kernel: Intrusion disconnecting me I've read about it a little but I'm concerned.
It never happened before and for last 5 hours my router gets kernel: Intrusion alerts similar to these:

As soon as the kernel: Intrusion is detected, it drops my ADSL line connection.
I have dynamically assigned IP from my ISP, so I doubt it's DDoS.

So what can it be?
I guess normal kernel intrusions don't disconnect you from network, do they?

What can I do to stop it from disconnecting me?
It's been 5 hours and a disconnect every 2-5 minutes...

I know that the 'intrusions' being detected are harmless from other posts, but they are disconnecting me. There's no other explanation.

Your link goes down about 3 minutes after the "intrusion" has been detected. It's highly unlikely that the disconnect has been caused by one of these network packets.

The packets look like regular scans (SYN packet to TCP port 22 - that's a classic, the other is a proxy scan - looking for squid at 3128), I have serious reservations that this is something that can disrupt your connection. DDoS it isn't, you'd be seeing a LOT more packets if this was a proper DDoS.

Possible scenarios:

Buggy ADSL router firmware. Try turning off some of the "security" features of your router firewall (e.g. SPI firewall, DDoS protection, etc.), and testing whether this would make any difference. You may also want to look at firmware updates, or running a good open source firmware (e.g. Tomato).

Overheating chipset. Happened quite frequently with el-cheapo routers and poor heat dissipation design - dropping ADSL. Try shutting down your router for a few minutes and starting it again.
Disturbance/problems with the ADSL line (most likely). You need to talk to your service provider, or have a look at ADSL diagnostics, e.g. S/N ratio, BER, etc.

Good luck and let us know how you get on with this.


How could malware disable third party security software? I'm asking this question with the assumption that anything the user can do, so can malware.

I'm using a third party firewall on my system to control which programs are able to access the internet. However I notice that I - as a limited user - am able to change the firewall configuration without elevating through UAC. I notice the user interface is running as my user, but the agent is running as SYSTEM.

When I stop the software through the UI, it seems to block by default (ping blocked), which is of course good behaviour. However I can simply go to the UI and disable the firewall and other aspects without any extra privileges. There is an option to apply a password to the UI, but I'm not sure how secure the implementation is (so will assume it's weak).

So in the event of a malware infection, what's to stop the malware from simply disabling the firewall the same way as the user?

I'd like to find out more about how third party security products implement tamper protection and password protection, but I can't get any good results from my searches. Any pointing in the right direction would be greatly appreciated, thanks.

So in the event of a malware infection, what's the stop the malware from simply disabling the firewall the same way as the user?

Nothing.

If the malware is coded to do such things (which some samples are to some extent) they absolutely will.

If you are logged in with an account with local admin privileges, then this could explain why you can make changes without elevation. This is a bad security practice and a significant advantage for malware, which most samples are known to absolutely exploit local admin privileges to do make changes and ensure persistence.


Is it possible to save scanned biometrics and use it later I provided my identity using biometrics for getting a SIM card.  Is it possible for this Point-of-Sale guy to save my data and use it later for getting some more SIM cards without my knowledge?

If yes, please explain how it is done.

Biometrics is just data. Yes, it is possible to take captured biometric data and 'replay' it back into the system. BUT, the more important question is how the system protects against this. This is a known problem with multiple ways of combating it.

So, yes, it is possible but only if the system is so poorly designed that one would have to question the system's validity at performing core principles.


Is it important for an ethical hacker to know the C language in-depth nowadays? I'm interested in becoming an ethical hacker someday. I've been reading articles saying the Python language is very popular in hacking activity because of the extent of its modules (including network).
Nowadays, lots of applications are web applications or mobile ones and the antivirus software make a great job removing malware written in C. Because of that I'm a bit confused. Is the knowledge of the C language important for the ethical hacker career?

Of course, you don't necessarily have to know C, or the given platform's Assembly (read: instruction set), but knowing them is a great help in figuring out many possible low-level vulnerabilities.
It is not the C language itself that matters, but rather the fact that in order to know C, one must first understand many fundamental computer principles, which is what allows you to then (ab)use them in any other language. You could learn about all of them in theory, but without ever practically experiencing them (which is what you achieve by programming in C), you may not be able to use them very efficiently or even realize where they're best applicable.
Similarly, you don't have to know the exact packet structure of networking protocols. However, if you do, you may suddenly be able to figure out ways to break something, which wouldn't ever occur to those who make, often incorrect, assumptions about how these protocols function solely based on their high-level experience.


Justifying strong 1st factor in the context of multi factor authentication -- beyond passwords I am wondering if you need strong 1st factor (for theoretical correctness, please note it is the knowledge factor -- not necessarily a password, but definitely also includes strong passwords)?

What use case would be that to have strong first factor?

Why can't we have a combo of 2nd (what you have, device ) and 3rd factor (what you are, bio) and do away with 1st factor ? What is  that keeps 1st factor live and kicking in day-to-day secure transactions?

Breaking a knowledge factor have a theorical cost we can easily assure beyond human capability (a password with 12 dicewares words will never be unhashed using unbroken 256bit hash), if we exclude human vulnerability and implementation vulnerability (and the fact nobody use a 12 words password) this is a perfect security and provable as is. (as long as we can't read human mind at least)

Bio security isn't a theorical identification it is using natural part of our identity we are now able to read but not reproduce. (your print, ADN and iris aren't prvate everyone can access them). You can't determine how secure is your authentication, you can say it need a really hard to produce device to fool your system but you still have to admit this device can be build. This is just adding technical difficulty to break your authentification process not a assurance of security.


How do I check if a script is safe to run? I've been using NoScript for a couple of years now but I can't seem to figure out which scripts are safe to allow and most of the time I just temporarily allow all the scripts. Is there a way to check if a script is safe other then running it to find out?

In short, no.  Determining if something is "safe" is isomorphic to the halting problem.
The best you can do is to execute the script using an agent you regard as safe.

Keep in mind that one class of exploits involves trusted functions doing things
they're not supposed to do.  Suppose for example that choose your vendor here
installed a back door in the "print" function so that if the printed string was
39549235-052-4-234-2-42-3-29q4er-2348-2398 they would also open a connection to
NSA headquarters and dump the contents of your hard drive.


If I only know part of a password and part of the hash is it possible to get the full password? I'm trying to learn more about hashes and cryptography and doing my own pentesting, but I seem to be stuck on this problem.

The hash function being used is SHA1.

If I'm trying to determine a password and I know that the last X characters of the password are: endofpassword#.

And I know that the beginning of the hash is: e921a7cde9e64d612b, but not the rest of the characters for the hash, is it possible still to determine the password and what tool would you use for this?

I believe Hashcat would not be suited for this sort of attack but I may be wrong.

Considering that I am reading your question correctly you know the first section of an SHA1 hash and then the characters in plain text after the hash.

To successfully pull off this attack you would need to write a script that guesses passwords as Password1! + randombytes# and hashing the full combo with SHA1 and then checking to ensure the beginning of the hash of the guessed password equals e921a7cde9e64d612b and adding it to a list of potential passwords.

You mentioned using hashcat however due to the nature of your attack method as mentioned above it would be easier to write a simple script in a language of your choice to pull off your attack.

In short the attack is possible but would be more difficult since you do not have the full hash.


Exposing ports or hide them behind proxy Are there any security threats when ports are exposed publicly instead of hiding them via proxy? E.g. server application listens on port 8090. We can call this application directly hostname:8090 or use a proxy (apache/nginx/etc/) to make redirect hostname -> hostname:8090.

Does this solution increase the level of security?

This mainly depends on how you are doing the proxy.  If you are simply using mod_rewrite in Apache or Nginx to redirect from 80 to 8090 ... then there is no security gained at all.  This is the equiv of putting a sticky note on the front door of your house saying "please use the door in the back".  Anyone can read the sticky, and even if there isn't a sticky anyone could case the house and find the back door to be open (aka port scan your host).

If you need to have a web service that is only accessible by certain people one of the best ways to do it is to instead host the service on localhost or 127.0.0.1 ... this means that the port will not be accessible outside the box.  Then, in order get to the service you ssh port forward:

ssh -L 80:127.0.0.1:8090 example.com -i ~/.ssh/id_rsa

the above is how to achieve ssh port forwarding in Linux, however it is also available via tools like puTTY.

Using a ssh tunnel to access your service increases the level of security by:

encrypting the communication between client and server
protecting service behind pubkey (or password) auth used by ssh
no external port to be scanned

If you do not want to setup SSH tunnel another option is port knocking.


Google Open ID connect and ID token I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication.

The other item that is significant is the access token.

My idea was to send the id token to the client, and keep access token only on the server, so that when a user comes next time to the website they can "present" their "id token" and be considered as logged in.

I was wondering if it is a bad idea to send id token over the wire and cache it, or is it acceptable to do that?

Have you read the OpenID Connect docs thoroughly?

From the documentation:

  After obtaining user information from the ID token, you should query your app's user database. If the user already exists in your database, you should start an application session for that user.

I haven't read the docs fully, and I may be wrong here, but you receive the id_token from Google in response to an HTTPS POST

  id_token   |  A JWT that contains identity information about the user that is digitally signed by Google.

so why do you need to 'send' it to the client?


One-time mystery redirect from one of our pages I'll make the explanation of the situation as thorough as I can, and the question is at the bottom.

Recently, we received a report from one of our users that, immediately after logging out of our application, he was suddenly redirected to a malware site.

There was activity in the address bar, and was forwarded in succession to two subsequent malware sites (as seen in his history). The final site he landed on was one of those pages that displays the obviously false claim that your computer has been compromised, and gives you a number to call.

I have the two URLs in question, but I won't post them here, as they're obviously nefarious.

Anyway, this leaves us with the puzzling question of what happened. The way I see it, there are two options:

The user's computer (an Apple, with no anti-virus software) is compromised
Our server did the redirect

The user said that he had the same issue a long time ago, but nothing like this recently. This is the first time in a long time that something like this has happened, and it only happened the one time on our site. It's tough to know if the issue the user had actually is the same issue as now.

This is the first, and so far only, report of this nature that we have had.

Some of the checks I did were:

I checked the code in the area of the application relating to the action he performed, and there seemed to be nothing amiss.
I looked at the source of the website just before performing the last action the user did, to see if there was any odd JavaScript. It all checked out.
I checked the "live" version of the application against an older repository, and nothing out of the ordinary
I grepped the entire web directory looking for headers, PHP eval statements, header calls and base_64_decodes (possible PHP redirects), and the actual malware URLs, and found nothing suspicious.
I searched all the Apache config files for any suspicious redirects, and didn't find anything.

I've also tried repeating the action he performed (using a similar environment to his) many times, without replicating the redirect. He also did it again later, and didn't receive the same problem.

Obviously, whether it is on his side or ours, it is not consistent.

The question is: have I missed anything obvious to check? Could there be an Apache / server level compromise doing this, for example?

The first place I would be looking to find what my server has done is in my logs. A redirect issued as a header would show there (but not a meta or javascript redirect).

At least this would tell me which code to audit.


How to implement secure device identification in a for-pay wifi router to prevent usage fraud? After reading this question about how for-pay wifi routers identify specific devices it got me thinking about what a secure alternative might be.  I know that certain research has focused on identifying devices by their browser signature and by their hardware clock skew signature.  The former can be defeated by changing the browser signature, and the latter is difficult to implement and takes time to create the baseline.

MAC addresses can be altered, IPs can be rotated, and cookies can be hijacked or accidentally erased (eg. in the case of the for-pay wifi router, that would be undesirable).  Are there any practical alternatives to identify a specific device?  Are there characteristics of hardware that are consistent, unalterable, and undeniable (eg. CPU IDs [are they even still implemented?], but TPMs perhaps?)

How would you secure a for-pay wifi router to prevent others from gaining free access?

The only way to accurately identify a specific client on a network would be with cryptography.   If each client had their own asymmetric key pair and you used a SSL VPN then it would be a lot easier to enforce resource usage rules.

Panopticlick would never work for this.  The browser signature will change because of updates or installing new plugins/languages/etc.  Not only that but this value is about as easy to spoof as a MAC Address,  just run Panopticlick on the victim's browser and then modify your system to match.  The bottom line is that software fingerprinting is too easy to fool and is error prone.

My gut feeling is that hardware fingerprinting is not the right path.  What if the attacker has identical hardware?  Macbooks are pretty popular these days.  Again this kind of fuzzy matching is error prone and could produce false positives/false negatives.


Why does my SHA256 certificate get encrypted with 168 bit 3DES? We use S/Mime certificates for internal emails within our company.

The certificates signature algorithm are all SHA256RSA with a hash of SHA256. I have confirmed the public keys are RSA(2048bits).

Most of the time the emails are encrypted with AES256 encryption as expected. However some user's Outlook will only encrypt with 168bit 3DES, when these people are cc'd in emails going to others as well all emails are receive as 3DES (I assume this is because there is no point encrypting it at a higher level for some and not for others). This is happening despite all the certificates being issued by the same CA, and most at the same time.

Currently all the users we noticed this problem with are Mac users. However some are using Apple mail and others Outlook on mac, so this is likely a coincidence.

What do I need to update to ensure all the encryption is AES256?

Your question appears to have nothing to do with certificates or hashes. Neither one involve symmetric ciphers (like DES or AES) at all. The actual answer is just a matter of how Outlook (or Mail.app) is configured on each machine, nothing more. I don't know how to control the ciphers used on Outlook for Mac, but here are the steps for Outlook 2013 on Windows; hopefully you can find their equivalent on Macs:

In Outlook, open the File tab on the left of the ribbon.
Select Options from the left sidebar that appears.
In the "Outlook Options" window that pops up, select Trust Center from the left sidebar.
Under the "Microsoft Outlook Trust Center" heading, click the Trust Center Settings button.
In the "Trust Center" window that appears, select E-mail Security from the left sidebar.
Under the "Encrypted E-mail" heading, click the [Settings] button.
In the "Change Security Settings" window that appears, under the "Certificates and Algorithms" heading, check the "Encryption Algorithm" drop-down. Set it to AES (256-bit) if it isn't already set to that.

You might find the following page helpful for your Outlook for Mac users: https://support.office.com/en-us/article/Digital-signing-and-encryption-settings-8A6EB21D-0BEB-4E66-A63A-2D362966CF77. In particular, it tells you the steps to get to the settings page:

  To access these settings from the primary Outlook Accounts preferences screen, select the account, click Advanced, and then click the Security tab.

After that, it should be similar to the instructions above (under "Encryption settings", find the "Encryption algorithm" option and select AES-256).

Something to clear up: the certificate has nothing to do with the symmetric cipher used for bulk encryption. There are three types of cryptographic primitive in use, here, and none of them have anything to do with the others:

Asymmetric ciphers (in this case, 2048-bit RSA). These have pairs of keys, a public key that you let everybody see, and a corresponding private key that you don't let anybody see. Anybody with the public key can encrypt a message such that only you (the holder of the private key) can decrypt it, and anybody with the public key can verify that you signed a message using your private key. However, these ciphers are extremely computationally expensive, so usually you only encrypt or sign a short string (a symmetric key for a message or a hash digest of a message/certificate, respectively). Encryption provides privacy / confidentiality (nobody but the holder of the private key can read the message). Signing provides authentication (only the holder of the private key could have created that signature) and integrity (if the message is tampered with, the signature won't verify correctly, so if it verifies you know the message wasn't messed with). These are used for:

a CA (Certificate Authority) signing a certificate's hash (so that the recipient knows the certificate is yours and nobody is spoofing your key)
a message sender signing a message's hash (so the recipient knows you sent the message and it hasn't been tampered with)
encrypting a bulk encryption key to send with a message (this key is usually randomly generated for each message, and is never exchanged in plain text).

Symmetric ciphers (like 168-bit 3DES or 256-bit AES). These are used for the actual message bodies (and attachments) that are being encrypted. They are fast, but the same key is used for both encryption and decryption (that is, they are symmetric) so there is no public key that you can safely share with the whole world. Thus, the symmetric key for a given message is sent protected by asymmetric encryption. These provide confidentiality only.

Many symmetric ciphers are a type known as block ciphers (this includes all forms of AES, DES, Blowfish, and many others). Block ciphers work on fixed-length blocks. To be used with messages longer than one block, one uses a mode of operation; some of these are more secure than others. To securely encrypt messages that aren't an exact multiple of the block size, one uses padding.
While padding can make it possible to detect naïve tampering with the encrypted data (or ciphertext), it is easy for a skilled attacker to bypass this detection. Also, padding is not always used since the data to encrypt is sometimes reliably an exact multiple of the block size (for example, hard disk sectors). Therefore, padding alone should not be trusted to provide integrity.
Similarly, the most common modes of operation (CBC or CTR) do not provide integrity. Tampering with data encrypted using a block cipher in CBC mode can produce attacker-controlled changes in the decrypted data, although it will corrupt data beyond that. However, some modes of operation (like GCM) also ensure integrity when decrypting. If only one other party has the symmetric key, then these modes also provide authentication (you know that the message came from the other holder of the key). An algorithm that provides confidentiality, integrity, and authentication is called authenticated encryption.
There also exist symmetric stream ciphers (such as RC4, which was widely used until exploitable weaknesses in it were discovered). These have no block size, need no padding, and are usually extremely fast. However, they only provide confidentiality, and must be combined with other primitives to provide integrity and authentication.

Hash functions, sometimes called one-way encryption, like SHA-256 (a member of the SHA2 family). Hash algorithms are used to produce short codes called digests (suitable for asymmetric signatures) that can be used to demonstrate that something (like a certificate or message) has not been tampered with. The following are some properties common to secure hash algorithms:

Resistance to preimage attacks. That is, having the hash digest doesn't make it possible to produce the original data that was hashed to produce this digest.
Collision resistance. For a given message (such as an email or certificate) and its digest (such as was used to create a trusted signature), it should not be feasible to find a second message that produces the same digest.

The choices for one primitive have nothing to do with another. You can have somebody's certificate that was signed using 512-bit RSA (super weak) signature of an MD5 hash (cryptographically broken) but contains a 4096-bit RSA key that you can use to encrypt messages back to that person. You can't trust the signature on the certificate, but if you trust the source of the certificate anyway there's no reason you couldn't use that super-strong RSA key. You can encrypt a message to that person using the incredibly weak DES (56-bit) cipher, or using 256-bit AES; for either one, you'll send the symmetric encryption key protected by that 4096-bit RSA key.

There exist an enormous number of potential combinations of primitives (asymmetric and symmetric ciphers, hash function, key exchange algorithm if needed, mode of operation if needed, padding algorithm if needed). A number of popular ones are grouped as named "cipher suites" for use in TLS. That term is not commonly used for S/MIME (and some available features of TLS, such as ephemeral keys, are not available for asynchronous communication like email). However, the idea of combining a set of primitives to provide strong security against multiple types of attack is still relevant.


URL redirection vulnerability I've just read the following advisory at http://www.securitypentest.com/2011/02/facebook-url-redirect-vulnerability.html. In its solution section, I found a strike-through text: "Only works when your login to Facebook". What's wrong with it? If it requires users to be logged in to exploit, so is it still a vulnerability?

Yes. I guess before that point, a user didn't even have to be logged in to be redirected through Facebook. But then, for some time, the user needed to be logged in to Facebook for it to work.

It is still a problem, since a quite a few people are always logged in to Facebook. Though even though a user might now have Facebook open right now, he might still be logged in, so the redirect system can still be abused for a fair share of people on the internet, depending on the audience. A login box won't apear, since Facebook will recognize the session cookie that gets sent to them.


Volatility Forensics with Large dumps Today I was tasked with the analysis of a .vmem file of a Windows RDS one of our customers due to some "strange" connections coming from native Windows processes.

The extracted .vmem file has a size of 20GB.
Requesting the imageinfo with C:\Python27_64\python.exe vol.py -f XXXXXXX-Snapshot184.vmem imageinfo has so far taken up to 60 minutes without movement after:

Volatility Foundation Volatility Framework 2.6
INFO    : volatility.debug    : Determining profile based on KDBG search...

According to the volatility FAQ, there have even been reports of memdumps of over 200GB being analyzed with volatility.

What are the best practices to analyze large memdumps?

Granted that patience is a virtue and loading 20GB into memory can take some time, especially if the bytes have to be analyzed for signatures, I am looking for solutions or tips in the trend of:

File format XXX will give better performance results than format XXX
Running plugin XXX will speed up usage of future plugins
Tweaks (unofficial, unsupported, undocumented)

I just can't imagine anyone waiting X days to wait for imageinfo to return the correct profile for large dumps.

Have you looked at rekall?

It is a fork of volatility, while I have had better luck with volatility it might be faster for the initial analysis


Was I hacked remotely, how could I find out? Windows 7 I was cleaning out my old windows 7 HP desktop computer approximately 5 months ago. There was only the expired Norton 360 as far as antivirus and no firewall.  Up until this point I disabled the wifi since I knew it was unprotected.  I put all of the files I wanted to keep onto two external hard drives.  Then I deleted them from the internal hard drive.  When I went to find a file on the external hard drive a day later, it wasn't there, so I performed a system restore from a very old back up, and then I downloaded a recovery tool from cnet downloads.  My intent was to get all of the files back and repeat the saving.  I did that and got some files back, so I just left the program open and the computer on, but in sleep mode.  I thought I disabled the wifi connection, its my usual practice to do so, but I admit, I may not have.

Due to work/travel I just left the computer on for like 3 or so months in the sleep state with the program open under my windows user profile.  It would occasionally leave sleep mode but the screen would stay off, I could just hear it wake and then sleep, I assumed it was just me stepping too hard and moving the mouse or something like that.  When I woke the computer on purpose after all that time, it was open in under my dad's windows user profile, which isn't password protected.  I also checked and saw that the wifi was connected.

I live alone, so the odds of someone physically using my computer is ~.001% as I haven't had guests, and nothing was missing and there was no sign of entry.  Also on the desktop of my dad's user profile was the verizon fios home manager icon which seemed new, but then again I never was on his profile, but I personally don't remember this being there, and he never used the computer, I just set it up for him.

Was I hacked?
How can I check?
Could someone have accessed my plugged in external hard drive?  I had WEP protection on my Fios router.  Which I know isn't safe (now).  Sorry for the long post.  Just wanted to be thorough.

Additional info: I downloaded Avast immediately after I thought something was wrong and I turned on the highest level firewall and disconnected the wifi.  I scanned every drive 3 or 4 times and didn't find anything.  I then turned the computer off and haven't had it on since.  That was approximately a month ago.

I would certainly format the computer but if you do not want to, and assuming you do not have a rootkit, you could:

-Use netstat to check active connections and see if there is something strange going on.

-If you are willing to, would be to proxy the traffic of your computer through another device and have wireshark or tcpdump capturing the traffic(a small raspberry pi?). Analyze it.Using a trusted external device would rule out the possibility of seeing tampered results.

-Check your running processes and startup ones. Check for those with high/intermittent cpu or high/intermittent network usage. When you are away from your pc, do as i do and disconnect the network cable. Check if the computer turns on even with the cable unplugged. This won't probably rule out anything if the malware connects to a malicious server but let us assume it is the opposite (the server connects to your pc and wakes it up).

-Paranoid mode: create a usb bootable kali and run some AVs and rootkit detectors on the hard drive. Running an AV on a compromised machine rarely works. You can also check the applications running on boot through the bootable distro. This also rules out the possibility of the OS misbehaving.

-As for the wireless, go to the admin page of the AP and disable wifi (to prevent a hacker who found your password from keeping the access). Change to WPA2-PSK and change the password (bigger is better). Through the interface check the connected devices: mac addresses and compare them against your list of devices. A malicious AP could also be ruled out by having you capture wireless/ethernet traffic from it to your devices to check if it is compromised and attempting to compromise the internal network.

Good luck and stay safe ;)


Denial of Service question I am studying for an exam in computer security, and I got stuck on the following question from a past exam:
A random program generator service S allows clients to generate random data. Each client Ci
shares a symmetric key Ki with the service. The system implements the following protocol:

In order to ask for random data, a client Ci sends the UDP message IPi, IPS, X, L to S, where IPi is the IP of the client and IPS is the IP of the server, X = E(IPi, Ki) is the encryption of IPi using key Ki, and L is the number of byte requested

The service checks that D(X, Ki) = IPi and terminates if the check fails

If the check succeeds, the service generates L bytes of random data, splits the results in
blocks of 512 KB, and sends each block Dj to the client via a UDP message IPS, IPi
, Dj to Ci

Describe how this system can be abused by an attacker (that is not one of the clients)
in order to perform a DOS of one of the clients Ci. Assume that the attacker has less
bandwidth than the victim and that they cannot recover the key Ki even if they can
analyze the traffic.
So far I am thinking that in order to DOS a client we have to somehow make S send out data to this client. However, since we do not have the key Ki, I cannot really see how we could ever make S send out any data. Some guidance here would really be appreciated.

Assume that the attacker ... can analyze the traffic

Based on this I would assume that the attacker can see the traffic. It can thus see the packets send by the client Ci. It can generate a new message with the same and IPi (using IP spoofing), IPS, and X as a previous one but with a large L. Since the authentication of the client is only based on a static token X which is the same for all messages from Ci and independent of the actual number of requested bytes, this request will be considered a valid request from Ci. This small request will trigger the sending a huge amount of random data from IPS to IPi - thus causing a denial of service against Ci.


Hacking own computer Ok I've worked with some penetration testing but it's all done in house where I work at on a secure network to secure servers and work stations before being deployed. But my question here is kind of vague on the laws of the U.S.
I want to show my girlfriends son who is interested in my line of work some examples of hacking, but I can not bring him to where I work because they live two hours away from me.

So my question here is, would it be illegal for me to set up one of my personal servers or computers on my home network and then actually hack into it from her house with in the same state? I would be using all my personally owned equipment (ie. laptop, server, desktop PC, routers and cable modems) only thing I wouldn't own is the internet itself, that is owned and controlled by bright house networks.

For demonstration purposes, I personally would just create a few virtual machines, and demonstrate what you can do to them locally. As mentioned, placing a vulnerable machine on the internet is just a bad idea. If you can hack into it, so can others... and as my firewall logs indicate, there's always someone poking around...


Is it possible to detect the real location of an IMSI catcher? As already known, IMSI-catcher is “is a telephone eavesdropping device used for intercepting mobile phone traffic and tracking location data of mobile phone user”.

When the user registers to this fake base station, it (usually) answers with a fake location.

Can it be located nevertheless? i.E. does any device exist to do that, or is it possible to identify the real location by using some specialized software?

The SeaGlass researchers aim to find the location of IMSI-catchers via anomaly detection at a city scale: https://seaglass.cs.washington.edu/ .

To identify potential IMSI-catchers, they rely on four anomalies:

Reporting to be at a fake location (as you mentioned)
Broadcasting at unusual channels
Supporting different features from regular towers
Constantly moving or turning on and off

To answer your question: you may be able to detect it easily, but finding the location may require triangulation.


Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu) Does the built-in apt package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages?
My understanding was that software downloaded with apt-get packages would be cryptographically verified because the repo would sync pgp-signed manifest files on apt-get update.
However, I stumbled on an article today that suggested that unsigned packages are accepted by default on all major Debian-based Operating Systems by the contents of /etc/dpkg/dpkg.cfg
root@disp2019:~# cat /etc/dpkg/dpkg.cfg
# dpkg configuration file
#
# This file can contain default options for dpkg.  All command-line
# options are allowed.  Values can be specified by putting them after
# the option, separated by whitespace and/or an `=' sign.
#

# Do not enable debsig-verify by default; since the distribution is not using
# embedded signatures, debsig-verify would reject all packages.
no-debsig

# Log status changes and actions to a file.
log /var/log/dpkg.log
root@disp2019:~#

Indeed, this does not look good.
Do Operating Systems with apt require valid signatures from a pinned set of keys stored to the apt-key keyring on all packages by default? Or are these signatures just treated as optional by default?

There are two types of cryptographic validation here:

Apt supports that each developer signs the package with its own key, and to validate that on package install. This is what this file refers to and is not used (currently) by Debian, Ubuntu, etc.

The repository manifest is cryptographically signed with a repository key (see apt-secure(8)) and that validates the referred packages. That is used by all of them.

So, there is a cryptographic validation, just not the one that file refers to.


Understanding a real stack based based buffer overflow while reading on how, and what is buffer overflow on the owasp page
I saw documentation on a buffer overflow in the LibPNG

It said the following code is vulnerable:

if (!(png_ptr->mode & PNG_HAVE_PLTE)) {
    /* Should be an error, but we can cope with it */
    png_warning(png_ptr, "Missing PLTE before tRNS");
}
else if (length > (png_uint_32)png_ptr->num_palette) {
    png_warning(png_ptr, "Incorrect tRNS chunk length");
    png_crc_finish(png_ptr, length);
    return;
}
...
png_crc_read(png_ptr, readbuf, (png_size_t)length);

I am having trouble understanding why it's vulnerable.

From the wiki article you linked:

  The code appears to safely perform bounds checking because it checks the size of the variable length, which it later uses to control the amount of data copied by png_crc_read(). However, immediately before it tests length, the code performs a check on png_ptr->mode, and if this check fails a warning is issued and processing continues. Because length is tested in an else if block, length would not be tested if the first check fails, and is used blindly in the call to png_crc_read(), potentially allowing a stack buffer overflow.

The code appears to check if the length is shorter than the buffer. But the length checking is done in an else if block. When png_ptr->mode & PNG_HAVE_PLTE is false, a warning is logged and program execution continues without performing the else branch and thus without checking length > (png_uint_32)png_ptr->num_palette. That means in any situation where the "Missing PLTE before tRNS" warning is generated, the length is passed to png_crc_read without ever being checked.

A plausible explanation for how this bug could have been introduced is that "Missing PLTE before tRNS" used to be an error-condition which aborted the whole function. In that case there was no reason to bother what would happen afterwards. But some time later someone reduced it to a warning-condition without checking what that meant for any subsequent code.

Edit: Another possibility for a buffer overflow in the above code could be if the value of png_ptr->num_palette comes from an untrustworthy source. But the example doesn't mention where it comes from, so I doubt that's what this example wants to illustrate.


Help me find the right Security Consultant for the stage our organization is in We are a small company (< 20 ppl), have developed a fairly complex backend platform that exposes a web services API and we are currently productizing a SaaS-based offering that is a client to the backend. Both the backend and the SaaS-based offering are being marketed to enterprise prospects.

We adhere to security best practices but obviously we need independent verification and scrutiny if we are going to satisfy some of these large prospects. Eventually we will probably adopt some framework (COBIT, ISO 27001, etc.) once we can make some additional hires, segregate duties, etc. but for now we would like to improve our SDLC and submit our web applications to third-party penetration testing.

We have been trying to avoid the big accounting firms and big technology vendors (e.g. IBM) in the belief that they will be expensive and not in very good alignment with our organization. I guess I would call these "Tier I" consultants for lack of a better term.

We have tried what I'd guess I would call a "Tier II" firm (i.e. their personnel have come from a Tier I firm and provide similar services but are more affordable) but their experience seemed highly influenced by servicing companies seeking SOX compliance, etc. and the approach didn't seem like it was in good alignment with our need to prioritize our security expenditure.

I have tried to get in touch with other Tier II consultants but they seem to have their own issues (i.e. personnel leaving, don't get back to me in a timely fashion, don't really probe to see how they can best service our needs, etc.).

I am a bit reluctant to seek a sole proprietor or smallish company (call this Tier III I guess) as we want to leverage a name a little bit if we can and partner with someone that can provide some continuity of service and resources in a timely manner. No, "Sorry, I'm fully engaged right now, call me back in a month."

Which leads me to my conundrum/question: What kind of Security Consultant would you recommend for a small company that: 1) has a fairly complex web application; 2) markets its products and services towards enterprise prospects; and 3) needs to prioritize its security expenditure?

I should also state that I was trying to find someone with feet on the street in my neck of the woods so that we could meet face-to-face. I'm wondering how important a factor you think that is for this type of engagement.

TIA

Here's some background on the players:

CPA firms. Financial-world focused, they deal with CFOs and regulatory questions. Typically less technical in exchange for more business knowledge and being able to sign off on assurance engagements. Depending on the field you're in, other companies might not play with you if you don't have a letter from one of these. Because of their basic financial assurance, they are also found playing strong in other assurance fields like HIPAA.

The big 4 (down from 8) KPMG, Ernst & Young, PwC, Deloitte Touche. They all have specialist departments focused on IT. Their strength is in great depth and they can call up from around the world. Big doesn't necessarily mean better -- it's a price trade-off. you're paying extra for the insurance of somebody who "cannot fail". I've seen some signs otherwise, but maybe that's personal bitterness: http://www.healthcareitnews.com/news/maine-inks-179m-deal-medicaid-management Go here if your company is so large that you need more than 10 staff to get through your engagement.
The regional players: There are many, and they're filled with people who will go to the big firms or who came from them. Since Sarbanes-Oxley's independence rules, they get a bigger share of the pie. I work for one of the regional players, and regionals play in the Fortune 500 game. Go here if you're looking for expertise at a lower cost than a Big-5 and won't need enough feet on the ground to trample you. Beware that not all of them have deep technical knowledge. Most of them should have appropriate connections to other firms for specific parts of projects. (Say you're in Seattle - I might show up there once or twice, but if I need a lot of hands-on I might send somebody from another firm as part of a network). Shameless promotional pitch: http://bnncpa.com/

Boutique firms Specifically dedicated to IT, they may be useful for better internal development. Some industries will take assurances from a boutique as an outside vendor.

National / International firms Sourcefire, Rapid7 and IOActive fall into this category. They're probably closer in staffing to a larger regional CPA firm. Their customers are technology companies or suitably large IT departments.
Local players The rest of the world fills out this. Smaller shops that cover a specific region and have a more narrow field of experience. Their people probably are more generalized in their experience.

One really good way to get an idea of what's in your area is to take a look at your regional conferences for ISACA. In my case, http://www.isacane.org/events_detail.php?select=257 has a list of players form all of the above categories except the regional CPAs (boy, somebody dropped the ball there?). Besides that, you might also find actual specific recommendations if you poke around this site's chat room.


TLS - How to know a CRL URL is not changed If a hacker would manage to sign a certificate with a stolen (private) key of a CA and would remove or change the URL in the CRL Distribution Points extension, and later the certificate would be revoked by the CA, then how would a browser know the certificate has been revoked if the URL to the CRL is changed so that it links to an old or by the hacker generated CRL?

The location of the CRL for a specific certificate is embedded into the certificate itself and is visible for all which have access to the certificate, which is at least any client connecting to a server using this certificate. The location is put their by the issuer of the certificate (the CA), i.e. it is not included in the CSR (or gets replaced).

To have a different CRL in the certificate than the usual one the attacker needs to compromise the CA, i.e. the issuer of the certificate. It is true that the CA can not revoke the issued certificate then as long it has no access to the CRL location published in the certificate.

But again, making such a change to the certificate means that the attacker has compromised the CA. After such a compromise the CA itself must be revoked (or removed from the trust store in case of a root CA) which in effect invalidates all certificates issued by the CA, including the one certificate with the bad CRL location.

That's at least the theory. In practice some CA's are too big to fail and in this case fraudulent certificates actually gets inserted into the browsers trust store and explicitly marked as untrusted there. This process is outside the CRL/OCSP revocation checks.


Should a web application return true http errors? Exception and error information can be used by a malicious user to map out the API of an web application, so it is routine to see security checklists to advise returning only a "Please contact your administrator" type of message.

On the otherhand, we are encouraged to use HTTP standards, which recommend errors such as

400 -- bad request
401 -- unauthorized
403 -- forbidden
405 -- method not allowed
500 -- internal error
501 -- not implemented

Those all seem to provide some information about the API, namely that such an invocation exists and while your attack was close to a properly formatted request, it wasn't close enough.

Should all of these HTTP request be translated to the same error message, or should standards compliance prevail?

UPDATE: As an application developer, personally I prefer fairly rich exception messages and don't like that most apps I work on return 200 for everything that the application returns and only returns non-200 errors when ASP.NET or IIS feels like returning a non-200 error.

I'd say to not buck against RFCs in a vain attempt to provide security through obscurity, they'll create more headaches when someone plugs into your API and is receiving 200 codes when the server is really throwing 500s.

Honestly: if you somehow get a list of all my API signatures, I still wont care and will return 403s all day. Even on an open API your 500 messages should be generic enough that they don't really know what is going on to begin with other than "the server didn't like the input, please follow spec, etc. etc".


How wise is it to use a tool for portspoofing at your server to confuse attackers? I came across this tool recently  https://github.com/drk1wi/portspoof

How efficient will it be to use it to confuse hackers doing port scanning? If it's actually  going to be pretty efficient, why hasn't it caught up so far? That is, 189 stars for 5 years is bad.

Multiple problems here.

Dynamic port responses - if I scan you from two different IPs and compare the two responses, do I get a valid port list? If so, it is a very weak defence.
You're burning CPU to respond to the reconnaissance phase of an attack. This can be used against you. Depending on how this is set up, I can kill your server by forcing your spoofer to consume all the CPU on the machine.
Are you sure portspoof doesn't have any extra bonus vulnerabilities that your app DOESN'T have?
Can I slowloris likely non-real ports and see what else stops responding to filter out spam?
If you're running this, and I get a foothold and open a remote command port - will you notice, or will you get lost in your own spam?


What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings? I work heavily with SSH and SFTP, to be specific between two machines, both of which have their SSH port open on a public IP address.

What are the toughest SSH daemon settings in terms of encryption, handshake, or other cryptographic settings in 2018?

I am specifically interested in the cryptographic protocols. Securing SSH with good password selection, good key management, firewalling, etc. are out of scope for what I am asking here.

So far, I have found and set on both machines in /etc/ssh/sshd_config:

AuthenticationMethods publickey
Ciphers aes256-cbc
MACs hmac-sha2-512-etm@openssh.com
FingerprintHash sha512
#KexAlgorithms

This can be considered a follow-up question of Hardening SSH security on a Debian 9 server which I have posted before some time ago. But in a specific way, I want to know the highest settings.

You have a good discussion here: https://wiki.mozilla.org/Security/Guidelines/OpenSSH

On modern OpenSSH they recommend:

KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256

Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com

This page gives explanations for each choice: https://stribika.github.io/2015/01/04/secure-secure-shell.html

(do not be fooled by the hardcoded date in the URL, the document is updated from time to time as can be seen from its "changelog" at https://github.com/stribika/stribika.github.io/commits/master/_posts/2015-01-04-secure-secure-shell.md)

Against Logjam, see the end of https://weakdh.org/sysadmin.html :

KexAlgorithms curve25519-sha256@libssh.org


How to prevent WiFi jammer attack? How can I prevent a WiFi jammer attack on my wireless network?

For example if I send a deauth (deauthentication) packet with aircrack-ng on Kali Linux for a specific client, he/she can't use WiFi.
and if there is differences between jamming and deauthentication attack, whats that?

There's not really a solution to it. Deauth packets are part of the protocol. If you're using WPA, someone can send deauth packets. One method of mitigation would preparing for wireless location. If you notice an attack, you can quickly triangulate and neutralize the source.

This question also deals more specifically with making sure you aren't vulnerable to other issues that can come from a deauth.


Can expired credit card information be used for fraud? I have encountered a situation where payment card (debit/credit) information, including name, number, expiration date, and cvc, is being saved by an organization unencrypted in excel spreadsheets on shared drives.  The files are several years old and per the expiration date all the cards recorded have been expired.  The obvious solution to the problem is to delete the information unless a very good reason exists to keep.

My question is, what is the risk exposure for unencrypted information for expired payment cards.  I am not looking for details on how to carry out a fraud.  I am seeking general information on whether the data can still be exploited for a fraud and if so what are some general ways.  I am asking so that I can properly assess risk in an area I don't have experience in and so I can educate my clients on any dangers so they can appreciate the need to identify all the instances and address the problem.

In addition to the chance that a replacement card with the same PAN, but new expiration date and CVV has been issued (as noted by others in the comments), it can of course be used for spearphishing.

Just knowing that John Smith has a platinum card with XYZ bank, and used it to pay for a 10-pack of Nutella sandwich spread opens up for sending him an email or snailmail with some fantastic offer from that bank, or from a merchant he has been doing business with in the past (e.g. "Nutella Wholesale Traders Int").


Preventing man in middle attack (LAN) I am working on a local area chat application which would simply establish connection between two sockets on the LAN and proceed with communication. Now focusing on security, my main concern is to prevent my application from data leakage due to successful mitm attack.

In web there is certificate verification, but I don't have any dedicated server, as it can be simply communication between the only two nodes on network.
The closest question was this - Preventing man in the middle attack, but adding a static entry in ARP table is neither viable nor feasible in my case.

You can't create an application in a way it's not vulnerable to MiTM attacks because these attacks happen an a lower layer than your application works on. You can only secure the network which is used by the clients. There are several countermesures available. First you need port security which will prevent many of these attacks. Then you could add a net based IDS/IPS which is capturing the monitor port of your switch. But all of this wont come for free it will cost you some money and a lot of time.

//
The more practical solution is to use encryption to ensure that someone who performs a MiTM attack isn't able to read the data he captures. But even this won't give you 100% security. The main problem here is that you dont have a server.

Async encription (SSH like)

On both sides you create a RSA key pair and then use this to encrypt and decrypt messages. When the first connection is established between two hosts you save the key of that host to identifiy this host in further sessions. The problem here is that a MiTM-Attacker might interrupt the first session. He is then in a position where he can inject his own certificates to perform a MiTM attack anyway. This will also lead to a sitiuation where in further sessions that aren't interrupted by the attacker the connection will be recognized as insecure because the saved key of the opossing host is in fact the one of the attacker.

Your problem her is that you don't know the key of the opossing side until you connect for the first time. Many companies solve this issue when it comes to ssh by syncing the ssh_known_hosts via a trustworthy server. You dont have such server because of that you can't do this here and you are kind of insecure at the first connection.

Pre-Shared-Key

You can implement encryption with a pre-shared-key but the problem here is always the useability and the user behaviour. When you generate a PSK for every connection then the key must be exchanged. Always remember: People are lazy. They will send the PSK via mail which is potentially unencrypted. Also many people might say "ohh thats to complex I will use another software that is easy to use" and this is how people end up with easy to use but totally insecure software.

// Also none of the described proceedures will prevent a MiTM-Attack they will only prevent the attack from being successful in the way it was ment to be.


PHP Local File Inclusion from URL; no param The PHP code has a handleRoute($path) function that is triggered for URLs like server.com/routeme/a. Handle route has the follwing: if file_exists($path) then include $path.

The $path argument is /srv/dirs/routeme/a.

A Google search leads to a million results where the file name is directly read from a parameter. When instead read from an URL, I can't just say server.com/routeme/a/../../, as nginx will reply with 400 Bad Request instead of executing the handleRoute function.

I have been attempting to find something that PHP will interpret as a Path outside of routeme/ while nginx does not and thus still lead to the execution of the include.

I was hoping %2E%2E%2F (encoded ../) would do it, but nginx still interprets this as a path.

I have a feeling that either I'm missing some obvious method to do this, or that it is a dead end and the code not vulnerable.

I don't think this is possible unless the HTTP Daemon itself is either in the root directory (e.g. in / rather than /var/www/html) OR if the HTTP Daemon itself is a superuser.

Unless I'm misreading your text and not properly grasping what you're trying to say here, I don't think this is a possibility without the httpd being in root dir.. I've came across instances where LFI/LFD has been possible simply by appending the path to the end of a URL, but like I said, only in instances wherein the HTTP Daemon itself is installed in the root directory, rather than the webroot.. If it's installed properly (e.g. in the webroot) then I think it will always be considered a URL Path as opposed to a path to a local system file?


Why is plain dm-crypt only recommended for experts? I am curious about the following claim from the Cryptsetup FAQ:

  2.4 What is the difference between "plain" and LUKS format?

  First, unless you happen to understand the cryptographic background
  well, you should use LUKS. It does protect the user from a lot of
  common mistakes. Plain dm-crypt is for experts.

After reading through the manual I can see the benefit of LUKS in particular situations. However, I do NOT see the need to "understand the cryptographic background" to use plain dm-crypt.

From reading the manual, I understand that:

There are some things done in LUKS (like hashing) that don't happen in plain dm-crypt. The result is that I need a bit more entropy in my passphrase to make it safe.
In plain mode you can argue it's easier to accidentally overwrite encrypted data.

The second point is not really related to understanding cryptography, and it doesn't seem to require expert cryptography knowledge to prevent this (note that I do agree that this is a risk and it can easily happen, even to the best, but I would just argue that having or not having expert cryptography knowledge does not have much of an impact).

So on to the first point. In the same manual the following is stated:

  5.12 What about iteration count with plain dm-crypt?

  Simple: There is none. There is also no salting. If you use plain
  dm-crypt, the only way to be secure is to use a high entropy
  passphrase. If in doubt, use LUKS instead.

This implies to me that the only thing that is needed to have a secure setup with plain dm-crypt, cryptography wise, is to use a high entropy passphrase (higher than what could be used in LUKS for the same lever of security). Again, it doesn't take rocket science to understand or apply this.

Likely, I am not understanding or capturing something important here, but my question is therefore: what is the kind of cryptography knowledge required that makes dm-crypt only recommended to experts? If I stick to standard operations, and I do not require any of the features from LUKS, what risks am I as a non-expert taking?

If I stick to standard operations, and I do not require any of the features from LUKS, what risks am I as a non-expert taking?

LUKS partitions have a header that ensures such a partition won't be seen as ext2, vfat, etc. A plain dm-crypt partition may coincidentally end up looking like a unencrypted filesystem, and has a chance of being written to accidentally, destroying your data.

LUKS checks if you entered the correct passphrase. If you put in the wrong passphrase, plain dm-crypt won't pick up on this; instead, it will happily give you garbled crypto-mapping which may also coincidentally look like an unencrypted filesystem, and has a chance of being written to accidentally, destroying your data.

LUKS stores the type of encryption used, while dm-crypt requires you to supply the same options each time. If, after a period of not using your encrypted device, you find there are a few gaps in your recollection of what the password was, and it turns out you forgot the encryption options as well, you are doubly hosed (this happened to me personally before LUKS existed; the encrypted data wasn't so important so I just reformatted after unsuccessfully trying to get in for an hour or so).

Also, there may have been a period during the development of cryptsetup in which essiv was not the default for dm-crypt, but was for LUKS, and the documentation you are reading may have been intended to allude to that.

Finally, some of the options of LUKS do things that are important from a security standpoint. For example, suppose you fall asleep while authenticating with gmail and accidentally type in your drive password. In dm-crypt there is no way to change the password without re-encrypting your whole device (and doing so in-place is risky, since a system crash or power loss event will leave you with a guaranteed hosed system). With LUKS, you can change the password.


Can ransomware run without prompting user? That is, a user downloads attachment from email and runs it, will the ransomware run silently without showing the security prompt/UAC (that should block non-administrator users...)

Ransomware wouldn't need to raise a UAC alert as it is after a user's personal files, not system files.


Can a hard drive be destroyed by drowning? These are some ways of disposing of hard drives: Special firms, degaussing, hammering, pulling apart.

Can this be accomplished more quickly by drowning it? Fill a bucket with water, maybe add some aggressive cleaning products, throw the drive in, let it sit overnight, then dump it in the garbage.

Will the data be irretrievable after that?

Special firms either degauss, destroy or melt the harddrives.

Harddrives are magnetic data. Magnetism can be destroyed by either:

Degaussing (changing the magnetism)
Heating the drive (melting) (which destroys/changes the magnetism)
Hammering (shock) (shock damages magnetism somewhat, but the denting of the drive makes it very difficult to read the surface, as metal deforms, the surface area changes as well thus making it even more difficult to determine what is and isn't a sector)
Drilling (removes sectors altogether, physically changes the layout of the drive like hammering, generates a large localised amount of heat as well)
shooting (same as hammering, but more extreme)
Chemical corrosion (if the magnetic substrate is removed from the platters altogether, there's nothing left to recover)
Shredding, there's plenty of services that offer to shred your harddrive which leaves you with nothing but metal scraps, nothing to recover there.

So, Would simply submerging the drive render it un-usable? No. Probably not to an experienced forensics or recovery team. What WILL kill the drive is corrosion of the platters, so it depends on what you add to the water, how long it stays in there, what the platters are made out of and how good the people trying to recover the data are.


Live Linux which does not mount any hard drive in the computer I am searching for a Linux System which runs from a CD and does not mount any hard drive of the computer.

I want to prevent any possiblity to write something on the hard drive of the computer and on the current operating system which is installed on any harddrive in the computer.

Backtrack 5 gives you the option when booting to start in forensic mode which means it will not attempt to mount any drives, unless specifically requested by the user.


How to log packets which are allowed by SNORT? Suppose i have not written rule for a type of attack in SNORT; It is obvious that it wont show any alerts. I wanna develop a system wherein i capture packets that SNORT allows n do further processing on those packets to detect if those belonged to an attack or not!

So, how to i log packets which snort considers to be genuine if no rules are written for that ?

You are approaching this the wrong way.  A far better approach is to use a capture engine like Daemonlogger and then post-process the data in near real time.

The reason is that, as wonderful as Snort is, the more you add the the ruleset, the slower it will operate.  Don't get me wrong, it's very good, but this is not an ideal way to configure it.  If you are dealing with high speed well utilized links, Snort may begin to drop packets.

Marty Roesch, created of Snort, wrote Daemonlogger to address exactly this issue.  Daemonlogger is used for fast full packet capture, which is then analyzed by one or more Snort instances (or other tools like SANCP, Silk, etc.)

Rather than starting from scratch I'd suggest that you look into SecurityOnion, which has all of this stuff already installed and ready to use, or look at NSMWiki.org, which has great general information and lots of specific information on Sguil, which is an excellent NSM architecture and interface.


What can I do with a radius shared secret? During an authorized pentest, I found several radius servers and a /etc/raddb/server file that stores shared secret, e.g

10.10.10.10  123456  15

Now what could one do with this "shared secret", perhaps dump the database?

From what I know, this radius server is used together with a krb5 server for authentication, e.g SSH logins

The RADIUS client and server use the shared secret to encrypt the password.  If you know the shared secret, and you can capture RADIUS packets with encrypted passwords, you can decrypt them and get the user's unencrypted password.

Wireshark includes the ability to do this, of course:

  perhaps dump the database?

No, the shared secret is used to protect things on the wire, not anything on disk or in the database.  You'll note that the shared secret you found was specific to a client IP address; a RADIUS server can use a different shared secret for each system it's extending authentication services to... which implies, in turn, that it's not for the back-end password (else you'd need N copies of the back-end password for N shared secrets).

  this radius server is used together with a krb5 server for authentication

Usually when a RADIUS server is used with KRB5, it's to extend authentication to dumber devices that don't support Kerberos. So you don't have to worry about Kerberos being tunneled over RADIUS; it's merely providing a down-level front-end to the back-end database that's part of Kerberos.  It may do so by speaking RADIUS on one side and Kerberos on the other, but that doesn't change the fact that the RADIUS packets on the wire are vulnerable if you know the shared secret.


How can I tunnel through an SSH server for application layer protocols such as HTTP/s and FTP? Are there client programs that allow me to "tunnel" through my SSH enabled server for normal Internet requests such as HTTP(s)?

If so what are they and can someone point me in the right direction?

Note: I'm not asking about a VPN; I'm specifically asking if its possible to "tunnel" a connection through SSH.

Most SSH clients will do that for you. With the ssh client provided with any good Linux system, simply type:

ssh -D 5000 -N theservername

where theservername is the name of the SSH server to which you want to tunnel the requests. Then set your Web browser to use localhost, on port 5000, as SOCKS proxy. And voila! all your HTTP and HTTPS requests will go through the SSH tunnel and exit on the other side.

For Windows, PuTTY can also be used as a SOCKS proxy.


Locking IP addresses to try and improve security I know being an employee I am paid to do what my boss tells me to do, however:

I am currently writing a website for my company that I work for. We work with sensitive data, so much so that my line manager told me that the overall boss wants me to lock IP addresses to accounts so that you cannot access it unless you are in that particular location.

Background

For my company, we are creating a private portal so the company can log in and get the information about their product from our website. My boss wants it to be that only people logging in from that specific area can access the files. I.E. not going home and logging in and showing their wife of friends, or them getting fired and showing off the documents to our competitors.

The Problem:

Having searched for this it has made me think:

Is locking down an account a really good idea?

I used to play a lot of online games. If your IP address changed, it sometimes caused major problems (i.e. WOW)

What if that company's IP address changes and the entire company is banned from logging in?

I am trying to think of a better solution to this and was wondering if you have any ideas?

Locking down access to a site is, in a lot of cases, a good defence-in-depth measure.  It shouldn't replace things like user authentication and good password policies but it can be a useful add-on.

In terms of it causing problems, you're right if the companies IP addresses change they it would cause an issue, however most companies will have static IP addresses assigned to them (tends to be a feature of business-grade Internet Access packages)

In terms of stopping that happening, I'd recommend speaking to your network manager and/or ISP to make sure that you're notified ahead of times if they are going to change the IP address. if it's integrated into the change management process, hopefully the chance of disruption would be minimal.


Authenticated Encryption vs. contained and encrypted checksum/hash? So I read through http://en.wikipedia.org/wiki/Authenticated_encryption and http://www.cryptopp.com/wiki/Authenticated_Encryption and I don't seem to be following the concept.

From the simple examples provided, it seems that Authenticated Encryption aims to prove that the message has not been altered - i.e. that an attacker has not modified the payload of an encrypted container by way of a manipulation that doesn't require the key.

My question is this - if the goal is simply to ensure that the payload/contents haven't been modified (again, the attacker doesn't have the key, they are modifying the message at the binary level) then why wouldn't the inclusion of a trailing hash of the payload within the encrypted container be sufficient for verification?

In the case of an encrypted AES message, the message is received, the pre-shared symmetric key is used to decrypt, and the message (data) and hash evaluated. The payload/data is hashed and compared to the received hash - if they match, then we have an extremely high probability that the message was not tampered with.

So... my question is this. That seems really simple, and yet people far more experienced and intelligent than myself have spent a lot of time on Authenticated Encryption - what am I missing?

Thanks in advance.

Overview. Your proposal is not secure (see below for cryptanalysis).  That's why it is not a reasonable alternative to authenticated encryption.

A little more background.  Why do we need authenticated encryption?  It is because encryption without authentication is not secure.  Many developers don't know this, so they end up with an insecure use of cryptography.

It is possible to manually use both an encryption algorithm and an authentication algorithm.  For instance, you can use the encrypt-then-authenticate construction using a secure encryption scheme and a secure message authentication (MAC) algorithm.  However, this requires some extra effort from the developer.

Authenticated encryption was designed as a single primitive that is easy for developers to use, and that provides all the necessary authentication (so you don't have to do some extra stuff to provide security).  Thus, it is helpful for security.  Some authenticated encryption schemes also have the benefit of better performance than separately encrypting and then authenticating, but that is a secondary consideration.

Please read Don't use encryption without authentication for more detail on this subject.

Cryptanalysis of your scheme. You proposed that we append a hash of the message before encrypting: in other words, C = Encrypt(K, M||H(M)), where || represents concatenation of bit strings.  This scheme is not secure against chosen-plaintext attacks, with many encryption algorithms.  For instance, I'll show an attack against your proposal, if you are using CBC mode encryption (though the attack applies to many other modes of encryption as well).

Note that if a man-in-the-middle truncates a ciphertext that was generated with CBC mode (at a block boundary), the recipient won't notice the truncation, and after decryption will receive a truncated version of the message that the sender was trying to send.  So, with that background, here's the attack.  Let Alice be the sender, Bob the recipient, and assume a chosen-plaintext setting.

The attacker chooses some message M that he wishes Alice would send: but Alice refuses to send it (maybe M says "transfer $100 from my account and give it to the attacker", or something).  The attacker constructs some other value X such that Alice is willing to send M' = M||H(M)||X (maybe X says "just kidding! don't you dare").  The attacker convinces Alice to encrypt and send M'.  This means that Alice is going to transmit the ciphertext C' = Encrypt(K, M'||H(M')) = Encrypt(K, M||H(M)||X||H(M')).  The attacker plays man-in-the-middle, captures C', and truncates it while it is in flight.  Let's call C'' the truncated ciphertext.  Bob will receive C'', decrypt it, and then check the hash.  If the attacker chose the truncation point correctly, then after decryption Bob gets M||H(M), checks the hash, sees that the hash is correct, and concludes that Alice must have sent M.

In other words, at the conclusion of this attack, Bob concludes that Alice authorized transmission of the message M -- but she never did.  (She authorized the transmission of some other message, but not M.)

Whether or not this is a serious security vulnerability will depend upon the context in which it is used, such as the format of the message M.  But, empirically, in at least some applications, this kind of attack could pose a serious danger to the application.  Therefore, cryptographers consider that this is not a good general-purpose scheme.

Given that there are good schemes out there which have been carefully vetted and proven to be secure for general-purpose use, cryptographers would recommend that you use one of those general-purpose schemes (such as authenticated encryption, or the encrypt-then-authenticate construction) -- and in particular, don't use the one you mentioned.


What is the Session ID parameter indicate in Client Hello and Server Hello messages I was trying to understand the TLS handshake in depth. I set up Wireshark and captured the github.com traffic. While inspecting the Client Hello and Server Hello, I found a parameter Session ID.

According to this article session id can be used in case we want to reconnect without a big handshake. What I understand is, if we had previously connected, then the cached session id can be used again for the latest session. In that case, we are sending the session id as plain text. Can this be captured by an attacker?

Or, am I completely wrong here? Is this different from the symmetric key?

Can this be captured by an attacker?

Yes - but its not much use to them.

It's an indirect reference to the algorithms and keys previously (and securely) agreed, which are remembered by the server/client. So if the attacker asserts to your server that he wants to resume the session, your server will resume with ciphertext the attacker's client doesn't know how to decrypt.

(There may be some scope for escalating this to a DOS against a single client, but that's conjecture on my part. And if the attacker can sniff the traffic there are easier ways to subvert the connection.)

The TLS session has got nothing to with the HTTP session(s) so even if the attacker was able to decrypt the data, this is not sufficient to get control over the users session in the application.


Why does Canonical not enable https here? It is always verify disk images before using.

In Ubuntu's website, many pages are sent through https. However, some of the most crucial pages are not. For example, http://releases.ubuntu.com/trusty/.

This is clearly vulnerable to mitm and tons of other attacks. Although most of them are debunked, there has been lots of myth of backdoors in Ubuntu. I fear that this is a sign of government bugging the image files, or backdooring the software.

Is there any reason for Canonical/Ubuntu site maintainers to disable https at none but the checksums pages?

Ubuntu images are available from lots of mirrors which are out of control of Canonical. That means you cannot trust the image itself because it might be that one mirror is compromised and is distributing modified files. That's why Canonical offers signed checksum files like SHA256SUMS.gpg which are cryptographically signed so you can verify that the image is actually the one released by Canonical.

Nevertheless would it be of course much nicer if they provide their own mirrors with https and if they also provide detailed instructions how the download should be verified, instead of just downloading the image without any kind of obvious validation.


copy protection (or licensing) mechanism for an android app I am trying to implement a copy protection (or licensing) mechanism for an android app. The app is not distributed through Google Play or other online market and instead it is distributed through media such as CD/DVD. So we cannot employ market based licensing methods.

The app is a learning app for different levels of education. Students purchase the app media and install the app to their devices (an android tablet) over a USB cable. Students have limited access to Internet so we cannot force them to connect to our servers except one time for app activation over school wireless connectivity.

I know that there is no hack proof mechanism for piracy protection specifically for off-line scenarios and the app price is too low as well as target audiences are students without professional knowledge of hacking or cracking, though my client is willing to protect the app somehow as strong as possible.

I think the mechanism must be something like Machine Locking Scheme but I do not know what the best method is.

Any help or suggestion will be appreciated.

Each device has a unique hardware-ID - We will call it HID for readability.

Create an algorithm that takes the HID and generates an unlock-serial-number

Pseudo-code:

Generate_Serial(input = HID)
{
    scramble that HID
    add a secrete value to it
    send the value to costumer
}

Have a sms/phone-calls bot to answer requests coming from your clients devices. Automation of the process is your goal here.

The bot will take the HID and then sends back the unlock-serial-number, which will be used to unlock the app via another on-app algorithm as follow:

Pseudo-code:

Unlock_App(input = unlock-serial-number)
{
    unscramble unlock-serial-number
    remove the HID value
    do you have the secrete value?
    YES : Unlock
    NO : Print Error
}

Think about this as your favorite IM app (WhatsApp, Viber, etc..) verification process.

Note: Be careful storing your secrete value on-app! - you will have to protect it somehow from reverse engineering.

I hope this was helpful!


Is it possible to have authentication without state In order to login to most websites you need a username and password which is often stored in a SQL database.   You are storing per-user information that can change,  this is state.  Can you prove that someone has the rights to access your system,  such as an administrator or a user,  without the need to store per-user state?

To some extent, you can offload state on the clients. You encode the access rights of a user into a blob to which you add a MAC computed with a server secret key. The blob-with-MAC is then sent to the client. Later on, the client comes back and shows the blob; the server verifies the MAC and thus makes sure that the blob is legitimate. This maps reasonably well on HTTP cookies. Possibly, the blob could contain some encrypted data (there again with a server-only symmetric key) if the server wants to store some user-related data without making it visible to the user.

Trouble begins when you want to revoke or change rights. You cannot prevent a client from showing a stale blob. This can be coped with by using a combination of expiration dates (the blob contains a date and is valid for, e.g., one week) and, if need be, revocation lists (the server knows a list of blobs that it must reject, even if their MAC looks good -- this is state, but not much because the wide majority of access rights do not get revoked).

If the entity issuing the access rights (the one which creates the blob) and the entity verifying the access rights (the one which verifies the MAC) are not the same, then you need to replace the MAC with a digital signature scheme.


Passport copy is being used to defraud others - what can I do? I was an idiot and sent my passport and address to a scam artist I was hoping to rent an apartment from abroad. Luckily, I realized the trickery before sending anything else or any money. Unfortunately, the person is now using my passport and photos of me to lure in other people.

I have two questions:

What should I do now to try to stop them from using my identity?
Am I at risk of further identity theft e.g. breaches that would be damaging to me, not just harmful to others?

1) There is truly nothing you can DO to STOP them from using your identify in the current manner. The best you can do to impede them is to essentially "cyberstalk" them and report their every attempt to defraud someone to the system administrator or security team of the website they use to do this. So essentially hit the 'Report Abuse' link.

It gets hairy here. It's now a he-said she-said situation. To put some weight behind your claims, and as recommended as one of the steps to take if you are a victim of identity theft, you should to file a police report to substantiate your claims. You can do that in their state & country and/or in your state & country. The laws within the U.S. do not completely cover situations of this nature, so I would not expect the laws in that country to be so much more ahead. Moreover, realize this is now an 'international incident'. So the agencies pathways to handle this are probably not established.  (When my ex had their credit card # stolen and recreated, while they still had the physical card within hand, the police agencies of both states were not equipped to handle this situation. Filing a report was like inserting ourselves into a pinball machine.) And a situation of this nature, crossing country lines, is probably not high on InterPol's to do list.

2) Yes and no. While there is a lot of information on the 1st page of your passport. The thief now has a clear picture (you mentioned photos in addition to the passport copy), your full name, D.O.B, state of your birth, your passport number and possibly a clear signature (if you copied the 1st two pages). While this alone is not enough for ID theft, it's working framework for the scam artist to build a case up around. They now have your email address and depending on their sophistication they can start to try to search for the other pieces of your ID puzzle (16 big pieces listed below).

While it seems like their motivations are not as lofty now, you could be an addition to their database for further mining. It might be best to take some precautionary steps. A good website for ID theft information and actions to take if you are a victim is: https://www.privacyrights.org/identity-theft-what-do-if-it-happens-you

Be sure to save your documentation of the incident (email exchanges, reports you filed, requests you made to credit bureaus, etc). Just continue to monitor your credit like you should normally be doing www.annualcreditreport.com (the only site authorized by federal law).

If any of your accounts (esp. the email account you used in the exchange) have a password that uses information on that passport page, or any other information you make have sent to this person, change it immediately.

As it relates to the harm of others, there is nothing you can do other than put out a public-service-announcement-of-sorts on the websites that the scam artist is listing on.

Good luck to you. Just keep your eyes open going forward.


Is amazon S3 secure enough to hold personal documents? I have a client who is looking to hold personal information such as Driving Licences and Insurance documents in order to verify if a user of the site is who they say they are and lives where they say they live (the site is a sort of brokerage)

We were looking at storing this information in an offsite solution such as amazon S3, obviously it will be encrypted before it is sent from our server and pulled down and decrypted when we need it but is this enough? Are there extra levels of compliance I need to meet?

Forgive me ignorance with this, I'm by no means a security expert and just want to know if this is something we should even be considering.

From a purely technical perspective, if you encrypt it properly before you upload it, and it stays encrypted all the time it is in the cloud, then the data is very safe.

However, there are very probably extra levels of legal compliance you need to meet. This is "Personally Identifiable Information" and there are a lot of laws and regulations that apply to handling it. You need to take legal advice on what you need to do.

Note that you not only need to worry about the jurisdiction where your client is, but also the jurisdictions where the data is, and the jurisdictions where the users are. (That alone might make using S3 more of a challenge, since you'll have no way of controlling whether the data you put in there is in stored in Newark or Tokyo or some other place Amazon hasn't even told us about yet.)


Will password protected files like zip and rar also get affected by Odin ransomware? If I protect my files with password and use rar or zip files to store these files. Can ransomware encrypt password protected files?

Yes. The zip or rar file will be encrypted like all other files so that they are useless for you. The only protection is making backups to another physical storage.
This will help independantly of whether the files are in a password protected rar or zip format.


Use PKCS#12 file to distribute trusted CA certificates? Is it possible to use PKCS#12 file to store multiple CA certificates (with no private key and these CA certificates are not in a chain) ?

I read about PKCS#12 and think this is do-able. However, all examples I found only use it to store private key and associated certificate chain.

Sure: PKCS#12 is an "archive" format for cryptographic objects. It can contain pretty much whatever you want: multiple certificates, multiple private keys, etc. The encryption and signature is optional so you could use it for storing certificates.

PKCS#7, however, is more commonly used for storing certificates: it's a simpler format that is specifically designed to hold X509 certificates without the corresponding private keys.


Is it normal for my IPv6 to change? My IPv6 is changing a lot, exactly three times in last three days (I saw on Microsoft's last activity), and all accounts that I keep login on my browser have disconnected. The actual IP is listed by Google as a IP from a nearby neighborhood. Is this normal? May I be worried?

My IPv6 is changing a lot, exactly three times in last three days

You most likely have a dynamic IP address. These are often used because it makes managing IP addresses easier for an ISP. Some ISPs will charge extra for a static address which does not change. This is common for businesses or customers who wish to host a website over their connection.

  all accounts that I keep login on my browser have disconnected

Many websites will automatically log you out if your IP address changes for security reasons. This is normal behavior and is to be expected when using a connection with a dynamic IP assigned.

  The actual IP is listed by Google as a IP from a nearby neighborhood.

It is possible to geolocate IP addresses, but the accuracy can vary considerably. Sometimes it's accurate to within a few miles, but other times it doesn't even get the city right. Occasionally, the entire country is wrong. If your home IP address is showing an incorrect location, this is normal.

  Is this normal? May I be worried?

This is completely normal and there is nothing to be worried about. If these frequent IP changes are causing you trouble, you may want to contact your ISP and inquire about upgrading to a static address.


Is bcrypt better than scrypt Possible Duplicate:
  Do any security experts recommend bcrypt for password storage?

I'm no security expert and do not pretend to be that's why I'm asking here. I write many PHP based applications and up to now I have been using bcrypt to hash my passwords.

The scrypt website claims to be 4000 times slower than bcrypt, can this claim really be correct? If so would it be 'better' for a safety conscious developer to switch over to use scrypt instead of bcrypt?

Scrypt is supposed to be "better" than bcrypt, but is is also much more recent, and that's bad (because "more recent" inherently implies "has received less scrutiny").

All these password hashing schemes try to make processing of a single password more expensive for the attacker, while not making it too expensive for your server. Since your server is, basically, a PC, and the attacker can choose the most efficient hardware for his task, password hashing schemes try to be such that the best platform for them will be a PC. PBKDF2 can be thoroughly optimized with GPU, while bcrypt and scrypt are much less GPU-friendly. Bcrypt and scrypt both require fast RAM, which is a scarce resource in a GPU (a GPU can have a lot of RAM, but will not be able to access it from all cores simultaneously).

It so happens that modern FPGA embed many small RAM blocks which are very handy to optimize a parallel dictionary attack with bcrypt: this means that an attacker will get a huge boost by using 1000$ worth of FPGA instead of 1000$ worth of generic PC. This is the kind of boost that we want to avoid. Hence scrypt, which requires a lot more RAM; not too much for a PC (we are only talking about a couple megabytes here), but enough to make life hard for a FPGA (see this answer for a detailed treatment of the question).

Thus, theoretically, scrypt should be better than bcrypt. However, this is all subject to whether scrypt lives up to its cryptographic promises. This kind of guarantee of robustness can only be achieved through time: the scheme will be deemed secure if it survives years of relentless assaults from cryptographers. How much time is needed, is of course a bit subjective, and also depends a lot on exposure (the more widely deployed a scheme is, the more "interesting" a target it becomes, in that breaking it would increase the academic fame of the perpetrator; thus attracting more scrutiny). My own rule of thumb is to wait for about 5 years after publication, thus 2014 in the case of scrypt.

There is also the question of availability: if you want to use a function, then you need an implementation which can be inserted in the programming framework you use.


CSRF mitigation in MVC I'm wondering about the best way to protect against CSRF in MVC or any other stateless web app. Due to the stateless nature, we can not keep a secret token in the session and compare it to the secret that accepted form client afterwards.
My question is - how can we prevent a malicious user from attacking by CSRF?
Note that i'm not seeking for a specific implementation info such as "use AntiForgeryToken()".
Any related information will be helpful. Thanks a lot.

in MVC or any other stateless web app

Your  terminology is rather confused. Any user facing application is a hierarchy of MVC patterns. MVC is rarely stateless, indeed in the cases where it is stateless (serverside) there's very little risk from CSRF. Your question is really about session management.

In the absence of session management, the only way I know of to solve the problem is via OTPs - but arguably this is session management since the OTP must be retained until it used, and the information about the OTP modified when it is used.

If you consider the case for pay-per-click advertising - you're not relying on any information being supplied by the user, however you do need to keep track of counts - hence the application is no loinger stateless. You can avoid the need to maintain a session by using (for example) browser fingerprinting - but you then need to maintain a list (state) of fingerprints already considered to have 'clicked' - the application is no longer stateless with regard to the client device and there is a session. It's really not that different from dropping a cookie on the browser and reading it back later.

Given that it also solves many other problems, maintaining a session serverside is the best solution.


Where are FIDO U2F Keys Stored? I'm getting conflicting information on how the security keys are stored and used. Where are the public and private keys stored? If the private key is stored on the Yubikey itself, how many can it hold?
If the both keys are stored on the service you are authenticating against (Gmail), does it send the yubikey the private key to unencrypt to use the private key for signing?
Yubikey Website:

During the registration process, the key pairs are generated on the
device (secure element) but the key pairs are not stored on the
YubiKeys. Instead, the key pair (public key and encrypted private key)
are stored by each relying party/service that initiated the
registration. Therefore, this approach allows for an unlimited number
of services to be associated with the U2F-certified YubiKeys.

FIDO Website:

The U2F device and protocol need to guarantee user privacy and
security. At the core of the protocol, the U2F device has a capability
(ideally, embodied in a secure element) which mints an origin-specific
public/private key pair. The U2F device gives the public key and a Key
Handle to the origin online service or website during the user
registration step. Later, when the user performs an authentication,
the origin online service or website sends the Key Handle back to the
U2F device via the browser. The U2F device uses the Key Handle to
identify the user's private key, and creates a signature which is sent
back to the origin to verify the presence of the U2F device. Thus, the
Key Handle is simply an identifier of a particular key on the U2F
device.

https://fastmail.blog/2016/07/23/how-u2f-security-keys-work/
https://developers.yubico.com/U2F/
https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-u2f-overview-v1.2-ps-20170411.html#site-specific-public-private-key-pairs
https://www.yubico.com/authentication-standards/fido-u2f/#toggle-id-4

The keys can be either stored on the device, or encrypted and returned in the key handle. Both are allowed (and mentioned) by the spec.
From the implementation considerations:

U2F tokens might not store private key material, and instead might
export a wrapped private key as part of the key handle.

Also in the raw message format specification:

A key handle [length specified in previous field]. This a handle that
allows the U2F token to identify the generated key pair. U2F tokens
may wrap the generated private key and the application id it was
generated for, and output that as the key handle.

This leaves the decision to the manufacturer of the U2F device.
Yubico chose to return the encrypted private key as the key handle, allowing an unlimited number of credentials.
If a device manufacturer chooses to store the private key on the device itself, the number of possible keys will be limited by the amount of storage available. You'd have to look at the specs for a specific device.


Reason behind HeapSpray format I am curious as to why heap spraying consists of allocating repeated chunks of NOP + Shellcode? Why is the format not repeating NOP and then just Shellcode at the end; when the stack pivot occurs wouldn't EIP just slide down the sled until it hits the shellcode? In addition, in a Heap Spray a predictable address seems to always be chosen to pivot too, so the repetition of chunks seems unnecessary.

The point of a spray is that you don't always know exactly which block your object was allocated to.  I believe it's because how volatile the heap can be.  At any given time a block of memory could be allocated, and your NOP sled/shellcode could be interrupted.

You see examples with predictable addresses because it makes it easier to learn the concept, but in the wild ASLR will randomize where the heap is laid out.  So you need to be as robust as possible.


What is this NAT rule forwarding UDP port 1052? I just went to have a look through some router settings today and found an unknown new entry in the NAT table, forwarding UDP port 1052 to the same port on a host which runs both Windows 7 and Linux. I disabled the rule and have asked the ISP if they have added it, which is unlikely because of the name of the NAT rule. I've looked around and could find only two references to this name which seem relevant (possibly NSFW): a Reddit post (referring to port 1057) and a decompiled binary with no context. I also checked netstat on both OSes and found no service listening on UDP port 1052 (although a sophisticated hack could of course hide itself). I had a quick look in Wireshark as well but found no traffic to that port.

The router an ISP-provided NetComm Wireless NF4V. It doesn't get firmware updates.

Is this a known virus/worm? Is there anything else I should do?

Iana.org port list includes 1052 tcp/udp as a Dynamic DNS linked port.  This may make sense if you consider that DNS port is 53 traditionally, and 52 is close, as is 1052.  This is how ports are selected when people try to choose a different port to make access less than trivial but associate it with some service (like 8080 instead of 80 or port 81 instead of 80).  Chances are someone selected 1052 as a DNS linked port.

Also, chances are you played with DDNS in the past.  Just guessing.