How can a webpage get the MAC address? I was logged on to my router and filling out some information. I clicked a button and a field was automatically filled in with my computer's MAC address. How is this possible? Does it present a security risk?

I'm connected through VPN and my computer is up to date and running Microsoft Security Essentials (MSE). Is there JavaScript code that can get the MAC address? Is the MAC address sent in an IP header? I was surprised I wasn't at least prompted to share this information.

This is not a security risk.

The router looks in its ARP table to find the MAC address of your IP address. The reason it can do this, is because you are connected to the router via layer 2 in the OSI model. The router simply looks up your IP address in the ARP cache to find its MAC address. A website on the Internet is not connected to your LAN and will not be able to determine your MAC address.

In the same way, you from your computer determine the MAC address of your router by looking in the ARP cache of your computer. If you open up your command prompt (cmd.exe on Windows) and type "arp -a", you will see your router's MAC address. This does not pose a security risk, and is required for IP traffic to work on an Ethernet network.


Is this phishing? How can I be sure? And what can be gained? Yesterday I received an email that I assumed/hoped was legitimately from a prospective employer that I interviewed with several weeks ago. The timing of the email couldn't have made more sense as they said upon leaving the interview that I should hear back in two to three weeks. Yesterday was exactly three weeks and a day. The email address appeared authentic as it contained the domain name of the company, but the user threw me off (Resumes1@) as I hadn't received any correspondence from this address previously.

The email didn't contain any request to sign into anything or ask for personal information, but it did have a link to the original job posting on a recruiter website that also appeared to be legit (hovering over the link produced the same https address in the lower part of the browser window). My suspicion was raised when the email signature contained no phone number, email address link, or company website link and was simply from "company name, Human Resources Department". I did "show original" to view the header info and noticed a three hour delay from the time the message was sent which is also very suspicious, right?

Does anyone have any other tests or verifiers to determine if this is truly a phishing attempt? If it is, what can really be gained by merely replying that I was still interested in the position (the only question/request they had of me was if I was still interested and when I was free to discuss further)? Any insights would be greatly appreciated. :)

This appears to be valid. No single fool-proof answer exists, but it appears valid and safe for the following reasons:

You were expecting it from them. While it's possible someone trying to spearphish you knew this, it is one of several positive indicators. This alone is not enough, however.
The domain headers check out and having a generic email (resumes1@company.com) is very common. See #4.
The URL checks out when hovering over it.
There is about a 90% chance someone is reviewing your resume and position from software like taleo or brass ring, which means the email sent will almost certainly NOT originate from their actual email. Probably a dozen or so recruiters share said software, so having it tailored to a specific Email signature is highly unlikely and the signature you received would not be out of character. It's also not uncommon (although it is unprofessional) to have several fields that are supposed to be filled out NOT filled out, leaving a generic term in it's place. Additionally, in a large, well-developed company it's not out of character to receive form letters with $variable_job posting that is filled in on the form letter. This is far more efficient for recruiters to work within their software - just like a salesman has an easier time integrating his email with salesforce than custom writing each email for each invoice.
A 3 hour delay does not necessarily indicate any serious risk. If it's a medium or large business (or poorly configured) the website may "batch out" emails or spool up several at once at a pre-determined period of time (e.g. every 3 hours). There are also other reasons an outgoing email may stall, without being risky.
Replying to an email will not get you "phished." Clicking on links will, or replying with PHI/PII will - but responding that you'd love to move forward and are excited for the opportunity poses no risk.

Anecdotally, I  have been involved with phishing campaigns on the security side, and nothing is raising my hairs.

If you are ever unsure, it's still always best to open an attachment or click on the link in a sandboxed environment.


What needs to be encrypted for FIPS 140-2 compliance? We're developing a Client/Server C# .NET application that needs to be FIPS compliant.Im reading a lot about FIPS online, but am having a bit of difficulty determining the difference between the compliance of the encryption algorithm chosen, and what data needs to be encrypted for compliance.

I understand that the following algorithms are compliant:

Symmetric Key

AES, Triple-DES, Escrowed Encryption Standard

Asymmetric Key

DSA, RSA, ECDSA

Hash Standards

SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256

Random number generators

See annex c

Message authentication

CCM, GCM, GMAC, CMAC, HMAC

Source

However, let's pretend absolutely nothing in my software used encryption, then I would technically be fully compliant, no?

The things I can think of that would need encryption are our communications from client -> server and vice-versa, our serialized data we store on disk, and our licensing process / files.

What am I missing here?

FIPS140-2 deals only with the proper way by which a cryptographic module must operate and be protected from attacks. One can be just compliant with his modules, or one can be compliant AND validated with her modules. There are 4 different levels of compliance, 1 to 4, with a higher level more protective than a lower level. Getting validated is an expensive undertaking, usually done by external security labs.
FIPS140-2 does not talk about what data need to be encrypted by an application. Various standards bodies, unique to each industry segment of interest, establish the requirements, procedures and processes of data protection and encryption specific to that industry. For example, PCI DSS by the credit-card industry, HIPAA by the health care industry.
These bodies may or may not demand that an encryption module would be FIPS140-2 compliant, but certainly being such is a prudent choice - at least from a liability point of view.

Some relevant comments from infosecisland.com:

"I have done FIPS 140-2 compliance tasks firsthand with:
OpenSSL, OpenSSH, Sun Java 6, Apache Tomcat 5.5 and 6.0, Mozilla NSS.
I can tell you that none of these modules are operating in a FIPS 140-2 compliant mode by default, getting them into a FIPS 140-2 compliant mode is not trivial, and operating in a FIPS 140-2 compliant mode is not always a good idea for compatibility reasons."
"Allow me to clarify the business cases that someone will want to invest in the time and expenses necessary to achieve FIPS 140-2 validation, not just compliance:
When you want to sell anything that is cryptographically relevant to the DoD or any government working group that looks to the DoD for security specifications. This is not going to be your typical enterprise customers, but specific government entities that require the assurance of cryptographic integrity that FIPS 140-2 provides."

So, if you don't have a crytographic module in your application, FIPS140-2 is not relavant to you. If you do encrypt some parts of your program, like data or a comm protocol - either because it is the proper thing to do or being required by a standards body or by customer requirements or by regulations - and you need to be FIPS140-2 compliant, that encrytion routine/module needs to either just adhere to the FIPS specs or even be fully validated.


How to authenicate personal computers and phones? I feel like this information should be readily available but looks like it's not:
When I buy a new laptop or phone, it seems like there's a whole set of initial connections that might require my (client) authentication. For example, if I bought a Mac, Apple might want to authenticate that the Mac I'm registering is not a hackintosh (not sure if Apple actually does this), or two-way TLS in some cases.
Does such a thing not exist? If it does, then my new laptop/phone must come shipped with a valid cert?

For stuff like "registering a genuine product", the solution is simply serial numbers (which are not particularly secure, but do provide some speed bump to faking a product registration). As a general rule, though, shipping commodity hardware with a unique private key and a meaningful signed certificate is probably more effort than it's worth. What does it actually get you?
Like, sure, Apple would definitely prefer that Hackintoshes never become widespread, but it doesn't actually harm them that much if a few exist and this kind of system isn't needed to just keep the number low. Microsoft, Sony, and Nintendo want to be able to identify unique consoles on their network, and might actually bother with a system like this, but it eats into the already-poor margins on the hardware in exchange for... making it slightly more possible to ban cheaters? Microsoft and other PC/Chromebook vendors probably don't care at all; if something wants to run their software, or pretend to run their software, well that's fine; they distribute the software in inspectable form so there's no way to hide keys in it anyhow. Intel chips do have an embedded key that works something like this; users routinely leave it disabled or even permanently wipe it, because for most users this is a net-negative-value "feature". If Intel attempted to make it impossible to disable, this would lead to a substantial backlash against them.
Phones already have at least one unique identifier (the IMEI), though it's not a private key. It lets operators identify the model of phone on their network, and maintain lists of stolen devices, but you can still use a banned-IMEI phone as a pocket computer. I suppose Apple might want to (and might even be able to) identify iPhones that they want to keep off their store or otherwise track in some way; this isn't a practical option for Android since the software is also distributed separately from the hardware.
It's worth noting that these unique values are generally not available to third-party software. Having a unique key baked into hardware but usable by software can make DRM much easier to implement, but that doesn't make the product more appealing to any end user (Intel briefly exposed full CPU serial numbers to software; this was unpopular and quickly canned). All modern smartphone OSes prevent access to any hardware secrets (like IMEI) and only enable access to a device-wide OS-based secret (usually called an "advertising ID" or similar) with user consent.


Is logging into SSH with a 2048 bit SSH password less secure than logging in with a a 2048 bit private key? I'm certainly not saying this is a "good idea," and I always disable password authentication on SSH servers. However, the question came up when talking to a friend: If your password is as long and random as your private SSH key, is there a security difference with logging in with your long password vs. your private key?

My intuition is that the password is less secure because you need to transmit it "over the wire" for the server to authenticate. Whereas your private key stays on your computer, and you only send a calculation of public_key*private_key to the remote server. But then, the remote server has your public key... so is it any better?

Theoretically, brute forcing a 2048 bit password (with proper entropy) should be exactly as difficult as brute forcing a 2048 bit private key, correct?

Theoretically, brute forcing a 2048 bit password (with proper entropy) should be exactly as difficult as brute forcing a 2048 bit private key, correct?

Not quite. A 2048-bit RSA key only have 112-bit effective entropy (explanation).

An SSH public key is safer than a password because in the case that an attacker manage to take over your server, they would be able to capture your password. If you reuse the same password anywhere, they'd be able to login to those machines with the captured password.

With SSH key, an attacker that compromised your server can't go anywhere else.

There's also a slight advantage that once you kick the intruder out, you won't need to change your SSH key. You couldn't lock out the intruder without changing your password.


How could a publicly available stream cipher (RC4) be kept secret so long? I'm reading about the cryptographic function called RC4.

Apparently, its method was kept secret from 1987 until 1994 despite being available to the public for licensing and use.

How did it stay secret for so long? It's not a very complicated algorithm. Couldn't someone just reverse-engineer the code and get the source?

Is there some reason they couldn't that I don't know about?

Couldn't someone just reverse-engineer the code and get the source?

Yes. That's exactly what happened in 1994:

From the Wikipedia entry:

  RC4 was initially a trade secret, but in September 1994 a description
  of it was anonymously posted to the Cypherpunks mailing list. It
  was soon posted on the sci.crypt newsgroup, and from there to many
  sites on the Internet. The leaked code was confirmed to be genuine as
  its output was found to match that of proprietary software using
  licensed RC4. Because the algorithm is known, it is no longer a trade
  secret. The name RC4 is trademarked, so RC4 is often referred to as
  ARCFOUR or ARC4 (meaning alleged RC4) to avoid trademark problems.
  RSA Security has never officially released the algorithm; Rivest has,
  however, linked to the English Wikipedia article on RC4 in his own
  course notes in 2008 and confirmed the history of RC4 and its code
  in a 2014 paper by him.

You can, with varying degrees of success, make it more difficult by, for example, obfuscating the code, encrypting the code, storing the code in an HSM that self-destructs when tampered with, requiring restrictive contracts, threatening legal actions, etc... But in the end, there is no security without physical security. Once you let the code out of your physical control, it is potentially exposed.

As to why nobody did it before, I suspect that it was lack of interest and legal concerns.


Wireshark - Facebook account Someone use Wireshark software, if he browse on the internet from home (using the same router) and I'm also at home, is he able to find the password of my Facebook account?

Simple answer: no. Facebook network traffic is encrypted by default which means someone using a tool like Wireshark will only see random characters and nothing like a password or username.

More complicated answer: there are techniques to circumvent the encryption such as SSL strip or other forms of man in the middle attacks (a type of attack where someone intercepts your network traffic). I am assuming that such attacks are not likely in the situation you describe.


How to monitor and manage ALL internet network activity Is there a way to monitor and manage (block, unblock, log) all internet activity (mainly outoing traffic) from my computer?
For example, in my android phone I've installed a VPN tool called "Tracker Control" (from the F-Droid repository) that shows me all outgoing traffic and it's destination (google, facebook, amazon and other big brothers) which I can then (in several cases, but not all) block or unblock it.
Putting in plain words, I need a tool that shows me that software X is trying to send data to Sever Y and ask me if I allow it or not...
I've heard of tools like Wireshark, but I do not know if it can block the packets, or if is just too low level for this purpose.
Is VPN an solution? Or maybe a home made proxy server (using Apache or other software)? Or some kind of Firewall?
I don't know much about the "network fauna" besides TCP and UDP. Is there other types of internet traffic that I should be aware of?
My OS: Win7, Win10 and Linux (Xubuntu)
PS: I'm kind of a advanced user, but not a network literate.

Outgoing firewalls that seek user-space confirmation are very effective at limiting the damage that malicious software can inflict if it gains a 'toe-hold'.
On Android, one such tool is called NetGuard. It works by installing itself as a VPN, which forces the Android OS to route all packets via its code. (It does it this way so that the user doesn't require root or su.) So, not a VPN per se, but using the VPN function of the host operating system to achieve the goal. If you're using this software, you won't be able to have a genuine VPN running - alternatively, a tool called AFWall exists but this requires su as it modifies the iptables ruleset(s) for applications.
Regardless of how the packets are intercepted, either of these tools check the outgoing connection to determine whether the user has previously configured any rules for network access, or whether the application has changed. If no definitive answer is available to the software it will prompt the user, or place the request in an 'ambiguous' queue for the user to handle.
On Windows other tools exist to provide similar function, one such that I've used is called Comodo, which is a free but closed-source solution. (Please feel free to edit or comment if you know of any open source solutions - edit: can Windows Firewall do this already? Brinkmann, 2016)
On Linux there is no GUI solution that I know of that will provide this functionality. Instead, you must use the isolation functions provided by the kernel, eg. block general access to the network, then create a bridge interface, allow access to the bridge to a particular context, and then place applications that you trust within that context so they might access the bridge and the internet. At this point, you might wish to apply additional filters and rules using the iptables (or gufw/ ufw rules-interfaces). More on bridges.
Another alternative is to use a tool called firejail, however, this will only block programs that are launched with isolation. It relies on modifications to your bin directories to place a link with the same name as common applications' processes to instead point to the firejail binary. This can be circumvented trivially.
It may be possibe to run Android in a Linux container, configured  to quarantine browser/ email/ etal. using AFWall, and otherwise, configuring Linux to prevent direct internet access in the manner described previously.
This answer discusses another possible solution called Douane but I have no experience with this tool.
In most of these cases you still need to configure interfaces in the kernel to limit all other activity, limiting only programs with access to the bridge, or virtual network interface, to connect to the internet.
I'm aware of a tool provided by a VPN service (Mullvad) which has an option to force all packets through the VPN tunnel. I don't know how it does this, but I suspect it uses a similar method. Feel free to comment or edit to explain this functionality.


How compromised should I assume my computer is? I had turned ssh on a while ago to do some remote work. I was just looking over some netstat info when I noticed someone had established an ssh session with me D: I turned ssh off immediately and looked up the address.

Netstat said the ssh session was "established". I'm assuming that means they know my password, and I'm going to change it either way, but I want to know if they definitely know my password. I assume my computer's been leaking because there were 68 packets in my Send-Q; I don't know exactly what that is, but I don't like the "Send" bit.

Am I ok if I just wipe my computer and put all my data back on it? I don't do anything important, and I don't connect to any networks that might have sensitive research material or keep much banking or personal information on there. Should I "nuke it from orbit", or is that overkill? If it isn't, how would I go about doing it?

Whether or not you should leave SSH exposed is subject to debate. I'll avoid that.

When you attempt to login to an SSH server, you complete the handshake prior to entering credentials. This means that even without a username or password, an SSH connection can show up as established. If someone was trying to brute force you, you would see some connections as being established.

You should check your server log files. If they have root access, it's easy to hide any wrong doing, so this is not a guarantee.

I would start with your lastlog to see your most recent successful logins.
I would then check for failed SSH login attempts, and see if there is any relation to that IP

grep sshd.\*Failed /var/log/auth.log | less

There is more you can and should be doing if you feel like you have been compromised. I am not going to cover everything, but wanted to suggest that there is the possibility that you were not compromised based solely on the data you have provided.


Can oauth2 "state" parameter be used to avoid using session cookies to identify user https://tools.ietf.org/html/rfc6749#section-4.1.1 states:

  4.1.1.  Authorization Request"

  "state"

  RECOMMENDED.  An opaque value used by the client to maintain
           state between the request and callback.  The authorization
           server includes this value when redirecting the user-agent back
           to the client.  The parameter SHOULD be used for preventing
           cross-site request forgery as described in Section 10.12.

Is it safe to use a "state" parameter I generate (uuid/v4) in OAuth2 authorization request besides CSRF protection to identify the user in the provider callback in the authorization flow? Thus making the oauth2 flow "stateless" and don't require "sticky-sessions" for the load-balancer.

Currently, when a user starts the OAuth2 flow (visits login page) I create a unique auth-request-id and state for him and store it in Redis and send the auth-request-id in the cookies.

After the user logins into the provider (Google or Facebook) in the callback request, I try to find the user's session from the auth-request-id cookie in Redis and validate whether a session exists and that the received state matches the one I sent (against CSRF attacks).

Wondering, can I skip creating the auth-request-id cookie and identify the user in the callback by the state? Given the logic, if no matching state can be found in Redis, presume the state to be invalid and all Redis stored state has a 5 min expiry time.

I believe You cannot do this securely.

Malicious actor can freely obtain redirects using your application. Now if he manage to make a unsuspecting victim to open redirect address then the victim will see that Your application is asking for access. If he grant access he will be redirected back to you, if you use only state to identify him then you just assigned victim resources to malicious actor account in your app.


Why do password strength requirements exist? Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a developer hate it when a website requires a complex password), what are the actual benefits of having strong passwords (for website authentication)? Here are the prerequisites of a system that handles authentication properly:

store passwords using bcrypt (or at least use salt+hash) - hard-to-impossible to find the original password when an attacker gets the database
lock subsequent password attempts with a growing cooldown - no brute-force via the site

Because, as LinkedIn and other recent password leakages reveal, still the most common passwords for websites are "password", "god", "123456", etc. So you can brute-force with really short list of most common passwords. Still, you can just ban those passwords, or require long password - as possible combinations grow exponentially with the length, and requiring long password is better than requiring "strong" password to prevent brute-force. But too many people follow what they believe is a best practice without questioning it, so - great question indeed!


Is buffer overflow the only way to take control of stack pointer? I understand how buffer overflow works (in minimal knowledge), which create buffer overflow and take control of stack pointer, to make it execute whatever attacker wants. However, with my current knowledge, programming language such as python or java, the memory space is allocated dynamically at heap (correct me if I am wrong), so it is harder to create the buffer overflow for programs written in these language.

My question maybe very vague, but just want to know is buffer overflow is the only way to take control of stack pointer?

PS. reference:
https://stackoverflow.com/questions/479701/does-java-have-buffer-overflows
https://en.m.wikipedia.org/wiki/Heap_overflow

In a word, no.

Buffer overflows can occur on both the stack and the heap. Stack-based ones are the classic target, since the saved stack pointer and return pointer are part of the stack frame and if you can overwrite either you can usually control the instruction pointer (IP) as soon as the function returns. However, there are ways to turn almost many kinds of memory corruption into arbitrary code execution.

A partial list of ways that are specific to buffer overflows:

Tamper with heap memory allocation (i.e. malloc) metadata, which is stored on the heap itself and usually near the allocated buffer. When the buffer is freed, a value might incorrectly be written to a user-controlled address (such as the return pointer, or a function pointer variable, or...). This one is heap-specific.
Overflow into a neighboring data structure that the attacker shouldn't be able to control, and change it in a way that gives code execution (such as by changing a function pointer that is later called, or changing an object's class reference so that it treats attacker-controlled data as its vtable, or changing the value of a pointer that is about to be written to). This can be done on both the stack and the heap.
Change a neighboring variable so that code flows down a different path than it should (e.g. bypassing an authorization check and granting access when it shouldn't). You don't always need complete control over the IP to get the desired result; sometimes just getting the program to take the wrong branch is good enough!

A partial list of non-buffer-overflow-based ways to control the IP:

Trigger a double-free, by passing data that causes the program to try calling free (or delete or whatever) on the same non-NULL address more than once (without re-allocating in between). This corrupts the heap metadata in predictable ways and can be used similarly to the first bullet above.
Trigger a use-after-free, by providing data that results in the program taking a code path where it frees a buffer, allocates a new object in its place, but also continues using the original pointer (to the old object type). Treating a pointer to an object of one type as though it's a different type is often exploitable, for example by changing a field that is a harmless, user-controllable int, but has the same address (in the other type) as a non-user-controllable function pointer.
Format string vulnerability, where a function of the printf or scanf family is used but the format string is at least partly under attacker control, because the attacker can use the %n format specifier to treat an arbitrary "word" along the stack as a pointer and write an attacker-controlled value to the address it "points to".

Memory corruption in managed-language environments (such as .NET, Java, Python, JS, etc.) is supposed to never happen (unless the managed code calls some native code) - that is, it's not supposed to be possible to write this class of bug in those environments - but managed-code runtimes are themselves written in native code, and native code sometimes has memory corruption bugs. The existence of such memory corruption bugs in those managed runtimes is often a serious security vulnerability, because a lot of them are used for running code from untrusted sources. For example, there have been many use-after-free bugs found in various browsers' JS runtimes, which can be exploited by a maliciously-crafted script to break out of the browser's JS sandbox and run code with the browser's privileges (this is a large part of why browsers are now sandboxed by the OS).


How to add certificate pinning for a certain domain to my web browser? There is HPKP (HTTP Public Key Pinning) which servers use to tell the client's web browser which certificates to trust (in the future) for the domain that is being contacted.
Google's Chrome and Mozilla's FireFox bring their own lists of websites that are pinned to certain certificates. (Google calls an entry in this list "a pinset".)

How can I add certificate pinning for other domains to my web browser (e.g. FireFox)?

Is there a reason why there is no option to "Pin this certificate to this URI" when viewing the details of a certificate in a web browser? Would it undermine the concept of CAs, or is it just not implemented?

HPKP does not address this need.

HPKP is an extension to the HTTP protocol allowing website administrators to provide specific pining information to the browser, allowing:

To check that at least one of the certificate composing the authentication chain of the current HTTPS connection (depending on the platform architecture architecture, the server administrator may choose not to pin the final certificate but an intermediary or the root one instead),
Present an alternative Pin corresponding to backup certificate in case the primary one is lost/leaked/etc, so clients keep the ability to access the website after the certificate has been changed,
Tell the browser if the certificate pining should also be enable for sub-domains or not,
Tell the browser how long the pin is applicable in accordance with potential key migration schedule.

Would an HPKP set improperly, the browser will deny any access to the website without any direct recourse for the user. All the details above are mainly known and controlled by the server administrator, and not the final user, therefore the final user has no way to configure properly an HPKP pin in his browser.

What you may look for, instead, is for the browser to store some information concerning the certificates presented by non HPKP websites, and be able to alert you upon certificate change, up to the user then to check the new certificate and agree to continue if everything seems in order. Such feature already exists, at least on Firefox, but is handled by addons such as Certificate Patrol.


Potential risks when sending plain text E-Mails with encrypted attachments? To ensure privacy in communication I encrypt and sign E-Mails using gpg4win. However, sometimes the communication does not work as expeceted (GPGTools and Outlook/gpg4win seem to be incompatible).

In such cases I ask the counterparty to send an encrypted attachment. I decrypt it, then write my answer into the file, encrypt it and send it back. The E-Mails are always plain text, but the attachments are always encrypted.

Is my approach, except for usability, a viable option?

If the underlying algo's and methods (i.e. including signing) are the same then the reliance on the actual encryption is no different and in the real-world there is little difference in risk.

From a theoretical cryptanalysis standpoint one could argue that if the plaintext covering email provided context it would aid an attack on the cipher text, but modern algo's make this largely irrelevant.
One could also argue that if the entire email is encrypted an attacker would not know which aspect of the cipher text is email and which is attachment, but again if the crypto is reliable this is really only a theoretical difference in security. And provided the attachment is signed an attacker will not be able to replace the attachment (without the recipient being aware).

From a practical perspective I have always relied on specifically encrypted attachments rather than rely on a built-in email client mechanism, this is so that I know before an attachment is used that it has been encrypted and therefore no matter what finger trouble I have, when creating and sending the email, the attachment will always be encrypted and only accessible to the intended recipients (which in my opinion outweighs any theoretical benefits of encrypting the whole email).


What is different about being targeted by a professional attacker? It is often said that security tools such as firewalls, antivirus programs, etc. are only effective against random, untargeted attacks. If you are specifically targeted by an intentional, professional attacker (e.g. state sponsored, NSA, Chinese state attacker, or competitor looking to steal trade secrets) then most of these protections are useless. Is this true?

If it is true, then what tools or techniques make a targeted attack from a professional attacker different? Does the attacker have a significant advantage over me? What strategies can I employ to reduce the risk of a successful attack?

Disclaimer: I work at a company developing security software to mitigate against targeted attacks.
Some of the methods we use are similar to those used by attackers (when clients want to test their systems).
For example, one client asked us to test their security by doing targeted [spear] phishing attacks. We emailed only the IT department with a combination of 2 emails. One was an apparently mis-addressed email to the board with a link to a Pdf named something like Executive bonus summary.pdf, the other purported to be a new external portal for the company to use during the Olympics ("Please check your domain credentials work correctly..."). With a quick search on social media, we could've made user-specific emails but that would be time consuming and ultimately wasn't necessary.
We registered a domain name that was visually similar to the target's, then used it to host fake pages (styled identically to the real ones) and send DKIM signed emails (to avoid spam filters).
Of the techies targeted, 43% gave us their corporate login details, 54% tried to download the bogus pdf (the pdf was just garbage bytes so it looked like a corrupt download. One guy tried 5 times using Firefox, IE and finally wget).
We were told that only one user had detected the attack and reported it to management (but only after giving us their credentials).
So... Getting into the company is not impossible. As for getting information out, our normal sales pitch includes a demo of us bypassing company firewalls/traditional DLP. I don't believe we've ever failed unless they're air-gapped or using a good data diode (although the rate of exfiltration varies. In one case, we had a restrictive white-listing firewall, so had the software encode documents into images and keep updating a profile picture on Google. Then we watched the profile externally and downloaded each chunk).
That said, we've found time and again that software can be worked around but users are consistently the weakest link.
So to answer your question, a targeted attack includes the personal touch. Custom websites designed to trick users, research into what software (and release) is being used to check for known vulnerabilities, investigations on social media, social engineering, etc, etc.
Another one worth considering although less common is bribery/blackmail. If you're talking about state actors, it's not inconceivable.


What type of encoding do .pem files use to store the key? What encoding is the modulus in RSA cryptography stored as in a .pem file? Is it something similar to base64 of the modulus?

I can retrieve the modulus using the following:

openssl rsa -in pubkey.pem -pubin -modulus

But what does it actually do? If I have the product of two prime numbers(n) in decimal form then how should I encode it so that the rsa utility can decode it?

There are two commonly used formats:

DER - binary; data is stored in ASN.1 structure
PEM - text; basically it is base64-encoded DER

You can inspect them both for example with openssl asn1parse command or online decoder.


Machine Certificate Key File Artifacts When a new machine certificate is imported with a private key a MachineKey file is generated in "%ProgramData%\Microsoft\Crypto\RSA\MachineKeys".  When using the certificate mmc snapin or removing a certificate with powershell's Remove-Item the MachineKey file is left behind.  What are the implications to the artifacts existence?

Windows manages certificates and private keys separately. Each certificate may point to a private key; several certificates can point to the same key. Each such "pointer" is given as the name of the Cryptographic Service Provider (that morally contains the key), and the key name within that CSP. Windows does not keep track of how many certificates point to a given private key, and indeed this is not completely defined (especially since certificate stores can be extended with custom DLL). The main consequence is that when you delete a certificate, the private key stays there.

Private keys can be destroyed, but this requires calling the Win32 function CryptAcquireContext() with the CRYPT_DELETEKEYSET flag. Alternatively, you can use the certutil -key command to list private keys, and certutil -delkey to delete them. Neither of these commands is described in the Certutil documentation but you can get some help with certutil -key -? and certutil -delkey -?. In both case you may need to specify an explicit CSP name with the -csp option (use certutil -csplist to get the list of CSP installed on your machine).

Anyway, the security implication is the following: don't rely on private key deletion. A private key is a sensitive object; it must be handled with care. The normal lifecycle for a "machine key" is to be generated on the machine where it will be used, and never leave it. You should arrange for never to have to delete a private key. The need for private key deletion usually arises from people generating keys on their desktop system, to manage certificate enrollment from the comfort of their desk, and then transferring the private key and certificate to the system that will actually use it. This is poor practice, because it may leave traces of the private key on the desktop system.

Private key deletion is not very easy (as shown above: custom C program or undocumented command), and even when it works, it really is a file deletion, which does not actually ensure that the data no longer exists; file deletion merely marks the corresponding space as "free for reuse" but does not wipe it proactively.


How hard is it to read flash memory off a chip? What are the parameters in play, and what is a rough estimate of the hardness of the task of reading the contents of flash memory off a microcontroller? Of course, it is assumed that there is no conventional way to do it.

It largely depends on the chip and the person that programmed it. Microcontrollers usually have a feature that allows you to pull the existing firmware binary off, but in many cases that can be disabled with a so-called "secure flag", which disables the download process until a new firmware is uploaded containing directives that turn the secure flag off. Of course, this wipes the existing firmware in the process. Check the datasheet for the microcontroller for specifics.

If it's a microprocessor (as opposed to a microcontroller) then there is usually no on-chip firmware, and the program code is stored externally on a memory device. Usually this will be an EEPROM or a mask ROM which you can interface with separately. I've done this with embedded systems that use SPI flash - just desolder it and hook it up to a Bus Pirate. If you can't desolder the device, it may also be possible to sniff the bus and gain information that way.

The universal way to get at the data is decapping. You get some strong acid (nitric acid is a common choice) that will eat away and the package compound, but not the silicon, and leave it in there for a day or two. You then take photographs with a digital microscope and use image processing to turn the patterns into data.


I can receive all PADI packets for PPPoE connections of my ISP, is that a problem? for debugging why my router wasn't connecting to pppoe i've tried to connect via the pc, it worked, then i started wireshark just to see what was going on, and i've seen that i can read all the PADI packets from ISP's other clients, now i'm thinking, is that a security problem? Can another user respond with a PADO packet and complete a pppoe session acting as gateway and maybe also sniffing pppoe credentials?

I remember an Article on the German news site heise.de which described a similar vulnerability at a German DSL provider:

Wenn der Nachbar heimlich mitsurft  (Google-Translate)
Fremde Daten per ADSL-Kurzschluss   (Google-Translate)

The problem in that case was, that not only all the PPPoE packets were visible, but all packets. So if connected directly to a Windows computer, Windows would autoconfigure a private ip-address in the 169.0.0.0/8 range. Furthermore since this is another interface, Firewall rules for the internet-connection were not applied, exposing the Windows Network file and printer sharing.

So this is the next thing to check.


Mutual Auth and other protocols I’ve implemented mutual TLS for web applications. But can you do mutual tls, specifically for auth for other protocols and services?

Services like

RDP (windows client)
SSH
MySQL Workbench
oracle studio
etc

Is it true that you could do mutual auth for all these protocols?

... etc

There is no generic "mutual auth" scheme available for arbitrary protocols the same as there is no generic "auth" scheme in the first place. What is possible depends on the specific protocol used. Protocols using TLS could do it in theory but there might be restrictions in actual specification or implementation on how TLS is used within the protocol. Protocols not using TLS might offer mutual auth too (like SSH does) but again it depends on the specifics of the protocol.


SSL Certificate - Renewal vs. Requesting New Is there any benefit to renewing an existing SSL Cert as opposed to requesting a new one?

If may.

Renewal can be cheaper.
If the renewal mean keeping the same private key it may impact your key management (HPKP for example)


Are there security pitfalls on relying on an emails domain to automatically assign permissions? I'm working in a new clients system, and they automatically assign permissions based on the domain name for the email address the account was created under (they do require validation via an email).

They check that the email ends with @somedomain.tld. For large banking corporations. If you have the appropriate domain name you will have full access to employment histories, address histories, SSNs....etc for a cuople million people. These are 3rd party domains (that are used for the email addresses), are under no control of the aforementioned client operating this system. And are the company email addresses of whomever owns those domains. There are ~500 domains whose email addresses have access in this manner.

Are there security pitfalls with this? Are there exploits that have been used to work around such systems?

My goal is to do some due diligence since at first glance this seems like a fragile way of authorizing access to such information. But I do not have the knowledge to say if it is or is not. I would also like to know, outside of the scope of the above scenario, if there are pitfalls and issues with this sort of setup, regardless of the type of role or risk.

My understanding of your question is that you want to use the domain part of the users email to identify the company of the user and then setup access permissions based on this detected company. But you don't just use a single email for this - instead you associate the email with a user account (i.e. additional protection with password or similar) and the user has to prove that he has access to the claimed mail account when setting up the user account by sending some kind of confirmation link to the given mail address.

In order to have this kind of association between a user/company and an mail address you have to guarantee that nobody outside the company can send and receive mails using a company specific email address. Given that company specific mails can often be accessed from outside the companies network (mobile workers) and that phishing for credentials including mail credentials is heavily done today, it must be assumed that somebody outside the company might get access to a companies mail account.

Moreover the initial verification of the mail when setting up the user account does not help if the user leaves the company since there is no procedure to automatically disable the user account. While one can check from time to time if the user still has access to the mail account the process of disabling access for ex-employees is often broken, i.e. the user might still have access to his old companies mail even he does not work longer for the company.


Can HDD without OS contain active virus I bought a Free-dos computer with 128gb SSD and 1 TB HDD some time ago, installed Windows 10 on the SSD. After months of usage by many people, I question the security of the computer, I see sudden cpu, gpu and disk usage spikes, though I have Kaspersky and tried malwarebytes, I am still unsure of the computers security, I wanted to give it a frest start yet I have many important files inside the computer that I don't have any external storing place now.

My question is, if I were to completely erase windows 10 and re-install it, would it be a good solution for cleaning up (Format SSD) ? I want to store my files to HDD, I won't format HDD but given that the OS is reinstalled, there is no chance that HDD contains active viruses right ? Even if some application had some virus inside, it would need to be run first ? So I can extract safe files from it ?

Yes, an HDD without OS can contain active virus. For example, one of NSA implants can install itself into the hard drive firmware. The firmware area is not accessible to ordinary HDD formatting tools, so even if you wipe your hard drive with zeros, it would do nothing to this kind of implant.

Another kind of exiting malware installs itself into your bios, and thus would also survive OS reinstall with full disk wipe.

However, unless you're kind of person a three-letter agency would have definite interest about, both are more of a theoretical threat. What is more likely to happen in case you do have an infection is one of your often-used files (such as documents) is infected, and after you reinstall your OS, and open this document, you'd reinfect the newly installed OS back.

On the other hand, sudden spikes on hardware use alone are hardly sign of malware infection. Especially since you're using an antivirus, which itself uses CPU quite heavily.


How should I choose a trust model in GnuPG? GnuPG offers a set of different trust models, but the manual isn't sufficient (for me at least) to figure out which one to use.

Ideally, I would like a trust model that accepts the trust I explicitly assign to a key using GnuPG's --edit-key and trust subcommand, and also computes trust based on signatures.  Is this possible?  When I have tried to use GnuPG, it seems like it's ignoring the trust I assign using trust, and only trusting if I sign a key.

GnuPG does not allow a trust model like you describe, unless you specify ultimate trust on those keys (which makes them introducers into your local view on the web of trust). For GnuPG (and this also applies for OpenPGP in general), signatures are for defining verified identity, trust is just about defining which key's signatures to follow.

Given your actual requirement is not getting along without any signatures on the trusted keys but with not sharing those, GnuPG's local signatures might be what you're looking for.

Additionally, the concept of "trust on first use" might be sufficient for your use case, although providing a much weaker concept of defining trust.


Does anti-CSRF token really protect from CSRF? I have been reading all over the internet that I should have CSRF token on my page and this will protect it from CSRF.

However, I can imagine a scenario where anti-CSRF is not helpful. Is my understanding wrong somewhere? Scenario is following.

My website (example.com) has a form with anti-CSRF-token field on it.
The attacker creates own page (example2.com), on which he places js code that does following in background:

submit GET request to 'example.com'
scrape anti-CSRF-token out of it (since he can see the structure of the page by using it himself)
make a malicious request to 'example.com' including the scraped value of token, so that my server cannot know that request is not valid

Now, if such scenario is possible, it would mean that whole CSRF-token protection useless!

CSRF tokens are unique for each user and stored on either the server or client side. This means an attacker would have to guess the value of your CSRF token to attack you. If the token is generated using a cryptographically secure PRNG, a basic attack like you describe is not possible.


How secure is docker container-to-container traffic? I'm working on building a web application using the microservice architecture pattern in a set of docker containers and I'm wondering about the importance of securing the communication between the application and the microservices.

The application and microservices will be linked together in a cluster using the --link option and the microservices will not expose any ports. Communication between the application and microservices will be via HTTP. The application will expose port 80 only.

I've thought about what might happen if the application is compromised - it seems to me that if that happens, the details of any calls made to the microservice APIs will be in the hands of the attacker (including any secret keys, if implemented - see the scheme discussed below), so they'll have access to any data that can be obtained through those API calls, but they won't have access to the database or any other resources that are used exclusively by the microservices. But this is true regardless of whether the API calls are authenticated by the method given above or not.

How secure is this? Do I need to add an additional layer of authentication to the API calls?

I'm considering this scheme for authentication: Designing a Secure REST (Web) API without OAuth

Basically, the idea is that the application and the service have a shared secret which is used to encrypt the message contents in order to determine if the message comes from an authorized source and if it has been tampered with. At present, the APIs will be available only to the application, although at some point in the future it might be helpful to make some microservice APIs available to other applications, potentially not running in docker containers, and I know that a robust authentication scheme will be required at that point - is the scheme discussed above adequate?

From the docker documentation on container linking, it's possible to see that the standard setup for links is to create an internal network on the docker host which is used by the containers to talk to each other.

This network isn't exposed off-host by default so from that perspective it should be secure from network based attackers (i.e. no ports or services are accessible over the network so nothing to attack).

If an attacker gets access to the docker host, well the security of the containers is likely in trouble anyway with or without linking, depending on the privilege level the attacker can get, as with access to a privileged account on the docker host all bets are off.

The other likely attack scenario is where the attacker gets access to the externally facing part of your containerized application.  Here there again isn't much downside to having used links without additional security as once they have access to the front-end application server, they're likely to get the credentials needed to access the back-end services as those will be present on the front-end server.

One note of caution would be that if you design relying on container linking security, you may run into issues if you later scale up your solution to split components of the application onto different VMs or indeed different physical hosts, as you would then potentially be exposing those services to untrusted networks.

In summary I'd say that container linking should be considered a relatively secure means of inter-container communication.


How secure is FaceTime by Apple Apple says their messages and FaceTime calls are end-to-end encrypted and nobody can access them.

As I'm unfamiliar with cryptology, I've found security white paper from Apple, where says:

  FaceTime uses Internet Connectivity Establishment (ICE) to establish a
  peer-to-peer connection between devices. Using Session Initiation
  Protocol (SIP) messages, the devices verify their identity
  certificates and establish a shared secret for each session. The
  cryptographic nonces supplied by each device are combined to salt keys
  for each   of the media channels, which are streamed via Secure Real
  Time Protocol (SRTP) using AES-256 encryption.

How secure is FaceTime and is it really impossible to decrypt/access/listen calls and video?

If you believe Apple, FaceTime traffic is end-to-end encrypted using AES-256. This is secure, in the sense that somebody intercepting the traffic can not decrypt it (as far as is publicly known).

However, crypto is hard and the security could be compromised if Apple has made an implementation error. I.e. because of a programming bug the traffic may not get encrypted correctly. Apple has previously shown that they made pretty secure systems (e.g. the iPhone in the FBI case), so this is not likely.

Even if the traffic is encrypted, the system is not secure without authentication. If you set up a connection to the wrong person, an encrypted connection is not going to help. In that case you may tell your secrets to somebody pretending to be someone else. Of course in the case of FaceTime it would be pretty hard to impersonate someone, because you can see their face and hear their voice. Verifying that you are talking to the right person is pretty easy, even though there is no technical solution for this in FaceTime.


Is using Git for deploying a bad practice? I tend to use Git for deploying production code to the web server. That usually means that somewhere a master Git repository is hosted somewhere accessible over ssh, and the production server serves that cloned repository, while restricting access to .git/ and .gitignore. When I need to update it, I simply pull to the server's repository from the master repository. This has several advantages:

If anything ever goes wrong, it's extremely easy to rollback to an earlier revision - as simple as checking it out.
If any of the source code files are modified, checking it as easy as git status, and if the server's repository has been modified, it will be come obvious the next time I try to pull.
It means there exists one more copy of the source code, in case bad stuff happens.
Updating and rolling back is easy and very fast.

This might have a few problems though:

If for whatever reason web server decides it should serve .git/ directory, all the source code there was and is becomes readable for everyone. Historically, there were some (large) companies who made that mistake. I'm using .htaccess file to restrict access, so I don't think there's any danger at the moment. Perhaps an integration test making sure nobody can read the .git/ folder is in order?
Everyone who accidentally gains read access to the folder also gains access to every past revision of the source code that used to exist. But it shouldn't be much worse than having access to the present version. After all, those revisions are obsolete by definition.

All that said, I believe that using Git for deploying code to production is reasonably safe, and a whole lot easier than rsync, ftp, or just copying it over. What do you think?

I would go as far as considering using git for deployment very good practice.

The two problems you listed has very little to do with using git for deployment itself. Substitute .git/ for the config file containing database passwords and you have the same problem. If I have read access to your web root, I have read access to whatever is contained in it. This is a server hardening issue that you have to discuss with your system administration.

git offers some very attractive advantages when it comes to security.

You can enforce a system for deploying to production. I would even configure a post-receive hook to automatically deploy to production whenever a commit to master is made. I am assuming of course, a workflow similar to git flow.
git makes it extremely easy to rollback the code deployed on production to a previous version if a security issue is raised. This can be helpful in blocking access to mission-critical security flaws that you need time to fix properly.
You can enforce a system where your developers have to sign the commits they make. This can help in tracing who deployed what to production if a deliberate security flaw is  found.


Are VPNs/proxies legal? Are VPNs/proxies (and VPN/proxy software such as Tunnelblick and Hola) legal in the U.S., assuming that you are doing legitimate activities on the Internet (i.e. nothing illegal)?

Ask a lawyer for legal advice, but yes.  There are many VPNs and proxy services run in the US, and the most common use of VPNs are for corporate connections, so there are literally thousands in use at any time.


Encrypting a disk that has stuff on it? Ok, so a pretty big disk ~1-2TB (90% full, multiple partitions + 2 operating systems on it), needs to be encrypted and zeroed-out, and it's a bit too much data for backing it all up before encryption.

How do you recommend this to be done? Which tool should one use?
How reliable would zeroing-out and encryption on-the-fly be anyway (don't want to loose any data in the process)?

Not doing backups is crazy and scary given that your data is business/mission critical and not your movie collection. So whatever you do, backup your data. Consider the following scenario: you're performing the encryption and during the encryption process you have a power failure on the power grid. In that case you would will lose a lot, if not all your data.

So invest the time to backup - even if you have to backup over a 56k line, it's worth the time.

Regarding which tool to use, see the other answers.


Is native app vulnerable to FREAK attack? If yes, how to detect it as a user? When I research about FREAK attack, most of them explain about the server and browser vulnerability, but how about native apps (e.g. Windows executable program, mobile apps)?

From Mark's answer  on Can someone explain, in simple terms, how the FREAK attack on browsers works?,

  As far as I can tell, the "FREAK" vulnerability affects the SChannel library (Internet Explorer and related Windows browsers), Apple's SSL library (Safari and other MacOSX/IOS browsers), and OpenSSL (most Android browsers and a scattering of Linux browsers). The NSS library (Firefox and Chrome) does not appear to be affected.

it seems that it's related to the TLS libraries they are using. Is it also the same for native apps?

If it is, then as a user, how can we detect that?

Yes, it's the same for native apps.

On Windows, you can simply assume that the application is using SChannel and be right 99% of the time; the same for MacOSX/iOS and Secure Transport.  On Linux, you can run ldd /path/to/program/binary and inspect the output for either libgnutls (GnuTLS) or libssl (OpenSSL/LibreSSL).  I don't know how you'd figure it out for Android.


Are there any class of systems where it is safe to disable spectre and meltdown patches I was not able to find a definite answer to the question whether it is safe to disable spectre and meltdown vulnerabilities but i could articles that suggests the defaults might be revisited & windows seems to allow the disabling of these.
Does anyone know if it has been established clearly, the type of servers which are allowed to turn it off? e.g servers which are not running on shared infrastructure or servers which do not allow user code execution

Like many other mitigations the fixes for Spectre and Meltdown address problems with running not fully trustable code. If these fixes are not applied than such code might bypass the normal restrictions to gain information information about the memory content of other processes or the OS kernel.
If definitely all code running on the system can be fully trusted then these mitigations are not needed. But note that even code from a trusted code or code you've written yourself might not be "fully trustable". There might still be unexpected code flows, especially if external input (user input, sensors ...) is processed. But the more one is in control of the code and it's behavior, the more one can control this risk and there might be a case where the risks of the code it sufficiently low to switch off mitigations against Meltdown and Spectre.
There might also be cases where not fully trustable code is run, but where an exploited information leak does not cause relevant harm. This might be the case where no important data are stored on the system in the first place or where there is no way to misuse gained information. For example if the system cannot make any connections to the outside world due to external protections (like firewalls) then the risk is low (but not zero) that captured secrets from the machine can be send to the outside attacker.


Is Hydra splitting the wordlist file into as many parts as tasks / threads? I'm playing around with Hydra and an xmpp authentication.

I created a basic xmpp server of my own, reproducing an authentication (server side) from a clear text pcap file.
I think I got something wrong in my connections handling (I'm creating one thread per new connection but I close it on error) but nevermind, this is not my point.

I fixed this scalability problem. For those interested, it was due to an optimization from Hydra, not replaying the first, let's call it "Hello request".  A regular authentication needs 4 requests or responses from a client, 4 packets  from the server too. And this optimization skips the first, going straight to the 2nd, that looks like that in my case : <auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='SCRAM-SHA-1'/>

Stats / Info :

Conf of the VM : 2 CPU, 2 GB RAM.
Password location in the wordlist : 795th position out of 60k.
Single task : ~50 tries / min -> ~17min to find the password.
16 tasks : ~820 tries / min -> 1h14min to complete without finding the pw ('cause of the connections handling problem).

New stats (after optimization) :

Single task : ~90 tries / min -> 9min 13s
16 tasks : ~1400+ tries / min -> 33s

The question is: is Hydra splitting the wordlist into 16 equal parts? And how?

One part size is ~3.8k passwords.
Is the thread 1 working on the first 3.8k passwords? The thread 2 working on the 3801rst -> 7600 ? and so on till thread 16? So that the last 16 tested passwords would be the 3799th, 7599th and so on?

The other possibility is that the thread 1 for example proceeds every 1%16 (modulo) password from the wordlist, so that the passwords are tested in the same order than if we had only 1 task (/ thread) running.

I can test it myself but if someone already did, please enlighten my darkness.

I found the answer.

Hydra is, I think, doing a modulo [number of tasks] to create each "subfile" that are processed in parallel. Why that ? Because it's 99% the same sequence of passwords test, I mean they are processed in the same order.

ie : Password number 1 will be tested as number 1 launching 16 tasks, password number 2000 will be tested in 2000th position as well in the 16 tasks hydra processing.

It also means the thread/task 1 will process password 1, 17, 33, 49...

Thread/task 2 will process password 2, 18, 34, 50... and so on.

And of course passwords are processed sequentially, ie in the same order, if you launch hydra with only 1 task.

I tested it on 8k passwords and it's almost all the time the same order in both cases, with very little variation sometimes.


How to analyze a rootkit? The other a friend of mine sent me a rootkit/code  he found on a server that was exploited (php cgi exploit).

Now I was thinking of having a look at it, but I was wondering if there are some basic steps to follow to analyze these things?

I'm not talking about the obvious stuff like using a sandbox that's not attached to the network. But more how one does a thorough step by step analysis  and how this normally is documented.

As part of a CTF challenge that I run, we had some reverse-engineering challenges last year. I posted some advice on how to perform the analysis (verified by folks that do this on a daily basis). The blogpost is here. The links point to tutorials for IDA and OllyDbg, two of the most popular tools for such analysis and there's a nice paper from one of the AV vendors. From memory the tutorials were step by step.

There's also some rootkit analysis videos on http://www.securitytube.net/.


is dll hooking and dll hijacking the same concept? I'm very confused after reading all about these concepts, want an example so as to the concept of dll hooking/hijacking and dll injection is clear!
Is dll hijacking/hooking the samething?!

Please help me with an example!

No, they're not the same.

DLL injection is one process forcing a different, already executing process to load a DLL.

DLL hijacking is malicious software taking advantage of a program not specifying the exact location of a DLL it is loading and having it load a different DLL than the program intended.

DLL hooking is where an application takes over the entry points of a DLL so that it can intercept API calls.

Injection and hooking may or may not be malicious, injection is nearly always malicious.


How to add wildcards to snort rule ip address? Is it possible to add wildcards or something that would function like them to a snort rule IP address?

For example:

If I'd like to detect source-ip of: 192.168.*.9

Where the third octet can be anything in range 1-255, but the fourth octet has to be exactly '9'.

Snort doesn't support wildcards or regular expressions on IP addresses/ranges. It does support CIDR notation for IP ranges, a few pre-configured variables in snort.conf like $HOME_NET and similar, and a ! for IP or IP range negation (edit: Oh, and of course any, but not !any).

What you could do however is to define a new ipvar variable, fill it with the list of IPs that match your requirements, and then refer to it in the rules definition to simplify things and avoid adding 256 individual rules:

ipvar ENDS_WITH_A_NINE [192.168.0.9,192.168.1.9,192.168.2.9,192.168.3.9,192.168.4.9, ... ]
alert tcp $ENDS_WITH_A_NINE any -> any any (msg:"Last octet of 9 detected!"; sid:9;)

This way, it will be a lot easier to maintain your Snort rules. I realize it doesn't look elegant, but it shouldn't take you longer than a few minutes to copy all the 256 possible IP addresses in the variable list, and beats creating all 256 rules, then later realizing you need to change something in them.

Anyway, hope this helps! ;)


How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext? I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case.

When I sign on to my online banking account, I'm prompted for three random digits from a four digit PIN, and three random characters from my (long, random) password.

From my limited understanding of all this, the bank is unable to create my password hash from this login because they don't have my whole password. So are they storing my password in cleartext and comparing individual characters? Is it a decent balance of convenience/security?

Prompted to ask this question by this blog post: Who cares about password security? NatWest don't

Whilst I don't know explicitly how banks handle this requirement, an alternate process to the one that @rakhi mentions would be to use an HSM and reversible encryption.

The idea is that the full password would be stored in the database encrypted using a symmetric cipher (eg, AES).  Then when the password characters are passed to the application they are fed into the HSM along with the encrypted password.

The HSM could then decrypt the password and confirm that the 3 characters are as expected, returning a pass/fail response to the application.  So at no point is the password held in the clear (apart from in the HSM which is considered secure).

This would tie up with the way that PIN encryption can be handled by ATM networks (eg, symmetric encryption and HSMs)


A secure alternative for e-mail I am looking for an alternative for my current e-mail provider (gmail).  I would like to gain back a little bit more "privacy" on the internet. I would like the following things:

The e-mails I send and receive are not available in bulk for companies like NSA(so best is to locate the servers outside the USA).
The company that host the e-mail server stores my mails encrypted so only me and the receiver can view it.

These are the most important 2 point which come in mind right now, but maybe there are more things that can be added.

I have founded 3 options to achieve this:

protonmail.ch
tutanota.com
posteo.de

I am kind leaning towards the first one for the reason that that the only one is that is located in switzerland. The other two are located in (I hope this is correct) Germany. After some research became clear that Germany has worked in the past with the NSA and is not really what I want.

Question: Is protonmail.ch the way to go? Am I approaching the problem from the good angle? Any thought or advise is welcome!!

You want end-to-end encryption. For e-mail, you can use things like PGP. There are several e-mail hosts offering users advanced Web clients to perform end-to-end crypto with JavaScript, but any second party needs to either have their own account (for hosts that do not use PGP or similar), or their own PGP key pair if applicable: you must know a public key for any secure recipient, and a recipient must be able and willing to engage in end-to-end-encrypted correspondence in this way.

If you want an actual alternative to e-mail, Bitmessage is an option that comes with several other benefits, in particular the condition of identity bound to cryptographic key components, and there are no servers that need to host your messages distinct from any others (can't tell who a message is to/from; all nodes handle all messages, seeing if they can decrypt each message they receive). See Blinked if you are interested in exploring Bitmessage these days. There are also native clients on the main site linked above, and using it this way helps you contribute to the network.


Man-in-the-middle attack with public wifi I'm using Charles to sniff out the traffic on my iPhone at Starbucks and for some reason it won't work with at&t wifi. Google Starbucks wifi does, however. I use my iPhone to connect to the same wifi network that my MacBook is connected to. Then, for the proxy settings on my phone, I enter my computer's local IP address and the port that I specified in the proxy settings on Charles. I'm aware that some wifi networks block certain ports, but even when I change the proxy settings on Charles so that it's dynamic and it finds an open port, it still doesn't work. Any ideas?

Your Charles Proxy software was working fine. The reason you won't see other users on a Starbucks WiFi network is because Starbucks enlisted Google to design and implement their WiFi networks (which is why the SSIDs are named "Google Starbucks"), and Google set them up in a really smart way. Each user that connects to a Google Starbucks hotspot is "sandboxed" on their own individual subnet. If you use a network analysis tool like Nmap, you won't see anyone else. This is a fantastic way to isolate users from each other, which eliminates direct attacks from other people connected to that hotspot.
However, the threat of a Man-in-the-Middle attack still exists on ANY public WiFi network (i.e., WiFi that does not require a password to connect), because actually, these attacks do NOT come from other users who are already connected to that network. The vulnerability is at the moment you initially connect to a public WiFi hotspot. An attacker can set up their own WiFi hotspot and let unsuspecting people connect to it instead of the legitimate hotspot.
This is how it works: an attacker can use a laptop with two WiFi adapters. They would connect one of them to the legitimate public hotspot which is connected to the Internet. Then they would set up their second adapter as another WiFi hotspot that uses the same SSID as the legitimate hotspot. They would also create a fake login screen that looks just like the legitimate one (which is not difficult to do). If you happen to be sitting closer to this "rogue" hotspot than you are to the legitimate hotspot, you may unwittingly connect to it instead of the legitimate hotspot. Then the attacker proxies all of your traffic to/from the Internet and you wouldn't notice the difference. Your secure connection (using HTTPS/SSL/TLS) terminates at their laptop, and then another secure connection is established to go out to the Internet and back, so you will still see that the websites you're using are happily connected using HTTPS. But meanwhile, ALL of your data is passing through the attacker's laptop as unencrypted, clear text that can be intercepted, viewed and recorded. This includes any and all information a user sends through a web page, including passwords.
The only way to be absolutely sure your Internet connection is secure from end to end, is to use locally installed software that "tunnels" your traffic directly to a (proxy) server that the software already recognizes as a trusted provider. Then, even if you do connect to a rogue hotspot, your traffic passing through the attacker's computer is still encrypted, so the attacker cannot view anything at all. Some examples of tunneling software are corporate VPNs (they use client software), anonymous proxy services (only those that use a client app), and SSH (secure shell) tunnels that, once again, connect to and proxy your traffic through already known and trusted servers.
Public WiFi can be safe. Now you know how. Happy surfing.


webapp directories should have the directory name as owner and group? Some programmer told me that my usual way to change ownership and permissions to my webapp dirs isn't good:

sudo chown www-data:www-data /var/www/html/* -R

He told me that this could result in a state when malicious CMS modules affect molecularity of adjacent webapps with the same owner.

I think that this is a good solution

1) When I create a new webapp:

sudo chown -R ${domain}:${domain} ${domain}/*

2) When I change an existing webapp:

cd /var/www/html && sudo chown -R $<domain.tld>:<domain.tld> domain.tld/*

My qeustion

My question is comprised of the following two questions:

Was the programmer right?
How should I add user in a safe user to give it as owner and group? (not sure if to pick useradd/adduser and with what permissions, for that purpose.

I don't think the suggestion is particularly to have the same value as the user and group as the directory name, but rather to have a single user/group for each directory.

If you use www-data for all cases, then a compromise of a single site (or malicious site owner in the case of shared hosting) can easily read & write files into the other site directories.

Having multiple users (one per site, for example) mitigates the damage in a compromise.  Typically, you'd want www-data for the group (and group readable, but not writable permissions) so your webserver can read all of the static files, and to run a per-user instance of your application server.  (For example, one php-fcgi or python gunicorn instance running as each site owner, for the appropriate language.)

You can use adduser, but I would use both the --disabled-password and --disabled-login flags to ensure that the new user does not also become an attack vector!


PHP Code Injection vulnerability exists even after recommended hardening Using Burp to intercept traffic and inject code we have identified
  remote code execution vulnerability in a website. After entering data
  in input fields on the form and clicking submit the traffic was
  intercepted and the following commands were added to the request in
  the value of the input fields

%27%2bsystem(%22id%22)%2b%27

To fix it we have done the recommended hardening

On all the input fields we have done the input sanitization. We we have allowed only digits and put a limit on the number of digits allowed. We have also used the functions such as htmlspecialchars , escapeshellcmd, escapeshellargs etc.

This did not help.
What I am not able to understand here is that if they intercept the traffic,how are they able to bypass the input validation I have put on the form

So when we were able to intercept traffic and inject system command we checked the userid and removed shell access for this userid In etc/passwd it was /bin/bash for this user, we removed the access and verified that it was updated to /bin/false for this user

This also did not help

The user whose id was displayed using code injection is the owner of the website home directory. We didn't try changing the ownership but We tried removing execute permissions for this user on the home directory, but then the site itself became inaccessible and was giving 403 forbidden error.

So the execute permissions for this user and other users in the same group was retained

We have used disable_functions in php.ini to disable most of the recommended functions such as exec,system etc.
We have Restarted httpd , I was hopeful that this would solve the issue, but still the issue exists.
We have also used other directives such as Session cookie secure,Cookie httponly,session.referer_check,session.use_strict_mode etc. but all in vain
We tried removing the execute permission on /usr/bin for all users other than root.
With this the vulnerability was fixed, but after sometime the site itself became inaccessible. The database was not starting as it needed these permissions.
Hence we reverted back the permissions.

Could you please let me know if there is anything else that I can try or if I need to provide more information?

Right Idea, wrong implementation

  On all the input fields we have done the input sanitization. We we
  have allowed only digits and put a limit on the number of digits
  allowed. We have also used the functions such as htmlspecialchars ,
  escapeshellcmd, escapeshellargs etc.

Input sanitization is the crux of your problem ... but sanitizing it on the front end is just putting lipstick on a pig.  Anything code that is run on the client side should not be trusted ... so sanitizing client side is purely for UI/UX functionality.  For security you need to do the same sanitation on server side, and kick back error codes as needed.


What security arrangements do I need to think about when passing a password through my site server I want to automate some of my home admin.

I'm writing a small-ish website, to do that. Written in C#/.NET, hosted on Azure, backed by an Azure SQL DB, codebase available publicly on GitHub.

One of the things that I'm going to want my site to do is log into a couple of other websites in Selenium and scrape some information.

I don't want to have to worry about whether I've done password storage correctly, so I'm expecting to have the user (me! :D) enter the relevant password(s) into my site's UI each time it wants to do this scraping.

So I'll enter the relevant p/w into my site, in plaintext, which will be transmitted to the server in Azure, my code will briefly hold it in memory before plugging it into the Selenium UI of the destination site (again, in plain text).

I want to make sure that I've not made myself less secure by doing this.

What are my security considerations & solutions for this system?

I think that there are 4 attack vectors that I should be consider:

Something snooping on the requests between my home PC and my Azure site.
Something snooping on the requests between my Azure site and the destination site.
Someone noticing the source code on GitHub.
Someone gaining access to the Azure system.

And I think my solutions/responses to these things are:

This is solved by implementing standard TLS for my site, as documented on OWASP.
I assume that the destination site is inherrently securely set up (otherwise logging into it from my home PC is ALSO insecure, in which case my new system is no worse.). So all I need to do is to make sure that Selenium is respecting all the normal security of "a browser talking to a website".
I have control over write-access to the codebase. Read-only access to the code-base should never be a security risk, as you already assume that the attacker has full knowledge of the structure of your system. The codebase doesn't know anything about the password, so I'm not exposing anything there.
Would depend on what it is that they can do in there... If they can see the Database, that's not a problem since the password never gets put there. If they can monitor traffic, that's no different from #1 and #2. If they can replace my executables they I'm irrevocably screwed because any protection I make can be un-done by changing the executable.

Based on the above:

I think that the first 2 have known solutions.
I think the 3rd isn't a problem.
I think the last one isn't solvable (but is also very unlikely to be a risk)

I can't do anything that resembles sending a hash of the password (rather than the password itself), because I fundamentally need my server code to have the plaintext password so that it can give it to the destination site UI.

I could try to do some encryption of the password, in my browser (or in my head) and have my site decrypt it. But either I use proper, safe encryption where knowing the mechanisms and encryption keys doesn't help ... in which case I think I'm just re-implementing TLS, and will probably do a bad job. Or I'm adding simplistic security-by-obscurity enciphering, which doesn't achieve anything because the code-base is public (and hence so is the full de-ciphering mechanism & key).

Is my analysis and understanding correct?

The biggest concern seems to stem from the use of a password you know being transmitted to a remote site for gathering information. The biggest staple in password based authentication protection for your use case is HTTPS which will prevent most MitM attacks and obscure your information from packet sniffers.

As far as being concerned about someone hijacking your Azure system, it sounds like you don't have much to lose. All your code is available on line, the only thing I would worry about is your database and the data you store there. If your credential for accessing the database can be found anywhere on your application server, then your data could be exposed. Unfortunately, you can't do much to stop an attacker on your machine other than to decommission and rebuild and prevent them from entering in again.

Now, the challenge behind password based authentication is continuing beleaguer the security community. Passwords are terribly difficult to manage and aren't great for security. While some protocols have been built to try and mitigate these risks (NTML, Kerberos, etc), we're finding that more secure authentication schemes are required. Depending on your relationship with the vendor, may be worth looking to see if they can or will support FIDO, OATH, or other modern authentication solutions in the near future.


If someone knows my wi-fi password, will he know what I am doing? I just told my friend my Wi-Fi password, will he know what I am doing even though he does not connect to my home internet?

The answer is yes, he can see what you're doing on the internet when he is connected to your WiFi network.

The encryption protocol used is pretty much irrelevant. Whilst WPA2 will generate a unique session key for each client association, if the attacker captures this he can still decrypt your traffic. Even if the attacker doesn't capture it, he can forge a disassociation and capture the session key when you reconnect, revealing all of your subsequent traffic.

Once someone has your WiFi password, consider it to be the same as them having a LAN cable plugged directly into the router. The WiFi password offers no additional security beyond limiting access to the network itself.


Why does Facebook serve several SSL certificates? Facebook seems to be alternately serving two SSL certificates, one from DigiCert and one from VeriSign. There are only two reasons for this that I can think of:

They're in the middle of a certificate change that hasn't propagated to all of their load-balanced servers yet. This seems unlikely as it's been going on for some time, and it's almost a year until the first certificate expires.
I'm being man-in-the-middled. Also seems unlikely.

Why would Facebook do this, except for making paranoid people even more paranoid? I also remember Google serving lots of different SSL certificates half a year ago or so.

Edited to clarify my concern: Facebook apparently expects its users to accept any of the different certificates that it supplies, and not. If an attacker were to extract the certificate from one server farm, they could then use it to MITM a user on that or any other server farms, as the users are expected not to care about certificate changes. The traditional way to prevent this is to have users be wary about inexplicable certificate changes.

Normally, a user would just need to know if the current certificate was close to expire. In this case, she would need to maintain a list of currently used certificates and also need to know if Facebook just built a new server farm somewhere. Is there any way for a user to validate their concerns about a new certificate? I can only see this decreasing the security of the site.

For reference, the SHA1 fingerprints of the keys are D3:81:DE:E3:2C:9C:C9:F7:B6:6F:EE:41:1E:64:27:80:21:76:D0:BC and 63:08:84:E2:79:CB:11:07:F1:FB:8A:6B:11:A6:4D:1B:14:76:3F:8E.

Option 3 is that they don't want to put all of their CA eggs in the same basket. I know that various Apple.com certificates - all apparently legitimate - are issued by different CAs, so it could just be that these companies do not want to depend on a single supplier.

Why not? Well imagine that one CA is compromised, or goes out of business, or fails some audit such that one or more browser vendors decide to stop trusting its certificates. If they're your only provider of SSL certificates, that's a problem: you can't offer a good SSL experience until you find a new provider, establish a relationship with them, get new certificates issued, revoke the old ones and deploy the new ones. If you've got multiple CAs you just deploy one of your other existing certs into the places where the bad certificate is currently being used, revoke the bad cert, and you're good to go.

BTW, your description of Option 2 expresses one of the key problems with SSL: almost every warning you ever see is a false positive, so even when people are suspicious of the certificate (which is almost never anyway) they tend to assume that the problem is anything but a real attack. Browsers have cried wolf too often.


Why middleman cannot capture the encryption key of https/tor traffic? When we use Tor or https traffic , the encryption- decryption key has to be exchanged between the browser and the website server. Why somebody who can capture entire traffic , say ISP or somebody who controls the wifi router, cannot capture the key and hence read the actual content of the encrypted traffic ?

This is the basics of Asymmetric Key Encryption (or public key encryption).  Each party has a key pair, a public key and private key.

You can encrypt data with the public key, but it can only be decrypted with the private key.  Now, there is a performance hit when using public keys, so usually a symmetric key is set up.  The problem is that we need to have a secure way to distribute our key.    Public key cryptography is used to securely exchange that key.

In it's most simplified form, a client creates a secret key K, and encrypt this using the server's public key. Now, only the server can decrypt this, and K is used to encrypt all further traffic.

K is never transferred in clear text, so even though an ISP collects all traffic between client and server, they'll never know what K is.  (That is, unless there are vulnerabilities).

As said, there's a lot more to see (SSL negotiation, etc...) when setting up an SSL tunnel, but that's the general idea.


How does Dumpper program get default WPS without bruteforcing them? Today I tried a program called Dumpper and the program showed me default WPS of all of my neighbor access points without bruteforcing them, see screenshot below:

How does this program work?

WPS does not seem to be a well implemented technology. If you reverse engineer the firmware, you may find that the algorithm is MAC based, etc (such as in the case of some D-Link Routers or Belkin).

It also looks like in many cases that implementation weaknesses also permit brute forcing (also see CERT VU#723755) to be done easily.

This is supposedly open source software, so you can examine it to see what is going on exactly, but the code doesn't seem to actually be upon on SF.


How secure is my software for file encryption with AES-256? I'm working on a project to build software for file encryption with AES in Java, it's operation is quite simple, but I was wondering if it is really safe.

The program prompts the user for a passphrase to encrypt the selected file, after entering the passphrase, it's secured with a Key Derivation Function PBKDF2 With Hmac-SHA256, salt is a Pseudorandom Number Generator to 8-byte SHA1 PRNG, iterations are 100,000 and key length is 256-bit.

The secure key generated is used to encrypt the file.
The Initialization Vector for the AES is a Pseudorandom Number Generator of 16 byte SHA1 PRNG, the file is now encrypted.

The first 16 bytes of the encrypted file is saved to the IV and for the past 8-bytes to store the salt of PBKDF2.

The salt and IV are not encrypted along with the files, but are added later. Are these operations are safe?

First: Please don't roll your own crypto.

If you're doing this for production purposes I've to strongly recommend against using it. If it you want to improve your programming skills or this is a smiliar research project, it's fine as long as you do not expect strong (professional) security from it.

Now to the actual points which are improvable on what you gave here (in order of appearance in the post):

PKCS#5 PBKDF2 with HMAC-SHA-256. Please. PBKDF2 is an old standard for password based key derivation and should be replaced by at least bcrypt or even better Argon2. Also see our canonical answer on password hashing.
100,000 iterations. Please don't hard-code the iteration count but rather dynmically find it at run-time depending on what the CPU can do. This is especially true if you don't know your exact target platform and if your software will be around for some time. TrueCrypt also fell about this issue.
8-byte salt. While an 8-byte (=64-bit) salt may be fine, a 16 byte (= 128-bit) salt is a better choice, to prevent pre-computation attacks on the limited range of salts.
SHA-1-PRNG. You didn't give any details about this one. This looks OK, but you should upgrade if possible (to SHA-256 or SHA-3), to avoid SHA-1 which is still OK for running a PRNG but may shine a bad light on your tool for using such an old and "broken" algorithm.
16 byte IV for AES. Note while this is the appropriate choice for CBC, CFB, CTR, OFB, ... (i.e. all unauthenticated encryption modes) it usually isn't the appropriate choice for authenticated encryption modes which require a 12-byte nonce for optimal security. If you can guarantee unique keys (which it looks like you can), you can let the nonce default to all-zero.
AES/CBC/PKCS5Padding. This would be an OK choice (not a good one!) if you'd have some means to authenticate the message (i.e. confirm it hasn't been tampered with). You don't, so the better choice would be to use an authenticated encryption scheme like AES-GCM, AES-CCM, AES-EAX, ...
The associated data (salt + IV). First, you can let the IV default to some value (all zero?) if you files stay small (less than 68GB) and use AES-GCM. Second, you should authenticate this data as "associated data" and add an authentication tag (in clear) at the end of the file (decent libraries will do that automatically). If you were to use this is as it stands, an attacker (who knows the first block) could change the IV to make the legitimate user decrypt a plaintext of the attacker's choice. Additionally you'd want to add the key derivation parameters (like iteration counts, time and space parameters and other configuration) to your associated data to ensure long-term adaptibility of the format.


Will a wildcard SSL work properly for an A record subdomain pointing to another domain/website? Client has wildcard SSL for his domain/subdomains.

The application we are building is on one of our linux servers using one of our IP addresses and is contained within an account named www.somedomain.com. Our plan was to set the SSL cert up on our server.

Client suggested we can use HIS wildcard SSL cert for the application/site.
He suggested that all he needs is SHA2 on our server.

Will his SSL Certificate cause browsers to warn about the domains changing? The browser requests will always be made at his.subdomain.com and directed to www.somedomain.com via an A record and a parked domain on our server.

Do I in fact need the SSL for our server and domain?

Thanks

First, an A record can only point to an IP address, not a hostname.

Secondly, once the clients hit that IP address - which seems to be your own server - it needs to have a valid certificate for the hostname requested (his.subdomain.com would need *.subdomain.com). Obviously, you need your server to answer for this hostname/vhost.

www.somedomain.com doesn't have anything to do in this picture.

Also, SHA2 is a different topic and has nothing to do with the vhost setup. This relates to the signature of the certificate which you don't own and have no control over.

To correctly understand all those elements, I suggest referring to the OSI model. Being able to abstract complexity of different layers is extremely useful to correctly understand the big picture without mixing concepts from different technology altogether.


Encrypt database records to be accessed by multiple users I want to encrypt serialised customer details and store in a database to protect against attacks where the attacker has access to the raw database records. The records then need to be accessible by multiple logged-in users, but do not need to be indexed nor searched.

The naive approach would be to use a system-wide key for symmetrical encryption using AES or similar, however I'm not sure that this is any more secure than no encryption at all.

Is it generally safe to say that raw DB access is more of a threat than source code access? Assuming so (which I believe to be the case in my situation), is there a better approach that I can use than one system-wide key?

Thanks

The problem with direct access to the database is that users can extract large amounts of data e.g. SELECT * FROM TableName.

If you encrypt data in the database using transparent encryption, the users with access to the data see the encryption transparently or, in other words, they see clear text data. Even if they see encrypted data, they may have a view configured to see such data in the clear.

You could consider encrypting the data at the application layer. This means the data would be encrypted within the database so DBAs would only see encrypted data. The application can then decrypt and publish data depending on user privileges. This could be tuned so end users only see single pieces of data at a time rather than lists or volumes and logging could be enabled so you can identify who has accessed what data.

Then you need to consider how your key management is implemented so the encryption key used by application is not stored somewhere in clear text and is not available to any user. AES with a bit length of 128 or greater is a perfectly reasonable symmetric key to use.


Insecure VPN entry point If I use an insecure router as an entry point of a VPN, does this effectively bypass all of the privacy benefits of using a VPN?

VPN is designed to protect against attackers on the path of the communication between the VPN endpoints. This means it is does not protect against attackers before or at the VPN entry or at or after the VPN exit. This means an insecure router as VPN entry seriously impacts the protection offered by the VPN - an attacker could simply attack the VPN entry and access the communication before encryption or after decryption.