7a80ed3fca12c9beb1592ecb1d4d2ca4cc2178837996484ee71773e4ce5dcd911220d38e17
9e943971c1847254cba338a69973d55e857e55fb0bdaf62b18bbe4cfd39647256d31ac88a9c75823594c062b2def6c618429af60618150f640590c6ef7a0d565
18028aa0c81dd5dc03ed972d0a066803841f1cb0a43eadbb4cf001ecafbc38f3604579f84196e9c6344cb3f676f53add0d4054b1daa5eca119c46522201ae27c

If you step into the decompiled sources for System.Web.dll and System.Security.dll, you'll find that the MachineKey.Protect call loads a provider from a factory which ultimately wraps the underlying DPAPI protection methods - specifically CryptProtectData, using the hash of the purposes list as the "optional entropy" field. The DPAPI automatically applies a salt and a MAC.


How to set up a secure VirtualBox VM in Windows

The VM is only as secure as the machine it's running on.

The proper setup is a clean install from verified media, and then doing all untrusted, day-to day activity in a VM. And secure business in another, clean VM

That way you have an installed machine. For simple things, just make a linux live USB and work from that.


This is the nature of how email works, unfortunately.

There is nothing preventing you or I from sending an email from any address we choose, this is by design. What we can tell though is the IP address the email originated from in the mail headers, and this will give us an idea of where the original message came from.

In the old internet, most mail servers were run as open relays. This means that to send an email from yahoo.com to google.com, you could use any open relay you found on the internet. If the IP got banned, its okay because it isn't your IP, and you could just change relays.

Now, with most modern mail servers, this isn't really an option. SMTP servers will only relay a message if you are authenticated, preventing random internet users from abusing your services. The server would accept unauthenticated mail only for users on that particular mail server.

Due to this change, spammers now need to completely compromise mail servers in order to abuse them.

If an attacker compromises your server, there isn't much you can do to stop them from sending emails short of blocking outbound port 25 on the firewall. If you need to run a legitimate mail server, then this becomes a problem as you would be denying legit email from being sent.

Also, I would check your IP against any blacklists. It may have ended up on some lists and you would then need to submit a delist request, including how you resolved the issue.


Result disparity between nmap and curl/nc for TRACE method

The http-methods script just issues an options requests and if this returns Allow methods than it trusts this information. Just try an OPTIONS request and you will get the following response:

> OPTIONS / HTTP/1.0

< HTTP/1.1 500 Internal Server Error
< Allow: GET, HEAD, POST, TRACE, OPTIONS
...

Thus the OPTIONS request itself reports that TRACE is supported. And actually the method is supported by the server:

> TRACE / HTTP/1.0

< HTTP/1.1 405 Method Not Allowed
< ...

This means that the server supports this method but actively refuses using it, at least with specific URLs. Not supported methods would result in a different kind of response:

> FOO / HTTP/1.0

< HTTP/1.0 501 Not Implemented
< ...

  ... it seems that TRACE is enabled

nmap does not check if enabled or not, it checks if it supported (i.e. implemented and allowed according to OPTIONS) or not. Actively denying use of the method on specific resources does not mean that the option is not supported, i.e. implemented in the server and maybe available for specific resources.


I left time to see if any other answer to this. Finally, it seems I'm not wrong on my comment. I found on BeEF docs this: https://github.com/beefproject/beef/wiki/Autorun-Rule-Engine#matching

So you can set rules for browser A or operating system B, but not possible to set rules for surfing on website A and others for website B. So the answer is no, you can't as I said time ago in the comments. You need two BeEF to do that.


Linux antivirus and files bigger than 4GB

I have never tried myself, but checking in clamd.conf file I can see that the size of files can be set manually.

Changing the following values to "n" appears to be the workaround for the file size limit which sets it to unlimited:

-max-filesize=#n
-max-scansize=#n
BytecodeUnsigned yes

http://blog.clamav.net/2014/11/brief-re-introduction-to-clamav.html

However, I know that currently ClamAV has hard file limit to 4GB. However, from my understanding by setting to "n" along with BytecodeUnsigned to "yes" in config file will do the workaround and of course there are a few particulars to consider before doing that, particulars such as:

  the amount of memory present/available on server should be way bigger than the file size because ClamAV is mapping the file into memory.
  The swap file system, the size of swap fs should be calculated according to the ram size on server (just in case it hits the swap).

If the above to particular are not taken care of it with an extra attention ClamAV won't be able to scan or better, it will eat all of systems memory and therefore killed by OEM Killer.


On most modern distributions, the salts and the hashed passwords are stored in the shadow file /etc/shadow (which is only readable by root), not the /etc/passwd file.  For each user record in /etc/shadow, the salt is between the 2nd $ and the third $.  See answer by mti2935 in https://stackoverflow.com/questions/18035093/given-a-linux-username-and-a-password-how-can-i-test-if-it-is-a-valid-account for more info.


Could a phishing page generate a genuine session with the targeted service?

Yes it is possible for a phishing site to act as a proxy between the user and the expected website and thereby record/inject data. It would require something more sophisticated than just SSLstrip sitting on the phishing site though.

The URL in the browser would reference the phishing site throughout the session.


There's no way to tell from the logfile alone.  The "200 OK" response just means your webserver is running and has an index page at "/" -- something true of almost every webserver in the world.

If x='() { :;}; echo VULNERABLE' bash -c : doesn't print the word VULNERABLE, you almost certainly aren't vulnerable.


How much information can be obtained from observing someone type their password?

After a few days or weeks, you will find that your type your password much faster than just about any other sequence of letters, simply out of repeated usage. Whether the password "makes sense" in some language or not will not matter for that.

Apart from delays between keystrokes, which can be due to many factors such as the "unnaturalness" of the character sequence but also the involved movements and hand flexibility, each key is likely to emit a slightly distinctive sound. It can be done easily with a human ear for the space bar, but with some recording and computer-aided analysis you can get a lot more information. Recording is easy because any smartphone can do it (and waving around your smartphone no longer constitutes suspicious behaviour, so an attacker can get away with a lot of sneaky recording).

There is some heavy research on that subject. Some googling reveals this article, and also this PhD thesis, and this blog post, and even a previous question on security.SE.

Executive summary: audio analysis of keystrokes works. However, there does not seem to be ready-to-download software for that (for now !), although the various researchers who work on the subject do have code.


I read that this should be avoided because of CRIME/BREACH attack, is this correct?

It depends.

The CRIME attack is already mitigated in current browsers in that they don't use TLS compression and have special handling of contexts in HTTP/2.0. BREACH is only relevant in the context of HTTP level compression if the following two conditions both apply at the same time (to cite http://www.breachattack.com/):

Reflect user-input in HTTP response bodies
Reflect a secret (such as a CSRF token) in HTTP response bodies

If none or only one of these apply you can use gzip without being affected by BREACH. This means you are safe to use it for any static pages or for any pages which don't include secrets like CSRF tokens (that's the secrets the attacker wants to extract).

Also the attacker needs multiple requests to the same site and must be able to look how the size of the transferred data changes. So if your secrets change all the time or if the site changes (like with adding random padding with a random size) the attacker will not be able to use BREACH. See also Defending against the BREACH Attack.


There are many attacks that can be launched from Layer 2 that would provide credentials to a user that hasn't authenticated to the corporate domain ...yet.

For example, Responder is capable of spoofing LLMNR and NBNS requests even without being connected to the domain -based on the way NBNS (and subsequently LLMNR) were designed. They are enabled by default in most environments and IT needs to explicitly disable them (which is usually not the case). In that case, without MAC filtering a rogue device may be connected to the network via the meeting room jack and obtain network level access, from their there they could perform a variety of spoofing attacks. ARP poisoning is a related attack that could also be performed.

Additionally, abuse of the corporate Internet may also occur if just any device is able to connect to the network and receive Internet access.


CSRF Guard: Injects token in POST Request?

Generally, you would indeed creating a hidden field in your forms for the CSRF token when you're POSTing.
From the documentation, it should look something like this:
<input type="hidden" name="<csrf:token-name/>" value="<csrf:token-value/>"/>
Additionally, in order to work for post requests, the inject-into-forms property must be true, like you see in the example:

<init-param>
    <param-name>inject-into-forms</param-name>
    <param-value>true</param-value>
</init-param>

In fact, disabling this parameter is particularly discouraged, because of the sensitivity of many POST requests.


How can I find out who is behind a Mac address?

Technically there is no way to couple a MAC address to a person. MAC addresses are easily spoofed. In case the attackers were careless and didn't spoof their MAC address, you can at best try to identify the device vendor (http://www.macvendorlookup.com/).

If your tablet or phone are compromised it's best to install them from scratch (from a computer you know is not compromised). Also take care not to jailbreak/root your phones as this often leaves them more vulnerable as usual.


How do certificates work in terms of encryption, hashing, and signing?

Your writeup checks out. One nit:

As dave_thompson_085 mentions, encrypting and signing are not the same operations. Although they may be implemented in the same manner in textbook RSA, does not mean they are the same. Indeed, X.509 supports ECDSA, where signatures are implemented entirely different.


How to provide security for passwords stored in Database?

You can start of by using a stronger hashing mechanism like SHA-2 instead of MD5. Also you can make your hashed passwords' database more secure by using salted password hashing. I did a presentation in my class once about password hashing and I found this link and this one too to be very informative (apart from the Wikipedia). Hope this helps you too.


A Socks 5 compatible proxy support DNS look-ups,  and squid supports the sock 5 protocol.  On a side note,  TOR can make use of Sock 5 for their own DNS .onion domains.  This is probably a false positive on behalf of snort,  I don't see how this is a security issue.


How can I focus on the positive side of information security to create awareness?

What you're looking for is a change in culture, rather than positivity as a goal. You'd want to re-state your objective, which is "Achieving a better cybersecurity culture". I'd highly recommend looking at SANS Securing the Human program. The resources available are effective, and they look at the psychological aspect as well.

Suggested starting point:
https://securingthehuman.sans.org/media/resources/presentations/STH-Presentation-MakingAwarenessStickv2.pdf

Have a look at the Fogg Behavioral Model, and the various models you can use (Kotter's Vision model, the Heath - Commander's Intent, etc.). It's not just about positivity, it's about impact and transformation. Positivity plays a role, but don't focus only on that, otherwise it's hard to be successful in 3 months.

Good luck with your internship!


fwsnort - How safe compared with Snort/Suricata?

Based on the description of fwsnort it is a packet level IDS using the iptables string matching feature. This means that it can not apply any rules which span multiple packets. This includes any serious application level analysis like looking into SMTP (mail) and HTTP (web) traffic.

Thus if you care mostly about attacks at the lower layers it might be enough, but it will not be able to detect attacks at the application layer except the most trivial.


Isn't a HIDS, NIDS and WAF complementary?

You are correct to think that these three technologies are complementary and will often detect the same issues.  However, that in itself is no reason not to use them in layers.  One may catch things the other may not.  Look at virus scanners - here's an example where only 14% of the 37 scanners attempted found the virus!  And that's with the same exact type of protection!

The products you've listed have more variation than comparing virus scanners, and in fact have significant architectural differences.  A HIDS will often see things that sailed right past the NIDS because of SSL encryption.  A WAF will often have specific signatures for a web application that the NIDS and HIDS won't have. The NIDS will detect network layer attacks that the WAF and HIDS would never notice.

In short, complementary does not mean equal.


Workaround for no www.subdomain.domain coverage on wildcard cert

Just specify Subject Alternative Name (SAN) as www.hungry.example.org in your main wildcard certificate.


Difference between OpenPGP symmetric encryption and AES-256?

OpenPGP is a standard defining a message format. That message format is fairly complex, but in short, it contains:

Which algorithm it's using, if any
Any required parameters for that algorithm (e.g. nonces)
The (encrypted) message body
Some other metadata which isn't relevant here

OpenPGP is, notably, not an encryption algorithm. It can use encryption (and that's its whole raison d'être, so it normally does) but the algorithm it uses is variable.

AES-256, on the other hand, is a specific algorithm. It takes as input a secret key and a message, and it encrypts that key with that message.

AES-256 is one of the many encryption algorithms that the OpenPGP standard supports.

Encrypting something with AES-256 and the same key with OpenPGP is going to lead to the same ciphertext (encrypted text) as using any other software. However, there are two things to note:

Bad implementations of AES do exist, and can be exploited, depending on context. Bad usages also exist; for example, the AES mode can be any number of things -- ECB, CBC, GCM -- and picking the wrong one could break your security.
Because they're in different formats, the files produced by telling 7zip to encrypt a zipfile versus telling OpenPGP to encrypt a message will likely be different. However, this has nothing to do with their implementation of AES-256; as long as it's not broken, it'll still produce the same ciphertext. It's just represented differently.


The difference is mostly a matter of historical tradition.

Biologically, a virus is a piece of RNA. RNA is an intermediary vessel for genetic code, which temporarily duplicates a piece of the DNA (the permanent storage of genetic information in a cell). RNA then goes through some "engines" which can duplicate it and/or convert it into proteins (genetic code is really blueprints for proteins). Proteins are the active molecules which do all the work to keep a cell "alive". The virus is sufficiently small to enter some cells, where it hijacks the replicator engine, which makes other copies of the virus, by which the attack spreads. The adverse effect of the virus comes from the fact that while the replicator is busy with photocopying the virus, it does not process the "normal" RNA which comes from the cell's own genetic code. Protein production is thus slowed down or stopped altogether, and the cell ceases to function properly (or at all). Effects on the host body depend on what kind of cells are affected, and how much it hijacks the replicators. So the virus is not a living organism by itself (the question of whether a virus can be considered to be "alive" is hotly debated, and not very meaningful in the same time).

On the other hand, a worm is a fully-defined pluricellular organism, which does not interact in any way with the host genetic code and mechanism; the worm just sits there and feeds on local cells. The worm is quite definitely alive and distinct from the host, which, from the worm point of view, is mostly home and feeding ground. The worm also replicates itself, but since this is a living organism, such replication is called "reproduction".

In computers, some software pieces are called "virus" and "worm" as an analogy which, like all analogies, breaks down when you looked at it too closely. The "replicator engine" alluded to above, is considered as somehow equivalent to normal program execution. Under normal operational conditions, computers execute programs by reading executable files into memory, and ordering the CPU to consider that data as a sequence of instructions which are to be interpreted right away. A computer virus is a piece of code which hijacks normal execution by inserting its own code somewhere in that sequence of instructions. The analogy stops there, because while a biological virus just uses an RNA replication mechanism which is already in place and totally genuine, the computer virus must do its own replication, i.e. looking for other executable files to copy its own code in them. A virus may be harmful through this replication mechanism, depending on whether its forceful insertion in executable files damages them or not (a careful virus will move around the original instructions so that they still get executed; a careless virus replaces the original instructions, thus affecting the executable primary functionality). A virus may also be harmful by doing other tasks than mere replication (that's the "payload" and it can be quite nasty).

A computer worm is a piece of software which, when executed, tries to replicate itself through the network. The worm uses a few known security holes to force remote machines to execute some arbitrary code, and in the case of a worm, that arbitrary code is the worm code itself. So we have the traditional distinction: a virus replicates itself by modifying executable files (found, by essence, "locally") while a worm replicates itself through network-exploitable security holes. However, a worm which runs on a given machine will often, beyond its replication-through-network job, take steps to become "permanent", so that it will run again regularly, even if the host machine is rebooted. Permanency is achieved by inserting the worm code into some executable files; so, most worms are also virus.

This leads us to a second definition: a worm is a virus which can also replicate itself through a network, using remotely exploitable security holes, whereas a plain virus is limited to executable files.

Virus and worms where thus named because when such things began to be common place (around 1985-1990, when home computers became widespread and used floppy disks, and Internet exceeded a few hundred hosts), program execution on a basic computer was not happening "by itself": the user had to type something or click on something to launch a new executable. So the spread of a virus could be paused by getting your hands off the keyboard, whereas a worm had the seemingly magical property of happening by itself. Nowadays, the most basic PC will spawn hundreds of new processes transparently, many of them on an automatic and regular basis, so a virus will also replicate in a seemingly autonomous way, blurring the operational distinction between virus and worm.

The Trojan Horse is a big hollow wooden horse filled with ill-intentioned Greek warriors, and happens not to be Trojan at all -- it was Achaean, built against the Trojans. The cornerstone of the story (as reported in the Odyssey) is that the Trojans pulled the horse within the walls of Troy themselves, a military feat which the Achaeans had unsuccessfully tried to achieve for the ten preceding years. In computers, the expression "Trojan Horse" was applied to the case of a malicious executable which a target user launches himself consciously, lured by some advertised seemingly benign functionality of the executable. Trojans believed that the horse was an offering to the gods of the sea, hence imbued with religious and esthetic goodies.

So, what of a piece of software which, when executed, finds local executable files to copy itself, and also sends itself by email to random other people under a cunning guise ("this is your tax form, fill it ASAP or you will get fined"; or "have a peek at this screensaver full of photos of Natalie Portman"), to lure them into clicking on the attached executable file, thereby executing its contents ?

This is a virus, since it copies itself into local executable files. This is a worm, since it replicates itself through the network (the remotely exploitable hole being the combination of the user, who has little awareness of security issues, and his mail reader application, which happily runs executable files with only the flimsiest of guardrails). This is a Trojan Horse since it exploits user gullibility and lures him into launching malicious code.

Hence, the distinction between virus, worm and Trojan Horse is not absolute and has become quite fuzzy in recent years. The terminology does not offer practical information anymore.


Constructing file path from database table leading to vulnerability CWE 73: Directory Traversal

If the database is considered a tainted source (which makes sense e.g. if you want to defend against changes in the database performed by SQL injection), you need to follow the standard procedure to sanitize the contents. So you should verify that the machine name contains only allowed characters (and if the dot is allowed: that it does not contain consecutive dots), that the directory path does not contain '/../', start with '../' or ends with '/..' (maybe also stricter validation) and that the file name at least does not contain any slashes.

You likely should read about path traversal attacks and recommended validation and sanitization policies for file and path names instead of blindly following my suggestion, as they are just what occurred to me as minimum requirements.


No, C will not be able to know that A is the original source of traffic.  All packets will have B as their source IP address, and even the TTL of B.  (Because only the contents of packets are copied, not their metadata.)

Of course, if you control B, you can detect the port forwarding, and block or tag it as you want, but you probably shouldn't allow untrusted users to do port forwarding on B, or shouldn't be treating B as a trusted host.


What is the best way to manage gpg keys across multiple devices?

The obvious answer is to use gpg -a --export-secret-key and gpg --import to share the one key you have across the devices. (Some people suggest copying the ~/.gnupg/secring.gpg file, or, even worse, the entire ~/.gnupg/ directory. Do not do that; I've come across subtle bugs that make the binary format not portable across implementations, although if you stick to only recent GnuPG, you are almost certainly fine; differences in gpg.conf might bite you though, so it's still better to export/import the keys all the time.) – This is the scheme I normally use (I do not own an Android device).

If you have systems with varying security levels – for example, Cyanogen has this phone-home backdoor – you may want to use a subkey scheme instead: you create a sign-only key first, then create two or more subkeys (one sign-only subkey with which you can sign messages and (if necessary: do not normally do that, use your master key for it) other keys, and one encrypt-only subkey with which you can decrypt eMails others encrypt to this subkey). Then, you only export those subkeys you need on the less-trusted device to it. The Debian Wiki has got very detailed instructions on how to do this; the gist is, you first export the entire key into a backup, then delete locally the “master” subkey, then export again (this time missing the master, keeping only the subkeys you actually want to export), then import the backup file created in the first step. Import only the second export on the device.

Do not create multiple keys. People will be confused over which one to use.

I'm willing to add more specifics; this is a somewhat generic answer; more detail depends on your use cases (e.g. do you want to read encrypted mail on all devices or just one, or do you want to read only some encrypted mail on all devices but have other encrypted mail your Android device cannot access; and what about signing).


Is the same decryption key used for data on the server as locally with Lastpass?

Yes, the same decryption key is used for data on the server as local data. Although if you are using a Yubikey, so you can set your local password database to be encrypted with the public identifier too.

Does it give a database to anyone who asks?

Not anyone. LastPass will comply with the law, so if a relevant law enforcement agency requests the data with the correct authorisation then LastPass will supply them with the encrypted data.

If no, then what authentication (i.e. password) is used?

Your password is never sent to LastPass themselves. According to Security Now podcast:

when you log in, when you give your system your LastPass username and password, the first thing it does is it runs it through this SHA - it lowercases the email address, removes the whitespace, adds the password, and then it does this hash to it, turning it into a 256-bit blob

(Mandatory Attrition link)
This is the symmetric key used to encrypt your password database before it is sent to LastPass, and to decrypt the password database when retrieved the from LastPass servers.
So the key used never leaves your system.
Regarding authentication:

they take that key, the cryptographic key, and they add your password to it, that is, they concatenate your password to your cryptographic key, and they hash that. So they do another one-way function on your crypto key with your password, which they don't know because they never get it. But they get another blob
So this second blob, this second output from the hash, that's your unique ID. That is, the only way to get that is if you take your username and password, hash it, then add the password to that and hash it again. So it absolutely depends upon both of those pieces of information. So then your username and that goes to LastPass to identify you. And because that contains your password twice hashed into it, nobody who doesn't have your password, even if they have your email address, is able to produce that blob. So you have to have your email address and your password run through this hash twice to get that blob.
But notice that your cryptographic key, which is sort of the first byproduct of that because that's the output from the first hash, that goes into the second hash but is lost in the hashing process, thanks to it being mixed with your password. So the LastPass people never get your crypto key. They get a different unique token that identifies you to them so that you're able to log on securely to their facility. And these guys are so paranoid that they don't even save that on their servers. They don't even save that special logon blob, the output from that second hashing process.
Instead they, at the time you create your account, they come up with, they use a random number generator at their headquarters to create a unique 256-bit token which they save with your account. And whenever you're logging in, they take this 256 blob you're sending them that's the result of these two hashing processes. They add that to this unique 256k random number, and they hash that. And that's what they compare to what's stored with your account. Which is to say they never store that logon token. They store the result of hashing that logon token with a unique 256-bit value that they created for you. So they dynamically see if it's the same, but they never save your logon token. They just - they don't want it. They don't need it. So they're able to perform a dynamic check whenever you need to authenticate, but they don't keep it statically.

So to summarise the podcast your encryption key is:
DK = sha256("foo@example.com" + password)

(Note that LastPass state they use PBKDF2 over SHA-256).
Your effective authentication passkey is:
key = sha256(DK + password)

And they store this on their system only in salted hashed form with a 256 bit salt (the "random number").
stored_value = sha256(key + salt)

(assuming it is sha256 once again. This answer states this is PBKDF2 over HMAC-SHA256 with 100,000 rounds.)

they know how to decrypt it e.g. a court order could compel them to do so?

As they don't have the DK they can't decrypt your data. However, bear in mind that many countries have a key disclosure law which could compel you to hand over your LastPass password.


What are the risks of having a port forward through a NAT gateway to an unused IP?

I don't see any risks while the VPN server is running, if as you say, you can be sure that there's nothing at the other end of that port-forward.

I'm not sure I understand your wake-on-LAN setup with dropbear - but it appears that your server might have an exposed SSH for long periods of time - which could have other risks - such as variants of the BothanSpy / Gryfalcon.


Brute forcing consists of repeatedly generating some new input and then checking if the guess was correct or not. Difficulty of brute forcing thus depends on the average number of guesses needed (i.e. how many different input are there) and how fast it is to verify the correctness of a guess.

Nothing in your question provides these two information and thus your question cannot be answered for your specific example.

But in general the amount of time needed is half the search space (i.e. number of inputs) multiplied with the time needed to create the guess and then check if the guess is correct. For example with a string of 8 characters (A-Z, i.e. 26 characters) the number of possible inputs is 268 and half of these (268/2) are needed to guess correctly on average. If 10,000 guesses per second are possible brute forcing would thus take about 120 days on average to guess the correct input.


Does stack (UNIX x86, x86-64, ARM) grow up or down, buffer overflow tutorials wrong explained?

The direction of stack growth is hardware dependent.  On x86 architectures, it grows downward, but it may be different on other architectures.


What happens to data in the Secure Element when a device is Jailbroken?

Are you asking about iDevices running Apple iOS? The Secure Enclave is not cleared/erased or inaccessible when a device is jailbroken.

The architecture of the Secure Enclave and its security implications is documented here -- http://mista.nu/research/sep-paper.pdf -- and many assume it has been broken into, but nobody is saying for sure. Here is the full prezo from BlackHat US 2016 -- https://www.blackhat.com/docs/us-16/materials/us-16-Mandt-Demystifying-The-Secure-Enclave-Processor.pdf

There are other components, such as the Kernel Patch Protector (Apple's use of TrustZone), which was thought to reside in the Secure Enclave but it actually on the ARM Elx -- http://technologeeks.com/files/TZ.pdf

Here is an early article on the Secure Enclave as we first saw it in the iPhone 5S -- https://blog.fortinet.com/2013/09/16/iphone5s-inside-the-secure-enclave

What we know today is that the apps that connect to the Secure Enclave can be bypassed in many ways, but not in one key way: the TouchID mechanism to access the device through the lock screen -- but only the lock screen. If TouchID is used via an app, then it likely can be bypassed whether the device is jailbroken or not.

Some of the Apple TouchID and Apple Pay security architecture was first discussed here -- http://www.slideshare.net/0xroot/demystifying-apple-pie-touchid

What we know is that the GlobalPlatform AIDs (application identifiers) can be cloned from one device to another by attaching to the passd process (this can also be done on a jailed or jailbroken device), as discussed here -- https://www.blackhat.com/docs/us-15/materials/us-15-Fillmore-Crash-Pay-How-To-Own-And-Clone-Contactless-Payment-Devices.pdf -- https://www.blackhat.com/docs/us-15/materials/us-15-Fillmore-Crash-Pay-How-To-Own-And-Clone-Contactless-Payment-Devices-wp.pdf -- https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20Peter%20Fillmore%20-%20Crash%20and%20Pay_%20Owning%20and%20Cloning%20NFC%20Payment%20cards.pdf

We also know that the keychain can be dumped in numerous ways for both jailed and jailbroken devices as seen here -- https://github.com/juuso/keychaindump -- and here -- https://github.com/n0fate/chainbreaker -- but also iCloud and other authorization tokens -- https://github.com/manwhoami/MMeTokenDecrypt

Most-everything can be extracted regardless of the Secure Enclave and regardless of the device being jailed or jailbroken.


This code is a standard form, there is not much secure or insecure about it.

Some enterprise policies will require it to include a flag to stop browsers from auto completing, but if you do not need that it is better to leave it off.

There seems to be no anti-CSRF token in this form, this seems to be a problem. Other than that make sure it is hosted on https and the server side handling the input is secure.

You might also want to add some headers against frame inclusion and set a content security policy to turn off or limit scripting.


Client sent me an OpenPGP key; I need to generate key for SSH authentication on FTP server

You (or your customers) seem to be confusing a whole bunch of different concepts. First of all, SSH keys cannot be used for FTP authentication -- this is simply not specified, the protocol does not allow to do so. There is SFTP which has FTP in its name, but actually transfers files over SSH.

Then again, OpenPGP keys cannot be immediately used for SSH. While both use the same mathematical principles, the formats (and some details regarding the cryptographic "mode of operation") are different. It is possible to convert OpenPGP keys to SSH keys, but it does not seem reasonable to generate OpenPGP keys to just convert them. It is possible to configure GnuPG's gpg-agent to be used by the SSH client for authenticating with OpenPGP keys, but then again it requires even more (rather uncommon) software on the server side. While it is possible and there is quite a number of people doing exactly this (including me), I'd not expect this to be seen in a general business environment where you have no control over the customer's computers.

A common use case would be using SFTP/SCP (both based on SSH) to transfer the files and protect SSH authentication through SSH keys instead of OpenPGP keys. OpenPGP keys might be used to additionally encrypt the files, but then you'd have to share your public key (so you can decrypt using your private key).


TL;DR: Yes, it possibly could be decrypted.
NOTE: I originally did not realize your question has a subtle nuance to it. You mention safe primes and then non-primes. But safe primes is a mathematical term. Not every prime is a safe prime! Safe prime is a prime 2p + 1 such that p is also prime. It is not only important that modulus in DH is prime but it should be a safe prime for best security.
Why you should not use non-primes
Whether non-primes can be safe depends on what you mean by sufficient length. It may not be possible to reasonably break them, if the numbers are much bigger then usual, but it would very much depend on the exact numbers.
One of the reasons we use safe primes as modulus (p) is to make sure we generate many possible secrets from the range <0, p). When p is not prime, this may not be the case. The fewer secrets we generate, the easier to brute-force them.
For example lets say we use g=5, p=25. Then the generated secret s will always be either 0 or 5. Obviously this is much easier to brute-force than all the numbers from 0 to 24. Safe primes (not normal primes) generate large prime subgroups, meaning the secret can have many values, even if not all the possible ones.
Another even bigger problem is that, if you use a non-prime you would only have to solve the discrete logarithm problem for the factors of p, which is much easier. You can read more on CryptoSE.
Now as you can see, it is still possible to think of numbers large enough that it would be secure enough. For example if we choose two different primes both large enough to be secure on their own and then multiply them and use the result as p, then this should be secure. But you can't really be sure for arbitrary values as there may be many small factors or the same factors and using unnecessarily large numbers would cost you in performance.
There also may be other problems I am unaware of.
Thanks to AleksanderRas for the link to CryptoSE.
Why you should use safe primes
The reason to use safe primes is related to the first reason to use primes. Even a prime number may have a small prime group. This means it does not generate many secrets from the range <0,p). Safe primes are better at having large prime groups and therefore generating more secrets making brute-forcing harder. You can read a bit more at CryptoSE.


Windows server 2016 Remote Desktop username leaked

You are assuming they extracted the names from the server. If they did it would not make sense to try any other names as well.

It is more likely the list of names was obtained via a different method, for example a leaked list of email addresses.


How to look up permutation tables in DES?

DES is specified in FIPS 46-3, which is a rather old standard that uses a somewhat uncommon numbering of bits within bytes. Namely, they start at 1, and count bits from left to right.

So, in the following sequence of bytes:

00 00 00 80 00 00 00 02

First byte is bits 1 to 8, second byte is bits 9 to 16, third byte is bits 17 to 24, fourth byte (the one with value 80) is bits 25 to 32, and so on. If you consider that 80 is written in binary 10000000, and that these bits are thus numbered from 25 to 32 left-to-right, then bit 25 has value 1. Similarly, the last byte (02) contains bits 57 to 64; bit 63 has value 1.

The "solution" in the document you link to contains the sentence:

  Given the hex input, when we expand it to binary, we find that only bit 64 and bit 25 are 1s and the other bits are 0s.

which is wrong, and probably a typographic error. It should read "only bit 63 and bit 25 are 1s".

The "initial permutation" is specified on page 10 of FIPS 46-3; it lists the bits of the output of the permutation, and says where they come from (this is a "comes from" table, not a "goes to" table). The input bit 25 goes to output bit 37 (the value "25" is the 37th in the table), while input bit 63 goes to output bit 57. This should yield:

00 00 00 00 08 00 00 80

which is not at all what the document lists as "solution". Indeed, the solution talks about the "final permutation" (while the question was about the "initial permutation"). If we suppose that the question also has a typographic error (the author wrote "initial" but thought "final") then we can try the final permutation, whose table is also on page 10 of FIPS 46-3. In that table, bit 25 of the input goes to bit 64 of the output (the number "25" appears as 64th, i.e. last, element of the table of IP-1), while bit 63 of the input goes to bit 15 of the output (the number "63" appears as 15th element in the table). In that case, this would yield this output:

00 02 00 00 00 00 00 01

which is what the "solution" gives as correct answer.

Summary: the document contains two errors:

In the question, it says "initial permutation" but it should be "final permutation".
In the solution, it says "bit 64 and 25" but it should be "bit 63 and 25".

With these two fixes, the question and the solution now match each other.

I have not looked at the other questions/solutions, but two such errors in the first question shed a poor light on the document quality.


Will ISP see my router MAC address? connection by 4g USB modem

No. ISP cant see MAC address of your router. MAC is a layer 2 address which exist within the network only.

And yes, your ISP will see only the IMEI.


RHEL 6: PHP 5.3.3 - Is it inherently insecure?

Please take below-mentioned as my personal opinion.

I think is is less secure. But it depends on what you consider a security problem and what not.

real life example

my company reported a few security issues to PHP. They have fixed it in latest release of 5.5.x ..

I'm not even going to get into they have forgotten to fix it on 5.4.x tree and haven't released an updated version for 5.4.x even after my emails.

The bug report for one of them is here: https://bugs.php.net/bug.php?id=67538

Red Hat bugzilla for it is here: https://bugzilla.redhat.com/show_bug.cgi?id=1120266

Red Hat does not really consider this a security problem even if it affects quite a few shared hosting environments - as they say open_basedir, disable_functions and similar "protections" (that can be bypassed using above-mentioned bug(s)) are not real protections and should not be taken so.

Having said that - it's only up to you to decide whether it even make sense to somehow assume PHP provides some security features.

In my opinion your environment should be configured in a way that even if someone compromises a site and gains access to PHP they won't be able to do much more than just messing with that one site and nothing else.

One more answer I gave on stackoverflow might become handy in considerations.

edit: none of the issues we've reported to PHP weeks ago have been fixed in RHEL so far - that's what I based my opinion on.


"Tor Profile" folder in Brave Browser cache

Brave developer here.  We do not try to conceal whether you have used Tor or not -- that would be a little difficult.  We do, however, avoid storing your private browsing history.  If you find evidence of your private browsing history stored there, please let us know or file a bug.

You appear to be using a slightly older version of Brave (1.0.0) from before we changed how private windows with Tor work, which fixed a number of bugs (including at least one possible leak to disk).  If you update Brave, the corresponding directory will be at .../Default/session_profiles/Tor Profile instead of .../Tor Profile.  There shouldn't be any private browsing history there -- but if you find any, we'd like to hear about it!


Can website detect if I’m using chrome remote desktop?

No.

The chrome browser http request and the Chrome RDP session are two separate things.

The browser might send the browser user agent in the header but not the way you are connected to your device.


As a non-security professional how should I respond when told my site is insecure?

Stay calm, and be nice to the person reporting this. If they are contacting you, they only want to help, so do not threaten them.

Also don't ignore them, make sure they understand that you are interested in fixing this. Explain to them that you need time to do this; ideally you can give them a time frame in which you think that you can have this fixed (right now, it does not seem that you can estimate this, but keep this in mind for future incidents).

If you do not fully understand what they are telling you, you can ask for clarification and a proof of concept (although make sure to formulate it in a way that does not sound demanding. Depending on the country they are in, this might cause them legal trouble).

If you do not have developers who can fix this, either hire someone external or have your developers read up on common security issues and how to fix them (especially SQL injection) for the language (and/or platform, software, libraries, etc) that you use.


What Same Origin Policy related risks are there with static pages?

XSS generally impacts integrity and confidentiality (an attacker can read and modify data they shouldn't).

If you only have static pages with no authentication and/or user-specific content, then confidentiality may not be as important (an attacker may eg still be able to log which specific pages a victim user views, which depending on the nature of the site may not be desired).

Possibly of higher interest is that the integrity of the site is in danger. An attacker can show what they like to a user, eg a login page, or as you note, they can replace all links. A very simple example would be:

var w = window.open("http://example.com/a.html",'_blank');
w.onload = function() {
    var links = w.document.getElementsByTagName("a");

    for (var i = 0; i < links.length; i++) {
        links[i].href = "http://evil.com"
    }
}

Additionally, you may run into problems if another origin trusts the vulnerable origin (eg https://blog.example.com is vulnerable to XSS, and https://admin.example.com has a CORS policy trusting all *.example.com domains).