How do personal/private cloud products work?

The data is stored locally on your drive and not transferred to them.

I believe they use OpenVPN in some way (that is transparent to the user), so that when you link it to their online service, it connects back to your local drive.

So they do not store your data, but they do hold the keys to your drive.  If you were concerned about this, you could disconnect the NAS drive from their online service, and use your own VPN if you need to access the data remotely.


cant a CSRF token be stolen using iframe?

would an attack like this be possible

This would not be possible. The Same Origin Policy prevents cross-origin reading. This applies also to an iframe from a different domain which is embedded in the current page.


How can these spam emails be accessing email accounts on respected domains?

Rogers is a very large Canadian ISP, and their every cable client gets a @rogers.com address, so finding one that has a weak password would be trivial.


Can Windows malware harm a Linux computer when it's executed with Wine?

You are right about accessing the file system and internet, especially because the home folder is mapped with write permission by default. This implies that it can mess with your documents as well, for example adding macros to Open Office documents, deleting your mp3 files or sending interesting files to someone on the internet.

And yes, it can write to your Firefox profile and install an Addon.

Connecting to the internet means, that it can fetch commands from a C&C server to turn your computer into a drone.

I guess some maleware will fail to find those locations outside the standard windows folders. But other will just scan all drives for interesting places.


How to effectively save database password inside desktop application?

Any secret key that you embed in a program can be recovered by a person who has full access to that program, the best you can do is make it time consuming to do so.

  But let's say you could make the secret totally unrecoverable by analysing the binary.

The user could perform dynamic analysis by running the program while monitoring it's memory and wait for the key to be constructed.

  OK let's say you have managed to use a key without ever building it completely in memory somehow.

The key still has to be used for something, and the user could examine that mechanism and use the anti-forensic key in the same way.

  Let's say the mechanism for constructing and using the key is totally obfuscated beyond recovery.

The key still has to depart your program in order to be useful outside it. I could just masquerade as a database waiting for my secret key to be passed to me, I wouldn't have to analyse your program at all. Any form of encryption you use would have to be readable by my database software, which I am also in complete control of regarding keypairs and such.

  But I have written my own database format which is loaded into the same program as the key which you can't read.

So your program is completely locked down and everything happens inside. Except it doesn't - you will load dynamic libraries which I could edit thereby changing the behavior of your program.

Ultimately there is nothing that runs on my machine that I do not have final control over. This is not something you can avoid.


Is signature an universal biometric trait?

This is absolutely not my area, but I think the answer is no.

It isn't universal because not everyone can write (illiteracy, blindness, missing limbs, spring to mind) - see https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/118600/applicants-unable-to-write.pdf .

I would assume that if there exist provisions for delivering a passport without the need for a signature (thumbprints are one option, but assume that the person has a thumb - the absence of one might be part of the reason the same person cannot write), then it isn't universal.

I also suspect that inability to write might in fact be common enough it can't be considered an edge case - the worldwide literacy rate is apparently around 86% (https://en.wikipedia.org/wiki/List_of_countries_by_literacy_rate).


Why does Facebook serve several SSL certificates?

Option 3 is that they don't want to put all of their CA eggs in the same basket. I know that various Apple.com certificates - all apparently legitimate - are issued by different CAs, so it could just be that these companies do not want to depend on a single supplier.

Why not? Well imagine that one CA is compromised, or goes out of business, or fails some audit such that one or more browser vendors decide to stop trusting its certificates. If they're your only provider of SSL certificates, that's a problem: you can't offer a good SSL experience until you find a new provider, establish a relationship with them, get new certificates issued, revoke the old ones and deploy the new ones. If you've got multiple CAs you just deploy one of your other existing certs into the places where the bad certificate is currently being used, revoke the bad cert, and you're good to go.

BTW, your description of Option 2 expresses one of the key problems with SSL: almost every warning you ever see is a false positive, so even when people are suspicious of the certificate (which is almost never anyway) they tend to assume that the problem is anything but a real attack. Browsers have cried wolf too often.


How can "unvalidated redirects and forwards" be exploited?

Lets say there is a url called www.example.com/redirect.jsp?url=www.example.com/login that is used to redirect to the login page. I craft a link to www.example.com/redirect.jsp?url=www.myphishingsite.com/login which redirects to my phishing site. People look at the domain name and think its legit. It can also be used to DOS something and conceal your identity from the target.
There is no form involved.


Is there any security benefit of not using email services recently associated with PRISM?

More recent leaks and evidence suggests that the email providers themselves are, as a rule, not cooperating with the NSA. Rather the telecom companies such as AT&T are. The NSA wholesale captures and analyzes all the traffic upstream of companies like Google and Yahoo, and through that get implicit access to anything that isn't encrypted. So the critical detail is this: Which companies encrypt their traffic?

I did some tests, and here's what I came up with:

Email Encryption Availability

Forced:         +++
On by default:  ++
Off by default: +
Not available:  -
Outbound Only:  +*

                  Gmail     Microsoft   Yahoo      AOL
Web Interface     +++       +++         +          -
POP3/IMAP         +++       +++         ++         ++
SMTP              ++        -           +*         +*

So Gmail does encryption everywhere it's possible, and won't even let you connect unencrypted if you're fetching your email.

Microsoft (Live/Hotmail/Outlook.com, etc.) Forces you to encrypt to retrieve your mail, but does not support STARTTLS on port 25, neither inbound or outbound, so all mail to and from them is unencrypted.

Yahoo supports SSL across the board, but it's off by default on the web interface.

AOL doesn't even support SSL on their web interface, but does support it on the backend.

There's no "default" on/off state for SSL on POP3/IMAP, so I gave everyone the benefit of the doubt there.

Possibly most interesting: GMail will encrypt everything if you allow it, including server-to-server. Microsoft will not encrypt server-to-server, while Yahoo and AOL both do something odd: Both will encrypt server-to-server outbound email, but do not support STARTTLS on inbound email. So mail going from Yahoo or AOL will be encrypted if the destination supports it (e.g. Gmail), but mail going to Yahoo or AOL cannot be encrypted.

But with respect to server-to-server encryption, there's a catch: unencrypted connections are always supported, which makes a man-in-the-middle attack trivial. Simply MITM the connection on PORT 25, and filter out the line where the destination server advertises STARTTLS availability. Also, since certificate validity is rarely checked by mail servers, you can MITM the TLS session as well with a self-signed certificate.

Caveat Emailor
Remember that email is inherently insecure in its very design. Using your ISP's email service or setting up your own may not be any better. Remember that its the network backbones that are getting tapped, not the mail service providers. So we're all similarly vulnerable. Use S/MIME or PGP/GPG if you need email security.


You can sniff the packets provided that you have access to the path the packets are travelling. Suppose Router1 belongs to your friend and Router2 is your own router. You would (1) need access to Router1's network, or (2) packets would need to travel onto your network for you to be able to sniff these packets.

Network traffic can be forwarded using routing protocols and ACLs that send traffic from Router 1's network (say 10.1.0.0/16) to Router 2's network (say 10.2.0.0/16). Traffic can then be mirrored using port spanning or port mirroring for later analysis. This can be filtered by IP address or port to examine specific traffic, such as that from the 10.1.0.0/16 network.

An alternative is to take advantage of unpatched or zero-day vulnerabilities, and potentially take a more active approach to execute attacks on, or penetrate the network(s) on which the packets are travelling. However, be aware that there are ethical and legal implications to be considered which are beyond the scope of your question.


Prevent location being exposed through VPN

Maybe your IP is exposed by RTC/DNS leaks. You can check ALL the information a website can get about you on http://ipleak.net/ . You should check this website every time before using the VPN.

Besides, it might be possible that you've visited a website before without VPN. This website could have saved a cookie/localStorage variable on your PC and is possible to identify you later when you're using your VPN.

Also, as you can see on ipleak.net your browser usually sends your language/locale information which may reveal something about your location. Websites usually don't use this information to find a location though.


What are the main vulnerabilities of TLS v1.1?

There is no "real" security issue in TLS 1.1 that TLS 1.2 fixes. However, there are changes and improvements, which can be argued to qualify as "fixing". Mainly:

The PRF in TLS 1.1 is based on a combination of MD5 and SHA-1. Both MD5 and SHA-1 are, as cryptographic hash functions, broken. However, the way in which they are broken does not break the PRF of TLS 1.1. There is no known weakness in the PRF of TLS 1.1 (nor, for that matter, in the PRF of SSL 3.0 and TLS 1.0). Nevertheless, MD5 and SHA-1 are "bad press". TLS 1.2 replaces both with SHA-256 (well, actually it could be any other hash function, but in practice it is SHA-256).
TLS 1.2 allows the use of authenticated encryption modes like GCM. This can replace the more traditional CBC encryption mode, which has historically been a source of many flaws. Properly implemented CBC encryption is still fine; however, it appears that properly implementing CBC encryption is easier said than done. Getting GCM right seems a more readily achievable goal.
TLS 1.2 mandates support for TLS_RSA_WITH_AES_128_CBC_SHA whereas TLS 1.1 required only TLS_RSA_WITH_3DES_EDE_CBC_SHA. Thus, if you use TLS 1.2 then you have a "guarantee" that AES encryption will be available. (This is not in fact completely true: the guarantee holds only as long as no "application specific profile" mandates otherwise. Also, you will get AES only if both client and server support it, and if they both support it, then it is available, regardless of whether TLS 1.1 or 1.2 is used.)

To summarize, it's not a bad idea to patch your servers to support TLS 1.2 and configure them to prefer it over TLS 1.1, but there is no real flaw in TLS 1.1 that needed fixing and would make a switch to TLS 1.2 mandatory or even recommended. The main drive for TLS 1.2 adoption is the usual pavlovian craving for anything new and shiny.


how is public key being exchanged in asymmetric cryptography?

Even though I think you might be referring to the secure key exchange process (for this, I suggest you have a look at Diffie-Hellman as an example) rather than to the public key specifically, I will answer the original question because I have always been taught not to divagate.

There are three main ways you can exchange a public key with someone:

Manually: you simply take your public key and send it to the recipient. This is often done when you use PGP with some of your contacts, for example, if you decide not to upload it to one of the key servers;
Automatically: your computer comes with a bunch of certificates built-in, which of course include the relevant public keys. In this case, you don't have to do anything as you already own a list of trusted public keys;
You use a directory: this is the typical implementation in the workplace. You probably already have a directory with user account information, so you can add the users' public keys as an extra piece of information in a user account.


Blocking Email Attachment download from outside company in Office 365

You may be able to do this but the capability, I think, isn't available to every license SKU.

Unfortunately, I can't remember off the top of my head, the right part of the toolset but I think you can do this if you have "Enterprise Mobility & Security" which is an add-on license. You should also be able to do it if you manage your corporate devices via the InTune mobile device manager.


Can stack overflow be prevented by pushing return address first?

The main reasons are that it is inconvenient, results in sub-optimal code, requires prior knowledge of function stack size, limits performance, violates the specification of many calling conventions, and doesn't actually prevent overflows from succeeding.

The usual way that a function calls into another function, at least on x86, is (unsurprisingly) with the call instruction. This instruction pushes the return address onto the stack and redirects the instruction pointer to the target address. The stack is a concept that the processor itself understands and facilitates, and we can't change the processor's behaviour.

In order to facilitate putting the return pointer before stack allocations, we would need to allocate the function's stack space before the call instruction is executed. This requires the calling function (the caller) to allocate the stack for the called function (the callee), and thus inherently requires that the caller clean up the stack of the callee. This is possible in calling conventions such as cdecl (also some cases with thiscall), which utilise caller clean-up, but is a violation of the calling convention specifications for stdcall, fastcall, vectorcall, pascal, and a number of other conventions.

You might be wondering why it matters whether stack allocation is done by the caller or callee. Well, in general, a function exists because it contains code that is used in more than one place (this is why we have inlining optimisations!). In a callee-cleanup model, the code for setting up the function's stack allocation space and cleaning it up at the end is part of the callee function itself. The calling function doesn't need to know about the stack memory requirements of the callee function. This is useful because you don't end up duplicating the stack management logic for every call into that function. Imagine, for example, a program that called memcpy in 10,000 different locations - for callee cleanup there is only one instance of the stack management code for the memcpy function, whereas for caller cleanup there are now 10,000 copies. Even if this is only 10 or 20 bytes of code each time that's already hundreds of kilobytes of redundant code.

Another issue is stack growth. You mentioned that the compiler knows how much stack a function will use - this is not strictly true. Dynamic stack allocations are quite common, and your proposed model sandwiches the callee stack between the stack frame of the calling function and the return address of the callee:

| return addr | saved *bp | stackalloc space | return addr | saved bp | ...
|  (callee)   | (callee)  |     (callee)     |  (caller)   | (caller) |
 *bp+0         *bp+N       *bp+2N             *bp+?N         ...

This means that if the function requires its stack space to grow dynamically, it must move the return pointer and stack frame pointer (saved *bp) when it does so, and also modify the stack frame pointer in the process. This is unnecessarily complex and introduces some performance issues.

You may have also just realised why this isn't a fix for buffer overflows. By overflowing a buffer in the stackalloc space you don't overwrite the callee's return address, but you can overwrite the caller's return address. This does not really complicate exploitation.


In the context of a CVE, what does "unspecified vectors" mean?

An attack vector is a path or means by which an attacker can gain access to a computer or network server in order to deliver a payload or malicious outcome. When it's not specified, it simply means that probably there is a way, but no-one has found one or the vendor does not want the vector to be disclosed yet.


Can it be proved that two CDs were burned by different computers?

According to Microsoft (via here), CD burners can leave a digital fingerprint of sorts. What's necessary to detect and compare them, or whether it's within the reach with consumer technology I don't know though.


Is WebRTC safe for connecting random clients to each other?

In terms of IP address leakage you might want to see How bad is the leaking of Internal IP addresses through external DNS.

Nowadays, WebRTC works only on HTTPS and you should also use WebSockets on wss instead of ws. And I guess this way you should be fine.


Differentiating between IKEv2 and OpenVPN Traffic

Yep, if you had something like a palo alto / fortinet behind the wifi network, it would be able to distinguish VPN types based on application signatures.  Having a quick squizz at the ruleset for the openvpn app-id on my palo altos says you need port 1184 open as well as 443 and 80, so even if you were allowing access to IKE-V2 using a port-filtering firewall only,it still wouldn't work.


How to encrypt, sign and decrypt a file with gpg?

You're trying to use technology to solve a people problem

This is generally not a good idea.

Let me explain a bit more in-depth. You - the sender - generate a message, then encrypt it and then sign the encrypted message. This is akin to writing a letter, putting it into a box, locking the box and then putting your signature on the box.

You want the recipient of the message to verify your signature, then decrypt it and read your message. This is akin to them looking for the signature, verifying that it is correct, then unlocking the box and then reading the letter.

The problem in both scenarios is that you can't control how the other person is going to act. They could be lazy and always just unlock any box they find, just how they could just decrypt anything they find without checking who sent it.

A people problem...

Before, I stated that this is a "people problem". What I mean by that is that you want recipients to verify the signature, so that they don't trust something they're not supposed to. Some people just don't care, and it's hard to fix that. "Making someone care" is very difficult, and human psychology isn't really helping.

For example, when a user does something, they do that for a specific reason. If a computer asks them "Do you really want to do that?" then, they will just click whatever button they need to click for that message to go away. This is true for many security warnings, and unfortunately, there's not a lot you can do technology-wise.

...requires a people solution.

But what you can do is educate users. Explain to them what a signature is, why it's important and why they should care. And if your reason for them to care is because it's mandatory, as you said, then that should be a good enough reason.

Imagine your boss would come in today and say "Look, if there is a warning and you ignore it, you could get fired", then I have quite a high incentive to not click that warning away. It's a people solution, even if it's negative reinforcement.

Security at the cost of usability comes at the cost of security

Someone who is much smarter than me, but who's name I don't remember, once said that. And for all intents and purposes, it's true. You want to use signatures to improve security, and that should be hassle-free for your users. Signatures should be verified automatically without users even having to think about it.

If you tell a user "Command foo does the thing you need to do. Command bar needs to be run before foo and it does something you don't care about", guess how many users will actually run bar and then foo? Approximately none.

Instead, deploy a script that automatically runs bar, checks if the signature is valid and then runs foo.


Where to publicly report a vulnerability, after developer ignores it?

You can try getting CERT involved. https://vulcoord.cert.org/VulReport/

  We are more likely to accept reports if they:

  are technically accurate, sufficiently detailed, and reasonably    complete
  affect multiple vendors
  impact safety or critical infrastructure
  involve disagreement or dispute between reporters and    vendors
  involve hard-to-reach or unresponsive vendors
  affect vendors or sectors that are new to software security and vulnerability    disclosure
  require reporter anonymity


Yes. In fact all big load balancers (eg. F5 Big-IP) work in this mode by default.


I want to inject XSS payload in an anchor tag, but the double quotes are being converted into %22

Here, the double quote I put is turned into %22. Is there a way to overcome it?

No. Double quotes changing into %22 is called url encoding, which is performed so that rendered page doesn't treat it as double quotes.


Is it possible to install spyware in password protected android phone?

The scope of this question is too large. Is the phone stock? Running a custom ROM or rooted? Could he have guessed your PIN (looking at grease marks on screen)? When you say spyware do you mean an app from the store or custom apk?

I would say no, this is not possible, in normal circumstances. If you suspect something why not just wipe the phone and sync all your data back and vet the applications?


How does attacker Brute force facebook account if there is a limit for tries?

They don't.

If an attacker is trying to get into a specific account, he will rely on phishing or malware.

If an attacker is just trying to get working accounts, he will have a wordlist of emails and passwords that he'll try, thereby bypassing the restriction of password attempts simply because it's not being attempted on the same account.


Best practice in web application security authentication to avoid bruteforce attack

A relatively user-friendly way of mitigating brute-force attacks is delaying the minimum time between attempts. The first time your user enters wrong credentials, you let him wait 1 second before he can try again. The second time, you let him wait 2 seconds. The 3rd time, you make him wait 4 seconds. 4th time, 8 seconds, and so on. You also base this on the username that is used to authenticate, not any IP addresses. If there hasn't been an attempt in the past 5 minutes (or if the user authenticated successfully), you reset the counter.

The result is that a user that makes a typo in their password isn't affected the first few times, but any brute forcers will very quickly reach a point where brute-forcing is effectively not viable anymore.

Aside from preventing your web application against brute-force attacks, you should also ensure standard password protection practices like hashing & salting (preferably with PBKDF2 or bcrypt), secure password resetting, and mitigation against username enumeration.  But I assume that, since you post on here, you already know that.


Why standards organizations give so short protection times for 128 bit encryption?

By ">2030", NIST is actually stating that 128-bit symmetric encryption should be safe until at least the year 2030. If the current version of any given piece of software that relies on 128-bit cryptography is still around in 17 years, bravo.

As Dan said, it's NIST's job to be pessimistic about these things, because everyone listens to them, and because cryptography, in the cold light of day, has a pretty bad track record; if we had, by now, developed the ideal symmetric encryption primitive (as in, we can mathematically prove there are no attacks more efficient than brute force) that used a finite key length (OTP is provably uncrackable because it uses an infinite key length), we would still be using it.

As it is, almost every cryptographic system that has ever been devised through human history has since been cracked, and while the ones currently in use today (an elite minority of all ciphers ever invented) are believed secure, it's only because the best attacks known against them right now are only better than brute force when applied against a reduced-complexity version of the algorithm (fewer "rounds" of the cipher).


Problem with overwriting the return address (buffer overflow)

It is not rbp what you have to control, but the instruction pointer rip. When the function returns, ret instruction will take whatever is at the top of the stack and send execution there. So, notice those last two instructions, pop rbp and ret. The first one will take whatever is left at the top of the stack at that moment and store it in rbp; the second will take whatever is left at the top of the stack next and store it in rip, the instruction pointer.

Basically, you have to make sure that, when execution reaches that ret instruction, at the top of the stack (where rsp points) you are seeing your target address. If you fail to pop a valid address into rip, you will get a segmentation fault the moment the processor tries to read an instruction from an invalid (i.e. unmapped) location. Alternatively, if you overwrite rbp with some trash value but execution continues undeterred (i.e. leaving the actual return address untouched), you may set the program up for an eventual attempt to read or write to some invalid memory location, also causing a segmentation fault, so you have to account for that.

Also, keep in mind that 64 bit addresses and registers are 8 bytes long. For the exploit to work, you should replace the return address for (in little endian)

0x44 0x05 0x40 0x00 0x00 0x00 0x00 0x00

Hence, ret instruction will pop value 0x0000000000400544 into the instruction pointer, granting you control over the execution path.

If you only use strcpy, though, you may indeed have problems dealing with those null bytes. You see, strcpy exercise are way old, from the 32 bit era; today, in x64, a bad null byte can be a real hassle when trying to overwrite target addresses. Fortunately (or not, actually), misuse of strcpy is not the only way to mess things up. You may want to adjust your example to use memcpy, to read from a file or a socket, to take a bogus index for an out of bounds array access, or even have some loop with an attacker-controllable break condition. Coming up with new, creative ways to screw things up is actually good way to practice your exploitation skills.


Is replacing all apostrophes with two apostrophes sufficient to prevent SQL-injection on MSSQL?

No. This will certainly not handle string concatenation that is not delimited by quotes. e.g. a numeric field.

Consider

sql= "select username from users where id=" + id

if id is provided as 1 or 1=1 then all rows from the database can be returned. Obviously this can example could be extended to union select attacks or even entire nested queries.

Just use bound parameters and avoid the entire problem of SQLi.


Say you use Diceware you can generate a memorable, secure passphrase.

  For the technically inclined, each word in your Diceware passphrase yields 12.9 bits of entropy, the way passphrase security is measured.

If you want a passphrase to be uncrackable, ever, using today's technology (and the technology of the foreseeable future), you need 128 bits of entropy in your passphrase.

Therefore you need 10 dicewords to achieve this level of entropy:

128/12.9 = ~9.9

You can use a list memorising technique to connect the words in a memorable fashion. You could also use this technique to link it to the purpose of the passphrase. This is the type of technique that artists such as Derren Brown use in their stage shows. For example, the "tricks" where they remember whole telephone directories.

If the passphrase is stored hashed using a key stretching algorithm, you could get away with less entropy. This is because for every password an attacker tries, they have to run the hashing algorithm a number of times, known as the iteration count. The iteration count will cause any brute force cracking of the passphrase to be sufficiently slowed. If you want 10 bits less, then this is the equivalent of 1024 hash iterations (2^10) using, say bcrypt. For 20 bits less, then this is 1,048,576 iterations (2^20). So if you went for the latter, you could make your password slightly easier to remember by using 9 dicewords. However, if you're using a memory linking technique, an extra word won't hinder memorability of the passphrase - it would just be slightly easier to type in each time it is used.

  Are there password strength metrics which take both entropy and ease of memorization into account?

If you're measuring password strength in an objective way the only metric is amount of entropy. Entropy does take into account the passphrase generation method. If the average English word length is five letters, a password generated using Diceware would be 50 characters long on average if we're going for 10 words (for simplicity, we're discounting the character symbols used in Diceware). A 50 character lower case password completely randomly generated would normally have 235 bits of entropy - as we can see though, as the method of generation is to use whole words generated by five throws of a six sided die we only have 128 bits.

With the Diceware approach, the aim is to remove the memorisation portion from the equation, so we're left with the mathematical calculation of entropy only. We make memorisation of the passphrase a solved problem so we're just left with an objective "strength" value, based on the time required to brute force it.

You don't have to go for the full 128 bits. Just be aware that a targeted offline attack on a passphrase with less strength will be cracked eventually. A 128 bit passphrase is more important where the passphrase protects something that can be accessed directly - such as in password-based-encryption where cracking the password will enable an attacker to read the encrypted data. It is less important where the passphrase is only used as an authentication mechanism, for example where it protects an online account. It is advisable to regularly change your online passwords if they are a lesser strength because if an attacker has managed to retrieve hashed passwords, they will be cracked given enough time - although I disagree with the 90 day period usually mandated.

Edit:

So I would recommend a (separate) memorable passphrase with sufficient entropy for situations where you need to be able to type the passphrase. For example, as the master password for your password manager, for Operating System logins, or to authenticate you for full disk encryption. For online accounts, I would recommend the use of a password manager to generate a completely random 128 bit password that you can't remember.


TCP and UDP are layer 4 (transport protocols), and ports are an addressing feature particular to them.  There are many other protocols, and they do not use ports.  While malware often uses TCP or UDP, mostly to "hide" among normal traffic, it can use other protocols, or even one that the malware writers created on their own.

As Rashad pointed out, advanced malware can "hijack" normal programs on your computer, using them to communicate on their established ports.

Firewalls have many different strategies for inspecting data, from simple IP filters to deep packet inspection and application analysis.


What is the likelihood of a NAS getting hacked?

A NAS is not necessarily connected to the Internet, e.g. my NAS has a local 192.168 address which is not routed. In addition I have blocked that IP address from getting Internet access through the DSL router. The NAS itself is protected via username and password.

There are a few attack vectors, of course:

the DSL router can be hacked. Getting root access on the DSL router, the intruder could reach the NAS. Then, the attacker still needs to hack the user account of the NAS.
my PC could be hacked. Getting access to my PC would immediately give access to the NAS as well, because I authenticate with the same username and password. You could choose different username and password to get a higher security. If so, the attacker would need to transfer data from the NAS via my PC to the Internet.

Depending on your backup strategy, you can protect the backup by an additional password or even encrypt it.

That said, if

you're a bit careful,
run an up-to-date virus scanner,
configure your network and DSL router carefully,
do not browse as admin,
install updates frequently

you'll likely not run into problems. I have a NAS setup like that since ~10 years and don't know of any issues.

If you need the NAS only for backups, you can turn it off when unused and just turn it on e.g. every 2 weeks for making the backup.


What is the most up-to-date secure method for storing .ENV variables?

The first answer by Schwern makes the argument that .ENV variables are fine and

".ENV is a convenience and, ideally, is not used in production"

Before that line, you skipped this line:

To clarify, the security and flexibility are gained by putting secrets into environment variables.

If you're not comfortable using .ENV, then just pass the credentials as environment variables. .ENV is just a convenience around environment variables.

The credentials are currently stored in plain text in the relevant php files

From a security POV, storing credentials in a plain text vs. passing them as environment variables is functionally equivalent. You're not making your website more secure by making this change.

The context for that question was storing plain-text secrets in the code repository vs. passing them through .ENV, and which approach was more secure. Unless your situation is similar, that answer is irrelevant


Security in wireless ad hoc sensor network (without physical access)

Here you are talking of just an ad-Hoc wireless connection with/without internet connectivity is an important aspect which is unclear.
Considering it to be with an Internet Connectivity then the usual WEP key is completely vulnerable.
WPA-2 is preferred alternative.
Also node data can be theft only if specific ports are left open.
So that has nothing much to do with network here; instead iptables or firewall must me secured.
On similar lines even if the key is lost to the hacker that doesn't guarantee he can take all your node data.


They could try using background processes to check for VPN usage, however I strongly suspect that is not the case for two reasons:

Too much effort. Devs are lazy and an implementation like this would take a lot of effort (I wouldn't expect a simple poker game to do this).
Not everyone uses the same client (PIA, OpenVPN, Securpoint, etc.), though if they wanted, they could just target the most comment clients.
Like you mentioned, you could just use a VPN on another device and then bridge connections if you were really determined.

I would think that they would be using blacklists, in which case renting your own VPS will probably work, unless the VPS is already on a blacklist. If they are using blacklists, then you could try looking around to see if maybe there are VPN providers that aren't on the blacklist, but that would be hit and miss, so I wouldn't try it unless you could get a free trial type deal during which to test the program out on.

It's really pretty hard to detect VPN usage, and I haven't heard of any cases in which the implementation you mentioned with the system process monitoring has been enacted. If this is the case, you could try to circumvent it using what I listed above, or rename the process.


Force public key collision to break certificate pinning

Actually I'm not looking for a private key collision but for two private keys (where one is the original and the other is mine) that share the same public key.

For RSA, every private key corresponds to exactly one public key, so this is not possible. For more information, see these questions:

Multiple private keys for single public key
Can we have multiple public keys with a single private key for RSA?

Of course, TLS is specifically designed to be hard to MitM. There are usually a couple of options to intercept it anyways:

Modify the client. Change the binary, use Frida or a debugger to change the certificate validation logic.
Install a custom CA certificate as trusted. Create a CA certificate and configure the OS to trust this certificate.


Is running "apt-get upgrade" every so often enough to keep a Web-server secure?

You've removed a lot of problems that normally get you in trouble (namely, assuming that the app you're hosting is completely secure). From a practical perspective, you absolutely have to consider those.

But presumably since you're aware of them, you have some protective measures in place. Let's talk about the rest, then.

As a start, you probably shouldn't run an update "every so often". Most distros operate security announcement mailing lists, and as soon as a vulnerability is announced there, it's rather public (well, it often is before that, but in your situation you can't really monitor all the security lists in the world). These are low-traffic lists, so you should really subscribe to your distro's and upgrade when you get notifications from it.

Often, a casually-maintained server can be brute-forced or dictionary attacked over a long period of time, since the maintainer isn't really looking for the signs. It's a good idea then to apply the usual counter-measures - no ssh password authentication, fail2ban on ssh and apache - and ideally to set up monitoring alerts when suspicious activity occurs. If that's out of your maintenance (time) budget, make a habit of logging in regularly to check those things manually.

While not traditionally thought of as a part of security, you want to make sure you can bring up a new server quickly. This means server configuration scripts (tools like Ansible, Chef, etc. are useful in system administration anyways) and an automatic backup system that you've tested. If your server's been breached, you've got to assume it's compromised forever and just wipe it, and that sucks if you haven't been taking regular backups of your data.


Are .dll files normally found in system32 but now in a user’s AppData folder always suspicious?

Since Microsoft has straightened the default permissions on the Program Files folder, many developers have turned to AppData as an alternative location for their code. The logic being that an application installed this way can be updated without requiring elevation or admin level access. (Google Chrome, for instance, does this).

This also means that, sometimes, you will find legitimate libraries that usually live in the system32 folder somewhere under the AppData path. These usually are run-time components (like the MSVCRT, GDI+ or capicom) that are maintained and updated by the application itself (usually because they require a specific version to work but sometimes because they are pushed as a user component instead of a system one and needs to be deployed without elevation).

That does not mean that you should find libraries belonging to the operating system there: there is no legitimate reason for, say, schannel.dll to be found there since the only application that maintain that library is the operating system.

So, dlls under AppData having the same name as a dll in system32 are not automatically suspicious.


What is the meaning of public key parameter in the X.509 certificate?

Nowadays the most important use of field "key parameters" is within ECDSA certificate; the field holds an elliptic curve per RFC 5480 section 2.1.1.

Still, as of 2017, most people use RSA certificates; for these RFC 4055 section 1.2 says "the parameters field MUST contain NULL" (except the fringe RSASSA-PSS or RSAES-OAEP). Bytes 05 00 simply mean NULL in DER (and CER and BER).


How can an old hardware lead to a security failure?

"Lack of processing power" is not a security hole.

There are things like eg. DDOS: sending more requests to a system (webserver etc.) than it can handle, leading to normal users getting their services slower or not at all. But a newer faster CPU doesn't make DDOS impossible, it just needs even more requests by the attacker. In times where people can easily rent thousands of computers for a short time (in some cloud service), DDOSing a single device will always be possible, independent of the hardware.

Your "transport" point is a very different angle: Systems that eg. control self-driving cars (just as an example) are real-time systems. If this term isn't familiar, it does NOT mean that there is no delay. It does mean that there is a guarantee that it will do some work with max x milliseconds/seconds delay after its ideal time. Eg. starting to break max 100ms after the red traffic light is detected.
For this to work, there are many requirements not only to the sensor and cable/connection, but also to the control unit itself - our average computers and operating systems are not real-time-capable at all.

Back to the remote attacks - car control with internet is a bad example, but well ... The simple answer is, internet is not real-time-capable either. And there is nothing that can change that, other than reinventing everything in a different way (and even then it would be very hard).
So, your real-time-capable car control unit just can't have internet access if it should real-time-capable. => Remote internet attacks not possible.

Anyways, enough about processing power.

Old hardware indeed can be a problem for other reasons:

You mentioned firmware updates - but there are, again and again, hardware bugs that just can't be solved or mitigated with firmware. Some of them might allow malicious abuse.
And other than bugs, there are plenty security problems nowadays (2018) that were not known to exist eg. 20 years ago. Some require hardware support for a good protection. Old hardware just won't have this features. Random example: Intel SGX.


Run only MySQL on the Server - If possible run only MySQL on the server and remove any unused services.
Firewall - Limit access by IP address to only the servers / clients that require access.
User Privileges - When creating users always give the minimum amount of privileges and expand as needed. Also try to avoid using '%' wildcard for hosts and instead limit to the host that requires access.
Bind Address Appropriately - If you only require remote access to the server within the same network and the  machine has both an external IP and an internal network address. Setup MySQL to only listen on the internal address.
Enable Logging - Enable logging if the database doesn’t handle to many queries.
mysql_secure_installation - Use the mysql_secure_installation utility which does a number of things including removing anonymous-user accounts, removes the test database etc.
Root Account Accessible Local Only - Its best to limit the root account to be accessible only directly from the machine. The mysql_secure_installation does allow you to remove any remote access for root accounts easily. I usually then either ssh to the machine and use the mysql command prompt or MySQL Workbench has functionality to tunnel over SSH.

Additional Resources

MySQL Security Best Practices (Hardening MySQL Tips)
MySQL Best Practices: User Security
Security in MySQL


Thales HSM: relationship between the various key types?

LMK is Local Master Key which is the root key protecting all the other keys. This LMK is generated by 3 components and divided in to 3 smart cards. LMK is responsible for encrypting all the other keys. LMK is stored in plain in HSM secure area.

Which key should I use if I'm looking for general purpose encryption/decryption? How about key wrapping?

For this, you can use TPK which will be used for encryption and decryption.
The process will be as below:

Generate a TPK
Encrypt TPK from TMK, this will create TWK
TMK will be injected
TWK will be defined in code level or in a profile
When something needs to be encrypted, TWK will be decrypted with TMK to receive TPK, TPK will encrypt and vise versa

Can zone keys and terminal keys be used interchangeably (e.g TPK and ZPK)?

Zone keys are designed to exchange keys between HSMs.
You can wrap a TPK from ZPK and share.


Is a password box with pseudo-random number of stars more secure?

Someone watching you can often hear how many keys you've typed already (or can count the number of times the typing indicator changes), so the standard model of showing a star for each character doesn't really leak anything new. By changing the text field from that to making it based on some other quality related to the password, you're just leaking that new quality in addition to the length. If an attacker knows the password is 10 characters long, shows 8 stars, and knows your software's algorithm, that tells them even more about the password. What if your algorithm is found out to only show 8 stars for a single 10 character password?

Maybe the above is an extreme example, but consider that this system also leaks info about all of the partially typed forms of the password. If the password is "abcd", then when the user types "a" first, then some number of stars will be shown, and this will tell the attacker about the first character. Maybe "a" causes 3 stars to be shown right off the bat, and the attacker knows that only "a", "g", and "x" do that. Next, "ab" is typed, and that shows 1 star. The attacker can then figure out of all of the possible two-letter sequences that start with "a", "g", and "x" that result in 1 star. The attacker can then cut these down further by throwing away a lot of the sequences that they think are unlikely to be at the start of a password. The attacker might see that "ab", "am", "gq", "ge", "xc" are the possible two-letter sequences, and then throw out or de-prioritize "gq" and "xc" as possibilities for the start. Next, "abc" is typed, and that shows 4 stars, and the attacker only has to consider the possible three-letter sequences that start with "ab", "am", or "ge" that result in 4 stars. Repeat this a few times, and the attacker might not be down to one possibility for the password, but the search space is massively cut down.

If you want a system that is sure to leak less information than the standard show-characters-as-asterisks prompt, then you could copy a convention often used in terminal password prompts: don't move the cursor or change the screen at all while the user types their password. This does confuse some users though.


Why can't Wifi be secured assymetrically?

The concept

I will assume you mean a hybrid cryptosystem, since encrypting everything with asymmetric algorithms would be slow for embedded devices like (cheap) routers. TLS (used in HTTPS) uses the same thing: public key gets sent to the browser, they use that to exchange a secret key (randomly generated for each connection), and from there use AES or ChaCha20 to exchange data (encrypted using the random key).

In WPA2-PSK networks, you can decrypt the traffic from all clients if you know the pre-shared key (the PSK) and were able to capture the handshake that took place at the beginning of a connection. Why do we not use asymmetric encryption, which allows only the recipient to decrypt our message? It would work like this:

Client connects to the WiFi access point (AP)
AP sends public key to client
Client generates a random key, encrypts it with the PSK, encrypts that with the public key, and sends it to the AP
AP decrypts the message with its private key and consequently with the PSK.
Now, they both know the random key, to be used for symmetric encryption.

One cannot setup an AP without knowing the PSK, since they would never be able to decrypt the random key.

The issue: public key verification

There is one issue here: how do you know that you received the correct public key upon connecting? Anyone could send you a public key, also an attacker, and your client would be encrypting the random key with the attacker's public key. The attacker can decrypt your traffic, and relay it to the AP, so you have no idea that you are being intercepted.

Why a CA system can't be used

In HTTPS, this is solved by the CA system, where there are trusted third parties whom can sign your public key. Anyone connecting to the website will check that it is signed by a trusted third party. This works because a CA can easily check whether someone owns a domain: "I will only sign your certificate for example.com, if you put the code 1ZTHrM5OM14fe2ce in example.com/verification". This is not possible for a WiFi network since it requires physical proximity, and there is no concept of having a unique domain name.

Checking the fingerprint

SSH solves this by showing the fingerprint to the client, something along the lines of "192.168.1.1 has the fingerprint SHA256:1OBS2zY..., do you wish to continue?" If you continue, it will store the fingerprint (FP) and the IP address or domain that you were connecting to, so it can just check that it didn't change since last time.

This is also possible with WiFi (after first use, the FP would be stored with the SSID). The trouble is that the full FP needs to be communicated to the client, and the user needs to check each byte. Do you see your grandparents carefully checking whether Wa3rQOGlqo matches the FP published by the owner of the network? If you check only a few bytes in the beginning and/or end, it is trivial to generate a public key whose FP matches the beginning and/or end. It also makes it more difficult to replace your AP, since you'd need to transfer the private key (or re-configure each connected device to trust the new FP).

What is the point of this again?

But why bother? The AP already proved that it knows the PSK. Why do we want to have an additional verification?

Well, the whole point of using asymmetric crypto rather than symmetric crypto, is preventing clients from reading each other's traffic. Anyone with knowledge of the PSK can setup a fake AP and intercept traffic. Therefore it is necessary to employ a scheme which verifies that the correct public key was used.

Conclusion

Because there is no user-friendly way of doing this, I assume. But I don't know of any literature in which this was discussed and rejected. Or any proposed standards that never got to widespread use.

It could definitely be done as described above if people are willing to check fingerprints, but it might be easier to just connect a VPN if you want to protect your traffic.


Linux File Security when connected to internet

There is no easy answer to this.
Some loose thoughts:

Is this system directly connected to the internet, or is there a router and or firewall between this system an the internet?

How strong are your passwords?

Is your filesystem encrypted?

Do you have ssh login enabled?
If so, from where?

Do you use twofactor authentication (google authenticator is free and very simple to implement)

What services does this system run which are listening to connections from the internet?

You could do some pen testing yourself
(https://www.kali.org)

Who else has access to this computer?

Is your system up to date?

Are you browsing potentially harmful websites?


Can duct tape prevent hackers from watching me?

Figuring out if any device has been hacked is an extremely complex
subject.  In most cases, unless you know precisely what to look for
or have weird side-effects of the hack, you may never notice it.
Duct tape on camera lens will most definitely prevent anyone from
seeing you.  You'd obviously need to cover both cameras on a mobile
phone.  Other than that, you would not be visible as the screen
itself is not an input device.


Is cacert.org more harmful than self-signing?

The PKI model works on the trust you can give to the initial third party. Namely, the root CA. If you trust the root CA, you should import their root certificate, so that any certificate they issue (sign) will be automatically accepted by your system.

If you do not trust the CA, well there is nothing more you can do. So why would you trust CAcert.org ? Well, you can take a look at their Web of Trust system, where you can get assurance about certificates (I won't go in details here). Another question is: why would you trust the other root certificates already on your machine more than cacert?

Then to the question of is it more reliable than a self-signed one? Well, you could argue that the process involves at least two people, the CA and the website. Unless they are accomplice, it's usually better than self-signed only. Of course, all is based on the trust you can grant the CA.


Can Microsoft collect data from inside a virtual machine?

They technically can, but they only do so under certain circumstances.

A malicious hypervisor can tamper with the guest at will. A virtualized guest allows the hypervisor to trap certain instructions, deferring action to the hypervisor itself. If you spun up a guest operating system on a compromised Windows machine, it would be able to compromise the guest. From the perspective of the guest, the hypervisor runs at what has been nicknamed ring -1. The implication is that it is even lower and more privileged than ring 0, which is true (though it is not implemented as an actual protection ring, but the effect is roughly the same). A technology called SGX on newer processors can run certain aspects of a virtual machine in such a way that the hypervisor cannot tamper with it, but I do not believe there are any implementations that are sufficient.

So Windows absolutely has this ability, but does Windows actually do this collecting by default? Sort of. While they will not tamper with your guest and upload a bunch of private details relating to it, crash dumps relating to virtualization may be uploaded to Microsoft, and this detailed information may contain sensitive data from the running guest. You can avoid this by turning off error reporting.

Warning! Technical details ahead!

I explain how virtualization works in an answer to another question. It might be a good idea to read that answer to understand exactly what a hypervisor can do to the guest and what it cannot. A simplified but easy to understand view is provided in the slides for a lecture paper on virtualization:

  In practice, most of the time the hypervisor simply lets the guest run on the real CPU and memory, not knowing what the guest is doing. [...] If the guest is executing an "interesting" assembly instruction then the hardware traps it, and the hypervisor emulates the instruction carefully.

Some instructions can be configured to trap. Others trap unconditionally, such as out which is used to communicate with other hardware and do things like shut the system down. Others still, like mov, don't normally trap and will run without the host or hypervisor being able to influence them directly. When an instruction traps, control is temporarily returned to the hypervisor. It can choose to deny the instruction, run the instruction directly, or emulate it. From the perspective of the guest, an instruction that gets trapped simply takes a little longer to retire. From the perspective of the host, the VM is just a very slow instruction that only returns when the code in the guest is trapped and the hypervisor needs to make an executive decision, after which the VM resumes.


If Signal database leaks, can somebody bruteforce access into my contact's chat history?

There is a Signal blog post titled "Improving Registration Lock with Secure Value Recovery" that partially addresses this question:

By transitioning Registration Lock PINs to Secure Value Recovery, we can restrict offline brute force access for those PINs.

To understand how Secure Vault Recovery works under the hood, another post titled "Technology Preview for secure value recovery" must be read. Here's how the process works from a high level, according to the article, with some key notes included:

Clients use Argon2 to stretch the passphrase or PIN into a 32-byte key.
Two additional variables are generated from this stretched key: an authentication token, and (combined with a randomly generated input) a master key. This master key can then be used to derive additional application keys used to protect data stored in “the cloud.”
The master key incorporates c2 (256 bits of secure random data), which requires limited access to be resilient to offline brute force attacks.
auth_key, part of what is used to reconstruct the master_key, is put into a secure enclave, which is "isolated from the host operating system and kernel," with c2, which enforces a maximum failed guess count. "For example, if we set the maximum failed guess count to 5, then an attacker who obtained access to the service (or the service operator) would only get 5 password guesses rather than an unlimited number of guesses that they could attempt as fast as their hardware would allow."
Finally, because this is provisioned by SGX, and SGX supports remote attestation, "clients can transmit these values into the enclave over an encrypted channel with the assurance that they are actually being stored and processed by an enclave rather than someone pretending to be one."

The article goes further down the rabbit hole to address concerns that spring up with this approach, but this seems to me to be a good starting point.


Are there ways to protect the guest kernels at the hypervisor level?

That exists handily? I'm not aware. However, within the memory space that the VM allocates, the kernel is in predictable location. One could write code which reads the memory and compares the structure to what is expected.

If I were implementing such a creature, I'd focus on following the system APIs and ensuring that they are appropriate. One likely challenge is that different kernel versions will have changes in different areas. You may have to do mapping on a kernel-by-kernel basis.

You may be able to run chrootkit externally to the VM by exporting your filesystems. I've never tried such a thing, but I bet it would make an excellent research project.

EDIT: or read your disk images direct live and use known good hash comparisons from outside the vM. Then your VM continues running, but you have the benefit of the "LiveCD" confidence. There, now I have answers ordered from most esoteric to readily available.


What is the first step in auditing the security efficiency of a simple website?

Have a look at the OWASP Top 10 Project.

OWASP has the best set of resources available online when it comes to web applications. You can learn plenty of information from there.

In addition, I would look into hardening the servers which your application run on. CIS has a good set of benchmarks you could base your audit upon.

As far as tools go - recommendations are beyond the scope of the site. There are far too many out there. The BackTrack distribution comes with many great ones. It can be quite confusing for a beginner though.


OpenSSH < 7.0 Multiple vulnerabilities question

CVE-2015-5600: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices
This vulnerability has low impact on RHEL, because by default the option ChallengeResponseAuthentication is disabled in default configuration. Though it is or will be fixed in RHEL 6 and 7.
CVE-2016-1907: openssh: out-of-bounds read in packet handling code
This one does not affect RHEL systems, because the bug was introduced in openssh-6.8 (RHEL 7 ships openssh-6.6.1p1) as comment to the related bug.
Also other vulnerabilities can be similarly explained (usually because the the bug was introduced recently). Openssh is quite secure and breaking through all the levels of security needs a lot of effort.
Disclaimer: I work for Red Hat.


Keyboard entry obfuscation to defy keyloggers?

There are no such mechanisms and the reason is that they would not be cost effective.

The cost for such a technique is initially high because it is unclear how to realize it. You suggest that the receiver of a password somehow add noise to the input stream. For that you need the application that uses passwords to act a a keyboard. While this is possible it would still be a completely orthogonal extension to the application. In addition you would need to somehow emulate a keyboard in such a way that a keylogger cannot differentiate between the fake keyboards and the real ones. This might require operating system interference at a deep level depending on the system. All of this is extra implementation cost.
The benefit of this method is actually not that great. When your system is running a keylogger that means it is running malicious code which can intercept keyboard events. This usually means that your system is completely compromised and while it would probably be a nuisance to attackers it doesn't actually diminish their power because they could also retrieve the passwords from memory.

And that's why this idea does not actually make it into practice.


Are X.509 nameConstraints on certificates supported on OS X?

No. Apple does not support this.

Apple's Secure Transport library does not support X.509's nameConstraints.

There is a bug in Chromium's bug database about this. And it's been closed as WontFix.
Developer Ryan Sleevi had this to say on Aug 25, 2014 (archived here):

  Chrome defers to the OS cryptographic stack for verification.

  It's a well-known, long-standing issue that Apple does not implement name constraints. This applies to all applications that use OS X's SSL or certificate verification libraries (e.g. Safari, Curl, Python, etc)

Related

Should name constraints be present on a subordinate CA issued to an organization?
Which properties of a X.509 certificate should be critical and which not?
http://karl.kornel.us/2014/09/cas-name-constraints-and-a-business-opportunity/


Is there any known encrypting ransomware that attacks Macs?

Yes, now there is a confirmed and well documented case of ransomware specifically targeting Mac OS X. It was named "KeRanger" and was distributed through a breach of the Transmission Bittorrent Client website.

http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/

Some basic OS X security features (Gatekeeper) had been circumvented by using a valid developer certificate. Apple has since revoked that certificate and updated it's XProtect signature list, but obviously this happened after the malware had already done damage.


Is it OK to store the user's plain-text password in a claim?

it is NEVER ok to store a plain text password that is not yours. EVER!
the way to go about this is to validate the access you have and if the access check fails. ask the user for there changed password (e.a. re login)
you must assume that all data in any token transmitted between your server and a client is 'public'. use proper once tokens and try to go for a token authentication based approach (auth 2 / saml / etc).
basically treat the passwords of your users as secrets, you only store the salted hashed version. never the original!


Is splitting a REST API server from a Web server considered a security threat?

It would be more accurate to say that "using two servers e.g. api.myservice.org and www.myservice.org has security implications " --in other words, would normally be blocked by default server CORS config. But there are safe and secure methods to allow this by adjusting those settings.
The alternative of configuring URL paths to point to different hosts also has security implications. Arguably in favor of your proposed method, due to SEO considerations (i.e. you don't want a search engine indexing your JS lib files).
Read more details about "Cross-Origin Resource Sharing (CORS)" at https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS


How is a process forced to execute binary code?

A usual buffer overflow attack sends the server a message which not just overwrites a return address but also includes the code the attacker wants to execute. The return address would be overwritten to make the program jump into the message itself which will then be interpreted as code and executed.

Sometimes there is not enough space for the complete shellcode. In that case the attacker might use other methods to place their shellcode in a known memory location. This can be done by sending data to functions which aren't vulnerable them self but accept larger amounts of data and store it in a predictable memory location.


How can I hide my logged in sessions from other websites?

I think what you are noticing is a client-side acknowledgement of your sessions with Facebook, Gmail, etc. If a sharing script originates from facebook.com and you have an active session with that hostname, they will present a streamlined share button (for example) for your account. The website linking you to the script on Facebook cannot see who you are according to Facebook, or according to any hostnames that they do not control, if you do not explicitly authorize them to access that information.

In other words: if your browser currently holds a session cookie for facebook.com, then you will be able to use account-specific features of that script. It's meant as a matter of convenience, although it would give Facebook a pretty good ledger of where you've been and what you're up to (but no more than Google's tracking cookies). You can at least go incognito in Chrome or Firefox if you want to avoid leaks like that while working through a secure proxy.

Edit:

In the case of hide.me, they are doing about the most a host in their position possibly can in order to scare prospective customers into thinking they know more than they do. For instance, here's how they determine whether or not you are logged in to Facebook and Google+. In the case of Google+, they just add a new img element to the DOM and listen on a "loaded" event from the element—that is, they are literally just checking whether or not your browser is able to load an image that isn't available to non-users.


In the Kerberos protocol, what prevents clients from decrypting a service's secret key?

Tl;Dr - nothing, you can crack it. It is called keberoasting.
The TGS shared secret can be cracked, but there are some issues trying to do that.
Since the common case is that that the shared secret is the machine account password, getting that password allows you access to that specific machine (via silver tickets) or in the case of a DC to every domain password (via DCsync) (service accounts are the uncommon case and are a prime target of kerberoasting)
The password is changed automatically every 30 days, it's encrypted with aes(normally) and is a binary (256 options) randomly generated password of up to 32 chars hashed with md4, with a specific salt when traveling as part of a kerberos tgs request. Meaning that a true brute force is needed and the end result isn't as rewarding as the other quicker and easier options.


It's up to the merchant to ensure he is PCI compliant. So this means that when you as a merchant run a webshop which holds or processes carholder data you are responsible for securing it. Either you do it yourself or you transfer the risk to Heroku. To transfer the risk (or some of it) you would require an attestation from Heroku which specifically shows which controls they implement in regard to PCI-DSS. You can then use this attestation as assurance.

If you look at what they state:

  We use PCI compliant payment processor Braintree for encrypting and
  processing credit card payments. Heroku’s infrastructure provider is
  PCI Level 1 compliant.

It doesn't mean that their whole environment is usable to store or process card holder data, it just means they, themselves are PCI compliant when they process their clients and their cards. They do not state that Heroku can be used, as is, for applications which process or store card holder data.

So to be able to have assurance from Heroku, the whole Heroku platform should be audited to provide assurance they are PCI compliant. Often these providers offer these types of statements which can cover the PCI-DSS controls in the form of an ISAE3402 (if deemed acceptable by your QSA).

Also they state they can be used for applications which need to conform to the Sarbanes and Oxley Act (SOX). These require SOC reports, which they seem to offer. SOC reports also cover a myriad of security controls which can be used for assurance in terms of PCI DSS by your QSA.

Note that it is up to the QSA to accept or decline the SOC reports, it's in his right to refuse reliance of these reports and perform the audit himself.


Incident response to a medium scale phishing attack whereas the targets are not from our company?

This sort of thing needs to be handed off to law enforcement to handle if it is on-going.

Notify victims, then let them handle it.
Notify hosters, then let them handle it.

Do not go public about an on-going attack with active victims.

As much as you want to fix this, and have the skills to fix this, you have to respect the boundaries of responsibility that you have. You can't make the fix happen.


What is the rationale of binding SSL certificates to a domain name?

Because, when using the PKI, you do want the CA to confirm for you that the holder of the key is indeed the legitimate owner of the domain.

If if worked as you suggested, I could get a certificate and MITM your server, posing as your server on your domain and present a valid certificate (as the domain I'm presenting it for is not restricted).

The CA does not confirm that the holder of a key is trustworthy but does confirm that the holder of the key is also the legitimate holder of the domain.


Is there a way to physically trace stolen hardware?

RFID chips can only be read at very close distances (a few centimeters to a few meters, depending on type). So unless you suspect that the device is in the same room, an RFID chip won't help you locate it.

To remotely locate a device anywhere in the world, the device needs:

A GPS receiver to get its location
A GSM modem to transmit its location to a server via a cellphone network.

A smartphone already has both, so a software solution is quite straight-forward in this case.

When you want to bug an item which has neither, there are hardware devices available which have both. Usually each of these devices has a cellphone number. You send an SMS to the given number and the device responds with its GPS coordinates. Enter them into Google Maps and you have an address you can report to the police (Do not attempt to recover your property by going there yourself. You are endangering yourself, you might violate the law yourself by overstepping legal boundaries of vigilantism and might give the criminals opportunity to destroy evidence which can then not be used to convict them in a court).

To find such devices in online stores, search for "GPS tracker". A quick search on amazon.com shows gadgets like this, but I have no first-hand experience with these devices, so I can not give a product recommendation.


What vulnerability might this invalid HTTP_HOST value be trying to exploit?

It looks a little like shared cache poisoning attack that leverages HTTP Response Splitting.

This attack works by sending two HTTP Host headers: evil.com and yourhost.com, and exploiting a mismatch in how different subsystems deal with multiple headers.

For example, the Varnish cache would treat the first Host header as true, whereas the nginx web server would use the last one.

I'm guessing you use Apache, which concatenates the Host headers.

A standardization was established in RFC7230 that purports to protect against these attacks:

  A server MUST respond with a 400 (Bad Request) status code to any HTTP/1.1 request message that lacks a Host header field and to any request message that contains more than one Host header field or a Host header field with an invalid field-value.

SCRIPT_NAME does not indicate a PHP exploit, it's likely just the initial portion of the application's path in your WSGI.


You mean something like a wax seal on an envelope?  Not to protect its contents, but to make it plain if the seal was ever broken?

There is special purpose technology that does exactly that, but requires specialized hardware.  Essentially there is a cryptographic key kept in a chip that erases itself when it is used, or if the hardware loses power or the assembly is tampered with.  The memory and control logic for the whole thing has to be wrapped up inside special containment.

I have never heard of any sort of application of this technology to the problem of password storage.  Passwords don't need to be in a tamper-evident container, they need to be kept confidential, which is an entirely different problem.


In my opinion, it's perfectly fine to use, and probably a very good option for a home user. Perhaps you should elaborate on your specific concerns?

I think it's OK because it seems well resourced (due to its business success), and has otherwise signaled "good" intentions. By virtue of its size, it is well placed to protect against malicious websites.

From Wikipedia:

  OpenDNS is a company and service which extends the Domain Name System
  (DNS) by adding features such as misspelling correction, phishing
  protection, and optional content filtering. It provides an
  ad-supported service "showing relevant ads when we [show] search
  results" and a paid advertisement-free service.

  The company’s Umbrella cloud-delivered security service secures
  enterprise users from malware, botnets and phishing on PCs, laptops,
  and tablets. The OpenDNS Global Network processes ~50 billion DNS
  queries daily from 50 million active users connected to the service
  through 20 data centers worldwide.

This does mean that you have to trust OpenDNS not to do bad things - because they will see all your DNS requests, they can tell what websites you're visiting. Again, signals of good intent will factor into your decision about whether or not to trust them.

Many other companies offer similar DNS services: Almost any major antivirus vendor will have it built into their product, plus there are companies targeting businesses with dedicated appliances that do the same thing.


My question is has the malware installed proxy server on my pc?

Based on your description this is very likely.

  How the malware has done this?

Use of proxy is only a registry setting or similar (i.e. browser profile) setting and can be changed by a process (no manual interaction required).

  How to resolve this issue?

Unless you have instructions which are specific to your malware you should reinstall the system from scratch. You might also try a trusted antivirus (AV) product and see if this helps. But don't just download some random software claiming to be an AV - there are lots of fake AV out there which do even more harm.


Obstacle in Implementing a Time Limited/Number of Use Limited Software

The trick isn't implementing the feature: that's basic timekeeping, file use, subtraction, etc. The trick is ensuring they don't bypass it. The body of tricks you must google for that is called "code obfuscation techniques." If this was easy, there wouldn't be entire industries producing and countering them. The major tech in this area is DRM, which is basically what you're creating. It typically doesn't work if it's on a machine they control. So, the software needs to be on one you control.

The TPM's are designed to accomplish this, but are failures. The web option another mentioned is possible, but you say that's unacceptable. The last solution that can work in standalone is to provide a piece of hardware that runs your software while protecting it. Technology such as CODESEAL[1], SecureCore, SecureME, etc (Google them) allows software to run in a system while not trusting memory, devices, etc. You might combine a tech like CODESEAL, a simple OS, a driver, and a tiny form-factor PC to make a solution somewhat convenient for your users. They plug the device into their PC, drivers for communication are installed, an app for interface is installed, they register their device via a code (or online), and from that point on they just click an icon to see the application. Even though it seems like it's on their system, it's actually running on the device which protects its code via memory encryption & control flow protection.

That was my design a while back for solving this problem.

[1] http://www.microsemi.com/products/information-assurance/softwareanti-tamper/codeseal


Where to get an SSL certificate for personal website?

I like using StartCom for a free certificate.  Until mid-2016, it was recognized in most major browsers and is better than using a self-signed certificate (No error prompts for users).

EDIT 2016: Major browser vendors like Mozilla, Apple, and Google have announced they (and their browsers) no longer trust StartCom as a certificate authority, due to recently uncovered sketchy behavior by the certificate authority (see links in vendors names for their announcements of this and reason why).

Edit 2017: Let's Encrypt is now a great option for personal use and seems to be accepted even more widely than StartSSL was. Downsides to Let's Encrypt are the relatively short validity of the certificate (3 months) but that is not overly burdensome if you are able to take advantage of the automatic renewal they offer through some of their tooling.


You should familiarize yourself with the terminology. What you're trying to do has nothing to do with privilege escalation. What you want to do is code execution through buffer overflow.
I suggest you read the input for overflowing the buffer from stdin (gets), that is a lot more straightforward than reading it from a file. You can then do

python -c "<python encoded binary payload>" | yourprogram

That should do the trick.


Can Tor browser bundle be attacked like this?

The Tor Browser Bundle doesn't pin* the check.torproject.org certificate. So, yes, this is very possible.

But, Martin Martin Martin, the NSA doesn't really need to do that. You already download get your TrueCrypt download link from the official TrueCrypt site via HTTP, same goes for KeePass and tens of other security tools. Actually, they don't even need to do that. They can just intercept your connection when you do your Microsoft updates, or when you run sudo apt-get upgrade, or.. or.. or.

This is how it is. You have to accept it and live with it. Unless you create your own MartinOS and run your own MartinNet, then there's pretty much nothing you can do about it. If they want you, they can have you. Period.

* What is certificiate pinning?


Is it secure to put a mysqldumped file online?

Basically there is not so much information that attacker can use, but lets see an example scenario:
You will allow users to download the mysql dump file from your web host, and the file will include the operating system and version this may give the attacker ground to step on and try to find exploit for that OS and version, but unless is very outdated there is nothing to worry about.
You can simply remove those lines by yourself or specify it in the software you are using to dump that file(example: phpmyadmin).


What's the difference between an executable signed with a Windows Digital Signature and one signed with PGP?

Does a Windows Digital Signature and a PGP signature perform the same function?

Well, yes and no. The windows digital signature you refer to is present because Windows requires all executables to be signed. Otherwise Windows will complain that the executable is from an untrusted publisher and Defender SmartScreen will block it. Windows uses it to verify the that the executable has been signed by a reputable publisher (just signing is not enough, you also need a positive reputation). Of course since its signed, the executables integrity is also verified. Almost.
So if the digital signature on the file already verifies the file's integrity, why use PGP too?
The thing is KeePassXC is software used by security-conscious people. And quite a few of these people are (often right-fully so) extremely paranoid. The problem with the Microsoft Authenticode certificates used to sign executables is that they are issued by CAs trusted by Windows. And CAs can (and have in the past) be hacked or go rogue. So if a CA was compromised, went rogue or forced by a government, they could issue a fake Authenticode certificate under KeePass's name. Then any software signed with it would pass as verified KeePass code, and a fake backdoored but signed version can be distributed to users. That's a risk the paranoid folks would rather not take.
So the solution is to sign it with their own PGP key as well. Now anybody who verifies the PGP signature on the executable can be sure they aren't using a backdoored version signed using a fraudulent certificate.


How to check whether the erase was secure enough?

Some drives conform to higher ATA standards than others. An ATA secure wipe (if available) will tell the controller to "release the charge in the NAND chips", effectively making it appear that there is no data on the drive. This can brick drives, as some overwrite firmware as well.

More importantly, a study done by the University of California San Diego showed that an ATA secure erase command may not sufficiently destroy data: http://nvsl.ucsd.edu/index.php?path=projects/sanitize

Some older consumer SSDs (and some newer ones) are SEDs, or Self Encrypting Drives. Each write to drive is first passed though the drive's controller which encrypts data before it is written. The advantages of these types of drives is that by changing the key used for encryption, one can have some level of confidence that the data is not recoverable. Data is unrecoverable by consumers.

As others have pointed out, with SSDs, there are other "reserve" blocks of memory which do not tend to be overwritten when preforming a disk wipe (especially generic disk wipes). This again should not be of significant worry for consumers as consumer level disk recovery software would be unable to recover from those special blocks.


Can a hacker install known-vulnerable software on a machine in order to control the PC and elude antivirus?

Of course it is possible to install weak software in order to get more access to a machine. This is a known approach.
However, if you have access to install something, you tend to have enough access already. SolarWinds provided a backdoor, and if you can install SolarWinds, then you can simply install a backdoor.
If the software gave you more access than you might have (like system-level access) then it becomes a viable approach. But that's not the case with SolarWinds.


Security implications of syncing with off-site keepass database

Are you worried that someone may break your AES/Rijndael 256-encrypted database? If your key sucks, then yeah, you should be worried.

It's always good to elaborate what your fears are.

If you're afraid that a government agency may have the resources to compromise your KeePass database - I wouldn't be worried about that, they have other ways to get what they need.

If you think a hacking group is looking to break your precious database of cloudy accounts, then it's more likely that you become a victim of a drive-by (e.g. malware on your droid).

In all cases, the baddies will go after the lowest hanging fruit, and in this case it's not the KeePass database - it's as solid as you need it to be. However, your Android may not be as solid as you think. The endpoint is usually the weakest link, especially if it's a phone.


This isn't the place to ask, but it is a wifi camera and there is no DVR function attached to it, therefore if you do not have a wireless router or if the router/access point turns off then you will not receive the video stream.

NOTE: I do not own the product nor do am I affiliated with Belkin so my answer could potentially be wrong.


Will hashing passwords in my use case improve security and why?

In your scenario the hashes add little security because the client sends the hash to the central server, however the client should send the attempted password, the central server then checks the hash of the password against the submitted hash.

Hashing is very important in this scenario, because you may have a malicious user. The malicious user has a real account and password, she then connects to the host server via the central server as normal. She is then connected to the host server and if she can exploit a vulnerability in this server she can dump the plaintext passwords of all other users. Salting should be handled as normal, i.e. the host sends the central server a hash and a salt, and the client sends a plaintext password over TLS, and the server verifies that the password and salt match.


Secure environment for servers with sensitive private data

Seek professional advice...seriously, if the data is as sensitive as you say and the consequences are truly fatal, it would be negligent to rely on advice from here upon which to base a solution.

Nobody can offer a reliable contextual answer because there is not enough information about the business requirement the solution is for. Some things that would need to be considered in order to determine an appropriate solution: the intended audience, what the data is, what it will be used for etc. these may open up alternative architectures that would provide more effective risk mitigation.

There will be aspects that are not referred to in your question...access control (multi-factor possibly), pseudo or real-world identity requirement (impacts registration), encryption of data.

If you are in Europe data protection legislation will apply...so there is a whole raft of pre-reqs before even collecting the data: conditions for processing, where the data can be processed, what it can be used for etc.

I know this is not a direct answer to your question, but I was running out of space in a comment...you may well have considered all of this, but I just wanted to make sure!


Setup and record outbound traffic from a botnet in a sandbox/secure environment

If you want to use the XP firewall log, just enable it - it works tolerably well.

Better may be to use wireshark, which will log the actual data sent out from the machine


Using virtual server for backing up files

If you don't do anything wrong and don't lose your encryption key, then you should be reasonable safe that others won't be able to decrypt those files. However, somebody who is able to gain read access will probably have write access, too (and delete or destroy your backups).

Just a few suggestions:

Keep your encryption keys at a safe place. If you want to store them with your backup, protect them with a passphrase. If you can't recover those keys, your backup is useless.

You should have tested a recovery. Your scenario isn't that complicated so it's not a big deal.

Keep more than one version of your backups. Maybe you'll need a file that you deleted last week.

Think about automation.

Use a user account for your scp. On your server you can use the local root account to regularly move your files where your backup user can't delete them.

There's a lot more things you could do if you're really paranoid...


Are memcpy() based race conditions exploitable for causing remote code execution?

Based on what I see here, you can modify *src after ValidateOpcodesOrCrash finished checking that part of the memory but before SafeMemcpy starts.

I don't know how ValidateOpcodesOrCrash is implemented, but presuming that it simply loops through [src,src+size] and look for illegal instructions, then you can call with a fairly TrustedPart_for_safe_jit large size, busy wait for a few hundreds of CPU cycles, and then start overwriting *src that ValidateOpcodesOrCrash likely had finished checking. If ValidateOpcodesOrCrash does something more complicated, you can figure out what sequence of instructions will be the fastest and slowest for ValidateOpcodesOrCrash to check, put the fastest at the front and, a whole lot of the slowest instructions all up to the end. You probably won't need to wait for ValidateOpcodesOrCrash to complete before you start overwriting src.


Agree with the advice given so far. Someone has validated at least your email address against a database, this has value in itself.

They may also have captured additional information including those mentioned. Other possible information may have come from well-known cookies and other persistent information.

The links, of course, all contain specific tracking GUID's so they have matched your email address and browser details against their "campaign" as well. I would expect that you will see, at some future point, a big increase in spam and phishing attacks against that email address.

There is a small possibility that a rootkit might have been installed that might only activate later. I wouldn't rely on a single malware checker, run a few.

Looks to me as though you were relatively lucky in this instance. Here are some things you can do to avoid stuff like this being a disaster:

Use a different email address for every vendor contact. Many email services allow you to use a + symbol following your name and then you can put what you like after it. So using something like mymailaddress+vendor1@mydomain.com for example allows you to keep things separate and should an "address" be compromised, you can then blacklist it.
Use a good adblocker in your browser. Better still use one on your router if you can (most can't but a few can such as the Ubiquiti EdgeRouter's) and/or also use OpenDNS with some of their blocks in place.
Check occasionally using multiple anti-malware tools. You mentioned Malwarebytes, Hitman Pro is another good tool. There are plenty of others and most allow you to run a check without paying.


Accesing private information in PKI Smart Card without PIN

That depends. On the actual card you are using and on the way the card was initialised and the key and PIN configured.

There are two roads a thief could go, to use your key

Firstly, he could just try to use the card the way it is intended, using its official interface (ususally PKCS#11 or PC/SC). Most of the time, usage of a key is protected by a PIN and the PIN has a retry counter (somewhere between 3 and 10, depending on the length of the PIN) which completely blocks the PIN (and thus the key) once reached. So if the card has been configured properly, this should prevent anyone from brute-forcing the PIN

Secondly, a more technically inclined thief could try to circumvent the smartcard's operating system and try to access its flash memory directly. If that is hard-but-doable, very hard or impossible depends on the card used. A lot of cards do have security certifications, which include some (or a lot of) physical protection of the key used. Look out for security certifications of the smartcard (FIPS 140-2 or CC-EAL), those are a good sign that the hardware might be somehow protected (and a lot more expensive)


Session key renewal between two constrained devices

This approach works, if you derive the session key in a secure manner (using a cryptographic hash function or some construction built on a cryptographic hash function).

As only the two parties know the key, only the two parties will know subsequent keys.
It may even be possible to omit the the synced random number generator and just use some session constant as derivation parameter for your key derivation function (KDF).

Another approach:

But there's a way to do this without a synced Random Number Generator (RNG) and fresh keys for all connections. This assumes you've got a good random number generator and the pre-shared key K of length 64 bytes which is highly random. All undefined variables below are random and 32 bytes long.

Device A sends device B a random number n_A.
Device B responds with E_K(r_B,n_A,n_B). If the answer takes too long A refuses the answer or if the n_A is not the n_A sent in step 1.
Device A responds with E_K(r_A,n_B,n_A). If the answer takes too long B refuses the answer or if the n_B is not the n_B sent in step 2.

Now you can use the xor of r_A and r_B and use a KDF to get the session key, if you're not sure about your RNG you can also input K into the KDF call.
Note that you may wish to use GCM mode for your cipher.


How can I create a service that automatically logs onto a third-party service without storing credentials in plain text?

You will need to store the user's email password in a recoverable form.  You can still encrypt the passwords, but you cannot hash them.

Storing your users' passwords in recoverable form does entail some security risks.  If the database of user passwords is ever leaked, you've got a serious security breach.  However, that's just the nature of your service.  People normally recommend hashing to try to mitigate this risk, but since you can't use password hashing in your particular application, you'll have to use other measures to mitigate the risk.

Here is my recommendation for how to do it in as secure a way as possible.  Set up a separate machine (or VM) that is used solely for the purposes of managing email passwords.  It runs a service -- let's call it the password-keeper service -- that exposes a few simple APIs:

Register IMAP account.  The caller provides information about an email account: e.g., the username and password.  Your password-keeper service stores this information.
Read email.  The caller identifies an IMAP account that was previously registered with your service.  Your password-keeper service looks up the username and password for that IMAP account, connects to the IMAP server and authenticates to it, downloads any new email, and returns the desired email messages to the caller.

This password-keeper service is like a Hotel California for email passwords: passwords go in, but they never leave.  The password-keeper service is responsible for storing passwords as securely as possible, and never exposing them to others.  It might store the passwords in a separate database, encrypted under a special key.  The encryption key might be stored in a configuration file that is accessible to this service, but not to anyone else.  The password-keeper service can now control access to your users' email accounts.  For example, it can perform secure logging (so you can track down intrusions), rate-limiting (to reduce the impact of a breach of your other systems), or other protections.  You can also lock down who or what can access it.

Now, write the rest of your system to be a client of the password-keeper service.  Configure the password-keeper service so it is only accessible to your code (and not to the public), and use strong authentication for your code's connection to it.  Make sure that you never store users' email passwords anywhere else in your system.  When the user supplies an email password to your application, you should immediately invoke the password-keeper service's "Register IMAP account" API, pass it the password, and delete all other copies of the password.

This will not provide perfect protection, but it gives you a place to stand: a way to get as much protection as possible, for your users' passwords.  With this kind of approach and some diligence, I think you can provide a reasonable level of security to your users.


best practices for storing retrievable passwords

Never. Ever. Use. Base. 64. Encoding. It is not secure. It is also not allowed if you are managing other peoples passwords.

You must store the passwords encrypted through a machine level program that will encrypt and decrypt them. After they have been encrypted you can store them where you like, but you must always go through the program to encrypt and decrypt them.

Roboform Enterprise is a great password manager. The security official can change the roboform password for the clients, generate random passwords, and keep things pretty darned secure.

Of course since you're building your own, the truth of the matter is that you will have to build an auto key rotating encryption program with the keys stored in a separate physical, non network, secure location. You then encrypt the passwords and store them.

When a key gets rotated, the program retrieves every password, decrypts, encrypts with the new key, and restores them to the database or does it on the fly with the next retrieval. But basically you have to have a system level program do it.

You should also make this dependent on the system it is compiled on. This way you can make sure that if the program itself is taken to a new system, it won't work decrypt those passwords correctly.

Of course this means that for every client on your system, they need their own copy of the application, and their own set of keys. That however is the nature of enterprise security.


How can using multiple laptops improve security?

You seem to assume that handling sensitive information is all that Snowden - or anyone else - does all day.

But that's not true. Most people use a laptop for a variety of tasks: Gaming, watching videos, listening to music, surfing the web, developing software, social networks, etc.

Many of these tasks create additional attack vectors. For example, there are games that contained vulnerabilities and DRM systems that were vulnerable. And that's assuming that the person purchases the game legally over a secure channel.

It seems reasonable to separate tasks that produce an additional attack surface but do not contain any sensitive information - eg gaming, music - to a different computer.

Personally, I don't really see the need for 4 laptops. Your ideas might be close to Snowdens thought process though (1 Laptop for communication and 1 for IDS/Firewall seems to make sense at least). Your Laptop 1 is only responsible for storage though. Why not use an external drive for this?