Did any VT100 derivatives rely on client-side security? VT100 terminals are "dumb terminals" - they just display data from the server, and send key strokes, with no local processing. In this setup, there can be server-side application flaws, and the connection is usually unencrypted. But the client isn't relied on for security controls.

Newer derivatives like VT220 introduced more control codes - colours, cursor control, primitive graphics. From basic reading on Wikipedia I can't see how they sent data up to the server. Is it still just direct key strokes, or some more structured protocol?

Someone mentioned to me informally that some of these protocols introduce client-side security controls. E.g. the screen would have several fields, some of which are read-only - and the control is enforced on the client. This would be interesting for security people, because a malicious client could bypass those controls. However, I can't find any information online to show this was in fact a problem.

I am asking for historic interest only. Do you know of any dumb-terminal related protocols where the client performs security controls?

In the old days, the grand father of all terminals was the Teletype model 33, one of the first ASCII capable terminal. AFAIK, the only protocol was:

send the ASCII code for any key pressed
print the character for any code received

It is still what is provided for dumb emulators. No security involved here.

They came terminal having screens. Manufacturer implemented various control codes to allow positioning the cursor on the screen and to allow some effects: blinking, dim or high intensity, reverse video and finally colours. More possibilities of presentation, but still no place for security.

With those terminals it was possible to use full screen editing (in the sense of what is allowed with curses and editors like emacs and vi) but all the presentation was done by the server. Some terminal manufacturers decided to implement a transactional model: the server sent a page, marking some zone as read-only and other as editable, the terminal displayed it and allowed operator to fill the editable fields locally and only when all the page was completed, the operator pressed a Send key and all the editable fields were sent to the server in once single operation. This allowed one single server to accept much more terminal.

But no security was involved either: the terminal were either local (hardwired) or connected through simple modems. The user was supposed to login when he first connected, full stop. All the security was at the application level on the server, because the equivalent of Javascript to send code to be executed on terminal did not exist.


When does iOS check validity of enterprise certificates? Here is an article that should give a little more context (and see my comment on it, same username, for additional info).

iOS developers are able to distribute apps outside of the App Store using an Enterprise provisioning profile. This allows apps to be installed even right from Safari without the need for App Store approval, enabling non-developers to test beta builds, companies to distribute internal apps to employees, etc.

However, both Apple and the enterprise account holder retain the ability to revoke the certificate backing the provisioning profile, which would prevent anymore users from installing the app (in the case of the article linked above, Apple revoked the enterprise profile used to sign the emulator because they considered it abuse of the freedom granted by enterprise distribution)...excluding, of course, the "loophole" used to bypass that check: simply change your system date to any date in the past.

This raises a lot of questions about how the certificate validation is implemented, but I'm most curious about what goes on when the loophole is not being exploited. At what point does the device actually reach out to Apple to make sure the certificate has not been revoked? At the moment the app is installed? If that's the case, is it "soft" (allows install unless revocation is explicitly detected) or "hard" (forbids install unless certificate is absolutely proven still valid)? Or does the device check in with Apple periodically to get an updated blacklist/whitelist of enterprise certificate identities? Or is it something even different?

From the iOS 7 Deployment Technical Reference document (opens a PDF):

  Certificate validation
  The first time a user opens an app, the
  distribution certificate is validated by contacting Apple’s OCSP
  server. Unless the certificate has been revoked, the app is allowed to
  run. Inability to contact or get a response from the OCSP server isn’t
  interpreted as a revocation. To verify the status, the device must be
  able to reach ocsp.apple.com. See “Network Configuration
  Requirements,” earlier in this appendix.  The OCSP response is cached
  on the device for the period of time specified by the OCSP
  server—currently, between three and seven days. The validity of the
  certificate isn’t checked again until the device has restarted and the
  cached response has expired. If a revocation is received at that time,
  the app is prevented from running.  Revoking a distribution certificate
  invalidates all of the apps you’ve signed with it. You should revoke a
  certificate only as a last resort— if you’re sure the private key is
  lost or the certificate is believed to be compromised.


Does flagging a file as read-only prevent a hash from changing? Some time ago I developed a simple script to detect duplicated files. It works in the following way:

Locates Excel files in a folder.
Obtains SHA-256 of the file.
Stores a mapping between Filename - SHA256.
Flags the file as read-only.

Now, I am well aware that Excel stores metadata in its own structure, so opening and saving an Excel file even if no modification has been made will modify the SHA-256 for this file.

My question is: if I flag the file as read-only after obtaining its SHA-256, is it possible to obtain a different SHA-256 while this flag is enabled?

I have noticed that I'm getting different SHA-256 hashes for files flagged as read-only, and I would like to understand if this is even possible.

There are two scenarios that would explain why your file can still be changed, despite it being write protected:

If you start your program (Excel) as a user who is allowed to change the permissions, most notably write permissions, of the file, then the program (Excel) could simply re-enable write permission without telling you. That's generally a bad idea, but maybe Excel is dumb. Libreoffice Calc asks whether you want to modify the write permission flag. I'd assume Excel would, too.
If your program DELETES the file and recreates a file with the same name, it will look as if the file changed, even though it was actually completely removed and replaced by a different file which just happens to look mostly identical. This is possible because deleting a file isn't prevented by denying write permission to the file.


Selfie as form of authentication for credit card transactions I read in a news snippet on various sites (cnn for one), that one of the large credit card companies wants to implement some sort of authentication whereby credit card transactions are authenticated bio -metrically with a selfie.

I would assume that since each selfie is unique, time-stamped and geo-tagged,  defeating this mechanism is fairly challenging.

What would the privacy issues (and concerns) be?

For many people, obtaining a selfie would be very easy. Using social media, many people upload tons of selfies of which if a criminal wanted, they would just download it. Editing a photo's time-stamp and geotag is very easy to do. This idea of using a selfie is absurd! If you want to be secure, combine it with other methods such as a secure password, pin, 2 factor authorization, and a series of questions which the user sets answer to at the time they setup their account.


File shares from a DMZ into an internal network We have a firewall policy that prohibits MS RPC through firewall, particularly from internet facing DMZ's back to the internal network. There is a business unit requesting an alternative method to transfer their files to the internal network to make files available to users on the internal network.

Anyone have any good ideas around this?  Systems like SFTP seem a bit cumbersome for this, so I'm looking for any alternative that would make life easy for the users and the system owners while still meeting the no RPC requirement.

What's wrong with SFTP? You can mount it as a drive if WinSCP isn't enough and they really must have it look like a Windows folder.


Is my ISP trying to impersonate google? Everything has been well for years and today I wake up with this:

A warning on EM Client (also got the same on my iPhone) that the certificate for googleapis.com isn't valid. And the certificate happens to be not to Google but to LiveBox emitted by Orange (respectively my box to connect to the net, emitted by my ISP!)

Is this a sign that my ISP is trying to act as proxy between me and Google and get access to unencrypted data on the way?

It is not unexpected for enterprise networks to run web security proxies that inspect encrypted traffic when given a reason to suspect something problematic.  This allows them to detect encrypted malware and prevent it from infecting you. (It also allows them to restrict other content, such as porn or some other policy enforcement that is not related to security.)

I haven't heard of this for consumer-grade networks though. This is very disappointing and I suggest either finding another provider or at least using a VPN to tunnel your traffic through another location that does not inspect your encrypted data in this manner.

If you don't get the error any more (as noted in the comments above), contact technical support and ask about it. Perhaps something (e.g. DNS) was merely misconfigured, or perhaps the threshold for a "reason to suspect" your traffic was too aggressive. If they're wise, they should apologize profusely and try to win back your trust.


A POWER7 processor on IBM i is currently vulnerable to Meltdowm or Spectre All the updates on available linux systems have already been made.

But I also have an IBM i (AS400) server, I have not heard in the news. But obviously it is more lucrative for news channels to inform about intel, amd or ARM. Since POWER processors are not that famous.

Is there a report confirming whether or not the processors are vulnerable?

Given that the PowerPC architecture does speculative execution and branch prediction too and has also multi-level caches I would expect that it is vulnerable to Spectre or similar timing based side channel attacks. As for the Meltdown attack I don't know since this attack needs some additional  "optimizations" in the processor design and therefore fewer architectures are affected.


New user auth to prevent man in the middle compromise On new account creation in client-server "zero knowledge encryption" schemes

Client requests a nonce by sending new username
Server sends client a random nonce if username is available.
Client generates new RSA key pair.
Client signs nonce with private key.
Client sends singed nonce AND public key AND clear text username.
Server verifies nonce using public key.

Does this preclude man in the middle attacks?

On the face of it the sever must trust everything send by the 'client' but only the originating client could have signed the nonce with it's own private key. So therefor the public key sent by the client can also be trusted?

Is this true?

What do you want to accomplish with this system? First, Attacker can generate its own pair of key. But why would attacker want to do that? In new account creation process, attacker would want to get the username AND password. Interrupting Server-Client communication by replacing Client's Public key with his is of no point.

Second, even if attacker simply listens to the traffic, it'll get the Client's public key. Now, next time Client sends anything to the server (maybe password?) by encrypting it with private key, attacker will be able to decrypt it with the public key.


Can I hide information from the device I use to encrypt it? Assume I have some Information (i.e. my choice during an election) I want my device to encrypt. At the same time i don't want my device to know the meaning of the information it decrypts.

Example: Before voting I get a ballot and a coding card that indicates which choice represents which candidate. Now the Device can not know which candidate I voted, even if it knows what I "crossed".

My Question: Are there more such methods to hide the Information from my device?

There are certain algorithms that allow you to do calculations on encrypted values. http://en.wikipedia.org/wiki/Homomorphic_encryption however the things are still slow and impractical.

What you can do in your example is create two 'machines'. When you insert a ballot in your apparatus, one machine independently counts votes (which hole you punched), the other independently keeps track of the randomizer on the ballot card. You can later then merge that data to count the vote in a third machine.

Machines here could be virtual or even separate scripts, depending on the degree of physical separation you need and how 'trusted' your code is. Independently the data sources do not mean anything to either machine, only when you put them together will it 'resolve'.


Does OAuth 2 increase the risk for clients to expose their "client_secret" Upon doing a bit of research about the OAuth protocol, I find it hard to avoid the glaring criticism of the OAuth 2 standard, and its supposedly inferior security.  An answer on stackoverflow suggests, as it outlines differences in the flow of each protocol

  OAuth 1.0 Flow

  Client application registers with provider, such as Twitter.
  Twitter provides client with a “consumer secret” unique to that application.
  Client app signs all OAuth requests to Twitter with its unique “consumer secret.”
  If any of the OAuth request is malformed, missing data, or signed improperly, the request will be rejected.

  OAuth 2.0 Flow

  Client application registers with provider, such as Twitter.
  Twitter provides client with a “client secret” unique to that application.
  Client application includes “client secret” with every request commonly as http header.
  If any of the OAuth request is malformed, missing data, or contains the wrong secret, the request will be rejected.

In my understanding, this would suggest that there is then an elevated risk for the client to accidentally leak their "client_secret", as it is repeatedly being sent over network.  Of course, at some level we have to assume that https is safe enough to transmit the secret, because this is how Google sends it to the client to begin with in the registration process.

Still, it does seem peculiar that a "secret", should be repeatedly sent over the network when both parties supposedly already know its value.  Is this not a quintessential use case for signing?

So my main question is, does the OAuth 2 standard increase the risk for the client to expose their secret key?

Bonus topics to touch on for the sake of intrigue:

Why have leading companies like Google seemingly all adopted OAuth 2 for services like Google Sign-in?

If the risk is elevated, what can/should the client do to protect them self and their users?

Let’s go over the “authorization code” flow and along the way I’ll clarify and address your points.

The OAuth2.0 standard has a few grant types but the most common I’ll go over is Authorization code flow.

Let’s say we have a webapp that wants access to a resource (say your google calendar). Our webapp requests access to your Google account by opening the browser to a google.com authorization page. You click allow which sends a redirect to your app in the browser URL, passing an authorization code.

The backend of our application takes that authorization code and along with the client_secret, and other params, requests an access token from the authorization server. This happens once!

Once our webapp receives the access token, our application can make api requests to the resource server as long as it’s valid.

To address your issue. No, it is more secure, because the client_secret is only sent over the network once, not every time. Once we have the access token, that is the only sensitive information that is being sent over the network. It also has a finite lifespan. This is why it’s more secure. The client_secret is sent by the confidential backend server and is not exposed to the browser further limiting risk of exposure.


Why would modern OS allocate static addresses or why is ASLR still needed? I have a question about ASLR which allocates randomized addresses for things. Based on my understanding (which might be wrong), a modern OS has pretty complicated memory management mechanisms and it seems REALLY challenging to allocate the same address for the same program every single time. In other words, by intuition, I feel like randomized address should be the default behavior, and to allocate static address would require some effort.

Is this understanding completely wrong? Or the OS allocates separate address space for each process so that in each address space the process always gets its comfortable static address by default?

Most modern systems have a Memory Management Unit, or MMU. The MMU is responsible for translating physical addresses to virtual addresses. This is used to give each process its own private virtual memory. One process' address X is not the same as another process' address X. This improves performance, security, and reduces the risk of crashes, but it also has the benefit of being usable to implement ASLR. While data may be placed in non-random addresses in physical memory, the system is free to place the data anywhere it wants in a process' virtual memory.
When a process is first created, the only real memory it has access to is the stack, which is limited and is not meant to be used for general purposes. Whenever a non-trivial amount of memory is required, the process needs to use the heap. The only way to do this is to request memory from the kernel via a system call. This system call is given a few arguments specifying the amount of memory it wants, the type of memory, etc. The call returns the base address of some freshly allocated memory of the size specified. One of the things ASLR does is cause this base address to be unpredictable. When ASLR is disabled, allocated memory is placed in predictable locations.
ASLR does more than just randomize the base of allocated memory. When a binary is executed, the dynamic linker connects it to all the shared libraries it needs. Although any given library is kept in only one place in physical memory, the system is able to translate it to a virtual address for each process that uses it. This address translation is done for efficiency reasons, but ASLR makes additional use of it by ensuring the virtual address is random. An executable specially compiled as a Position-Independent Executable (PIE) can call library functions even though the library's base address is randomized.
This is not all ASLR does, and certain security-focused operating systems (OpenBSD, HardenedBSD, Linux with grsecurity/PaX patches, etc.) use a form of ASLR that does even more.


wpa2-psk + wireless isolation = secure connection? from what I've read:

If I am on a wireless network without encryption, any other computer connected to that same network could easily (with right tools & knowledge) intercept any traffic I send/receive.

If I am on a wpa2-psk wireless network, the situation is better, but another computer connected to that same network could still (with right knowledge and tools, and capturing my initial 4-way handshake) intercept and decrypt any traffic I send/receive.

My question is:
does enabling "wireless isolation" option in the access point/wireless router change this state of things? does it stop someone to be able to sniff and decrypt my traffic?

[EDIT:]
This post clarifies how someone that is connected to a wpa2-psk network (and therefore knows the pre shared key) could sniff and decrypt traffic intended for another computer of the same network: Are WPA2 connections with a shared key secure?

Wireless isolation will stop wireless clients from being able to talk to each other.

It will NOT however stop someone from sniffing the traffic and possibly decrypting it.


How are tor hidden nodes/services found? Tor has "hidden services", which have an address like duskgytldkxiuqc6.onion.

Now I was wondering: how is this duskgytldkxiuqc6.onion name mapped to the real server?

I don't think there's a central server translating those addresses to a location/route as that would defeat the purpose. But what is it then? Broadcasts?

The best simple description of the process can be found in the Tor Project's documentation. Here are the 5 parts of the connection:

The hidden service, running on a server somewhere with a Tor client.
Introduction points, which are Tor relays chosen by the hidden service.
The database of hidden service descriptors (each descriptor consists of the public key and introduction points).
A Tor client trying to communicate with the hidden service.
A rendezvous point, a Tor relay chosen by the client.

The hidden service publishes its descriptor to the database (part of Tor's directory service) via its anonymized circuits which end at the introduction points. When a client wants to communicate, it gets the descriptor from the database, encrypts information about the rendezvous point with the service's public key, and passes it to the service via one of the introduction points. Then both the service and the client make a 3-hop Tor circuit to the rendezvous point and begin a fully encrypted, mutually anonymous conversation.

Any Tor relay can act as an introduction point or a rendezvous point without extra configuration; that's part of the function of a Tor relay.

References:

Hidden service protocol
Tor design paper, section 5
Tor rendezvous specification
Hidden service names demystified


Is it safe to use namebench? As the title states is Google's namebench utility safe to run on my Mac and let it use Safari's web history?

Namebench uses your cached browser info and there is an option to allow your anonymized results to be uploaded to Google, which you can turn off.

The bug tracker has no bugs related to malicious activity. The Python source code is available for everyone to inspect.

There is no reason to suspect this application of 'un-safe' activity.

What un-safe results do you wish to avoid?


How can a Software application defend against DoS or DDoS? Most of the solutions for DoS attacks are not at the application level. In case I am using a  proxy server, what are the possible countermeasures for DoS at the application level?

Fist of all, it is important to distinguish DoS, which stands for Denial of Service, and DDoS - Distributed Denial of Service. In most cases DoS is caused by software vulnerability, here comes patching and updates as a measure of attack prevention. DoS against service that is not vulnerable are not distributed attacks, they are ineffective and not used today. If to talk about DDoS, which I guess was the point of your question, then things come a bit complicated. IPTABLES in case of huge PPS usually does not help greatly - attack comes from different locations, like in case of zombie-machines. You just ban users, but there will appear new again and again.
What I can suggest:

configure server software so it handles connections in a more lightweight manner - deny long and heavy requests (e.g. MaxKeepAliveRequests in Apache);
configure your OS - IP stack tuning (e.g. sysctl in FreeBSD);
close unused ports, remove unused services;
mod_evasive - Apache module against attacks;
set up a lightweight server as front-end - Nginx, for example.

This is a long topic to discuss, I would recommend not to stop within these recommendations but google on them for more precise information.


"Digital" signatures on real life objects Although this question may be out of scope, I'm wondering if there's a reliable way to apply a "digital signature" to real life objects in order to prove your ownership of them to a degree.

As an example, let's assume I bought my own office chair for the workplace, and it may be physically indistinguishable from the others. I'd like to print a "tag" or "signature" and stick it to a hidden spot on the chair. If the situation ever arises that I have to provide some sort of proof that the chair is my own, what should that tag contain? Is my name or a random word sequence good enough? Or could I make it more sound by leveraging asymmetric cryptography somehow?

You are not actually asking to apply a signature to a real life object but you are only asking how to create a signature which can be associated with you and with nobody else. What then happens with this signature is another thing: you can attach it to the object you own or you can attach it to an object you don't actually own. Others can remove the signature, copy the signature, put it somewhere else or destroy it. Thus the actual use of such a digital signature in real life is limited.

Still, you can create such a signature if you have a digital identity based in public key cryptography and where the identity is accepted by others. This can for example be a smartcard, a PGP key, an S/MIME certificate etc. All these allow you to sign something and that's actually all you need: for example you can sign a description of the item with it.

But again, real ownership cannot be proven this way. It would be different though if the items you want to mark already have a unique identification, like a serial number you can find in car chassis or bike frames. In this case the act of ownership transfer could be digitally signed, i.e. the vendor digitally signs a contract which transfers ownership to you and if you give the item away you also sign such a contract for ownership transfer. This way nobody can just claim something as its own but must actually prove how they got it by showing the contract. In reality this gets way more complex than that but this is the basic idea.


Bad things about no SSL encryption? So I was reading some comments on a popular forum about SSL encryption and how some websites pass their login form data as plaintext and don't use SSL or TLS. I understand that using an encryption method allows data to pass to the server securely and stops a 3rd party from eavesdropping, and then allows decryption on the server-side.

But lets say there isn't a 3rd party sniffing the packets - is there any benefits to using SSL in that case? Or is SSL's sole purpose to encrypt packets to stop sniffers?

Thanks in advance.

Well, yes, if you live in the Care Bears Wonderland then nothing bad can happen. Unfortunately, in what is colloquially and pompously known as the Real World™, there are Bad People. Evildoers. Wicked individuals who like to spy and eavesdrop and alter the nice data packets.

SSL (now known as TLS) applies encryption to prevent spying, integrity checks to reliably detect alterations, and authentication to prevent impersonation. The encryption part is only against spying.

If all your data is public, then you don't really need encryption, but you may still want the other characteristics of SSL, so that users know that they are connecting to the genuine site, and that the pages and documents they obtain from the site have not been altered in transit.


Is it reasonable to block Cookies company-wide? In our company we are using a tool for saving user profile data (like desktop settings, internet settings, cookies, etc.) into a database. During the annual cleanup of this database I discovered that lots of users have cookies, which are older than two years.

This leads me to the question: is it reasonable to block Cookies completely company-wide?

Do some security issues exists that support this idea, i.e. pros?

Or is this just a bad idea, e.g. in terms of user-comfort?

You can use black lists of tracker or advertisement websites (from ad-block software) to filter cookies that you can safely remove. You should leave legitimate cookies because you should not hinder your users in their work without a really good reason.

However, you can change default settings in the browsers to keep cookies until the browsers are closed. This will allow users to change the setting on the website that matters. You should document this change of policy and communicate it to your users before applying it.


COMMUNITY SIP TCP/IP message flooding directed to SIP proxy I have installed Snort IDS and most alarm is:

"COMMUNITY SIP TCP/IP message flooding directed to SIP proxy"

And i use home DSL Internet connection , should i be worried about this alarm ?

I have read this article but i couldn't understand it completely?

I set firewall on my router and I've block WAN to LAN connections, how these kind of packet pass it inside ?!!

Is it possible that you are using an old snort version?
Please see here: http://ubuntuforums.org/archive/index.php/t-1469108.html

Otherwise it would be great if you refine your question with some Firewallrules (Inbound) or some PCAP Files from wireshark.


Blackberry + RIM Bluetooth-based Smart Card Reader Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it?

Can you tell me if it's possible to require only the presence of the card + card reader, but no password? All of our devices have a local password already.  Is the challenge password something you know or is it based on the LCD screen?

The benefits (as I understand it) was that the Bluetooth connected device (PC, Blackberry) would lock immediately as soon as the RSA token was out of range.

Wow.  Cool Reader!!  I wish I could say I'd tried it, it's very enticing.

From a solid understanding of SmartCards, though, I don't think you are going to get away without entering the password.  The password is protecting the keys on the Smart Card, not the usage of the device.  These keys need to be protected from use on your device, or any other device - so the lock on your device isn't going to help with the security of the Smart Card.  Given how this is written, I expect the password to be a string of characters (upper, lower, number and non-alpha numeric) that can be set at the time of card issuance.

There would be the question of whether you could get an API for your phone to the reader, so that the phone could store the Smart Card password locally - but this becomes a security nightmare quite quickly, as secure storage on a smart phone will be difficult and the ease with which a smart phone can be lost makes storing a password there quite problematic.


URL rewrite spoofable I am considering using URL rewrites in kubernetes nginx proxy to publish selected context paths in microservices which are run in a cluster running internal services. For example

https://public.mycompany.com/microserviceone/api/v4/resource1

would be rewritten and routed to

http://microserviceone/public/api/v4/resource1

inside the k8s cluster. Webservices are generally REST based accepting get requests and post with application/json payloads.

This is the hypothetical ingress configuration in this case:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: microserviceone-public-ingress
  namespace: default
  labels:
    app: microserviceone
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /public/
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  rules:
    - host: public.mycompany.com
      http:
        paths:
          - path: /microserviceone
            backend:
              serviceName: microserviceone-service
              servicePort: 80
  tls:
    - hosts:
        - public.mycompany.com
      secretName: microserviceone-cert

My question is this: Assuming that all resources within the /public/ URL context on a service are secure using appropriate methods such as certificates, API tokens or user authentication tokens, is there a known way for an attacker to circumvent the URL rewrite and request resources outside the /public/ context path?

It is not possible to give a definite answer, because you are telling us how things should work, not the actual implementation. As a result, people can only make wild guesses. It would be very unethical for a professional to make any kind of statement about the security of the system in such a case. It would be akin to a doctor making a diagnosis, based on a phone call with a patient, who claimed that sometimes their joints hurt a bit.

The best way to get some more practical results is to conduct a professional penetration test. This may or may not be within your budget, but you can always contact a pentesting company near you and ask for an estimate. Depending on the size of your application and some other details, such a test could cost you several thousand dollars.

If this is out of your reach budget-wise, then an automated vulnerability scanner may be worth a try. Most well-developed vulnerability scanners come with a free trial, but be sure to adhere to the license requirements (especially in regards to commercial use, should that apply to you). Keep in mind that automated scanners will give automated results, so please don't equate "The scanner did not find anything" with "No vulnerabilities exist".

You might ask which pentesting companies or vulnerability scanners I would recommend, but such recommendations are off-topic.


Does this method of password confirmation risk encrypted file integrity? I'm trying to make a basic encryption/decryption script for personal use, and it works perfectly fine. I'm posting this in the infosec section because my question revolves around how easy it is to break the encryption.

NOTE: I know little about cryptology, hence the simplistic question.

Here is a quick mock-up of my code:

from Crypto.Cipher import AES
import hashlib
from random import randint
import struct
from getpass import getpass
import os

infile = sys.argv[1]
password = hashlib.sha256(getpass('[*] Enter Password: ')).digest()
ivector = ''.join(chr(randint(0, 0xFF)) for i in range(16))

encryptor = AES.new(password, AES.MODE_CBC, ivector)

with open(infile, 'rb') as infile:
    to_encrypt = infile.read()

to_encrypt += 'password_is_correct'
while len(to_encrypt)%16 != 0:
    to_encrypt += ' ' #Pad file to a multiple of 16 for encryption

encrypted = encryptor.encrypt(to_encrypt)
size = os.path.getsize(infile)
with open(infile, 'wb') as outfile:
    outfile.write(struct.pack(size, '<Q'))
    outfile.write(ivector)
    outfile.write(encrypted)

print '[*] Encryption Completed!'

To summarize. This code will encrypt a file with a random initialization vector and a password given by the user. It will read the file to encrypt and will append the string "password_is_correct" to the end of the string. Upon decryption, the initialization vector will be read from the file, and a password will be taken from the user. If the password is correct, then the string "password_is_correct" should be in the decrypted string. Is this a valid method a password verification? Does this pose any sort of risk to file integrity as to easing the file cracking process?

The full code can be found here.

Yes, this is a valid method of password verification.

A disadvantage is that an attacker now knows that the plaintext "password_is_correct" corresponds to the last block in the ciphertext. Fortunately, AES is not vulnerable for known-plaintext attacks.

PGP also checks the decrypted data, but it uses properties of a random block instead of a fixed string. Another way that is often used incorrectly is to verify the padding of the message. This can make a padding oracle attack possible, although this does not apply to your situation.

Another typical way is to store a hash of the key in the message, so that the password can be verified before decrypting the message.

There are some other things that can be improved with your script:

Use SystemRandom to get the IV, as normal random is not cryptographically secure.
Use a real key derivation function such as PBKDF2 instead of SHA256 to derive the encryption key from the password.
Store a HMAC of the encrypted text and verify it before encryption. CBC is vulnerable to a bit-flipping attack.
You may want to also encrypt the filesize field.


HMAC Based Request Signing - Storing the Salt I'm working on a (non high security) project that currently isn't live but might go live at some point.

We have a REST API (implemented using Restlet and Neo4j) running on a server and an Android client app.

To keep things stateless, we need to send auth information together with each request. We decided to use a MAC-based approach: We sign a set of header values as well as the entity body of each HTTP request using the HMAC-SHA256 algorithm. We then put that hash together with the username in the Authorization header of the request.

For the HMAC secret, we use a password that is chosen by the user. To make things more secure, we hash the password before using it and storing it in the client.

Of course, in order for the server to be able to validate the HMAC-SHA256 header, we need to transmit the secret once. But as this only happens a single time, it's not that much of a security risk.

The problem with this setup is the secure storage of the user passwords. I know that passwords should never be hashed without using a salt to prevent rainbow table attacks. But when I generate a secure/random salt, a client that logs a user in for the first time has no way to get access to that salt in order to generate the correct hash.

What would be the best decision in this case? Should I simply store the passwords using a "conventional" hashing algorithm like SHA256 without using a salt? I guess that would be very negligent. I could also use a more secure algorithm like bcrypt or PBKDF2 with a "dummy salt" like the username a MD5 hash of the username and a higher iteration count. Even though the salt is known, it would be very slow and painful to generate rainbow tables.

Would bcrypt with a "security-by-obscurity" salt be secure enough? Or is the entire setup insecure and should be exchanged with another authentication method?

The most important thing you should be doing is: use SSL.  Use HTTPS, not HTTP.

Justification:

If you use SSL, your approach is reasonable.

Tactical detail: I suggest using PBKDF2 with a large iteration count to generate the HMAC key from the password.  You can use a fixed value (or a hash of the username) as the salt.
This will admittedly have some weaknesses: since you store a hash of the password on the client device, someone who gains access to the mobile device can use dictionary attacks to try to recover the password, and they might or might not be successful, depending upon how strong the password is.  Also, anyone who gains access to the mobile device can learn the crypto key, which is all that is needed to submit authenticated HTTP requests.  In many settings, this weakness might be an acceptable risk.

If you don't use SSL, your scheme will probably have major security problems.  Anyone who can sniff the wire will be able to learn a hash of the password, and if the password is not strong, they may be able to recover the user's password using dictionary search.

If you want even better security, then here is a slightly stronger approach:

Use SSL throughout.  Don't mess around with unencrypted HTTP; use HTTPS for everything.
Use a full-strength crypto key. Have the server generate a full-strength 128-bit cryptographically-random crypto key for use with HMAC.  The server can store this key.

The first time the client connects, it will need to learn this crypto key.  To do that, have a special request where the client supplies its username and password, and receives the crypto key in response if the password is correct.  (The server can rate-limit these requests, to deter dictionary attacks.)  When the client receives the crypto key, it stores it locally.
For every subsequent request, the client can look up its locally-stored copy of the crypto key and use that to compute the HMAC.
If the user logs onto the web site from a new device, no problem, that device just goes through the initialization step mentioned above to retrieve the crypto key, then everything continues to work.

This avoids the need to store the user's password or a hash of the user's password on the end device.  It also prevents dictionary-search attacks against the crypto key; since the crypto key is a fully-random value that's chosen randomly independent of the password, off-line dictionary search attacks against the password are not going to be successful at retrieving the key.  However, it does retain the weakness that if a bad guy gets their hands on the client device, they will be able to learn the crypto key and thus issue forged requests.  I suspect that's about as good as you can do, given your goals.


Allow visiting website B only if you visited website A first Having two websites: A and B. I want that the users that open website B to get redirected to another website (e.g. http://example.com) if they didn't visit the website A.

To do this I tried to set a cookie on website B (by just loading a page on website A, setting the cookie). When opening the website B I check for that cookie.

This works nice, except on Safari. Safari blocks setting the cookie on website B. I searched a lot and found out that Safari blocks the third-party cookies by default.

Another solution to the problem could be using the Referer header (when clicking a link on website A the referer will be sent to website B)–this fails for the users that don't want to get tracked and they disabled the referer header.

Is there a simple solution to this problem, without having a database where we store the ips or something similar?

I feel like this is a classical problem that should have a classical solution, but I couldn't find any.

The question is: how can I know if the user that opens website B navigated first to website A?

The navigation from website A to B can be done using a link/button.

You can use some authentication scheme, where clicking that button will make server generate the token that is signed or maced and make the second server trust that. Then you can pass that as a parameter in the URL, but this scheme will allow anyone who gets the token to use that (I am not sure if you are doing that for security or as a some UI feature).

Another simple solution if your users are authenticated is just add a database entry after the first logon to the site A and then read it on the second site.


how we know whether our computers are part of a botnet? When we visit websites, unknowingly our computers can be a victims of a botnet. There should be a way to identify whether we are victims or not. What is the way to identify it and how to recover from it?

You can detect if your clients have been become a part of a botnet in three ways.

Detect the botnet code using anti-virus software on clients.
Detect the traffic from the client to the command-and-control server using an IDS sensor.
Additionally, you can also detect if your client download malicious software containing botnet code using a web proxy. Here you also should block such download attempts - so this does not really answer your question.

But back to your question on how to detect if your clients already are part of a botnet.
The most effective way (in my opinion), is to detect communication between botnet clients and botnet servers by installing an Intrusion Detection System (IDS) sensor in your network.

You configure this IDS sensor with a list of known C&C traffic, and traffic patterns that indicate that there is a botnet client.

When the IDS see traffic to the C&C servers, it can be configured to warn you about such traffic.

A common used IDS product is snort, and a common used ruleset for detecting C&C traffic is emerging-botcc.rules


GPG Different Passphrase for Subkey Is it possible to have a different passphrase for a GPG subkey?

The reason is that I'm using duplicity to back up my files, and it needs the key passphrase to sign the files.

Since I want run duplicity automatically, I would have to store the passphrase in an environment variable. I don't feel comfortable storing my main key's passphrase in an environment variable, so I'm wondering if I could have a different passphrase for the subkey that does the signing.

My recommendation is to use a completely separate key.  Because you're signing backups, only you need to trust the separate key, so there's not a web of trust issue here.  You can even sign it with your main key, if you like.

A second option is to load a gpg-agent and load the key.  You'll need to set max-cache-ttl=-1 and default-cache-ttl=-1 to allow it to keep the key indefinitely.  You'll still need to type in the passphrase once per boot.  (I haven't tested the -1 options, that's based on reading the code that -1 is infinite.)

If you don't want to do that, you could copy your GNUPGHOME (~/.gnupg, typically), delete the other subkeys, and change the passphrase on the key.  Then have duplicity use this subkey-only installation with the new passphrase.  (Just set the GNUPGHOME environment variable to work with the different home directory.)


If A Password Is Unique, Does It Really Matter How "Strong" It Is? People seemed to find this "If a Password is Super-Strong Does it Matter if It's Unique" question very interesting, but it actually reminded me that the converse question is interesting, too: If you use a genuinely unique password for an online account, does the "strength" (ie. the complexity & randomness) of the password actually matter that much?

So very, very, very much advice--and for employees with "security-conscious" employers, mandatory rules--has been issued to users about the need to create "strong" passwords and how to do so.  But this advice and those rules often don't take into account how and where passwords are actually used. Specifically, they completely ignore the effect on password security of the lockout & throttling mechanisms that are used by on online services, remote servers at work, and well, pretty much everywhere any responsibly-managed password and PIN authentication systems.

Let's think about a slightly-extreme scenario:

I'm setting a new password for an online account at some unnamed major U.S. bank.  To create that password I decide I want to be lazy, but I also don't want to pick something that's identical (or anything close to it) to any other password I use and not idiotically common or easy to guess. So, I fire up my web browser, grab a (puesdo)randomly-selected English word from here, let's say tack on a randomly-selected digit from here, and...

direful4

Let's assume that direful4 is completely unique and unrelated to any other password I have ever used or will ever used.  Let's also assume that no attacker had any information about the password and how it was chosen. (And let's also assume that today my bank would even allow me to set such a "weak" password to begin with.)

So, keeping in mind the limitations that any decent failed log-in lockout or throttling mechanism is going to place on an attacker's speed at brute-forcing cracking on the bank's site, is using direful4 for your bank password really significantly less secure than using, say, Kt3w54EIsq%OinCs8@f? If so, how so?

(Tip of the cap to an excellent paper from a couple of Microsoft researchers I read a few years ago that really got me thinking about this: "Do 'Strong' Web Passwords Actually Accomplish Anything??")

Yes, it's less secure. Because if a hacker gets hold of a copy of the bank's user database, including the hashed passwords, then they are no longer limited by the throttling or lockout on the web interface and can run a full-speed brute-force attack against the hashes. If the bank uses an efficient hashing algorithm (which they obviously shouldn't, but banks do not in fact all have perfect security) then an attacker might be able to make a billion attempts per second. At that speed, they can enumerate every eight-letter password containing a mixture of digits, upper-case and lower-case letters in two and a half days.


Nmap scanning single port too fast? Shows as filtered? I ran into an issue when trying to scan a single port on a single machine. I ran a range scan to find machines with port 25 open. Then I just arbitrarily chose one to work on. I scan that machine with port 25, and suddenly it is showing filtered instead of open.

I start tinkering to see if I can try to troubleshoot this problem. First I try running the same scan again to see if maybe I got the wrong IP. Same list, but I chose the next result. Try the new IP with port 25, shows filtered.

Now I'm trying to figure out how I can get it to show open on that one IP. I scan the same single IP with no specified port, and port 25, along with others show as open. Scan the same IP with just port 25, and it says filtered. I add one more port from the previous scan, and port 25 and the other port show as open.

It confuses me why running nmap -p 25 [IP] gives me 25/tcp filtered smtp yet running the same command with at least two ports gets me a positive result.

Am I missing something? Can someone explain what I'm doing wrong?

I did write in the title that maybe the scan was too fast, because I had already tried the -T flag.

The commands that I used in the process of troubleshooting and their result:

nmap 10.11.1.227
...
PORT     STATE SERVICE
21/tcp   open  ftp
25/tcp   open  smtp
80/tcp   open  http
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
443/tcp  open  https
445/tcp  open  microsoft-ds
1025/tcp open  NFS-or-IIS
1026/tcp open  LSA-or-nterm
1028/tcp open  unknown
3372/tcp open  msdtc
5800/tcp open  vnc-http
5900/tcp open  vnc

I tried one port with scripts (which failed, so I tried one port no scripts):

nmap -p 25 10.11.1.227
...
PORT   STATE    SERVICE
25/tcp filtered smtp

I tried two ports that I know are open:

nmap -p 25,5900 10.11.1.227
...
PORT     STATE SERVICE
25/tcp   open  smtp
5900/tcp open  vnc

At that point I think about whether probing one port is too fast and decide to try -T4, then -T3, and then finally:

nmap -p 25 -T2 10.11.1.227

Gives me a positive result. So problem fixed right? Not in my head. I want to know if I'm doing something wrong, or if this is unavoidable, and I just have to accept the solution as is. And if that is the case, and someone knows why, I would also like to know why that is the case.

It does indeed seem like a timing issue. nmap might be timing out on the single scan and reporting the results as filtered. With the other ports or systems included in the scan, the timeout might be different.

To find out what is going on, you will have to run a packet capture. Wireshark is the de facto tool for this. Run nmap -p 25 10.11.1.227 and capture the results, then run nmap -p 25,5900 10.11.1.227 and capture the results. Compare the differences. Chances are that the differences are obvious.

In general, when things like this happen, always go to the packet traces to see what's going on. You will learn a lot.


Does turning off my modem before leaving home significantly improve security? Like many, most of my time is spent away from home: at work, the gym, out socializing, etc. I'd estimate I use my internet a few hours a night.

I never turn my modem off unless I travel for longer than a few days, and I have not disabled SSID broadcasting, as I've read that doing so has little to no security benefits.

But if my modem (and wi-fi) is off while I'm away, that would seem to nullify any security risks that do not include someone illegally accessing my physical devices, however minimal.

Are there any significant benefits to turning off your modem before leaving home, or would doing so be practically useless to protect against threats?

Generally speaking, a vulnerable device/network doesn't become less vulnerable if it is turned off some of the time. Or if you have infected devices on the network, this won't make them any less infected.

However, it may reduce the probability of your router or any exposed service from becoming infected any given day. I guess you could also argue that an already infected device will do less damage to others if it is powered off. But really, there are botnets and others constantly scanning the internet for potentially vulnerable devices, so if your device is vulnerable, it's only a matter of time before it is compromised.

Instead, I'd focus on decreasing your attack surface and fixing weaknesses. Make sure your modem/router is up-to-date, and the same for other devices you have exposed to the internet.


MITM faking certificates I am looking at the theory behind MITM attacks in order to see some unencrypted packets from the 3DS. From research here is what I understand so far:

3DS > Proxy > Nintendo server

I am going to try and force the 3DS to use a forged certificate. The 3DS will then communicate with the proxy and the proxy will decrypt the packets, see whats there, re-encrypt them and then send it out to the Nintendo server. I see an issue though, the Nintendo server is expecting to see the original 3DS public certificate from the proxy server but it wont as I do not have it. Is it possible for me to get the original certificate from the 3DS before giving it the forged one?

Here is my idea:

start send packets from 3ds, original cert is sent from 3ds to proxy, which is stored
insert forged cert to 3ds
connection is reset

using forged cert, start communication, fake cert speaks with proxy server
proxy decrypts packets from 3ds, logs them, re-encrypts them
uses the old certificate to communicate with the Nintendo server then forward packets

Is this feasible. Is there an easier way? I know some of them are hard (insert forged cert to 3DS). Which tools can help me accomplish this?

This may or may not even be possible depending on what checks Nintendo does.  If Nintendo only trusts their own certificate, signed by them, then you will be unable to make a key pair for the proxy that your DS will trust.

Normal SSL/TLS MITM proxies require that the client trust the certificate used by the proxy as a root cert, that way the proxy can make "valid" certificates on the fly.  If you can't push that trust and the client actually checks trust, then your proxy will fail to be accepted as the server and the communication will not occur.


Where's the security when a payment gateway let website handle Credit Card detail Has anyone worked with eWay payment gateway before?

Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends those detail to the server.

Now, how's that security of anykind? (Please note I'm no security expert. Just a developer) The weakest link of online payment, AFAIK, has always been the consuming party of the service, ie the eCommerce websites themself.

If I were the user, I expect my CC detail to be only handled by the payment gateway, not the web applicatiion. Wasn't that the whole point of a payment gateway? To abstract the security concern from the web application?

Agreed, from disclosure of information point of view fewer parties in the transaction process the better.

Specifically to eWAY (with I have not used) I assume you are referring to the Hosted Payment solution (See http://www.eway.com.au/Developer/eway-api/hosted-payment-solution.aspx) where a web service is exposed. eWAY do offer alternatives such as the Shared Payment (See http://www.eway.com.au/Developer/eway-api/shared-payment-solution.aspx) which is the redirect to the payment gateway solution but this may not be available in your specific location.

In the case where you are taking payment details you would need to be PCI-DSS (or equivalent) compliant in addition to the payment gateway. Also you should avoid storing any payment details that could be harvested by an attacker.

From a user’s point of view my personal opinion is they would be more cautious being redirected to a payment gateway that they don’t know then using the payment off the web site. Just something to consider.

In my mind, I would use a payment gateway that handled all the payment details for the purpose of offloading risk.

I hope that helps.


How to set up TLS without a certificate authority on a site for internal use I wish to set up SSL/TLS for my site. How can I do this on my own without using a certificate authority.
The site will be accessed only via certain machines so I can easily install the public certificates on their browsers.

If you can arrange for the correct certificates to be reliably recognized by clients, then all you need is to produce your own certificate "by yourself", traditionally as a self-signed certificate. Tutorials are easily found for that, e.g. with Linux tools or Windows IIS.

You might also want to run your own CA (e.g. with this software), and install the CA certificate in the client browsers -- this is extra initial complexity, but will make things simpler if you need to change some certificates later on (e.g. if the previously installed certificates expire).


RRD Performance reporting with GSA/OpenVAS I'm running Greenbone Security Assistant 7.0.2 (on Kali Linux) and the default performance reporting currently goes a "Fallback Report" which only dumps /proc/meminfo to the screen. A note on the page implies that there's more rich reporting but I haven't been able to find anything documented for setting up or enabling it. I'm assuming it's more or less standard RRD reporting. Anyone know how to configure this?

Quoting the relevant part of the source code documentation:

Prerequisites for generating system reports:

A program in the PATH, with usage "openvasmr seconds type", where
seconds is the number of seconds before now that the report covers,
and type is the type of report.  When called with type "titles" the
script must print a list of possible types, where the name of the
type is everything up to the first space and everything else is a
title for the report.  When called with one of these types openvasmr
must print a PNG in base64 encoding.  When called with the special
type "blank", openvasmr must print a PNG in base64 for the Manager to
use when a request for one of the titled types fails.  openvasmr may
indicate failure by simply refraining from printing.

Disclaimer: Answer of a NVT Dev @ Greenbone


Brute force password cracking with a GPU How are GPU's provisioned for password cracking? Do all, if not most cracking programs have special GPU aware software or do they just function at the basic driver or API level of the device?

Can it be as simple as plugging in a video card  and installing a driver?

Also, I have access to a lot of processing power from ASICs chips(+10 TeraHash/s) from bitcoin miners. I know they can only calculate based off of sha256, but can those chips ever be easily converted for cracking? If so, I would imagine the bitcoin gold rush of our era has made anything with sha256 obsolete.

This question might be too simple that its considered common sense and there isn't much documentation on it. Either way, I'm over thinking it.

How are GPU's provisioned for password cracking? Do all, if not most cracking programs have special GPU aware software or do they just function at the basic driver or API level of the device?
Can it be as simple as plugging in a video card and installing a driver?

No, it is definitely not that simple. The password cracking application has to be written with GPU support in mind, either using CUDA (if you are using an Nvidia card), or OpenCL.
However, many of the popular password cracking applications has already done this. For example, John the Ripper has GPU support. Another popular password cracking application known for GPU support is oclHashcat.

Also, I have access to a lot of processing power from ASICs chips(+10 TeraHash/s) from bitcoin miners. I know they can only calculate based off of sha256, but can those chips ever be easily converted for cracking? If so, I would imagine the bitcoin gold rush of our era has made anything with sha256 obsolete.

For this particular question, I will refer you to an answer on our sister Bitcoin site.


Algorithm to Transaction Data Signing Transaction Data Signing

I need an idea to develop a very secure algorithm to authenticate online operations using PHP in the server and an Android app in the user's device.

What is the idea?

The user try to login in the system. The server sends a confirmation request to user's device (Android).

The user sees the date, country, city, IP, browser and OS in the app, all about the login try, and if all this informations match, he can clicks on confirm. The app will generate an 8 decimal digit token based in this informations and send it to server, the server will try to generate a token with the same informations and if both tokens match, the server accept the login try.

This is just one possible operation.

What do I need?

An universal algorithm to authenticate any online operation.

e.g.:

function generateRandonTokenUsingNParameters(){
    $args = func_num_args();
    $token = ""; //Start token

    for($i=0; $i < $args; $i++){
        $token = CRAZY_MATH_USING_ALL_PARAMETERS_TO_GENERATE_8_DIGITS_TOKEN($token, func_get_arg($i));
    }

    return $token; //Final token based in all informations of the operation

}

//e.g.
//LOGIN INFORMATION
$date = "2014-05-30 01:02:00"
$ip = "192.168.0.1";
$browser = "Chrome";
$city = "Los Angeles";
$country = "USA";
$os = "Windows";
$android_app_local_seed = "698dc19d489c4e4db73e28a713eab07b"; //each user have a different seed in his app

//PRINTING LOGIN TOKEN
echo generateRandonTokenUsingNParameters($date, $ip, $browser, $city, $country, $os, $android_app_local_seed);

What would you use in the CRAZY_MATH_USING_ALL_PARAMETERS_TO_GENERATE_8_DIGITS_TOKEN() function?

P.S.: I need an 8 decimal digit numeric token.
Because if the user does not have internet connection, he can read the operation's details using QR Code and he will need insert the token in the system manually.

Stringify the sent information in a standard way, take the SHA256 hash, sign it with the private half of the key-pair that is genned for the handset when the application is installed (the public half is sent to the server at enrollment time).

Most importantly, HMAC is easy to do wrong because it is crypto and crypto is really hard to do right (even Ron Rivest -- the R in RSA, and possibly one of the top expert in crypto -- can come up with something like RC4 which has some protocol-level weaknesses_. DO NOT ROLL YOUR OWN CRYPTO. I would bet money you will not do it correctly. Instead, use existing algorithms, existing methodologies, existing libraries. HMAC using SHA256+ECDSA is well understood and has been tested. If you go with EC crypto for your public-private key-pair-generation and signing, use a curve that is well known, such as the NIST curves, since they have the most scrutiny and have highly funded cryptanalytic research by the federal government.


Is it safe to open "suspect" pdf files in virtual machine? I became aware recently that Javascript scripts can be embedded in PDF files.

Anyway, I have a pdf file which I suspect is not safe to open. I scanned it with VirusTotal and Kaspersky VirusDesk and they found no threats, however they informed me that the file contains Javascript indeed (some kind of automated script on opening) and the possible threats these scripts can contain.

I was wondering what is my safest option, I thought about opening the PDF in a dedicated virtual machine, say Ubuntu. Is this indeed the safest option I have? (Assume I need to open the PDF file).

As a sidenote, should I be so worried of PDF files?

Short of setting up a dedicated (physical) machine just for potential malware, a dedicated virtual machine is pretty much your safest option. It's how the professionals do it.

Make sure your virtualization program (e.g. VirtualBox, VMware) is up to date. Malware could potentially escape a virtual machine, but such vulnerabilities tend to be fixed in updates very quickly.

  As a sidenote, should I be so worried of PDF files?

As with many other things: it depends. Do you know the source of the PDF? Is that source trustworthy? If the answer is "yes" to both of those questions, there is little reason to worry. If the answer is "no", then you might want to proceed with caution.

However, even if the PDF contains malicious code, you are generally only at risk if you open it with a viewer that contains some vulnerability, allowing the code to "escape" the viewer. This is analogous to a program escaping a VM, or JavaScript escaping the sandbox of your browser.

In short: use an up-to-date viewer, and you're probably fine. Still worried? Check it out in an up-to-date VM.


Efficiency of end-user training I have read a lot on the topic of enforcing end-user security training, such as how to spot a phishing email for example. Even enforced training, such as conferences or videos that the end-user must watch can easily be neglected or not cared for by the end-user.

I keep hearing the use of "consequences" of not taking the training seriously, but I feel as though that is not the best course of action. My question here would be, what are your suggestions to improve the effectiveness of the training and keeping the audience (the end-user) with a true willingness to pay full attention to the training?

I do this very successfully using 2 methods:

Mix training with small 'escapes', moments that attract attention with a joke or something unrelated to the main (probably boring for them) subject. This is like hitting their refresh button.
Be interactive. Do not present your case like an advocate in a court of law. Ask them what they think, make them state their opinions on the matter and interactively explain why certain things have to be done in a certain manner.

As an intro on-top of those, you can use the Fear against them. Start your presentation by giving a disaster situation example (i.e. Dude 1 clicked on a phishing file and cause the company that many k/M$ in damage and he got fired).


GSM - Implementing Cipher Mode Command on YateBTS I've been studying on Yate & YateBTS source code for a while, and I was wondering why there is no ciphering mode implementation in the source!?

I use the combination of BladeRF x40 FPGA and YateBTS package to simulate a private BTS and have a private GSM network in a small area, but all packets are transferred in clear text and can be captured and sniffed by Wireshark!

Is there anybody released a patch for YateBTS to enable Ciphering Mode Command? I need my connection ciphered by A5/2 algorithm. It takes a lot of time and effort to do it by my own! Have anyone patched the source to make ciphering command mode work?

EDIT:
We need to send Ciphering Mode Command message (RR) from BTS to MS to make ciphering enabled.

The YateBTS Wiki states the MBTS software supports Ciphering for A5/1 and A5/3 in the air interface, though not the A5/2 you have mentioned, perhaps this implimentaion would suit your needs?

MBTS features


Why would taking my laptop home be encouraged for security reasons? My company's infosec policy contains a statement to the effect that I am encouraged to bring my laptop home with me to that it never leaves my possession/control.

This doesn't seem useful, from a security perspective (I can't think of any pros, other than being able to say that it decreases the average distance between me and my laptop...), and has definite cons:

The company has no knowledge of or control over the physical security of my home
There's no guarantee that when I go home, I keep my laptop with me (I could leave it in the car, or leave it at home while I went somewhere else)
Many (most?) employees use public transit to get to and from work, introducing lots of potential places where theft could occur

Is there anything to this that I'm missing, or is this just bad security practice?

So here's the TL;DR:

It's easier for you to maintain a watchful eye on the laptop than it is an empty desk other people can access in a large area to either infect it, or walk away with it

It's basically the same reason you don't leave your laptop in a public place:

  You don't know who has access to your laptop.

By bringing it home you've guaranteed you know who had access to the laptop. That's a big improvement when it gets compromised. Think of the conversation that would be had:

  "What happened during the time your laptop was compromised?"
  'I left it unattended on my desk overnight and possible thousand of people could have touched it.'

Or

  "What happened during the time your laptop was compromised?"
  'I watched a video on Youtube with it and it started acting funny'

The top situation is a 'I left it unattended' and the bottom is a 'We have a direct vector to investigate first as it was being used at the time of infection'. I know I'd always would rather deal with the second situation than the first if I were your IT department. Especially for the following reasons:

It was monitored
Anyone who could have had access to it must have had personal access to you and where you were
Your group of friends who would have access to it would be much smaller than a company(basically anyone who asked, and you'd remember them)

Those three reasons alone are a huge consideration besides the theft deterrent of an unattended laptop and why many companies decide to adopt similar practices.


Can a physican website be on a non-HIPAA server? I'm starting my first website for a doctor's office and I'm wondering if the website needs to be on a HIPAA compliant server, even if no patient health information is collected or stored on the server? There would be no storing or even collecting of any patient health information.

An ordinary website, such as one advertising office hours, contact information and related media should be fine, so long as it is completely separate from the HIPAA-compliant network & systems that serve the doctor's office.

This also means that you cannot use this webserver for any remote-access services (ie: VPN portal), regardless of the fact that the webserver itself will not be "storing" any PII.


What path (programming language, courses) should I take inorder to become a network/ security developer. (Not network configuration)? I would want to work in network and network security field as a developer(programmer),developing network products(not network/network product configuration) ultimately to get into network security product development and research. I am going to pursue masters in CS specialising in Network/Security

Note : If this is opinion based, i would like to know different opinions. Answers from different perspective wont harm.

There's no straight way to develop a product. It is non-trivial thing. I'd start from the top with the learning of the networking which is basically switching, routing, load-balancing, proxying, fail-overing, firewalling (so that would be Computer Network Course), and then I'd proceed to enterprise grade programming language which aids in things like Big Data, network capture and so on.

Network Course is non-trivial but very well structured so it's easy to complete one. It takes at least a year to learn what can be done with network switch alone. However, to invent any software takes another year. And then implementing the first version may take another year. That's how the R&D works.

On the other side, I'd take course in cryptography but I'd look also on concepts like SSO, network monitoring, orchestrating. It's not as heavy as big-data but very helpful and that's were new products are heading

There's also the secret sauce of next-generation products which is Machine Learning.

Regarding network products like switches and routers, it's usually more than a switch - it's whole ecosystem of software, which includes e.g. VHDL, Verilog for hardware and C for software, which is embedded software.

You can check for job posting to find out what specific company (e.g. the one in your country or city) is using.

You can also have a look on Arduino IDE.

See here: Hardware Description Languages

However, to produce the switch or security gateway, there's a lot bigger ecosystem of things like simulation, prototyping. You can still go for HDLs if you want to develop next generation networking products.

There's also Robotics, real-time network communication, network virtualization, for each of these, different programming language is used while HDLs are the Hardware Description Languages for programming the hardware itself. There's still software running on it as well (like C or Java, depends on the vendor).

As you have some experience with Web Development you would already know APIs and things related to the web which is better than good start.

If you intend developing products and platforms, you should decide on your product architecture and technology, so you can choose whatever suits you best. Plus, you should choose something which is more decent regarding syntax and has extensive libraries for the functionality you need, for example:

Java and Scala for high performance, high scalability enterprise applications, mainly if it's going to be huge platform. The build-in language safety and threading makes it very attractive and indeed very popular. Huge number of professional grade libraries. There's everything - profilers, debuggers, editors and it's whole load of them. JRE is the #1 runtime today.
C is universal language and anything can be done and there's also huge number of libraries. If you look into kernel hacking or other linux based development, that's the way to go. It is useful to know for debugging common issues, exploits, reporting issues and so on.
C++ similarly to C, if used well can do a lot for you, whatever it's cross-platform app in QT, GTK, DirectX, OpenGL, server or engine. There's are many paid libraries to do many things, however not every library is available in C++ nor it's always free. However, for things like web browser hacking, games hacking, C++ knowledge is very useful.
Python is general scripting language. It has excellent standard library which is very important, has built-in safety and it's also very popular. There's good ecosystem supporting it as good as in Java (from developer perspective, there are libraries, editors, visual debuggers). I said almost, but it's the only thing getting close. It's ideal for development of command-line utilities. It is extensively used in many fields so there are many experimental libraries not available in other languages.
C# is what powers Windows but regarding cross-platform support it is currently in flux, the new .NET Core has small number of issues regarding importing existing libraries, and Mono is another open sourced runtime. It's good for ASP.NET. The syntax and language design is superior. There's plenty of libraries for Windows. It can be used for anything like command-line utilities, GUI applications and IIS powered websites.
PHP is good for prototyping, scripting and testing and obviously developing web pages. It builds on any server like Python. Since it was designed and optimized for web, it is very compact and very fast and can be used for many other things. It's one of the most clever languages out there. There's little bloat in everything you do.
Javascript is the only choice (along with Typestript) for building client-side applications running in web browser. It can be also used for server-side applications, however, there are not as many libraries as in Java, Python and has bigger limitations than Python. However, it is fast and compact. Syntax is the most horrible one, but there's no alternative for web browsers. It is very quickly evolving. There's new JS framework every hour.
What Perl is everyone knows. If you want to develop server-side daemon it can do the job, however, you won't have editor auto-suggestions like with Java, but Linux packaging and Docker can help you dealing with dependencies when deploying it to cloud. There's more than one library to do anything, even most exotic things. It is closely tied to the OS just like Python.
Ruby is used for generation of web pages. Otherwise there's little libraries yet but it's slowly happening. But before it reaches the level of Python it may take long time. If you are interested in porting, integrating and creating libraries that's something interesting. Also there's relatively poor editor support. Linux packages and Docker can help you dealing with dependencies.

And finally:

Swift is the next-generation compiled language which has additional safety compared to C. It's not only that, there's the whole layer of libraries with it. I am currently onto it myself so I can't tell much yet how it works on Linux, but so far so cool.
Groovy is next-generation language running on JRE. With Grails you can create powerful enterprise applications with little code and you can use any Java library. It is usable and enterprise ready.
Scala is Java alternative, can use Java libraries, you can also create enterprise applications (Play framework), however with being enterprise ready there are few glitches you might not encounter if you are not in enterprise environment, in particular, they do not support HTTPS for their downloads which basically is big pain if you have to use it, and it's problem for many.

And finally:

Java, Scala, Static Groovy, C# are for high performance, multi-threaded application servers which can do more than serving web pages - like listening on sockets, schedule jobs, process data and so on with high performance and safety. Todays Java is really nice. Static typing is important if you want performance and safety, so anything where multiple clients are connecting or you process a lot of data like real-time systems. Java can handle it well today.
Use C, C++ only when you have to, including real-time systems which is must-have in networking.
Use HDLs for Hardware Development
Use dynamic languages for scripting, web pages for managed hosting. You can use Python for almost everything, but look at Java as well.

ps. I don't mention any GUIs - in fact, it's real hell. I do myself HTML5. Sometimes I build it with embedded browser engine. Sometimes C++ / QT, WinRT etc. Look out for the various widget libraries etc.

You will need also to seriously consider database engines. Historically, all database engines were SQLs - MariaDB, Oracle, PostgreSQL, DB2, SQL Server. These are good for generic engines like CRUD, for security you can look at MongoDB, Cassandra, Neo4j, Redis, and also Hadoop and things like Sping Framework, Apache Spark and so on. For embedded devices it's SQL Lite, but many newer embedded devices mainly rely on the real-time, super highly available databases, which are usually specialized for the job any sometimes not free.


Does Hibernate feature pose any security threat? My organization previously allowed its employees to hibernate their devices(Start>Power>Hibernate). Sometime later, the 'Hibernate' option disappeared from the Start menu. Some employees started using shutdown /h to hibernate their PCs. It worked for a few weeks. Later, running the same command through Windows command prompt threw an error that "Hibernate feature has been disabled on this machine".

Obviously, this was a step taken by IT team for some reason which I fail to understand. First they removed the option from Start menu, later they must've realized that people have started hibernating the PCs from the command prompt, and then disabled that as well.

My question is, how does enabling hibernate pose a security threat? Or could it have some other reason?

If it helps, we have Windows 7 Enterprise PCs, hard drive encrypted by Bitlocker, and we are allowed to put the PC in Sleep mode.

Also, I guess the hard drive is not encrypted when the PC is in sleep mode, but all the data is encrypted when it is in hibernate mode. Please correct me if I'm wrong.

EDIT:
Well, my question's domain was not limited to Bitlocker encryption of hard drive. It was kind of a, more general question. I would be interested to know if there are any other threats in hibernate mode, apart from encryption.
Also, if encryption would have been an issue, then obviously putting the machine in Sleep mode could be dangerous as well. But they do allow Sleep mode...

This is what Microsoft has to say about it:

Disable sleep
BitLocker unlock methods for operating system drives—such as TPM
integrity checks or requests for a PIN or startup key before allowing
access to the drive—are only used when a computer is turned on, is
restarted, or comes out of hibernation. If a computer enters sleep
mode after a period of inactivity instead of entering hibernation, the
drive stays unlocked. Therefore, for added security, it is recommended
that sleep mode be disabled by using Group Policy.

Bolds mine. Implied is the fact that resuming from hibernation is as secure as cold booting.
You're probably dealing with an overzealous IT dept, they misunderstood the issue, or they have other reasons not related to disk encryption for the change.
Regarding the more general cuestión of why hibernate might get disabled, you'd have to ask your IT dept. At this point it's not even clear it was done for security-related reasons. Perhaps they were experiencing issues with it on some hardware and disabled it company-wide for uniformity.
Another reason could be they're aiming to disable fast startup for reasons.
Security-related, perhaps not all workstations use FDE or secure boot, and in that case hibernation could be a problem.
We could speculate for all eternity, but unless your IT dept roams SecSE, you won't get an actual answer.


Biometric Match Threshold I'm a beginner to security, and I had a question about biometric match thresholds. Does a higher threshold signify that the system follows a strict(er) policy? Also, suppose I have a threshold of 0.5; does it mean that the sample must be at least a 50% match of the reference template?

How exactly is a threshold calculated?

The match threshold is specific to both the type of biometric and the individual implementation. In academic terminology, the match threshold is generally measured as a percentage of features matched, although each feature does not necessarily contribute an equal value, nor does each feature necessarily contribute to a single global score. It is fairly common to find that biometric systems produce several different properties during comparison, each with their own separate algorithm and threshold. Common units for scores are a percentage, a ratio of matched to unmatched features, or a dimensionless number.

As an example, fingerprints have three main characteristic patterns: arches, loops, and whorls. One can trace each ridge on the print sample, vectorise it, and categorise it as part of one of the three pattern types. While absolute locations are generally not useful, the inter-ridge distances and relative positions of features (e.g. the peak of an arch or the extents of a whorl) are much more reliable for comparison. In a single fingerprint, one can match the presence of features, the weighted average inter-ridge distances across the sample, and the extents of the features. Each of these scores is produced by its own algorithm to perform the comparison, which outputs its own convenient type of result (e.g. a percentage), and is generally configured with an individual threshold based on the accuracy and security requirements of the system.

Threshold values are generally developed through trial and error, influenced by statistics such as False Acceptance Rate (FAR) and False Rejection Rate (FRR). You can read more about computing FAR and FFR here.


How does Freenet maintain access to 'freesites' while retaining plausible deniability about content? On Freenet you can host websites deemed 'freesites' which are publicly accessible by everyone. As I understand, Freenet can serve a variety of content, some which is illegal, which is why content is encrypted on the users computer to ensure plausible deniability.

If this is so, how can many people access a freesite if they aren't the author (and can't decrypt it)?

Below I have supplied the "basic" information required to achieve "understanding" of how the data is stored a accessed; this information has come directly from the Freenet web site. I would suggest viewing the following, "Understand Freenet" ,if you wish to read further.

How can many people access a freesite if they aren't the author (and can't decrypt it)?

  The Datastore

  All Freenet nodes contribute with a part of their harddrive space to
  store files. The files are stored encrypted in the store-directory in
  the Freenet installation directory.

  Unlike other peer-to-peer networks, you as a user has little or no
  control over what is stored in your datastore. Instead, files are kept
  or deleted depending on how popular they are. This is to ensure that
  Freenet is censorship resistant. The only possible way to remove
  something from Freenet is to not search for it, and hope that
  everybody else does the same.

  It is hard, but not impossible, to determine which files that are
  stored in your local Freenet Datastore. This is to enable plausible
  deniability as to what kind of material that lies on your harddrive in
  the datastore.

  The initial diskspace allocated for the datastore is 5% of available
  disk space if it is over 20GB, 10% if it is over 10GB, 512MB if under
  10GB, and 256MB if under 5GB. You can change the store size at any
  time, the more the better, both for your personal browsing and for
  Freenet as a whole.

  Freenet Routing

  Initially, each node has no information about the performance of the
  other nodes it knows about. This means that routing of requests is
  essentially random. But since different nodes have different
  randomness, they will disagree about where to send a request, given a
  key. So the data in a newly-started Freenet will be distributed
  somewhat randomly.

  As more documents are inserted by the same node, they will begin to
  cluster with data items whose keys (see below) are similar, because
  the same routing rules are used for all of them. More importantly, as
  data items and requests from different nodes "cross paths", they will
  begin to share clustering information as well.

  The result is that the network will self-organize into a distributed,
  clustered structure where nodes tend to hold data items that are close
  together in key space. There will probably be multiple such clusters
  throughout the network, any given document being replicated numerous
  times, depending on how much it is used.

  Freenet keys

  Each file that exists on Freenet has a key associated with it. Freenet
  0.7 has various types of keys. Keys are used for everything on freenet, and are a kind of URI (e.g. freenet:=KSK@sample.txt).

  Most keys are hashes: there is no notion of semantic closeness when
  speaking of key closeness. Therefore there will be no correlation
  between key closeness and similar popularity of data as there might be
  if keys did exhibit some semantic meaning, thus avoiding bottlenecks
  caused by popular subjects.

If you are interested, here is a direct link to Ian Clarke's paper "Freenet: A Distributed Anonymous Information Storage and Retrieval System" hosted by the computer science department at the University of Iowa.


Can a password be the same as its hash? So me and my friend were pondering why passwords have a max length (and found the answer here) and I had an odd thought.. could a password be the same as its hash?
I realize that salted hashes are based off RNG but is it possible? If so, what are the chances?

In theory, yes. In order to prove this, all you need to do is hash every possible output hash, and see if any of them result in the same value as was input.

This might take a while.

In practice, very few people use passwords which are themselves valid outputs for hash functions, since this would rewrite remembering a 30+ character string comprised of digits and the letters A to F (assuming a hexadecimal representation). Furthermore, the use of salt in modern hashing algorithms would further confuse the issue - the password would have to be part of it's own hash, and the salt be the remaining part.


Is VM per service a reasonable server security model? Let's say I am hosting several services on my server, for instance, email and a web page. I am concerned that the web server software may have unknown vulnerabilities in it, which will allow an attacker to take over my machine. The attacker will then have access not only to my website, but also my emails!

I could solve the problem by simply having two separate physical machines, each one dedicated to a server. If the attacker breaks into the web server, he can only see the web site. To see emails, he must break into the email server.

I don't want to actually buy a new server for each service I'm running, so as a compromise I thought I could use virtual machines. In this model, the host OS runs a secured SSH server and a VM software. For each service, a new virtual machine is created, and configured to provide that service.

My model can be catastrophically defeated in two ways:

Attacker breaks into the SSH server, essentially gaining access to all VMs.
Attacker finds a security flaw in the VM software, and manages to tunnel out of the compromised VM into the host OS.

However, if both of these are harder to do than simply exploiting a vulnerability in one of the myriad of services I want to host, it seems like the attacker's life has been made much more difficult. He must first realize that the servers are actually VMs on the same machine, then exploit e.g. the web server, and then defeat the virtualization on top of that - this seems harder to do than just exploiting the web server.

My question is, is this sort of strategy actually reasonable and practical for a non-enterprise set up? Do drawbacks like slower performance from running many OSes, disk space wasted on each OS, justify the realistic security gain (if any)?

My primary security goal is to compartmentalize individual services, so that gaining access to the machine through one service (eg. web server) does not immediately provide access to private data of other services (such as emails of the mail server). Every time I add a service to my server, I feel like I'm just adding yet more potential vulnerabilities and exploits that attackers can use and take everything - it would be preferable if, when a flaw in one service is exploited, only that service itself is compromised.

Your assumptions are correct. Security by isolation is indeed a good principle to follow.

There is also a whole Operating System which implements this idea on the Desktop: Qubes OS (Which is running on the laptop I'm using to write this).

To get back to your server model, I think one VM per service is a good idea, but it will become resource intensive.

We have been using FreeBSD Jails system for about 8 years here, to replicate exactly what your are talking about: isolating the web server from the database and the mail server and etc.

What we do is that the Jail hosts runs nothing, except the firewall. All services are isolated into jails, based upon their security domain. We treat the host as you would treat Dom0 under Xen.

Since it is not visualization but instead a very much improved chroot like mechanism, it has not the performances impacts of visualization, while adding separation and security. From the inside of a jailed system, it looks like you are running in a virtualized or real environment. The drawback is that you can only run FreeBSD ( I don't mind, but it might not be suitable for you).

I think Docker is similar in its approach, though I only recently started to use it, and it feels more like a development tool than a replacement for a virtual environment.

Though, I think Xen is worth looking at.


Can malicious phone software mount a MITM attack on a phone call? Suppose my smartphone has been compromised and there is malicious software running on it.  You can assume that the malicious software has broken out of any sandboxes and is running as root.

If I'm on a phone call, can the malicious software change what I'm hearing?  Can it modify the audio of the phone call?  In other words, can it mount a man-in-the-middle attack on the audio channel of a phone call that I place from my smartphone or that I receive on my smart phone?

Also, can the malicious software eavesdrop on the phone call, i.e., can it record the audio of the entire call?

I realize this might be a little bit "science-fiction-y".  Still, I'm interested in whether it is possible, even in principle.  Or is there some fundamental barrier that would make it difficult or impossible for an attacker who has compromised the software on my smartphone to mess with my phone calls like this?

Yes, the "phone" itself is an application.  It can be hijacked or replaced entirely.  In fact, Android handsets are DESIGNED to do this so that you can automatically use a VOIP provider when making phone calls if you so desire.  Malware with complete device control could simply place itself as such a service and when you dialed a call, it would be connected through VOIP and the attacker.

Even without doing this, the microphone and speaker are also controlled by software and there isn't any reason that it couldn't record the input and output from there either if it has sufficient privileges to the system.


Detecting heartbleed without sending a heartbeat packet (Heartbleed specific) I am trying to detect if a server is vulnerable to heartbleed.
To do this, only idea i have is to actually send a heartbeat packet having length field and actual payload having different length.

But since it is a specially crafted packet firewalls and softwares block this request.

Is there any other way to check for the heartbleed (OR openssl version)?
As far as i know, openssl version is not sent by the server in any hello case.

As you've already noticed there is no way to reliably get the OpenSSL version by just looking at the servers response. But even if you would somehow know the version (like if sent in the http Server header) you still don't know if the server is affected by the bug or not, since most distributions just backported the bugfix to the OpenSSL version they shipped and did not upgrade to a newer version.

As for other ways to check for the bug: they only way to check is to trigger the bug which means that you need to send a packet using the heartbeat extension.


Are the encryptions "broken" with great computing power? http://www.dwavesys.com/en/pressreleases.html#lm_2011

  Lockheed Martin Corporation (NYSE: LMT) has entered into an agreement to purchase a quantum computing system from D-Wave Systems Inc.

I'm just asking that if computing power would be "infinite" (not really, but the quantum computers could bring dimensional difference against the modern supercomputer-clusters in a medium term(? fixme) ).

So are there any symetric/asymetric encryptions that can be still good when computing power is "infinite"?

Or the whole "encryption thing" in information technology will be DEAD in about 10-20 years because of these quantum computers (brute force)?

Thank you for any opinion.

Public-key cryptosystems base their security on certain assumptions, one of these being that certain mathematical problems, while theoretically solvable, are computationally infeasible to solve. Typical examples are integer factorisation and the reverse logarithm problem which are used in cryptosystems such as RSA, DSA and Elgamal. For example, an attacker that had infinite processing power, memory and time, could derive a private key only by having a public key.

Quantum computers work with qubits instead of bits, which means that each bit could be in either 0, 1 or a superposition of these states simultaneously, in contrast to classical computers where each bit can only be in one state at a time. This leads to what is called quantum parallelism.

The real issue is to find how to utilise this parallelism to solve mathematical problems faster. Certain tasks, such as multiplication, cannot be performed much quicker by this kind of computer, while others, such as integer factorisation can. Algorithms such as Shor’s algorithm exploit the power of quantum parallelism to perform integer factorisation in exponentially less time than normal computers. For example factorising a 1024-digit number which would take billions of billions of years, with a quantum computer it could take 20 minutes. This means that cryptosystems such as RSA that rely on the computational infeasibility of breaking an integer into two primes will be considered obsolete if a quantum computer (that can handle such computation) is built.

For this reason, cryptographers are already researching what would happen in a post-quantum era and have been trying to find how to build public-key cryptosystems that rely on problems that cannot be solved by quantum computers any quicker that classical computers.

Finally, it should be stated that symmetric cryptography is thought not be affected so much by quantum computers. By using a quantum computer, Grover’s algorithm can make the search for a key quicker by needing the square root of the time of a normal brute-force search. This is significant, but it is suggested that simply doubling the key length is enough to mitigate the attack.