Disinfecting Android device If an unrooted Android device is infected with a virus, rootkit or malware, would resetting the device disinfect it?

A factory reset will reset back to the state the phone has set as last known good image, and for most compromises that will be sufficient.
But if that image is infected then no, it will not help. I have had one Android phone delivered from the factory with malware already installed, so I was concerned that I would need to provide a known good image, but a factory reset was enough in that instance - so the compromise was obviously in an application rather than core OS or firmware.
So if you want to be safe, grab the latest firmware image from a reputable source and use that. Just in case the reset doesn't clear the malware.


Duqu and other reference material for security people I would like to read more on Duqu and similar exploits when they appear. The problem is that most references from google are for laymen.
Isn't there a reference website or... that reports on these exploits with words adequate to security experts?

For Duqu Symantic has a quite detailed explanation http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf

Most anti-virus companies have some reporting on threats of varing levels of details. As this is not my specialty it appears to be random as to who will have details of what, but with a little hunting I can usually find something technical.


Differ between encrypted and unecrypted FTP (21) without login I'm looking at an IP range as a part of a project and discovered several FTP server. They all run vsftpd (3.0.2) on port 21.

I do not have login credentials and anonymous logins are disabled. Can I somehow identify whether the server would encrypt the actual file transfer (e.g. FTPS/SFTP) or not (Plaintext FTP)?

As suggested by Moonsik Park, I've attempted to identify the used protocol. My result differs from the suggestion, as it seems that I can't use AUTH TLS before authentication.

telnet <TARGET-IP> 21
Trying <TARGET-IP>...
Connected to <TARGET-IP>.
Escape character is '^]'.
220 (vsFTPd 3.0.2)
AUTH TLS
530 Please login with USER and PASS.

edit2: The same applies to vsFTPd 3.0.3. The default configuration has SSL disabled, but I'm yet to find out how I can identify this as an unauthenticated user.

Plain FTP

[root@mainserver ~]# telnet **** 21
Trying 10.0.0.10...
Connected to ****.
Escape character is '^]'.
220 **** FTP server ready.
AUTH TLS
504 AUTH: security mechanism 'TLS' not supported.

FTPS

[root@mainserver ~]# telnet **** 21
Trying 10.0.0.10...
Connected to ****.
Escape character is '^]'.
220 **** FTP server ready.
AUTH TLS
234 AUTH SSL command successful.

SFTP

[root@mainserver ~]# telnet **** 22
Trying 10.0.0.4...
Connected to ****.
Escape character is '^]'.
SSH-2.0-OpenSSH_7.4
NO COMMAND AVAILABLE
Protocol mismatch.
Connection closed by foreign host.

The command AUTH TLS can be done before authentication.

Plain FTP servers can't AUTH TLS, FTPS servers can, and SFTP can be identified by port and ssh version.

Do note that you can connect to FTPS server insecurely because ftps is just ftp with some encryption commands. We can tell if the server is forcing to use AUTH TLS, thus can assume users will only use FTPS.

But if it accept both, then we can only assume the users will use both FTP and FTPS.


Asymmetric crypto to store credentials in HTML LocalStorage We are developing a Mobile web app where the users want (and it is a non relaxable requirement) to be logged for a very long time.

The solution we are developing has a web-client part in HTML+JS and a middleware in Java. Storing the users credentials in the middleware is not an option because we do not want to have a single point where some Administrator can get ALL the credentials of the users. So to be short these are the requirements:

Remember me for a very long time
Middleware cannot store users credentials
Auth systems in the Backend of the middleware cannot produce a long time session token
We want to protect the users credentials more than the application access

We know very well that storing credentials in the HTML LocalStorage or Cookies is a very bad security practice, but:

1) Users know that they have a very long time "remember me" and it's their responsibility to log-off (Security vs Usability)

Obviously storing the credentials in plain text in the HTML LocalStorage is not an option because XSS attack can steal the credentials, so we have designed a solution and we want to discuss its security here. A small notice: we'd like to discuss it under a real point of view not an academic vision ;)

a) users put their credentials in a web form
b) a JS lib encrypt the credentials with a RSA Public Key (1024) and put the encrypted payload (EP) in the LocalStorage
c) the EP is sent to the middleware which decrypt it with the private key and authenticate the users to backend system(s) (there could be many backend system with SSO) - there is a session id to avoid decryption on every call (when the session expires the client resend the EP)
d) if EP exists in the client side, the client send it and authenticate again the user
e) if the user want to log-off, the client deletes the EP and give the login form to the user

The security point are:

a) on the client side there is only an encrypted stuff with an asymmetric algorithm ==> none can decrypt it
b) we consider much harder for an Administrator to put inside the middleware than to steal credentials on the disk
c) Every N months we renew the RSA keys and all the users must reauthenticate

The only attacks I can image are:

a) a browser plugin that steal the credentials before the encryption ==> this is true for ALL the web auth forms
b) a replay attack: stealing the enc payload permits to authenticate impersonating the real users ==> this is a problem, but the credentials of the users are safe and this balancing the very long rememberme (same problem of very long session)

I cannot imagine other kind of attacks.

I am very opened to all the opinion to improve the security of our solution (but usability is very important...)

It sounds like you're making this more difficult than it has to be.

Clearly a random, server-issued key which corresponds to a server-side data element is by far the best solution, and in practice the only solution that any reputable organization employs. But since you want something different, here you go:

Upon login, you encrypt the login information server-side, with salt and some HMAC (and possibly a timestamp), base64 encode the result, and there's your persistent token that you issue to the client. Ideally you should also tie the login to the device somehow; perhaps some sort of static device ID that gets sent to the server and encoded into it.

Then when you need to re-authenticate, your client passes this token to the server, which your server will decrypt, authenticate, and then issue your app a session key as normal.

It's not quite as good a solution as a random, opaque authentication token (which is valuable only as it corresponds to some server-side datastore), but you said that this is impossible for some unknown reason. I would argue that if something as simple and useful as this is impossible, then you're using the wrong software.

As for using asymmetric crypto and browser-based RSA for storing authentication tokens, I can't come up with even one scenario where this is appropriate. But sometimes complexity for complexity's sake has it's own allure.


Does Google capture microphone data to better target advertising? Recently several ads which I had never seen before started popping up. Most were related to products I had been talking about and thinking about buying as Christmas Gifts. Some of the most specific ads which popped up were "Dinosaur Books for Children" and "coffee machines". I never searched for these products online, but had mentioned many times in front of my computer while talking to friends.

Back in April Mark Zuckerberg was addressing Congress in the Senate in the United States, where he answered many questions about privacy and security. One question which kept coming up was whether or not Facebook listens to microphone data to better target advertising. He replied saying that this is not the case. Google was not there to answer on their behalf.

Is Google always listening with the microphone to better target advertising, or is this simply a conspiracy theory?

Is there any proof to support or deny this claim?

This could be the result of excellent Deep Learning algorithms which are capable of connecting many dots behind the scenes to predict results.

I find it highly unlikely that Google would be monitoring 1.17 Billion People who use their search to target advertising, however recent advertisements for products I never searched for but had talked about made me wonder.

Is Google always listening: Live Test

EDIT:

I came across the video above after I saw the lucky ad targets. I agree that the experiment was flawed, mostly by clicking on the related ad. However, I hadn't seen the other video disproving the hypothesis. I still don't think this is conclusive enough. Were formal tests/security checks done on this issue? Are there official statistics from third parties regarding Google Ads?

To me (as someone with little to no information security expertise) something like this raises big questions, and would have thought that these serious claims would have been addressed before. I can't seem to find much information about this on Google (ironically).

  Do you use Google Home or similar smart devices?

No, however I do have an Amazon Alexa which was not on during that time. I also have Whats app and backup to Google Drive.

I'm not necessarily talking about my particular case, which may or may not have been a coincidence, but if this serious claim has been looked into professionally.

Possible, but unlikely.

As others have stated Google (and others) could record your conversations and analyze them, but it would probably be very expensive and the return of investment not high enough. Presumably this is a manifestation of (self)-selection bias.

What does that mean? In a nutshell: If you would have mentioned a wide selection of products in front of your computer would you have seen advertisement for them? Probably not.

The far more likely scenario:

you already use some Google services so they have a pretty good idea of who you are and
you (like 99% of all people) live in relatively easy to approximate personal circumstances.

Thus follows that showing you ads for the mentioned books or a coffee machine is pretty reasonable. If the Internet as a whole taught humanity one thing it's that we are all very much alike.


Why does Tor Browser disable Javascript optimizations? The security level slider in Tor Browser disables various Javascript optimizations.

How can the presence or absence of optimizations be a browser tracking method?

The presence of certain JavaScript features can be used to fingerprint the person like

  "X's unique hash is ...".

Whereas the absence of certain JavaScript features can be used to fingerprint the person like

  "has disabled X".

It's not recommended to tweak the Tor Browser Bundle in any way, as a lot of people use it (with default settings) and therefore your fingerprint only says "uses Tor Browser Bundle".

Browser fingerprinting resources:

privacytools.io
my blog post


John the Ripper password cracker is viable? Is this still viable? I remember using this when it just worked in shells.

http://www.openwall.com/john/

Yes.  I believe JTR, Hashcat, and InsidePro are the three dominant password crackers these days.  You may find it lacking features that the others have or vice versa.

All three have teams using them pretty successfully in the major password cracking competitions, like Crack Me If You Can.


Who to assign read/write access rights for a single-user application to run correctly? My application installs for a single user on a Windows machine. Any user may install the application for himself, but the application will save some information common to all users in a separate directory (currently in the subdirectory of the hidden ProgramData folder on Win Vista, 7 and 8). The application will need read and write access to this subdirectory and all of its subdirectories.

What are the minimum access rights, and which user must have them, i.e. do I need to assign read/write access to that subdirectory to each user separately, or is it enough to assign it to one user/group and which one? The application runs on Windows XP, Vista, 7 and 8.

You can either add the individual user or use built-in groups. The simplest way would be to assign the group read/write permissions to the parent directory the application needs permission to and propagate permissions down to the children via inheritance (usually automatic).

As far as groups there are many built-in groups as well as custom groups you can create.  The default local groups, Administrator and User, should be sufficient to accomplish what you want.  Alternatively you can also use the Authenticated Use" group.


Does cross platform (authenticated) volume encryption exist? Note: this is not the same as What is a self-contained cross-platform encryption for USB drive?. I believe my question is on topic because I'm not asking for a recommendation. I'm asking if such a product exists. I'm not asking for a subjective comparison of products. A correct answer could be as short as "yes" or "no" with a link to corroborate.

Here's the use case I'm considering:

The user has multiple, heterogenous computers. (Linux, Mac OS, and Windows)
The user shares a volume of files between said computers. (The method of sharing is unspecified. Could be Dropbox or USB drive or … anything.)
The volume can be sliced to support large volumes on host file systems with file size constraints. (E.g. a 10GB volume can be stored as 5 X 2GB files on a FAT file system.)
The user enters a passphrase once to unlock the volume and see file metadata. (Not required to type a passphrase for each individual file.)
Uses authenticated encryption.

Notice that the last criterion eliminates TrueCrypt as a possible answer.

I am not aware of any generic, cross-platform encryption utilities which can do this, but the newest version of Linux's LUKS2 volume encryption format supports authenticated encryption. You can format a partition to use authenticated encryption with a recent copy of cryptsetup and a modern kernel:

cryptsetup luksFormat --type luks2 $device --cipher aes-xts-plain64 --integrity hmac-sha256

This will use standard AES in XTS mode, using an HMAC for integrity. You can alternatively do:

cryptsetup luksFormat --type luks2 $device --cipher chacha20-random --integrity poly1305

This gives you an encrypted volume using the ChaCha20 stream cipher, with the Poly1305 MAC for authentication. While stream ciphers are normally a bad idea for disk encryption because of their malleability, it is not a security issue when combined with a secure MAC for cryptographic integrity.

Note that AEAD adds some storage overhead, as the MAC tag must be stored along with the ciphertext. This causes the amount of usable free space to be a bit smaller than if you did not use authentication.


"What's my IP" shows a different result when running over https than over http We had issues with one internet provider, and switched to another one. However, we received word that the new internet provider is somewhat affiliated with the previous.

When running a "what's my ip" query online, we see different results if we run it over an http link opposed to over an https link.

Over an http link, our ip is from a new subnet registered to the new company.
Over https, our ip appears to belong to the subnet and ip range of our previous provider.

1- How would you explain this?

2- The new provider claims the old IP is somehow stuck in the buffer of our very own router, is that possible? How can we flush it? we already tried powering off then back on.

3- Is it possible our https commuications are being spied on? Like a man-in-the-middle attack?

4- Is it possible the new provider is cheating us and re-selling from the initial provider? at a higher price.

Many thanks

Pure speculation without more info, but it could well be a case of HTTP proxying.

HTTPS proxying is not feasible without a complex set up, which would be why you see a different IP over HTTPS (your IP) than over HTTP (the proxy's IP). While this indeed can be used to "spy" on your HTTP traffic, it could also be a caching service, used to reduce unnecessary traffic due to repetitive web browsing.

The theory that they are reselling with a http proxy to 'hide' your IP from yourself seems unlikely to me.

There exist various ways to detect a proxy. Conveniently, publicly available tests exist freely (with varying quality - try a few..) e.g. here.


Why is the Diffie-Hellmann exchange not enough to authenticate the communication partners in IKE_SA_INIT? The IKE_SA_INIT does create a key seed SKEYSEED from the Diffie-Hellman values and nonces. Since the exchange does sharing the secret between the communication partners, I do not understand why it is not enough for authentication.

The plain ephemeral (new key every connection) Diffie-Hellman is unauthenticated. You perform the DH operation using newly created keys on both sides and establish a shared secret value you can use to encrypt the communication. But you do not know who you're talking to. The other side can be anyone. You have no way to know, except if you trust the source IP address in the packets (you shouldn't).

TLS, SSH and IKE perform authentication after DH to establish that you are talking to the server/client you meant to talk to. This is called "authenticated Diffie-Hellman".

Usually the client ensures the server is not an impostor by requiring the server to produce a new asymmetric digital signature (and then verifying the signature), thus proving the server possesses the private key matching the public key the client already has (or which the client receives in a certificate and checks the certificate is signed by someone the client already trusts, etc.).

The server may require the same from the client, or some other form of authentication (or no client authentication at all as is common for TLS but not common for SSH and IKE).

Static DH (long term keys) can be used for authentication. For example, the client may know the public key share of the server, and the server may know the public key share of the client, and they can send messages to each other by performing DH using the private part of their own key and the public part of the other side's key, establish the same shared secret every time and use it for encryption. The problem with this scheme is that all messages are encrypted with the same key. When the the private part of either side's DH key leaks, the adversary can decrypt all previously recorded communication. To avoid this problem, we use ephemeral DH, with new keys every time and destroy the private part of the key in memory immediately after it has been used.

It is possible to combine ephemeral DH (new key every connection) and static DH (long term key), to use a long term  DH key only for authentication while encrypting using newly established keys thus providing forward secrecy as in authenticated DH. If so, the handshake will be two DH operations instead of one DH operation and one digital signature operation. But AFAIK, this variant does not exist in the spec for IKE (or TLS or SSH). You can read about this in Noise protocol framework, if you're interested.


Should login and logout action have CSRF protection? I am making a web application in Django which generates and includes CSRF tokens for sessions (a Django session can be anonymous or a registered user). Should I keep CSRF protection to the controllers handling login and logout action?

Possibly you should protect against Login CSRF. Without this protection an attacker can effectively reverse a CSRF attack. Rather than the victim being logged in to their own account and the attacker tries to ride the session by making requests to the site using the victim's cookies, they will be logging into the site under the attacker's credentials allowing the attacker to effectively hijack requests to the domain that the victim thought were anonymous or were under their own account and then sending it to the attacker's account. Of course whether this is relevant to your particular site or not depends on the nature of your site and whether something like this is advantageous to an attacker. An example is a Login CSRF attack on a search engine so the attacker can see the terms being searched for as they are logged under the attacker's account instead of the victim's.

The main targets for this type of attack is where authenticated actions can take place outside of the main application itself. e.g. from a browser plugin or widget embedded on another site. This is because these actions will be authenticated through the use of cookies, and if an attacker has you logged in as them each action will be recorded in their account.

You should also protect your logout mechanism against CSRF. At first it seems that all an attacker can do is logout the user, which would be annoying at worst. However, if you combine this with a phishing attack, the attacker may be able to entice the victim to re-login in using their own form and then capture the credentials. See here for a recent example - LostPass.


Any solution to passing a penetration test for an outdated php web application without upgrading the application? A vulnerability list for my project's PHP version. The client would rather not upgrade the PHP version to the last version. Also, it's quite probable that some code will break after the switch from 5.1.6 to 5.3.0. There are, however, two problems I face:

Some vulnerabilities can't be solved with code, they can be solved only be recompiling PHP with the fixes; I'm forced to rewrite the code to avoid them
I can't seem to find PoC(proof of concept) for most of the vulnerabilities; how can I know I've fixed them/where the problem is, precisely?

Any advice is greatly appreciated.

Upgrading and re-writing some of the code will be the most secure way to address vulnerabilities. Depending on how your application is being accessed you could look at a few different perspectives.

If this is accessed externally on the Internet, I would assume that the users would be within a specific geographic scope. Ex. Site in Florida for a local company with local products. You could block all International traffic since it would not be needed.

If it's an internal intranet application then just monitor the network for anyone doing anything fishy.

If it's on the Internet with International exposure as a requirement, keep everything updated and patched because you are going to get scanned.


Is it worth deleting certificate exceptions if they no longer need to be? At my organization, I had some self-signed certificates for some internal applications. This was causing the browser to show the "This page is insecure" prompt and users would add an exception for that certificate.

We've recently switched those certificates to a proper Certificate Authority and that warning prompt no longer appears.

Would there be a reason to have all of my users go into their browser settings and remove the previous exceptions?

The only reason you would need to have them remove it is if there's a possibility somebody will steal the certificate's private key. If this were to happen, AND a hacker were able to hijack a connection to one of your internal applications (with the same domain name that the self-signed cert had), then they would be able to see private information.

Now if a hacker were able to get the old private key, they would probably be able to get the new one as well (if you're storing them in the same place). So it probably doesn't make a difference whether your users delete the exceptions.

If you want to be extra safe, though, you could.


What is the collision chance of a 128-bit hashing function if it is always fed with 256-bits of data? I mean "normal" collisions not based on any attack.

How do i calculate it?

The relevant principle here is the birthday attack. It roughly states that for a 2n algorithm, your probably of a random collision is between any two items is 50% once you generate 2(n/2) outputs.

When looking at a hashing algorithm, the naive consideration of the algorithm is that the odds are bassed only on the last iteration. In this way, a 128 bit algorithm doesn't care if you feed it 1 bit or a million bits: your odds of collision should be the same for a given number of unique inputs (as you can obviously only input 2 different one-bit values).

Thus, the answer for a 128 bit algorithm is that it has a 50% chance of a collision occurring between any two values after 264 outputs have been created.


IPSec optional advanced questions [homework] AH/ESP and Tunnel/Transport modes I have 2 questions regarding IPSec. This is the last 2 optional questions of my homework:

Scenario when combining AH and ESP can be needed?
Scenario when combining Tunnel and Transport modes can be needed?

These are the optional questions, but I am just curious and can't answer on my own.

#1 Transport Adjacency This is where you need the entire packet authenticated but also in ESP transport mode.

#2 Dynamic routing This is what happens when you need the tunnel end-to-end, but need the path through the untrusted network to be dynamically assigned (i.e. resiliency).


What is the purpose of time-dependent form input names? This login form keeps changing the names of its fields:

What does that accomplish? What kind of attack does it protect against?

Your example is a banking app.  Many banks are facing trouble with "scraping" tools which collect information from the bank.  Basically, the banks are so far behind on APIs for accessing our information that customers are choosing to give out their usernames and passwords to third party sites which then go scrape their financials and present them in a usable format (such as a CSV file).

Several banks have made the decision that this is a problem, and rather than build the API's, they're just trying to make it harder for scrapers to do their job.  Dynamic fields like this are one tool they can leverage.  Others have some token encoded into javascript which must be decoded and passed along.  The idea is that if they can make it difficult enough for a 3d party to scrape your data, you'll stop giving out your password to make up for their failure to provide the services their customers are asking for.


Using OAuth SPA app to provide third party with access token Say I had a centralized OAuth 2 authentication server, a Single Page Application (SPA) in an electron app, and a third-party server. The user launches this SPA, goes through the PKCE flow to obtain an access & refresh token, and is now authenticated. The SPA is now allowed to access & modify information in the authentication server.

Next, say this SPA wanted to access a third party API, which performs some function - in my case, it provides authenticated downloads to a client. That third party API can already authenticate a user via the normal OAuth flow, having a user access the page, redirect the user to the authentication server, and then send the user back with an access code, which the third party API exchanges for an access token. But instead, what happens if I want this SPA to access the third party service? The SPA isn't "signed in" to the authentication server, since it is only an OAuth client, and the user can't just go to the authentication server's URL to follow the standard authorization code flow. What would be the process to generate an access token for this third party API to allow access to the authentication server on the user's behalf - retrieving or modifying information about the user?

Thanks in advance!

Adding more accurate answer based on the discussion above.

Based on your clarification in the comments the flow is to try to download a resource through the SPA, after sign in. Then the appropriate course of action is to change the third party service to verify the access token that SPA will send to it, on behalf of the user. This way SPA will not know and neither should it care how access tokens are generated. This will make sure no one can exploit the mechanism to generate access tokens freely.

Given that secure channels(TLS) should always be used for all interactions between OAuth service and any other subsequent interactions with thirdparty service to make sure no one can eavesdrop and obtain tokens. Make sure the access token has a shorter TTL to minimize the possibility of replay attacks. Have a look at the OAuth Threat Model since you are writing your own OAuth server.

[

Of course this means you have to be able to configure your user permissions per resource.


Thales HSM: relationship between the various key types? I am going through the Thales HSM manuals, and frankly the key acronyms are driving me crazy. I would like to understand the differences between the following keys, and how they relate to one another:

LMK
TMK/TPK/TAK/TEK
ZMK/ZPK/ZAK/ZEK
DEK
KEK

I know that in terms of "hierarchy" (if that's the right term to use), LMK > TMK/ZMK > TPK/ZPK...and that's it. Specifically, I would also like to know:

Which key should I use if I'm looking for general purpose encryption/decryption? How about key wrapping?
Can zone keys and terminal keys be used interchangeably (e.g TPK and ZPK)?

LMK is Local Master Key which is the root key protecting all the other keys. This LMK is generated by 3 components and divided in to 3 smart cards. LMK is responsible for encrypting all the other keys. LMK is stored in plain in HSM secure area.

Which key should I use if I'm looking for general purpose encryption/decryption? How about key wrapping?

For this, you can use TPK which will be used for encryption and decryption.
The process will be as below:

Generate a TPK
Encrypt TPK from TMK, this will create TWK
TMK will be injected
TWK will be defined in code level or in a profile
When something needs to be encrypted, TWK will be decrypted with TMK to receive TPK, TPK will encrypt and vise versa

Can zone keys and terminal keys be used interchangeably (e.g TPK and ZPK)?

Zone keys are designed to exchange keys between HSMs.
You can wrap a TPK from ZPK and share.


If I have my neighbors wireless router password, can I access his data with a smartphone? My neighbor gave me his wireless router password to use on my smartphone.  Using this, can I access any of his accounts whether it's his bank account or
Att/Direct TV account?
I ask because I think someone stole the password from me.

Probably harder to do with your phone than with a laptop, but attacks can be (and have been) mounted with a phone. Your neighbor should definitely change his password just to be safe, but IMO his chances of being attacked aren't as high as one might expect.

The attacker would have to find the location of the network if he didn't know it already, and then he'd have to get physically close enough to get onto it before the password would be of any use to him. Heading over to the nearest fast-food joint and sniffing on the free Wi-Fi there is much easier. Even cracking Wi-Fi passwords (particularly WEP, although that's not in widespread use anymore) is probably easier than actually moving around (at least for me). With cracking, you have the added bonus that anyone whose network is easily crackable is probably pretty lax about security, so additional opportunities are likely to present themselves.

To learn more about this, I highly recommend using google. There's a lot of information on the internet, or so I'm told.


What is the hack attempt going on when I see: did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA When I look at my sendmail logs, by far the most common "error" I see is the following:

Nov 22 16:49:50 MyHostname sendmail[18832]: rAMMnj2u018832: [IP address redacted to hide the guilty] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA

This is not coming from poorly configured MUA's inside my small network.  It always comes from outside my network, from where only MTA's should be communicating with my sendmail.  Overwhelmingly, the single largest source of these IP addresses is China, but plenty of other countries are sources of this as well.

I assume that this must be part of some sort of attempt to hack, but I cannot figure what it is.  Is this coming from hackers/scripts that connect to port 25, figure out that my sendmail isn't a combination of MTA/OS/version that they can crack into, and disconnect without doing anything?  (If that's it, why do they connect repeatedly?)  Or is something else going on?  While I have fail2ban running, and I see regular bans occur, is there anything else to do about this?  For context, the OS is Fedora 19.

Note:  What especially confuses me about this is that I typically see many of this in a row from the same IP address.  I almost never see this just once from a given IP address.  I've even been "attacked" in this way, before, by multiple servers in the same subnet ... after each one gets banned (via fail2ban), they just move to the next server in the same /24 subnet.  I finally changed my sendmail fail2ban rule to ban a whole /24 subnet instead of just a single IP address -- just to cut down on the noise.  If this were just a "checking in to see if we could exploit" then I'd expect a single knock at the door, not such repeated attempts.

I'm actually tempted to put a 24 hour listen on port 25 -- I get little enough mail that this wouldn't kill me -- just to try to figure out what is going on in these connections.  Some days I get dozens of these connections from the same IP address.

SMTP expects commands in the following sequence:

HELO or EHLO servername
MAIL FROM: <address>
RCPT TO: <address>
DATA

Though technically instead of MAIL FROM, the server could send EXPN, VRFY, or ETRN, though nobody ever does.

Apparently your server got the HELO or EHLO greeting, but then nothing after that, or something after that that wasn't expected.

Often this comes from monitoring agents or other scanners who aren't interested in actually sending mail, but rather just testing to see what's listening. Also, it's quite likely that they're attempting to exploit some old vulnerability, which is (correctly) simply being interpreted as garbage and terminating the connection.

Typically when a server takes some unusual steps (such at prematurely terminating a conversation) it will make a log entry noting the fact, just in case you need to debug it later.


First step into pentesting Vaadin web application framework I have been given a project to perform penetration testing on a Vaadin Web Application. This kind of web application is new for me, so I'm just wondering what should I prepare to perform penetration testing on this application or what should I do after gathering information about the application?

I have tried to intercept the request and response using Burp and it seems like the application is using websockets to exchange data. I haven't seen such a method before.

If there are any tools that you think can help please let me know (Like JSON Beautifier, or vuln. scanner).

There isn't anything brilliant for web application testing with web sockets. Last time I tried, ZAP (https://www.zaproxy.org/) offered a better alternative to burpsuite, but I know that portswigger have since improved this aspect.

Like any other web application, you need to worry about user input, requests to the server, responses, etc. Consider the same layers of implementation where vulnerabilities could exist in: configuration, authentication, access controls, session management, input validation...
https://owasp.org/www-project-web-security-testing-guide/stable/
https://owasp.org/www-project-top-ten/


How do malware developers avoid wrecking their own computers? Given

that there's quite a lot of malware running around targeting home computers;
that for there to be malware, someone has to have built it; and
most malware developers probably don't have the luxury of being able to use a whole different kind of system for actually building the malware (and, even if they did, they'd still need a PC in order to test the damn stuff);

how do people developing malware avoid wrecking the systems that they use to develop said malware?

Developing malware and destroying environments is the same as investigating malware to reverse it.

Your assumption about developers not being able to use different systems is incorrect. The below allow a developer to host multiple virutal machines for testing against different platform images.

Azure
AWS
Virutalbox
VMware

Virutalization allows the machines to be torn down and spun up again after deploying the malware and executing it. This is how forensic investigators reverse malware by running it in an isolated environment where they can watch how it interacts with the system - the process is the same for developing it.

Buying a second hand machine is cheap and would be done if you want the malware to target physcial machines and detect virtual environments. Take some disk images and you're good to go.

Modern malware is often made up of different stages or modules. Modular development results in it being more difficult to reverse engineer it also allows testing of the modules seperate to the whole. This way a destructive payload is not executed per test.


Is malware on an air gapped computer a requirement to communicate over side-channels? Is it a requirement to infect the air-gapped pc with malware at first to get all needed functions for a communication path between air gapped pc and attacker pc?

For example: Stuxnet, first was the infected USB-stick on air-gapped pc then the communication over side-channel.
Or are there any side channel attacks that don't require malware on air-gapped pc?

When malware is a requirement to communicate (see upper question), does the malware do write functions?
I think so because it doesn't make sense "when malware is required" (see upper question) but don't need to work/write/execute any code, is that right?

With air-gapped pc i mean:
A brandnew tower computer or laptop/netbook etc. (very simple) Just FYI all communications devices (bluetooth, wlan etc.) are physical destroyed/removed

Or are there any side channel attacks that don't require malware on
  air gapped pc?

Of course.

Let me just quote from Wikipedia as simple source:

  General classes of side channel attack include:

  Cache attack — attacks based on attacker's ability to monitor cache accesses made by the victim in a shared physical system as in virtualized environment or a type of cloud service.
  Timing attack — attacks based on measuring how much time various computations (such as, say, comparing an attacker's given password with the victim's unknown one) take to perform.
  Power-monitoring attack — attacks that make use of varying power consumption by the hardware during computation.
  Electromagnetic attack — attacks based on leaked electromagnetic radiation, which can directly provide plaintexts and other information. Such measurements can be used to infer cryptographic keys using techniques equivalent to those in power analysis or can be used in non-cryptographic attacks, e.g. TEMPEST (aka van Eck phreaking or radiation monitoring) attacks.
  Acoustic cryptanalysis — attacks that exploit sound produced during a computation (rather like power analysis).
  Differential fault analysis — in which secrets are discovered by introducing faults in a computation.
  Data remanence — in which sensitive data are read after supposedly having been deleted. (i.e. Cold boot attack)
  Software-initiated fault attacks — Currently a rare class of side-channels, Row hammer is an example in which off-limits memory can be changed by accessing adjacent memory too often (causing state retention loss).
  Optical - in which secrets and sensitive data can be read by visual recording using a high resolution camera, or other devices that have such capabilities (see examples below).

Eg. getting information by measuring power consumption (of the intended non-malicious software) doesn't need malicious software in any way.


How to estimate the time for a hacker to crack a strong password Some kind-heart hacker just sql-injected our website, getting the hash of admin password of 10 lower case chars. It took him half a day to crack it without knowing the SALT (he know that we use "sha256" because the site is opensource).

Now, the manager is not happy. Obviously we will have to change the algorithm to something unpredictable, and a strong admin password, apart from patching that sql-inject hole.

Points to consider:

Password are strong like : "MyB0y6thJan@)!%" : my boy 6th Jan 2015 -> easier to remember. Or passphrase "we love this website so much"
The hackers are usually pro ones, they attacked us all the time. They may have access to 10-100 strong computer.
Hackers may think we are using sha256 as in the opensource but we will change them to something strong like bcrypt.
we would change password every month.

Question: if they manage to sql inject and get the hash in the future, would he be able to crack it fast?

P/S : I have read many similar topic like :

Estimate the time to crack passwords using bcrypt.

How do we estimate the time taken to crack a hash using brute force techniques

But still I am so confused now, many people ( including the hacker) claim that any hash password can be cracked to its original form, just a matter of time. While many say it may take years to crack just one.

It's not possible to answer how long it will take to crack a password without knowing how the password is created. If you create a password based on your (or a relative's) birthday, street address, middle name, etc it is assumed to be a week password due to Kerckhoffs's principle. Since you don't know if an attacker will know this information, it's best to assume that they will, and that they know the format you decided to use.

For the sake of demonstration, let's assume they don't know anything about your family, but they know you've formatted your password as My[B0y or G1rl][day of month with suffix][abbreviated month][symbols on keyboard corresponding to year]. That's 2 possibilities for boy or girl, 365.25 for month and day, and let's be generous and say 50 for year. 2 * 365.25 * 50 = 36,525. That's nothing. An attacker could try hundreds of similar methods without having to do a significant number of hashes.

The only way to reliably estimate password strength is by basing the estimate on the password generation method. If your password generation method is to generate 10 random alphanumeric characters, you'll be randomly picking 1 password from a set of 6210 passwords. On average, an attacker will guess your password after trying half of the possible passwords, so unless they get extremely lucky they'll have to guess around 6210/2 = 419649682934170112 times before they guess yours (of course this could be higher or lower if they're lucky).

This 8x GTX 1080 benchmark has been floating around for a while, if we assume that's what an attacker uses, they can do 200 billion md5 hashes or 826 bcrypt* hashes per second. If you're worried they have a room full of ASICs, take that times a billion (although bcrypt is somewhat resistant to ASICs). Worst case scenario with bcrypt is 6210 / 2 / 826000000000 = 508050 seconds, which is only a few days, but as far as I know bcrypt ASICs are still unlikely to exist (or be that fast if they do exist). Of course, you could easily make this much better by using 12 or 15 random characters instead of 10.

*Assuming a cost of 12; the benchmark gives 105.7 kH/s with cost 5, so 105700/2^(12-5) ≈ 826 H/s.


Can a full SSD or HDD recover deleted data? I've always been curious. It may be a stupid question but what if you deleted a file then filled up the SSD or HDD. Could your deleted data be recovered or is it physically impossible? I know Windows when you delete, you are actually just removing the headers from the files and waiting for the bytes to be overwritten (which means it still remains there).

But is it possible to recover deleted data (if not, some) from a full SSD or HDD (being that new files have overwritten the old data)?

There are three main types of storage drives. Hard disk drives, solid state drives, and solid state hybrid drives. Each of them behaves differently.
Hard Disk Drives
When you delete a file, you unlink it, effectively telling the filesystem that the sectors in which the file resides are no longer in use and are free to be overwritten. When this happens, the file is said to be present in unallocated space. Filling up an entire drive, in theory, will fill up every sector, including the ones which the unlinked file resided in, overwriting it. This is true for hard drives in most cases (rare exceptions include when a sector on a hard drive goes bad, and the hard drive is unable to write to it, causing the damaged data to be stuck in place). In general, you can assume that a single overwrite of any given sector is sufficient to destroy the underlying data. Random data is often said to be better than zeros. If you are on Linux, you should probably avoid using /dev/urandom as it is very slow. A very fast and sufficiently random alternative to create a random file to fill up all your free space would be the following:
# key=$(head -c 16 /dev/urandom | base64)
# sync
# openssl aes-128-ctr -nosalt -k $key -in /dev/zero -out /fillfile
# sync
# rm /fillfile
# sync

It's important to do this as root because some filesystems, such as ext4, have a certain amount of the filesystem reserved for the root user only. On ext4, this is 5% of the entire drive space by default. This is designed to prevent a regular user from filling up the entire drive and preventing daemons running as root from writing their important log files to the disk. However it also interferes with filling up the entire disk, so you must create the random file using root.
You can test if your drive has any bad sectors with the smartctl command. Install the smartmontools package, and run the following:
# smartctl -A /dev/sda | grep Reallocated_Sector_Ct | grep -o '[0-9]*$'

This should output the number of bad sectors on your drive. The first command lists a bunch of data about drive errors, the second command singles out the error related to bad sectors, and the third command displays only the last number, which is the raw value of relocated (bad) sectors in the drive's lifetime. In most cases, this value will be 0. If the number is higher, some data may still be left over on your drive. In theory, this could contain sensitive information. Each sector's size is typically 512 bytes (or 4096 bytes on some modern drives). If the number is very large, then you've got other problems to worry about, because your drive is about to fail soon, and you should probably back it up and wipe it before it dies on you. Note that this issue applies to solid state drives as well.
Solid State Drives
SSDs are a bit different. They contain an extra area called overprovisioning space, which is not accessible by the operating system. Due to wear leveling, filling the entire drive may not actually delete all your previous data, and files in unallocated space may remain in the overprovisioning space. Each time you fully fill up an SSD, you have only a statistical chance of overwriting any given sector, and there's a small chance that the sector will not be overwritten, and will instead be part of the overprovisioning space. Now, you can issue the TRIM command to some SSDs, which tells the firmware to erase the contents of all unallocated space. However, you have to trust the firmware to do it properly, and many do not. Additionally, there is no research on whether or not TRIM destroys data in a way that ensures it cannot be recovered with specialized hardware, as far as I am aware, even if you could trust the firmware to erase cells promptly.
(Since I wrote this, there is evidence of data being recovered from erased flash memory, even after multiple writes.)
On Linux, you can mount your filesystem with the discard option, or you can periodically run the command fstrim / (with / replaced with the mountpoint of any SSD you want to TRIM). Using fstrim has less overhead. Doing this is good for performance, and also helps make sure that data which is deleted is harder to recover. If you use disk encryption, you may want to avoid using TRIM however, for reasons this article explains quite nicely.
Solid State Hybrid Drives
SSHDs are hard drives which contain a small (several GiB) built in solid state drive which they use for caching reads and writes in order to speed up the drive without being as expensive as a full solid state drive. I don't believe you can issue the TRIM command to these drives, or even control the solid state component of these drives at all. The behavior of these drives is entirely dependent on the firmware of the drives, and is entirely unpredictable. Such drives could easily send all consecutive writes to the hard drive platter and only send random writes to the solid state drive, causing a large file used to overwrite the drive to overwrite none of the solid state drive at all, leaving plenty of sensitive data there. I would not use these drives if you want to be able to overwrite files at a whim.
Instead, if you need to hybridize an HDD and SSD, you could buy a small caching SSD and a larger HDD, and combine them using software such as bcache, which is far more efficient than crappy SSHD firmware, but also easier to wipe data off of if you need to. To wipe data off of them, you can disconnect the caching drive, essentially turning the system back into a regular HDD, then securely erase everything from the SSD, fill the HDD with a large file, and reconnect the SSD and turn it back into caching drive.
In summary, it's not easy to securely overwrite data by filling your hard drive with a large file. There are so many caveats to be aware of. If there is any chance that sensitive files may ever touch your hard drive, you should use full disk encryption. That is the only way to ensure your data is secure.


Proxying Requests through Python and Burpsuite not working I have BurpSuite configured as a proxy.  I have generated and installed a certificate for Burp in my Mac's keychain.  On a Kali box I have also configured Iceweasel to proxy through my Burp Proxy running on my Mac.  I can can browse from Kali to both http and https sites and burp intercepts the requests.  I forward them through and confirm the security exceptions and the browser eventually displays web pages.

From the Kali command line I exported the following two variables

export http_proxy=http://172.xx.yy.z:8081
export https_proxy=http://172.xx.yy.z:8081

I wrote one python script:

(env) ojblass@kali:~/effective_python$ cat ojblass_urllib_http.py
import urllib
url = urllib.urlopen("http://www.hotmail.com")
data = url.read()
print data

This correctly hits the BurpSuite proxy; however, when I attempt to run https traffic through the request is not intercepted:

(env) ojblass@kali:~/effective_python$ cat ojblass_urllib_https.py
import urllib
url = urllib.urlopen("https://mail.live.com/default.aspx")
data = url.read()
print data

Instead the following error is printed:

<title>Burp Suite Professional</title>

Burp Suite Professional

Error

Invalid&#32;client&#32;request&#32;received&#58;&#32;First&#32;line&#32;of&#32;request&#32;did&#32;not&#32;contain&#32;an&#32;absolute&#32;URL&#32;&#45;&#32;try&#32;enabling&#32;invisible&#32;proxy&#32;support&#46;

GET&nbsp;https://mail.live.com/default.aspx&nbsp;HTTP/1.0

User-Agent:&nbsp;Python-urllib/1.17

Accept:&nbsp;*/*

&nbsp;

The main content of the error states 'Invalid client request received.  First line of request did not contain an absolute URL. I have googled this error but everything I seem to come does not appear relevant.  I am new to this and would appreciate any insight you might have.

I found the answer.  Urllib does not support https proxy.  I found this site which has a recipe for connecting properly.

Here is the code in case the link goes dead:

# urllib2 opener to connection through a proxy using the CONNECT method, (useful for SSL)
# tested with python 2.4

import urllib2
import urllib
import httplib
import socket

class ProxyHTTPConnection(httplib.HTTPConnection):

    _ports = {'http' : 80, 'https' : 443}

    def request(self, method, url, body=None, headers={}):
        #request is called before connect, so can interpret url and get
        #real host/port to be used to make CONNECT request to proxy
        proto, rest = urllib.splittype(url)
        if proto is None:
            raise ValueError, "unknown URL type: %s" % url
        #get host
        host, rest = urllib.splithost(rest)
        #try to get port
        host, port = urllib.splitport(host)
        #if port is not defined try to get from proto
        if port is None:
            try:
                port = self._ports[proto]
            except KeyError:
                raise ValueError, "unknown protocol for: %s" % url
        self._real_host = host
        self._real_port = port
        httplib.HTTPConnection.request(self, method, url, body, headers)

    def connect(self):
        httplib.HTTPConnection.connect(self)
        #send proxy CONNECT request
        self.send("CONNECT %s:%d HTTP/1.0\r\n\r\n" % (self._real_host, self._real_port))
        #expect a HTTP/1.0 200 Connection established
        response = self.response_class(self.sock, strict=self.strict, method=self._method)
        (version, code, message) = response._read_status()
        #probably here we can handle auth requests...
        if code != 200:
            #proxy returned and error, abort connection, and raise exception
            self.close()
            raise socket.error, "Proxy connection failed: %d %s" % (code, message.strip())
        #eat up header block from proxy....
        while True:
            #should not use directly fp probablu
            line = response.fp.readline()
            if line == '\r\n': break

class ProxyHTTPSConnection(ProxyHTTPConnection):

    default_port = 443

    def __init__(self, host, port = None, key_file = None, cert_file = None, strict = None):
        ProxyHTTPConnection.__init__(self, host, port)
        self.key_file = key_file
        self.cert_file = cert_file

    def connect(self):
        ProxyHTTPConnection.connect(self)
        #make the sock ssl-aware
        ssl = socket.ssl(self.sock, self.key_file, self.cert_file)
        self.sock = httplib.FakeSocket(self.sock, ssl)

class ConnectHTTPHandler(urllib2.HTTPHandler):

    def do_open(self, http_class, req):
        return urllib2.HTTPHandler.do_open(self, ProxyHTTPConnection, req)

class ConnectHTTPSHandler(urllib2.HTTPSHandler):

    def do_open(self, http_class, req):
        return urllib2.HTTPSHandler.do_open(self, ProxyHTTPSConnection, req)

if __name__ == '__main__':

    import sys

    opener = urllib2.build_opener(ConnectHTTPHandler, ConnectHTTPSHandler)
    urllib2.install_opener(opener)
    req = urllib2.Request(url='https://192.168.1.1')
    req.set_proxy('192.168.1.254:3128', 'https')
    f = urllib2.urlopen(req)
    print f.read()


Editing images containing hidden information Suppose we have an image with some hidden info behind it. If we open it in a photo manipulation software like Photoshop or Gimp, without editing it and just save it as a new image, does the image still contain the secret info?

If someone is hiding a message within an image using Steganography, then the message should be unmolested by simply saving it.  Depending on how much the image was modified, and the steganography method used, the message may or may not be readable.

For example if BPCS-Stenography was used to hide the message and you drew a smiley face over the image, then parts of the message will still be readable.  If the message was protected by an error correcting code,  then the original message maybe entirely intact.

However,  if you were to take that same image and convert it to a low quality lossy compression scheme like JPEG, then the BPCS-Steganography message will likely be destroyed.


How to know which database is behind a web application? I've read that different databases (mysql, sql server,...) have different vulnerabilities and that they are vulnerable to some specific sql injections.

When attacker try to perform a database attack against a website (like SQL injection) first of all identifies the kind of database, and after performs the attack thinking of the database detected.

How this previous inspection is performed by the attacker? Using some special queries? Are there specific tools? I've not found any information of this.

Let's say you've got a query like this:

$q="SELECT username, joindate FROM users WHERE username LIKE '%" . $search . "%' LIMIT 20";

Now imagine you control $search via a parameter. We would usually make it return the user passwords in the joindate field like this:

$search="' UNION SELECT username, password FROM users; -- -";

As such the query becomes:

SELECT username, joindate FROM users WHERE username LIKE '%' UNION SELECT username, password FROM users; -- - %' LIMIT 20

The part after the double-hyphen is a comment, so it's ignored, and we get all the username and password combinations appended as new records at the end of the dataset, after the legitimate records. Awesome!

But now we want to adapt this so we can find the database name, for further investigation of their database. On MySQL, we can use the DATABASE() function:

$search="' UNION SELECT DATABASE(), 1; -- -";

The use of 1 here is to pad the joindate field, which we aren't using.

On MSSQL we can do exactly the same, but with DB_NAME():

$search="' UNION SELECT DB_NAME(), 1; -- -";

Both of these tricks will append a single row to the end of the result set, containing the database name.

We can then expand this trick to use VERSION() on MySQL or @@VERSION on MSSQL, which returns the current database version. For Oracle and PL/SQL you can check for the existence of the v$version table, simply by doing a query on it and checking for an error.


Replace IPSEC VPN with Shadowsocks, is it secure enough? I've a web site (HTTPS) only allow authenticated users to access. Currently in the web server I grant access allow connection from a VPN gateway.

So all users need to connect to this gateway in order to access the web site.

I found that Shadowsocks can serve as the same purpose. Given my user case above, do you think it is secure enough for replace my current VPN gateway with Shadowsocks server? (Since it is much more easy to use Shadowsocks clients on mobile devices)

Short answer is no. Purpose of shadowsocks is to obfuscate traffic so that Chinese GFW cannot recognize the pattern to bypass it. It is not designed for security purpose. In fact from security perspective, it is poorly designed.


How to get started with DNSSEC? I have been assigned the task of improving security of a specific service. After some analysis of the requirements we have come to the conclusion, that a certain aspect of the specified requirements can only be met through the use of DNSSEC.

I have a decent amount of experience with information security and cryptography, and I believe I understand the general principles in DNSSEC. However I have no hands on experience.

Usually such new technologies first get deployed to a subdomain of our primary domain name. But that approach doesn't seem to be possible with DNSSEC, since a proper deployment involves signing all the way from the root servers to the subdomain. Our domains currently have no DNSSEC and the hosting provider doesn't support DNSSEC.

Buying an experimental domain through a separate hosting provider might be an option, but due to lack of hands on experience with DNSSEC I have no clue what to look for in such a hosting provider.

I have also considered using one of the numerous services where one can acquire a free subdomain with dynamic DNS. However none of the providers I have looked at so far supports DNSSEC.

What would be a sensible next step to take in order to get the hands on experience I need?

I recently added dnssec to a few domains, and here are a few random notes and tips from that experience:

First of all, make sure your domain registrar support DNSSEC. Some do, others (e.g. namecheap) don't. If your registrar don't support dnssec (i.e. don't have a method for adding DS records for your domain at the parent level) you need to switch registrar first.

Depending on which dns server you use, signing the domain can be an almost automated trivial task, or a fairly complex manual thing. My primary dns is Windows DNS, where you can just right-click on a zone, select DNSSEC/sign..., and a wizard takes you through the process.

Set up a test domain and go through the entire process on that one before doing on a real prod domain. If something goes wrong, you can bring your domain offline for users that use DNSSEC validating resolvers (e.g. Google DNS), so testing on an unused domain first is a very good idea.

GetDS is a neat tool on linux that can help you along the way to troubleshoot and validate your setup.

Another useful tool that will help with validating your config is this site: http://dnscheck.iis.se/


Chinese or "pinyin" wordlists for dictionary attacks Background:

I am currently trying to crack a salted md5 hash which I have recovered from an embedded device running busybox and manufactured in china.

I have tried john the ripper using all of the wordlists I could find in Kali.

I have tried cloudcracker and that returned no results.

I am currently brute-forcing on a machine with several GPUS using oclHashcat but haven't got anything back yet.

I have a serial console on the device which is in English. I have a low privileged account with the username jdoe and no password. I have handed this to someone who is much better at Linux privesc than I am.

I want to ensure that the device does not have a noddy password in Chinese. I.e. whatever the equivalent of "password" "hello" "letmein" etc. would be if you were a electronics factory in Shenzhen.

I am aware that there are multiple Chinese dialects but would be interested in wordlists from any of them as it would be worth a try anyway and they may be useful on similar devices.

TLDR: I have tried Google and had difficulty finding Chinese or "pinyin" wordlists suitable for dictionary attacks. I have searched this site and found some good sources for wordlists which I will probably try next but they are mainly in English and I have not seen any in Chinese.

Does anyone know of a good source for them?

Edit: Further searching has found me this http://www.backtrack-linux.org/forums/showthread.php?t=27764 which I will try. I am unsure if that will provide decent coverage for my purposes though.

Edit 2:

I have posted an ascii seed symbol wordlist generated from the top answer below at http://pastebin.com/aHrnZF57

This should be able to be used to generate wordlists of your desired length by using the "crunch" wordlist generator or your favourite alternative tool.

For example:

Save the raw pastebin data as seed.txt in your home directory then invoke:

crunch MIN MAX -q ~\seed.txt -o myOutputWordlist.txt

The same can be done by substituting my seed list with some of those available from the backtrack-linux forums thread linked above.

Hope this helps anyone with this problem - Happy bruteforcing :)

Chinese (Mandarin) is a very phonologically restrictive language with a limited amount of possible syllables. Hence, you can make a table consisting of every possible syllable in the Chinese language as exemplified here:

        a       ai      au      an      aŋ      e       ə       əi      əu      ən      əŋ      i       ia      iai     iau     ian     iaŋ     ie      iə      iəu     iən     iəŋ     io      iu      iuan    iuə     iun     iuəŋ    aɻ      o       u       ua      uai     uan     uaŋ     uə      uəi     uən     uəŋ     m       n       ŋ
        a       ai      ao      an      ang     ê       e       ei      ou      en      eng     yi      ya      yai     yao     yan     yang    yê      ye      you     yin     ying    yo      yu      yuan    yue     yun     yong    er      o       wu      wa      wai     wan     wang    wo      wei     wun     weng    m       n       ng
p       ba      bai     bao     ban     bang            bo      bei             ben     beng    bi                      biao    bian    biang           bie     biu     bin     bing                                                                    bu
pʰ      pa      pai     pao     pan     pang            po      pei     pou     pen     peng    pi                      piao    pian                    pie     piu     pin     ping                                                                    pu
m       ma      mai     mao     man     mang            mo      mei     mou     men     meng    mi                      miao    mian                    mie     miu     min     ming                                                                    mu
f       fa                      fan     fang            fo      fei     fou     fen     feng                                                                                fu
t       da      dai     dao     dan     dang            de      dei     dou     den     deng    di                      diao    dian                    die     diu             ding                                                                    du                      duan            duo     dui     dun     dong
tʰ      ta      tai     tao     tan     tang            te              tou             teng    ti                      tiao    tian                    tie     tiu             ting                                                                    tu                      tuan            tuo     tui     tun     tong
n       na      nai     nao     nan     nang            ne      nei     nou     nen     neng    ni                      niao    nian    niang           nie     niu     nin     ning            nü              nüe                                     nu                      nuan            nuo                     nong
l       la      lai     lao     lan     lang            le      lei     lou             leng    li      lia             liao    lian    liang           lie     liu     lin     ling            lü              lüe                             lo      lu                      luan            luo             lun     long
ts      za      zai     zao     zan     zang            ze      zei     zou     zen     zeng    zi                                                                                zu                      zuan            zuo     zui     zun     zong
tsʰ     ca      cai     cao     can     cang            ce              cou     cen     ceng    ci                                                                                cu                      cuan            cuo     cui     cun     cong
s       sa      sai     sao     san     sang            se              sou     sen     seng    si                                                                                su                      suan            suo     sui     sun     song
tʂ      zha     zhai    zhao    zhan    zhang           zhe     zhei    zhou    zhen    zheng   zhi                                                                                zhu     zhua    zhuai   zhuan   zhuang  zhuo    zhui    zhun    zhong
tʂʰ     cha     chai    chao    chan    chang           che             chou    chen    cheng   chi                                                                                chu     chua    chuai   chuan   chuang  chuo    chui    chun    chong
ʂ       sha     shai    shao    shan    shang           she     shei    shou    shen    sheng   shi                                                                                shu     shua    shuai   shuan   shuang  shuo    shui    shun
ɻ                       rao     ran     rang            re              rou     ren     reng    ri                                                                                ru      rua             ruan            ruo     rui     run     rong
tɕ                                                                                ji      jia             jiao    jian    jiang           jie     jiu     jin     jing            ju      juan    jue     jun     jiong
tɕʰ                                                                                qi      qia             qiao    qian    qiang           qie     qiu     qin     qing            qu      quan    que     qun     qiong
ɕ                                                                                xi      xia             xiao    xian    xiang           xie     xiu     xin     xing            xu      xuan    xue     xun     xiong
k       ga      gai     gao     gan     gang            ge      gei     gou     gen     geng                                                                                gu      gua     guai    guan    guang   guo     gui     gun     gong
kʰ      ka      kai     kao     kan     kang            ke      kei     kou     ken     keng                                                                                ku      kua     kuai    kuan    kuang   kuo     kui     kun     kong
x       ha      hai     hao     han     hang            he      hei     hou     hen     heng                                                                                hu      hua     huai    huan    huang   huo     hui     hun     hong

The first row are the column headings and the first column are the row headings. Thus, you can ignore the first row and column as they were for my aid in learning Mandarin pronounciation.

Many syllables are not used and their positions are, thus, empty in the table giving a total of 410 possible syllables. Furthermore, there are 5 tones (beginning with 0) in the Mandarin Chinese language denoted by numbers, so a password could be something like gao1mi4. Counting the tones, there are 2050 possible syllables. With Chinese words being typically 1 to 3 syllables long, it's a real possibility that you could break a Pinyin-based password in  less than 8,615,125,000 attempts using random combinations of syllables and tones without the aid of a word list.


Brute Force In Order Or Random? Which is faster, on average to find the original plain text of a hash: brute force in-order, or with random plaintexts?

Mathematically, we assume that the user creates his password using a probability distribution that the attacker knows perfectly. The attacker then generates the passwords to try in order of plausibility. When several passwords have the exact same probability of being chosen by the user, then the order in which the attacker tries them does not matter for the average success rate.

The hypothesis of "perfect knowledge" by the attacker is the only one which allows for sustainable risk analysis. For instance, suppose that you begin in a situation where users choose their passwords at random, uniformly, in a set of N possibly passwords. Attackers then customarily explore passwords in lexicographic order. Noticing that, a user may then say to himself: "hey, I will begin my password with 'zzz' so that the attackers try that last. How cunning of me !". However, this won't last: attackers will adapt, and will begin to try passwords in reverse order. Our witty user will then choose a password which begins with "mzz" or "naa", so as to be in the middle of the range, at a "safe distance" from both kinds of attackers. This will only prompt some attackers to start exploration at the middle of the range too. And so on...

This example shows that the advantage that a user may gain over attackers based on asymmetry of information is, at best, transient in nature, and cannot be reliably quantified, because it depends on the "smartness" and evolution speed of attackers. So we prefer to assume that attackers try passwords in the "optimal" order, i.e. that they already know how we generate passwords.

Under these conditions, the best that user can hope for is uniform selection: when there are N possible passwords, and each password has probability 1/N of being selected, the attack's average cost is N/2. The interesting points being:

With uniform selection, the attack's average cost is always _N/2_; there is no selection strategy which makes it faster or slower.
When there are N possible passwords, for any distribution of probability of selection, the average attack cost of the best attack is always, at most, N/2. This is easily seen by considering that the attacker may try passwords in a random order, and that one will have average cost N/2 regardless of the user's strategy.

To some extent, this in fact means that random order is the attacker's strategy which minimizes the attacker's risks. Exploring the N possible passwords in a random order guarantees an average cost of N/2, regardless of how cunning the user might have been in his password selection strategy. From the point of view of the attacker, using a specific, defined order runs the risk of being outwitted by the user. Attackers are rational beings too: we assume attackers to have perfect knowledge of our password generation strategy because we could not evaluate our risks otherwise; similarly, attackers assume that users could be fully aware of the order of password space exploration and select passwords based on this knowledge, so rational attackers react by enforcing a random order.

All of the above, though, is for a known, finite space of possible passwords. This is what would apply, for instance, to old Unix passwords with the DES-based "crypt" function: the space is the set of all sequences of 8 ASCII characters.

In many practical cases, the space of passwords is more open-ended, and the attacker will have a rather low success rate: he will crack some passwords, but not all. In that case, the password exploration order does not matter much: for each password, the attacker tries a complete space of N passwords, which either works (the space contains the user's passwords), or, more often, does not. For all cases where the attack does not work, the attacker's cost will be that of N tries, no more, no less -- and this does not depend upon the order in which the attacker tries.

So the practical answer is: it does not matter.


Why are passwords not locally hashed aditionally? People are reusing passwords all the time, and with many sites accepting email addresses as logins, a stolen password can potentially unlock many accounts. So why not just hash the password locally via javascript and send the hashed password to the server(via SSL obviously) which then again hashes it, before saving it in its database. This would:
1:
Show security to concerned users, that their passwords are at least once hashed(by looking at the JS code), meaning their passwords are somewhat safe in any case.
2:
In the case of a stolen private key, decrypted captured communications between clients and servers would only reveal a hashed password. This would provide access to the corrupted service, but since the password is already hashed(and seeded with the site name or whatever) it can not be used to enter any other websites with email+password unless the hash is broken.
3:
In the case of stealing the password database, the server side hash AND the client side hash would have to be "reversed" to reveal the true password.
Now I am aware that these 3 cases are somewhat rare, however they are not far-fetched imho, since password databases get stolen, private keys are leaked and hash algorithms become outdated(see SHAttered). Now I know argument 3 isn't particularly strong, since passwords are hashed many times over anyway, but nevertheless my question:
Why isn't this best practice? Am I overseeing any drawbacks? Is this already implemented somewhere?

Hashing the passwords on the client would at best do nothing, and at worst make users doubt your applications security.  As far as the server is concerned, the client hashed passwords are effectively the cleartext passwords.  See my answers to your individual questions.

No, it does not.  It just shows that it has been hashed in the browser.  To the user, it does not mean that the password are hashed yet again on the server.  If I saw this, I would assume that the hashing is being done only in the browser, and would assume the application is not secure.
I assume you mean private key to the SSL certificate.  If this has been stolen, there are much larger issues at stake.  With the certificate information leaked, someone can successfully impersonate your web server, which means that none of the downloaded content can be trusted.  The client-side scripts can simply snatch the passwords before they are encrypted.
No, they would only need to crack the hashes obtained from the server.  Again, as far as the server is concerned, the client-hashed password is the cleartext.


Should I consider my Azure tenant ID as a secret? As the title says: Should I consider my Azure tenant ID (GUID) as a secret? Are there any security implications when someone knows about this id?

The Azure Tenant ID is a key piece of information used for configuration, management, and identification of your Azure cloud architecture. As such it should be treated in the same way as other internal architecture information/documentation would be. The exact steps you take will vary depending upon your particular organizations policies.
However, having said that, as per this site https://www.whatismytenantid.com/ if someone has the domain name then they can also get your tenant ID.
This StackOverFlow thread also contains multiple ways (ex. curl) to access the tenant ID depending on other pieces of information in your possession: https://stackoverflow.com/questions/26384034/how-to-get-the-azure-account-tenant-id
At the end of the day it makes sense to make it harder for an attacker to discover information about your Cloud environment, while realizing that the information is discoverable and protecting yourself accordingly.
Dirk-jan Mollema's presentation https://media.defcon.org/DEF%20CON%2027/DEF%20CON%2027%20presentations/DEFCON-27-Dirk-jan-Mollema-Im-in-your-cloud-pwning-your-azure-environment.pdf at Defcon 27 has examples where the tenant ID is part of the information used to exploit weaknesses in Azure.


What difference does the attacker’s proximity to target / access point make to KRACK susceptibility? In the Tools section of www.krackattacks.com it states:

  We remark that the reliability of our proof-of-concept script may depend on how close the victim is to the real network. If the victim is very close to the real network, the script may fail because the victim will always directly communicate with the real network, even if the victim is (forced) onto a different Wi-Fi channel than this network.

This appears to infer that the attacker has to rely on ‘overcoming’ the access point’s signal strength in some way for the attack to be successful.

If we assume that only standards compliant antennae are used for the attack is there a practical distance or rule that can be applied to determine whether an attack is likely to be successful (assuming the connection is susceptible)?

There are too many variable factors to create a reliable formula.

  If we assume that only standards compliant antennae are used for the attack

The antennae is not the main issue. By default the signal strength (TX strength) on a lot of NICs is set to ~20dBm. This is a legal requirement, each country has a different cap on signal strength.

You can find out more here: https://w.wol.ph/2015/08/28/maximum-wifi-transmission-power-country/

It is trivial however to crank your TX strength up, in fact it is usually an important step in getting a successful WiFi Evil Twin/MiTM. I very much doubt anyone actually trying to use this attack will be sticking to standards compliance.

They might not be setting up in your local coffee shop with a 20ft Yagi antenna, but you can bet they will be cranking up their TX strength to at least 30dBm, which will be enough to over come many short range strength issues if the target is physically closer to the original AP.


How to detect fileless kernel compromise in linux Is there a way to detect fileless kernel compromise in Linux?
The only one way to analyze this kind of attack is by volatility. Volatility is a very good product, but not often updated especially with modern kernels (obviously because kernel change often), so it gives false positives.
Is there any alternative way to check the running kernel?

You do have the possibility to use LKIM in order to measure dynamically the integrity of the kernel. Unlike an antivirus software that uses a database containing signatures, LKIM will check for specific patterns or behavior that could involve malicious deviations.
Note that RHEL now has its own kernel integrity sub-system using a similar kind of technology, you can check the full documentation here.


Why are stack address the same all the time when not using ASLR? In an answer to How do ASLR and DEP work? Polynomial says:

  In a non-ASLR and non-DEP process, the stack address is the same every time we run the process. We know exactly where it is in memory.

I don't understand how that could be. Isn't RAM allocated dynamically at run time? What about when the program (X) exits and another process comes along (Y)? Could'nt the OS give (Y) that RAM at the same location?

Addresses that you are seeing through your debugging tool are logical memory addresses. Every time a program is spawned, the CPU allocates certain bytes of memory to the program. On the hardware, this may be allocated in one single chunk or it may be strewn over in parts all over the place. However, to make it simpler for the program to refer to memory locations, the CPU maps these hardware or physical memory address to logical address.

A program interacting within this address space does not see other programs. Only the CPU knows which physical address to fetch when the program refers to some logical memory address within the code.

So, two different programs can refer to the same logical memory location, say 0x7c900000. But the CPU knows where to point this instruction to on the physical RAM. This makes life simpler for the programmer when memory management is taken care of by the CPU.

About ASLR (Adress Space Layout Randomization):

ASLR was introduced because it was fairly easy to reach the exact point in memory during program execution to find buffer overflow vulnerable variables. This made writing exploits easy. ASLR randomized the placement of variables making it difficult for hackers to exploit buffer overflow vulnerabilities.

So without ASLR, the variables in your program and instructions are going to be loaded in the exact same (logical) locations every time you execute it.


What does a VPN NOT protect me from? At my office we have two wireless networks - an official one, and a "Guest" one.  There is extensive filtering on the official one, and using it requires a users work credentials.  The Guest one is basically "wide open", and anybody can connect without credentials (this is so that employees can use e.g. personal devices, while keeping them isolated from our official infrastructure).

I know one of the people who works in our network security department, and he tells me, "Oh yeah, I see all kinds of nasty malicious crap on that Guest network, I would NEVER connect my personal device to it".  I assume he is talking about e.g. port scans, exploit attempts, etc.

My friend openly admits that he's usually overly paranoid, but in this case he feels very strongly about this.

I have proposed that connecting over a VPN provider would mitigate a lot of his concerns, but he does not agree.  It was my understanding that a VPN to e.g. my own home's Internet connection would be effectively the same as connecting directly while I'm actually at home.

Assuming I trust the VPN provider, am I any worse off doing

[Device]-->[Trusted VPN client]-->[Nasty Wifi]-->[Trusted VPN server]-->[Home Network]

... than I am doing

[Device]-->[Home Network]

... ?

The device in question is an up-to-date Android device, and I should reiterate that I am assuming that I trust the VPN provider implicitly.

The VPN connection will not protect you from other devices attempting to connect to your device. The VPN will encrypt your network transmissions. If your friend states that he has noticed port scans and exploit attempts, the VPN will not protect you from that. The described malicious network activity is going after your actual network adapter and attempting to connect into your computer via known ports and exploits.

For best protection in such an environment, you would want a personal firewall that explicitly denies all inbound traffic to your computer.


Do Linux desktop environments add security risks? I'm thinking about migrating to Fedora, but I'm not a big fan of Gnome3 so I'm thinking about using their Cinnamon spin. I've read in the past arguments whether or not Linux Mint is as secure as other distros, so I had a question:

Is it possible for the Cinnamon DE to bring any "security problems" to the Fedora operating system, and actually degrade Fedora's security? And, is this the case in general? Are you better off just using the default environment from a security standpoint, or does using an environment you install yourself not really alter the security of Linux?

FWIW, I'm pretty new to Linux so I'm exploring the different options I have. I've also started to take my security more seriously (partially what prompted me to move towards Linux), and I had a hard time finding a good answer to this question. Hopefully someone can help!

The key question is what untrusted inputs they process and how different the processing is.

Window managers do process icons and titles. Most of the time, they are trusted (they come from apps running with the same privileges), but – for example – some webpage might try to set a very long title, causing a bufferr overflow in the window manager. I believe that such threats are usually minor.

But desktop environment is not just window manager. It might use even a file indexer. I've recently seen an attack technique where a webpage causes a file download (Chrome saves such files by default) and exploits indexing engine. Because it can parse various types of files, attacker might have a large number of potentially vulnerable libraries to attack.

Desktop environment can also contains some widgets and utilities that download some data (e.g. weather forecast) over the Internet. Those are also somehow exposed to attackers.

If you are concerned about local security, you might want to compare screenlocks. However, screen locks work against less sophisticated attacks only.

To sum it up: When you are using traditional distros, there probably will not be significant differences, especially if you turn file indexing (if there is some present) off. Unless you use some totally bad desktop environment. However, if you are interested in securing your desktop OS, you might want to look at QubesOS. but this goes far beyond your original question.


How exactly do you infect the firmware of a hard drive? Now that we are told that infecting firmware has been done in practice, how exactly does this work?

There have been a few white papers and conference presentations on this, a quick google search would be a good start. However, this step by step explanation is pretty awesome: http://spritesmods.com/?art=hddhack


How a malware executes remote payload Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the malware connects to a C&C server and retrieves some additional malicious payload. Then, the malware tries to execute the retrieved malicious payload.

What is not quite clear for me is that how that malicious payload is executed? Does it need to be written on a file and then a call to execve be made? Are there other possibilities?

There are lots of ways to run the downloaded code:

Write a file and then exec it as you note
The payload might be written in a language that the loader is an interpreter for.
The loader could exec a shell or other scripting executable (python, ruby) and pipe the payload to it as a script.
The loader could mmap executable memory, load the payload into it, assign a function pointer, and call it.

I'm sure there are more approaches, but I suspect that covers the major categories (write and exec, interpret it, give it to someone else to interpret, or run it directly). There may be some ways to trick the system into exec'ing an ELF executable that isn't written to the file system (maybe through a named pipe), but nothing comes immediately to mind.

EDIT: See fexecve(). This should let you create a pipe, fork, and then fexecve to read the executable from the parent's pipe without writing a file.


What has to occur for a hacker to monitor traffic from my LAN? I understand that if you change your network card from managed mode to monitor mode you will be able to monitor and sniff the traffic of your local network plus all the access points around you. My question has two parts:

If the hacker knows the SSID of my access point and the password (WPA2), could he sniff the traffic of my local network? Is it necessary to capture the authentication handshake between the device and the access point in order to decrypt the IEEE 802.11 traffic? If so, how this process could be done?
If the hacker now the SSID of my access point but not the password, could he still be able to sniff the traffic of my local network?

If the hacker knows the SSID of my access point and the password (WPA2), could he sniff the traffic of my local network?

If they have access to both your SSID and have your WPA2 password, then they will be able to monitor any traffic going between you and the router. This is of course limited to unencrypted connections. If you use websites that have HTTPS, then while the attacker will obtain the raw data you are transmitting, they will not be able to decrypt it. HTTPS adds another layer to the encryption.

Note that an active attacker could also tamper with traffic, for example by injecting malware into websites or redirecting logins to a phishing site. This is a reason why a secure password is important.

  Is it necessary to capture the authentication handshake between the device and the access point in order to decrypt the IEEE 802.11 traffic? If so, how this process could be done?

It used to be, but a new method has been discovered which allows the attacker to bypass that stage. However, simply obtaining the handshake (or using the new technique) does not automatically give them access. They will still need to crack your password, and if your password is strong, you will be safe from that. Make sure your password is difficult to guess. Remember that computers can guess at hundreds of millions of times per second, so take that into account when creating a strong password.

  If the hacker now the SSID of my access point but not the password, could he still be able to sniff the traffic of my local network?

Sort of. He would be able to monitor and record the traffic but not decrypt it. If he later obtained the password (e.g. by cracking it or by stealing it from you), he would be able to retroactively decrypt everything he has recorded so far. This means that you need to make sure your password is secure and stays secure to prevent retroactive decryption at any point in the future.


Ask ISP for all dynamic IP? Would it be possible to ask your ISP for all dynamic IP's that your modem has had/was given? I have to prove ownership of a game account but I do not know which dynamic IP I had when I registered the account.

TL;DR: You shouldn't need to, linking account to IP is bad practice.

Requiring a specific public IP to identify an user is unwise from the perspective of the online game team.

Someone may create an account from his smartphone whilst connecting through several random free WiFi hotspots and he would never be able to reproduce the same public IPs.  Binding an account to an IP is a bad idea, and using IPs to check a user's identity is as error prone as asking him questions about his behaviour.  It is no wonder that Google calls your phone (or your backup phone) when you fail to remember part of your MFA (or lost you main phone).

Real world example

As someone who monitors user activity I never require exact IPs to prove that a certain user is himself.  Instead I compare, in a handful of GeoIP databases (3 different ones), the location of the user's current IP and the one that was used during the registration (or other incident with the user).  Although GeoIP databases are unreliable, using several of them and then taking the median is often good enough.

If I find that the location is very close and the same ISP is managing the IP, I have no reason to disbelieve the user.  If the user registered his account in South Africa and is now, say, two days later, connected to my website from Alaska claiming "problems with the account" I cut communications on the spot.

On the other hand, if I am still in doubt about a user's intentions after I checked his location and ISP I actually perform a ruse and email him something random.  For example:

  Oh yes, I think, I see your problem!  You created the account whilst you were in Marseilles, that's why I could not find it.  Am not 100% sure if I'm looking at the right log though, was that you?

(Of course I never got any connection from the given user from Marseilles.)  A user confirming this is obviously not the owner of the account.

That's a simplistic example but works pretty well in practice (moreover since this is in the same context of an online game).  And as @dandavis already said, this is pretty similar to the fact that the same IP pool is convincing enough.

This kind of bad practice kills a business.  Notably because of the example with the smartphone above, you can't ask a user who was surfing your page/app/game on a random free WiFi to get the IP address.  And users who forget their passwords and erase cookies, or simply cannot remember how to login are very common.


Security implications of granting IIS user group folder modify permissions I have an Application Pool in IIS running under the standard AppPoolIdentity as part of the IIS_IUSRS group.

What are the security implications of granting AppPoolIdentity modify and create permissions in the intepub/wwwroot/website/ directory? Are there any ways to mitigate these risks?

In my particular instance, it is for an ASP.NET website that needed these privileges for logging and reporting.

It is perfectly normal for a website to need write access to one or more folders under it's web root. The AppPoolIdentity is the best thing to use for application pool identities as it does not create a windows user account that can be compromised. Instead it generates a new local user on the fly when the application pool is started. Granting the AppPoolIdentity write permission to the entire wwwroot would be my only concern. Instead you can just give it modify access to the particular logs or reports folder to minimize any sort of risk.

EDIT: Restricting write access mitigates any damage that could be caused by a compromised application. Write access to the entire wwwroot would give full access to rewrite entire site (if compromised) compared to if you only gave write permissions to the logs folder. They would have to compromise the OS/NTFS Permissions to get past that so it is an added layer of security.


Can you recover original data from a screenshot that has been 'blacked out'? Is there a threat from screenshots with blacked out info? That is can someone take out that aftermarket addition so to speak?

For instance

I take a screenshot (using MS snipper)

Then I 'blur/blackout' some info

Is the picture above vulnerable to someone looking through its hex values for that extra green layer and just removing it, thus reconstructing the original image (or any other way to 'take off' my attempt of redacting info)?

To make it more secure I always then open up the blurred out screen and then screen capture that.

Does the above screen of a screen add better security -there is no way to reconstruct missing data because nothing is "missing"?

I have always been paranoid but after finding out a colleague does the same thing, I'd thought I'd ask.

update So I compared pics one and two (from above) and looked at the hex values, the metadata had not changed at all and the only change was within the image data itself (results below). The results are specific to this particular editor and process. The possibility (likelihood) does exist for data to be recovered if using other tools.

Usually the PNG format does not support multiple layers. So when you draw over something, whatever was there before is lost.

However, the PNG format supports storage of an unlimited amount of metadata which is usually not displayed by image viewers. This feature is often used by image editors to add additional metadata to the image. One possible use-case is to store the undo-history of the image. This could mean that the previous version can be restored. To prevent this, make sure to set the exporting settings of your editor in a "export for web" mode which is supposed to strip all unnecessary data from the file. How to do this (and if it is even necessary) depends on the image editor.

Another possible faux-pas is to use an image blurring method which isn't 100% effective. You could, for example, accidentally set the opacity of your brush to almost but not completely 100%, which would mean that the section isn't recognizable by the human eye but might be made readable again by enhancing the contrast of the section. Another mistake is to use a filter which is reversible. I remember a case of a child-pornographer who got caught because he blurred out his own face with the "twirl" filter in Photoshop not realizing that when the same filter is applied in reverse, the image is restored to almost the original.