Skype opens base64-encoded JavaScript. What does it do?

I started by renaming some variables to make things a bit more understandable:

    function obscurify(function_input) {
        var returnstring, local_counter;
        returnstring = "";
        for (local_counter = 0; local_counter < function_input.length; local_counter++)
        {
            returnstring += String.fromCharCode(function_input.charCodeAt(local_counter) + 2 - local_counter % 14);

        }

        return returnstring
    }

This is the first function, when we run the obscure string pdqvgvxFtpuj~tmmFscpi through it, we indeed receive the word requestAnimationFrame as demonstrated in this bin (alertbox ahead).

The h() function bothered me for a bit, so I started looking around for reasons people use the requestanimationframe function.

That's when I found this page:

  Limiting the frame rate while using requestAnimationFrame can be a
  common want especially when coding Games where you want your
  animations and mechanics to not exceed a particular mark of frames per
  second. Let’s go through 2 ways of doing it.

The first way the author describes is through setTimeOut, but then he writes this:

  Ok, browsers cannot optimize setTimeout or setInterval. So it’s kinda
  better to do our own calculations and restrict the frame rate. Let’s
  see how.

And then he proceeds with the following code:

var fps = 30;
var now;
var then = Date.now();
var interval = 1000/fps;
var delta;

function draw() {

    requestAnimationFrame(draw);

    now = Date.now();
    delta = now - then;

    if (delta > interval) {
        // update time stuffs

        // Just `then = now` is not enough.
        // Lets say we set fps at 10 which means
        // each frame must take 100ms
        // Now frame executes in 16ms (60fps) so
        // the loop iterates 7 times (16*7 = 112ms) until
        // delta > interval === true
        // Eventually this lowers down the FPS as
        // 112*10 = 1120ms (NOT 1000ms).
        // So we have to get rid of that extra 12ms
        // by subtracting delta (112) % interval (100).
        // Hope that makes sense.

        then = now - (delta % interval);

        // ... Code for Drawing the Frame ...
    }
}

draw();

Which does look a lot like the calculations that are being done in our code.

But why does this show up in Skype without me doing anything?

Because browsers and Javascript are literally everywhere.
I just started Skype and it didn't give me an error, but it's showing me ads.
My gut tells me the embedded browser that loads the ad has no handler for data URL's in your case, which is why Skype appears to give that error.

The code is really just adding an eventhandler, and making sure FPS isn't broken every time the event is called. (Switching between ads, make ads run smoothly, make loading icon run smoothly,...)

If ads exceed or go below their display time on 1 000 000, 30-second impressions, a 10 ms difference can scale incredibly fast and thus give your advertisers less or more displaytime than they pay for.

But why is it obscure?

As per @dandavis comment, there indeed is no appearant reason to obfuscate this code, it's available freely on the internet (like i linked above).
However, the same embedded browser that is executing this code, might as well host a login frame for example.

We're not going to rewrite a handler for both obscure and non-obscure code when it's much easier and less bug prone to just run all code through an obfuscator if we need it once.

Chances are likely to me that the reason this is obfuscated is just a General Rule: Obfuscate all JS Code.


However, what ensures that CPU really starts booting the system from the correct ROM?

Usually ROM are sorted onto motherboard. Since information once written to ROM can not be electronically altered, the only way a computer to use another ROM is change of motherboard which requires physical access to machine. As suggested by  @multithr3at3d in the comments if an adversary has physical access to machine, there is no restriction to what can be done.

Can't an adversary force the CPU to read a malicious initiating
program that disregards the verification step?

Rootkits may change the sequence of boot-loaders or change the boot-loader with a malicious one. The BIOS doesn't know the difference between a trusted boot-loader and a malicious one. Hence Secure boot is in place to help avoid it.


What is the best way to encrypt a JSON object in Java?

There are many ways to do this.

I would encrypt the JSON at a entire file level rather than encrypting content within it.  The alternative is complicated and gives no meaningful security advantage.  I recommend using an AEAD cipher (my present recommendation is AES-256 with GCM: aka AES/GCM/NoPadding with 256-bit keys).  To use GCM you need to be on Java 8 or later.  To use AES-256 with an Oracle JRE you will need the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files installed as documented.

You should make sure to set the authentication tag to include information about location and use (the true filename is a good start) to make it hard to rename or substitute other versions (a form of at-rest replay attack).

However, encrypting the JSON content isn't a complete solution.  It just moves the ball a bit.  If the attacker still has plaintext access to the private key then it won't be effective.

To protect the private key plaintext you can use a KMS (Key Management Service) on a separate system.  That keeps the private key out of memory access on the machine with the encrypted JSON file.  You submit the encrypted file content to the KMS to be decrypted on load or vice versa on store.

With those in place you can effectively protect the file from offline attacks (ex: disk image analysis, machine image analysis, backup theft, media theft).  Without further defenses, the content of the file is still subject to online attacks of the memory of the machine itself.


How esignature verification process work?

An electronic signature (in the cryptographic sense, which I'm assuming is the meaning here) is a method of attesting that the holder of a particular private key has signed the document in it's current state.  The verification of the private key needs to be handled as a separate step.  This can either be by a third party certificate authority or by some procedure to establish the validity of the public key by you.

If it needs to be legally binding, there may be additional requirements in your area and you should consult a lawyer for details about that.


How to keep web traffic private with a satellite intenet connection

The correct way is a VPN.

Since satellite communication is already relatively slow adding a VPN in the middle will just slow it down. Only if you really don't trust your provider go ahead and use a VPN.

  I wonder if could use a VPS as a secure proxy?

You can. But you have to make sure (and trust yourself) that you are able to provide the correct security measures you are looking for.


Ensuring security of web based games and contests

Encryption is not a good way to ban automated clients, because if a browser is able to decrypt the content of the contest, a good bod is able to to the same.

But for the sake of completeness:

A very easy way to eliminate automated scripts would be something only a human can solve.
A very popular way of doing this is a Captcha. From Wikipedia:

  A CAPTCHA [...] is a type of challenge-response test used in computing to determine whether or not the user is human

There are many different types of captchas, some of them are nearly impossible to solve for computers, some of them are relatively easy to solve.
A very good system is recaptcha from Google. It even has a fallback for people who are blind or don't see very well. And by solving a captcha from recaptcha the user even does something good by helping digitizing books.

Sure it is a little bit more work for the human user, too, if there is always a captcha to solve but unfortunately there is not really a good alternative to it.


Transferring Microsoft SmartScreen reputation to renewed certificate

To complement the comment by @JozefIzso: The binary became trusted after about one month. While the further release become trusted after about 10 days only, third release did not become trusted for weeks again.

It does not look like a standard code signing certificate can be used nowadays. We gave up and went for EV certificate.


Best and secure way to do a authentication protocol between Restfull webservice and Android client

The best way - as it mostly the case - is to use TLS. Then you can simply log in using username/password. Besides authentication, you probably also want to protect the requests and responses. It's not often that you just have to protect against eavesdropping alone, in most of the cases active attacks are also possible (e.g. when using insecure WiFi connections).

You could also have a look at the SRP protocol, but that might be more tricky if you aren't that well informed about cryptography. Besides that, it doesn't provide a complete solution.


Do I need to purchase a PCI DSS certificate?

It's likely that PCI-DSS doesn't really apply to you. Most e-commerce sites outsource their payment to a payment processing company, e.g. PayPal or Google Checkout. This means that you never store financial information about your customers.

But, if you want to do it yourself, and you'll be directly storing and accepting card payments, then you should read the PCI-DSS guidelines and understand fully what's required before going ahead. PCI-DSS isn't just a certification - it becomes part of the contract you have with the bank that accepts your funds.

If you're not experienced in security, you'll need to get training. Same goes for any developers you hire. You may also be legally required to follow certain government laws related to data storage (e.g. Data Protection Act in the UK), which will require further study. You might need to consult a lawyer.

Once your system design is complete, it's worth paying a security consultant to identify any security problems that you might face. From there, you can move to implementation. You'll need to follow strict code security guidelines, as well as take careful consideration in chosing your hardware and hosting platforms. You may need to invest in a HSM or a similar system to store credit card details, depending on applicable laws and regulations. Once you've completed the development, you'll need a security review by a company certified to provide PCI-DSS compliance tests. These tests usually involve normal penetration testing, as well as checking for complaince in all areas of the standard.

Once that's all done, you're (probably) PCI-DSS compliant. Your bank may ask you to perform periodic re-testing of your site.

All in all, it's not cheap or easy to comply to PCI-DSS. It may be wiser to let the payment processing companies handle this burden, and focus on making a better online experience for your customers.


Guest wireless network is directly connected to internal LAN. How bad is this?

That is for sure an insecure way to proceed. As I think you know, the wireless network should be separated from the wired domain network. And of course the wireless guest network should be an isolated different one only with internet access (it depends of what your guests need but usually is only internet access).

You can be victim of many different attacks. You can be victim of "layer 2" based attacks like ARP spoofing or starvation attacks. Do you have good network switches with port security or similar? I guess no, so your network is a very good "practice field" for some skilled hacker.

Another tipical attack for Active Directory is a pass the hash attack. It can be easily done if a NTLM hash was previously sniffed and that seems very easy on your network. Using that attack, somebody can easily access to the network shares. The same for the pass the ticket attacks which is he same but for Kerberos authentication.

Definitely, that is a bad design network regarding security but for sure is a very cheap option. I guess is a small company with a limited resources. Anyway could be a good practice to warn then about this and then the company should evaluate the risk in order to proceed (or not) with some changes.

In may opinion (but this is absolutelly personal) the security is one of the most important elements for a company even if is a small one.


Public Digital Signature Validation with JWE

With JWS you can use one of the signature schemed supported. Broadly there are three options - HS, RS and PS - HMAC , RSA PKCS 1.5 and RSA PSS respectively.

The payload and protected headers would be signed and the signature would be transmitted. As far as overall security is concerned, be aware of alg:None issues with JWS libraries and the possibility kg replay attacks if exp header isn't included.


Would IT Security professionel people notice a backdoor in Windows 7 or SBS 2011 implemented by Microsoft?

Is it possible that one could avoid detection, possibly, but if it was used with any regularity, it would be detected quickly.  There would need to be a mechanism to hook into it and the amount of scrutiny that the code receives makes it pretty unlikely.  Additionally, if there was any such back door, then the software wouldn't be used on government machines and we can compare the executables the government uses to the ones that are otherwise provided to users.

Since there aren't differences like this and nothing has ever been spotted, we can be reasonably sure that there aren't backdoors as they would be both hard to find and a security issue for the government itself.  Again, there is no way to definitively prove a negative, but it isn't particularly likely that Windows has a backdoor in it.  Even if it did, using a firewall that isolates the system from the Internet would prevent it from being able to be accessed remotely unless the networking gear also had back doors.

Unless you are using encryption, Windows doesn't provide any security against local control of your hardware, so the only real question then becomes is there a backdoor in the encryption Windows provides.  This gets a little bit trickier since this kind of encryption is used less or not at all by government, so there might be something there and it would be far harder to tell since cryptography systems are far harder to look for holes.

Once again, the possible outcry from something being found probably makes it unlikely.  It would be on a whole different level if the encryption was intentionally compromised than the fact that they have been sharing access to records that they maintain.  Businesses use the encryption to protect billions of dollars worth of data and if Microsoft intentionally put a backdoor in, they would be liable if that backdoor was used to compromise business data.  You don't normally make that kind of gamble with your entire business.


How do crackers upload php scripts to Wordpress' wp-content directory?

I wouldn't say that the root cause of the problem is Wordpress, but rather the fact that:

There is so many themes/plugins for Wordpress available from 3rd party developers, and people usually don't audit them before installing them. Since the entry barrier for PHP is very low, a lot of those 3rd party developers have no/poor IT security knowledge

I think one of the most possible scenario is where a Wordpress setup is configured with a plugin/theme which allows anonymous uploads. One example is the Clockstone Theme upload.php Arbitrary File Upload Vulnerability.

Basicly, you

Need to make sure unauthorized/anonymous uploads are not allowed
Move uploaded files out of the web root directory
Verify the content to make sure only what you expect gets uploaded and saved

The page on Unrestricted File Upload on the OWASP web site has some very good explanations on the subject.


Whether a data leak is because of internal or external factors does not matter. In the situation you describe the UK company is the data controller and solely responsible for taking the appropriate measures to avoid data leaks. Even if they used a processor this processor may be liable, but the UK company is still responsible.

See the basis for all European Data Protection law, the 95/46 directive.

You can file a complaint with the ICO, the UK data protection authority, their conclusions will greatly help you in any legal follow-ups.

Keep in mind that for compensation you will likely have to illustrate that you suffered damages and need to show how you quantify these damages.


SSH keys are OK regardless on your company size.

Let's get deeper in the PCI DSS (extracted from the version 3.0, but also in 2.0) :

8.2 In addition to assigning a unique ID, ensure proper user-authentication management for non-consumer users and administrators on all system components by employing at least one of the following methods to authenticate all users:
*Something you know, such as a password or passphrase
*Something you have, such as a token device or smart card
*Something you are, such as a biometric.

"at least" : one of the 3 options above is OK.

Official guidance about "something you have" :

 Note that a digital certificate is a valid option for “something you have” as long as it is unique for a particular user.

Conclusion :

SSH keys are compliant as long as each SysAdmin have its own keys pair.

In must add that best practices (and so PCI DSS req 2) will require to protect private key with a strong passphrase.


In practice, does TPM SRK really be decrypted by EK first, before it decrypt its child keys

The SRK is not encrypted by EK. Both are not required to be encrypted at all. Their security are based on their physical protection and the logic of the TPM itself - no API are to provide their private portion.

The fact that some TPM requires some special operation to create EK after manufacturing is describe in the spec. Please see page 15 or so from Protection Profile PC Client Specific Trusted Platform Module TPM Family 1.2.


PHP: Save e-mail address hashed or plain

Hashing is a one-way function. Encryption can be reversed with a key; hashes cannot. The only time you'd use hashing is if you don't care what the value of something is, you just want to check that it's equal to what the user just typed in. In particular, if you hash the email addresses, you will never be able to send mail to the addresses. Since you want to send mail to the addresses, you cannot hash them.


Authentication of temporary worker without a badge (physical security)

Some years ago we used "generic" badges with the word Contractor and a number.  There was an intranet page with the names of current contractors and their badge numbers.  Contractors were required to wear their badges and told they must produce picture ID (like a driver's license) on request of anyone wearing an employee badge.

This was in a medium-security environment with few contractors or temporary workers, and it worked pretty well.


PCI 3.6.6 cryptographic key procedures include split knowledge

At some point you will have to trust some code, somewhere. This is why audit procedures involve source code review and background checks on developers.

For the practical way to split and reassemble a secret, a reasonably strong way is to make the reassembly only on a "safe" machine, under visual scrutiny of the secret part holders. A "safe" machine can be a laptop which:

Is kept in a safe or a reasonably sturdy locked cupboard when not in used.
Is booted off a CD-ROM or a write-protected USB key when it should be used.

This kind of thing can be arbitrarily expanded upon, depending on the amount of safety or paranoia you have to contend with (e.g. put the machine in a bunker with armed guards; hire external auditors whenever you come close to the machine; use Hardware Security Modules to run the code which uses the rebuilt secret...).


How does Windows Hello recognize me with a mask on?

Any kind of biometrics (actually any measurement), including facial recognition, is subject to False Positives and False Negatives . In practice the algorithms are tweaked to favor one over the other as a function of context.
A super secure Alien Autopsy Lab at area 51 would favor False Negatives as the preference is to block even a few people who are authorized rather than take the chance of admitting uncleared people.
A general purpose user access system like Windows Hello favors False Positives because with a huge number of users (many millions), blocking out a significant percentage of valid users would be a firestorm of complaints.
I'm not sure of exactly what criteria Windows Hello uses, but it's almost assuredly very weak criteria.
As for IR, that's near infrared in the 1 micron region, i.e. barely redder than red. It's not capable of peering through a mask.
-- addendum --
Microsoft has some very specific statistics on these rates, but they are too specific to be reliable. Actual testing of facial recogniton systems vary widely, specifically they vary with Race and Gender so a single statistic is questionable.


This looks like part of an attempt to exploit CVE-2018-7600 aka SA-CORE-2018-002, the vulnerability that was fixed in Drupal 7.58 (and 8.3.9, 8.4.6 and 8.5.1). This was being widely exploited at the time this question was asked.

If you were already running a fully patched Drupal then you were not vulnerable to this attack. However, Drupal 7.58 is now known to be vulnerable to a similar attack, so you should make sure to update to the latest version, if you haven't already.

Generally anyone using Drupal should make sure to keep both Drupal core and any modules and themes they use up to date (this is true of all software). Drupal publishes its security announcements, along with information about how to get notified when they become available, at https://www.drupal.org/security.

If you have any Drupal sites that are still not patched, see https://www.drupal.org/docs/develop/security/your-drupal-site-got-hacked-now-what.

If you're interested, you can add $conf['sanitize_input_logging'] = TRUE; to your settings.php file (on a fully patched site) to enable additional logging of detected attempts to exploit this issue. You will then start to see messages about "Potentially unsafe keys removed..." in your watchdog log when an exploit attempt is detected.

The original attack (for Drupal 7) is in two parts. The first part makes a crafted request to a page with a form, usually the password reset form, to store a special value in a cache; the second requests the /file/ajax... URL in a way that tricks Drupal's form API into misinterpreting the cached value and  executing some code contained within it. The first request is the one that will be sanitized by the fix in Drupal 7.58. The second is what you're seeing in the log here. (The additional fix in Drupal 7.59 adds additional sanitization for both). The random value is the cache key, known in Drupal parlance as the form build ID.

I guess an exploit of CVE-2018-7602 might look similar, although the announcement seems to indicate this one isn't exploitable by an unauthenticated user, and in any case details weren't public at the time.


The main problem with your code is that it isn't vulnerable to a buffer overflow more than likely due to the compiler (are you using gcc?) replacinggets withfgets

If you strace the above compiled code (with malicious input) you should see what I mean.


Is it possible for a 3rd party to own a sub-domain of my xxx.com site?

No, other folks cannot own register subdomains for a domain which you have already registered.

Here's the ownership tree.

The domain name (e.g. example.com) is registered by you with a Registrar. (e.g. Namecheap, Network Solutions, etc.)
On the registration, you can designate Nameservers. (DNS Servers) The nameservers provide a listing of subdomains, and where they are hosted.
For every subdomain, there is a designated Host. The Website and Email can be hosted separately, and you can also have separate Hosts for each subdomain if desirable.

  I have just checked and found that I have a number of subdomains live, which re-direct to sites which I don't recognize.

In your case, it sounds like either a) someone has added subdomain entries to the DNS so that they are hosted elsewhere, or b) the subdomains could be hosted in the same place as your main site, but something about the website configuration is causing the redirects you describe.

  From a Security POV, should I be worried about these sites?

Yes. Since this is your domain, and you control the Registration, (#1 above) you should be able to dictate what happens to all the subdomains. If you are unaware of these, you should get some IT person involved who can determine whether the faulty entry is at the Nameservers, or the Host, and help you to resolve the problem.

Feel free to ask additional questions if that would be helpful to you.


Is it a good idea to sign into your Android TV using your regular google account?

The Google Slides app is compatible with my Android TV -
https://play.google.com/store/apps/details?id=com.google.android.apps.docs.editors.slides&hl=en_GB

From memory I believe I can install apps without a password. I believe even changing Google Play to require authentication for purchases will not enforce this for free applications.

So yes - it is possible to access google data via applications.

If this is not desirable then you either need to use a different Google account or use something like AppLock to restrict access to Google Play and any other applications with permissions you aren't happy sharing with other TV users.


Should I contact the manufacturer if their product allows access to other users' location information?

Yes, you should notify the problem to the company - with caution.
Update: a shorter, very complete answer was supplied by @crovers. But if you have patience...
...the problem here is not simply the possibility of tracking J. Random Stranger, but rather that:

once your ID has been given to someone, apparently you cannot take it back and it does not expire. That person can now follow you everywhere (think "overly attached girlfriend"). Also, that ID may leak. Emails get forwarded by mistake and sometimes the little, easily overseen ... glyph in mail programs covers lots of sensitive information.

you don't even need to give it to me. If the IDs are sequential [as commented by @crovers], I can tabulate all of them in very little time, check their position, and easily single out those five or six that are near enough to the position I know you might be in. Tomorrow, other five or six will be near enough a different place you're now in; of those five, maybe two were in the original five, so you must be one of those two. In a comparatively little time I've narrowed my candidates to one: I now have your ID and can stalk you, and you are none the wiser.

I may even not know you. The ID can be used to prank total strangers. I just googled a bit and found a couple thousand Facebook users that boasted of their new (NAME OF GPS-RELATED GADGET). I used a very well known brand, so your gadget will have maybe only one hundred people that I can discover easily. A full half of those, I'm confident, will routinely post pictures about where they are (does Facebook purge EXIF GPS information?).
In a very little while, one of them that caught my fancy might receive a message stating "How's the weather in Old Nowhereville?" even if he (or she) never said anything to anyone about where he (or she) was, nor even posted anything anywhere. Such pranks - and knowing that some total stranger is apparently interested in you, and always seems to know where you are - can totally ruin your day.
And they can totally ruin the company's day, if some pranked people get convinced that their GPS can somehow be "hacked remotely", even if, as in this case, that's not what's happening at all. Yes, I have a sick mind - but I'm not the only one, so you might want to point the company's people to this page - and, to restate another very good point made by @crovers and Arminius, do so anonymously. The potential damage to them is huge, and you're doing them a big favor by pointing this to them. But some companies might have a (knee-)jerk reaction and try to bully you into silence believing this solves something (or even solves the matter entirely); Nobel Prize Richard P. Feynman's "vulnerability disclosure" story makes for a hilarious reading ("That was his solution: I was the danger!").

You're actually helping them.

trust me, lots and lots of people would do exactly what you did when seeing "id=XXXXX" in a URL. I  would have done it. Depending on the gadget's popularity, I'd wager many others will already have done so. So it's not like you're unleashing a zombie apocalypse over someone which otherwise would have remained safe - you'll probaby simply be the first to have had the conscience of telling them they are not safe at all. Because that's significantly rarer than having the curiosity of changing a ID.

It totally hadn't to be like this.
It is trivially simple, from the company's point of view, to fix this by allowing each user to regenerate a different secret ID on demand any time they choose. And even set an expiration date. And they still could do it now.
A very quick fix could be to proxy their website through a simple filter, connected with a database.
Your new URL is, say, http://www.example.com/mylocation/?id=22b255b332474ae3e7f008cc50ebe3e0&...
or one could translate that to "true.pony.pile.main.jazz.call.mine.soft.pink.rake.jane" to get something more easily remembered or dictated over a phone.
the first four words are somewhat connected to "correct horse battery staple".
The proxy checks in a database and finds that 22b255b332474ae3e7f008cc50ebe3e0 is a valid ID, and is associated to "real" (or "old") id 12345, so it transforms the URL by simply replacing the ID with 12345, sends the request to the true, hidden website, gets the page back, rewrites any 12345's with the original 22b2... stuff, and hey presto!, the external user can see where you are, same page as before, but he has no way of knowing that the true ID is 12345 (and, even if he knew, he'd have no way of getting it through to the system, which now only accepts hashes).
But now, user 12345 can have as many IDs active as the company wants (or sells!), and give one to his mom, one to his SO, and so on. One ID leaks, or he breaks up with his friend -- he invalidates that one ID. It also becomes possible to know how many accesses there have been to each ID, so the snooping can be two-way. Possibly for premium users only :-D. For some IDs, the website may even release randomized information, or low-precision GPS coordinates.
And if you wanted to guess at random a valid ID - well, there are some 2128 of those. If each customer had one hundred disposable IDs (say 27), and the company had one billion customers (say 230), there would still be approximately one possibility over 290 to get a valid ID by trying at random. If that's too little (or if my math happened to be a bit askew), there are larger hashes too.
And the old ID no longer works since you can't reach the original server without the ID you supply getting hashed.
Given the reasonable implementation cost (a couple day's worth for one developer and one QA engineer, and I'm padding heavily), I'm a bit baffled that this wasn't designed in from the start.


Firefox Add-ons not using HTTPS? Security bug. (?)

Mozilla extensions, no matter what the download site says, are served through this URL:

http://releases.mozilla.org/pub/mozilla.org/addons/NUMBER/EXTENSION_NAME.xpi

But, here is the thing: releases.mozilla.org is load-balanced through DNS, it's used like a Content Distribution Network. Here is the dig result:

;; ANSWER SECTION:
releases.mozilla.org.   60  IN  CNAME   releases.geo.mozilla.com.
releases.geo.mozilla.com. 60    IN  A   216.165.129.141
releases.geo.mozilla.com. 60    IN  A   64.50.233.100
releases.geo.mozilla.com. 60    IN  A   64.50.236.52
releases.geo.mozilla.com. 60    IN  A   64.50.236.214
releases.geo.mozilla.com. 60    IN  A   128.61.111.9
releases.geo.mozilla.com. 60    IN  A   129.101.198.59
releases.geo.mozilla.com. 60    IN  A   131.188.12.212
releases.geo.mozilla.com. 60    IN  A   155.98.64.83
releases.geo.mozilla.com. 60    IN  A   156.56.247.196
releases.geo.mozilla.com. 60    IN  A   204.152.184.113
releases.geo.mozilla.com. 60    IN  A   204.152.184.196
releases.geo.mozilla.com. 60    IN  A   204.246.0.136
releases.geo.mozilla.com. 60    IN  AAAA    2001:6b0:e:2018::1337

Those are all the IPs that domain can take, you can hit a different server every time you use the URL. They are all different servers, usually hosted in various universities around the world.

And here comes the problem:

The result of tests I did just know confirm that none of these servers supports HTTPS connection.

So if you blindly try to reach https://releases.mozilla.org/pub/mozilla.org/addons/NUMBER/EXTENSION_NAME.xpi the request will fail, or will take too long because some of the servers don't immediately refuse the connection so it has to time out.

time wget https://releases.mozilla.org/pub/mozilla.org/addons/138/stumbleupon-3.81-fx+sm.xpi
https://releases.mozilla.org/pub/mozilla.org/addons/138/stumbleupon-3.81-fx+sm.xpi
Resolving releases.mozilla.org... 129.101.198.59, 131.188.12.212, 155.98.64.83, ...
Connecting to releases.mozilla.org|129.101.198.59|:443... failed: Connection timed out.
Connecting to releases.mozilla.org|131.188.12.212|:443... failed: Connection refused.
Connecting to releases.mozilla.org|155.98.64.83|:443... failed: Connection timed out.
Connecting to releases.mozilla.org|156.56.247.196|:443... failed: Connection refused.
Connecting to releases.mozilla.org|204.152.184.113|:443... failed: Connection timed out.
Connecting to releases.mozilla.org|204.152.184.196|:443... failed: Connection refused.
Connecting to releases.mozilla.org|204.246.0.136|:443... failed: Connection refused.
Connecting to releases.mozilla.org|216.165.129.141|:443... failed: Connection refused.
Connecting to releases.mozilla.org|64.50.233.100|:443... failed: Connection refused.
Connecting to releases.mozilla.org|64.50.236.52|:443... failed: Connection refused.
Connecting to releases.mozilla.org|64.50.236.214|:443... failed: Connection refused.
Connecting to releases.mozilla.org|128.61.111.9|:443... failed: No route to host.
Connecting to releases.mozilla.org|2001:6b0:e:2018::1337|:443... failed: Network is unreachable.

real    **9m31.370s**

It took 9:30 minutes for the request to finally fail (I don't have IPv6 connection right now so I don't know if the last server supports it, but I doubt it).

For third party verification this helps: https://www.ssllabs.com/ssldb/analyze.html?d=releases.mozilla.org

Just to make it clear: Extensions like HTTPS Everywhere will not work - in fact I tested it and the addon is still served through HTTP (it does not rewrite releases.mozilla.org - if it did, you wouldn't be able to get the extension.)


Why do Browsers warn about self-signed certificates but not about plain HTTP (which is not even encrypted)?

They warn you because a self signed certificate could be a sign of a MITM attack where an attacker is attempting to get you to send them important credentials under the guise of a secure connection.

The major reason a browser wont warn about plain HTTP is because its far too common on the internet and would just be annoying for most users. One thing browsers do warn about however is if there are elements of a page being delivered over HTTP in an HTTPS page (ex. when a page loads elements from a different page and embeds them onto the page).

The reason browsers throw these scary messages for self signed certs is because they don't want inexperienced users adding random certs to their trusted list. Again, someone could MITM a connection, send their cert to you and pretend to be the site you are attempting to visit. Yes this can be done over HTTP too but many sites deliver at least a logon page over HTTPS so it is beneficial to users if browsers check since they could prevent your credentials from being compromised.

And on top of that, if people make self signed certs they could be working under a false sense of security. SSL isnt the most simple idea and even very large companies struggle with it, just look at how Dell messed up with their cert. The idea is to discourage the use of self signed certs, so that users can have the benefit of having a third party verify the legitimacy of a certificate.

The matter of CAs being irresponsible with their power however is another matter and can cause issues if they make bonehead decisions.


Conversant, CNAME, Cookies, and PCI complaince

Cookies that are used to maintain session state must have a limited scope.

Using JavaScript track users by their session id,  means you can't use the httpOnly cookie flag. Scoping cookies to *.foobar.com means that XSS on *.foobar.com could compromise this cookie value. Or to put this another way, if a session id is scoped to *.foobar.com and doesn't have the httpOnly flag, then every domain on *.foobar.com is permitted to compromise a session using XSS.  In the context of PCI compliance,  this specific design would greatly expand the attack surface that needs to be regularly validated.

One solution is to use another randomly generated token for the purposes of tracking users, and then protect the authenticated session id as a separate cookie value.


You can offer your service on a Tor .onion site, with instructions on how to connect to it on a standard website. This will enable anyone who wants to remain anonymous to connect to your survey (or whatever) over the .onion site, which will make it impossible for you to figure out who they are based on their IP.

If you only allow people to take the survey through your .onion site, you'll probably lose a large number of people because they won't want to download the Tor browser just to fill out your survey. So, if regulations allow for it, what I'd do is offer your survey, or whistleblowing report, or security issue report, or whatever it is, through both a normal website reachable over https:// and an .onion site.

This is how wikileaks and (I think) the New York Times do it.

Edit: Correction: It's the Guardian I was thinking about, not the New York Times. See https://securedrop.theguardian.com/


Your question is very open ended, so it's a little hard to be specific enough to be helpful.  I would suggest looking outside Android at (a) techniques used to detect malware and (b) techniques used to avoid detection.
As an example, some malware scanners look for specific binary string matching a payload, and the response from malware writers is along the lines of Metamorphic Code (https://en.wikipedia.org/wiki/Metamorphic_code)... which is basically having the code swap out different instructions with identical outcomes (eg, replace x = 5; with x = 3; x+=2;).  Similarly, some applications will compress & encrypt their payload code and build in a decompression/decryption routine.
Note that malware detection is usually a proprietary game, so usually your best bet is to start with the specific detection tools and try different things to see what it is they're picking up on exactly.


iOS: intercepting passcode before it reaches secure enclave

I somehow get root access

That's a pretty big if.
If that were true and subsequently the device had been unlocked at least once then I wouldn't bother intercepting the passcode, according to the iOS security guide:

When a file is opened, its metadata is decrypted with the file system key, revealing the wrapped per-file key and a notation on which class protects it. The per-file key is unwrapped with the class key, then supplied to the hardware AES engine, which decrypts the file as it is read from flash memory.

As root I can presumably open any file I like and read the unencrypted content.
The only limitation of this is that you couldn't learn the passcode at one time, then use it some time in the future to access some data which wasn't originally present. However, I have doubts about whether you could modify the passcode software to intercept the data and send it to you:

When an iOS device is turned on, its application processor immediately executes code from read-only memory known as the Boot ROM. This immutable code, known as the hardware root of trust, is laid down during chip fabrication, and is implicitly trusted. The Boot ROM code contains the Apple Root CA public key, which is used to verify that the Low-Level Bootloader (LLB) is signed by Apple before allowing it to load. This is the  first step in the chain of trust where each step ensures that the next is signed by Apple. When the LLB finishes its tasks, it verifies and runs the next-stage bootloader, iBoot, which in turn verifies and runs the iOS kernel.
This secure boot chain helps ensure that the lowest levels of software are not tampered with and allows iOS to run only on validated Apple devices.

So you might be able to modify the software temporarily but I doubt you could do it permanently because the system software would be re-verified next boot.
I also strongly suspect that as root you could access some of the derived keys which would render the passcode moot, such as the file system key:

The key that encrypts each file’s metadata, including its class key.
This is kept in Effaceable Storage to facilitate fast wipe, rather
than confidentiality.

"Rather than confidentiality" sounds to me like it could be read as root and subsequently use it to decrypt the whole file system.


Do most browsers handle mixed encrypted and unencrypted content correctly?

Yes, it does add to security and yes it should be done but security is often neglected over usability.

For example the Chrome notification is barely even present as opposed to the firefox popup. More importantly, to actually prevent such a threat the browser must not only notify the average user (who would have no idea what's doing on) but also give the option to load or not load unsecure content in a manner where he understands that there are risks involved.

In such a case, the browser requires the technology to prevent HTTP content from loading and allowing HTTPS to load. This as you know can have several effects on the page. As time passes I'm sure other browsers will developer similar technology to be able to isolate HTTP and HTTPS content and then give the user an option to load or block it each time they encounter such a page.

As far as security is concerned about mixed content in technicality, it really depends on what is going through. A good example is going to a company's website doesn't require open public knowledge to be loaded in HTTPS, but your log in does.

Ultimately its is the question of user privacy, wherein HTTPS  triumphs, but the average user is unaware of this, and websites do not want the extra effort to make the entire thing HTTPS.

Firefox Similar Bug Report: https://bugzilla.mozilla.org/show_bug.cgi?id=251123


In fact, there is some research addressing the problem. We should acknowledge the fact storing fingerprint info at the client side (as suggested by others) might not be a viable solution in specific cases. It might be ok for a cell phone, but insufficient for an enterprise or distributed service.

There are (non cryptographic) hash functions which can create the same hash for similar input. It is called Locality-Sensitive Hash (LSH) and extensively used in search algorithms. This functions can "reduce the differences occurring between similar data with high probability, whereas distant data should remain significantly remote." Then you may try to crypto-hash the LSH for a more error tolerant result. You may combine this with Bloom filter as described in this 2009's article which I warmly suggest to read if you are interested in the topic. Unfortunately I'm not aware of any existing implementation of the method described there.

In summary, the answer is that you can do this with fault-tolerant encryption methods (like above), but if you are in short of time you might be better off with a separated, dedicated secure provider for fingerprint-UID conversion (with a machine gunner sitting on it).


Are there any reliable estimates of the password cracking abilities of nation states?

It is in fact doubtful that "Nation States" are really interested in cracking bcrypt. Cracking bcrypt is what you do when you purloined a list of password hashes from a Web site, and want to obtain some of the passwords to be able to log into these accounts, on that site, or on other sites under the assumption that people tend to reuse passwords. Logging into accounts is active: it tends to leave traces. Spy agencies who deal with some "serious customers" (people who plant bombs, not people who send spam emails), usually, abhor leaving traces of their activities.

What a Nation State would really love is to be able to break password-based encryption, the usual suspects being then GnuPG (with the command-line option -c to password-protect a file) and TrueCrypt (for the people who still use it). Neither uses bcrypt as password-based key derivation function; GnuPG uses its own construction called Iterated and Salted S2K, while TrueCrypt relies on PBKDF2 with 1000 or 2000 iterations (depending on the underlying hash function). There are various estimates of how fast one can go about cracking passwords with these functions; this depends on the number of iterations, which may vary (especially with GnuPG, where this is done with a simple command-line option). See for instance this question for some discussion and pointers.

Basically, both for GnuPG and TrueCrypt, the easy, efficient, and above all discreet hardware to use is GPU, because these are off-the-shelf and benefit from very high production volumes, thus allowing for heavy cost reduction. While theoretically some dedicated ASIC would be even better (almost by definition), it would take a huge number of units (think millions) to actually make it worthwhile from the attacker's point of view. In the case of bcrypt, we often talk about FPGA because bcrypt is quite GPU-unfriendly; but this does not extend to PBKDF2 and OpenPGP's S2K, both hugely benefiting from GPU and making FPGA, comparatively, less attractive.

In my experience, governments are very good at spending money, but not necessarily at getting their money's worth. This partially comes from the fact that a government is not a business, and thus does not have much incentive in terms of cost reduction and RoI. However, let's suppose that, by extraordinary, some big Nation State actually achieved efficient usage of taxpayer money. Then we can make estimates.

For really serious attackers who think in the long term, the dominant cost is electrical power; that cost exceeds the cost of buying and replacing the hardware. For computing centres, the relevant notion is that of Power Usage Effectiveness, which qualifies how much extra energy is needed when feeding your hardware (for cooling, lighting and so on); a PUE of about 1.2 would be already quite good (that's about what Amazon, Microsoft and Google say they achieve). For some discussion on PUE, see this report, especially section 4.

Let's throw some figures at it. An AMD R9 290X can compute about 4 billions of SHA-1 per second (see this site); a 2000-round PBKDF2 with SHA-1 involves 4000 SHA-1 invocations (2000 HMAC/SHA-1 calls), so that's 1 million per second on that GPU. That beast is rated at 250W of Thermal Design Power, a figure that we will use for our estimates (in fact, GPU involved in such compute-intensive tasks tend to consume more than their advertised TDP). Thus, in one hour, the system will hash 3.6 billions of passwords, and consume 300 W·h (250 W·h for the GPU, but this becomes 300 with a PUE of 1.2). Average electricity cost in the USA is about 0.10$ per kW·h, so this put the cost at 0.03$ for hashing 3.6 billions of password. Said otherwise, for 1$, you get to hash 120 billions of password. This is close to 237 so let's keep that figure.

Now, the NSA has an annual budget estimated to a bit more than 10 billions of US dollars (the real budget is classified, but the money comes from taxes so it can still be estimated quite accurately). Assuming that they spend all of it on cracking TrueCrypt passwords, and do so very efficiently (both notions being quite preposterous), then this would allow them to crack up to 10 billions of passwords with an average entropy of 38 bits, per year (38 and not 37, because on average brute force explores half of the space before succeeding). I find it utterly improbable that they could really achieve even 1/100th of that performance, though -- both because they have a lot more other things to do with their budget, and because I don't believe that they would achieve Google-like efficiency. That would put them at 100 millions of passwords per year, as long as the passwords have 38 bits of entropy on average.

While 100 millions if a huge figure, remember that entropy can bite them hard. If they stumble upon a password with 66 bits of entropy (e.g. a password generated with the correct horse method expanded to 6 words, thus still highly human-compatible), then it would take the NSA 2.5 years to crack that password (on average), and they would not be cracking other passwords during all that time. The password had better be valuable -- and the terrorists would also have to be courteous enough to delay the execution of their nefarious plans for a few years, so that the NSA has time to catch up.

Note that TrueCrypt is not very good, as far as password hashing is concerned. It uses PBKDF2, which can be very efficiently optimized on GPU (contrary to bcrypt). It uses only 2000 iterations, a very meagre value. And yet, a single human-compatible password can still defeat the whole of an idealized NSA that would have magically become more efficient than any other government agency in the World.

Presumably, an efficient government agency involved in cracking passwords would have made the same estimates as above, and concluded that they'd better not invest all their budget into password cracking, since it can be so easily defeated. From this I conclude that password-cracking abilities of Nation States are not as high as they are often cracked up to be.


How is HTTP converted to HTTPS when no HSTS is present?

The site is manually redirecting you to the HTTPS version of the site, typically using the HTTP 301 redirect status code. This is not as secure as HSTS because it is vulnerable to a MITM attack, but it does cause you to transparently switch to the encrypted version of the site. This behavior must be configured in the server to work. The server can either be made to automatically perform the 301 redirect on all pages, or only for certain pages such as those with password input fields.
The client first sends a request to the non-encrypted version of the site:
GET /index.html HTTP/1.1
Host: www.example.com

The site then responds with a redirect:
HTTP/1.1 301 Moved Permanently
Location: https://www.example.com/index.html

This instructs your browser to send another GET request, this time to port 443 with TLS.
Note that, even when HSTS is used, this is still necessary for the first connection. HSTS headers are only allowed to be set over the HTTPS protocol, so a redirect is usually used to tell the browser to use the encrypted protocol the first time. Only after that will the browser remember that it should rewrite all requests to the encrypted version of the site without being told first.


Is there any security risk allowing regular Linux users to run arbitrary code?

There is always some risk and in this case if the system isn't hardened internally it might be trivial for a "user in the know" or a bad actor to access other users data in a matter of minutes if not seconds.

In this case you still have all the local privilege escalation issues and local security hardening issues which could allow local users to become root or run things as root or simply give them full access to the other users data. In many ways this is much harder to secure than trying to secure a system from the outside. That said it's not that you cannot add a lot of security controls to protect yourself from the users or that it can't be done but it requires much more work.

It may be wise to look into setting up a chrooted environment keeping in mind that you still need to harden the system from insider attacks. Likewise it would be wise to send all of your logs off to a remote system on the off chance a user does escalate privileges it will be harder for them to hide this.

Keep in mind there may be easier ways to solve your end goal and that sometimes it's worth taking a step back to look at where all the security trade-offs are and what you are actually trying to accomplish.

The following Linux Security Hardening guides may be helpful. You may also want to run a tool similar to Nessus to look at your local risks.

CIS Security Benchmarks
http://benchmarks.cisecurity.org/downloads/browse/index.cfm?category=benchmarks.os.linux

NSA Operating systems security configuration guides
https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml#linux2

NIST sp800-123 Guide to General Server Security
http://csrc.nist.gov/publications/nistpubs/800-123/SP800-123.pdf

Matt Brock Security Hardening on Ubuntu Server 14.04
http://blog.mattbrock.co.uk/hardening-the-security-on-ubuntu-server-14-04/

Hardening IPTables config with limit rates
https://petermolnar.eu/linux-tech-coding/hardening-iptables-config-with-limit-rates/

Linux Server hardening security tips
http://www.tecmint.com/linux-server-hardening-security-tips/

Hardening your TCP/IP Stack against SYN Floods
https://www.ndchost.com/wiki/server-administration/hardening-tcpip-syn-flood

IBM guide to hardening Linux
http://www.ibm.com/developerworks/linux/tutorials/l-harden-server/index.html


DDoS: Why not block originating IP addresses?

Let's say that you run a shop. Every day, you might get a few hundred customers.

One day, you get tens of thousands of people coming in, who get in the check-out line, buys a trinket, and then gets right back in line to repeat.

Obviously, you are losing business from authentic customers who must wait hours in line.

Now, you hire a security guard at the entrance to verify that these customers satisfy some criteria.

However, there's still tens of thousands of people who want to get in. The only difference is that now, everyone must go through security.

You notice that, from the authentic customer's perspective, you still wait hours in line, just that now it's just to get through security!


You can use a terminal emulator and execute the following:

shell@android:/ $ cat /proc/net/tcp

That will list open ports.

Alternately, install an app like OS Monitor.

If you want to close any, use a Firewall app.


Windows 10 Latest patch can protect cold boot attack?

No.

DDR3 or DDR4 RAM still have vulnerability?

DDR3 and DDR4 retain memory for a shorter period of time than DDR2, but cold boots are still possible. DDR4 additionally uses memory scrambling (for purposes of electrical reliability), but the scrambling algorithm, which is an LFSR, is not designed for security and can be broken.

Is there another way to protect rather than BitLocker pin?

A BitLocker pin does not protect from cold boot attacks.
Some modern AMD CPUs support full and transparent memory encryption called SME and branded as "Memory Guard". I don't know if you can enable the full memory encryption from Windows. Other than that, all you can really do is use physical security. Use strong encryption, and always turn off your computer before you leave it unattended. As long as you are with your computer for a few seconds after it has powered down, the chances of recovering any memory quickly becomes nil.


Shall I enable 'send all traffic over VPN' on my Mac?

This depends upon what threats you are trying to mitigate against.  By using a VPN you are essentially changing then end point of you traffic, or where it connects to the Internet.  If you are using an insecure WiFi connection this will encrypt and thus protect all of your traffic that traverses the wireless network.  This is significantly more secure then passing all of your Internet traffic over and open/insecure network.  However you are only moving the "on ramp" that you are using to connect to the Internet.  If you are concerned with your Internet Service Provider monitoring your connections to particular networks this is also a good technique to use.  Using a VPN will not however give you and end to end secure connection, so if you are using insecure protocols such as HTTP or email in plain text then you are just as insecure once that traffic reaches the public Internet.  Using a layered approach including multiple layers of encryption both at the protocol level and at the network level (VPN) afford you the most security.


ISP glitch or a malware? Has this ever happened to you?

You're either behind a malicious proxy/VPN or your host file is effected. Most likely the latter.

On windows 8 you can check your hosts file here

C:\Windows\System32\drivers\etc\hosts

Remove any lines with strange IPs. Infact you can remove everything if you aren't running any cracked software or have routes setup for a web server.

This could also be DNS poisoning on your local network, so be sure that's secure too.


Cookie tossing is an attack which abuses the feature that a subdomain can put a key=value pair in a cookies which can then also be read by the domain above it. For example, when security.stackexchange.com sets a cookie, stackexchange.com will be able to read it. Unfortunately there is no way for stackexchange.com to see if the key=value pair comes from stackexchange.com or from security.stackexchange.com. So when stackexchange.com uses the same key for some of its own functionality, it might mistake the value from the subdomain for its own value and treat it as if it set it itself.

This becomes problematic when a website allows untrusted people to host subdomains under its domain. They can then abuse this feature to write manipulated cookie information. The ability to take over a session this way is limited, because the attacker can only write information, not read anything. However, setting arbitrary cookie values can in some cases be used for a CSRF attack or an XSS injection, depending on what the main domain does with the content of the cookie.

Protecting your website from this is easy: When you use cookies for anything on your main domain, don't let anyone you don't trust put their content on your subdomains.


Windows - How to restrict access to VBScript.dll and JScript.dll?

Point 1 - Restricting access means to block certain user groups from accessing these files. You don't want them to use them or interact with them.

Addressing point 2 - how to restrict access, I suggest using App Locker to block this.

In Local Security Policy, expand Application Control Policies -> AppLocker

1a. Before proceeding - select configure rule enforcement -> advanced -> Enable DLL rule collection, apply -> back to enforcement tab, at the bottom under DLL rules: check configured and then press ok.
Right click DLL Rules -> Create New Rule
Select Deny and the user or group who it should be denied to
Since the Path of the file can be changed, select the File Hash option for blocking
Browse to the file in question, and add it
Create!


How much access to the file system does the recent Drupal vulnerability give?

The vulnerability allows remote code execution, meaning that you can perform arbitrary actions (like performing file system operations) with the privileges of the web server process on the remote host. You can imagine the attacker actually sitting in front of the compromised computer and typing commands in the console.

Here's how Remote Code Execution is achieved: https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html


How secure is an IP whitelist compared to other web service security mechanisms like a passphrase?

Within a network segment (e.g. an Ethernet network in an office) IP spoofing is fairly easy with tools like Ettercap, so a passphrase is much more secure.

On the wider Internet, IP spoofing a TCP connection is definitely not trivial. It's possible with BGP poisoning and maybe some other techniques, but not something your average pen tester can do. Still, I'd say a passphrase is more secure.

IP whitelisting is difficult to deploy, as a typical user will use different IP addresses - home, work, mobile - and most of these are dynamic IPs. You can often use it to whitelist whole organisations, as a company will typically have a single or a small number of outgoing IP addresses, and this can cover mobile users who connect to the office with a VPN. The main limitation with this is that you normally want to control access to individual users, not whole organisations.

Where IP whitelisting can be really useful is as an additional control mechanism to a passphrase. Quite a lot of business SaaS platforms offer this as an option. If you configure it, it means employees can only log in from work (or via VPN), not from home. This keeps business data on business workstations. And when someone leaves the company, they lose access to cloud services, even if the admin forgets to disable their account on that service.


Why isn't applying security and usability best practices enough?

I think you dropped an important word in the homework question. "Applying  security and usability best practices simultaneously isn't enough to create a secure and usable system."

The concept being explored by the question is the intersection of usability and security. The most usable system is not secure, and the most secure system is not usable. If you try to be the best of both, you'll fail at one of them.

For instance, a security best practice is to use passwords. But passwords are horrible for usability. How and where do you draw the line between a secure system and a usable system?

So, the idea that I think you missed is not the idea of following best practices, but trying to follow different best practices at the same time that tend to be at odds with each other.


how to identify all packages in a Linux distribution which requires root access?

To some extent, it is infeasible. You may run a firewall to manage such problems. If you want to do some, the comments other users have given to you are the most you can really think to do.

There are reasons why such classification is generally infeasible.
Then there are a few packages which files are encouraged not to be run but with high permissions.

You always need to refer to the specific system you plan to install the package into; therefore, such classification cannot be solely per-package. Examples:

File permissions may differ -after- the installation.
Even if the permissions won't change throughout the package's files, you can allow non-root users to use (some of) them by simply modifying your system groups.

You cannot rely uniquely on file permissions, but you shall know specific behaviours and semantics of binaries and scripts. Examples:

Take a simple HTTP server. Generally, it opens a port 80. Port 80 is below 1024 and you need advanced permissions. But if you change some conf file to a high port, then you won't need advanced permissions any more. Yet, the package is the same.
Moreover, how will you know IF the package has got what configuration files? If more than one?
What if you have a service accepting input from file rather than socket? (The file may be in a remote filesystem).

Finally, some package is intrinsically ambiguous by the classification you aim to do. Example:

If you want to make partitions your USB stick using some foo application, likely you are not gonna need any high privilege. However, the very same application foo may be used to change the partition table of the running system, which is likely a high privilege operation.

Perhaps there are other reasons, but I cannot think of them right now.


Privileged access management vs named accounts

I don't think it's reasonable to limit the response to a single commercial
product.  Looking at the question more generally:

There are a few basic strategies to control access to high-privileged
access (root, Administrator and the like) on systems:

Create a personal admin account for every human that may ever
need one.  Users may know the passwords to these or they may
be asked to sign into these via a PAM solution.
Have one or a few shared high-privilege accounts and control
access to those with a product such as Cyber-Ark, Hitachi ID
PAM or similar.
Create accounts dynamically and delete them after each use.
Have users sign in with normally unprivileged accounts but
at runtime assign them additional group memberships / privileges.

Personal, named accounts with elevated privileges make sense if:

You only have a limited number of systems and people who need
elevated access.  Imagine a larger IT team with 100 administrators
who need access to 10,000 systems, where systems are onboarded
and retired at a rate of hundreds per day and staff come and go
at least weekly.  The pace of creating/deleting high privilege
personal accounts and managing passwords to those would be cost
prohibitive.
You are OK with password-only authentication.  Most systems either
do not support 2FA or require very complex and possibly fragile
configuration to support login with more than just a password.
Built-in audit logs are adequate.  You don't need to play back
a video of user interaction with a privileged login, for example.

PAM systems can secure personal, named admin accounts by removing
user knowledge of passwords, by randomizing and vaulting passwords,
by introducing 2FA and with good authorization models and audit logs.
They don't eliminate the administrative burden of personal admin
accounts, however.

Some people talk about "Privileged Identity Management" but this
is a really dumb label because these products don't generally
create or delete accounts, they control access to existing
accounts, hence PAM not PIM.
Some PAM products let users request temporary group membership
or temporary SSH trust.  This is true of Hitachi ID PAM, for
example.  This is a nice alternative to password randomization/vaulting
but is mutually exclusive with mandatory session recording.
All PAM products should support some form of 2FA.  The nice thing
here is that you can configure 2FA once - into the PAM system
itself, and from there just launch user logins into the end
system.  Which 2FA technologies are supported should matter less
to any given organization than whether the PAM system supports
the 2FA system that they use or plan on.  Some PAM systems also
bundle a 2FA, in case you don't already have one (again, Hitachi ID
comes to mind, but this is likely going to be increasingly common).
All PAM products should support some form of session recording.
With some, this will be an extra cost item, and with others it's
built-in.  Figure out whether you need this, what kinds of
data streams you care about (keylogging?  video capture?  copy buffer
integration?  etc.) and what it will cost before investing in a
PAM product.
How PAM products launch logins to privileged sessions varies.  There
are a few approaches, each with its own pros and cons, which can
be combined to suit your needs:

Launch an admin tool (MSTSC, PuTTY, vSphere, whatever) on the
authenticated+authorized user's PC, and inject target address and
credentials into it.  This is most flexible and scalable, but it
implies a certain client OS, a network path from the user's device
to the managed endopint and the temporary existence of target
account credentials on the user's device.  Users gain single
sign-on across multiple privileged sessions (just sign into the
PAM portal once) and runtime performance.
VDI to a proxy and then do the above.  This eliminates many
connectivity and OS compatibility problems.
Proxy the connection protocol, and authenticate in-line.  This
means that the range of both authentication options and session
protocols is limited to what the proxy can handle.  Usually you
can support PIN-type authentication with things like RSA tokens
and protocols such as SSH and RDP.  You also tend to concentrate
connections in a few choke-point proxy servers, which can create
performance problems (reduced per-session bandwidth, in some cases
high latency for the full network path).  You also force users
to re-authenticate for every session - a major nuisance.  The
upside is that users continue to sign in with whatever tools they
are used to and credentials never exist on the user's PC.  Caution:
some PAM products only support this model, which is quite
restrictive (Cyber-Ark may be limited in this way).
Proxy the display, not the connection protocol.  Basically launch
an SSH or RDP session from a proxy server to the managed system and
display the session in a browser tab for the user.  Very convenient
for remote access or vendor access scenarios, but has similar
limitations to protocol proxies as above.
Never mind proxies or single sign-on -- either tell the user
the current password value (display or copy buffer integration)
or assign temporary entitlements to the user's existing account.
Note that if the session is not launched by PAM, it may not be
possible to enforce session recording.

The previous poster correctly pointed out that PAM systems offer
additional benefits, including:

Replacing static passwords with regularly changing ones.
Replacing weak password storage (paper, spreadsheets) with something
encrypted, replicated, access controlled, etc.
Replacing embedded passwords used to launch programs or connect to
services with regularly changing passwords, hopefully no longer
stored in plaintext anywhere.


How does a flash pathogen manage to act as a key logger?

As Iszi noted, a lot of the threats from Adobe products come in the form of privilege escalation and remote code execution vulnerabilities in Flash, rather than features of Flash in general that can be used maliciously. If a malicious Flash script (or PDF, or executable, or anything else) can successfully compromise a machine, any variety of key loggers or network sniffers may be installed.

Additionally, there have been several Flash file overlay vulnerabilities. These problems allow a maliciously designed Flash file to detect keyboard input and mouse clicks without the user's knowledge. The primary purpose of these scripts is for clickjacking, however they could easily work as some sort of a key logger as well. It's important to note that these flaws are browser-based, not backgrounded Flash files.

In terms of defense, certainly removing a ~/.Macromedia directory couldn't hurt, but it might make sense to also killall npviewer.bin, which will kill all instances of Flash running on your Linux system.

Hope this helped!


According to Preparing for PCI DSS 3.2 - Summary of Changes, the following changes exist in addition to Multifactor and "early TLS" changes:

“Designated Entities Supplemental Validation” (DESV) is incorporated as an appendix and may be required on a case-by-case basis.
Service Providers are being singled out for more scrutiny given their broader impact on the attack surface.


There is no such thing as a "SSL logo". However, there is a long-standing tradition (nothing as official as a logo) of making some ongoing SSL explicit with an icon figuring a padlock. In recent versions, Firefox decided to put that padlock on the left of the URL bar, like this:

The icon is actually redundant with the https protocol indication in the URL itself. However, many non-technically inclined people find the padlock icon easier to grasp.

The icon is also clickable; it will give details on the server's certificate, and the currently used SSL/TLS cryptographic algorithms.

Browsers are very susceptible to fashion; the padlock icon used to be in the bottom bar in the days of Netscape and early versions of Internet Explorer. It then gradually migrated up. Firefox is simply following the trend.


Are files like favicon.ico, robots.txt, and sitemap.xml vulnerable to XSS?

We will be deprecating that passive scan rule shortly.

Here's the issue: https://github.com/zaproxy/zaproxy/issues/5849
Here are the related PRs:

https://github.com/zaproxy/zap-extensions/pull/2297
https://github.com/zaproxy/zaproxy/pull/5850

You should really have CSP in place, as for whether or not it matters for those files it depends if they exist, and if not, how the error might be handled.

Further, as pointed out on MDN:

  Chrome has an "Intent to Deprecate and Remove the XSS Auditor"
  Firefox have not, and will not implement X-XSS-Protection
  Edge have retired their XSS filter

  This means that if you do not need to support legacy browsers, it is
  recommended that you use Content-Security-Policy without allowing
  unsafe-inline scripts instead.

There is further discussion of this topic (X-XSS-Protection vs CSP) in this Q/A as well.

Update: The "Header XSS Protection" passive scan rule has been removed as of Passive Scan Rules v27 > https://github.com/zaproxy/zap-extensions/releases/tag/pscanrules-v27


OpenSSL version 1.0.1e in CentOS 6 -- Heartbleed Vulnerability

Most distributors don't just upgrade to the latest version of OpenSSL since this could have unintended side effects (slightly different behavior or even new bugs). Instead they just backport the patch and keep the version number. This means you should not only look at the openssl version but at the distributors version number to.

For CentOS 6.8 this is currently OpenSSL 1.0.1e but vendor release 48.el6_8.3. This release includes all recent bugfixes and also the fix for Heartbleed:

* Mon Apr 07 2014 TomÃ¡Å¡ MrÃ¡z <tmraz@redhat.com> 1.0.1e-23
  - fix CVE-2014-0160 - information disclosure in TLS heartbeat extension


How to make USB drive read only and write by a password or key or certificate?

Completely impossible with standard flash drives. It's possible that a custom flash drive could have a storage controller to support something like this, but they'd be the rare exception and not the rule.

Instead, sign your executable and enable signature verification (such as AppLocker on Windows) on the computers that will run it. Then, if malware infects your executable, it won't run.


What tools are available to identify which country a specific IP address is located in?

Use whois:  http://tools.whois.net/whoisbyip/

Or/and you can try IP address geolocation services, like:

  http://www.ip2location.com/
  http://www.digitalenvoy.com/
  http://www.maxmind.com/app/ip_locate
  http://www.ip2country.com/
  http://www.hostip.info/
  http://www.atelierweb.com/iploc/
  http://www.ip2country.net/
  http://www.quova.com/


CVSS 3.1 -- does a scope change imply at the very least a low confidentiality impact?

Hmm, I'm trying to think up a counter-example. Say you have a blind SSRF -- I can cause the server to send a request of my choosing to a host of my choosing within its LAN, but I can't see the response. That's definitely a scope change because I'm jumping from the host I'm allowed to talk to to one that I'm not. But it's not a confidentiality issue because I can't get any information out.


how to get cookies from aspx site to use it with hydra

Use a browser plugin such as Cookies Manager Plus on Firefox, then you can simply copy the value to the clipboard.

As you say, simply paste the value into the command line for Hydra.

See my answer here for the syntax that worked for me.

"/dvwa/vulnerabilities/brute/:username=^USER^&password=^PASS^&Login=Login:F=incorrect:H=Cookie: PHPSESSID=07b7ebb2faea96f8471ecdb759e68108; security=low"

So instead of PHPSESSID and the value you include the name of the ASP.NET session ID and value.


Can wireshark capture the exact payload and end point of API used by my Mobile APP?

Can an attacker on the network see plain HTTP requests?

Yes, they can. They can also modify the request as they want.

  Can an attacker on the network see HTTPS requests?

Depends. If the attacker is the one using your app, then they can. If the attacker is trying to spy on others, it becomes more difficult, but it is not impossible.


Two-Step vs. Two-Factor Authentication - Is there a difference?

Two-factor authentication refers specifically and exclusively to authentication mechanisms where the two authentication elements fall under different categories with respect to "something you have", "something you are", and "something you know".

A multi-step authentication scheme which requires two physical keys, or two passwords, or two forms of biometric identification is not two-factor, but the two steps may be valuable nonetheless.

A good example of this is the two-step authentication required by Gmail. After providing the password you've memorized, you're required to also provide the one-time password displayed on your phone. While the phone may appear to be "something you have", from a security perspective it's still "something you know". This is because the key to the authentication isn't the device itself, but rather information stored on the device which could in theory be copied by an attacker. So, by copying both your memorized password and the OTP configuration, an attacker could successfully impersonate you without actually stealing anything physical.

The point to multi-factor authentication, and the reason for the strict distinction, is that the attacker must successfully pull off two different types of theft to impersonate you: he must acquire both your knowledge and your physical device, for example. In the case of multi-step (but not multi-factor), the attacker needs only to only pull off one type of theft, just multiple times. So for example he needs to steal two pieces of information, but no physical objects.

The type of multi-step authentication provided by Google or Facebook or Twitter is still strong enough to thwart most attackers, but from a purist point of view, it technically isn't multi-factor authentication.


Why do some antivirus programs find infections that others miss?

Viruses don't identify themselves as such.  In fact, they often try to disguise themselves to make it difficult to detect them.  Virus scanning software uses a variety of different techniques to figure out if a program looks like a known virus, but the exact methods they use and the things they look for vary from program to program.  Since these virus definitions differ, sometime a rule either won't exist or won't detect a particular edge case that another virus scanner will detect.

While some virus scanners are better than others, in general, they are simply different.  Even the best virus scanner (if you could determine a best) would still miss some viruses that the worst one might pick up.


Why generate dedicated issuer CA for TSU certificates?

The question is too broad and/or can be opinion-based. There are no best design approaches to answer all scenarios and PKI design depends on multiple factors. Factors include (but not limited to):

business requirements
technical resources
licenses
management structure
certificate policies

By deploying separate CA to issue TSA certificates (that are used to timestamp and sign data) you can assign a dedicated management team, protect this CA from possible misuse in the case if there are general-purpose CAs. You can apply different issuance policies (governed by certificate practices) to individual CAs.

PKI is primary business for commercial CA (such as DigiCert, Comodo) and they have enough resources to manage multiple CA groups per purpose: SSL/TLS, code signing, TSA, etc. And most likely every CA group is managed by a dedicated team, so dedicated CAs are necessary in this case.

If you have small certificate volume and all certificates are issued under similar policies, CAs are managed by same team, a dedicated CA may be an overkill.

Every extra CA increases the complexity of the PKI and increase TCO (especially, if HSMs are in use). Thus, the design of PKI tree and how you structure CAs is evaluated in every individual case.


OpenPGP master key with certificate and authentication capabilities (on a smartcard)

I wouldn't go for it. This means additional exposure of the master key, and it might have been exposed in bugs like CVE-2016-0777 when used with SSH.

You can also not distinguish any more between using the primary key vs using a subkey.

If you're going to buy several cards anyway, and are keen on using a card for the primary key, buy another one (or set of cards) and put the primary key on a dedicated card (set). This will not only enable you to be sure about which key you're going to use (the primary key is not connected at all), but also remove the three-keys-limitation of OpenPGP smartcards.


XSS Injection invalidate meta redirection tag

Seems like using something like:
javascript:alert(1); as the URL, then closing the meta tag and opening a new script tag for the XSS works.


very simple: the request-method is not GET, but XGET which is not known, thus you server reports error 501

do you run tomcat/jboss or a similar app-serever? i guess, not.

this looks like a simple scan from some random skiddo who tries to find vulnerable app-servers but fails with the simple task of generating valid requests; the XGET looks interesting (from an ids-pov)

  Does this sound like an intrusion or

no, just a simple scan

  am I overreacting

surely :)


How many digits of a Visa card number can vendors disclose on receipts?

As per PCI, the first 6 (BIN) and the last 4 can be shown, others should be masked:

From an official 2008 PDF: PCI Data Storage Do’s and Don’ts:

  Never store the personal identification number (PIN) or PIN Block. Be
  sure to mask PAN whenever it is displayed. The first six and last four
  digits are the maximum number of digits that may be displayed.

PAN is Primary Account Number

So as far as compliance goes, the data terminal used to print the receipt is compliant.


Is it possible to make a "proof of anteriority" for sites content?

What you want here is not "non-repudiation". Non-repudiation is about preventing the true author of a document from later on claiming that he was not, in fact, the author, and cannot be held responsible for the document contents.

No, what you seek is quite the contrary: you want to prevent non-authors from claiming that they are the true author. You want to prove that you produced/published the data first. This is called a proof of anteriority. In the non-computer world, this is done with a Soleau envelope (in France). The computer equivalent is Trusted Time-Stamping: an "authority" (called "TSA") applies a digital signature on a structure which contains both the current date (as known by the TSA) and a hash value; assuming that the hash function is cryptographically strong (resistant to second preimages), this signature is a proof that "whatever was hashed" already existed at the date contained in the time stamp. All you have to do is then to time stamp a copy of your content along with an unambiguous designation of yourself (say, your name).

How a time stamp may hold in court, during litigation, is a complex question. It depends on a lot of things. In France again, there is a notion of horodatage qualifié which designates a TSA whose systems apply a lot of security measures which collectively ensure that the time stamp is trustworthy; it is all spelled out in this document (in French). Supposedly, a time stamp from such a TSA would be accepted as proof "by default", the burden of proof being placed squarely on whoever claims that the time stamp is fake. Actual rules are heavy: redundant physical security, regular audits, background checks on all developers and operators... and, last but not least, demonstration that the TSA uses a time source which is accurate to the second, and cannot be easily subverted remotely (e.g. simply using some NTP servers on the Internet is not sufficient, since NTP packets can be spoofed). The "under 1 second accuracy" rule is especially troublesome, because computer internal clocks tend to drift by more than one second per month, and leap seconds cannot be simply ignored, as is customary in computers.

Of course, one would have guessed that France would go for a centralized, bureaucratic set of byzantine rules. In countries with a Common Law tradition (in particular UK, USA, and Commonwealth members), it is expected that whether some time stamps are acceptable as proof "beyond any doubt" or not, will be asserted by judges in the course of the resolution of actual litigation. Which means that question is still, as of now, open.

If you really want, now, to establish your authorship of your works, I suggest that you print them out on actual paper, and use established pre-computer procedures, e.g. registration with a specialized office (of course, there may be fees).


How can Opera browser access my sessions on Google Chrome?

This felt creepy and made me think how Opera browser can do this?

Consider how session cookies are stored. It's stored on disk, as a database of some sort. In Chrome, it appears to be a sqlite database, which is readable by any program running as your user.

The same goes for bookmarks and other user data; it's stored in some form on disk. Accessing it is trivial for any application not specifically sandboxed.

Opera does this to make it easier to switch browser; you get to keep your sessions, bookmarks and history, making a switch almost seamless.

There's no need to change passwords; opera did not do any trickery. Programs that runs on your computer can impersonate you. This is not an unknown side channel or anything, it's fundamentally how computers work.


Are cloud storage services a good strategy to protect against ransomware attacks?

I'm not sure about Google Drive, but Dropbox provides a way to recover previous file versions, a feature that wouldn't be impacted by the ransomware, since it relies on a file copies on the Dropbox servers. So it'd certainly be a way of protecting your data.

However, recovering everything over your internet connection is a relatively slow process. Personally, I would use a NAS device, but wouldn't map it as a network drive (because those can - and will be influenced if a ransomware is activated on your computer). I would use it via FTP / SFTP, probably with a script that syncs the files on a regular basis. This way you have the files locally, which makes restoring from an attack less of a problem. It is probably cheaper too.

Also, if you prefer Dropbox-like experience, you might want to try ownCloud on your own device - it also keeps the previous versions of file, allowing you to roll back in case of file damage or corruption. Keep in mind that storing multiple old versions of a file takes space on your NAS's disk(s).


From a PCAP file determine if the address has been spoofed?

There are a couple of things to think about with your question.

First, you mention "spoof an internal address". Assuming you mean spoofing a reserved 10.a.b.c or 192.168.a.b private address space, how do you plan to get the packet into the victim's network?  Those are "non routable" addresses, meaning that no internet router knows where to send a 10. address.  This includes your home router, which will not send 10. packets onto the internet in the first place.  For this attack to work, you must already be inside the victim's network.

Now let's assume you're successfully attacking from within the internal network.  Yes, you can spoof a source IP, but how are you going to see the response?  The response will be sent to the real IP, not to your machine.  To solve this, you'll have to take over the real address.  This can be done using a technique like ARP cache poisoning.  And ARP attacks are detectable with certain kinds of network monitoring tools, so this is not guaranteed to be an entirely invisible attack.

Another option would be if your machine is on the same subnet as the victim machine, and you have full access to the network switch.  Most managed switches allow the creation of a "mirror port" to capture packets for network monitoring tools.  You could theoretically use data from the mirror port to see the replies and mount your attack; but be aware that this will still be delivering those reply packets to the victim's computer.


Decrypting possibly compromised Veracrypt hard drive

Yes, because you're connecting to the machine meaning that the machine is mounting the drive. If possible maybe use a virtual environment to access it while not allowing the virtual environment to access your files. Even then there are ways around virtual environments. Your best bet is to use a device you only plan on using once unless you're 100 percent certain that you have a controlled environment for such activity and that nothing else can be compromised.


Preventive security action in Android App

Obfuscation is a delaying tactic, not a solution. You have to work on the assumption that the application and phone will be compromised. Treat it like you would a browser, use the app to send and display information only:

Do not store any sensitive data locally
Handle all processing on the bank's servers
Do not cache any passwords, account details, or transaction data

Encourage the bank to perform a risk analysis on the functionality they want the app to have, and evaluate whether the functionality should be included. Do your own analysis and warn them about anything you aren't confident you can protect.

There's no point in blocking use on rooted phones, many people root their phones for legitimate reasons and you don't want to deny service on that basis. If you design your app right it won't matter, which is the whole point.


How to avoid crash after successfully run shellcode?

This can be solved by longjmp. longjmp is similar to goto, so this can rollback to original state of your code.


How secure are the default, randomized passwords that ISP routers come with?

They're often not as random as they might appear. The forums posts listed here show many examples of researchers reverse-engineering the algorithms used to generate default router passwords - sometimes, even by disassembling the firmware.

Many manufacturers assume that no one will go to such trouble. These manufacturers often rely on obscurity, using algorithms that are only pseudo-random, and/or derived from the MAC address or other non-random information.

This varies by manufacturer and model, of course - but since it's often very hard to tell, you're almost always better off changing to something that you know is random, and of sufficient length to be beyond run-of-the-mill bruteforce capabilities - say, 15 characters random mixed-case alphanumeric+specials (or often better, the equivalent entropy in a randomly-generated passphrase that's easy to type).


How does a BlackBerry handheld connect to BES?

This should help you out: http://docs.blackberry.com/en/admin/deliverables/25762/BlackBerry_Enterprise_Solution-Security_Technical_Overview--1315426-0302055542-001-5.0.3-US.pdf

The basic idea is a new device is provisioned on BES with an activation code that is communicated to the user. The user enters the activation code and BES generates a device transport key when it connects. The device transport key takes care of authentication after enrollment.

A rogue device could possibly connect if the activation password is intercepted and the rogue device is connected first. The only problem with the scenario is the administrator would have an indicator that a rogue device is connected when the end user complains that the enrollment did not work.

The BES architecture is well thought out. BES attachment handling has been the achiles heal.

http://btsc.webapps.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB27244

http://btsc.webapps.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB17118


What are the risks associated with SSH'in from corporate LAN to untrusted server on the Internet

You've identified the main risks:

You're contacting a foreign host/network.
It is very easy to create a reverse tunnel using SSH (so the remote party can get to you)

(3. Communication stream is encrypted) ... my additional risk.

With regards to LAN vs. DMZ.  Well.. of course, it all depends.  On some LANs there might be more inspection with regards to outbound connects (?).  I mean, it really depends on your own setup, policies, etc.

Anytime you have "trusted" going to "non-trusted" (no matter what zone), you have the risks already mentioned.  Encrypting the traffic doesn't really matter as much, though it can often times confuse the issue (makes people forget that whole "trusted" going to "non-trusted" issue).

But, "are you supposed to do this?"

You effectively said "no", but again, it all depends.  The Internet is essentially a public trusted network.  We use it because it's there.  Not because it provides safety.  Thus, by definition, by default, it's certainly in the "untrusted" category for most companies.  But maybe we get enough benefit to mitigate (perception wise) the risks (??).

Firewall wise, btw, when an connection is initiated from the company (trusted) to the outside (untrusted), it is very difficult to "block" any nastiness.  And because the communication is encrypted, I'd say it is very very very difficult.


Why *is* PKCE recommended for single page JavaScript apps?

PKCE ensures that the client which requests a token is still the same one which started the authentication request.
Beside a malicious extension, this Draft also names the risk of CSRF which is avoided with PKCE:
https://tools.ietf.org/html/draft-ietf-oauth-browser-based-apps-05#section-7.1
You shouln't accept an attackers auth code on your SPA redirect URI. This would establish the use of the attackers resources at the victims app session. The victim could enter secret data stored at the attackers resources.


According the documentation it states that

  After you click the ‘Format’ button in the Volume Creation Wizard window (the last step), there will be a short delay while your system is being polled for additional random data.

So that might take some time. Also it depends on what options you use when creating the VeraCrypt volume especially if you don't use Quick format which is unchecked by default which will fill the volume with random data. I don't think Mac does this or may do it in the background.

As long as "security level" of what Apple provides, this is not really known since their code is not open source and there is little technical documentation around their encrypted volume so there is no way to know if they are following security best practices.

Here is an article with some technical details on encrypted dmg format and how it can be cracked.

According to linked article "

  AES256-encrypted DMG uses 250,000 rounds of PBKDF2-HMAC-SHA-1 to generate the encryption key

So the "security level" is pretty good when it comes to the encryption algorithm (AES) but the key derivation (PBKDF2-HMAC-SHA-1) is known to have weaknesses. According to Wikipedia

  One weakness of PBKDF2 is that while its number of iterations can be adjusted to make it take an arbitrarily large amount of computing time, it can be implemented with a small circuit and very little RAM, which makes brute-force attacks using application-specific integrated circuits or graphics processing units relatively cheap.The bcrypt key derivation function requires a larger amount of RAM (but still not tunable separately, i. e. fixed for a given amount of CPU time) and is slightly stronger against such attacks,while the more modern scrypt key derivation function can use arbitrarily large amounts of memory and is therefore more resistant to ASIC and GPU attacks.