How to configure ZAP for Desktop Appliation

If the application honours the system-wide proxy settings, you can configure them on Windows via the Internet Options window, or on Linux using the http_proxy environment variable. If the application will not communicate through a proxy, you're stuck because Zap does not support transparent proxying of traffic.

If you need transparent proxying of web traffic, I recommend Burp Suite for this job because it's so simple to set up. Burp calls this feature invisible proxying and you can configure it in your project's options. The idea is that you set up a local listening "proxy" on the same port as the target server, and have that proxy connect out to the real server's IP address on the same port, transparently forwarding all traffic back and forth rather than using a proxy protocol like SOCKS.

There are two easy ways to coerce the application into talking to your transparent proxy rather than the real server. The first is by modifying the application's config files (or binaries) to point to 127.0.0.1 rather than the real server, although this can cause problems because the application will send a Host request header containing that IP rather than the real domain. The other way, which is more reliable, is to add the domain to your hosts file so that it resolves to 127.0.0.1.

If the connection is HTTPS, you'll need to export Burp's CA from the config tab and install it on your OS so that you can properly man-in-the-middle it.

If the protocol turns out to be binary rather than HTTP(S) then you could use CANAPE in the same way.


Advantages of Enabling Firmware Password Protection

Setting a firmware password prevents your Mac from starting up from any device other than the built in hard drive.

Even if the contents of the hard drive are encrypted, the attacker could still modify the boot sector or copy the contents of the drive.


In fact you are using the wrong public key to decode the signature.

Being part of a PKI, the paypal certificate is signed by an issuer called "Symantec Class 3 EV SSL CA - G2". If you display the certificate with your browser, you should see it.

You can find their public key in the certificate as well :

daecc56a361186db2021a3ec4c21fd0fc55c3abeeca26e980e82996b7a7aeb6ef225c92d60205dd62be6dd99d9f1545c769b0bf92742247cead4e63c2ace239ffb78c91544f4562c55ce56b730f04989fe0dd86e017c61d34499665e9648188709c8c349e935ecbb4c7a159155ed6080950bd718f3a74be6e8740c2e6b45f417f9cbbf5456ee36d44ee6cfad1f4d7d8fb35535dd62d26e54859e45537aee6096227fb81aaf6fa00ea68e13b685a1cc5c8c9ead1d71b80894e6cebc38d0d1e93f7143fb9723a86cf431dc023bde2955f2a0be1e216caf1a5cdf6a3764029ad05171a57fba69c52c8967703b130572ed2123102b232a1aae3a0964237a276212d1

With this modulus, you will compute : hex(s, e, n) as :

0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff003021300906052b0e03021a05000414e80a2b06b2b3c004b770831bdb9429f0e631376f


Wipe rewriteable optical media (CD, DVD, ...) content

The DoD 5220.22-M document, which is often allegedly "quoted" for describing the 3-pass wiping on hard-disks, distinguishes the two following situations (see section 8-301):

Clearing. Clearing  is  the  process  of eradicating  the  data  on  media  before  reusing  the media in an environment that provides
an acceptable  level of protection for the data that was on the media
before clearing. All internal memory, buffer, or other reusable memory
shall be cleared to effectively deny access to previously stored
information.
Sanitization. Sanitization  is  the  process  of removing  the  data  from  media  before  reusing  the media  in  an  environment
that  does  not  provide  an acceptable level of protection for the
data that was in the  media  before  sanitizing.  IS  resources  shall
be sanitized  before  they  are  released  from  classified
information  controls  or released  for use  at  a  lower
classification level.

Sanitization will therefore very often lead to the media destruction. However, here in this post we are merely focusing on clearing.
I will share below my few findings on the subject.
Data deletion is handled by the disk writer, not the software
Disk erasing is somewhat similar to HDD's SecureErase feature mentioned in the question. Indeed, when asking a software to erase a disk, all it will do is send an ATAPI BLANK message to the disk writer's firmware, and it will be up to the firmware to handle actual data erasing and send back the operation result to the software.
However, unlike the SDD, I did not encountered any information leading to think that some writer may be more or less efficient than other to erase a rewriteable disk content.
There is two level of erasing
Some writers actually allow even more fine-grained data erasing, like per-track erasing, but as per our concern it is very interesting to note that they propose at least two erasing level:

A quick erase, used by default when erasing a disk, will only delete the disk's Table Of Content (TOC) and a few other related information, but the data themselves will remain on the disk. It seems very similar to a quick HDD formatting. I also strongly suspect that a lot of end-user software may only propose this mode.
A full erase will take a long longer since the software will instruct the firmware to go through all the disk surface to erase all data from it to turn back the disk into pristine state.

Full disk erase are efficient
My few searches did not point out any weakness to a rewriteable disk full erase. On the contrary, all forensics vendor I went through seem to limit efficiency of their products (whether it is software or hardware) to quick-erased disks.
While from a pure theoretical point-of-view one may still imagine some tiny weakness exploitable by a large and well-founded organization, as a reminder we are here in the scope of data clearance and not sanitization. For clearance goal, a full disk erase is therefore fine, the trick being to not mistakenly use a quick erase where, on the contrary, the data could be retrieved relatively easily.
How to proceed
On Unix platforms, a full disk erase can be achieved using the cdrecord tool. It can be used the following way:
cdrecord blank=all dev=/dev/scd0

blank=all: to be opposed to blank=fast, this the actual argument which will initiate the full disk erase process,
dev=/dev/scd0: to indicate the path to your disk writer device,
-force: this usefull parameter can be added to allow cdrecord to use "some tricks" which may allow to erase a disk which would not be erasable otherwise (damaged disks for instance). cdrecord manpage.


What are the odds of brute-forcing an archive with 256-bit encryption?

Brute forcing means "attacking the system with all the subtlety of a slow-witted gorilla". Here, it means trying out all possible passwords of "20-odd characters". Even if you limited yourself to alphanumeric characters (26 lowercase letters, 26 uppercase, and 10 digits), that's 6220 possibilities, i.e. close to 2119. Then it depends on how much costs each try. If the password derivation scheme used by your system is good, it will use many nested invocations of some one-way function, meaning that each try will need, say, one billion clock cycles. If the password derivation scheme is bad, it will need less, possibly down to a few dozen cycles (with AES encryption and the hardware support offered by the recent Intel processors). Assuming your processor runs at 3 GHz and has four cores, you might hope to try, say, up to 230 passwords per second (but, realistically, you won't). So you would be done in a mere ten billions of billions of years.

Let's face it: even if your real name is Barack Obama, 2119 is way above your league.

So your best chance is to do a non-brutal attack: one in which you first try to establish a list of possible passwords that you could have chosen (possibly a large list containing thousands or even millions of passwords, but not 2119).


What use does a TPM have for accurate timekeeping?

The oscillator is a mandatory component for the TPM system to function.

The TPM module has a 100 kHz SMBus which is synced using that oscillator.

If the TPM board also has a wireless sensor node, that one also gets synced by the same oscillator.

Here's a basic schematic for the Atmel AT97SC3203S-based TPM modules:


Yes, NIDs are OpenSSL only.
The separate encodings and registries for the hash and signature parts of TLS 'SignatureAndHashAlgorithm' only apply to TLS1.2. The IANA page section you link, and the immediately following one, phrase this a bit obscurely as 'prior to 1.3'. However, sigalgs did not exist prior to 1.2, so the only protocol that is prior to 1.3 and not prior to 1.2 is 1.2. TLS 1.3 changes the definition of 'SignatureScheme' to be a single 2-byte value, with most (not all) of the pairs defined in 1.2 preserved, but new values added that do not fit the 'hash byte, signature byte' format. EdDSA is defined for TLS1.2 by RFC8422 with 'hash'=8 to mean no separate hash, and that same first byte 8 is also used in TLS1.3 for RSASSA-PSS which does hash the data as a separable step but also uses the hash in MGF1 so it arguably isn't fully 'separate'.
OpenSSL doesn't need to 'convert' any cert signature to the TLS wire type(s), and doesn't. Rather, for protocols 1.2 and 1.3 it determines whether to use a certificate by comparing the NIDs (or sometimes even more-compressed CERT-array indexes) for each configured/offered/shared sigalg to the potential certificate(s). It does allow configuring the sigalgs to be offered and accepted, and SSL_[CTX_]set1_[client_]sigalgs does accept pairs of NIDs. However, this data is then used only for the protocol; AFAICS there's no supported way of getting it back out.
ObSec: MD5 is broken; don't use it in certificates. Or for almost anything else.


Is there any functional distributed timestamp server available? If not what about this homebrew solution?

First things first. What's the problem you are trying to solve ? What is the attack model ? We cannot tell whether a protocol achieves a given goal if the said goal has not been given.

Apparently, you are dissatisfied with Time Stamp Authorities as they are commonly used. Let's see what TSA do and on what security property they rely.

A TSA emits time stamps, where a time stamp is a signature over a structure containing the signature date and time, and a hash value. By this signature, the TSA asserts that the hash value "existed" at the specified time. "Existence" requires some semantic caution, since we could say that the set of all sequence of 256 bits is well-defined mathematically, and finite, so it "exists" already. What we mean is that, given a message m and a time stamp t which contains h(m) and the time T, then "someone" must have handled m before time T as a sequence of bits in its own right.

A time stamp is a verifiable proof of existence of a given message m at a past date T, and can serve as a basis for constructs which need such proofs (e.g. long-term archival of signed documents, which must be verified long after all the involved certificates have expired). To verify a time stamp, we must have access to the public key of the TSA, and the message, and recompute the hash, and verify the signature from the TSA.

The goal of the attacker is to produce at date T' (after date T) a so-called time stamp t over a message m which did not exist at date T, but such that the verifier will accept it nonetheless as a proof. There are several ways by which this could be done:

Tweaking the message m until h(m) matches a hash value for an existing time stamp (for another message) which bears the date T. This method is not feasible as long as h is resistant to preimages (included multi-target second preimages).
Subverting a TSA to issue (sign) the fake time stamp.
Stealing the TSA private key (by breaking its public key, or purloining the private key from where it is stored) in order to sign the fake time stamp.
Convincing the verifier that a given public key is owned by the TSA, whereas it is in reality controlled by the attacker.
Tricking the TSA into assuming that the current time is T, so that it unwillingly issues time stamps "in the past".

A very important point to make is that all of this is about security of the involved elements (hash functions, private keys, clocks) at the current date, i.e. not at date T. It is not sufficient to ensure that everything was "secure" at the time the time stamp was issued; security must be enforced as long as the time stamp is to be verifiable. In all generality, since time stamps tend to expire (because security of the private key cannot be maintained indefinitely, because of possible cryptanalytic advances), time stamps have to be chained by regularly re-timestamping (e.g. as is described in ERS).

What you describe seems to be a protocol by which a number of "nodes" may come up with a shared agreed-upon designation of one of them. Apparently you want that selection to be somewhat "random", i.e. such that none of the node may arrange to be selected more often than any other. However, as far as I can tell, this is not achieved: a dishonest node may invest in some CPU in order to compute several hash candidates, then keeping the one which is closest to the middle-point of the hash space, thus improving its chances of being selected.

But, more importantly, whatever you do at that point may only offer some protection at a given date against "subversion". This does not do what we want with regards to time stamps. For instance, suppose that there is one (only one) TSA which is corrupt. All that TSA needs to do is to wait for being the "TSA du jour" and be allowed to issue valid time stamps in a time range including the time T. The corrupt TSA faithfully follows the protocol, except for one point: at the end of the day, it does not destroy its private key; instead, it keeps a copy. From the outside, this is completely undetectable. But this allows the attacker to produce afterwards as many fake time stamps as he wishes to, all for alleged date T (any date within the range during which the corrupt TSA was the TSA).

Also, nothing is said about how the verifier is supposed to learn the correct public key for the agreed-upon TSA at date T. All games about selection of one TSA have any worth only as long as this is verifiable afterwards. I don't see anything in your protocol about that point.

Summary: you don't say what your protocol tries to achieve but I am pretty sure that:

this is not what we want,
and it fails to do it properly anyway.

What can be done to make time stamping more reliable and, as you say, "distributed", is to use several TSA in parallel. When you need to time stamp a message m, go ask for time stamps over h(m) to several TSA. Say that there are n TSA in use, and TSA number i returns a time stamp bearing date Ti. Then consider the set of time stamp to prove the existence of m at date T = max(Ti): indeed, when a time stamp states that a given message exists at a given date, it implicitly also states that the message has continued to exist since that date. By taking T to be the latest of all dates in the n time stamps, you are simply using all time stamps to individually prove (independently of each other) that the message existed at date T (and possibly before, but definitely at date T).

Under these conditions, your time stamping is secure until the attacker succeeds at subverting/breaking/framing all the n TSA. Now THAT is robust. And it is decentralized and efficient; the TSA do not need to talk to each other or even to be aware of each other's existence.


Using Bluestacks with VLC and Live Net TV

Bluestacks is an Android emulator. When you run it, it pretends to be a particular Android based device. For the newest version of Bluestacks, I believe OnePlus 5 is the default device emulated.
So yes, you do have a OnePlus 5 device, it's just emulated.


Generally if you find an SQLi you don't need to map the whole database to prove the vulnerability, actually very little information is needed as proof. SQLmap is a great tool for what it's meant for, mapping databases, but it does have some limitations in usability.

Generally I'd advice to use a web application scanner to look for SQLi vectors, for example the OWASP ZAP proxy scanner. But in this case even scanners might be hard to configure to always do a series of valid requests before the target form is sent. Scanners have a large set of ready-made SQLi payloads and response analysis techniques and this is definitely a resource that should be used.

If all fails then a simple script and a list of SQLi strings could be used to do the job. Automating the two earlier forms to be sent with valid static input is easily done in most languages, especially if you don't need any part of the response. After this you can send the third form with an injected parameter. Now you can repeat this process for all the payloads until you get an interesting response. Anything slightly out of the ordinary is an interesting response.

Often an error message, a slightly different response or a difference in query duration is enough to mount a blind SQLi attack. This means that all the proof needed to show that the vulnerability exists is a series of (in this case) three requests that end up responding in a way that discloses information about the querying process. Given this one proof-of-concept series of requests an attacker could easily write a script that slowly extracts the whole database, you, as a tester don't actually need to do this.

If you are an experienced programmer you could leverage the libraries that are a part of the SQLmap project.


Why does Assembly seem so important in IT security?

It allows you for one to understand what is happening at the lowest possible level of the operating system.  Second of all it allows you to change code at byte level which means you have a lot of control over the code. This is, for instance nescessary when exploiting buffer or stack overflows. When doing either attack you will essentially inject byte code directly into the memory and execute it. While you can technically generate this with another language, often it's not optimal and a lot more bulky than when you would write it in another language. Often what happens is that you first write the exploit in c and then generate the assembly from your c program. This is called prototyping. From here you can optimise the code and remove unwanted characters such as 0x00 bytes ( often these are used as a delimiter).

Also if you have a program you need to analyse but do not have the source code you will often need to decompile it. The result of the de compilation is assembly.

I think most security professionals have a why mentality while other IT professionals sometimes don't care as long as it works. Assembly allows you to explore the why at the lowest level possible. This is also a reason why a lot of security professionals like to know assembly.

Also note that there are programs to help you understand the decompiled assembly by identifying and vizualising system calls( have a look at my blog there is step through analysis of shell code).


C# (and other .Net languages) are compiled into Common Intermediated Language bytecode which is translated into native code "Just in Time" by the Common Language Runtime. This is similar to how java works. Donut converts the intermediate bytecode generated by your C# compiler into shellcode (i.e. native code which the cpu can process directly).*
ILSpy reverts Intermediate Language bytecode back into C#. It isn't designed to, and therefore cannot, convert shellcode back into C# code. Your second executable contained shellcode from Donut so ILSpy didn't find any managed metadata in it and couldn't decompile it. If you want further help for decompiling the shellcode, try asking at https://reverseengineering.stackexchange.com

*For further information on this, read Donut's own explanation


Cryptography is at least half-mathematics so you have to use a bit of mathematics at some point, if you want to understand cryptography. However, for the specific case of Feistel schemes, mathematics are not hard.

A block cipher should transform a data block (a sequence of n bits) into another block of the same size, such that:

the transform is parameterized by knowledge of some (secret) value (the key);
with the key, it is easy to compute the transform and its inverse;
without the key, well, tough luck.

Hans Feistel designed a generic way of building block ciphers. Namely, the cipher will consist of the application of several rounds, each round looking like this:

You split the input block into two halves, let's call them L (as "left") and R ("right"). Usually, you do an even split (both halves have length n/2 bits) but that's not an absolute necessity.
You compute a value S which is the result of "mangling" together R and the key K. Details of the mangling are where overall security hides, and are not part of the "Feistel structure" per se: Feistel described the overall design, not a precise block cipher. Roughly speaking, the mangling should propagate bits of R and K all over the place and should depend upon the round number. The value S must have the same size than L.
You compute the value R' as being equal to L xor S. "xor" is the bitwise "exclusive or" combination. By "bitwise" I mean that the first bit of L is combined with the first bit of S, yielding the first bit of R'; then the second bit of L is combined with the second bit of S, yielding the second bit of R'; and so on. The "exclusive or" of two bits is 0 if both bits are equal, 1 otherwise.
You define the value L' as being equal to R.
The output of the round is the concatenation of L' and R', in that order.

In simple words, a Feistel round consists in xoring the left half of the data with a value derived from the combination of the right half and the key, and then swapping the left and right halves. The Wikipedia article on Feistel ciphers has some nice diagrams.

The whole point of the structure is that computing the inverse transform (which means "decryption") is easy if you know the key. This is where there are some mathematics:

for all a, b and c, if a xor b = c then a = b xor c
for all a and b, a xor b = b xor a

(Write it down with the bit values, there are only eight combinations, so it is easy to see that it works). Thus, if you have L' and R', and the key K, then you have R (L' is equal to R); from R and K you can do the mangling again, and obtain S. Since R' = L xor S, you can rewrite it as: L = R' xor S. In other words, given the output of a round (L' and R') and the key K, you can run the mangling part again, and, with a simple xor, recompute the round input (L and R).

At that point you have the Feistel scheme. Things become complex (cryptographically speaking) when you want to know how to do the mangling, and how many rounds you will use. DES is a well-known standard which uses a Feistel scheme with 64-bit blocks, a 64-bit key, and 16 rounds (on the 64 key bits, only 56 are actually used, so the key is often said to have length 56, not 64). "Triple DES", which consists of three successive DES encryptions (with distinct keys !) can be viewed as a Feistel scheme with 48 rounds.

Luby and Rackoff have shown in 1988 that if you use wide enough blocks (say 256 bits or more) and the mangling steps consist in random-oracle like functions (think "ideal hash functions" here), then 4 rounds are enough to achieve ultimate security; however, building a "random-oracle like function" is hard (quite harder, actually, than building a secure enough mangling), and if you build a block cipher out of existing hash functions, performance will very likely be poor (hash functions are fast for processing long runs of data, but here we are talking about four hash function invocations on small data elements per encrypted block).

Most notably, the currently recommended standard block cipher, the AES, is not a Feistel block cipher.


Whether cross cookie sharing between the android apps is potential threat to privacy?

You are logged in to FB on the web browser you used to browse the shopping site, so the site operator tells FB what you were looking at. The cookies are not actually shared by anyone, FB keeps those to themselves. FB centrally determines what your account sees in the FB app, regardless of OS or device, based on everything it knows abuot you and your activities.

The solution is to block 3rd-party cookies in your web browser, a well-covered topic. You can also just sign out of FB before browsing (instead of just closing the tab), but a recent legal decision found that FB can legally track you even when you are signed out. That varies by jurisdiction, but they technically can for sure.


Hardware token to authenticate web application

I would then suggest Yubikey ( http://www.yubico.com ). Yubikey is a OTP hardware token that does pretend to be a keyboard (Thus requiring NO extra software installation), and then sends a 128 bit encrypted secret to the server. The tokens are fully programmable by the administrator, and its possible to use the token in a variety of ways. You could either use the tokens password-less, eg use the tokens as a one-factor "What you have" authentication.

But you can aswell have the user type a password prior to pressing the button on the token.

Its also possible to configure the token to either use a public identity and then a unique AES key per user, OR you could use a secret identity and then iterate through all AES keys and decrypt (eg, if you have 10 users then you iterate through the 10 different AES keys stored on server) but the process can be CPU consuming, OR you could have the same AES key for all users.

If you select any on the first alternatives, you could use any of the Yubico tokens. If you go for the last alternative, I would suggest Yubikey NEO, which does have a tamper-resistant cryptographic Smart card Chip, which makes it impossible for a rogue user, to tamper with the yubikey to extract the AES key (that would make it possible for this rogue user to identify itself as a Another user).

The advantage of using a secret identity is that if someone finds the yubikey, they wont be able to find out who it belongs to.
Another advantage of the NEO is that is has NFC support, and can generate the signals that a "NFC URL sticker" does, but appending a OTP to the end, like "http://www.example.com/login.php?otp=ifhgieififhgieififhgieififhgieif" so the user can use his Yubikey to login via a NFC-compatible mobile phone.


Generate wordlist with exactly 4 letters and 6 numbers in any order?

I don't know if crunch is able to generate that, however it's pretty easy to generate the word list programmatically. I put such a program (un-optimized) at :

https://gist.github.com/brohee/e0be67593b71d2845b86

The word list ends up humongous, so not hosting it anywhere...

The list going from "aaaa222222" to "aa973ac757" was already 2.6GiB big, so I stopped the experiment.


How do I deal with companies that call and ask for personal information?

I react exactly the same as you- I first ask them to authenticate themselves to me, after all,  they called me. If they can't or won't I tell them that I will call my bank manager/utility rep/whatever and that if this is an official message I should be able to receive it after authenticating the usual way.

Don't give in to them- they need motivation to start doing this right.


Are services like Hide My Ass and UnoDNS reasonably safe to use?

What about HTTPS? Would anyone be able to steal my online banking
  password or Gmail credentials?

You shouldn't worry about this unless you make it a habit of installing forged certificates.

Furthermore....

If you are on a wireless connection which has a password and the proper security modes enables ( WPA, WPA2) the only way to hijack your information is to connect to somebody else pretending to be said access point.

If you are viewing a https page you are safe.


Percentage of 0-day vulnerabilities used as vectors for infections?

It's a valid question, and I can't find data to answer it precisely.  The Verizon DBIR does not seem to single out zero-day vulnerabilities used, and I'm not aware of any study that does.  I do believe the chances to be small, however.

I think you're looking at a very narrow slice of things, however, since it sounds like you're mostly focused on isolated home workstations.  Yes, those are basically going to be compromised by:

Users executing things (including document macros, files on flash drives, downloads, whatever)
Known (and patched upstream, but patch not deployed) vulnerabilities
Known (and unpatched upstream) vulnerabilities
Unknown vulnerabilities (0-day)

I completely agree that for home users, the last category is a small percentage of infections.  However, there is a non-trivial lag time between an 0-day being "burned" (i.e., the vendor becomes aware of it, and it becomes a 1-day), and the general availability of a patch.  During this time, a compromised user is not compromised by an 0-day, but is also unable to stop it via patching.

However, in the enterprise, things get different very quickly.  Firstly, we have to add "lateral movement" and "stolen credentials" to our list of vectors.  Secondly, we add enterprise applications, many written in house without attention to security, to our threat landscape.  These may have "0-days" by the dozen, and are commonly used to breach enterprises.  Finally, most enterprises roll out patches quite slowly in comparison to the rate of malware appearing that exploits a vulnerability.  Malware authors may not care if their malware crashes 50% of the time, but you better believe an enterprise cares if 50% of their workstations start crashing due to a bad patch.


Simple idea: If I can't make you go to a dangerous place, I check the "safe" places you go to and make one of them dangerous.

Attackers often spread malware by compromising websites and uploading malicious scripts to infect visitors (e.g. injecting a Flash exploit on a famous news site) - this is rarely a targeted attack. But in a watering hole attack, the adversary carefully chooses a specific website that they know their victim or group of victims visit frequently. So even if they are trained to not click on any untrusted links or to open unknown email attachments they will still eventually visit the website and get infected anyways. This way the attacker doesn't need to have the usual interaction with the victim, like sending out emails with dangerous links.

Real-life example from 2015:

  A Chinese attack group infected Forbes.com back in November in a watering hole attack targeting visitors working in the financial services and defense industries, according to two security companies.

(Source)

The term derives from the idea that instead of hunting their prey, predators often wait at watering holes because they know that other animals will eventually need to go there to drink.


is it possible to make a process hosted on svchost?

Yes, it is possible to run malicious code on svchost or any other system process if you have sufficiently high privileges. Malicious code can use one of many injection techniques to modify a running process. This has the advantage of making it harder (or nearly impossible) to detect or remove without crashing the system. In your particular case, it seems likely that your brother was infected with WinstarNssmMiner. Rather than making a process running under svchost.exe, it spawns it as a benign privileged system process and then injects malicious code into it:

  It’s unclear what the WinstarNssmMiner infection path is, but once the malware executes on a targeted system it launches a system process called svchost.exe, a process that manages system services. Next, it injects malicious code into svchost.exe.

Does the BSOD message say a critical process had died? If so, this is likely caused by the process being intentionally marked as critical, so its termination will bring down the system:

  The svchost.exe process created for cryptomining has a process attribute of CriticalProcess, which means terminating the process crashes the system.

This malware is new and is actively spreading in the wild. You should update your antivirus definitions. Teach your brother to only download files from official, trusted sources, or configure your system to only run signed executables. These are files that contain an embedded digital signature that proves that it was signed by a reputable certificate authority trusted by Microsoft.


Creating an X.509 certificate with an invalid signature

The simplest way to create an X.509 certificate with an invalid signature is to create one with a valid signature, and then alter the signature. A simple text editor will do the trick if you use the PEM encoding of certificates (the one with the "-----BEGIN CERTIFICATE-----" header and Base64 encoding).

X.509 certificates use ASN.1 and the signature value comes last, as specified in the standard:

 Certificate  ::=  SEQUENCE  {
     tbsCertificate       TBSCertificate,
     signatureAlgorithm   AlgorithmIdentifier,
     signature            BIT STRING  }

So for instance, take this certificate with a valid signature:

-----BEGIN CERTIFICATE-----
MIIGgTCCBWmgAwIBAgIIP2loSeAn4ucwDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UE
BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl
cm5ldCBBdXRob3JpdHkgRzIwHhcNMTQwNTIyMTEyODU3WhcNMTQwODIwMDAwMDAw
WjBmMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN
TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEVMBMGA1UEAwwMKi5n
b29nbGUuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQ80mW9KOdkTavOvJ
T8KdnZW/ClBvM2DNSYlXEjlHxLfN23DIgwfk7xnThlwyH4RTk4bhhtWtBTyR9Gh4
3BIE5aOCBBkwggQVMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjCCAuIG
A1UdEQSCAtkwggLVggwqLmdvb2dsZS5jb22CDSouYW5kcm9pZC5jb22CFiouYXBw
ZW5naW5lLmdvb2dsZS5jb22CEiouY2xvdWQuZ29vZ2xlLmNvbYIWKi5nb29nbGUt
YW5hbHl0aWNzLmNvbYILKi5nb29nbGUuY2GCCyouZ29vZ2xlLmNsgg4qLmdvb2ds
ZS5jby5pboIOKi5nb29nbGUuY28uanCCDiouZ29vZ2xlLmNvLnVrgg8qLmdvb2ds
ZS5jb20uYXKCDyouZ29vZ2xlLmNvbS5hdYIPKi5nb29nbGUuY29tLmJygg8qLmdv
b2dsZS5jb20uY2+CDyouZ29vZ2xlLmNvbS5teIIPKi5nb29nbGUuY29tLnRygg8q
Lmdvb2dsZS5jb20udm6CCyouZ29vZ2xlLmRlggsqLmdvb2dsZS5lc4ILKi5nb29n
bGUuZnKCCyouZ29vZ2xlLmh1ggsqLmdvb2dsZS5pdIILKi5nb29nbGUubmyCCyou
Z29vZ2xlLnBsggsqLmdvb2dsZS5wdIIPKi5nb29nbGVhcGlzLmNughQqLmdvb2ds
ZWNvbW1lcmNlLmNvbYIRKi5nb29nbGV2aWRlby5jb22CDSouZ3N0YXRpYy5jb22C
CiouZ3Z0MS5jb22CDCoudXJjaGluLmNvbYIQKi51cmwuZ29vZ2xlLmNvbYIWKi55
b3V0dWJlLW5vY29va2llLmNvbYINKi55b3V0dWJlLmNvbYIWKi55b3V0dWJlZWR1
Y2F0aW9uLmNvbYILKi55dGltZy5jb22CC2FuZHJvaWQuY29tggRnLmNvggZnb28u
Z2yCFGdvb2dsZS1hbmFseXRpY3MuY29tggpnb29nbGUuY29tghJnb29nbGVjb21t
ZXJjZS5jb22CCnVyY2hpbi5jb22CCHlvdXR1LmJlggt5b3V0dWJlLmNvbYIUeW91
dHViZWVkdWNhdGlvbi5jb20wCwYDVR0PBAQDAgeAMGgGCCsGAQUFBwEBBFwwWjAr
BggrBgEFBQcwAoYfaHR0cDovL3BraS5nb29nbGUuY29tL0dJQUcyLmNydDArBggr
BgEFBQcwAYYfaHR0cDovL2NsaWVudHMxLmdvb2dsZS5jb20vb2NzcDAdBgNVHQ4E
FgQUZ+wFAJG6n8knT4i1EhyqBhTlMxgwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAW
gBRK3QYWG7z2aLV29YG2u2IaulqBLzAXBgNVHSAEEDAOMAwGCisGAQQB1nkCBQEw
MAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3BraS5nb29nbGUuY29tL0dJQUcyLmNy
bDANBgkqhkiG9w0BAQUFAAOCAQEAFId/P3amOfPZtGwUDvIZlfp4kUJ/Qr/y9KMc
syO7YdcO+mSwOarZtZ1UdB3zBJ3d7vn2Ld1G0TiqFW8vIZk1OtWtdMC6hFQuC21P
Papck9jRhLZO1Jx4uFbGQdWM25z+a1TzxaoULmhAN9FF38OFKcrZlb/Gf4uETYV7
mMFQ10GT6UBESCkvEsT4hgEONQ/wXiOxDgMrbXBBm67IfXJzxmpncPDG6o49Dqw4
F6Jkkotp7ca6OvBnTvi0hcd4qS/64c/+0SjjLsWFq04W/zRJAUvF7mt8yiZHmv8f
E+FdDynG49hiV4MhWpmLdY5xzOWqb7+xmPdo3947SoHe9ZO2Mg==
-----END CERTIFICATE-----

(This is one of Google's certificates, I hope they don't mind.)

To turn that certificate into one with an invalid signature, you just have to modify one letter at the end. Don't touch the '=' signs (if they are present -- they are padding for Base64 when the binary data length is not a multiple of 3); to avoid an exceedingly rare potential issue with BER encoding, don't modify one of the four letters which immediately precede these equal signs (or end of data) either. To do what you are trying to achieve, you may change the last 'Z' into another letter (e.g., a 'Y'), so that the last data line now reads:

E+FdDynG49hiV4MhWpmLdY5xzOWqb7+xmPdo3947SoHe9YO2Mg==

and voilà! a certificate which decodes properly but has an invalid signature.


Could be anything from referral stuff to password steal. %68%74%74%70%3A%2F%2F%63%32%36%34%2E%72%75" translate from hex as http://c264.ru .

From there, anything can run further (scripts, etc).


How to sniff [possibly encrypted] TDS protocol data from the host the client application is installed on?

The best answer to "How can I monitor SQL queries" is to ask the SQL Server administrator to run Profiler.

However, failing that, on the machine you are a legitimate administrator on, you could run the app and a tool to look at your machine's RAM, the simplest example I know of being a simple Hex editor like HxD.

You can also use that same utility or a tool like Strings from Sysinternals to look for clear text SQL statements in the app's files themselves, wherever those files reside on your system.

Microsoft Message Analyzer can at least decode the TDS handshake.


A HTTP proxy server doesn't hide the content of the connection, it simply makes the request on behalf of the requester.  Now, if you're tunneling that through a VPN before it reaches the TMG server then your traffic should not be readable by the TMG (assuming the VPN is configured correctly e.g. DNS leaks, WebRTC, etc.).

With that in mind, it's usually pretty easy to tell that a VPN connection is being used on the network, and if that's against policy you could get in trouble for that.

There could also be additional software that was installed on your devices (assuming these are company devices) which are logging your browsing.


Exploiting memory corruption issues using a DLL file

Depending on how they were compiled, most DLLs use ASLR (http://en.wikipedia.org/wiki/Address_space_layout_randomization). Some do not, so this makes them easy to exploit. If there is some sort of information leak (printing out a function pointer or something), then the randomization doesn't matter because the attacker knows the randomized address.


How could the Skype app log me out from my Facebook account on OSX? Isn't this a huge security flaw?

First off, I am not associated with Facebook in any way, shape or form and I have no idea how the site code actually works.

That said, this doesn't have to be a security issue at all. In very broad terms, here's how I suspect it's happening in the backend:

Somewhere in FB's vast, vast database of user info there is a table that basically lists "The connection with this session ID is signed on as this user."
When your skype app starts up and presents FB with your login credentials, Facebook notices that you are now connected with two different sessions, decides that something must have happened to your previous connection and clears it from the session table.
The next time that your web browser calls up a refresh of your facebook page as it's instructed to do via the ajax/jquery code on the facebook site, facebook no longer recognizes that particular session and asks you to log back in.

No security breaches, and the Skype app is blisfully unaware of the havoc it has wreaked.


The query in question probably looks something like this:

SELECT * FROM users WHERE user = '$user' AND pass = '$pass'

The $user and $pass variables are likely sanitized by either removing or escaping " and/or '. That's why a standard attack of ' or '1'='1 or similar is not working.

With your injection, you will get the following query:

SELECT * FROM users WHERE user = '\' AND pass = '||1#'

As you are escaping the ' from the query, user is now compared to ' and pass = (which will likely evaluate to false, as no such user exists). # is a comment which cuts off the rest of the query, so ||1#' evaluates to OR true, which will be true. The authentication code will now likely fetch the first result of that query, or check if anything was returned, and thus authenticate you.


Security considerations in providing VPN access to non-company issued computers

I don't consider your policy overly restrictive or paranoid at all. It's right to consider VPN client computers to be less trusted than your on-premise LAN-attached computers. It's a sound practice to have firewalls or other control devices in place to limit the traffic allowed to move to/from that semi-trusted VPN security zone into more trusted areas of the network. VPN access from domain-joined, company-owned computers is, to my mind, more trustworthy than VPN access from home computers. Depending on the authentication mechanisms used by the company-owned computers, however, I might be inclined to limit their access as I would home computers. If simply swiping a company-owned laptop grants VPN access without additional authentication, for example, I'd be locking-down the network access of company-owned computers from the VPN, too.

The root issue you're getting at, though, is a policy issue and not a technical one. Whether or not employees should be permitted to replicate company data into non-company owned data storage mechanisms is a policy decision your management needs to make. It's not always a truism that a non-company owned data storage repository is less secure but it's almost always something that the company has no ability to easily audit the security of. Taking security on faith w/o auditing is a bad idea.


How to proceed after attempted cracking to accounts?

The first step is to identify if the attackers even managed to gain access to any accounts, or were still trying to get in. Head over to Have I Been Pwned? and check if any of your accounts have been leaked in the past. If that's a 'yes' - check if you were reusing your passwords. If that's a 'yes' again, go reset them and ensure that you use unique passwords this time around.

Next - if the attackers were attempting to access your accounts (I'm assuming this is the case, since your account was locked due to bad answers to the security Qs), I'd not worry as much. Reset the account, and go through the reset questions to ensure that you haven't given away the answers to them on social media or to anyone else you know.

All of this is general security advice. It's applicable to every question regarding actions to be taken after a breach.

Finally, if you're feeling very paranoid, you could call your account while you look around for what may have provided the attackers with information - scan your PC, wipe it if you have to. Do the same for all devices that you enter credentials on. Have you logged in on any new devices? Someone else's device?


The Origin-inheritance rules for iframes will prevent malicious content within an iframe from accessing the DOM of the parent.

Allowing sensitive control functional,  like administrative pages to be placed within an iframe exposes you application to clickjacking.  As a result most security-aware application disallow iframes with the x-frame-options.

Iframes can be a vector for XSS if you do not use proper sanitation:
<iframe src='javascript:alert(1)'> </iframe>


Is it possible to decode xor encoded string from N copys?

No, this is not possible. Encoding a message using XOR and a key of equal length, randomly chosen from a uniform distribution, leaves you with a ciphertext that is equally likely as any other possible ciphertext, regardless of what the original message was. Therefore, without knowledge of the key, the encoded message tells us absolutely nothing about its secret.

The security is not compromised by running the algorithm again. It will yield a second number whose probability is also evenly distributed and more importantly, independant of the first ciphertext, as long as the keys are chosen independantly, even if the message is the same. Once again, these two numbers are equally likely as any other possible combination of two ciphertexts, regardless of the original message. So here too, the message stays a secret.

In fact, if this were not the case and multiple versions of the same message, but encoded with different keys, did reveal information, breaking the encryption would be trivial, even with only one ciphertext. An attacker could easily make more, by XOR'ing the ciphertext with another number, as this is equivalent to XOR'ing the message with a different random number.


How to devise cryptographic system with sharing ability

You are raising a few questions here actually, so the answer won't be simple, and for sure won't be complete. First thing first, this question might be better suited for crypto.stackexchange.com.
A few basic things I'd like to point out:

Depending on the data size, you most likely don't want to use RSA keys for encrypting that. RSA keys can encrypt only data of up to certain size, which is just under the key length. It's not particularly efficient either.
I don't think you want to derive RSA keys from user password. This is not what RSA was created for and there is no standard solution to do that. RSA key is just a bunch of large integers, but of certain important characteristics. What I'd suggest to do instead is to encrypt data using a symmetric key derived from user password using one of the *KDF* functions. You can then use static, long-term RSA keys to encrypt the symmetric keys - both master and derived ones.
As for the password-based key derivation, I believe this is more about key lifecycle management than anything else. One solution would be to store key id for the current and previously derived keys in the metadata of the data it was encrypted with. Assuming the password changes, this will change the current symmetric key id (as well as the key itsefl), but previously derived symmetric keys could be used to decrypt data encrypted in the past. This all assumes keys are effectively rotated on password change, but never expired.

Apologies for my answer not being as complete as I'd like. However, I think it would be good to take a step back and rethink the original requirements, as what you have described in your question is more like a partial solution. If the community gets to know the original problem, they may be better equipped to provide the best answer possible.


The screenshot you presented is, without doubt (okay: excluding a prank app installed by an evil room-mate), a classic sign of a Man-in-the-Middle attack.

Despite the name, it's not necessarily hostile activity, or even bad. Some antiviruses have to routinely MitM their clients to be able to scan HTTPS flow (as well as decoding MIME attachments and expanding ZIP files; but those activities usually go unnoticed). You definitely want to be "MitM'ed" by your antivirus!

Several proxies, firewalls, load balancers and security apps do the same, to their networks' benefit rather than for your sake. That's still not hostile activity.

So - what really happened to you, this time?

The warning

On the "hostile" side of the question we have the fact that we don't know who is it that is unpacking/repacking the flow. Normally, you should be aware of protections that you own, or otherwise avail yourself of. They should go at reasonable lengths to make themselves known to you and reduce the chances of a mistake or misrepresentation (e.g. through error messages and popups exactly like the one you saw). This did not happen.

On the "friendly" side, there is the fact - not that it's good news - that the operation was sloppy in the extreme, writing "FAKE" in SSL fields and using a certificate that's been out of date for two years. It's almost as if the 'attacker' wanted to be detected. This scenario is common in poorly or carelessly maintained softwares (I could name a ministry where they replaced the certificates with last year's archived ones, so that until last Friday a certain website was expired on January 2nd, 2017 instead of expiring on January 2nd, 2019; the fact that this happened to you near the turn of the year might be relevant - or not), but also in hardware.

It is also conceivable (and too frequently seen) in hacked access points and routers, where sites such as windowsupdate.com, apple.com or antivirus sites or identity-querying sites (GMail, etc.) can be redirected to personal-data-grabbing or Trojan-supplying sites. You think you're updating your video card, instead you're installing a ransomware or a zombie kit. Your credit card details do not go just where you think they're going. This is done by breaking into vulnerable hardware through external access or cross-site scripting attacks (think  inside an advert banner: evil.site.com will then try to access your IP after a few seconds and see whether it succeeds. If it does, they pwn your ass).

But if this had happened, the broken-into appliance would stay broken into; what happened once would keep happening (and they wouldn't have been so sloppy).

This would be plausible if you'd unpacked an old router from the basement storage and plugged it in, complete with the hack you hadn't noticed when you thought the router had just given up the ghost two years ago.

The file

The binary file could have been deemed suspicious, but the VirusTotal upload was legit (i.e., you haven't uploaded it to a fake VT site pretending that the file was clean when it wasn't), the file is digitally signed and the sign checks out, so we can dismiss this data point as "McAfee false positive".

My current conclusions

We're left with what looks to me as a very low suspicion situation; I'd face it with heightened awareness and being more careful than normal for a few days, to see whether other strange things happen.

(Keep in mind that little strange things happen all the time, so it's important not to see the hand of Dr. Evil behind every network lag or broken image).

I don't think that the situation warrants replacing the firmware or the motherboard or similar extreme resorts.

BadBIOS

You may have found out that the "BadBIOS scare" is now thought by several researchers[who?] to have likely been little more than a series of coincidences - or, who knows, maybe even pranks, or attempts to get him to discredit himself - over which Ruiu, the only researcher to have been "hit" by BadBIOS, built an edifice of suspicions.

(If you think this has never happened to reputable researchers or even scientists, think again. I do not feel this event reflects badly on Ruiu at all).

So... with this new "definition" of BadBIOS - "something that makes you suspect that your BIOS has gone bad on you" - yes, you were hit by BadBIOS :-)


Spoof another IP address in the same network,will the spoofing source get the response?

It relies on how far you go in spoofing. When you only spoof the ip address but not the mac address the original host will get the answer.

If you did not only spoof the ip address but also the mac address it can happen that you also receive the answer. This is because the switch(es) on your LAN do map mac addresses to physical ports. This means you can "by accident" cause what is called port stealing by also spoofing the mac address. This happens when the switch sees that the mac address which is assigned to the spoofed ip address appears on your port. The switch then changes its CAM table and assigns the spoofed mac address to your port.

Port stealing will only work on when you send spoofed packets continously which does not seem to be the case. So when it happens it will only work for a very short time until the mac address is assigned back to the right port in the CAM table.


GnuPG is an ancient design that wasn't designed from the ground up to do authenticated encryption properly. This is, for example, one of the causes of the Efail vulnerabilities. GnuPG will output the whole plaintext for forged messages to stdout before checking its message digest code.

If you're looking for a commandline file encryption tool that follows modern best practices, age seems to be the up and comer right now. It uses ChaCha20-Poly1305, though, not AES-GCM as you're asking.

If you need public key signatures, signify is a much recommended newer tool.


Depends on what you do once it's rooted. Some phones such as HTC make it easy for developers to root them. Risks depend on your carefulness. Don't delete system files.

Security - more security benefits than risks if you know what you're doing.


I think I downloaded spyware from an ad on tortoise-svn site

PDFCreator, the real one, is a virtual printer which produces PDF files. It provides the "print to PDF" functionality to Windows machines. It is good software -- but what you got under the name "PDF Creator" might or might not be this software. Name uniqueness is not proactively enforced throughout the Web.

Wisedownloads.com is one of these myriads of sites which offer links or mirrored copies of various software packages. The AVG people find it "currently safe" although some users had mixed experiences with regards to stuff downloaded from that site (and other peoples have had mixed experiences with regards to AVG itself, so that information is not necessarily the Word of God). Wisedownloads.com appears to be based in Florida, thus subject to US Law, which could be a good sign.

On Windows, use Program and Features from the control panel to see which software is actually installed. "Honest" software which does not create menu entries or desktop icons will still appear there.

(If you were "in a rush" then possibly you did not install anything, you just downloaded the file, which will then appear in your "Downloads" folder. If you locate the downloaded file, whether you installed it or not, you could hash it with MD5 and search for the hash value on Google. There are sites which aggregate hash values for known bad files, and Google indexes them.)


binding to loopback interface secure enough

In general binding to localhost can provide a level of security in that the application is not generally reachable from other processes unless they run on the same system.

How much practical security that provides you somewhat depends on the security of any other applications running on the host.

For example an SSRF vulnerability in another application could lead to an attacker being able to submit requests to your application.  Whilst in many cases this would have to be done blind, I have seen examples of SSRF which allow the attacker to see responses to request made.

Obviously also if there are vulnerabilities on other applications running on the host (e.g. command injection/SQLi) then that'd likely be bad as the attacker may be able to get access to the localhost interface to send requests.


Dangers in hosting software on a webserver?

you can get a VPS for a month for $5 USD from one of the big VPS providers. You can even get one hourly, just for the competition. That way, you risk nothing to your home and don't rely on residential internet to host your competition.


Perhaps try this.  Isolate the network to only the laptop and the router producing the statistics in question are connected.  If the traffic onf concern is across WIFI, disconnect all network cables.  If across wire, shut down WIFI on both devices and watch to see it is not re-enabled.

Run Wireshark with a filter that logs only items that match NEITHER normally expected MAC.  Let it run for the duration needed to see the pattern.  If you can't figure it out from that, try replacing the NIC and different routers.


Obtaining e-mail address at registration

To avoid this kind of leak, you could also begin the registration process by asking for the e-mail. After entering it, you would send an e-mail with a link so that the user could continue with the registration process. If the e-mail was already registered, you would send an e-mail saying that.

That way, only the owner of the e-mail could register.

Drawbacks:

probably the real, common users will get bored by having so much steps to register.
in very few cases simple revealing that an e-mail is already registered in a site is a problem, specially because it's easy to register at any site providing any e-mail that you want. You'll just won't receive the e-mail to activate your account, but in general the site will link the account / username to that e-mail.


The effect of hidden or spoofed service banners on vulnerability scanners

The first thing to note here is that banner grabbing is an error prone way to check for vulnerabilities in a lot of cases (as OS vendors backport security fixes without updating version numbers).  Nessus as an example will try and work around that, but it's not foolproof.

The best way to address checking your security with scanners is to get them to do credentialed checking.  It's a lot more accurate and comprehensive than uncredentialed checking.  It doesn't take the place of a proper manual pen. test as there's things the scanners don't find, but still worth doing.

As to whether you should hide banners, I'm going to disagree with @limbenjamin and say that removing banners is generally a good idea as long as it's not really hard to do.  The reason for this is that it makes an attacker work harder to find out what software you're running, which makes more "noise" which can be detected by detective systems such as IDS (see also this question)


SFTP (as in, file transfer over an SSH tunnel) provides end-to-end encryption, plus verification of the server's identity.  FTP over VPN provides encryption from your computer to the VPN endpoint, and no verification of the server's identity.

If the VPN endpoint is the same computer as the FTP server, then FTP over VPN is as secure as SFTP.  In any other circumstance, SFTP is more secure.


Does public wifi pose a security risk to existing logins?

If the site you are visiting uses HTTPS for the entire site (not just the login page) and you check that it actually is using HTTPS, with a valid certificate (e.g., no warnings about a bad certificate) and it is the URL you want to go to, then you are safe.

(Except against extremely strong adversaries like governments who have the ability to coerce Certificate Authorities into signing fraudulent certificates or giving them the ability to sign them.  But at this point, these strong adversaries can do these malicious changes at the ISP level, so you are screwed either way).

If the site isn't using HTTPS, any data you send or receive may be eavesdropped or easily changed by an attacker.

You should also be extremely careful about downloading and installing anything that didn't come over HTTPS when on public wifi (though you probably should be cautious about this regardless).  E.g., if you install a browser plugin or command-line instructions that came over regular HTTP, it would be possible for an attacker to modify the plugin (to for example run on all webpages and send every form submission to some random domain it controls to steal your passwords / credit card info / etc).

  EDIT: While I appreciate the answers so far they seem geared towards real computers and I want to clarify I'm thinking about my Android phone. Thus my question about apps, because I have no idea how to tell if an app is using HTTPS or what.

You could try using a network packet catcher (like wireshark) to see if the apps are communicating using only encryption (e.g., look for HTTPS protocol).  Most major vendors should be using HTTPS for their apps if they use HTTPS for their website everywhere else, but you can't be sure (and its safer to assume it doesn't).  You mentioned Dropbox, and Dropbox for example states they use network encryption (TLS) everywhere between their apps, so you are safe to use Dropbox (assuming they are checking certificates correctly).

If you are unsure of a mobile app you can often use the mobile HTTPS site in your web browser instead.


Is it possible to do anything against a website with SQL injection that returns 400?

Errors such as 400 (and above) errors are thrown from the web-server side instead of the DB side. So your current query does not actually execute all the way yet. To correct it, you could possibly add linefeed characters such as %0A to the end of your injection test string. If you are on a windows platform you could try %0D%0A. These are HTML linefeed characters to assist with execution.
E.g:

%0D%0AUnion%0D%0Aselect
%0AUnion%0Aselect

A better alternative is to use a SQL testing tool such as the tool from Acunetix or alternatively the tools listed on the OWASP website: https://www.owasp.org/index.php/Testing_for_SQL_Injection_%28OTG-INPVAL-005%29 These tools will be able to test a much larger range of possible injections than you could perform manually.

Glad your company got testers but wish the dev person did not just ignore the error.


Separation of duties for user account creation

In Active Directory this can be done with the help of third-party solutions that can provide approval-based workflow. Here's our solution that allows you to do that (it's a solution that we provide which illustrates the approach)

The operation can be sent for approval only if certain conditions are met (e.g. if the initiator is not a member of IT staff group).


How can a server certificate be valid when there's a hostname/issued to mistmatch?

cyberark.com is in SAN (subject alternative name) of that certificate


How to secure a domain name from insider threats, domain hijacking in a corperate context?

The best thing you can do is choose a registrar with a good track record of taking security seriously.

Registrars sometimes offer the ability to have multiple user accounts which can administrate the domain. This is important because you wouldn't want to be locked out if someone quits and doesn't give you the current password, or if the email associated with the account is linked to that employee.

Certain registrars will also allow out of band verification before changes are allowed. E.g. they call you to confirm changes.

CloudFlare registrar has a good rundown of some good registrar protections https://www.cloudflare.com/products/registrar/custom-domain-protection/

Your domain security depends heavily on your registrars policies and security.


"Premium SSL" vs "Stanard SSL" certificates - Any reason why I would want a "Premium SSL"?

From a security perspective, you don't get any additional capabilities from the Premium vs the Standard as long as the key lengths are the same.  The difference is simply the level of validation that the CA performs and thus gives the end user more confidence in your site being legit.


Are CVEs and EDBs normally hard to reproduce?

I think it's difficult to talk about "the difficulty of reproducing CVEs" as a single topic since the complexity of the underlying vulnerability varies wildly from one CVE to the next.

Exploiting some CVEs is trivial, just download the exploit code, fire it at the application and presto! You're in. Other vulnerabilities can be much trickier, requiring a very specific environment setup, or a precisely crafted payload, or both.

The general rule for defensive security is "you can't protect what you don't know" and I think the same applies, maybe to a lesser extent, to reproducing vulnerabilities. Looking back at my own experiences, the most frustrating times came when I was working on a technology stack or a vulnerability I didn't understand.

My biggest piece of advice would be for each CVE you're trying to reproduce, take the time to read the white paper and really understand how the attack works. If it's on a technology you're unfamiliar with, take the time to learn that too.


Data collection when responding to malware alerts

Live response is a common and accepted practice today. A number of commercial and open source tools can gather volatile data, because immediately pulling the system off of the network can also be disruptive to the forensic validity of your evidence. The key is not "don't change anything", but rather "be able to explain and have documentation for any changes".

For example, SANS best practices explain fairly well how to proceed in this sort of case. NIST 800-86 also documents this in sections 5.1 and 5.2.

I recommend looking into tools like GRR or OSQuery. I don't know of remote live response tools for Windows other than commercial ones like MIR or Carbon Black. (I have no affiliation with any of those tools or organizations.)


I'd start with locking down BIOS so that the device can't be used to boot the system.

Then, I would disable automounting for USB devices. At this point, you need to limit user's interaction with the USB drive "subsystem". For example, this copying of data is usually required to dump logs or acquired data, therefore you can boil it down (in most cases) to:

mount the USB device
verify it is valid and has enough space
select the data you want copied among a choice of possible files
  (e.g. datalog.001, 20130402-dump.csv, anything in /var/local/data...)
copy said files
(optionally) re-read and check their MD5/SHA hashes
(optionally) delete/rotate the originals to free space on device
unmount the USB device

The process only allows interaction in the "select data", and that interaction is limited to a multiple checkbox choice. There are utilities (zenity, kdialog, or dialog for curses systems) that allow you to build a "locked down" interface in next to no time: this is an adapted example

#!/bin/bash
n=0
for file in $(ls /tmp); do
    n=$[n+1]
    echo "$file $n off" >> /tmp/output.txt
done
dialog --checklist "Items to copy:" 20 60 20 \
    $(cat /tmp/output.txt) 2>/tmp/output2.txt

for i in $(cat /tmp/output2.txt); do
    cp $i /mnt/usbkey/
done
rm /tmp/output*

Now, the user can only usefully plug a USB key when the system is already booted, and when he does, nothing happens; when he chooses the "Data Dump" function, his choices are limited.

You shouldn't need it, but be aware of possible exploits through shell metacharacters embedded in file names. Always get the file names with ls (or equivalent) and filter them.

Note: as noticed by Gilles, the above example is flawed: dialog there will only support names without spaces. For a more robust implementation, you ought to use something else than a bash script, possibly Python with Urwid or, depending on the existing interface, a CGI or web module.

Update

The best that can be done in bash and with dialog is, unfortunately, to remove the problematic files (those with $, space, single quote, double quotes...). A better, if lacking, script is this. It ignores any file not adhering to its naming convention; it may still be useful to someone (e.g. to copy logs. Unless you're now closing data-九月.log).

#!/bin/bash

DIRTOCOPY="/tmp"

clean() {
        rm -f .tmp.dir .tmp.out .tmp.cpy
}

clean

n=0

ls "$DIRTOCOPY" > .tmp.dir

while read file ; do
    if ( echo "$file" | grep "^[A-Za-z0-9._~^-]*\$" > /dev/null ); then
        n=$[n+1]
        echo "$file $n off" >> .tmp.out
    fi
done < .tmp.dir
rm -f .tmp.dir

dialog --checklist "Items to copy:" 20 60 20 \
    $(cat .tmp.out) 2>.tmp.cpy

cat .tmp.cpy
exit

for file in $( cat .tmp.cpy ); do
    echo cp "$file" /mnt/usbkey/
done

clean

Python

To do better, we have to employ a less fragile costruct. As suggested above, this can be done in Python using the urwid library (apt-get install python-urwid on Ubuntu, I'm told. Otherwise, installation is straightforward). This is little more than a modified tutorial I whipped up - yet it works even with files that either choke dialog or are copied incorrectly:

/tmp/tests/file with spaces.txt
/tmp/tests/file "quoted, but only once.txt
/tmp/tests/file "quoted twice", that's right!.txt
/tmp/tests/ceci n'est pas une |.txt

The only thing is that UTF8 files may have their names mangled: I have a file that's named "Chissà?" in Linux EXT3, and while it remains intact when copied to Linux or NTFS, it became "Chiss????" (yes, four question marks) on a FAT USB key. But I believe this is a limitation of the filesystem, not the script.

#!/usr/bin/python

import urwid
from os import listdir
from os.path import isfile, join
from shutil import copyfile

directory = '/tmp'
destination = '/mnt/usbkey'

choices = [ file for file in listdir(directory) if isfile(join(directory,file)) ]

tocopy = [ ]

def menu(title, choices):
    body = [urwid.Text(title), urwid.Divider()]
    for c in choices:
        box     = urwid.CheckBox(c, False, False, toggle, c)
        body.append(urwid.AttrMap(box, None, focus_map='reversed'))

    ende = urwid.Button('-- COPY --')
    urwid.connect_signal(ende, 'click', item_chosen)
    body.append(urwid.AttrMap(ende, None, focus_map='reversed'))

    return urwid.ListBox(urwid.SimpleFocusListWalker(body))

def toggle(button, state, file):
    if state:
        tocopy.append(file)
    else:
        tocopy.remove(file)

def item_chosen(button):
    response = urwid.Text([u'Proceed with copy?\n'])
    done = urwid.Button(u'Proceed')
    fine = urwid.Button(u'Cancel')
    urwid.connect_signal(done, 'click', copy_files)
    urwid.connect_signal(fine, 'click', exit_program)
    main.original_widget = urwid.Filler(urwid.Pile([response,
        urwid.AttrMap(done, None, focus_map='reversed'),
        urwid.AttrMap(fine, None, focus_map='reversed') ]))

def exit_program(button):
    raise urwid.ExitMainLoop()

def copy_files(button):
    for file in tocopy:
        src = join(directory, file)
        dst = join(destination, file)
        copyfile(src, dst)
    raise urwid.ExitMainLoop()

main = urwid.Padding(menu(u'File to be copied to USB', choices), left=2, right=2)
top = urwid.Overlay(main, urwid.SolidFill(u'\N{MEDIUM SHADE}'),
    align='center', width=('relative', 60),
    valign='middle', height=('relative', 60),
    min_width=20, min_height=9)
urwid.MainLoop(top, palette=[('reversed', 'standout', '')]).run()


Use same PGP key for private and business mail addresses

I use separate keys for the following reasons:

1) So my work/email is not exposed unnecessarily (not just to legit recipients but suppose a recipient's computer is compromised then you've made yourself a nice social engineering target for the bad actor since they may now have your personal and work email and possibly more if this was a work-sourced email then title and phones if in your signature)
2) So I can have different expirations
3) If I change jobs I don't have to update my home key

You would obviously also be able to have keys of differing types and sizes if that matters.

Hopefully that helps.


To some degree this is a matter of opinion, but I do not agree that there is a vulnerability here. If a client reflects HTML data from your JSON response without any sanitation, it is a vulnerability in that client and not in your API. Any webpage should treat API responses as untrusted data.

You are correct that HTML encoding the response is a bad idea. Why should the API make any assumptions about what is a proper encoding for the client? What if you want to use the API for a mobile app as well where the data will be displayed in a non HTML context? HTML encoding would just be bad design. It would be solving a problem for the client on the server side.

What I would do instead is to clearly document that the output may contain HTML special characters, and that the client should take appropriate action.

One thing, though: Make sure to respone with a no sniff header. Without it, mime sniffing browsers could interpret the response as HTML or JS, which would be a real vulnerability.


How to detect malicious fb2 & epub file?

What is EPUB?

  EPUB is an e-book file format with the extension .epub that can be
  downloaded and read on devices like smartphones, tablets, computers,
  or e-readers.

Can EPUB file contain malicious code?

Yes it can. (You can read this - https://www.baldurbjarnason.com/notes/epub-javascript-security/)

Here is another example of how epub had security flaw in past: XML External Entities

Are epub files often used by malware authors?

No. Compared to PDF and others formats epub is rarely used by attackers.

If you want to detect suspicious content (i.e. JavaScript) manually you can start with any hex editor and then you can write your own yara rules if it's needed. Of course if JavaScript is present that doesn't mean it has to be malicious but it can be a subject of further investigating.

Search in header of file for:

6D 69 6D 65 74 79 70 65 61 70 70 6C 69 63 61 74 69 6F 6E 2F 65 70 75 62

mimetypeapplication/epub

or:

74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74

text/javascript

More about epub/epub2 and epub3 go here - http://epubzone.org/news/epub-3-and-interactivity


Is it a good idea to to use secure_hashing_function(mypassword.url) as my password?

It's better than using a single password, but not much. If you have one site store the new password in clear, and if your hashing algorithm isn't strong, someone could notice that hash sitting in a list of otherwise clear text passwords and try breaking it. Assuming they know where they got the original list, if they find "passwordexample.com", they are going to be pretty confident that other passwords you have will be "passwordexample.org" and "passwordexample.net", hashed with whatever hash function you chose.

If you can remember a single strong password, which I'm assuming you can from the question, use a password manager. You can either use an offline one, such as Password Safe or Keepass, or a cloud based one. Either way, you can generate unique passwords for each site, and only have to remember one password yourself.

There are attacks against password manager apps, but they generally require either access to the machine which the app is currently running on, so assuming you don't leave your app open, are very unlikely in practice. Similarly, cloud based ones have been hacked before, but attackers don't appear to have been able to get access to the passwords stored in them.


Multiple instances of programs allowed in Windows Firewall

(IME) Java requires firewall exceptions for both TCP and UDP (and one firewall rule can't do both) so that's always two. In addition you can easily have/use more than one java programfile if you:

use both java.exe for console mode and javaw.exe for GUI mode
use both 32-bit and 64-bit java on 64-bit Windows
use more than one major version (java 7 and java 8) and possibly with recent versions if you install new update(s) without replacing/removing earlier one(s)

Click the AdvancedSettings botton on ControlPanel / Firewall, or equivalently ControlPanel / AdministrativeTools / WindowsFirewall... or shortcut just run mmc wf.msc. Select InboundRules or OutboundRules as applicable (usually only Inbound as normal profiles implicitly allow programs Outbound), expand the Program column so you can see all of it, optionally drag columns around and/or click on the heading to sort, and you can more easily see the different programs.

Your two Firefox entries indicate the same executable in the entry name; it's conceivable the actual executables are different, and you should probably confirm, but the Mozilla people don't usually do silly things like that. But quite a few other properties of a firewall entry can differ, like protocol and address/port limitations, so scroll across and look for differences in any column(s) except Name.


Builder vs. Breaker - Do developers make good pen testers & vice versa

Generally speaking, to be a good pentester you have to master some of the skills that are required to be a good programmer. Solid development experience about possible programming mistakes is very helpful, because a lot of pentesting is about finding corner cases that the programmer did not think of -- i.e., bugs. This goes both way: a good developer should have some pentesting skills because making robust code implies taking care of anomalous conditions, the kind of things that the pentester (and potential attackers) try hard to trigger.

There are facets of software development which do not directly help with pentesting; in particular structural abilities like knowing how to design a simple, slick and extensible API, or being good at documenting code.

There are facets of pentesting which do not directly help with development, e.g. everything which amounts to social engineering.

As for psychological traits, I'd say that it is not really a question of building vs breaking; at least not about being good at building or breaking. It is more about having fun at building or breaking. Pentesting can be frustrating, especially if you are on the "creative" side of people, because you spend all day dealing with poorly written code and you know you could do much better, but that's not your job. On the other hand, a successful intrusion into a seemingly robust server is intellectually rewarding; pentesting is a battle of wits, where you fight against the mind of the developers, while development is a battle against the laws of physics, which can be daunting at times. Development or pentesting, you can do it for a long time only if you find the activity pleasurable.

Alexander the Great was a developer; Machiavelli was a pentester. Genghis Khan was both.


Website uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Looks like you are missing which SSL protocol and in which order to use, also you must specify on which IP should SSL be listening.

And eventually your virtual host with 443 should look like this:

<VirtualHost X.X.X.X:443>
SSLEngine on
SSLCertificateFile /home/user/ssl.cert
SSLCertificateKeyFile /home/user/ssl.key
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCACertificateFile /home/user/ssl.ca

 #rest of directives...
</VirtualHost>

Above version will ensure compatibility with most SSL clients.

Make sure to replace X.X.X.X with your server's IP.

Line SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 tells apache which ssl protocols to use.

You can then use some online tool to test validity and quality of your server setup and SSL certificate, one good result for example could look like this:


Help understanding PCI-DSS when using password based encryption from automatically generated keys

Q1. no, the password from which the key is generated (btw how is this done? PBKDF?) is not the KEK. The key you use to encrypt the password stored in the config file, that is the KEK. What do you mean, the password is not encrypted?

Q2. Not exactly.
If you implement a KEK to protect the key-generating password, then the KEK needs to be managed. Who can access the KEK, who can change it? That is where the split knowledge / dual control needs to come into play. For example, depending on your system, perhaps when it comes up two people need to manually enter (their part of) the KEK, to allow it to decrypt the key-generating password. Or perhaps you focus on the "dual control" part, where one has the OS-level password to enable local access to the config file, and one has the physical key to enter the room (assuming the config file can only be modifed locally, of course).

Of course, I am not a QSA, most importantly I am not your QSA - consult with him/her to verify your solution before implementing it.


What happened to US-CERT Weekly Vulnerability Bulletins?

The February 1st report seems to be restricted access, though I can't say for what reason.

The February 8th and 15th reports don't seem to exist, or at least not at the urls at which they would be expected.

Edit/Update:

They are apparently having unspecified issues which are affecting their weekly security bulletins in unspecified ways, but are in an unspecified process of applying unspecified resolutions to these unspecified issues, and they hope that they will be able to resume posting their security bulletins at an unspecified time in the near future.


Is it a common practice to give a user an unmodifiable password?

You are right to be suspicious about this service.

The automatic login after account creation doesn't really bother me too much. The only reason it's not commonly used is that websites typically like to verify the email address in the case of an account needing to be reset, if you don't have a verified email, how can they do that reliably?

The bit of them sending you a password in plain text, is a very bad idea for a couple of reasons.  First, if they send you the email with a password in it, it is very possible that that password can be compromised by a mitm as email is not encrypted by default.  Second, if they are sending you the password, it is likely that they have stored it in plain text.  Normally it is a bad idea to store passwords in plain text because people reuse passwords and when one site is broken into, the attacker can access all the other sites that password is used in. In this case I would think it would be less likely that the password you get assigned is something you would use with another site, but still possible (obviously don't do this).

If you can't change the password, I would not trust the website. If you can change the password, I would still be a bit skeptical.


Is macOS installing known bad Certificate Authorities by default?

Apple's reaction to the StartCom irregularities is:

Apple products will block certificates from (...) StartCom root CAs if the 'Not Before' date is on or after 1 Dec 2016 00:00:00 GMT/UTC. (Source)

So to verify certificates that have a 'Not Before' date prior to the one mentioned above, they need the StartCom certificate.
With regard to Symantec certificate authorities they've decided on the following timeline:

Starting August 1, 2018: Partial distrust of Symantec CAs
(...)
Later date: Full distrust of Symantec CAs
(Source)

I guess the 'later date' hasn't arrived yet which is why they still need the Symantec certificates.


Can the aproximated date on which a given Encryption Algorithm will become prone to brute force be predicted?

Given the constraints in your question, yes, it can be predicted.

For symmetric-key encryption algorithms, the answer is "never".

Assuming Moore's Law is valid for the next century (an extremely optimistic assumption -- such a computer would be drawing much of the energy output of the Sun to power itself) and that current computers can test a million keys a second (a reasonable assumption), a computer in 2114 will be able to test 7.3*10^25 keys/sec.  At that rate, it will take approximately 146,000 years to brute-force a 128-bit symmetric cypher (the minimum considered "secure" right now).

Asymmetric cyphers are a different matter.  Since they depend on certain mathematical operations (eg. computing discrete logs or factoring numbers into large primes) being difficult, they're vulnerable to improvements in the algorithms for performing those operations.  Improvements in computing power are relatively easy to predict; mathematical breakthroughs are rather less so.


Hacker used my account to place an order, but not my credit card. Why?

This is my first time hearing about this kind of "scam", so I am guessing, but I'm pretty sure I can tell you the answer.  The key detail is here:

  Order confirmation (about $1000 worth of power tools)

When I hear that I immediately conclude that this order was placed with a stolen credit card.

Anecdotally, I used to manage an eCommerce site for a very small (3 store) chain of hardware stores.  They had frequent problems with people using their eCommerce site to purchase things with stolen credit cards, and the chargeback fees from their processor when the fraud was reported were painfully high.  This caused them to spend time manually verifying any potential fraud orders.  Fortunately, fraud orders were fairly obvious: they always involved large numbers of power tools.  Fraudsters would buy power tools for the same reason they buy phones/laptops with stolen credit cards: they are easy to resell for near retail.

Initially the company I worked with would look at the shipping address as one factor to determine the odds of fraud, but that eventually became worthless: as you mentioned, fraudsters learned to change the shipping destination en-route (UPS supports this with a myUPS account, for instance).

Therefore I suspect that the combination of a local shipping address and using your already established account had the same purpose: attempts to minimize red flags and skirt past any potential fraud screening on Home Depot's side.  I would guess that the fraudsters are working under the assumption that Home Depot will look less carefully at orders from established accounts than from new accounts or anonymous orders.  I'm sure that Home Depot does plenty of their own fraud screening (probably automatic rather than manual), so the fraudsters may even be correct.

Also, I agree with your assessment that the spam was meant to hide the order confirmation from you.

In short, your account is being used as a patsy to use stolen credit cards to place fraudulent orders.  Whether or not Home Depot might try to hold you responsible for the order when the credit card is discovered to be stolen is unclear to me (probably not), nor does the fraudster care (IMO).  I suspect the use of your account was all about trying to minimize red flags on the order, rather than trying to hide their own identity or shift blame (they could have just as easily placed an anonymous order for that).

Regardless, proactively notifying Home Depot about the fraud order was obviously the right call: then there is certainly no risk of them blaming you.  Moreover, it saves them a bunch of money.  It's a shame that they made it so hard for you to do that for them.


Program detecting sandboxie present - How to prevent?

What should I be doing to prevent the application from breaking when I
  hex edit the new name in? Should I be searching for something else
  beside SbieDll.dll to replace?

In the 80s, it was possible to open a program binary with a hex editor and change strings (on computers such as Atari ST, Amiga, etc.) and even then the size of the string had to remain the same... In today's operating systems, it is possible  to change some strings in an .exe, but that will tamper the exe’s Code Signing Certificate (if there is one) and provided you overcome counter measures taken (such as obfuscating these strings) weren't taken.

  The second being, what other techniques may the game be employing to
  detect the presence of sandboxie? And if so are there any other ways I
  can hide that the game is in fact run by sandboxie?

Other techniques commonly used are:

Anti debugging
There are many ways to detect a debugger running and the simples one is calling the IsDebuggerPresent function. This function detects if the calling process is being debugged by a user-mode debugger.
Anti breakpoints
It's very hard to reverse engineer software without breakpoints. Popular anti-reverse engineering tactics are based on detecting breakpoints, providing a series of corresponding anti-debugging methods.
Bypassing NtQueryInformationProcess checks
Probably the method used to detect Sandboxie.
To bypass it,  The values returned by the NtQueryInformationProcess function should be changed to values that don't indicate the presence of a debugger.
Obfuscation in your case, making it hard to find the string “SbieDll.dll".

In fact, you can learn more by reading what the other side if this endless battle has to offer, for example PELock.
They have dedicated functionality to prevent game hacking.

To sum up, the only way is to some how overcome these protection methods, reverse engineer the entire software, disassemble it, then make the changes at the source code level, and rebuild it.


AES ECB Mode for single block/random data encryption

If you only have ONE block, using other modes such as CBC does not offer extra security. Remember, the only secret here should be the key to encryption/decryption. IV is usually a known entity. If you hope to achieve better security by making IV a secret, you are approaching it from a wrong direction.

Saying so, I would still not recommend ECB ;). Think about two users having a same password. Their encrypted passwords are also the same, due to the "code book" nature of ECB.

In your case, I would probably use CTR mode with the counter value being simply the ID of the user.


Where are fingerprints stored on an Android phone?

Does a fingerprint scanner come with its own storage where fingerprints are stored?

No, but Android uses a Trusted environment, known as Trusty TEE. This secure enclave runs the Trusty operating system. The Trusty does not hand out the fingerprint data.

On hardware with support for a secure enclave, this OS will run on special parts of the hardware, unavailable to the rest of the OS. It communicates via a dedicated interface.

  How does the fingerprint scanner decide which fingerprint requests from apps are legitimate?

It doesn't. That's left to the user. But the fingerprint scanner doesn't return raw fingerprint scan results to the OS. An app requests the Trusty OS to authenticate the fingerprint, using the relevant API. It then tells the app whatever the authentication succeeded or not.

  When you factory reset a phone, do all the fingerprints get securely wiped?

I would imagine that wiping the device nukes any encryption keys, which will probably be stored within the TEE. This effectively makes the data unrecoverable, as it is unencrypted. I could however not find any sources for this.


Yes.
If the connection isn't encrypted (for example TLS) and the attacker is able to spoof his IP (which isnt hard) in this scenario he can even make a Man in The Middle Attack by putting himself in a position where he can receive the packages from the Client, analyze them and pass them to the Server.


Why is there "t=[your device]" in duckduckgo query URL?

From DuckDuckGo's &t= page:

  Through partnerships with developers and companies, DuckDuckGo has been integrated into many applications. In these partnerships, a portion of DuckDuckGo's advertising revenue is sometimes shared back. To assign advertising revenue and collect anonymous aggregate usage information, developers add a unique "&t=" parameter to searches made through their applications.

They say the results are an "anonymous aggregate" and not for customizing results or tracking users.

Their API docs also suggest apps using the API should include a descriptive t parameter.

  Use a descriptive t parameter, i.e. append &t=nameofapp to your requests.

Sounds like whatever software you are using on your Raspberry Pi is simply using this feature as instructed.


Feasibility and scalability of a large biometric system (e.g. Aadhaar)

Assuming that only "the best two fingers are being matched" doesn't seem to be a reasonable assumption.  Since deduplication is harder, surely evaluating all 10 fingerprints where physically possible would be an obviously more sensible strategy, and likely the one followed.
One of your sources says UIDAI says duplicate enrolments are around 5% and that  UIDAI says it detected 34,015 cases (about 0.1%) where one person has been issued two Aadhaar numbers.  What's unclear to me is how they detected these cases - what techniques were used to identify "true duplicates" as opposed to "false duplicates" in each of these sets.  In other words, once UIDAI cancelled those 34,015 Aadhaar numbers, how many duplicate enrolments were left?  None?  Not necessarily.  How many residents who a valid Aadhaar numbers no longer had one?  None?  Not necessarily.

We don't know the  collision rate among 290 million users is 0.01%.  Given the info presented, I think we don't know the  number of fingerprints being compared, or what else if anything is being compared) to identify the 5%, 0.1%, or (by definition) what % of duplicate enrolments remain undetected.

But can we figure it out / guesstimate?  The report on authentication says the System FAR is set to 1 in 10, 000 (i.e. 1 in 10, 000 authentications will have a false accept error)

If as the report suggests, the FRR – False Reject Rate goes from 6.5% to 2% with one scan and from 3.5% to 0.7% with up to 3 scans when going from 1 best finger to the two best fingers, what would we expect could happen when we go with the maximum # of fingers for 1:1 authentication?  for 1:N identification?  I don't find enough info to offer specifics.  More research needed.

But I can answer the "Do biometric authentication systems have negative network effects, whereby they get progressively worse (less accurate/precise) as the number of users increase?" part of your question. Yes.  They do, categorically.  You have a correct understanding of the problem.  Biometric systems do get progressively more challenged, as users are added, to keep FAR and FRR low.


Secure way for bulk mailbox verification to avoid IP Blacklisting

While you might have a valid reason to do mass verification of e-mail addresses such validations are also done in preparation of spamming these users and thus are often considered misuse - which will quickly get you onto blacklists. No TLS will help you in this case, because TLS only protects the transport but says nothing about abuse or not.


Is this HSTS header set correctly in LAMP?

1. What does preload do?

The preload flag indicates consent for the domain to be allowed onto the HSTS preload list (used by Chrome, Firefox, IE 11, Edge, and other browsers).

  The Chrome security team allows any domain to submit their domain to the list, provided it meets the following requirements:

  HTTPS is enabled on the root domain (e.g. https://donotcall.gov), and all subdomains (e.g. https://www.donotcall.gov) – especially the www subdomain, if a DNS record for it exists.
  The HSTS policy includes all subdomains, with a long max-age, and a preload flag to indicate that the domain owner consents to preloading.
  The website redirects from HTTP to HTTPS, at least on the root domain.

Source: https://https.cio.gov/hsts/#hsts-preloading

You can see more information on the HSTS Preload Submission page.

2. What does env=HTTPS do?

This is an argument of the Apache Header directive (part of the mod_headers module):

  env=[!]varname

  The directive is applied if and only if the environment variable varname exists. A ! in front of varname reverses the test, so the directive applies only if varname is unset.

In this case, the HTTP header is only sent when the HTTPS environment variable is set. This environment variable is only set when pages/resources are accessed via HTTPS. The reasoning behind this is in section 7.2 of the HSTS specification:

  An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.

As to why, see this question.


There is a benefit from doing this. These options enabled retpoline to mitigate Spectre V2. This is important in programs which handle sensitive or confidential data where the variable performance impact is not a concern. The binary is different because return trampolines are being added to the code.

The second flag, -mfunction-return, is required on Skylake+ processors as they are additionally vulnerable to attacks against the branch target buffer (BTB) that return prediction may use as a fallback.


Can one use a Credit Card as a Smart Card?

While the EMV chip on credit cards is technically a smart card, It is of a type that is    not reprogram-able. (would be a very bad design if it could be)

Most smart cards can  be used as a key source and often they can hold several keys inside. they usually employ a strategy of single-write or generate on chip for the private key itself. this also makes duplication impossible (a preferred characteristic in most cases).

If you want to play around with smartcards is often easier to get a sub variant, like the YubiKey or Nitrokey. I also strongly advise you te read up on what each type exactly is and what it can and can not do.


Exactly how is a pseudorandom number generator a security risk?

The recommendation on the Diceware site is based on the assumption that the user is a non technical person. A dice has a very simple construction, and it's pretty obvious to any person how a dice works. It is much easier for a non technical person to verify that a dice throw will produce a random result, than for them to verify how an electronic PRNG computes a random number. Even for the smartest of technical people, it takes years of study of very specialised form of discrete mathematics to be properly qualified to evaluate the mathematics of a CSPRNG.

The other main problem with electronic PRNG is that most of the popular PRNGs are designed for speed, not for security purpose; a cryptographically secure PRNG is much slower than normal PRNG. They're also quite fickle, it's fairly easy to use a CSPRNG to produce random looking numbers that turns out to barely contains any randomness (examples: Debian's OpenSSL fiasco). A physical dice a lot easier to use correctly than a CSPRNG. It is much easier to teach non-technical user to use physical dice correctly, than it is to teach an experienced programmer to write code that uses CSPRNG correctly or to teach seasoned system administrator to setup a system with the proper environment to run a CSPRNG code.

With that said, in modern system, it is possible to write an pseudo random number generator that's suitable for pass phrase generation purpose. As long as you're aware of the twenty thousand or so caveats and precautions, it can be just as secure as physical dice. Its fickleness and opaqueness though, makes it much easier to recommend a dice to non technical users and most technical users.

  Let's say I wrote a small script that ... current time in milliseconds, takes the square root and takes the digit before the decimal point if it's 1-6) to simulate a dice throw. ... how exactly does this help me to guess the passphrase I create with this method?

If you seed your PRNG using the current date time in milliseconds and the attacker knows or guesses that you generated the passphrase sometime around 2018, then this reduces the range of possible passphrases significantly. Instead of having to search 7666^6 = 77.5 bits of entropy for a 6-words passphrase, knowing just the year that the passphrase was generated allows the attacker to only need to search 31536000000 possible passphrases (the number of milliseconds in a year), which is equivalent to 34.9 bits of entropy (a modern computer can brute force this in a few hours, or minutes with GPU).